@wular/coder 0.4.12 → 0.4.13

package/dist/args-Dqf5Y1RP.js

@@ -0,0 +1 @@
+import{Gt as e,Zt as t,kn as n}from"./core-DwsAMCnL.js";import{_r as r,ar as i,br as a,cr as o,fr as s,ir as c,nr as l,sr as u,tr as d}from"./errors-DO_IltpP.js";function f(e,t=``,r){return n.add(e,{description:t,...r?{value:r}:{}}),e}const p=e=>f(s(i()),e),m=(e,t)=>f(s(r()),e,t),h=(e,t)=>f(s(c(r())),e,t),g=(e,t)=>f(s(a([r(),o(!0)])),e,t),_=e=>f(l(s(a([r(),o(!0)])),!0),e,`[url]`),v=e=>f(s(a([o(`all`),d().check(u(),t())],{error:`expected a positive integer or "all"`})),e,`<n|all>`),y=t=>f(s(a([o(`all`),d().check(u(),e())],{error:`expected a number or "all"`})),t,`<n|all>`),b={server:g(`act on your Coder server`,`[url]`),workspace:m(`with --server: the workspace to act in (default: the saved one)`,`<slug>`),yes:p(`with --server: connect to a server used for the first time without asking`)};function x(e){return(e.server===!0?` --server`:typeof e.server==`string`?` --server ${JSON.stringify(e.server)}`:``)+(e.workspace?` --workspace ${JSON.stringify(e.workspace)}`:``)}const S={server:_(`act on your Coder server, in the saved workspace`),yes:p(`connect to a server used for the first time without asking`)};export{g as a,m as c,v as i,h as l,S as n,b as o,p as r,x as s,f as t,y as u};

package/dist/async-Tj4zKHXR.js

@@ -0,0 +1,3 @@
+import{qi as e}from"./core-DwsAMCnL.js";import{A as t,G as n,Or as r,Tr as i,kr as a}from"./errors-DO_IltpP.js";import{C as o}from"./output-SNqdgh9A.js";import{c as s,o as c}from"./actions-D12xDiQS.js";import{C as l,b as u,i as d,r as f,s as p,t as m,w as h}from"./executor-ufWRqhdS.js";import g from"node:path";import _ from"node:process";var v=e({driveAsyncTool:()=>T,pendingCall:()=>C,startAsyncTool:()=>w,taskFlow:()=>S});const y=e=>g.join(e,`async.json`),b=e=>i(y(e))??[];function x(e,t){return r(`${y(e)}.lock`,()=>{let n=b(e),r=t(n);return a(y(e),n),r})}const S=e=>e.flowRunId?h(e.flowRunId)?.name:void 0;function C(e,t){return b(e).find(e=>(!t||e.tool===t)&&!e.delivered&&(l(e.runId)?.status===`running`||e.pid!==void 0&&f(e.pid)))?.runId}async function w(e,t,n,r){let a=i(g.join(e,`job.json`));if(!a)throw Error(`This task has no record`);if(S(a)===t.flow)throw Error(`A ${t.name} task cannot start a ${t.name}`);if(r!==void 0&&!(r>0))throw Error(`timeout must be a positive number of seconds`);let s=a.cwd??_.cwd();return x(e,i=>{let c=C(e,t.name);if(c)throw Error(`${E(t.name)} ${c} is still running; its result arrives as a message.`);if(i.filter(e=>e.tool===t.name).length>=t.limit)throw Error(`This task has used all ${t.limit} of its ${t.name}s.`);let l=d(t.flow,{cwd:s,args:t.args(n,s)});i.push({tool:t.name,runId:l.runId});let{[o]:f,...p}=_.env;return u(l,s,{env:p,drive:[`--task`,a.id,`--tool`,t.name,...r?[`--timeout`,String(r)]:[]]}),l.runId})}async function T(e,r,i,a,o){let l=n(i,a),u=e=>x(l,t=>{let n=t.find(e=>e.runId===r);n&&Object.assign(n,e)}),d=E(e.name),f,g,v=()=>{},y=new Promise(e=>{o&&(g=setTimeout(()=>e(`timeout`),o*1e3)),v=()=>e(`stopped`),_.once(`SIGINT`,v),_.once(`SIGTERM`,v)}),S;try{await u({pid:_.pid});let t=h(r);if(!t)throw Error(`No flow run "${r}".`);let n=await Promise.race([m(t,i,{onStart:e=>f=e}),y]);typeof n==`string`?(await p(r,f?.runningIds()),f?.requestStop(),S=n===`timeout`?`${d} timed out after ${o}s and was stopped`:`${d} was stopped`):S=`${d} finished\n\n${e.render(n.result,r)}`}catch(e){S=`${d} ${r} failed: ${e instanceof Error?e.message:String(e)}`}finally{clearTimeout(g),_.off(`SIGINT`,v),_.off(`SIGTERM`,v)}let C=t(i,a);if(!C)throw Error(`No task "${a}" to send ${e.name} ${r} to.`);let w=e.limit-b(l).filter(t=>t.tool===e.name).length,[T,...D]=S.split(`
+`),O=[`${T} (task ${e.name}s left ${w}/${e.limit}).`,...D].join(`
+`);await s(C.cwd??i,C,O,(C.connectionSource??(C.connections?`server`:void 0))===`server`?{resolveConnections:c(C.mcp)}:{}),await u({delivered:!0})}const E=e=>e[0].toUpperCase()+e.slice(1);export{S as i,C as n,w as r,v as t};

package/dist/{auth-DuXnSNf9.js → auth-BhpnOCbn.js}

@@ -1 +1 @@
-import{$ as e,A as t,B as n,C as r,D as i,E as a,F as o,G as s,H as c,I as l,J as u,K as d,L as f,M as p,N as m,O as h,P as g,Q as _,R as v,S as y,T as b,U as x,V as S,W as C,X as w,Y as T,Z as E,_ as D,a as O,at as k,b as ee,c as A,ct as j,d as M,dt as te,et as N,f as ne,ft as re,g as ie,gt as ae,ht as oe,i as se,it as ce,j as le,k as ue,lt as de,m as fe,mt as P,n as pe,nt as me,o as he,ot as F,p as ge,pt as _e,q as ve,r as ye,rt as be,s as xe,st as Se,tt as Ce,ut as we,v as Te,vt as Ee,w as De,x as Oe,y as ke,z as Ae}from"./build-CmtlB7pX.js";import{i as je,l as Me}from"./http-BZfjbiov.js";import{B as Ne,_r as Pe,gr as Fe,or as Ie,yn as Le}from"./apps-D-v5sQJk.js";import{m as I,p as L,platformLink as R}from"./schema.js";import{a as Re,i as ze,o as Be}from"./serve-CWtLyyTz.js";import{createECDH as Ve,hkdfSync as He}from"node:crypto";import{isDeepStrictEqual as Ue}from"node:util";function We(e,t,n){if(!S(e,t,n))throw new N(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function Ge(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new N(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,i,a,c,l,d,f,p,m]=e;if(l!==void 0&&v(l,`JWE Additional Authenticated Data`),d!==void 0&&v(d,`JWE Content Encryption Key`),f!==void 0&&v(f,`JWE Initialization Vector`),!n&&i!==void 0&&(i=s(N,i)[0],e[1]=i),a!==void 0&&(a=s(N,a)[0],e[2]=a),!n&&c!==void 0&&(c=s(N,c)[0],e[3]=c),p!==void 0&&!x(p))throw TypeError(`JWE Key Management Parameters must be an object`);We(i,a,c);let h={...i,...a,...c};T(N,i),u(N,o,m,i,h),ke(h,i);let{alg:g,enc:_}=h;if(typeof g!=`string`||!g)throw new N(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let y=Oe[g];if(y?.mode===`integrated-encryption`){if(_!==void 0)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(d!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${g}`);if(f!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${g}`);return[h,void 0,y]}if(typeof _!=`string`||!_)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[h,r(_),y]}async function Ke(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,m,,h]=e,g=s,_=c,v=a??y(r.alg),x,S,C;v.mode===`integrated-encryption`?C=await p(v,n,`encrypt`):[C,x,S]=await ee(v,i,n,r,d,m),S&&(h?_=_?{..._,...S}:S:g=g?{...g,...S}:S,We(g,_,l));let T=g?w(JSON.stringify(g)):``,E=u?.byteLength?w(u):void 0,D=P(E?`${T}.${E}`:T),O=o;r.zip===`DEF`&&(O=await Te(O).catch(e=>{throw new N(`Failed to compress plaintext`,{cause:e})}));let k,A,j;v.mode===`integrated-encryption`?[x,k]=await v.encrypt(C,O,D,g,r,m):{ciphertext:k,tag:A,iv:j}=await b(i,O,C,f,D);let M={ciphertext:w(k)};return j&&(M.iv=w(j)),A&&(M.tag=w(A)),x?.byteLength&&(M.encrypted_key=w(x)),E&&(M.aad=E),g&&(M.protected=T),l&&(M.unprotected=l),_&&(M.header=_),M}async function qe(e,t,n){return Ke(e,Ge(e,n),t)}function Je(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}const z=[[`verify`],[`sign`]];function Ye(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:z}}function B(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:z,minRsaBits:2048}}function Xe(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:z}}function Ze(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:z}}function Qe(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:z}}const $e=De({HS256:Ye(256),HS384:Ye(384),HS512:Ye(512),RS256:B(256),RS384:B(384),RS512:B(512),PS256:B(256,32),PS384:B(384,48),PS512:B(512,64),ES256:Xe(`P-256`,256),ES384:Xe(`P-384`,384),ES512:Xe(`P-521`,512),EdDSA:Ze(),Ed25519:Ze(),"ML-DSA-44":Qe(44),"ML-DSA-65":Qe(65),"ML-DSA-87":Qe(87)});function et(t){let n=typeof t==`string`?$e[t]:void 0;if(!n)throw new e(`alg ${t} is not supported either by JOSE or your javascript runtime`);return n}function tt(e){return[e&&d(`algorithms`,e.algorithms),e?.crit]}function nt(e){return e===void 0?{}:C(e,F,`JWS Protected Header is invalid`)}function rt(e){try{return P(e)}catch{throw new F(`JWS Compact Serialization payload must use only ASCII characters`)}}async function it(e,t,r,i,o){let{protected:s,header:c,payload:d}=e,f=o??nt(s);if(!S(f,c))throw new F(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let h={...f,...c},g=ve(f,u(F,l,t[1],f,h)),{alg:_}=h;if(typeof _!=`string`||!_)throw new F(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(_))throw new E(`"alg" (Algorithm) Header Parameter value not allowed`);if(g){if(typeof d!=`string`)throw new F(`JWS Payload must be a string`)}else if(typeof d!=`string`&&!(d instanceof Uint8Array))throw new F(`JWS Payload must be a string or an Uint8Array instance`);let v=g||typeof d!=`string`?d:i(d),y=!1;typeof r==`function`&&(r=await r(f,e),y=!0);let b=et(_),x=te(s===void 0?new Uint8Array:P(s),P(`.`),typeof v==`string`?t[2]??=n(v,`payload`,F):v),C=Ae(e.signature,`signature`,F),w=await p(b,r,`verify`),T=await m(w,b.subtle,`verify`);b.minRsaBits&&a(b.alg,T);let D=!1;try{D=await crypto.subtle.verify(b.signing,T,C,x)}catch{}if(!D)throw new Se;let O={payload:typeof v==`string`?Ae(v,`payload`,F):v};return s!==void 0&&(O.protectedHeader=f),c!==void 0&&(O.unprotectedHeader=c),y?[{...O,key:w},g]:[O,g]}async function at(e,t,n){if(e instanceof Uint8Array&&(e=re.decode(e)),typeof e!=`string`)throw new F(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new F(`Invalid Compact JWS`);return it({payload:i,protected:r,signature:a},t,n,rt)}const V=e=>Math.floor(e.getTime()/1e3),ot={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},st=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,H=`check_failed`;function ct(){throw TypeError(`Invalid time period format`)}function U(e){typeof e!=`string`&&ct();let t=st.exec(e);(!t||t[4]&&t[1])&&ct();let n=parseFloat(t[2]),r=Math.round(n*ot[t[3][0].toLowerCase()]);return Number.isFinite(r)||ct(),t[1]===`-`||t[4]===`ago`?-r:r}function W(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function lt(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function ut(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function dt(e,t){return typeof e==`number`?W(t,e):e instanceof Date?W(t,V(e)):V(new Date)+U(e)}const ft=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},pt=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function mt(e,t,n=!1){let r=e[t];if(!(r===void 0&&!n)){if(typeof r!=`number`)throw new j(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function ht(e,t){throw new j(`unexpected "${t}" claim value`,e,t,H)}function gt(e,t,n={}){let r;try{r=JSON.parse(ae.decode(t))}catch{}if(!x(r))throw new we(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||ft(e.typ)!==ft(i)))throw new j(`unexpected "typ" JWT header value`,r,`typ`,H);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new j(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&ht(r,`iss`),s!==void 0&&r.sub!==s&&ht(r,`sub`),c!==void 0&&!pt(r.aud,typeof c==`string`?[c]:c)&&ht(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=U(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}W(`clockTolerance option`,f);let{currentDate:p}=n,m=W(`currentDate option`,V(p===void 0?new Date:p)),h=mt(r,`iat`,l!==void 0),g=mt(r,`nbf`);if(g!==void 0&&g>m+f)throw new j(`"nbf" claim timestamp check failed`,r,`nbf`,H);let _=mt(r,`exp`);if(_!==void 0&&_<=m-f)throw new de(`"exp" claim timestamp check failed`,r,`exp`,H);if(l!==void 0){let e=m-h,t=W(`maxTokenAge option`,typeof l==`number`?l:U(l));if(e-f>t)throw new de(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,H);if(e<-f)throw new j(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,H)}return r}let _t;function G(e){return _t.get(e)}function vt(e){let t=G(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return oe.encode(JSON.stringify(t))}function yt(e,t){return G(e)[t]}var bt=class{constructor(e={}){if(!x(e))throw TypeError(`JWT Claims Set MUST be an object`);(_t||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return lt(`iss`,e),G(this).iss=e,this}setSubject(e){return lt(`sub`,e),G(this).sub=e,this}setAudience(e){return ut(e),G(this).aud=e,this}setJti(e){return lt(`jti`,e),G(this).jti=e,this}setNotBefore(e){return G(this).nbf=dt(e,`setNotBefore`),this}setExpirationTime(e){return G(this).exp=dt(e,`setExpirationTime`),this}setIssuedAt(e){let t=G(this);return t.iat=e===void 0?V(new Date):typeof e==`string`?W(`setIssuedAt`,V(new Date)+U(e)):dt(e,`setIssuedAt`),this}};async function xt(e,t,n){let[r,i]=await at(e,tt(n),t);if(!i)throw new we(`JWTs MUST NOT use unencoded payload`);let a=gt(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function St(e,t,n){let{plaintext:r,...i}=await ie(e,D(n),t),{protectedHeader:a}=i,o=gt(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new j(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}const Ct=bt;var wt=class extends Ct{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return f(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return f(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return f(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return f(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=vt(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?yt(this,`iss`):void 0,sub:this.#n?yt(this,`sub`):void 0,aud:this.#r?yt(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,Je(await qe(r,e,t))}};async function Tt(e){if(t(e))if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`});if(e instanceof Uint8Array)return{kty:`oct`,k:w(e)};if(!h(e))throw TypeError(i(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let n=await crypto.subtle.exportKey(`jwk`,e);delete n.ext,delete n.key_ops,delete n.use,n.kty!==`AKP`&&delete n.alg;for(let e of Object.keys(n))n[e]===void 0&&delete n[e];return n}const K=(e,t)=>{if(typeof e!=`string`||!e)throw new Ce(`${t} missing or invalid`)};async function Et(t,n){let r;if(x(t)){if(r=g(t),typeof r.kty!=`string`)throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(ue(t))r=g(await Tt(t));else throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(n??=`sha256`,n!==`sha256`&&n!==`sha384`&&n!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let a;switch(r.kty){case`AKP`:K(r.alg,`"alg" (Algorithm) Parameter`),K(r.pub,`"pub" (Public key) Parameter`),a={alg:r.alg,kty:r.kty,pub:r.pub};break;case`EC`:K(r.crv,`"crv" (Curve) Parameter`),K(r.x,`"x" (X Coordinate) Parameter`),K(r.y,`"y" (Y Coordinate) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case`OKP`:K(r.crv,`"crv" (Subtype of Key Pair) Parameter`),K(r.x,`"x" (Public Key) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x};break;case`RSA`:K(r.e,`"e" (Exponent) Parameter`),K(r.n,`"n" (Modulus) Parameter`),a={e:r.e,kty:r.kty,n:r.n};break;case`oct`:if(typeof r.k!=`string`)throw new Ce(`"k" (Key Value) Parameter missing or invalid`);a={k:r.k,kty:r.kty};break;default:throw new e(`"kty" (Key Type) Parameter missing or unsupported`)}let o=P(JSON.stringify(a));return w(await _e(n,o))}function Dt(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function Ot(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=le(n,t,!0).then(e=>{if(e.type!==`public`)throw new me(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function kt(t){let n;try{n=structuredClone(t)}catch{}if(!c(n))throw new me(`JSON Web Key Set malformed`);let r=n.keys.map(e=>{let t=g(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),i=new WeakMap;return Object.defineProperty(async(t,a)=>{let{alg:o,kid:s}={...t,...a?.header},c=typeof o==`string`?$e[o]:void 0;if(!c||c.secret)throw new e(`Unsupported "alg" value for a JSON Web Key Set`);let l=n.keys.filter((e,t)=>Dt(r[t],c,o,s)),{0:u,length:d}=l;if(!d)throw new ce;if(d!==1){let e=new be;throw e[Symbol.asyncIterator]=async function*(){for(let e of l)try{yield await Ot(i,e,c)}catch{}},e}return Ot(i,u,c)},"jwks",{value:()=>structuredClone(n)})}function At(){return typeof WebSocketPair<`u`||typeof navigator<`u`&&navigator.userAgent===`Cloudflare-Workers`||typeof EdgeRuntime<`u`&&EdgeRuntime===`vercel`}let jt;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(jt=`jose/v6.2.12`);const Mt=Symbol();async function Nt(e,t,n,r=fetch){let i=await r(e,{method:`GET`,signal:n,redirect:`manual`,headers:t}).catch(e=>{throw e.name===`TimeoutError`?new k:e});if(i.status!==200)throw new _(`Expected 200 OK from the JSON Web Key Set HTTP response`);try{return await i.json()}catch{throw new _(`Failed to parse the JSON Web Key Set HTTP response as JSON`)}}const Pt=Symbol();function q(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Ft(e,t,n){if(Number.isNaN(e))throw TypeError(`"${n}" option must not be NaN`);return typeof e==`number`?e:t}function It(e,t){if(!(e instanceof URL))throw TypeError(`url must be an instance of URL`);let n=new URL(e.href).href,r=t??{},i=r.timeoutDuration;if(typeof i==`number`&&(!Number.isInteger(i)||i<0))throw TypeError(`"timeoutDuration" option must be a non-negative integer`);let a=typeof i==`number`?i:5e3,o=Ft(r.cooldownDuration,3e4,`cooldownDuration`),s=Ft(r.cacheMaxAge,6e5,`cacheMaxAge`),l=new Headers(r.headers);jt&&!l.has(`User-Agent`)&&l.set(`User-Agent`,jt),l.has(`accept`)||l.set(`accept`,`application/json, application/jwk-set+json`);let u=r[Mt],d=r[Pt],f,p,m=0,h=0,g;if(d&&typeof d==`object`){let{uat:e,jwks:t}=d;q(e,s)&&c(t)&&(f=e,g=kt(t))}let _=async()=>{if(p&&At()&&(p=void 0),!p){let e=++m,t=p=Nt(n,l,AbortSignal.timeout(a),u).then(t=>{let n=kt(t);if(e<=h)return;g=n;let r=Date.now();d&&(d.uat=r,d.jwks=t),f=r,h=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{(!g||!q(f,s))&&await _();try{return await g(e,t)}catch(n){if(n instanceof ce&&!q(f,o))return await _(),g(e,t);throw n}},{coolingDown:{get:()=>q(f,o),enumerable:!0},fresh:{get:()=>q(f,s),enumerable:!0},reload:{value:_,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}const Lt=(e,t)=>new Uint8Array(He(`sha256`,e,``,t,32));async function Rt(e){let t=Lt(e,`coder oidc client key`),n=Ve(`prime256v1`);n.setPrivateKey(t);let r=n.getPublicKey(),i={kty:`EC`,crv:`P-256`,x:Buffer.from(r.subarray(1,33)).toString(`base64url`),y:Buffer.from(r.subarray(33)).toString(`base64url`)},a=await crypto.subtle.importKey(`jwk`,{...i,d:Buffer.from(t).toString(`base64url`)},{name:`ECDSA`,namedCurve:`P-256`},!1,[`sign`]),o=await Et(i);return{key:a,kid:o,jwk:{...i,kid:o,alg:`ES256`,use:`sig`}}}async function zt(e){let t=[e.encryptionKey,e.previousEncryptionKey].filter(e=>!!e),n=await Promise.all(t.map(Rt));return{cookie:t.map(e=>Lt(e,`coder session cookie`)),client:n[0],jwks:{keys:n.map(e=>e.jwk)}}}const J=`${Fe}.session`,Y=`${Fe}.oidc`,X=`${Fe}.operator`,Bt=3800,Vt=2592e3,Ht=3600,Z=()=>Math.floor(Date.now()/1e3);function Q(e){let t=new Map;for(let n of(e.get(`cookie`)??``).split(/;\s*/)){let e=n.indexOf(`=`);e>0&&t.set(n.slice(0,e),n.slice(e+1))}return t}function Ut(e){let t=[];for(;e.has(`${J}.${t.length}`);)t.push(`${J}.${t.length}`);return t}function $(e){let t=Q(e);return t.get(J)??(Ut(t).map(e=>t.get(e)).join(``)||void 0)}function Wt(e){return Array.isArray(e)?e.flatMap(e=>typeof e?.id==`string`&&typeof e.role==`string`?[{id:e.id,slug:String(e.slug??e.id),name:String(e.name??e.slug??e.id),role:e.role}]:[]):[]}function Gt(e){let t=(e?.orgs.find(t=>t.id===e.org)??e?.orgs[0])?.slug;return t?`/dash/${encodeURIComponent(t)}/operator`:`/dash/operator`}function Kt(e,t,n){let r=e.get(`x-coder-organization`);if(r)return Ie(t,r);let i=t.organizations.find(e=>e.id===n)??t.organizations[0];return i?{...t,organizationId:i.id,role:i.role}:t}async function qt(e,t){let n=t.auth.wular.url,r=t.publicUrl,i=new URL(r).origin,a=r.startsWith(`https:`),o=await zt(t),s=t=>t instanceof Le?t.db:e,c=`${r}${ze}`,l=(e,t,n)=>`${e}=${t}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${n}${a?`; Secure`:``}`,u=(e,t)=>new wt(e).setProtectedHeader({alg:`dir`,enc:`A256GCM`}).setIssuedAt().setExpirationTime(`${t}s`).encrypt(o.cookie[0]);async function d(e){if(e)for(let t of o.cookie)try{return(await St(e,t)).payload}catch{}}async function f(e,t){let n=await u(t,Vt),r=Ut(Q(e));if(n.length<=Bt)return[l(J,n,Vt),...r.map(e=>l(e,``,0))];let i=n.match(RegExp(`.{1,${Bt}}`,`g`));return[l(J,``,0),...i.map((e,t)=>l(`${J}.${t}`,e,Vt)),...r.slice(i.length).map(e=>l(e,``,0))]}let p=e=>[J,...Ut(Q(e))].map(e=>l(e,``,0)),m,h=()=>m??=A(new URL(n),`${r}${Be}`,void 0,pe(o.client),new URL(n).protocol===`http:`?{execute:[ye]}:void 0).catch(e=>{throw m=void 0,e}),g,v=async()=>g??=It(new URL((await h()).serverMetadata().jwks_uri));function y(e,t){let n=e.claims();if(!n)throw Error(`Wular Auth returned no ID token`);let r=Wt(n.organizations),i=e=>r.find(t=>t.id===e)?.id;return{sub:n.sub,name:typeof n.name==`string`?n.name:``,email:typeof n.email==`string`?n.email:``,orgs:r,org:i(t?.org)??i(n.org)??r[0]?.id,exp_at:Z()+(e.expires_in??600),at:Z(),rt:e.refresh_token??t?.rt,idt:e.id_token??t?.idt}}let b=async t=>{try{await Promise.all(t.map(({id:t,slug:n,name:r})=>new Le(e,t).put(`delivery`,`workspace`,{slug:n,name:r})))}catch(e){console.error(`coder server: saving organizations failed`,e)}},x=new Map;function S(e){let t=e.rt;if(!t)return Promise.resolve(void 0);let n=x.get(t);return n||(n=h().then(e=>fe(e,t)).then(t=>y(t,e)).then(t=>(Ue(t.orgs,e.orgs)||b(t.orgs),t)).catch(e=>(x.delete(t),e instanceof Ee&&e.error===`invalid_grant`?!1:void 0)),x.set(t,n),setTimeout(()=>x.delete(t),6e4).unref?.()),n.then(t=>t&&t.orgs.some(t=>t.id===e.org)?{...t,org:e.org}:t)}async function C(e,t,r){let a=(await v().then(t=>xt(e,t,{issuer:n,audience:i,typ:`at+jwt`})).catch(e=>{(!(e instanceof _)||e instanceof k||e.code===`ERR_JOSE_GENERIC`)&&console.error(`coder server: bearer verification unavailable`,e)}))?.payload;if(!a?.sub)return;let o={user:{id:a.sub,name:``,email:``},organizations:Wt(a.organizations)};return r&&Z()-(a.iat??0)>60?{...o,stale:!0}:Kt(t,o,typeof a.org==`string`?a.org:void 0)}async function w(e){let t=await h().catch(()=>void 0);if(!t)return Response.redirect(`${r}/login?error=unavailable`,302);let n=e.searchParams.get(`operator`)===`1`,a=e.searchParams.get(`prompt`)===`login`,o={verifier:ne(),state:ge(),nonce:M(),return:n?`/dash`:Pe(e.searchParams.get(`return`),i),...n?{operator:n}:{}},s=O(t,{redirect_uri:c,...n?{scope:`openid`,prompt:`login`}:{scope:Re},...a?{prompt:`login`}:{},code_challenge:await xe(o.verifier),code_challenge_method:`S256`,state:o.state,nonce:o.nonce});return new Response(null,{status:302,headers:{location:s.href,"set-cookie":l(Y,await u(o,600),600)}})}async function T(e,t){let n=e=>{let t=new Headers({location:`/login?error=${encodeURIComponent(e)}`});return t.append(`set-cookie`,l(Y,``,0)),new Response(null,{status:302,headers:t})},r=await d(Q(e.headers).get(Y));if(!r)return n(`expired`);let i=t.searchParams.get(`error`);if(i)return n(i);let a,o;try{let e=await se(await h(),new URL(`${c}${t.search}`),{pkceCodeVerifier:r.verifier,expectedState:r.state,expectedNonce:r.nonce,idTokenExpected:!0});a=y(e),o=e.claims()?.auth_time}catch{return n(`sign_in_failed`)}if(r.operator)return D(e,a.sub,o);await b(a.orgs);let s=new Headers({location:r.return});s.append(`set-cookie`,l(Y,``,0));for(let t of await f(e.headers,a))s.append(`set-cookie`,t);return new Response(null,{status:302,headers:s})}let E=e=>u(e,e.at+Ht-e.seen).then(t=>l(X,t,e.at+Ht-e.seen));async function D(e,n,r){let a=await d($(e.headers)),o=Z(),s=typeof r==`number`&&o-r<=60,c=s&&a?.sub===n&&t.operators?.includes(n),u=new Headers({location:c?Gt(a):`${Gt(a)}?error=${s?`denied`:`stale`}`});return u.append(`set-cookie`,l(Y,``,0)),c&&u.append(`set-cookie`,await E({sub:n,aud:i,at:o,seen:o})),new Response(null,{status:302,headers:u})}async function ee(e){if(!Ne(e,r))return je();let t=await d($(e.headers)),n=await h().catch(()=>void 0),i=`${r}/?signed_out=1`,a=n?.serverMetadata().end_session_endpoint&&t?.idt?he(n,{id_token_hint:t.idt,post_logout_redirect_uri:i}).href:i,o=Response.json({url:a});for(let t of p(e.headers))o.headers.append(`set-cookie`,t);return o.headers.append(`set-cookie`,l(X,``,0)),o}return{issuer:n,jwks:o.jwks,handler(e){let t=new URL(e.url);return t.pathname===`/api/auth/sign-in`&&e.method===`GET`?w(t):t.pathname===`/api/auth/callback`&&e.method===`GET`?T(e,t):t.pathname===`/api/auth/sign-out`&&e.method===`POST`?ee(e):Promise.resolve(Me())},async session(e,t=!1,n=[]){let r=e.get(`authorization`);if(r?.startsWith(`Bearer `))return C(r.slice(7),e,t);let i=await d($(e));if(i){if(i.exp_at<=Z()||t&&Z()-i.at>60){let t=await S(i);if(t===!1&&n.push(...p(e)),!t)return;i=t,n.push(...await f(e,i))}return Kt(e,{user:{id:i.sub,name:i.name,email:i.email},organizations:i.orgs},i.org)}},async operator(e,t=[]){let n=Q(e).get(X),r=await d(n),a=Z();if(!r||r.aud!==i||a-r.seen>900||a>=r.at+Ht){n&&t.push(l(X,``,0));return}return t.push(await E({...r,seen:a})),r.sub},async setOrganization(e,t,n=[]){let r=await d($(e));r&&r.exp_at<=Z()&&(r=await S(r)||void 0);let i=r?.orgs.find(e=>e.slug===t);if(!(!r||!i))return r.org!==i.id&&n.push(...await f(e,{...r,org:i.id})),i},async organization(t){let n=await new Le(e,t).get(`delivery`,`workspace`);return n&&`slug`in n?n:void 0},async link(e,t,n,r={},i){let a={name:e.name,email:e.email,...r.organizations?{organizations:r.organizations}:{},...r.token?{token:r.token}:{}},[o]=await s(i).insert(R).values({platform:t,platformUserId:n,userId:e.id,...a}).onConflictDoUpdate({target:[R.platform,R.platformUserId],set:a,setWhere:I(R.userId,e.id)}).returning({userId:R.userId});return o?.userId===e.id?`linked`:`taken`},async linkedAccounts(e,t){return(await s(t).select().from(R).where(I(R.userId,e))).map(e=>({platform:e.platform,platformUserId:e.platformUserId,name:e.name,email:e.email,...e.organizations?{organizations:e.organizations}:{},...e.token?{token:e.token}:{}}))},async unlink(e,t,n,r){await s(r).delete(R).where(L(I(R.userId,e),I(R.platform,t),I(R.platformUserId,n)))},async refreshLinkedToken(e,t,n,r,i,a){let[o]=await s(a).update(R).set({token:i}).where(L(I(R.userId,e),I(R.platform,t),I(R.platformUserId,n),I(R.token,r))).returning({userId:R.userId});return!!o},async linkedUser(t,n){let[r]=await e.select({id:R.userId,name:R.name,email:R.email,organizations:R.organizations,token:R.token}).from(R).where(L(I(R.platform,t),I(R.platformUserId,n)));return r&&{id:r.id,name:r.name,email:r.email,...r.organizations?{organizations:r.organizations}:{},...r.token?{token:r.token}:{}}}}}export{qt as createAuth};
+import{$ as e,A as t,B as n,C as r,D as i,E as a,F as o,G as s,H as c,I as l,J as u,K as d,L as f,M as p,N as m,O as h,P as g,Q as _,R as v,S as y,T as b,U as x,V as S,W as C,X as w,Y as T,Z as E,_ as D,a as O,at as k,b as ee,c as A,ct as j,d as M,dt as te,et as N,f as ne,ft as re,g as ie,gt as ae,ht as oe,i as se,it as ce,j as le,k as ue,lt as de,m as fe,mt as P,n as pe,nt as me,o as he,ot as F,p as ge,pt as _e,q as ve,r as ye,rt as be,s as xe,st as Se,tt as Ce,ut as we,v as Te,vt as Ee,w as De,x as Oe,y as ke,z as Ae}from"./build-CmtlB7pX.js";import{i as je,l as Me}from"./http-Cg8PSe-c.js";import{Tn as Ne,V as Pe,_r as Fe,sr as Ie,vr as Le}from"./apps-Bnk7F3A2.js";import{m as I,p as L,platformLink as R}from"./schema.js";import{a as Re,i as ze,o as Be}from"./serve-vKNqVaVy.js";import{createECDH as Ve,hkdfSync as He}from"node:crypto";import{isDeepStrictEqual as Ue}from"node:util";function We(e,t,n){if(!S(e,t,n))throw new N(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function Ge(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new N(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,i,a,c,l,d,f,p,m]=e;if(l!==void 0&&v(l,`JWE Additional Authenticated Data`),d!==void 0&&v(d,`JWE Content Encryption Key`),f!==void 0&&v(f,`JWE Initialization Vector`),!n&&i!==void 0&&(i=s(N,i)[0],e[1]=i),a!==void 0&&(a=s(N,a)[0],e[2]=a),!n&&c!==void 0&&(c=s(N,c)[0],e[3]=c),p!==void 0&&!x(p))throw TypeError(`JWE Key Management Parameters must be an object`);We(i,a,c);let h={...i,...a,...c};T(N,i),u(N,o,m,i,h),ke(h,i);let{alg:g,enc:_}=h;if(typeof g!=`string`||!g)throw new N(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let y=Oe[g];if(y?.mode===`integrated-encryption`){if(_!==void 0)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(d!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${g}`);if(f!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${g}`);return[h,void 0,y]}if(typeof _!=`string`||!_)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[h,r(_),y]}async function Ke(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,m,,h]=e,g=s,_=c,v=a??y(r.alg),x,S,C;v.mode===`integrated-encryption`?C=await p(v,n,`encrypt`):[C,x,S]=await ee(v,i,n,r,d,m),S&&(h?_=_?{..._,...S}:S:g=g?{...g,...S}:S,We(g,_,l));let T=g?w(JSON.stringify(g)):``,E=u?.byteLength?w(u):void 0,D=P(E?`${T}.${E}`:T),O=o;r.zip===`DEF`&&(O=await Te(O).catch(e=>{throw new N(`Failed to compress plaintext`,{cause:e})}));let k,A,j;v.mode===`integrated-encryption`?[x,k]=await v.encrypt(C,O,D,g,r,m):{ciphertext:k,tag:A,iv:j}=await b(i,O,C,f,D);let M={ciphertext:w(k)};return j&&(M.iv=w(j)),A&&(M.tag=w(A)),x?.byteLength&&(M.encrypted_key=w(x)),E&&(M.aad=E),g&&(M.protected=T),l&&(M.unprotected=l),_&&(M.header=_),M}async function qe(e,t,n){return Ke(e,Ge(e,n),t)}function Je(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}const z=[[`verify`],[`sign`]];function Ye(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:z}}function B(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:z,minRsaBits:2048}}function Xe(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:z}}function Ze(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:z}}function Qe(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:z}}const $e=De({HS256:Ye(256),HS384:Ye(384),HS512:Ye(512),RS256:B(256),RS384:B(384),RS512:B(512),PS256:B(256,32),PS384:B(384,48),PS512:B(512,64),ES256:Xe(`P-256`,256),ES384:Xe(`P-384`,384),ES512:Xe(`P-521`,512),EdDSA:Ze(),Ed25519:Ze(),"ML-DSA-44":Qe(44),"ML-DSA-65":Qe(65),"ML-DSA-87":Qe(87)});function et(t){let n=typeof t==`string`?$e[t]:void 0;if(!n)throw new e(`alg ${t} is not supported either by JOSE or your javascript runtime`);return n}function tt(e){return[e&&d(`algorithms`,e.algorithms),e?.crit]}function nt(e){return e===void 0?{}:C(e,F,`JWS Protected Header is invalid`)}function rt(e){try{return P(e)}catch{throw new F(`JWS Compact Serialization payload must use only ASCII characters`)}}async function it(e,t,r,i,o){let{protected:s,header:c,payload:d}=e,f=o??nt(s);if(!S(f,c))throw new F(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let h={...f,...c},g=ve(f,u(F,l,t[1],f,h)),{alg:_}=h;if(typeof _!=`string`||!_)throw new F(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(_))throw new E(`"alg" (Algorithm) Header Parameter value not allowed`);if(g){if(typeof d!=`string`)throw new F(`JWS Payload must be a string`)}else if(typeof d!=`string`&&!(d instanceof Uint8Array))throw new F(`JWS Payload must be a string or an Uint8Array instance`);let v=g||typeof d!=`string`?d:i(d),y=!1;typeof r==`function`&&(r=await r(f,e),y=!0);let b=et(_),x=te(s===void 0?new Uint8Array:P(s),P(`.`),typeof v==`string`?t[2]??=n(v,`payload`,F):v),C=Ae(e.signature,`signature`,F),w=await p(b,r,`verify`),T=await m(w,b.subtle,`verify`);b.minRsaBits&&a(b.alg,T);let D=!1;try{D=await crypto.subtle.verify(b.signing,T,C,x)}catch{}if(!D)throw new Se;let O={payload:typeof v==`string`?Ae(v,`payload`,F):v};return s!==void 0&&(O.protectedHeader=f),c!==void 0&&(O.unprotectedHeader=c),y?[{...O,key:w},g]:[O,g]}async function at(e,t,n){if(e instanceof Uint8Array&&(e=re.decode(e)),typeof e!=`string`)throw new F(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new F(`Invalid Compact JWS`);return it({payload:i,protected:r,signature:a},t,n,rt)}const V=e=>Math.floor(e.getTime()/1e3),ot={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},st=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,H=`check_failed`;function ct(){throw TypeError(`Invalid time period format`)}function U(e){typeof e!=`string`&&ct();let t=st.exec(e);(!t||t[4]&&t[1])&&ct();let n=parseFloat(t[2]),r=Math.round(n*ot[t[3][0].toLowerCase()]);return Number.isFinite(r)||ct(),t[1]===`-`||t[4]===`ago`?-r:r}function W(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function lt(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function ut(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function dt(e,t){return typeof e==`number`?W(t,e):e instanceof Date?W(t,V(e)):V(new Date)+U(e)}const ft=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},pt=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function mt(e,t,n=!1){let r=e[t];if(!(r===void 0&&!n)){if(typeof r!=`number`)throw new j(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function ht(e,t){throw new j(`unexpected "${t}" claim value`,e,t,H)}function gt(e,t,n={}){let r;try{r=JSON.parse(ae.decode(t))}catch{}if(!x(r))throw new we(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||ft(e.typ)!==ft(i)))throw new j(`unexpected "typ" JWT header value`,r,`typ`,H);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new j(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&ht(r,`iss`),s!==void 0&&r.sub!==s&&ht(r,`sub`),c!==void 0&&!pt(r.aud,typeof c==`string`?[c]:c)&&ht(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=U(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}W(`clockTolerance option`,f);let{currentDate:p}=n,m=W(`currentDate option`,V(p===void 0?new Date:p)),h=mt(r,`iat`,l!==void 0),g=mt(r,`nbf`);if(g!==void 0&&g>m+f)throw new j(`"nbf" claim timestamp check failed`,r,`nbf`,H);let _=mt(r,`exp`);if(_!==void 0&&_<=m-f)throw new de(`"exp" claim timestamp check failed`,r,`exp`,H);if(l!==void 0){let e=m-h,t=W(`maxTokenAge option`,typeof l==`number`?l:U(l));if(e-f>t)throw new de(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,H);if(e<-f)throw new j(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,H)}return r}let _t;function G(e){return _t.get(e)}function vt(e){let t=G(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return oe.encode(JSON.stringify(t))}function yt(e,t){return G(e)[t]}var bt=class{constructor(e={}){if(!x(e))throw TypeError(`JWT Claims Set MUST be an object`);(_t||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return lt(`iss`,e),G(this).iss=e,this}setSubject(e){return lt(`sub`,e),G(this).sub=e,this}setAudience(e){return ut(e),G(this).aud=e,this}setJti(e){return lt(`jti`,e),G(this).jti=e,this}setNotBefore(e){return G(this).nbf=dt(e,`setNotBefore`),this}setExpirationTime(e){return G(this).exp=dt(e,`setExpirationTime`),this}setIssuedAt(e){let t=G(this);return t.iat=e===void 0?V(new Date):typeof e==`string`?W(`setIssuedAt`,V(new Date)+U(e)):dt(e,`setIssuedAt`),this}};async function xt(e,t,n){let[r,i]=await at(e,tt(n),t);if(!i)throw new we(`JWTs MUST NOT use unencoded payload`);let a=gt(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function St(e,t,n){let{plaintext:r,...i}=await ie(e,D(n),t),{protectedHeader:a}=i,o=gt(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new j(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}const Ct=bt;var wt=class extends Ct{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return f(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return f(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return f(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return f(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=vt(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?yt(this,`iss`):void 0,sub:this.#n?yt(this,`sub`):void 0,aud:this.#r?yt(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,Je(await qe(r,e,t))}};async function Tt(e){if(t(e))if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`});if(e instanceof Uint8Array)return{kty:`oct`,k:w(e)};if(!h(e))throw TypeError(i(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let n=await crypto.subtle.exportKey(`jwk`,e);delete n.ext,delete n.key_ops,delete n.use,n.kty!==`AKP`&&delete n.alg;for(let e of Object.keys(n))n[e]===void 0&&delete n[e];return n}const K=(e,t)=>{if(typeof e!=`string`||!e)throw new Ce(`${t} missing or invalid`)};async function Et(t,n){let r;if(x(t)){if(r=g(t),typeof r.kty!=`string`)throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(ue(t))r=g(await Tt(t));else throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(n??=`sha256`,n!==`sha256`&&n!==`sha384`&&n!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let a;switch(r.kty){case`AKP`:K(r.alg,`"alg" (Algorithm) Parameter`),K(r.pub,`"pub" (Public key) Parameter`),a={alg:r.alg,kty:r.kty,pub:r.pub};break;case`EC`:K(r.crv,`"crv" (Curve) Parameter`),K(r.x,`"x" (X Coordinate) Parameter`),K(r.y,`"y" (Y Coordinate) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case`OKP`:K(r.crv,`"crv" (Subtype of Key Pair) Parameter`),K(r.x,`"x" (Public Key) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x};break;case`RSA`:K(r.e,`"e" (Exponent) Parameter`),K(r.n,`"n" (Modulus) Parameter`),a={e:r.e,kty:r.kty,n:r.n};break;case`oct`:if(typeof r.k!=`string`)throw new Ce(`"k" (Key Value) Parameter missing or invalid`);a={k:r.k,kty:r.kty};break;default:throw new e(`"kty" (Key Type) Parameter missing or unsupported`)}let o=P(JSON.stringify(a));return w(await _e(n,o))}function Dt(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function Ot(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=le(n,t,!0).then(e=>{if(e.type!==`public`)throw new me(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function kt(t){let n;try{n=structuredClone(t)}catch{}if(!c(n))throw new me(`JSON Web Key Set malformed`);let r=n.keys.map(e=>{let t=g(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),i=new WeakMap;return Object.defineProperty(async(t,a)=>{let{alg:o,kid:s}={...t,...a?.header},c=typeof o==`string`?$e[o]:void 0;if(!c||c.secret)throw new e(`Unsupported "alg" value for a JSON Web Key Set`);let l=n.keys.filter((e,t)=>Dt(r[t],c,o,s)),{0:u,length:d}=l;if(!d)throw new ce;if(d!==1){let e=new be;throw e[Symbol.asyncIterator]=async function*(){for(let e of l)try{yield await Ot(i,e,c)}catch{}},e}return Ot(i,u,c)},"jwks",{value:()=>structuredClone(n)})}function At(){return typeof WebSocketPair<`u`||typeof navigator<`u`&&navigator.userAgent===`Cloudflare-Workers`||typeof EdgeRuntime<`u`&&EdgeRuntime===`vercel`}let jt;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(jt=`jose/v6.2.12`);const Mt=Symbol();async function Nt(e,t,n,r=fetch){let i=await r(e,{method:`GET`,signal:n,redirect:`manual`,headers:t}).catch(e=>{throw e.name===`TimeoutError`?new k:e});if(i.status!==200)throw new _(`Expected 200 OK from the JSON Web Key Set HTTP response`);try{return await i.json()}catch{throw new _(`Failed to parse the JSON Web Key Set HTTP response as JSON`)}}const Pt=Symbol();function q(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Ft(e,t,n){if(Number.isNaN(e))throw TypeError(`"${n}" option must not be NaN`);return typeof e==`number`?e:t}function It(e,t){if(!(e instanceof URL))throw TypeError(`url must be an instance of URL`);let n=new URL(e.href).href,r=t??{},i=r.timeoutDuration;if(typeof i==`number`&&(!Number.isInteger(i)||i<0))throw TypeError(`"timeoutDuration" option must be a non-negative integer`);let a=typeof i==`number`?i:5e3,o=Ft(r.cooldownDuration,3e4,`cooldownDuration`),s=Ft(r.cacheMaxAge,6e5,`cacheMaxAge`),l=new Headers(r.headers);jt&&!l.has(`User-Agent`)&&l.set(`User-Agent`,jt),l.has(`accept`)||l.set(`accept`,`application/json, application/jwk-set+json`);let u=r[Mt],d=r[Pt],f,p,m=0,h=0,g;if(d&&typeof d==`object`){let{uat:e,jwks:t}=d;q(e,s)&&c(t)&&(f=e,g=kt(t))}let _=async()=>{if(p&&At()&&(p=void 0),!p){let e=++m,t=p=Nt(n,l,AbortSignal.timeout(a),u).then(t=>{let n=kt(t);if(e<=h)return;g=n;let r=Date.now();d&&(d.uat=r,d.jwks=t),f=r,h=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{(!g||!q(f,s))&&await _();try{return await g(e,t)}catch(n){if(n instanceof ce&&!q(f,o))return await _(),g(e,t);throw n}},{coolingDown:{get:()=>q(f,o),enumerable:!0},fresh:{get:()=>q(f,s),enumerable:!0},reload:{value:_,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}const Lt=(e,t)=>new Uint8Array(He(`sha256`,e,``,t,32));async function Rt(e){let t=Lt(e,`coder oidc client key`),n=Ve(`prime256v1`);n.setPrivateKey(t);let r=n.getPublicKey(),i={kty:`EC`,crv:`P-256`,x:Buffer.from(r.subarray(1,33)).toString(`base64url`),y:Buffer.from(r.subarray(33)).toString(`base64url`)},a=await crypto.subtle.importKey(`jwk`,{...i,d:Buffer.from(t).toString(`base64url`)},{name:`ECDSA`,namedCurve:`P-256`},!1,[`sign`]),o=await Et(i);return{key:a,kid:o,jwk:{...i,kid:o,alg:`ES256`,use:`sig`}}}async function zt(e){let t=[e.encryptionKey,e.previousEncryptionKey].filter(e=>!!e),n=await Promise.all(t.map(Rt));return{cookie:t.map(e=>Lt(e,`coder session cookie`)),client:n[0],jwks:{keys:n.map(e=>e.jwk)}}}const J=`${Fe}.session`,Y=`${Fe}.oidc`,X=`${Fe}.operator`,Bt=3800,Vt=2592e3,Ht=3600,Z=()=>Math.floor(Date.now()/1e3);function Q(e){let t=new Map;for(let n of(e.get(`cookie`)??``).split(/;\s*/)){let e=n.indexOf(`=`);e>0&&t.set(n.slice(0,e),n.slice(e+1))}return t}function Ut(e){let t=[];for(;e.has(`${J}.${t.length}`);)t.push(`${J}.${t.length}`);return t}function $(e){let t=Q(e);return t.get(J)??(Ut(t).map(e=>t.get(e)).join(``)||void 0)}function Wt(e){return Array.isArray(e)?e.flatMap(e=>typeof e?.id==`string`&&typeof e.role==`string`?[{id:e.id,slug:String(e.slug??e.id),name:String(e.name??e.slug??e.id),role:e.role}]:[]):[]}function Gt(e){let t=(e?.orgs.find(t=>t.id===e.org)??e?.orgs[0])?.slug;return t?`/dash/${encodeURIComponent(t)}/operator`:`/dash/operator`}function Kt(e,t,n){let r=e.get(`x-coder-organization`);if(r)return Ie(t,r);let i=t.organizations.find(e=>e.id===n)??t.organizations[0];return i?{...t,organizationId:i.id,role:i.role}:t}async function qt(e,t){let n=t.auth.wular.url,r=t.publicUrl,i=new URL(r).origin,a=r.startsWith(`https:`),o=await zt(t),s=t=>t instanceof Ne?t.db:e,c=`${r}${ze}`,l=(e,t,n)=>`${e}=${t}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${n}${a?`; Secure`:``}`,u=(e,t)=>new wt(e).setProtectedHeader({alg:`dir`,enc:`A256GCM`}).setIssuedAt().setExpirationTime(`${t}s`).encrypt(o.cookie[0]);async function d(e){if(e)for(let t of o.cookie)try{return(await St(e,t)).payload}catch{}}async function f(e,t){let n=await u(t,Vt),r=Ut(Q(e));if(n.length<=Bt)return[l(J,n,Vt),...r.map(e=>l(e,``,0))];let i=n.match(RegExp(`.{1,${Bt}}`,`g`));return[l(J,``,0),...i.map((e,t)=>l(`${J}.${t}`,e,Vt)),...r.slice(i.length).map(e=>l(e,``,0))]}let p=e=>[J,...Ut(Q(e))].map(e=>l(e,``,0)),m,h=()=>m??=A(new URL(n),`${r}${Be}`,void 0,pe(o.client),new URL(n).protocol===`http:`?{execute:[ye]}:void 0).catch(e=>{throw m=void 0,e}),g,v=async()=>g??=It(new URL((await h()).serverMetadata().jwks_uri));function y(e,t){let n=e.claims();if(!n)throw Error(`Wular Auth returned no ID token`);let r=Wt(n.organizations),i=e=>r.find(t=>t.id===e)?.id;return{sub:n.sub,name:typeof n.name==`string`?n.name:``,email:typeof n.email==`string`?n.email:``,orgs:r,org:i(t?.org)??i(n.org)??r[0]?.id,exp_at:Z()+(e.expires_in??600),at:Z(),rt:e.refresh_token??t?.rt,idt:e.id_token??t?.idt}}let b=async t=>{try{await Promise.all(t.map(({id:t,slug:n,name:r})=>new Ne(e,t).put(`delivery`,`workspace`,{slug:n,name:r})))}catch(e){console.error(`coder server: saving organizations failed`,e)}},x=new Map;function S(e){let t=e.rt;if(!t)return Promise.resolve(void 0);let n=x.get(t);return n||(n=h().then(e=>fe(e,t)).then(t=>y(t,e)).then(t=>(Ue(t.orgs,e.orgs)||b(t.orgs),t)).catch(e=>(x.delete(t),e instanceof Ee&&e.error===`invalid_grant`?!1:void 0)),x.set(t,n),setTimeout(()=>x.delete(t),6e4).unref?.()),n.then(t=>t&&t.orgs.some(t=>t.id===e.org)?{...t,org:e.org}:t)}async function C(e,t,r){let a=(await v().then(t=>xt(e,t,{issuer:n,audience:i,typ:`at+jwt`})).catch(e=>{(!(e instanceof _)||e instanceof k||e.code===`ERR_JOSE_GENERIC`)&&console.error(`coder server: bearer verification unavailable`,e)}))?.payload;if(!a?.sub)return;let o={user:{id:a.sub,name:``,email:``},organizations:Wt(a.organizations)};return r&&Z()-(a.iat??0)>60?{...o,stale:!0}:Kt(t,o,typeof a.org==`string`?a.org:void 0)}async function w(e){let t=await h().catch(()=>void 0);if(!t)return Response.redirect(`${r}/login?error=unavailable`,302);let n=e.searchParams.get(`operator`)===`1`,a=e.searchParams.get(`prompt`)===`login`,o={verifier:ne(),state:ge(),nonce:M(),return:n?`/dash`:Le(e.searchParams.get(`return`),i),...n?{operator:n}:{}},s=O(t,{redirect_uri:c,...n?{scope:`openid`,prompt:`login`}:{scope:Re},...a?{prompt:`login`}:{},code_challenge:await xe(o.verifier),code_challenge_method:`S256`,state:o.state,nonce:o.nonce});return new Response(null,{status:302,headers:{location:s.href,"set-cookie":l(Y,await u(o,600),600)}})}async function T(e,t){let n=e=>{let t=new Headers({location:`/login?error=${encodeURIComponent(e)}`});return t.append(`set-cookie`,l(Y,``,0)),new Response(null,{status:302,headers:t})},r=await d(Q(e.headers).get(Y));if(!r)return n(`expired`);let i=t.searchParams.get(`error`);if(i)return n(i);let a,o;try{let e=await se(await h(),new URL(`${c}${t.search}`),{pkceCodeVerifier:r.verifier,expectedState:r.state,expectedNonce:r.nonce,idTokenExpected:!0});a=y(e),o=e.claims()?.auth_time}catch{return n(`sign_in_failed`)}if(r.operator)return D(e,a.sub,o);await b(a.orgs);let s=new Headers({location:r.return});s.append(`set-cookie`,l(Y,``,0));for(let t of await f(e.headers,a))s.append(`set-cookie`,t);return new Response(null,{status:302,headers:s})}let E=e=>u(e,e.at+Ht-e.seen).then(t=>l(X,t,e.at+Ht-e.seen));async function D(e,n,r){let a=await d($(e.headers)),o=Z(),s=typeof r==`number`&&o-r<=60,c=s&&a?.sub===n&&t.operators?.includes(n);c||console.error(`coder server: operator sign-in refused: ${s?`not this session or not an operator`:`auth_time ${typeof r==`number`?`${o-r}s old`:`missing`}`}`);let u=new Headers({location:`${Gt(a)}?${c?`entered=1`:`error=${s?`denied`:`stale`}`}`});return u.append(`set-cookie`,l(Y,``,0)),c&&u.append(`set-cookie`,await E({sub:n,aud:i,at:o,seen:o})),new Response(null,{status:302,headers:u})}async function ee(e){if(!Pe(e,r))return je();let t=await d($(e.headers)),n=await h().catch(()=>void 0),i=`${r}/?signed_out=1`,a=n?.serverMetadata().end_session_endpoint&&t?.idt?he(n,{id_token_hint:t.idt,post_logout_redirect_uri:i}).href:i,o=Response.json({url:a});for(let t of p(e.headers))o.headers.append(`set-cookie`,t);return o.headers.append(`set-cookie`,l(X,``,0)),o}return{issuer:n,jwks:o.jwks,handler(e){let t=new URL(e.url);return t.pathname===`/api/auth/sign-in`&&e.method===`GET`?w(t):t.pathname===`/api/auth/callback`&&e.method===`GET`?T(e,t):t.pathname===`/api/auth/sign-out`&&e.method===`POST`?ee(e):Promise.resolve(Me())},async session(e,t=!1,n=[]){let r=e.get(`authorization`);if(r?.startsWith(`Bearer `))return C(r.slice(7),e,t);let i=await d($(e));if(i){if(i.exp_at<=Z()||t&&Z()-i.at>60){let t=await S(i);if(t===!1&&n.push(...p(e)),!t)return;i=t,n.push(...await f(e,i))}return Kt(e,{user:{id:i.sub,name:i.name,email:i.email},organizations:i.orgs},i.org)}},async operator(e,t=[]){let n=Q(e).get(X),r=await d(n),a=Z();if(!r||r.aud!==i||a-r.seen>900||a>=r.at+Ht){n&&t.push(l(X,``,0));return}return t.push(await E({...r,seen:a})),r.sub},async setOrganization(e,t,n=[]){let r=await d($(e));r&&r.exp_at<=Z()&&(r=await S(r)||void 0);let i=r?.orgs.find(e=>e.slug===t);if(!(!r||!i))return r.org!==i.id&&n.push(...await f(e,{...r,org:i.id})),i},async organization(t){let n=await new Ne(e,t).get(`delivery`,`workspace`);return n&&`slug`in n?n:void 0},async link(e,t,n,r={},i){let a={name:e.name,email:e.email,...r.organizations?{organizations:r.organizations}:{},...r.token?{token:r.token}:{}},[o]=await s(i).insert(R).values({platform:t,platformUserId:n,userId:e.id,...a}).onConflictDoUpdate({target:[R.platform,R.platformUserId],set:a,setWhere:I(R.userId,e.id)}).returning({userId:R.userId});return o?.userId===e.id?`linked`:`taken`},async linkedAccounts(e,t){return(await s(t).select().from(R).where(I(R.userId,e))).map(e=>({platform:e.platform,platformUserId:e.platformUserId,name:e.name,email:e.email,...e.organizations?{organizations:e.organizations}:{},...e.token?{token:e.token}:{}}))},async unlink(e,t,n,r){await s(r).delete(R).where(L(I(R.userId,e),I(R.platform,t),I(R.platformUserId,n)))},async refreshLinkedToken(e,t,n,r,i,a){let[o]=await s(a).update(R).set({token:i}).where(L(I(R.userId,e),I(R.platform,t),I(R.platformUserId,n),I(R.token,r))).returning({userId:R.userId});return!!o},async linkedUser(t,n){let[r]=await e.select({id:R.userId,name:R.name,email:R.email,organizations:R.organizations,token:R.token}).from(R).where(L(I(R.platform,t),I(R.platformUserId,n)));return r&&{id:r.id,name:r.name,email:r.email,...r.organizations?{organizations:r.organizations}:{},...r.token?{token:r.token}:{}}}}}export{qt as createAuth};

package/dist/builtin/coder/agent.json

@@ -1,7 +1,6 @@
 {
   "name": "Coder",
   "description": "Answers engineering questions, reviews pull requests, and makes requested changes.",
-  "permissions": "workspace-write",
   "integrations": {
     "github": {
       "events": {

package/dist/builtin/coder/system.md

@@ -12,6 +12,6 @@ Always make sure you have the ability to perform a specific task rather than bli
 
 # Platform notes
 
-On a pull request or when asked for a review, run the `review` flow from your shell (`coder flow run review --wait --json --args '{"pr": <number>, "post": true}'`) and point at its result.
+When asked for a review, use your `review` tool; for a pull request, pass its number.
 
 Generally read the event and its context, then answer the question or make the requested change. If the task is gonna take longer, inform the user about your intent very early and concisely, and then perform the task and link the pull request or any resource you create or reference. Don't spam the user though, one or two messages should be enough for most requests.

package/dist/{chat-CgQdDRhs.js → chat-CSepnsrK.js}

@@ -1,4 +1,4 @@
-import{bn as e}from"./apps-D-v5sQJk.js";import{a as t}from"./client-C4QCT6cG.js";import{C as n,M as r,T as i,b as a,chatItem as o,chatState as s,h as c,m as l,p as u}from"./schema.js";import{randomUUID as d}from"node:crypto";var f=class{db;now;constructor(e,t=Date.now){this.db=e,this.now=t}at(e){return e?new Date(this.now()+e):null}stamp(e){return e===void 0?null:new Date(this.now()+e).toISOString()}live(){return i(a(s.expiresAt),c(s.expiresAt,new Date(this.now())))}expired(){return n(s.expiresAt,new Date(this.now()))}async read(e){let[n]=await t(this.db,()=>this.db.select({value:r`${s.value}`}).from(s).where(u(l(s.key,e),this.live())));return n?.value}async claim(e,t,n){return(await this.db.insert(s).values({key:e,value:t,expiresAt:n}).onConflictDoUpdate({target:s.key,set:{value:t,expiresAt:n},setWhere:this.expired()}).returning({key:s.key})).length>0}async connect(){}async disconnect(){}async get(e){return await this.read(`k:${e}`)??null}async set(e,t,n){let r={value:t,expiresAt:this.at(n)};await this.db.insert(s).values({key:`k:${e}`,...r}).onConflictDoUpdate({target:s.key,set:r})}setIfNotExists(e,t,n){return this.claim(`k:${e}`,t,this.at(n))}async delete(e){await this.db.execute(r`with items as (delete from ${o} where key = ${`k:${e}`}) delete from ${s} where key = ${`k:${e}`}`)}async appendToList(e,t,n={}){let i=`k:${e}`,a=n.maxLength?r`or seq <= coalesce((select seq from ${o} where key = ${i} order by seq desc offset ${n.maxLength-1} limit 1), -1)`:r``;await this.db.execute(r`
+import{En as e}from"./apps-Bnk7F3A2.js";import{a as t}from"./client-C4QCT6cG.js";import{C as n,M as r,T as i,b as a,chatItem as o,chatState as s,h as c,m as l,p as u}from"./schema.js";import{randomUUID as d}from"node:crypto";var f=class{db;now;constructor(e,t=Date.now){this.db=e,this.now=t}at(e){return e?new Date(this.now()+e):null}stamp(e){return e===void 0?null:new Date(this.now()+e).toISOString()}live(){return i(a(s.expiresAt),c(s.expiresAt,new Date(this.now())))}expired(){return n(s.expiresAt,new Date(this.now()))}async read(e){let[n]=await t(this.db,()=>this.db.select({value:r`${s.value}`}).from(s).where(u(l(s.key,e),this.live())));return n?.value}async claim(e,t,n){return(await this.db.insert(s).values({key:e,value:t,expiresAt:n}).onConflictDoUpdate({target:s.key,set:{value:t,expiresAt:n},setWhere:this.expired()}).returning({key:s.key})).length>0}async connect(){}async disconnect(){}async get(e){return await this.read(`k:${e}`)??null}async set(e,t,n){let r={value:t,expiresAt:this.at(n)};await this.db.insert(s).values({key:`k:${e}`,...r}).onConflictDoUpdate({target:s.key,set:r})}setIfNotExists(e,t,n){return this.claim(`k:${e}`,t,this.at(n))}async delete(e){await this.db.execute(r`with items as (delete from ${o} where key = ${`k:${e}`}) delete from ${s} where key = ${`k:${e}`}`)}async appendToList(e,t,n={}){let i=`k:${e}`,a=n.maxLength?r`or seq <= coalesce((select seq from ${o} where key = ${i} order by seq desc offset ${n.maxLength-1} limit 1), -1)`:r``;await this.db.execute(r`
       with added as (insert into ${o} (key, value, expires_at) values (${i}, ${JSON.stringify(t)}::jsonb, ${this.stamp(n.ttlMs)}::timestamptz))
       delete from ${o} where key = ${i} and ((select expires_at from ${o} where key = ${i} order by seq desc limit 1) <= ${this.stamp(0)}::timestamptz ${a})`)}async getList(n){let i=`k:${n}`;return(await t(this.db,()=>e(this.db,r`
       with newest as (select expires_at from ${o} where key = ${i} order by seq desc limit 1)

package/dist/cli.js

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
-import{kn as e}from"./core-DwsAMCnL.js";import{An as t,Ct as n,Dn as r,bt as i,jn as a}from"./errors-XBA-Ls4n.js";import{f as o,m as s,p as c,r as l,s as u,u as d}from"./args-CbO_Ck9Z.js";import{$ as f,Ct as p,Zt as m,f as h,h as g,i as _,p as v,r as y,s as b,t as x}from"./output-D95NoAA9.js";import{a as ee,l as S,m as C,r as te,t as ne,u as re}from"./prompt-onpyIyXK.js";import w from"node:path";import T from"node:process";import{pathToFileURL as ie}from"node:url";const ae={title:`Coder`,usageLine:`coder <command>`,description:`Delegate a coding task to the best available engine and steer it while it runs.`,commands:[{usage:`dash`,blurb:`your tasks, agents and settings in the browser`},{usage:`run "<text>"`,blurb:`run a task (background; --wait blocks)`},{usage:`list`,blurb:`list recent tasks (by default running + just stopped)`},{usage:`result [task-id]`,blurb:`status + final answer (--wait blocks)`},{usage:`task <cmd>`,blurb:`run, list, result, watch, steer, stop, approve, ...`},{usage:`flow <cmd>`,blurb:`run, list, watch, result, resume, stop, discover, ...`},{usage:`agent <cmd>`,blurb:`list, show, init, push, run, usage, integrations`},{usage:`credentials <cmd>`,blurb:`engine credentials: list, add, login, remove`},{usage:`server <cmd>`,blurb:`self-host Coder: serve, rotate-key`},{usage:`runner <cmd>`,blurb:`run your server's tasks on this machine: serve, list, ...`},{usage:`auth <cmd>`,blurb:`sign in to Coder: login, logout, status`},{usage:`review [--base <ref> | --pr <n>]`,blurb:`review changed code with a built-in flow`},{usage:`config <list|get|set|unset> [<key> [value]]`,blurb:`read or write config`},{usage:`model <list|add|alias|disable>`,blurb:`manage models: built-ins, aliases, custom endpoints`},{usage:`connection <cmd>`,blurb:`platform accounts, API keys and MCP servers tasks use: add, list, rm, ...`},{usage:`docs [topic]`,blurb:`print bundled documentation (for agents to read)`},{usage:`upgrade [--cli-only|--plugins-only]`,blurb:`update the CLI and host plugins`}],start:[{usage:`coder setup-host [claude|agents]`,blurb:`"claude" for Claude Code, "agents" for any ~/.agents host (Codex, Pi, ...)`},{usage:`coder run --engine [codex|claude] "<task>"`,blurb:`run a task on that engine's default model`},{usage:`coder task result <task-id> --wait`,blurb:`wait for the answer; returns early if the task needs your approval`}],agents:[{usage:`coder docs skill [--claude]`,blurb:`load the skill once`},{usage:`coder mcp`,blurb:`the MCP server your host runs (setup-host adds it)`}],cloudIntro:`Your agents, always on at coder.wular.ai, connected to GitHub, Slack and any other app.`,cloud:[{usage:`coder auth login`,blurb:`sign in`},{usage:`coder <command> --server`,blurb:`the same commands on your Coder server, e.g. coder run --server "<task>"`}],usage:[{usage:`coder <command> --help`,blurb:`flags and details for any command`}]};function E(e){let t=e._zod.def;for(;t.innerType??t.in;)t=(t.innerType??t.in)._zod.def;return t.type===`union`&&t.options?.some(e=>e._zod.def.values?.includes(!0))?`maybe`:t.type}const D=t=>e.get(t)??{};function O(e,t){let n=e.args[t],r=E(n)===`array`?`...`:``;return n._zod.optin?`[${t}${r}]`:`<${t}>${r}`}function k(e,t){let n=E(t),r=D(t).value??(n===`boolean`?``:n===`maybe`?`[${e}]`:`<${e}>`);return{usage:`--${e}${r?` ${r}`:``}`,blurb:D(t).description??``}}const A=e=>[e.description,e.usage==null?``:t(e.usage)].filter(Boolean);function j(e,t,n=t.cyan){let r=Math.max(0,...e.map(e=>e.usage.length))+2;return e.map(e=>`  ${n(e.usage.padEnd(r))}${t.dim(e.blurb)}${e.note?` ${t.light(e.note)}`:``}`)}function M(e,t,n){return[``,n.bold(`${e}:`),...t]}function oe(e,t,n){let r=v,i=d(t).namespaces.find(t=>t.namespace===e)?.path??[e.name],a=i.join(` `),o=e=>Object.entries(n).find(([,t])=>t.join(` `)===[...i,e.name].join(` `))?.[0],s=e.namespaces??[],c=[...e.commands.map(e=>({usage:[e.name,...(e.cli?.positional??[]).map(t=>O(e,t))].join(` `),blurb:e.description,...o(e)?{note:`(coder ${o(e)})`}:{}})),...s.map(e=>({usage:`${e.name} <${e.commands.map(e=>e.name).join(`|`)}>`,blurb:e.description}))];return`${[r.bold(`Usage:`),`  coder ${a} <subcommand>`,``,A(e).join(`
+import{kn as e}from"./core-DwsAMCnL.js";import{Ar as t,Nr as n,On as r,Pr as i,Tn as a}from"./errors-DO_IltpP.js";import{a as o,i as s,r as c,t as l}from"./emit-BrkJJPUE.js";import{Dt as u,Y as d,f,h as p,i as m,lt as h,p as g,r as _,s as v,t as ee}from"./output-SNqdgh9A.js";import{a as te,l as ne,m as y,r as b,t as re,u as x}from"./prompt-CIx4jwQF.js";import{c as S,r as C,s as w}from"./args-Dqf5Y1RP.js";import T from"node:path";import E from"node:process";import{pathToFileURL as ie}from"node:url";const D={title:`Coder`,usageLine:`coder <command>`,description:`Delegate a coding task to the best available engine and steer it while it runs.`,commands:[{usage:`dash`,blurb:`your tasks, agents and settings in the browser`},{usage:`run "<text>"`,blurb:`run a task (background; --wait blocks)`},{usage:`list`,blurb:`list recent tasks (by default running + just stopped)`},{usage:`result [task-id]`,blurb:`status + final answer (--wait blocks)`},{usage:`task <cmd>`,blurb:`run, list, result, watch, steer, stop, approve, ...`},{usage:`flow <cmd>`,blurb:`run, list, watch, result, resume, stop, discover, ...`},{usage:`agent <cmd>`,blurb:`list, show, init, push, run, usage, integrations`},{usage:`credentials <cmd>`,blurb:`engine credentials: list, add, login, remove`},{usage:`server <cmd>`,blurb:`self-host Coder: serve, rotate-key`},{usage:`runner <cmd>`,blurb:`run your server's tasks on this machine: serve, list, ...`},{usage:`auth <cmd>`,blurb:`sign in to Coder: login, logout, status`},{usage:`review [--base <ref> | --pr <n>]`,blurb:`review changed code with a built-in flow`},{usage:`config <list|get|set|unset> [<key> [value]]`,blurb:`read or write config`},{usage:`model <list|add|alias|disable>`,blurb:`manage models: built-ins, aliases, custom endpoints`},{usage:`connection <cmd>`,blurb:`platform accounts, API keys and MCP servers tasks use: add, list, rm, ...`},{usage:`docs [topic]`,blurb:`print bundled documentation (for agents to read)`},{usage:`upgrade [--cli-only|--plugins-only]`,blurb:`update the CLI and host plugins`}],start:[{usage:`coder setup-host [claude|agents]`,blurb:`"claude" for Claude Code, "agents" for any ~/.agents host (Codex, Pi, ...)`},{usage:`coder run --engine [codex|claude] "<task>"`,blurb:`run a task on that engine's default model`},{usage:`coder task result <task-id> --wait`,blurb:`wait for the answer; returns early if the task needs your approval`}],agents:[{usage:`coder docs skill [--claude]`,blurb:`load the skill once`},{usage:`coder mcp`,blurb:`the MCP server your host runs (setup-host adds it)`}],cloudIntro:`Your agents, always on at coder.wular.ai, connected to GitHub, Slack and any other app.`,cloud:[{usage:`coder auth login`,blurb:`sign in`},{usage:`coder <command> --server`,blurb:`the same commands on your Coder server, e.g. coder run --server "<task>"`}],usage:[{usage:`coder <command> --help`,blurb:`flags and details for any command`}]};function O(e){let t=e._zod.def;for(;t.innerType??t.in;)t=(t.innerType??t.in)._zod.def;return t.type===`union`&&t.options?.some(e=>e._zod.def.values?.includes(!0))?`maybe`:t.type}const k=t=>e.get(t)??{};function A(e,t){let n=e.args[t],r=O(n)===`array`?`...`:``;return n._zod.optin?`[${t}${r}]`:`<${t}>${r}`}function j(e,t){let n=O(t),r=k(t).value??(n===`boolean`?``:n===`maybe`?`[${e}]`:`<${e}>`);return{usage:`--${e}${r?` ${r}`:``}`,blurb:k(t).description??``}}const M=e=>[e.description,e.usage==null?``:n(e.usage)].filter(Boolean);function N(e,t,n=t.cyan){let r=Math.max(0,...e.map(e=>e.usage.length))+2;return e.map(e=>`  ${n(e.usage.padEnd(r))}${t.dim(e.blurb)}${e.note?` ${t.light(e.note)}`:``}`)}function P(e,t,n){return[``,n.bold(`${e}:`),...t]}function ae(e,t,n){let r=g,i=l(t).namespaces.find(t=>t.namespace===e)?.path??[e.name],a=i.join(` `),o=e=>Object.entries(n).find(([,t])=>t.join(` `)===[...i,e.name].join(` `))?.[0],s=e.namespaces??[],c=[...e.commands.map(e=>({usage:[e.name,...(e.cli?.positional??[]).map(t=>A(e,t))].join(` `),blurb:e.description,...o(e)?{note:`(coder ${o(e)})`}:{}})),...s.map(e=>({usage:`${e.name} <${e.commands.map(e=>e.name).join(`|`)}>`,blurb:e.description}))];return`${[r.bold(`Usage:`),`  coder ${a} <subcommand>`,``,M(e).join(`
 
-`),...M(`Subcommands`,j(c,r),r),``,b([`Details on a subcommand: coder ${a} <subcommand> --help`],r,r.cyan)].join(`
-`)}\n`}function N(e,t){let n=v,r=e.cli?.positional??[],i=Object.entries(e.args??{}).filter(([e])=>!r.includes(e)),a=i.filter(([e])=>e!==`json`&&e!==`cwd`),o=i.filter(([e])=>e===`json`||e===`cwd`),s=t?d(t).commands.find(t=>t.command===e)?.path??[e.name]:[e.name],c=s.join(` `),l=[n.bold(`Usage:`),`  ${[`coder`,c,...r.map(t=>O(e,t)),...a.length?[`[flags]`]:[]].join(` `)}`,``,A(e).join(`
+`),...P(`Subcommands`,N(c,r),r),``,v([`Details on a subcommand: coder ${a} <subcommand> --help`],r,r.cyan)].join(`
+`)}\n`}function F(e,t){let n=g,r=e.cli?.positional??[],i=Object.entries(e.args??{}).filter(([e])=>!r.includes(e)),a=i.filter(([e])=>e!==`json`&&e!==`cwd`),o=i.filter(([e])=>e===`json`||e===`cwd`),s=t?l(t).commands.find(t=>t.command===e)?.path??[e.name]:[e.name],c=s.join(` `),u=[n.bold(`Usage:`),`  ${[`coder`,c,...r.map(t=>A(e,t)),...a.length?[`[flags]`]:[]].join(` `)}`,``,M(e).join(`
 
-`)],u=e=>j(e.map(([e,t])=>k(e,t)),n),f=e=>j(e.map(([e,t])=>({usage:String(e),blurb:t})),n),{exit:p,env:m,examples:h}=e.cli??{};return a.length&&l.push(...M(`Flags`,u(a),n)),o.length&&l.push(...M(`Global flags`,u(o),n)),p?.length&&l.push(...M(`Exit codes`,f(p),n)),m?.length&&l.push(...M(`Environment`,f(m),n)),h?.length&&l.push(...M(`Examples`,h.flatMap(e=>{let t=e.lastIndexOf(`  # `);return t<0?[`  ${n.cyan(e)}`]:[`  ${n.cyan(e.slice(0,t))}`,`    ${n.dim(e.slice(t+4))}`]}),n)),s.length>1&&l.push(...M(`Related`,[`  ${n.cyan(`coder ${s.slice(0,-1).join(` `)} --help`)}`],n)),`${l.join(`
-`)}\n`}function P(e,t){let n=v,{start:r,agents:i,cloud:a,usage:o,commands:s,globals:c}=e,l=j([...r,...i,...a,...o,...s,...c],n),u=0,d=e=>l.slice(u,u+=e);return`${[`${n.bold(e.title)} ${n.dim(`v${t}`)}`,e.description,...M(`Get started`,d(r.length),n),...M(`Agents`,d(i.length),n),...M(`Coder Cloud`,[`  ${n.dim(e.cloudIntro)}`,...d(a.length)],n),...M(`Usage`,[`  ${e.usageLine}`,...d(o.length)],n),...M(`Commands`,d(s.length),n),...M(`Global`,l.slice(-c.length),n)].join(`
-`)}\n`}function F(e){let t=e.indexOf(`--`),n=t===-1?e:e.slice(0,t);return n.includes(`-h`)||n.includes(`--help`)}const I=`Use luna or sonnet for mechanical work; sol or opus is the default.
-Use astra or fable for the hardest work; they cost the most.`,L={json:l(`JSON output`),cwd:u(`workspace directory (default: current)`,`<dir>`)};function R(e,t){return e.map(e=>{let n=e.search(/(?:\b[A-Z][A-Z0-9_]*=\S+\s+)*coder /);return{usage:n<0?``:e.slice(n),blurb:n<0?e:e.slice(0,n).trim().replace(/:$/,``),cli:{...t,text:e}}})}function z(e,t={}){e=e.filter(e=>!e.cli?.hidden&&e.cli?.slot===t.slot);let n=j(e.map(e=>({...e,blurb:e.cli?.layout===`rows`?e.cli.text??e.blurb:e.blurb})),v,v.blue);for(let r=0;r<e.length;){let{text:i,...a}=e[r].cli??{},o={...a,...t},s=r+1;for(;s<e.length;){let{text:n,...r}=e[s].cli??{};if(JSON.stringify({...r,...t})!==JSON.stringify(o))break;s++}let c=o.stream===`stderr`?T.stderr:T.stdout,l=o.stream===`stderr`&&o.style!==`stdout`?y:v,u=e.slice(r,s).map(e=>e.cli?.text??`${e.blurb}: ${e.usage}`),d=o.layout===`plain`?o.dim?l.dim(u.join(`
+`)],d=e=>N(e.map(([e,t])=>j(e,t)),n),f=e=>N(e.map(([e,t])=>({usage:String(e),blurb:t})),n),{exit:p,env:m,examples:h}=e.cli??{};return a.length&&u.push(...P(`Flags`,d(a),n)),o.length&&u.push(...P(`Global flags`,d(o),n)),p?.length&&u.push(...P(`Exit codes`,f(p),n)),m?.length&&u.push(...P(`Environment`,f(m),n)),h?.length&&u.push(...P(`Examples`,h.flatMap(e=>{let t=e.lastIndexOf(`  # `);return t<0?[`  ${n.cyan(e)}`]:[`  ${n.cyan(e.slice(0,t))}`,`    ${n.dim(e.slice(t+4))}`]}),n)),s.length>1&&u.push(...P(`Related`,[`  ${n.cyan(`coder ${s.slice(0,-1).join(` `)} --help`)}`],n)),`${u.join(`
+`)}\n`}function oe(e,t){let n=g,{start:r,agents:i,cloud:a,usage:o,commands:s,globals:c}=e,l=N([...r,...i,...a,...o,...s,...c],n),u=0,d=e=>l.slice(u,u+=e);return`${[`${n.bold(e.title)} ${n.dim(`v${t}`)}`,e.description,...P(`Get started`,d(r.length),n),...P(`Agents`,d(i.length),n),...P(`Coder Cloud`,[`  ${n.dim(e.cloudIntro)}`,...d(a.length)],n),...P(`Usage`,[`  ${e.usageLine}`,...d(o.length)],n),...P(`Commands`,d(s.length),n),...P(`Global`,l.slice(-c.length),n)].join(`
+`)}\n`}function se(e){let t=e.indexOf(`--`),n=t===-1?e:e.slice(0,t);return n.includes(`-h`)||n.includes(`--help`)}const I=`Use luna or sonnet for mechanical work; sol or opus is the default.
+Use astra or fable for the hardest work; they cost the most.`,L={json:C(`JSON output`),cwd:S(`workspace directory; default current`,`<dir>`)};function R(e,t){return e.map(e=>{let n=e.search(/(?:\b[A-Z][A-Z0-9_]*=\S+\s+)*coder /);return{usage:n<0?``:e.slice(n),blurb:n<0?e:e.slice(0,n).trim().replace(/:$/,``),cli:{...t,text:e}}})}function z(e,t={}){e=e.filter(e=>!e.cli?.hidden&&e.cli?.slot===t.slot);let n=N(e.map(e=>({...e,blurb:e.cli?.layout===`rows`?e.cli.text??e.blurb:e.blurb})),g,g.blue);for(let r=0;r<e.length;){let{text:i,...a}=e[r].cli??{},o={...a,...t},s=r+1;for(;s<e.length;){let{text:n,...r}=e[s].cli??{};if(JSON.stringify({...r,...t})!==JSON.stringify(o))break;s++}let c=o.stream===`stderr`?E.stderr:E.stdout,l=o.stream===`stderr`&&o.style!==`stdout`?_:g,u=e.slice(r,s).map(e=>e.cli?.text??`${e.blurb}: ${e.usage}`),d=o.layout===`plain`?o.dim?l.dim(u.join(`
 `)):u.join(`
-`):o.layout===`good`||o.layout===`bad`?u.map(o.layout===`good`?h:x).join(`
+`):o.layout===`good`||o.layout===`bad`?u.map(o.layout===`good`?f:ee).join(`
 `):o.layout===`inline`?e.slice(r,s).map(e=>`${l.bold(e.usage)}  ${l.dim(e.blurb)}`).join(`
 `):o.layout===`rows`?[l.bold(`${o.title??`Related`}:`),...n.slice(r,s)].join(`
-`):b(u,l,o.paint===`cyan`?l.cyan:l.blue,o.title);c.write(`${o.prefix??`
-`}${d}\n`),r=s}}const B=e=>e===`https://coder.wular.ai`?`Sign in: coder auth login`:`Sign in: coder auth login --server ${e}`;async function V(e,t=!1){let n=C(e);if(S(n))return n;if(!t){if(!te())throw new m(`invalid-option`,`First use of Coder server ${new URL(n).origin} needs confirmation.`,{hint:`Inspect the origin, then repeat with --yes.`});if((await ee({title:`Connect to ${new URL(n).origin}?`,hint:`This server can receive task and agent data.`,options:[{value:`yes`,label:`Continue`},{value:`no`,label:`Cancel`}]}))[0]!==`yes`)throw new m(`invalid-option`,`Server connection cancelled.`)}return re(n),n}function H(e){T.stderr.write(`[coder] No engine could start. Follow fallback.instructions with a native subagent.
-`),g(e)}function U(e,t=!1){let n=`read-only unavailable on this host: the OS sandbox failed to start (Linux/WSL2 needs bubblewrap + socat). Re-dispatch with --permissions auto (or workspace-write) if writes are acceptable, or install the sandbox deps.`;t?g({error:n,code:`read-only-unavailable`,detail:e}):T.stderr.write(`[coder] ${n}\n`),T.exit(1)}function W(e,t,n){let r=p(e).approvals.escalationTimeoutMs/1e3;return R([`Approve: coder task approve ${t} ${n.id}`,`Deny: coder task approve ${t} ${n.id} --deny`,`Then wait again in its own background shell, one per task: coder task result ${t} --wait`,`Unanswered approvals auto-deny after ${r} seconds.`,...n.networkHost?[`Network access to ${n.networkHost} can be pre-approved with approvals.allowedNetworkHosts.`]:[]])}function G(e,t){return Error(JSON.stringify({...typeof e==`object`&&e?e:{result:e},next:t.map(({usage:e,blurb:t})=>({usage:e,blurb:t}))}))}function K(e,t,n,r=!1){if(r)g({taskId:t,status:`awaiting-approval`,approval:n});else{let r=W(e,t,n).map(e=>e.cli.text);T.stdout.write(`Approval needed for task ${t}: ${n.summary}\n`),n.cwd&&T.stdout.write(`Runs in: ${n.cwd}\n`),T.stderr.write(`\n${b(r,y,y.blue,`Next steps`)}\n`)}T.exit(4)}function se(e,t,n){switch(e.code){case`chain-exhausted`:H(e.payload),T.exit(3);case`read-only-unavailable`:U(e.message,n.json);case`approval-pending`:K(t,e.taskId,e.approval,n.json);case`startup-failed`:n.json&&(g({taskId:e.taskId,status:`failed`,detail:e.message}),T.exit(1)),_(`Task ${e.taskId} failed to start.${e.message?`\n${e.message}`:``}`,{hint:`See: coder task result ${e.taskId}`});case`login-failed`:_(e.message,{hint:[B(C(n.server)),`Or, for a memory server, set the same ADMIN_TOKEN it was started with`]});case`server`:_(e.message,{hint:e.hint??(e.status===401?B(C(n.server)):void 0)});default:_(e.message,e.hint?{hint:e.hint}:{})}}function ce(e){let t=Object.entries(L).filter(([t])=>e.globalFlags?.[t]!==!1),n={...e.args,...Object.fromEntries(t)},r=e.cli?.positional??[],i=(t,n)=>{let{cwd:i}=t,a=t;return{options:t,args:r.flatMap(e=>a[e]??[]),cwd:i?w.resolve(i):T.cwd(),tool:n,next(r,i){!n&&(!t.json||i?.force)&&z(e.next?.({result:r,args:t})??[],i)}}},c=async t=>{let n=t.options;return n.server!==void 0&&await V(n.server,n.yes),e.run(t)},l=a({name:e.name,description:e.description,...e.usage?{usage:e.usage}:{},access:e.access,args:n,...e.cli?{cli:e.cli}:{},...e.mcp===!1?{mcp:!1}:{},...e.mcp===!1?{}:{mcp:{text:e=>typeof e.output==`string`?e.output:JSON.stringify(e.output)??``}},async run(t){let n=i(t,!0),r;try{r=await c(n)}catch(e){throw e instanceof m&&e.code===`approval-pending`&&e.taskId&&e.approval?G({taskId:e.taskId,status:`awaiting-approval`,approval:e.approval},W(n.cwd,e.taskId,e.approval)):e}let a=e.json?e.json(r,n):r;if(e.exit?.(r,n))throw G(a,e.next?.({result:r,args:t})??[]);return{value:r,output:a}},next:({result:t,args:n})=>e.next?.({result:t.value,args:n})??[]}),u=async t=>{let n;try{n=s(l,t)}catch(t){if(!(t instanceof o))throw t;let{cli:n}=await import(`./cmd-DX5ByXo3.js`),r=d(n).commands.find(e=>e.command.run===l.run)?.path??[e.name];throw new m(`invalid-option`,t.message,{hint:`Help: coder ${r.join(` `)} --help`})}let r=i(n,!1),a;try{a=await c(r)}catch(e){throw e instanceof m&&se(e,r.cwd,r.options),e}if(n.json&&a!==void 0)g(e.json?e.json(a,r):a);else{let t=e.print?.(a,r);t&&typeof t.then==`function`&&await t,r.next(a),await e.afterNext?.(a,r)}let u=e.exit?.(a,r);u!==void 0&&(T.exitCode=u)};return Object.defineProperty(u,"name",{value:e.name,writable:!0,enumerable:!0}),Object.assign(u,l)}function le({usage:e,...t}){let n=async e=>{let{cli:n}=await import(`./cmd-DX5ByXo3.js`);return Z([...d(n).namespaces.find(e=>e.namespace.name===t.name&&e.namespace.commands===t.commands)?.path??[t.name],...e])};return Object.defineProperty(n,"name",{value:t.name,writable:!0,enumerable:!0}),Object.assign(n,r({...t,...e?{usage:e}:{}}))}const q={"task worker":async()=>(await import(`./worker-C1tuzq5n.js`)).commandWorker,"task mcp":async()=>(await import(`./mcp-CUITALl1.js`)).commandTaskMcp,"task tools":async()=>(await import(`./tools-CM4UCsId.js`)).commandTools,"flow drive":async()=>(await import(`./drive-Y-ZlgiUW.js`)).commandDrive,"upgrade refresh":async()=>(await import(`./refresh-D-0K9fo3.js`)).commandRefreshUpdate};async function J(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-DX5ByXo3.js`),r=n[e[0]];return c(t,r?[...r,...e.slice(1)]:e)}async function Y(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-DX5ByXo3.js`);return`command`in e?N(e.command,t):oe(e.namespace,t,n)}async function ue(e){let t=await J(e.split(` `));return t&&!t.rest.length?Y(t):null}const X=()=>P({...ae,globals:[{usage:`-h, --help`,blurb:`show help (top-level, or for a command)`},{usage:`-v, --version`,blurb:`print the coder version`},...Object.entries(L).map(([e,t])=>k(e,t))]},n());async function Z(e){let[t,...r]=e;if(t===`--version`||t===`-v`){T.stdout.write(`${n()}\n`);return}if(t===void 0||t===`help`||t===`--help`||t===`-h`){let e=r.length?await J(r):void 0;T.stdout.write(e?await Y(e):X());return}let a=e.slice(0,2).join(` `);if(!q[a]&&t!==`mcp`){let e=f(n(),i);e&&T.stderr.write(y.dim(`coder ${n()} -> `)+y.bold(e)+y.dim(` available. run: coder upgrade
+`):v(u,l,o.paint===`cyan`?l.cyan:l.blue,o.title);c.write(`${o.prefix??`
+`}${d}\n`),r=s}}const B=e=>e===`https://coder.wular.ai`?`Sign in: coder auth login`:`Sign in: coder auth login --server ${e}`;async function V(e,t=!1){let n=y(e);if(ne(n))return n;if(!t){if(!b())throw new u(`invalid-option`,`First use of Coder server ${new URL(n).origin} needs confirmation.`,{hint:`Inspect the origin, then repeat with --yes.`});if((await te({title:`Connect to ${new URL(n).origin}?`,hint:`This server can receive task and agent data.`,options:[{value:`yes`,label:`Continue`},{value:`no`,label:`Cancel`}]}))[0]!==`yes`)throw new u(`invalid-option`,`Server connection cancelled.`)}return x(n),n}function H(e){E.stderr.write(`[coder] No engine could start. Follow fallback.instructions with a native subagent.
+`),p(e)}function U(e,t=!1){let n=`read-only unavailable on this host: the OS sandbox failed to start (Linux/WSL2 needs bubblewrap + socat). Re-dispatch with --permissions auto (or workspace-write) if writes are acceptable, or install the sandbox deps.`;t?p({error:n,code:`read-only-unavailable`,detail:e}):E.stderr.write(`[coder] ${n}\n`),E.exit(1)}function W(e,t,n,r){let i=w(r);return R([`Approve: coder task approve ${t} ${n.id}${i}`,`Deny: coder task approve ${t} ${n.id} --deny --reason "<why>"${i}`,`Then wait again in its own background shell, one per task: coder task result ${t} --wait${i}`,`The decision reaches the task as a message, any time.`])}function G(e,t){return Error(JSON.stringify({...typeof e==`object`&&e?e:{result:e},next:t.map(({usage:e,blurb:t})=>({usage:e,blurb:t}))}))}function ce(e,t,n,r){if(r.json)p({taskId:t,status:`awaiting-approval`,approval:n});else{let i=W(e,t,n,r).map(e=>e.cli.text);E.stdout.write(`Approval needed for task ${t}: ${n.reason}\n`),E.stdout.write(`${h(n.actions)}\n`),E.stderr.write(`\n${v(i,_,_.blue,`Next steps`)}\n`)}E.exit(4)}function le(e,t,n){switch(e.code){case`chain-exhausted`:H(e.payload),E.exit(3);case`read-only-unavailable`:U(e.message,n.json);case`approval-pending`:ce(t,e.taskId,e.approval,n);case`startup-failed`:n.json&&(p({taskId:e.taskId,status:`failed`,detail:e.message}),E.exit(1)),m(`Task ${e.taskId} failed to start.${e.message?`\n${e.message}`:``}`,{hint:`See: coder task result ${e.taskId}`});case`login-failed`:m(e.message,{hint:[B(y(n.server)),`Or, for a memory server, set the same ADMIN_TOKEN it was started with`]});case`server`:m(e.message,{hint:e.hint??(e.status===401?B(y(n.server)):void 0)});default:m(e.message,e.hint?{hint:e.hint}:{})}}function ue(e){let t=Object.entries(L).filter(([t])=>e.globalFlags?.[t]!==!1),n={...e.args,...Object.fromEntries(t)},r=e.cli?.positional??[],a=(t,n)=>{let{cwd:i}=t,a=t;return{options:t,args:r.flatMap(e=>a[e]??[]),cwd:i?T.resolve(i):E.cwd(),tool:n,next(r,i){!n&&(!t.json||i?.force)&&z(e.next?.({result:r,args:t})??[],i)}}},s=async t=>{let n=t.options;return n.server!==void 0&&await V(n.server,n.yes),e.run(t)},d=i({name:e.name,description:e.description,...e.usage?{usage:e.usage}:{},access:e.access,args:n,...e.cli?{cli:e.cli}:{},...e.mcp===!1?{mcp:!1}:{},...e.mcp===!1?{}:{mcp:{text:e=>typeof e.output==`string`?e.output:JSON.stringify(e.output)??``}},async run(t){let n=a(t,!0),r;try{r=await s(n)}catch(e){throw e instanceof u&&e.code===`approval-pending`&&e.taskId&&e.approval?G({taskId:e.taskId,status:`awaiting-approval`,approval:e.approval},W(n.cwd,e.taskId,e.approval,n.options)):e}let i=e.json?e.json(r,n):r;if(e.exit?.(r,n))throw G(i,e.next?.({result:r,args:t})??[]);return{value:r,output:i}},next:({result:t,args:n})=>e.next?.({result:t.value,args:n})??[]}),f=async t=>{let n;try{n=o(d,t)}catch(t){if(!(t instanceof c))throw t;let{cli:n}=await import(`./cmd-BHZwhrfa.js`),r=l(n).commands.find(e=>e.command.run===d.run)?.path??[e.name];throw new u(`invalid-option`,t.message,{hint:`Help: coder ${r.join(` `)} --help`})}let r=a(n,!1),i;try{i=await s(r)}catch(e){throw e instanceof u&&le(e,r.cwd,r.options),e}if(n.json&&i!==void 0)p(e.json?e.json(i,r):i);else{let t=e.print?.(i,r);t&&typeof t.then==`function`&&await t,r.next(i),await e.afterNext?.(i,r)}let f=e.exit?.(i,r);f!==void 0&&(E.exitCode=f)};return Object.defineProperty(f,"name",{value:e.name,writable:!0,enumerable:!0}),Object.assign(f,d)}function K({usage:e,...n}){let r=async e=>{let{cli:t}=await import(`./cmd-BHZwhrfa.js`);return Z([...l(t).namespaces.find(e=>e.namespace.name===n.name&&e.namespace.commands===n.commands)?.path??[n.name],...e])};return Object.defineProperty(r,"name",{value:n.name,writable:!0,enumerable:!0}),Object.assign(r,t({...n,...e?{usage:e}:{}}))}const q={"task worker":async()=>(await import(`./worker-sTJL2eoe.js`)).commandWorker,"task mcp":async()=>(await import(`./mcp-CGU7aoJ-.js`)).commandTaskMcp,"task hook":async()=>(await import(`./hook-CIipj9MJ.js`)).commandTaskHook,"task tools":async()=>(await import(`./tools-FVop8XYG.js`)).commandTools,"task tools-search":async()=>(await import(`./tools-search-kjKKolwp.js`)).commandToolsSearch,"flow drive":async()=>(await import(`./drive-Bwl7Bjme.js`)).commandDrive,"upgrade refresh":async()=>(await import(`./refresh-CxsaX5R9.js`)).commandRefreshUpdate};async function J(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-BHZwhrfa.js`),r=n[e[0]];return s(t,r?[...r,...e.slice(1)]:e)}async function Y(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-BHZwhrfa.js`);return`command`in e?F(e.command,t):ae(e.namespace,t,n)}async function de(e){let t=await J(e.split(` `));return t&&!t.rest.length?Y(t):null}const X=()=>oe({...D,globals:[{usage:`-h, --help`,blurb:`show help (top-level, or for a command)`},{usage:`-v, --version`,blurb:`print the coder version`},...Object.entries(L).map(([e,t])=>j(e,t))]},r());async function Z(e){let[t,...n]=e;if(t===`--version`||t===`-v`){E.stdout.write(`${r()}\n`);return}if(t===void 0||t===`help`||t===`--help`||t===`-h`){let e=n.length?await J(n):void 0;E.stdout.write(e?await Y(e):X());return}let i=e.slice(0,2).join(` `);if(!q[i]&&t!==`mcp`){let e=d(r(),a);e&&E.stderr.write(_.dim(`coder ${r()} -> `)+_.bold(e)+_.dim(` available. run: coder upgrade
 
-`))}if(q[a])return(await q[a]())(e.slice(2));let o=await J(e);if(o||(T.stdout.write(X()),T.stdout.write(`
-`),_(`Unknown command "${t}".`,{hint:`See all commands: coder --help`})),`namespace`in o){let[e]=o.rest,t=o.path.join(` `);T.stdout.write(await Y(o)),e&&![`help`,`-h`,`--help`].includes(e)&&_(`Unknown ${t} subcommand "${e}".`,{hint:`Help: coder ${t} --help`});return}if(F(o.rest))return void T.stdout.write(await Y(o));await o.command(o.rest)}function Q(){return T.stdout.on(`error`,e=>{throw e.code===`EPIPE`&&T.exit(0),e}),Z(T.argv.slice(2)).catch(e=>{e instanceof ne&&T.exit(130),e instanceof m&&e.hint&&_(e.message,{hint:e.hint});let t=e instanceof Error&&e.cause instanceof Error?`: ${e.cause.message}`:``;T.stderr.write(`${e instanceof Error?e.message:String(e)}${t}\n`),T.exit(1)})}const $=T.argv[1]&&ie(T.argv[1]).href;$&&[import.meta.url,new URL(`./cli.js`,import.meta.url).href].includes($)&&Q();export{I as MODEL_HINT,ce as command,V as confirmServer,Z as dispatch,le as group,Q as main,R as nextSteps,ue as renderHelp,X as renderTopHelp,N as t};
+`))}if(q[i])return(await q[i]())(e.slice(2));let o=await J(e);if(o||(E.stdout.write(X()),E.stdout.write(`
+`),m(`Unknown command "${t}".`,{hint:`See all commands: coder --help`})),`namespace`in o){let[e]=o.rest,t=o.path.join(` `);E.stdout.write(await Y(o)),e&&![`help`,`-h`,`--help`].includes(e)&&m(`Unknown ${t} subcommand "${e}".`,{hint:`Help: coder ${t} --help`});return}if(se(o.rest))return void E.stdout.write(await Y(o));await o.command(o.rest)}function Q(){return E.stdout.on(`error`,e=>{throw e.code===`EPIPE`&&E.exit(0),e}),Z(E.argv.slice(2)).catch(e=>{e instanceof re&&E.exit(130),e instanceof u&&e.hint&&m(e.message,{hint:e.hint});let t=e instanceof Error&&e.cause instanceof Error?`: ${e.cause.message}`:``;E.stderr.write(`${e instanceof Error?e.message:String(e)}${t}\n`),E.exit(1)})}const $=E.argv[1]&&ie(E.argv[1]).href;$&&[import.meta.url,new URL(`./cli.js`,import.meta.url).href].includes($)&&Q();export{I as MODEL_HINT,ue as command,V as confirmServer,Z as dispatch,K as group,Q as main,R as nextSteps,de as renderHelp,X as renderTopHelp,F as t};