@wular/coder 0.4.11 → 0.4.12

package/dist/apps-BNe86LfS.js

@@ -1,367 +0,0 @@
-import{Ft as e,Rt as t,en as n,qi as r}from"./core-DwsAMCnL.js";import{$ as i,Bn as a,Bt as o,Cr as s,Dn as c,Er as l,Et as u,G as d,Gn as f,Hn as p,Ht as m,In as h,Jt as g,Kt as _,Or as v,P as y,Pt as ee,Qn as te,Rn as ne,Tt as re,U as ie,Un as ae,Vt as b,W as oe,Wn as se,Wt as ce,Yt as le,Zt as ue,_r as de,_t as fe,ar as pe,br as me,c as he,ct as ge,dr as _e,dt as ve,er as ye,f as be,fn as xe,gr as Se,gt as Ce,hn as we,ht as Te,in as Ee,ir as De,it as Oe,jr as ke,kr as x,kt as Ae,lr as je,mt as Me,nn as Ne,nr as Pe,nt as Fe,pn as Ie,pr as Le,qn as Re,rn as ze,rr as Be,sn as Ve,tn as He,tr as Ue,tt as We,un as Ge,v as Ke,vr as qe,vt as Je,wr as S,wt as Ye,x as Xe,xr as Ze,yt as Qe,zn as $e,zt as et}from"./prompts-Bj4Fbd_n.js";import{A as tt,U as nt,a as rt,c as it,l as at,m as ot,r as st,u as ct,x as lt,y as ut}from"./dispatch-CFZ9Crvg.js";import{a as dt,d as ft,f as pt,i as mt,l as ht,n as gt,o as _t,r as vt,t as yt,u as bt}from"./load-Q9fL4VC6.js";import{d as xt,m as St,p as Ct}from"./slack-DhPhLuWb.js";import{n as wt,t as Tt}from"./integrations-IGnXBrPw.js";import{t as Et}from"./dist-DAnSqY1s.js";import{c as Dt,i as Ot,o as kt,s as At,t as jt}from"./actions-Cwe3IDVs.js";import{a as Mt,i as Nt,v as Pt,y as Ft}from"./executor-3QMa-XRY.js";import{n as It}from"./log-view-CL3_S0IQ.js";import{a as Lt,l as Rt,n as zt}from"./mcp-Dsl3Xdd3.js";import{c as Bt,n as Vt,o as Ht,r as Ut,t as Wt,u as Gt}from"./exec-Cprez703.js";import{f as Kt,r as qt}from"./task-bkoi8_NN.js";import{n as Jt,t as Yt}from"./match-BwcxeAZF.js";import{a as C,c as Xt,d as Zt,f as Qt,i as $t,l as en,m as tn,n as nn,p as w,r as rn,u as an,v as on,y as sn}from"./http-CDZKt5ln.js";import{n as cn}from"./env-BgE9ipvN.js";import{C as T,S as ln,T as un,_ as dn,b as fn,c as pn,d as mn,f as hn,h as gn,l as _n,p as vn,r as yn,s as bn,t as xn,u as Sn,w as Cn,x as E}from"./runners-DyLnqHKy.js";import{C as wn,S as Tn,c as En,d as Dn,g as On,i as kn,l as An,m as jn,o as Mn,p as Nn,s as Pn,t as Fn,u as In,v as Ln,w as Rn,y as zn}from"./local-Bzdmzc1o.js";import{n as Bn,t as Vn}from"./chat-bwKd3y6V.js";import{A as Hn,B as Un,E as Wn,F as Gn,H as Kn,I as D,L as qn,M as O,N as Jn,P as Yn,R as k,T as Xn,U as Zn,V as Qn,W as $n,X as A,_ as er,c as tr,d as j,g as nr,h as M,i as N,j as P,k as F,l as rr,m as ir,n as I,o as ar,p as L,r as or,s as sr,t as R,u as cr,v as lr}from"./schema-CjHmulYJ.js";import{a as z,i as ur,t as dr}from"./client-sqXb-y09.js";import B from"node:path";import fr from"node:process";import{fileURLToPath as pr,pathToFileURL as mr}from"node:url";import V,{accessSync as hr,constants as gr,existsSync as _r,readFileSync as vr,statSync as yr}from"node:fs";import{execFile as br,spawn as xr}from"node:child_process";import{createHash as Sr,createHmac as Cr,randomBytes as wr,randomUUID as Tr}from"node:crypto";import Er from"node:os";import Dr from"node:net";import{isDeepStrictEqual as Or,promisify as kr}from"node:util";import{brotliDecompressSync as Ar,constants as jr,createGzip as Mr,gunzipSync as Nr,gzipSync as Pr,inflateSync as Fr}from"node:zlib";const Ir=e=>`nonce:${St(e)}`;function Lr(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function Rr(e,t){return Cr(`sha256`,Lr(e)).update(t).digest(`base64url`)}async function zr(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:wr(18).toString(`base64url`),exp:a+i},s=sn(o),c=`${s}.${Rr(e,s)}`;return await e.store.put(`delivery`,Ir(c),{at:a,target:r},{ttlMs:i}),c}function Br(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&Ct(Rr(e,n),r))try{return on(n)}catch{return}}async function Vr(e,t){let n=await e.store.get(`delivery`,Ir(t));return n&&`target`in n?n.target:void 0}function Hr(e,t){return Br(e,t)?.organization}function Ur(e,t){return Br(e,t)?.user}function Wr(e,t,n,r,i=!0){let a=Br(e,t);return a&&a.kind===n&&(a.user===r||i&&a.user===`*`)&&a.organization===e.organizationId&&a.exp>=(e.now??Date.now)()?a:void 0}async function Gr(e,t,n,r,i){if(!Wr(e,t,n,r,!1))return!1;let a=await e.store.take(`delivery`,Ir(t),{target:i});return!!a&&`target`in a&&a.target===i}async function Kr(e,t,n,r){if(!Wr(e,t,n,r))return;let i=await e.store.take(`delivery`,Ir(t));return i&&`target`in i?i.target:void 0}async function qr(e,t,n,r){return Wr(e,t,n,r)?Vr(e,t):void 0}const Jr=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function Yr(e,t,n,r){return{method:e,pattern:t,handler:n,...r?{guard:r}:{}}}function Xr(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function Zr(e,t,n){return[e,`${e}/*`].flatMap(e=>Jr.map(r=>Yr(r,e,t,n)))}function Qr(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function $r(e,t,n,r){for(let i of e){let a=Qr(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=Xt();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const ei=`coder`;function ti(e,t){let n=e??`/dash`;try{let e=new URL(n,t);return e.origin===t&&!n.includes(`\\`)&&!/^\/[/\\]/.test(e.pathname)?`${e.pathname}${e.search}${e.hash}`:`/dash`}catch{return`/dash`}}const ni=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(Tt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function ri(e){let t=B.dirname(pr(e));for(;;){let e=B.join(t,`package.json`);if(_r(e))try{if(JSON.parse(vr(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=B.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function ii(e=import.meta.url){let t=B.dirname(pr(e)),n=ri(e),r=pr(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[B.resolve(r,`../../..`),B.join(n,`dist/dash`),B.join(t,`../dash`)].find(e=>_r(ai(e)))}const ai=e=>B.join(e,`standalone/server/manifest.json`);function oi(e){let t=B.join(e,`standalone/server/entry.js`);if(!_r(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function si(e){let t=JSON.parse(vr(ai(e),`utf8`));return{handler:await(await import(mr(oi(e)).href)).createRequestHandler({root:B.join(e,`standalone`)}),manifest:t}}var ci=class{moduleUrl;root;loaded;constructor(e=import.meta.url){this.moduleUrl=e}host(){let e=Date.now(),t=this.loaded;if(t&&e-t.checked<1e3)return t.host;if(this.root??=ii(this.moduleUrl),!this.root)return;let n;try{n=yr(ai(this.root)).mtimeMs}catch{}if(t&&(t.checked=e,n===void 0||n===t.build))return t.host;let r={build:n,checked:e,host:si(this.root)};return r.host.catch(()=>{this.loaded===r&&(this.loaded=void 0)}),this.loaded=r,r.host}};const li=e=>e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;function ui(e,t){let n=li(e);return!!(Qr(`/assets/*`,n)||Qr(`/dash/*`,n)||t.routes.some(e=>Qr(e.route,n)))}async function di(e,t=new ci){return!!(await t.host()?.catch(()=>void 0))?.manifest.routes.some(t=>Qr(t.route,li(e)))}const fi=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,pi=e=>`'sha256-${Sr(`sha256`).update(e).digest(`base64`)}'`;function mi(e){let t=[...e.matchAll(fi)].map(e=>pi(e[1]));return[...ni,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function hi(e,t){return t===`gzip`?Nr(e).toString(`utf8`):t===`br`?Ar(e).toString(`utf8`):t===`deflate`?Fr(e).toString(`utf8`):e.toString(`utf8`)}const gi=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function _i(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function vi(e){let t=Mr(),n=e=>new Promise(n=>{t.write(e),t.flush(jr.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function yi(e,t,n,r){n.set(`content-security-policy`,[...ni,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return gi(e)&&(_i(n),i=vi(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function bi(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return yi(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=hi(a,i);r.set(`content-security-policy`,mi(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&gi(e)&&(s=new Uint8Array(Pr(o)),_i(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function xi(e,t=new ci){let n=await t.host();if(!n||!ui(new URL(e.url).pathname,n.manifest))return;let r=wr(16).toString(`base64`),i=new Headers(e.headers);return i.set(`content-security-policy`,`script-src 'nonce-${r}'`),bi(e,await n.handler(new Request(e,{headers:i})),r)}const Si=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function Ci(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function wi(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=ti(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?vm(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":Si(e,a)}}):w(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":Si(e,``,!0)}}):w(`/dash?token=rejected`,303)}async function Ti(e,t,n,r){return w(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function Ei(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(ti(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(Ci(e,n)).host!==new URL(a).host?w(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function Di(e,t,n,r){return t.auth?!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?Ei(e,t,r,r.searchParams.get(`return`)):ji(e,t):w(`/dash`)}function Oi(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,Sm(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}const ki=()=>new Response(`UI is not built`,{status:503}),Ai=e=>async(t,n)=>await xi(Oi(t,n),n.dashboardHosts)??e(),ji=Ai(ki),Mi=Ai(en);function Ni(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}function H(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function Pi(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:H(e,n.organizationId),app:n.app}}async function Fi(e,t){if(e.boundInstallation?.installation.id===t)return{...H(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:H(e,n)}function Ii(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...H(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function Li(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function Ri(e,t,n,r){let i=t.session,a=r.searchParams.get(`token`)??``,o=Ii(t,i,Hr(t,a))??t;if(await qr(o,a,`link`,i.user.id))return await xi(e,t.dashboardHosts)??ki();let s=await Kr(o,a,`link-start`,i.user.id);if(!s)return new Response(`This link is invalid or has expired.`,{status:400});let c=await zr(o,`link`,i.user.id,s,3e5);return w(`/connect?token=${encodeURIComponent(c)}`)}async function zi(e,t,n,r){let i=t.session,a=await e.json().catch(()=>({})),o=typeof a.token==`string`?await Kr(Ii(t,i,Hr(t,a.token))??t,a.token,`link`,i.user.id):void 0;if(!o)return C({error:`This link is invalid or has expired.`},400);let s=JSON.parse(o);return await t.auth.link(i.user,s.platform,s.platformUserId,{organizations:i.organizations.map(e=>e.id)})===`taken`?C({error:`That platform account is connected to someone else.`},409):C({ok:!0,...s})}async function Bi(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`connection`);if(c){let e=Ii(t,s,r.searchParams.get(`organization`)??s.organizationId),n=e&&await e.store.get(`connection`,c);if(!e||!n||n.provider!==i.id||n.auth!==`oauth`||n.owner&&n.owner!==s.user.id)return C({error:`Unknown OAuth connection`},404);if(!n.owner){let t=_m(e,`Only workspace owners and admins can authorize workspace connections`);if(t instanceof Response)return t}let l=await Rf(e,i.id);if(!l)return C({error:`No OAuth client is available for ${i.name}.`},400);let u=await zr(e,`native-oauth`,s.user.id,JSON.stringify({connection:n,app:l.id,attempt:r.searchParams.get(`attempt`)}));return w(a.authorizeUrl(E(t.config,l.credentials),{publicUrl:o,state:u,access:n.access??`write`}))}let l=r.searchParams.get(`installation`)??``,u=Ii(t,s,l?await t.installationOrganization?.(l):void 0),d=u??{...t,session:s};if(!u)return $(d,`not-member`,{platform:i.id});let f=await Li(u,l);if(!f||f.integration!==i.id)return $(d,`disconnected`,{platform:i.id});let p=await zr(u,`link-oauth`,s.user.id,l);return w(a.authorizeUrl(E(t.config,f.credentials),{publicUrl:o,state:p}))}async function Vi(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`state`)??``,l=Ii(t,s,Hr(t,c)),u=l??{...t,session:s},d=l&&await Kr(l,c,`native-oauth`,s.user.id);if(l&&d){let n=JSON.parse(d),r=n.connection;if(r.provider!==i.id)return $(u,`link-expired`,{platform:i.id});if(!r.owner){let e=_m(l,`Only workspace owners and admins can authorize workspace connections`);if(e instanceof Response)return e}else if(r.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id});let c=await Rf(l,i.id,n.app);return c?l.store.withAppLock(`connection:${r.id}`,async d=>{let f=await d.get(`connection`,r.id);if(!f||JSON.stringify(f)!==JSON.stringify(r))return $(u,`link-expired`,{platform:i.id});let p=await a.exchange(e,E(t.config,c.credentials),{publicUrl:o,access:f.access??`write`,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return p?.token?f.owner&&await t.auth.link(s.user,i.id,p.id,{organizations:s.organizations.map(e=>e.id),token:T(t.config,{app:c.id,token:p.token})},d)===`taken`?$(u,`account-taken`,{platform:i.id}):(await d.put(`connection`,f.id,{...f,account:f.owner?p.id:p.login??p.id,oauthApp:f.owner?c.id:void 0,secret:f.owner?void 0:T(t.config,{app:c.id,token:p.token}),broken:void 0,updatedAt:(t.now??Date.now)()}),n.attempt&&await Ki({...l,store:d},f,n.attempt),$(u,`linked`,{platform:i.id,account:p.login??p.id})):$(u,`failed`,{platform:i.id})}):$(u,`link-expired`,{platform:i.id})}let f=l&&await Kr(l,c,`link-oauth`,s.user.id),p=l&&f?await Li(l,f):void 0;if(!l||!p||p.integration!==i.id)return $(u,`link-expired`,{platform:i.id});let m=await a.exchange(e,E(t.config,p.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return m instanceof xt?$(u,m.code,{platform:i.id,error:m.error}):m instanceof Error?(console.error(`coder server: ${i.id} sign-in failed`,m),$(u,`failed`,{platform:i.id})):await t.auth.link(s.user,i.id,m.id,{organizations:s.organizations.map(e=>e.id),...m.token?{token:T(t.config,{app:p.id,token:m.token})}:{}})===`taken`?$(u,`account-taken`,{platform:i.id}):(await Ff(l,s.user.id,i.id,m.id),$(u,`linked`,{platform:i.id,account:m.login??m.id}))}const Hi=`/connections/oauth/client.json`,Ui=`/connections/oauth/callback`,Wi=6e5,Gi=e=>`connection-oauth:${e}`;async function Ki(e,t,n){await e.store.put(`delivery`,`connection-authorized:${Sr(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:Wi})}const U=x().check(t(1)),qi=s({resource:U,authorization_servers:de(U).check(t(1)),scopes_supported:S(de(U))}),Ji=s({issuer:U,authorization_endpoint:U,token_endpoint:U,registration_endpoint:S(U),userinfo_endpoint:S(U),scopes_supported:S(de(U)),code_challenge_methods_supported:S(de(U)),client_id_metadata_document_supported:S(qe()),authorization_response_iss_parameter_supported:S(qe())}),Yi=Se([`none`,`client_secret_basic`,`client_secret_post`]),Xi=s({client_id:U,client_secret:S(U),token_endpoint_auth_method:S(Yi),redirect_uris:S(de(U))}),Zi=s({name:S(U),preferred_username:S(U),email:S(U)});function Qi(e,t){let n=Be(t);if(!f(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function $i(e,t,n,r=!1){for(let i of[...new Set(n)]){Qi(e,i);let n=await Pe(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function ea(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function ta(e,t,n=!1,r){let i=Qi(e,t),a=e.fetch??fetch;if(r===void 0){let e=await Pe(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=ea(r),s=await $i(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=qi.parse(s);if(Qi(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function na(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return Be(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function ra(e){let t=na(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+Ui],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function ia(e,t){return!t.config.publicUrl||Be(t.config.publicUrl).protocol!==`https:`?en():C({client_id:Be(t.config.publicUrl).origin+Hi,...ra(t)})}function aa(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function oa(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function sa(e,t,n){let r=await e.get(`delivery`,Gi(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function ca(e,t,n){let r=aa(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await ta(e,t.endpoint.url),s=a.authorization_servers[0],c=Qi(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=Ji.parse(await $i(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);Qi(e,u.authorization_endpoint),Qi(e,u.token_endpoint),u.registration_endpoint&&Qi(e,u.registration_endpoint),u.userinfo_endpoint&&Qi(e,u.userinfo_endpoint);let d=t.secret?E(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&Be(e.config.publicUrl).protocol===`https:`&&(f={clientId:Be(e.config.publicUrl).origin+Hi,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await Pe(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(ra(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=Xi.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(na(e)+Ui))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=T(e.config,p),h=wr(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{oa(await n.get(`connection`,t.id),t),await n.put(`delivery`,Gi(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:Wi})});let g=wr(32).toString(`base64url`),_=await zr(e,`connection-oauth`,r,T(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:na(e)+Ui,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),Wi),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:na(e)+Ui,state:_,code_challenge:Sr(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function la(e,t,n){let r=t,i=e=>w(`${fh(uh(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,a=Hr(t,e);if(t.auth&&(!a||!t.session?.organizations.some(e=>e.id===a)))return i(`invalid-state`);let o=t.session?Ii(t,t.session,a)??t:t;r=o;let s=await Kr(o,e,`connection-oauth`,aa(o));if(!s)return i(`invalid-state`);let c=E(o.config,s);if(!c.owner&&!gm(o))return i(`failed`);let l=E(o.config,c.secret),u=n.searchParams.get(`iss`);if((c.requireIssuer||u!==null)&&u!==l.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let d=n.searchParams.get(`code`);if(!d)return i(`failed`);oa(await o.store.get(`connection`,c.id),c),await sa(o.store,c.id,c.attempt);let f=o.fetch??fetch,p=await De(f,l,new URLSearchParams({grant_type:`authorization_code`,code:d,redirect_uri:c.redirectUri,code_verifier:c.verifier})),m=p.preferred_username??p.email??p.name;if(!m&&c.userinfo)try{let e=await Pe(f,c.userinfo,{headers:{authorization:`Bearer ${p.access_token}`,accept:`application/json`}});if(e.ok){let t=Zi.parse(await e.json());m=t.preferred_username??t.email??t.name}}catch(e){console.error(`coder server: OAuth userinfo failed`,e)}return await o.store.withAppLock(`connection:${c.id}`,async t=>{let n=await t.get(`connection`,c.id);oa(n,c),await sa(t,c.id,c.attempt),await t.put(`connection`,n.id,{...n,secret:T(o.config,pe(l,p,(o.now??Date.now)())),account:m??n.account,broken:void 0,updatedAt:(o.now??Date.now)()}),await t.delete(`delivery`,Gi(c.id)),await Ki({...o,store:t},n,e)}),i(`connected`)}catch(e){return console.error(`coder server: connection OAuth callback failed`,e),i(`failed`)}}async function ua(e,t,n){return(await Nf(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}function da(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?Er.homedir():e.startsWith(`~/`)?B.join(Er.homedir(),e.slice(2)):e;if(!B.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=B.normalize(t);try{return V.statSync(n).isDirectory()?(V.accessSync(n,V.constants.R_OK),{ok:!0,folder:{path:n,name:B.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function fa(e){let t=new Map,n=[...o(e),...et(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=da(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:B.basename(e)},recent:[...t.values()],picker:!!ma()}}const pa=e=>(process.env.PATH??``).split(B.delimiter).some(t=>t&&V.existsSync(B.join(t,e)));function ma(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(pa(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(pa(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,Er.homedir(),`--title`,e]]}async function ha(){let e=ma();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await kr(br)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?da(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function ga(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function _a(e){let t=typeof e==`string`?e.trim():``,n=ga(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=Ae(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>kr(br)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await Kt(r,async()=>{if(V.existsSync(B.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await V.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await V.promises.rename(e,r)}finally{await V.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
-`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const va=e=>`app-token:${e}:`;async function ya(e,t){return(await e.store.list(`snapshot`,{prefix:va(t)})).flatMap(({id:t,value:n})=>{if(!(`secret`in n))return[];let r=E(e.config,n.secret);return r.unusable?[]:[{id:t,token:r}]}).sort((e,t)=>t.token.lastUsedAt-e.token.lastUsedAt).map(({id:e,token:t})=>({id:e,label:`${t.workspaceName} · saved by ${t.savedBy}`}))}function ba(e,t){let n=()=>(e.now??Date.now)();return{async put(r){let i=va(t)+St(JSON.stringify([r.workspace,r.user]));return await e.store.withAppLock(`${e.organizationId}:${i}`,t=>t.put(`snapshot`,i,{secret:T(e.config,{...r,savedBy:e.session?.user.name||`Server operator`,lastUsedAt:n()})})),i},async use(r,i){if(!r.startsWith(va(t)))throw new xt(`invalid-field`,`token`,`Choose a saved configuration token or paste a new one.`);let a=await e.store.withAppLock(`${e.organizationId}:${r}`,async t=>{let a=await t.get(`snapshot`,r),o=a&&E(e.config,a.secret);if(!o||o.unusable)return{error:new xt(`invalid-field`,`token`,`This configuration token is unavailable. Paste a new token.`)};let s=()=>t.put(`snapshot`,r,{secret:T(e.config,o)});try{let e=await i(o.credentials,async(e,t)=>{t&&(o.workspaceName=t),o.credentials=e,await s()},async()=>{o.unusable=!0,await s()});return o.lastUsedAt=n(),await s(),{value:e}}catch(e){return{error:e}}});if(`error`in a)throw a.error;return a.value}}}const xa=`.coder/agents`,Sa=2592e6;function Ca(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const wa=(e,t,n)=>`repo-file:${e}@${t}@${n}:`;function Ta(e,t){let n=Ca(t);return n?[wa(e.id,n,t.repo?.defaultBranch??``)]:[]}const Ea=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function Da(e,t,n,r,i,a){let o=`${wa(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([Oa(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function Oa(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=Ea(n.installation,r,a??``),[f,p]=await Promise.all([n.token(),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:Sa}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:Sa}),_.text}async function ka(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,Ea(t.installation,t.repo,r),{push:Tr()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:wa(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:Sa})}}async function Aa(e,t,n,r,i){let a=await Da(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function ja(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token();if(e)return{contents:t,token:e}}for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let a=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(a)try{let e=a.token?{...a,token:E(t.config,a.token)}:a;return{contents:i,token:await i.auth.token(e,E(t.config,r.credentials),{tools:i.tools.presets.read}),app:r,installation:a}}catch(e){console.error(`coder server: repository access for ${a.id} failed`,e);continue}}}function Ma(e,t){let n=t.cwd,r=t.now??Date.now;async function i(t,n,r){let i=Ca(n),a=e[n.integration],o=i&&a?.repos&&await r(n.integration);if(!(!i||!o))return Aa(t,a,o,i,n.repo?.defaultBranch)}async function a(n,a,o,s){let c={store:s?.store??t.store,fileReads:t.fileReads},l=s??await Nn(t.store,n.agent);l.record?.source===`builtin`&&!t.settings?.builtinAgents&&(await jn(t,r()),l=await Nn(t.store,n.agent));let{record:u,version:d}=l;if(!u)return;if(u.problems?.length)throw new yt(u.problems.join(`
-`));if(!d)throw Error(`No version ${u.currentVersion} for agent "${u.id}".`);let f=await i(c,a,o),p=f&&typeof f==`object`?f[n.agent]:void 0;if(p===!1||p?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${Ca(a)??n.agentsRepo}.`);return Tn(u,d,p&&typeof p==`object`?p:void 0,e)}return async(i,o,s,c,l)=>{let u=n?(await _t(n,e)).find(e=>e.id===i.agent&&!e.builtin):void 0;if(u)return u;let d=await a(i,s,c,l);if(d)return d;if(i.agentsRepo){let n=await ja(e,t,i.agentsRepo,s,c);if(n){await Na(t.store,n.contents,i.agentsRepo,Ca(s)===i.agentsRepo?s.repo?.defaultBranch??`HEAD`:`HEAD`,n.token,r());let e=await a(i,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await zn(t.store,r(),i.agent,{})){let e=await a(i,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function Na(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=await t.repos.tree(n,s,i,r),d=o.slugs??[...new Set(u.filter(e=>/^[^/]+\/agent\.json$/.test(e)).map(e=>e.split(`/`)[0]))];return vt(d),(await Promise.all(d.map(async o=>{let d=`${s}/${o}`,f=u.filter(e=>e.startsWith(`${o}/`)&&e.split(`/`).length<=22),p=Object.fromEntries(await Promise.all(f.map(async e=>[e.slice(o.length+1),await t.repos.readFile(n,`${s}/${e}`,i,r)]))),m=p[`agent.json`];if(m===void 0)return;let h;try{[h]=gt({definitions:{[o]:{json:JSON.parse(m),builtin:!1}},usage:void 0},{...Tt,[t.id]:t})}catch(t){if(!(t instanceof yt||t instanceof SyntaxError))throw t;console.error(`coder server: could not load agent ${o}`,t);let r=await e.get(`agent`,o);await e.put(`agent`,o,{id:o,name:o,source:`repo`,repo:n,path:d,currentVersion:0,createdAt:a,...r,problems:[t.message],updatedAt:a});return}if(!h)return;let{"agent.json":g,"system.md":_,...v}=p;return Ln(e,{id:o,name:h.name,description:h.definition.description,source:`repo`,repo:n,path:d,definition:h.definition,systemPrompt:_??``,files:Object.fromEntries(Object.entries(v).filter(e=>e[1]!==void 0)),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a)}))).filter(e=>!!e)}const Pa=e=>`app-sync:${e}`,Fa=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,definition:r})??r,Ia=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&Or(e.manifest,n));async function La(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,Pa(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,definition:r.definition}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,Pa(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,E(e.config,n.credentials),{publicUrl:a,definition:r.definition,fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,Pa(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function Ra(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await On(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return La(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=Fa(c,o,r,s.definition),d=Pa(t),f=await a.get(`delivery`,d);if(!n&&Ia(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,E(e.config,o.credentials),{publicUrl:r,definition:s.definition,fetch:e.fetch??fetch,tokens:ba({...e,store:a},o.integration),saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:T(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:T(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function za(e,t){let n=(await Ra(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
-`))}function Ba(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function Va(e,t,n,r=Ba(),i){let a=await ja(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await Na(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await za(e,o),o}const Ha=`default`;async function Ua(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await import(`./client-sqXb-y09.js`).then(e=>e.n);return t(e.databaseUrl,e.databasePool)}async function Wa(e,t={}){if(e.store!==`postgres`){let e=t.local?new Fn:new Mn;return{store:()=>e,queue:new Op(e),chatState:new Vn(t.local?B.join(He(``),`chat.json`):void 0),defaultOrganizationId:Ha,webhookTarget:async(t,n)=>{let r=await e.get(`app`,t),i=n?await e.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await e.list(`app`,{prefix:`${t}/`})){let i=await e.get(`installation`,`${r.id}${n.slice(t.length)}`);if(i&&!i.deletedAt)return{organizationId:Ha,app:r,bound:{organizationId:Ha,installation:i}}}return r&&{organizationId:Ha,app:r,...i&&i.app===t&&!i.deletedAt?{bound:{organizationId:Ha,installation:i}}:{}}},appRecord:async t=>{let n=await e.get(`app`,t);return n&&{organizationId:Ha,app:n}},apps:async t=>(await e.list(`app`,{prefix:`${t}:`})).map(e=>({organizationId:Ha,app:e.value})),installationOrganization:async t=>await e.get(`installation`,t)?Ha:void 0,installations:async t=>(await e.list(`installation`,{prefix:`${t}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:Ha})),taskOrganization:async(t,n)=>(await e.get(`task`,t))?.tokenHash===n?Ha:void 0,sweep:async()=>{},close:async()=>{}}}let n=await Ua(e),[{DrizzleStore:r},{DrizzleQueue:i},{UNSCOPED_ORGANIZATION:a},{PgChatState:o}]=await Promise.all([Promise.resolve().then(()=>Qs),Promise.resolve().then(()=>rc),Promise.resolve().then(()=>ts),import(`./chat-3AvUDOwf.js`)]);return{store:t=>new r(n.db,t,Date.now,e),queue:new i(n.db),chatState:new o(n.db),defaultOrganizationId:a,webhookTarget:(e,t)=>r.webhookTarget(n.db,e,t),appRecord:e=>r.appRecord(n.db,e),apps:e=>r.apps(n.db,e),installationOrganization:e=>r.installationOrganization(n.db,e),installations:e=>r.installations(n.db,e),taskOrganization:(e,t)=>r.taskOrganization(n.db,e,t),connection:n,sweep:e=>new r(n.db,a).sweep(e),close:()=>n.close()}}async function Ga(e,t,n,r){return e.updateMetadata(t,n,r)}async function Ka(e,t){return e.getApps([...new Set(t)])}async function qa(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return C({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return C({error:`PUBLIC_URL is not set on this server`},400);let o=await zr(t,`install`,t.session?.user.id??`anonymous`,i.id),s=sn({tx:o,...r?{back:r}:{}});return C({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function Ja(e,t){let n=e.serverOrganizationId,[r,i]=await Promise.all([e.store.list(`app`),n!==void 0&&n!==e.organizationId&&e.scope?e.scope(n).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)):[]]);return[...r,...i].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.builtin===`shared`)&&(!t||n.agent===t))}function Ya(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,E(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}async function Xa(e,t){let n=e.config.publicUrl,r=t.filter(t=>!t.builtin&&!t.shared&&e.integrations[t.integration]?.app);if(!n||!r.length)return new Set;let[i,a]=await Promise.all([e.store.list(`delivery`,{ids:r.map(e=>Pa(e.id))}),e.store.listAgentsWithVersions([...new Set(r.map(e=>e.agent))])]),o=e=>i.find(t=>t.id===Pa(e))?.value;return new Set(r.filter(t=>{let r=e.integrations[t.integration].app,i=a.find(e=>e.record.id===t.agent)?.version;return i?.definition.integrations[t.integration]?r.update?!Ia(o(t.id),i.version,Fa(r,t,n,i.definition)):o(t.id)?.changed===!0:!1}).map(e=>e.id))}async function Za(e,t,n,r){let i=await Ja(t,r.searchParams.get(`agent`)),a=await Xa(t,i.map(({value:e})=>e));return C(i.map(({id:e,value:n})=>({id:e,value:{...Ya(t,n),...a.has(e)?{changed:!0}:{}}})))}async function Qa(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return C({error:`Unknown app`},404);if(r.builtin)return C({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now();for(let{id:e,value:n}of await t.store.list(`installation`))n.app===r.id&&!n.deletedAt&&await Ga(t.store,`installation`,e,{deletedAt:i});return await t.store.delete(`app`,r.id),await Wu(t.store,r.id),C({ok:!0})}async function $a(e,t){let n=await e.store.get(`app`,t);if(!n)return C({error:`Unknown app`},404);if(n.builtin||n.shared)return C({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return C({error:`PUBLIC_URL is not set on this server`},400);let r=e.integrations[n.integration];if(!r||!(r.app.update||r.app.drift||r.app.values))return C({error:`Coder cannot update ${r?.name??n.integration} apps.`},400);let i=await On(e.store,n.agent);return i?.definition.integrations[n.integration]?{app:n,version:i,integration:r}:C({error:`The agent no longer listens on ${r.name}.`},400)}async function eo(e,t,n){let r=await $a(t,n.id);if(r instanceof Response)return r;if(r.integration.app.update)return C({error:`Coder updates ${r.integration.name} apps itself.`},400);try{return C(await La(t,t.store,r.app,r.version))}catch(e){return console.error(`coder server: reading ${r.app.id} on ${r.integration.name} failed`,e),C({error:e instanceof Error?e.message:String(e)},502)}}async function to(e,t,n){let r=await $a(t,n.id);if(r instanceof Response)return r;let{app:i,version:a,integration:o}=r;if(o.app.values){let{lines:e}=o.app.values(i,{publicUrl:t.config.publicUrl,definition:a.definition});return await t.store.put(`delivery`,Pa(i.id),{version:a.version,manifest:e,changed:!1}),C({updated:!0})}if(!o.app.update)return C({error:`Change the app on ${o.name}; Coder cannot.`},400);let[s]=await Ra(t,[a],i.id);return s?.error?C({error:s.error},502):C({updated:!0})}async function no(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0,includeUninstalled:!0}:{},limit:Zt(r,200)});return C(a.map(({id:e,value:n})=>{let{token:r,...i}=n,a=n.account.url??t.integrations[n.integration]?.app.accountUrl?.(n.account);return{id:e,value:{...i,account:{...i.account,...a?{url:a}:{}}}}}))}async function ro(e,t){let n=e.config.publicUrl,r=n?bm.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),o=e.store.list(`app`),[s,c,l]=await Promise.all([a?Nn(e.store,a):void 0,bh(e,o),o]),u=s?.record,d=new Set(c.map(e=>e.integration));return C(await Promise.all(Object.values(e.integrations).map(async n=>{let a=typeof n.use==`function`?n.use(bt(s?.version?.definition.integrations[n.id])):n.use;return{id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...a?{use:a}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.builtin,...n.auth.user?{personal:!0}:{},...await Rf(e,n.id,void 0,[...c,...l.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{saved:await ya(e,n.id),name:u?.name,shared:d.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...n.app.update?{appUpdate:`push`}:n.app.drift?{appUpdate:`drift`}:n.app.values?{appUpdate:`confirm`}:{}}})))}async function io(e,t,n=!1,r){let i=t;if(i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=ao(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function ao(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await Ku(e,t,n,E(e.config,i.credentials)),o=await t.repos.list(Hu(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await Ga(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function oo(e,t=!1){let n=new Map,r=(await e.store.list(`installation`,{active:!0})).filter(({value:t})=>e.integrations[t.integration]?.repos),i=Array(r.length),a=0;await Promise.all(Array.from({length:Math.min(4,r.length)},async()=>{for(let n=a++;n<r.length;n=a++){let a=r[n].value;i[n]=t||a.repos==null?await io(e,a,t).catch(e=>(console.error(`coder server: repositories for installation ${a.id} failed`,e),a)):a}}));for(let e of i)if(!(!e||e.deletedAt))for(let t of e.repos??[])n.has(t)||n.set(t,{repo:t,integration:e.integration});return C([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}var W=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function so(e,t,n){if(n?.problems?.length)throw new W(n.problems.join(`
-`),409);if(n?.settings?.disabled)throw new W(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${fh(uh(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function co(e,t){if(t.cwd===void 0)return;if(!e.local)throw new W(`cwd is available on a local server only`);let n=da(t.cwd);if(!n.ok)throw new W(n.detail);return n.folder.path}const lo=/^[a-z0-9][a-z0-9_-]*$/i,uo=new Set([`claude`,`codex`,`custom`]),fo=new Set([`low`,`medium`,`high`]);function po(e){let t=e.flow??`default`;if(!lo.test(t))throw new W(`Invalid flow "${t}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new W(`prompt must be text`);if(t==="default"&&!e.prompt?.trim())throw new W(`prompt is required`);if((e.prompt?.length??0)>65536)throw new W(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new W(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new W(`pr needs a repo and a pull request number`);if(e.engine!==void 0&&!uo.has(e.engine))throw new W(`Unknown engine "${e.engine}"`);if(e.effort!==void 0&&!fo.has(e.effort))throw new W(`Unknown effort "${e.effort}"`);if(e.permissions!==void 0&&!(e.permissions in y))throw new W(`Unknown permissions "${e.permissions}"`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>lo.test(e))))throw new W(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new W(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new W(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new W(`args must be an object`)}async function mo(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await Ka(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(a)try{let r=await Ku(e,n,i,E(e.config,a.credentials)),o=i.repos?.includes(t)?i:await io(e,i,!1,{app:a,token:r,repo:t});if(!o?.repos?.includes(t))continue;return{integration:n,installation:o,app:a,token:r}}catch(e){console.error(`coder server: repository token for ${i.id} failed`,e)}}throw new W(`No install in this workspace reaches ${t}`,404)}async function ho(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await mo(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:l},author:a.author?.(s.name)??s.name}}async function go(e,t,n){po(n);let r=co(e,n),i=(e.now??Date.now)(),a=e.session?.user.id,o=n.agent||dt();if(!o)throw new W(`Name an agent: this server has no default agent.`);o===dt()&&await jn(e,i),e.local&&await kn(e.store,e.local.cwd,e.integrations);let{record:s,version:c}=await Nn(e.store,o),l=await yn(e,{requester:a,runner:n.runner,agent:c?.definition.runner}).catch(e=>{throw new W(e.message)});if(!s||!c)throw new W(`No agent "${o}"`,404);so(e,o,s);let u={...n.engine?{engine:n.engine}:{},...n.model?{model:n.model}:{},...n.effort?{effort:n.effort}:{},...n.permissions?{permissions:n.permissions}:{}},d=Tn(s,c,u,e.integrations),f=ft(d),{engine:p,credential:m,usable:h,chain:g,credentials:_}=await rf(e,f,a);if(!h&&l.runner!==`http`)throw new W(`No ${p} credential is connected`,409,await gf(e,p));let v=`${i.toString(36)}-${wr(4).toString(`hex`)}`,y=n.repo?await ho(e,v,n,a):void 0,ee={id:v,source:t,agent:d.id,flow:n.flow??`default`,...l,permissions:f.permissions,...y?{event:y.event,author:y.author}:{},...r&&!y?{cwd:r}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},definition:d.definition,engineChain:g,engineCredentials:_,...m?{credential:m}:{},...a?{requester:a}:{},...d.files?{files:d.files}:{},usage:{...d.usage,engine:p},tools:{},connections:await ua(e,a,te(d.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&l.runner===`local`&&!l.runnerId?wd(e,ee):(await e.queue.enqueue(e.organizationId,ee,i,void 0,e.config.maxQueued??1e3),{task:ee,status:`queued`,attempts:0,createdAt:i,updatedAt:i})}function _o(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function vo(e,t){let n=t.event,r;if(n){let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i||!a||a.deletedAt||!e.loadAgent)return{};so(e,t.agent,await e.store.get(`agent`,t.agent));let o=e.integrations[n.integration],s=E(e.config,i.credentials);r=await e.loadAgent(i,a,n,Yu(e,o,a,n,s))}else{t.agent===dt()&&await jn(e,(e.now??Date.now)());let{record:n,version:i}=await Nn(e.store,t.agent);if(so(e,t.agent,n),!n||!i)return{};r=Tn(n,i,t.usage,e.integrations)}let i=n&&Jt(n,r),{engine:a,model:o,effort:s}=t.usage??{};return{definition:r.definition,usage:{...r.usage,...a?{engine:a}:{},...o?{model:o}:{},...s?{effort:s}:{}},tools:i?.tools??Yt(r),...r.files?{files:r.files}:{},permissions:i?.permissions??ft(r).permissions}}async function yo(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new W(`outputSchema must be an object`);if(!n.trim())throw new W(`text is required`);if(n.length>65536)throw new W(`text is longer than 64 KB`);let{model:a,effort:o,permissions:s}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new W(`model must be text`);if(o!==void 0&&!fo.has(o))throw new W(`Unknown effort "${o}"`);if(s!==void 0&&!(s in y))throw new W(`Unknown permissions "${s}"`);let c=e=>Object.keys(y).indexOf(e??`auto`);if(s!==void 0&&c(s)>c(t.task.permissions))throw new W(`permissions can only be lowered on a resumed task (it runs ${t.task.permissions??`auto`})`);if(e.session&&t.task.requester&&t.task.requester!==e.session.user.id)throw new W(`Only the member who asked can continue this task`,403);let l=(e.now??Date.now)(),u=t.task.context?.messages??[],d=String(t.finishedAt??l),f=[...u,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:d}].slice(-20),p=t.task.context??{},m=_o(t);m.at(-1).finishedAt??=l;let h=await vo(e,t.task),g={task:{...t.task,...h,prompt:n,...a||o?{usage:{...h.usage??t.task.usage,...a?{model:a}:{},...o?{effort:o}:{}}}:{},...s?{permissions:s}:{},context:{...p,...r?{outputSchema:r}:{},messages:f,turns:m}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:l};if(!await e.queue.continueTask(e.organizationId,t.task.id,g.task,l,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new W(`Task is already active`,409);return g}const bo={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var xo=class{buckets=new Map;sweptAt;startedAt;requests=0;rejections=0;constructor(e=Date.now()){this.startedAt=this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return C({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const So=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function Co(e,t,n){let r=new URL(e.url).pathname,i=So.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?wo(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await km(e,t):void 0;return wo(t,r===`/runners/register`?await jm(e,t):a&&!(a instanceof Response)?a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function wo(e,t,n,r){let i=e.limits??=new xo((e.now??Date.now)()),a={...bo,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}const To=Symbol(`miss`);function Eo(e,t){return new Proxy(e,{get(e,n){let r=Reflect.get(e,n,e);if(typeof r!=`function`)return r;let i=r.bind(e),a=t[n];return a?async(...e)=>{let t=a(...e);return t===To?i(...e):t}:i}})}const Do=(e,t)=>e.length===t.length&&e.every((e,n)=>e===t[n]);function Oo(e,t,n){let r=t.task,i=r.event,a=e=>e in n,o=`connections:${r.id}:${t.generation??0}:${t.attempts}:`;return Eo(e,{get:(e,t)=>e===`app`&&a(`app`)&&t===i?.appId?n.app:e===`installation`&&a(`installation`)&&t===`${i?.appId}:${i?.installationId}`?n.installation:e===`credential`&&a(`credential`)&&t===r.credential?n.credential:e===`config`&&a(`config`)&&t===`workspace`?n.config:e===`runner`&&a(`runner`)&&t===r.runnerId?n.runner:e===`snapshot`&&a(`secrets`)&&t===`connection-secrets:${r.id}`?n.secrets?.old:e===`snapshot`&&a(`resolved`)&&t.startsWith(o)?n.resolved?.id===t?n.resolved.value:void 0:To,list:(e,t)=>e===`snapshot`&&a(`secrets`)&&t?.prefix===`connection-secrets:${r.id}:`?n.secrets.rows.map((e,n)=>({id:`${t.prefix}${n}`,value:{secret:e}})):To,listCredentials:e=>a(`credentials`)&&e.owner===r.requester&&e.limit===void 0?n.credentials??[]:To,heldTokens:(e,t)=>a(`tokens`)&&n.installation&&Do(e,[n.installation.id])&&Do(t,[n.installation.app])?n.tokens:To})}function ko(e,t,n){let r=e=>e===void 0||e===t.requester,i=(e,t)=>!e.owner||e.owner===t;return Eo(e,{get:(e,r)=>e===`agent`&&r===n.agent?t.record:e===`snapshot`&&n.files.some(e=>r.startsWith(e))?t.files[r]:To,conversationState:e=>e===n.conversation?t.conversation:To,listCredentials:e=>r(e.owner)&&e.limit===void 0?t.credentials.filter(t=>i(t.value,e.owner)):To,list:(e,n)=>e===`runner`&&n?.defaults&&!n.runner&&r(n.visibleTo)?t.runners.filter(e=>i(e.value,n.visibleTo)):e===`connection`&&!n?.ids&&!n?.secrets&&r(n?.visibleTo)?t.connections.filter(e=>i(e,n?.visibleTo)).map(e=>({id:e.id,value:e})):To,heldTokens:(e,r)=>Do(e,[n.installation.id])&&Do(r,[n.installation.app])?t.tokens:To})}function Ao(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function jo(e,t,n,r){try{await Ao(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function Mo(e,t,n,r={}){let i=t.handle?await pn(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});return a&&await Fo(e,t,!0,i),a}async function No(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`))return vd(e,t,n);let r=t.handle?await pn(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});return i&&await Fo(e,t,!0,r),i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?Mo(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return Mo(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await Ao(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?Mo(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):Mo(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function Po(e,t){return[`running`,`waiting`].includes(t.status)&&await No(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function Fo(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await pn(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await jo(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function Io(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await Po(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function Lo(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??bo.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await md(e,e.local.cwd):t&&await e.queue.archiveStopped(void 0,r());let n=await e.queue.running(),i=0;for(let t of n)await No(H(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?pd(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],s=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,c=t.filter(t=>!s.has(t.task.id)&&!s.has(b(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,l=a===void 0?void 0:a-c;if(l!==void 0&&l<=0)break;let u=await e.queue.claim(r(),l,n,i);if(n=!1,!u)break;let d=u.status,f=H(e,u.organizationId),p=u.loaded&&f.store?{...f,store:Oo(f.store,d,u.loaded)}:f;if(await _d(p,d,u.token)){if(n=u.more,!u.more)break;continue}let m=await pn(p,d.task);if(!m){await Mo(p,d,`No runner available: ${d.task.runner}`);continue}let h=d,g={generation:d.generation??0,attempts:d.attempts,tokenHash:d.tokenHash??null,statuses:[`running`,`waiting`]},_;try{let e=m.kind===`vercel-sandbox`?await td(p,d.task):void 0,t=e?[e,...(await nd(p,d.task)).map(e=>e.credential)]:[],i=await Promise.all(t.map(e=>ad(p,d.task,e))),a=m.start(d.task,{CODER_SERVER:p.local&&m.kind===`local`?`http://localhost:${p.local.port}`:p.config.publicUrl??``,CODER_TASK_TOKEN:u.token,CODER_INBOX_MODE:m.push?`push`:`poll`},e?Object.assign({},...t.map(e=>e.env).reverse()):void 0,{timeoutMs:p.config.taskTimeoutMs+6e4,waitUntil:p.waitUntil,...e?{hosts:i.some(e=>e===void 0)?void 0:[...new Set(i.flatMap(e=>e??[]))],brokered:await Ou(p.store).then(e=>t.flatMap(t=>id(e,d.task,t)))}:{}});if(_=await Ao(a,p.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw a.then(e=>jo(p,m,e,d.task.id),()=>{}),e}),await p.queue.patchTask(u.organizationId,d.task.id,{handle:_},r(),g)||await jo(p,m,_,d.task.id),n=u.more,!u.more)break}catch(e){_!==void 0&&await jo(p,m,_,d.task.id);let t=e instanceof Error?e.message:String(e);if(d.attempts<(p.config.taskAttempts??2)){o.push({...u,status:h});continue}await Mo(p,h,t)}}for(let t of o)await H(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function Ro(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,Lo(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function zo(e,t=!1){let n=Ro(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}var Bo=r({addUsage:()=>Uo,leaders:()=>Ko,readUsage:()=>$o,readUsageTotals:()=>es,sumUsageTotals:()=>Go,timeZone:()=>Ho,usageReport:()=>Qo,usageSummary:()=>Yo,usageTotals:()=>Wo});function Vo(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+Vo(t),0)}function Ho(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const Uo=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function Wo(e,t){return e.usageTotals(t)}async function Go(e,t){if(t.top){let{top:n,...r}=t,i=(await Wo(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return Wo(e,{...r,parts:i})}let n=Ho(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:Vo(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};Uo(s,o),i.has(n.agent)&&(s.parts??={},Uo(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Ko(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function qo(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=qo(n[e],r);return n}function Jo(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=qo(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Yo(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?Jo(r,n):{agent:Jo(r,`agent`),installation:Jo(r,`installation`),engine:Jo(r,`engine`)}}}const Xo={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},Zo={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function Qo(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return C({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=Xo[n(`sort`)??`tokens`]??`tokenCount`,l=await Wo(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Ho(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await _t(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(mt()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return C({...u,totals:l,top:Ko(l,c)});if(!Qt(t)||a!==`agent`)return C({...u,totals:l});let d=Zo[n(`sort`)??`tokens`]??Zo.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=nn(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=Zt(t),y=e=>l.reduce((t,n)=>t+e(n),0);return C({...u,...an(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function $o(e,t,n,r){t.local&&await Nd(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:Zt(r,200),...i?{installation:i}:{}});return C(i?a.filter(e=>e.value.installationId===i):a)}async function es(e,t,n,r){t.local&&await Nd(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);return[`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`?Qo(t,r):!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a)?C({error:`Invalid usage query`},400):C({since:i,totals:await t.store.usageSummary(i,a)})}var ts=r({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>gs,agentValue:()=>ls,app:()=>G,date:()=>J,defined:()=>os,escapeLike:()=>as,fromJson:()=>Y,install:()=>K,ms:()=>q,opaque:()=>hs,readTaskContext:()=>rs,rows:()=>ys,setSecret:()=>_s,splitKey:()=>is,stateKey:()=>X,statePrefix:()=>vs,storedTaskContext:()=>ns,taskRecord:()=>ps,versionColumns:()=>ds,versionSummary:()=>fs,versionValue:()=>us});function ns(e){return e.connections===void 0&&!e.engineChain&&!e.engineCredentials?e.context:{...e.context,connections:e.connections,engineChain:e.engineChain,engineCredentials:e.engineCredentials}}function rs(e){let{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,...a}=e??{};return{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,context:Object.keys(a).length?a:void 0}}function is(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const G=sr,K=tr,q=e=>e.getTime(),J=e=>new Date(e),as=e=>e.replace(/[\\%_]/g,`\\$&`),os=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),ss=e=>e?q(e):void 0,cs=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},ls=e=>os({id:e.slug,name:e.name,description:e.description,problems:e.problems,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:q(e.createdAt),updatedAt:q(e.updatedAt)}),us=(e,t)=>os({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:cs(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:q(e.createdAt)}),ds={id:I.id,agentId:I.agentId,version:I.version,definition:I.definition,commit:I.commit,importedFrom:I.importedFrom,createdAt:I.createdAt},fs=(e,t)=>{let{systemPrompt:n,files:r,...i}=us({...e,systemPrompt:``,files:null},t);return i};function Y(e,t){let n=new Xn(dr);return Object.fromEntries(Object.entries($n(e)).map(([e,r])=>{let i=t[n.getColumnCasing(r)];return[e,i==null?null:r.mapFromDriverValue(i)]}))}function ps(e){let t=rs(e.context);return os({task:os({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,connections:t.connections,author:e.author,definition:e.definition,credential:e.credential,engineChain:t.engineChain,engineCredentials:t.engineCredentials,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,context:t.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:ss(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,...(t.runnerLogs?.handle??null)===e.handle&&t.runnerLogs?.attempts===e.attempts&&t.runnerLogs?.generation===e.generation?{logsComplete:t.runnerLogs?.complete}:{},archivedAt:ss(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:q(e.createdAt),startedAt:ss(e.startedAt),finishedAt:ss(e.finishedAt),cancelRequestedAt:ss(e.cancelRequestedAt),updatedAt:q(e.updatedAt)})}function ms(e,t){if(t.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:t.slice(6),keyVersion:0};let[n,r,i]=t.split(`.`);if(!n||!r||!i)throw Error(`Invalid encrypted secret`);return{iv:n,tag:r,ciphertext:i,keyVersion:un(e.encryption,t)}}function hs(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function gs(e,t,n){let[r]=await e.db.insert(j).values({organizationId:e.organizationId,kind:t,...ms(e,n)}).returning({id:j.id});return r.id}async function _s(e,t,n){await e.db.update(j).set({...ms(e,n),updatedAt:e.at()}).where(P(e.mine(j.organizationId),O(j.id,t)))}const vs=(e,t)=>`o:${JSON.stringify([e,t])}:`,X=(e,t,n)=>vs(e,t)+n;async function ys(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}function bs(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(R).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:J(t.createdAt),updatedAt:J(t.updatedAt)}).onConflictDoUpdate({target:[R.organizationId,R.slug],set:{slug:t.id}}).returning(),a=ls(i),[o]=a.currentVersion?await r.select().from(I).where(P(O(I.agentId,i.id),O(I.version,a.currentVersion))):[],s=o&&us(o,t.id),c=!!(s&&Or(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&Or(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&Or(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let d=c?A``:A`with published as (
-      insert into ${I} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
-      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
-        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${J(l.createdAt).toISOString()}::timestamptz)
-      returning version
-    )`;return await r.execute(A`${d} update ${R} set
-      name = ${u.name}, description = ${u.description??null}, problems = null, source = ${u.source},
-      repo = ${u.repo??null}, path = ${u.path??null},
-      current_version = ${c?A`${l.version}`:A`(select version from published)`}, updated_at = ${J(u.updatedAt).toISOString()}::timestamptz
-      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function xs(e){let t=R;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(P(e.mine(t.organizationId),n)).orderBy(F(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:ls(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,problems:r.problems??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:J(r.createdAt),updatedAt:J(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(P(e.mine(t.organizationId),O(t.slug,n)))}}}async function Ss(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(I).values({agentId:A`(select id from ${R} where organization_id = ${e.organizationId} and slug = ${t.slice(0,r)})`,version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:J(n.createdAt)}).onConflictDoNothing().returning({id:I.id})).length>0}function Cs(e){let t=I,n=A`${R.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>P(O(R.slug,e),n===void 0?void 0:r?O(t.version,n):Jn(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:R.slug,key:n}).from(t).innerJoin(R,O(R.id,t.agentId)).where(P(e.mine(R.organizationId),r)).orderBy(F(R.slug),F(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:us(e,t)}))},put:async(t,n)=>{await Ss(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=A`(select id from ${R} where organization_id = ${e.organizationId} and slug = ${n.slice(0,r)})`;await e.db.delete(t).where(P(O(t.agentId,i),O(t.version,Number(n.slice(r+1)))))}}}const ws=(e,t)=>os({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:hs(t),createdAt:q(e.createdAt)});function Ts(e){let t=G;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:j}).from(t).innerJoin(j,O(j.id,t.credentialsSecretId)).where(P(e.mine(t.organizationId),n)).orderBy(F(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:ws(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:j}).from(t).innerJoin(j,O(j.id,t.credentialsSecretId)).where(P(e.mine(t.organizationId),O(t.key,n))),[a]=r.shared?await e.db.select({secretId:t.credentialsSecretId}).from(t).where(P(O(t.organizationId,``),O(t.key,r.shared))):[];if(r.shared&&!a)throw Error(`No shared app ${r.shared}`);let o=i?.secretId??a?.secretId??await gs(e,`app`,r.credentials);i&&!r.shared&&hs(i.sealed)!==r.credentials&&await _s(e,o,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:o,createdAt:J(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(P(e.mine(t.organizationId),O(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(j).where(P(O(j.id,r.secretId),e.mine(j.organizationId)))})}}function Es(e,t,n){return os({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?hs(n):void 0,installer:e.installer,self:e.self,covers:e.covers,repos:e.repos,settings:e.settings,createdAt:q(e.createdAt),deletedAt:e.deletedAt?q(e.deletedAt):void 0,uninstalled:e.uninstalled||void 0})}function Ds(e,t,n){let r=n.app.split(`/`)[0],i=[t.slice(n.app.length+1),...n.covers??[]],a=A`array[${A.join(i.map(e=>A`${e}`),A`, `)}]::text[]`;return e.transaction(`binding:${r}`,async e=>{let[n]=await e.db.select({id:K.id}).from(K).innerJoin(G,O(G.id,K.appId)).where(P(Zn(D(K.platformInstallId,i),A`${K.covers} ?| ${a}`),k(K.deletedAt),Kn(K.key,t),Zn(O(G.key,r),A`left(${G.key}, ${r.length+1}) = ${`${r}/`}`))).limit(1);if(n)throw new Dn(`Installation "${t}" is bound through another app.`)})}function Os(e){let t=K;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:G.key,integration:G.integration},sealed:j}).from(t).innerJoin(G,O(G.id,t.appId)).leftJoin(j,O(j.id,t.tokenSecretId)).where(P(e.mine(t.organizationId),n)).orderBy(F(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:Es(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({row:t,sealed:j,appKey:G.key,parent:A`(select id from ${G} where organization_id in (${e.organizationId}, ${``}) and key = ${r.app} order by organization_id desc limit 1)`}).from(A`(select 1) as anchor`).leftJoin(t,O(t.key,n)).leftJoin(G,O(G.id,t.appId)).leftJoin(j,O(j.id,t.tokenSecretId)),a=i?.row?{secretId:i.row.tokenSecretId,organizationId:i.row.organizationId,covers:i.row.covers,deletedAt:i.row.deletedAt,appKey:i.appKey,sealed:i.sealed}:void 0,o=()=>Error(`Installation "${n}" belongs to another workspace.`);if(a&&a.organizationId!==e.organizationId)throw o();if(!i?.parent)throw Error(`Unknown app "${r.app}".`);r.deletedAt===void 0&&(!a||a.appKey!==r.app||a.deletedAt!==null||JSON.stringify(a.covers??[])!==JSON.stringify(r.covers??[]))&&await Ds(e,n,r);let s=a?.secretId??null;r.token&&(s?(!a?.sealed||hs(a.sealed)!==r.token)&&await _s(e,s,r.token):s=await gs(e,`installation`,r.token));let c={appId:i.parent,platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?s:null,installer:r.installer??null,self:r.self??null,covers:r.covers??null,repos:r.repos??null,settings:r.settings??null,createdAt:J(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:J(r.deletedAt),uninstalled:r.uninstalled??null},[l]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...c}).onConflictDoUpdate({target:t.key,set:c,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!l)throw o();!r.token&&a?.secretId&&await e.db.delete(j).where(O(j.id,a.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(P(e.mine(t.organizationId),O(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(j).where(O(j.id,r.secretId))})}}async function ks(e,t){let n=Wn(K,`locked`),[r]=await e.db.select({row:n,app:{key:G.key,integration:G.integration},sealed:j}).from(n).innerJoin(G,O(G.id,n.appId)).leftJoin(j,O(j.id,n.tokenSecretId)).where(P(e.mine(n.organizationId),O(n.key,t))).for(`update`,{of:n});return r&&Es(r.row,r.app,r.sealed)}const As=(e,t)=>os({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,owner:e.owner,account:e.account,createdAt:q(e.createdAt)}),js=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function Ms(e,t){let n=ar;return(await e.db.select({row:n,sealed:j}).from(n).innerJoin(j,O(j.id,n.secretId)).where(P(e.mine(n.organizationId),t?O(n.owner,t):k(n.owner))).orderBy(F(n.label)).for(`update`)).map(({row:e,sealed:t})=>({id:Jd(e.owner??void 0,e.label),value:As(e,t),row:e,sealed:t}))}async function Ns(e,t,n,r){let i=ar;if(!r){if(!t)return;await e.db.delete(i).where(O(i.id,t.row.id)),await e.db.delete(j).where(O(j.id,t.row.secretId));return}let a=hs(r),o={account:r.account??null,createdAt:r.createdAt===void 0?t?.row.createdAt??e.at():J(r.createdAt),updatedAt:e.at()};if(t){hs(t.sealed)!==a&&await _s(e,t.row.secretId,a),await e.db.update(i).set(o).where(O(i.id,t.row.id));return}let{owner:s,name:c}=Yd(n);await e.db.insert(i).values({organizationId:e.organizationId,owner:s??null,label:c,secretId:await gs(e,`engine`,a),...o})}function Ps(e){let t=ar,n=(t,n)=>{let{owner:r}=Yd(t);return e.transaction(js(e,r),async e=>Ns(e,(await Ms(e,r)).find(e=>e.id===t),t,n))};return{key:A`coalesce(${t.owner} || '/', '') || ${t.label}`,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:j}).from(t).innerJoin(j,O(j.id,t.secretId)).where(P(e.mine(t.organizationId),n)).orderBy(F(A`coalesce(${t.owner} || '/', '') || ${t.label}`));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:Jd(e.owner??void 0,e.label),value:As(e,t)}))},put:(e,t)=>n(e,t),delete:e=>n(e,null)}}const Fs=(e,t)=>A`jsonb_build_object('row', to_jsonb(${e}), 'sealed', to_jsonb(${t}))`,Is=e=>{let t=Y(ar,e.row);return{id:Jd(t.owner??void 0,t.label),value:As(t,Y(j,e.sealed))}},Ls=e=>{let t=Y(cr,e.row);return{id:t.publicId,value:Us(t,Y(j,e.sealed))}},Rs=e=>{let t=Y(G,e.app);return{installation:Es(Y(K,e.row),t,e.sealed?Y(j,e.sealed):null),app:ws(t,Y(j,e.credentials))}};function zs(e,t,n,r){let i=N,a=t.map(t=>`${as(X(e,`snapshot`,Rn(t)))}%`),o=[...t,...n].map(t=>X(e,`snapshot`,wn(t)));return A`(select coalesce(jsonb_object_agg(${i.key}, ${i.value}), '{}'::jsonb) from ${i}
-    where (${i.expiresAt} is null or ${i.expiresAt} > clock_timestamp()) and (${i.key} like any(${A.param(a)}::text[])
-      or ${i.key} in (select unnest(${A.param(o)}::text[])${r?A` union all ${r}`:A``})))`}function Bs(e,t){let n=vs(e,`snapshot`),r={held:new Map,drops:new Map};for(let[e,i]of Object.entries(t)){let t=e.slice(n.length);t.startsWith(`token-drop:`)?r.drops.set(t,i.drop):r.held.set(t,i)}return r}function Vs(e){let t=A`coalesce((${N.value}->>'version')::bigint, jsonb_array_length(${N.value}->'messages') + (${N.value}->>'more')::bigint)`,n=A`greatest(coalesce((${N.value}->>'acknowledged')::bigint, 0), least(${e}, ${t}))`;return A`(select ${N.value} || jsonb_build_object('version', ${t}, 'acknowledged', ${n},
-        'messages', remaining, 'more', ${t} - ${n} - jsonb_array_length(remaining))
-        from (select coalesce(jsonb_agg(item order by n) filter (where coalesce((item->>'sequence')::bigint, n) > ${n}), '[]'::jsonb) as remaining
-          from jsonb_array_elements(${N.value}->'messages') with ordinality e(item,n)) as pending)`}function Hs(e,t){let n=N,r=vs(e.organizationId,t),i=n.key;return{key:i,where:e=>P(e.id===void 0?A`${n.key} like ${`${as(r+(e.prefix??``))}%`}`:O(n.key,r+e.id),e.after===void 0?void 0:Jn(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:A`${n.value}`}).from(n).where(P(A`${n.key} like ${`${as(r)}%`}`,e.live(n.expiresAt),t)).orderBy(F(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o,c=e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?A`${n.expiresAt}`:s}}),l=t===`delivery`&&i.startsWith(`connection-authorized:`)?e.notification(t,i):void 0;await(l?c.returning(l):c)},delete:async i=>{await e.db.delete(n).where(O(n.key,r+(t===`config`?`workspace`:i)))}}}const Us=(e,t)=>os({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?q(e.lastSeen):void 0,secret:hs(t),createdAt:q(e.createdAt),updatedAt:q(e.updatedAt)});function Ws(e){let t=cr,n=n=>P(e.mine(t.organizationId),O(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:j}).from(t).innerJoin(j,O(j.id,t.secretId)).where(P(e.mine(t.organizationId),n)).orderBy(F(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:Us(e,t)}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[a]=await e.db.select({id:t.id,secretId:t.secretId,sealed:j}).from(t).innerJoin(j,O(j.id,t.secretId)).where(n(r)),o={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:J(i.lastSeen),updatedAt:J(i.updatedAt)};if(a){hs(a.sealed)!==i.secret&&await _s(e,a.secretId,i.secret),await e.db.update(t).set(o).where(O(t.id,a.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await gs(e,`runner`,i.secret),createdAt:J(i.createdAt),...o})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(j).where(O(j.id,i.secretId))})}}function Gs(e,t){let n=X(e,`snapshot`,`connection-secrets:${t}`),r=t=>A`${N.key} like ${`${as(X(e,`snapshot`,t))}%`}`;return A`(${N.key} = ${n} or ${r(`connection-secrets:${t}:`)} or ${r(`connections:${t}:`)})`}function Ks(e){let t=L;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(P(e.mine(t.organizationId),n)).orderBy(F(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:ps(e)}))},put:async(n,r,i,a={})=>{let{task:o}=r,s={source:o.source,status:r.status,agent:o.agent,flow:o.flow,reviewKey:xp(o)??null,runner:o.runner,permissions:o.permissions??null,appId:o.event?A`(select id from ${G} where organization_id in (${e.organizationId}, ${``}) and key = ${o.event.appId} order by organization_id desc limit 1)`:null,installationId:o.event?A`(select id from ${K} where organization_id = ${e.organizationId} and key = ${`${o.event.appId}:${o.event.installationId}`})`:null,event:o.event??null,prompt:o.prompt??null,args:o.args??null,mcp:o.mcp??null,author:o.author??null,definition:o.definition,credential:o.credential??null,requester:o.requester??null,runnerId:o.runnerId??null,usage:o.usage??null,tools:o.tools,context:r.logsComplete===void 0?ns(o)??null:{...ns(o),runnerLogs:{complete:r.logsComplete,handle:r.handle,attempts:r.attempts,generation:r.generation??0}},files:o.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:J(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:J(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:J(r.createdAt),startedAt:r.startedAt===void 0?null:J(r.startedAt),finishedAt:r.finishedAt===void 0?null:J(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:J(r.cancelRequestedAt),updatedAt:J(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...s,archivedAt:a.unarchive?s.archivedAt:A`coalesce(${t.archivedAt}, ${s.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(P(e.mine(t.organizationId),O(t.publicId,n)))}}}async function qs(e,t){return(await e.db.select({engine:ir.engine,conversation:ir.conversation,savedAt:ir.savedAt}).from(ir).innerJoin(L,O(L.id,ir.taskId)).where(P(e.mine(ir.organizationId),e.mine(L.organizationId),O(L.publicId,t))).orderBy(F(ir.savedAt))).map(e=>({...e,savedAt:q(e.savedAt)}))}function Js(e){let t=ir,n=A`${L.publicId} || ':' || ${t.conversation}`,r=e=>[e.slice(0,e.indexOf(`:`)),e.slice(e.indexOf(`:`)+1)];return{key:n,where:({id:n,prefix:i})=>{let[a,o]=r(n??i??``);return P(e.mine(L.organizationId),O(L.publicId,a),n===void 0?void 0:O(t.conversation,o))},rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,O(L.id,t.taskId)).where(P(e.mine(t.organizationId),r)).orderBy(F(t.savedAt));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:os({engine:e.engine,conversation:e.conversation,data:e.data,state:e.state,savedAt:q(e.savedAt)})}))},put:async(n,i)=>{let a={engine:i.engine,data:i.data,state:i.state??null,savedAt:J(i.savedAt)};await e.db.insert(t).values({organizationId:e.organizationId,taskId:A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${r(n)[0]})`,conversation:i.conversation,...a}).onConflictDoUpdate({target:[t.taskId,t.conversation],set:a})},delete:async n=>{let[i,a]=r(n),o=A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${i})`;await e.db.delete(t).where(P(O(t.taskId,o),O(t.conversation,a)))}}}function Ys(e){let t=nr,n=A`${L.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>P(e.mine(L.organizationId),O(L.publicId,n),r===void 0?void 0:i?O(t.seq,r):Jn(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,O(L.id,t.taskId)).where(P(e.mine(t.organizationId),r)).orderBy(F(L.publicId),F(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:q(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:J(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(P(O(t.taskId,i),O(t.seq,Number(n.slice(r+1)))))}}}function Xs(e){let t=M,n=A`${L.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>P(e.mine(L.organizationId),O(L.publicId,n),r===void 0?void 0:i?O(t.seq,r):Jn(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,O(L.id,t.taskId)).where(P(e.mine(t.organizationId),r)).orderBy(F(L.publicId),F(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:q(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:J(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(P(O(t.taskId,i),O(t.seq,Number(n.slice(r+1)))))}}}function Zs(e){let t=lr;return{key:L.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:L.publicId,installationId:K.key}).from(t).innerJoin(L,O(L.id,t.taskId)).leftJoin(K,O(K.id,t.installationId)).where(P(e.mine(t.organizationId),n)).orderBy(F(L.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:os({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:q(e.at)})}))},put:async(n,r)=>{let i=A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n})`,a={installationId:r.installationId?A`(select id from ${K} where organization_id = ${e.organizationId} and key = ${r.installationId})`:null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:J(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=A`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n})`;await e.db.delete(t).where(O(t.taskId,r))}}}var Qs=r({DrizzleStore:()=>$s}),$s=class e{db;organizationId;now;encryption;inTransaction;notifications;recordChannel(e,t){return`record_${Sr(`sha256`).update(JSON.stringify([this.organizationId,e,t])).digest(`hex`).slice(0,48)}`}notification(e,t){return this.notifications?{notified:A`pg_notify(${this.recordChannel(e,t)}, '')`}:void 0}async watch(e,t){let n=_e(),r=this.db.$client,i=r?.listen?await r.listen(this.recordChannel(e,t),n.notify,n.notify).catch(()=>void 0):void 0;return{...n,close(){i?.unlisten().catch(()=>{}),n.close()}}}publishAgent=(e,t)=>bs(this,e,t);kinds;constructor(e,t,n=Date.now,r={},i=!1,a=!!e.$client?.unsafe){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.inTransaction=i,this.notifications=a,this.kinds={agent:xs(this),agentversion:Cs(this),app:Ts(this),installation:Os(this),credential:Ps(this),task:Ks(this),history:Js(this),tasklog:Ys(this),inbox:Xs(this),usage:Zs(this),delivery:Hs(this,`delivery`),login:Hs(this,`login`),config:Hs(this,`config`),runner:Ws(this),snapshot:Hs(this,`snapshot`),connection:Hs(this,`connection`)}}static async webhookTarget(e,t,n){let r=Wn(j,`installation_secret`),[i]=await z(e,()=>e.select({app:G,credentials:j,installation:K,token:r}).from(G).innerJoin(j,O(j.id,G.credentialsSecretId)).leftJoin(K,P(O(K.appId,G.id),O(K.key,n??``),k(K.deletedAt))).leftJoin(r,O(r.id,K.tokenSecretId)).where(P(O(G.integration,t.slice(0,t.indexOf(`:`))),O(G.platformAppId,t.slice(t.indexOf(`:`)+1)))));if(i&&!i.installation&&n){let a=`${i.app.platformAppId}/`,[o]=await z(e,()=>e.select({app:G,credentials:j,installation:K,token:r}).from(K).innerJoin(G,O(G.id,K.appId)).innerJoin(j,O(j.id,G.credentialsSecretId)).leftJoin(r,O(r.id,K.tokenSecretId)).where(P(O(G.integration,i.app.integration),A`left(${G.platformAppId}, ${a.length}) = ${a}`,O(K.platformInstallId,n.slice(t.length+1)),k(K.deletedAt))).limit(1));if(o)return{organizationId:o.app.organizationId,app:ws(o.app,o.credentials),bound:{organizationId:o.installation.organizationId,installation:Es(o.installation,o.app,o.token)}}}return i&&{organizationId:i.app.organizationId,app:ws(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:Es(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await z(e,()=>e.select({row:G,sealed:j}).from(G).innerJoin(j,O(j.id,G.credentialsSecretId)).where(P(O(G.integration,t.slice(0,t.indexOf(`:`))),O(G.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:ws(n.row,n.sealed)}}static async apps(e,t){return(await z(e,()=>e.select({row:G,sealed:j}).from(G).innerJoin(j,O(j.id,G.credentialsSecretId)).where(O(G.integration,t)))).map(({row:e,sealed:t})=>({organizationId:e.organizationId,app:ws(e,t)}))}static async installationOrganization(e,t){let[n]=await z(e,()=>e.select({organizationId:K.organizationId}).from(K).where(O(K.key,t)));return n?.organizationId}static async installations(e,t){return z(e,()=>e.select({key:K.key,organizationId:K.organizationId}).from(K).where(P(A`${K.key} like ${`${as(t)}:%`}`,k(K.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await z(e,()=>e.select({organizationId:L.organizationId}).from(L).where(P(O(L.publicId,t),O(L.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await z(this.db,()=>this.db.select({row:G,sealed:j}).from(G).innerJoin(j,O(j.id,G.credentialsSecretId)).where(P(D(G.organizationId,[this.organizationId,``]),D(G.key,e))))).map(e=>({id:e.row.key,value:ws(e.row,e.sealed)})):[]}async listCredentials(e){let t=ar,n=this.db.select({row:t,sealed:j}).from(t).innerJoin(j,O(j.id,t.secretId)).where(P(this.mine(t.organizationId),e.owner?Zn(k(t.owner),O(t.owner,e.owner)):k(t.owner))).orderBy(F(A`case when ${t.owner} is null then 'workspace' else 'personal' end`),F(t.label));return(await z(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({row:e,sealed:t})=>({id:Jd(e.owner??void 0,e.label),value:As(e,t)}))}async updateMetadata(e,t,n){return e===`installation`&&(`covers`in n||`deletedAt`in n)?this.transaction(`installation:${t}`,async r=>{let i=await r.get(`installation`,t);if(!i)return!1;let a={...i,...n};return a.deletedAt===void 0&&await Ds(r,t,a),r.writeMetadata(e,t,n)}):this.writeMetadata(e,t,n)}async writeMetadata(e,t,n){let r=e===`app`?G:e===`installation`?K:cr,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`self`,`covers`,`repos`,`settings`,`deletedAt`,`uninstalled`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?J(t):t])),o=e===`runner`?cr.publicId:e===`app`?G.key:K.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?J(n.updatedAt):this.at()}).where(P(this.mine(r.organizationId),O(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){let n=/^connections?[:-]/.test(e)?`${this.organizationId}:${e}`:e;return this.transaction(`app:${n}`,t)}withConfigLock(e){return this.transaction(`config:${this.organizationId}`,e)}async transaction(t,n){let r=A`select pg_advisory_xact_lock(3, hashtext(${t}))`;return this.inTransaction?(await this.db.execute(r),n(this)):this.db.transaction(async t=>(await t.execute(r),n(new e(t,this.organizationId,this.now,this.encryption,!0,this.notifications))))}withCredential(e,t,n){if(e===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>An(e,`runner`,t,n));if(e===`installation`)return this.transaction(`installation:${t}`,async e=>{let r=await ks(e,t),i=await n(r,r?[{id:t,value:r}]:[],e);for(let t of i??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!i?.length});let{owner:r}=Yd(t);return this.transaction(js(this,r),async e=>{let i=await Ms(e,r),a=i.map(({id:e,value:t})=>({id:e,value:t})),o=await n(a.find(e=>e.id===t)?.value,a,e);for(let t of o??[])await Ns(e,i.find(e=>e.id===t.id),t.id,t.value);return!!o?.length})}at(){return J(this.now())}live(e){return Zn(k(e),Jn(e,this.at()))}mine(e){return O(e,this.organizationId)}async get(e,t){if(e===`app`)return(await this.getApps([t]))[0]?.value;let n=this.kinds[e],r=is(t),i=n.where?n.where({id:t}):n.split&&r?n.split(r[0],r[1],!0):A`${n.key} = ${t}`;return(await z(this.db,async()=>await n.rows(i,1)))[0]?.value}async patchLogin(e,t,n={}){let[r]=await this.db.update(N).set({value:A`jsonb_strip_nulls(${N.value} || ${JSON.stringify(t)}::jsonb)`}).where(P(O(N.key,X(this.organizationId,`login`,e)),this.live(N.expiresAt),A`(${N.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?D(A`${N.value}->>${e}`,t):A`${N.value}->>${e} = ${t}`))).returning({value:A`${N.value}`,...this.notification(`login`,e)});return r?.value}completeLogin(e,t,n){return lf(this,e,t,n)}async listAgentsWithVersions(e){return(await z(this.db,()=>this.db.select({record:R,version:I}).from(R).leftJoin(I,P(O(I.agentId,R.id),O(I.version,R.currentVersion))).where(P(this.mine(R.organizationId),e===void 0?void 0:Array.isArray(e)?e.length?D(R.slug,e):A`false`:O(R.slug,e))).orderBy(F(R.slug)))).map(({record:e,version:t})=>({record:ls(e),...t?{version:us(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${as(e.q)}%`:void 0,n=this.db.select({record:R,version:ds}).from(R).leftJoin(I,P(O(I.agentId,R.id),O(I.version,R.currentVersion))).where(P(this.mine(R.organizationId),e.slug===void 0?void 0:O(R.slug,e.slug),e.after?Jn(R.slug,e.after):void 0,e.source?O(R.source,e.source):void 0,t?Zn(Gn(R.slug,t),Gn(R.name,t),Gn(R.description,t),Gn(R.repo,t)):void 0,e.platform?A`${I.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(F(R.slug));return(await z(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({record:e,version:t})=>({record:ls(e),...t?{version:fs(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:ds}).from(I).innerJoin(R,O(R.id,I.agentId)).where(P(this.mine(R.organizationId),O(R.slug,e),n===void 0?t===void 0?void 0:Qn(I.version,R.currentVersion):Un(I.version,n),t===void 0?void 0:Yn(I.version,n===void 0?A`${R.currentVersion} + 1 - ${t}`:n-t))).orderBy(F(I.version));return(await z(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:fs(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:J(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i,r)}async putMany(e,t,n={}){if(!t.length)return;if(e===`delivery`){await this.db.insert(N).values(t.map(({id:t,value:r})=>({key:X(this.organizationId,e,t),value:r,expiresAt:n.ttlMs===void 0?null:J(this.now()+n.ttlMs)}))).onConflictDoUpdate({target:N.key,set:{value:A`excluded.value`,expiresAt:A`excluded.expires_at`}});return}if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value,n)));return}let r=t[0].id.lastIndexOf(`:`),i=t[0].id.slice(0,r),a=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==i)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:A`(select ${L.id} from ${L} where ${L.organizationId} = ${this.organizationId} and ${L.publicId} = ${i})`,seq:Number(e.id.slice(t+1)),at:J(n.at),level:n.level,line:n.line}});await this.db.insert(nr).values(a).onConflictDoUpdate({target:[nr.taskId,nr.seq],set:{at:A`excluded.at`,level:A`excluded.level`,line:A`excluded.line`}})}async list(e,t={}){let n=this.kinds[e],r=[];if(t.ids&&r.push(t.ids.length?D(A`${n.key}`,t.ids.map(t=>n.where?X(this.organizationId,e,t):t)):A`false`),t.runner&&r.push(e===`runner`?Zn(O(cr.publicId,t.runner),O(cr.name,t.runner)):A`false`),t.defaults&&r.push(e===`runner`?O(cr.isDefault,!0):A`false`),t.installation&&r.push(e===`usage`?O(K.key,t.installation):A`false`),t.agent&&r.push(e===`app`||e===`installation`?O(G.agent,t.agent):e===`agent`?O(R.slug,t.agent):A`false`),t.active&&r.push(e===`installation`?Zn(k(K.deletedAt),...t.includeUninstalled?[O(K.uninstalled,!0)]:[]):void 0),t.apps&&r.push(e===`installation`&&t.apps.length?D(G.key,t.apps):A`false`),Object.hasOwn(t,`visibleTo`)){let n=e===`runner`?cr.owner:e===`credential`?ar.owner:A`${N.value}->>'owner'`;r.push(Zn(k(n),t.visibleTo?O(A`${n}`,t.visibleTo):void 0))}if(n.where)return z(this.db,async()=>await n.rows(P(n.where(t),...r),t.limit));let i=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,a=t.after===void 0?void 0:is(t.after);if(n.split&&i&&!i.includes(`:`)&&(t.after===void 0||a?.[0]===i))return z(this.db,async()=>await n.rows(n.split(i,a?.[1]),t.limit));let o=t.prefix?A`${n.key} like ${`${as(t.prefix)}%`}`:void 0,s=t.after?A`${n.key} > ${t.after}`:void 0,c=P(o,s,...r);return z(this.db,async()=>await n.rows(c,t.limit))}async delete(e,t){let n=e===`login`?this.notification(e,t):void 0;if(n){await this.db.delete(N).where(O(N.key,X(this.organizationId,e,t))).returning(n);return}await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return Ss(this,t,n);if(e!==`delivery`&&e!==`connection`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:J(this.now()+r.ttlMs);return(await this.db.insert(N).values({key:X(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:N.key,set:{value:n,expiresAt:i},setWhere:Qn(N.expiresAt,this.at())}).returning({key:N.key})).length>0}async claimDeliveryLease(e,t,n){let r=A`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(N).values({key:X(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:N.key,set:{value:A`${N.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:A`${N.expiresAt} <= clock_timestamp()`}).returning({value:N.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=P(O(N.key,X(this.organizationId,`delivery`,e)),A`${N.value}->>'owner' = ${t} and ${N.expiresAt} > clock_timestamp()`),a=A`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(N).where(i).returning({key:N.key}):await this.db.update(N).set({value:n.next===void 0?n:A`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:N.key})).length>0}async updateDelivery(e,t,n,r={}){let i=P(O(N.key,X(this.organizationId,`delivery`,e)),A`${N.value}->>'owner' = ${t}`,this.live(N.expiresAt));return(n===void 0?await this.db.delete(N).where(i).returning({key:N.key}):await this.db.update(N).set({value:n,expiresAt:r.ttlMs===void 0?null:J(this.now()+r.ttlMs)}).where(i).returning({key:N.key})).length>0}listHistory(e){return qs(this,e)}async installationApp(e){let t=Wn(j,`installation_secret`),[n]=await z(this.db,()=>this.db.select({installation:K,app:G,credentials:j,token:t}).from(K).innerJoin(G,P(O(G.id,K.appId),D(G.organizationId,[this.organizationId,``]))).innerJoin(j,O(j.id,G.credentialsSecretId)).leftJoin(t,P(O(t.id,K.tokenSecretId),this.mine(t.organizationId))).where(P(this.mine(K.organizationId),O(K.key,e),k(K.deletedAt))));return n&&{installation:Es(n.installation,n.app,n.token),app:ws(n.app,n.credentials)}}async conversationState(e){let t=Wn(N,`unseen`),n=Wn(N,`batch`),[r]=await z(this.db,()=>this.db.select({record:N.value,unseen:t.value,batch:n.value,task:L}).from(A`(select 1) as anchor`).leftJoin(N,P(O(N.key,X(this.organizationId,`delivery`,e)),this.live(N.expiresAt))).leftJoin(t,P(O(t.key,X(this.organizationId,`delivery`,`since:${e}`)),this.live(t.expiresAt))).leftJoin(n,P(O(n.key,X(this.organizationId,`delivery`,`batch:${e}`)),this.live(n.expiresAt))).leftJoin(L,P(this.mine(L.organizationId),O(L.publicId,A`${N.value}->>'taskId'`),O(L.flow,`default`))));return{...r?.record?{record:r.record}:{},...r?.unseen?{unseen:r.unseen}:{},...r?.batch?{batch:r.batch}:{},...r?.task?{status:ps(r.task)}:{}}}async heldTokens(e,t){let[n]=await z(this.db,()=>ys(this.db,A`select ${zs(this.organizationId,e,t)} as tokens`));return Bs(this.organizationId,n?.tokens??{})}async holdToken(e){let t=N,n=e=>X(this.organizationId,`snapshot`,e);await this.db.execute(A`insert into ${t} (key, value, expires_at)
-      select ${n(e.key)}, ${JSON.stringify(e.value)}::jsonb, ${J(this.now()+e.ttlMs).toISOString()}::timestamptz
-      where ${A.join(e.drops.map(e=>A`coalesce((select ${t.value}->>'drop' from ${t} where ${t.key} = ${n(e.key)} and ${this.live(t.expiresAt)}), '') = ${e.drop??``}`),A` and `)}
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`)}async saveTaskSecrets(e,t){let[n]=await ur(this.db,[A`select pg_advisory_xact_lock(3, hashtext(${`app:${this.organizationId}:connections:${e}`}))`],A`with active as (select 1 from ${L} where ${this.mine(L.organizationId)} and ${L.publicId} = ${e} and ${L.status} in ('queued', 'running', 'waiting')),
-        kept as (insert into ${N} (key, value, expires_at)
-          select key, value, expires_at from (values ${A.join(t.map(e=>A`(${X(this.organizationId,`snapshot`,e.id)}, ${JSON.stringify({secret:e.value,expiresAt:e.expiresAt})}::jsonb, ${J(e.expiresAt).toISOString()}::timestamptz)`),A`, `)}) as row(key, value, expires_at) where exists (select 1 from active) on conflict (key) do nothing)
-        select exists (select 1 from active) as active`);return!!n?.active}async dispatchState(e){let t=N,n=e=>X(this.organizationId,`delivery`,e),r=e.conversation??``,i=e=>A`(select ${t.value} from ${t} where ${t.key} = ${n(e)} and ${this.live(t.expiresAt)})`,a=e=>A`(${e} is null or ${e} = (select requester from member))`,o=e=>A`${e} = ${this.organizationId}`,s=e=>A`(select coalesce(jsonb_agg(${Fs(A`r`,A`s`)}), '[]'::jsonb) from ${e})`,c=vs(this.organizationId,`snapshot`),l=e.files.map(e=>`${as(c+e)}%`),[u]=await ys(this.db,A`
-      with claim as (
-        insert into ${t} (key, value, expires_at)
-        values (${n(e.delivery.key)}, ${JSON.stringify({at:e.delivery.at,owner:e.delivery.owner,pending:!0})}::jsonb, ${J(e.delivery.at+e.delivery.ttlMs).toISOString()}::timestamptz)
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${t.expiresAt} <= ${this.at().toISOString()}::timestamptz
-        returning key
-      ), conversation as (select ${i(r)} as value),
-      member as (select ${rr.userId} as requester from ${rr}
-        where ${rr.platform} = ${e.actor?.platform??null}::text and ${rr.platformUserId} = ${e.actor?.id??null}::text
-          and ${rr.organizations} ? ${this.organizationId} limit 1)
-      select exists (select 1 from claim) as claimed,
-        (select to_jsonb(a) from ${R} a where ${o(A`a.organization_id`)} and a.slug = ${e.agent}) as record,
-        (select to_jsonb(v) from ${I} v join ${R} a on a.id = v.agent_id and v.version = a.current_version
-          where ${o(A`a.organization_id`)} and a.slug = ${e.agent}) as version,
-        (select value from conversation) as conversation,
-        ${i(`since:${r}`)} as unseen,
-        ${i(`batch:${r}`)} as batch,
-        (select to_jsonb(t) from ${L} t, conversation c where ${o(A`t.organization_id`)} and t.public_id = c.value->>'taskId' and t.flow = 'default') as task,
-        (select requester from member) as requester,
-        ${s(A`${ar} r join ${j} s on s.id = r.secret_id where ${o(A`r.organization_id`)} and ${a(A`r.owner`)}`)} as credentials,
-        ${s(A`${cr} r join ${j} s on s.id = r.secret_id where ${o(A`r.organization_id`)} and r.is_default and ${a(A`r.owner`)}`)} as runners,
-        (select coalesce(jsonb_agg(${t.value}), '[]'::jsonb) from ${t}
-          where ${t.key} like ${`${as(vs(this.organizationId,`connection`))}%`} and ${this.live(t.expiresAt)} and ${a(A`${t.value}->>'owner'`)}) as connections,
-        ${i(`workspace`)} as workspace,
-        (select coalesce(jsonb_object_agg(${t.key}, ${t.value}), '{}'::jsonb) from ${t}
-          where ${this.live(t.expiresAt)} and ${t.key} like any(${A.param(l)}::text[])) as files,
-        ${zs(this.organizationId,[e.installation.id],[e.installation.app])} as tokens`);if(!u?.claimed)return{claimed:!1};let d=u.record?ls(Y(R,u.record)):void 0,f=u.version&&d?us(Y(I,u.version),d.id):void 0;return{claimed:!0,loaded:{...d?{record:d}:{},...f?{version:f}:{},conversation:{...u.conversation?{record:u.conversation}:{},...u.unseen?{unseen:u.unseen}:{},...u.batch?{batch:u.batch}:{},...u.task?{status:ps(Y(L,u.task))}:{}},...u.requester?{requester:u.requester}:{},credentials:u.credentials.map(Is),runners:u.runners.map(Ls),connections:u.connections,...u.workspace?{workspace:u.workspace}:{},files:Object.fromEntries(Object.entries(u.files).map(([e,t])=>[e.slice(c.length),t])),tokens:Bs(this.organizationId,u.tokens)}}}async markConversation(e,t,n,r,i){await this.db.update(N).set({value:A`${N.value} || ${JSON.stringify({at:r,seen:n})}::jsonb`,expiresAt:J(this.now()+i)}).where(P(O(N.key,X(this.organizationId,`delivery`,e)),A`${N.value}->>'taskId' = ${t}`,this.live(N.expiresAt)))}async appendUnseen(e,t,n){let r=A`coalesce((${N.value}->>'version')::bigint, jsonb_array_length(${N.value}->'messages') + (${N.value}->>'more')::bigint)`,i={messages:[{...t,sequence:1}],more:0,version:1,epoch:Tr()};await this.db.execute(A`
-      insert into ${N} (key, value, expires_at)
-      select ${X(this.organizationId,`delivery`,`since:${e}`)}, ${JSON.stringify(i)}::jsonb, ${J(this.now()+n).toISOString()}::timestamptz
-      where exists (select 1 from ${N} where key = ${X(this.organizationId,`delivery`,e)} and ${this.live(N.expiresAt)})
-      on conflict (key) do update set value = case when ${N.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-        ${N.value} || jsonb_build_object('version', ${r} + 1,
-          'messages', case when jsonb_array_length(${N.value}->'messages') < ${50} then
-            (${N.value}->'messages') || jsonb_build_array(${JSON.stringify(t)}::jsonb || jsonb_build_object('sequence', ${r} + 1)) else ${N.value}->'messages' end,
-          'more', (${N.value}->>'more')::int + case when jsonb_array_length(${N.value}->'messages') < ${50} then 0 else 1 end) end,
-        expires_at = excluded.expires_at
-    `)}async acknowledgeUnseen(e,t,n){await this.db.update(N).set({value:Vs(t)}).where(P(O(N.key,X(this.organizationId,`delivery`,`since:${e}`)),A`${N.value}->>'epoch' is not distinct from ${n??null}::text`,this.live(N.expiresAt)))}async appendBatch(e,t,n,r,i){let a=Pn(void 0,t,n,r),o=J(this.now()+i);await this.db.insert(N).values({key:X(this.organizationId,`delivery`,e),value:a,expiresAt:o}).onConflictDoUpdate({target:N.key,set:{value:A`case when ${N.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-          (select ${N.value} || excluded.value || jsonb_build_object(
-            'items', prefix || coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(pending) with ordinality e(item,n) where n > greatest(jsonb_array_length(pending) - 50, 0)), '[]'::jsonb),
-            'more', coalesce((${N.value}->>'more')::int, 0) + coalesce((excluded.value->>'more')::int, 0) + greatest(jsonb_array_length(pending) - 50, 0),
-            'mustReply', coalesce((${N.value}->>'mustReply')::boolean, false) or coalesce((excluded.value->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(pending) with ordinality e(item,n) where n <= greatest(jsonb_array_length(pending) - 50, 0) and item->'event'->>'mustReply' = 'true'))
-            from (select coalesce(jsonb_agg(item order by n) filter (where n <= coalesce((${N.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) as prefix,
-              coalesce(jsonb_agg(item order by n) filter (where n > coalesce((${N.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) || (excluded.value->'items') as pending
-              from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n)) queued) end`,expiresAt:o}})}async claimBatch(e,t){let n=X(this.organizationId,`delivery`,e),r=(await ys(this.db,A`
-      with held as materialized (
-        select key as batch_key, value as previous from ${N}
-        where key = ${n} and value->>'owner' = ${t} and ${this.live(N.expiresAt)} for update
-      ), claimed as (
-        update ${N} set value = (
-          select ready || jsonb_build_object('more', 0, 'mustReply', false, 'sending', jsonb_build_object(
-            'owner', ${t}::text, 'until', ${this.now()+In}::bigint,
-            'count', jsonb_array_length(ready->'items'), 'more', ready->'more', 'mustReply', ready->'mustReply'))
-          from (select (value - 'sending') || jsonb_build_object(
-            'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n > greatest(jsonb_array_length(value->'items') - 50, 0)), '[]'::jsonb),
-            'more', coalesce((value->>'more')::int, 0) + coalesce((value->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(value->'items') - 50, 0),
-            'mustReply', coalesce((value->>'mustReply')::boolean, false) or coalesce((value->'sending'->>'mustReply')::boolean, false) or exists(
-              select 1 from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n <= greatest(jsonb_array_length(value->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')) as ready) as available)
-        from held where key = held.batch_key and coalesce((value->'sending'->>'until')::bigint, 0) <= ${this.now()}
-          and jsonb_array_length(value->'items') > 0
-        returning value
-      ) select value, true as claimed from claimed
-      union all select previous, false from held where not exists (select 1 from claimed)
-    `))[0];return r?.claimed?{...r.value,more:r.value.sending?.more,mustReply:r.value.sending?.mustReply}:r?.value.sending?null:void 0}async finishBatch(e,t,n,r){let i=A`(${N.value}->'sending'->>'count')::int`,a=r===void 0?i:A`coalesce((select n from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n)
-          where n <= ${i} and item->>'admission' = ${r} limit 1), 0)`;return(await this.db.update(N).set({value:A`case when ${n} and ${i} > ${a} then
-          ${N.value} || jsonb_build_object('items',
-            coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n)
-              where n > ${a}), '[]'::jsonb),
-            'sending', (${N.value}->'sending') || jsonb_build_object(
-              'count', ${i} - ${a},
-              'until', ${this.now()+In}::bigint))
-        else (${N.value} - 'sending') || jsonb_build_object('items',
-        case when ${n} then coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${N.value}->'items') with ordinality as entries(item, n)
-          where n > ${i}), '[]'::jsonb) else
-          coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n)
-            where n > greatest(jsonb_array_length(${N.value}->'items') - 50, 0)), '[]'::jsonb) end,
-        'more', coalesce((${N.value}->>'more')::int, 0) + case when ${n} then 0 else coalesce((${N.value}->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(${N.value}->'items') - 50, 0) end,
-        'mustReply', coalesce((${N.value}->>'mustReply')::boolean, false) or (not ${n} and (coalesce((${N.value}->'sending'->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n)
-          where n <= greatest(jsonb_array_length(${N.value}->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')))) end`}).where(P(O(N.key,X(this.organizationId,`delivery`,e)),A`${N.value}->'sending'->>'owner' = ${t}`,this.live(N.expiresAt))).returning({key:N.key})).length>0}async take(e,t,n){if(e===`delivery`||e===`snapshot`){let[r]=await this.db.delete(N).where(P(O(N.key,X(this.organizationId,e,t)),this.live(N.expiresAt),n?A`${N.value} @> ${JSON.stringify(n)}::jsonb`:void 0)).returning({value:N.value});return r?.value}let r=await this.get(e,t);if(!(r===void 0||Object.entries(n??{}).some(([e,t])=>r[e]!==t)))return await this.delete(e,t),r}async usageSummary(e,t){let n=A`case groups.kind when 'agent' then ${lr.agent} when 'engine' then coalesce(${lr.engine}, 'unknown') else coalesce(${K.key}, 'none') end`,r=t?n:A`groups.kind || ':' || (${n})`,i=(await z(this.db,()=>ys(this.db,A`
-      with recursive records as (
-        select ${r} as key, ${lr.runnerMs} as runner_ms, ${lr.tokens} as tokens,
-          row_number() over (partition by ${r} order by ${L.publicId}) as n
-        from ${lr} inner join ${L} on ${L.id} = ${lr.taskId}
-        left join ${K} on ${K.id} = ${lr.installationId}
-        cross join unnest(${A.param(t?[t]:[`agent`,`installation`,`engine`])}::text[]) groups(kind)
-        where ${this.mine(lr.organizationId)} and ${lr.at} >= ${new Date(e).toISOString()}::timestamptz
-      ), nodes(key, path, n, value) as (
-        select key, '{}'::text[], n, tokens from records where tokens is not null
-        union all
-        select nodes.key, nodes.path || child.key, nodes.n, child.value from nodes
-        cross join lateral jsonb_each(case when jsonb_typeof(nodes.value) = 'object' then nodes.value else '{}'::jsonb end) child
-      ), resolved(key, path, kind, cutoff) as (
-        select keys.key, '{}'::text[], latest.kind, coalesce((
-          select max(n) from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0) from (select distinct key from records) keys
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest
-        union all
-        select parent.key, child.path, latest.kind, greatest(parent.cutoff, coalesce((
-          select max(n) from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0)) from resolved parent
-        cross join lateral (
-          select distinct path[1:cardinality(parent.path) + 1] as path from nodes
-          where nodes.key = parent.key and n > parent.cutoff and cardinality(path) > cardinality(parent.path)
-            and path[1:cardinality(parent.path)] = parent.path
-        ) child
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest where parent.kind = 'object'
-      ), sums as (
-        select key, path, case when kind = 'object' then '{}'::jsonb else to_jsonb((
-          select sum(case when jsonb_typeof(value) = 'number' then (value #>> '{}')::numeric end)::float8
-          from nodes where nodes.key = resolved.key and nodes.path = resolved.path and n > cutoff
-        )) end as value from resolved
-      ) select key, count(*)::int as tasks, sum(runner_ms)::float8 as runner_ms,
-        (select jsonb_agg(jsonb_build_object('path', path, 'value', value) order by path) from sums where sums.key = records.key) as tokens
-        from records group by key order by key
-    `))).map(e=>{let t;for(let n of e.tokens??[]){if(!n.path.length){t=typeof n.value==`number`?n.value:Object.create(null);continue}let e=t&&typeof t==`object`?t:Object.create(null);t=e;let r=e;for(let e of n.path.slice(0,-1))r=r[e]??=Object.create(null);Object.defineProperty(r,n.path.at(-1),{value:typeof n.value==`number`?n.value:Object.create(null),enumerable:!0,configurable:!0,writable:!0})}return{key:e.key,tasks:e.tasks,runnerMs:e.runner_ms,...t===void 0?{}:{tokens:t}}});if(t)return i;let a={agent:[],installation:[],engine:[]};for(let e of i){let t=e.key.indexOf(`:`);a[e.key.slice(0,t)].push({...e,key:e.key.slice(t+1)})}return a}async usageTotals(e){let t=lr,n=e.by===`agent`?A`${t.agent}`:e.by===`engine`?A`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?A`coalesce(${K.key}, 'none')`:A`to_char(${t.at} at time zone ${Ho(e.tz)}, 'YYYY-MM-DD')`,r=P(this.mine(t.organizationId),Yn(t.at,J(e.since)),e.until===void 0?void 0:Un(t.at,J(e.until)),e.agent?O(t.agent,e.agent):void 0),i=A`coalesce(
-      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
-      (select sum((v #>> '{}')::numeric)
-        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
-        where jsonb_typeof(v) = 'number')
-    )`,a={tasks:A`count(*)`,runnerMs:A`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:A`coalesce(sum(${i}), 0)`},o=e.top?A`case when ${t.agent} in (
-          select ${t.agent} from ${t} where ${r} group by ${t.agent}
-          order by ${a[e.top.by]} desc, ${t.agent} limit ${e.top.count}
-        ) then ${t.agent} end`:e.parts?.length?A`case when ${D(t.agent,e.parts)} then ${t.agent} end`:A`null::text`,s=e.by===`installation`?A`left join ${K} on ${K.id} = ${t.installationId}`:A``,c=await z(this.db,()=>ys(this.db,A`
-      select ${n} as key, ${o} as part, ${a.tasks}::int as tasks,
-        ${a.runnerMs}::float8 as runner_ms,
-        ${a.tokenCount}::float8 as token_count
-      from ${t} ${s}
-      where ${r}
-      group by 1, 2
-    `)),l=new Map;for(let e of c){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=l.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};Uo(n,t),e.part&&((n.parts??={})[e.part]=t),l.set(e.key,n)}return[...l.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(A`
-      with tombstones as (
-        delete from ${er} where (organization_id, public_id) in (
-          select organization_id, public_id from ${er}
-          where deleted_at < ${new Date(this.now()-6e5).toISOString()}::timestamptz
-          order by deleted_at limit ${e}
-        )
-      ), expired_state as (
-        delete from ${N} where expires_at <= clock_timestamp() and key in (
-          select key from ${N} where expires_at <= clock_timestamp() order by expires_at limit ${e}
-        )
-      ), lists as (
-        select expired.key from ${or} as expired
-        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
-          and not exists (select 1 from ${or} as newer where newer.key = expired.key and newer.seq > expired.seq)
-        order by expired.expires_at limit ${e}
-      ), expired_items as (
-        select key, seq from ${or} where key in (select key from lists) order by seq limit ${e}
-      ), expired_queue as (
-        select key, seq from ${or} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
-      )
-      delete from ${or} where (key, seq) in (
-        select key, seq from expired_items union all select key, seq from expired_queue
-      )`)}};const ec=St;function tc(e,t,n,r=wr(32).toString(`base64url`)){let i=`${sn({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:ec(i)}}function nc(e){try{return on(e.slice(0,e.indexOf(`.`)))}catch{return{}}}var rc=r({DrizzleQueue:()=>mc});const ic=(e,t)=>A`('[' || to_json(${e})::text || ',' || to_json(${t}::text)::text || ']:')`,ac=e=>A`(select ${Fs(A`c`,A`s`)} from ${ar} c join ${j} s on s.id = c.secret_id
-    where c.organization_id = ${e}.organization_id and coalesce(c.owner || '/', '') || c.label = ${e}.credential)`,oc=e=>A`(select ${N.value} from ${N} where ${N.key} = 'o:' || ${ic(e,`config`)} || 'workspace')`,sc=e=>A`(select ${Fs(A`r`,A`s`)} from ${cr} r join ${j} s on s.id = r.secret_id
-    where r.organization_id = ${e}.organization_id and r.public_id = ${e}.runner_id)`;function cc(e,t){if(typeof t==`number`)return A`to_jsonb(coalesce(case when jsonb_typeof(${e}) = 'number' then (${e} #>> '{}')::numeric end, 0) + ${t}::numeric)`;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=Object.entries(t).map(([t,n])=>A`${t}::text, ${cc(A`(${e} -> ${t}::text)`,n)}`);return A`(case when jsonb_typeof(${e}) = 'object' then ${e} else '{}'::jsonb end || jsonb_build_object(${A.join(n,A`, `)}))`}const lc=e=>A`(case ${e} ${A.join([...Q,...we].map(e=>A`when ${e} then ${A.raw(String(fe(e)))}`),A` `)} end)`,uc=e=>A`date_trunc('milliseconds', ${e})`,dc=e=>A`${e} collate "C"`,fc=e=>[F(lc(e.status)),Hn(uc(e.createdAt)),Hn(dc(e.publicId))],pc=e=>[F(e.updatedAt),F(dc(e.publicId))];var mc=class{db;constructor(e){this.db=e}async metrics(e,t){let n=await this.db.select({status:L.status,total:A`count(*)::int`,recent:A`count(*) filter (where ${L.createdAt} >= ${new Date(t).toISOString()}::timestamptz)::int`}).from(L).where(O(L.organizationId,e)).groupBy(L.status),r={tasks:{queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},queueDepth:0};for(let e of n)r.tasks[e.status]=e.recent,e.status===`queued`&&(r.queueDepth=e.total);return r}where(e,t){return P(O(L.organizationId,e),O(L.publicId,t))}fence(e,t,n={}){return P(this.where(e,t),n.generation===void 0?void 0:O(L.generation,n.generation),n.attempts===void 0?void 0:O(L.attempts,n.attempts),n.tokenHash===void 0?void 0:n.tokenHash===null?k(L.tokenHash):O(L.tokenHash,n.tokenHash),n.handle===void 0?void 0:n.handle===null?k(L.handle):O(L.handle,n.handle),n.lastSeenAt===void 0?void 0:n.lastSeenAt===null?k(L.lastSeenAt):O(L.lastSeenAt,new Date(n.lastSeenAt)),n.updatedAt===void 0?void 0:O(L.updatedAt,new Date(n.updatedAt)),n.statuses?D(L.status,n.statuses):void 0)}async enqueue(e,t,n,r,i,a){let o=this.insertion(e,t,n,r,i,void 0,a),[s]=await ur(this.db,i===void 0?[]:[A`select pg_advisory_xact_lock(1, hashtext(${e}))`],o);if(!s?.allowed)throw Error(`Organization task queue is full`);return!!s.inserted}insertion(e,t,n,r,i,a,o){let s=t.event,c=new Date(n).toISOString(),l=e=>A`${e===void 0?null:JSON.stringify(e)}::jsonb`,u=t=>X(e,`delivery`,t),d=r?A`
-      receipt as (
-        insert into ${N} (key, value, expires_at)
-        select ${u(r.key)}, ${l({at:n})}, ${new Date(n+r.ttlMs).toISOString()}::timestamptz
-        from capacity where allowed ${a?A`and (${a.create} or exists (select 1 from target))`:A``}
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${N.expiresAt} <= ${c}::timestamptz or ${N.value}->>'owner' = ${r.owner??null}::text
-        returning key
-      ),`:A``,f=A`exists (select 1 from inserted)`,p=A`on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`,{conversation:m,unseen:h,secrets:g}=o??{},_=A`${m?A`, remembered as (insert into ${N} (key, value, expires_at)
-        select key, value, ${new Date(n+m.ttlMs).toISOString()}::timestamptz from (values
-          (${u(m.key)}, ${l(m.record)}), (${u(m.root)}, ${l({at:m.record.at})})) as row(key, value)
-        where ${f} ${p})`:A``}${h?A`, acknowledged as (update ${N} set value = ${Vs(h.version)}
-        where key = ${u(`since:${h.key}`)} and ${N.value}->>'epoch' is not distinct from ${h.epoch??null}::text
-          and (expires_at is null or expires_at > ${c}::timestamptz) and ${f})`:A``}${g?.length?A`, secrets as (insert into ${N} (key, value, expires_at)
-        select key, value, expires_at from (values ${A.join(g.map(t=>A`(${X(e,`snapshot`,t.id)}, ${l({secret:t.value,expiresAt:t.expiresAt})}, ${new Date(t.expiresAt).toISOString()}::timestamptz)`),A`, `)}) as row(key, value, expires_at) where ${f} on conflict (key) do nothing)`:A``}`;return A`
-      with ${a?A`target as materialized (${a.target}),`:A``} capacity as (
-        select ${i===void 0?A`true`:A`(select count(*) from ${L} where organization_id = ${e} and status = 'queued') < ${i} ${r?A`or exists (select 1 from ${N} where key = ${u(r.key)} and expires_at > ${c}::timestamptz and value->>'owner' is distinct from ${r.owner??null}::text)`:A``}`} ${a?A`or exists (select 1 from target) or not ${a.create}`:A``} as allowed
-      ), ${d} ${a?A`advanced as (
-        update ${L} set inbox_seq = inbox_seq + 1, updated_at = ${c}::timestamptz where id in (select id from target) and exists (select 1 from receipt)
-        returning id, inbox_seq, generation
-      ), forwarded as (
-        insert into ${M} (organization_id, task_id, seq, generation, at, kind, value)
-        select ${e}, id, inbox_seq, generation, ${c}::timestamptz, 'steer', ${l({text:a.steer})} from advanced returning seq
-      ),`:A``} inserted as (
-        insert into ${L} (organization_id, public_id, source, status, agent, flow, review_key, runner, permissions,
-          app_id, installation_id, event, prompt, args, mcp, author, definition, credential, requester,
-          runner_id, usage, tools, context, files, attempts, created_at, updated_at)
-        select ${e}, ${t.id}, ${t.source}, 'queued', ${t.agent}, ${t.flow}, ${xp(t)??null}, ${t.runner}, ${t.permissions??null},
-          ${s?A`coalesce((select id from ${sr} where key = ${s.appId} and organization_id in (${e}, '')), 0)`:A`null`},
-          ${s?A`coalesce((select id from ${tr} where key = ${`${s.appId}:${s.installationId}`} and organization_id = ${e}), 0)`:A`null`},
-          ${l(s)}, ${t.prompt??null}, ${l(t.args)}, ${l(t.mcp)}, ${t.author??null}, ${l(t.definition)},
-          ${t.credential??null}, ${t.requester??null}, ${t.runnerId??null}, ${l(t.usage)}, ${l(t.tools)},
-          ${l(ns(t))}, ${l(t.files)}, 0, ${c}::timestamptz, ${c}::timestamptz
-        from capacity where allowed ${a?A`and ${a.create} and not exists (select 1 from target)`:A``} ${r?A`and exists (select 1 from receipt)`:A``}
-        returning id
-      )${_} select allowed, exists (select 1 from inserted) as inserted ${a?A`, exists (select 1 from forwarded) as steered`:A``} from capacity`}async deliver(e,t,n,r,i,a,o=!0,s){if(i===void 0)return o&&await this.enqueue(e,t,n,r,a,s)?{taskId:t.id}:{};let c=t.event,l=A`select id from ${L} where organization_id = ${e} and status in ('queued', 'running', 'waiting')
-      and agent = ${t.agent} and source = ${t.source} and flow = 'default'
-      and event->>'appId' is not distinct from ${c?.appId??null}
-      and event->>'installationId' is not distinct from ${c?.installationId??null}
-      and event->'chat'->'thread'->>'id' = ${c?.chat?.thread.id||null}
-      order by created_at desc, public_id desc limit 1 for update`,u=this.insertion(e,t,n,r,a,{target:l,create:o,steer:i},s),d=[A`select pg_advisory_xact_lock(3, hashtext(${JSON.stringify([e,yp(t)])}))`];a!==void 0&&o&&d.push(A`select pg_advisory_xact_lock(1, hashtext(${e}))`);let[f]=await ur(this.db,d,u);if(!f?.allowed)throw Error(`Organization task queue is full`);return f.inserted?{taskId:t.id}:f.steered?{steered:!0}:{}}async claim(e,t,n=!1,r){let i=A`not exists (select 1 from ${L} reviewing
-      where reviewing.organization_id = ${L.organizationId} and reviewing.status in ('running', 'waiting')
-        and reviewing.review_key = ${L.reviewKey})`,a=r===void 0?A`true`:A`(select count(*) from ${L} active where active.organization_id = ${L.organizationId} and active.status in ('running', 'waiting')) < ${r}`;if(!n){let[e]=await z(this.db,()=>ys(this.db,A`select exists (select 1 from ${L} where status = 'queued' and ${a} and ${i})
-        and ${t===void 0?A`true`:A`(select count(*) from ${L} where status in ('running', 'waiting')) < ${t}`} as ready`));if(!e?.ready)return}let o=wr(32).toString(`base64url`),s=A`translate(rtrim(replace(encode(convert_to(format('{"task":%s,"organization":%s,"attempt":%s}',
-      to_json(public_id), to_json(organization_id), attempts + 1), 'UTF8'), 'base64'), E'\\n', ''), '='), '+/', '-_') || '.' || ${o}`,c=A`with stamp as materialized (select date_trunc('milliseconds', clock_timestamp()) as at), picked as materialized (
-      select id, ${s} as bearer from ${L} where status = 'queued'
-        and ${a} and ${i}
-        ${t===void 0?A``:A`and (select count(*) from ${L} where status in ('running', 'waiting')) < ${t}`}
-        order by created_at, id limit 1 for update
-      ), claimed as (
-        update ${L} set status = 'running', attempts = attempts + 1, locked_at = (select at from stamp),
-          started_at = (select at from stamp), updated_at = (select at from stamp), last_seen_at = (select at from stamp),
-          token_hash = translate(rtrim(encode(sha256(convert_to(picked.bearer, 'UTF8')), 'base64'), '='), '+/', '-_')
-        from picked where ${L.id} = picked.id returning ${L}.*
-      ) select to_jsonb(claimed) as record, exists (select 1 from ${L} where status = 'queued' and id <> claimed.id
-        and ${i} and (${L.organizationId} <> claimed.organization_id or ${L.reviewKey} is null or ${L.reviewKey} is distinct from claimed.review_key)
-        and ${r===void 0?A`true`:A`(select count(*) from ${L} active where active.organization_id = ${L.organizationId} and active.status in ('running', 'waiting')) + case when ${L.organizationId} = claimed.organization_id then 1 else 0 end < ${r}`})
-        and ${t===void 0?A`true`:A`(select count(*) from ${L} where status in ('running', 'waiting')) + 1 < ${t}`} as more,
-        ${ac(A`claimed`)} as credential, ${oc(A`claimed.organization_id`)} as config, ${sc(A`claimed`)} as runner
-        from claimed`,[l]=await ur(this.db,[A`select pg_advisory_xact_lock(2, 0)`],c);if(!l)return;let u=Y(L,l.record);return{organizationId:u.organizationId,status:ps(u),token:tc(u.publicId,u.organizationId,u.attempts,o).token,more:l.more,loaded:{credential:l.credential?Is(l.credential).value:void 0,config:l.config??void 0,runner:l.runner?Ls(l.runner).value:void 0}}}async authorize(e,t,n,r,i,a={}){let o=D(L.status,[`running`,`waiting`]),s=new Date(i).toISOString(),c=this.db.update(L).set({lastSeenAt:A`case when ${o} then ${s}::timestamptz else ${L.lastSeenAt} end`,updatedAt:A`case when ${o} then ${s}::timestamptz else ${L.updatedAt} end`}).where(this.fence(r,e,{tokenHash:t,attempts:n,statuses:a.allowCompleted?[`running`,`waiting`,`completed`,`failed`,`cancelled`]:[`running`,`waiting`]})).returning(),l=a.include===`context`,u=!!a.include,d=N,f=A`touched.organization_id`,p=e=>A`('o:' || ${ic(f,`snapshot`)} || ${e})`,m=e=>A`replace(replace(replace(${e}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`,h=A`(${d.expiresAt} is null or ${d.expiresAt} > ${s}::timestamptz)`,[g]=await ys(this.db,A`with touched as (${c.getSQL()}), target as (
-        select i.key, a.key as app from touched, ${tr} i join ${sr} a on a.id = i.app_id
-        where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and ${l}
-      )
-      select to_jsonb(touched) as status,
-        case when ${l} then (select ${Fs(A`a`,A`s`)} from ${sr} a join ${j} s on s.id = a.credentials_secret_id
-          where a.key = touched.event->>'appId' and a.organization_id in (touched.organization_id, '')) end as app,
-        case when ${u} then (select ${Fs(A`i`,A`s`)} || jsonb_build_object('app', to_jsonb(a), 'credentials', to_jsonb(c))
-          from ${tr} i join ${sr} a on a.id = i.app_id join ${j} c on c.id = a.credentials_secret_id left join ${j} s on s.id = i.token_secret_id
-          where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and i.deleted_at is null) end as installation,
-        case when ${u} then ${ac(A`touched`)} end as credential,
-        case when ${u} and touched.credential is null then (select coalesce(jsonb_agg(${Fs(A`c`,A`s`)}), '[]'::jsonb)
-          from ${ar} c join ${j} s on s.id = c.secret_id where c.organization_id = touched.organization_id
-          and (c.owner is null or c.owner = touched.requester)) end as credentials,
-        case when ${l} then ${oc(f)} end as config,
-        case when ${l} then ${sc(A`touched`)} end as runner,
-        case when ${u} then jsonb_build_object('rows', coalesce((select jsonb_agg(${d.value}->>'secret') from ${d}
-          where ${d.key} like ${m(p(A`'connection-secrets:' || touched.public_id || ':'`))} || '%' and ${h}), '[]'::jsonb),
-          'old', (select ${d.value} from ${d} where ${d.key} = ${p(A`'connection-secrets:' || touched.public_id`)} and ${h})) end as secrets,
-        case when ${l} then (select jsonb_build_object('key', ${d.key}, 'value', ${d.value}) from ${d}
-          where ${d.key} like ${m(p(A`'connections:' || touched.public_id || ':' || touched.generation || ':' || touched.attempts || ':'`))} || '%' and ${h} limit 1) end as resolved,
-        case when ${l} then (select coalesce(jsonb_object_agg(${d.key}, ${d.value}), '{}'::jsonb) from ${d} where ${h} and (
-          ${d.key} like any (select ${m(p(A`'token:' || key || ':'`))} || '%' from target)
-          or ${d.key} in (select ${p(A`'token-drop:' || key`)} from target union all select ${p(A`'token-drop:' || app`)} from target))) end as tokens
-      from touched`);if(!g)return;let _=Y(L,g.status),v=vs(_.organizationId,`snapshot`),y=(e,t)=>e?t(e):void 0;return{organizationId:_.organizationId,status:ps(_),...u?{loaded:{installation:y(g.installation,e=>Rs(e).installation),credential:y(g.credential,e=>Is(e).value),...g.credentials?{credentials:g.credentials.map(Is)}:{},secrets:y(g.secrets,e=>({rows:e.rows,...e.old?{old:e.old}:{}})),...l?{app:y(g.app,e=>ws(Y(sr,e.row),Y(j,e.sealed))),config:g.config??void 0,runner:y(g.runner,e=>Ls(e).value),resolved:y(g.resolved,e=>({id:e.key.slice(v.length),value:e.value})),tokens:Bs(_.organizationId,g.tokens??{})}:{}}}:{}}}async touch(e,t,n,r,i,a=!1){return(await this.authorize(t,n,r,e,i,{allowCompleted:a}))?.status}async patchTask(e,t,n,r,i={}){let{answer:a,archivedAt:o,autoArchived:s,lastSeenAt:c,logsComplete:l,...u}=n,[d]=await this.db.update(L).set({...Object.fromEntries(Object.entries(u).map(([e,t])=>[e,t??null])),...l===void 0?{}:{context:A`jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{runnerLogs}', coalesce(${L.context}->'runnerLogs', '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object('complete', ${l??null}::boolean, 'handle', ${L.handle}, 'attempts', ${L.attempts}, 'generation', ${L.generation})))`},...a===void 0?{}:{answer:A`coalesce(${L.answer}, '[]'::jsonb) || ${JSON.stringify([a])}::jsonb`},...Object.hasOwn(n,`archivedAt`)?{archivedAt:o===void 0?null:new Date(o)}:{},...Object.hasOwn(n,`lastSeenAt`)?{lastSeenAt:c===void 0?null:new Date(c)}:{},updatedAt:new Date(r)}).where(this.fence(e,t,i)).returning({id:L.id});return!!d}async archiveStopped(e,t,n){await this.db.update(L).set({archivedAt:new Date(t),updatedAt:new Date(t)}).where(P(e===void 0?void 0:O(L.organizationId,e),n?D(L.publicId,n):void 0,k(L.archivedAt),D(L.status,[...we]),Un(A`coalesce(${L.finishedAt}, ${L.updatedAt})`,A`${new Date(t-Qe).toISOString()}::timestamptz`)))}async requeue(e,t,n,r={}){let[i]=await this.db.update(L).set({status:`queued`,lockedAt:null,handle:null,tokenHash:null,lastSeenAt:null,updatedAt:new Date(n)}).where(this.fence(e,t,{...r,statuses:[`running`,`waiting`]})).returning({id:L.id});return!!i}connectionLock(e,t){return A`select pg_advisory_xact_lock(3, hashtext(${`app:${e}:connections:${t}`}))`}async deleteTask(e,t,n){let[r]=await ur(this.db,[this.connectionLock(e,t)],A`
-      with gone as (
-        delete from ${L} where ${this.fence(e,t,n)}
-        returning organization_id, public_id
-      ), marked as (
-        insert into ${er} (organization_id, public_id, deleted_at)
-        select organization_id, public_id, clock_timestamp() from gone
-      ), connections as (delete from ${N} where ${Gs(e,t)} and exists (select 1 from gone))
-      select count(*)::int as deleted from gone`);return!!r?.deleted}async finish(e,t,n,r,i={}){let a=new Date(r),o=this.db.update(L).set({status:n.status,result:n.result??null,error:n.error??null,tokens:n.tokens??null,lastSeenAt:a,lockedAt:null,finishedAt:a,updatedAt:a}).where(this.fence(e,t,{...i,statuses:[`queued`,`running`,`waiting`]})).returning({id:L.id}),[s]=await ur(this.db,[this.connectionLock(e,t)],A`
-      with finished as (${o.getSQL()}), purged as (
-        delete from ${N} where ${Gs(e,t)} and exists (select 1 from finished)
-      ) select id from finished`);return!!s}async continueTask(e,t,n,r,i){let a=A`(${JSON.stringify(n.context??{})}::jsonb - 'connections' - 'engineChain' - 'engineCredentials') || jsonb_strip_nulls(jsonb_build_object('connections', ${L.context}->'connections', 'engineChain', ${L.context}->'engineChain', 'engineCredentials', ${L.context}->'engineCredentials'))`,[o]=await this.db.update(L).set({prompt:n.prompt??null,context:a,...n.definition?{definition:n.definition}:{},...n.usage?{usage:n.usage}:{},...n.tools?{tools:n.tools}:{},...`files`in n?{files:n.files??null}:{},...`permissions`in n?{permissions:n.permissions??null}:{},status:`queued`,attempts:0,generation:A`${L.generation} + 1`,inboxAck:-1,result:null,error:null,tokens:null,handle:null,tokenHash:null,lastSeenAt:null,logCursor:null,lockedAt:null,startedAt:null,finishedAt:null,cancelRequestedAt:null,approval:null,answer:null,archivedAt:null,updatedAt:new Date(r)}).where(this.fence(e,t,{...i,statuses:[`completed`,`failed`,`cancelled`]})).returning({context:L.context});return o&&(n.context=rs(o.context).context),!!o}async completeTask(e,t,n,r){let{outcome:i,usage:a}=n,o=new Date(r).toISOString(),s=n.logsComplete?A`, context = jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{runnerLogs}', jsonb_strip_nulls(jsonb_build_object('complete', true, 'handle', ${L.handle}, 'attempts', ${L.attempts}, 'generation', ${L.generation})))`:A``,c=n.known?.length?A`, posts as (insert into ${N} (key, value, expires_at)
-      select key, ${JSON.stringify({at:r})}::jsonb, expires_at from (values ${A.join(n.known.map(t=>A`(${X(e,`delivery`,t.id)}, ${new Date(r+t.ttlMs).toISOString()}::timestamptz)`),A`, `)}) as row(key, expires_at) where exists (select 1 from finished)
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at)`:A``,[l]=await ur(this.db,[this.connectionLock(e,t)],A`
-    with finished as (
-      update ${L} set status = ${i.status}, result = ${JSON.stringify(i.result??null)}::jsonb,
-        error = ${i.error??null}, tokens = ${JSON.stringify(i.tokens??null)}::jsonb,
-        last_seen_at = ${o}::timestamptz, locked_at = null, finished_at = ${o}::timestamptz, updated_at = ${o}::timestamptz${s}
-      where ${this.fence(e,t,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]})}
-      returning id, installation_id, generation
-    ), connections as (delete from ${N} where ${Gs(e,t)} and exists (select 1 from finished)), inbox as (delete from ${M} where (task_id, generation) in (select id, generation from finished))${c}, recorded as (
-      insert into ${lr} (organization_id, task_id, installation_id, agent, target, engine, model, credential, runner_ms, tokens, at, updated_at)
-      select ${e}, id, installation_id, ${a.agent}, ${a.target}, ${a.engine??null}, ${a.model??null},
-        ${a.credential}, ${a.runnerElapsedMs}, ${JSON.stringify(a.tokens??null)}::jsonb, ${new Date(a.at).toISOString()}::timestamptz, ${o}::timestamptz from finished
-      on conflict (task_id) do update set installation_id = excluded.installation_id, agent = excluded.agent, target = excluded.target,
-        engine = excluded.engine, model = excluded.model, credential = excluded.credential, runner_ms = ${lr.runnerMs} + excluded.runner_ms,
-        tokens = ${cc(A`${lr.tokens}`,a.tokens)}, at = excluded.at, updated_at = excluded.updated_at
-    )
-    select exists (select 1 from finished) as completed`);return!!l?.completed}async cancel(e,t,n,r={}){let i=new Date(n).toISOString(),[a]=await ur(this.db,[this.connectionLock(e,t)],A`
-    with cancelled as (
-      update ${L} set status = case when status = 'queued' then 'cancelled' else status end,
-        finished_at = case when status = 'queued' then ${i}::timestamptz else finished_at end,
-        inbox_seq = case when status = 'queued' then inbox_seq else inbox_seq + 1 end,
-        cancel_requested_at = ${i}::timestamptz, updated_at = ${i}::timestamptz
-      where ${this.fence(e,t,{...r,statuses:Q})} returning id, generation, inbox_seq, status
-    ), connections as (delete from ${N} where ${Gs(e,t)} and exists (select 1 from cancelled where status = 'cancelled')), message as (
-      insert into ${M} (organization_id, task_id, seq, generation, kind, value, at)
-      select ${e}, id, inbox_seq, generation, 'cancel', 'null'::jsonb, ${i}::timestamptz from cancelled where status in ('running', 'waiting')
-    ) select exists(select 1 from cancelled) as accepted`);return!!a?.accepted}async cancelRequested(e,t){let[n]=await z(this.db,()=>this.db.select({at:L.cancelRequestedAt}).from(L).where(this.where(e,t)));return!!n?.at}filter(e,t){let n=t.status?[t.status]:t.statuses,r=t.q?.trim(),i=r&&`%${r.replace(/[\\%_]/g,`\\$&`)}%`;return P(O(L.organizationId,e),n?D(L.status,n):void 0,t.agent?O(L.agent,t.agent):void 0,t.source?O(L.source,t.source):void 0,t.reviewKey?O(L.reviewKey,t.reviewKey):void 0,t.archived===void 0?void 0:t.archived?qn(L.archivedAt):k(L.archivedAt),i?Zn(Gn(A`${L.event}->>'text'`,i),Gn(L.prompt,i),Gn(L.agent,i),Gn(L.publicId,i)):void 0)}pageQuery(e,t){let{before:n}=t,r=t.summary?{publicId:L.publicId,source:L.source,agent:L.agent,flow:L.flow,prompt:L.prompt,event:A`case when ${L.event} is not null then jsonb_build_object('integration', ${L.event}->>'integration', 'type', ${L.event}->>'type', 'text', ${L.event}->>'text') end`.as(`event`),status:L.status,attempts:L.attempts,approval:L.approval,archivedAt:L.archivedAt,createdAt:L.createdAt,startedAt:L.startedAt,finishedAt:L.finishedAt,updatedAt:L.updatedAt}:$n(L),i=this.db.select(r).from(L).where(P(this.filter(e,t),t.since===void 0?void 0:Zn(Jn(L.updatedAt,new Date(t.since)),t.sinceId?P(O(L.updatedAt,new Date(t.since)),Jn(dc(L.publicId),t.sinceId)):void 0),n?this.after(n):void 0)).orderBy(...t.since===void 0?fc(L):pc(L));return t.limit===void 0?i:i.limit(t.limit)}after(e){if(`updatedAt`in e)return Zn(Jn(L.updatedAt,new Date(e.updatedAt)),P(O(L.updatedAt,new Date(e.updatedAt)),Jn(dc(L.publicId),e.id)));let t=A`(${uc(L.createdAt)}, ${dc(L.publicId)}) < (${new Date(e.createdAt).toISOString()}::timestamptz, ${e.id})`;return Zn(Jn(lc(L.status),e.rank),P(O(lc(L.status),e.rank),t))}record(e,t){return t?os({task:os({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,prompt:e.prompt,event:e.event}),status:e.status,attempts:e.attempts,approval:e.approval,archivedAt:e.archivedAt?q(e.archivedAt):void 0,createdAt:q(e.createdAt),startedAt:e.startedAt?q(e.startedAt):void 0,finishedAt:e.finishedAt?q(e.finishedAt):void 0,updatedAt:q(e.updatedAt)}):ps(e)}async list(e,t={}){return(await z(this.db,()=>this.pageQuery(e,t))).map(e=>this.record(e,t.summary))}async changes(e,t){if(!e.length)return{rows:[],deleted:[]};let n=e.map(e=>e.organizationId),r=e.flatMap(e=>e.ids.map(()=>e.organizationId)),i=e.flatMap(e=>e.ids),a=i.length?A`(${L.organizationId}, ${L.publicId}) in (select * from unnest(${A.param(r)}::text[], ${A.param(i)}::text[]))`:A`false`,[o,s]=await Promise.all([z(this.db,()=>this.db.select({organizationId:L.organizationId,publicId:L.publicId,source:L.source,agent:L.agent,flow:L.flow,status:L.status,approval:L.approval,answer:A`case when ${a} then ${L.answer} end`,result:A`case when ${a} then ${L.result} end`,error:A`case when ${a} then ${L.error} end`,attempts:L.attempts,archivedAt:L.archivedAt,createdAt:L.createdAt,startedAt:L.startedAt,finishedAt:L.finishedAt,updatedAt:L.updatedAt}).from(L).where(Zn(P(D(L.organizationId,n),Jn(L.updatedAt,new Date(t))),i.length?a:void 0))),z(this.db,()=>this.db.select().from(er).where(P(D(er.organizationId,n),Jn(er.deletedAt,new Date(t)))))]);return{rows:o.map(e=>({organizationId:e.organizationId,status:os({task:{id:e.publicId,source:e.source,agent:e.agent,flow:e.flow},status:e.status,approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,result:e.result,error:e.error,attempts:e.attempts,archivedAt:e.archivedAt&&q(e.archivedAt),createdAt:q(e.createdAt),startedAt:e.startedAt&&q(e.startedAt),finishedAt:e.finishedAt&&q(e.finishedAt),updatedAt:q(e.updatedAt)})})),deleted:s.map(e=>({organizationId:e.organizationId,id:e.publicId,at:q(e.deletedAt)}))}}countQuery(e,t){return this.db.select({all:A`count(*)::int`.as(`all`),active:A`(count(*) filter (where ${D(L.status,Q)}))::int`.as(`active`),waiting:A`(count(*) filter (where ${O(L.status,`waiting`)}))::int`.as(`waiting`)}).from(L).where(this.filter(e,t))}async counts(e,t={}){let[n]=await z(this.db,()=>this.countQuery(e,t));return n??{all:0,active:0,waiting:0}}async listWithCounts(e,t){let n=this.db.$with(`totals`).as(this.countQuery(e,t)),r=this.db.$with(`page`).as(this.pageQuery(e,{...t,limit:t.limit??20})),i=Object.fromEntries(Object.keys(r._.selectedFields).map(e=>[e,r[e]])),a=await z(this.db,()=>this.db.with(n,r).select({...i,all:n.all,active:n.active,waiting:n.waiting}).from(n).leftJoin(r,A`true`).orderBy(...t.since===void 0?fc({status:i.status,createdAt:i.createdAt,publicId:i.publicId}):pc({updatedAt:i.updatedAt,publicId:i.publicId}))),{all:o=0,active:s=0,waiting:c=0}=a[0]??{};return{items:a.filter(e=>e.publicId!==null&&e.publicId!==void 0).map(e=>this.record(e,t.summary)),counts:{all:o,active:s,waiting:c}}}async runningCount(){let[e]=await z(this.db,()=>this.db.select({value:A`count(*)::int`}).from(L).where(D(L.status,[`running`,`waiting`])));return e?.value??0}async running(){return(await z(this.db,()=>this.db.select().from(L).where(D(L.status,[`running`,`waiting`])))).map(e=>({organizationId:e.organizationId,status:ps(e)}))}async appendLogs(e,t,n,r,i,a,o){let s=n.length?A`, inserted as (
-      insert into ${nr} (organization_id, task_id, seq, at, level, line)
-      select ${e}, accepted.id, entry.seq, to_timestamp(entry.at / 1000.0), entry.level, entry.line
-      from accepted cross join jsonb_to_recordset(${JSON.stringify(n)}::jsonb) as entry(seq int, at bigint, level text, line text)
-    )`:A``,[c]=await ys(this.db,A`
-      with accepted as (
-        update ${L} set log_cursor = ${i.cursor}, log_seq = ${i.seq}, log_bytes = ${i.bytes}, updated_at = ${new Date(a).toISOString()}::timestamptz
-        where ${this.fence(e,t,o)} and coalesce(log_seq, 0) = ${r.seq} and coalesce(log_cursor, -1) = ${r.cursor}
-        returning id
-      ) ${s} select exists (select 1 from accepted) as accepted`);return!!c?.accepted}async readInbox(e,t,n,r){return(await z(this.db,()=>this.db.select({seq:M.seq,generation:M.generation,at:M.at,kind:M.kind,value:M.value}).from(M).innerJoin(L,O(L.id,M.taskId)).where(P(this.where(e,t),O(L.generation,n),D(L.status,Q),O(M.generation,n),A`${M.seq} > ${r}`)).orderBy(F(M.seq)).limit(100))).map(e=>({...e,at:q(e.at)}))}async appendInbox(e,t,n,r,i,a,o){let s=o?A`select key, value from ${N}
-          where key = ${X(e,`delivery`,o.key)}
-            and value->'sending'->>'owner' = ${o.owner}
-            and (expires_at is null or expires_at > ${new Date(i).toISOString()}::timestamptz) for update`:A`select null`,c=o&&dp(o),l=c?A`, context = coalesce(${L.context}, '{}'::jsonb) || jsonb_build_object('admissions',
-          coalesce(${L.context}->'admissions', '{}'::jsonb) || ${JSON.stringify(c)}::jsonb)`:A``,u=A`(${N.value}->'sending'->>'count')::int`,d=A`coalesce((select n from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n)
-          where n <= ${u} and item->>'admission' = ${o?.through??null}::text limit 1), 0)`,[f]=await ys(this.db,A`
-      with held as materialized (${s}), next as (
-        update ${L} set inbox_seq = inbox_seq + 1, updated_at = ${new Date(i).toISOString()}::timestamptz${l}
-        where ${this.fence(e,t,{generation:a,statuses:Q})}
-          and exists(select 1 from held) returning id, inbox_seq, generation
-      ), admitted as (
-        insert into ${M} (organization_id, task_id, seq, generation, kind, value, at)
-        select ${e}, id, inbox_seq, generation, ${n}, ${JSON.stringify(c?{...r,admissions:c}:r??null)}::jsonb, ${new Date(i).toISOString()}::timestamptz from next returning seq
-      ) ${o?A`, acknowledged as (
-        update ${N} set value = (${N.value} - 'sending') || jsonb_build_object(
-          'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${N.value}->'items') with ordinality e(item,n) where n > ${d}), '[]'::jsonb)) ||
-          case when ${u} > ${d} then jsonb_build_object('sending',
-            (${N.value}->'sending') || jsonb_build_object('count', ${u} - ${d}, 'until', ${i+In}::bigint)) else '{}'::jsonb end
-        where key in (select key from held) and exists(select 1 from admitted)
-      )`:A``}
-      select (select seq from admitted) as seq, exists(select 1 from held) as held`);if(o&&!f?.held)throw new fp;return f?.seq==null?void 0:{seq:f.seq,generation:a,at:i,kind:n,value:r}}async fetchInbox(e,t,n,r,i){let[a]=await z(this.db,()=>ys(this.db,A`
-      select coalesce(jsonb_agg(jsonb_build_object('seq', i.seq, 'generation', i.generation, 'at', extract(epoch from i.at) * 1000, 'kind', i.kind, 'value', i.value) order by i.seq) filter (where i.seq is not null), '[]'::jsonb) as entries
-      from ${L} left join ${M} i on i.task_id = ${L.id} and i.generation = ${L.generation} and i.seq > ${i}
-      where ${this.fence(e,t,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})} group by ${L.id}`));return a?.entries}async ackInbox(e,t,n,r){if(r.generation!==void 0&&r.generation!==n.generation)return;let[i]=await ur(this.db,[this.connectionLock(e,t)],A`
-    with current as (
-      select id from ${L} where ${this.fence(e,t,{...r,generation:n.generation,statuses:void 0})}
-        and inbox_seq >= ${n.seq} and (status in ('running', 'waiting') or (status in ('completed', 'failed', 'cancelled') and inbox_ack >= ${n.seq})) for update
-    ), applied as (
-      delete from ${M} where task_id in (select id from current) and generation = ${n.generation} and seq <= ${n.seq} returning seq, kind, value
-    ), answers as (
-      select jsonb_agg(a.value order by a.seq) as value from jsonb_to_recordset(${JSON.stringify(n.answers??[])}::jsonb) a(seq int, value jsonb)
-      where exists (select 1 from applied where applied.seq = a.seq and applied.kind = 'ask')
-    ), updated as (
-      update ${L} set inbox_ack = greatest(inbox_ack, ${n.seq}), answer = coalesce(answer, '[]'::jsonb) || coalesce(answers.value, '[]'::jsonb),
-        status = case when exists(select 1 from applied where kind = 'cancel') then 'cancelled'
-          when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${L.approval}->>'id') then 'running' else status end,
-        approval = case when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${L.approval}->>'id') then null else approval end,
-        finished_at = case when exists(select 1 from applied where kind = 'cancel') then now() else finished_at end,
-        updated_at = now()
-      from answers where id in (select id from current) returning status
-    ), connections as (delete from ${N} where ${Gs(e,t)} and exists (select 1 from updated where status = 'cancelled'))
-    select exists (select 1 from current) as accepted, (select status from updated) as status`);return i?.accepted?i.status??void 0:void 0}async pendingInbox(e){return(await z(this.db,()=>this.db.select().from(L).where(P(e===void 0?void 0:O(L.organizationId,e),D(L.status,[`running`,`waiting`]),A`exists (select 1 from ${M} where ${M.taskId} = ${L.id} and ${M.generation} = ${L.generation})`)))).map(e=>({organizationId:e.organizationId,status:ps(e)}))}};const hc=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function gc(e,t,n){n.length&&await e.store.withAppLock(`connection-warnings:${t}`,async r=>{let i=r instanceof $s?new mc(r.db):e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`connection-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`connection-warning:${t}:${e}`,{at:c});return}}})}async function _c(e,t,n,r,i,a=0){let o=vc(n,r,i,a);return await e.putMany(`tasklog`,o.lines.map(({seq:e,...n})=>({id:hc(t,e),value:n}))),{seq:o.seq,bytes:o.bytes}}function vc(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function yc(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:hc(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=It(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function bc(e,t,n=!1){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]);n&&i.delete(a);let o=i.get(a);return o||(o=cd(e,t).then(e=>{let t=e.sort((e,t)=>t.length-e.length);return e=>t.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e)}).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.()),o}async function xc(e,t,n){let r=await bc(e,t),i=e=>typeof e==`string`?r(e):Array.isArray(e)?e.map(i):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[r(e),i(t)])):e,a=e=>{try{return JSON.stringify(i(JSON.parse(e)))}catch{return r(e)}};for(let r=0;r<5;r++){let i=r===0&&e.callbackTask===t?t:await e.store.get(`task`,t.task.id);if(!i||i.attempts!==t.attempts||i.tokenHash!==t.tokenHash||i.generation!==t.generation)return`stale`;let o=i.logCursor??-1,s=n.filter(e=>e.seq>o);if(!s.length)return`ok`;if(i.logsComplete||s[0].seq!==o+1)return`gap`;let c=(e.now??Date.now)(),l=vc(s.map(e=>({...e,line:a(e.line)})),i.logSeq??0,c,i.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,l.lines,{seq:i.logSeq??0,cursor:o},{seq:l.seq,cursor:s.at(-1).seq,bytes:l.bytes},c,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}function Sc(e,t){return zr(e,`link-start`,`*`,JSON.stringify(t),3e5)}function Cc(e,t,n){return`thread:${e}:${t}:${n}`}async function wc(e,t,n,r){let i={};if(r)i.user={name:r.name,email:r.email};else if(r===void 0&&e.auth&&n.actor.id){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);r&&(i.user={name:r.name,email:r.email})}return i}const Tc=2592e6,Ec=36e5;async function Dc(e,t){if(!t.chat)return{};let n=Oc(t);return e.store.conversationState(n)}const Oc=e=>Cc(e.appId,e.installationId,e.chat.thread.id),kc=e=>e.slice(0,e.indexOf(`:`)),Ac=e=>e.channelId?.slice((e.adapterName?.length??-1)+1)??``;function jc(e,t,n,r){return`known:${e}:${t}:${n}:${r}`}async function Mc(e,t){return t.chat?(await e.store.conversationState(Oc(t))).status:void 0}function Nc(e,t,n){let r=e.chat?.thread;if(!r)return;let i=r.id.slice((r.channelId?.length??-1)+1);return{key:Oc(e),record:{at:n,taskId:t,...e.chat?.message?{seen:e.chat.message.id}:{}},root:jc(e.appId,e.installationId,Ac(r),i),ttlMs:Tc}}async function Pc(e,t,n,r){let i=Nc(t,n,r);i&&await e.store.putMany(`delivery`,[{id:i.key,value:i.record},{id:i.root,value:{at:r}}],{ttlMs:Tc})}function Fc(e,t){let n=e.chat?.thread;return n?[...new Set([t].flat().filter(Boolean))].map(t=>jc(e.appId,e.installationId,Ac(n),t)):[]}async function Ic(e,t,n,r){await e.store.putMany(`delivery`,Fc(t,n).map(e=>({id:e,value:{at:r}})),{ttlMs:Tc})}async function Lc(e,t,n,r){if(t.chat?.message)return e.store.markConversation(Oc(t),n,t.chat.message.id,r,Tc)}function Rc(e){let t=e.conversation?.unseen;return e.chat&&t!==void 0?{key:Oc(e),version:t.version,...t.epoch?{epoch:t.epoch}:{}}:void 0}async function zc(e,t,n){await e.store.appendUnseen(Oc(t),n,Tc)}async function Bc(e,t){let n=Rc(t);n&&await e.store.acknowledgeUnseen(n.key,n.version,n.epoch)}function Vc(e,t,n){let r=bt(n.definition.integrations[e.id]);return!t.builtin&&Object.entries(e.events).some(([e,t])=>t.noisy&&r.includes(e))}async function Hc(e,t,n,r){let i=n.chat?.thread;if(!i)return n;let a=i.isDM===!0,o=t.events[n.type]?.on===`mention`||n.chat?.message?.isMention===!0,s=a||o||t.answersEveryPrompt===!0,[c,l]=await Promise.all([r.loaded?r.unseen??{messages:[],more:0}:e.store.get(`delivery`,`since:${Oc(n)}`).then(e=>e??{messages:[],more:0}),t.conversation?t.conversation(n,{token:r.token,fetch:e.fetch??fetch,delivered:r.delivered,...r.existing?.seen?{after:r.existing.seen}:{}}).catch(e=>(console.error(`coder server: ${t.id} conversation facts failed`,e),{})):{}]),u=new Set(c.messages.flatMap(e=>e.id??[])),d=new Map(l.since?.flatMap(e=>e.id?[[e.id,e]]:[])),f=[...c.messages.map(({sequence:e,...t})=>t.id&&d.get(t.id)||t),...(l.since??[]).filter(e=>!e.id||!u.has(e.id))],p=f.slice(0,50),m=(l.since?0:c.more)+f.length-p.length,h=r.existing||a?void 0:l.index??n.conversation?.index;return{...n,mustReply:s,conversation:{...h===void 0?{}:{index:h},...c.messages.length||c.more?{unseen:{version:c.version??c.messages.length+c.more,epoch:c.epoch}}:{},...p.length?{since:p}:{},...m?{more:m}:{}}}}async function Uc(e,t,n){for(;;){let r=await e.store.claimBatch(t,n);if(r!==null)return r;await new Promise(e=>setTimeout(e,500))}}async function Wc(e,t,n,r,i){return e.store.finishBatch(t,n,r,i)}async function Gc(e,t,n,r){let i=await e.store.get(`task`,t.task.id)??t,a=kc(n),o=await Ep(e,t.task.id,-1,i.generation??0),s=new Set([i.task.context?.admissions?.[a],...o.map(e=>e.value?.admissions?.[a])]);return{fresh:i,through:r.reduce((e,t,n)=>s.has(t.admission)?n+1:e,0)}}async function Kc(e,t,n,r){if(!Q.includes(t.status))return!1;let i=t.status!==`queued`&&qc(e,t.task)?Dd(e.local.cwd,t.task.id,!1):void 0;return i&&!Q.includes(i.status)?!1:!!await Tp(e,t,`steer`,{text:n},r)}const qc=(e,t)=>!!e.local&&!t.event?.repo&&t.runner===`local`&&!t.runnerId;async function Jc(e,t,n,r,i){let{task:a}=t,o={mustReply:r,admissions:{...a.context?.admissions,...i}};if(qc(e,a))return Od(e,e.local.cwd,a.id,n,void 0,{},o);try{await yo(e,{...t,task:{...a,context:{...a.context,...o}}},n)}catch(e){if(e instanceof W&&e.status===409)return!1;throw e}return!0}function Yc(e,t){let n=t.catch(e=>console.error(`coder server: conversation batch failed`,e));e.waitUntil&&e.waitUntil(n)}function Xc(e){let t=t=>he(e.slice(0,t).map(e=>e.event),e[t-1].user),n=t(1);if(n.length>65536){let t=e[0].event,n=n=>he([{...t,text:t.text.slice(0,n)+`
-[message truncated]`}],e[0].user);n(0).length>65536&&(t={...t,conversation:{...t.conversation,since:void 0,more:(t.conversation?.more??0)+(t.conversation?.since?.length??0)},promptContext:void 0,chat:t.chat?{thread:t.chat.thread,message:t.chat.message?{...t.chat.message,attachments:[],links:[]}:void 0}:void 0});let r=0,i=t.text.length;for(;r<i;){let e=Math.ceil((r+i)/2);n(e).length<=65536?r=e:i=e-1}return{text:n(r),count:1}}let r=1;for(;r<e.length;){let e=t(r+1);if(e.length>65536)break;n=e,r++}return{text:n,count:r}}async function Zc(e,t,n,r,i,a){let o=`batch:${Oc(n)}`;if(!(a?a.batch:await e.store.get(`delivery`,o))?.items.length&&await Kc(e,t,he([n],r))){await Bc(e,n),await Lc(e,n,t.task.id,i());return}let s=Tr(),c=n.chat?.message,l=c?{...n,chat:{thread:n.chat.thread,message:{...c,formatted:{type:`root`,children:[]},raw:null,attachments:c.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}}}:n;await e.store.appendBatch(o,s,[{admission:s,event:l,user:r}],i(),Ec),await Bc(e,n),Yc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.steerBatchMs??5e3));let n=await Uc(e,o,s);if(!n)return;let r=n.items.map((e,t)=>t===n.items.length-1?{...e,event:{...e.event,mustReply:e.event.mustReply||n.mustReply,conversation:{...e.event.conversation,more:(e.event.conversation?.more??0)+(n.more??0)}}}:e),a=!1,c=!1,l=!1;try{for(let n=0;n<r.length;){let{fresh:a,through:u}=await Gc(e,t,o,r);if(u>n){if(c=!0,!await Wc(e,o,s,!0,r[u-1].admission))return;n=u;continue}let{text:d,count:f}=Xc(r.slice(n)),p=r.slice(n,n+f),m=p.at(-1).admission,h=await Kc(e,a,d,{key:o,owner:s,through:m}),g=h||await Jc(e,a,d,p.some(e=>e.event.mustReply===!0),{[kc(o)]:m});if(!g&&!l){l=!0;continue}if(!g)throw Error(`Conversation task did not accept the batch`);if(c=!0,!h&&!await Wc(e,o,s,!0,m))return;await Lc(e,p.at(-1).event,t.task.id,i()),n+=f}a=!0}catch(e){if(!(e instanceof fp))throw e}finally{a||await Wc(e,o,s,!1),c&&await Ro(e,!0,!1,!0)}})())}async function Qc(e,t,n,r){let i=await Mc(e,t);if(!i||!Q.includes(i.status))return;let a=`reactions:${Oc(t)}`,o=Tr();await e.store.appendBatch(a,o,[{...n,admission:o}],r(),Ec),Yc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.reactionBatchMs??3e4));let n=await Uc(e,a,o);if(!n)return;let r=!1;try{let{fresh:s,through:c}=await Gc(e,i,a,n.items),l=n.items.slice(c);if(c&&!await Wc(e,a,o,!0,n.items[c-1].admission))return;if(!l.length){r=!0;return}let u=new Map;for(let{emoji:e,by:t,on:n}of l){let r=u.get(`${e}\n${n}`)??{emoji:e,by:[],on:n};r.by.includes(t)||r.by.push(t),u.set(`${e}\n${n}`,r)}r=await Kc(e,s,be({...t,conversation:{...t.conversation,more:n.more}},[...u.values()]),{key:a,owner:o,through:l.at(-1).admission})}catch(e){if(!(e instanceof fp))throw e}finally{r||await Wc(e,a,o,!1)}})())}const $c=6e4,el=864e5,tl=262144,nl=[`model`,`engine`,`effort`],rl=[`Usage:`,"• `/setup model <name>`. Sets the engine model. Also accepts `engine` and `effort`.","• `/setup show`. Shows the current settings."].join(`
-`);function il(e){return e.type===`command`}function al(e){let t=Object.entries(e??{}).filter(([,e])=>e);return t.length?`Current settings:\n${t.map(([e,t])=>`• ${e}: \`${t}\``).join(`
-`)}`:`No settings yet. A workspace admin can configure this agent in the dashboard.`}function ol(e){let[t=``,...n]=e.text.trim().split(/\s+/);return nl.includes(t)&&n.join(` `).trim()!==``}async function sl(e,t,n){let[r=``,...i]=e.text.trim().split(/\s+/),a=i.join(` `).trim(),o={...t.settings},s;return r?r===`show`?s=al(t.settings):nl.includes(r)?a?(o[r]=a,s=`${r} set to \`${a}\`.`):s=`Give a value: \`/setup ${r} <name>\`.`:s=`Unknown setting \`${r}\`.\n${rl}`:s=rl,JSON.stringify(o)!==JSON.stringify(t.settings??{})&&await Ga(n,`installation`,t.id,{settings:o}),s}async function cl(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}async function ll(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}async function ul(e,t,n,r){if(!t.auth.canWrite)return;let i=await(await r(n.integration)).token();return t.auth.canWrite(n,i,e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed for ${n.appId} event ${n.deliveryId}`,e),null))}async function dl(e,t,n,r,i){let a=e.config.publicUrl?.replace(/\/$/,``);if(!a)return;let o=e=>`Link your Coder account so I can work for you here: ${e}`;if(t.auth.user){await i.post(o(`${a}/connect/${t.id}?installation=${encodeURIComponent(n.id)}`));return}let s=await Sc(e,{platform:t.id,platformUserId:r.actor.id});await i.whisper(o(`${a}/connect?token=${encodeURIComponent(s)}`))}async function fl(e,t,n){return`No model is configured yet. If you have access to it, [add one here](${await gf(e,t,n)}).`}async function pl(e,t,n){return`There was a problem with your connected model. If you have access to it, [check it here](${await gf(e,t,n)}).`}async function ml(e,t,n){let r=e.config.publicUrl?.replace(/\/$/,``);return r?`${r}${fh(n,`/tasks/${t}`)}`:void 0}async function hl(e,t,n){let r=t.chat?.thread.id;if(!e.local||t.repo||!r)return;let i=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(({value:e})=>{let i=e.pending?.task;return i?.flow==="default"&&i.agent===n&&i.event?.appId===t.appId&&i.event.installationId===t.installationId&&i.event.chat?.thread.id===r&&e.pending?.taskId})?.value.pending;if(!i?.task)return;let a=await wd(e,i.task,i.taskId);return await Pc(e,i.task.event,a.task.id,(e.now??Date.now)()),await e.store.get(`task`,a.task.id)??a}async function gl(e,t,n,r,i,a,o){let s=`delivery:${t.id}:${n.id}:${i.installationId}:${i.chat?.thread.id??``}:${i.deliveryId}`,c=await cl(e,n,i);if(!c)return{};if(e.local&&await(e.syncAgent?.(n.agent)??kn(e.store,e.local.cwd,e.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e)),!e.local){let l=Tr(),u={delivery:{key:s,owner:l,at:a(),ttlMs:$c},agent:n.agent,...i.chat?{conversation:Cc(i.appId,i.installationId,i.chat.thread.id)}:{},...i.actor.id?{actor:{platform:t.id,id:i.actor.id}}:{},installation:c,files:Ta(c,i)},{claimed:d,loaded:f}=await e.store.dispatchState(u);if(!d)return{};let p=f?{...e,store:ko(e.store,f,u)}:e;if((await p.store.get(`agent`,n.agent))?.settings?.disabled)return await e.store.updateDelivery(s,l,void 0),{};try{let u=await vl(p,t,n,r,i,c,a,o,s,{owner:l,loaded:f&&{...f,store:p.store}});return!u.work&&!u.taskId&&!u.steered&&await e.store.updateDelivery(s,l,{at:a()},{ttlMs:el}),await u.work,u.taskId?{taskId:u.taskId}:{}}catch(t){let n=await e.store.get(`delivery`,s).catch(()=>void 0),r=n?.pending?.task?n.pending:void 0;throw await e.store.updateDelivery(s,l,r?{at:a(),pending:r}:void 0).catch(()=>{}),t}}if((await e.store.get(`agent`,n.agent))?.settings?.disabled||await e.store.get(`delivery`,s).then(e=>e&&!e.pending))return{};let l=JSON.stringify([i.appId,i.installationId,i.chat?.thread.id]),u=e.store.handoffs??=new Map,d=(u.get(l)??Promise.resolve()).catch(()=>{}).then(async()=>{let l=await vl(e,t,n,r,i,c,a,o,s);return await l.work,l});u.set(l,d);try{return await d}finally{u.get(l)===d&&u.delete(l)}}async function _l(e,t,n,r,i,a,o,s){let c=s??Tr(),l=a&&(a.flow==="default"?ee():Pt()),u=l&&a?.taskUrl?await ml(e,l,await(o?.()??dh(e))):void 0,d={event:n,...a?{task:{...a,...u?{taskUrl:u}:{}},taskId:l}:{}};if(e.local&&!n.repo){let n=await e.store.get(`delivery`,t);if(n&&!n.pending)return{};if(d=n?.pending??d,d.task&&!d.taskId)throw Error(`Local delivery has no task binding`);await e.store.put(`delivery`,t,{at:r(),owner:c,pending:d})}else if(!s&&!await e.store.create(`delivery`,t,{at:r(),owner:c,pending:d},{ttlMs:$c}))return{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,c,{at:r(),owner:c,pending:d},{ttlMs:$c})}).catch(()=>{})},$c/3);try{await i(d),a&&clearInterval(a),await n,await e.store.updateDelivery(t,c,{at:r()},{ttlMs:el})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!d.task)&&await e.store.updateDelivery(t,c,void 0).catch(()=>{}),r}})()}}async function vl(e,t,n,r,i,a,o,s,c,l){let u,d=()=>u??=dh(e,l?.loaded?.workspace),f=t=>_l(e,c,i,o,t,void 0,d,l?.owner);if(il(i))return e.auth&&ol(i)&&!await ll(e,t,i)?f(()=>dl(e,t,a,i,s)):f(()=>sl(i,a,e.store).then(e=>s.whisper(e)).then(()=>{}));let p=Yu(e,t,a,i,r),[m,h]=await Promise.all([e.loadAgent(n,a,i,p,l?.loaded),e.auth&&i.actor.id?ll(e,t,i):void 0]),g=Jt(i,m);if(!g){let t=i.chat?.message;return t&&await zc(e,i,{id:t.id,author:t.author.userName||t.author.userId,text:i.text,sentAt:t.metadata.dateSent}),{}}let _=await ul(e,t,i,p);if(_===null)return f(async()=>{await s.problem(`Coder could not check your access to this conversation.`)});if(_===!1)return{};let v=(t,n,r)=>_l(e,c,i,o,async t=>{let i=t.task,a=await wd(e,i,t.taskId);await Promise.all([Pc(e,i.event,a.task.id,o()),Bc(e,i.event)]),await op(e,a.task.id,[...p.minted,...r?[r]:[]]),n&&Ye(e.local.cwd,a.task.id,{kind:`status`,message:n})},t,d);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,c);if(t?.pending?.task){let e=t.pending.task;return e.agent!==m.id||e.flow!==g.flow?{}:v(e)}}let y=!!i.chat&&g.flow==="default",ee=y?await Dc(e,i):void 0,te=ee?.record,ne=y?await Hc(e,t,i,{token:async()=>(await p(i.integration))?.token(),delivered:Vc(t,n,m),unseen:ee?.unseen,loaded:!0,...te?{existing:te}:{}}):i,re=h?{name:h.name,email:h.email}:void 0,ie=y?ee?.status??await hl(e,ne,m.id):void 0;if(ie)return f(()=>Zc(e,ie,ne,re,o,ee));let ae=!y||ne.chat?.thread.isDM===!0,b=ae?h?.id:void 0,oe=ae?g.actAs:void 0,se=ft(m),[ce,le,ue,de,fe]=await Promise.all([yn(e,{requester:b,agent:m.definition.runner}),rf(e,se,b),wc(e,t,i,h??null),ua(e,b,m.usage?.connections),oe===`requester`?qu(e,t,i,r).catch(()=>void 0):void 0]),{engine:pe,credential:me,usable:ge,chain:_e,credentials:ve}=le;if(!ge&&ce.runner!==`http`)return ne.mustReply??t.events[i.type]?.on===`mention`?f(async()=>{let r=`setup:${n.id}:${i.chat?.thread.id??i.deliveryId}`,a=i.deliveryId;if(!(!(t.answersEveryPrompt||await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5}))&&(await e.store.get(`delivery`,r))?.owner!==a))try{await s.problem(await fl(e,pe,await d()))}catch(n){throw t.answersEveryPrompt||await e.store.updateDelivery(r,a,void 0),n}}):{};let ye=e.auth&&oe===`requester`&&!fe?`Acting as the app because the requester's account has no usable ${t.name} token. [Connect your account](${e.config.publicUrl?.replace(/\/$/,``)??``}${fh(await d(),`/settings/connections`)}).`:void 0;if(ye&&(ue.instructions=[ue.instructions,ye,`Include the account connection link in your reply.`].filter(Boolean).join(`
-
-`)),Buffer.byteLength(JSON.stringify(i))>tl)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(ue))>tl)throw Error(`Task context exceeds 256 KB`);let be=`${i.deliveryId}-${m.id}`,xe=await ml(e,be,await d()),Se={id:be,source:i.integration,agent:m.id,flow:g.flow,...ce,permissions:g.permissions??se.permissions,event:ne,failureReply:await pl(e,pe,await d()),...xe?{taskUrl:xe}:{},author:t.author?.(n.name)??n.name,definition:m.definition,engineChain:_e,engineCredentials:ve,...me?{credential:me}:{},...b?{requester:b}:{},...m.files?{files:m.files}:{},usage:{...m.usage,engine:pe},tools:g.tools,connections:de,...Object.keys(ue).length?{context:ue}:{}};if(e.local&&!i.repo&&ce.runner===`local`&&!ce.runnerId)return v(Se,ye,fe);let Ce=o(),we=await e.queue.deliver(e.organizationId,Se,Ce,{key:c,ttlMs:el,...l?{owner:l.owner}:{}},y?he([ne],re):void 0,e.config.maxQueued??1e3,!0,{conversation:Nc(ne,be,Ce),unseen:Rc(ne),secrets:ap(e,be,[...p.minted,...fe?[fe]:[]])});return ye&&we.taskId&&await gc(e,we.taskId,[ye]),we}var yl=r({failedDeliveries:()=>xl,recordFailure:()=>bl});async function bl(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await Fi(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
-`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??Tr()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:el})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a))try{await(await a()).problem(n instanceof yt?n.message:`Coder could not handle this message. If you run this server, check its logs. Otherwise report it at ${e.config.issuesUrl}.`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function xl(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}var Sl=r({adapterContext:()=>Hl,addressedTo:()=>jl,chatFor:()=>Ul,dashUrl:()=>Vl,deliver:()=>Pl,eventReplies:()=>Il,later:()=>Nl,threadReplies:()=>Fl});async function Cl(e,t,n){let r=`${t.id}:${n}`,i=await Fi(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function wl(e,t,n,r,i){let{tenant:a,installation:o}=await Cl(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return Ku(a,e.integrations[t.integration],o,n,i)}function Tl(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const El=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),Dl=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),Ol=`(?![\\w-]|\\.\\w)`,kl=e=>e.replace(/[ \t]{2,}/g,` `).trim();function Al(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${El(t)}${Ol}`,`gi`),`$1`),e);return n===e?void 0:kl(n)}function jl(e,t){let n=Al(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${El(t)}${Ol}[\\s,:;!.?-]*`,`i`);return r.test(e)?kl(e.replace(r,``)):void 0}async function Ml(e,t,n,r,i,a){if(n.builtin)return jl(a,n.agent)!==void 0;let o=await Fi(e,`${n.id}:${r.id}`);if(t.events[i]?.on!==`message`||!o)return!1;o.local&&await(o.syncAgent?.(n.agent)??kn(o.store,o.local.cwd,o.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e));let{record:s,version:c}=await Nn(o.store,n.agent);return!s||!c||!s.settings?.disabled&&pt(c.definition.integrations[t.id],i)!==void 0}function Nl(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),bl(e,t,r,n.installationId,n,()=>i??Il(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function Pl(e,t,n,r,i,a,o){if(n.builtin&&t.app.builtin!==`shared`)return;let s=`${n.id}:${i.installationId}`,c=await Fi(e,s);if(!c||!n.builtin&&c.organizationId!==e.organizationId)return;let l=c.boundInstallation?.installation.id===s?c.boundInstallation.installation:await c.store.get(`installation`,s);if(l?.covers&&!l.covers.includes(i.within??``))return;let u=await gl(c,t,n,r,i,e.now??Date.now,a);if(await u.work,u.taskId)return await o?.(),await Ro(c,!0,!1,!0),u.taskId}function Fl(e,t,n,r,i){let a=async(t,a=!1)=>{let o=await Ht(e,t,r,n,a).catch(async e=>{throw await i?.(e),e});return{id:o.at(-1)?.id,ids:o.map(e=>e.id)}},o=e.adapter.postProblem;return{post:a,react:(t,r)=>Bt(e,t,r??(typeof n==`string`?n:n?.id)),problem:t=>o?o.call(e.adapter,e.id,t):a(t),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null)}}async function Il(e,t,n){if(!n.chat)return{post:async()=>{},problem:async()=>{},whisper:async()=>{}};let r=await Ul(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),Fl(r.thread(n.chat.thread.id),n.actor.id||void 0,n.chat.message?.id||void 0,e.integrations[t.integration]?.replyLimit,r=>Ll(e,t,n.installationId,r))}async function Ll(e,t,n,r){if(!e.integrations[t.integration]?.isUninstalled?.(r))return;let i=`${t.id}:${n}`,a=await Fi(e,i);a&&await Gu(a.store,i,(e.now??Date.now)())}function Rl(e,t,n,r,i,a,o=a.id){let s=r===`message`&&t.builtin?jl(a.text,t.agent):void 0;if(r===`message`&&t.builtin&&s===void 0)return;let c=Dl(e,s===void 0?r:`mention`);if(!c||a.author.isBot===!0)return;let l=e.event?e.event(c,i,a,t):{};if(!l)return;let u=(l.type??c)===Dl(e,`mention`)?s??Al(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:c,appId:t.id,installationId:n.id,deliveryId:Sr(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${o}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:u,chat:{thread:Tl(i.toJSON()),message:Tl(a.toJSON())},...n.index===void 0?{}:{conversation:{index:n.index}},...n.within?{within:n.within}:{},...n.repo?{repo:n.repo}:{},...l}}async function zl(e,t,n,r,i){let a=await Bl(e,t,n).catch(e=>{console.error(`coder server: conversation workspace lookup failed`,e)});a&&await zc(a,{appId:t.id,installationId:n.id,chat:{thread:Tl(r.toJSON())}},{author:i.author.userName||i.author.userId,text:i.text,sentAt:i.metadata.dateSent.toISOString()}).catch(e=>console.error(`coder server: could not keep a message for ${t.id}`,e))}async function Bl(e,t,n){let{tenant:r,installation:i}=await Cl(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.within??``));return i&&a?r:void 0}async function Vl(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${fh(await dh(e))}`}function Hl(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>wl(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await Cl(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await Cl(e,n,t);!i||!a||a.self||await Ga(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:(r,a)=>Ml(e,t,n,i,r,a).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async t=>{let r=await Fi(e,`${n.id}:${i.id}`),a=Cc(n.id,i.id,t);return!!await r?.store.get(`delivery`,a)},knows:async(t,r)=>{let a=await Fi(e,`${n.id}:${i.id}`),o=jc(n.id,i.id,t,r);return!!await a?.store.get(`delivery`,o)},agent:async t=>{let r=await Bl(e,n,i),{record:a,version:o}=r?await Nn(r.store,t??n.agent):{};if(!a||!o)return;let{definition:s}=o,c=a.description??s.description;return{slug:a.id,name:a.name,...c?{description:c}:{},listens:Object.entries(s.integrations).flatMap(([t,n])=>{let r=bt(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}},task:async t=>{let r=await Bl(e,n,i),a=r&&await r.store.get(`task`,t);if(!a)return;let{task:o}=a,s=o.event?.integration;return{id:o.id,title:o.name?.trim()||o.prompt?.trim()||o.event?.text?.trim()||`${o.event?.type??`task`} on ${o.agent}`,agent:o.agent,status:a.status,from:s&&e.integrations[s]?.name||o.source,startedAt:a.startedAt??a.createdAt}}}:{},privateState:()=>new Vn,...e.config.publicUrl?{publicUrl:e.config.publicUrl}:{},...a?{dashUrl:a}:{}}}async function Ul(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=new Map;e={...e,fetch:r.requestFetch?.(e.fetch??fetch,n?.within??n?.id)??e.fetch,syncAgent:t=>(i.has(t)||i.set(t,kn(e.store,e.local.cwd,e.integrations,t)),i.get(t))};let a=E(e.config,t.credentials),o=await r.adapter(Hl(e,r,t,a,n)),s=Bn(e.chatState??new Vn,t.id),c=new Et({userName:t.name,adapters:{[r.id]:o},state:{...s,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:el,logger:`error`});if(!n)return c;let l=async(i,o,s,c)=>{let l=Rl(r,t,n,i,o,s,c);if(!l){s.author.isBot!==!0&&await zl(e,t,n,o,s);return}let u=Fl(o,s.author,s,r.replyLimit,r=>Ll(e,t,n.id,r));Nl(e,t,l,Pl(e,r,t,a,l,u),u)};return c.onNewMention((e,t)=>l(`mention`,e,t)),c.onNewMessage(/[\s\S]*/,(e,t)=>l(`message`,e,t)),c.onMessageUpdated((e,t)=>l(t.isMention?`mention`:`message`,e,t,`edit\n${t.id}\n${t.metadata.editedAt?.toISOString()??``}`)),c.onReaction(async i=>{if(!i.added||i.user.isBot===!0)return;let a=i.thread,o=await Bl(e,t,n);if(!o)return;let s={integration:r.id,type:`reactions`,appId:t.id,installationId:n.id,deliveryId:`reaction-${i.messageId}-${i.user.userId}-${i.rawEmoji}`,actor:{id:i.user.userId,login:i.user.userName},text:``,chat:{thread:Tl(a.toJSON())},...n.within?{within:n.within}:{}},c=Qc(o,s,{emoji:`:${i.emoji.name}:`,by:i.user.userName||i.user.userId,on:i.message?.text??i.messageId},e.now??Date.now);Nl(e,t,s,c)}),c.onSlashCommand(`/setup`,async i=>{let o=Dl(r,`command`);if(!o)return;let s=e=>i.channel.postEphemeral(i.user,e,{fallbackToDM:!1}),c={integration:r.id,type:o,appId:t.id,installationId:n.id,deliveryId:Sr(`sha256`).update(`${t.id}\n${n.id}\n${i.channel.id}\n${i.triggerId??i.text}`).digest(`base64url`).slice(0,22),actor:{id:i.user.userId,...i.user.userName?{login:i.user.userName}:{}},text:i.text.trim(),...n.within?{within:n.within}:{}},l={post:s,problem:s,whisper:s};Nl(e,t,c,Pl(e,r,t,a,c,l),l)}),c}function Wl(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));En(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function Gl(e,t,n,r){let i=n.id,a=t.operatorApp??!1?`*`:t.session?.user.id??`anonymous`,o=rn(r.searchParams.get(`state`)),s=gh(o?.back),c=t.integrations[i];if(!c)return $(t,`unknown-integration`,{platform:i},s);let l=t.config.publicUrl;if(!l)return $(t,`no-public-url`,{},s);let u=r.searchParams.get(`app`),d=o?.tx?await qr(t,o.tx,`install`,a):void 0;if(!d||u&&u!==d)return $(t,`install-expired`,{platform:i,appId:u??void 0},s);let f=await t.store.get(`app`,u??d);if(!f)return $(t,`unknown-app`,{platform:i},s);let p=E(t.config,f.credentials);return w(c.app.installUrl(f,p,{publicUrl:l,state:r.searchParams.get(`state`)??sn({})}))}async function Kl(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:E(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:Ii(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await zr(u,`install`,t.session?.user.id??`anonymous`,s.id);return w(n.app.installUrl(s,E(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:sn({tx:d,installation:c}),installation:c}))}async function ql(e,t,n,r){let i=n.id,a=t.operatorApp??!1,o=a?`*`:t.session?.user.id??`anonymous`,s=rn(r.searchParams.get(`state`)),c=s?.tx&&t.session?Ii(t,t.session,Hr(t,s.tx)):void 0,l=c?{...t,...c}:t,u=gh(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await qr(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return Kl(e,l,d,f);if(!m||p&&p!==m||!await Gr(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m);return _?Jl(e,l,d,_,u,s?.installation):$(l,`connected`,{platform:i},u)}async function Jl(e,t,n,r,i,a){let o=n.id,s=t.fetch??fetch,c=t.now?.()??Date.now(),l=t.config.publicUrl;if(r.builtin&&n.app.builtin!==`shared`)return $(t,`unknown-app`,{platform:o},i);let u=i??(r.builtin?void 0:mh(t,r.agent)),d=E(t.config,r.credentials),f=await n.app.installCallback(e,{app:r,credentials:d,publicUrl:l,fetch:s,tokens:ba(t,n.id),...a?{installation:a}:{}}).catch(e=>e instanceof xt?$(t,e.code,{platform:o,appId:r.id,error:e.error},u):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:o,appId:r.id},u)));if(f instanceof Response)return f;let p=`${r.id}:${f.platformInstallId}`,m=t.session;f.user&&m&&t.auth&&await t.auth.link(m.user,o,f.user.id,{organizations:m.organizations.map(e=>e.id),...f.user.token?{token:T(t.config,f.user.token)}:{}});let h=await t.store.get(`installation`,p),g={...h,id:p,app:r.id,integration:o,account:f.account??h?.account??{login:`unknown`},...f.token?{token:T(t.config,f.token)}:{},...f.installer?{installer:f.installer}:{},...f.self?{self:f.self}:{},...f.covers?{covers:f.covers}:{},createdAt:h?.createdAt??c};if(delete g.deletedAt,delete g.uninstalled,n.repos){let e=await n.auth.token(f.token?{...g,token:f.token}:g,d,void 0,{fetch:s});g.repos=await n.repos.list(g,e,s)}try{g=await Wl(t.store,p,e=>f.covers===null?{...g,covers:e?.covers??[]}:g,c)}catch(e){return e instanceof Dn?$(t,`installation-bound`,{platform:o,account:g.account.login},u):$(t,`installation-taken`,{platform:o},u)}return g.installer&&n.welcome&&await Yl(t,n,r,d,f.platformInstallId,g.installer),$(t,`connected`,{platform:o,account:g.account.login},u)}async function Yl(e,t,n,r,i,a){try{let[{adapterContext:o,dashUrl:s},{record:c,version:l}]=await Promise.all([Promise.resolve().then(()=>Sl),Nn(e.store,n.agent)]),{engine:u,usable:d}=await rf(e,{engine:c?.settings?.engine??l?.definition.engine,model:c?.settings?.model??l?.definition.model},e.session?.user.id),f=o(e,t,n,r,{id:i},await s(e)),p=`${e.config.publicUrl.replace(/\/$/,``)}${mh(e,n.agent)}`;await t.welcome(f,a,{open:p,...d?{}:{setup:await gf(e,u)}})}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const Xl=/^[a-z0-9][a-z0-9_-]*$/i;async function Zl(e,t){let n=Xe(Ke(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return C(n);try{let{integration:r,token:i}=await mo(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>Xl.test(e));return C([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return lu(e)}}async function Ql(e,t){if(!t)throw new W(`repo is required`);let{integration:n,token:r}=await mo(e,t);return C(await n.repos?.pullRequests(t,r)??[])}async function $l(e,t){try{return C(du(await go(e,`dashboard`,t)),201)}catch(e){return lu(e)}}async function eu(e,t,n,r){return Zl(t,r.searchParams.get(`repo`)).catch(lu)}async function tu(e,t,n,r){return Ql(t,r.searchParams.get(`repo`)).catch(lu)}async function nu(e,t,n,r){return Ru(e).then(e=>$l(t,{...e,flow:n.name})).catch(lu)}async function ru(e,t,n,r){return Ru(e).then(({post:e,...n})=>{if(!n.repo||!n.pr)throw new W(`repo and pr are required`);return $l(t,{...n,flow:`review`,args:{post:e===!0}})}).catch(lu)}function iu(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(C({tasks:n},202))}async function au(e,t,n){let r=t.repos?.pullRequest(n)===void 0?void 0:await Fi(e,`${n.appId}:${n.installationId}`);if(!r)return;let i=xp({flow:`review`,event:n});if(!i)return;let a=await r.queue.list(r.organizationId,{status:`queued`,reviewKey:i}),o=(e.now??Date.now)(),s=JSON.stringify({kind:`status`,message:`Replaced by a newer review of this pull request.`});for(let e of a.filter(e=>e.task.event?.type===n.type&&e.task.event.deliveryId!==n.deliveryId))await r.queue.cancel(r.organizationId,e.task.id,o,{statuses:[`queued`]})&&await _c(r.store,e.task.id,[{level:`sys`,line:s}],e.logSeq??0,o,e.logBytes??0)}async function ou(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`uninstalled`in i){let t=await Fi(e,i.uninstalled);return t&&await Gu(t.store,i.uninstalled,a),C({ok:!0})}if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=Vl(e).then(a=>i.work(Hl(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),bl(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}return C({ok:!0})}if(`installation`in i){let t=await Fi(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?C({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await Ga(e,`installation`,n.id,{account:i.installation.op===`delete`?t.account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0,uninstalled:i.installation.installation.uninstalled})}),await Wu(t.store,n.id),C({ok:!0}))}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await Fi(e,t),s=!1;try{o&&await Wl(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof Dn))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?C({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`pushed`in i&&i.pushed){let t=await Fi(e,i.pushed.installation);t&&await ka(t.store,i.pushed)}if(!(`changes`in i)&&`pushed`in i)return C({ok:!0});if(`changes`in i){let r=i.changes;try{n.branch||await Ga(e.store,`app`,n.id,{branch:r.branch});let i=await Va(e,r.repo,r.ref,{...Ba(),integration:t.id,appId:n.id},r.branch);return i?C({imported:i.map(e=>e.agent)}):C({error:`No installed app can read ${r.repo}`},400)}catch(e){return C({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)Nl(e,n,a,Il(e,n,a).then(i=>Pl(e,t,n,r,a,i,()=>au(e,t,a))));return C({accepted:i.events.length},202)}async function su(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...H(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await Pi(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=E(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return ou(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await Ul(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),bl(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}const cu=new Set([`completed`,`failed`,`cancelled`]);function lu(e){if(e instanceof Du)return C({error:e.message},400);if(e instanceof W)return C({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function uu(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,prompt:s,cwd:c}=e.task;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...c?{cwd:c}:{},...s?{prompt:s}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text}}:{}},status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt,...up(e)}}function du(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...up(e),...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},turns:_o(e),...e.task.credential?{credential:Yd(e.task.credential).name}:{}}}async function fu(e,t){let n=await e.store.get(`task`,t);if(n&&!(e.local&&n.handle?.startsWith(`cli:`)&&n.task.flow==="default"))return{status:n};let r=n?.task.cwd??e.local?.cwd;return r?{cwd:r,answer:n?.answer}:C({error:`No task "${t}"`},404)}async function pu(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?Zt(r,500,2e3):void 0,c=yc(t.store,i,o,s??500);c?.catch(()=>{});let l=await fu(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;if(!u){let e=Dd(d,i,!0);return e?C({...e,...l.answer?{answer:l.answer}:{},logs:Ed(d,i,-1,s??500)}):C({error:`No task "${i}"`},404)}return C({...du(await Po(t,u)),logs:await c})}async function mu(e,t,n,r){let i=n.id,a=await fu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o){let n=await kd(e,s,i,void 0,t);return n.ok&&t.queue instanceof Op&&t.queue.tombstone(i),n}if(t.local&&o.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:o.attempts,tokenHash:o.tokenHash,generation:o.generation??0});let n=await t.store.get(`task`,i);if(n&&Q.includes(n.status)){await vd(t,n,e);let r=await t.store.get(`task`,i);if(r&&Q.includes(r.status))return C({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(o.status)&&o.handle)try{let e=await pn(t,o.task);if(!e)return C({error:`Task runner is unavailable. Try again.`},409);await e.stop(o.handle)}catch{return C({error:`Task is still stopping. Try again.`},409)}return await Cp(t,o)?(t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),zo(t,!0),C({ok:!0})):C({error:`Task changed while deleting. Try again.`},409)}async function hu(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?Zt(r,500,2e3):void 0,c=yc(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await fu(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;return u?(await Po(t,u),C(await c)):Dd(d,i,!1)?C(Ed(d,i,o,s)):C({error:`No task "${i}"`},404)}async function gu(e,t,n,r){let i=n.id,a=await fu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return kd(e,s,i,`steer`,t);if(o.task.flow!=="default")return C({error:`steer is available only for default-flow tasks`},409);let c=await e.json().catch(()=>void 0);if(cu.has(o.status)){let{text:e,outputSchema:n,model:r,effort:i,permissions:a}=c??{};try{let s=await yo(t,o,String(e??``),n,{model:r,effort:i,permissions:a});return zo(t,!0),C(du(s))}catch(e){return lu(e)}}let l=await Tp(t,o,`steer`,c);return l?C(l):C({error:`Task "${i}" is no longer active`},409)}function _u(e){return async(t,n,r)=>{let i=r.id,a=await fu(n,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return kd(t,s,i,e,n);if(o.task.flow!=="default")return C({error:`${e} is available only for default-flow tasks`},409);if(!Q.includes(o.status))return C({error:`Task "${i}" is not active`},409);if(e===`approve`&&!o.approval)return C({error:`Task "${i}" has no pending approval`},409);let c=await Tp(n,o,e,await t.json().catch(()=>void 0));return c?C(c):C({error:`Task "${i}" is no longer active`},409)}}const vu=_u(`ask`),yu=_u(`approve`);async function bu(e,t,n,r){let i=n.id,a=await fu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return kd(e,s,i,`cancel`,t);let c=await t.queue.cancel(t.organizationId,i,(t.now??Date.now)(),{attempts:o.attempts,tokenHash:o.tokenHash??null,generation:o.generation??0});if(c&&o.status!==`queued`){await Ap(t,i);let e=await t.store.get(`task`,i);e&&!cu.has(e.status)&&Io(t,o)}return c?C({ok:!0}):C({error:`No running or queued task "${i}"`},404)}async function xu(e,t,n,r){let i=n.id,a=await fu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return kd(e,s,i,`archive`,t);let c=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:c,autoArchived:void 0},c),C({ok:!0})}async function Su(e,t){if(!e.agent||!e.event?.integration)return C({error:`agent and event are required`},400);let n=t.integrations[e.event.integration];if(!n)return C({error:`Unknown integration "${e.event.integration}"`},400);let r=e.event.actor?.id;if(t.auth&&r){let e=await t.auth.linkedUser(n.id,r);if(e&&e.id!==t.session?.user.id)return C({error:`The event's actor is linked to another member`},403)}let i=(await t.store.list(`app`)).map(e=>e.value).find(t=>t.agent===e.agent&&t.integration===n.id);if(!i)return C({error:`No ${n.id} app for agent "${e.agent}" on this server.`},404);let a=(await t.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===i.id&&!e.deletedAt),o=a.find(t=>t.id===`${i.id}:${e.event.installationId}`)??a[0];if(!o)return C({error:`The ${n.id} app for "${e.agent}" is not installed anywhere yet`},404);let s=t.now??Date.now,c={...e.event,appId:i.id,installationId:o.id.slice(i.id.length+1),deliveryId:`admin-${s()}-${Tr()}`},l=await gl(t,n,i,E(t.config,i.credentials),c,s,await Il(t,i,c));return iu(t,l.work??Promise.resolve(),l.taskId?[l.taskId]:[])}const Cu=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function wu(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return C({error:`A JSON body is required`},400);try{if(co(t,i),i.event)return Su(i,t);let e=(i.source===`cli`?void 0:await hd(t,i))??await go(t,i.source===`cli`?`cli`:`dashboard`,i);return C(du(e),201)}catch(e){return lu(e)}}function Tu(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)_(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function Eu(e,t,n,r){let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!Cu.has(i))return C({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return C({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return C({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:Q}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(uu):e.map(du);if(t.local){let e=o===void 0?pd(t.local.cwd,l.archived):[...pd(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...pd(t.local.cwd,!1)],n=Tu(t.local.cwd,e,await t.queue.list(t.organizationId)).filter(e=>pp(e,{...l,...u})).sort(o===void 0?_p:gp),i=Zt(r,Qt(r)?void 0:20);if(!Qt(r))return C(f(n.slice(0,i)));let a=nn(r),s=n.filter(e=>vp(e,a)),c=an(s.slice(0,i+1),i,o===void 0?mp:hp);return C({...c,items:f(c.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}:{}})}if(!Qt(r)){let e=Zt(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return C(f(n))}let p=Zt(r),m=nn(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,[g,_]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0]),v=an(g,p,o===void 0?mp:hp);return C({...v,items:f(v.items),..._?{counts:_}:{}})}var Du=class extends Error{};const Ou=async e=>await e.get(`config`,`workspace`)??{};function ku(){let e=i();if(!V.existsSync(e))return{};try{return JSON.parse(V.readFileSync(e,`utf8`))}catch(t){throw new Du(`Invalid JSON in ${e}: ${t.message}`)}}function Au(e){let{mcp:t,...n}=e;return n}async function ju(e){return e.local?Au(ku()):Ou(e.store)}const Mu=(e,t)=>e.local?Au(oe(e.local.cwd)):Fe(t);async function Nu(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function Pu(e){let t=We(e);if(t.length)throw new Du(t.join(`; `))}async function Fu(e,t){if(Pu(t),t.mcp)throw new Du(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:n}=ku();return Oe({...t,...n?{mcp:n}:{}}),ju(e)}return await e.store.put(`config`,`workspace`,t),Au(t)}async function Iu(e,t){return Nu(e,async e=>{let n=structuredClone(await ju(e));return t(n),Fu(e,n)})}function Lu(e,t){return Nu(e,async e=>Fu(e,Je(await ju(e),t)))}async function Ru(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new Du(`A JSON body is required`);return t}async function zu(e,t){return Iu(e,t).then(C).catch(lu)}async function Bu(e,t,n,r){return ju(t).then(e=>C({config:e,effective:Mu(t,e)})).catch(lu)}async function Vu(e,t,n,r){return e.json().catch(()=>{throw new Du(`A JSON body is required`)}).then(e=>Lu(t,e)).then(C).catch(lu)}function Hu(e,t){return t.token?{...t,token:E(e.config,t.token)}:t}const Uu=3e5;async function Wu(e,t){await e.put(`snapshot`,wn(t),{drop:Tr()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:Rn(t)}))await e.delete(`snapshot`,n.id)}async function Gu(e,t,n){await e.withAppLock(`installation:${t}`,async e=>{let r=await e.get(`installation`,t);!r||r.deletedAt||(await Ga(e,`installation`,t,{deletedAt:n,uninstalled:!0}),await Wu(e,t))})}async function Ku(e,t,n,r,i,a=0){let o=n.token,s=Hu(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=Rn(n.id,t),o=await e.store.heldTokens([n.id],[n.app]),s=o.held.get(i),c=(e.now??Date.now)(),l=s?s.expiresAt-s.mintedAt:0,u=a+(a+Uu<=l?Uu:0);if(s&&s.expiresAt-c>Math.max(u,Uu))try{return E(e.config,s.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let d=await r();return await e.store.holdToken({key:i,value:{token:T(e.config,d.token),expiresAt:d.expiresAt,mintedAt:c},ttlMs:Math.max(d.expiresAt-c-Uu,0),drops:[n.id,n.app].map(e=>({key:wn(e),drop:o.drops.get(wn(e))}))}),d.token},async save(t){let r=T(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&E(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&E(e.config,i)}})}async function qu(e,t,n,r){if(!t.auth.user||!e.auth)return;let i=await e.auth.linkedUser(t.id,n.actor.id);if(!i?.token||!i.organizations?.includes(e.organizationId))return;let a=jf(e.config,i.token),o=a.app&&a.app!==n.appId,s=o?await Rf(e,t.id,a.app):void 0;if(o&&!s)return;let c=await t.auth.user.access(a.token,s?E(e.config,s.credentials):r,{fetch:e.fetch??fetch,now:(e.now??Date.now)()});return c.refreshed&&await e.auth.link(i,t.id,n.actor.id,{token:T(e.config,a.app?{app:a.app,token:c.refreshed}:c.refreshed)}),c.accessToken}async function Ju(e,t,n,r,i,a,o){return(o===`requester`?await qu(e,t,r,i).catch(()=>void 0):void 0)??Ku(e,t,n,i,a,e.config.taskTimeoutMs)}function Yu(e,t,n,r,i){let a=[],o,s={installation:n.id,record:n,fetch:e.fetch??fetch,token:()=>o??=Ku(e,t,n,i,{tools:t.tools.presets.read}).then(e=>(a.push(e),e))};return Object.assign(async e=>e===r.integration?s:void 0,{minted:a})}function Xu(e,t){let n=(e.settings??={}).agentInstallations??=new Map,r=`${e.organizationId}:${t.id}`,i=n.get(r);return i||(i=e.store.list(`installation`,{agent:t.agent,active:!0}).then(e=>e.map(e=>e.value)),n.set(r,i),setTimeout(()=>n.delete(r),6e4).unref()),i}const Zu=e=>t=>{console.error(`coder server: could not mint a token for ${e}`,t)};async function Qu(e,t){let n=t.event,r=e.integrations[n.integration];if(!r)throw Error(`Unknown integration "${n.integration}"`);let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i)throw Error(`Unknown app "${n.appId}"`);if(!a||a.deletedAt)throw Error(`Installation is gone`);let o=t.flow===`review`&&t.args?.post===!0,s=await Ju(e,r,a,n,E(e.config,i.credentials),{tools:t.tools[n.integration]??(o?r.tools.presets.read:[])},$u(t)),c={[n.integration]:s},l=(await Xu(e,t)).filter(e=>e.id!==a.id&&e.integration in t.tools),u=new Map((await e.store.getApps([...new Set(l.map(e=>e.app))])).map(e=>[e.id,e.value]));return await Promise.all(l.map(async n=>{let r=e.integrations[n.integration],i=u.get(n.app);if(!r||!i)return;let a=await Ku(e,r,n,E(e.config,i.credentials),{tools:t.tools[n.integration]??[]},e.config.taskTimeoutMs).catch(Zu(n.id));a&&(c[zt(n.integration,n.account.login)]=a)})),c}function $u(e){let t=e.event;return t.chat&&!t.chat.thread.isDM?void 0:pt(e.definition.integrations[t.integration],t.type)?.actAs}async function ed(e,t){let n=t.task,[r,i,a]=await Promise.all([n.event?Qu(e,t.task):{},e.local?{}:Ou(e.store),td(e,n)]),o,s=n.event;if(n.flow==="default"&&s?.chat&&n.source===s.integration){let t=e.integrations[s.integration],i=t.tools.presets.read,a=n.tools[s.integration]??[];if(!$u(n)&&a.length===i.length&&i.every(e=>a.includes(e)))o=r[s.integration];else{let[n,r]=await Promise.all([e.store.get(`app`,s.appId),e.store.get(`installation`,`${s.appId}:${s.installationId}`)]);if(!n||!r||r.deletedAt)throw Error(`Conversation installation is gone`);o=await Ku(e,t,r,E(e.config,n.credentials),{tools:i},e.config.taskTimeoutMs)}}let c=await ip(e,t,r),l=n.engineChain?.length?await nd(e,n):void 0,u={...c.env},d=[...c.warnings];for(let e of Object.keys(u))a.env[e]===void 0&&!l?.some(t=>t.credential.env[e]!==void 0)||(delete u[e],d.push(`${e} is temporarily unavailable; skipped for this task.`));let f=await sp(e,n),p={...n,tools:c.tools},m=await op(e,n.id,[...c.secrets,...f,...Object.values(c.tokens),...Object.values(r),...o?[o]:[],...od(a.env),...l?.flatMap(e=>od(e.credential.env))??[]]);await gc(e,n.id,d);let h={task:p,tokens:{...c.tokens,...r},nativeTokens:c.nativeTokens,...o?{postToken:o}:{},credential:a,...l?{engineCredentials:l}:{},config:i,connections:c.mcp,connectionEnv:u,connectionSecrets:m};if(n.runner!==`vercel-sandbox`)return h;let g=e=>{let t=new Set(id(i,n,e).map(e=>e.name));return{...e,env:Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,t.has(e)?vn:n]))}};return{...h,credential:g(a),...l?{engineCredentials:l.map(e=>({...e,credential:g(e.credential)}))}:{}}}async function td(e,t){let n=t.usage?.engine??t.definition.engine??`claude`,r=t.credential?await e.store.get(`credential`,t.credential):(await nf(e,n,t.requester,{model:t.usage?.model}))?.value;if(r)return{engine:n,...fn(e.config,r)};if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:n,env:{}}}async function nd(e,t){let n=t.usage?.engine??t.definition.engine,r=t.engineChain??[],i=r.slice(Math.max(0,r.indexOf(n??``))+1),a=await Promise.all(i.map(async n=>{let r=t.engineCredentials?.[n],i=r?await e.store.get(`credential`,r):void 0;return i&&(!i.owner||i.owner===t.requester)?{id:r,credential:{engine:n,...fn(e.config,i)}}:void 0}));return[...t.credential?[{id:t.credential,credential:await td(e,t)}]:[],...a.flatMap(e=>e?[e]:[])]}const rd=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];function id(e,t,n){if(n.engine!==`custom`)return hn;let r=e.models??{},i=t.usage?.model?r[t.usage.model]:void 0,a=(i&&`baseUrl`in i?[i]:Object.values(r)).flatMap(e=>`baseUrl`in e&&e.envKey&&URL.canParse(e.baseUrl)?[{name:e.envKey,host:new URL(e.baseUrl).hostname,header:`authorization`,prefix:`Bearer `}]:[]);return[...hn,...a]}async function ad(e,t,n){if(t.permissions===`auto`)return;let r=e.local?{}:await Ou(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=gn(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))`baseUrl`in e&&a.push(...rd(e.baseUrl));for(let n of t.connections??[]){let r=await Pf(e,n,t.requester);r?.provider===`mcp`?a.push(...rd(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...rd(e.url));for(let e of t.mcp??[])a.push(...rd(r.mcp?.[e]?.url));for(let e of r.approvals?.allowedNetworkHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...Dr.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}function od(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!ge(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function sd(e,t){return t.event?(await Xu(e,t)).flatMap(t=>t.token?[E(e.config,t.token)]:[]):[]}async function cd(e,t){let[n,r,i]=await Promise.all([cp(e,t.task),td(e,t.task).catch(e=>{if(e instanceof Error&&e.message===`no-credential`)return{engine:`codex`,env:{}};throw e}),sd(e,t.task)]),a=e.store instanceof Fn&&t.task.event&&!(await e.store.list(`snapshot`,{prefix:`connection-secrets:${t.task.id}:`,limit:1})).length?Object.values(await Qu(e,t.task)):[];return a.length&&await op(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...od(r.env)].filter(e=>e.length>=8)}var ld=r({LOCAL_LOGINS:()=>Ld,engineSignIn:()=>Bd,engineSignOut:()=>Vd,engineStatus:()=>Ud,inspectLocalTask:()=>vd,isLoginEngine:()=>zd,localLog:()=>Ed,localTask:()=>Dd,localTaskAction:()=>kd,localTasks:()=>pd,localUsage:()=>Ad,machineSignedIn:()=>Wd,pushLocalInbox:()=>Td,recoverLocalTasks:()=>bd,resumeLocalTask:()=>Od,runLocalTask:()=>wd,startLocalTask:()=>hd,startQueuedLocalTask:()=>_d,stopLocalTasks:()=>xd,sweepLocalQueue:()=>md,syncLocalUsage:()=>Nd});const ud=e=>!e.name?.startsWith(Wt),dd=e=>e?Date.parse(e):void 0;function fd(e,t,n=!1){let r=dd(t.createdAt)??0,i=je(B.join(Ne(e,t.id),`answers.json`)),a=t.status===`running`?ut(Ne(e,t.id)).find(e=>!e.response):void 0,o=n&&!Ie.includes(t.status)?rt(e,t.id):null,s=n?g(e,t.id).filter(e=>!Ie.includes(t.status)||(dd(e.at)??0)<(dd(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:dd(e.at)}}):[];n&&(Ie.includes(t.status)||!s.length||(s.at(-1)?.finishedAt??0)<(dd(t.resumedAt)??r))&&s.push({prompt:t.currentPrompt??t.prompt??``,...o?{result:{ok:o.status===0,output:o.finalMessage??o.error?.message??``}}:{},...t.error?{error:t.error}:{},...Ie.includes(t.status)?{}:{finishedAt:dd(t.completedAt)}});let c=t.flowRunId?Ft(t.flowRunId)?.name:void 0,l={task:{id:t.id,source:t.source??`cli`,agent:t.agentId??dt()??``,flow:c??`default`,...t.name?{name:t.name}:c?{name:c===`review`?`Review`:c}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.permissions?{permissions:t.permissions}:{},...t.prompt?{prompt:Rt(t.prompt)?t.prompt:t.currentPrompt??t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:a?`waiting`:t.status,attempts:1,...a?{approval:a}:{},...i?{answer:i}:{},...o?{result:{ok:o.status===0,exitCode:null,output:o.finalMessage??o.error?.message??``},...o.tokens?{tokens:o.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:dd(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:dd(t.resumedAt)??r,...t.completedAt&&!Ie.includes(t.status)?{finishedAt:dd(t.completedAt)}:{},updatedAt:dd(t.updatedAt)??r,local:!0,...n?{turns:s}:{}};return{...l,...up(l)}}function pd(e,t){let n=kt(e);return(t?et(e,{migrate:!1}):n).filter(ud).map(n=>{let r=fd(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function md(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...we]})).filter(e=>re(e.finishedAt??e.updatedAt,n)&&_(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function hd(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=co(e,t)??e.local.cwd;await kn(e.store,r,e.integrations);let i=dt(),o=t.agent??i;if(!o)throw new W(`Name an agent: this server has no default agent.`);let{record:s,version:c}=await Nn(e.store,o);so(e,o,s);let l=await yn(e,{requester:e.session?.user.id,runner:t.runner,agent:c?.definition.runner}).catch(e=>{throw new W(e.message)});if(!(l.runner!==`local`||l.runnerId)){if(po(t),!n)return gd(e,{id:ee(),source:`dashboard`,agent:o,flow:`default`,runner:`local`,cwd:r,prompt:t.prompt,definition:c?.definition??{integrations:{}},...s?.settings?{usage:s.settings}:{},connections:await ua(e,void 0,te(s?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let l=n?await e.store.get(`task`,n):void 0,u=l?.task.connections??await ua(e,void 0,te(s?.settings?.connections,t.connections)),d=await rp(e,l?.task??{connections:u,tools:{},definition:c?.definition??{integrations:{}},...s?.settings?{usage:s.settings}:{}}),f=a(d.mcp,d.env),p=Lt({tools:d.tools},d.tokens,void 0,Object.keys(d.nativeTokens)),m=o===i?void 0:await Vt(r,o,t.mcp?.join(`,`),f.mcp),h=m??at(t.mcp?.join(`,`),oe(r).mcp,{},f.mcp),g=[],_=await st({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,engine:t.engine??m?.engine,model:t.model??(t.engine?void 0:m?.model),effort:t.effort??(t.engine?void 0:m?.effort),permissions:t.permissions??m?.permissions,...m?{agentPrompt:{developer:m.developer,access:ht({definition:c?.definition??{integrations:{}},...s?.settings?{usage:s.settings}:{}})}}:{},mcp:[...Object.values(p.mcp),...h.mcp],mcpBindings:h.mcpBindings,mcpWarnings:[...h.warnings??[],...d.warnings],connectionEnv:{...f.env,...p.env},connections:u,nativeMcp:h.nativeMcp,...m?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>g.push(e)},{waitForStartup:!1});return fd(r,g.length?xe(r,_.taskId,{fallbacks:g}):_.task)}catch(e){throw e instanceof nt?new W(e.message,409):e}}}async function gd(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await Ro(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:Dd(n.cwd,t.id)??i}async function _d(e,t,n){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;try{let i=t.task.id,a,o=r.resume?g(r.cwd,t.task.id).length:0,s=t.task.flow==="default"?b(r.cwd,t.task.id):void 0,c=n?Sd(e,t.task.id,n):void 0;if(s&&!r.resume)i=s.id;else if(r.resume){let n=b(r.cwd,t.task.id);if(!n)throw Error(`Local task is missing`);await At(r.cwd,n,t.task.prompt??``,{onWorker:e=>{a=e},outputSchema:t.task.context?.outputSchema,...r.overrides,resolveConnections:n=>Cd(e,t.task,n,c)})}else r.input?await hd(e,{...r.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??r.input.outputSchema},t.task.id):i=(await wd(e,t.task,t.task.id,!0,c)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...r,startedId:i});let l={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${i}`},(e.now??Date.now)(),l)){let e=b(r.cwd,i);return e&&await Dt(r.cwd,e),!0}if(t.task.flow==="default"){let n={task:t.task,cwd:r.cwd,fence:l,turns:o};await e.store.put(`snapshot`,`completion:${i}`,n),yd(e,i,n,a);let s=Ap(e,t.task.id);e.waitUntil&&e.waitUntil(s)}}catch(n){await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})}return!0}async function vd(e,t,n){if(t.status!==`running`&&t.status!==`waiting`||t.task.flow==="default"&&e.store.localFlows?.has(t.task.id)&&t.cancelRequestedAt===void 0&&(t.startedAt===void 0||n-t.startedAt<e.config.taskTimeoutMs))return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=Ft(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await Mt(t.task.id),r=Ft(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=Dd(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=b(r.cwd,r.startedId??t.task.id);e&&await Dt(r.cwd,e),a=Dd(r.cwd,t.task.id)}else return!1;let o=a.status;return o!==`completed`&&o!==`failed`&&o!==`cancelled`?!1:e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i)}function yd(e,t,n,r){let i=e.store.completionWatches??=new Map;if(i.has(t))return;let a={stopped:!1,work:Promise.resolve()};i.set(t,a),a.work=(async()=>{let i=`completion:${t}:${n.fence?.generation??0}`,o=await e.store.get(`delivery`,i);if(o&&!o.owner)return;if(o?.posting!==void 0){console.error(`coder server: local completion ${t} has an interrupted post for turn ${o.posting+1}; retained for reconciliation`);return}if(o?.pid)try{process.kill(o.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let s=Tr(),l={owner:s,pid:process.pid,pending:!0,turns:o?.turns??n.turns??0};if(o?.owner){if(!await e.store.updateDelivery(i,o.owner,l))return}else if(!await e.store.create(`delivery`,i,l))return;let u=async(t=!1)=>{if(!n.fence)return!0;let r=await e.store.get(`task`,n.task.id);return r&&(r.generation??0)===n.fence.generation&&r.attempts===n.fence.attempts&&r.tokenHash===n.fence.tokenHash&&r.status!==`queued`&&(!t||[`running`,`waiting`].includes(r.status))},d,f=async t=>{let r=n.task.event;if(!r||n.task.source!==r.integration)throw Error(`The task has no conversation`);if(!await u(t))throw Error(`The conversation task is no longer running`);if(!d){let t=await e.store.get(`app`,r.appId);if(!t)throw Error(`Local completion has no app`);let{eventReplies:n}=await Promise.resolve().then(()=>Sl);d=await n(e,t,r)}return d},p=async(t,r=!1,i=!1)=>{let a=await f(i),o=await(r?a.problem(t):a.post(t,i));!i&&l.posting!==void 0&&(l={...l,turns:l.posting+1,posting:void 0}),o&&await Ic(e,n.task.event,o.ids??(o.id?[o.id]:[]),Date.now())},h=ce(),_=Ge(n.cwd,t,r),v=100;try{for(let r=0;r<5;r++)try{let r=async(e,r,i)=>{if(n.task.source!==n.task.event?.integration)return;c(`completion.reply`,{id:t});let a=Gt(n.task,e,r,i);a.skipped&&Ye(n.cwd,t,{kind:`status`,message:Me}),a.text&&!a.duplicate&&await p(a.text,a.problem)};for(;;){if(a.stopped||!await u())return;let o=b(n.cwd,t);if(!o)return;let c=g(n.cwd,t);for(let t of c.slice(l.turns)){t.status!==0&&e.local&&(e.local.engineChecks=void 0);let a={finalMessage:t.finalMessage,error:t.error},o=Gt(n.task,a,!1,t),c=n.task.source===n.task.event?.integration&&o.text&&!o.duplicate;c&&await f(!1);let u=l.turns+1;if(l={...l,posting:c?l.turns:void 0},!await e.store.updateDelivery(i,s,l)||(await r(a,!1,t),l={...l,turns:u,posting:void 0},!await e.store.updateDelivery(i,s,l)))return}let d=le(n.cwd,o,h);if(!Ie.includes(d.status)&&!(d.pid&&m(d.pid,d,h))&&(d.status!==`completed`||c.length>(n.turns??0))){let t=await e.store.get(`task`,n.task.id);n.fence&&t&&(t.generation??0)===n.fence.generation&&t.attempts===n.fence.attempts&&t.tokenHash===n.fence.tokenHash&&await vd(e,t,(e.now??Date.now)())&&zo(e,!0);let a=d.status===`cancelled`;if((a||d.error)&&c.at(-1)?.prompt!==(d.currentPrompt??d.prompt??null)){if(!await e.store.updateDelivery(i,s,l))return;await r({error:{message:d.error??`Task cancelled`}},a)}break}await _.wait(v),v=Math.min(1e3,v*2)}await e.store.updateDelivery(i,s,{posted:!0,turns:l.turns,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(r===4)throw n;console.error(`coder server: local completion ${t} attempt ${r+1} failed, retrying`,n);let i=e.now??Date.now,o=i()+5e3*2**r;for(;!a.stopped&&i()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-i())))}}finally{_.close(),await e.store.updateDelivery(i,s,{...l,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{i.delete(t)})}async function bd(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))b(n.cwd,t.slice(11))&&yd(e,t.slice(11),n)}async function xd(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}function Sd(e,t,n){return{url:`http://127.0.0.1:${e.local.port}/tasks/${encodeURIComponent(t)}`,token:n}}async function Cd(e,t,n,r){let i=t.event?await Qu(e,t):{},o=await rp(e,{...t,connections:n},i);await op(e,t.id,[...o.secrets,...Object.values(o.tokens)]);let s=a(o.mcp,o.env),c=Lt({...t,tools:o.tools},o.tokens,r,Object.keys(o.nativeTokens));return{mcp:s.mcp,env:{...s.env,...c.env},warnings:o.warnings}}async function wd(e,t,n,r=!1,i){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await Ro(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=co(e,t)??e.local.cwd;return gd(e,{...t,id:n??ee(),cwd:r},{cwd:r})}let s=t.event?await Qu(e,t):{},c=await rp(e,t,s);await gc(e,n??t.id,c.warnings),await op(e,n??t.id,[...c.secrets,...Object.values(c.tokens)]),t={...t,tools:c.tools};let l=c.tokens,u=t.event&&s[t.event.integration],d=co(e,t)??e.local.cwd,f=await e.store.get(`task`,n??t.id),p={task:t,cwd:d,...f?{fence:{generation:f.generation??0,attempts:f.attempts,tokenHash:f.tokenHash,statuses:[`running`,`waiting`]}}:{}},m=t.flow!=="default"&&n?Ft(n):void 0;if(m){let r=o(d).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?fd(d,r):{task:t,status:m.status===`running`?`running`:m.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=ee();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&yp(i.task)!==yp(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,p)}let h=t.flow==="default"&&n?b(d,n):void 0;if(h){let n;return h.status===`queued`&&!h.pid&&(n=ct(d,h.id,{...a(c.mcp,c.env).env,...Lt(t,l,i,Object.keys(c.nativeTokens)).env})),yd(e,h.id,p,n),fd(d,h)}let g,_=new Promise(e=>g=e),v,y;v=Ut({cwd:d,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:l,native:Object.keys(c.nativeTokens)},...i?{replyEndpoint:i}:{},connections:c.mcp,connectionEnv:c.env,availability:e.local?.engineChecks&&e.local.engineChecks.expiresAt>Date.now()?e.local.engineChecks.availability:void 0,...t.engineChain?{onEngine:t=>Wd(e,t)}:{},post:t.flow!=="default"&&t.source===t.event?.integration,...u?{postToken:u}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await Nt(n.runId,n.runningIds())},work:v}),g(t.id)},onWorker:(e,t)=>{y=t},onTask:e=>{g(e)}}).then(async n=>(t.flow==="default"&&n.taskId&&(p.turns=n.turn??p.turns,await e.store.put(`snapshot`,`completion:${n.taskId}`,p),yd(e,n.taskId,p,y)),n)).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===p.fence?.attempts&&n.tokenHash===p.fence?.tokenHash&&(n.generation??0)===p.fence?.generation&&await vd(e,n,(e.now??Date.now)()),zo(e,!0)}}),t.flow==="default"&&(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{let e=b(d,n??t.id);e&&await Dt(d,e)},work:v}),v.catch(()=>{e.local&&(e.local.engineChecks=void 0)});let te=await Promise.race([_,v.then(()=>void 0)]),ne=te?b(d,te):void 0,re=(e.now??Date.now)();return ne&&fd(d,ne)||{task:t,status:t.flow!=="default"&&Ft(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:re,updatedAt:re,local:!0}}async function Td(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let s=b(i.cwd,r);if(!s)throw Error(`Local task is missing`);let c=o.kind===`cancel`?await Dt(i.cwd,s):await qt(i.cwd,{...s,name:void 0},o,n=>Cd(e,t.task,n));o.kind===`ask`&&a.answers.push({seq:o.seq,value:c}),a.seq=o.seq}return a}function Ed(e,t,n=-1,r){let i=``;try{i=V.readFileSync(B.join(Ne(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
-`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=It(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:dd(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function Dd(e,t,n=!0){let r=b(e,t);return r&&ud(r)?fd(e,le(e,r),n):void 0}async function Od(e,t,n,r,i,a={},o={}){let s=e.store.completionWatches?.get(n);s&&await s.work;let c=(e.now??Date.now)(),l=await e.store.get(`task`,n);l&&[`running`,`waiting`].includes(l.status)&&(await vd(e,l,c),l=await e.store.get(`task`,n));let u={...l?await vo(e,l.task):{},prompt:r,context:{...l?.task.context,...o,...i?{outputSchema:i}:{}}};if(await e.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),l){if(!await e.queue.continueTask(e.organizationId,n,u,c,{attempts:l.attempts,generation:l.generation??0}))return!1}else{let r=b(t,n);if(!r)throw Error(`No task "${n}"`);await e.queue.enqueue(e.organizationId,{...fd(t,r).task,...u},c,void 0,e.config.maxQueued??1e3)}return await Ro(e,!1,!0,!0),!0}async function kd(e,t,n,r,i){let a=b(t,n);if(!a||!ud(a))return Response.json({error:`No task "${n}"`},{status:404});let o=le(t,a),s=Ie.includes(o.status),c=e.method===`POST`?await e.json().catch(()=>({})):{},l=(e,t=409)=>Response.json({error:e},{status:t});if(e.method===`DELETE`&&!r){if(s&&await Dt(t,o),Ot(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),zo(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return s?(await Dt(t,o),Response.json({ok:!0})):l(`No running or queued task "${n}"`,404);if(r===`archive`)return u(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(c.text??``);if(!e.trim())return l(`text is required`,400);let r=s?void 0:c.outputSchema,a=Object.fromEntries([`model`,`effort`,`permissions`].flatMap(e=>typeof c[e]==`string`&&c[e]?[[e,c[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return l(`outputSchema must be an object`,400);try{if(!s&&i){if(!await Od(i,t,n,e,r,a))return l(`Task is already active`);let o=await i.store.get(`task`,n);return Response.json(o?.status===`queued`?{...o,statusReason:`Waiting for a task slot`}:Dd(t,n))}let c=await At(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(s?c:Dd(t,n))}catch(e){return l(e.message)}}if(r===`ask`){let e=String(c.question??c.text??``);if(!e.trim())return l(`question is required`,400);let r=await jt(t,o,e),i=r.finalMessage??r.error?.message??``,a=B.join(Ne(t,n),`answers.json`);return Le(a,[...je(a)??[],i]),Response.json({ok:!0,answer:i})}if(r===`approve`){let e=ut(Ne(t,n)).filter(e=>!e.response),r=String(c.approvalId??c.id??e[0]?.id??``);return e.some(e=>e.id===r)?(ot(Ne(t,n),r,c.decision===`deny`||c.decision===`decline`?`decline`:`accept`),Response.json({ok:!0})):l(`Task "${n}" has no pending approval`)}return new Response(`Not found`,{status:404})}function Ad(e,t=new Set,n=!0){let r=jd(t);return[...o(e),...n?et(e,{migrate:!1}):[]].filter(ud).flatMap(e=>Md(e,r))}function jd(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function Md(e,t){let n=e.turnUsage??[],r=t.get(e.id)??[];t.set(e.id,r);let i=dd(e.createdAt)??0;return n.flatMap(t=>{let n=dd(t.at);if(n===void 0||!Number.isFinite(n))return[];let a=dd(e.resumedAt),o=a!==void 0&&a>=i&&a<=n?a:i,s=r.includes(n);return i=n,s?[]:(r.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??dt()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-o),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function Nd(e){let t=e.local;return t.usageSync??=Id(e).finally(()=>t.usageSync=void 0)}async function Pd(e){try{return JSON.parse(await V.promises.readFile(e,`utf8`))}catch{return null}}async function Fd(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await V.promises.stat(B.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function Id(e){let t=e.local;await t.cacheMaintenance;let n=ze(),r=await Pd(n),i=await e.store.list(`usage`,{prefix:`cli:`}),a=new Set(i.map(e=>e.id)),o=0,s=async()=>{++o%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))a.has(t)||(await e.store.put(`usage`,t,n),a.add(t)),await s();let c=jd(a),l=(await V.promises.stat(ue(t.cwd)).catch(()=>void 0))?.mtimeMs??0,u={},d=new Set,f=!1;for await(let{id:n,dir:i,archived:a}of Ve(t.cwd)){if(await s(),d.has(n))continue;let t=a?await Fd(i):void 0;if(a&&r?.counted?.[n]===t){u[n]=t,d.add(n);continue}let o=await Pd(B.join(i,`job.json`));if(o){if(o.agent&&(o.engine=o.agent),d.add(n),ud(o))for(let[t,n]of Md(o,c))await e.store.put(`usage`,t,n),f=!0,await s();a&&(u[n]=t)}}if(f||r?.archive!==l||JSON.stringify(r?.counted)!==JSON.stringify(u)){let t=await e.store.list(`usage`,{prefix:`cli:`});await V.promises.mkdir(B.dirname(n),{recursive:!0});let r=Ee(n);try{await V.promises.writeFile(r,`${JSON.stringify({archive:l,counted:u,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await V.promises.rename(r,n)}finally{await V.promises.rm(r,{force:!0})}}t.archiveScan=l}const Ld=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,Rd={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},zd=e=>e in Rd;function Bd(e){let t=Rd[e];xr(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function Vd(e){let t=Rd[e];return new Promise(e=>br(t.file,t.logout,{timeout:15e3},()=>e()))}function Hd(e){return new Promise(t=>br(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function Ud(e){let t=e?.local;if(t?.engineChecks&&t.engineChecks.expiresAt>Date.now())return t.engineChecks.work;let n={},r=Promise.all([Hd(Rd.claude),Hd(Rd.codex)]).then(([e,r])=>(t&&(n.claude=lt(`claude`,process.env,t.cwd),n.codex=tt(t.cwd)),{claude:{signedIn:e,command:Rd.claude.command},codex:{signedIn:r,command:Rd.codex.command}})).catch(e=>{throw t?.engineChecks?.work===r&&(t.engineChecks=void 0),e});return t&&(t.engineChecks={expiresAt:Date.now()+3e4,availability:n,work:r}),r}async function Wd(e,t,n){if(!e.local)return!1;let r=t?[t]:oe(e.local.cwd).chain,i=await Ud(e);return r.some(t=>{if(t!==`custom`)return i[t]?.signedIn===!0;let r=oe(e.local.cwd);try{let e=it({engine:`custom`,model:n},r).model,t=e&&r.models?.[e];return!!(t&&`baseUrl`in t&&process.env[t.envKey??`OPENAI_API_KEY`])}catch{return!1}})}var Gd=r({CredentialCheckError:()=>Zd,addCredential:()=>sf,checkCredential:()=>$d,completeLogin:()=>lf,createCredential:()=>bf,credentialEnv:()=>of,credentialFix:()=>gf,credentialId:()=>Jd,credentialSummary:()=>df,deleteCredential:()=>xf,listCredentials:()=>yf,parseCredentialId:()=>Yd,removeCredential:()=>cf,reseal:()=>hf,resolveCredential:()=>nf,resolveEngine:()=>rf,signInEngine:()=>Sf,signOutEngine:()=>Cf,visibleCredentials:()=>af,writeBackCodexAuth:()=>pf});const Kd={claude:`ANTHROPIC_API_KEY`,codex:`OPENAI_API_KEY`},qd={claude:`CLAUDE_CODE_OAUTH_TOKEN`,codex:`CODEX_AUTH_JSON`};function Jd(e,t){return e?`${e}/${t}`:t}function Yd(e){let t=e.lastIndexOf(`/`);return t<0?{name:e}:{owner:e.slice(0,t),name:e.slice(t+1)}}function Xd(e){let[t=``]=Object.keys(e);return Object.keys(qd).find(e=>qd[e]===t)??t}var Zd=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function Qd(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function $d(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=Qd(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new Zd(i.status,i.statusText)}function ef(e,t,n){if(e===`claude`||e===`codex`)return[e,Kd[e]];let r=null;try{r=it({...n,engine:e},t).model}catch{return[]}let i=r?t.models?.[r]:void 0;return[i&&ie(i)&&i.envKey||Kd.codex]}function tf(e,t,n){for(let r of n?[n,void 0]:[void 0])for(let n of t){let t=e.find(e=>e.id===Jd(r,n));if(t)return t}}async function nf(e,t,n,r={}){let[i,a]=await Promise.all([ju(e),e.store.listCredentials({owner:n})]);return tf(a,ef(t,Mu(e,i),r),n)}async function rf(e,t,n){let[r,i]=await Promise.all([ju(e),e.store.listCredentials({owner:n})]),a=Mu(e,r),o=t.engine??(t.model?it(t,a).engine:void 0),s=o?[o]:a.chain,c=Object.fromEntries(s.flatMap(e=>{let r=ef(e,a,e===o?t:{}),s=tf(i,r,n);return s?[[e,s.id]]:[]}));for(let n of s){let r=c[n];if(r)return{engine:n,credential:r,usable:!0,chain:s,credentials:c};if(await Wd(e,n,n===o?t.model:void 0))return{engine:n,usable:!0,chain:s,credentials:c}}return{engine:Object.values(a.models??{}).some(ie)||i.some(e=>![...Object.keys(Kd),...Object.values(Kd),...Object.values(qd)].includes(Yd(e.id).name))?`custom`:s[0]??ve,usable:!1,chain:s,credentials:c}}async function af(e,t,n){return(await e.listCredentials({owner:t,limit:n})).filter(e=>!e.value.owner||e.value.owner===t)}async function of(e,t){let n=e.session?.user.id,r=tf(await af(e.store,n),[t],n);return(r?fn(e.config,r.value).env[t]:void 0)??(e.local?fr.env[t]:void 0)}async function sf(e,t,n,r=Date.now){let i=n.owner||void 0,a=Jd(i,Xd(n.env)),o=!1;return await e.withCredential(`credential`,a,async e=>{o=!!e;let s={...ln(t,{env:n.env}),...i?{owner:i}:{},...n.account?{account:n.account}:{},createdAt:r()};return[{id:a,value:s}]}),{id:a,replaced:o}}function cf(e,t){return e.withCredential(`credential`,t,async e=>e&&[{id:t,value:null}])}async function lf(e,t,n,r){let i=await e.get(`login`,t);if(!i)return!1;let a=Jd(i.owner,i.engine);return e.withCredential(`credential`,a,async(e,o,s)=>{if(await s.patchLogin(t,{state:`done`},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:i.owner}))return[{id:a,value:{...r,owner:i.owner}}]})}function uf(e){if(e.CODEX_AUTH_JSON)return`auth.json`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,7)}…${t.slice(-4)}`:`••••`}function df(e,t,n){let{name:r}=Yd(t);return{name:r,scope:n.owner?`personal`:`workspace`,subscription:Object.hasOwn(qd,r),createdAt:n.createdAt??0,masked:uf(fn(e,n).env),...n.account?{account:n.account}:{}}}const ff=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function pf(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=fn(t,e);if(!(!i.CODEX_AUTH_JSON||!(ff(r)>(ff(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...ln(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function mf(e,t){return un(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function hf(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=Cn(t.encryptionKey),i=e=>un(t,e)!==r,a=e=>i(e)?T(t,E(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19).replace(/:[a-f0-9]{24}$/,``):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`secret`in o?`secret`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||mf(t,e)===r))return[{id:n,value:{...e,...ln(t,fn(t,e))}}]})&&s++;return s}async function gf(e,t,n){let r=fh(n??await dh(e),t===`custom`?`/settings/models`:`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}${t===`custom`?``:`?engine=${encodeURIComponent(t)}`}`}const _f=s({env:l(x().check(n(/^[A-Z_][A-Z0-9_]*$/)),x().check(t(1))),workspace:S(qe()),noCheck:S(qe())}),vf=`Only an owner or admin of this workspace can change workspace credentials.`;async function yf(e,t,n,r){let i=t.session?.user.id,a=e=>`${e.scope}/${e.name}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return C({error:`Invalid fields`},400);if(s===`id`){let e=nn(r),n=Zt(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:Qt(r)?n+1:n})).map(({id:e})=>({id:e}));return C(Qt(r)?an(a,n,e=>e.id):a)}let c=(await af(t.store,i,Qt(r)?void 0:Zt(r,200))).map(e=>df(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!Qt(r))return C(c.slice(0,Zt(r,200)));let l=nn(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.name,e.account?.email??``].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return C(an(d,Zt(r),a))}async function bf(e,t,n,r){let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=_f.safeParse(a);if(!o.success||Object.keys(o.data.env).length!==1)return C({error:`Invalid credential`},400);let{env:s}=o.data,c=!!o.data.workspace||!i;if(c&&!gm(t))return C({error:vf},403);if(s.CODEX_AUTH_JSON)return C({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&!t.config.subscriptions?.claude)return C({error:`Claude subscriptions are off on this server; add an API key.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&c&&t.auth)return C({error:`A Claude subscription is personal; add it without --workspace.`},400);let l=c?void 0:i,u=s.CLAUDE_CODE_OAUTH_TOKEN?`claude`:Object.keys(Kd).find(e=>Kd[e]in s)??`custom`;try{o.data.noCheck||await $d({engine:u,env:s},t.fetch??fetch);let{id:e,replaced:n}=await sf(t.store,t.config,{...l?{owner:l}:{},env:s},t.now??Date.now);return C({ok:!0,name:Yd(e).name,replaced:n})}catch(e){return e instanceof Zd?C({error:e.message},e.status):(console.error(`coder server: could not save credential`,e),C({error:`Could not save credential. Please try again.`},500))}}async function xf(e,t,n,r){let i=t.session?.user.id,a=r.searchParams.has(`workspace`)||!i;if(a&&!gm(t))return C({error:vf},403);let o=Jd(a?void 0:i,n.name);return await cf(t.store,o)?C({ok:!0}):C({error:`Unknown credential`},404)}async function Sf(e,t,n,r){let i=n.engine;return Bd(i),t.local&&(t.local.engineChecks=void 0),C(await Ud())}async function Cf(e,t,n,r){let i=n.engine;return await Vd(i),t.local&&(t.local.engineChecks=void 0),C(await Ud())}var wf=r({ConnectionError:()=>Bf,addConnection:()=>Kf,authorizeConnection:()=>ep,changeConnection:()=>qf,completeNativeConnection:()=>Ff,connectionAllowed:()=>If,connectionAuthorization:()=>Yf,connectionRow:()=>Af,connectionRows:()=>Uf,createConnection:()=>Zf,deleteConnection:()=>$f,findConnection:()=>Pf,listConnections:()=>Xf,nativeApp:()=>Rf,nativeConnections:()=>Mf,nativeCredential:()=>jf,removeConnection:()=>Jf,updateConnection:()=>Qf,visibleConnections:()=>Nf});const Tf=x().check(n(/^[a-z0-9][a-z0-9_-]*$/i)),Ef=ke([v({header:x().check(n(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),v({env:x().check(n(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),Df=v({name:x().check(t(1)),id:S(Tf),provider:S(Tf),owner:S(me(`me`)),access:S(Se([`read`,`write`])),endpoint:S(d),auth:S(Se([`none`,`key`,`oauth`])),key:S(x().check(t(1))),keyIn:S(Ef),credential:S(x().check(t(1)))}),Of=v({name:S(x().check(t(1))),access:S(Ze(Se([`read`,`write`]))),key:S(x().check(t(1)))});function kf(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`write`&&!!t.keyIn&&`env`in t.keyIn&&$e(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`read`&&!n.tools?.length||n.tools?.some(e=>!se(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!f(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(ge)}function Af(e,t,n){let r=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{r=!!E(n,e.secret).accessToken}catch{r=!1}return{id:e.id,name:e.name,provider:e.provider,auth:e.auth,...e.access?{access:e.access}:{},...e.owner?{owner:e.owner,...t===e.owner?{mine:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.account}:{},status:e.broken?`reconnect`:e.auth===`oauth`&&!r?`authorize`:`ok`,createdAt:e.createdAt}}function jf(e,t){let n=E(e,t);return typeof n==`string`?{token:n,app:void 0}:n}async function Mf(e,t){return!t||!e.auth?.linkedAccounts?[]:(await e.auth.linkedAccounts(t,e.store)).filter(t=>t.token&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:`${t}:${n.platform}-${Sr(`sha256`).update(n.platformUserId).digest(`hex`).slice(0,12)}`,name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,auth:`oauth`,secret:n.token,account:n.platformUserId,oauthApp:jf(e.config,n.token).app,createdAt:0}))}async function Nf(e,t,n){let r=await Mf(e,t),i=(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t).map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let t=r.find(t=>t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:t?.secret,account:t?.account??e.account}});return[...i,...r.filter(e=>!i.some(n=>n.id===e.id||n.owner===t&&n.provider===e.provider&&n.account===e.account))]}async function Pf(e,t,n){let r=await e.store.get(`connection`,t);return r?!r.owner||r.owner===n?r:void 0:(await Mf(e,n)).find(e=>e.id===t)}async function Ff(e,t,n,r){for(let{id:i,value:a}of await e.store.list(`connection`))a.owner!==t||a.provider!==n||a.auth!==`oauth`||a.account&&a.account!==r||await e.store.withAppLock(`connection:${i}`,async a=>{let o=await a.get(`connection`,i);!o||o.owner!==t||o.provider!==n||o.account&&o.account!==r||await a.put(`connection`,i,{...o,account:r,broken:void 0,secret:void 0,updatedAt:(e.now??Date.now)()})})}async function If(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await Pf(t,n.id,t.session?.user.id);if(!e)return C({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else if((await e.clone().json().catch(()=>void 0))?.owner===`me`)return t.auth&&t.session&&!t.local?t:C({error:`Personal connections need a signed-in member`},400);return _m(t,`Only workspace owners and admins can manage workspace connections`)}var Lf=class extends Error{};async function Rf(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([bh(e),e.store.list(`app`)]);r=[...t,...n.map(e=>e.value)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(E(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function zf(e,t,n){if(t.provider===`mcp`)return ca(e,t,n);if(!await Rf(e,t.provider))throw new Lf(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:wr(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var Bf=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const Z=(e,t)=>new Bf(e,t);async function Vf(e,t=200){try{return C(await e(),t)}catch(e){if(e instanceof Bf)return C({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function Hf(e){return e.json().catch(()=>void 0)}async function Uf(e,t){let n=e.session?.user.id,r=await Nf(e,n,`oauth`),i=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0;return r.map(r=>{let a=Af(r,n,e.config);return t&&r.auth===`oauth`&&(!i||!(`target`in i)||i.target!==`${r.id}:${r.createdAt}`)&&(a.status=`authorize`),a})}async function Wf(e,t,n,r){if(n.key&&n.credential)throw Z(400,`Give a key or a credential, not both`);if(n.key){let{id:i,replaced:a}=await sf(e.store,e.config,{...r?{owner:r}:{},env:{[t]:n.key}},e.now??Date.now);return a?{id:i}:{id:i,created:!0}}let i=(await af(e.store,r)).filter(n=>fn(e.config,n.value).env[t]!==void 0),a=n.credential?i.find(e=>e.id===n.credential):i.find(e=>r&&e.value.owner===r)??i.find(e=>!e.value.owner);if(!a)throw Z(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:a.id}}async function Gf(e,t,n){let r=t.keyIn.env;return(await Wf(e,r,{key:n},t.owner)).id}async function Kf(e,t){let n=Df.safeParse(t);if(!n.success)throw Z(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!Tf.safeParse(i).success)throw Z(400,`Invalid connection id`);let a=r.provider??`mcp`,o=r.owner===`me`?e.session.user.id:void 0;if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw Z(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw Z(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw Z(400,`Only environment connections use a credential`);let s=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(s===`key`&&!r.key&&a!==`env`)throw Z(400,`A key is required`);if(r.key&&s!==`key`)throw Z(400,`A key needs key authentication`);let c={id:o?`${o}:${i}`:i,name:r.name,provider:a,...o?{owner:o}:{},...r.access||a===`env`?{access:r.access??`write`}:{},auth:s,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:T(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!kf(e,c))throw Z(400,`Invalid endpoint or read-only tools`);if(await e.store.get(`connection`,c.id))throw Z(409,`Connection already exists`);let l;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(l=await ta(e,r.endpoint.url,!0),!l)try{await p({...c,access:`write`},void 0,e.fetch)}catch(t){if(!(t instanceof h)||!t.authenticate||(l=await ta(e,r.endpoint.url,!0,t.authenticate),!l))throw t}l&&(c.auth=`oauth`)}catch(e){throw e instanceof h?new Bf(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):(console.error(`coder server: connection discovery failed`,e),Z(502,`Could not start authorization`))}if(c.auth===`oauth`&&e.local?.port===0)throw Z(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let u=a===`env`?await Wf(e,r.keyIn.env,r,o):void 0;if(u&&(c.credential=u.id),!await e.store.withAppLock(`connection:${c.id}`,e=>e.create(`connection`,c.id,c)))throw u?.created&&await cf(e.store,u.id),Z(409,`Connection already exists`);try{let t=c.auth===`oauth`?await zf(e,c,l):void 0;return{...Af(c,o,e.config),...t?{authorize:t}:{}}}catch(t){throw t instanceof Lf||console.error(`coder server: connection authorization failed`,t),await e.store.withAppLock(`connection:${c.id}`,async e=>{let t=await e.get(`connection`,c.id);Or(t,c)&&await e.delete(`connection`,c.id)}),t instanceof Lf?Z(400,t.message):Z(502,`Could not start authorization`)}}async function qf(e,t,n){let r=Of.safeParse(n);if(!r.success)throw Z(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await Pf({...e,store:n},t,e.session?.user.id);if(!i)throw Z(404,`Unknown connection`);let{key:a,access:o,...s}=r.data;if(a&&i.auth!==`key`)throw Z(400,`This connection does not use a key`);let{access:c,...l}=i,u={...o===null?l:i,...s,...o?{access:o}:{},...a&&i.provider!==`env`?{secret:T(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!kf(e,u))throw Z(400,`Invalid read-only tools`);return a&&i.provider===`env`&&(u.credential=await Gf({...e,store:n},i,a)),await n.put(`connection`,u.id,u),Af(u,e.session?.user.id,e.config)})}async function Jf(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await Pf({...e,store:n},t,e.session?.user.id);if(!r)throw Z(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function Yf(e,t){let n=await Pf(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw Z(404,`Unknown OAuth connection`);try{return await zf(e,n)}catch(e){throw e instanceof Lf||console.error(`coder server: connection authorization failed`,e),e instanceof Lf?Z(400,e.message):Z(502,`Could not start authorization`)}}async function Xf(e,t){let n=new URL(e.url),r=n.searchParams.get(`authorization`)??void 0,i=n.searchParams.get(`wait`);if(!r||!i)return C(await Uf(t,r));let a=await t.store.watch(`delivery`,`connection-authorized:${r}`),o=Date.now()+25e3;try{for(;;){let n=await Uf(t,r),s=n.find(e=>e.id===i);if(!s||s.status===`ok`||Date.now()>=o||e.signal.aborted)return C(n);await a.wait(Math.min(1e4,o-Date.now()),e.signal)}}finally{a.close()}}async function Zf(e,t){let n=await Hf(e);return Vf(()=>Kf(t,n),201)}async function Qf(e,t,n){let r=await Hf(e);return Vf(()=>qf(t,n.id,r))}async function $f(e,t,n){return Vf(async()=>(await Jf(t,n.id),{ok:!0}))}async function ep(e,t,n){return Vf(async()=>({url:await Yf(t,n.id)}))}function tp(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}async function np(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=fn(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}async function rp(e,t,n={}){let r={},i={},a={...n},o={...t.tools},s=ht(t),c={},l=[],u=[],d=[...new Set(t.connections??[])],f=d.length?await e.store.list(`connection`,{ids:d,visibleTo:t.requester,secrets:`all`}):[],m=new Set(f.map(e=>e.id)),g,_=d.some(e=>!m.has(e))?await Mf(e,t.requester).catch(e=>(console.error(`coder server: native connection lookup failed`,e),g=e,[])):[],v=new Map([..._.map(e=>[e.id,e]),...f.map(({id:e,value:t})=>[e,t])]),y=await Promise.allSettled(d.map(async e=>{if(!v.has(e)&&g)throw g;return{id:e,value:v.get(e)}})),ee,te=y.sort((e,t)=>Number(t.status===`fulfilled`&&!!t.value.value?.owner)-Number(e.status===`fulfilled`&&!!e.value.value?.owner)),re=ne(te.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of te){let d,f=``;try{if(n.status===`rejected`)throw n.reason;if({id:f,value:d}=n.value,!d||d.owner&&d.owner!==t.requester)continue;if(d.provider===`env`&&(d.auth!==`key`||d.access!==`write`||d.endpoint||!d.credential||!d.keyIn||!(`env`in d.keyIn)||!$e(d.keyIn.env)||re.has(d.keyIn.env)||`local`in e&&e.local&&process.env[d.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(d.broken){l.push(`${d.name} needs reconnecting.`);continue}let m,g;if(d.provider!==`mcp`&&d.provider!==`env`&&d.auth===`oauth`){if(c[d.provider])continue;let n=d,r=e.integrations[n.provider];if(!r?.auth.user)throw Error(`Missing user OAuth`);let i=!n.owner&&n.secret?E(e.config,n.secret):void 0,a=n.owner?(await e.auth?.linkedAccounts?.(n.owner,e.store))?.find(t=>t.platform===n.provider&&t.token&&t.organizations?.includes(e.organizationId)&&(!n.account||t.platformUserId===n.account)):void 0,o=await Rf(e,n.provider,(a?.token?jf(e.config,a.token).app:void 0)??n.oauthApp??i?.app,await(ee??=Promise.all([bh(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value)])));if(!o)throw Error(`Missing integration credentials`);let s=n.owner?n.account??a?.platformUserId:void 0;if(n.owner&&!s)throw Error(`Missing linked account`);let l=n.owner?`native:${n.owner}:${n.provider}:${s}`:`connection:${f}`;m=await e.store.withAppLock(l,async i=>{let a=await Pf({...e,store:i},f,t.requester);if(!a||a.owner!==n.owner||a.provider!==n.provider||a.broken)throw Error(`Connection changed during resolution`);d=a;let c=(a.owner?await e.auth?.linkedAccounts?.(a.owner,i):[])?.find(t=>t.platform===a.provider&&t.token&&t.organizations?.includes(e.organizationId)&&t.platformUserId===s&&(!a.account||t.platformUserId===a.account)),l=a.owner?void 0:a.secret&&E(e.config,a.secret),p=c?.token?jf(e.config,c.token):void 0,m=a.owner?p?.token:l&&l.token;if(!m)throw Error(`Missing native credential`);u.push(...tp(m));let h=p?.app??a.oauthApp??(l?l.app:void 0);if(h&&h!==o.id)throw Error(`OAuth client changed during resolution`);let g;try{g=await r.auth.user.access(m,E(e.config,o.credentials),{fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)})),now:(e.now??Date.now)()})}catch(e){throw e instanceof xt&&[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`].includes(e.error??``)?new ye(`Native credential was revoked`):e}if(g.refreshed)if(u.push(...tp(g.refreshed)),a.owner){if(!c||!await e.auth?.refreshLinkedToken?.(a.owner,c.platform,c.platformUserId,c.token,T(e.config,{app:o.id,token:g.refreshed}),i))throw Error(`Linked account changed during refresh`)}else a.secret=T(e.config,{app:o.id,token:g.refreshed}),await i.put(`connection`,f,a);else if(a.owner&&!(await e.auth?.linkedAccounts?.(a.owner,i))?.some(e=>e.platform===c?.platform&&e.platformUserId===c.platformUserId&&e.token===c.token))throw Error(`Linked account changed during resolution`);return g.accessToken})}else if(d.provider===`env`)m=await np(e,d);else if(d.auth!==`none`){if(!d.secret)throw Error(`Missing credential`);let t=E(e.config,d.secret);if(u.push(...[t.key,t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),d.auth===`key`){if(!t.key)throw Error(`Missing key`);m=t.key}else{let t=d.owner;g=async(n=!1,r)=>{let i=await e.store.withAppLock(`connection:${f}`,async i=>{let a=await i.get(`connection`,f);if(!a||a.owner!==t||a.broken||a.auth!==`oauth`)throw Error(`Connection changed during resolution`);if(!a.secret)throw Error(`Missing credential`);let o=E(e.config,a.secret);u.push(...[o.accessToken,o.refreshToken,o.clientSecret].filter(e=>!!e));let s=AbortSignal.timeout(5e3);return{connection:a,token:await Ue({secret:o,now:(e.now??Date.now)(),force:n&&o.accessToken===r,fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:s})),save:async t=>{u.push(...[t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),a.secret=T(e.config,t),await i.put(`connection`,f,a)}})}});return d=i.connection,i.token},m=await g()}}if(m&&u.push(m),d.provider===`env`)i[d.keyIn.env]=m;else if(d.provider===`mcp`){let t=d.access??s,n;try{n=await p({...d,access:t},m,e.fetch??fetch)}catch(r){if(!(r instanceof h)||!g)throw r;m=await g(!0,m),u.push(m),n=await p({...d,access:t},m,e.fetch??fetch)}n&&(r[f]={...n,description:d.name,access:t})}else if(!c[d.provider]&&m){let t=e.integrations[d.provider];if(!t)throw Error(`Unknown integration`);c[d.provider]=m,a[d.provider]=m,(d.access||!o[d.provider])&&(o[d.provider]=[...t.tools.presets[d.access??s]])}}catch(t){if(d&&ae(t)){let t=d;await e.store.withAppLock(`connection:${f}`,async n=>{let r=await n.get(`connection`,f);r&&r.secret===t.secret&&await n.put(`connection`,f,{...r,broken:{at:(e.now??Date.now)(),reason:`Needs reconnecting`}})})}l.push(Re(d?.name??`A connection`,t))}}return{mcp:r,env:i,tokens:a,nativeTokens:c,tools:o,warnings:l,secrets:u}}async function ip(e,t,n){if(!t.task.connections?.length)return{mcp:{},env:{},tokens:n,nativeTokens:{},tools:t.task.tools,warnings:[],secrets:[]};let r=Sr(`sha256`).update(JSON.stringify(t.task.connections)).digest(`hex`).slice(0,12),i=`connections:${t.task.id}:${t.generation??0}:${t.attempts}:${r}`,a=await e.store.get(`snapshot`,i);if(a&&`resolvedConnections`in a){let t=E(e.config,a.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n,...t.nativeTokens}}}let o=await e.store.get(`task`,t.task.id),s=await rp(e,t.task,n);return!s.warnings.length&&o&&await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0))return;let a=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,i,{resolvedConnections:T(e.config,s),expiresAt:a},{ttlMs:Math.max(1,a-(e.now??Date.now)())})}),s}function ap(e,t,n){let r=(e.now??Date.now)()+(e.config.taskTimeoutMs??36e5);return[...new Set(n)].filter(e=>e.length>=8).map(n=>({id:`connection-secrets:${t}:${Sr(`sha256`).update(n).digest(`hex`).slice(0,24)}`,value:T(e.config,n),expiresAt:r}))}async function op(e,t,n){let r=ap(e,t,n);return r.length&&await e.store.saveTaskSecrets(t,r),[...new Set(n)].filter(e=>e.length>=8)}async function sp(e,t){let n=[],r=[...new Set(t.connections??[])],i=r.length?await e.store.list(`connection`,{ids:r,visibleTo:t.requester,secrets:`all`}):[],a=r.some(e=>!i.some(t=>t.id===e))?await Mf(e,t.requester):[],o=new Map([...a.map(e=>[e.id,e]),...i.map(({id:e,value:t})=>[e,t])]);for(let t of r){let r=o.get(t);if(r?.provider===`env`){n.push(...await np(e,r).then(e=>[e],()=>[]));continue}if(!r?.secret)continue;let i=E(e.config,r.secret);n.push(...typeof i==`string`?[i]:[...`token`in i&&typeof i.token==`string`?tp(i.token):[],i.key,i.accessToken,i.refreshToken,i.clientSecret].filter(e=>!!e))}return n}async function cp(e,t){let[n,r,i]=await Promise.all([e.store.get(`snapshot`,`connection-secrets:${t.id}`),e.store.list(`snapshot`,{prefix:`connection-secrets:${t.id}:`}),sp(e,t)]);if(n)throw Error(`Task ${t.id} keeps its secrets in the old single-row layout`);let a=r.flatMap(t=>`secret`in t.value?[E(e.config,t.value.secret)]:[]);return[...new Set([...a,...i])]}async function lp(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);for(let n of[`connection-secrets:${t}:`,`connections:${t}:`])for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id)})}function up(e,t=Date.now()){let n=e.status===`running`||e.status===`waiting`?t:e.finishedAt??e.updatedAt;return{lastActivityAt:e.updatedAt,lastTurnMs:e.startedAt===void 0?0:Math.max(0,n-e.startedAt)}}const dp=e=>({[e.key.slice(0,e.key.indexOf(`:`))]:e.through});var fp=class extends Error{};const Q=[`queued`,`running`,`waiting`];function pp(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(n&&!n.includes(e.status)||t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.reviewKey&&xp(e.task)!==t.reviewKey||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const mp=e=>({rank:fe(e.status),createdAt:e.createdAt,id:e.task.id}),hp=e=>({updatedAt:e.updatedAt,id:e.task.id}),gp=(e,t)=>e.updatedAt-t.updatedAt||Te(e.task.id,t.task.id),_p=(e,t)=>Ce(mp(e),mp(t)),vp=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:Ce(mp(e),t)>0);function yp(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent])}function bp(e,t){return e.flow==="default"&&!!e.event?.chat&&yp(e)===yp(t)}function xp(e){let t=e.event;if(e.flow!==`review`||!t)return;let n=Tt[t.integration]?.repos?.pullRequest(t);if(n!==void 0)return JSON.stringify([t.appId,t.installationId,t.repo?.owner,t.repo?.name,n])}const Sp=6e5;async function Cp(e,t){let n=t.task.id,r={generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};return e.queue.deleteTask(e.organizationId,n,r)}const wp=(e,t)=>({...e,context:{...e.context,admissions:{...e.context?.admissions,...t}}});async function Tp(e,t,n,r,i){let a=t.task.id,o=await e.queue.appendInbox(e.organizationId,a,n,r,(e.now??Date.now)(),t.generation??0,i);return o&&await Ap(e,a,t.task,t),o}async function Ep(e,t,n=-1,r){return r??=(await e.store.get(`task`,t))?.generation??0,e.queue.readInbox(e.organizationId,t,r,n)}const Dp=new Set([`completed`,`failed`,`cancelled`]);var Op=class{store;lock=Promise.resolve();tombstones=new Map;constructor(e){this.store=e}async metrics(e,t){let n=await this.list(e),r={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0};for(let e of n)e.createdAt>=t&&r[e.status]++;return{tasks:r,queueDepth:n.filter(e=>e.status===`queued`).length}}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i?.pending?.task&&await this.store.put(`delivery`,n.key,{at:t,...n.owner?{owner:n.owner}:{},pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:e,status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}async admit(e,t,n){if(!t)return;let{conversation:r,unseen:i}=t;r&&await this.store.putMany(`delivery`,[{id:r.key,value:r.record},{id:r.root,value:{at:r.record.at}}],{ttlMs:r.ttlMs}),i&&await this.store.acknowledgeUnseen(i.key,i.version,i.epoch);for(let e of t.secrets??[])await this.store.put(`snapshot`,e.id,{secret:e.value,expiresAt:e.expiresAt},{ttlMs:Math.max(1,e.expiresAt-n)})}deliver(e,t,n,r,i,a,o=!0,s){return this.serial(async()=>{let c=await this.store.get(`delivery`,r.key);if(c&&!c.pending)return{};if(c?.pending?.inbox){let{taskId:e,id:i,entry:a}=c.pending.inbox,o=await this.read(e);if(o&&Q.includes(o.status)&&(o.generation??0)===a.generation&&bp(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),c=void 0}let l=i!==void 0&&!c?.pending?.task?(await this.list(e,{statuses:Q,agent:t.agent,source:t.source})).find(e=>bp(e.task,t)):void 0;if(!l)return!o||!await this.insert(t,n,r,a)?{}:(await this.admit(t,s,n),{taskId:t.id});let u=await this.nextSeq(l.task.id),d={seq:u,generation:l.generation??0,at:n,kind:`steer`,value:{text:i}},f=`${l.task.id}:${String(u).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:l.task.id,id:f,entry:d}}}),await this.store.put(`task`,l.task.id,{...l,inboxSeq:u,updatedAt:n}),await this.store.put(`inbox`,f,d),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=new Set(n.filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>xp(e.task)).filter(e=>e!==void 0)),i=n.filter(e=>{let t=xp(e.task);return e.status===`queued`&&(t===void 0||!r.has(t))}).sort((e,t)=>e.createdAt-t.createdAt),a=i[0];if(!a)return;let o=tc(a.task.id,`default`,a.attempts+1),s={...a,tokenHash:o.hash,lastSeenAt:e,status:`running`,attempts:a.attempts+1,startedAt:e,updatedAt:e};await this.store.put(`task`,s.task.id,s);let c=xp(a.task);return{organizationId:`default`,status:s,token:o.token,more:i.some(e=>e!==a&&(c===void 0||xp(e.task)!==c))&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&Dp.has(e.status)||e.status===`queued`)return;if(Dp.has(e.status))return e;let o={...e,lastSeenAt:i,updatedAt:i};return await this.store.put(`task`,t,o),o})}async authorize(e,t,n,r,i,a={}){let o=await this.touch(r,e,t,n,i,a.allowCompleted);return o&&{organizationId:`default`,status:o}}async archiveStopped(e,t,n){let r=e=>e!==void 0&&Dp.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&re(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,...o}=n;return await this.store.put(`task`,t,{...e,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...o,...a===void 0?{}:{answer:[...e.answer??[],a]},updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t),await lp(this.store,t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);return!e||!Dp.has(e.status)||!this.allowed(e,i)?!1:(await this.store.put(`task`,t,{task:{...e.task,...n},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0)})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage);for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);await this.store.put(`task`,t,{...e,...n.outcome,...n.logsComplete?{logsComplete:!0}:{},lastSeenAt:r,finishedAt:r,updatedAt:r});for(let e of n.known??[])await this.store.put(`delivery`,e.id,{at:r},{ttlMs:e.ttlMs});return await lp(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await lp(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||Dp.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await lp(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>pp(e,t)).filter(e=>vp(e,n)).sort(t.since===void 0?_p:gp).slice(0,t.limit)}tombstone(e){this.tombstones.set(e,Date.now())}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,t]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,e])=>e>t).map(([e,t])=>({organizationId:n,id:e,at:t}))}}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>pp(e,t));return{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes,updatedAt:a}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!Q.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if(Dp.has(e.status))return n.seq<=i?e.status:void 0;if(![`running`,`waiting`].includes(e.status))return;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c),u=Object.assign({},...a.map(e=>e.value.value?.admissions)),d={...e,...Object.keys(u).length?{task:wp(e.task,u)}:{},inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,finishedAt:Date.now()}:{},updatedAt:Date.now()};await this.store.put(`task`,t,d);for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await lp(this.store,t),d.status})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a,o){let s=async()=>{if(o&&(await this.store.get(`delivery`,o.key))?.sending?.owner!==o.owner)throw new fp;let e=await this.read(t);if(!e||!Q.includes(e.status)||(e.generation??0)!==a)return;let s=await this.nextSeq(t),c=o&&dp(o),l={seq:s,generation:a,at:i,kind:n,value:c?{...r,admissions:c}:r};return await this.store.put(`inbox`,`${t}:${String(s).padStart(8,`0`)}`,l),await this.store.put(`task`,t,{...e,...c?{task:wp(e.task,c)}:{},inboxSeq:s,updatedAt:i}),o&&await this.store.finishBatch(o.key,o.owner,!0,o.through),l};return this.serial(()=>o?this.store.withAppLock(`batch:${o.key}`,s):s())}};const kp=3e4;function Ap(e,t,n,r){if(n&&!e.local&&!n.runnerId&&!e.runners[n.runner]?.push)return Promise.resolve();let i=e.queue.inboxDelivery??=new Map,a=JSON.stringify([e.organizationId,t]),o=i.get(a);if(o||i.set(a,o={}),o.work)return o.again=!0,o.work;let s=o,c=async()=>{let n,i=Tr(),a=0,o=0,c,l=r,u=async()=>{for(;;){s.again=!1;let r=l??await e.store.get(`task`,t);if(l=void 0,!r?.handle||![`running`,`waiting`].includes(r.status))return;let c=await pn(e,r.task),u=!!(e.local&&r.handle.startsWith(`cli:`));if(!u&&!c?.push)return;o=r.generation??0;let d={generation:o,attempts:r.attempts,tokenHash:r.tokenHash??null,handle:r.handle},f=`inbox:${JSON.stringify([t,d])}`;if(n!==f){n&&await e.store.updateDeliveryLease(n,i),n=void 0;let t=await e.store.claimDeliveryLease(f,i,kp);if(t===void 0)return;n=f,a=t}else if(!await e.store.updateDeliveryLease(n,i,{owner:i,failures:a},{ttlMs:kp}))return;let p=(await e.queue.readInbox(e.organizationId,t,r.generation??0,-1)).slice(0,100);if(!p.length){if(s.again)continue;return}let m=u?await Td(e,r,p):await c.push(r.handle,p);if(m.generation!==(r.generation??0)||!p.some(e=>e.seq===m.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,m,d)||(a=0,p.length<100&&!s.again))return}};try{await u()}catch(r){if(console.error(`coder server: inbox delivery failed for ${t}`,r),n){let t=Math.min(3e4,1e3*2**Math.min(a,5)),r={owner:i,failures:a+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,i,r,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,i),c=o)}return c};return s.work=(async()=>{for(;;){let n=await c();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!s.again)break}i.delete(a)})().finally(()=>{i.get(a)===s&&i.delete(a)}),s.work}async function jp(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>Ap(H(e,t),n.task.id)))}function Mp(e,t){let n=jp(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function Np(){return(process.env.PATH??``).split(B.delimiter).some(e=>{try{let t=B.join(e,`docker`);return hr(t,gr.X_OK),yr(t).isFile()}catch{return!1}})}function Pp(e){let t=!!e.local,n=t&&Np();return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:xn,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0}],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0}],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0}],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const Fp=x().check(t(1),e(80)),Ip=Se([`personal`,`workspace`]),Lp=l(x(),x()),Rp=v({kind:Se([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:Fp,scope:Ip,config:Lp}),zp=v({name:S(Fp),default:S(me(!0)),config:S(Lp)});function Bp(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const Vp=(e,t)=>({value:n})=>mn(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function Hp(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?gm(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(Vp(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return Bp(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function Up(e,t,n,r){return C({items:Wp(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:Pp(t)})}function Wp(e,t,n){let r=t.filter(Vp(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:bn(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>Bp(e,t,n,e===i?.id))]}async function Gp(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=Hp(t);{let n=Rp.safeParse(await e.json().catch(()=>void 0));if(!n.success)return C({error:`Invalid runner`},400);if(!o(n.data.scope))return C({error:`This scope requires a member or workspace admin.`},403);let r=Pp(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return C({error:r.reason??`Pair this runner with runner serve.`},400);try{Sn(r,n.data.config)}catch(e){return C({error:e.message},400)}let s=Yp(n.data.kind,n.data.config,t),l=`rnr_${wr(9).toString(`base64url`)}`,u={...n.data,...s,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),C(await c(l,u))}}async function Kp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Hp(t);if(i===bn(t))return C(await _n(t));let u=e=>{if(!e||!mn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!gm(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)},d=await t.store.get(`runner`,i),f=u(d);if(f)return f;let p=await _n(t,d);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===d.secret&&JSON.stringify(n.config)===JSON.stringify(d.config)&&await e.put(`runner`,i,{...n,lastSeen:p.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),C(p)}async function qp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Hp(t);if(i===bn(t)){if(gm(t)){let n=zp.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return C({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{for(let{id:t,value:n}of await e.list(`runner`))n.scope===`workspace`&&n.default&&await e.put(`runner`,t,{...n,default:!1,updatedAt:o})});let r=(await c()).some(({value:e})=>e.scope===`personal`&&e.default);return C({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return C({error:`The server default cannot be renamed or removed.`},403)}let u=e=>{if(!e||!mn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!gm(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=u(r);if(a||!r)return a;{let a=zp.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return C({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...E(t.config,r.secret),...a.data.config};try{Sn(Pp(t).find(e=>e.kind===r.kind),e)}catch(e){return C({error:e.message},400)}s=Yp(r.kind,e,t)}if(a.data.default)for(let e of await n.list(`runner`))e.id!==i&&e.value.scope===r.scope&&e.value.owner===r.owner&&e.value.default&&await n.put(`runner`,e.id,{...e.value,default:!1,updatedAt:o});let c={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,c),C(await l(i,c,n))}})}async function Jp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Hp(t);if(i===bn(t))return C({error:`The server default cannot be renamed or removed.`},403);let u=e=>{if(!e||!mn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!gm(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=u(n);if(r||!n)return r;{let n=(await e.list(`task`)).filter(({value:e})=>e.task.runnerId===i&&Q.includes(e.status)).length;return n?C({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),t.settings?.runnerInstances?.delete(i),C({ok:!0}))}})}function Yp(e,t,n){let r=new Set(Pp(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:T(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const Xp=v({name:S(Fp),scope:Ip});async function Zp(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=Hp(t),l=Xp.safeParse(await e.json().catch(()=>void 0));if(!l.success)return C({error:`Invalid pairing`},400);if(!o(l.data.scope))return C({error:`This scope requires a member or workspace admin.`},403);let u=`${Buffer.from(t.organizationId).toString(`base64url`)}.${wr(32).toString(`base64url`)}`,d=a+9e5;await t.store.put(`snapshot`,`runner-pair:${St(u)}`,{...l.data,owner:l.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:d},{ttlMs:9e5});let f=t.config.publicUrl??r.origin;return C({token:u,expiresAt:d,command:`coder runner serve --url ${f} --token ${u}`})}const Qp=v({token:S(x()),id:S(x()),organizationId:S(x()),name:S(x().check(t(1),e(80))),url:x(),secret:x().check(t(32)),offline:S(qe())});async function $p(e,t,n,r){let i=Qp.safeParse(await e.json().catch(()=>void 0));if(!i.success)return C({error:`Invalid runner registration`},400);let a=i.data;try{new dn({url:a.url,secret:a.secret})}catch{return C({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return C({error:`Invalid runner token`},401);t=H(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${St(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return C({error:`Pairing token expired or already used`},401);r=`rnr_${wr(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...Yp(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!Ct(E(t.config,i.secret).secret??``,a.secret))return C({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}return await e.put(`runner`,r,n),C({...Bp(r,n,s),organizationId:o})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}async function em(e,t,n,r=!1,i){let a=ym(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=nc(a);return o.task!==n||o.organization!==t.organizationId||!Number.isInteger(o.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.authorize(n,ec(a),o.attempt,t.organizationId,(t.now??Date.now)(),{allowCompleted:r,include:i})??new Response(`Unauthorized`,{status:401})}function tm(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}async function nm(e,t,n,r){let i=n.id,a=ym(e),o=nc(a),s=ec(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return C({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?C(l):new Response(`Unauthorized`,{status:401})}async function rm(e,t,n,r){let i=n.id,a=ym(e),o=nc(a),s=ec(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return C({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u===`cancelled`){let e=await t.store.get(`task`,i);e&&await Fo(t,e)}return u?C({ok:!0}):new Response(`Unauthorized`,{status:401})}async function im(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return C({error:`Invalid task logs`},400);let i=await xc(t,t.callbackTask,r);return i===`ok`?C({ok:!0}):i===`gap`?C({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function am(e,t,n,r){let i=n.id,a=ym(e),o=nc(a),s=ec(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?C({ok:!0}):new Response(`Unauthorized`,{status:401})}async function om(e,t,n,r){let i=n.id;ym(e);let a=t.callbackTask,o=a.handle?await pn(t,a.task):void 0;if([`completed`,`failed`,`cancelled`].includes(a.status))return await Fo(t,a,!1,o),C({ok:!0});let s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status)||s.installationRevoked!==void 0&&s.installationRevoked!==!0||s.machine!==void 0&&s.machine!==!0||s.postedMessages!==void 0&&(!Array.isArray(s.postedMessages)||s.postedMessages.some(e=>typeof e!=`string`)))return C({error:`Invalid task result`},400);let c=await bc(t,a,!0);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c(t):t)));let l=(t.now??Date.now)(),u=a.task.event?Fc(a.task.event,s.postedMessages??[]):[];if(s.status===`running`||s.status===`waiting`)return u.length&&await Ic(t,a.task.event,s.postedMessages,l),await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),C({ok:!0});let d=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),f={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:d,...typeof s.diff==`string`?{diff:s.diff}:{}},p=!o||o.kind===`vercel-sandbox`||o.kind===`local-docker`,m=await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,known:u.map(e=>({id:e,ttlMs:Tc})),logsComplete:!!a.handle&&!p,outcome:{status:s.status,result:f,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:tm(a.task),...a.task.usage?.engine??a.task.definition.engine?{engine:a.task.usage?.engine??a.task.definition.engine}:{},...a.task.usage?.model??a.task.definition.model?{model:a.task.usage?.model??a.task.definition.model}:{},credential:a.task.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l),h=a.task.event;if(m&&s.status===`failed`&&s.installationRevoked&&h&&t.integrations[h.integration]?.isUninstalled&&await Gu(t.store,`${h.appId}:${h.installationId}`,l),m&&s.machine&&h&&a.task.source===h.integration){let e=await t.store.get(`app`,h.appId),{recordFailure:n}=await Promise.resolve().then(()=>yl);e&&await n(t,e,s.error??`The machine failed`,h.installationId,h,async()=>(await cm(t,a)).replies)}return m&&await Fo(t,p?a:{...a,logsComplete:!0},!1,o),C({ok:!0})}const sm=/^[a-f0-9-]{36}$/;async function cm(e,t){let n=t.task.event;if(!n||t.task.source!==n.integration)throw Error(`The task has no conversation`);let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation app is gone`);let{eventReplies:i}=await Promise.resolve().then(()=>Sl);return{event:n,replies:await i(e,r,n)}}async function lm(e,t,n,r){let i=e.callbackTask,a=`${t}:${i.task.id}:${i.generation??0}:${n}`,o=(e.now??Date.now)();if(!await e.store.create(`delivery`,a,{at:o},{ttlMs:864e5}))return C({ok:!0,duplicate:!0});try{await r(await cm(e,i))}catch(t){return await e.store.delete(`delivery`,a),C({error:t instanceof Error?t.message:String(t)},409)}return C({ok:!0})}async function um(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!sm.test(n.id))return C({error:`Invalid call id`},400);if(typeof n.text!=`string`||!n.text.trim())return C({error:`Reply text is required`},400);let r=n.text.trim();return lm(t,`reply`,n.id,async({event:e,replies:n})=>{let i=await n.post(r,!0);i&&await Ic(t,e,i.ids??(i.id?[i.id]:[]),(t.now??Date.now)())})}async function dm(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!sm.test(n.id))return C({error:`Invalid call id`},400);if(typeof n.emoji!=`string`||!n.emoji.trim())return C({error:`Emoji is required`},400);if(n.message!==void 0&&(typeof n.message!=`string`||!n.message.trim()))return C({error:`Message id must be a non-empty string`},400);let{emoji:r,message:i}=n;return lm(t,`react`,n.id,async({replies:e})=>{if(!e.react)throw Error(`The conversation cannot add reactions`);await e.react(r.trim(),i)})}async function fm(e,t,n,r){n.id,ym(e);let i=t.callbackTask,a=await e.json().catch(()=>({}));if(typeof a.authJson!=`string`||!i.task.credential)return C({error:`Invalid credential update`},400);let o=typeof a.credentialId==`string`?a.credentialId:i.task.credential;return o!==i.task.credential&&o!==i.task.engineCredentials?.codex?C({error:`Invalid credential update`},400):C({kept:await pf(t.store,t.config,o,a.authJson)})}async function pm(e,t,n,r){n.id,ym(e);let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await ed(t,i);return C({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return C({error:e instanceof Error?e.message:String(e)},409)}}async function mm(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...H(t,n.organizationId),session:n}}const hm=new Set([`owner`,`admin`]);function gm(e){return!e.auth||hm.has(e.session?.role??``)}function _m(e,t){return gm(e)?e:C({error:t},403)}function vm(e,t){return!!(e&&t&&Ct(e,t))}function ym(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const bm=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function xm(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return bm.has(new URL(`http://${t}`).hostname)}catch{return!1}}const Sm=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,Cm=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,wm=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function Tm(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(bm.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||Cm(r)||wm.some(e=>r.startsWith(e))}function Em(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(xm(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!xm(e)&&(n.pathname===`/connections/oauth/client.json`||Cm(n.pathname)||wm.some(e=>n.pathname.startsWith(e)))}function Dm(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function Om(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function km(e,t){if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!xm(e))return n();let r=Om(e),i=vm(ym(e),t.config.adminToken),a=vm(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||Dm(e)?{...t,authorizedRequest:e}:$t():n()}let n=await t.auth.session(e.headers,e.method!==`GET`);if(n?.stale)return C({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(n?.organizationDenied)return C({error:`You are not a member of that workspace.`},403);let r=n?.role;return!n?.organizationId||!r?C({error:`Sign in first.`,hint:`coder auth login`},401,ym(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!Dm(e,t.config.publicUrl)?$t():{...H(t,n.organizationId),auth:t.auth,session:n,authorizedRequest:e}}async function Am(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?tn(new URL(e.url)):{...H(t,i.organizationId),session:i}}async function jm(e,t){if(e.method!==`POST`)return;let n=Qp.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=H(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&Ct(E(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function Mm(e,t,n,r){let i=n.id,a=ym(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=nc(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=H(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function Nm(e,t,n,r,i=!1,a){let o=n.id,s=ym(e),c=s&&Rm(s);c&&t.scope&&(t=H(t,c));let l=await em(e,t,o,i,a);if(l instanceof Response)return l;let{status:u,loaded:d}=l;return{...t,...d?{store:Oo(t.store,u,d)}:{},callbackTask:u}}const Pm=(e,t)=>(n,r,i,a)=>Nm(n,r,i,a,t(n),e),Fm=Pm(`secrets`,e=>e.method===`POST`),Im=Pm(`secrets`,()=>!0),Lm=Pm(`context`,()=>!1);function Rm(e){let{organization:t}=nc(e);return typeof t==`string`?t:void 0}async function zm(e,t,n){let r=ym(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=Rm(r),a=i&&t.scope&&i!==t.organizationId?H(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!Ct(ec(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function Bm(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??rn(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function Vm(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??n.id??``))return Mi(e,t);let i=await Bm(e,r),a=t.serverOrganizationId??t.organizationId;return i&&Ur(t,i)===`*`&&Hr(t,i)===a?{...H(t,a),operatorApp:!0}:Am(e,t)}function Hm(e,t,n,r){return/^[a-z0-9_-]+$/.test(n.integration??n.id??``)?Am(e,t):Mi(e,t)}async function Um(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??``))return Mi(e,t);if(!t.integrations[n.integration]?.auth.user||!t.auth||!t.config.publicUrl)return en();if(e.method!==`GET`)return t;let i=await mm(e,t);return i?.session?i:tn(r)}async function Wm(e,t,n,r){if(t.local&&!t.auth)return Ym(e,t);if(!t.auth)return en();let i=await mm(e,t);return i?.session?i:tn(r)}function Gm(e,t){return _m(t,`Workspace admin access is required.`)}const Km=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function qm(e,t){return Km(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?C({error:`Operator mode ended. Sign in again to continue.`},401):t:en()}async function Jm(e,t,n,r){let i=await ih(e,t,n,r);return i instanceof Response||!t.auth?i:Km(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):en()}function Ym(e,t){return t.local?t:en()}function Xm(e,t){return t.local?C({error:Ld},400):t.session?.user.id?t:C({error:`Sign in to use a subscription.`},403)}function Zm(e){return async(t,n,r,i)=>{let a=n.authorizedRequest===t?n:await km(t,n);return a instanceof Response?a:e?e(t,a,r,i):a}}function Qm(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!zd(n.engine))?C({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function $m(e,t,n,r){return t.config.publicUrl&&t.auth?t:Mi(e,t)}async function eh(e,t,n,r){if(!t.auth)return km(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?C({error:`You are not a member of that workspace.`},403):i?{...t,session:i}:C({error:`Sign in first.`,hint:`coder auth login`},401)}function th(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!xm(e)?en():Dm(e)?t:$t():t}async function nh(e,t,n,r){return e.method===`GET`?{...t,session:(await mm(e,t))?.session}:t}async function rh(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await mm(e,t))?.session?w(`/dash`):t}async function ih(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return Ei(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return w(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await di(u,t.dashboardHosts)?w(`${u}${r.search}`):t.auth&&e.method===`GET`&&await di(`${c}${l}`,t.dashboardHosts)?w(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):en()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...H(t,c.id),session:o}):t}function ah(e,t,n,r){return e.method===`POST`&&t.local?C({error:Ld},400):t}async function oh(e,t,n,r){if(![`GET`,`POST`].includes(e.method))return t;if(!t.auth)return en();if(e.headers.get(`authorization`)?.startsWith(`Bearer `))return C({error:`Link your account from the browser.`},403);let i=await mm(e,t);return i?.session?i:e.method===`GET`?tn(r):C({error:`Sign in first.`},401)}function sh(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:en()}async function ch(e,t,n,r){if(!t.auth)return C({mode:Sm(t),organization:{id:t.organizationId,slug:`local`},server:lh(t),operator:Km(t)});let i=t.session;return C({mode:Sm(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:lh(t),operator:Km(t,i)})}function lh(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function uh(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function dh(e,t){let n=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug??t?.slug;return n||!e.auth?n??`local`:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const fh=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??fh(uh(e),`/setup`);return w(`${ph(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const ph=e=>e.local?`http://localhost:${e.local.port}`:``,mh=(e,t)=>fh(uh(e),`/agents/${encodeURIComponent(t)}/platforms`);function hh(e){let t=e.get(`agent`),n=e.get(`def`),r=rn(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const gh=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,_h=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function vh(e,t,n,r){let i=await qr(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=rn(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await Gr(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}var yh=r({serverAppLink:()=>xh,serverAppUrl:()=>Sh,sharedApps:()=>bh});async function bh(e,t){let n=e.serverOrganizationId&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store;return(await(n===e.store&&t?t:n.list(`app`))).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)}async function xh(e,t={}){let n=cn(t.env??fr.env),r=wt(n.integrations);if(!r[e])throw new nt(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(r[e].app.builtin!==`shared`)throw new nt(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new nt(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await Wa(n);try{let a=i.defaultOrganizationId;return{url:await Sh({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function Sh(e,t,n){if(e.integrations[t]?.app.builtin!==`shared`)throw new nt(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=dt();if(!r)throw new nt(`invalid-option`,`This server ships no default agent.`);let i={...mt()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:sn(i),...n.owner?{owner:n.owner}:{},public:!0},o=await zr(e,`create`,`*`,_h(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${ph(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{om as $,Hi as $n,xu as $t,Ym as A,qa as An,Cf as At,Dm as B,Ka as Bn,Ku as Bt,ah as C,es as Cn,zr as Cr,of as Ct,Mm as D,zo as Dn,hf as Dt,Qm as E,Ro as En,yf as Et,Um as F,no as Fn,ld as Ft,Nm as G,Pa as Gn,Mu as Gt,Sm as H,Na as Hn,Du as Ht,qm as I,eo as In,bd as It,am as J,ya as Jn,ju as Jt,oh as K,za as Kn,Vu as Kt,Jm as L,Qa as Ln,xd as Lt,zm as M,Ja as Mn,Ed as Mt,Im as N,ro as Nn,Dd as Nt,Hm as O,xo as On,rf as Ot,$m as P,Za as Pn,pd as Pt,im as Q,ha as Qn,yu as Qt,nh as R,to as Rn,md as Rt,Vm as S,$o as Sn,qr as Sr,bf as St,th as T,Po as Tn,xf as Tt,rh as U,Ma as Un,Ru as Ut,Fm as V,xa as Vn,Hu as Vt,Tm as W,Ra as Wn,zu as Wt,nm as X,_a as Xn,cu as Xt,pm as Y,da as Yn,Iu as Yt,fm as Z,fa as Zn,wu as Zt,Zm as _,bc as _n,ti as _r,Zf as _t,gh as a,mu as an,Ri as ar,Up as at,Wm as b,ys as bn,Zr as br,wf as bt,$ as c,su as cn,ci as cr,Wp as ct,vh as d,ru as dn,Ti as dr,Sp as dt,vu as en,la as er,dm as et,fh as f,nu as fn,ji as fr,jp as ft,eh as g,yc as gn,ei as gr,If as gt,bm as h,xl as hn,Di as hr,ep as ht,bh as i,pu as in,Bi as ir,Jp as it,Xm as j,oo as jn,Ud as jt,Em as k,Co as kn,Sf as kt,mh as l,eu as ln,Mi as lr,qp as lt,uh as m,Gl as mn,xi as mr,up as mt,xh as n,Eu as nn,Vi as nr,Kp as nt,_h as o,gu as on,Ni as or,Zp as ot,ch as p,ql as pn,ki as pr,Mp as pt,rm as q,ba as qn,Bu as qt,Sh as r,Tu as rn,zi as rr,Gp as rt,ph as s,hu as sn,H as sr,$p as st,yh as t,bu as tn,ia as tr,um as tt,hh as u,tu as un,wi as ur,Op as ut,Gm as v,tc as vn,$r as vr,$f as vt,ih as w,Bo as wn,Gd as wt,Lm as x,X as xn,Yr as xr,Qf as xt,sh as y,$s as yn,Xr as yr,Xf as yt,_m as z,Wa as zn,Nd as zt};