@wular/coder 0.4.12 → 0.5.0

package/dist/apps-D-v5sQJk.js

@@ -1,367 +0,0 @@
-import{Ft as e,Rt as t,en as n,qi as r}from"./core-DwsAMCnL.js";import{$ as i,$t as a,At as o,D as s,E as c,En as l,Et as u,F as d,Ft as f,G as p,Gt as m,H as h,Ht as g,I as _,J as v,Jt as y,Kt as ee,Lt as te,Mt as ne,N as re,Nt as ie,O as b,Ot as ae,Pt as oe,Qt as se,R as ce,Sn as le,U as ue,W as de,Wt as fe,Yt as pe,Z as me,an as he,cn as x,d as ge,dn as _e,en as ve,et as ye,f as be,g as xe,gn as Se,gt as Ce,in as we,it as Te,j as Ee,k as De,kt as Oe,mn as S,o as ke,p as Ae,pn as je,qt as Me,sn as Ne,wn as Pe,x as Fe}from"./errors-XBA-Ls4n.js";import{Ct as Ie,E as Le,Ft as Re,H as ze,Jt as Be,Kt as Ve,L as He,Lt as Ue,M as We,Mt as Ge,N as Ke,O as qe,Pt as Je,St as Ye,Ut as Xe,Vt as Ze,W as Qe,Xt as $e,Yt as et,Zt as tt,ht as nt,j as rt,qt as it,tt as at,wt as ot}from"./output-D95NoAA9.js";import{a as st,d as ct,f as lt,i as ut,l as dt,n as ft,o as pt,r as mt,t as ht,u as gt}from"./load-zhcrwSRF.js";import{d as _t,m as vt,p as yt}from"./slack-Bo5l13Rs.js";import{n as bt,t as xt}from"./integrations-DyInAa5g.js";import{t as St}from"./dist-DAnSqY1s.js";import{i as Ct,t as wt}from"./discover-CPZdprlQ.js";import{c as Tt,i as Et,o as Dt,s as Ot,t as kt}from"./actions-BT7_eKXm.js";import{C as At,S as jt,c as Mt,s as Nt}from"./executor-Dt2FFT-y.js";import{n as Pt}from"./log-view-CL3_S0IQ.js";import{n as Ft,r as It}from"./mcp-Bta09QCU.js";import{a as Lt,n as Rt,r as zt}from"./turn-DMvPfhb5.js";import{c as Bt,n as Vt,o as Ht,r as Ut,t as Wt,u as Gt}from"./exec-iFssTO5V.js";import{f as Kt,r as qt}from"./task-BU1JEK9X.js";import{n as Jt}from"./async-XNO3nqum.js";import{n as Yt,t as Xt}from"./match-Bq4sDuCy.js";import{n as Zt,t as Qt}from"./base64url-CsVsW4Id.js";import{a as C,c as $t,d as en,f as tn,i as nn,l as rn,m as an,n as on,p as w,r as sn,u as cn}from"./http-BZfjbiov.js";import{n as ln}from"./env-B9JG6gwo.js";import{C as T,S as un,T as dn,_ as fn,b as pn,c as mn,d as hn,f as gn,h as _n,l as vn,p as yn,r as bn,s as xn,t as Sn,u as Cn,w as wn,x as E}from"./runners-CYTicTb7.js";import{C as Tn,S as En,c as Dn,d as On,g as kn,i as An,l as jn,m as Mn,o as Nn,p as Pn,s as Fn,t as In,u as Ln,v as Rn,w as zn,y as Bn}from"./local-D55UkW93.js";import{n as Vn,t as Hn}from"./chat-bwKd3y6V.js";import{a as D,i as Un,t as Wn}from"./client-C4QCT6cG.js";import{C as Gn,E as Kn,M as O,S as qn,T as Jn,_ as Yn,agent as k,agentVersion as A,b as j,c as Xn,chatItem as Zn,chatState as M,d as N,engineCredential as Qn,f as $n,g as er,h as tr,integrationApp as nr,integrationAppInstallation as rr,m as P,p as F,platformLink as ir,runner as ar,s as or,secret as I,task as L,taskHistory as sr,taskInbox as R,taskLog as cr,taskTombstone as lr,usage as ur,v as z,w as dr,y as fr}from"./schema.js";import B from"node:path";import pr from"node:process";import{fileURLToPath as mr,pathToFileURL as hr}from"node:url";import V,{accessSync as gr,constants as _r,existsSync as vr,readFileSync as yr,statSync as br}from"node:fs";import{execFile as xr,spawn as Sr}from"node:child_process";import{createHash as Cr,createHmac as wr,randomBytes as Tr,randomUUID as Er}from"node:crypto";import Dr from"node:os";import Or from"node:net";import{isDeepStrictEqual as kr,promisify as Ar}from"node:util";import{brotliDecompressSync as jr,constants as Mr,createGzip as Nr,gunzipSync as Pr,gzipSync as Fr,inflateSync as Ir}from"node:zlib";const Lr=e=>`nonce:${vt(e)}`;function Rr(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function zr(e,t){return wr(`sha256`,Rr(e)).update(t).digest(`base64url`)}async function Br(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:Tr(18).toString(`base64url`),exp:a+i},s=Zt(o),c=`${s}.${zr(e,s)}`;return await e.store.put(`delivery`,Lr(c),{at:a,target:r},{ttlMs:i}),c}function Vr(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&yt(zr(e,n),r))try{return Qt(n)}catch{return}}async function Hr(e,t){let n=await e.store.get(`delivery`,Lr(t));return n&&`target`in n?n.target:void 0}function Ur(e,t){return Vr(e,t)?.organization}function Wr(e,t){return Vr(e,t)?.user}function Gr(e,t,n,r,i=!0){let a=Vr(e,t);return a&&a.kind===n&&(a.user===r||i&&a.user===`*`)&&a.organization===e.organizationId&&a.exp>=(e.now??Date.now)()?a:void 0}async function Kr(e,t,n,r,i){if(!Gr(e,t,n,r,!1))return!1;let a=await e.store.take(`delivery`,Lr(t),{target:i});return!!a&&`target`in a&&a.target===i}async function qr(e,t,n,r){if(!Gr(e,t,n,r))return;let i=await e.store.take(`delivery`,Lr(t));return i&&`target`in i?i.target:void 0}async function Jr(e,t,n,r){return Gr(e,t,n,r)?Hr(e,t):void 0}const Yr=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function Xr(e,t,n,r){return{method:e,pattern:t,handler:n,...r?{guard:r}:{}}}function Zr(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function Qr(e,t,n){return[e,`${e}/*`].flatMap(e=>Yr.map(r=>Xr(r,e,t,n)))}function $r(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function ei(e,t,n,r){for(let i of e){let a=$r(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=$t();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const ti=`coder`;function ni(e,t){let n=e??`/dash`;try{let e=new URL(n,t);return e.origin===t&&!n.includes(`\\`)&&!/^\/[/\\]/.test(e.pathname)?`${e.pathname}${e.search}${e.hash}`:`/dash`}catch{return`/dash`}}const ri=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(xt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function ii(e){let t=B.dirname(mr(e));for(;;){let e=B.join(t,`package.json`);if(vr(e))try{if(JSON.parse(yr(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=B.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function ai(e=import.meta.url){let t=B.dirname(mr(e)),n=ii(e),r=mr(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[B.resolve(r,`../../..`),B.join(n,`dist/dash`),B.join(t,`../dash`)].find(e=>vr(oi(e)))}const oi=e=>B.join(e,`standalone/server/manifest.json`);function si(e){let t=B.join(e,`standalone/server/entry.js`);if(!vr(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function ci(e){let t=JSON.parse(yr(oi(e),`utf8`));return{handler:await(await import(hr(si(e)).href)).createRequestHandler({root:B.join(e,`standalone`)}),manifest:t}}var li=class{moduleUrl;root;loaded;constructor(e=import.meta.url){this.moduleUrl=e}host(){let e=Date.now(),t=this.loaded;if(t&&e-t.checked<1e3)return t.host;if(this.root??=ai(this.moduleUrl),!this.root)return;let n;try{n=br(oi(this.root)).mtimeMs}catch{}if(t&&(t.checked=e,n===void 0||n===t.build))return t.host;let r={build:n,checked:e,host:ci(this.root)};return r.host.catch(()=>{this.loaded===r&&(this.loaded=void 0)}),this.loaded=r,r.host}};const ui=e=>e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;function di(e,t){let n=ui(e);return!!($r(`/assets/*`,n)||$r(`/dash/*`,n)||t.routes.some(e=>$r(e.route,n)))}async function fi(e,t=new li){return!!(await t.host()?.catch(()=>void 0))?.manifest.routes.some(t=>$r(t.route,ui(e)))}const pi=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,mi=e=>`'sha256-${Cr(`sha256`).update(e).digest(`base64`)}'`;function hi(e){let t=[...e.matchAll(pi)].map(e=>mi(e[1]));return[...ri,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function gi(e,t){return t===`gzip`?Pr(e).toString(`utf8`):t===`br`?jr(e).toString(`utf8`):t===`deflate`?Ir(e).toString(`utf8`):e.toString(`utf8`)}const _i=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function vi(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function yi(e){let t=Nr(),n=e=>new Promise(n=>{t.write(e),t.flush(Mr.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function bi(e,t,n,r){n.set(`content-security-policy`,[...ri,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return _i(e)&&(vi(n),i=yi(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function xi(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return bi(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=gi(a,i);r.set(`content-security-policy`,hi(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&_i(e)&&(s=new Uint8Array(Fr(o)),vi(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function Si(e,t=new li){let n=await t.host();if(!n||!di(new URL(e.url).pathname,n.manifest))return;let r=Tr(16).toString(`base64`),i=new Headers(e.headers);return i.set(`content-security-policy`,`script-src 'nonce-${r}'`),xi(e,await n.handler(new Request(e,{headers:i})),r)}const Ci=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function wi(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function Ti(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=ni(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?ym(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":Ci(e,a)}}):w(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":Ci(e,``,!0)}}):w(`/dash?token=rejected`,303)}async function Ei(e,t,n,r){return w(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function Di(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(ni(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(wi(e,n)).host!==new URL(a).host?w(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function Oi(e,t,n,r){return t.auth?!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?Di(e,t,r,r.searchParams.get(`return`)):Mi(e,t):w(`/dash`)}function ki(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,Cm(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}const Ai=()=>new Response(`UI is not built`,{status:503}),ji=e=>async(t,n)=>await Si(ki(t,n),n.dashboardHosts)??e(),Mi=ji(Ai),Ni=ji(rn);function Pi(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}function H(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function Fi(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:H(e,n.organizationId),app:n.app}}async function Ii(e,t){if(e.boundInstallation?.installation.id===t)return{...H(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:H(e,n)}function Li(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...H(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function Ri(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function zi(e,t,n,r){let i=t.session,a=r.searchParams.get(`token`)??``,o=Li(t,i,Ur(t,a))??t;if(await Jr(o,a,`link`,i.user.id))return await Si(e,t.dashboardHosts)??Ai();let s=await qr(o,a,`link-start`,i.user.id);if(!s)return new Response(`This link is invalid or has expired.`,{status:400});let c=await Br(o,`link`,i.user.id,s,3e5);return w(`/connect?token=${encodeURIComponent(c)}`)}async function Bi(e,t,n,r){let i=t.session,a=await e.json().catch(()=>({})),o=typeof a.token==`string`?await qr(Li(t,i,Ur(t,a.token))??t,a.token,`link`,i.user.id):void 0;if(!o)return C({error:`This link is invalid or has expired.`},400);let s=JSON.parse(o);return await t.auth.link(i.user,s.platform,s.platformUserId,{organizations:i.organizations.map(e=>e.id)})===`taken`?C({error:`That platform account is connected to someone else.`},409):C({ok:!0,...s})}async function Vi(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`connection`);if(c){let e=Li(t,s,r.searchParams.get(`organization`)??s.organizationId),n=e&&await e.store.get(`connection`,c);if(!e||!n||n.provider!==i.id||n.auth!==`oauth`||n.owner&&n.owner!==s.user.id)return C({error:`Unknown OAuth connection`},404);if(!n.owner){let t=vm(e,`Only workspace owners and admins can authorize workspace connections`);if(t instanceof Response)return t}let l=await zf(e,i.id);if(!l)return C({error:`No OAuth client is available for ${i.name}.`},400);let u=await Br(e,`native-oauth`,s.user.id,JSON.stringify({connection:n,app:l.id,attempt:r.searchParams.get(`attempt`)}));return w(a.authorizeUrl(E(t.config,l.credentials),{publicUrl:o,state:u,access:n.access??`write`}))}let l=r.searchParams.get(`installation`)??``,u=Li(t,s,l?await t.installationOrganization?.(l):void 0),d=u??{...t,session:s};if(!u)return $(d,`not-member`,{platform:i.id});let f=await Ri(u,l);if(!f||f.integration!==i.id)return $(d,`disconnected`,{platform:i.id});let p=await Br(u,`link-oauth`,s.user.id,l);return w(a.authorizeUrl(E(t.config,f.credentials),{publicUrl:o,state:p}))}async function Hi(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`state`)??``,l=Li(t,s,Ur(t,c)),u=l??{...t,session:s},d=l&&await qr(l,c,`native-oauth`,s.user.id);if(l&&d){let n=JSON.parse(d),r=n.connection;if(r.provider!==i.id)return $(u,`link-expired`,{platform:i.id});if(!r.owner){let e=vm(l,`Only workspace owners and admins can authorize workspace connections`);if(e instanceof Response)return e}else if(r.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id});let c=await zf(l,i.id,n.app);return c?l.store.withAppLock(`connection:${r.id}`,async d=>{let f=await d.get(`connection`,r.id);if(!f||JSON.stringify(f)!==JSON.stringify(r))return $(u,`link-expired`,{platform:i.id});let p=await a.exchange(e,E(t.config,c.credentials),{publicUrl:o,access:f.access??`write`,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return p?.token?f.owner&&await t.auth.link(s.user,i.id,p.id,{organizations:s.organizations.map(e=>e.id),token:T(t.config,{app:c.id,token:p.token})},d)===`taken`?$(u,`account-taken`,{platform:i.id}):(await d.put(`connection`,f.id,{...f,account:f.owner?p.id:p.login??p.id,oauthApp:f.owner?c.id:void 0,secret:f.owner?void 0:T(t.config,{app:c.id,token:p.token}),broken:void 0,updatedAt:(t.now??Date.now)()}),n.attempt&&await qi({...l,store:d},f,n.attempt),$(u,`linked`,{platform:i.id,account:p.login??p.id})):$(u,`failed`,{platform:i.id})}):$(u,`link-expired`,{platform:i.id})}let f=l&&await qr(l,c,`link-oauth`,s.user.id),p=l&&f?await Ri(l,f):void 0;if(!l||!p||p.integration!==i.id)return $(u,`link-expired`,{platform:i.id});let m=await a.exchange(e,E(t.config,p.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return m instanceof _t?$(u,m.code,{platform:i.id,error:m.error}):m instanceof Error?(console.error(`coder server: ${i.id} sign-in failed`,m),$(u,`failed`,{platform:i.id})):await t.auth.link(s.user,i.id,m.id,{organizations:s.organizations.map(e=>e.id),...m.token?{token:T(t.config,{app:p.id,token:m.token})}:{}})===`taken`?$(u,`account-taken`,{platform:i.id}):(await If(l,s.user.id,i.id,m.id),$(u,`linked`,{platform:i.id,account:m.login??m.id}))}const Ui=`/connections/oauth/client.json`,Wi=`/connections/oauth/callback`,Gi=6e5,Ki=e=>`connection-oauth:${e}`;async function qi(e,t,n){await e.store.put(`delivery`,`connection-authorized:${Cr(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:Gi})}const U=S().check(t(1)),Ji=Ne({resource:U,authorization_servers:a(U).check(t(1)),scopes_supported:x(a(U))}),Yi=Ne({issuer:U,authorization_endpoint:U,token_endpoint:U,registration_endpoint:x(U),userinfo_endpoint:x(U),scopes_supported:x(a(U)),code_challenge_methods_supported:x(a(U)),client_id_metadata_document_supported:x(ve()),authorization_response_iss_parameter_supported:x(ve())}),Xi=se([`none`,`client_secret_basic`,`client_secret_post`]),Zi=Ne({client_id:U,client_secret:x(U),token_endpoint_auth_method:x(Xi),redirect_uris:x(a(U))}),Qi=Ne({name:x(U),preferred_username:x(U),email:x(U)});function $i(e,t){let n=Me(t);if(!f(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function ea(e,t,n,r=!1){for(let i of[...new Set(n)]){$i(e,i);let n=await ee(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function ta(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function na(e,t,n=!1,r){let i=$i(e,t),a=e.fetch??fetch;if(r===void 0){let e=await ee(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=ta(r),s=await ea(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=Ji.parse(s);if($i(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function ra(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return Me(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function ia(e){let t=ra(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+Wi],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function aa(e,t){return!t.config.publicUrl||Me(t.config.publicUrl).protocol!==`https:`?rn():C({client_id:Me(t.config.publicUrl).origin+Ui,...ia(t)})}function oa(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function sa(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function ca(e,t,n){let r=await e.get(`delivery`,Ki(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function la(e,t,n){let r=oa(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await na(e,t.endpoint.url),s=a.authorization_servers[0],c=$i(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=Yi.parse(await ea(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);$i(e,u.authorization_endpoint),$i(e,u.token_endpoint),u.registration_endpoint&&$i(e,u.registration_endpoint),u.userinfo_endpoint&&$i(e,u.userinfo_endpoint);let d=t.secret?E(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&Me(e.config.publicUrl).protocol===`https:`&&(f={clientId:Me(e.config.publicUrl).origin+Ui,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await ee(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(ia(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=Zi.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(ra(e)+Wi))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=T(e.config,p),h=Tr(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{sa(await n.get(`connection`,t.id),t),await n.put(`delivery`,Ki(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:Gi})});let g=Tr(32).toString(`base64url`),_=await Br(e,`connection-oauth`,r,T(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:ra(e)+Wi,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),Gi),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:ra(e)+Wi,state:_,code_challenge:Cr(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function ua(e,t,n){let r=t,i=e=>w(`${ph(dh(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,a=Ur(t,e);if(t.auth&&(!a||!t.session?.organizations.some(e=>e.id===a)))return i(`invalid-state`);let o=t.session?Li(t,t.session,a)??t:t;r=o;let s=await qr(o,e,`connection-oauth`,oa(o));if(!s)return i(`invalid-state`);let c=E(o.config,s);if(!c.owner&&!_m(o))return i(`failed`);let l=E(o.config,c.secret),u=n.searchParams.get(`iss`);if((c.requireIssuer||u!==null)&&u!==l.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let d=n.searchParams.get(`code`);if(!d)return i(`failed`);sa(await o.store.get(`connection`,c.id),c),await ca(o.store,c.id,c.attempt);let f=o.fetch??fetch,p=await y(f,l,new URLSearchParams({grant_type:`authorization_code`,code:d,redirect_uri:c.redirectUri,code_verifier:c.verifier})),m=p.preferred_username??p.email??p.name;if(!m&&c.userinfo)try{let e=await ee(f,c.userinfo,{headers:{authorization:`Bearer ${p.access_token}`,accept:`application/json`}});if(e.ok){let t=Qi.parse(await e.json());m=t.preferred_username??t.email??t.name}}catch(e){console.error(`coder server: OAuth userinfo failed`,e)}return await o.store.withAppLock(`connection:${c.id}`,async t=>{let n=await t.get(`connection`,c.id);sa(n,c),await ca(t,c.id,c.attempt),await t.put(`connection`,n.id,{...n,secret:T(o.config,pe(l,p,(o.now??Date.now)())),account:m??n.account,broken:void 0,updatedAt:(o.now??Date.now)()}),await t.delete(`delivery`,Ki(c.id)),await qi({...o,store:t},n,e)}),i(`connected`)}catch(e){return console.error(`coder server: connection OAuth callback failed`,e),i(`failed`)}}async function da(e,t,n){return(await Pf(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}function fa(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?Dr.homedir():e.startsWith(`~/`)?B.join(Dr.homedir(),e.slice(2)):e;if(!B.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=B.normalize(t);try{return V.statSync(n).isDirectory()?(V.accessSync(n,V.constants.R_OK),{ok:!0,folder:{path:n,name:B.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function pa(e){let t=new Map,n=[...s(e),...c(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=fa(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:B.basename(e)},recent:[...t.values()],picker:!!ha()}}const ma=e=>(process.env.PATH??``).split(B.delimiter).some(t=>t&&V.existsSync(B.join(t,e)));function ha(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(ma(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(ma(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,Dr.homedir(),`--title`,e]]}async function ga(){let e=ha();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await Ar(xr)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?fa(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function _a(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function va(e){let t=typeof e==`string`?e.trim():``,n=_a(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=xe(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>Ar(xr)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await Kt(r,async()=>{if(V.existsSync(B.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await V.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await V.promises.rename(e,r)}finally{await V.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
-`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const ya=e=>`app-token:${e}:`;async function ba(e,t){return(await e.store.list(`snapshot`,{prefix:ya(t)})).flatMap(({id:t,value:n})=>{if(!(`secret`in n))return[];let r=E(e.config,n.secret);return r.unusable?[]:[{id:t,token:r}]}).sort((e,t)=>t.token.lastUsedAt-e.token.lastUsedAt).map(({id:e,token:t})=>({id:e,label:`${t.workspaceName} · saved by ${t.savedBy}`}))}function xa(e,t){let n=()=>(e.now??Date.now)();return{async put(r){let i=ya(t)+vt(JSON.stringify([r.workspace,r.user]));return await e.store.withAppLock(`${e.organizationId}:${i}`,t=>t.put(`snapshot`,i,{secret:T(e.config,{...r,savedBy:e.session?.user.name||`Server operator`,lastUsedAt:n()})})),i},async use(r,i){if(!r.startsWith(ya(t)))throw new _t(`invalid-field`,`token`,`Choose a saved configuration token or paste a new one.`);let a=await e.store.withAppLock(`${e.organizationId}:${r}`,async t=>{let a=await t.get(`snapshot`,r),o=a&&E(e.config,a.secret);if(!o||o.unusable)return{error:new _t(`invalid-field`,`token`,`This configuration token is unavailable. Paste a new token.`)};let s=()=>t.put(`snapshot`,r,{secret:T(e.config,o)});try{let e=await i(o.credentials,async(e,t)=>{t&&(o.workspaceName=t),o.credentials=e,await s()},async()=>{o.unusable=!0,await s()});return o.lastUsedAt=n(),await s(),{value:e}}catch(e){return{error:e}}});if(`error`in a)throw a.error;return a.value}}}const Sa=`.coder/agents`,Ca=2592e6;function wa(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const Ta=(e,t,n)=>`repo-file:${e}@${t}@${n}:`;function Ea(e,t){let n=wa(t);return n?[Ta(e.id,n,t.repo?.defaultBranch??``)]:[]}const Da=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function Oa(e,t,n,r,i,a){let o=`${Ta(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([ka(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function ka(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=Da(n.installation,r,a??``),[f,p]=await Promise.all([n.token(),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:Ca}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:Ca}),_.text}async function Aa(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,Da(t.installation,t.repo,r),{push:Er()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:Ta(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:Ca})}}async function ja(e,t,n,r,i){let a=await Oa(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function Ma(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token();if(e)return{contents:t,token:e}}for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let a=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(a)try{let e=a.token?{...a,token:E(t.config,a.token)}:a;return{contents:i,token:await i.auth.token(e,E(t.config,r.credentials),{tools:i.tools.presets.read}),app:r,installation:a}}catch(e){console.error(`coder server: repository access for ${a.id} failed`,e);continue}}}function Na(e,t){let n=t.cwd,r=t.now??Date.now;async function i(t,n,r){let i=wa(n),a=e[n.integration],o=i&&a?.repos&&await r(n.integration);if(!(!i||!o))return ja(t,a,o,i,n.repo?.defaultBranch)}async function a(n,a,o,s){let c={store:s?.store??t.store,fileReads:t.fileReads},l=s??await Pn(t.store,n.agent);l.record?.source===`builtin`&&!t.settings?.builtinAgents&&(await Mn(t,r()),l=await Pn(t.store,n.agent));let{record:u,version:d}=l;if(!u)return;if(u.problems?.length)throw new ht(u.problems.join(`
-`));if(!d)throw Error(`No version ${u.currentVersion} for agent "${u.id}".`);let f=await i(c,a,o),p=f&&typeof f==`object`?f[n.agent]:void 0;if(p===!1||p?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${wa(a)??n.agentsRepo}.`);return En(u,d,p&&typeof p==`object`?p:void 0,e)}return async(i,o,s,c,l)=>{let u=n?(await pt(n,e)).find(e=>e.id===i.agent&&!e.builtin):void 0;if(u)return u;let d=await a(i,s,c,l);if(d)return d;if(i.agentsRepo){let n=await Ma(e,t,i.agentsRepo,s,c);if(n){await Pa(t.store,n.contents,i.agentsRepo,wa(s)===i.agentsRepo?s.repo?.defaultBranch??`HEAD`:`HEAD`,n.token,r());let e=await a(i,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await Bn(t.store,r(),i.agent,{})){let e=await a(i,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function Pa(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=await t.repos.tree(n,s,i,r),d=o.slugs??[...new Set(u.filter(e=>/^[^/]+\/agent\.json$/.test(e)).map(e=>e.split(`/`)[0]))];return mt(d),(await Promise.all(d.map(async o=>{let d=`${s}/${o}`,f=u.filter(e=>e.startsWith(`${o}/`)&&e.split(`/`).length<=22),p=Object.fromEntries(await Promise.all(f.map(async e=>[e.slice(o.length+1),await t.repos.readFile(n,`${s}/${e}`,i,r)]))),m=p[`agent.json`];if(m===void 0)return;let h;try{[h]=ft({definitions:{[o]:{json:JSON.parse(m),builtin:!1}},usage:void 0},{...xt,[t.id]:t})}catch(t){if(!(t instanceof ht||t instanceof SyntaxError))throw t;console.error(`coder server: could not load agent ${o}`,t);let r=await e.get(`agent`,o);await e.put(`agent`,o,{id:o,name:o,source:`repo`,repo:n,path:d,currentVersion:0,createdAt:a,...r,problems:[t.message],updatedAt:a});return}if(!h)return;let{"agent.json":g,"system.md":_,...v}=p;return Rn(e,{id:o,name:h.name,description:h.definition.description,source:`repo`,repo:n,path:d,definition:h.definition,systemPrompt:_??``,files:Object.fromEntries(Object.entries(v).filter(e=>e[1]!==void 0)),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a)}))).filter(e=>!!e)}const Fa=e=>`app-sync:${e}`,Ia=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,definition:r})??r,La=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&kr(e.manifest,n));async function Ra(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,Fa(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,definition:r.definition}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,Fa(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,E(e.config,n.credentials),{publicUrl:a,definition:r.definition,fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,Fa(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function za(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await kn(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return Ra(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=Ia(c,o,r,s.definition),d=Fa(t),f=await a.get(`delivery`,d);if(!n&&La(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,E(e.config,o.credentials),{publicUrl:r,definition:s.definition,fetch:e.fetch??fetch,tokens:xa({...e,store:a},o.integration),saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:T(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:T(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function Ba(e,t){let n=(await za(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
-`))}function Va(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function Ha(e,t,n,r=Va(),i){let a=await Ma(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await Pa(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await Ba(e,o),o}const Ua=`default`;async function Wa(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await import(`./client-C4QCT6cG.js`).then(e=>e.n);return t(e.databaseUrl,e.databasePool)}async function Ga(e,t={}){if(e.store!==`postgres`){let e=t.local?new In:new Nn;return{store:()=>e,queue:new kp(e),chatState:new Hn(t.local?B.join(h(``),`chat.json`):void 0),defaultOrganizationId:Ua,webhookTarget:async(t,n)=>{let r=await e.get(`app`,t),i=n?await e.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await e.list(`app`,{prefix:`${t}/`})){let i=await e.get(`installation`,`${r.id}${n.slice(t.length)}`);if(i&&!i.deletedAt)return{organizationId:Ua,app:r,bound:{organizationId:Ua,installation:i}}}return r&&{organizationId:Ua,app:r,...i&&i.app===t&&!i.deletedAt?{bound:{organizationId:Ua,installation:i}}:{}}},appRecord:async t=>{let n=await e.get(`app`,t);return n&&{organizationId:Ua,app:n}},apps:async t=>(await e.list(`app`,{prefix:`${t}:`})).map(e=>({organizationId:Ua,app:e.value})),installationOrganization:async t=>await e.get(`installation`,t)?Ua:void 0,installations:async t=>(await e.list(`installation`,{prefix:`${t}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:Ua})),taskOrganization:async(t,n)=>(await e.get(`task`,t))?.tokenHash===n?Ua:void 0,sweep:async()=>{},close:async()=>{}}}let n=await Wa(e),[{DrizzleStore:r},{DrizzleQueue:i},{UNSCOPED_ORGANIZATION:a},{PgChatState:o}]=await Promise.all([Promise.resolve().then(()=>$s),Promise.resolve().then(()=>ic),Promise.resolve().then(()=>ns),import(`./chat-CgQdDRhs.js`)]);return{store:t=>new r(n.db,t,Date.now,e),queue:new i(n.db),chatState:new o(n.db),defaultOrganizationId:a,webhookTarget:(e,t)=>r.webhookTarget(n.db,e,t),appRecord:e=>r.appRecord(n.db,e),apps:e=>r.apps(n.db,e),installationOrganization:e=>r.installationOrganization(n.db,e),installations:e=>r.installations(n.db,e),taskOrganization:(e,t)=>r.taskOrganization(n.db,e,t),connection:n,sweep:e=>new r(n.db,a).sweep(e),close:()=>n.close()}}async function Ka(e,t,n,r){return e.updateMetadata(t,n,r)}async function qa(e,t){return e.getApps([...new Set(t)])}async function Ja(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return C({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return C({error:`PUBLIC_URL is not set on this server`},400);let o=await Br(t,`install`,t.session?.user.id??`anonymous`,i.id),s=Zt({tx:o,...r?{back:r}:{}});return C({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function Ya(e,t){let n=e.serverOrganizationId,[r,i]=await Promise.all([e.store.list(`app`),n!==void 0&&n!==e.organizationId&&e.scope?e.scope(n).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)):[]]);return[...r,...i].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.builtin===`shared`)&&(!t||n.agent===t))}function Xa(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,E(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}async function Za(e,t){let n=e.config.publicUrl,r=t.filter(t=>!t.builtin&&!t.shared&&e.integrations[t.integration]?.app);if(!n||!r.length)return new Set;let[i,a]=await Promise.all([e.store.list(`delivery`,{ids:r.map(e=>Fa(e.id))}),e.store.listAgentsWithVersions([...new Set(r.map(e=>e.agent))])]),o=e=>i.find(t=>t.id===Fa(e))?.value;return new Set(r.filter(t=>{let r=e.integrations[t.integration].app,i=a.find(e=>e.record.id===t.agent)?.version;return i?.definition.integrations[t.integration]?r.update?!La(o(t.id),i.version,Ia(r,t,n,i.definition)):o(t.id)?.changed===!0:!1}).map(e=>e.id))}async function Qa(e,t,n,r){let i=await Ya(t,r.searchParams.get(`agent`)),a=await Za(t,i.map(({value:e})=>e));return C(i.map(({id:e,value:n})=>({id:e,value:{...Xa(t,n),...a.has(e)?{changed:!0}:{}}})))}async function $a(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return C({error:`Unknown app`},404);if(r.builtin)return C({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now();for(let{id:e,value:n}of await t.store.list(`installation`))n.app===r.id&&!n.deletedAt&&await Ka(t.store,`installation`,e,{deletedAt:i});return await t.store.delete(`app`,r.id),await Gu(t.store,r.id),C({ok:!0})}async function eo(e,t){let n=await e.store.get(`app`,t);if(!n)return C({error:`Unknown app`},404);if(n.builtin||n.shared)return C({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return C({error:`PUBLIC_URL is not set on this server`},400);let r=e.integrations[n.integration];if(!r||!(r.app.update||r.app.drift||r.app.values))return C({error:`Coder cannot update ${r?.name??n.integration} apps.`},400);let i=await kn(e.store,n.agent);return i?.definition.integrations[n.integration]?{app:n,version:i,integration:r}:C({error:`The agent no longer listens on ${r.name}.`},400)}async function to(e,t,n){let r=await eo(t,n.id);if(r instanceof Response)return r;if(r.integration.app.update)return C({error:`Coder updates ${r.integration.name} apps itself.`},400);try{return C(await Ra(t,t.store,r.app,r.version))}catch(e){return console.error(`coder server: reading ${r.app.id} on ${r.integration.name} failed`,e),C({error:e instanceof Error?e.message:String(e)},502)}}async function no(e,t,n){let r=await eo(t,n.id);if(r instanceof Response)return r;let{app:i,version:a,integration:o}=r;if(o.app.values){let{lines:e}=o.app.values(i,{publicUrl:t.config.publicUrl,definition:a.definition});return await t.store.put(`delivery`,Fa(i.id),{version:a.version,manifest:e,changed:!1}),C({updated:!0})}if(!o.app.update)return C({error:`Change the app on ${o.name}; Coder cannot.`},400);let[s]=await za(t,[a],i.id);return s?.error?C({error:s.error},502):C({updated:!0})}async function ro(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0,includeUninstalled:!0}:{},limit:en(r,200)});return C(a.map(({id:e,value:n})=>{let{token:r,...i}=n,a=n.account.url??t.integrations[n.integration]?.app.accountUrl?.(n.account);return{id:e,value:{...i,account:{...i.account,...a?{url:a}:{}}}}}))}async function io(e,t){let n=e.config.publicUrl,r=n?xm.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),o=e.store.list(`app`),[s,c,l]=await Promise.all([a?Pn(e.store,a):void 0,xh(e,o),o]),u=s?.record,d=new Set(c.map(e=>e.integration));return C(await Promise.all(Object.values(e.integrations).map(async n=>{let a=typeof n.use==`function`?n.use(gt(s?.version?.definition.integrations[n.id])):n.use;return{id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...a?{use:a}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.builtin,...n.auth.user?{personal:!0}:{},...await zf(e,n.id,void 0,[...c,...l.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{saved:await ba(e,n.id),name:u?.name,shared:d.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...n.app.update?{appUpdate:`push`}:n.app.drift?{appUpdate:`drift`}:n.app.values?{appUpdate:`confirm`}:{}}})))}async function ao(e,t,n=!1,r){let i=t;if(i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=oo(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function oo(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await qu(e,t,n,E(e.config,i.credentials)),o=await t.repos.list(Uu(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await Ka(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function so(e,t=!1){let n=new Map,r=(await e.store.list(`installation`,{active:!0})).filter(({value:t})=>e.integrations[t.integration]?.repos),i=Array(r.length),a=0;await Promise.all(Array.from({length:Math.min(4,r.length)},async()=>{for(let n=a++;n<r.length;n=a++){let a=r[n].value;i[n]=t||a.repos==null?await ao(e,a,t).catch(e=>(console.error(`coder server: repositories for installation ${a.id} failed`,e),a)):a}}));for(let e of i)if(!(!e||e.deletedAt))for(let t of e.repos??[])n.has(t)||n.set(t,{repo:t,integration:e.integration});return C([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}var W=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function co(e,t,n){if(n?.problems?.length)throw new W(n.problems.join(`
-`),409);if(n?.settings?.disabled)throw new W(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${ph(dh(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function lo(e,t){if(t.cwd===void 0)return;if(!e.local)throw new W(`cwd is available on a local server only`);let n=fa(t.cwd);if(!n.ok)throw new W(n.detail);return n.folder.path}const uo=/^[a-z0-9][a-z0-9_-]*$/i,fo=new Set([`claude`,`codex`,`custom`]),po=new Set([`low`,`medium`,`high`]);function mo(e){let t=e.flow??`default`;if(!uo.test(t))throw new W(`Invalid flow "${t}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new W(`prompt must be text`);if(t==="default"&&!e.prompt?.trim())throw new W(`prompt is required`);if((e.prompt?.length??0)>65536)throw new W(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new W(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new W(`pr needs a repo and a pull request number`);if(e.engine!==void 0&&!fo.has(e.engine))throw new W(`Unknown engine "${e.engine}"`);if(e.effort!==void 0&&!po.has(e.effort))throw new W(`Unknown effort "${e.effort}"`);if(e.permissions!==void 0&&!(e.permissions in nt))throw new W(`Unknown permissions "${e.permissions}"`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>uo.test(e))))throw new W(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new W(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new W(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new W(`args must be an object`)}async function ho(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await qa(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(a)try{let r=await qu(e,n,i,E(e.config,a.credentials)),o=i.repos?.includes(t)?i:await ao(e,i,!1,{app:a,token:r,repo:t});if(!o?.repos?.includes(t))continue;return{integration:n,installation:o,app:a,token:r}}catch(e){console.error(`coder server: repository token for ${i.id} failed`,e)}}throw new W(`No install in this workspace reaches ${t}`,404)}async function go(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await ho(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:l},author:a.author?.(s.name)??s.name}}async function _o(e,t,n){mo(n);let r=lo(e,n),i=(e.now??Date.now)(),a=e.session?.user.id,o=n.agent||st();if(!o)throw new W(`Name an agent: this server has no default agent.`);o===st()&&await Mn(e,i),e.local&&await An(e.store,e.local.cwd,e.integrations);let{record:s,version:c}=await Pn(e.store,o),l=await bn(e,{requester:a,runner:n.runner,agent:c?.definition.runner}).catch(e=>{throw new W(e.message)});if(!s||!c)throw new W(`No agent "${o}"`,404);co(e,o,s);let u={...n.engine?{engine:n.engine}:{},...n.model?{model:n.model}:{},...n.effort?{effort:n.effort}:{},...n.permissions?{permissions:n.permissions}:{}},d=En(s,c,u,e.integrations),f=ct(d),{engine:p,credential:m,usable:h,chain:_,credentials:v}=await af(e,f,a);if(!h&&l.runner!==`http`)throw new W(`No ${p} credential is connected`,409,await _f(e,p));let y=`${i.toString(36)}-${Tr(4).toString(`hex`)}`,ee=n.repo?await go(e,y,n,a):void 0,te={id:y,source:t,agent:d.id,flow:n.flow??`default`,...l,permissions:f.permissions,...ee?{event:ee.event,author:ee.author}:{},...r&&!ee?{cwd:r}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},definition:d.definition,engineChain:_,engineCredentials:v,...m?{credential:m}:{},...a?{requester:a}:{},...d.files?{files:d.files}:{},usage:{...d.usage,engine:p},tools:{},connections:await da(e,a,g(d.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&l.runner===`local`&&!l.runnerId?Td(e,te):(await e.queue.enqueue(e.organizationId,te,i,void 0,e.config.maxQueued??1e3),{task:te,status:`queued`,attempts:0,createdAt:i,updatedAt:i})}function vo(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function yo(e,t){let n=t.event,r;if(n){let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i||!a||a.deletedAt||!e.loadAgent)return{};co(e,t.agent,await e.store.get(`agent`,t.agent));let o=e.integrations[n.integration],s=E(e.config,i.credentials);r=await e.loadAgent(i,a,n,Xu(e,o,a,n,s))}else{t.agent===st()&&await Mn(e,(e.now??Date.now)());let{record:n,version:i}=await Pn(e.store,t.agent);if(co(e,t.agent,n),!n||!i)return{};r=En(n,i,t.usage,e.integrations)}let i=n&&Yt(n,r),{engine:a,model:o,effort:s}=t.usage??{};return{definition:r.definition,usage:{...r.usage,...a?{engine:a}:{},...o?{model:o}:{},...s?{effort:s}:{}},tools:i?.tools??Xt(r),...r.files?{files:r.files}:{},permissions:i?.permissions??ct(r).permissions}}async function bo(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new W(`outputSchema must be an object`);if(!n.trim())throw new W(`text is required`);if(n.length>65536)throw new W(`text is longer than 64 KB`);let{model:a,effort:o,permissions:s}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new W(`model must be text`);if(o!==void 0&&!po.has(o))throw new W(`Unknown effort "${o}"`);if(s!==void 0&&!(s in nt))throw new W(`Unknown permissions "${s}"`);let c=e=>Object.keys(nt).indexOf(e??`auto`);if(s!==void 0&&c(s)>c(t.task.permissions))throw new W(`permissions can only be lowered on a resumed task (it runs ${t.task.permissions??`auto`})`);if(e.session&&t.task.requester&&t.task.requester!==e.session.user.id)throw new W(`Only the member who asked can continue this task`,403);let l=(e.now??Date.now)(),u=t.task.context?.messages??[],d=String(t.finishedAt??l),f=[...u,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:d}].slice(-20),p=t.task.context??{},m=vo(t);m.at(-1).finishedAt??=l;let h=await yo(e,t.task),g={task:{...t.task,...h,prompt:n,...a||o?{usage:{...h.usage??t.task.usage,...a?{model:a}:{},...o?{effort:o}:{}}}:{},...s?{permissions:s}:{},context:{...p,...r?{outputSchema:r}:{},messages:f,turns:m}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:l};if(!await e.queue.continueTask(e.organizationId,t.task.id,g.task,l,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new W(`Task is already active`,409);return g}const xo={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var So=class{buckets=new Map;sweptAt;startedAt;requests=0;rejections=0;constructor(e=Date.now()){this.startedAt=this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return C({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const Co=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function wo(e,t,n){let r=new URL(e.url).pathname,i=Co.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?To(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await Am(e,t):void 0;return To(t,r===`/runners/register`?await Mm(e,t):a&&!(a instanceof Response)?a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function To(e,t,n,r){let i=e.limits??=new So((e.now??Date.now)()),a={...xo,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}const Eo=Symbol(`miss`);function Do(e,t){return new Proxy(e,{get(e,n){let r=Reflect.get(e,n,e);if(typeof r!=`function`)return r;let i=r.bind(e),a=t[n];return a?async(...e)=>{let t=a(...e);return t===Eo?i(...e):t}:i}})}const Oo=(e,t)=>e.length===t.length&&e.every((e,n)=>e===t[n]);function ko(e,t,n){let r=t.task,i=r.event,a=e=>e in n,o=`connections:${r.id}:${t.generation??0}:${t.attempts}:`;return Do(e,{get:(e,t)=>e===`app`&&a(`app`)&&t===i?.appId?n.app:e===`installation`&&a(`installation`)&&t===`${i?.appId}:${i?.installationId}`?n.installation:e===`credential`&&a(`credential`)&&t===r.credential?n.credential:e===`config`&&a(`config`)&&t===`workspace`?n.config:e===`runner`&&a(`runner`)&&t===r.runnerId?n.runner:e===`snapshot`&&a(`secrets`)&&t===`connection-secrets:${r.id}`?n.secrets?.old:e===`snapshot`&&a(`resolved`)&&t.startsWith(o)?n.resolved?.id===t?n.resolved.value:void 0:Eo,list:(e,t)=>e===`snapshot`&&a(`secrets`)&&t?.prefix===`connection-secrets:${r.id}:`?n.secrets.rows.map((e,n)=>({id:`${t.prefix}${n}`,value:{secret:e}})):Eo,listCredentials:e=>a(`credentials`)&&e.owner===r.requester&&e.limit===void 0?n.credentials??[]:Eo,heldTokens:(e,t)=>a(`tokens`)&&n.installation&&Oo(e,[n.installation.id])&&Oo(t,[n.installation.app])?n.tokens:Eo})}function Ao(e,t,n){let r=e=>e===void 0||e===t.requester,i=(e,t)=>!e.owner||e.owner===t;return Do(e,{get:(e,r)=>e===`agent`&&r===n.agent?t.record:e===`snapshot`&&n.files.some(e=>r.startsWith(e))?t.files[r]:Eo,conversationState:e=>e===n.conversation?t.conversation:Eo,listCredentials:e=>r(e.owner)&&e.limit===void 0?t.credentials.filter(t=>i(t.value,e.owner)):Eo,list:(e,n)=>e===`runner`&&n?.defaults&&!n.runner&&r(n.visibleTo)?t.runners.filter(e=>i(e.value,n.visibleTo)):e===`connection`&&!n?.ids&&!n?.secrets&&r(n?.visibleTo)?t.connections.filter(e=>i(e,n?.visibleTo)).map(e=>({id:e.id,value:e})):Eo,heldTokens:(e,r)=>Oo(e,[n.installation.id])&&Oo(r,[n.installation.app])?t.tokens:Eo})}function jo(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function Mo(e,t,n,r){try{await jo(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function No(e,t,n,r={}){let i=t.handle?await mn(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});return a&&await Io(e,t,!0,i),a}async function Po(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`))return yd(e,t,n);let r=t.handle?await mn(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});return i&&await Io(e,t,!0,r),i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?No(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return No(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await jo(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?No(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):No(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function Fo(e,t){return[`running`,`waiting`].includes(t.status)&&await Po(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function Io(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await mn(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await Mo(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function Lo(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await Fo(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function Ro(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??xo.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await hd(e,e.local.cwd):t&&await e.queue.archiveStopped(void 0,r());let n=await e.queue.running(),i=0;for(let t of n)await Po(H(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?md(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],s=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,c=t.filter(t=>!s.has(t.task.id)&&!s.has(b(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,l=a===void 0?void 0:a-c;if(l!==void 0&&l<=0)break;let u=await e.queue.claim(r(),l,n,i);if(n=!1,!u)break;let d=u.status,f=H(e,u.organizationId),p=u.loaded&&f.store?{...f,store:ko(f.store,d,u.loaded)}:f;if(await vd(p,d,u.token)){if(n=u.more,!u.more)break;continue}let m=await mn(p,d.task);if(!m){await No(p,d,`No runner available: ${d.task.runner}`);continue}let h=d,g={generation:d.generation??0,attempts:d.attempts,tokenHash:d.tokenHash??null,statuses:[`running`,`waiting`]},_;try{let e=m.kind===`vercel-sandbox`?await nd(p,d.task):void 0,t=e?[e,...(await rd(p,d.task)).map(e=>e.credential)]:[],i=await Promise.all(t.map(e=>od(p,d.task,e))),a=m.start(d.task,{CODER_SERVER:p.local&&m.kind===`local`?`http://localhost:${p.local.port}`:p.config.publicUrl??``,CODER_TASK_TOKEN:u.token,CODER_INBOX_MODE:m.push?`push`:`poll`},e?Object.assign({},...t.map(e=>e.env).reverse()):void 0,{timeoutMs:p.config.taskTimeoutMs+6e4,waitUntil:p.waitUntil,...e?{hosts:i.some(e=>e===void 0)?void 0:[...new Set(i.flatMap(e=>e??[]))],brokered:await ku(p.store).then(e=>t.flatMap(t=>ad(e,d.task,t)))}:{}});if(_=await jo(a,p.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw a.then(e=>Mo(p,m,e,d.task.id),()=>{}),e}),await p.queue.patchTask(u.organizationId,d.task.id,{handle:_},r(),g)||await Mo(p,m,_,d.task.id),n=u.more,!u.more)break}catch(e){_!==void 0&&await Mo(p,m,_,d.task.id);let t=e instanceof Error?e.message:String(e);if(d.attempts<(p.config.taskAttempts??2)){o.push({...u,status:h});continue}await No(p,h,t)}}for(let t of o)await H(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function zo(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,Ro(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function Bo(e,t=!1){let n=zo(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}var Vo=r({addUsage:()=>Wo,leaders:()=>qo,readUsage:()=>es,readUsageTotals:()=>ts,sumUsageTotals:()=>Ko,timeZone:()=>Uo,usageReport:()=>$o,usageSummary:()=>Xo,usageTotals:()=>Go});function Ho(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+Ho(t),0)}function Uo(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const Wo=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function Go(e,t){return e.usageTotals(t)}async function Ko(e,t){if(t.top){let{top:n,...r}=t,i=(await Go(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return Go(e,{...r,parts:i})}let n=Uo(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:Ho(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};Wo(s,o),i.has(n.agent)&&(s.parts??={},Wo(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function qo(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function Jo(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=Jo(n[e],r);return n}function Yo(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=Jo(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Xo(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?Yo(r,n):{agent:Yo(r,`agent`),installation:Yo(r,`installation`),engine:Yo(r,`engine`)}}}const Zo={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},Qo={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function $o(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return C({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=Zo[n(`sort`)??`tokens`]??`tokenCount`,l=await Go(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Uo(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await pt(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(ut()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return C({...u,totals:l,top:qo(l,c)});if(!tn(t)||a!==`agent`)return C({...u,totals:l});let d=Qo[n(`sort`)??`tokens`]??Qo.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=on(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=en(t),y=e=>l.reduce((t,n)=>t+e(n),0);return C({...u,...cn(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function es(e,t,n,r){t.local&&await Pd(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:en(r,200),...i?{installation:i}:{}});return C(i?a.filter(e=>e.value.installationId===i):a)}async function ts(e,t,n,r){t.local&&await Pd(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);return[`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`?$o(t,r):!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a)?C({error:`Invalid usage query`},400):C({since:i,totals:await t.store.usageSummary(i,a)})}var ns=r({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>_s,agentValue:()=>us,app:()=>G,date:()=>J,defined:()=>ss,escapeLike:()=>os,fromJson:()=>Y,install:()=>K,ms:()=>q,opaque:()=>gs,readTaskContext:()=>is,rows:()=>bs,setSecret:()=>vs,splitKey:()=>as,stateKey:()=>X,statePrefix:()=>ys,storedTaskContext:()=>rs,taskRecord:()=>ms,versionColumns:()=>fs,versionSummary:()=>ps,versionValue:()=>ds});function rs(e){return e.connections===void 0&&!e.engineChain&&!e.engineCredentials?e.context:{...e.context,connections:e.connections,engineChain:e.engineChain,engineCredentials:e.engineCredentials}}function is(e){let{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,...a}=e??{};return{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,context:Object.keys(a).length?a:void 0}}function as(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const G=nr,K=rr,q=e=>e.getTime(),J=e=>new Date(e),os=e=>e.replace(/[\\%_]/g,`\\$&`),ss=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),cs=e=>e?q(e):void 0,ls=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},us=e=>ss({id:e.slug,name:e.name,description:e.description,problems:e.problems,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:q(e.createdAt),updatedAt:q(e.updatedAt)}),ds=(e,t)=>ss({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:ls(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:q(e.createdAt)}),fs={id:A.id,agentId:A.agentId,version:A.version,definition:A.definition,commit:A.commit,importedFrom:A.importedFrom,createdAt:A.createdAt},ps=(e,t)=>{let{systemPrompt:n,files:r,...i}=ds({...e,systemPrompt:``,files:null},t);return i};function Y(e,t){let n=new or(Wn);return Object.fromEntries(Object.entries(Kn(e)).map(([e,r])=>{let i=t[n.getColumnCasing(r)];return[e,i==null?null:r.mapFromDriverValue(i)]}))}function ms(e){let t=is(e.context);return ss({task:ss({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,connections:t.connections,author:e.author,definition:e.definition,credential:e.credential,engineChain:t.engineChain,engineCredentials:t.engineCredentials,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,context:t.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:cs(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,...(t.runnerLogs?.handle??null)===e.handle&&t.runnerLogs?.attempts===e.attempts&&t.runnerLogs?.generation===e.generation?{logsComplete:t.runnerLogs?.complete}:{},archivedAt:cs(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:q(e.createdAt),startedAt:cs(e.startedAt),finishedAt:cs(e.finishedAt),cancelRequestedAt:cs(e.cancelRequestedAt),updatedAt:q(e.updatedAt)})}function hs(e,t){if(t.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:t.slice(6),keyVersion:0};let[n,r,i]=t.split(`.`);if(!n||!r||!i)throw Error(`Invalid encrypted secret`);return{iv:n,tag:r,ciphertext:i,keyVersion:dn(e.encryption,t)}}function gs(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function _s(e,t,n){let[r]=await e.db.insert(I).values({organizationId:e.organizationId,kind:t,...hs(e,n)}).returning({id:I.id});return r.id}async function vs(e,t,n){await e.db.update(I).set({...hs(e,n),updatedAt:e.at()}).where(F(e.mine(I.organizationId),P(I.id,t)))}const ys=(e,t)=>`o:${JSON.stringify([e,t])}:`,X=(e,t,n)=>ys(e,t)+n;async function bs(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}function xs(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(k).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:J(t.createdAt),updatedAt:J(t.updatedAt)}).onConflictDoUpdate({target:[k.organizationId,k.slug],set:{slug:t.id}}).returning(),a=us(i),[o]=a.currentVersion?await r.select().from(A).where(F(P(A.agentId,i.id),P(A.version,a.currentVersion))):[],s=o&&ds(o,t.id),c=!!(s&&kr(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&kr(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&kr(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let d=c?O``:O`with published as (
-      insert into ${A} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
-      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
-        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${J(l.createdAt).toISOString()}::timestamptz)
-      returning version
-    )`;return await r.execute(O`${d} update ${k} set
-      name = ${u.name}, description = ${u.description??null}, problems = null, source = ${u.source},
-      repo = ${u.repo??null}, path = ${u.path??null},
-      current_version = ${c?O`${l.version}`:O`(select version from published)`}, updated_at = ${J(u.updatedAt).toISOString()}::timestamptz
-      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function Ss(e){let t=k;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(F(e.mine(t.organizationId),n)).orderBy(N(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:us(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,problems:r.problems??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:J(r.createdAt),updatedAt:J(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.slug,n)))}}}async function Cs(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(A).values({agentId:O`(select id from ${k} where organization_id = ${e.organizationId} and slug = ${t.slice(0,r)})`,version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:J(n.createdAt)}).onConflictDoNothing().returning({id:A.id})).length>0}function ws(e){let t=A,n=O`${k.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>F(P(k.slug,e),n===void 0?void 0:r?P(t.version,n):tr(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:k.slug,key:n}).from(t).innerJoin(k,P(k.id,t.agentId)).where(F(e.mine(k.organizationId),r)).orderBy(N(k.slug),N(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:ds(e,t)}))},put:async(t,n)=>{await Cs(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=O`(select id from ${k} where organization_id = ${e.organizationId} and slug = ${n.slice(0,r)})`;await e.db.delete(t).where(F(P(t.agentId,i),P(t.version,Number(n.slice(r+1)))))}}}const Ts=(e,t)=>ss({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:gs(t),createdAt:q(e.createdAt)});function Es(e){let t=G;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.credentialsSecretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:Ts(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:I}).from(t).innerJoin(I,P(I.id,t.credentialsSecretId)).where(F(e.mine(t.organizationId),P(t.key,n))),[a]=r.shared?await e.db.select({secretId:t.credentialsSecretId}).from(t).where(F(P(t.organizationId,``),P(t.key,r.shared))):[];if(r.shared&&!a)throw Error(`No shared app ${r.shared}`);let o=i?.secretId??a?.secretId??await _s(e,`app`,r.credentials);i&&!r.shared&&gs(i.sealed)!==r.credentials&&await vs(e,o,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:o,createdAt:J(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(I).where(F(P(I.id,r.secretId),e.mine(I.organizationId)))})}}function Ds(e,t,n){return ss({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?gs(n):void 0,installer:e.installer,self:e.self,covers:e.covers,repos:e.repos,settings:e.settings,createdAt:q(e.createdAt),deletedAt:e.deletedAt?q(e.deletedAt):void 0,uninstalled:e.uninstalled||void 0})}function Os(e,t,n){let r=n.app.split(`/`)[0],i=[t.slice(n.app.length+1),...n.covers??[]],a=O`array[${O.join(i.map(e=>O`${e}`),O`, `)}]::text[]`;return e.transaction(`binding:${r}`,async e=>{let[n]=await e.db.select({id:K.id}).from(K).innerJoin(G,P(G.id,K.appId)).where(F(Jn(z(K.platformInstallId,i),O`${K.covers} ?| ${a}`),j(K.deletedAt),dr(K.key,t),Jn(P(G.key,r),O`left(${G.key}, ${r.length+1}) = ${`${r}/`}`))).limit(1);if(n)throw new On(`Installation "${t}" is bound through another app.`)})}function ks(e){let t=K;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:G.key,integration:G.integration},sealed:I}).from(t).innerJoin(G,P(G.id,t.appId)).leftJoin(I,P(I.id,t.tokenSecretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:Ds(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({row:t,sealed:I,appKey:G.key,parent:O`(select id from ${G} where organization_id in (${e.organizationId}, ${``}) and key = ${r.app} order by organization_id desc limit 1)`}).from(O`(select 1) as anchor`).leftJoin(t,P(t.key,n)).leftJoin(G,P(G.id,t.appId)).leftJoin(I,P(I.id,t.tokenSecretId)),a=i?.row?{secretId:i.row.tokenSecretId,organizationId:i.row.organizationId,covers:i.row.covers,deletedAt:i.row.deletedAt,appKey:i.appKey,sealed:i.sealed}:void 0,o=()=>Error(`Installation "${n}" belongs to another workspace.`);if(a&&a.organizationId!==e.organizationId)throw o();if(!i?.parent)throw Error(`Unknown app "${r.app}".`);r.deletedAt===void 0&&(!a||a.appKey!==r.app||a.deletedAt!==null||JSON.stringify(a.covers??[])!==JSON.stringify(r.covers??[]))&&await Os(e,n,r);let s=a?.secretId??null;r.token&&(s?(!a?.sealed||gs(a.sealed)!==r.token)&&await vs(e,s,r.token):s=await _s(e,`installation`,r.token));let c={appId:i.parent,platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?s:null,installer:r.installer??null,self:r.self??null,covers:r.covers??null,repos:r.repos??null,settings:r.settings??null,createdAt:J(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:J(r.deletedAt),uninstalled:r.uninstalled??null},[l]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...c}).onConflictDoUpdate({target:t.key,set:c,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!l)throw o();!r.token&&a?.secretId&&await e.db.delete(I).where(P(I.id,a.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(I).where(P(I.id,r.secretId))})}}async function As(e,t){let n=Xn(K,`locked`),[r]=await e.db.select({row:n,app:{key:G.key,integration:G.integration},sealed:I}).from(n).innerJoin(G,P(G.id,n.appId)).leftJoin(I,P(I.id,n.tokenSecretId)).where(F(e.mine(n.organizationId),P(n.key,t))).for(`update`,{of:n});return r&&Ds(r.row,r.app,r.sealed)}const js=(e,t)=>ss({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,owner:e.owner,account:e.account,createdAt:q(e.createdAt)}),Ms=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function Ns(e,t){let n=Qn;return(await e.db.select({row:n,sealed:I}).from(n).innerJoin(I,P(I.id,n.secretId)).where(F(e.mine(n.organizationId),t?P(n.owner,t):j(n.owner))).orderBy(N(n.label)).for(`update`)).map(({row:e,sealed:t})=>({id:Yd(e.owner??void 0,e.label),value:js(e,t),row:e,sealed:t}))}async function Ps(e,t,n,r){let i=Qn;if(!r){if(!t)return;await e.db.delete(i).where(P(i.id,t.row.id)),await e.db.delete(I).where(P(I.id,t.row.secretId));return}let a=gs(r),o={account:r.account??null,createdAt:r.createdAt===void 0?t?.row.createdAt??e.at():J(r.createdAt),updatedAt:e.at()};if(t){gs(t.sealed)!==a&&await vs(e,t.row.secretId,a),await e.db.update(i).set(o).where(P(i.id,t.row.id));return}let{owner:s,name:c}=Xd(n);await e.db.insert(i).values({organizationId:e.organizationId,owner:s??null,label:c,secretId:await _s(e,`engine`,a),...o})}function Fs(e){let t=Qn,n=(t,n)=>{let{owner:r}=Xd(t);return e.transaction(Ms(e,r),async e=>Ps(e,(await Ns(e,r)).find(e=>e.id===t),t,n))};return{key:O`coalesce(${t.owner} || '/', '') || ${t.label}`,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(O`coalesce(${t.owner} || '/', '') || ${t.label}`));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:Yd(e.owner??void 0,e.label),value:js(e,t)}))},put:(e,t)=>n(e,t),delete:e=>n(e,null)}}const Is=(e,t)=>O`jsonb_build_object('row', to_jsonb(${e}), 'sealed', to_jsonb(${t}))`,Ls=e=>{let t=Y(Qn,e.row);return{id:Yd(t.owner??void 0,t.label),value:js(t,Y(I,e.sealed))}},Rs=e=>{let t=Y(ar,e.row);return{id:t.publicId,value:Ws(t,Y(I,e.sealed))}},zs=e=>{let t=Y(G,e.app);return{installation:Ds(Y(K,e.row),t,e.sealed?Y(I,e.sealed):null),app:Ts(t,Y(I,e.credentials))}};function Bs(e,t,n,r){let i=M,a=t.map(t=>`${os(X(e,`snapshot`,zn(t)))}%`),o=[...t,...n].map(t=>X(e,`snapshot`,Tn(t)));return O`(select coalesce(jsonb_object_agg(${i.key}, ${i.value}), '{}'::jsonb) from ${i}
-    where (${i.expiresAt} is null or ${i.expiresAt} > clock_timestamp()) and (${i.key} like any(${O.param(a)}::text[])
-      or ${i.key} in (select unnest(${O.param(o)}::text[])${r?O` union all ${r}`:O``})))`}function Vs(e,t){let n=ys(e,`snapshot`),r={held:new Map,drops:new Map};for(let[e,i]of Object.entries(t)){let t=e.slice(n.length);t.startsWith(`token-drop:`)?r.drops.set(t,i.drop):r.held.set(t,i)}return r}function Hs(e){let t=O`coalesce((${M.value}->>'version')::bigint, jsonb_array_length(${M.value}->'messages') + (${M.value}->>'more')::bigint)`,n=O`greatest(coalesce((${M.value}->>'acknowledged')::bigint, 0), least(${e}, ${t}))`;return O`(select ${M.value} || jsonb_build_object('version', ${t}, 'acknowledged', ${n},
-        'messages', remaining, 'more', ${t} - ${n} - jsonb_array_length(remaining))
-        from (select coalesce(jsonb_agg(item order by n) filter (where coalesce((item->>'sequence')::bigint, n) > ${n}), '[]'::jsonb) as remaining
-          from jsonb_array_elements(${M.value}->'messages') with ordinality e(item,n)) as pending)`}function Us(e,t){let n=M,r=ys(e.organizationId,t),i=n.key;return{key:i,where:e=>F(e.id===void 0?O`${n.key} like ${`${os(r+(e.prefix??``))}%`}`:P(n.key,r+e.id),e.after===void 0?void 0:tr(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:O`${n.value}`}).from(n).where(F(O`${n.key} like ${`${os(r)}%`}`,e.live(n.expiresAt),t)).orderBy(N(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o,c=e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?O`${n.expiresAt}`:s}}),l=t===`delivery`&&i.startsWith(`connection-authorized:`)?e.notification(t,i):void 0;await(l?c.returning(l):c)},delete:async i=>{await e.db.delete(n).where(P(n.key,r+(t===`config`?`workspace`:i)))}}}const Ws=(e,t)=>ss({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?q(e.lastSeen):void 0,secret:gs(t),createdAt:q(e.createdAt),updatedAt:q(e.updatedAt)});function Gs(e){let t=ar,n=n=>F(e.mine(t.organizationId),P(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:Ws(e,t)}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[a]=await e.db.select({id:t.id,secretId:t.secretId,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(n(r)),o={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:J(i.lastSeen),updatedAt:J(i.updatedAt)};if(a){gs(a.sealed)!==i.secret&&await vs(e,a.secretId,i.secret),await e.db.update(t).set(o).where(P(t.id,a.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await _s(e,`runner`,i.secret),createdAt:J(i.createdAt),...o})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(I).where(P(I.id,i.secretId))})}}function Ks(e,t){let n=X(e,`snapshot`,`connection-secrets:${t}`),r=t=>O`${M.key} like ${`${os(X(e,`snapshot`,t))}%`}`;return O`(${M.key} = ${n} or ${r(`connection-secrets:${t}:`)} or ${r(`connections:${t}:`)})`}function qs(e){let t=L;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(F(e.mine(t.organizationId),n)).orderBy(N(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:ms(e)}))},put:async(n,r,i,a={})=>{let{task:o}=r,s={source:o.source,status:r.status,agent:o.agent,flow:o.flow,reviewKey:Sp(o)??null,runner:o.runner,permissions:o.permissions??null,appId:o.event?O`(select id from ${G} where organization_id in (${e.organizationId}, ${``}) and key = ${o.event.appId} order by organization_id desc limit 1)`:null,installationId:o.event?O`(select id from ${K} where organization_id = ${e.organizationId} and key = ${`${o.event.appId}:${o.event.installationId}`})`:null,event:o.event??null,prompt:o.prompt??null,args:o.args??null,mcp:o.mcp??null,author:o.author??null,definition:o.definition,credential:o.credential??null,requester:o.requester??null,runnerId:o.runnerId??null,usage:o.usage??null,tools:o.tools,context:r.logsComplete===void 0?rs(o)??null:{...rs(o),runnerLogs:{complete:r.logsComplete,handle:r.handle,attempts:r.attempts,generation:r.generation??0}},files:o.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:J(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:J(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:J(r.createdAt),startedAt:r.startedAt===void 0?null:J(r.startedAt),finishedAt:r.finishedAt===void 0?null:J(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:J(r.cancelRequestedAt),updatedAt:J(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...s,archivedAt:a.unarchive?s.archivedAt:O`coalesce(${t.archivedAt}, ${s.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.publicId,n)))}}}async function Js(e,t){return(await e.db.select({engine:sr.engine,conversation:sr.conversation,savedAt:sr.savedAt}).from(sr).innerJoin(L,P(L.id,sr.taskId)).where(F(e.mine(sr.organizationId),e.mine(L.organizationId),P(L.publicId,t))).orderBy(N(sr.savedAt))).map(e=>({...e,savedAt:q(e.savedAt)}))}function Ys(e){let t=sr,n=O`${L.publicId} || ':' || ${t.conversation}`,r=e=>[e.slice(0,e.indexOf(`:`)),e.slice(e.indexOf(`:`)+1)];return{key:n,where:({id:n,prefix:i})=>{let[a,o]=r(n??i??``);return F(e.mine(L.organizationId),P(L.publicId,a),n===void 0?void 0:P(t.conversation,o))},rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,P(L.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(N(t.savedAt));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:ss({engine:e.engine,conversation:e.conversation,data:e.data,state:e.state,savedAt:q(e.savedAt)})}))},put:async(n,i)=>{let a={engine:i.engine,data:i.data,state:i.state??null,savedAt:J(i.savedAt)};await e.db.insert(t).values({organizationId:e.organizationId,taskId:O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${r(n)[0]})`,conversation:i.conversation,...a}).onConflictDoUpdate({target:[t.taskId,t.conversation],set:a})},delete:async n=>{let[i,a]=r(n),o=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${i})`;await e.db.delete(t).where(F(P(t.taskId,o),P(t.conversation,a)))}}}function Xs(e){let t=cr,n=O`${L.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>F(e.mine(L.organizationId),P(L.publicId,n),r===void 0?void 0:i?P(t.seq,r):tr(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,P(L.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(N(L.publicId),N(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:q(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:J(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(F(P(t.taskId,i),P(t.seq,Number(n.slice(r+1)))))}}}function Zs(e){let t=R,n=O`${L.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>F(e.mine(L.organizationId),P(L.publicId,n),r===void 0?void 0:i?P(t.seq,r):tr(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,P(L.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(N(L.publicId),N(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:q(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:J(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(F(P(t.taskId,i),P(t.seq,Number(n.slice(r+1)))))}}}function Qs(e){let t=ur;return{key:L.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:L.publicId,installationId:K.key}).from(t).innerJoin(L,P(L.id,t.taskId)).leftJoin(K,P(K.id,t.installationId)).where(F(e.mine(t.organizationId),n)).orderBy(N(L.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:ss({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:q(e.at)})}))},put:async(n,r)=>{let i=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n})`,a={installationId:r.installationId?O`(select id from ${K} where organization_id = ${e.organizationId} and key = ${r.installationId})`:null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:J(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n})`;await e.db.delete(t).where(P(t.taskId,r))}}}var $s=r({DrizzleStore:()=>ec}),ec=class e{db;organizationId;now;encryption;inTransaction;notifications;recordChannel(e,t){return`record_${Cr(`sha256`).update(JSON.stringify([this.organizationId,e,t])).digest(`hex`).slice(0,48)}`}notification(e,t){return this.notifications?{notified:O`pg_notify(${this.recordChannel(e,t)}, '')`}:void 0}async watch(e,t){let n=Pe(),r=this.db.$client,i=r?.listen?await r.listen(this.recordChannel(e,t),n.notify,n.notify).catch(()=>void 0):void 0;return{...n,close(){i?.unlisten().catch(()=>{}),n.close()}}}publishAgent=(e,t)=>xs(this,e,t);kinds;constructor(e,t,n=Date.now,r={},i=!1,a=!!e.$client?.unsafe){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.inTransaction=i,this.notifications=a,this.kinds={agent:Ss(this),agentversion:ws(this),app:Es(this),installation:ks(this),credential:Fs(this),task:qs(this),history:Ys(this),tasklog:Xs(this),inbox:Zs(this),usage:Qs(this),delivery:Us(this,`delivery`),login:Us(this,`login`),config:Us(this,`config`),runner:Gs(this),snapshot:Us(this,`snapshot`),connection:Us(this,`connection`)}}static async webhookTarget(e,t,n){let r=Xn(I,`installation_secret`),[i]=await D(e,()=>e.select({app:G,credentials:I,installation:K,token:r}).from(G).innerJoin(I,P(I.id,G.credentialsSecretId)).leftJoin(K,F(P(K.appId,G.id),P(K.key,n??``),j(K.deletedAt))).leftJoin(r,P(r.id,K.tokenSecretId)).where(F(P(G.integration,t.slice(0,t.indexOf(`:`))),P(G.platformAppId,t.slice(t.indexOf(`:`)+1)))));if(i&&!i.installation&&n){let a=`${i.app.platformAppId}/`,[o]=await D(e,()=>e.select({app:G,credentials:I,installation:K,token:r}).from(K).innerJoin(G,P(G.id,K.appId)).innerJoin(I,P(I.id,G.credentialsSecretId)).leftJoin(r,P(r.id,K.tokenSecretId)).where(F(P(G.integration,i.app.integration),O`left(${G.platformAppId}, ${a.length}) = ${a}`,P(K.platformInstallId,n.slice(t.length+1)),j(K.deletedAt))).limit(1));if(o)return{organizationId:o.app.organizationId,app:Ts(o.app,o.credentials),bound:{organizationId:o.installation.organizationId,installation:Ds(o.installation,o.app,o.token)}}}return i&&{organizationId:i.app.organizationId,app:Ts(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:Ds(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await D(e,()=>e.select({row:G,sealed:I}).from(G).innerJoin(I,P(I.id,G.credentialsSecretId)).where(F(P(G.integration,t.slice(0,t.indexOf(`:`))),P(G.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:Ts(n.row,n.sealed)}}static async apps(e,t){return(await D(e,()=>e.select({row:G,sealed:I}).from(G).innerJoin(I,P(I.id,G.credentialsSecretId)).where(P(G.integration,t)))).map(({row:e,sealed:t})=>({organizationId:e.organizationId,app:Ts(e,t)}))}static async installationOrganization(e,t){let[n]=await D(e,()=>e.select({organizationId:K.organizationId}).from(K).where(P(K.key,t)));return n?.organizationId}static async installations(e,t){return D(e,()=>e.select({key:K.key,organizationId:K.organizationId}).from(K).where(F(O`${K.key} like ${`${os(t)}:%`}`,j(K.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await D(e,()=>e.select({organizationId:L.organizationId}).from(L).where(F(P(L.publicId,t),P(L.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await D(this.db,()=>this.db.select({row:G,sealed:I}).from(G).innerJoin(I,P(I.id,G.credentialsSecretId)).where(F(z(G.organizationId,[this.organizationId,``]),z(G.key,e))))).map(e=>({id:e.row.key,value:Ts(e.row,e.sealed)})):[]}async listCredentials(e){let t=Qn,n=this.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(F(this.mine(t.organizationId),e.owner?Jn(j(t.owner),P(t.owner,e.owner)):j(t.owner))).orderBy(N(O`case when ${t.owner} is null then 'workspace' else 'personal' end`),N(t.label));return(await D(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({row:e,sealed:t})=>({id:Yd(e.owner??void 0,e.label),value:js(e,t)}))}async updateMetadata(e,t,n){return e===`installation`&&(`covers`in n||`deletedAt`in n)?this.transaction(`installation:${t}`,async r=>{let i=await r.get(`installation`,t);if(!i)return!1;let a={...i,...n};return a.deletedAt===void 0&&await Os(r,t,a),r.writeMetadata(e,t,n)}):this.writeMetadata(e,t,n)}async writeMetadata(e,t,n){let r=e===`app`?G:e===`installation`?K:ar,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`self`,`covers`,`repos`,`settings`,`deletedAt`,`uninstalled`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?J(t):t])),o=e===`runner`?ar.publicId:e===`app`?G.key:K.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?J(n.updatedAt):this.at()}).where(F(this.mine(r.organizationId),P(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){let n=/^connections?[:-]/.test(e)?`${this.organizationId}:${e}`:e;return this.transaction(`app:${n}`,t)}withConfigLock(e){return this.transaction(`config:${this.organizationId}`,e)}async transaction(t,n){let r=O`select pg_advisory_xact_lock(3, hashtext(${t}))`;return this.inTransaction?(await this.db.execute(r),n(this)):this.db.transaction(async t=>(await t.execute(r),n(new e(t,this.organizationId,this.now,this.encryption,!0,this.notifications))))}withCredential(e,t,n){if(e===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>jn(e,`runner`,t,n));if(e===`installation`)return this.transaction(`installation:${t}`,async e=>{let r=await As(e,t),i=await n(r,r?[{id:t,value:r}]:[],e);for(let t of i??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!i?.length});let{owner:r}=Xd(t);return this.transaction(Ms(this,r),async e=>{let i=await Ns(e,r),a=i.map(({id:e,value:t})=>({id:e,value:t})),o=await n(a.find(e=>e.id===t)?.value,a,e);for(let t of o??[])await Ps(e,i.find(e=>e.id===t.id),t.id,t.value);return!!o?.length})}at(){return J(this.now())}live(e){return Jn(j(e),tr(e,this.at()))}mine(e){return P(e,this.organizationId)}async get(e,t){if(e===`app`)return(await this.getApps([t]))[0]?.value;let n=this.kinds[e],r=as(t),i=n.where?n.where({id:t}):n.split&&r?n.split(r[0],r[1],!0):O`${n.key} = ${t}`;return(await D(this.db,async()=>await n.rows(i,1)))[0]?.value}async patchLogin(e,t,n={}){let[r]=await this.db.update(M).set({value:O`jsonb_strip_nulls(${M.value} || ${JSON.stringify(t)}::jsonb)`}).where(F(P(M.key,X(this.organizationId,`login`,e)),this.live(M.expiresAt),O`(${M.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?z(O`${M.value}->>${e}`,t):O`${M.value}->>${e} = ${t}`))).returning({value:O`${M.value}`,...this.notification(`login`,e)});return r?.value}completeLogin(e,t,n){return uf(this,e,t,n)}async listAgentsWithVersions(e){return(await D(this.db,()=>this.db.select({record:k,version:A}).from(k).leftJoin(A,F(P(A.agentId,k.id),P(A.version,k.currentVersion))).where(F(this.mine(k.organizationId),e===void 0?void 0:Array.isArray(e)?e.length?z(k.slug,e):O`false`:P(k.slug,e))).orderBy(N(k.slug)))).map(({record:e,version:t})=>({record:us(e),...t?{version:ds(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${os(e.q)}%`:void 0,n=this.db.select({record:k,version:fs}).from(k).leftJoin(A,F(P(A.agentId,k.id),P(A.version,k.currentVersion))).where(F(this.mine(k.organizationId),e.slug===void 0?void 0:P(k.slug,e.slug),e.after?tr(k.slug,e.after):void 0,e.source?P(k.source,e.source):void 0,t?Jn(Yn(k.slug,t),Yn(k.name,t),Yn(k.description,t),Yn(k.repo,t)):void 0,e.platform?O`${A.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(N(k.slug));return(await D(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({record:e,version:t})=>({record:us(e),...t?{version:ps(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:fs}).from(A).innerJoin(k,P(k.id,A.agentId)).where(F(this.mine(k.organizationId),P(k.slug,e),n===void 0?t===void 0?void 0:Gn(A.version,k.currentVersion):qn(A.version,n),t===void 0?void 0:er(A.version,n===void 0?O`${k.currentVersion} + 1 - ${t}`:n-t))).orderBy(N(A.version));return(await D(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:ps(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:J(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i,r)}async putMany(e,t,n={}){if(!t.length)return;if(e===`delivery`){await this.db.insert(M).values(t.map(({id:t,value:r})=>({key:X(this.organizationId,e,t),value:r,expiresAt:n.ttlMs===void 0?null:J(this.now()+n.ttlMs)}))).onConflictDoUpdate({target:M.key,set:{value:O`excluded.value`,expiresAt:O`excluded.expires_at`}});return}if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value,n)));return}let r=t[0].id.lastIndexOf(`:`),i=t[0].id.slice(0,r),a=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==i)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:O`(select ${L.id} from ${L} where ${L.organizationId} = ${this.organizationId} and ${L.publicId} = ${i})`,seq:Number(e.id.slice(t+1)),at:J(n.at),level:n.level,line:n.line}});await this.db.insert(cr).values(a).onConflictDoUpdate({target:[cr.taskId,cr.seq],set:{at:O`excluded.at`,level:O`excluded.level`,line:O`excluded.line`}})}async list(e,t={}){let n=this.kinds[e],r=[];if(t.ids&&r.push(t.ids.length?z(O`${n.key}`,t.ids.map(t=>n.where?X(this.organizationId,e,t):t)):O`false`),t.runner&&r.push(e===`runner`?Jn(P(ar.publicId,t.runner),P(ar.name,t.runner)):O`false`),t.defaults&&r.push(e===`runner`?P(ar.isDefault,!0):O`false`),t.installation&&r.push(e===`usage`?P(K.key,t.installation):O`false`),t.agent&&r.push(e===`app`||e===`installation`?P(G.agent,t.agent):e===`agent`?P(k.slug,t.agent):O`false`),t.active&&r.push(e===`installation`?Jn(j(K.deletedAt),...t.includeUninstalled?[P(K.uninstalled,!0)]:[]):void 0),t.apps&&r.push(e===`installation`&&t.apps.length?z(G.key,t.apps):O`false`),Object.hasOwn(t,`visibleTo`)){let n=e===`runner`?ar.owner:e===`credential`?Qn.owner:O`${M.value}->>'owner'`;r.push(Jn(j(n),t.visibleTo?P(O`${n}`,t.visibleTo):void 0))}if(n.where)return D(this.db,async()=>await n.rows(F(n.where(t),...r),t.limit));let i=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,a=t.after===void 0?void 0:as(t.after);if(n.split&&i&&!i.includes(`:`)&&(t.after===void 0||a?.[0]===i))return D(this.db,async()=>await n.rows(n.split(i,a?.[1]),t.limit));let o=t.prefix?O`${n.key} like ${`${os(t.prefix)}%`}`:void 0,s=t.after?O`${n.key} > ${t.after}`:void 0,c=F(o,s,...r);return D(this.db,async()=>await n.rows(c,t.limit))}async delete(e,t){let n=e===`login`?this.notification(e,t):void 0;if(n){await this.db.delete(M).where(P(M.key,X(this.organizationId,e,t))).returning(n);return}await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return Cs(this,t,n);if(e!==`delivery`&&e!==`connection`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:J(this.now()+r.ttlMs);return(await this.db.insert(M).values({key:X(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:M.key,set:{value:n,expiresAt:i},setWhere:Gn(M.expiresAt,this.at())}).returning({key:M.key})).length>0}async claimDeliveryLease(e,t,n){let r=O`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(M).values({key:X(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:M.key,set:{value:O`${M.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:O`${M.expiresAt} <= clock_timestamp()`}).returning({value:M.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=F(P(M.key,X(this.organizationId,`delivery`,e)),O`${M.value}->>'owner' = ${t} and ${M.expiresAt} > clock_timestamp()`),a=O`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(M).where(i).returning({key:M.key}):await this.db.update(M).set({value:n.next===void 0?n:O`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:M.key})).length>0}async updateDelivery(e,t,n,r={}){let i=F(P(M.key,X(this.organizationId,`delivery`,e)),O`${M.value}->>'owner' = ${t}`,this.live(M.expiresAt));return(n===void 0?await this.db.delete(M).where(i).returning({key:M.key}):await this.db.update(M).set({value:n,expiresAt:r.ttlMs===void 0?null:J(this.now()+r.ttlMs)}).where(i).returning({key:M.key})).length>0}listHistory(e){return Js(this,e)}async installationApp(e){let t=Xn(I,`installation_secret`),[n]=await D(this.db,()=>this.db.select({installation:K,app:G,credentials:I,token:t}).from(K).innerJoin(G,F(P(G.id,K.appId),z(G.organizationId,[this.organizationId,``]))).innerJoin(I,P(I.id,G.credentialsSecretId)).leftJoin(t,F(P(t.id,K.tokenSecretId),this.mine(t.organizationId))).where(F(this.mine(K.organizationId),P(K.key,e),j(K.deletedAt))));return n&&{installation:Ds(n.installation,n.app,n.token),app:Ts(n.app,n.credentials)}}async conversationState(e){let t=Xn(M,`unseen`),n=Xn(M,`batch`),[r]=await D(this.db,()=>this.db.select({record:M.value,unseen:t.value,batch:n.value,task:L}).from(O`(select 1) as anchor`).leftJoin(M,F(P(M.key,X(this.organizationId,`delivery`,e)),this.live(M.expiresAt))).leftJoin(t,F(P(t.key,X(this.organizationId,`delivery`,`since:${e}`)),this.live(t.expiresAt))).leftJoin(n,F(P(n.key,X(this.organizationId,`delivery`,`batch:${e}`)),this.live(n.expiresAt))).leftJoin(L,F(this.mine(L.organizationId),P(L.publicId,O`${M.value}->>'taskId'`),P(L.flow,`default`))));return{...r?.record?{record:r.record}:{},...r?.unseen?{unseen:r.unseen}:{},...r?.batch?{batch:r.batch}:{},...r?.task?{status:ms(r.task)}:{}}}async heldTokens(e,t){let[n]=await D(this.db,()=>bs(this.db,O`select ${Bs(this.organizationId,e,t)} as tokens`));return Vs(this.organizationId,n?.tokens??{})}async holdToken(e){let t=M,n=e=>X(this.organizationId,`snapshot`,e);await this.db.execute(O`insert into ${t} (key, value, expires_at)
-      select ${n(e.key)}, ${JSON.stringify(e.value)}::jsonb, ${J(this.now()+e.ttlMs).toISOString()}::timestamptz
-      where ${O.join(e.drops.map(e=>O`coalesce((select ${t.value}->>'drop' from ${t} where ${t.key} = ${n(e.key)} and ${this.live(t.expiresAt)}), '') = ${e.drop??``}`),O` and `)}
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`)}async saveTaskSecrets(e,t){let[n]=await Un(this.db,[O`select pg_advisory_xact_lock(3, hashtext(${`app:${this.organizationId}:connections:${e}`}))`],O`with active as (select 1 from ${L} where ${this.mine(L.organizationId)} and ${L.publicId} = ${e} and ${L.status} in ('queued', 'running', 'waiting')),
-        kept as (insert into ${M} (key, value, expires_at)
-          select key, value, expires_at from (values ${O.join(t.map(e=>O`(${X(this.organizationId,`snapshot`,e.id)}, ${JSON.stringify({secret:e.value,expiresAt:e.expiresAt})}::jsonb, ${J(e.expiresAt).toISOString()}::timestamptz)`),O`, `)}) as row(key, value, expires_at) where exists (select 1 from active) on conflict (key) do nothing)
-        select exists (select 1 from active) as active`);return!!n?.active}async dispatchState(e){let t=M,n=e=>X(this.organizationId,`delivery`,e),r=e.conversation??``,i=e=>O`(select ${t.value} from ${t} where ${t.key} = ${n(e)} and ${this.live(t.expiresAt)})`,a=e=>O`(${e} is null or ${e} = (select requester from member))`,o=e=>O`${e} = ${this.organizationId}`,s=e=>O`(select coalesce(jsonb_agg(${Is(O`r`,O`s`)}), '[]'::jsonb) from ${e})`,c=ys(this.organizationId,`snapshot`),l=e.files.map(e=>`${os(c+e)}%`),[u]=await bs(this.db,O`
-      with claim as (
-        insert into ${t} (key, value, expires_at)
-        values (${n(e.delivery.key)}, ${JSON.stringify({at:e.delivery.at,owner:e.delivery.owner,pending:!0})}::jsonb, ${J(e.delivery.at+e.delivery.ttlMs).toISOString()}::timestamptz)
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${t.expiresAt} <= ${this.at().toISOString()}::timestamptz
-        returning key
-      ), conversation as (select ${i(r)} as value),
-      member as (select ${ir.userId} as requester from ${ir}
-        where ${ir.platform} = ${e.actor?.platform??null}::text and ${ir.platformUserId} = ${e.actor?.id??null}::text
-          and ${ir.organizations} ? ${this.organizationId} limit 1)
-      select exists (select 1 from claim) as claimed,
-        (select to_jsonb(a) from ${k} a where ${o(O`a.organization_id`)} and a.slug = ${e.agent}) as record,
-        (select to_jsonb(v) from ${A} v join ${k} a on a.id = v.agent_id and v.version = a.current_version
-          where ${o(O`a.organization_id`)} and a.slug = ${e.agent}) as version,
-        (select value from conversation) as conversation,
-        ${i(`since:${r}`)} as unseen,
-        ${i(`batch:${r}`)} as batch,
-        (select to_jsonb(t) from ${L} t, conversation c where ${o(O`t.organization_id`)} and t.public_id = c.value->>'taskId' and t.flow = 'default') as task,
-        (select requester from member) as requester,
-        ${s(O`${Qn} r join ${I} s on s.id = r.secret_id where ${o(O`r.organization_id`)} and ${a(O`r.owner`)}`)} as credentials,
-        ${s(O`${ar} r join ${I} s on s.id = r.secret_id where ${o(O`r.organization_id`)} and r.is_default and ${a(O`r.owner`)}`)} as runners,
-        (select coalesce(jsonb_agg(${t.value}), '[]'::jsonb) from ${t}
-          where ${t.key} like ${`${os(ys(this.organizationId,`connection`))}%`} and ${this.live(t.expiresAt)} and ${a(O`${t.value}->>'owner'`)}) as connections,
-        ${i(`workspace`)} as workspace,
-        (select coalesce(jsonb_object_agg(${t.key}, ${t.value}), '{}'::jsonb) from ${t}
-          where ${this.live(t.expiresAt)} and ${t.key} like any(${O.param(l)}::text[])) as files,
-        ${Bs(this.organizationId,[e.installation.id],[e.installation.app])} as tokens`);if(!u?.claimed)return{claimed:!1};let d=u.record?us(Y(k,u.record)):void 0,f=u.version&&d?ds(Y(A,u.version),d.id):void 0;return{claimed:!0,loaded:{...d?{record:d}:{},...f?{version:f}:{},conversation:{...u.conversation?{record:u.conversation}:{},...u.unseen?{unseen:u.unseen}:{},...u.batch?{batch:u.batch}:{},...u.task?{status:ms(Y(L,u.task))}:{}},...u.requester?{requester:u.requester}:{},credentials:u.credentials.map(Ls),runners:u.runners.map(Rs),connections:u.connections,...u.workspace?{workspace:u.workspace}:{},files:Object.fromEntries(Object.entries(u.files).map(([e,t])=>[e.slice(c.length),t])),tokens:Vs(this.organizationId,u.tokens)}}}async markConversation(e,t,n,r,i){await this.db.update(M).set({value:O`${M.value} || ${JSON.stringify({at:r,seen:n})}::jsonb`,expiresAt:J(this.now()+i)}).where(F(P(M.key,X(this.organizationId,`delivery`,e)),O`${M.value}->>'taskId' = ${t}`,this.live(M.expiresAt)))}async appendUnseen(e,t,n){let r=O`coalesce((${M.value}->>'version')::bigint, jsonb_array_length(${M.value}->'messages') + (${M.value}->>'more')::bigint)`,i={messages:[{...t,sequence:1}],more:0,version:1,epoch:Er()};await this.db.execute(O`
-      insert into ${M} (key, value, expires_at)
-      select ${X(this.organizationId,`delivery`,`since:${e}`)}, ${JSON.stringify(i)}::jsonb, ${J(this.now()+n).toISOString()}::timestamptz
-      where exists (select 1 from ${M} where key = ${X(this.organizationId,`delivery`,e)} and ${this.live(M.expiresAt)})
-      on conflict (key) do update set value = case when ${M.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-        ${M.value} || jsonb_build_object('version', ${r} + 1,
-          'messages', case when jsonb_array_length(${M.value}->'messages') < ${50} then
-            (${M.value}->'messages') || jsonb_build_array(${JSON.stringify(t)}::jsonb || jsonb_build_object('sequence', ${r} + 1)) else ${M.value}->'messages' end,
-          'more', (${M.value}->>'more')::int + case when jsonb_array_length(${M.value}->'messages') < ${50} then 0 else 1 end) end,
-        expires_at = excluded.expires_at
-    `)}async acknowledgeUnseen(e,t,n){await this.db.update(M).set({value:Hs(t)}).where(F(P(M.key,X(this.organizationId,`delivery`,`since:${e}`)),O`${M.value}->>'epoch' is not distinct from ${n??null}::text`,this.live(M.expiresAt)))}async appendBatch(e,t,n,r,i){let a=Fn(void 0,t,n,r),o=J(this.now()+i);await this.db.insert(M).values({key:X(this.organizationId,`delivery`,e),value:a,expiresAt:o}).onConflictDoUpdate({target:M.key,set:{value:O`case when ${M.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-          (select ${M.value} || excluded.value || jsonb_build_object(
-            'items', prefix || coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(pending) with ordinality e(item,n) where n > greatest(jsonb_array_length(pending) - 50, 0)), '[]'::jsonb),
-            'more', coalesce((${M.value}->>'more')::int, 0) + coalesce((excluded.value->>'more')::int, 0) + greatest(jsonb_array_length(pending) - 50, 0),
-            'mustReply', coalesce((${M.value}->>'mustReply')::boolean, false) or coalesce((excluded.value->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(pending) with ordinality e(item,n) where n <= greatest(jsonb_array_length(pending) - 50, 0) and item->'event'->>'mustReply' = 'true'))
-            from (select coalesce(jsonb_agg(item order by n) filter (where n <= coalesce((${M.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) as prefix,
-              coalesce(jsonb_agg(item order by n) filter (where n > coalesce((${M.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) || (excluded.value->'items') as pending
-              from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)) queued) end`,expiresAt:o}})}async claimBatch(e,t){let n=X(this.organizationId,`delivery`,e),r=(await bs(this.db,O`
-      with held as materialized (
-        select key as batch_key, value as previous from ${M}
-        where key = ${n} and value->>'owner' = ${t} and ${this.live(M.expiresAt)} for update
-      ), claimed as (
-        update ${M} set value = (
-          select ready || jsonb_build_object('more', 0, 'mustReply', false, 'sending', jsonb_build_object(
-            'owner', ${t}::text, 'until', ${this.now()+Ln}::bigint,
-            'count', jsonb_array_length(ready->'items'), 'more', ready->'more', 'mustReply', ready->'mustReply'))
-          from (select (value - 'sending') || jsonb_build_object(
-            'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n > greatest(jsonb_array_length(value->'items') - 50, 0)), '[]'::jsonb),
-            'more', coalesce((value->>'more')::int, 0) + coalesce((value->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(value->'items') - 50, 0),
-            'mustReply', coalesce((value->>'mustReply')::boolean, false) or coalesce((value->'sending'->>'mustReply')::boolean, false) or exists(
-              select 1 from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n <= greatest(jsonb_array_length(value->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')) as ready) as available)
-        from held where key = held.batch_key and coalesce((value->'sending'->>'until')::bigint, 0) <= ${this.now()}
-          and jsonb_array_length(value->'items') > 0
-        returning value
-      ) select value, true as claimed from claimed
-      union all select previous, false from held where not exists (select 1 from claimed)
-    `))[0];return r?.claimed?{...r.value,more:r.value.sending?.more,mustReply:r.value.sending?.mustReply}:r?.value.sending?null:void 0}async finishBatch(e,t,n,r){let i=O`(${M.value}->'sending'->>'count')::int`,a=r===void 0?i:O`coalesce((select n from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= ${i} and item->>'admission' = ${r} limit 1), 0)`;return(await this.db.update(M).set({value:O`case when ${n} and ${i} > ${a} then
-          ${M.value} || jsonb_build_object('items',
-            coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-              where n > ${a}), '[]'::jsonb),
-            'sending', (${M.value}->'sending') || jsonb_build_object(
-              'count', ${i} - ${a},
-              'until', ${this.now()+Ln}::bigint))
-        else (${M.value} - 'sending') || jsonb_build_object('items',
-        case when ${n} then coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality as entries(item, n)
-          where n > ${i}), '[]'::jsonb) else
-          coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-            where n > greatest(jsonb_array_length(${M.value}->'items') - 50, 0)), '[]'::jsonb) end,
-        'more', coalesce((${M.value}->>'more')::int, 0) + case when ${n} then 0 else coalesce((${M.value}->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(${M.value}->'items') - 50, 0) end,
-        'mustReply', coalesce((${M.value}->>'mustReply')::boolean, false) or (not ${n} and (coalesce((${M.value}->'sending'->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= greatest(jsonb_array_length(${M.value}->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')))) end`}).where(F(P(M.key,X(this.organizationId,`delivery`,e)),O`${M.value}->'sending'->>'owner' = ${t}`,this.live(M.expiresAt))).returning({key:M.key})).length>0}async take(e,t,n){if(e===`delivery`||e===`snapshot`){let[r]=await this.db.delete(M).where(F(P(M.key,X(this.organizationId,e,t)),this.live(M.expiresAt),n?O`${M.value} @> ${JSON.stringify(n)}::jsonb`:void 0)).returning({value:M.value});return r?.value}let r=await this.get(e,t);if(!(r===void 0||Object.entries(n??{}).some(([e,t])=>r[e]!==t)))return await this.delete(e,t),r}async usageSummary(e,t){let n=O`case groups.kind when 'agent' then ${ur.agent} when 'engine' then coalesce(${ur.engine}, 'unknown') else coalesce(${K.key}, 'none') end`,r=t?n:O`groups.kind || ':' || (${n})`,i=(await D(this.db,()=>bs(this.db,O`
-      with recursive records as (
-        select ${r} as key, ${ur.runnerMs} as runner_ms, ${ur.tokens} as tokens,
-          row_number() over (partition by ${r} order by ${L.publicId}) as n
-        from ${ur} inner join ${L} on ${L.id} = ${ur.taskId}
-        left join ${K} on ${K.id} = ${ur.installationId}
-        cross join unnest(${O.param(t?[t]:[`agent`,`installation`,`engine`])}::text[]) groups(kind)
-        where ${this.mine(ur.organizationId)} and ${ur.at} >= ${new Date(e).toISOString()}::timestamptz
-      ), nodes(key, path, n, value) as (
-        select key, '{}'::text[], n, tokens from records where tokens is not null
-        union all
-        select nodes.key, nodes.path || child.key, nodes.n, child.value from nodes
-        cross join lateral jsonb_each(case when jsonb_typeof(nodes.value) = 'object' then nodes.value else '{}'::jsonb end) child
-      ), resolved(key, path, kind, cutoff) as (
-        select keys.key, '{}'::text[], latest.kind, coalesce((
-          select max(n) from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0) from (select distinct key from records) keys
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest
-        union all
-        select parent.key, child.path, latest.kind, greatest(parent.cutoff, coalesce((
-          select max(n) from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0)) from resolved parent
-        cross join lateral (
-          select distinct path[1:cardinality(parent.path) + 1] as path from nodes
-          where nodes.key = parent.key and n > parent.cutoff and cardinality(path) > cardinality(parent.path)
-            and path[1:cardinality(parent.path)] = parent.path
-        ) child
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest where parent.kind = 'object'
-      ), sums as (
-        select key, path, case when kind = 'object' then '{}'::jsonb else to_jsonb((
-          select sum(case when jsonb_typeof(value) = 'number' then (value #>> '{}')::numeric end)::float8
-          from nodes where nodes.key = resolved.key and nodes.path = resolved.path and n > cutoff
-        )) end as value from resolved
-      ) select key, count(*)::int as tasks, sum(runner_ms)::float8 as runner_ms,
-        (select jsonb_agg(jsonb_build_object('path', path, 'value', value) order by path) from sums where sums.key = records.key) as tokens
-        from records group by key order by key
-    `))).map(e=>{let t;for(let n of e.tokens??[]){if(!n.path.length){t=typeof n.value==`number`?n.value:Object.create(null);continue}let e=t&&typeof t==`object`?t:Object.create(null);t=e;let r=e;for(let e of n.path.slice(0,-1))r=r[e]??=Object.create(null);Object.defineProperty(r,n.path.at(-1),{value:typeof n.value==`number`?n.value:Object.create(null),enumerable:!0,configurable:!0,writable:!0})}return{key:e.key,tasks:e.tasks,runnerMs:e.runner_ms,...t===void 0?{}:{tokens:t}}});if(t)return i;let a={agent:[],installation:[],engine:[]};for(let e of i){let t=e.key.indexOf(`:`);a[e.key.slice(0,t)].push({...e,key:e.key.slice(t+1)})}return a}async usageTotals(e){let t=ur,n=e.by===`agent`?O`${t.agent}`:e.by===`engine`?O`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?O`coalesce(${K.key}, 'none')`:O`to_char(${t.at} at time zone ${Uo(e.tz)}, 'YYYY-MM-DD')`,r=F(this.mine(t.organizationId),er(t.at,J(e.since)),e.until===void 0?void 0:qn(t.at,J(e.until)),e.agent?P(t.agent,e.agent):void 0),i=O`coalesce(
-      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
-      (select sum((v #>> '{}')::numeric)
-        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
-        where jsonb_typeof(v) = 'number')
-    )`,a={tasks:O`count(*)`,runnerMs:O`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:O`coalesce(sum(${i}), 0)`},o=e.top?O`case when ${t.agent} in (
-          select ${t.agent} from ${t} where ${r} group by ${t.agent}
-          order by ${a[e.top.by]} desc, ${t.agent} limit ${e.top.count}
-        ) then ${t.agent} end`:e.parts?.length?O`case when ${z(t.agent,e.parts)} then ${t.agent} end`:O`null::text`,s=e.by===`installation`?O`left join ${K} on ${K.id} = ${t.installationId}`:O``,c=await D(this.db,()=>bs(this.db,O`
-      select ${n} as key, ${o} as part, ${a.tasks}::int as tasks,
-        ${a.runnerMs}::float8 as runner_ms,
-        ${a.tokenCount}::float8 as token_count
-      from ${t} ${s}
-      where ${r}
-      group by 1, 2
-    `)),l=new Map;for(let e of c){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=l.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};Wo(n,t),e.part&&((n.parts??={})[e.part]=t),l.set(e.key,n)}return[...l.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(O`
-      with tombstones as (
-        delete from ${lr} where (organization_id, public_id) in (
-          select organization_id, public_id from ${lr}
-          where deleted_at < ${new Date(this.now()-6e5).toISOString()}::timestamptz
-          order by deleted_at limit ${e}
-        )
-      ), expired_state as (
-        delete from ${M} where expires_at <= clock_timestamp() and key in (
-          select key from ${M} where expires_at <= clock_timestamp() order by expires_at limit ${e}
-        )
-      ), lists as (
-        select expired.key from ${Zn} as expired
-        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
-          and not exists (select 1 from ${Zn} as newer where newer.key = expired.key and newer.seq > expired.seq)
-        order by expired.expires_at limit ${e}
-      ), expired_items as (
-        select key, seq from ${Zn} where key in (select key from lists) order by seq limit ${e}
-      ), expired_queue as (
-        select key, seq from ${Zn} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
-      )
-      delete from ${Zn} where (key, seq) in (
-        select key, seq from expired_items union all select key, seq from expired_queue
-      )`)}};const tc=vt;function nc(e,t,n,r=Tr(32).toString(`base64url`)){let i=`${Zt({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:tc(i)}}function rc(e){try{return Qt(e.slice(0,e.indexOf(`.`)))}catch{return{}}}var ic=r({DrizzleQueue:()=>hc});const ac=(e,t)=>O`('[' || to_json(${e})::text || ',' || to_json(${t}::text)::text || ']:')`,oc=e=>O`(select ${Is(O`c`,O`s`)} from ${Qn} c join ${I} s on s.id = c.secret_id
-    where c.organization_id = ${e}.organization_id and coalesce(c.owner || '/', '') || c.label = ${e}.credential)`,sc=e=>O`(select ${M.value} from ${M} where ${M.key} = 'o:' || ${ac(e,`config`)} || 'workspace')`,cc=e=>O`(select ${Is(O`r`,O`s`)} from ${ar} r join ${I} s on s.id = r.secret_id
-    where r.organization_id = ${e}.organization_id and r.public_id = ${e}.runner_id)`;function lc(e,t){if(typeof t==`number`)return O`to_jsonb(coalesce(case when jsonb_typeof(${e}) = 'number' then (${e} #>> '{}')::numeric end, 0) + ${t}::numeric)`;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=Object.entries(t).map(([t,n])=>O`${t}::text, ${lc(O`(${e} -> ${t}::text)`,n)}`);return O`(case when jsonb_typeof(${e}) = 'object' then ${e} else '{}'::jsonb end || jsonb_build_object(${O.join(n,O`, `)}))`}const uc=e=>O`(case ${e} ${O.join([...Q,...Te].map(e=>O`when ${e} then ${O.raw(String(et(e)))}`),O` `)} end)`,dc=e=>O`date_trunc('milliseconds', ${e})`,fc=e=>O`${e} collate "C"`,pc=e=>[N(uc(e.status)),$n(dc(e.createdAt)),$n(fc(e.publicId))],mc=e=>[N(e.updatedAt),N(fc(e.publicId))];var hc=class{db;constructor(e){this.db=e}async metrics(e,t){let n=await this.db.select({status:L.status,total:O`count(*)::int`,recent:O`count(*) filter (where ${L.createdAt} >= ${new Date(t).toISOString()}::timestamptz)::int`}).from(L).where(P(L.organizationId,e)).groupBy(L.status),r={tasks:{queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},queueDepth:0};for(let e of n)r.tasks[e.status]=e.recent,e.status===`queued`&&(r.queueDepth=e.total);return r}where(e,t){return F(P(L.organizationId,e),P(L.publicId,t))}fence(e,t,n={}){return F(this.where(e,t),n.generation===void 0?void 0:P(L.generation,n.generation),n.attempts===void 0?void 0:P(L.attempts,n.attempts),n.tokenHash===void 0?void 0:n.tokenHash===null?j(L.tokenHash):P(L.tokenHash,n.tokenHash),n.handle===void 0?void 0:n.handle===null?j(L.handle):P(L.handle,n.handle),n.lastSeenAt===void 0?void 0:n.lastSeenAt===null?j(L.lastSeenAt):P(L.lastSeenAt,new Date(n.lastSeenAt)),n.updatedAt===void 0?void 0:P(L.updatedAt,new Date(n.updatedAt)),n.statuses?z(L.status,n.statuses):void 0)}async enqueue(e,t,n,r,i,a){let o=this.insertion(e,t,n,r,i,void 0,a),[s]=await Un(this.db,i===void 0?[]:[O`select pg_advisory_xact_lock(1, hashtext(${e}))`],o);if(!s?.allowed)throw Error(`Organization task queue is full`);return!!s.inserted}insertion(e,t,n,r,i,a,o){let s=t.event,c=new Date(n).toISOString(),l=e=>O`${e===void 0?null:JSON.stringify(e)}::jsonb`,u=t=>X(e,`delivery`,t),d=r?O`
-      receipt as (
-        insert into ${M} (key, value, expires_at)
-        select ${u(r.key)}, ${l({at:n})}, ${new Date(n+r.ttlMs).toISOString()}::timestamptz
-        from capacity where allowed ${a?O`and (${a.create} or exists (select 1 from target))`:O``}
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${M.expiresAt} <= ${c}::timestamptz or ${M.value}->>'owner' = ${r.owner??null}::text
-        returning key
-      ),`:O``,f=O`exists (select 1 from inserted)`,p=O`on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`,{conversation:m,unseen:h,secrets:g}=o??{},_=O`${m?O`, remembered as (insert into ${M} (key, value, expires_at)
-        select key, value, ${new Date(n+m.ttlMs).toISOString()}::timestamptz from (values
-          (${u(m.key)}, ${l(m.record)}), (${u(m.root)}, ${l({at:m.record.at})})) as row(key, value)
-        where ${f} ${p})`:O``}${h?O`, acknowledged as (update ${M} set value = ${Hs(h.version)}
-        where key = ${u(`since:${h.key}`)} and ${M.value}->>'epoch' is not distinct from ${h.epoch??null}::text
-          and (expires_at is null or expires_at > ${c}::timestamptz) and ${f})`:O``}${g?.length?O`, secrets as (insert into ${M} (key, value, expires_at)
-        select key, value, expires_at from (values ${O.join(g.map(t=>O`(${X(e,`snapshot`,t.id)}, ${l({secret:t.value,expiresAt:t.expiresAt})}, ${new Date(t.expiresAt).toISOString()}::timestamptz)`),O`, `)}) as row(key, value, expires_at) where ${f} on conflict (key) do nothing)`:O``}`;return O`
-      with ${a?O`target as materialized (${a.target}),`:O``} capacity as (
-        select ${i===void 0?O`true`:O`(select count(*) from ${L} where organization_id = ${e} and status = 'queued') < ${i} ${r?O`or exists (select 1 from ${M} where key = ${u(r.key)} and expires_at > ${c}::timestamptz and value->>'owner' is distinct from ${r.owner??null}::text)`:O``}`} ${a?O`or exists (select 1 from target) or not ${a.create}`:O``} as allowed
-      ), ${d} ${a?O`advanced as (
-        update ${L} set inbox_seq = inbox_seq + 1, updated_at = ${c}::timestamptz where id in (select id from target) and exists (select 1 from receipt)
-        returning id, inbox_seq, generation
-      ), forwarded as (
-        insert into ${R} (organization_id, task_id, seq, generation, at, kind, value)
-        select ${e}, id, inbox_seq, generation, ${c}::timestamptz, 'steer', ${l({text:a.steer})} from advanced returning seq
-      ),`:O``} inserted as (
-        insert into ${L} (organization_id, public_id, source, status, agent, flow, review_key, runner, permissions,
-          app_id, installation_id, event, prompt, args, mcp, author, definition, credential, requester,
-          runner_id, usage, tools, context, files, attempts, created_at, updated_at)
-        select ${e}, ${t.id}, ${t.source}, 'queued', ${t.agent}, ${t.flow}, ${Sp(t)??null}, ${t.runner}, ${t.permissions??null},
-          ${s?O`coalesce((select id from ${nr} where key = ${s.appId} and organization_id in (${e}, '')), 0)`:O`null`},
-          ${s?O`coalesce((select id from ${rr} where key = ${`${s.appId}:${s.installationId}`} and organization_id = ${e}), 0)`:O`null`},
-          ${l(s)}, ${t.prompt??null}, ${l(t.args)}, ${l(t.mcp)}, ${t.author??null}, ${l(t.definition)},
-          ${t.credential??null}, ${t.requester??null}, ${t.runnerId??null}, ${l(t.usage)}, ${l(t.tools)},
-          ${l(rs(t))}, ${l(t.files)}, 0, ${c}::timestamptz, ${c}::timestamptz
-        from capacity where allowed ${a?O`and ${a.create} and not exists (select 1 from target)`:O``} ${r?O`and exists (select 1 from receipt)`:O``}
-        returning id
-      )${_} select allowed, exists (select 1 from inserted) as inserted ${a?O`, exists (select 1 from forwarded) as steered`:O``} from capacity`}async deliver(e,t,n,r,i,a,o=!0,s){if(i===void 0)return o&&await this.enqueue(e,t,n,r,a,s)?{taskId:t.id}:{};let c=t.event,l=O`select id from ${L} where organization_id = ${e} and status in ('queued', 'running', 'waiting')
-      and agent = ${t.agent} and source = ${t.source} and flow = 'default'
-      and event->>'appId' is not distinct from ${c?.appId??null}
-      and event->>'installationId' is not distinct from ${c?.installationId??null}
-      and event->'chat'->'thread'->>'id' = ${c?.chat?.thread.id||null}
-      order by created_at desc, public_id desc limit 1 for update`,u=this.insertion(e,t,n,r,a,{target:l,create:o,steer:i},s),d=[O`select pg_advisory_xact_lock(3, hashtext(${JSON.stringify([e,bp(t)])}))`];a!==void 0&&o&&d.push(O`select pg_advisory_xact_lock(1, hashtext(${e}))`);let[f]=await Un(this.db,d,u);if(!f?.allowed)throw Error(`Organization task queue is full`);return f.inserted?{taskId:t.id}:f.steered?{steered:!0}:{}}async claim(e,t,n=!1,r){let i=O`not exists (select 1 from ${L} reviewing
-      where reviewing.organization_id = ${L.organizationId} and reviewing.status in ('running', 'waiting')
-        and reviewing.review_key = ${L.reviewKey})`,a=r===void 0?O`true`:O`(select count(*) from ${L} active where active.organization_id = ${L.organizationId} and active.status in ('running', 'waiting')) < ${r}`;if(!n){let[e]=await D(this.db,()=>bs(this.db,O`select exists (select 1 from ${L} where status = 'queued' and ${a} and ${i})
-        and ${t===void 0?O`true`:O`(select count(*) from ${L} where status in ('running', 'waiting')) < ${t}`} as ready`));if(!e?.ready)return}let o=Tr(32).toString(`base64url`),s=O`translate(rtrim(replace(encode(convert_to(format('{"task":%s,"organization":%s,"attempt":%s}',
-      to_json(public_id), to_json(organization_id), attempts + 1), 'UTF8'), 'base64'), E'\\n', ''), '='), '+/', '-_') || '.' || ${o}`,c=O`with stamp as materialized (select date_trunc('milliseconds', clock_timestamp()) as at), picked as materialized (
-      select id, ${s} as bearer from ${L} where status = 'queued'
-        and ${a} and ${i}
-        ${t===void 0?O``:O`and (select count(*) from ${L} where status in ('running', 'waiting')) < ${t}`}
-        order by created_at, id limit 1 for update
-      ), claimed as (
-        update ${L} set status = 'running', attempts = attempts + 1, locked_at = (select at from stamp),
-          started_at = (select at from stamp), updated_at = (select at from stamp), last_seen_at = (select at from stamp),
-          token_hash = translate(rtrim(encode(sha256(convert_to(picked.bearer, 'UTF8')), 'base64'), '='), '+/', '-_')
-        from picked where ${L.id} = picked.id returning ${L}.*
-      ) select to_jsonb(claimed) as record, exists (select 1 from ${L} where status = 'queued' and id <> claimed.id
-        and ${i} and (${L.organizationId} <> claimed.organization_id or ${L.reviewKey} is null or ${L.reviewKey} is distinct from claimed.review_key)
-        and ${r===void 0?O`true`:O`(select count(*) from ${L} active where active.organization_id = ${L.organizationId} and active.status in ('running', 'waiting')) + case when ${L.organizationId} = claimed.organization_id then 1 else 0 end < ${r}`})
-        and ${t===void 0?O`true`:O`(select count(*) from ${L} where status in ('running', 'waiting')) + 1 < ${t}`} as more,
-        ${oc(O`claimed`)} as credential, ${sc(O`claimed.organization_id`)} as config, ${cc(O`claimed`)} as runner
-        from claimed`,[l]=await Un(this.db,[O`select pg_advisory_xact_lock(2, 0)`],c);if(!l)return;let u=Y(L,l.record);return{organizationId:u.organizationId,status:ms(u),token:nc(u.publicId,u.organizationId,u.attempts,o).token,more:l.more,loaded:{credential:l.credential?Ls(l.credential).value:void 0,config:l.config??void 0,runner:l.runner?Rs(l.runner).value:void 0}}}async authorize(e,t,n,r,i,a={}){let o=z(L.status,[`running`,`waiting`]),s=new Date(i).toISOString(),c=this.db.update(L).set({lastSeenAt:O`case when ${o} then ${s}::timestamptz else ${L.lastSeenAt} end`,updatedAt:O`case when ${o} then ${s}::timestamptz else ${L.updatedAt} end`}).where(this.fence(r,e,{tokenHash:t,attempts:n,statuses:a.allowCompleted?[`running`,`waiting`,`completed`,`failed`,`cancelled`]:[`running`,`waiting`]})).returning(),l=a.include===`context`,u=!!a.include,d=M,f=O`touched.organization_id`,p=e=>O`('o:' || ${ac(f,`snapshot`)} || ${e})`,m=e=>O`replace(replace(replace(${e}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`,h=O`(${d.expiresAt} is null or ${d.expiresAt} > ${s}::timestamptz)`,[g]=await bs(this.db,O`with touched as (${c.getSQL()}), target as (
-        select i.key, a.key as app from touched, ${rr} i join ${nr} a on a.id = i.app_id
-        where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and ${l}
-      )
-      select to_jsonb(touched) as status,
-        case when ${l} then (select ${Is(O`a`,O`s`)} from ${nr} a join ${I} s on s.id = a.credentials_secret_id
-          where a.key = touched.event->>'appId' and a.organization_id in (touched.organization_id, '')) end as app,
-        case when ${u} then (select ${Is(O`i`,O`s`)} || jsonb_build_object('app', to_jsonb(a), 'credentials', to_jsonb(c))
-          from ${rr} i join ${nr} a on a.id = i.app_id join ${I} c on c.id = a.credentials_secret_id left join ${I} s on s.id = i.token_secret_id
-          where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and i.deleted_at is null) end as installation,
-        case when ${u} then ${oc(O`touched`)} end as credential,
-        case when ${u} and touched.credential is null then (select coalesce(jsonb_agg(${Is(O`c`,O`s`)}), '[]'::jsonb)
-          from ${Qn} c join ${I} s on s.id = c.secret_id where c.organization_id = touched.organization_id
-          and (c.owner is null or c.owner = touched.requester)) end as credentials,
-        case when ${l} then ${sc(f)} end as config,
-        case when ${l} then ${cc(O`touched`)} end as runner,
-        case when ${u} then jsonb_build_object('rows', coalesce((select jsonb_agg(${d.value}->>'secret') from ${d}
-          where ${d.key} like ${m(p(O`'connection-secrets:' || touched.public_id || ':'`))} || '%' and ${h}), '[]'::jsonb),
-          'old', (select ${d.value} from ${d} where ${d.key} = ${p(O`'connection-secrets:' || touched.public_id`)} and ${h})) end as secrets,
-        case when ${l} then (select jsonb_build_object('key', ${d.key}, 'value', ${d.value}) from ${d}
-          where ${d.key} like ${m(p(O`'connections:' || touched.public_id || ':' || touched.generation || ':' || touched.attempts || ':'`))} || '%' and ${h} limit 1) end as resolved,
-        case when ${l} then (select coalesce(jsonb_object_agg(${d.key}, ${d.value}), '{}'::jsonb) from ${d} where ${h} and (
-          ${d.key} like any (select ${m(p(O`'token:' || key || ':'`))} || '%' from target)
-          or ${d.key} in (select ${p(O`'token-drop:' || key`)} from target union all select ${p(O`'token-drop:' || app`)} from target))) end as tokens
-      from touched`);if(!g)return;let _=Y(L,g.status),v=ys(_.organizationId,`snapshot`),y=(e,t)=>e?t(e):void 0;return{organizationId:_.organizationId,status:ms(_),...u?{loaded:{installation:y(g.installation,e=>zs(e).installation),credential:y(g.credential,e=>Ls(e).value),...g.credentials?{credentials:g.credentials.map(Ls)}:{},secrets:y(g.secrets,e=>({rows:e.rows,...e.old?{old:e.old}:{}})),...l?{app:y(g.app,e=>Ts(Y(nr,e.row),Y(I,e.sealed))),config:g.config??void 0,runner:y(g.runner,e=>Rs(e).value),resolved:y(g.resolved,e=>({id:e.key.slice(v.length),value:e.value})),tokens:Vs(_.organizationId,g.tokens??{})}:{}}}:{}}}async touch(e,t,n,r,i,a=!1){return(await this.authorize(t,n,r,e,i,{allowCompleted:a}))?.status}async patchTask(e,t,n,r,i={}){let{answer:a,archivedAt:o,autoArchived:s,lastSeenAt:c,logsComplete:l,...u}=n,[d]=await this.db.update(L).set({...Object.fromEntries(Object.entries(u).map(([e,t])=>[e,t??null])),...l===void 0?{}:{context:O`jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{runnerLogs}', coalesce(${L.context}->'runnerLogs', '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object('complete', ${l??null}::boolean, 'handle', ${L.handle}, 'attempts', ${L.attempts}, 'generation', ${L.generation})))`},...a===void 0?{}:{answer:O`coalesce(${L.answer}, '[]'::jsonb) || ${JSON.stringify([a])}::jsonb`},...Object.hasOwn(n,`archivedAt`)?{archivedAt:o===void 0?null:new Date(o)}:{},...Object.hasOwn(n,`lastSeenAt`)?{lastSeenAt:c===void 0?null:new Date(c)}:{},updatedAt:new Date(r)}).where(this.fence(e,t,i)).returning({id:L.id});return!!d}async archiveStopped(e,t,n){await this.db.update(L).set({archivedAt:new Date(t),updatedAt:new Date(t)}).where(F(e===void 0?void 0:P(L.organizationId,e),n?z(L.publicId,n):void 0,j(L.archivedAt),z(L.status,[...Te]),qn(O`coalesce(${L.finishedAt}, ${L.updatedAt})`,O`${new Date(t-ke).toISOString()}::timestamptz`)))}async requeue(e,t,n,r={}){let[i]=await this.db.update(L).set({status:`queued`,lockedAt:null,handle:null,tokenHash:null,lastSeenAt:null,updatedAt:new Date(n)}).where(this.fence(e,t,{...r,statuses:[`running`,`waiting`]})).returning({id:L.id});return!!i}connectionLock(e,t){return O`select pg_advisory_xact_lock(3, hashtext(${`app:${e}:connections:${t}`}))`}async deleteTask(e,t,n){let[r]=await Un(this.db,[this.connectionLock(e,t)],O`
-      with gone as (
-        delete from ${L} where ${this.fence(e,t,n)}
-        returning organization_id, public_id
-      ), marked as (
-        insert into ${lr} (organization_id, public_id, deleted_at)
-        select organization_id, public_id, clock_timestamp() from gone
-      ), connections as (delete from ${M} where ${Ks(e,t)} and exists (select 1 from gone))
-      select count(*)::int as deleted from gone`);return!!r?.deleted}async finish(e,t,n,r,i={}){let a=new Date(r),o=this.db.update(L).set({status:n.status,result:n.result??null,error:n.error??null,tokens:n.tokens??null,lastSeenAt:a,lockedAt:null,finishedAt:a,updatedAt:a}).where(this.fence(e,t,{...i,statuses:[`queued`,`running`,`waiting`]})).returning({id:L.id}),[s]=await Un(this.db,[this.connectionLock(e,t)],O`
-      with finished as (${o.getSQL()}), purged as (
-        delete from ${M} where ${Ks(e,t)} and exists (select 1 from finished)
-      ) select id from finished`);return!!s}async continueTask(e,t,n,r,i){let a=O`(${JSON.stringify(n.context??{})}::jsonb - 'connections' - 'engineChain' - 'engineCredentials') || jsonb_strip_nulls(jsonb_build_object('connections', ${L.context}->'connections', 'engineChain', ${L.context}->'engineChain', 'engineCredentials', ${L.context}->'engineCredentials'))`,[o]=await this.db.update(L).set({prompt:n.prompt??null,context:a,...n.definition?{definition:n.definition}:{},...n.usage?{usage:n.usage}:{},...n.tools?{tools:n.tools}:{},...`files`in n?{files:n.files??null}:{},...`permissions`in n?{permissions:n.permissions??null}:{},status:`queued`,attempts:0,generation:O`${L.generation} + 1`,inboxAck:-1,result:null,error:null,tokens:null,handle:null,tokenHash:null,lastSeenAt:null,logCursor:null,lockedAt:null,startedAt:null,finishedAt:null,cancelRequestedAt:null,approval:null,answer:null,archivedAt:null,updatedAt:new Date(r)}).where(this.fence(e,t,{...i,statuses:[`completed`,`failed`,`cancelled`]})).returning({context:L.context});return o&&(n.context=is(o.context).context),!!o}async completeTask(e,t,n,r){let{outcome:i,usage:a}=n,o=new Date(r).toISOString(),s=n.logsComplete?O`, context = jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{runnerLogs}', jsonb_strip_nulls(jsonb_build_object('complete', true, 'handle', ${L.handle}, 'attempts', ${L.attempts}, 'generation', ${L.generation})))`:O``,c=n.known?.length?O`, posts as (insert into ${M} (key, value, expires_at)
-      select key, ${JSON.stringify({at:r})}::jsonb, expires_at from (values ${O.join(n.known.map(t=>O`(${X(e,`delivery`,t.id)}, ${new Date(r+t.ttlMs).toISOString()}::timestamptz)`),O`, `)}) as row(key, expires_at) where exists (select 1 from finished)
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at)`:O``,[l]=await Un(this.db,[this.connectionLock(e,t)],O`
-    with finished as (
-      update ${L} set status = ${i.status}, result = ${JSON.stringify(i.result??null)}::jsonb,
-        error = ${i.error??null}, tokens = ${JSON.stringify(i.tokens??null)}::jsonb,
-        last_seen_at = ${o}::timestamptz, locked_at = null, finished_at = ${o}::timestamptz, updated_at = ${o}::timestamptz${s}
-      where ${this.fence(e,t,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]})}
-      returning id, installation_id, generation
-    ), connections as (delete from ${M} where ${Ks(e,t)} and exists (select 1 from finished)), inbox as (delete from ${R} where (task_id, generation) in (select id, generation from finished))${c}, recorded as (
-      insert into ${ur} (organization_id, task_id, installation_id, agent, target, engine, model, credential, runner_ms, tokens, at, updated_at)
-      select ${e}, id, installation_id, ${a.agent}, ${a.target}, ${a.engine??null}, ${a.model??null},
-        ${a.credential}, ${a.runnerElapsedMs}, ${JSON.stringify(a.tokens??null)}::jsonb, ${new Date(a.at).toISOString()}::timestamptz, ${o}::timestamptz from finished
-      on conflict (task_id) do update set installation_id = excluded.installation_id, agent = excluded.agent, target = excluded.target,
-        engine = excluded.engine, model = excluded.model, credential = excluded.credential, runner_ms = ${ur.runnerMs} + excluded.runner_ms,
-        tokens = ${lc(O`${ur.tokens}`,a.tokens)}, at = excluded.at, updated_at = excluded.updated_at
-    )
-    select exists (select 1 from finished) as completed`);return!!l?.completed}async cancel(e,t,n,r={}){let i=new Date(n).toISOString(),[a]=await Un(this.db,[this.connectionLock(e,t)],O`
-    with cancelled as (
-      update ${L} set status = case when status = 'queued' then 'cancelled' else status end,
-        finished_at = case when status = 'queued' then ${i}::timestamptz else finished_at end,
-        inbox_seq = case when status = 'queued' then inbox_seq else inbox_seq + 1 end,
-        cancel_requested_at = ${i}::timestamptz, updated_at = ${i}::timestamptz
-      where ${this.fence(e,t,{...r,statuses:Q})} returning id, generation, inbox_seq, status
-    ), connections as (delete from ${M} where ${Ks(e,t)} and exists (select 1 from cancelled where status = 'cancelled')), message as (
-      insert into ${R} (organization_id, task_id, seq, generation, kind, value, at)
-      select ${e}, id, inbox_seq, generation, 'cancel', 'null'::jsonb, ${i}::timestamptz from cancelled where status in ('running', 'waiting')
-    ) select exists(select 1 from cancelled) as accepted`);return!!a?.accepted}async cancelRequested(e,t){let[n]=await D(this.db,()=>this.db.select({at:L.cancelRequestedAt}).from(L).where(this.where(e,t)));return!!n?.at}filter(e,t){let n=t.status?[t.status]:t.statuses,r=t.q?.trim(),i=r&&`%${r.replace(/[\\%_]/g,`\\$&`)}%`;return F(P(L.organizationId,e),n?z(L.status,n):void 0,t.agent?P(L.agent,t.agent):void 0,t.source?P(L.source,t.source):void 0,t.reviewKey?P(L.reviewKey,t.reviewKey):void 0,t.archived===void 0?void 0:t.archived?fr(L.archivedAt):j(L.archivedAt),i?Jn(Yn(O`${L.event}->>'text'`,i),Yn(L.prompt,i),Yn(L.agent,i),Yn(L.publicId,i)):void 0)}pageQuery(e,t){let{before:n}=t,r=t.summary?{publicId:L.publicId,source:L.source,agent:L.agent,flow:L.flow,prompt:L.prompt,event:O`case when ${L.event} is not null then jsonb_build_object('integration', ${L.event}->>'integration', 'type', ${L.event}->>'type', 'text', ${L.event}->>'text') end`.as(`event`),status:L.status,attempts:L.attempts,approval:L.approval,archivedAt:L.archivedAt,createdAt:L.createdAt,startedAt:L.startedAt,finishedAt:L.finishedAt,updatedAt:L.updatedAt}:Kn(L),i=this.db.select(r).from(L).where(F(this.filter(e,t),t.since===void 0?void 0:Jn(tr(L.updatedAt,new Date(t.since)),t.sinceId?F(P(L.updatedAt,new Date(t.since)),tr(fc(L.publicId),t.sinceId)):void 0),n?this.after(n):void 0)).orderBy(...t.since===void 0?pc(L):mc(L));return t.limit===void 0?i:i.limit(t.limit)}after(e){if(`updatedAt`in e)return Jn(tr(L.updatedAt,new Date(e.updatedAt)),F(P(L.updatedAt,new Date(e.updatedAt)),tr(fc(L.publicId),e.id)));let t=O`(${dc(L.createdAt)}, ${fc(L.publicId)}) < (${new Date(e.createdAt).toISOString()}::timestamptz, ${e.id})`;return Jn(tr(uc(L.status),e.rank),F(P(uc(L.status),e.rank),t))}record(e,t){return t?ss({task:ss({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,prompt:e.prompt,event:e.event}),status:e.status,attempts:e.attempts,approval:e.approval,archivedAt:e.archivedAt?q(e.archivedAt):void 0,createdAt:q(e.createdAt),startedAt:e.startedAt?q(e.startedAt):void 0,finishedAt:e.finishedAt?q(e.finishedAt):void 0,updatedAt:q(e.updatedAt)}):ms(e)}async list(e,t={}){return(await D(this.db,()=>this.pageQuery(e,t))).map(e=>this.record(e,t.summary))}async changes(e,t){if(!e.length)return{rows:[],deleted:[]};let n=e.map(e=>e.organizationId),r=e.flatMap(e=>e.ids.map(()=>e.organizationId)),i=e.flatMap(e=>e.ids),a=i.length?O`(${L.organizationId}, ${L.publicId}) in (select * from unnest(${O.param(r)}::text[], ${O.param(i)}::text[]))`:O`false`,[o,s]=await Promise.all([D(this.db,()=>this.db.select({organizationId:L.organizationId,publicId:L.publicId,source:L.source,agent:L.agent,flow:L.flow,status:L.status,approval:L.approval,answer:O`case when ${a} then ${L.answer} end`,result:O`case when ${a} then ${L.result} end`,error:O`case when ${a} then ${L.error} end`,attempts:L.attempts,archivedAt:L.archivedAt,createdAt:L.createdAt,startedAt:L.startedAt,finishedAt:L.finishedAt,updatedAt:L.updatedAt}).from(L).where(Jn(F(z(L.organizationId,n),tr(L.updatedAt,new Date(t))),i.length?a:void 0))),D(this.db,()=>this.db.select().from(lr).where(F(z(lr.organizationId,n),tr(lr.deletedAt,new Date(t)))))]);return{rows:o.map(e=>({organizationId:e.organizationId,status:ss({task:{id:e.publicId,source:e.source,agent:e.agent,flow:e.flow},status:e.status,approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,result:e.result,error:e.error,attempts:e.attempts,archivedAt:e.archivedAt&&q(e.archivedAt),createdAt:q(e.createdAt),startedAt:e.startedAt&&q(e.startedAt),finishedAt:e.finishedAt&&q(e.finishedAt),updatedAt:q(e.updatedAt)})})),deleted:s.map(e=>({organizationId:e.organizationId,id:e.publicId,at:q(e.deletedAt)}))}}countQuery(e,t){return this.db.select({all:O`count(*)::int`.as(`all`),active:O`(count(*) filter (where ${z(L.status,Q)}))::int`.as(`active`),waiting:O`(count(*) filter (where ${P(L.status,`waiting`)}))::int`.as(`waiting`)}).from(L).where(this.filter(e,t))}async counts(e,t={}){let[n]=await D(this.db,()=>this.countQuery(e,t));return n??{all:0,active:0,waiting:0}}async listWithCounts(e,t){let n=this.db.$with(`totals`).as(this.countQuery(e,t)),r=this.db.$with(`page`).as(this.pageQuery(e,{...t,limit:t.limit??20})),i=Object.fromEntries(Object.keys(r._.selectedFields).map(e=>[e,r[e]])),a=await D(this.db,()=>this.db.with(n,r).select({...i,all:n.all,active:n.active,waiting:n.waiting}).from(n).leftJoin(r,O`true`).orderBy(...t.since===void 0?pc({status:i.status,createdAt:i.createdAt,publicId:i.publicId}):mc({updatedAt:i.updatedAt,publicId:i.publicId}))),{all:o=0,active:s=0,waiting:c=0}=a[0]??{};return{items:a.filter(e=>e.publicId!==null&&e.publicId!==void 0).map(e=>this.record(e,t.summary)),counts:{all:o,active:s,waiting:c}}}async runningCount(){let[e]=await D(this.db,()=>this.db.select({value:O`count(*)::int`}).from(L).where(z(L.status,[`running`,`waiting`])));return e?.value??0}async running(){return(await D(this.db,()=>this.db.select().from(L).where(z(L.status,[`running`,`waiting`])))).map(e=>({organizationId:e.organizationId,status:ms(e)}))}async appendLogs(e,t,n,r,i,a,o){let s=n.length?O`, inserted as (
-      insert into ${cr} (organization_id, task_id, seq, at, level, line)
-      select ${e}, accepted.id, entry.seq, to_timestamp(entry.at / 1000.0), entry.level, entry.line
-      from accepted cross join jsonb_to_recordset(${JSON.stringify(n)}::jsonb) as entry(seq int, at bigint, level text, line text)
-    )`:O``,[c]=await bs(this.db,O`
-      with accepted as (
-        update ${L} set log_cursor = ${i.cursor}, log_seq = ${i.seq}, log_bytes = ${i.bytes}, updated_at = ${new Date(a).toISOString()}::timestamptz
-        where ${this.fence(e,t,o)} and coalesce(log_seq, 0) = ${r.seq} and coalesce(log_cursor, -1) = ${r.cursor}
-        returning id
-      ) ${s} select exists (select 1 from accepted) as accepted`);return!!c?.accepted}async readInbox(e,t,n,r){return(await D(this.db,()=>this.db.select({seq:R.seq,generation:R.generation,at:R.at,kind:R.kind,value:R.value}).from(R).innerJoin(L,P(L.id,R.taskId)).where(F(this.where(e,t),P(L.generation,n),z(L.status,Q),P(R.generation,n),O`${R.seq} > ${r}`)).orderBy(N(R.seq)).limit(100))).map(e=>({...e,at:q(e.at)}))}async appendInbox(e,t,n,r,i,a,o){let s=o?O`select key, value from ${M}
-          where key = ${X(e,`delivery`,o.key)}
-            and value->'sending'->>'owner' = ${o.owner}
-            and (expires_at is null or expires_at > ${new Date(i).toISOString()}::timestamptz) for update`:O`select null`,c=o&&fp(o),l=c?O`, context = coalesce(${L.context}, '{}'::jsonb) || jsonb_build_object('admissions',
-          coalesce(${L.context}->'admissions', '{}'::jsonb) || ${JSON.stringify(c)}::jsonb)`:O``,u=O`(${M.value}->'sending'->>'count')::int`,d=O`coalesce((select n from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= ${u} and item->>'admission' = ${o?.through??null}::text limit 1), 0)`,[f]=await bs(this.db,O`
-      with held as materialized (${s}), next as (
-        update ${L} set inbox_seq = inbox_seq + 1, updated_at = ${new Date(i).toISOString()}::timestamptz${l}
-        where ${this.fence(e,t,{generation:a,statuses:Q})}
-          and exists(select 1 from held) returning id, inbox_seq, generation
-      ), admitted as (
-        insert into ${R} (organization_id, task_id, seq, generation, kind, value, at)
-        select ${e}, id, inbox_seq, generation, ${n}, ${JSON.stringify(c?{...r,admissions:c}:r??null)}::jsonb, ${new Date(i).toISOString()}::timestamptz from next returning seq
-      ) ${o?O`, acknowledged as (
-        update ${M} set value = (${M.value} - 'sending') || jsonb_build_object(
-          'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n) where n > ${d}), '[]'::jsonb)) ||
-          case when ${u} > ${d} then jsonb_build_object('sending',
-            (${M.value}->'sending') || jsonb_build_object('count', ${u} - ${d}, 'until', ${i+Ln}::bigint)) else '{}'::jsonb end
-        where key in (select key from held) and exists(select 1 from admitted)
-      )`:O``}
-      select (select seq from admitted) as seq, exists(select 1 from held) as held`);if(o&&!f?.held)throw new pp;return f?.seq==null?void 0:{seq:f.seq,generation:a,at:i,kind:n,value:r}}async fetchInbox(e,t,n,r,i){let[a]=await D(this.db,()=>bs(this.db,O`
-      select coalesce(jsonb_agg(jsonb_build_object('seq', i.seq, 'generation', i.generation, 'at', extract(epoch from i.at) * 1000, 'kind', i.kind, 'value', i.value) order by i.seq) filter (where i.seq is not null), '[]'::jsonb) as entries
-      from ${L} left join ${R} i on i.task_id = ${L.id} and i.generation = ${L.generation} and i.seq > ${i}
-      where ${this.fence(e,t,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})} group by ${L.id}`));return a?.entries}async ackInbox(e,t,n,r){if(r.generation!==void 0&&r.generation!==n.generation)return;let[i]=await Un(this.db,[this.connectionLock(e,t)],O`
-    with current as (
-      select id from ${L} where ${this.fence(e,t,{...r,generation:n.generation,statuses:void 0})}
-        and inbox_seq >= ${n.seq} and (status in ('running', 'waiting') or (status in ('completed', 'failed', 'cancelled') and inbox_ack >= ${n.seq})) for update
-    ), applied as (
-      delete from ${R} where task_id in (select id from current) and generation = ${n.generation} and seq <= ${n.seq} returning seq, kind, value
-    ), answers as (
-      select jsonb_agg(a.value order by a.seq) as value from jsonb_to_recordset(${JSON.stringify(n.answers??[])}::jsonb) a(seq int, value jsonb)
-      where exists (select 1 from applied where applied.seq = a.seq and applied.kind = 'ask')
-    ), updated as (
-      update ${L} set inbox_ack = greatest(inbox_ack, ${n.seq}), answer = coalesce(answer, '[]'::jsonb) || coalesce(answers.value, '[]'::jsonb),
-        status = case when exists(select 1 from applied where kind = 'cancel') then 'cancelled'
-          when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${L.approval}->>'id') then 'running' else status end,
-        approval = case when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${L.approval}->>'id') then null else approval end,
-        finished_at = case when exists(select 1 from applied where kind = 'cancel') then now() else finished_at end,
-        updated_at = now()
-      from answers where id in (select id from current) returning status
-    ), connections as (delete from ${M} where ${Ks(e,t)} and exists (select 1 from updated where status = 'cancelled'))
-    select exists (select 1 from current) as accepted, (select status from updated) as status`);return i?.accepted?i.status??void 0:void 0}async pendingInbox(e){return(await D(this.db,()=>this.db.select().from(L).where(F(e===void 0?void 0:P(L.organizationId,e),z(L.status,[`running`,`waiting`]),O`exists (select 1 from ${R} where ${R.taskId} = ${L.id} and ${R.generation} = ${L.generation})`)))).map(e=>({organizationId:e.organizationId,status:ms(e)}))}};const gc=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function _c(e,t,n){n.length&&await e.store.withAppLock(`connection-warnings:${t}`,async r=>{let i=r instanceof ec?new hc(r.db):e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`connection-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`connection-warning:${t}:${e}`,{at:c});return}}})}async function vc(e,t,n,r,i,a=0){let o=yc(n,r,i,a);return await e.putMany(`tasklog`,o.lines.map(({seq:e,...n})=>({id:gc(t,e),value:n}))),{seq:o.seq,bytes:o.bytes}}function yc(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function bc(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:gc(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=Pt(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function xc(e,t,n=!1){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]);n&&i.delete(a);let o=i.get(a);return o||(o=ld(e,t).then(e=>{let t=e.sort((e,t)=>t.length-e.length);return e=>t.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e)}).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.()),o}async function Sc(e,t,n){let r=await xc(e,t),i=e=>typeof e==`string`?r(e):Array.isArray(e)?e.map(i):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[r(e),i(t)])):e,a=e=>{try{return JSON.stringify(i(JSON.parse(e)))}catch{return r(e)}};for(let r=0;r<5;r++){let i=r===0&&e.callbackTask===t?t:await e.store.get(`task`,t.task.id);if(!i||i.attempts!==t.attempts||i.tokenHash!==t.tokenHash||i.generation!==t.generation)return`stale`;let o=i.logCursor??-1,s=n.filter(e=>e.seq>o);if(!s.length)return`ok`;if(i.logsComplete||s[0].seq!==o+1)return`gap`;let c=(e.now??Date.now)(),l=yc(s.map(e=>({...e,line:a(e.line)})),i.logSeq??0,c,i.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,l.lines,{seq:i.logSeq??0,cursor:o},{seq:l.seq,cursor:s.at(-1).seq,bytes:l.bytes},c,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}function Cc(e,t){return Br(e,`link-start`,`*`,JSON.stringify(t),3e5)}function wc(e,t,n){return`thread:${e}:${t}:${n}`}async function Tc(e,t,n,r){let i={};if(r)i.user={name:r.name,email:r.email};else if(r===void 0&&e.auth&&n.actor.id){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);r&&(i.user={name:r.name,email:r.email})}return i}const Ec=2592e6,Dc=36e5;async function Oc(e,t){if(!t.chat)return{};let n=kc(t);return e.store.conversationState(n)}const kc=e=>wc(e.appId,e.installationId,e.chat.thread.id),Ac=e=>e.slice(0,e.indexOf(`:`)),jc=e=>e.channelId?.slice((e.adapterName?.length??-1)+1)??``;function Mc(e,t,n,r){return`known:${e}:${t}:${n}:${r}`}async function Nc(e,t){return t.chat?(await e.store.conversationState(kc(t))).status:void 0}function Pc(e,t,n){let r=e.chat?.thread;if(!r)return;let i=r.id.slice((r.channelId?.length??-1)+1);return{key:kc(e),record:{at:n,taskId:t,...e.chat?.message?{seen:e.chat.message.id}:{}},root:Mc(e.appId,e.installationId,jc(r),i),ttlMs:Ec}}async function Fc(e,t,n,r){let i=Pc(t,n,r);i&&await e.store.putMany(`delivery`,[{id:i.key,value:i.record},{id:i.root,value:{at:r}}],{ttlMs:Ec})}function Ic(e,t){let n=e.chat?.thread;return n?[...new Set([t].flat().filter(Boolean))].map(t=>Mc(e.appId,e.installationId,jc(n),t)):[]}async function Lc(e,t,n,r){await e.store.putMany(`delivery`,Ic(t,n).map(e=>({id:e,value:{at:r}})),{ttlMs:Ec})}async function Rc(e,t,n,r){if(t.chat?.message)return e.store.markConversation(kc(t),n,t.chat.message.id,r,Ec)}function zc(e){let t=e.conversation?.unseen;return e.chat&&t!==void 0?{key:kc(e),version:t.version,...t.epoch?{epoch:t.epoch}:{}}:void 0}async function Bc(e,t,n){await e.store.appendUnseen(kc(t),n,Ec)}async function Vc(e,t){let n=zc(t);n&&await e.store.acknowledgeUnseen(n.key,n.version,n.epoch)}function Hc(e,t,n){let r=gt(n.definition.integrations[e.id]);return!t.builtin&&Object.entries(e.events).some(([e,t])=>t.noisy&&r.includes(e))}async function Uc(e,t,n,r){let i=n.chat?.thread;if(!i)return n;let a=i.isDM===!0,o=t.events[n.type]?.on===`mention`||n.chat?.message?.isMention===!0,s=a||o||t.answersEveryPrompt===!0,[c,l]=await Promise.all([r.loaded?r.unseen??{messages:[],more:0}:e.store.get(`delivery`,`since:${kc(n)}`).then(e=>e??{messages:[],more:0}),t.conversation?t.conversation(n,{token:r.token,fetch:e.fetch??fetch,delivered:r.delivered,...r.existing?.seen?{after:r.existing.seen}:{}}).catch(e=>(console.error(`coder server: ${t.id} conversation facts failed`,e),{})):{}]),u=new Set(c.messages.flatMap(e=>e.id??[])),d=new Map(l.since?.flatMap(e=>e.id?[[e.id,e]]:[])),f=[...c.messages.map(({sequence:e,...t})=>t.id&&d.get(t.id)||t),...(l.since??[]).filter(e=>!e.id||!u.has(e.id))],p=f.slice(0,50),m=(l.since?0:c.more)+f.length-p.length,h=r.existing||a?void 0:l.index??n.conversation?.index;return{...n,mustReply:s,conversation:{...h===void 0?{}:{index:h},...c.messages.length||c.more?{unseen:{version:c.version??c.messages.length+c.more,epoch:c.epoch}}:{},...p.length?{since:p}:{},...m?{more:m}:{}}}}async function Wc(e,t,n){for(;;){let r=await e.store.claimBatch(t,n);if(r!==null)return r;await new Promise(e=>setTimeout(e,500))}}async function Gc(e,t,n,r,i){return e.store.finishBatch(t,n,r,i)}async function Kc(e,t,n,r){let i=await e.store.get(`task`,t.task.id)??t,a=Ac(n),o=await Dp(e,t.task.id,-1,i.generation??0),s=new Set([i.task.context?.admissions?.[a],...o.map(e=>e.value?.admissions?.[a])]);return{fresh:i,through:r.reduce((e,t,n)=>s.has(t.admission)?n+1:e,0)}}async function qc(e,t,n,r){if(!Q.includes(t.status))return!1;let i=t.status!==`queued`&&Jc(e,t.task)?Od(e.local.cwd,t.task.id,!1):void 0;return i&&!Q.includes(i.status)?!1:!!await Ep(e,t,`steer`,{text:n},r)}const Jc=(e,t)=>!!e.local&&!t.event?.repo&&t.runner===`local`&&!t.runnerId;async function Yc(e,t,n,r,i){let{task:a}=t,o={mustReply:r,admissions:{...a.context?.admissions,...i}};if(Jc(e,a))return kd(e,e.local.cwd,a.id,n,void 0,{},o);try{await bo(e,{...t,task:{...a,context:{...a.context,...o}}},n)}catch(e){if(e instanceof W&&e.status===409)return!1;throw e}return!0}function Xc(e,t){let n=t.catch(e=>console.error(`coder server: conversation batch failed`,e));e.waitUntil&&e.waitUntil(n)}function Zc(e){let t=t=>zt(e.slice(0,t).map(e=>e.event),e[t-1].user),n=t(1);if(n.length>65536){let t=e[0].event,n=n=>zt([{...t,text:t.text.slice(0,n)+`
-[message truncated]`}],e[0].user);n(0).length>65536&&(t={...t,conversation:{...t.conversation,since:void 0,more:(t.conversation?.more??0)+(t.conversation?.since?.length??0)},promptContext:void 0,chat:t.chat?{thread:t.chat.thread,message:t.chat.message?{...t.chat.message,attachments:[],links:[]}:void 0}:void 0});let r=0,i=t.text.length;for(;r<i;){let e=Math.ceil((r+i)/2);n(e).length<=65536?r=e:i=e-1}return{text:n(r),count:1}}let r=1;for(;r<e.length;){let e=t(r+1);if(e.length>65536)break;n=e,r++}return{text:n,count:r}}async function Qc(e,t,n,r,i,a){let o=`batch:${kc(n)}`;if(!(a?a.batch:await e.store.get(`delivery`,o))?.items.length&&await qc(e,t,zt([n],r))){await Vc(e,n),await Rc(e,n,t.task.id,i());return}let s=Er(),c=n.chat?.message,l=c?{...n,chat:{thread:n.chat.thread,message:{...c,formatted:{type:`root`,children:[]},raw:null,attachments:c.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}}}:n;await e.store.appendBatch(o,s,[{admission:s,event:l,user:r}],i(),Dc),await Vc(e,n),Xc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.steerBatchMs??5e3));let n=await Wc(e,o,s);if(!n)return;let r=n.items.map((e,t)=>t===n.items.length-1?{...e,event:{...e.event,mustReply:e.event.mustReply||n.mustReply,conversation:{...e.event.conversation,more:(e.event.conversation?.more??0)+(n.more??0)}}}:e),a=!1,c=!1,l=!1;try{for(let n=0;n<r.length;){let{fresh:a,through:u}=await Kc(e,t,o,r);if(u>n){if(c=!0,!await Gc(e,o,s,!0,r[u-1].admission))return;n=u;continue}let{text:d,count:f}=Zc(r.slice(n)),p=r.slice(n,n+f),m=p.at(-1).admission,h=await qc(e,a,d,{key:o,owner:s,through:m}),g=h||await Yc(e,a,d,p.some(e=>e.event.mustReply===!0),{[Ac(o)]:m});if(!g&&!l){l=!0;continue}if(!g)throw Error(`Conversation task did not accept the batch`);if(c=!0,!h&&!await Gc(e,o,s,!0,m))return;await Rc(e,p.at(-1).event,t.task.id,i()),n+=f}a=!0}catch(e){if(!(e instanceof pp))throw e}finally{a||await Gc(e,o,s,!1),c&&await zo(e,!0,!1,!0)}})())}async function $c(e,t,n,r){let i=await Nc(e,t);if(!i||!Q.includes(i.status))return;let a=`reactions:${kc(t)}`,o=Er();await e.store.appendBatch(a,o,[{...n,admission:o}],r(),Dc),Xc(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.reactionBatchMs??3e4));let n=await Wc(e,a,o);if(!n)return;let r=!1;try{let{fresh:s,through:c}=await Kc(e,i,a,n.items),l=n.items.slice(c);if(c&&!await Gc(e,a,o,!0,n.items[c-1].admission))return;if(!l.length){r=!0;return}let u=new Map;for(let{emoji:e,by:t,on:n}of l){let r=u.get(`${e}\n${n}`)??{emoji:e,by:[],on:n};r.by.includes(t)||r.by.push(t),u.set(`${e}\n${n}`,r)}r=await qc(e,s,Lt({...t,conversation:{...t.conversation,more:n.more}},[...u.values()]),{key:a,owner:o,through:l.at(-1).admission})}catch(e){if(!(e instanceof pp))throw e}finally{r||await Gc(e,a,o,!1)}})())}const el=6e4,tl=864e5,nl=262144,rl=[`model`,`engine`,`effort`],il=[`Usage:`,"• `/setup model <name>`. Sets the engine model. Also accepts `engine` and `effort`.","• `/setup show`. Shows the current settings."].join(`
-`);function al(e){return e.type===`command`}function ol(e){let t=Object.entries(e??{}).filter(([,e])=>e);return t.length?`Current settings:\n${t.map(([e,t])=>`• ${e}: \`${t}\``).join(`
-`)}`:`No settings yet. A workspace admin can configure this agent in the dashboard.`}function sl(e){let[t=``,...n]=e.text.trim().split(/\s+/);return rl.includes(t)&&n.join(` `).trim()!==``}async function cl(e,t,n){let[r=``,...i]=e.text.trim().split(/\s+/),a=i.join(` `).trim(),o={...t.settings},s;return r?r===`show`?s=ol(t.settings):rl.includes(r)?a?(o[r]=a,s=`${r} set to \`${a}\`.`):s=`Give a value: \`/setup ${r} <name>\`.`:s=`Unknown setting \`${r}\`.\n${il}`:s=il,JSON.stringify(o)!==JSON.stringify(t.settings??{})&&await Ka(n,`installation`,t.id,{settings:o}),s}async function ll(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}async function ul(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}async function dl(e,t,n,r){if(!t.auth.canWrite)return;let i=await(await r(n.integration)).token();return t.auth.canWrite(n,i,e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed for ${n.appId} event ${n.deliveryId}`,e),null))}async function fl(e,t,n,r,i){let a=e.config.publicUrl?.replace(/\/$/,``);if(!a)return;let o=e=>`Link your Coder account so I can work for you here: ${e}`;if(t.auth.user){await i.post(o(`${a}/connect/${t.id}?installation=${encodeURIComponent(n.id)}`));return}let s=await Cc(e,{platform:t.id,platformUserId:r.actor.id});await i.whisper(o(`${a}/connect?token=${encodeURIComponent(s)}`))}async function pl(e,t,n){return`No model is configured yet. If you have access to it, [add one here](${await _f(e,t,n)}).`}async function ml(e,t,n){return`There was a problem with your connected model. If you have access to it, [check it here](${await _f(e,t,n)}).`}async function hl(e,t,n){let r=e.config.publicUrl?.replace(/\/$/,``);return r?`${r}${ph(n,`/tasks/${t}`)}`:void 0}async function gl(e,t,n){let r=t.chat?.thread.id;if(!e.local||t.repo||!r)return;let i=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(({value:e})=>{let i=e.pending?.task;return i?.flow==="default"&&i.agent===n&&i.event?.appId===t.appId&&i.event.installationId===t.installationId&&i.event.chat?.thread.id===r&&e.pending?.taskId})?.value.pending;if(!i?.task)return;let a=await Td(e,i.task,i.taskId);return await Fc(e,i.task.event,a.task.id,(e.now??Date.now)()),await e.store.get(`task`,a.task.id)??a}async function _l(e,t,n,r,i,a,o){let s=`delivery:${t.id}:${n.id}:${i.installationId}:${i.chat?.thread.id??``}:${i.deliveryId}`,c=await ll(e,n,i);if(!c)return{};if(e.local&&await(e.syncAgent?.(n.agent)??An(e.store,e.local.cwd,e.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e)),!e.local){let l=Er(),u={delivery:{key:s,owner:l,at:a(),ttlMs:el},agent:n.agent,...i.chat?{conversation:wc(i.appId,i.installationId,i.chat.thread.id)}:{},...i.actor.id?{actor:{platform:t.id,id:i.actor.id}}:{},installation:c,files:Ea(c,i)},{claimed:d,loaded:f}=await e.store.dispatchState(u);if(!d)return{};let p=f?{...e,store:Ao(e.store,f,u)}:e;if((await p.store.get(`agent`,n.agent))?.settings?.disabled)return await e.store.updateDelivery(s,l,void 0),{};try{let u=await yl(p,t,n,r,i,c,a,o,s,{owner:l,loaded:f&&{...f,store:p.store}});return!u.work&&!u.taskId&&!u.steered&&await e.store.updateDelivery(s,l,{at:a()},{ttlMs:tl}),await u.work,u.taskId?{taskId:u.taskId}:{}}catch(t){let n=await e.store.get(`delivery`,s).catch(()=>void 0),r=n?.pending?.task?n.pending:void 0;throw await e.store.updateDelivery(s,l,r?{at:a(),pending:r}:void 0).catch(()=>{}),t}}if((await e.store.get(`agent`,n.agent))?.settings?.disabled||await e.store.get(`delivery`,s).then(e=>e&&!e.pending))return{};let l=JSON.stringify([i.appId,i.installationId,i.chat?.thread.id]),u=e.store.handoffs??=new Map,d=(u.get(l)??Promise.resolve()).catch(()=>{}).then(async()=>{let l=await yl(e,t,n,r,i,c,a,o,s);return await l.work,l});u.set(l,d);try{return await d}finally{u.get(l)===d&&u.delete(l)}}async function vl(e,t,n,r,i,a,o,s){let c=s??Er(),l=a&&(a.flow==="default"?Fe():jt()),u=l&&a?.taskUrl?await hl(e,l,await(o?.()??fh(e))):void 0,d={event:n,...a?{task:{...a,...u?{taskUrl:u}:{}},taskId:l}:{}};if(e.local&&!n.repo){let n=await e.store.get(`delivery`,t);if(n&&!n.pending)return{};if(d=n?.pending??d,d.task&&!d.taskId)throw Error(`Local delivery has no task binding`);await e.store.put(`delivery`,t,{at:r(),owner:c,pending:d})}else if(!s&&!await e.store.create(`delivery`,t,{at:r(),owner:c,pending:d},{ttlMs:el}))return{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,c,{at:r(),owner:c,pending:d},{ttlMs:el})}).catch(()=>{})},el/3);try{await i(d),a&&clearInterval(a),await n,await e.store.updateDelivery(t,c,{at:r()},{ttlMs:tl})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!d.task)&&await e.store.updateDelivery(t,c,void 0).catch(()=>{}),r}})()}}async function yl(e,t,n,r,i,a,o,s,c,l){let u,d=()=>u??=fh(e,l?.loaded?.workspace),f=t=>vl(e,c,i,o,t,void 0,d,l?.owner);if(al(i))return e.auth&&sl(i)&&!await ul(e,t,i)?f(()=>fl(e,t,a,i,s)):f(()=>cl(i,a,e.store).then(e=>s.whisper(e)).then(()=>{}));let p=Xu(e,t,a,i,r),[m,h]=await Promise.all([e.loadAgent(n,a,i,p,l?.loaded),e.auth&&i.actor.id?ul(e,t,i):void 0]),g=Yt(i,m);if(!g){let t=i.chat?.message;return t&&await Bc(e,i,{id:t.id,author:t.author.userName||t.author.userId,text:i.text,sentAt:t.metadata.dateSent}),{}}let _=await dl(e,t,i,p);if(_===null)return f(async()=>{await s.problem(`Coder could not check your access to this conversation.`)});if(_===!1)return{};let v=(t,n,r)=>vl(e,c,i,o,async t=>{let i=t.task,a=await Td(e,i,t.taskId);await Promise.all([Fc(e,i.event,a.task.id,o()),Vc(e,i.event)]),await sp(e,a.task.id,[...p.minted,...r?[r]:[]]),n&&ge(e.local.cwd,a.task.id,{kind:`status`,message:n})},t,d);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,c);if(t?.pending?.task){let e=t.pending.task;return e.agent!==m.id||e.flow!==g.flow?{}:v(e)}}let y=!!i.chat&&g.flow==="default",ee=y?await Oc(e,i):void 0,te=ee?.record,ne=y?await Uc(e,t,i,{token:async()=>(await p(i.integration))?.token(),delivered:Hc(t,n,m),unseen:ee?.unseen,loaded:!0,...te?{existing:te}:{}}):i,re=h?{name:h.name,email:h.email}:void 0,ie=y?ee?.status??await gl(e,ne,m.id):void 0;if(ie)return f(()=>Qc(e,ie,ne,re,o,ee));let b=!y||ne.chat?.thread.isDM===!0,ae=b?h?.id:void 0,oe=b?g.actAs:void 0,se=ct(m),[ce,le,ue,de,fe]=await Promise.all([bn(e,{requester:ae,agent:m.definition.runner}),af(e,se,ae),Tc(e,t,i,h??null),da(e,ae,m.usage?.connections),oe===`requester`?Ju(e,t,i,r).catch(()=>void 0):void 0]),{engine:pe,credential:me,usable:he,chain:x,credentials:_e}=le;if(!he&&ce.runner!==`http`)return ne.mustReply??t.events[i.type]?.on===`mention`?f(async()=>{let r=`setup:${n.id}:${i.chat?.thread.id??i.deliveryId}`,a=i.deliveryId;if(!(!(t.answersEveryPrompt||await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5}))&&(await e.store.get(`delivery`,r))?.owner!==a))try{await s.problem(await pl(e,pe,await d()))}catch(n){throw t.answersEveryPrompt||await e.store.updateDelivery(r,a,void 0),n}}):{};let ve=e.auth&&oe===`requester`&&!fe?`Acting as the app because the requester's account has no usable ${t.name} token. [Connect your account](${e.config.publicUrl?.replace(/\/$/,``)??``}${ph(await d(),`/settings/connections`)}).`:void 0;if(ve&&(ue.instructions=[ue.instructions,ve,`Include the account connection link in your reply.`].filter(Boolean).join(`
-
-`)),Buffer.byteLength(JSON.stringify(i))>nl)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(ue))>nl)throw Error(`Task context exceeds 256 KB`);let ye=`${i.deliveryId}-${m.id}`,be=await hl(e,ye,await d()),xe={id:ye,source:i.integration,agent:m.id,flow:g.flow,...ce,permissions:g.permissions??se.permissions,event:ne,failureReply:await ml(e,pe,await d()),...be?{taskUrl:be}:{},author:t.author?.(n.name)??n.name,definition:m.definition,engineChain:x,engineCredentials:_e,...me?{credential:me}:{},...ae?{requester:ae}:{},...m.files?{files:m.files}:{},usage:{...m.usage,engine:pe},tools:g.tools,connections:de,...Object.keys(ue).length?{context:ue}:{}};if(e.local&&!i.repo&&ce.runner===`local`&&!ce.runnerId)return v(xe,ve,fe);let Se=o(),Ce=await e.queue.deliver(e.organizationId,xe,Se,{key:c,ttlMs:tl,...l?{owner:l.owner}:{}},y?zt([ne],re):void 0,e.config.maxQueued??1e3,!0,{conversation:Pc(ne,ye,Se),unseen:zc(ne),secrets:op(e,ye,[...p.minted,...fe?[fe]:[]])});return ve&&Ce.taskId&&await _c(e,Ce.taskId,[ve]),Ce}var bl=r({failedDeliveries:()=>Sl,recordFailure:()=>xl});async function xl(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await Ii(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
-`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??Er()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:tl})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a))try{await(await a()).problem(n instanceof ht?n.message:`Coder could not handle this message. If you run this server, check its logs. Otherwise report it at ${e.config.issuesUrl}.`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function Sl(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}var Cl=r({adapterContext:()=>Ul,addressedTo:()=>Ml,chatFor:()=>Wl,dashUrl:()=>Hl,deliver:()=>Fl,eventReplies:()=>Ll,later:()=>Pl,threadReplies:()=>Il});async function wl(e,t,n){let r=`${t.id}:${n}`,i=await Ii(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function Tl(e,t,n,r,i){let{tenant:a,installation:o}=await wl(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return qu(a,e.integrations[t.integration],o,n,i)}function El(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const Dl=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),Ol=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),kl=`(?![\\w-]|\\.\\w)`,Al=e=>e.replace(/[ \t]{2,}/g,` `).trim();function jl(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${Dl(t)}${kl}`,`gi`),`$1`),e);return n===e?void 0:Al(n)}function Ml(e,t){let n=jl(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${Dl(t)}${kl}[\\s,:;!.?-]*`,`i`);return r.test(e)?Al(e.replace(r,``)):void 0}async function Nl(e,t,n,r,i,a){if(n.builtin)return Ml(a,n.agent)!==void 0;let o=await Ii(e,`${n.id}:${r.id}`);if(t.events[i]?.on!==`message`||!o)return!1;o.local&&await(o.syncAgent?.(n.agent)??An(o.store,o.local.cwd,o.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e));let{record:s,version:c}=await Pn(o.store,n.agent);return!s||!c||!s.settings?.disabled&&lt(c.definition.integrations[t.id],i)!==void 0}function Pl(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),xl(e,t,r,n.installationId,n,()=>i??Ll(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function Fl(e,t,n,r,i,a,o){if(n.builtin&&t.app.builtin!==`shared`)return;let s=`${n.id}:${i.installationId}`,c=await Ii(e,s);if(!c||!n.builtin&&c.organizationId!==e.organizationId)return;let l=c.boundInstallation?.installation.id===s?c.boundInstallation.installation:await c.store.get(`installation`,s);if(l?.covers&&!l.covers.includes(i.within??``))return;let u=await _l(c,t,n,r,i,e.now??Date.now,a);if(await u.work,u.taskId)return await o?.(),await zo(c,!0,!1,!0),u.taskId}function Il(e,t,n,r,i){let a=async(t,a=!1)=>{let o=await Ht(e,t,r,n,a).catch(async e=>{throw await i?.(e),e});return{id:o.at(-1)?.id,ids:o.map(e=>e.id)}},o=e.adapter.postProblem;return{post:a,react:(t,r)=>Bt(e,t,r??(typeof n==`string`?n:n?.id)),problem:t=>o?o.call(e.adapter,e.id,t):a(t),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null)}}async function Ll(e,t,n){if(!n.chat)return{post:async()=>{},problem:async()=>{},whisper:async()=>{}};let r=await Wl(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),Il(r.thread(n.chat.thread.id),n.actor.id||void 0,n.chat.message?.id||void 0,e.integrations[t.integration]?.replyLimit,r=>Rl(e,t,n.installationId,r))}async function Rl(e,t,n,r){if(!e.integrations[t.integration]?.isUninstalled?.(r))return;let i=`${t.id}:${n}`,a=await Ii(e,i);a&&await Ku(a.store,i,(e.now??Date.now)())}function zl(e,t,n,r,i,a,o=a.id){let s=r===`message`&&t.builtin?Ml(a.text,t.agent):void 0;if(r===`message`&&t.builtin&&s===void 0)return;let c=Ol(e,s===void 0?r:`mention`);if(!c||a.author.isBot===!0)return;let l=e.event?e.event(c,i,a,t):{};if(!l)return;let u=(l.type??c)===Ol(e,`mention`)?s??jl(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:c,appId:t.id,installationId:n.id,deliveryId:Cr(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${o}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:u,chat:{thread:El(i.toJSON()),message:El(a.toJSON())},...n.index===void 0?{}:{conversation:{index:n.index}},...n.within?{within:n.within}:{},...n.repo?{repo:n.repo}:{},...l}}async function Bl(e,t,n,r,i){let a=await Vl(e,t,n).catch(e=>{console.error(`coder server: conversation workspace lookup failed`,e)});a&&await Bc(a,{appId:t.id,installationId:n.id,chat:{thread:El(r.toJSON())}},{author:i.author.userName||i.author.userId,text:i.text,sentAt:i.metadata.dateSent.toISOString()}).catch(e=>console.error(`coder server: could not keep a message for ${t.id}`,e))}async function Vl(e,t,n){let{tenant:r,installation:i}=await wl(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.within??``));return i&&a?r:void 0}async function Hl(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${ph(await fh(e))}`}function Ul(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>Tl(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await wl(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await wl(e,n,t);!i||!a||a.self||await Ka(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:(r,a)=>Nl(e,t,n,i,r,a).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async t=>{let r=await Ii(e,`${n.id}:${i.id}`),a=wc(n.id,i.id,t);return!!await r?.store.get(`delivery`,a)},knows:async(t,r)=>{let a=await Ii(e,`${n.id}:${i.id}`),o=Mc(n.id,i.id,t,r);return!!await a?.store.get(`delivery`,o)},agent:async t=>{let r=await Vl(e,n,i),{record:a,version:o}=r?await Pn(r.store,t??n.agent):{};if(!a||!o)return;let{definition:s}=o,c=a.description??s.description;return{slug:a.id,name:a.name,...c?{description:c}:{},listens:Object.entries(s.integrations).flatMap(([t,n])=>{let r=gt(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}},task:async t=>{let r=await Vl(e,n,i),a=r&&await r.store.get(`task`,t);if(!a)return;let{task:o}=a,s=o.event?.integration;return{id:o.id,title:o.name?.trim()||o.prompt?.trim()||o.event?.text?.trim()||`${o.event?.type??`task`} on ${o.agent}`,agent:o.agent,status:a.status,from:s&&e.integrations[s]?.name||o.source,startedAt:a.startedAt??a.createdAt}}}:{},privateState:()=>new Hn,...e.config.publicUrl?{publicUrl:e.config.publicUrl}:{},...a?{dashUrl:a}:{}}}async function Wl(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=new Map;e={...e,fetch:r.requestFetch?.(e.fetch??fetch,n?.within??n?.id)??e.fetch,syncAgent:t=>(i.has(t)||i.set(t,An(e.store,e.local.cwd,e.integrations,t)),i.get(t))};let a=E(e.config,t.credentials),o=await r.adapter(Ul(e,r,t,a,n)),s=Vn(e.chatState??new Hn,t.id),c=new St({userName:t.name,adapters:{[r.id]:o},state:{...s,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:tl,logger:`error`});if(!n)return c;let l=async(i,o,s,c)=>{let l=zl(r,t,n,i,o,s,c);if(!l){s.author.isBot!==!0&&await Bl(e,t,n,o,s);return}let u=Il(o,s.author,s,r.replyLimit,r=>Rl(e,t,n.id,r));Pl(e,t,l,Fl(e,r,t,a,l,u),u)};return c.onNewMention((e,t)=>l(`mention`,e,t)),c.onNewMessage(/[\s\S]*/,(e,t)=>l(`message`,e,t)),c.onMessageUpdated((e,t)=>l(t.isMention?`mention`:`message`,e,t,`edit\n${t.id}\n${t.metadata.editedAt?.toISOString()??``}`)),c.onReaction(async i=>{if(!i.added||i.user.isBot===!0)return;let a=i.thread,o=await Vl(e,t,n);if(!o)return;let s={integration:r.id,type:`reactions`,appId:t.id,installationId:n.id,deliveryId:`reaction-${i.messageId}-${i.user.userId}-${i.rawEmoji}`,actor:{id:i.user.userId,login:i.user.userName},text:``,chat:{thread:El(a.toJSON())},...n.within?{within:n.within}:{}},c=$c(o,s,{emoji:`:${i.emoji.name}:`,by:i.user.userName||i.user.userId,on:i.message?.text??i.messageId},e.now??Date.now);Pl(e,t,s,c)}),c.onSlashCommand(`/setup`,async i=>{let o=Ol(r,`command`);if(!o)return;let s=e=>i.channel.postEphemeral(i.user,e,{fallbackToDM:!1}),c={integration:r.id,type:o,appId:t.id,installationId:n.id,deliveryId:Cr(`sha256`).update(`${t.id}\n${n.id}\n${i.channel.id}\n${i.triggerId??i.text}`).digest(`base64url`).slice(0,22),actor:{id:i.user.userId,...i.user.userName?{login:i.user.userName}:{}},text:i.text.trim(),...n.within?{within:n.within}:{}},l={post:s,problem:s,whisper:s};Pl(e,t,c,Fl(e,r,t,a,c,l),l)}),c}function Gl(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));Dn(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function Kl(e,t,n,r){let i=n.id,a=t.operatorApp??!1?`*`:t.session?.user.id??`anonymous`,o=sn(r.searchParams.get(`state`)),s=_h(o?.back),c=t.integrations[i];if(!c)return $(t,`unknown-integration`,{platform:i},s);let l=t.config.publicUrl;if(!l)return $(t,`no-public-url`,{},s);let u=r.searchParams.get(`app`),d=o?.tx?await Jr(t,o.tx,`install`,a):void 0;if(!d||u&&u!==d)return $(t,`install-expired`,{platform:i,appId:u??void 0},s);let f=await t.store.get(`app`,u??d);if(!f)return $(t,`unknown-app`,{platform:i},s);let p=E(t.config,f.credentials);return w(c.app.installUrl(f,p,{publicUrl:l,state:r.searchParams.get(`state`)??Zt({})}))}async function ql(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:E(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:Li(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await Br(u,`install`,t.session?.user.id??`anonymous`,s.id);return w(n.app.installUrl(s,E(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:Zt({tx:d,installation:c}),installation:c}))}async function Jl(e,t,n,r){let i=n.id,a=t.operatorApp??!1,o=a?`*`:t.session?.user.id??`anonymous`,s=sn(r.searchParams.get(`state`)),c=s?.tx&&t.session?Li(t,t.session,Ur(t,s.tx)):void 0,l=c?{...t,...c}:t,u=_h(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await Jr(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return ql(e,l,d,f);if(!m||p&&p!==m||!await Kr(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m);return _?Yl(e,l,d,_,u,s?.installation):$(l,`connected`,{platform:i},u)}async function Yl(e,t,n,r,i,a){let o=n.id,s=t.fetch??fetch,c=t.now?.()??Date.now(),l=t.config.publicUrl;if(r.builtin&&n.app.builtin!==`shared`)return $(t,`unknown-app`,{platform:o},i);let u=i??(r.builtin?void 0:hh(t,r.agent)),d=E(t.config,r.credentials),f=await n.app.installCallback(e,{app:r,credentials:d,publicUrl:l,fetch:s,tokens:xa(t,n.id),...a?{installation:a}:{}}).catch(e=>e instanceof _t?$(t,e.code,{platform:o,appId:r.id,error:e.error},u):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:o,appId:r.id},u)));if(f instanceof Response)return f;let p=`${r.id}:${f.platformInstallId}`,m=t.session;f.user&&m&&t.auth&&await t.auth.link(m.user,o,f.user.id,{organizations:m.organizations.map(e=>e.id),...f.user.token?{token:T(t.config,f.user.token)}:{}});let h=await t.store.get(`installation`,p),g={...h,id:p,app:r.id,integration:o,account:f.account??h?.account??{login:`unknown`},...f.token?{token:T(t.config,f.token)}:{},...f.installer?{installer:f.installer}:{},...f.self?{self:f.self}:{},...f.covers?{covers:f.covers}:{},createdAt:h?.createdAt??c};if(delete g.deletedAt,delete g.uninstalled,n.repos){let e=await n.auth.token(f.token?{...g,token:f.token}:g,d,void 0,{fetch:s});g.repos=await n.repos.list(g,e,s)}try{g=await Gl(t.store,p,e=>f.covers===null?{...g,covers:e?.covers??[]}:g,c)}catch(e){return e instanceof On?$(t,`installation-bound`,{platform:o,account:g.account.login},u):$(t,`installation-taken`,{platform:o},u)}return g.installer&&n.welcome&&await Xl(t,n,r,d,f.platformInstallId,g.installer),$(t,`connected`,{platform:o,account:g.account.login},u)}async function Xl(e,t,n,r,i,a){try{let[{adapterContext:o,dashUrl:s},{record:c,version:l}]=await Promise.all([Promise.resolve().then(()=>Cl),Pn(e.store,n.agent)]),{engine:u,usable:d}=await af(e,{engine:c?.settings?.engine??l?.definition.engine,model:c?.settings?.model??l?.definition.model},e.session?.user.id),f=o(e,t,n,r,{id:i},await s(e)),p=`${e.config.publicUrl.replace(/\/$/,``)}${hh(e,n.agent)}`;await t.welcome(f,a,{open:p,...d?{}:{setup:await _f(e,u)}})}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const Zl=/^[a-z0-9][a-z0-9_-]*$/i;async function Ql(e,t){let n=Ct(wt(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return C(n);try{let{integration:r,token:i}=await ho(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>Zl.test(e));return C([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return uu(e)}}async function $l(e,t){if(!t)throw new W(`repo is required`);let{integration:n,token:r}=await ho(e,t);return C(await n.repos?.pullRequests(t,r)??[])}async function eu(e,t){try{return C(fu(await _o(e,`dashboard`,t)),201)}catch(e){return uu(e)}}async function tu(e,t,n,r){return Ql(t,r.searchParams.get(`repo`)).catch(uu)}async function nu(e,t,n,r){return $l(t,r.searchParams.get(`repo`)).catch(uu)}async function ru(e,t,n,r){return zu(e).then(e=>eu(t,{...e,flow:n.name})).catch(uu)}async function iu(e,t,n,r){return zu(e).then(({post:e,...n})=>{if(!n.repo||!n.pr)throw new W(`repo and pr are required`);return eu(t,{...n,flow:`review`,args:{post:e===!0}})}).catch(uu)}function au(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(C({tasks:n},202))}async function ou(e,t,n){let r=t.repos?.pullRequest(n)===void 0?void 0:await Ii(e,`${n.appId}:${n.installationId}`);if(!r)return;let i=Sp({flow:`review`,event:n});if(!i)return;let a=await r.queue.list(r.organizationId,{status:`queued`,reviewKey:i}),o=(e.now??Date.now)(),s=JSON.stringify({kind:`status`,message:`Replaced by a newer review of this pull request.`});for(let e of a.filter(e=>e.task.event?.type===n.type&&e.task.event.deliveryId!==n.deliveryId))await r.queue.cancel(r.organizationId,e.task.id,o,{statuses:[`queued`]})&&await vc(r.store,e.task.id,[{level:`sys`,line:s}],e.logSeq??0,o,e.logBytes??0)}async function su(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`uninstalled`in i){let t=await Ii(e,i.uninstalled);return t&&await Ku(t.store,i.uninstalled,a),C({ok:!0})}if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=Hl(e).then(a=>i.work(Ul(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),xl(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}return C({ok:!0})}if(`installation`in i){let t=await Ii(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?C({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await Ka(e,`installation`,n.id,{account:i.installation.op===`delete`?t.account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0,uninstalled:i.installation.installation.uninstalled})}),await Gu(t.store,n.id),C({ok:!0}))}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await Ii(e,t),s=!1;try{o&&await Gl(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof On))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?C({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`pushed`in i&&i.pushed){let t=await Ii(e,i.pushed.installation);t&&await Aa(t.store,i.pushed)}if(!(`changes`in i)&&`pushed`in i)return C({ok:!0});if(`changes`in i){let r=i.changes;try{n.branch||await Ka(e.store,`app`,n.id,{branch:r.branch});let i=await Ha(e,r.repo,r.ref,{...Va(),integration:t.id,appId:n.id},r.branch);return i?C({imported:i.map(e=>e.agent)}):C({error:`No installed app can read ${r.repo}`},400)}catch(e){return C({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)Pl(e,n,a,Ll(e,n,a).then(i=>Fl(e,t,n,r,a,i,()=>ou(e,t,a))));return C({accepted:i.events.length},202)}async function cu(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...H(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await Fi(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=E(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return su(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await Wl(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),xl(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}const lu=new Set([`completed`,`failed`,`cancelled`]);function uu(e){if(e instanceof Ou)return C({error:e.message},400);if(e instanceof W)return C({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function du(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,prompt:s,cwd:c}=e.task;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...c?{cwd:c}:{},...s?{prompt:s}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text}}:{}},status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt,...dp(e)}}function fu(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...dp(e),...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},turns:vo(e),...e.task.credential?{credential:Xd(e.task.credential).name}:{}}}async function pu(e,t){let n=await e.store.get(`task`,t);if(n&&!(e.local&&n.handle?.startsWith(`cli:`)&&n.task.flow==="default"))return{status:n};let r=n?.task.cwd??e.local?.cwd;return r?{cwd:r,answer:n?.answer}:C({error:`No task "${t}"`},404)}async function mu(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?en(r,500,2e3):void 0,c=bc(t.store,i,o,s??500);c?.catch(()=>{});let l=await pu(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;if(!u){let e=Od(d,i,!0);return e?C({...e,...l.answer?{answer:l.answer}:{},logs:Dd(d,i,-1,s??500)}):C({error:`No task "${i}"`},404)}return C({...fu(await Fo(t,u)),logs:await c})}async function hu(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o){let n=await Ad(e,s,i,void 0,t);return n.ok&&t.queue instanceof kp&&t.queue.tombstone(i),n}if(t.local&&o.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:o.attempts,tokenHash:o.tokenHash,generation:o.generation??0});let n=await t.store.get(`task`,i);if(n&&Q.includes(n.status)){await yd(t,n,e);let r=await t.store.get(`task`,i);if(r&&Q.includes(r.status))return C({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(o.status)&&o.handle)try{let e=await mn(t,o.task);if(!e)return C({error:`Task runner is unavailable. Try again.`},409);await e.stop(o.handle)}catch{return C({error:`Task is still stopping. Try again.`},409)}return await wp(t,o)?(t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),Bo(t,!0),C({ok:!0})):C({error:`Task changed while deleting. Try again.`},409)}async function gu(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?en(r,500,2e3):void 0,c=bc(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await pu(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;return u?(await Fo(t,u),C(await c)):Od(d,i,!1)?C(Dd(d,i,o,s)):C({error:`No task "${i}"`},404)}async function _u(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Ad(e,s,i,`steer`,t);if(o.task.flow!=="default")return C({error:`steer is available only for default-flow tasks`},409);let c=await e.json().catch(()=>void 0);if(lu.has(o.status)){let{text:e,outputSchema:n,model:r,effort:i,permissions:a}=c??{};try{let s=await bo(t,o,String(e??``),n,{model:r,effort:i,permissions:a});return Bo(t,!0),C(fu(s))}catch(e){return uu(e)}}let l=await Ep(t,o,`steer`,c);return l?C(l):C({error:`Task "${i}" is no longer active`},409)}function vu(e){return async(t,n,r)=>{let i=r.id,a=await pu(n,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Ad(t,s,i,e,n);if(o.task.flow!=="default")return C({error:`${e} is available only for default-flow tasks`},409);if(!Q.includes(o.status))return C({error:`Task "${i}" is not active`},409);if(e===`approve`&&!o.approval)return C({error:`Task "${i}" has no pending approval`},409);let c=await Ep(n,o,e,await t.json().catch(()=>void 0));return c?C(c):C({error:`Task "${i}" is no longer active`},409)}}const yu=vu(`ask`),bu=vu(`approve`);async function xu(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Ad(e,s,i,`cancel`,t);let c=await t.queue.cancel(t.organizationId,i,(t.now??Date.now)(),{attempts:o.attempts,tokenHash:o.tokenHash??null,generation:o.generation??0});if(c&&o.status!==`queued`){await jp(t,i);let e=await t.store.get(`task`,i);e&&!lu.has(e.status)&&Lo(t,o)}return c?C({ok:!0}):C({error:`No running or queued task "${i}"`},404)}async function Su(e,t,n,r){let i=n.id,a=await pu(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Ad(e,s,i,`archive`,t);let c=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:c,autoArchived:void 0},c),C({ok:!0})}async function Cu(e,t){if(!e.agent||!e.event?.integration)return C({error:`agent and event are required`},400);let n=t.integrations[e.event.integration];if(!n)return C({error:`Unknown integration "${e.event.integration}"`},400);let r=e.event.actor?.id;if(t.auth&&r){let e=await t.auth.linkedUser(n.id,r);if(e&&e.id!==t.session?.user.id)return C({error:`The event's actor is linked to another member`},403)}let i=(await t.store.list(`app`)).map(e=>e.value).find(t=>t.agent===e.agent&&t.integration===n.id);if(!i)return C({error:`No ${n.id} app for agent "${e.agent}" on this server.`},404);let a=(await t.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===i.id&&!e.deletedAt),o=a.find(t=>t.id===`${i.id}:${e.event.installationId}`)??a[0];if(!o)return C({error:`The ${n.id} app for "${e.agent}" is not installed anywhere yet`},404);let s=t.now??Date.now,c={...e.event,appId:i.id,installationId:o.id.slice(i.id.length+1),deliveryId:`admin-${s()}-${Er()}`},l=await _l(t,n,i,E(t.config,i.credentials),c,s,await Ll(t,i,c));return au(t,l.work??Promise.resolve(),l.taskId?[l.taskId]:[])}const wu=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function Tu(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return C({error:`A JSON body is required`},400);try{if(lo(t,i),i.event)return Cu(i,t);let e=(i.source===`cli`?void 0:await gd(t,i))??await _o(t,i.source===`cli`?`cli`:`dashboard`,i);return C(fu(e),201)}catch(e){return uu(e)}}function Eu(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)re(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function Du(e,t,n,r){let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!wu.has(i))return C({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return C({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return C({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:Q}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(du):e.map(fu);if(t.local){let e=o===void 0?md(t.local.cwd,l.archived):[...md(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...md(t.local.cwd,!1)],n=Eu(t.local.cwd,e,await t.queue.list(t.organizationId)).filter(e=>mp(e,{...l,...u})).sort(o===void 0?vp:_p),i=en(r,tn(r)?void 0:20);if(!tn(r))return C(f(n.slice(0,i)));let a=on(r),s=n.filter(e=>yp(e,a)),c=cn(s.slice(0,i+1),i,o===void 0?hp:gp);return C({...c,items:f(c.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}:{}})}if(!tn(r)){let e=en(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return C(f(n))}let p=en(r),m=on(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,[g,_]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0]),v=cn(g,p,o===void 0?hp:gp);return C({...v,items:f(v.items),..._?{counts:_}:{}})}var Ou=class extends Error{};const ku=async e=>await e.get(`config`,`workspace`)??{};function Au(){let e=Ge();if(!V.existsSync(e))return{};try{return JSON.parse(V.readFileSync(e,`utf8`))}catch(t){throw new Ou(`Invalid JSON in ${e}: ${t.message}`)}}function ju(e){let{mcp:t,...n}=e;return n}async function Mu(e){return e.local?ju(Au()):ku(e.store)}const Nu=(e,t)=>e.local?ju(Ie(e.local.cwd)):Re(t);async function Pu(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function Fu(e){let t=Je(e);if(t.length)throw new Ou(t.join(`; `))}async function Iu(e,t){if(Fu(t),t.mcp)throw new Ou(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:n}=Au();return Ue({...t,...n?{mcp:n}:{}}),Mu(e)}return await e.store.put(`config`,`workspace`,t),ju(t)}async function Lu(e,t){return Pu(e,async e=>{let n=structuredClone(await Mu(e));return t(n),Iu(e,n)})}function Ru(e,t){return Pu(e,async e=>Iu(e,$e(await Mu(e),t)))}async function zu(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new Ou(`A JSON body is required`);return t}async function Bu(e,t){return Lu(e,t).then(C).catch(uu)}async function Vu(e,t,n,r){return Mu(t).then(e=>C({config:e,effective:Nu(t,e)})).catch(uu)}async function Hu(e,t,n,r){return e.json().catch(()=>{throw new Ou(`A JSON body is required`)}).then(e=>Ru(t,e)).then(C).catch(uu)}function Uu(e,t){return t.token?{...t,token:E(e.config,t.token)}:t}const Wu=3e5;async function Gu(e,t){await e.put(`snapshot`,Tn(t),{drop:Er()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:zn(t)}))await e.delete(`snapshot`,n.id)}async function Ku(e,t,n){await e.withAppLock(`installation:${t}`,async e=>{let r=await e.get(`installation`,t);!r||r.deletedAt||(await Ka(e,`installation`,t,{deletedAt:n,uninstalled:!0}),await Gu(e,t))})}async function qu(e,t,n,r,i,a=0){let o=n.token,s=Uu(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=zn(n.id,t),o=await e.store.heldTokens([n.id],[n.app]),s=o.held.get(i),c=(e.now??Date.now)(),l=s?s.expiresAt-s.mintedAt:0,u=a+(a+Wu<=l?Wu:0);if(s&&s.expiresAt-c>Math.max(u,Wu))try{return E(e.config,s.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let d=await r();return await e.store.holdToken({key:i,value:{token:T(e.config,d.token),expiresAt:d.expiresAt,mintedAt:c},ttlMs:Math.max(d.expiresAt-c-Wu,0),drops:[n.id,n.app].map(e=>({key:Tn(e),drop:o.drops.get(Tn(e))}))}),d.token},async save(t){let r=T(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&E(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&E(e.config,i)}})}async function Ju(e,t,n,r){if(!t.auth.user||!e.auth)return;let i=await e.auth.linkedUser(t.id,n.actor.id);if(!i?.token||!i.organizations?.includes(e.organizationId))return;let a=Mf(e.config,i.token),o=a.app&&a.app!==n.appId,s=o?await zf(e,t.id,a.app):void 0;if(o&&!s)return;let c=await t.auth.user.access(a.token,s?E(e.config,s.credentials):r,{fetch:e.fetch??fetch,now:(e.now??Date.now)()});return c.refreshed&&await e.auth.link(i,t.id,n.actor.id,{token:T(e.config,a.app?{app:a.app,token:c.refreshed}:c.refreshed)}),c.accessToken}async function Yu(e,t,n,r,i,a,o){return(o===`requester`?await Ju(e,t,r,i).catch(()=>void 0):void 0)??qu(e,t,n,i,a,e.config.taskTimeoutMs)}function Xu(e,t,n,r,i){let a=[],o,s={installation:n.id,record:n,fetch:e.fetch??fetch,token:()=>o??=qu(e,t,n,i,{tools:t.tools.presets.read}).then(e=>(a.push(e),e))};return Object.assign(async e=>e===r.integration?s:void 0,{minted:a})}function Zu(e,t){let n=(e.settings??={}).agentInstallations??=new Map,r=`${e.organizationId}:${t.id}`,i=n.get(r);return i||(i=e.store.list(`installation`,{agent:t.agent,active:!0}).then(e=>e.map(e=>e.value)),n.set(r,i),setTimeout(()=>n.delete(r),6e4).unref()),i}const Qu=e=>t=>{console.error(`coder server: could not mint a token for ${e}`,t)};async function $u(e,t){let n=t.event,r=e.integrations[n.integration];if(!r)throw Error(`Unknown integration "${n.integration}"`);let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i)throw Error(`Unknown app "${n.appId}"`);if(!a||a.deletedAt)throw Error(`Installation is gone`);let o=t.flow===`review`&&t.args?.post===!0,s=await Yu(e,r,a,n,E(e.config,i.credentials),{tools:t.tools[n.integration]??(o?r.tools.presets.read:[])},ed(t)),c={[n.integration]:s},l=(await Zu(e,t)).filter(e=>e.id!==a.id&&e.integration in t.tools),u=new Map((await e.store.getApps([...new Set(l.map(e=>e.app))])).map(e=>[e.id,e.value]));return await Promise.all(l.map(async n=>{let r=e.integrations[n.integration],i=u.get(n.app);if(!r||!i)return;let a=await qu(e,r,n,E(e.config,i.credentials),{tools:t.tools[n.integration]??[]},e.config.taskTimeoutMs).catch(Qu(n.id));a&&(c[Ft(n.integration,n.account.login)]=a)})),c}function ed(e){let t=e.event;return t.chat&&!t.chat.thread.isDM?void 0:lt(e.definition.integrations[t.integration],t.type)?.actAs}async function td(e,t){let n=t.task,[r,i,a]=await Promise.all([n.event?$u(e,t.task):{},e.local?{}:ku(e.store),nd(e,n)]),o,s=n.event;if(n.flow==="default"&&s?.chat&&n.source===s.integration){let t=e.integrations[s.integration],i=t.tools.presets.read,a=n.tools[s.integration]??[];if(!ed(n)&&a.length===i.length&&i.every(e=>a.includes(e)))o=r[s.integration];else{let[n,r]=await Promise.all([e.store.get(`app`,s.appId),e.store.get(`installation`,`${s.appId}:${s.installationId}`)]);if(!n||!r||r.deletedAt)throw Error(`Conversation installation is gone`);o=await qu(e,t,r,E(e.config,n.credentials),{tools:i},e.config.taskTimeoutMs)}}let c=await ap(e,t,r),l=n.engineChain?.length?await rd(e,n):void 0,u={...c.env},d=[...c.warnings];for(let e of Object.keys(u))a.env[e]===void 0&&!l?.some(t=>t.credential.env[e]!==void 0)||(delete u[e],d.push(`${e} is temporarily unavailable; skipped for this task.`));let f=await cp(e,n),p={...n,tools:c.tools},m=await sp(e,n.id,[...c.secrets,...f,...Object.values(c.tokens),...Object.values(r),...o?[o]:[],...sd(a.env),...l?.flatMap(e=>sd(e.credential.env))??[]]);await _c(e,n.id,d);let h={task:p,tokens:{...c.tokens,...r},nativeTokens:c.nativeTokens,...o?{postToken:o}:{},credential:a,...l?{engineCredentials:l}:{},config:i,connections:c.mcp,connectionEnv:u,connectionSecrets:m};if(n.runner!==`vercel-sandbox`)return h;let g=e=>{let t=new Set(ad(i,n,e).map(e=>e.name));return{...e,env:Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,t.has(e)?yn:n]))}};return{...h,credential:g(a),...l?{engineCredentials:l.map(e=>({...e,credential:g(e.credential)}))}:{}}}async function nd(e,t){let n=t.usage?.engine??t.definition.engine??`claude`,r=t.credential?await e.store.get(`credential`,t.credential):(await rf(e,n,t.requester,{model:t.usage?.model}))?.value;if(r)return{engine:n,...pn(e.config,r)};if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:n,env:{}}}async function rd(e,t){let n=t.usage?.engine??t.definition.engine,r=t.engineChain??[],i=r.slice(Math.max(0,r.indexOf(n??``))+1),a=await Promise.all(i.map(async n=>{let r=t.engineCredentials?.[n],i=r?await e.store.get(`credential`,r):void 0;return i&&(!i.owner||i.owner===t.requester)?{id:r,credential:{engine:n,...pn(e.config,i)}}:void 0}));return[...t.credential?[{id:t.credential,credential:await nd(e,t)}]:[],...a.flatMap(e=>e?[e]:[])]}const id=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];function ad(e,t,n){if(n.engine!==`custom`)return gn;let r=e.models??{},i=t.usage?.model?r[t.usage.model]:void 0,a=(i&&`baseUrl`in i?[i]:Object.values(r)).flatMap(e=>`baseUrl`in e&&e.envKey&&URL.canParse(e.baseUrl)?[{name:e.envKey,host:new URL(e.baseUrl).hostname,header:`authorization`,prefix:`Bearer `}]:[]);return[...gn,...a]}async function od(e,t,n){if(t.permissions===`auto`)return;let r=e.local?{}:await ku(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=_n(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))`baseUrl`in e&&a.push(...id(e.baseUrl));for(let n of t.connections??[]){let r=await Ff(e,n,t.requester);r?.provider===`mcp`?a.push(...id(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...id(e.url));for(let e of t.mcp??[])a.push(...id(r.mcp?.[e]?.url));for(let e of r.approvals?.allowedNetworkHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...Or.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}function sd(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!Ze(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function cd(e,t){return t.event?(await Zu(e,t)).flatMap(t=>t.token?[E(e.config,t.token)]:[]):[]}async function ld(e,t){let[n,r,i]=await Promise.all([lp(e,t.task),nd(e,t.task).catch(e=>{if(e instanceof Error&&e.message===`no-credential`)return{engine:`codex`,env:{}};throw e}),cd(e,t.task)]),a=e.store instanceof In&&t.task.event&&!(await e.store.list(`snapshot`,{prefix:`connection-secrets:${t.task.id}:`,limit:1})).length?Object.values(await $u(e,t.task)):[];return a.length&&await sp(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...sd(r.env)].filter(e=>e.length>=8)}var ud=r({LOCAL_LOGINS:()=>Rd,engineSignIn:()=>Vd,engineSignOut:()=>Hd,engineStatus:()=>Wd,inspectLocalTask:()=>yd,isLoginEngine:()=>Bd,localLog:()=>Dd,localTask:()=>Od,localTaskAction:()=>Ad,localTasks:()=>md,localUsage:()=>jd,machineSignedIn:()=>Gd,pushLocalInbox:()=>Ed,recoverLocalTasks:()=>xd,resumeLocalTask:()=>kd,runLocalTask:()=>Td,startLocalTask:()=>gd,startQueuedLocalTask:()=>vd,stopLocalTasks:()=>Sd,sweepLocalQueue:()=>hd,syncLocalUsage:()=>Pd});const dd=e=>!e.name?.startsWith(Wt),fd=e=>e?Date.parse(e):void 0;function pd(e,t,n=!1){let r=fd(t.createdAt)??0,i=le(B.join(ue(e,t.id),`answers.json`)),a=t.status===`running`?ze(ue(e,t.id)).find(e=>!e.response):void 0,o=n&&!ye.includes(t.status)?qe(e,t.id):null,s=n?d(e,t.id).filter(e=>!ye.includes(t.status)||(fd(e.at)??0)<(fd(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:fd(e.at)}}):[];n&&(ye.includes(t.status)||!s.length||(s.at(-1)?.finishedAt??0)<(fd(t.resumedAt)??r))&&s.push({prompt:t.currentPrompt??t.prompt??``,...o?{result:{ok:o.status===0,output:o.finalMessage??o.error?.message??``}}:{},...t.error?{error:t.error}:{},...ye.includes(t.status)?{}:{finishedAt:fd(t.completedAt)}});let c=t.flowRunId?At(t.flowRunId)?.name:void 0,l={task:{id:t.id,source:t.source??`cli`,agent:t.agentId??st()??``,flow:c??`default`,...t.name?{name:t.name}:c?{name:c===`review`?`Review`:c}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.permissions?{permissions:t.permissions}:{},...t.prompt?{prompt:Rt(t.prompt)?t.prompt:t.currentPrompt??t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:a?`waiting`:t.status,attempts:1,...a?{approval:a}:{},...i?{answer:i}:{},...o?{result:{ok:o.status===0,exitCode:null,output:o.finalMessage??o.error?.message??``},...o.tokens?{tokens:o.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:fd(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:fd(t.resumedAt)??r,...t.completedAt&&!ye.includes(t.status)?{finishedAt:fd(t.completedAt)}:{},updatedAt:fd(t.updatedAt)??r,local:!0,...n?{turns:s}:{}};return{...l,...dp(l)}}function md(e,t){let n=Dt(e);return(t?c(e,{migrate:!1}):n).filter(dd).map(n=>{let r=pd(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function hd(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...Te]})).filter(e=>be(e.finishedAt??e.updatedAt,n)&&re(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function gd(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=lo(e,t)??e.local.cwd;await An(e.store,r,e.integrations);let a=st(),s=t.agent??a;if(!s)throw new W(`Name an agent: this server has no default agent.`);let{record:c,version:l}=await Pn(e.store,s);co(e,s,c);let u=await bn(e,{requester:e.session?.user.id,runner:t.runner,agent:l?.definition.runner}).catch(e=>{throw new W(e.message)});if(!(u.runner!==`local`||u.runnerId)){if(mo(t),!n)return _d(e,{id:Fe(),source:`dashboard`,agent:s,flow:`default`,runner:`local`,cwd:r,prompt:t.prompt,definition:l?.definition??{integrations:{}},...c?.settings?{usage:c.settings}:{},connections:await da(e,void 0,g(c?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let u=n?await e.store.get(`task`,n):void 0,d=u?.task.connections??await da(e,void 0,g(c?.settings?.connections,t.connections)),f=await ip(e,u?.task??{connections:d,tools:{},definition:l?.definition??{integrations:{}},...c?.settings?{usage:c.settings}:{}}),p=o(f.mcp,f.env),m=It({tools:f.tools},f.tokens,void 0,Object.keys(f.nativeTokens)),h=s===a?void 0:await Vt(r,s,t.mcp?.join(`,`),p.mcp),_=h??We(t.mcp?.join(`,`),Ie(r).mcp,{},p.mcp),v=[],y=await Le({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,engine:t.engine??h?.engine,model:t.model??(t.engine?void 0:h?.model),effort:t.effort??(t.engine?void 0:h?.effort),permissions:t.permissions??h?.permissions,...h?{agentPrompt:{developer:h.developer,access:dt({definition:l?.definition??{integrations:{}},...c?.settings?{usage:c.settings}:{}})}}:{},mcp:[...Object.values(m.mcp),..._.mcp],mcpBindings:_.mcpBindings,mcpWarnings:[..._.warnings??[],...f.warnings],connectionEnv:{...p.env,...m.env},connections:d,nativeMcp:_.nativeMcp,...h?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>v.push(e)},{waitForStartup:!1});return pd(r,v.length?i(r,y.taskId,{fallbacks:v}):y.task)}catch(e){throw e instanceof tt?new W(e.message,409):e}}}async function _d(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await zo(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:Od(n.cwd,t.id)??i}async function vd(e,t,n){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;try{let i=t.task.id,a,o=r.resume?d(r.cwd,t.task.id).length:0,s=t.task.flow==="default"?b(r.cwd,t.task.id):void 0,c=n?Cd(e,t.task.id,n):void 0;if(s&&!r.resume)i=s.id;else if(r.resume){let n=b(r.cwd,t.task.id);if(!n)throw Error(`Local task is missing`);await Ot(r.cwd,n,t.task.prompt??``,{onWorker:e=>{a=e},outputSchema:t.task.context?.outputSchema,...r.overrides,resolveConnections:n=>wd(e,t.task,n,c)})}else r.input?await gd(e,{...r.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??r.input.outputSchema},t.task.id):i=(await Td(e,t.task,t.task.id,!0,c)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...r,startedId:i});let l={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${i}`},(e.now??Date.now)(),l)){let e=b(r.cwd,i);return e&&await Tt(r.cwd,e),!0}if(t.task.flow==="default"){let n={task:t.task,cwd:r.cwd,fence:l,turns:o};await e.store.put(`snapshot`,`completion:${i}`,n),bd(e,i,n,a);let s=jp(e,t.task.id);e.waitUntil&&e.waitUntil(s)}}catch(n){await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})}return!0}async function yd(e,t,n){if(t.status!==`running`&&t.status!==`waiting`||t.task.flow==="default"&&e.store.localFlows?.has(t.task.id)&&t.cancelRequestedAt===void 0&&(t.startedAt===void 0||n-t.startedAt<e.config.taskTimeoutMs))return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=At(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await Mt(t.task.id),r=At(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=Od(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=b(r.cwd,r.startedId??t.task.id);e&&await Tt(r.cwd,e),a=Od(r.cwd,t.task.id)}else return!1;let o=a.status;return o!==`completed`&&o!==`failed`&&o!==`cancelled`?!1:e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i)}function bd(e,t,n,r){let i=e.store.completionWatches??=new Map;if(i.has(t))return;let a={stopped:!1,work:Promise.resolve()};i.set(t,a),a.work=(async()=>{let i=`completion:${t}:${n.fence?.generation??0}`,o=await e.store.get(`delivery`,i);if(o&&!o.owner)return;if(o?.posting!==void 0){console.error(`coder server: local completion ${t} has an interrupted post for turn ${o.posting+1}; retained for reconciliation`);return}if(o?.pid)try{process.kill(o.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let s=Er(),c={owner:s,pid:process.pid,pending:!0,turns:o?.turns??n.turns??0};if(o?.owner){if(!await e.store.updateDelivery(i,o.owner,c))return}else if(!await e.store.create(`delivery`,i,c))return;let l=async(t=!1)=>{if(!n.fence)return!0;let r=await e.store.get(`task`,n.task.id);return r&&(r.generation??0)===n.fence.generation&&r.attempts===n.fence.attempts&&r.tokenHash===n.fence.tokenHash&&r.status!==`queued`&&(!t||[`running`,`waiting`].includes(r.status))},u,f=async t=>{let r=n.task.event;if(!r||n.task.source!==r.integration)throw Error(`The task has no conversation`);if(!await l(t))throw Error(`The conversation task is no longer running`);if(!u){let t=await e.store.get(`app`,r.appId);if(!t)throw Error(`Local completion has no app`);let{eventReplies:n}=await Promise.resolve().then(()=>Cl);u=await n(e,t,r)}return u},p=async(t,r=!1,i=!1)=>{let a=await f(i),o=await(r?a.problem(t):a.post(t,i));!i&&c.posting!==void 0&&(c={...c,turns:c.posting+1,posting:void 0}),o&&await Lc(e,n.task.event,o.ids??(o.id?[o.id]:[]),Date.now())},m=Ee(),h=me(n.cwd,t,r),g=100;try{for(let r=0;r<5;r++)try{let r=async(e,r,i)=>{if(n.task.source!==n.task.event?.integration)return;Ce(`completion.reply`,{id:t});let a=Gt(n.task,e,r,i);a.skipped&&ge(n.cwd,t,{kind:`status`,message:Ve}),a.text&&!a.duplicate&&await p(a.text,a.problem)};for(;;){if(a.stopped||!await l())return;let o=b(n.cwd,t);if(!o)return;let u=d(n.cwd,t);for(let t of u.slice(c.turns)){t.status!==0&&e.local&&(e.local.engineChecks=void 0);let a={finalMessage:t.finalMessage,error:t.error},o=Gt(n.task,a,!1,t),l=n.task.source===n.task.event?.integration&&o.text&&!o.duplicate;l&&await f(!1);let u=c.turns+1;if(c={...c,posting:l?c.turns:void 0},!await e.store.updateDelivery(i,s,c)||(await r(a,!1,t),c={...c,turns:u,posting:void 0},!await e.store.updateDelivery(i,s,c)))return}let p=_(n.cwd,o,m);if(!ye.includes(p.status)&&!(p.pid&&De(p.pid,p,m))&&!Jt(ue(n.cwd,t))&&(p.status!==`completed`||u.length>(n.turns??0))){let t=await e.store.get(`task`,n.task.id);n.fence&&t&&(t.generation??0)===n.fence.generation&&t.attempts===n.fence.attempts&&t.tokenHash===n.fence.tokenHash&&await yd(e,t,(e.now??Date.now)())&&Bo(e,!0);let a=p.status===`cancelled`;if((a||p.error)&&u.at(-1)?.prompt!==(p.currentPrompt??p.prompt??null)){if(!await e.store.updateDelivery(i,s,c))return;await r({error:{message:p.error??`Task cancelled`}},a)}break}await h.wait(g),g=Math.min(1e3,g*2)}await e.store.updateDelivery(i,s,{posted:!0,turns:c.turns,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(r===4)throw n;console.error(`coder server: local completion ${t} attempt ${r+1} failed, retrying`,n);let i=e.now??Date.now,o=i()+5e3*2**r;for(;!a.stopped&&i()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-i())))}}finally{h.close(),await e.store.updateDelivery(i,s,{...c,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{i.delete(t)})}async function xd(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))b(n.cwd,t.slice(11))&&bd(e,t.slice(11),n)}async function Sd(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}function Cd(e,t,n){return{url:`http://127.0.0.1:${e.local.port}/tasks/${encodeURIComponent(t)}`,token:n}}async function wd(e,t,n,r){let i=t.event?await $u(e,t):{},a=await ip(e,{...t,connections:n},i);await sp(e,t.id,[...a.secrets,...Object.values(a.tokens)]);let s=o(a.mcp,a.env),c=It({...t,tools:a.tools},a.tokens,r,Object.keys(a.nativeTokens));return{mcp:s.mcp,env:{...s.env,...c.env},warnings:a.warnings}}async function Td(e,t,n,r=!1,i){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await zo(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=lo(e,t)??e.local.cwd;return _d(e,{...t,id:n??Fe(),cwd:r},{cwd:r})}let a=t.event?await $u(e,t):{},c=await ip(e,t,a);await _c(e,n??t.id,c.warnings),await sp(e,n??t.id,[...c.secrets,...Object.values(c.tokens)]),t={...t,tools:c.tools};let l=c.tokens,u=t.event&&a[t.event.integration],d=lo(e,t)??e.local.cwd,f=await e.store.get(`task`,n??t.id),p={task:t,cwd:d,...f?{fence:{generation:f.generation??0,attempts:f.attempts,tokenHash:f.tokenHash,statuses:[`running`,`waiting`]}}:{}},m=t.flow!=="default"&&n?At(n):void 0;if(m){let r=s(d).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?pd(d,r):{task:t,status:m.status===`running`?`running`:m.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=Fe();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&bp(i.task)!==bp(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,p)}let h=t.flow==="default"&&n?b(d,n):void 0;if(h){let n;return h.status===`queued`&&!h.pid&&(n=Ke(d,h.id,{...o(c.mcp,c.env).env,...It(t,l,i,Object.keys(c.nativeTokens)).env})),bd(e,h.id,p,n),pd(d,h)}let g,_=new Promise(e=>g=e),v,y;v=Ut({cwd:d,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:l,native:Object.keys(c.nativeTokens)},...i?{replyEndpoint:i}:{},connections:c.mcp,connectionEnv:c.env,availability:e.local?.engineChecks&&e.local.engineChecks.expiresAt>Date.now()?e.local.engineChecks.availability:void 0,...t.engineChain?{onEngine:t=>Gd(e,t)}:{},post:t.flow!=="default"&&t.source===t.event?.integration,...u?{postToken:u}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await Nt(n.runId,n.runningIds())},work:v}),g(t.id)},onWorker:(e,t)=>{y=t},onTask:e=>{g(e)}}).then(async n=>(t.flow==="default"&&n.taskId&&(p.turns=n.turn??p.turns,await e.store.put(`snapshot`,`completion:${n.taskId}`,p),bd(e,n.taskId,p,y)),n)).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===p.fence?.attempts&&n.tokenHash===p.fence?.tokenHash&&(n.generation??0)===p.fence?.generation&&await yd(e,n,(e.now??Date.now)()),Bo(e,!0)}}),t.flow==="default"&&(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{let e=b(d,n??t.id);e&&await Tt(d,e)},work:v}),v.catch(()=>{e.local&&(e.local.engineChecks=void 0)});let ee=await Promise.race([_,v.then(()=>void 0)]),te=ee?b(d,ee):void 0,ne=(e.now??Date.now)();return te&&pd(d,te)||{task:t,status:t.flow!=="default"&&At(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:ne,updatedAt:ne,local:!0}}async function Ed(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let s=b(i.cwd,r);if(!s)throw Error(`Local task is missing`);let c=o.kind===`cancel`?await Tt(i.cwd,s):await qt(i.cwd,{...s,name:void 0},o,n=>wd(e,t.task,n));o.kind===`ask`&&a.answers.push({seq:o.seq,value:c}),a.seq=o.seq}return a}function Dd(e,t,n=-1,r){let i=``;try{i=V.readFileSync(B.join(ue(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
-`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=Pt(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:fd(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function Od(e,t,n=!0){let r=b(e,t);return r&&dd(r)?pd(e,_(e,r),n):void 0}async function kd(e,t,n,r,i,a={},o={}){let s=e.store.completionWatches?.get(n);s&&await s.work;let c=(e.now??Date.now)(),l=await e.store.get(`task`,n);l&&[`running`,`waiting`].includes(l.status)&&(await yd(e,l,c),l=await e.store.get(`task`,n));let u={...l?await yo(e,l.task):{},prompt:r,context:{...l?.task.context,...o,...i?{outputSchema:i}:{}}};if(await e.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),l){if(!await e.queue.continueTask(e.organizationId,n,u,c,{attempts:l.attempts,generation:l.generation??0}))return!1}else{let r=b(t,n);if(!r)throw Error(`No task "${n}"`);await e.queue.enqueue(e.organizationId,{...pd(t,r).task,...u},c,void 0,e.config.maxQueued??1e3)}return await zo(e,!1,!0,!0),!0}async function Ad(e,t,n,r,i){let a=b(t,n);if(!a||!dd(a))return Response.json({error:`No task "${n}"`},{status:404});let o=_(t,a),s=ye.includes(o.status),c=e.method===`POST`?await e.json().catch(()=>({})):{},u=(e,t=409)=>Response.json({error:e},{status:t});if(e.method===`DELETE`&&!r){if(s&&await Tt(t,o),Et(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),Bo(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return s?(await Tt(t,o),Response.json({ok:!0})):u(`No running or queued task "${n}"`,404);if(r===`archive`)return Ae(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(c.text??``);if(!e.trim())return u(`text is required`,400);let r=s?void 0:c.outputSchema,a=Object.fromEntries([`model`,`effort`,`permissions`].flatMap(e=>typeof c[e]==`string`&&c[e]?[[e,c[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return u(`outputSchema must be an object`,400);try{if(!s&&i){if(!await kd(i,t,n,e,r,a))return u(`Task is already active`);let o=await i.store.get(`task`,n);return Response.json(o?.status===`queued`?{...o,statusReason:`Waiting for a task slot`}:Od(t,n))}let c=await Ot(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(s?c:Od(t,n))}catch(e){return u(e.message)}}if(r===`ask`){let e=String(c.question??c.text??``);if(!e.trim())return u(`question is required`,400);let r=await kt(t,o,e),i=r.finalMessage??r.error?.message??``,a=B.join(ue(t,n),`answers.json`);return l(a,[...le(a)??[],i]),Response.json({ok:!0,answer:i})}if(r===`approve`){let e=ze(ue(t,n)).filter(e=>!e.response),r=String(c.approvalId??c.id??e[0]?.id??``);return e.some(e=>e.id===r)?(He(ue(t,n),r,c.decision===`deny`||c.decision===`decline`?`decline`:`accept`),Response.json({ok:!0})):u(`Task "${n}" has no pending approval`)}return new Response(`Not found`,{status:404})}function jd(e,t=new Set,n=!0){let r=Md(t);return[...s(e),...n?c(e,{migrate:!1}):[]].filter(dd).flatMap(e=>Nd(e,r))}function Md(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function Nd(e,t){let n=e.turnUsage??[],r=t.get(e.id)??[];t.set(e.id,r);let i=fd(e.createdAt)??0;return n.flatMap(t=>{let n=fd(t.at);if(n===void 0||!Number.isFinite(n))return[];let a=fd(e.resumedAt),o=a!==void 0&&a>=i&&a<=n?a:i,s=r.includes(n);return i=n,s?[]:(r.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??st()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-o),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function Pd(e){let t=e.local;return t.usageSync??=Ld(e).finally(()=>t.usageSync=void 0)}async function Fd(e){try{return JSON.parse(await V.promises.readFile(e,`utf8`))}catch{return null}}async function Id(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await V.promises.stat(B.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function Ld(e){let t=e.local;await t.cacheMaintenance;let n=de(),r=await Fd(n),i=await e.store.list(`usage`,{prefix:`cli:`}),a=new Set(i.map(e=>e.id)),o=0,s=async()=>{++o%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))a.has(t)||(await e.store.put(`usage`,t,n),a.add(t)),await s();let c=Md(a),l=(await V.promises.stat(ce(t.cwd)).catch(()=>void 0))?.mtimeMs??0,u={},d=new Set,f=!1;for await(let{id:n,dir:i,archived:a}of v(t.cwd)){if(await s(),d.has(n))continue;let t=a?await Id(i):void 0;if(a&&r?.counted?.[n]===t){u[n]=t,d.add(n);continue}let o=await Fd(B.join(i,`job.json`));if(o){if(o.agent&&(o.engine=o.agent),d.add(n),dd(o))for(let[t,n]of Nd(o,c))await e.store.put(`usage`,t,n),f=!0,await s();a&&(u[n]=t)}}if(f||r?.archive!==l||JSON.stringify(r?.counted)!==JSON.stringify(u)){let t=await e.store.list(`usage`,{prefix:`cli:`});await V.promises.mkdir(B.dirname(n),{recursive:!0});let r=p(n);try{await V.promises.writeFile(r,`${JSON.stringify({archive:l,counted:u,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await V.promises.rename(r,n)}finally{await V.promises.rm(r,{force:!0})}}t.archiveScan=l}const Rd=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,zd={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},Bd=e=>e in zd;function Vd(e){let t=zd[e];Sr(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function Hd(e){let t=zd[e];return new Promise(e=>xr(t.file,t.logout,{timeout:15e3},()=>e()))}function Ud(e){return new Promise(t=>xr(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function Wd(e){let t=e?.local;if(t?.engineChecks&&t.engineChecks.expiresAt>Date.now())return t.engineChecks.work;let n={},r=Promise.all([Ud(zd.claude),Ud(zd.codex)]).then(([e,r])=>(t&&(n.claude=Qe(`claude`,process.env,t.cwd),n.codex=at(t.cwd)),{claude:{signedIn:e,command:zd.claude.command},codex:{signedIn:r,command:zd.codex.command}})).catch(e=>{throw t?.engineChecks?.work===r&&(t.engineChecks=void 0),e});return t&&(t.engineChecks={expiresAt:Date.now()+3e4,availability:n,work:r}),r}async function Gd(e,t,n){if(!e.local)return!1;let r=t?[t]:Ie(e.local.cwd).chain,i=await Wd(e);return r.some(t=>{if(t!==`custom`)return i[t]?.signedIn===!0;let r=Ie(e.local.cwd);try{let e=rt({engine:`custom`,model:n},r).model,t=e&&r.models?.[e];return!!(t&&`baseUrl`in t&&process.env[t.envKey??`OPENAI_API_KEY`])}catch{return!1}})}var Kd=r({CredentialCheckError:()=>Qd,addCredential:()=>cf,checkCredential:()=>ef,completeLogin:()=>uf,createCredential:()=>xf,credentialEnv:()=>sf,credentialFix:()=>_f,credentialId:()=>Yd,credentialSummary:()=>ff,deleteCredential:()=>Sf,listCredentials:()=>bf,parseCredentialId:()=>Xd,removeCredential:()=>lf,reseal:()=>gf,resolveCredential:()=>rf,resolveEngine:()=>af,signInEngine:()=>Cf,signOutEngine:()=>wf,visibleCredentials:()=>of,writeBackCodexAuth:()=>mf});const qd={claude:`ANTHROPIC_API_KEY`,codex:`OPENAI_API_KEY`},Jd={claude:`CLAUDE_CODE_OAUTH_TOKEN`,codex:`CODEX_AUTH_JSON`};function Yd(e,t){return e?`${e}/${t}`:t}function Xd(e){let t=e.lastIndexOf(`/`);return t<0?{name:e}:{owner:e.slice(0,t),name:e.slice(t+1)}}function Zd(e){let[t=``]=Object.keys(e);return Object.keys(Jd).find(e=>Jd[e]===t)??t}var Qd=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function $d(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function ef(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=$d(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new Qd(i.status,i.statusText)}function tf(e,t,n){if(e===`claude`||e===`codex`)return[e,qd[e]];let r=null;try{r=rt({...n,engine:e},t).model}catch{return[]}let i=r?t.models?.[r]:void 0;return[i&&Ye(i)&&i.envKey||qd.codex]}function nf(e,t,n){for(let r of n?[n,void 0]:[void 0])for(let n of t){let t=e.find(e=>e.id===Yd(r,n));if(t)return t}}async function rf(e,t,n,r={}){let[i,a]=await Promise.all([Mu(e),e.store.listCredentials({owner:n})]);return nf(a,tf(t,Nu(e,i),r),n)}async function af(e,t,n){let[r,i]=await Promise.all([Mu(e),e.store.listCredentials({owner:n})]),a=Nu(e,r),o=t.engine??(t.model?rt(t,a).engine:void 0),s=o?[o]:a.chain,c=Object.fromEntries(s.flatMap(e=>{let r=tf(e,a,e===o?t:{}),s=nf(i,r,n);return s?[[e,s.id]]:[]}));for(let n of s){let r=c[n];if(r)return{engine:n,credential:r,usable:!0,chain:s,credentials:c};if(await Gd(e,n,n===o?t.model:void 0))return{engine:n,usable:!0,chain:s,credentials:c}}return{engine:Object.values(a.models??{}).some(Ye)||i.some(e=>![...Object.keys(qd),...Object.values(qd),...Object.values(Jd)].includes(Xd(e.id).name))?`custom`:s[0]??Xe,usable:!1,chain:s,credentials:c}}async function of(e,t,n){return(await e.listCredentials({owner:t,limit:n})).filter(e=>!e.value.owner||e.value.owner===t)}async function sf(e,t){let n=e.session?.user.id,r=nf(await of(e.store,n),[t],n);return(r?pn(e.config,r.value).env[t]:void 0)??(e.local?pr.env[t]:void 0)}async function cf(e,t,n,r=Date.now){let i=n.owner||void 0,a=Yd(i,Zd(n.env)),o=!1;return await e.withCredential(`credential`,a,async e=>{o=!!e;let s={...un(t,{env:n.env}),...i?{owner:i}:{},...n.account?{account:n.account}:{},createdAt:r()};return[{id:a,value:s}]}),{id:a,replaced:o}}function lf(e,t){return e.withCredential(`credential`,t,async e=>e&&[{id:t,value:null}])}async function uf(e,t,n,r){let i=await e.get(`login`,t);if(!i)return!1;let a=Yd(i.owner,i.engine);return e.withCredential(`credential`,a,async(e,o,s)=>{if(await s.patchLogin(t,{state:`done`},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:i.owner}))return[{id:a,value:{...r,owner:i.owner}}]})}function df(e){if(e.CODEX_AUTH_JSON)return`auth.json`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,7)}…${t.slice(-4)}`:`••••`}function ff(e,t,n){let{name:r}=Xd(t);return{name:r,scope:n.owner?`personal`:`workspace`,subscription:Object.hasOwn(Jd,r),createdAt:n.createdAt??0,masked:df(pn(e,n).env),...n.account?{account:n.account}:{}}}const pf=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function mf(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=pn(t,e);if(!(!i.CODEX_AUTH_JSON||!(pf(r)>(pf(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...un(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function hf(e,t){return dn(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function gf(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=wn(t.encryptionKey),i=e=>dn(t,e)!==r,a=e=>i(e)?T(t,E(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19).replace(/:[a-f0-9]{24}$/,``):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`secret`in o?`secret`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||hf(t,e)===r))return[{id:n,value:{...e,...un(t,pn(t,e))}}]})&&s++;return s}async function _f(e,t,n){let r=ph(n??await fh(e),t===`custom`?`/settings/models`:`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}${t===`custom`?``:`?engine=${encodeURIComponent(t)}`}`}const vf=Ne({env:_e(S().check(n(/^[A-Z_][A-Z0-9_]*$/)),S().check(t(1))),workspace:x(ve()),noCheck:x(ve())}),yf=`Only an owner or admin of this workspace can change workspace credentials.`;async function bf(e,t,n,r){let i=t.session?.user.id,a=e=>`${e.scope}/${e.name}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return C({error:`Invalid fields`},400);if(s===`id`){let e=on(r),n=en(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:tn(r)?n+1:n})).map(({id:e})=>({id:e}));return C(tn(r)?cn(a,n,e=>e.id):a)}let c=(await of(t.store,i,tn(r)?void 0:en(r,200))).map(e=>ff(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!tn(r))return C(c.slice(0,en(r,200)));let l=on(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.name,e.account?.email??``].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return C(cn(d,en(r),a))}async function xf(e,t,n,r){let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=vf.safeParse(a);if(!o.success||Object.keys(o.data.env).length!==1)return C({error:`Invalid credential`},400);let{env:s}=o.data,c=!!o.data.workspace||!i;if(c&&!_m(t))return C({error:yf},403);if(s.CODEX_AUTH_JSON)return C({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&!t.config.subscriptions?.claude)return C({error:`Claude subscriptions are off on this server; add an API key.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&c&&t.auth)return C({error:`A Claude subscription is personal; add it without --workspace.`},400);let l=c?void 0:i,u=s.CLAUDE_CODE_OAUTH_TOKEN?`claude`:Object.keys(qd).find(e=>qd[e]in s)??`custom`;try{o.data.noCheck||await ef({engine:u,env:s},t.fetch??fetch);let{id:e,replaced:n}=await cf(t.store,t.config,{...l?{owner:l}:{},env:s},t.now??Date.now);return C({ok:!0,name:Xd(e).name,replaced:n})}catch(e){return e instanceof Qd?C({error:e.message},e.status):(console.error(`coder server: could not save credential`,e),C({error:`Could not save credential. Please try again.`},500))}}async function Sf(e,t,n,r){let i=t.session?.user.id,a=r.searchParams.has(`workspace`)||!i;if(a&&!_m(t))return C({error:yf},403);let o=Yd(a?void 0:i,n.name);return await lf(t.store,o)?C({ok:!0}):C({error:`Unknown credential`},404)}async function Cf(e,t,n,r){let i=n.engine;return Vd(i),t.local&&(t.local.engineChecks=void 0),C(await Wd())}async function wf(e,t,n,r){let i=n.engine;return await Hd(i),t.local&&(t.local.engineChecks=void 0),C(await Wd())}var Tf=r({ConnectionError:()=>Vf,addConnection:()=>qf,authorizeConnection:()=>tp,changeConnection:()=>Jf,completeNativeConnection:()=>If,connectionAllowed:()=>Lf,connectionAuthorization:()=>Xf,connectionRow:()=>jf,connectionRows:()=>Wf,createConnection:()=>Qf,deleteConnection:()=>ep,findConnection:()=>Ff,listConnections:()=>Zf,nativeApp:()=>zf,nativeConnections:()=>Nf,nativeCredential:()=>Mf,removeConnection:()=>Yf,updateConnection:()=>$f,visibleConnections:()=>Pf});const Ef=S().check(n(/^[a-z0-9][a-z0-9_-]*$/i)),Df=Se([je({header:S().check(n(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),je({env:S().check(n(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),Of=je({name:S().check(t(1)),id:x(Ef),provider:x(Ef),owner:x(we(`me`)),access:x(se([`read`,`write`])),endpoint:x(ot),auth:x(se([`none`,`key`,`oauth`])),key:x(S().check(t(1))),keyIn:x(Df),credential:x(S().check(t(1)))}),kf=je({name:x(S().check(t(1))),access:x(he(se([`read`,`write`]))),key:x(S().check(t(1)))});function Af(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`write`&&!!t.keyIn&&`env`in t.keyIn&&Oe(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`read`&&!n.tools?.length||n.tools?.some(e=>!oe(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!f(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(Ze)}function jf(e,t,n){let r=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{r=!!E(n,e.secret).accessToken}catch{r=!1}return{id:e.id,name:e.name,provider:e.provider,auth:e.auth,...e.access?{access:e.access}:{},...e.owner?{owner:e.owner,...t===e.owner?{mine:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.account}:{},status:e.broken?`reconnect`:e.auth===`oauth`&&!r?`authorize`:`ok`,createdAt:e.createdAt}}function Mf(e,t){let n=E(e,t);return typeof n==`string`?{token:n,app:void 0}:n}async function Nf(e,t){return!t||!e.auth?.linkedAccounts?[]:(await e.auth.linkedAccounts(t,e.store)).filter(t=>t.token&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:`${t}:${n.platform}-${Cr(`sha256`).update(n.platformUserId).digest(`hex`).slice(0,12)}`,name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,auth:`oauth`,secret:n.token,account:n.platformUserId,oauthApp:Mf(e.config,n.token).app,createdAt:0}))}async function Pf(e,t,n){let r=await Nf(e,t),i=(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t).map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let t=r.find(t=>t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:t?.secret,account:t?.account??e.account}});return[...i,...r.filter(e=>!i.some(n=>n.id===e.id||n.owner===t&&n.provider===e.provider&&n.account===e.account))]}async function Ff(e,t,n){let r=await e.store.get(`connection`,t);return r?!r.owner||r.owner===n?r:void 0:(await Nf(e,n)).find(e=>e.id===t)}async function If(e,t,n,r){for(let{id:i,value:a}of await e.store.list(`connection`))a.owner!==t||a.provider!==n||a.auth!==`oauth`||a.account&&a.account!==r||await e.store.withAppLock(`connection:${i}`,async a=>{let o=await a.get(`connection`,i);!o||o.owner!==t||o.provider!==n||o.account&&o.account!==r||await a.put(`connection`,i,{...o,account:r,broken:void 0,secret:void 0,updatedAt:(e.now??Date.now)()})})}async function Lf(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await Ff(t,n.id,t.session?.user.id);if(!e)return C({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else if((await e.clone().json().catch(()=>void 0))?.owner===`me`)return t.auth&&t.session&&!t.local?t:C({error:`Personal connections need a signed-in member`},400);return vm(t,`Only workspace owners and admins can manage workspace connections`)}var Rf=class extends Error{};async function zf(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([xh(e),e.store.list(`app`)]);r=[...t,...n.map(e=>e.value)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(E(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function Bf(e,t,n){if(t.provider===`mcp`)return la(e,t,n);if(!await zf(e,t.provider))throw new Rf(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:Tr(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var Vf=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const Z=(e,t)=>new Vf(e,t);async function Hf(e,t=200){try{return C(await e(),t)}catch(e){if(e instanceof Vf)return C({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function Uf(e){return e.json().catch(()=>void 0)}async function Wf(e,t){let n=e.session?.user.id,r=await Pf(e,n,`oauth`),i=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0;return r.map(r=>{let a=jf(r,n,e.config);return t&&r.auth===`oauth`&&(!i||!(`target`in i)||i.target!==`${r.id}:${r.createdAt}`)&&(a.status=`authorize`),a})}async function Gf(e,t,n,r){if(n.key&&n.credential)throw Z(400,`Give a key or a credential, not both`);if(n.key){let{id:i,replaced:a}=await cf(e.store,e.config,{...r?{owner:r}:{},env:{[t]:n.key}},e.now??Date.now);return a?{id:i}:{id:i,created:!0}}let i=(await of(e.store,r)).filter(n=>pn(e.config,n.value).env[t]!==void 0),a=n.credential?i.find(e=>e.id===n.credential):i.find(e=>r&&e.value.owner===r)??i.find(e=>!e.value.owner);if(!a)throw Z(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:a.id}}async function Kf(e,t,n){let r=t.keyIn.env;return(await Gf(e,r,{key:n},t.owner)).id}async function qf(e,t){let n=Of.safeParse(t);if(!n.success)throw Z(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!Ef.safeParse(i).success)throw Z(400,`Invalid connection id`);let a=r.provider??`mcp`,o=r.owner===`me`?e.session.user.id:void 0;if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw Z(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw Z(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw Z(400,`Only environment connections use a credential`);let s=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(s===`key`&&!r.key&&a!==`env`)throw Z(400,`A key is required`);if(r.key&&s!==`key`)throw Z(400,`A key needs key authentication`);let c={id:o?`${o}:${i}`:i,name:r.name,provider:a,...o?{owner:o}:{},...r.access||a===`env`?{access:r.access??`write`}:{},auth:s,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:T(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!Af(e,c))throw Z(400,`Invalid endpoint or read-only tools`);if(await e.store.get(`connection`,c.id))throw Z(409,`Connection already exists`);let l;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(l=await na(e,r.endpoint.url,!0),!l)try{await ne({...c,access:`write`},void 0,e.fetch)}catch(t){if(!(t instanceof u)||!t.authenticate||(l=await na(e,r.endpoint.url,!0,t.authenticate),!l))throw t}l&&(c.auth=`oauth`)}catch(e){throw e instanceof u?new Vf(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):(console.error(`coder server: connection discovery failed`,e),Z(502,`Could not start authorization`))}if(c.auth===`oauth`&&e.local?.port===0)throw Z(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let d=a===`env`?await Gf(e,r.keyIn.env,r,o):void 0;if(d&&(c.credential=d.id),!await e.store.withAppLock(`connection:${c.id}`,e=>e.create(`connection`,c.id,c)))throw d?.created&&await lf(e.store,d.id),Z(409,`Connection already exists`);try{let t=c.auth===`oauth`?await Bf(e,c,l):void 0;return{...jf(c,o,e.config),...t?{authorize:t}:{}}}catch(t){throw t instanceof Rf||console.error(`coder server: connection authorization failed`,t),await e.store.withAppLock(`connection:${c.id}`,async e=>{let t=await e.get(`connection`,c.id);kr(t,c)&&await e.delete(`connection`,c.id)}),t instanceof Rf?Z(400,t.message):Z(502,`Could not start authorization`)}}async function Jf(e,t,n){let r=kf.safeParse(n);if(!r.success)throw Z(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await Ff({...e,store:n},t,e.session?.user.id);if(!i)throw Z(404,`Unknown connection`);let{key:a,access:o,...s}=r.data;if(a&&i.auth!==`key`)throw Z(400,`This connection does not use a key`);let{access:c,...l}=i,u={...o===null?l:i,...s,...o?{access:o}:{},...a&&i.provider!==`env`?{secret:T(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!Af(e,u))throw Z(400,`Invalid read-only tools`);return a&&i.provider===`env`&&(u.credential=await Kf({...e,store:n},i,a)),await n.put(`connection`,u.id,u),jf(u,e.session?.user.id,e.config)})}async function Yf(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await Ff({...e,store:n},t,e.session?.user.id);if(!r)throw Z(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function Xf(e,t){let n=await Ff(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw Z(404,`Unknown OAuth connection`);try{return await Bf(e,n)}catch(e){throw e instanceof Rf||console.error(`coder server: connection authorization failed`,e),e instanceof Rf?Z(400,e.message):Z(502,`Could not start authorization`)}}async function Zf(e,t){let n=new URL(e.url),r=n.searchParams.get(`authorization`)??void 0,i=n.searchParams.get(`wait`);if(!r||!i)return C(await Wf(t,r));let a=await t.store.watch(`delivery`,`connection-authorized:${r}`),o=Date.now()+25e3;try{for(;;){let n=await Wf(t,r),s=n.find(e=>e.id===i);if(!s||s.status===`ok`||Date.now()>=o||e.signal.aborted)return C(n);await a.wait(Math.min(1e4,o-Date.now()),e.signal)}}finally{a.close()}}async function Qf(e,t){let n=await Uf(e);return Hf(()=>qf(t,n),201)}async function $f(e,t,n){let r=await Uf(e);return Hf(()=>Jf(t,n.id,r))}async function ep(e,t,n){return Hf(async()=>(await Yf(t,n.id),{ok:!0}))}async function tp(e,t,n){return Hf(async()=>({url:await Xf(t,n.id)}))}function np(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}async function rp(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=pn(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}async function ip(e,t,n={}){let r={},i={},a={...n},o={...t.tools},s=dt(t),c={},l=[],d=[],f=[...new Set(t.connections??[])],p=f.length?await e.store.list(`connection`,{ids:f,visibleTo:t.requester,secrets:`all`}):[],h=new Set(p.map(e=>e.id)),g,_=f.some(e=>!h.has(e))?await Nf(e,t.requester).catch(e=>(console.error(`coder server: native connection lookup failed`,e),g=e,[])):[],v=new Map([..._.map(e=>[e.id,e]),...p.map(({id:e,value:t})=>[e,t])]),y=await Promise.allSettled(f.map(async e=>{if(!v.has(e)&&g)throw g;return{id:e,value:v.get(e)}})),ee,re=y.sort((e,t)=>Number(t.status===`fulfilled`&&!!t.value.value?.owner)-Number(e.status===`fulfilled`&&!!e.value.value?.owner)),b=ae(re.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of re){let f,p=``;try{if(n.status===`rejected`)throw n.reason;if({id:p,value:f}=n.value,!f||f.owner&&f.owner!==t.requester)continue;if(f.provider===`env`&&(f.auth!==`key`||f.access!==`write`||f.endpoint||!f.credential||!f.keyIn||!(`env`in f.keyIn)||!Oe(f.keyIn.env)||b.has(f.keyIn.env)||`local`in e&&e.local&&process.env[f.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(f.broken){l.push(`${f.name} needs reconnecting.`);continue}let h,g;if(f.provider!==`mcp`&&f.provider!==`env`&&f.auth===`oauth`){if(c[f.provider])continue;let n=f,r=e.integrations[n.provider];if(!r?.auth.user)throw Error(`Missing user OAuth`);let i=!n.owner&&n.secret?E(e.config,n.secret):void 0,a=n.owner?(await e.auth?.linkedAccounts?.(n.owner,e.store))?.find(t=>t.platform===n.provider&&t.token&&t.organizations?.includes(e.organizationId)&&(!n.account||t.platformUserId===n.account)):void 0,o=await zf(e,n.provider,(a?.token?Mf(e.config,a.token).app:void 0)??n.oauthApp??i?.app,await(ee??=Promise.all([xh(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value)])));if(!o)throw Error(`Missing integration credentials`);let s=n.owner?n.account??a?.platformUserId:void 0;if(n.owner&&!s)throw Error(`Missing linked account`);let l=n.owner?`native:${n.owner}:${n.provider}:${s}`:`connection:${p}`;h=await e.store.withAppLock(l,async i=>{let a=await Ff({...e,store:i},p,t.requester);if(!a||a.owner!==n.owner||a.provider!==n.provider||a.broken)throw Error(`Connection changed during resolution`);f=a;let c=(a.owner?await e.auth?.linkedAccounts?.(a.owner,i):[])?.find(t=>t.platform===a.provider&&t.token&&t.organizations?.includes(e.organizationId)&&t.platformUserId===s&&(!a.account||t.platformUserId===a.account)),l=a.owner?void 0:a.secret&&E(e.config,a.secret),u=c?.token?Mf(e.config,c.token):void 0,m=a.owner?u?.token:l&&l.token;if(!m)throw Error(`Missing native credential`);d.push(...np(m));let h=u?.app??a.oauthApp??(l?l.app:void 0);if(h&&h!==o.id)throw Error(`OAuth client changed during resolution`);let g;try{g=await r.auth.user.access(m,E(e.config,o.credentials),{fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)})),now:(e.now??Date.now)()})}catch(e){throw e instanceof _t&&[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`].includes(e.error??``)?new fe(`Native credential was revoked`):e}if(g.refreshed)if(d.push(...np(g.refreshed)),a.owner){if(!c||!await e.auth?.refreshLinkedToken?.(a.owner,c.platform,c.platformUserId,c.token,T(e.config,{app:o.id,token:g.refreshed}),i))throw Error(`Linked account changed during refresh`)}else a.secret=T(e.config,{app:o.id,token:g.refreshed}),await i.put(`connection`,p,a);else if(a.owner&&!(await e.auth?.linkedAccounts?.(a.owner,i))?.some(e=>e.platform===c?.platform&&e.platformUserId===c.platformUserId&&e.token===c.token))throw Error(`Linked account changed during resolution`);return g.accessToken})}else if(f.provider===`env`)h=await rp(e,f);else if(f.auth!==`none`){if(!f.secret)throw Error(`Missing credential`);let t=E(e.config,f.secret);if(d.push(...[t.key,t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),f.auth===`key`){if(!t.key)throw Error(`Missing key`);h=t.key}else{let t=f.owner;g=async(n=!1,r)=>{let i=await e.store.withAppLock(`connection:${p}`,async i=>{let a=await i.get(`connection`,p);if(!a||a.owner!==t||a.broken||a.auth!==`oauth`)throw Error(`Connection changed during resolution`);if(!a.secret)throw Error(`Missing credential`);let o=E(e.config,a.secret);d.push(...[o.accessToken,o.refreshToken,o.clientSecret].filter(e=>!!e));let s=AbortSignal.timeout(5e3);return{connection:a,token:await m({secret:o,now:(e.now??Date.now)(),force:n&&o.accessToken===r,fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:s})),save:async t=>{d.push(...[t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),a.secret=T(e.config,t),await i.put(`connection`,p,a)}})}});return f=i.connection,i.token},h=await g()}}if(h&&d.push(h),f.provider===`env`)i[f.keyIn.env]=h;else if(f.provider===`mcp`){let t=f.access??s,n;try{n=await ne({...f,access:t},h,e.fetch??fetch)}catch(r){if(!(r instanceof u)||!g)throw r;h=await g(!0,h),d.push(h),n=await ne({...f,access:t},h,e.fetch??fetch)}n&&(r[p]={...n,description:f.name,access:t})}else if(!c[f.provider]&&h){let t=e.integrations[f.provider];if(!t)throw Error(`Unknown integration`);c[f.provider]=h,a[f.provider]=h,(f.access||!o[f.provider])&&(o[f.provider]=[...t.tools.presets[f.access??s]])}}catch(t){if(f&&ie(t)){let t=f;await e.store.withAppLock(`connection:${p}`,async n=>{let r=await n.get(`connection`,p);r&&r.secret===t.secret&&await n.put(`connection`,p,{...r,broken:{at:(e.now??Date.now)(),reason:`Needs reconnecting`}})})}l.push(te(f?.name??`A connection`,t))}}return{mcp:r,env:i,tokens:a,nativeTokens:c,tools:o,warnings:l,secrets:d}}async function ap(e,t,n){if(!t.task.connections?.length)return{mcp:{},env:{},tokens:n,nativeTokens:{},tools:t.task.tools,warnings:[],secrets:[]};let r=Cr(`sha256`).update(JSON.stringify(t.task.connections)).digest(`hex`).slice(0,12),i=`connections:${t.task.id}:${t.generation??0}:${t.attempts}:${r}`,a=await e.store.get(`snapshot`,i);if(a&&`resolvedConnections`in a){let t=E(e.config,a.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n,...t.nativeTokens}}}let o=await e.store.get(`task`,t.task.id),s=await ip(e,t.task,n);return!s.warnings.length&&o&&await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0))return;let a=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,i,{resolvedConnections:T(e.config,s),expiresAt:a},{ttlMs:Math.max(1,a-(e.now??Date.now)())})}),s}function op(e,t,n){let r=(e.now??Date.now)()+(e.config.taskTimeoutMs??36e5);return[...new Set(n)].filter(e=>e.length>=8).map(n=>({id:`connection-secrets:${t}:${Cr(`sha256`).update(n).digest(`hex`).slice(0,24)}`,value:T(e.config,n),expiresAt:r}))}async function sp(e,t,n){let r=op(e,t,n);return r.length&&await e.store.saveTaskSecrets(t,r),[...new Set(n)].filter(e=>e.length>=8)}async function cp(e,t){let n=[],r=[...new Set(t.connections??[])],i=r.length?await e.store.list(`connection`,{ids:r,visibleTo:t.requester,secrets:`all`}):[],a=r.some(e=>!i.some(t=>t.id===e))?await Nf(e,t.requester):[],o=new Map([...a.map(e=>[e.id,e]),...i.map(({id:e,value:t})=>[e,t])]);for(let t of r){let r=o.get(t);if(r?.provider===`env`){n.push(...await rp(e,r).then(e=>[e],()=>[]));continue}if(!r?.secret)continue;let i=E(e.config,r.secret);n.push(...typeof i==`string`?[i]:[...`token`in i&&typeof i.token==`string`?np(i.token):[],i.key,i.accessToken,i.refreshToken,i.clientSecret].filter(e=>!!e))}return n}async function lp(e,t){let[n,r,i]=await Promise.all([e.store.get(`snapshot`,`connection-secrets:${t.id}`),e.store.list(`snapshot`,{prefix:`connection-secrets:${t.id}:`}),cp(e,t)]);if(n)throw Error(`Task ${t.id} keeps its secrets in the old single-row layout`);let a=r.flatMap(t=>`secret`in t.value?[E(e.config,t.value.secret)]:[]);return[...new Set([...a,...i])]}async function up(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);for(let n of[`connection-secrets:${t}:`,`connections:${t}:`])for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id)})}function dp(e,t=Date.now()){let n=e.status===`running`||e.status===`waiting`?t:e.finishedAt??e.updatedAt;return{lastActivityAt:e.updatedAt,lastTurnMs:e.startedAt===void 0?0:Math.max(0,n-e.startedAt)}}const fp=e=>({[e.key.slice(0,e.key.indexOf(`:`))]:e.through});var pp=class extends Error{};const Q=[`queued`,`running`,`waiting`];function mp(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(n&&!n.includes(e.status)||t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.reviewKey&&Sp(e.task)!==t.reviewKey||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const hp=e=>({rank:et(e.status),createdAt:e.createdAt,id:e.task.id}),gp=e=>({updatedAt:e.updatedAt,id:e.task.id}),_p=(e,t)=>e.updatedAt-t.updatedAt||it(e.task.id,t.task.id),vp=(e,t)=>Be(hp(e),hp(t)),yp=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:Be(hp(e),t)>0);function bp(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent])}function xp(e,t){return e.flow==="default"&&!!e.event?.chat&&bp(e)===bp(t)}function Sp(e){let t=e.event;if(e.flow!==`review`||!t)return;let n=xt[t.integration]?.repos?.pullRequest(t);if(n!==void 0)return JSON.stringify([t.appId,t.installationId,t.repo?.owner,t.repo?.name,n])}const Cp=6e5;async function wp(e,t){let n=t.task.id,r={generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};return e.queue.deleteTask(e.organizationId,n,r)}const Tp=(e,t)=>({...e,context:{...e.context,admissions:{...e.context?.admissions,...t}}});async function Ep(e,t,n,r,i){let a=t.task.id,o=await e.queue.appendInbox(e.organizationId,a,n,r,(e.now??Date.now)(),t.generation??0,i);return o&&await jp(e,a,t.task,t),o}async function Dp(e,t,n=-1,r){return r??=(await e.store.get(`task`,t))?.generation??0,e.queue.readInbox(e.organizationId,t,r,n)}const Op=new Set([`completed`,`failed`,`cancelled`]);var kp=class{store;lock=Promise.resolve();tombstones=new Map;constructor(e){this.store=e}async metrics(e,t){let n=await this.list(e),r={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0};for(let e of n)e.createdAt>=t&&r[e.status]++;return{tasks:r,queueDepth:n.filter(e=>e.status===`queued`).length}}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i?.pending?.task&&await this.store.put(`delivery`,n.key,{at:t,...n.owner?{owner:n.owner}:{},pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:e,status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}async admit(e,t,n){if(!t)return;let{conversation:r,unseen:i}=t;r&&await this.store.putMany(`delivery`,[{id:r.key,value:r.record},{id:r.root,value:{at:r.record.at}}],{ttlMs:r.ttlMs}),i&&await this.store.acknowledgeUnseen(i.key,i.version,i.epoch);for(let e of t.secrets??[])await this.store.put(`snapshot`,e.id,{secret:e.value,expiresAt:e.expiresAt},{ttlMs:Math.max(1,e.expiresAt-n)})}deliver(e,t,n,r,i,a,o=!0,s){return this.serial(async()=>{let c=await this.store.get(`delivery`,r.key);if(c&&!c.pending)return{};if(c?.pending?.inbox){let{taskId:e,id:i,entry:a}=c.pending.inbox,o=await this.read(e);if(o&&Q.includes(o.status)&&(o.generation??0)===a.generation&&xp(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),c=void 0}let l=i!==void 0&&!c?.pending?.task?(await this.list(e,{statuses:Q,agent:t.agent,source:t.source})).find(e=>xp(e.task,t)):void 0;if(!l)return!o||!await this.insert(t,n,r,a)?{}:(await this.admit(t,s,n),{taskId:t.id});let u=await this.nextSeq(l.task.id),d={seq:u,generation:l.generation??0,at:n,kind:`steer`,value:{text:i}},f=`${l.task.id}:${String(u).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:l.task.id,id:f,entry:d}}}),await this.store.put(`task`,l.task.id,{...l,inboxSeq:u,updatedAt:n}),await this.store.put(`inbox`,f,d),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=new Set(n.filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>Sp(e.task)).filter(e=>e!==void 0)),i=n.filter(e=>{let t=Sp(e.task);return e.status===`queued`&&(t===void 0||!r.has(t))}).sort((e,t)=>e.createdAt-t.createdAt),a=i[0];if(!a)return;let o=nc(a.task.id,`default`,a.attempts+1),s={...a,tokenHash:o.hash,lastSeenAt:e,status:`running`,attempts:a.attempts+1,startedAt:e,updatedAt:e};await this.store.put(`task`,s.task.id,s);let c=Sp(a.task);return{organizationId:`default`,status:s,token:o.token,more:i.some(e=>e!==a&&(c===void 0||Sp(e.task)!==c))&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&Op.has(e.status)||e.status===`queued`)return;if(Op.has(e.status))return e;let o={...e,lastSeenAt:i,updatedAt:i};return await this.store.put(`task`,t,o),o})}async authorize(e,t,n,r,i,a={}){let o=await this.touch(r,e,t,n,i,a.allowCompleted);return o&&{organizationId:`default`,status:o}}async archiveStopped(e,t,n){let r=e=>e!==void 0&&Op.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&be(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,...o}=n;return await this.store.put(`task`,t,{...e,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...o,...a===void 0?{}:{answer:[...e.answer??[],a]},updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t),await up(this.store,t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);return!e||!Op.has(e.status)||!this.allowed(e,i)?!1:(await this.store.put(`task`,t,{task:{...e.task,...n},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0)})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage);for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);await this.store.put(`task`,t,{...e,...n.outcome,...n.logsComplete?{logsComplete:!0}:{},lastSeenAt:r,finishedAt:r,updatedAt:r});for(let e of n.known??[])await this.store.put(`delivery`,e.id,{at:r},{ttlMs:e.ttlMs});return await up(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await up(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||Op.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await up(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>mp(e,t)).filter(e=>yp(e,n)).sort(t.since===void 0?vp:_p).slice(0,t.limit)}tombstone(e){this.tombstones.set(e,Date.now())}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,t]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,e])=>e>t).map(([e,t])=>({organizationId:n,id:e,at:t}))}}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>mp(e,t));return{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes,updatedAt:a}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!Q.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if(Op.has(e.status))return n.seq<=i?e.status:void 0;if(![`running`,`waiting`].includes(e.status))return;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c),u=Object.assign({},...a.map(e=>e.value.value?.admissions)),d={...e,...Object.keys(u).length?{task:Tp(e.task,u)}:{},inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,finishedAt:Date.now()}:{},updatedAt:Date.now()};await this.store.put(`task`,t,d);for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await up(this.store,t),d.status})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a,o){let s=async()=>{if(o&&(await this.store.get(`delivery`,o.key))?.sending?.owner!==o.owner)throw new pp;let e=await this.read(t);if(!e||!Q.includes(e.status)||(e.generation??0)!==a)return;let s=await this.nextSeq(t),c=o&&fp(o),l={seq:s,generation:a,at:i,kind:n,value:c?{...r,admissions:c}:r};return await this.store.put(`inbox`,`${t}:${String(s).padStart(8,`0`)}`,l),await this.store.put(`task`,t,{...e,...c?{task:Tp(e.task,c)}:{},inboxSeq:s,updatedAt:i}),o&&await this.store.finishBatch(o.key,o.owner,!0,o.through),l};return this.serial(()=>o?this.store.withAppLock(`batch:${o.key}`,s):s())}};const Ap=3e4;function jp(e,t,n,r){if(n&&!e.local&&!n.runnerId&&!e.runners[n.runner]?.push)return Promise.resolve();let i=e.queue.inboxDelivery??=new Map,a=JSON.stringify([e.organizationId,t]),o=i.get(a);if(o||i.set(a,o={}),o.work)return o.again=!0,o.work;let s=o,c=async()=>{let n,i=Er(),a=0,o=0,c,l=r,u=async()=>{for(;;){s.again=!1;let r=l??await e.store.get(`task`,t);if(l=void 0,!r?.handle||![`running`,`waiting`].includes(r.status))return;let c=await mn(e,r.task),u=!!(e.local&&r.handle.startsWith(`cli:`));if(!u&&!c?.push)return;o=r.generation??0;let d={generation:o,attempts:r.attempts,tokenHash:r.tokenHash??null,handle:r.handle},f=`inbox:${JSON.stringify([t,d])}`;if(n!==f){n&&await e.store.updateDeliveryLease(n,i),n=void 0;let t=await e.store.claimDeliveryLease(f,i,Ap);if(t===void 0)return;n=f,a=t}else if(!await e.store.updateDeliveryLease(n,i,{owner:i,failures:a},{ttlMs:Ap}))return;let p=(await e.queue.readInbox(e.organizationId,t,r.generation??0,-1)).slice(0,100);if(!p.length){if(s.again)continue;return}let m=u?await Ed(e,r,p):await c.push(r.handle,p);if(m.generation!==(r.generation??0)||!p.some(e=>e.seq===m.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,m,d)||(a=0,p.length<100&&!s.again))return}};try{await u()}catch(r){if(console.error(`coder server: inbox delivery failed for ${t}`,r),n){let t=Math.min(3e4,1e3*2**Math.min(a,5)),r={owner:i,failures:a+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,i,r,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,i),c=o)}return c};return s.work=(async()=>{for(;;){let n=await c();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!s.again)break}i.delete(a)})().finally(()=>{i.get(a)===s&&i.delete(a)}),s.work}async function Mp(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>jp(H(e,t),n.task.id)))}function Np(e,t){let n=Mp(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function Pp(){return(process.env.PATH??``).split(B.delimiter).some(e=>{try{let t=B.join(e,`docker`);return gr(t,_r.X_OK),br(t).isFile()}catch{return!1}})}function Fp(e){let t=!!e.local,n=t&&Pp();return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:Sn,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0}],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0}],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0}],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const Ip=S().check(t(1),e(80)),Lp=se([`personal`,`workspace`]),Rp=_e(S(),S()),zp=je({kind:se([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:Ip,scope:Lp,config:Rp}),Bp=je({name:x(Ip),default:x(we(!0)),config:x(Rp)});function Vp(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const Hp=(e,t)=>({value:n})=>hn(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function Up(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?_m(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(Hp(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return Vp(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function Wp(e,t,n,r){return C({items:Gp(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:Fp(t)})}function Gp(e,t,n){let r=t.filter(Hp(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:xn(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>Vp(e,t,n,e===i?.id))]}async function Kp(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=Up(t);{let n=zp.safeParse(await e.json().catch(()=>void 0));if(!n.success)return C({error:`Invalid runner`},400);if(!o(n.data.scope))return C({error:`This scope requires a member or workspace admin.`},403);let r=Fp(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return C({error:r.reason??`Pair this runner with runner serve.`},400);try{Cn(r,n.data.config)}catch(e){return C({error:e.message},400)}let s=Xp(n.data.kind,n.data.config,t),l=`rnr_${Tr(9).toString(`base64url`)}`,u={...n.data,...s,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),C(await c(l,u))}}async function qp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Up(t);if(i===xn(t))return C(await vn(t));let u=e=>{if(!e||!hn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!_m(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)},d=await t.store.get(`runner`,i),f=u(d);if(f)return f;let p=await vn(t,d);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===d.secret&&JSON.stringify(n.config)===JSON.stringify(d.config)&&await e.put(`runner`,i,{...n,lastSeen:p.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),C(p)}async function Jp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Up(t);if(i===xn(t)){if(_m(t)){let n=Bp.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return C({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{for(let{id:t,value:n}of await e.list(`runner`))n.scope===`workspace`&&n.default&&await e.put(`runner`,t,{...n,default:!1,updatedAt:o})});let r=(await c()).some(({value:e})=>e.scope===`personal`&&e.default);return C({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return C({error:`The server default cannot be renamed or removed.`},403)}let u=e=>{if(!e||!hn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!_m(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=u(r);if(a||!r)return a;{let a=Bp.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return C({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...E(t.config,r.secret),...a.data.config};try{Cn(Fp(t).find(e=>e.kind===r.kind),e)}catch(e){return C({error:e.message},400)}s=Xp(r.kind,e,t)}if(a.data.default)for(let e of await n.list(`runner`))e.id!==i&&e.value.scope===r.scope&&e.value.owner===r.owner&&e.value.default&&await n.put(`runner`,e.id,{...e.value,default:!1,updatedAt:o});let c={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,c),C(await l(i,c,n))}})}async function Yp(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=Up(t);if(i===xn(t))return C({error:`The server default cannot be renamed or removed.`},403);let u=e=>{if(!e||!hn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!_m(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=u(n);if(r||!n)return r;{let n=(await e.list(`task`)).filter(({value:e})=>e.task.runnerId===i&&Q.includes(e.status)).length;return n?C({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),t.settings?.runnerInstances?.delete(i),C({ok:!0}))}})}function Xp(e,t,n){let r=new Set(Fp(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:T(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const Zp=je({name:x(Ip),scope:Lp});async function Qp(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=Up(t),l=Zp.safeParse(await e.json().catch(()=>void 0));if(!l.success)return C({error:`Invalid pairing`},400);if(!o(l.data.scope))return C({error:`This scope requires a member or workspace admin.`},403);let u=`${Buffer.from(t.organizationId).toString(`base64url`)}.${Tr(32).toString(`base64url`)}`,d=a+9e5;await t.store.put(`snapshot`,`runner-pair:${vt(u)}`,{...l.data,owner:l.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:d},{ttlMs:9e5});let f=t.config.publicUrl??r.origin;return C({token:u,expiresAt:d,command:`coder runner serve --url ${f} --token ${u}`})}const $p=je({token:x(S()),id:x(S()),organizationId:x(S()),name:x(S().check(t(1),e(80))),url:S(),secret:S().check(t(32)),offline:x(ve())});async function em(e,t,n,r){let i=$p.safeParse(await e.json().catch(()=>void 0));if(!i.success)return C({error:`Invalid runner registration`},400);let a=i.data;try{new fn({url:a.url,secret:a.secret})}catch{return C({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return C({error:`Invalid runner token`},401);t=H(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${vt(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return C({error:`Pairing token expired or already used`},401);r=`rnr_${Tr(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...Xp(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!yt(E(t.config,i.secret).secret??``,a.secret))return C({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}return await e.put(`runner`,r,n),C({...Vp(r,n,s),organizationId:o})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}async function tm(e,t,n,r=!1,i){let a=bm(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=rc(a);return o.task!==n||o.organization!==t.organizationId||!Number.isInteger(o.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.authorize(n,tc(a),o.attempt,t.organizationId,(t.now??Date.now)(),{allowCompleted:r,include:i})??new Response(`Unauthorized`,{status:401})}function nm(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}async function rm(e,t,n,r){let i=n.id,a=bm(e),o=rc(a),s=tc(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return C({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?C(l):new Response(`Unauthorized`,{status:401})}async function im(e,t,n,r){let i=n.id,a=bm(e),o=rc(a),s=tc(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return C({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u===`cancelled`){let e=await t.store.get(`task`,i);e&&await Io(t,e)}return u?C({ok:!0}):new Response(`Unauthorized`,{status:401})}async function am(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return C({error:`Invalid task logs`},400);let i=await Sc(t,t.callbackTask,r);return i===`ok`?C({ok:!0}):i===`gap`?C({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function om(e,t,n,r){let i=n.id,a=bm(e),o=rc(a),s=tc(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?C({ok:!0}):new Response(`Unauthorized`,{status:401})}async function sm(e,t,n,r){let i=n.id;bm(e);let a=t.callbackTask,o=a.handle?await mn(t,a.task):void 0;if([`completed`,`failed`,`cancelled`].includes(a.status))return await Io(t,a,!1,o),C({ok:!0});let s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status)||s.installationRevoked!==void 0&&s.installationRevoked!==!0||s.machine!==void 0&&s.machine!==!0||s.postedMessages!==void 0&&(!Array.isArray(s.postedMessages)||s.postedMessages.some(e=>typeof e!=`string`)))return C({error:`Invalid task result`},400);let c=await xc(t,a,!0);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c(t):t)));let l=(t.now??Date.now)(),u=a.task.event?Ic(a.task.event,s.postedMessages??[]):[];if(s.status===`running`||s.status===`waiting`)return u.length&&await Lc(t,a.task.event,s.postedMessages,l),await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),C({ok:!0});let d=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),f={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:d,...typeof s.diff==`string`?{diff:s.diff}:{}},p=!o||o.kind===`vercel-sandbox`||o.kind===`local-docker`,m=await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,known:u.map(e=>({id:e,ttlMs:Ec})),logsComplete:!!a.handle&&!p,outcome:{status:s.status,result:f,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:nm(a.task),...a.task.usage?.engine??a.task.definition.engine?{engine:a.task.usage?.engine??a.task.definition.engine}:{},...a.task.usage?.model??a.task.definition.model?{model:a.task.usage?.model??a.task.definition.model}:{},credential:a.task.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l),h=a.task.event;if(m&&s.status===`failed`&&s.installationRevoked&&h&&t.integrations[h.integration]?.isUninstalled&&await Ku(t.store,`${h.appId}:${h.installationId}`,l),m&&s.machine&&h&&a.task.source===h.integration){let e=await t.store.get(`app`,h.appId),{recordFailure:n}=await Promise.resolve().then(()=>bl);e&&await n(t,e,s.error??`The machine failed`,h.installationId,h,async()=>(await lm(t,a)).replies)}return m&&await Io(t,p?a:{...a,logsComplete:!0},!1,o),C({ok:!0})}const cm=/^[a-f0-9-]{36}$/;async function lm(e,t){let n=t.task.event;if(!n||t.task.source!==n.integration)throw Error(`The task has no conversation`);let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation app is gone`);let{eventReplies:i}=await Promise.resolve().then(()=>Cl);return{event:n,replies:await i(e,r,n)}}async function um(e,t,n,r){let i=e.callbackTask,a=`${t}:${i.task.id}:${i.generation??0}:${n}`,o=(e.now??Date.now)();if(!await e.store.create(`delivery`,a,{at:o},{ttlMs:864e5}))return C({ok:!0,duplicate:!0});try{await r(await lm(e,i))}catch(t){return await e.store.delete(`delivery`,a),C({error:t instanceof Error?t.message:String(t)},409)}return C({ok:!0})}async function dm(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!cm.test(n.id))return C({error:`Invalid call id`},400);if(typeof n.text!=`string`||!n.text.trim())return C({error:`Reply text is required`},400);let r=n.text.trim();return um(t,`reply`,n.id,async({event:e,replies:n})=>{let i=await n.post(r,!0);i&&await Lc(t,e,i.ids??(i.id?[i.id]:[]),(t.now??Date.now)())})}async function fm(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!cm.test(n.id))return C({error:`Invalid call id`},400);if(typeof n.emoji!=`string`||!n.emoji.trim())return C({error:`Emoji is required`},400);if(n.message!==void 0&&(typeof n.message!=`string`||!n.message.trim()))return C({error:`Message id must be a non-empty string`},400);let{emoji:r,message:i}=n;return um(t,`react`,n.id,async({replies:e})=>{if(!e.react)throw Error(`The conversation cannot add reactions`);await e.react(r.trim(),i)})}async function pm(e,t,n,r){n.id,bm(e);let i=t.callbackTask,a=await e.json().catch(()=>({}));if(typeof a.authJson!=`string`||!i.task.credential)return C({error:`Invalid credential update`},400);let o=typeof a.credentialId==`string`?a.credentialId:i.task.credential;return o!==i.task.credential&&o!==i.task.engineCredentials?.codex?C({error:`Invalid credential update`},400):C({kept:await mf(t.store,t.config,o,a.authJson)})}async function mm(e,t,n,r){n.id,bm(e);let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await td(t,i);return C({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return C({error:e instanceof Error?e.message:String(e)},409)}}async function hm(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...H(t,n.organizationId),session:n}}const gm=new Set([`owner`,`admin`]);function _m(e){return!e.auth||gm.has(e.session?.role??``)}function vm(e,t){return _m(e)?e:C({error:t},403)}function ym(e,t){return!!(e&&t&&yt(e,t))}function bm(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const xm=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function Sm(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return xm.has(new URL(`http://${t}`).hostname)}catch{return!1}}const Cm=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,wm=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,Tm=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function Em(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(xm.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||wm(r)||Tm.some(e=>r.startsWith(e))}function Dm(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(Sm(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!Sm(e)&&(n.pathname===`/connections/oauth/client.json`||wm(n.pathname)||Tm.some(e=>n.pathname.startsWith(e)))}function Om(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function km(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function Am(e,t){if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!Sm(e))return n();let r=km(e),i=ym(bm(e),t.config.adminToken),a=ym(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||Om(e)?{...t,authorizedRequest:e}:nn():n()}let n=await t.auth.session(e.headers,e.method!==`GET`);if(n?.stale)return C({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(n?.organizationDenied)return C({error:`You are not a member of that workspace.`},403);let r=n?.role;return!n?.organizationId||!r?C({error:`Sign in first.`,hint:`coder auth login`},401,bm(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!Om(e,t.config.publicUrl)?nn():{...H(t,n.organizationId),auth:t.auth,session:n,authorizedRequest:e}}async function jm(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?an(new URL(e.url)):{...H(t,i.organizationId),session:i}}async function Mm(e,t){if(e.method!==`POST`)return;let n=$p.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=H(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&yt(E(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function Nm(e,t,n,r){let i=n.id,a=bm(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=rc(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=H(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function Pm(e,t,n,r,i=!1,a){let o=n.id,s=bm(e),c=s&&zm(s);c&&t.scope&&(t=H(t,c));let l=await tm(e,t,o,i,a);if(l instanceof Response)return l;let{status:u,loaded:d}=l;return{...t,...d?{store:ko(t.store,u,d)}:{},callbackTask:u}}const Fm=(e,t)=>(n,r,i,a)=>Pm(n,r,i,a,t(n),e),Im=Fm(`secrets`,e=>e.method===`POST`),Lm=Fm(`secrets`,()=>!0),Rm=Fm(`context`,()=>!1);function zm(e){let{organization:t}=rc(e);return typeof t==`string`?t:void 0}async function Bm(e,t,n){let r=bm(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=zm(r),a=i&&t.scope&&i!==t.organizationId?H(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!yt(tc(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function Vm(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??sn(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function Hm(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??n.id??``))return Ni(e,t);let i=await Vm(e,r),a=t.serverOrganizationId??t.organizationId;return i&&Wr(t,i)===`*`&&Ur(t,i)===a?{...H(t,a),operatorApp:!0}:jm(e,t)}function Um(e,t,n,r){return/^[a-z0-9_-]+$/.test(n.integration??n.id??``)?jm(e,t):Ni(e,t)}async function Wm(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??``))return Ni(e,t);if(!t.integrations[n.integration]?.auth.user||!t.auth||!t.config.publicUrl)return rn();if(e.method!==`GET`)return t;let i=await hm(e,t);return i?.session?i:an(r)}async function Gm(e,t,n,r){if(t.local&&!t.auth)return Xm(e,t);if(!t.auth)return rn();let i=await hm(e,t);return i?.session?i:an(r)}function Km(e,t){return vm(t,`Workspace admin access is required.`)}const qm=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function Jm(e,t){return qm(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?C({error:`Operator mode ended. Sign in again to continue.`},401):t:rn()}async function Ym(e,t,n,r){let i=await ah(e,t,n,r);return i instanceof Response||!t.auth?i:qm(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):rn()}function Xm(e,t){return t.local?t:rn()}function Zm(e,t){return t.local?C({error:Rd},400):t.session?.user.id?t:C({error:`Sign in to use a subscription.`},403)}function Qm(e){return async(t,n,r,i)=>{let a=n.authorizedRequest===t?n:await Am(t,n);return a instanceof Response?a:e?e(t,a,r,i):a}}function $m(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!Bd(n.engine))?C({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function eh(e,t,n,r){return t.config.publicUrl&&t.auth?t:Ni(e,t)}async function th(e,t,n,r){if(!t.auth)return Am(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?C({error:`You are not a member of that workspace.`},403):i?{...t,session:i}:C({error:`Sign in first.`,hint:`coder auth login`},401)}function nh(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!Sm(e)?rn():Om(e)?t:nn():t}async function rh(e,t,n,r){return e.method===`GET`?{...t,session:(await hm(e,t))?.session}:t}async function ih(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await hm(e,t))?.session?w(`/dash`):t}async function ah(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return Di(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return w(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await fi(u,t.dashboardHosts)?w(`${u}${r.search}`):t.auth&&e.method===`GET`&&await fi(`${c}${l}`,t.dashboardHosts)?w(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):rn()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...H(t,c.id),session:o}):t}function oh(e,t,n,r){return e.method===`POST`&&t.local?C({error:Rd},400):t}async function sh(e,t,n,r){if(![`GET`,`POST`].includes(e.method))return t;if(!t.auth)return rn();if(e.headers.get(`authorization`)?.startsWith(`Bearer `))return C({error:`Link your account from the browser.`},403);let i=await hm(e,t);return i?.session?i:e.method===`GET`?an(r):C({error:`Sign in first.`},401)}function ch(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:rn()}async function lh(e,t,n,r){if(!t.auth)return C({mode:Cm(t),organization:{id:t.organizationId,slug:`local`},server:uh(t),operator:qm(t)});let i=t.session;return C({mode:Cm(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:uh(t),operator:qm(t,i)})}function uh(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function dh(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function fh(e,t){let n=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug??t?.slug;return n||!e.auth?n??`local`:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const ph=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??ph(dh(e),`/setup`);return w(`${mh(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const mh=e=>e.local?`http://localhost:${e.local.port}`:``,hh=(e,t)=>ph(dh(e),`/agents/${encodeURIComponent(t)}/platforms`);function gh(e){let t=e.get(`agent`),n=e.get(`def`),r=sn(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const _h=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,vh=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function yh(e,t,n,r){let i=await Jr(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=sn(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await Kr(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}var bh=r({serverAppLink:()=>Sh,serverAppUrl:()=>Ch,sharedApps:()=>xh});async function xh(e,t){let n=e.serverOrganizationId&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store;return(await(n===e.store&&t?t:n.list(`app`))).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)}async function Sh(e,t={}){let n=ln(t.env??pr.env),r=bt(n.integrations);if(!r[e])throw new tt(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(r[e].app.builtin!==`shared`)throw new tt(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new tt(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await Ga(n);try{let a=i.defaultOrganizationId;return{url:await Ch({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function Ch(e,t,n){if(e.integrations[t]?.app.builtin!==`shared`)throw new tt(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=st();if(!r)throw new tt(`invalid-option`,`This server ships no default agent.`);let i={...ut()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:Zt(i),...n.owner?{owner:n.owner}:{},public:!0},o=await Br(e,`create`,`*`,vh(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${mh(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{sm as $,Ui as $n,Su as $t,Xm as A,Ja as An,wf as At,Om as B,qa as Bn,qu as Bt,oh as C,ts as Cn,Br as Cr,sf as Ct,Nm as D,Bo as Dn,gf as Dt,$m as E,zo as En,bf as Et,Wm as F,ro as Fn,ud as Ft,Pm as G,Fa as Gn,Nu as Gt,Cm as H,Pa as Hn,Ou as Ht,Jm as I,to as In,xd as It,om as J,ba as Jn,Mu as Jt,sh as K,Ba as Kn,Hu as Kt,Ym as L,$a as Ln,Sd as Lt,Bm as M,Ya as Mn,Dd as Mt,Lm as N,io as Nn,Od as Nt,Um as O,So as On,af as Ot,eh as P,Qa as Pn,md as Pt,am as Q,ga as Qn,bu as Qt,rh as R,no as Rn,hd as Rt,Hm as S,es as Sn,Jr as Sr,xf as St,nh as T,Fo as Tn,Sf as Tt,ih as U,Na as Un,zu as Ut,Im as V,Sa as Vn,Uu as Vt,Em as W,za as Wn,Bu as Wt,rm as X,va as Xn,lu as Xt,mm as Y,fa as Yn,Lu as Yt,pm as Z,pa as Zn,Tu as Zt,Qm as _,xc as _n,ni as _r,Qf as _t,_h as a,hu as an,zi as ar,Wp as at,Gm as b,bs as bn,Qr as br,Tf as bt,$ as c,cu as cn,li as cr,Gp as ct,yh as d,iu as dn,Ei as dr,Cp as dt,yu as en,ua as er,fm as et,ph as f,ru as fn,Mi as fr,Mp as ft,th as g,bc as gn,ti as gr,Lf as gt,xm as h,Sl as hn,Oi as hr,tp as ht,xh as i,mu as in,Vi as ir,Yp as it,Zm as j,so as jn,Wd as jt,Dm as k,wo as kn,Cf as kt,hh as l,tu as ln,Ni as lr,Jp as lt,dh as m,Kl as mn,Si as mr,dp as mt,Sh as n,Du as nn,Hi as nr,qp as nt,vh as o,_u as on,Pi as or,Qp as ot,lh as p,Jl as pn,Ai as pr,Np as pt,im as q,xa as qn,Vu as qt,Ch as r,Eu as rn,Bi as rr,Kp as rt,mh as s,gu as sn,H as sr,em as st,bh as t,xu as tn,aa as tr,dm as tt,gh as u,nu as un,Ti as ur,kp as ut,Km as v,nc as vn,ei as vr,ep as vt,ah as w,Vo as wn,Kd as wt,Rm as x,X as xn,Xr as xr,$f as xt,ch as y,ec as yn,Zr as yr,Zf as yt,vm as z,Ga as zn,Pd as zt};