@wular/coder 0.4.13 → 0.5.1

package/dist/apps-Bnk7F3A2.js

@@ -1,379 +0,0 @@
-import{Ft as e,Rt as t,en as n,qi as r}from"./core-DwsAMCnL.js";import{$ as i,$n as a,$t as o,A as s,B as c,Bn as l,Dr as u,F as d,Fn as f,G as p,Gt as m,Hn as h,K as g,Kt as _,L as v,Ln as y,N as b,Nn as ee,O as te,Pn as ne,Pt as re,Qn as ie,R as ae,Rn as oe,S as se,Tr as ce,W as le,Wt as ue,Xn as de,Yn as fe,Zn as pe,_ as me,_n as he,_r as x,ar as ge,at as _e,br as ve,cn as ye,cr as be,d as xe,dn as Se,dr as Ce,dt as we,er as Te,f as Ee,fr as S,gn as De,gr as Oe,hn as ke,in as Ae,ir as je,j as Me,jn as Ne,k as Pe,kr as Fe,lr as Ie,mn as Le,mr as Re,nn as ze,o as Be,ot as Ve,p as He,q as Ue,qn as We,rr as Ge,rt as Ke,tn as qe,tt as Je,ut as Ye,vn as Xe,xn as Ze,yn as Qe,zn as $e}from"./errors-DO_IltpP.js";import{B as et,Ct as tt,D as nt,Dt as rt,E as it,Et as at,F as ot,N as st,P as ct,St as lt,Tt as ut,Z as dt,bt as ft,dt as pt,gt as mt,j as ht,k as gt,ot as _t,pt as vt,wt as yt}from"./output-SNqdgh9A.js";import{a as bt,d as xt,f as St,i as Ct,l as wt,n as Tt,o as Et,r as Dt,t as Ot,u as kt}from"./load-BDlEFetB.js";import{m as At,p as jt}from"./slack-BtKvW_4v.js";import{t as Mt}from"./types-DPtbvoo3.js";import{n as Nt,t as Pt}from"./integrations-I7fRDk_l.js";import{t as Ft}from"./dist-DAnSqY1s.js";import{i as It,t as Lt}from"./discover-CHfF4cEz.js";import{a as Rt,c as zt,l as Bt,n as Vt,s as Ht,t as Ut}from"./actions-D12xDiQS.js";import{C as Wt,S as Gt,c as Kt,s as qt}from"./executor-ufWRqhdS.js";import{n as Jt}from"./log-view-CfX9lakH.js";import{n as Yt,r as Xt}from"./mcp-DAHbhfUh.js";import{i as Zt,n as Qt}from"./turn-DQ13lkPF.js";import{c as $t,n as en,o as tn,r as nn,t as rn,u as an}from"./exec-BmTa0vcO.js";import{f as on,r as sn}from"./task-iuYQ0zAK.js";import{n as cn}from"./async-Tj4zKHXR.js";import{n as ln,t as un}from"./match-CufHAZQH.js";import{n as dn,t as fn}from"./base64url-CsVsW4Id.js";import{a as C,c as pn,d as mn,f as hn,i as gn,l as _n,m as vn,n as yn,p as w,r as bn,u as xn}from"./http-Cg8PSe-c.js";import{n as Sn}from"./env-6Y-NNnYD.js";import{C as Cn,D as wn,E as T,O as Tn,T as En,a as Dn,b as On,d as kn,f as An,g as jn,h as Mn,m as Nn,o as Pn,p as Fn,r as In,s as Ln,t as Rn,u as zn,v as Bn,w as E}from"./runners-CfaGE0nV.js";import{C as Vn,T as Hn,_ as Un,b as Wn,c as Gn,d as Kn,h as qn,i as Jn,l as Yn,m as Xn,o as Zn,s as Qn,t as $n,u as er,w as tr,y as nr}from"./local-COlczLwI.js";import{n as rr,t as ir}from"./chat-bwKd3y6V.js";import{a as D,i as ar,t as or}from"./client-C4QCT6cG.js";import{C as sr,E as cr,M as O,S as lr,T as ur,_ as dr,agent as k,agentVersion as A,b as j,c as fr,chatItem as pr,chatState as M,d as N,engineCredential as mr,f as hr,g as gr,h as _r,integrationApp as vr,integrationAppInstallation as yr,m as P,p as F,platformLink as br,runner as xr,s as Sr,secret as I,task as L,taskHistory as Cr,taskInbox as R,taskLog as wr,taskTombstone as Tr,usage as Er,v as z,w as Dr,y as Or}from"./schema.js";import B from"node:path";import kr from"node:process";import{fileURLToPath as Ar,pathToFileURL as jr}from"node:url";import V,{accessSync as Mr,constants as Nr,existsSync as Pr,readFileSync as Fr,statSync as Ir}from"node:fs";import{execFile as Lr,spawn as Rr}from"node:child_process";import{createHash as zr,createHmac as Br,randomBytes as Vr,randomUUID as Hr}from"node:crypto";import Ur from"node:os";import Wr from"node:net";import{isDeepStrictEqual as Gr,promisify as Kr}from"node:util";import{brotliDecompressSync as qr,constants as Jr,createGzip as Yr,gunzipSync as Xr,gzipSync as Zr,inflateSync as Qr}from"node:zlib";const $r=e=>`nonce:${At(e)}`;function ei(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function ti(e,t){return Br(`sha256`,ei(e)).update(t).digest(`base64url`)}async function ni(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:Vr(18).toString(`base64url`),exp:a+i},s=dn(o),c=`${s}.${ti(e,s)}`;return await e.store.put(`delivery`,$r(c),{at:a,target:r},{ttlMs:i}),c}function ri(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&jt(ti(e,n),r))try{return fn(n)}catch{return}}async function ii(e,t){let n=await e.store.get(`delivery`,$r(t));return n&&`target`in n?n.target:void 0}function ai(e,t){return ri(e,t)?.organization}function oi(e,t){return ri(e,t)?.user}function si(e,t,n,r,i=!0){let a=ri(e,t);return a&&a.kind===n&&(a.user===r||i&&a.user===`*`)&&a.organization===e.organizationId&&a.exp>=(e.now??Date.now)()?a:void 0}async function ci(e,t,n,r,i){if(!si(e,t,n,r,!1))return!1;let a=await e.store.take(`delivery`,$r(t),{target:i});return!!a&&`target`in a&&a.target===i}async function li(e,t,n,r){if(!si(e,t,n,r))return;let i=await e.store.take(`delivery`,$r(t));return i&&`target`in i?i.target:void 0}async function ui(e,t,n,r){return si(e,t,n,r)?ii(e,t):void 0}const di=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function fi(e,t,n,r){return{method:e,pattern:t,handler:n,...r?{guard:r}:{}}}function pi(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function mi(e,t,n){return[e,`${e}/*`].flatMap(e=>di.map(r=>fi(r,e,t,n)))}function hi(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function gi(e,t,n,r){for(let i of e){let a=hi(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=pn();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const _i=`coder`;function vi(e,t){let n=e??`/dash`;try{let e=new URL(n,t);return e.origin===t&&!n.includes(`\\`)&&!/^\/[/\\]/.test(e.pathname)?`${e.pathname}${e.search}${e.hash}`:`/dash`}catch{return`/dash`}}const yi=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(Pt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function bi(e){let t=B.dirname(Ar(e));for(;;){let e=B.join(t,`package.json`);if(Pr(e))try{if(JSON.parse(Fr(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=B.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function xi(e=import.meta.url){let t=B.dirname(Ar(e)),n=bi(e),r=Ar(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[B.resolve(r,`../../..`),B.join(n,`dist/dash`),B.join(t,`../dash`)].find(e=>Pr(Si(e)))}const Si=e=>B.join(e,`standalone/server/manifest.json`);function Ci(e){let t=B.join(e,`standalone/server/entry.js`);if(!Pr(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function wi(e){let t=JSON.parse(Fr(Si(e),`utf8`));return{handler:await(await import(jr(Ci(e)).href)).createRequestHandler({root:B.join(e,`standalone`)}),manifest:t}}var Ti=class{moduleUrl;root;loaded;constructor(e=import.meta.url){this.moduleUrl=e}host(){let e=Date.now(),t=this.loaded;if(t&&e-t.checked<1e3)return t.host;if(this.root??=xi(this.moduleUrl),!this.root)return;let n;try{n=Ir(Si(this.root)).mtimeMs}catch{}if(t&&(t.checked=e,n===void 0||n===t.build))return t.host;let r={build:n,checked:e,host:wi(this.root)};return r.host.catch(()=>{this.loaded===r&&(this.loaded=void 0)}),this.loaded=r,r.host}};const Ei=e=>e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;function Di(e,t){let n=Ei(e);return!!(hi(`/assets/*`,n)||hi(`/dash/*`,n)||t.routes.some(e=>hi(e.route,n)))}async function Oi(e,t=new Ti){return!!(await t.host()?.catch(()=>void 0))?.manifest.routes.some(t=>hi(t.route,Ei(e)))}const ki=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,Ai=e=>`'sha256-${zr(`sha256`).update(e).digest(`base64`)}'`;function ji(e){let t=[...e.matchAll(ki)].map(e=>Ai(e[1]));return[...yi,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function Mi(e,t){return t===`gzip`?Xr(e).toString(`utf8`):t===`br`?qr(e).toString(`utf8`):t===`deflate`?Qr(e).toString(`utf8`):e.toString(`utf8`)}const Ni=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function Pi(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function Fi(e){let t=Yr(),n=e=>new Promise(n=>{t.write(e),t.flush(Jr.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function Ii(e,t,n,r){n.set(`content-security-policy`,[...yi,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return Ni(e)&&(Pi(n),i=Fi(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function Li(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return Ii(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=Mi(a,i);r.set(`content-security-policy`,ji(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&Ni(e)&&(s=new Uint8Array(Zr(o)),Pi(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function Ri(e,t=new Ti){let n=await t.host();if(!n||!Di(new URL(e.url).pathname,n.manifest))return;let r=Vr(16).toString(`base64`),i=new Headers(e.headers);return i.set(`content-security-policy`,`script-src 'nonce-${r}'`),Li(e,await n.handler(new Request(e,{headers:i})),r)}const zi=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function Bi(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function Vi(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=vi(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?Ih(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":zi(e,a)}}):w(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":zi(e,``,!0)}}):w(`/dash?token=rejected`,303)}async function Hi(e,t,n,r){return w(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function Ui(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(vi(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(Bi(e,n)).host!==new URL(a).host?w(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function Wi(e,t,n,r){return t.auth?!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?Ui(e,t,r,r.searchParams.get(`return`)):Ji(e,t):w(`/dash`)}function Gi(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,Bh(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}const Ki=()=>new Response(`UI is not built`,{status:503}),qi=e=>async(t,n)=>await Ri(Gi(t,n),n.dashboardHosts)??e(),Ji=qi(Ki),Yi=qi(_n);var Xi=r({appOwner:()=>Qi,chosenOrganization:()=>Zi,forInstallation:()=>$i,scoped:()=>H});function Zi(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}function H(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function Qi(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:H(e,n.organizationId),app:n.app}}async function $i(e,t){if(e.boundInstallation?.installation.id===t)return{...H(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:H(e,n)}function ea(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...H(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function ta(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function na(e,t,n,r){let i=t.session,a=r.searchParams.get(`token`)??``,o=ea(t,i,ai(t,a))??t;if(await ui(o,a,`link`,i.user.id))return await Ri(e,t.dashboardHosts)??Ki();let s=await li(o,a,`link-start`,i.user.id);if(!s)return new Response(`This link is invalid or has expired.`,{status:400});let c=await ni(o,`link`,i.user.id,s,3e5);return w(`/connect?token=${encodeURIComponent(c)}`)}async function ra(e,t,n,r){let i=t.session,a=await e.json().catch(()=>({})),o=typeof a.token==`string`?await li(ea(t,i,ai(t,a.token))??t,a.token,`link`,i.user.id):void 0;if(!o)return C({error:`This link is invalid or has expired.`},400);let s=JSON.parse(o);return await t.auth.link(i.user,s.platform,s.platformUserId,{organizations:i.organizations.map(e=>e.id)})===`taken`?C({error:`That platform account is connected to someone else.`},409):C({ok:!0,...s})}async function ia(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`connection`);if(c){let e=ea(t,s,r.searchParams.get(`organization`)??s.organizationId),n=e&&await e.store.get(`connection`,c);if(!e||!n||n.provider!==i.id||n.auth!==`oauth`||n.owner&&n.owner!==s.user.id)return C({error:`Unknown OAuth connection`},404);if(!n.owner){let t=Fh(e,`Only workspace owners and admins can authorize workspace connections`);if(t instanceof Response)return t}let l=await em(e,i.id);if(!l)return C({error:`No OAuth client is available for ${i.name}.`},400);let u=await ni(e,`native-oauth`,s.user.id,JSON.stringify({connection:n,app:l.id,attempt:r.searchParams.get(`attempt`)}));return w(a.authorizeUrl(E(t.config,l.credentials),{publicUrl:o,state:u,access:n.access??`write`}))}let l=r.searchParams.get(`installation`)??``,u=ea(t,s,l?await t.installationOrganization?.(l):void 0),d=u??{...t,session:s};if(!u)return $(d,`not-member`,{platform:i.id});let f=await ta(u,l);if(!f||f.integration!==i.id)return $(d,`disconnected`,{platform:i.id});let p=await ni(u,`link-oauth`,s.user.id,l);return w(a.authorizeUrl(E(t.config,f.credentials),{publicUrl:o,state:p}))}async function aa(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.session,c=r.searchParams.get(`state`)??``,l=ea(t,s,ai(t,c)),u=l??{...t,session:s},d=l&&await li(l,c,`native-oauth`,s.user.id);if(l&&d){let n=JSON.parse(d),r=n.connection;if(r.provider!==i.id)return $(u,`link-expired`,{platform:i.id});if(!r.owner){let e=Fh(l,`Only workspace owners and admins can authorize workspace connections`);if(e instanceof Response)return e}else if(r.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id});let c=await em(l,i.id,n.app);return c?l.store.withAppLock(`connection:${r.id}`,async d=>{let f=await d.get(`connection`,r.id);if(!f||JSON.stringify(f)!==JSON.stringify(r))return $(u,`link-expired`,{platform:i.id});let p=await a.exchange(e,E(t.config,c.credentials),{publicUrl:o,access:f.access??`write`,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return p?.token?f.owner&&await t.auth.link(s.user,i.id,p.id,{organizations:s.organizations.map(e=>e.id),token:T(t.config,{app:c.id,token:p.token})},d)===`taken`?$(u,`account-taken`,{platform:i.id}):(await d.put(`connection`,f.id,{...f,account:f.owner?p.id:p.login??p.id,oauthApp:f.owner?c.id:void 0,secret:f.owner?void 0:T(t.config,{app:c.id,token:p.token}),broken:void 0,updatedAt:(t.now??Date.now)()}),n.attempt&&await ua({...l,store:d},f,n.attempt),$(u,`linked`,{platform:i.id,account:p.login??p.id})):$(u,`failed`,{platform:i.id})}):$(u,`link-expired`,{platform:i.id})}let f=l&&await li(l,c,`link-oauth`,s.user.id),p=l&&f?await ta(l,f):void 0;if(!l||!p||p.integration!==i.id)return $(u,`link-expired`,{platform:i.id});let m=await a.exchange(e,E(t.config,p.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return m instanceof Mt?$(u,m.code,{platform:i.id,error:m.error}):m instanceof Error?(console.error(`coder server: ${i.id} sign-in failed`,m),$(u,`failed`,{platform:i.id})):await t.auth.link(s.user,i.id,m.id,{organizations:s.organizations.map(e=>e.id),...m.token?{token:T(t.config,{app:p.id,token:m.token})}:{}})===`taken`?$(u,`account-taken`,{platform:i.id}):(await Zp(l,s.user.id,i.id,m.id),$(u,`linked`,{platform:i.id,account:m.login??m.id}))}const oa=`/connections/oauth/client.json`,sa=`/connections/oauth/callback`,ca=6e5,la=e=>`connection-oauth:${e}`;async function ua(e,t,n){await e.store.put(`delivery`,`connection-authorized:${zr(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:ca})}const U=x().check(t(1)),da=Ce({resource:U,authorization_servers:je(U).check(t(1)),scopes_supported:S(je(U))}),fa=Ce({issuer:U,authorization_endpoint:U,token_endpoint:U,registration_endpoint:S(U),userinfo_endpoint:S(U),scopes_supported:S(je(U)),code_challenge_methods_supported:S(je(U)),client_id_metadata_document_supported:S(ge()),authorization_response_iss_parameter_supported:S(ge())}),pa=Ge([`none`,`client_secret_basic`,`client_secret_post`]),ma=Ce({client_id:U,client_secret:S(U),token_endpoint_auth_method:S(pa),redirect_uris:S(je(U))}),ha=Ce({name:S(U),preferred_username:S(U),email:S(U)});function ga(e,t){let n=ie(t);if(!l(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function _a(e,t,n,r=!1){for(let i of[...new Set(n)]){ga(e,i);let n=await pe(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function va(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function ya(e,t,n=!1,r){let i=ga(e,t),a=e.fetch??fetch;if(r===void 0){let e=await pe(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=va(r),s=await _a(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=da.parse(s);if(ga(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function ba(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return ie(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function xa(e){let t=ba(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+sa],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function Sa(e,t){return!t.config.publicUrl||ie(t.config.publicUrl).protocol!==`https:`?_n():C({client_id:ie(t.config.publicUrl).origin+oa,...xa(t)})}function Ca(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function wa(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function Ta(e,t,n){let r=await e.get(`delivery`,la(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function Ea(e,t,n){let r=Ca(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await ya(e,t.endpoint.url),s=a.authorization_servers[0],c=ga(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=fa.parse(await _a(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);ga(e,u.authorization_endpoint),ga(e,u.token_endpoint),u.registration_endpoint&&ga(e,u.registration_endpoint),u.userinfo_endpoint&&ga(e,u.userinfo_endpoint);let d=t.secret?E(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&ie(e.config.publicUrl).protocol===`https:`&&(f={clientId:ie(e.config.publicUrl).origin+oa,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await pe(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(xa(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=ma.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(ba(e)+sa))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=T(e.config,p),h=Vr(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{wa(await n.get(`connection`,t.id),t),await n.put(`delivery`,la(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:ca})});let g=Vr(32).toString(`base64url`),_=await ni(e,`connection-oauth`,r,T(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:ba(e)+sa,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),ca),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:ba(e)+sa,state:_,code_challenge:zr(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function Da(e,t,n){let r=t,i=e=>w(`${Ag(Og(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,o=ai(t,e);if(t.auth&&(!o||!t.session?.organizations.some(e=>e.id===o)))return i(`invalid-state`);let s=t.session?ea(t,t.session,o)??t:t;r=s;let c=await li(s,e,`connection-oauth`,Ca(s));if(!c)return i(`invalid-state`);let l=E(s.config,c);if(!l.owner&&!Ph(s))return i(`failed`);let u=E(s.config,l.secret),d=n.searchParams.get(`iss`);if((l.requireIssuer||d!==null)&&d!==u.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let f=n.searchParams.get(`code`);if(!f)return i(`failed`);wa(await s.store.get(`connection`,l.id),l),await Ta(s.store,l.id,l.attempt);let p=s.fetch??fetch,m=await a(p,u,new URLSearchParams({grant_type:`authorization_code`,code:f,redirect_uri:l.redirectUri,code_verifier:l.verifier})),h=m.preferred_username??m.email??m.name;if(!h&&l.userinfo)try{let e=await pe(p,l.userinfo,{headers:{authorization:`Bearer ${m.access_token}`,accept:`application/json`}});if(e.ok){let t=ha.parse(await e.json());h=t.preferred_username??t.email??t.name}}catch(e){console.error(`coder server: OAuth userinfo failed`,e)}return await s.store.withAppLock(`connection:${l.id}`,async t=>{let n=await t.get(`connection`,l.id);wa(n,l),await Ta(t,l.id,l.attempt),await t.put(`connection`,n.id,{...n,secret:T(s.config,Te(u,m,(s.now??Date.now)())),account:h??n.account,broken:void 0,updatedAt:(s.now??Date.now)()}),await t.delete(`delivery`,la(l.id)),await ua({...s,store:t},n,e)}),i(`connected`)}catch(e){return console.error(`coder server: connection OAuth callback failed`,e),i(`failed`)}}async function Oa(e,t,n){return(await Yp(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}function ka(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?Ur.homedir():e.startsWith(`~/`)?B.join(Ur.homedir(),e.slice(2)):e;if(!B.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=B.normalize(t);try{return V.statSync(n).isDirectory()?(V.accessSync(n,V.constants.R_OK),{ok:!0,folder:{path:n,name:B.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function Aa(e){let t=new Map,n=[...Pe(e),...te(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=ka(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:B.basename(e)},recent:[...t.values()],picker:!!Ma()}}const ja=e=>(process.env.PATH??``).split(B.delimiter).some(t=>t&&V.existsSync(B.join(t,e)));function Ma(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(ja(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(ja(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,Ur.homedir(),`--title`,e]]}async function Na(){let e=Ma();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await Kr(Lr)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?ka(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function Pa(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function Fa(e){let t=typeof e==`string`?e.trim():``,n=Pa(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=me(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>Kr(Lr)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await on(r,async()=>{if(V.existsSync(B.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await V.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await V.promises.rename(e,r)}finally{await V.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
-`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const Ia=e=>`app-token:${e}:`;async function La(e,t){return(await e.store.list(`snapshot`,{prefix:Ia(t)})).flatMap(({id:t,value:n})=>{if(!(`secret`in n))return[];let r=E(e.config,n.secret);return r.unusable?[]:[{id:t,token:r}]}).sort((e,t)=>t.token.lastUsedAt-e.token.lastUsedAt).map(({id:e,token:t})=>({id:e,label:`${t.workspaceName} · saved by ${t.savedBy}`}))}function Ra(e,t){let n=()=>(e.now??Date.now)();return{async put(r){let i=Ia(t)+At(JSON.stringify([r.workspace,r.user]));return await e.store.withAppLock(`${e.organizationId}:${i}`,t=>t.put(`snapshot`,i,{secret:T(e.config,{...r,savedBy:e.session?.user.name||`Server operator`,lastUsedAt:n()})})),i},async use(r,i){if(!r.startsWith(Ia(t)))throw new Mt(`invalid-field`,`token`,`Choose a saved configuration token or paste a new one.`);let a=await e.store.withAppLock(`${e.organizationId}:${r}`,async t=>{let a=await t.get(`snapshot`,r),o=a&&E(e.config,a.secret);if(!o||o.unusable)return{error:new Mt(`invalid-field`,`token`,`This configuration token is unavailable. Paste a new token.`)};let s=()=>t.put(`snapshot`,r,{secret:T(e.config,o)});try{let e=await i(o.credentials,async(e,t)=>{t&&(o.workspaceName=t),o.credentials=e,await s()},async()=>{o.unusable=!0,await s()});return o.lastUsedAt=n(),await s(),{value:e}}catch(e){return{error:e}}});if(`error`in a)throw a.error;return a.value}}}const za=`.coder/agents`,Ba=2592e6;function Va(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const Ha=(e,t,n)=>`repo-file:${e}@${t}@${n}:`;function Ua(e,t){let n=Va(t);return n?[Ha(e.id,n,t.repo?.defaultBranch??``)]:[]}const Wa=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function Ga(e,t,n,r,i,a){let o=`${Ha(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([Ka(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function Ka(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=Wa(n.installation,r,a??``),[f,p]=await Promise.all([n.token(),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:Ba}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:Ba}),_.text}const qa=e=>!!e.installation&&(e.partial===!0||e.paths.some(e=>e.startsWith(`.coder/`)));function Ja(e,t){let n=t.branch??e.defaultBranch,r=e.paths.filter(e=>e.startsWith(`.coder/agents/`));if(!(e.repo!==t.agentsRepo||e.branch!==n||!e.commit||!r.length))return{repo:e.repo,ref:e.commit,branch:n,paths:r}}async function Ya(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,Wa(t.installation,t.repo,r),{push:Hr()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:Ha(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:Ba})}}async function Xa(e,t,n,r,i){let a=await Ga(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function Za(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token();if(e)return{contents:t,token:e}}for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let a=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(a)try{let e=a.token?{...a,token:E(t.config,a.token)}:a;return{contents:i,token:await i.auth.token(e,E(t.config,r.credentials),{tools:i.tools.presets.read}),app:r,installation:a}}catch(e){console.error(`coder server: repository access for ${a.id} failed`,e);continue}}}function Qa(e,t){let n=t.cwd,r=t.now??Date.now;async function i(t,n,r){let i=Va(n),a=e[n.integration],o=i&&a?.repos&&await r(n.integration);if(!(!i||!o))return Xa(t,a,o,i,n.repo?.defaultBranch)}async function a(n,a,o,s){let c={store:s?.store??t.store,fileReads:t.fileReads},l=s??await Xn(t.store,n.agent);l.record?.source===`builtin`&&!t.settings?.builtinAgents&&(await qn(t,r()),l=await Xn(t.store,n.agent));let{record:u,version:d}=l;if(!u)return;if(u.problems?.length)throw new Ot(u.problems.join(`
-`));if(!d)throw Error(`No version ${u.currentVersion} for agent "${u.id}".`);let f=await i(c,a,o),p=f&&typeof f==`object`?f[n.agent]:void 0;if(p===!1||p?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${Va(a)??n.agentsRepo}.`);return Vn(u,d,p&&typeof p==`object`?p:void 0,e)}return async(i,o,s,c,l)=>{let u=n?(await Et(n,e)).find(e=>e.id===i.agent&&!e.builtin):void 0;if(u)return u;let d=await a(i,s,c,l);if(d)return d;if(i.agentsRepo){let n=await Za(e,t,i.agentsRepo,s,c);if(n){await $a(t.store,n.contents,i.agentsRepo,Va(s)===i.agentsRepo?s.repo?.defaultBranch??`HEAD`:`HEAD`,n.token,r());let e=await a(i,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await Wn(t.store,r(),i.agent,{})){let e=await a(i,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function $a(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=await t.repos.tree(n,s,i,r),d=o.slugs??[...new Set(u.filter(e=>/^[^/]+\/agent\.json$/.test(e)).map(e=>e.split(`/`)[0]))];return Dt(d),(await Promise.all(d.map(async o=>{let d=`${s}/${o}`,f=u.filter(e=>e.startsWith(`${o}/`)&&e.split(`/`).length<=22),p=Object.fromEntries(await Promise.all(f.map(async e=>[e.slice(o.length+1),await t.repos.readFile(n,`${s}/${e}`,i,r)]))),m=p[`agent.json`];if(m===void 0)return;let h;try{[h]=Tt({definitions:{[o]:{json:JSON.parse(m),builtin:!1}},usage:void 0},{...Pt,[t.id]:t})}catch(t){if(!(t instanceof Ot||t instanceof SyntaxError))throw t;console.error(`coder server: could not load agent ${o}`,t);let r=await e.get(`agent`,o);await e.put(`agent`,o,{id:o,name:o,source:`repo`,repo:n,path:d,currentVersion:0,createdAt:a,...r,problems:[t.message],updatedAt:a});return}if(!h)return;let{"agent.json":g,"system.md":_,...v}=p;return nr(e,{id:o,name:h.name,description:h.definition.description,source:`repo`,repo:n,path:d,definition:h.definition,systemPrompt:_??``,files:Object.fromEntries(Object.entries(v).filter(e=>e[1]!==void 0)),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a)}))).filter(e=>!!e)}const eo=e=>`app-sync:${e}`,to=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,spec:jg(r,t.agent,t.integration)})??r,no=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&Gr(e.manifest,n));async function ro(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,eo(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,spec:jg(r.definition,n.agent,n.integration)}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,eo(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,E(e.config,n.credentials),{publicUrl:a,spec:jg(r.definition,n.agent,n.integration),fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,eo(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function io(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await Un(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return ro(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=to(c,o,r,s.definition),d=eo(t),f=await a.get(`delivery`,d);if(!n&&no(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,E(e.config,o.credentials),{publicUrl:r,spec:jg(s.definition,o.agent,o.integration),fetch:e.fetch??fetch,tokens:Ra({...e,store:a},o.integration),saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:T(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:T(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function ao(e,t){let n=(await io(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
-`))}function oo(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function so(e,t,n,r=oo(),i){let a=await Za(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await $a(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await ao(e,o),o}const co=`default`;async function lo(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await import(`./client-C4QCT6cG.js`).then(e=>e.n);return t(e.databaseUrl,e.databasePool)}async function uo(e,t={}){if(e.store!==`postgres`){let e=t.local?new $n:new Zn;return{store:()=>e,queue:new Gm(e),chatState:new ir(t.local?B.join(le(``),`chat.json`):void 0),defaultOrganizationId:co,webhookTarget:async(t,n)=>{let r=await e.get(`app`,t),i=n?await e.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await e.list(`app`,{prefix:`${t}/`})){let i=await e.get(`installation`,`${r.id}${n.slice(t.length)}`);if(i&&!i.deletedAt)return{organizationId:co,app:r,bound:{organizationId:co,installation:i}}}return r&&{organizationId:co,app:r,...i&&i.app===t&&!i.deletedAt?{bound:{organizationId:co,installation:i}}:{}}},appRecord:async t=>{let n=await e.get(`app`,t);return n&&{organizationId:co,app:n}},apps:async t=>(await e.list(`app`,{prefix:`${t}:`})).map(e=>({organizationId:co,app:e.value})),installationOrganization:async t=>await e.get(`installation`,t)?co:void 0,installations:async t=>(await e.list(`installation`,{prefix:`${t}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:co})),taskOrganization:async(t,n)=>(await e.get(`task`,t))?.tokenHash===n?co:void 0,sweep:async()=>{},close:async()=>{}}}let n=await lo(e),[{DrizzleStore:r},{DrizzleQueue:i},{UNSCOPED_ORGANIZATION:a},{PgChatState:o}]=await Promise.all([Promise.resolve().then(()=>Bs),Promise.resolve().then(()=>Gs),Promise.resolve().then(()=>Uo),import(`./chat-CSepnsrK.js`)]);return{store:t=>new r(n.db,t,Date.now,e),queue:new i(n.db),chatState:new o(n.db),defaultOrganizationId:a,webhookTarget:(e,t)=>r.webhookTarget(n.db,e,t),appRecord:e=>r.appRecord(n.db,e),apps:e=>r.apps(n.db,e),installationOrganization:e=>r.installationOrganization(n.db,e),installations:e=>r.installations(n.db,e),taskOrganization:(e,t)=>r.taskOrganization(n.db,e,t),connection:n,sweep:e=>new r(n.db,a).sweep(e),close:()=>n.close()}}async function fo(e,t,n,r){return e.updateMetadata(t,n,r)}async function po(e,t){return e.getApps([...new Set(t)])}async function mo(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return C({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return C({error:`PUBLIC_URL is not set on this server`},400);let o=await ni(t,`install`,t.session?.user.id??`anonymous`,i.id),s=dn({tx:o,...r?{back:r}:{}});return C({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function ho(e,t){let n=e.serverOrganizationId,[r,i]=await Promise.all([e.store.list(`app`),n!==void 0&&n!==e.organizationId&&e.scope?e.scope(n).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.shareable)):[]]);return[...r,...i].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.shareable)&&(!t||n.agent===t))}function go(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,E(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}async function _o(e,t){let n=e.config.publicUrl,r=t.filter(t=>!t.builtin&&!t.shared&&e.integrations[t.integration]?.app);if(!n||!r.length)return new Set;let[i,a]=await Promise.all([e.store.list(`delivery`,{ids:r.map(e=>eo(e.id))}),e.store.listAgentsWithVersions([...new Set(r.map(e=>e.agent))])]),o=e=>i.find(t=>t.id===eo(e))?.value;return new Set(r.filter(t=>{let r=e.integrations[t.integration].app,i=a.find(e=>e.record.id===t.agent)?.version;return i?.definition.integrations[t.integration]?r.update?!no(o(t.id),i.version,to(r,t,n,i.definition)):o(t.id)?.changed===!0:!1}).map(e=>e.id))}async function vo(e,t,n,r){let i=await ho(t,r.searchParams.get(`agent`)),a=await _o(t,i.map(({value:e})=>e));return C(i.map(({id:e,value:n})=>({id:e,value:{...go(t,n),...a.has(e)?{changed:!0}:{}}})))}async function yo(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return C({error:`Unknown app`},404);if(r.builtin)return C({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now();for(let{id:e,value:n}of await t.store.list(`installation`))n.app===r.id&&!n.deletedAt&&await fo(t.store,`installation`,e,{deletedAt:i});return await t.store.delete(`app`,r.id),await nf(t.store,r.id),C({ok:!0})}async function bo(e,t){let n=await e.store.get(`app`,t);if(!n)return C({error:`Unknown app`},404);if(n.builtin||n.shared)return C({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return C({error:`PUBLIC_URL is not set on this server`},400);let r=e.integrations[n.integration];if(!r||!(r.app.update||r.app.drift||r.app.values))return C({error:`Coder cannot update ${r?.name??n.integration} apps.`},400);let i=await Un(e.store,n.agent);return i?.definition.integrations[n.integration]?{app:n,version:i,integration:r}:C({error:`The agent no longer listens on ${r.name}.`},400)}async function xo(e,t,n){let r=await bo(t,n.id);if(r instanceof Response)return r;if(r.integration.app.update)return C({error:`Coder updates ${r.integration.name} apps itself.`},400);try{return C(await ro(t,t.store,r.app,r.version))}catch(e){return console.error(`coder server: reading ${r.app.id} on ${r.integration.name} failed`,e),C({error:e instanceof Error?e.message:String(e)},502)}}async function So(e,t,n){let r=await bo(t,n.id);if(r instanceof Response)return r;let{app:i,version:a,integration:o}=r;if(o.app.values){let{lines:e}=o.app.values(i,{publicUrl:t.config.publicUrl,spec:jg(a.definition,i.agent,i.integration)});return await t.store.put(`delivery`,eo(i.id),{version:a.version,manifest:e,changed:!1}),C({updated:!0})}if(!o.app.update)return C({error:`Change the app on ${o.name}; Coder cannot.`},400);let[s]=await io(t,[a],i.id);return s?.error?C({error:s.error},502):C({updated:!0})}async function Co(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0,includeUninstalled:!0}:{},limit:mn(r,200)});return C(a.map(({id:e,value:n})=>{let{token:r,...i}=n,a=n.account.url??t.integrations[n.integration]?.app.accountUrl?.(n.account);return{id:e,value:{...i,account:{...i.account,...a?{url:a}:{}}}}}))}async function wo(e,t){let n=e.config.publicUrl,r=n?Rh.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),o=e.store.list(`app`),[s,c,l]=await Promise.all([a?Xn(e.store,a):void 0,zg(e,o),o]),u=s?.record,d=new Set(c.map(e=>e.integration));return C(await Promise.all(Object.values(e.integrations).map(async n=>{let a=typeof n.use==`function`?n.use(kt(s?.version?.definition.integrations[n.id])):n.use;return{id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...a?{use:a}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.shareable?`shared`:`own`,...n.auth.user?{personal:!0}:{},...await em(e,n.id,void 0,[...c,...l.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{saved:await La(e,n.id),name:u?.name,shared:d.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...n.app.update?{appUpdate:`push`}:n.app.drift?{appUpdate:`drift`}:n.app.values?{appUpdate:`confirm`}:{}}})))}async function To(e,t,n=!1,r){let i=t;if(i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=Eo(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function Eo(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await af(e,t,n,E(e.config,i.credentials)),o=await t.repos.list(ef(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await fo(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function Do(e,t=!1){let n=new Map,r=(await e.store.list(`installation`,{active:!0})).filter(({value:t})=>e.integrations[t.integration]?.repos),i=Array(r.length),a=0;await Promise.all(Array.from({length:Math.min(4,r.length)},async()=>{for(let n=a++;n<r.length;n=a++){let a=r[n].value;i[n]=t||a.repos==null?await To(e,a,t).catch(e=>(console.error(`coder server: repositories for installation ${a.id} failed`,e),a)):a}}));for(let e of i)if(!(!e||e.deletedAt))for(let t of e.repos??[])n.has(t)||n.set(t,{repo:t,integration:e.integration});return C([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}var Oo=r({addUsage:()=>jo,leaders:()=>Po,readUsage:()=>Vo,readUsageTotals:()=>Ho,sumUsageTotals:()=>No,timeZone:()=>Ao,usageReport:()=>Bo,usageSummary:()=>Lo,usageTotals:()=>Mo});function ko(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+ko(t),0)}function Ao(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const jo=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function Mo(e,t){return e.usageTotals(t)}async function No(e,t){if(t.top){let{top:n,...r}=t,i=(await Mo(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return Mo(e,{...r,parts:i})}let n=Ao(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:ko(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};jo(s,o),i.has(n.agent)&&(s.parts??={},jo(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Po(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function Fo(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=Fo(n[e],r);return n}function Io(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=Fo(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function Lo(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?Io(r,n):{agent:Io(r,`agent`),installation:Io(r,`installation`),engine:Io(r,`engine`)}}}const Ro={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},zo={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function Bo(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return C({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=Ro[n(`sort`)??`tokens`]??`tokenCount`,l=await Mo(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Ao(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await Et(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(Ct()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return C({...u,totals:l,top:Po(l,c)});if(!hn(t)||a!==`agent`)return C({...u,totals:l});let d=zo[n(`sort`)??`tokens`]??zo.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=yn(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=mn(t),y=e=>l.reduce((t,n)=>t+e(n),0);return C({...u,...xn(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function Vo(e,t,n,r){t.local&&await Xf(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:mn(r,200),...i?{installation:i}:{}});return C(i?a.filter(e=>e.value.installationId===i):a)}async function Ho(e,t,n,r){t.local&&await Xf(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);return[`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`?Bo(t,r):!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a)?C({error:`Invalid usage query`},400):C({since:i,totals:await t.store.usageSummary(i,a)})}var Uo=r({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>is,agentValue:()=>Zo,app:()=>W,date:()=>q,defined:()=>Jo,escapeLike:()=>qo,fromJson:()=>J,install:()=>G,ms:()=>K,opaque:()=>rs,readTaskContext:()=>Go,rows:()=>ss,setSecret:()=>as,splitKey:()=>Ko,stateKey:()=>Y,statePrefix:()=>os,storedTaskContext:()=>Wo,taskRecord:()=>ts,versionColumns:()=>$o,versionSummary:()=>es,versionValue:()=>Qo});function Wo(e){return e.connections===void 0&&!e.engineChain&&!e.engineCredentials?e.context:{...e.context,connections:e.connections,engineChain:e.engineChain,engineCredentials:e.engineCredentials}}function Go(e){let{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,...a}=e??{};return{connections:t,runnerLogs:n,engineChain:r,engineCredentials:i,context:Object.keys(a).length?a:void 0}}function Ko(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const W=vr,G=yr,K=e=>e.getTime(),q=e=>new Date(e),qo=e=>e.replace(/[\\%_]/g,`\\$&`),Jo=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),Yo=e=>e?K(e):void 0,Xo=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},Zo=e=>Jo({id:e.slug,name:e.name,description:e.description,problems:e.problems,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:K(e.createdAt),updatedAt:K(e.updatedAt)}),Qo=(e,t)=>Jo({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:Xo(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:K(e.createdAt)}),$o={id:A.id,agentId:A.agentId,version:A.version,definition:A.definition,commit:A.commit,importedFrom:A.importedFrom,createdAt:A.createdAt},es=(e,t)=>{let{systemPrompt:n,files:r,...i}=Qo({...e,systemPrompt:``,files:null},t);return i};function J(e,t){let n=new Sr(or);return Object.fromEntries(Object.entries(cr(e)).map(([e,r])=>{let i=t[n.getColumnCasing(r)];return[e,i==null?null:r.mapFromDriverValue(i)]}))}function ts(e){let t=Go(e.context);return Jo({task:Jo({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,connections:t.connections,author:e.author,definition:e.definition,credential:e.credential,engineChain:t.engineChain,engineCredentials:t.engineCredentials,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,context:t.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:Yo(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,...(t.runnerLogs?.handle??null)===e.handle&&t.runnerLogs?.attempts===e.attempts&&t.runnerLogs?.generation===e.generation?{logsComplete:t.runnerLogs?.complete}:{},archivedAt:Yo(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:K(e.createdAt),startedAt:Yo(e.startedAt),finishedAt:Yo(e.finishedAt),cancelRequestedAt:Yo(e.cancelRequestedAt),updatedAt:K(e.updatedAt)})}function ns(e,t){if(t.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:t.slice(6),keyVersion:0};let[n,r,i]=t.split(`.`);if(!n||!r||!i)throw Error(`Invalid encrypted secret`);return{iv:n,tag:r,ciphertext:i,keyVersion:Tn(e.encryption,t)}}function rs(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function is(e,t,n){let[r]=await e.db.insert(I).values({organizationId:e.organizationId,kind:t,...ns(e,n)}).returning({id:I.id});return r.id}async function as(e,t,n){await e.db.update(I).set({...ns(e,n),updatedAt:e.at()}).where(F(e.mine(I.organizationId),P(I.id,t)))}const os=(e,t)=>`o:${JSON.stringify([e,t])}:`,Y=(e,t,n)=>os(e,t)+n;async function ss(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}function cs(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(k).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:q(t.createdAt),updatedAt:q(t.updatedAt)}).onConflictDoUpdate({target:[k.organizationId,k.slug],set:{slug:t.id}}).returning(),a=Zo(i),[o]=a.currentVersion?await r.select().from(A).where(F(P(A.agentId,i.id),P(A.version,a.currentVersion))):[],s=o&&Qo(o,t.id),c=!!(s&&Gr(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&Gr(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&Gr(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let d=c?O``:O`with published as (
-      insert into ${A} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
-      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
-        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${q(l.createdAt).toISOString()}::timestamptz)
-      returning version
-    )`;return await r.execute(O`${d} update ${k} set
-      name = ${u.name}, description = ${u.description??null}, problems = null, source = ${u.source},
-      repo = ${u.repo??null}, path = ${u.path??null},
-      current_version = ${c?O`${l.version}`:O`(select version from published)`}, updated_at = ${q(u.updatedAt).toISOString()}::timestamptz
-      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function ls(e){let t=k;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(F(e.mine(t.organizationId),n)).orderBy(N(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:Zo(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,problems:r.problems??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:q(r.createdAt),updatedAt:q(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.slug,n)))}}}async function us(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(A).values({agentId:O`(select id from ${k} where organization_id = ${e.organizationId} and slug = ${t.slice(0,r)})`,version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:q(n.createdAt)}).onConflictDoNothing().returning({id:A.id})).length>0}function ds(e){let t=A,n=O`${k.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>F(P(k.slug,e),n===void 0?void 0:r?P(t.version,n):_r(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:k.slug,key:n}).from(t).innerJoin(k,P(k.id,t.agentId)).where(F(e.mine(k.organizationId),r)).orderBy(N(k.slug),N(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:Qo(e,t)}))},put:async(t,n)=>{await us(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=O`(select id from ${k} where organization_id = ${e.organizationId} and slug = ${n.slice(0,r)})`;await e.db.delete(t).where(F(P(t.agentId,i),P(t.version,Number(n.slice(r+1)))))}}}const fs=(e,t)=>Jo({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:rs(t),createdAt:K(e.createdAt)});function ps(e){let t=W;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.credentialsSecretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:fs(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:I}).from(t).innerJoin(I,P(I.id,t.credentialsSecretId)).where(F(e.mine(t.organizationId),P(t.key,n))),[a]=r.shared?await e.db.select({secretId:t.credentialsSecretId}).from(t).where(F(P(t.organizationId,``),P(t.key,r.shared))):[];if(r.shared&&!a)throw Error(`No shared app ${r.shared}`);let o=i?.secretId??a?.secretId??await is(e,`app`,r.credentials);i&&!r.shared&&rs(i.sealed)!==r.credentials&&await as(e,o,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:o,createdAt:q(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(I).where(F(P(I.id,r.secretId),e.mine(I.organizationId)))})}}function ms(e,t,n){return Jo({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?rs(n):void 0,installer:e.installer,self:e.self,covers:e.covers,repos:e.repos,settings:e.settings,createdAt:K(e.createdAt),deletedAt:e.deletedAt?K(e.deletedAt):void 0,uninstalled:e.uninstalled||void 0})}function hs(e,t,n){let r=n.app.split(`/`)[0],i=[t.slice(n.app.length+1),...n.covers??[]],a=O`array[${O.join(i.map(e=>O`${e}`),O`, `)}]::text[]`;return e.transaction(`binding:${r}`,async e=>{let[n]=await e.db.select({id:G.id}).from(G).innerJoin(W,P(W.id,G.appId)).where(F(ur(z(G.platformInstallId,i),O`${G.covers} ?| ${a}`),j(G.deletedAt),Dr(G.key,t),ur(P(W.key,r),O`left(${W.key}, ${r.length+1}) = ${`${r}/`}`))).limit(1);if(n)throw new Kn(`Installation "${t}" is bound through another app.`)})}function gs(e){let t=G;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:W.key,integration:W.integration},sealed:I}).from(t).innerJoin(W,P(W.id,t.appId)).leftJoin(I,P(I.id,t.tokenSecretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:ms(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({row:t,sealed:I,appKey:W.key,parent:O`(select id from ${W} where organization_id in (${e.organizationId}, ${``}) and key = ${r.app} order by organization_id desc limit 1)`}).from(O`(select 1) as anchor`).leftJoin(t,P(t.key,n)).leftJoin(W,P(W.id,t.appId)).leftJoin(I,P(I.id,t.tokenSecretId)),a=i?.row?{secretId:i.row.tokenSecretId,organizationId:i.row.organizationId,covers:i.row.covers,deletedAt:i.row.deletedAt,appKey:i.appKey,sealed:i.sealed}:void 0,o=()=>Error(`Installation "${n}" belongs to another workspace.`);if(a&&a.organizationId!==e.organizationId)throw o();if(!i?.parent)throw Error(`Unknown app "${r.app}".`);r.deletedAt===void 0&&(!a||a.appKey!==r.app||a.deletedAt!==null||JSON.stringify(a.covers??[])!==JSON.stringify(r.covers??[]))&&await hs(e,n,r);let s=a?.secretId??null;r.token&&(s?(!a?.sealed||rs(a.sealed)!==r.token)&&await as(e,s,r.token):s=await is(e,`installation`,r.token));let c={appId:i.parent,platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?s:null,installer:r.installer??null,self:r.self??null,covers:r.covers??null,repos:r.repos??null,settings:r.settings??null,createdAt:q(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:q(r.deletedAt),uninstalled:r.uninstalled??null},[l]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...c}).onConflictDoUpdate({target:t.key,set:c,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!l)throw o();!r.token&&a?.secretId&&await e.db.delete(I).where(P(I.id,a.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(I).where(P(I.id,r.secretId))})}}async function _s(e,t){let n=fr(G,`locked`),[r]=await e.db.select({row:n,app:{key:W.key,integration:W.integration},sealed:I}).from(n).innerJoin(W,P(W.id,n.appId)).leftJoin(I,P(I.id,n.tokenSecretId)).where(F(e.mine(n.organizationId),P(n.key,t))).for(`update`,{of:n});return r&&ms(r.row,r.app,r.sealed)}const vs=(e,t)=>Jo({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,owner:e.owner,account:e.account,createdAt:K(e.createdAt)}),ys=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function bs(e,t){let n=mr;return(await e.db.select({row:n,sealed:I}).from(n).innerJoin(I,P(I.id,n.secretId)).where(F(e.mine(n.organizationId),t?P(n.owner,t):j(n.owner))).orderBy(N(n.label)).for(`update`)).map(({row:e,sealed:t})=>({id:dp(e.owner??void 0,e.label),value:vs(e,t),row:e,sealed:t}))}async function xs(e,t,n,r){let i=mr;if(!r){if(!t)return;await e.db.delete(i).where(P(i.id,t.row.id)),await e.db.delete(I).where(P(I.id,t.row.secretId));return}let a=rs(r),o={account:r.account??null,createdAt:r.createdAt===void 0?t?.row.createdAt??e.at():q(r.createdAt),updatedAt:e.at()};if(t){rs(t.sealed)!==a&&await as(e,t.row.secretId,a),await e.db.update(i).set(o).where(P(i.id,t.row.id));return}let{owner:s,name:c}=fp(n);await e.db.insert(i).values({organizationId:e.organizationId,owner:s??null,label:c,secretId:await is(e,`engine`,a),...o})}function Ss(e){let t=mr,n=(t,n)=>{let{owner:r}=fp(t);return e.transaction(ys(e,r),async e=>xs(e,(await bs(e,r)).find(e=>e.id===t),t,n))};return{key:O`coalesce(${t.owner} || '/', '') || ${t.label}`,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(O`coalesce(${t.owner} || '/', '') || ${t.label}`));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:dp(e.owner??void 0,e.label),value:vs(e,t)}))},put:(e,t)=>n(e,t),delete:e=>n(e,null)}}const Cs=(e,t)=>O`jsonb_build_object('row', to_jsonb(${e}), 'sealed', to_jsonb(${t}))`,ws=e=>{let t=J(mr,e.row);return{id:dp(t.owner??void 0,t.label),value:vs(t,J(I,e.sealed))}},Ts=e=>{let t=J(xr,e.row);return{id:t.publicId,value:js(t,J(I,e.sealed))}},Es=e=>{let t=J(W,e.app);return{installation:ms(J(G,e.row),t,e.sealed?J(I,e.sealed):null),app:fs(t,J(I,e.credentials))}};function Ds(e,t,n,r){let i=M,a=t.map(t=>`${qo(Y(e,`snapshot`,Hn(t)))}%`),o=[...t,...n].map(t=>Y(e,`snapshot`,tr(t)));return O`(select coalesce(jsonb_object_agg(${i.key}, ${i.value}), '{}'::jsonb) from ${i}
-    where (${i.expiresAt} is null or ${i.expiresAt} > clock_timestamp()) and (${i.key} like any(${O.param(a)}::text[])
-      or ${i.key} in (select unnest(${O.param(o)}::text[])${r?O` union all ${r}`:O``})))`}function Os(e,t){let n=os(e,`snapshot`),r={held:new Map,drops:new Map};for(let[e,i]of Object.entries(t)){let t=e.slice(n.length);t.startsWith(`token-drop:`)?r.drops.set(t,i.drop):r.held.set(t,i)}return r}function ks(e){let t=O`coalesce((${M.value}->>'version')::bigint, jsonb_array_length(${M.value}->'messages') + (${M.value}->>'more')::bigint)`,n=O`greatest(coalesce((${M.value}->>'acknowledged')::bigint, 0), least(${e}, ${t}))`;return O`(select ${M.value} || jsonb_build_object('version', ${t}, 'acknowledged', ${n},
-        'messages', remaining, 'more', ${t} - ${n} - jsonb_array_length(remaining))
-        from (select coalesce(jsonb_agg(item order by n) filter (where coalesce((item->>'sequence')::bigint, n) > ${n}), '[]'::jsonb) as remaining
-          from jsonb_array_elements(${M.value}->'messages') with ordinality e(item,n)) as pending)`}function As(e,t){let n=M,r=os(e.organizationId,t),i=n.key;return{key:i,where:e=>F(e.id===void 0?O`${n.key} like ${`${qo(r+(e.prefix??``))}%`}`:P(n.key,r+e.id),e.after===void 0?void 0:_r(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:O`${n.value}`}).from(n).where(F(O`${n.key} like ${`${qo(r)}%`}`,e.live(n.expiresAt),t)).orderBy(N(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o,c=e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?O`${n.expiresAt}`:s}}),l=t===`delivery`&&i.startsWith(`connection-authorized:`)?e.notification(t,i):void 0;await(l?c.returning(l):c)},delete:async i=>{await e.db.delete(n).where(P(n.key,r+(t===`config`?`workspace`:i)))}}}const js=(e,t)=>Jo({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?K(e.lastSeen):void 0,secret:rs(t),createdAt:K(e.createdAt),updatedAt:K(e.updatedAt)});function Ms(e){let t=xr,n=n=>F(e.mine(t.organizationId),P(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(F(e.mine(t.organizationId),n)).orderBy(N(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:js(e,t)}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[a]=await e.db.select({id:t.id,secretId:t.secretId,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(n(r)),o={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:q(i.lastSeen),updatedAt:q(i.updatedAt)};if(a){rs(a.sealed)!==i.secret&&await as(e,a.secretId,i.secret),await e.db.update(t).set(o).where(P(t.id,a.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await is(e,`runner`,i.secret),createdAt:q(i.createdAt),...o})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(I).where(P(I.id,i.secretId))})}}function Ns(e,t){let n=Y(e,`snapshot`,`connection-secrets:${t}`),r=t=>O`${M.key} like ${`${qo(Y(e,`snapshot`,t))}%`}`;return O`(${M.key} = ${n} or ${r(`connection-secrets:${t}:`)} or ${r(`connections:${t}:`)})`}function Ps(e){let t=L;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(F(e.mine(t.organizationId),n)).orderBy(N(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:ts(e)}))},put:async(n,r,i,a={})=>{let{task:o}=r,s={source:o.source,status:r.status,agent:o.agent,flow:o.flow,reviewKey:Lm(o)??null,runner:o.runner,permissions:o.permissions??null,appId:o.event?O`(select id from ${W} where organization_id in (${e.organizationId}, ${``}) and key = ${o.event.appId} order by organization_id desc limit 1)`:null,installationId:o.event?O`(select id from ${G} where organization_id = ${e.organizationId} and key = ${`${o.event.appId}:${o.event.installationId}`})`:null,event:o.event??null,prompt:o.prompt??null,args:o.args??null,mcp:o.mcp??null,author:o.author??null,definition:o.definition,credential:o.credential??null,requester:o.requester??null,runnerId:o.runnerId??null,usage:o.usage??null,tools:o.tools,context:r.logsComplete===void 0?Wo(o)??null:{...Wo(o),runnerLogs:{complete:r.logsComplete,handle:r.handle,attempts:r.attempts,generation:r.generation??0}},files:o.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:q(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:q(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:q(r.createdAt),startedAt:r.startedAt===void 0?null:q(r.startedAt),finishedAt:r.finishedAt===void 0?null:q(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:q(r.cancelRequestedAt),updatedAt:q(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...s,archivedAt:a.unarchive?s.archivedAt:O`coalesce(${t.archivedAt}, ${s.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(F(e.mine(t.organizationId),P(t.publicId,n)))}}}async function Fs(e,t){return(await e.db.select({engine:Cr.engine,conversation:Cr.conversation,savedAt:Cr.savedAt}).from(Cr).innerJoin(L,P(L.id,Cr.taskId)).where(F(e.mine(Cr.organizationId),e.mine(L.organizationId),P(L.publicId,t))).orderBy(N(Cr.savedAt))).map(e=>({...e,savedAt:K(e.savedAt)}))}function Is(e){let t=Cr,n=O`${L.publicId} || ':' || ${t.conversation}`,r=e=>[e.slice(0,e.indexOf(`:`)),e.slice(e.indexOf(`:`)+1)];return{key:n,where:({id:n,prefix:i})=>{let[a,o]=r(n??i??``);return F(e.mine(L.organizationId),P(L.publicId,a),n===void 0?void 0:P(t.conversation,o))},rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,P(L.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(N(t.savedAt));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:Jo({engine:e.engine,conversation:e.conversation,data:e.data,state:e.state,savedAt:K(e.savedAt)})}))},put:async(n,i)=>{let a={engine:i.engine,data:i.data,state:i.state??null,savedAt:q(i.savedAt)};await e.db.insert(t).values({organizationId:e.organizationId,taskId:O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${r(n)[0]})`,conversation:i.conversation,...a}).onConflictDoUpdate({target:[t.taskId,t.conversation],set:a})},delete:async n=>{let[i,a]=r(n),o=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${i})`;await e.db.delete(t).where(F(P(t.taskId,o),P(t.conversation,a)))}}}function Ls(e){let t=wr,n=O`${L.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>F(e.mine(L.organizationId),P(L.publicId,n),r===void 0?void 0:i?P(t.seq,r):_r(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,P(L.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(N(L.publicId),N(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:K(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:q(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(F(P(t.taskId,i),P(t.seq,Number(n.slice(r+1)))))}}}function Rs(e){let t=R,n=O`${L.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>F(e.mine(L.organizationId),P(L.publicId,n),r===void 0?void 0:i?P(t.seq,r):_r(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(L,P(L.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(N(L.publicId),N(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:K(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,i)})`,seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:q(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n.slice(0,r)})`;await e.db.delete(t).where(F(P(t.taskId,i),P(t.seq,Number(n.slice(r+1)))))}}}function zs(e){let t=Er;return{key:L.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:L.publicId,installationId:G.key}).from(t).innerJoin(L,P(L.id,t.taskId)).leftJoin(G,P(G.id,t.installationId)).where(F(e.mine(t.organizationId),n)).orderBy(N(L.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:Jo({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:K(e.at)})}))},put:async(n,r)=>{let i=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n})`,a={installationId:r.installationId?O`(select id from ${G} where organization_id = ${e.organizationId} and key = ${r.installationId})`:null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:q(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=O`(select id from ${L} where organization_id = ${e.organizationId} and public_id = ${n})`;await e.db.delete(t).where(P(t.taskId,r))}}}var Bs=r({DrizzleStore:()=>Vs}),Vs=class e{db;organizationId;now;encryption;inTransaction;notifications;recordChannel(e,t){return`record_${zr(`sha256`).update(JSON.stringify([this.organizationId,e,t])).digest(`hex`).slice(0,48)}`}notification(e,t){return this.notifications?{notified:O`pg_notify(${this.recordChannel(e,t)}, '')`}:void 0}async watch(e,t){let n=u(),r=this.db.$client,i=r?.listen?await r.listen(this.recordChannel(e,t),n.notify,n.notify).catch(()=>void 0):void 0;return{...n,close(){i?.unlisten().catch(()=>{}),n.close()}}}publishAgent=(e,t)=>cs(this,e,t);kinds;constructor(e,t,n=Date.now,r={},i=!1,a=!!e.$client?.unsafe){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.inTransaction=i,this.notifications=a,this.kinds={agent:ls(this),agentversion:ds(this),app:ps(this),installation:gs(this),credential:Ss(this),task:Ps(this),history:Is(this),tasklog:Ls(this),inbox:Rs(this),usage:zs(this),delivery:As(this,`delivery`),login:As(this,`login`),config:As(this,`config`),runner:Ms(this),snapshot:As(this,`snapshot`),connection:As(this,`connection`)}}static async webhookTarget(e,t,n){let r=fr(I,`installation_secret`),[i]=await D(e,()=>e.select({app:W,credentials:I,installation:G,token:r}).from(W).innerJoin(I,P(I.id,W.credentialsSecretId)).leftJoin(G,F(P(G.appId,W.id),P(G.key,n??``),j(G.deletedAt))).leftJoin(r,P(r.id,G.tokenSecretId)).where(F(P(W.integration,t.slice(0,t.indexOf(`:`))),P(W.platformAppId,t.slice(t.indexOf(`:`)+1)))));if(i&&!i.installation&&n){let a=`${i.app.platformAppId}/`,[o]=await D(e,()=>e.select({app:W,credentials:I,installation:G,token:r}).from(G).innerJoin(W,P(W.id,G.appId)).innerJoin(I,P(I.id,W.credentialsSecretId)).leftJoin(r,P(r.id,G.tokenSecretId)).where(F(P(W.integration,i.app.integration),O`left(${W.platformAppId}, ${a.length}) = ${a}`,P(G.platformInstallId,n.slice(t.length+1)),j(G.deletedAt))).limit(1));if(o)return{organizationId:o.app.organizationId,app:fs(o.app,o.credentials),bound:{organizationId:o.installation.organizationId,installation:ms(o.installation,o.app,o.token)}}}return i&&{organizationId:i.app.organizationId,app:fs(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:ms(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await D(e,()=>e.select({row:W,sealed:I}).from(W).innerJoin(I,P(I.id,W.credentialsSecretId)).where(F(P(W.integration,t.slice(0,t.indexOf(`:`))),P(W.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:fs(n.row,n.sealed)}}static async apps(e,t){return(await D(e,()=>e.select({row:W,sealed:I}).from(W).innerJoin(I,P(I.id,W.credentialsSecretId)).where(P(W.integration,t)))).map(({row:e,sealed:t})=>({organizationId:e.organizationId,app:fs(e,t)}))}static async installationOrganization(e,t){let[n]=await D(e,()=>e.select({organizationId:G.organizationId}).from(G).where(P(G.key,t)));return n?.organizationId}static async installations(e,t){return D(e,()=>e.select({key:G.key,organizationId:G.organizationId}).from(G).where(F(O`${G.key} like ${`${qo(t)}:%`}`,j(G.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await D(e,()=>e.select({organizationId:L.organizationId}).from(L).where(F(P(L.publicId,t),P(L.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await D(this.db,()=>this.db.select({row:W,sealed:I}).from(W).innerJoin(I,P(I.id,W.credentialsSecretId)).where(F(z(W.organizationId,[this.organizationId,``]),z(W.key,e))))).map(e=>({id:e.row.key,value:fs(e.row,e.sealed)})):[]}async listCredentials(e){let t=mr,n=this.db.select({row:t,sealed:I}).from(t).innerJoin(I,P(I.id,t.secretId)).where(F(this.mine(t.organizationId),e.owner?ur(j(t.owner),P(t.owner,e.owner)):j(t.owner))).orderBy(N(O`case when ${t.owner} is null then 'workspace' else 'personal' end`),N(t.label));return(await D(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({row:e,sealed:t})=>({id:dp(e.owner??void 0,e.label),value:vs(e,t)}))}async updateMetadata(e,t,n){return e===`installation`&&(`covers`in n||`deletedAt`in n)?this.transaction(`installation:${t}`,async r=>{let i=await r.get(`installation`,t);if(!i)return!1;let a={...i,...n};return a.deletedAt===void 0&&await hs(r,t,a),r.writeMetadata(e,t,n)}):this.writeMetadata(e,t,n)}async writeMetadata(e,t,n){let r=e===`app`?W:e===`installation`?G:xr,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`self`,`covers`,`repos`,`settings`,`deletedAt`,`uninstalled`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?q(t):t])),o=e===`runner`?xr.publicId:e===`app`?W.key:G.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?q(n.updatedAt):this.at()}).where(F(this.mine(r.organizationId),P(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){let n=/^connections?[:-]/.test(e)?`${this.organizationId}:${e}`:e;return this.transaction(`app:${n}`,t)}withConfigLock(e){return this.transaction(`config:${this.organizationId}`,e)}async transaction(t,n){let r=O`select pg_advisory_xact_lock(3, hashtext(${t}))`;return this.inTransaction?(await this.db.execute(r),n(this)):this.db.transaction(async t=>(await t.execute(r),n(new e(t,this.organizationId,this.now,this.encryption,!0,this.notifications))))}withCredential(e,t,n){if(e===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>Yn(e,`runner`,t,n));if(e===`installation`)return this.transaction(`installation:${t}`,async e=>{let r=await _s(e,t),i=await n(r,r?[{id:t,value:r}]:[],e);for(let t of i??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!i?.length});let{owner:r}=fp(t);return this.transaction(ys(this,r),async e=>{let i=await bs(e,r),a=i.map(({id:e,value:t})=>({id:e,value:t})),o=await n(a.find(e=>e.id===t)?.value,a,e);for(let t of o??[])await xs(e,i.find(e=>e.id===t.id),t.id,t.value);return!!o?.length})}at(){return q(this.now())}live(e){return ur(j(e),_r(e,this.at()))}mine(e){return P(e,this.organizationId)}async get(e,t){if(e===`app`)return(await this.getApps([t]))[0]?.value;let n=this.kinds[e],r=Ko(t),i=n.where?n.where({id:t}):n.split&&r?n.split(r[0],r[1],!0):O`${n.key} = ${t}`;return(await D(this.db,async()=>await n.rows(i,1)))[0]?.value}async patchLogin(e,t,n={}){let[r]=await this.db.update(M).set({value:O`jsonb_strip_nulls(${M.value} || ${JSON.stringify(t)}::jsonb)`}).where(F(P(M.key,Y(this.organizationId,`login`,e)),this.live(M.expiresAt),O`(${M.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?z(O`${M.value}->>${e}`,t):O`${M.value}->>${e} = ${t}`))).returning({value:O`${M.value}`,...this.notification(`login`,e)});return r?.value}completeLogin(e,t,n){return Tp(this,e,t,n)}async listAgentsWithVersions(e){return(await D(this.db,()=>this.db.select({record:k,version:A}).from(k).leftJoin(A,F(P(A.agentId,k.id),P(A.version,k.currentVersion))).where(F(this.mine(k.organizationId),e===void 0?void 0:Array.isArray(e)?e.length?z(k.slug,e):O`false`:P(k.slug,e))).orderBy(N(k.slug)))).map(({record:e,version:t})=>({record:Zo(e),...t?{version:Qo(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${qo(e.q)}%`:void 0,n=O`${k.source} <> 'builtin'`,r=this.db.select({record:k,version:$o}).from(k).leftJoin(A,F(P(A.agentId,k.id),P(A.version,k.currentVersion))).where(F(this.mine(k.organizationId),e.slug===void 0?void 0:P(k.slug,e.slug),e.after?O`(${n}, ${k.slug}) > (${e.after[0]===`1`}, ${e.after.slice(2)})`:void 0,e.source?P(k.source,e.source):void 0,t?ur(dr(k.slug,t),dr(k.name,t),dr(k.description,t),dr(k.repo,t)):void 0,e.platform?O`${A.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(n,N(k.slug));return(await D(this.db,()=>e.limit===void 0?r:r.limit(e.limit))).map(({record:e,version:t})=>({record:Zo(e),...t?{version:es(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:$o}).from(A).innerJoin(k,P(k.id,A.agentId)).where(F(this.mine(k.organizationId),P(k.slug,e),n===void 0?t===void 0?void 0:sr(A.version,k.currentVersion):lr(A.version,n),t===void 0?void 0:gr(A.version,n===void 0?O`${k.currentVersion} + 1 - ${t}`:n-t))).orderBy(N(A.version));return(await D(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:es(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:q(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i,r)}async putMany(e,t,n={}){if(!t.length)return;if(e===`delivery`){await this.db.insert(M).values(t.map(({id:t,value:r})=>({key:Y(this.organizationId,e,t),value:r,expiresAt:n.ttlMs===void 0?null:q(this.now()+n.ttlMs)}))).onConflictDoUpdate({target:M.key,set:{value:O`excluded.value`,expiresAt:O`excluded.expires_at`}});return}if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value,n)));return}let r=t[0].id.lastIndexOf(`:`),i=t[0].id.slice(0,r),a=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==i)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:O`(select ${L.id} from ${L} where ${L.organizationId} = ${this.organizationId} and ${L.publicId} = ${i})`,seq:Number(e.id.slice(t+1)),at:q(n.at),level:n.level,line:n.line}});await this.db.insert(wr).values(a).onConflictDoUpdate({target:[wr.taskId,wr.seq],set:{at:O`excluded.at`,level:O`excluded.level`,line:O`excluded.line`}})}async approvalPostsDue(e,t){return(await D(this.db,()=>ss(this.db,O`select ${M.key} as key, ${M.value} as value from ${M}
-          where ${M.key} like ${`o:%,"delivery"]:approval:%`} and ${this.live(M.expiresAt)}
-            and ((${M.value}->>'retryAt')::bigint <= ${e}
-              or (coalesce((${M.value}->>'shownAt')::bigint, 0) = 0 and (${M.value}->>'at')::bigint <= ${e-t}))`))).map(({key:e,value:t})=>{let n=e.indexOf(`]:`),[r]=JSON.parse(e.slice(2,n+1));return{organizationId:r,id:e.slice(n+2),value:t}})}async list(e,t={}){let n=this.kinds[e],r=[];if(t.ids&&r.push(t.ids.length?z(O`${n.key}`,t.ids.map(t=>n.where?Y(this.organizationId,e,t):t)):O`false`),t.runner&&r.push(e===`runner`?ur(P(xr.publicId,t.runner),P(xr.name,t.runner)):O`false`),t.defaults&&r.push(e===`runner`?P(xr.isDefault,!0):O`false`),t.installation&&r.push(e===`usage`?P(G.key,t.installation):O`false`),t.agent&&r.push(e===`app`||e===`installation`?P(W.agent,t.agent):e===`agent`?P(k.slug,t.agent):O`false`),t.active&&r.push(e===`installation`?ur(j(G.deletedAt),...t.includeUninstalled?[P(G.uninstalled,!0)]:[]):void 0),t.apps&&r.push(e===`installation`&&t.apps.length?z(W.key,t.apps):O`false`),Object.hasOwn(t,`visibleTo`)){let n=e===`runner`?xr.owner:e===`credential`?mr.owner:O`${M.value}->>'owner'`;r.push(ur(j(n),t.visibleTo?P(O`${n}`,t.visibleTo):void 0))}if(n.where)return D(this.db,async()=>await n.rows(F(n.where(t),...r),t.limit));let i=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,a=t.after===void 0?void 0:Ko(t.after);if(n.split&&i&&!i.includes(`:`)&&(t.after===void 0||a?.[0]===i))return D(this.db,async()=>await n.rows(n.split(i,a?.[1]),t.limit));let o=t.prefix?O`${n.key} like ${`${qo(t.prefix)}%`}`:void 0,s=t.after?O`${n.key} > ${t.after}`:void 0,c=F(o,s,...r);return D(this.db,async()=>await n.rows(c,t.limit))}async delete(e,t){let n=e===`login`?this.notification(e,t):void 0;if(n){await this.db.delete(M).where(P(M.key,Y(this.organizationId,e,t))).returning(n);return}await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return us(this,t,n);if(e!==`delivery`&&e!==`connection`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:q(this.now()+r.ttlMs);return(await this.db.insert(M).values({key:Y(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:M.key,set:{value:n,expiresAt:i},setWhere:sr(M.expiresAt,this.at())}).returning({key:M.key})).length>0}async claimDeliveryLease(e,t,n){let r=O`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(M).values({key:Y(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:M.key,set:{value:O`${M.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:O`${M.expiresAt} <= clock_timestamp()`}).returning({value:M.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=F(P(M.key,Y(this.organizationId,`delivery`,e)),O`${M.value}->>'owner' = ${t} and ${M.expiresAt} > clock_timestamp()`),a=O`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(M).where(i).returning({key:M.key}):await this.db.update(M).set({value:n.next===void 0?n:O`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:M.key})).length>0}async updateDelivery(e,t,n,r={}){let i=F(P(M.key,Y(this.organizationId,`delivery`,e)),O`${M.value}->>'owner' = ${t}`,this.live(M.expiresAt));return(n===void 0?await this.db.delete(M).where(i).returning({key:M.key}):await this.db.update(M).set({value:n,expiresAt:r.ttlMs===void 0?null:q(this.now()+r.ttlMs)}).where(i).returning({key:M.key})).length>0}listHistory(e){return Fs(this,e)}async installationApp(e){let t=fr(I,`installation_secret`),[n]=await D(this.db,()=>this.db.select({installation:G,app:W,credentials:I,token:t}).from(G).innerJoin(W,F(P(W.id,G.appId),z(W.organizationId,[this.organizationId,``]))).innerJoin(I,P(I.id,W.credentialsSecretId)).leftJoin(t,F(P(t.id,G.tokenSecretId),this.mine(t.organizationId))).where(F(this.mine(G.organizationId),P(G.key,e),j(G.deletedAt))));return n&&{installation:ms(n.installation,n.app,n.token),app:fs(n.app,n.credentials)}}async conversationState(e){let t=fr(M,`unseen`),n=fr(M,`batch`),[r]=await D(this.db,()=>this.db.select({record:M.value,unseen:t.value,batch:n.value,task:L}).from(O`(select 1) as anchor`).leftJoin(M,F(P(M.key,Y(this.organizationId,`delivery`,e)),this.live(M.expiresAt))).leftJoin(t,F(P(t.key,Y(this.organizationId,`delivery`,`since:${e}`)),this.live(t.expiresAt))).leftJoin(n,F(P(n.key,Y(this.organizationId,`delivery`,`batch:${e}`)),this.live(n.expiresAt))).leftJoin(L,F(this.mine(L.organizationId),P(L.publicId,O`${M.value}->>'taskId'`),P(L.flow,`default`))));return{...r?.record?{record:r.record}:{},...r?.unseen?{unseen:r.unseen}:{},...r?.batch?{batch:r.batch}:{},...r?.task?{status:ts(r.task)}:{}}}async heldTokens(e,t){let[n]=await D(this.db,()=>ss(this.db,O`select ${Ds(this.organizationId,e,t)} as tokens`));return Os(this.organizationId,n?.tokens??{})}async holdToken(e){let t=M,n=e=>Y(this.organizationId,`snapshot`,e);await this.db.execute(O`insert into ${t} (key, value, expires_at)
-      select ${n(e.key)}, ${JSON.stringify(e.value)}::jsonb, ${q(this.now()+e.ttlMs).toISOString()}::timestamptz
-      where ${O.join(e.drops.map(e=>O`coalesce((select ${t.value}->>'drop' from ${t} where ${t.key} = ${n(e.key)} and ${this.live(t.expiresAt)}), '') = ${e.drop??``}`),O` and `)}
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`)}async saveTaskSecrets(e,t){let[n]=await ar(this.db,[O`select pg_advisory_xact_lock(3, hashtext(${`app:${this.organizationId}:connections:${e}`}))`],O`with active as (select 1 from ${L} where ${this.mine(L.organizationId)} and ${L.publicId} = ${e} and ${L.status} in ('queued', 'running', 'waiting')),
-        kept as (insert into ${M} (key, value, expires_at)
-          select key, value, expires_at from (values ${O.join(t.map(e=>O`(${Y(this.organizationId,`snapshot`,e.id)}, ${JSON.stringify({secret:e.value,expiresAt:e.expiresAt})}::jsonb, ${q(e.expiresAt).toISOString()}::timestamptz)`),O`, `)}) as row(key, value, expires_at) where exists (select 1 from active) on conflict (key) do nothing)
-        select exists (select 1 from active) as active`);return!!n?.active}async dispatchState(e){let t=M,n=e=>Y(this.organizationId,`delivery`,e),r=e.conversation??``,i=e=>O`(select ${t.value} from ${t} where ${t.key} = ${n(e)} and ${this.live(t.expiresAt)})`,a=e=>O`(${e} is null or ${e} = (select requester from member))`,o=e=>O`${e} = ${this.organizationId}`,s=e=>O`(select coalesce(jsonb_agg(${Cs(O`r`,O`s`)}), '[]'::jsonb) from ${e})`,c=os(this.organizationId,`snapshot`),l=e.files.map(e=>`${qo(c+e)}%`),[u]=await ss(this.db,O`
-      with claim as (
-        insert into ${t} (key, value, expires_at)
-        values (${n(e.delivery.key)}, ${JSON.stringify({at:e.delivery.at,owner:e.delivery.owner,pending:!0})}::jsonb, ${q(e.delivery.at+e.delivery.ttlMs).toISOString()}::timestamptz)
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${t.expiresAt} <= ${this.at().toISOString()}::timestamptz
-        returning key
-      ), conversation as (select ${i(r)} as value),
-      member as (select ${br.userId} as requester from ${br}
-        where ${br.platform} = ${e.actor?.platform??null}::text and ${br.platformUserId} = ${e.actor?.id??null}::text
-          and ${br.organizations} ? ${this.organizationId} limit 1)
-      select exists (select 1 from claim) as claimed,
-        (select to_jsonb(a) from ${k} a where ${o(O`a.organization_id`)} and a.slug = ${e.agent}) as record,
-        (select to_jsonb(v) from ${A} v join ${k} a on a.id = v.agent_id and v.version = a.current_version
-          where ${o(O`a.organization_id`)} and a.slug = ${e.agent}) as version,
-        (select value from conversation) as conversation,
-        ${i(`since:${r}`)} as unseen,
-        ${i(`batch:${r}`)} as batch,
-        (select to_jsonb(t) from ${L} t, conversation c where ${o(O`t.organization_id`)} and t.public_id = c.value->>'taskId' and t.flow = 'default') as task,
-        (select requester from member) as requester,
-        ${s(O`${mr} r join ${I} s on s.id = r.secret_id where ${o(O`r.organization_id`)} and ${a(O`r.owner`)}`)} as credentials,
-        ${s(O`${xr} r join ${I} s on s.id = r.secret_id where ${o(O`r.organization_id`)} and r.is_default and ${a(O`r.owner`)}`)} as runners,
-        (select coalesce(jsonb_agg(${t.value}), '[]'::jsonb) from ${t}
-          where ${t.key} like ${`${qo(os(this.organizationId,`connection`))}%`} and ${this.live(t.expiresAt)} and ${a(O`${t.value}->>'owner'`)}) as connections,
-        ${i(`workspace`)} as workspace,
-        (select coalesce(jsonb_object_agg(${t.key}, ${t.value}), '{}'::jsonb) from ${t}
-          where ${this.live(t.expiresAt)} and ${t.key} like any(${O.param(l)}::text[])) as files,
-        ${Ds(this.organizationId,[e.installation.id],[e.installation.app])} as tokens`);if(!u?.claimed)return{claimed:!1};let d=u.record?Zo(J(k,u.record)):void 0,f=u.version&&d?Qo(J(A,u.version),d.id):void 0;return{claimed:!0,loaded:{...d?{record:d}:{},...f?{version:f}:{},conversation:{...u.conversation?{record:u.conversation}:{},...u.unseen?{unseen:u.unseen}:{},...u.batch?{batch:u.batch}:{},...u.task?{status:ts(J(L,u.task))}:{}},...u.requester?{requester:u.requester}:{},credentials:u.credentials.map(ws),runners:u.runners.map(Ts),connections:u.connections,...u.workspace?{workspace:u.workspace}:{},files:Object.fromEntries(Object.entries(u.files).map(([e,t])=>[e.slice(c.length),t])),tokens:Os(this.organizationId,u.tokens)}}}async markConversation(e,t,n,r,i){await this.db.update(M).set({value:O`${M.value} || ${JSON.stringify({at:r,seen:n})}::jsonb`,expiresAt:q(this.now()+i)}).where(F(P(M.key,Y(this.organizationId,`delivery`,e)),O`${M.value}->>'taskId' = ${t}`,this.live(M.expiresAt)))}async appendUnseen(e,t,n){let r=O`coalesce((${M.value}->>'version')::bigint, jsonb_array_length(${M.value}->'messages') + (${M.value}->>'more')::bigint)`,i={messages:[{...t,sequence:1}],more:0,version:1,epoch:Hr()};await this.db.execute(O`
-      insert into ${M} (key, value, expires_at)
-      select ${Y(this.organizationId,`delivery`,`since:${e}`)}, ${JSON.stringify(i)}::jsonb, ${q(this.now()+n).toISOString()}::timestamptz
-      where exists (select 1 from ${M} where key = ${Y(this.organizationId,`delivery`,e)} and ${this.live(M.expiresAt)})
-      on conflict (key) do update set value = case when ${M.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-        ${M.value} || jsonb_build_object('version', ${r} + 1,
-          'messages', case when jsonb_array_length(${M.value}->'messages') < ${50} then
-            (${M.value}->'messages') || jsonb_build_array(${JSON.stringify(t)}::jsonb || jsonb_build_object('sequence', ${r} + 1)) else ${M.value}->'messages' end,
-          'more', (${M.value}->>'more')::int + case when jsonb_array_length(${M.value}->'messages') < ${50} then 0 else 1 end) end,
-        expires_at = excluded.expires_at
-    `)}async acknowledgeUnseen(e,t,n){await this.db.update(M).set({value:ks(t)}).where(F(P(M.key,Y(this.organizationId,`delivery`,`since:${e}`)),O`${M.value}->>'epoch' is not distinct from ${n??null}::text`,this.live(M.expiresAt)))}async appendBatch(e,t,n,r,i){let a=Qn(void 0,t,n,r),o=q(this.now()+i);await this.db.insert(M).values({key:Y(this.organizationId,`delivery`,e),value:a,expiresAt:o}).onConflictDoUpdate({target:M.key,set:{value:O`case when ${M.expiresAt} <= ${this.at().toISOString()}::timestamptz then excluded.value else
-          (select ${M.value} || excluded.value || jsonb_build_object(
-            'items', prefix || coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(pending) with ordinality e(item,n) where n > greatest(jsonb_array_length(pending) - 50, 0)), '[]'::jsonb),
-            'more', coalesce((${M.value}->>'more')::int, 0) + coalesce((excluded.value->>'more')::int, 0) + greatest(jsonb_array_length(pending) - 50, 0),
-            'mustReply', coalesce((${M.value}->>'mustReply')::boolean, false) or coalesce((excluded.value->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(pending) with ordinality e(item,n) where n <= greatest(jsonb_array_length(pending) - 50, 0) and item->'event'->>'mustReply' = 'true'))
-            from (select coalesce(jsonb_agg(item order by n) filter (where n <= coalesce((${M.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) as prefix,
-              coalesce(jsonb_agg(item order by n) filter (where n > coalesce((${M.value}->'sending'->>'count')::int, 0)), '[]'::jsonb) || (excluded.value->'items') as pending
-              from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)) queued) end`,expiresAt:o}})}async claimBatch(e,t){let n=Y(this.organizationId,`delivery`,e),r=(await ss(this.db,O`
-      with held as materialized (
-        select key as batch_key, value as previous from ${M}
-        where key = ${n} and value->>'owner' = ${t} and ${this.live(M.expiresAt)} for update
-      ), claimed as (
-        update ${M} set value = (
-          select ready || jsonb_build_object('more', 0, 'mustReply', false, 'sending', jsonb_build_object(
-            'owner', ${t}::text, 'until', ${this.now()+er}::bigint,
-            'count', jsonb_array_length(ready->'items'), 'more', ready->'more', 'mustReply', ready->'mustReply'))
-          from (select (value - 'sending') || jsonb_build_object(
-            'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n > greatest(jsonb_array_length(value->'items') - 50, 0)), '[]'::jsonb),
-            'more', coalesce((value->>'more')::int, 0) + coalesce((value->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(value->'items') - 50, 0),
-            'mustReply', coalesce((value->>'mustReply')::boolean, false) or coalesce((value->'sending'->>'mustReply')::boolean, false) or exists(
-              select 1 from jsonb_array_elements(value->'items') with ordinality e(item,n)
-              where n <= greatest(jsonb_array_length(value->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')) as ready) as available)
-        from held where key = held.batch_key and coalesce((value->'sending'->>'until')::bigint, 0) <= ${this.now()}
-          and jsonb_array_length(value->'items') > 0
-        returning value
-      ) select value, true as claimed from claimed
-      union all select previous, false from held where not exists (select 1 from claimed)
-    `))[0];return r?.claimed?{...r.value,more:r.value.sending?.more,mustReply:r.value.sending?.mustReply}:r?.value.sending?null:void 0}async finishBatch(e,t,n,r){let i=O`(${M.value}->'sending'->>'count')::int`,a=r===void 0?i:O`coalesce((select n from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= ${i} and item->>'admission' = ${r} limit 1), 0)`;return(await this.db.update(M).set({value:O`case when ${n} and ${i} > ${a} then
-          ${M.value} || jsonb_build_object('items',
-            coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-              where n > ${a}), '[]'::jsonb),
-            'sending', (${M.value}->'sending') || jsonb_build_object(
-              'count', ${i} - ${a},
-              'until', ${this.now()+er}::bigint))
-        else (${M.value} - 'sending') || jsonb_build_object('items',
-        case when ${n} then coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality as entries(item, n)
-          where n > ${i}), '[]'::jsonb) else
-          coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-            where n > greatest(jsonb_array_length(${M.value}->'items') - 50, 0)), '[]'::jsonb) end,
-        'more', coalesce((${M.value}->>'more')::int, 0) + case when ${n} then 0 else coalesce((${M.value}->'sending'->>'more')::int, 0) + greatest(jsonb_array_length(${M.value}->'items') - 50, 0) end,
-        'mustReply', coalesce((${M.value}->>'mustReply')::boolean, false) or (not ${n} and (coalesce((${M.value}->'sending'->>'mustReply')::boolean, false) or exists(select 1 from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= greatest(jsonb_array_length(${M.value}->'items') - 50, 0) and item->'event'->>'mustReply' = 'true')))) end`}).where(F(P(M.key,Y(this.organizationId,`delivery`,e)),O`${M.value}->'sending'->>'owner' = ${t}`,this.live(M.expiresAt))).returning({key:M.key})).length>0}async take(e,t,n){if(e===`delivery`||e===`snapshot`){let[r]=await this.db.delete(M).where(F(P(M.key,Y(this.organizationId,e,t)),this.live(M.expiresAt),n?O`${M.value} @> ${JSON.stringify(n)}::jsonb`:void 0)).returning({value:M.value});return r?.value}let r=await this.get(e,t);if(!(r===void 0||Object.entries(n??{}).some(([e,t])=>r[e]!==t)))return await this.delete(e,t),r}async usageSummary(e,t){let n=O`case groups.kind when 'agent' then ${Er.agent} when 'engine' then coalesce(${Er.engine}, 'unknown') else coalesce(${G.key}, 'none') end`,r=t?n:O`groups.kind || ':' || (${n})`,i=(await D(this.db,()=>ss(this.db,O`
-      with recursive records as (
-        select ${r} as key, ${Er.runnerMs} as runner_ms, ${Er.tokens} as tokens,
-          row_number() over (partition by ${r} order by ${L.publicId}) as n
-        from ${Er} inner join ${L} on ${L.id} = ${Er.taskId}
-        left join ${G} on ${G.id} = ${Er.installationId}
-        cross join unnest(${O.param(t?[t]:[`agent`,`installation`,`engine`])}::text[]) groups(kind)
-        where ${this.mine(Er.organizationId)} and ${Er.at} >= ${new Date(e).toISOString()}::timestamptz
-      ), nodes(key, path, n, value) as (
-        select key, '{}'::text[], n, tokens from records where tokens is not null
-        union all
-        select nodes.key, nodes.path || child.key, nodes.n, child.value from nodes
-        cross join lateral jsonb_each(case when jsonb_typeof(nodes.value) = 'object' then nodes.value else '{}'::jsonb end) child
-      ), resolved(key, path, kind, cutoff) as (
-        select keys.key, '{}'::text[], latest.kind, coalesce((
-          select max(n) from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0) from (select distinct key from records) keys
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = keys.key and path = '{}'::text[]
-            and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest
-        union all
-        select parent.key, child.path, latest.kind, greatest(parent.cutoff, coalesce((
-          select max(n) from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
-        ), 0)) from resolved parent
-        cross join lateral (
-          select distinct path[1:cardinality(parent.path) + 1] as path from nodes
-          where nodes.key = parent.key and n > parent.cutoff and cardinality(path) > cardinality(parent.path)
-            and path[1:cardinality(parent.path)] = parent.path
-        ) child
-        cross join lateral (
-          select jsonb_typeof(value) as kind from nodes where nodes.key = parent.key and nodes.path = child.path
-            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
-        ) latest where parent.kind = 'object'
-      ), sums as (
-        select key, path, case when kind = 'object' then '{}'::jsonb else to_jsonb((
-          select sum(case when jsonb_typeof(value) = 'number' then (value #>> '{}')::numeric end)::float8
-          from nodes where nodes.key = resolved.key and nodes.path = resolved.path and n > cutoff
-        )) end as value from resolved
-      ) select key, count(*)::int as tasks, sum(runner_ms)::float8 as runner_ms,
-        (select jsonb_agg(jsonb_build_object('path', path, 'value', value) order by path) from sums where sums.key = records.key) as tokens
-        from records group by key order by key
-    `))).map(e=>{let t;for(let n of e.tokens??[]){if(!n.path.length){t=typeof n.value==`number`?n.value:Object.create(null);continue}let e=t&&typeof t==`object`?t:Object.create(null);t=e;let r=e;for(let e of n.path.slice(0,-1))r=r[e]??=Object.create(null);Object.defineProperty(r,n.path.at(-1),{value:typeof n.value==`number`?n.value:Object.create(null),enumerable:!0,configurable:!0,writable:!0})}return{key:e.key,tasks:e.tasks,runnerMs:e.runner_ms,...t===void 0?{}:{tokens:t}}});if(t)return i;let a={agent:[],installation:[],engine:[]};for(let e of i){let t=e.key.indexOf(`:`);a[e.key.slice(0,t)].push({...e,key:e.key.slice(t+1)})}return a}async usageTotals(e){let t=Er,n=e.by===`agent`?O`${t.agent}`:e.by===`engine`?O`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?O`coalesce(${G.key}, 'none')`:O`to_char(${t.at} at time zone ${Ao(e.tz)}, 'YYYY-MM-DD')`,r=F(this.mine(t.organizationId),gr(t.at,q(e.since)),e.until===void 0?void 0:lr(t.at,q(e.until)),e.agent?P(t.agent,e.agent):void 0),i=O`coalesce(
-      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
-      (select sum((v #>> '{}')::numeric)
-        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
-        where jsonb_typeof(v) = 'number')
-    )`,a={tasks:O`count(*)`,runnerMs:O`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:O`coalesce(sum(${i}), 0)`},o=e.top?O`case when ${t.agent} in (
-          select ${t.agent} from ${t} where ${r} group by ${t.agent}
-          order by ${a[e.top.by]} desc, ${t.agent} limit ${e.top.count}
-        ) then ${t.agent} end`:e.parts?.length?O`case when ${z(t.agent,e.parts)} then ${t.agent} end`:O`null::text`,s=e.by===`installation`?O`left join ${G} on ${G.id} = ${t.installationId}`:O``,c=await D(this.db,()=>ss(this.db,O`
-      select ${n} as key, ${o} as part, ${a.tasks}::int as tasks,
-        ${a.runnerMs}::float8 as runner_ms,
-        ${a.tokenCount}::float8 as token_count
-      from ${t} ${s}
-      where ${r}
-      group by 1, 2
-    `)),l=new Map;for(let e of c){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=l.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};jo(n,t),e.part&&((n.parts??={})[e.part]=t),l.set(e.key,n)}return[...l.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(O`
-      with tombstones as (
-        delete from ${Tr} where (organization_id, public_id) in (
-          select organization_id, public_id from ${Tr}
-          where deleted_at < ${new Date(this.now()-6e5).toISOString()}::timestamptz
-          order by deleted_at limit ${e}
-        )
-      ), expired_state as (
-        delete from ${M} where expires_at <= clock_timestamp() and key in (
-          select key from ${M} where expires_at <= clock_timestamp() order by expires_at limit ${e}
-        )
-      ), lists as (
-        select expired.key from ${pr} as expired
-        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
-          and not exists (select 1 from ${pr} as newer where newer.key = expired.key and newer.seq > expired.seq)
-        order by expired.expires_at limit ${e}
-      ), expired_items as (
-        select key, seq from ${pr} where key in (select key from lists) order by seq limit ${e}
-      ), expired_queue as (
-        select key, seq from ${pr} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
-      )
-      delete from ${pr} where (key, seq) in (
-        select key, seq from expired_items union all select key, seq from expired_queue
-      )`)}};const Hs=At;function Us(e,t,n,r=Vr(32).toString(`base64url`)){let i=`${dn({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:Hs(i)}}function Ws(e){try{return fn(e.slice(0,e.indexOf(`.`)))}catch{return{}}}var Gs=r({DrizzleQueue:()=>rc});const Ks=(e,t)=>O`('[' || to_json(${e})::text || ',' || to_json(${t}::text)::text || ']:')`,qs=e=>O`(select ${Cs(O`c`,O`s`)} from ${mr} c join ${I} s on s.id = c.secret_id
-    where c.organization_id = ${e}.organization_id and coalesce(c.owner || '/', '') || c.label = ${e}.credential)`,Js=e=>O`(select ${M.value} from ${M} where ${M.key} = 'o:' || ${Ks(e,`config`)} || 'workspace')`,Ys=e=>O`(select ${Cs(O`r`,O`s`)} from ${xr} r join ${I} s on s.id = r.secret_id
-    where r.organization_id = ${e}.organization_id and r.public_id = ${e}.runner_id)`;function Xs(e,t){if(typeof t==`number`)return O`to_jsonb(coalesce(case when jsonb_typeof(${e}) = 'number' then (${e} #>> '{}')::numeric end, 0) + ${t}::numeric)`;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=Object.entries(t).map(([t,n])=>O`${t}::text, ${Xs(O`(${e} -> ${t}::text)`,n)}`);return O`(case when jsonb_typeof(${e}) = 'object' then ${e} else '{}'::jsonb end || jsonb_build_object(${O.join(n,O`, `)}))`}const Zs=e=>O`(case ${e} ${O.join([...Q,...we].map(e=>O`when ${e} then ${O.raw(String(Xe(e)))}`),O` `)} end)`,Qs=e=>O`date_trunc('milliseconds', ${e})`,$s=e=>O`${e} collate "C"`,ec=ur(P(L.status,`waiting`),O`jsonb_path_exists(${L.context}, '$.approvals[*] ? (!(exists(@.response)) || @.response == null)')`),tc=e=>[N(Zs(e.status)),hr(Qs(e.createdAt)),hr($s(e.publicId))],nc=e=>[N(e.updatedAt),N($s(e.publicId))];var rc=class{db;constructor(e){this.db=e}async metrics(e,t){let n=await this.db.select({status:L.status,total:O`count(*)::int`,recent:O`count(*) filter (where ${L.createdAt} >= ${new Date(t).toISOString()}::timestamptz)::int`}).from(L).where(P(L.organizationId,e)).groupBy(L.status),r={tasks:{queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},queueDepth:0};for(let e of n)r.tasks[e.status]=e.recent,e.status===`queued`&&(r.queueDepth=e.total);return r}where(e,t){return F(P(L.organizationId,e),P(L.publicId,t))}fence(e,t,n={}){return F(this.where(e,t),n.generation===void 0?void 0:P(L.generation,n.generation),n.attempts===void 0?void 0:P(L.attempts,n.attempts),n.tokenHash===void 0?void 0:n.tokenHash===null?j(L.tokenHash):P(L.tokenHash,n.tokenHash),n.handle===void 0?void 0:n.handle===null?j(L.handle):P(L.handle,n.handle),n.lastSeenAt===void 0?void 0:n.lastSeenAt===null?j(L.lastSeenAt):P(L.lastSeenAt,new Date(n.lastSeenAt)),n.updatedAt===void 0?void 0:P(L.updatedAt,new Date(n.updatedAt)),n.statuses?z(L.status,n.statuses):void 0)}async enqueue(e,t,n,r,i,a){let o=this.insertion(e,t,n,r,i,void 0,a),[s]=await ar(this.db,i===void 0?[]:[O`select pg_advisory_xact_lock(1, hashtext(${e}))`],o);if(!s?.allowed)throw Error(`Organization task queue is full`);return!!s.inserted}insertion(e,t,n,r,i,a,o){let s=t.event,c=new Date(n).toISOString(),l=e=>O`${e===void 0?null:JSON.stringify(e)}::jsonb`,u=t=>Y(e,`delivery`,t),d=r?O`
-      receipt as (
-        insert into ${M} (key, value, expires_at)
-        select ${u(r.key)}, ${l({at:n})}, ${new Date(n+r.ttlMs).toISOString()}::timestamptz
-        from capacity where allowed ${a?O`and (${a.create} or exists (select 1 from target))`:O``}
-        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
-          where ${M.expiresAt} <= ${c}::timestamptz or ${M.value}->>'owner' = ${r.owner??null}::text
-        returning key
-      ),`:O``,f=O`exists (select 1 from inserted)`,p=O`on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at`,{conversation:m,unseen:h,secrets:g}=o??{},_=O`${m?O`, remembered as (insert into ${M} (key, value, expires_at)
-        select key, value, ${new Date(n+m.ttlMs).toISOString()}::timestamptz from (values
-          (${u(m.key)}, ${l(m.record)}), (${u(m.root)}, ${l({at:m.record.at})})) as row(key, value)
-        where ${f} ${p})`:O``}${h?O`, acknowledged as (update ${M} set value = ${ks(h.version)}
-        where key = ${u(`since:${h.key}`)} and ${M.value}->>'epoch' is not distinct from ${h.epoch??null}::text
-          and (expires_at is null or expires_at > ${c}::timestamptz) and ${f})`:O``}${g?.length?O`, secrets as (insert into ${M} (key, value, expires_at)
-        select key, value, expires_at from (values ${O.join(g.map(t=>O`(${Y(e,`snapshot`,t.id)}, ${l({secret:t.value,expiresAt:t.expiresAt})}, ${new Date(t.expiresAt).toISOString()}::timestamptz)`),O`, `)}) as row(key, value, expires_at) where ${f} on conflict (key) do nothing)`:O``}`;return O`
-      with ${a?O`target as materialized (${a.target}),`:O``} capacity as (
-        select ${i===void 0?O`true`:O`(select count(*) from ${L} where organization_id = ${e} and status = 'queued') < ${i} ${r?O`or exists (select 1 from ${M} where key = ${u(r.key)} and expires_at > ${c}::timestamptz and value->>'owner' is distinct from ${r.owner??null}::text)`:O``}`} ${a?O`or exists (select 1 from target) or not ${a.create}`:O``} as allowed
-      ), ${d} ${a?O`advanced as (
-        update ${L} set inbox_seq = inbox_seq + 1, updated_at = ${c}::timestamptz where id in (select id from target) and exists (select 1 from receipt)
-        returning id, inbox_seq, generation
-      ), forwarded as (
-        insert into ${R} (organization_id, task_id, seq, generation, at, kind, value)
-        select ${e}, id, inbox_seq, generation, ${c}::timestamptz, 'steer', ${l({text:a.steer})} from advanced returning seq
-      ),`:O``} inserted as (
-        insert into ${L} (organization_id, public_id, source, status, agent, flow, review_key, runner, permissions,
-          app_id, installation_id, event, prompt, args, mcp, author, definition, credential, requester,
-          runner_id, usage, tools, context, files, attempts, created_at, updated_at)
-        select ${e}, ${t.id}, ${t.source}, 'queued', ${t.agent}, ${t.flow}, ${Lm(t)??null}, ${t.runner}, ${t.permissions??null},
-          ${s?O`coalesce((select id from ${vr} where key = ${s.appId} and organization_id in (${e}, '')), 0)`:O`null`},
-          ${s?O`coalesce((select id from ${yr} where key = ${`${s.appId}:${s.installationId}`} and organization_id = ${e}), 0)`:O`null`},
-          ${l(s)}, ${t.prompt??null}, ${l(t.args)}, ${l(t.mcp)}, ${t.author??null}, ${l(t.definition)},
-          ${t.credential??null}, ${t.requester??null}, ${t.runnerId??null}, ${l(t.usage)}, ${l(t.tools)},
-          ${l(Wo(t))}, ${l(t.files)}, 0, ${c}::timestamptz, ${c}::timestamptz
-        from capacity where allowed ${a?O`and ${a.create} and not exists (select 1 from target)`:O``} ${r?O`and exists (select 1 from receipt)`:O``}
-        returning id
-      )${_} select allowed, exists (select 1 from inserted) as inserted ${a?O`, exists (select 1 from forwarded) as steered`:O``} from capacity`}async deliver(e,t,n,r,i,a,o=!0,s){if(i===void 0)return o&&await this.enqueue(e,t,n,r,a,s)?{taskId:t.id}:{};let c=t.event,l=O`select id from ${L} where organization_id = ${e} and status in ('queued', 'running', 'waiting')
-      and agent = ${t.agent} and source = ${t.source} and flow = 'default'
-      and event->>'appId' is not distinct from ${c?.appId??null}
-      and event->>'installationId' is not distinct from ${c?.installationId??null}
-      and event->'chat'->'thread'->>'id' = ${c?.chat?.thread.id||null}
-      order by created_at desc, public_id desc limit 1 for update`,u=this.insertion(e,t,n,r,a,{target:l,create:o,steer:i},s),d=[O`select pg_advisory_xact_lock(3, hashtext(${JSON.stringify([e,Fm(t)])}))`];a!==void 0&&o&&d.push(O`select pg_advisory_xact_lock(1, hashtext(${e}))`);let[f]=await ar(this.db,d,u);if(!f?.allowed)throw Error(`Organization task queue is full`);return f.inserted?{taskId:t.id}:f.steered?{steered:!0}:{}}async claim(e,t,n=!1,r){let i=O`not exists (select 1 from ${L} reviewing
-      where reviewing.organization_id = ${L.organizationId} and reviewing.status in ('running', 'waiting')
-        and reviewing.review_key = ${L.reviewKey})`,a=r===void 0?O`true`:O`(select count(*) from ${L} active where active.organization_id = ${L.organizationId} and active.status in ('running', 'waiting')) < ${r}`;if(!n){let[e]=await D(this.db,()=>ss(this.db,O`select exists (select 1 from ${L} where status = 'queued' and ${a} and ${i})
-        and ${t===void 0?O`true`:O`(select count(*) from ${L} where status in ('running', 'waiting')) < ${t}`} as ready`));if(!e?.ready)return}let o=Vr(32).toString(`base64url`),s=O`translate(rtrim(replace(encode(convert_to(format('{"task":%s,"organization":%s,"attempt":%s}',
-      to_json(public_id), to_json(organization_id), attempts + 1), 'UTF8'), 'base64'), E'\\n', ''), '='), '+/', '-_') || '.' || ${o}`,c=O`with stamp as materialized (select date_trunc('milliseconds', clock_timestamp()) as at), picked as materialized (
-      select id, ${s} as bearer from ${L} where status = 'queued'
-        and ${a} and ${i}
-        ${t===void 0?O``:O`and (select count(*) from ${L} where status in ('running', 'waiting')) < ${t}`}
-        order by created_at, id limit 1 for update
-      ), claimed as (
-        update ${L} set status = 'running', attempts = attempts + 1, locked_at = (select at from stamp),
-          started_at = (select at from stamp), updated_at = (select at from stamp), last_seen_at = (select at from stamp),
-          token_hash = translate(rtrim(encode(sha256(convert_to(picked.bearer, 'UTF8')), 'base64'), '='), '+/', '-_')
-        from picked where ${L.id} = picked.id returning ${L}.*
-      ) select to_jsonb(claimed) as record, exists (select 1 from ${L} where status = 'queued' and id <> claimed.id
-        and ${i} and (${L.organizationId} <> claimed.organization_id or ${L.reviewKey} is null or ${L.reviewKey} is distinct from claimed.review_key)
-        and ${r===void 0?O`true`:O`(select count(*) from ${L} active where active.organization_id = ${L.organizationId} and active.status in ('running', 'waiting')) + case when ${L.organizationId} = claimed.organization_id then 1 else 0 end < ${r}`})
-        and ${t===void 0?O`true`:O`(select count(*) from ${L} where status in ('running', 'waiting')) + 1 < ${t}`} as more,
-        ${qs(O`claimed`)} as credential, ${Js(O`claimed.organization_id`)} as config, ${Ys(O`claimed`)} as runner
-        from claimed`,[l]=await ar(this.db,[O`select pg_advisory_xact_lock(2, 0)`],c);if(!l)return;let u=J(L,l.record);return{organizationId:u.organizationId,status:ts(u),token:Us(u.publicId,u.organizationId,u.attempts,o).token,more:l.more,loaded:{credential:l.credential?ws(l.credential).value:void 0,config:l.config??void 0,runner:l.runner?Ts(l.runner).value:void 0}}}async authorize(e,t,n,r,i,a={}){let o=z(L.status,[`running`,`waiting`]),s=new Date(i).toISOString(),c=this.db.update(L).set({lastSeenAt:O`case when ${o} then ${s}::timestamptz else ${L.lastSeenAt} end`,updatedAt:O`case when ${o} then ${s}::timestamptz else ${L.updatedAt} end`}).where(this.fence(r,e,{tokenHash:t,attempts:n,statuses:a.allowCompleted?[`running`,`waiting`,`completed`,`failed`,`cancelled`]:[`running`,`waiting`]})).returning(),l=a.include===`context`,u=!!a.include,d=M,f=O`touched.organization_id`,p=e=>O`('o:' || ${Ks(f,`snapshot`)} || ${e})`,m=e=>O`replace(replace(replace(${e}, '\\', '\\\\'), '%', '\\%'), '_', '\\_')`,h=O`(${d.expiresAt} is null or ${d.expiresAt} > ${s}::timestamptz)`,[g]=await ss(this.db,O`with touched as (${c.getSQL()}), target as (
-        select i.key, a.key as app from touched, ${yr} i join ${vr} a on a.id = i.app_id
-        where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and ${l}
-      )
-      select to_jsonb(touched) as status,
-        case when ${l} then (select ${Cs(O`a`,O`s`)} from ${vr} a join ${I} s on s.id = a.credentials_secret_id
-          where a.key = touched.event->>'appId' and a.organization_id in (touched.organization_id, '')) end as app,
-        case when ${u} then (select ${Cs(O`i`,O`s`)} || jsonb_build_object('app', to_jsonb(a), 'credentials', to_jsonb(c))
-          from ${yr} i join ${vr} a on a.id = i.app_id join ${I} c on c.id = a.credentials_secret_id left join ${I} s on s.id = i.token_secret_id
-          where i.key = touched.event->>'appId' || ':' || (touched.event->>'installationId') and i.organization_id = touched.organization_id and i.deleted_at is null) end as installation,
-        case when ${u} then ${qs(O`touched`)} end as credential,
-        case when ${u} and touched.credential is null then (select coalesce(jsonb_agg(${Cs(O`c`,O`s`)}), '[]'::jsonb)
-          from ${mr} c join ${I} s on s.id = c.secret_id where c.organization_id = touched.organization_id
-          and (c.owner is null or c.owner = touched.requester)) end as credentials,
-        case when ${l} then ${Js(f)} end as config,
-        case when ${l} then ${Ys(O`touched`)} end as runner,
-        case when ${u} then jsonb_build_object('rows', coalesce((select jsonb_agg(${d.value}->>'secret') from ${d}
-          where ${d.key} like ${m(p(O`'connection-secrets:' || touched.public_id || ':'`))} || '%' and ${h}), '[]'::jsonb),
-          'old', (select ${d.value} from ${d} where ${d.key} = ${p(O`'connection-secrets:' || touched.public_id`)} and ${h})) end as secrets,
-        case when ${l} then (select jsonb_build_object('key', ${d.key}, 'value', ${d.value}) from ${d}
-          where ${d.key} like ${m(p(O`'connections:' || touched.public_id || ':' || touched.generation || ':' || touched.attempts || ':'`))} || '%' and ${h} limit 1) end as resolved,
-        case when ${l} then (select coalesce(jsonb_object_agg(${d.key}, ${d.value}), '{}'::jsonb) from ${d} where ${h} and (
-          ${d.key} like any (select ${m(p(O`'token:' || key || ':'`))} || '%' from target)
-          or ${d.key} in (select ${p(O`'token-drop:' || key`)} from target union all select ${p(O`'token-drop:' || app`)} from target))) end as tokens
-      from touched`);if(!g)return;let _=J(L,g.status),v=os(_.organizationId,`snapshot`),y=(e,t)=>e?t(e):void 0;return{organizationId:_.organizationId,status:ts(_),...u?{loaded:{installation:y(g.installation,e=>Es(e).installation),credential:y(g.credential,e=>ws(e).value),...g.credentials?{credentials:g.credentials.map(ws)}:{},secrets:y(g.secrets,e=>({rows:e.rows,...e.old?{old:e.old}:{}})),...l?{app:y(g.app,e=>fs(J(vr,e.row),J(I,e.sealed))),config:g.config??void 0,runner:y(g.runner,e=>Ts(e).value),resolved:y(g.resolved,e=>({id:e.key.slice(v.length),value:e.value})),tokens:Os(_.organizationId,g.tokens??{})}:{}}}:{}}}async touch(e,t,n,r,i,a=!1){return(await this.authorize(t,n,r,e,i,{allowCompleted:a}))?.status}async patchTask(e,t,n,r,i={}){let{answer:a,approvals:o,archivedAt:s,autoArchived:c,lastSeenAt:l,logsComplete:u,...d}=n,[f]=await this.db.transaction(async c=>{let[f]=o?await c.select({context:L.context}).from(L).where(this.where(e,t)).for(`update`):[];return c.update(L).set({...Object.fromEntries(Object.entries(d).map(([e,t])=>[e,t??null])),...o?{context:O`jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{approvals}', ${JSON.stringify(lt(f?.context?.approvals??[],o))}::jsonb)`}:{},...u===void 0?{}:{context:O`jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{runnerLogs}', coalesce(${L.context}->'runnerLogs', '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object('complete', ${u??null}::boolean, 'handle', ${L.handle}, 'attempts', ${L.attempts}, 'generation', ${L.generation})))`},...a===void 0?{}:{answer:O`coalesce(${L.answer}, '[]'::jsonb) || ${JSON.stringify([a])}::jsonb`},...Object.hasOwn(n,`archivedAt`)?{archivedAt:s===void 0?null:new Date(s)}:{},...Object.hasOwn(n,`lastSeenAt`)?{lastSeenAt:l===void 0?null:new Date(l)}:{},updatedAt:new Date(r)}).where(this.fence(e,t,i)).returning({id:L.id})});return!!f}async archiveStopped(e,t,n){await this.db.update(L).set({archivedAt:new Date(t),updatedAt:new Date(t)}).where(F(e===void 0?void 0:P(L.organizationId,e),n?z(L.publicId,n):void 0,j(L.archivedAt),z(L.status,[...we]),lr(O`coalesce(${L.finishedAt}, ${L.updatedAt})`,O`${new Date(t-Be).toISOString()}::timestamptz`)))}async requeue(e,t,n,r={}){let[i]=await this.db.update(L).set({status:`queued`,lockedAt:null,handle:null,tokenHash:null,lastSeenAt:null,updatedAt:new Date(n)}).where(this.fence(e,t,{...r,statuses:[`running`,`waiting`]})).returning({id:L.id});return!!i}connectionLock(e,t){return O`select pg_advisory_xact_lock(3, hashtext(${`app:${e}:connections:${t}`}))`}async deleteTask(e,t,n){let[r]=await ar(this.db,[this.connectionLock(e,t)],O`
-      with gone as (
-        delete from ${L} where ${this.fence(e,t,n)}
-        returning organization_id, public_id
-      ), marked as (
-        insert into ${Tr} (organization_id, public_id, deleted_at)
-        select organization_id, public_id, clock_timestamp() from gone
-      ), connections as (delete from ${M} where ${Ns(e,t)} and exists (select 1 from gone))
-      select count(*)::int as deleted from gone`);return!!r?.deleted}async finish(e,t,n,r,i={}){let a=new Date(r),o=this.db.update(L).set({status:n.status,result:n.result??null,error:n.error??null,tokens:n.tokens??null,lastSeenAt:a,lockedAt:null,finishedAt:a,updatedAt:a}).where(this.fence(e,t,{...i,statuses:[`queued`,`running`,`waiting`]})).returning({id:L.id}),[s]=await ar(this.db,[this.connectionLock(e,t)],O`
-      with finished as (${o.getSQL()}), purged as (
-        delete from ${M} where ${Ns(e,t)} and exists (select 1 from finished)
-      ) select id from finished`);return!!s}async continueTask(e,t,n,r,i){let a=O`(${JSON.stringify(n.context??{})}::jsonb - 'connections' - 'engineChain' - 'engineCredentials') || jsonb_strip_nulls(jsonb_build_object('connections', ${L.context}->'connections', 'engineChain', ${L.context}->'engineChain', 'engineCredentials', ${L.context}->'engineCredentials'))`,[o]=await this.db.update(L).set({prompt:n.prompt??null,context:a,...n.definition?{definition:n.definition}:{},...n.usage?{usage:n.usage}:{},...n.tools?{tools:n.tools}:{},...`files`in n?{files:n.files??null}:{},...`permissions`in n?{permissions:n.permissions??null}:{},status:`queued`,attempts:0,generation:O`${L.generation} + 1`,inboxAck:-1,result:null,error:null,tokens:null,handle:null,tokenHash:null,lastSeenAt:null,logCursor:null,lockedAt:null,startedAt:null,finishedAt:null,cancelRequestedAt:null,approval:null,answer:null,archivedAt:null,updatedAt:new Date(r)}).where(this.fence(e,t,{...i,statuses:[`completed`,`failed`,`cancelled`]})).returning({context:L.context});return o&&(n.context=Go(o.context).context),!!o}async completeTask(e,t,n,r){let{outcome:i,usage:a}=n,o=new Date(r).toISOString(),s=n.logsComplete?O`, context = jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{runnerLogs}', jsonb_strip_nulls(jsonb_build_object('complete', true, 'handle', ${L.handle}, 'attempts', ${L.attempts}, 'generation', ${L.generation})))`:O``,c=n.known?.length?O`, posts as (insert into ${M} (key, value, expires_at)
-      select key, ${JSON.stringify({at:r})}::jsonb, expires_at from (values ${O.join(n.known.map(t=>O`(${Y(e,`delivery`,t.id)}, ${new Date(r+t.ttlMs).toISOString()}::timestamptz)`),O`, `)}) as row(key, expires_at) where exists (select 1 from finished)
-      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at)`:O``,[l]=await ar(this.db,[this.connectionLock(e,t)],O`
-    with finished as (
-      update ${L} set status = ${i.status}, result = ${JSON.stringify(i.result??null)}::jsonb,
-        error = ${i.error??null}, tokens = ${JSON.stringify(i.tokens??null)}::jsonb,
-        last_seen_at = ${o}::timestamptz, locked_at = null, finished_at = ${o}::timestamptz, updated_at = ${o}::timestamptz${s}
-      where ${this.fence(e,t,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]})}
-      returning id, installation_id, generation
-    ), connections as (delete from ${M} where ${Ns(e,t)} and exists (select 1 from finished)), inbox as (delete from ${R} where (task_id, generation) in (select id, generation from finished))${c}, recorded as (
-      insert into ${Er} (organization_id, task_id, installation_id, agent, target, engine, model, credential, runner_ms, tokens, at, updated_at)
-      select ${e}, id, installation_id, ${a.agent}, ${a.target}, ${a.engine??null}, ${a.model??null},
-        ${a.credential}, ${a.runnerElapsedMs}, ${JSON.stringify(a.tokens??null)}::jsonb, ${new Date(a.at).toISOString()}::timestamptz, ${o}::timestamptz from finished
-      on conflict (task_id) do update set installation_id = excluded.installation_id, agent = excluded.agent, target = excluded.target,
-        engine = excluded.engine, model = excluded.model, credential = excluded.credential, runner_ms = ${Er.runnerMs} + excluded.runner_ms,
-        tokens = ${Xs(O`${Er.tokens}`,a.tokens)}, at = excluded.at, updated_at = excluded.updated_at
-    )
-    select exists (select 1 from finished) as completed`);return!!l?.completed}async cancel(e,t,n,r={}){let i=new Date(n).toISOString(),[a]=await ar(this.db,[this.connectionLock(e,t)],O`
-    with cancelled as (
-      update ${L} set status = case when status = 'queued' then 'cancelled' else status end,
-        finished_at = case when status = 'queued' then ${i}::timestamptz else finished_at end,
-        error = case when status = 'queued' then ${Ye} else error end,
-        inbox_seq = case when status = 'queued' then inbox_seq else inbox_seq + 1 end,
-        cancel_requested_at = ${i}::timestamptz, updated_at = ${i}::timestamptz
-      where ${this.fence(e,t,{...r,statuses:Q})} returning id, generation, inbox_seq, status
-    ), connections as (delete from ${M} where ${Ns(e,t)} and exists (select 1 from cancelled where status = 'cancelled')), message as (
-      insert into ${R} (organization_id, task_id, seq, generation, kind, value, at)
-      select ${e}, id, inbox_seq, generation, 'cancel', 'null'::jsonb, ${i}::timestamptz from cancelled where status in ('running', 'waiting')
-    ) select exists(select 1 from cancelled) as accepted`);return!!a?.accepted}async cancelRequested(e,t){let[n]=await D(this.db,()=>this.db.select({at:L.cancelRequestedAt}).from(L).where(this.where(e,t)));return!!n?.at}filter(e,t){let n=t.status&&t.status!==`waiting`?[t.status]:t.statuses,r=t.q?.trim(),i=r&&`%${r.replace(/[\\%_]/g,`\\$&`)}%`;return F(P(L.organizationId,e),n?z(L.status,n):void 0,t.status===`waiting`?ec:void 0,t.agent?P(L.agent,t.agent):void 0,t.source?P(L.source,t.source):void 0,t.reviewKey?P(L.reviewKey,t.reviewKey):void 0,t.archived===void 0?void 0:t.archived?Or(L.archivedAt):j(L.archivedAt),i?ur(dr(O`${L.event}->>'text'`,i),dr(L.prompt,i),dr(L.agent,i),dr(L.publicId,i)):void 0)}pageQuery(e,t){let{before:n}=t,r=t.summary?{publicId:L.publicId,source:L.source,agent:L.agent,flow:L.flow,prompt:L.prompt,event:O`case when ${L.event} is not null then jsonb_build_object('integration', ${L.event}->>'integration', 'type', ${L.event}->>'type', 'text', ${L.event}->>'text') end`.as(`event`),usage:O`jsonb_strip_nulls(jsonb_build_object('engine', coalesce(${L.usage}->>'engine', ${L.definition}->>'engine'), 'model', coalesce(${L.usage}->>'model', ${L.definition}->>'model'), 'effort', coalesce(${L.usage}->>'effort', ${L.definition}->>'effort')))`.as(`usage`),status:L.status,attempts:L.attempts,approval:L.approval,archivedAt:L.archivedAt,createdAt:L.createdAt,startedAt:L.startedAt,finishedAt:L.finishedAt,updatedAt:L.updatedAt}:cr(L),i=this.db.select(r).from(L).where(F(this.filter(e,t),t.since===void 0?void 0:ur(_r(L.updatedAt,new Date(t.since)),t.sinceId?F(P(L.updatedAt,new Date(t.since)),_r($s(L.publicId),t.sinceId)):void 0),n?this.after(n):void 0)).orderBy(...t.since===void 0?tc(L):nc(L));return t.limit===void 0?i:i.limit(t.limit)}after(e){if(`updatedAt`in e)return ur(_r(L.updatedAt,new Date(e.updatedAt)),F(P(L.updatedAt,new Date(e.updatedAt)),_r($s(L.publicId),e.id)));let t=O`(${Qs(L.createdAt)}, ${$s(L.publicId)}) < (${new Date(e.createdAt).toISOString()}::timestamptz, ${e.id})`;return ur(_r(Zs(L.status),e.rank),F(P(Zs(L.status),e.rank),t))}record(e,t){return t?Jo({task:Jo({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,prompt:e.prompt,event:e.event,usage:Object.keys(e.usage??{}).length?e.usage:void 0}),status:e.status,attempts:e.attempts,approval:e.approval,archivedAt:e.archivedAt?K(e.archivedAt):void 0,createdAt:K(e.createdAt),startedAt:e.startedAt?K(e.startedAt):void 0,finishedAt:e.finishedAt?K(e.finishedAt):void 0,updatedAt:K(e.updatedAt)}):ts(e)}async list(e,t={}){return(await D(this.db,()=>this.pageQuery(e,t))).map(e=>this.record(e,t.summary))}async changes(e,t){if(!e.length)return{rows:[],deleted:[]};let n=e.map(e=>e.organizationId),r=e.flatMap(e=>e.ids.map(()=>e.organizationId)),i=e.flatMap(e=>e.ids),a=i.length?O`(${L.organizationId}, ${L.publicId}) in (select * from unnest(${O.param(r)}::text[], ${O.param(i)}::text[]))`:O`false`,[o,s]=await Promise.all([D(this.db,()=>this.db.select({organizationId:L.organizationId,publicId:L.publicId,source:L.source,agent:L.agent,flow:L.flow,status:L.status,approval:L.approval,answer:O`case when ${a} then ${L.answer} end`,result:O`case when ${a} then ${L.result} end`,error:O`case when ${a} then ${L.error} end`,attempts:L.attempts,archivedAt:L.archivedAt,createdAt:L.createdAt,startedAt:L.startedAt,finishedAt:L.finishedAt,updatedAt:L.updatedAt}).from(L).where(ur(F(z(L.organizationId,n),_r(L.updatedAt,new Date(t))),i.length?a:void 0))),D(this.db,()=>this.db.select().from(Tr).where(F(z(Tr.organizationId,n),_r(Tr.deletedAt,new Date(t)))))]);return{rows:o.map(e=>({organizationId:e.organizationId,status:Jo({task:{id:e.publicId,source:e.source,agent:e.agent,flow:e.flow},status:e.status,approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,result:e.result,error:e.error,attempts:e.attempts,archivedAt:e.archivedAt&&K(e.archivedAt),createdAt:K(e.createdAt),startedAt:e.startedAt&&K(e.startedAt),finishedAt:e.finishedAt&&K(e.finishedAt),updatedAt:K(e.updatedAt)})})),deleted:s.map(e=>({organizationId:e.organizationId,id:e.publicId,at:K(e.deletedAt)}))}}countQuery(e,t){return this.db.select({all:O`count(*)::int`.as(`all`),active:O`(count(*) filter (where ${z(L.status,Q)}))::int`.as(`active`),waiting:O`(count(*) filter (where ${ec}))::int`.as(`waiting`)}).from(L).where(this.filter(e,t))}async counts(e,t={}){let[n]=await D(this.db,()=>this.countQuery(e,t));return n??{all:0,active:0,waiting:0}}async listWithCounts(e,t){let n=this.db.$with(`totals`).as(this.countQuery(e,t)),r=this.db.$with(`page`).as(this.pageQuery(e,{...t,limit:t.limit??20})),i=Object.fromEntries(Object.keys(r._.selectedFields).map(e=>[e,r[e]])),a=await D(this.db,()=>this.db.with(n,r).select({...i,all:n.all,active:n.active,waiting:n.waiting}).from(n).leftJoin(r,O`true`).orderBy(...t.since===void 0?tc({status:i.status,createdAt:i.createdAt,publicId:i.publicId}):nc({updatedAt:i.updatedAt,publicId:i.publicId}))),{all:o=0,active:s=0,waiting:c=0}=a[0]??{};return{items:a.filter(e=>e.publicId!==null&&e.publicId!==void 0).map(e=>this.record(e,t.summary)),counts:{all:o,active:s,waiting:c}}}async runningCount(){let[e]=await D(this.db,()=>this.db.select({value:O`count(*)::int`}).from(L).where(z(L.status,[`running`,`waiting`])));return e?.value??0}async running(){return(await D(this.db,()=>this.db.select().from(L).where(z(L.status,[`running`,`waiting`])))).map(e=>({organizationId:e.organizationId,status:ts(e)}))}async appendLogs(e,t,n,r,i,a,o){let s=n.length?O`, inserted as (
-      insert into ${wr} (organization_id, task_id, seq, at, level, line)
-      select ${e}, accepted.id, entry.seq, to_timestamp(entry.at / 1000.0), entry.level, entry.line
-      from accepted cross join jsonb_to_recordset(${JSON.stringify(n)}::jsonb) as entry(seq int, at bigint, level text, line text)
-    )`:O``,[c]=await ss(this.db,O`
-      with accepted as (
-        update ${L} set log_cursor = ${i.cursor}, log_seq = ${i.seq}, log_bytes = ${i.bytes}, updated_at = ${new Date(a).toISOString()}::timestamptz
-        where ${this.fence(e,t,o)} and coalesce(log_seq, 0) = ${r.seq} and coalesce(log_cursor, -1) = ${r.cursor}
-        returning id
-      ) ${s} select exists (select 1 from accepted) as accepted`);return!!c?.accepted}async readInbox(e,t,n,r){return(await D(this.db,()=>this.db.select({seq:R.seq,generation:R.generation,at:R.at,kind:R.kind,value:R.value}).from(R).innerJoin(L,P(L.id,R.taskId)).where(F(this.where(e,t),P(L.generation,n),z(L.status,Q),P(R.generation,n),O`${R.seq} > ${r}`)).orderBy(N(R.seq)).limit(100))).map(e=>({...e,at:K(e.at)}))}async appendInbox(e,t,n,r,i,a,o,s){return s?this.db.transaction(async c=>{let[l]=await c.select({context:L.context}).from(L).where(this.where(e,t)).for(`update`);for(let e of s){let t=yt(l?.context?.approvals?.find(t=>t.id===e.id),e);if(t)throw new _t(t)}let u=lt(l?.context?.approvals??[],s);return this.insertInbox(c,e,t,n,r,i,a,o,u)}):this.insertInbox(this.db,e,t,n,r,i,a,o)}async insertInbox(e,t,n,r,i,a,o,s,c){let l=s?O`select key, value from ${M}
-          where key = ${Y(t,`delivery`,s.key)}
-            and value->'sending'->>'owner' = ${s.owner}
-            and (expires_at is null or expires_at > ${new Date(a).toISOString()}::timestamptz) for update`:O`select null`,u=s&&Dm(s),d=u?O`, context = coalesce(${L.context}, '{}'::jsonb) || jsonb_build_object('admissions',
-          coalesce(${L.context}->'admissions', '{}'::jsonb) || ${JSON.stringify(u)}::jsonb)`:c?O`, context = jsonb_set(coalesce(${L.context}, '{}'::jsonb), '{approvals}', ${JSON.stringify(c)}::jsonb)`:O``,f=O`(${M.value}->'sending'->>'count')::int`,p=O`coalesce((select n from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n)
-          where n <= ${f} and item->>'admission' = ${s?.through??null}::text limit 1), 0)`,[m]=await ss(e,O`
-      with held as materialized (${l}), next as (
-        update ${L} set inbox_seq = inbox_seq + 1, updated_at = ${new Date(a).toISOString()}::timestamptz${d}
-        where ${this.fence(t,n,{generation:o,statuses:Q})}
-          and exists(select 1 from held) returning id, inbox_seq, generation
-      ), admitted as (
-        insert into ${R} (organization_id, task_id, seq, generation, kind, value, at)
-        select ${t}, id, inbox_seq, generation, ${r}, ${JSON.stringify(u?{...i,admissions:u}:i??null)}::jsonb, ${new Date(a).toISOString()}::timestamptz from next returning seq
-      ) ${s?O`, acknowledged as (
-        update ${M} set value = (${M.value} - 'sending') || jsonb_build_object(
-          'items', coalesce((select jsonb_agg(item order by n) from jsonb_array_elements(${M.value}->'items') with ordinality e(item,n) where n > ${p}), '[]'::jsonb)) ||
-          case when ${f} > ${p} then jsonb_build_object('sending',
-            (${M.value}->'sending') || jsonb_build_object('count', ${f} - ${p}, 'until', ${a+er}::bigint)) else '{}'::jsonb end
-        where key in (select key from held) and exists(select 1 from admitted)
-      )`:O``}
-      select (select seq from admitted) as seq, exists(select 1 from held) as held`);if(s&&!m?.held)throw new Om;return m?.seq==null?void 0:{seq:m.seq,generation:o,at:a,kind:r,value:i}}async fetchInbox(e,t,n,r,i){let[a]=await D(this.db,()=>ss(this.db,O`
-      select coalesce(jsonb_agg(jsonb_build_object('seq', i.seq, 'generation', i.generation, 'at', extract(epoch from i.at) * 1000, 'kind', i.kind, 'value', i.value) order by i.seq) filter (where i.seq is not null), '[]'::jsonb) as entries
-      from ${L} left join ${R} i on i.task_id = ${L.id} and i.generation = ${L.generation} and i.seq > ${i}
-      where ${this.fence(e,t,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})} group by ${L.id}`));return a?.entries}async ackInbox(e,t,n,r){if(r.generation!==void 0&&r.generation!==n.generation)return;let[i]=await ar(this.db,[this.connectionLock(e,t)],O`
-    with current as (
-      select id from ${L} where ${this.fence(e,t,{...r,generation:n.generation,statuses:void 0})}
-        and inbox_seq >= ${n.seq} and (status in ('running', 'waiting') or (status in ('completed', 'failed', 'cancelled') and inbox_ack >= ${n.seq})) for update
-    ), applied as (
-      delete from ${R} where task_id in (select id from current) and generation = ${n.generation} and seq <= ${n.seq} returning seq, kind, value
-    ), answers as (
-      select jsonb_agg(a.value order by a.seq) as value from jsonb_to_recordset(${JSON.stringify(n.answers??[])}::jsonb) a(seq int, value jsonb)
-      where exists (select 1 from applied where applied.seq = a.seq and applied.kind = 'ask')
-    ), updated as (
-      update ${L} set inbox_ack = greatest(inbox_ack, ${n.seq}), answer = coalesce(answer, '[]'::jsonb) || coalesce(answers.value, '[]'::jsonb),
-        status = case when exists(select 1 from applied where kind = 'cancel') then 'cancelled'
-          when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${L.approval}->>'id') then 'running' else status end,
-        approval = case when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${L.approval}->>'id') then null else approval end,
-        finished_at = case when exists(select 1 from applied where kind = 'cancel') then now() else finished_at end,
-        error = case when exists(select 1 from applied where kind = 'cancel') then ${Ye} else error end,
-        updated_at = now()
-      from answers where id in (select id from current) returning status
-    ), connections as (delete from ${M} where ${Ns(e,t)} and exists (select 1 from updated where status = 'cancelled'))
-    select exists (select 1 from current) as accepted, (select status from updated) as status`);return i?.accepted?i.status??void 0:void 0}async pendingInbox(e){return(await D(this.db,()=>this.db.select().from(L).where(F(e===void 0?void 0:P(L.organizationId,e),z(L.status,[`running`,`waiting`]),O`exists (select 1 from ${R} where ${R.taskId} = ${L.id} and ${R.generation} = ${L.generation})`)))).map(e=>({organizationId:e.organizationId,status:ts(e)}))}};const ic=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function ac(e,t,n){n.length&&await e.store.withAppLock(`task-warnings:${t}`,async r=>{let i=r instanceof Vs?new rc(r.db):e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`task-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`task-warning:${t}:${e}`,{at:c});return}}})}async function oc(e,t,n,r,i,a=0){let o=sc(n,r,i,a);return await e.putMany(`tasklog`,o.lines.map(({seq:e,...n})=>({id:ic(t,e),value:n}))),{seq:o.seq,bytes:o.bytes}}function sc(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function cc(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:ic(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=Jt(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function lc(e,t,n=!1){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]);n&&i.delete(a);let o=i.get(a);return o||(o=Sf(e,t).then(e=>{let t=e.sort((e,t)=>t.length-e.length);return e=>t.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e)}).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.()),o}async function uc(e,t,n){let r=await lc(e,t),i=e=>typeof e==`string`?r(e):Array.isArray(e)?e.map(i):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[r(e),i(t)])):e,a=e=>{try{return JSON.stringify(i(JSON.parse(e)))}catch{return r(e)}};for(let r=0;r<5;r++){let i=r===0&&e.callbackTask===t?t:await e.store.get(`task`,t.task.id);if(!i||i.attempts!==t.attempts||i.tokenHash!==t.tokenHash||i.generation!==t.generation)return`stale`;let o=i.logCursor??-1,s=n.filter(e=>e.seq>o);if(!s.length)return`ok`;if(i.logsComplete||s[0].seq!==o+1)return`gap`;let c=(e.now??Date.now)(),l=sc(s.map(e=>({...e,line:a(e.line)})),i.logSeq??0,c,i.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,l.lines,{seq:i.logSeq??0,cursor:o},{seq:l.seq,cursor:s.at(-1).seq,bytes:l.bytes},c,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}var X=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function dc(e,t,n){if(n?.problems?.length)throw new X(n.problems.join(`
-`),409);if(n?.settings?.disabled)throw new X(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${Ag(Og(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function fc(e,t){if(t.cwd===void 0)return;if(!e.local)throw new X(`cwd is available on a local server only`);let n=ka(t.cwd);if(!n.ok)throw new X(n.detail);return n.folder.path}const pc=/^[a-z0-9][a-z0-9_-]*$/i,mc=new Set([`claude`,`codex`,`custom`]),hc=new Set([`low`,`medium`,`high`]);function gc(e){let t=e.flow??`default`;if(!pc.test(t))throw new X(`Invalid flow "${t}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new X(`prompt must be text`);if(t==="default"&&!e.prompt?.trim())throw new X(`prompt is required`);if((e.prompt?.length??0)>65536)throw new X(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new X(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new X(`pr needs a repo and a pull request number`);if(e.engine!==void 0&&!mc.has(e.engine))throw new X(`Unknown engine "${e.engine}"`);if(e.effort!==void 0&&!hc.has(e.effort))throw new X(`Unknown effort "${e.effort}"`);if(e.permissions!==void 0&&!(e.permissions in re))throw new X(`Unknown permissions "${e.permissions}"`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>pc.test(e))))throw new X(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new X(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new X(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new X(`args must be an object`);if(e.name!==void 0&&(typeof e.name!=`string`||e.name.length>200))throw new X(`name must be text of at most 200 characters`);if(e.appendSystem!==void 0&&(typeof e.appendSystem!=`string`||e.appendSystem.length>65536))throw new X(`appendSystem must be text of at most 64 KB`);if(e.addDirs!==void 0&&(!Array.isArray(e.addDirs)||!e.addDirs.every(e=>typeof e==`string`&&B.isAbsolute(e))))throw new X(`addDirs must list absolute paths`)}async function _c(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await po(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(a)try{let r=await af(e,n,i,E(e.config,a.credentials)),o=i.repos?.includes(t)?i:await To(e,i,!1,{app:a,token:r,repo:t});if(!o?.repos?.includes(t))continue;return{integration:n,installation:o,app:a,token:r}}catch(e){console.error(`coder server: repository token for ${i.id} failed`,e)}}throw new X(`No install in this workspace reaches ${t}`,404)}async function vc(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await _c(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:l},author:a.author?.(s.name)??s.name}}async function yc(e,t,n){gc(n);let r=fc(e,n),i=(e.now??Date.now)(),a=e.session?.user.id,o=n.agent||bt();if(!o)throw new X(`Name an agent: this server has no default agent.`);o===bt()&&await qn(e,i),e.local&&await Jn(e.store,e.local.cwd,e.integrations);let{record:s,version:c}=await Xn(e.store,o),l=await In(e,{requester:a,runner:n.runner,agent:c?.definition.runner}).catch(e=>{throw new X(e.message)});if(!s||!c)throw new X(`No agent "${o}"`,404);dc(e,o,s);let u={...n.engine?{engine:n.engine}:{},...n.model?{model:n.model}:{},...n.effort?{effort:n.effort}:{},...n.permissions?{permissions:n.permissions}:{}},d=Vn(s,c,u,e.integrations),f=xt(d),{engine:p,credential:m,usable:h,chain:g,credentials:_}=await bp(e,f,a);if(!h&&l.runner!==`http`)throw new X(`No ${p} credential is connected`,409,await Mp(e,p));let v=`${i.toString(36)}-${Vr(4).toString(`hex`)}`,y=n.repo?await vc(e,v,n,a):void 0,b=n.addDirs?.length?nt(l.runner):void 0;if(e.local&&n.addDirs?.length&&!b)try{ht(r??e.local.cwd,n.addDirs)}catch(e){throw e instanceof rt?new X(e.message):e}let ee={id:v,...n.name?{name:n.name}:{},source:t,agent:d.id,flow:n.flow??`default`,...l,permissions:f.permissions,...y?{event:y.event,author:y.author}:{},...r&&!y?{cwd:r}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},...n.appendSystem?{appendSystem:n.appendSystem}:{},...n.addDirs?.length&&!b?{addDirs:n.addDirs}:{},definition:d.definition,engineChain:g,engineCredentials:_,...m?{credential:m}:{},...a?{requester:a}:{},...d.files?{files:d.files}:{},usage:{...d.usage,engine:p},tools:{},connections:await Oa(e,a,We(d.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&l.runner===`local`&&!l.runnerId?Bf(e,ee):(await e.queue.enqueue(e.organizationId,ee,i,void 0,e.config.maxQueued??1e3),b&&await ac(e,v,[b]),{task:ee,status:`queued`,attempts:0,createdAt:i,updatedAt:i})}function bc(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function xc(e,t){let n=t.event,r;if(n){let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i||!a||a.deletedAt||!e.loadAgent)return{};dc(e,t.agent,await e.store.get(`agent`,t.agent));let o=e.integrations[n.integration],s=E(e.config,i.credentials);r=await e.loadAgent(i,a,n,cf(e,o,a,n,s))}else{t.agent===bt()&&await qn(e,(e.now??Date.now)());let{record:n,version:i}=await Xn(e.store,t.agent);if(dc(e,t.agent,n),!n||!i)return{};r=Vn(n,i,t.usage,e.integrations)}let i=n&&ln(n,r),{engine:a,model:o,effort:s}=t.usage??{};return{definition:r.definition,usage:{...r.usage,...a?{engine:a}:{},...o?{model:o}:{},...s?{effort:s}:{}},tools:i?.tools??un(r),...r.files?{files:r.files}:{},permissions:i?.permissions??xt(r).permissions}}async function Sc(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new X(`outputSchema must be an object`);if(!n.trim())throw new X(`text is required`);if(n.length>65536)throw new X(`text is longer than 64 KB`);let{model:a,effort:o,permissions:s}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new X(`model must be text`);if(o!==void 0&&!hc.has(o))throw new X(`Unknown effort "${o}"`);if(s!==void 0&&!(s in re))throw new X(`Unknown permissions "${s}"`);let c=e=>Object.keys(re).indexOf(e??`auto`);if(s!==void 0&&c(s)>c(t.task.permissions))throw new X(`permissions can only be lowered on a resumed task (it runs ${t.task.permissions??`auto`})`);if(e.session&&t.task.requester&&t.task.requester!==e.session.user.id)throw new X(`Only the member who asked can continue this task`,403);let l=(e.now??Date.now)(),u=t.task.context?.messages??[],d=String(t.finishedAt??l),f=[...u,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:d}].slice(-20),p=t.task.context??{},m=bc(t);m.at(-1).finishedAt??=l;let h=await xc(e,t.task),g={task:{...t.task,...h,prompt:n,...a||o?{usage:{...h.usage??t.task.usage,...a?{model:a}:{},...o?{effort:o}:{}}}:{},...s?{permissions:s}:{},context:{...p,...r?{outputSchema:r}:{},messages:f,turns:m}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:l};if(!await e.queue.continueTask(e.organizationId,t.task.id,g.task,l,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new X(`Task is already active`,409);return g}const Cc={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var wc=class{buckets=new Map;sweptAt;startedAt;requests=0;rejections=0;constructor(e=Date.now()){this.startedAt=this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return C({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const Tc=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function Ec(e,t,n){let r=new URL(e.url).pathname,i=Tc.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?Dc(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await qh(e,t):void 0;return Dc(t,r===`/runners/register`?await Yh(e,t):a&&!(a instanceof Response)?a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function Dc(e,t,n,r){let i=e.limits??=new wc((e.now??Date.now)()),a={...Cc,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}const Oc=Symbol(`miss`);function kc(e,t){return new Proxy(e,{get(e,n){let r=Reflect.get(e,n,e);if(typeof r!=`function`)return r;let i=r.bind(e),a=t[n];return a?async(...e)=>{let t=a(...e);return t===Oc?i(...e):t}:i}})}const Ac=(e,t)=>e.length===t.length&&e.every((e,n)=>e===t[n]);function jc(e,t,n){let r=t.task,i=r.event,a=e=>e in n,o=`connections:${r.id}:${t.generation??0}:${t.attempts}:`;return kc(e,{get:(e,t)=>e===`app`&&a(`app`)&&t===i?.appId?n.app:e===`installation`&&a(`installation`)&&t===`${i?.appId}:${i?.installationId}`?n.installation:e===`credential`&&a(`credential`)&&t===r.credential?n.credential:e===`config`&&a(`config`)&&t===`workspace`?n.config:e===`runner`&&a(`runner`)&&t===r.runnerId?n.runner:e===`snapshot`&&a(`secrets`)&&t===`connection-secrets:${r.id}`?n.secrets?.old:e===`snapshot`&&a(`resolved`)&&t.startsWith(o)?n.resolved?.id===t?n.resolved.value:void 0:Oc,list:(e,t)=>e===`snapshot`&&a(`secrets`)&&t?.prefix===`connection-secrets:${r.id}:`?n.secrets.rows.map((e,n)=>({id:`${t.prefix}${n}`,value:{secret:e}})):Oc,listCredentials:e=>a(`credentials`)&&e.owner===r.requester&&e.limit===void 0?n.credentials??[]:Oc,heldTokens:(e,t)=>a(`tokens`)&&n.installation&&Ac(e,[n.installation.id])&&Ac(t,[n.installation.app])?n.tokens:Oc})}function Mc(e,t,n){let r=e=>e===void 0||e===t.requester,i=(e,t)=>!e.owner||e.owner===t;return kc(e,{get:(e,r)=>e===`agent`&&r===n.agent?t.record:e===`snapshot`&&n.files.some(e=>r.startsWith(e))?t.files[r]:Oc,conversationState:e=>e===n.conversation?t.conversation:Oc,listCredentials:e=>r(e.owner)&&e.limit===void 0?t.credentials.filter(t=>i(t.value,e.owner)):Oc,list:(e,n)=>e===`runner`&&n?.defaults&&!n.runner&&r(n.visibleTo)?t.runners.filter(e=>i(e.value,n.visibleTo)):e===`connection`&&!n?.ids&&!n?.secrets&&r(n?.visibleTo)?t.connections.filter(e=>i(e,n?.visibleTo)).map(e=>({id:e.id,value:e})):Oc,heldTokens:(e,r)=>Ac(e,[n.installation.id])&&Ac(r,[n.installation.app])?t.tokens:Oc})}function Nc(e,t){return ni(e,`link-start`,`*`,JSON.stringify(t),3e5)}function Pc(e,t,n){return`thread:${e}:${t}:${n}`}async function Fc(e,t,n,r){let i={};if(r)i.user={name:r.name,email:r.email};else if(r===void 0&&e.auth&&n.actor.id){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);r&&(i.user={name:r.name,email:r.email})}return i}const Ic=2592e6,Lc=36e5;async function Rc(e,t){if(!t.chat)return{};let n=zc(t);return e.store.conversationState(n)}const zc=e=>Pc(e.appId,e.installationId,e.chat.thread.id),Bc=e=>e.slice(0,e.indexOf(`:`)),Vc=e=>e.channelId?.slice((e.adapterName?.length??-1)+1)??``;function Hc(e,t,n,r){return`known:${e}:${t}:${n}:${r}`}async function Uc(e,t){return t.chat?(await e.store.conversationState(zc(t))).status:void 0}function Wc(e,t,n){let r=e.chat?.thread;if(!r)return;let i=r.id.slice((r.channelId?.length??-1)+1);return{key:zc(e),record:{at:n,taskId:t,...e.chat?.message?{seen:e.chat.message.id}:{}},root:Hc(e.appId,e.installationId,Vc(r),i),ttlMs:Ic}}async function Gc(e,t,n,r){let i=Wc(t,n,r);i&&await e.store.putMany(`delivery`,[{id:i.key,value:i.record},{id:i.root,value:{at:r}}],{ttlMs:Ic})}function Kc(e,t){let n=e.chat?.thread;return n?[...new Set([t].flat().filter(Boolean))].map(t=>Hc(e.appId,e.installationId,Vc(n),t)):[]}async function qc(e,t,n,r){await e.store.putMany(`delivery`,Kc(t,n).map(e=>({id:e,value:{at:r}})),{ttlMs:Ic})}async function Jc(e,t,n,r){if(t.chat?.message)return e.store.markConversation(zc(t),n,t.chat.message.id,r,Ic)}function Yc(e){let t=e.conversation?.unseen;return e.chat&&t!==void 0?{key:zc(e),version:t.version,...t.epoch?{epoch:t.epoch}:{}}:void 0}async function Xc(e,t,n){await e.store.appendUnseen(zc(t),n,Ic)}async function Zc(e,t){let n=Yc(t);n&&await e.store.acknowledgeUnseen(n.key,n.version,n.epoch)}function Qc(e,t,n){let r=kt(n.definition.integrations[e.id]);return!t.builtin&&Object.entries(e.events).some(([e,t])=>t.noisy&&r.includes(e))}function $c(e,t){let n=e.events[t.type]?.on;return n===`mention`||n===`command`||t.chat?.thread.isDM===!0||t.chat?.message?.isMention===!0}async function el(e,t,n,r){let i=n.chat?.thread;if(!i)return n;let a=i.isDM===!0,o=$c(t,n)||t.answersEveryPrompt===!0,[s,c]=await Promise.all([r.loaded?r.unseen??{messages:[],more:0}:e.store.get(`delivery`,`since:${zc(n)}`).then(e=>e??{messages:[],more:0}),t.conversation?t.conversation(n,{token:r.token,fetch:e.fetch??fetch,delivered:r.delivered,...r.existing?.seen?{after:r.existing.seen}:{}}).catch(e=>(console.error(`coder server: ${t.id} conversation facts failed`,e),{})):{}]),l=new Set(s.messages.flatMap(e=>e.id??[])),u=new Map(c.since?.flatMap(e=>e.id?[[e.id,e]]:[])),d=[...s.messages.map(({sequence:e,...t})=>t.id&&u.get(t.id)||t),...(c.since??[]).filter(e=>!e.id||!l.has(e.id))],f=d.slice(0,50),p=(c.since?0:s.more)+d.length-f.length,m=r.existing||a?void 0:c.index??n.conversation?.index;return{...n,mustReply:o,conversation:{...m===void 0?{}:{index:m},...s.messages.length||s.more?{unseen:{version:s.version??s.messages.length+s.more,epoch:s.epoch}}:{},...f.length?{since:f}:{},...p?{more:p}:{}}}}async function tl(e,t,n){for(;;){let r=await e.store.claimBatch(t,n);if(r!==null)return r;await new Promise(e=>setTimeout(e,500))}}async function nl(e,t,n,r,i){return e.store.finishBatch(t,n,r,i)}async function rl(e,t,n,r){let i=await e.store.get(`task`,t.task.id)??t,a=Bc(n),o=await Um(e,t.task.id,-1,i.generation??0),s=new Set([i.task.context?.admissions?.[a],...o.map(e=>e.value?.admissions?.[a])]);return{fresh:i,through:r.reduce((e,t,n)=>s.has(t.admission)?n+1:e,0)}}async function il(e,t,n,r){if(!Q.includes(t.status))return!1;let i=t.status!==`queued`&&al(e,t.task)?Uf(e.local.cwd,t.task.id,!1):void 0;return i&&!Q.includes(i.status)?!1:!!await Hm(e,t,`steer`,{text:n},r)}const al=(e,t)=>!!e.local&&!t.event?.repo&&t.runner===`local`&&!t.runnerId;async function ol(e,t,n,r,i){let{task:a}=t,o={mustReply:r,admissions:{...a.context?.admissions,...i}};if(al(e,a))return Wf(e,e.local.cwd,a.id,n,void 0,{},o);try{await Sc(e,{...t,task:{...a,context:{...a.context,...o}}},n)}catch(e){if(e instanceof X&&e.status===409)return!1;throw e}return!0}function sl(e,t){let n=t.catch(e=>console.error(`coder server: conversation batch failed`,e));e.waitUntil&&e.waitUntil(n)}function cl(e){let t=t=>Qt(e.slice(0,t).map(e=>e.event),e[t-1].user),n=t(1);if(n.length>65536){let t=e[0].event,n=n=>Qt([{...t,text:t.text.slice(0,n)+`
-[message truncated]`}],e[0].user);n(0).length>65536&&(t={...t,conversation:{...t.conversation,since:void 0,more:(t.conversation?.more??0)+(t.conversation?.since?.length??0)},promptContext:void 0,chat:t.chat?{thread:t.chat.thread,message:t.chat.message?{...t.chat.message,attachments:[],links:[]}:void 0}:void 0});let r=0,i=t.text.length;for(;r<i;){let e=Math.ceil((r+i)/2);n(e).length<=65536?r=e:i=e-1}return{text:n(r),count:1}}let r=1;for(;r<e.length;){let e=t(r+1);if(e.length>65536)break;n=e,r++}return{text:n,count:r}}async function ll(e,t,n,r,i,a){let o=`batch:${zc(n)}`;if(!(a?a.batch:await e.store.get(`delivery`,o))?.items.length&&await il(e,t,Qt([n],r))){await Zc(e,n),await Jc(e,n,t.task.id,i());return}let s=Hr(),c=n.chat?.message,l=c?{...n,chat:{thread:n.chat.thread,message:{...c,formatted:{type:`root`,children:[]},raw:null,attachments:c.attachments.map(({type:e,url:t,name:n})=>({type:e,...t?{url:t}:{},...n?{name:n}:{}}))}}}:n;await e.store.appendBatch(o,s,[{admission:s,event:l,user:r}],i(),Lc),await Zc(e,n),sl(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.steerBatchMs??5e3));let n=await tl(e,o,s);if(!n)return;let r=n.items.map((e,t)=>t===n.items.length-1?{...e,event:{...e.event,mustReply:e.event.mustReply||n.mustReply,conversation:{...e.event.conversation,more:(e.event.conversation?.more??0)+(n.more??0)}}}:e),a=!1,c=!1,l=!1;try{for(let n=0;n<r.length;){let{fresh:a,through:u}=await rl(e,t,o,r);if(u>n){if(c=!0,!await nl(e,o,s,!0,r[u-1].admission))return;n=u;continue}let{text:d,count:f}=cl(r.slice(n)),p=r.slice(n,n+f),m=p.at(-1).admission,h=await il(e,a,d,{key:o,owner:s,through:m}),g=h||await ol(e,a,d,p.some(e=>e.event.mustReply===!0),{[Bc(o)]:m});if(!g&&!l){l=!0;continue}if(!g)throw Error(`Conversation task did not accept the batch`);if(c=!0,!h&&!await nl(e,o,s,!0,m))return;await Jc(e,p.at(-1).event,t.task.id,i()),n+=f}a=!0}catch(e){if(!(e instanceof Om))throw e}finally{a||await nl(e,o,s,!1),c&&await gu(e,!0,!1,!0)}})())}async function ul(e,t,n,r){let i=await Uc(e,t);if(!i||!Q.includes(i.status))return;let a=`reactions:${zc(t)}`,o=Hr();await e.store.appendBatch(a,o,[{...n,admission:o}],r(),Lc),sl(e,(async()=>{await new Promise(t=>setTimeout(t,e.config.reactionBatchMs??3e4));let n=await tl(e,a,o);if(!n)return;let r=!1;try{let{fresh:s,through:c}=await rl(e,i,a,n.items),l=n.items.slice(c);if(c&&!await nl(e,a,o,!0,n.items[c-1].admission))return;if(!l.length){r=!0;return}let u=new Map;for(let{emoji:e,by:t,on:n}of l){let r=u.get(`${e}\n${n}`)??{emoji:e,by:[],on:n};r.by.includes(t)||r.by.push(t),u.set(`${e}\n${n}`,r)}r=await il(e,s,Zt({...t,conversation:{...t.conversation,more:n.more}},[...u.values()]),{key:a,owner:o,through:l.at(-1).admission})}catch(e){if(!(e instanceof Om))throw e}finally{r||await nl(e,a,o,!1)}})())}const dl=6e4,fl=864e5,pl=262144,ml=[`model`,`engine`,`effort`],hl=[`Usage:`,"• `/setup model <name>`. Sets the engine model. Also accepts `engine` and `effort`.","• `/setup show`. Shows the current settings."].join(`
-`);function gl(e){return e.type===`command`}function _l(e){let t=Object.entries(e??{}).filter(([,e])=>e);return t.length?`Current settings:\n${t.map(([e,t])=>`• ${e}: \`${t}\``).join(`
-`)}`:`No settings yet. A workspace admin can configure this agent in the dashboard.`}function vl(e){let[t=``,...n]=e.text.trim().split(/\s+/);return ml.includes(t)&&n.join(` `).trim()!==``}async function yl(e,t,n){let[r=``,...i]=e.text.trim().split(/\s+/),a=i.join(` `).trim(),o={...t.settings},s;return r?r===`show`?s=_l(t.settings):ml.includes(r)?a?(o[r]=a,s=`${r} set to \`${a}\`.`):s=`Give a value: \`/setup ${r} <name>\`.`:s=`Unknown setting \`${r}\`.\n${hl}`:s=hl,JSON.stringify(o)!==JSON.stringify(t.settings??{})&&await fo(n,`installation`,t.id,{settings:o}),s}async function bl(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}async function xl(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}const Sl=`Coder could not check your access to this conversation.`;async function Cl(e,t,n,r){if(t.auth.canWrite)return t.auth.canWrite(n,await r(),e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed for ${n.appId} event ${n.deliveryId}`,e),null))}async function wl(e,t,n,r,i){let a=e.config.publicUrl?.replace(/\/$/,``);if(!a)return;let o=e=>`Link your Coder account so I can work for you here: ${e}`;if(t.auth.user){await i.post(o(`${a}/connect/${t.id}?installation=${encodeURIComponent(n.id)}`));return}let s=await Nc(e,{platform:t.id,platformUserId:r.actor.id});await i.whisper(o(`${a}/connect?token=${encodeURIComponent(s)}`))}async function Tl(e,t,n){return`No model is configured yet. If you have access to it, [add one here](${await Mp(e,t,n)}).`}async function El(e,t,n){return`There was a problem with your connected model. If you have access to it, [check it here](${await Mp(e,t,n)}).`}async function Dl(e,t,n){let r=e.config.publicUrl?.replace(/\/$/,``);return r?`${r}${Ag(n,`/tasks/${t}`)}`:void 0}async function Ol(e,t,n){let r=t.chat?.thread.id;if(!e.local||t.repo||!r)return;let i=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(({value:e})=>{let i=e.pending?.task;return i?.flow==="default"&&i.agent===n&&i.event?.appId===t.appId&&i.event.installationId===t.installationId&&i.event.chat?.thread.id===r&&e.pending?.taskId})?.value.pending;if(!i?.task)return;let a=await Bf(e,i.task,i.taskId);return await Gc(e,i.task.event,a.task.id,(e.now??Date.now)()),await e.store.get(`task`,a.task.id)??a}async function kl(e,t,n,r,i,a,o){let s=`delivery:${t.id}:${n.id}:${i.installationId}:${i.chat?.thread.id??``}:${i.deliveryId}`,c=await bl(e,n,i);if(!c)return{};if(e.local&&await(e.syncAgent?.(n.agent)??Jn(e.store,e.local.cwd,e.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e)),!e.local){let l=Hr(),u={delivery:{key:s,owner:l,at:a(),ttlMs:dl},agent:n.agent,...i.chat?{conversation:Pc(i.appId,i.installationId,i.chat.thread.id)}:{},...i.actor.id?{actor:{platform:t.id,id:i.actor.id}}:{},installation:c,files:Ua(c,i)},{claimed:d,loaded:f}=await e.store.dispatchState(u);if(!d)return{};let p=f?{...e,store:Mc(e.store,f,u)}:e;if((await p.store.get(`agent`,n.agent))?.settings?.disabled)return await e.store.updateDelivery(s,l,void 0),{};try{let u=await jl(p,t,n,r,i,c,a,o,s,{owner:l,loaded:f&&{...f,store:p.store}});return!u.work&&!u.taskId&&!u.steered&&await e.store.updateDelivery(s,l,{at:a()},{ttlMs:fl}),await u.work,u.taskId?{taskId:u.taskId}:{}}catch(t){let n=await e.store.get(`delivery`,s).catch(()=>void 0),r=n?.pending?.task?n.pending:void 0;throw await e.store.updateDelivery(s,l,r?{at:a(),pending:r}:void 0).catch(()=>{}),t}}if((await e.store.get(`agent`,n.agent))?.settings?.disabled||await e.store.get(`delivery`,s).then(e=>e&&!e.pending))return{};let l=JSON.stringify([i.appId,i.installationId,i.chat?.thread.id]),u=e.store.handoffs??=new Map,d=(u.get(l)??Promise.resolve()).catch(()=>{}).then(async()=>{let l=await jl(e,t,n,r,i,c,a,o,s);return await l.work,l});u.set(l,d);try{return await d}finally{u.get(l)===d&&u.delete(l)}}async function Al(e,t,n,r,i,a,o,s){let c=s??Hr(),l=a&&(a.flow==="default"?se():Gt()),u=l&&a?.taskUrl?await Dl(e,l,await(o?.()??kg(e))):void 0,d={event:n,...a?{task:{...a,...u?{taskUrl:u}:{}},taskId:l}:{}};if(e.local&&!n.repo){let n=await e.store.get(`delivery`,t);if(n&&!n.pending)return{};if(d=n?.pending??d,d.task&&!d.taskId)throw Error(`Local delivery has no task binding`);await e.store.put(`delivery`,t,{at:r(),owner:c,pending:d})}else if(!s&&!await e.store.create(`delivery`,t,{at:r(),owner:c,pending:d},{ttlMs:dl}))return{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,c,{at:r(),owner:c,pending:d},{ttlMs:dl})}).catch(()=>{})},dl/3);try{await i(d),a&&clearInterval(a),await n,await e.store.updateDelivery(t,c,{at:r()},{ttlMs:fl})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!d.task)&&await e.store.updateDelivery(t,c,void 0).catch(()=>{}),r}})()}}async function jl(e,t,n,r,i,a,o,s,c,l){let u,d=()=>u??=kg(e,l?.loaded?.workspace),f=t=>Al(e,c,i,o,t,void 0,d,l?.owner);if(gl(i))return e.auth&&vl(i)&&!await xl(e,t,i)?f(()=>wl(e,t,a,i,s)):f(()=>yl(i,a,e.store).then(e=>s.whisper(e)).then(()=>{}));let p=cf(e,t,a,i,r),m=async()=>(await p(i.integration)).token(),h=i.chat?Il(i.text):void 0,g=h&&(await Rc(e,i)).status;if(h&&g&&(h.id||(await tu(e,g.task.id)).length===1))return f(()=>ru(e,t,g,h,i,m,e=>s.whisper(e)));let[_,v]=await Promise.all([e.loadAgent(n,a,i,p,l?.loaded),e.auth&&i.actor.id?xl(e,t,i):void 0]),y=ln(i,_);if(!y){let t=i.chat?.message;return t&&await Xc(e,i,{id:t.id,author:t.author.userName||t.author.userId,text:i.text,sentAt:t.metadata.dateSent}),{}}let b=await Cl(e,t,i,m);if(b===null)return f(async()=>{await s.problem(Sl)});if(b===!1)return{};let ee=(t,n,r)=>Al(e,c,i,o,async t=>{let i=t.task,a=await Bf(e,i,t.taskId);await Promise.all([Gc(e,i.event,a.task.id,o()),Zc(e,i.event)]),await Sm(e,a.task.id,[...p.minted,...r?[r]:[]]),n&&xe(e.local.cwd,a.task.id,{kind:`status`,message:n})},t,d);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,c);if(t?.pending?.task){let e=t.pending.task;return e.agent!==_.id||e.flow!==y.flow?{}:ee(e)}}let te=!!i.chat&&y.flow==="default",ne=te?await Rc(e,i):void 0,re=ne?.record,ie=te?await el(e,t,i,{token:async()=>(await p(i.integration))?.token(),delivered:Qc(t,n,_),unseen:ne?.unseen,loaded:!0,...re?{existing:re}:{}}):i,ae=v?{name:v.name,email:v.email}:void 0,oe=te?ne?.status??await Ol(e,ie,_.id):void 0;if(oe)return f(()=>ll(e,oe,ie,ae,o,ne));let se=!te||ie.chat?.thread.isDM===!0,ce=se?v?.id:void 0,le=se?y.actAs:void 0,ue=xt(_),[de,fe,pe,me,he]=await Promise.all([In(e,{requester:ce,agent:_.definition.runner}),bp(e,ue,ce),Fc(e,t,i,v??null),Oa(e,ce,_.usage?.connections),le===`requester`?of(e,t,i,r).catch(()=>void 0):void 0]),{engine:x,credential:ge,usable:_e,chain:ve,credentials:ye}=fe;if(!_e&&de.runner!==`http`)return ie.mustReply??$c(t,i)?f(async()=>{let r=`setup:${n.id}:${i.chat?.thread.id??i.deliveryId}`,a=i.deliveryId;if(!(!(t.answersEveryPrompt||await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5}))&&(await e.store.get(`delivery`,r))?.owner!==a))try{await s.problem(await Tl(e,x,await d()))}catch(n){throw t.answersEveryPrompt||await e.store.updateDelivery(r,a,void 0),n}}):{};let be=e.auth&&le===`requester`&&!he?`Acting as the app because the requester's account has no usable ${t.name} token. [Connect your account](${e.config.publicUrl?.replace(/\/$/,``)??``}${Ag(await d(),`/settings/connections`)}).`:void 0;if(be&&(pe.instructions=[pe.instructions,be,`Include the account connection link in your reply.`].filter(Boolean).join(`
-
-`)),Buffer.byteLength(JSON.stringify(i))>pl)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(pe))>pl)throw Error(`Task context exceeds 256 KB`);let Se=`${i.deliveryId}-${_.id}`,Ce=await Dl(e,Se,await d()),we={id:Se,source:i.integration,agent:_.id,flow:y.flow,...de,permissions:y.permissions??ue.permissions,event:ie,failureReply:await El(e,x,await d()),...Ce?{taskUrl:Ce}:{},author:t.author?.(n.name)??n.name,definition:_.definition,engineChain:ve,engineCredentials:ye,...ge?{credential:ge}:{},...ce?{requester:ce}:{},..._.files?{files:_.files}:{},usage:{..._.usage,engine:x},tools:y.tools,connections:me,...Object.keys(pe).length?{context:pe}:{}};if(e.local&&!i.repo&&de.runner===`local`&&!de.runnerId)return ee(we,be,he);let Te=o(),Ee=await e.queue.deliver(e.organizationId,we,Te,{key:c,ttlMs:fl,...l?{owner:l.owner}:{}},te?Qt([ie],ae):void 0,e.config.maxQueued??1e3,!0,{conversation:Wc(ie,Se,Te),unseen:Yc(ie),secrets:xm(e,Se,[...p.minted,...he?[he]:[]])});return be&&Ee.taskId&&await ac(e,Ee.taskId,[be]),Ee}const Ml=2592e6,Nl=`You need write access here to approve or deny this.`,Pl=/^\s*\/(approve|deny)\s+(apr-[\w-]+)(?:\s+([\s\S]*?))?\s*$/i,Fl=/^\s*(approve|deny)\s*$/i;function Il(e){let t=Pl.exec(e),n=(t?.[1]??Fl.exec(e)?.[1])?.toLowerCase();if(!n)return;let r=t?.[3]?.trim();return{...t?{id:t[2]}:{},decision:n===`approve`?`accept`:`decline`,...r&&n===`deny`?{reason:r}:{}}}function Ll(e){let t="`".repeat(Math.max(3,...(e.match(/`+/g)??[]).map(e=>e.length+1)));return`${t}\n${e}\n${t}`}function Rl(e){if(e.decision===`closed`)return`**Task stopped**.`;let t=`**${e.decision===`accept`?`Approved`:`Denied`}** ${e.by?`by ${e.by}`:`in Coder`}${e.reason?`: ${e.reason}`:``}`;return/[.!?]$/.test(t)?t:`${t}.`}function zl(e,t){let n=`${t+1}. `;return/[\n`]/.test(e)?n+Ll(e).replaceAll(`
-`,`\n${` `.repeat(n.length)}`):`${n}\`${e}\``}function Bl(e){return{summary:pt(e),markdown:e.actions.map(zl).join(`
-`),items:e.actions}}function Vl(e,t={}){let n=t.outcome?Rl(t.outcome):[!t.separate&&e.taskUrl&&`[Approve in Coder](${e.taskUrl})`,t.commands&&`reply \`/approve ${e.id}\` or \`/deny ${e.id} <reason>\``].filter(Boolean).join(`, or `),r=Bl(e);return[`**Approval needed**`,e.reason,!t.separate&&(t.collapsed?t.collapsed(r.summary,r.markdown):`**${r.summary}**\n\n${r.markdown}`),n&&`${n[0].toUpperCase()}${n.slice(1)}${t.outcome?``:`.`}`].filter(Boolean).join(`
-
-`)}function Hl(e,t,n,r){let i=e.messages&&!n?[{label:`Approve`,value:`/approve ${t.id}`,style:`primary`,confirm:`Approve ${pt(t)} for this task?`},{label:`Deny`,value:`/deny ${t.id}`,style:`danger`,ask:{label:`Why?`,placeholder:`The task reads it`}}]:void 0;return r?{markdown:[r.note,`Waiting for your answer on the approval above.`].filter(Boolean).join(`
-
-`),...i?{buttons:i}:{}}:{markdown:Vl(t,{outcome:n,commands:!i,separate:!!e.messages,collapsed:e.collapsed}),...e.messages?{card:{title:`Approval needed`,body:t.reason,...n?{status:Rl(n),outcome:n.decision===`accept`?`success`:`failure`}:{}},collapsed:Bl(t)}:{},...i?{buttons:i}:{},...i&&!e.messages?.asks?{hint:`Or reply \`/deny ${t.id} <why>\` to deny with a reason.`}:{},...i&&t.taskUrl?{link:{label:`Open in Coder`,url:t.taskUrl}}:{}}}const Ul=(e,t)=>`approval:${e}:${t}`;function Wl(e,t){let n=t.event,r=n?.chat&&t.source===n.integration?e.integrations[n.integration]:void 0;return r?{integration:r,event:n}:void 0}async function Gl(e,t,n){let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation's app ${n.appId} is gone`);let{adapterContext:i,eventThread:a}=await Promise.resolve().then(()=>Ou),o={id:n.installationId,...n.repo?{repo:n.repo}:{},...n.within?{within:n.within}:{}};return{ctx:i(e,t,r,E(e.config,r.credentials),o),thread:await a(e,r,n)}}async function Kl(e,t,n){return e.messages?e.messages.post(t,n):(await t.thread.post({markdown:n.markdown})).id}async function ql(e,t,n,r,i){if(e.messages?.edit)return n?e.messages.edit(t,n,r):void 0;if(e.messages)return void await e.messages.post(t,i);if(n)return t.thread.adapter.editMessage(t.thread.id,n,{markdown:r.markdown})}const Jl=(e,t)=>({id:t.id,task:e.id,reason:t.reason,actions:t.actions,...e.taskUrl?{taskUrl:e.taskUrl}:{}}),Yl=e=>({decision:e.decision,...e.reason?{reason:e.reason}:{},...e.by?{by:e.by}:{}});async function Xl(e,t){let n=(e.now??Date.now)();return e.store.withAppLock(t,async e=>{let r=await e.get(`delivery`,t);if(!r)return;let i=(r.lease??0)>n;return await e.put(`delivery`,t,i?{...r,again:!0}:{...r,lease:n+6e4},{ttlMs:Ml}),i?void 0:r})}async function Zl(e,t,n){return e.store.withAppLock(t,async e=>{let r=await e.get(`delivery`,t);if(!r)return!1;let{lease:i,again:a,retryAt:o,...s}={...r,...n};return await e.put(`delivery`,t,n.retryAt?{...s,retryAt:o}:s,{ttlMs:Ml}),a===!0})}async function Ql(e,t){let n=await e.store.get(`task`,t.id);return e.local&&n?.handle?.startsWith(`cli:`)?ft(p(t.cwd??e.local.cwd,t.id)):n?.task.context?.approvals??[]}async function $l(e,t,n){let r=Wl(e,t);if(!r)return;let i,a=async()=>i??=await Gl(e,r.integration,r.event);for(let i of n){let n=Ul(t.id,i.id);await e.store.create(`delivery`,n,{at:(e.now??Date.now)(),notice:Jl(t,i)},{ttlMs:Ml});for(let o=0;o<3;o++){let o=await Xl(e,n);if(!o)break;let s=Jl(t,i),c=i.response?Yl(i.response):void 0,l;if(o.shownAt&&(!i.response||o.shown===i.response.answeredAt))l=await Zl(e,n,{});else try{if(o.shownAt)await ql(r.integration,await a(),o.message,Hl(r.integration,s,c),{markdown:Rl(c)}),l=await Zl(e,n,{shown:i.response.answeredAt});else{let t=await Kl(r.integration,await a(),Hl(r.integration,s,c));l=await Zl(e,n,{shownAt:(e.now??Date.now)(),...t?{message:t}:{},...c?{shown:i.response.answeredAt}:{}})}}catch(r){console.error(`coder server: could not show approval ${i.id} of task ${t.id} in its conversation`,r),l=await Zl(e,n,{retryAt:(e.now??Date.now)()+6e4})}if(!l)break;i=(await Ql(e,t)).find(e=>e.id===i.id)??i}}}async function eu(e){let t=(e.now??Date.now)(),n=await e.store.approvalPostsDue(t,12e4),r=new Map;for(let t of n){let n=t.organizationId??e.organizationId,i=r.get(`${n}:${t.value.notice.task}`)??{organizationId:n,ids:new Set};i.ids.add(t.value.notice.id),r.set(`${n}:${t.value.notice.task}`,i)}for(let[t,{organizationId:n,ids:i}]of r){let r=t.slice(n.length+1),{scoped:a}=await Promise.resolve().then(()=>Xi),o=a(e,n),s=await o.store.get(`task`,r);if(!s)continue;let c=(await Ql(o,s.task)).filter(e=>i.has(e.id));await $l(o,s.task,c)}}async function tu(e,t){return(await e.store.list(`delivery`,{prefix:Ul(t,``)})).filter(e=>!e.value.shown).map(e=>e.value.notice.id)}async function nu(e,t,n,r,i){let a=Il(i);if(!a)return!1;let o=await $i(e,`${t.id}:${n.id}`),s=o&&(await o.store.conversationState(Pc(t.id,n.id,r))).status;return s?a.id?!!await o.store.get(`delivery`,Ul(s.task.id,a.id)):(await tu(o,s.task.id)).length===1:!1}async function ru(e,t,n,r,i,a,o){let s=r.id?[r.id]:await tu(e,n.task.id);if(s.length!==1){await o("Name the approval: `/approve <id>` or `/deny <id> <reason>`.");return}let c=i.actor,l=await Cl(e,t,i,a);if(l===null){await o(Sl);return}if(l===!1){await iu(e,n.task,s[0],c);return}let{decideApproval:u}=await Promise.resolve().then(()=>_d),d=await u(e,n.task.id,{approvalId:s[0],decision:r.decision,...r.reason?{reason:r.reason}:{}},c.login||c.id);d.ok||await o((await d.json()).error??`You need write access here to approve or deny this.`)}async function iu(e,t,n,r){let i=Wl(e,t);if(!i)return;let a=Ul(t.id,n),o=r.id||r.login||``,s=await e.store.withAppLock(a,async e=>{let t=await e.get(`delivery`,a);if(!(!t||t.refused?.includes(o)))return await e.put(`delivery`,a,{...t,refused:[...t.refused??[],o]},{ttlMs:Ml}),t});if(!s)return;let c=await Gl(e,i.integration,i.event);if(i.integration.messages?.clickConsumes&&!s.shown){await au(e,i.integration,c,a,s.notice,Nl);return}await Kl(i.integration,c,{markdown:Nl})}async function au(e,t,n,r,i,a){let o=await Kl(t,n,Hl(t,i,void 0,{note:a}));return Zl(e,r,{...o?{message:o}:{},shownAt:(e.now??Date.now)()})}async function ou(e,t,n){let r=Wl(e,t);if(!r?.integration.messages?.laterDismisses)return;let i=await Ql(e,t),a=new Set(i.filter(e=>e.response).map(e=>e.id)),o=(await e.store.list(`delivery`,{prefix:Ul(t.id,``)})).map(e=>e.value).filter(e=>e.shownAt&&e.shownAt<n&&!e.shown&&!a.has(e.notice.id));if(!o.length)return;let s=await Gl(e,r.integration,r.event);for(let{notice:n}of o){let i=Ul(t.id,n.id),a=await Xl(e,i);if(!a)continue;let o;try{o=a.shown?await Zl(e,i,{}):await au(e,r.integration,s,i,n)}catch(r){console.error(`coder server: could not ask approval ${n.id} of task ${t.id} again`,r),o=await Zl(e,i,{})}o&&await $l(e,t,(await Ql(e,t)).filter(e=>e.id===n.id))}}async function su(e,t,n,r,i){let a=Il(i.text?`${i.value} ${i.text}`:i.value);if(!a){console.warn(`coder server: ${n.id} sent a click Coder does not read: ${i.value}`);return}let o=await $i(e,`${n.id}:${r.id}`),s=o&&(await o.store.conversationState(Pc(n.id,r.id,i.thread))).status,c=s?.task.event;if(!o||!s||c?.appId!==n.id||c.installationId!==r.id){console.warn(`coder server: ${n.id} answered an approval of an unknown task`);return}let l=await Gl(o,t,c),u=()=>l.ctx.token(c.installationId,{tools:t.tools.presets.read});await ru(o,t,s,a,{...c,actor:i.actor},u,e=>l.thread.post({markdown:e}))}function cu(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function lu(e,t,n,r){try{await cu(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function uu(e,t,n,r={}){let i=t.handle?await kn(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});if(a){let{reportTaskFailure:r}=await Promise.resolve().then(()=>vu);await r(e,t.task,n),await pu(e,t,!0,i)}return a}async function du(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`))return Pf(e,t,n);let r=t.handle?await kn(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});return i&&await pu(e,t,!0,r),i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?uu(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return uu(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await cu(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?uu(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):uu(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function fu(e,t){return[`running`,`waiting`].includes(t.status)&&await du(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function pu(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await kn(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await lu(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function mu(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await fu(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function hu(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??Cc.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await Promise.all([Of(e,e.local.cwd),kf(e)]):t&&await Promise.all([e.queue.archiveStopped(void 0,r()),eu(e)]);let n=await e.queue.running(),i=0;for(let t of n)await du(H(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?Df(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],c=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,l=t.filter(t=>!c.has(t.task.id)&&!c.has(s(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,u=a===void 0?void 0:a-l;if(u!==void 0&&u<=0)break;let d=await e.queue.claim(r(),u,n,i);if(n=!1,!d)break;let f=d.status,p=H(e,d.organizationId),m=d.loaded&&p.store?{...p,store:jc(p.store,f,d.loaded)}:p;if(await Nf(m,f,d.token)){if(n=d.more,!d.more)break;continue}let h=await kn(m,f.task);if(!h){await uu(m,f,`No runner available: ${f.task.runner}`);continue}let g=f,_={generation:f.generation??0,attempts:f.attempts,tokenHash:f.tokenHash??null,statuses:[`running`,`waiting`]},v;try{let e=h.kind===`vercel-sandbox`?await yf(m,f.task):void 0,t=h.start(f.task,{CODER_SERVER:m.local&&h.kind===`local`?`http://localhost:${m.local.port}`:m.config.publicUrl??``,CODER_TASK_TOKEN:d.token,CODER_INBOX_MODE:h.push?`push`:`poll`},e?.credential,{timeoutMs:m.config.taskTimeoutMs+6e4,waitUntil:m.waitUntil,...e?{hosts:e.hosts,brokered:e.brokered}:{}});if(v=await cu(t,m.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw t.then(e=>lu(m,h,e,f.task.id),()=>{}),e}),await m.queue.patchTask(d.organizationId,f.task.id,{handle:v},r(),_)||await lu(m,h,v,f.task.id),n=d.more,!d.more)break}catch(e){v!==void 0&&await lu(m,h,v,f.task.id);let t=e instanceof Error?e.message:String(e);if(f.attempts<(m.config.taskAttempts??2)){o.push({...d,status:g});continue}await uu(m,g,t)}}for(let t of o)await H(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function gu(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,hu(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function _u(e,t=!1){let n=gu(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}var vu=r({failedDeliveries:()=>xu,recordFailure:()=>yu,reportTaskFailure:()=>bu});async function yu(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await $i(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
-`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??Hr()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:fl})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a||!o||!i||!$c(o,i)))try{await(await a()).problem(n instanceof Ot?n.message:`Coder could not handle this message. If you run this server, check its logs. Otherwise report it at ${e.config.issuesUrl}.`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function bu(e,t,n){let r=t.event;if(!r||t.source!==r.integration)return;let i=await e.store.get(`app`,r.appId).catch(e=>{console.error(`coder server: could not report the failure of task ${t.id}`,e)});if(!i)return;let{eventReplies:a}=await Promise.resolve().then(()=>Ou);await yu(e,i,n,r.installationId,r,()=>a(e,i,r))}async function xu(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}const Su={queued:`Queued`,running:`Running`,waiting:`Needs approval`,completed:`Completed`,failed:`Failed`,cancelled:`Cancelled`};function Cu(e,t,n){return(typeof e.use==`function`?e.use(n,!0):e.use)?.replaceAll(`{handle}`,t)}const wu=(e,t)=>t?.listens.find(t=>t.integration===e.id)?.events??[];function Tu(e,t,n,r){let i=r?.slug??n,a=wu(e,r),o=Cu(e,n,a),s=a.map(t=>e.events[t]?.description??t);return{title:r?.name??n,...r?.description?{text:r.description}:{},sections:[...o?[{title:`Use it here`,text:o}]:[],...s.length?[{title:`Listens to`,text:s.join(`
-`)}]:[]],links:[{id:`agent`,label:`Open in Coder`,url:`${t.dash}/agents/${encodeURIComponent(i)}/platforms`,primary:!0},{id:`coder`,label:`Make your own agent`,url:t.home.replace(/\/$/,``)}]}}function Eu(e,t,n,{open:r,setup:i}){let a=n?.name??t,o=Cu(e,t,n?wu(e,n):[`mention`]);return{title:`${a} is in your workspace`,...n?.description?{text:n.description}:{},sections:[...o?[{title:`Use it`,text:o}]:[],...i?[{title:`One step left`,text:`Add a model so ${a} can start working.`}]:[]],links:[...i?[{id:`model`,label:`Add a model`,url:i,primary:!0}]:[],{id:`agent`,label:`Open in Coder`,url:r,...i?{}:{primary:!0}}]}}async function Du(e,t,n,r){let i;try{i=new URL(n)}catch{return}let a=new URL(t),o=`${a.pathname.replace(/\/$/,``)}/`;if(i.origin!==a.origin||!i.pathname.startsWith(o))return;let[s,c]=i.pathname.slice(o.length).split(`/`);if(!c)return;let l;try{l=decodeURIComponent(c)}catch{return}if(s===`tasks`){let e=await r.task(l);return e&&{title:e.title.length>150?`${e.title.slice(0,149)}…`:e.title,url:n,fields:[{label:`Agent`,text:e.agent},{label:`Status`,text:Su[e.status]??e.status},{label:`From`,text:e.from},{label:`Started`,at:e.startedAt}],footer:`Coder task ${e.id}`}}if(s===`agents`){let t=await r.agent(l);if(!t)return;let i=t.listens.length===1&&t.listens[0].integration===e.id,a=t.listens.map(e=>e.name);return{title:t.name,url:n,...t.description?{text:t.description}:{},...i?{}:{fields:[{label:`Listens on`,text:a.join(`, `)||`Nothing yet`}]},footer:`Coder agent`}}}var Ou=r({adapterContext:()=>Yu,addressedTo:()=>Lu,agentSummary:()=>Xu,chatFor:()=>Qu,dashUrl:()=>Ju,deliver:()=>Bu,eventReplies:()=>Uu,eventThread:()=>Hu,later:()=>zu,threadReplies:()=>Vu});async function ku(e,t,n){let r=`${t.id}:${n}`,i=await $i(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function Au(e,t,n,r,i){let{tenant:a,installation:o}=await ku(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return af(a,e.integrations[t.integration],o,n,i)}function ju(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const Mu=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),Nu=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),Pu=`(?![\\w-]|\\.\\w)`,Fu=e=>e.replace(/[ \t]{2,}/g,` `).trim();function Iu(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${Mu(t)}${Pu}`,`gi`),`$1`),e);return n===e?void 0:Fu(n)}function Lu(e,t){let n=Iu(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${Mu(t)}${Pu}[\\s,:;!.?-]*`,`i`);return r.test(e)?Fu(e.replace(r,``)):void 0}async function Ru(e,t,n,r,i,a){if(n.builtin)return Lu(a,n.agent)!==void 0;let o=await $i(e,`${n.id}:${r.id}`);if(t.events[i]?.on!==`message`||!o)return!1;o.local&&await(o.syncAgent?.(n.agent)??Jn(o.store,o.local.cwd,o.integrations,n.agent)).catch(e=>console.error(`coder server: local agent sync failed`,e));let{record:s,version:c}=await Xn(o.store,n.agent);return!s||!c||!s.settings?.disabled&&St(c.definition.integrations[t.id],i)!==void 0}function zu(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),yu(e,t,r,n.installationId,n,()=>i??Uu(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function Bu(e,t,n,r,i,a,o){if(n.builtin&&!t.app.shareable)return;let s=`${n.id}:${i.installationId}`,c=await $i(e,s);if(!c||!n.builtin&&c.organizationId!==e.organizationId)return;let l=c.boundInstallation?.installation.id===s?c.boundInstallation.installation:await c.store.get(`installation`,s);if(l?.covers&&!l.covers.includes(i.within??``))return;let u=await kl(c,t,n,r,i,e.now??Date.now,a);if(await u.work,u.taskId)return await o?.(),await gu(c,!0,!1,!0),u.taskId}function Vu(e,t,n,r,i){let a=async(t,a=!1)=>{let o=await tn(e,t,r,n,a).catch(async e=>{throw await i?.(e),e});return{id:o.at(-1)?.id,ids:o.map(e=>e.id)}},o=e.adapter.postProblem;return{post:a,react:(t,r)=>$t(e,t,r??(typeof n==`string`?n:n?.id)),problem:t=>o?o.call(e.adapter,e.id,t):a(t),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null)}}async function Hu(e,t,n){if(!n.chat)throw Error(`The event has no conversation`);let r=await Qu(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),r.thread(n.chat.thread.id)}async function Uu(e,t,n){return n.chat?Vu(await Hu(e,t,n),n.actor.id||void 0,n.chat.message?.id||void 0,e.integrations[t.integration]?.replyLimit,r=>Wu(e,t,n.installationId,r)):{post:async()=>{},problem:async()=>{},whisper:async()=>{}}}async function Wu(e,t,n,r){if(!e.integrations[t.integration]?.isUninstalled?.(r))return;let i=`${t.id}:${n}`,a=await $i(e,i);a&&await rf(a.store,i,(e.now??Date.now)())}function Gu(e,t,n,r,i,a,o=a.id,s=!1){let c=r===`message`?s?a.text:t.builtin?Lu(a.text,t.agent):void 0:void 0;if(r===`message`&&t.builtin&&c===void 0)return;let l=Nu(e,c===void 0?r:`mention`);if(!l||a.author.isBot===!0)return;let u=e.event?e.event(l,i,a,t):{};if(!u)return;let d=(u.type??l)===Nu(e,`mention`)?c??Iu(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:l,appId:t.id,installationId:n.id,deliveryId:zr(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${o}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:d,chat:{thread:ju(i.toJSON()),message:ju(a.toJSON())},...n.index===void 0?{}:{conversation:{index:n.index}},...n.within?{within:n.within}:{},...n.repo?{repo:n.repo}:{},...u}}async function Ku(e,t,n,r,i){let a=await qu(e,t,n).catch(e=>{console.error(`coder server: conversation workspace lookup failed`,e)});a&&await Xc(a,{appId:t.id,installationId:n.id,chat:{thread:ju(r.toJSON())}},{author:i.author.userName||i.author.userId,text:i.text,sentAt:i.metadata.dateSent.toISOString()}).catch(e=>console.error(`coder server: could not keep a message for ${t.id}`,e))}async function qu(e,t,n){let{tenant:r,installation:i}=await ku(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.within??``));return i&&a?r:void 0}async function Ju(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${Ag(await kg(e))}`}function Yu(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>Au(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await ku(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await ku(e,n,t);!i||!a||a.self||await fo(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:(r,a)=>Ru(e,t,n,i,r,a).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async t=>{let r=await $i(e,`${n.id}:${i.id}`),a=Pc(n.id,i.id,t);return!!await r?.store.get(`delivery`,a)},knows:async(t,r)=>{let a=await $i(e,`${n.id}:${i.id}`),o=Hc(n.id,i.id,t,r);return!!await a?.store.get(`delivery`,o)},home:async()=>{let r=e.config.publicUrl;if(!r||!a)return;let o=await Xu(e,n,i);return Tu(t,{home:r,dash:a},n.name,o)},preview:async r=>a?Du(t,a,r,{agent:t=>Xu(e,n,i,t),task:t=>Zu(e,n,i,t)}):void 0}:{},privateState:()=>new ir}}async function Xu(e,t,n,r){let i=await qu(e,t,n),{record:a,version:o}=i?await Xn(i.store,r??t.agent):{};if(!a||!o)return;let{definition:s}=o,c=a.description??s.description;return{slug:a.id,name:a.name,...c?{description:c}:{},listens:Object.entries(s.integrations).flatMap(([t,n])=>{let r=kt(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}}async function Zu(e,t,n,r){let i=await qu(e,t,n),a=i&&await i.store.get(`task`,r);if(!a)return;let{task:o}=a,s=o.event?.integration;return{id:o.id,title:o.name?.trim()||o.prompt?.trim()||o.event?.text?.trim()||`${o.event?.type??`task`} on ${o.agent}`,agent:o.agent,status:a.status,from:s&&e.integrations[s]?.name||o.source,startedAt:a.startedAt??a.createdAt}}async function Qu(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=new Map;e={...e,fetch:r.requestFetch?.(e.fetch??fetch,n?.within??n?.id)??e.fetch,syncAgent:t=>(i.has(t)||i.set(t,Jn(e.store,e.local.cwd,e.integrations,t)),i.get(t))};let a=E(e.config,t.credentials),o=await r.adapter(Yu(e,r,t,a,n)),s=rr(e.chatState??new ir,t.id),c=new Ft({userName:t.name,adapters:{[r.id]:o},state:{...s,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:fl,logger:`error`});if(!n)return c;let l=async(i,o,s,c)=>{let l=i===`message`&&await nu(e,t,n,o.id,s.text),u=Gu(r,t,n,i,o,s,c,l);if(!u){s.author.isBot!==!0&&await Ku(e,t,n,o,s);return}let d=Vu(o,s.author,s,r.replyLimit,r=>Wu(e,t,n.id,r));zu(e,t,u,Bu(e,r,t,a,u,d),d)};return c.onNewMention((e,t)=>l(`mention`,e,t)),c.onNewMessage(/[\s\S]*/,(e,t)=>l(`message`,e,t)),c.onMessageUpdated((e,t)=>l(t.isMention?`mention`:`message`,e,t,`edit\n${t.id}\n${t.metadata.editedAt?.toISOString()??``}`)),c.onReaction(async i=>{if(!i.added||i.user.isBot===!0)return;let a=i.thread,o=await qu(e,t,n);if(!o)return;let s={integration:r.id,type:`reactions`,appId:t.id,installationId:n.id,deliveryId:`reaction-${i.messageId}-${i.user.userId}-${i.rawEmoji}`,actor:{id:i.user.userId,login:i.user.userName},text:``,chat:{thread:ju(a.toJSON())},...n.within?{within:n.within}:{}},c=ul(o,s,{emoji:`:${i.emoji.name}:`,by:i.user.userName||i.user.userId,on:i.message?.text??i.messageId},e.now??Date.now);zu(e,t,s,c)}),c.onSlashCommand(`/setup`,async i=>{let o=Nu(r,`command`);if(!o)return;let s=e=>i.channel.postEphemeral(i.user,e,{fallbackToDM:!1}),c={integration:r.id,type:o,appId:t.id,installationId:n.id,deliveryId:zr(`sha256`).update(`${t.id}\n${n.id}\n${i.channel.id}\n${i.triggerId??i.text}`).digest(`base64url`).slice(0,22),actor:{id:i.user.userId,...i.user.userName?{login:i.user.userName}:{}},text:i.text.trim(),...n.within?{within:n.within}:{}},l={post:s,problem:s,whisper:s};zu(e,t,c,Bu(e,r,t,a,c,l),l)}),c}function $u(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));Gn(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function ed(e,t,n,r){let i=n.id,a=t.operatorApp??!1?`*`:t.session?.user.id??`anonymous`,o=bn(r.searchParams.get(`state`)),s=Fg(o?.back),c=t.integrations[i];if(!c)return $(t,`unknown-integration`,{platform:i},s);let l=t.config.publicUrl;if(!l)return $(t,`no-public-url`,{},s);let u=r.searchParams.get(`app`),d=o?.tx?await ui(t,o.tx,`install`,a):void 0;if(!d||u&&u!==d)return $(t,`install-expired`,{platform:i,appId:u??void 0},s);let f=await t.store.get(`app`,u??d);if(!f)return $(t,`unknown-app`,{platform:i},s);let p=E(t.config,f.credentials);return w(c.app.installUrl(f,p,{publicUrl:l,state:r.searchParams.get(`state`)??dn({})}))}async function td(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:E(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:ea(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await ni(u,`install`,t.session?.user.id??`anonymous`,s.id);return w(n.app.installUrl(s,E(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:dn({tx:d,installation:c}),installation:c}))}async function nd(e,t,n,r){let i=n.id,a=t.operatorApp??!1,o=a?`*`:t.session?.user.id??`anonymous`,s=bn(r.searchParams.get(`state`)),c=s?.tx&&t.session?ea(t,t.session,ai(t,s.tx)):void 0,l=c?{...t,...c}:t,u=Fg(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await ui(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return td(e,l,d,f);if(!m||p&&p!==m||!await ci(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m);return _?rd(e,l,d,_,u,s?.installation):$(l,`connected`,{platform:i},u)}async function rd(e,t,n,r,i,a){let o=n.id,s=t.fetch??fetch,c=t.now?.()??Date.now(),l=t.config.publicUrl;if(r.builtin&&!n.app.shareable)return $(t,`unknown-app`,{platform:o},i);let u=i??(r.builtin?void 0:Ng(t,r.agent)),d=E(t.config,r.credentials),f=await n.app.installCallback(e,{app:r,credentials:d,publicUrl:l,fetch:s,tokens:Ra(t,n.id),...a?{installation:a}:{}}).catch(e=>e instanceof Mt?$(t,e.code,{platform:o,appId:r.id,error:e.error},u):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:o,appId:r.id},u)));if(f instanceof Response)return f;let p=`${r.id}:${f.platformInstallId}`,m=t.session;f.user&&m&&t.auth&&await t.auth.link(m.user,o,f.user.id,{organizations:m.organizations.map(e=>e.id),...f.user.token?{token:T(t.config,f.user.token)}:{}});let h=await t.store.get(`installation`,p),g={...h,id:p,app:r.id,integration:o,account:f.account??h?.account??{login:`unknown`},...f.token?{token:T(t.config,f.token)}:{},...f.installer?{installer:f.installer}:{},...f.self?{self:f.self}:{},...f.covers?{covers:f.covers}:{},createdAt:h?.createdAt??c};if(delete g.deletedAt,delete g.uninstalled,n.repos){let e=await n.auth.token(f.token?{...g,token:f.token}:g,d,void 0,{fetch:s});g.repos=await n.repos.list(g,e,s)}try{g=await $u(t.store,p,e=>f.covers===null?{...g,covers:e?.covers??[]}:g,c)}catch(e){return e instanceof Kn?$(t,`installation-bound`,{platform:o,account:g.account.login},u):$(t,`installation-taken`,{platform:o},u)}return g.installer&&n.messages?.direct&&await id(t,n,r,d,f.platformInstallId,g.installer),$(t,`connected`,{platform:o,account:g.account.login},u)}async function id(e,t,n,r,i,a){try{let[{adapterContext:o,agentSummary:s},{record:c,version:l}]=await Promise.all([Promise.resolve().then(()=>Ou),Xn(e.store,n.agent)]),{engine:u,usable:d}=await bp(e,{engine:c?.settings?.engine??l?.definition.engine,model:c?.settings?.model??l?.definition.model},e.session?.user.id),f={id:i},p=o(e,t,n,r,f),m=`${e.config.publicUrl.replace(/\/$/,``)}${Ng(e,n.agent)}`,h=Eu(t,n.name,await s(e,n,f),{open:m,...d?{}:{setup:await Mp(e,u)}});await t.messages.direct(p,a,h)}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const ad=/^[a-z0-9][a-z0-9_-]*$/i;async function od(e,t){let n=It(Lt(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return C(n);try{let{integration:r,token:i}=await _c(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>ad.test(e));return C([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return yd(e)}}async function sd(e,t){if(!t)throw new X(`repo is required`);let{integration:n,token:r}=await _c(e,t);return C(await n.repos?.pullRequests(t,r)??[])}async function cd(e,t){try{return C(xd(await yc(e,`dashboard`,t)),201)}catch(e){return yd(e)}}async function ld(e,t,n,r){return od(t,r.searchParams.get(`repo`)).catch(yd)}async function ud(e,t,n,r){return sd(t,r.searchParams.get(`repo`)).catch(yd)}async function dd(e,t,n,r){return Xd(e).then(e=>cd(t,{...e,flow:n.name})).catch(yd)}async function fd(e,t,n,r){return Xd(e).then(({post:e,...n})=>{if(!n.repo||!n.pr)throw new X(`repo and pr are required`);return cd(t,{...n,flow:`review`,args:{post:e===!0}})}).catch(yd)}function pd(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(C({tasks:n},202))}async function md(e,t,n){let r=t.repos?.pullRequest(n)===void 0?void 0:await $i(e,`${n.appId}:${n.installationId}`);if(!r)return;let i=Lm({flow:`review`,event:n});if(!i)return;let a=await r.queue.list(r.organizationId,{status:`queued`,reviewKey:i}),o=(e.now??Date.now)(),s=JSON.stringify({kind:`status`,message:`Replaced by a newer review of this pull request.`});for(let e of a.filter(e=>e.task.event?.type===n.type&&e.task.event.deliveryId!==n.deliveryId))await r.queue.cancel(r.organizationId,e.task.id,o,{statuses:[`queued`]})&&await oc(r.store,e.task.id,[{level:`sys`,line:s}],e.logSeq??0,o,e.logBytes??0)}async function hd(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`uninstalled`in i){let t=await $i(e,i.uninstalled);return t&&await rf(t.store,i.uninstalled,a),C({ok:!0})}if(`click`in i)return o&&(e.waitUntil??(()=>{}))(su(e,t,n,o,i.click).catch(e=>console.error(`coder server: a click failed for ${n.id}`,e))),new Response(null,{status:200});if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=Ju(e).then(a=>i.work(Yu(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),yu(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}return C({ok:!0})}if(`installation`in i){let t=await $i(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?C({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await fo(e,`installation`,n.id,{account:i.installation.op===`delete`?t.account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0,uninstalled:i.installation.installation.uninstalled})}),await nf(t.store,n.id),C({ok:!0}))}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await $i(e,t),s=!1;try{o&&await $u(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof Kn))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?C({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`push`in i){let{push:r}=i;if(qa(r)){let t=await $i(e,r.installation);t&&await Ya(t.store,r)}let a=Ja(r,n);if(!a)return qa(r)?C({ok:!0}):C({accepted:0},202);try{n.branch||await fo(e.store,`app`,n.id,{branch:a.branch});let r=await so(e,a.repo,a.ref,{...oo(),integration:t.id,appId:n.id},a.branch);return r?C({imported:r.map(e=>e.agent)}):C({error:`No installed app can read ${a.repo}`},400)}catch(e){return C({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)zu(e,n,a,Uu(e,n,a).then(i=>Bu(e,t,n,r,a,i,()=>md(e,t,a))));return C({accepted:i.events.length},202)}async function gd(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...H(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await Qi(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=E(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return hd(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await Qu(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),yu(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}var _d=r({DONE:()=>vd,adminCreate:()=>Id,adminEvent:()=>Pd,approveTask:()=>jd,archiveTask:()=>Nd,askTask:()=>Ad,cancelTask:()=>Md,decideApproval:()=>Od,listTasks:()=>Rd,localRows:()=>Ld,readTask:()=>Cd,redactTask:()=>xd,removeTask:()=>wd,steerTask:()=>Ed,summarizeTask:()=>bd,taskError:()=>yd,taskLogs:()=>Td});const vd=new Set([`completed`,`failed`,`cancelled`]);function yd(e){if(e instanceof zd)return C({error:e.message},400);if(e instanceof X)return C({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function bd(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,cwd:s}=e.task,{engine:c,model:l,effort:u}={...e.task.definition,...e.task.usage},d=e.task.context?.turns?.[0]?.prompt??e.task.prompt;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...s?{cwd:s}:{},...d?{prompt:d}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text}}:{},...c?{usage:{engine:c,...l?{model:l}:{},...u?{effort:u}:{}}}:{}},status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.approvals??e.task.context?.approvals?{approvals:e.approvals??e.task.context?.approvals}:{},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt,...Em(e)}}function xd(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...Em(e),...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},...e.task.context?.approvals?{approvals:e.task.context.approvals}:{},turns:at(bc(e),e.approvals??e.task.context?.approvals),...e.task.credential?{credential:fp(e.task.credential).name}:{}}}async function Sd(e,t){let n=await e.store.get(`task`,t);if(n&&!(e.local&&n.handle?.startsWith(`cli:`)&&n.task.flow==="default"))return{status:n};let r=n?.task.cwd??e.local?.cwd;return r?{cwd:r,answer:n?.answer}:C({error:`No task "${t}"`},404)}async function Cd(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?mn(r,500,2e3):void 0,c=cc(t.store,i,o,s??500);c?.catch(()=>{});let l=await Sd(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;if(!u){let e=Uf(d,i,!0);return e?C({...e,...l.answer?{answer:l.answer}:{},logs:Hf(d,i,-1,s??500)}):C({error:`No task "${i}"`},404)}return C({...xd(await fu(t,u)),logs:await c})}async function wd(e,t,n,r){let i=n.id,a=await Sd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o){let n=await Gf(e,s,i,void 0,t);return n.ok&&t.queue instanceof Gm&&t.queue.tombstone(i),n}if(t.local&&o.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:o.attempts,tokenHash:o.tokenHash,generation:o.generation??0});let n=await t.store.get(`task`,i);if(n&&Q.includes(n.status)){await Pf(t,n,e);let r=await t.store.get(`task`,i);if(r&&Q.includes(r.status))return C({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(o.status)&&o.handle)try{let e=await kn(t,o.task);if(!e)return C({error:`Task runner is unavailable. Try again.`},409);await e.stop(o.handle)}catch{return C({error:`Task is still stopping. Try again.`},409)}return await zm(t,o)?(o.handle?.startsWith(`cli:`)||await Ln(t,o.task,o.handle).catch(e=>console.error(`coder server: work folder of ${i} not removed`,e)),t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),_u(t,!0),C({ok:!0})):C({error:`Task changed while deleting. Try again.`},409)}async function Td(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?mn(r,500,2e3):void 0,c=cc(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await Sd(t,i);if(l instanceof Response)return l;let{status:u,cwd:d}=l;return u?(await fu(t,u),C(await c)):Uf(d,i,!1)?C(Hf(d,i,o,s)):C({error:`No task "${i}"`},404)}async function Ed(e,t,n,r){let i=n.id,a=await Sd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Gf(e,s,i,`steer`,t);if(o.task.flow!=="default")return C({error:`steer is available only for default-flow tasks`},409);let c=await e.json().catch(()=>void 0);if(vd.has(o.status)){let{text:e,outputSchema:n,model:r,effort:i,permissions:a}=c??{};try{let s=await Sc(t,o,String(e??``),n,{model:r,effort:i,permissions:a});return _u(t,!0),C(xd(s))}catch(e){return yd(e)}}let l=await Hm(t,o,`steer`,c);return l?C(l):C({error:`Task "${i}" is no longer active`},409)}function Dd(e){return async(t,n,r)=>{let i=r.id,a=await Sd(n,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(e===`approve`)return Od(n,i,await t.json().catch(()=>void 0)??{},n.session?.user.name);if(!o)return Gf(t,s,i,e,n);if(o.task.flow!=="default")return C({error:`${e} is available only for default-flow tasks`},409);if(!Q.includes(o.status))return C({error:`Task "${i}" is not active`},409);let c=await Hm(n,o,e,await t.json().catch(()=>void 0));return c?C(c):C({error:`Task "${i}" is no longer active`},409)}}async function Od(e,t,n,r){let i=await Sd(e,t);if(i instanceof Response)return i;let{status:a,cwd:o}=i;if(a&&a.task.flow!=="default")return C({error:`approve is available only for default-flow tasks`},409);let s=String(n.approvalId??n.id??(a?a.approval?.id:tt(p(o,t))[0]?.id)??``),c=n.decision===`deny`||n.decision===`decline`?`decline`:`accept`,l={...n,approvalId:s,decision:c,...r?{by:r}:{}},u=a?await kd(e,a,l):await Kf(o,t,l,e);if(!u.ok)return u;let d=await e.store.get(`task`,t),f=a?d?.task.context?.approvals??[]:ft(p(o,t));return d&&(e.waitUntil??(()=>{}))($l(e,d.task,f).catch(e=>console.error(`coder server: could not show the decision on approval ${s}`,e))),u}async function kd(e,t,n){let r=t.task.id,i=t.task.context?.approvals??[],a=t.approval,o=String(n.approvalId),s=i.find(e=>e.id===o)??(a?.id===o?a:void 0);if(!s)return C({error:`Task "${r}" has no approval "${o}"`},409);if(s.response?.decision===`accept`)return C({error:`Approval "${o}" is already approved`},409);if(s.response?.decision===`closed`)return C({error:ut(o)},409);let c=n.decision,l={...s,response:{decision:c,...typeof n.reason==`string`&&n.reason?{reason:n.reason}:{},answeredAt:new Date((e.now??Date.now)()).toISOString(),...typeof n.by==`string`&&n.by?{by:n.by}:{}}};if(vd.has(t.status))try{let n=await Sc(e,{...t,task:Bm(t.task,[l])},vt(l));return _u(e,!0),C(xd(n))}catch(e){return yd(e)}if(!Q.includes(t.status))return C({error:`Task "${r}" is not active`},409);let u;try{u=await Hm(e,t,`approve`,n,void 0,[l])}catch(e){if(e instanceof _t)return C({error:e.message},409);throw e}return u?C(u):C({error:`Task "${r}" is no longer active`},409)}const Ad=Dd(`ask`),jd=Dd(`approve`);async function Md(e,t,n,r){let i=n.id,a=await Sd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Gf(e,s,i,`cancel`,t);let c=(t.now??Date.now)(),l=await t.queue.cancel(t.organizationId,i,c,{attempts:o.attempts,tokenHash:o.tokenHash??null,generation:o.generation??0}),u=(o.task.context?.approvals??[]).filter(e=>!e.response);if(l&&u.length){let e=mt(new Date(c).toISOString());await t.queue.patchTask(t.organizationId,i,{approvals:u.map(t=>({...t,response:e}))},c);let n=await t.store.get(`task`,i);n&&(t.waitUntil??(()=>{}))($l(t,n.task,n.task.context?.approvals??[]).catch(e=>console.error(`coder server: could not show the stop on ${i}`,e)))}if(l&&o.status!==`queued`){await qm(t,i);let e=await t.store.get(`task`,i);e&&!vd.has(e.status)&&mu(t,o)}return l?C({ok:!0}):C({error:`No running or queued task "${i}"`},404)}async function Nd(e,t,n,r){let i=n.id,a=await Sd(t,i);if(a instanceof Response)return a;let{status:o,cwd:s}=a;if(!o)return Gf(e,s,i,`archive`,t);let c=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:c,autoArchived:void 0},c),C({ok:!0})}async function Pd(e,t){if(!e.agent||!e.event?.integration)return C({error:`agent and event are required`},400);let n=t.integrations[e.event.integration];if(!n)return C({error:`Unknown integration "${e.event.integration}"`},400);let r=e.event.actor?.id;if(t.auth&&r){let e=await t.auth.linkedUser(n.id,r);if(e&&e.id!==t.session?.user.id)return C({error:`The event's actor is linked to another member`},403)}let i=(await t.store.list(`app`)).map(e=>e.value).find(t=>t.agent===e.agent&&t.integration===n.id);if(!i)return C({error:`No ${n.id} app for agent "${e.agent}" on this server.`},404);let a=(await t.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===i.id&&!e.deletedAt),o=a.find(t=>t.id===`${i.id}:${e.event.installationId}`)??a[0];if(!o)return C({error:`The ${n.id} app for "${e.agent}" is not installed anywhere yet`},404);let s=t.now??Date.now,c={...e.event,appId:i.id,installationId:o.id.slice(i.id.length+1),deliveryId:`admin-${s()}-${Hr()}`},l=await kl(t,n,i,E(t.config,i.credentials),c,s,await Uu(t,i,c));return pd(t,l.work??Promise.resolve(),l.taskId?[l.taskId]:[])}const Fd=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function Id(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return C({error:`A JSON body is required`},400);try{if(fc(t,i),i.event)return Pd(i,t);let e=(i.source===`cli`?void 0:await jf(t,i))??await yc(t,i.source===`cli`?`cli`:`dashboard`,i);return C(xd(e),201)}catch(e){return yd(e)}}function Ld(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)d(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function Rd(e,t,n,r){let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!Fd.has(i))return C({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return C({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return C({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:Q}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(bd):e.map(xd);if(t.local){let e=o===void 0?Df(t.local.cwd,l.archived):[...Df(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...Df(t.local.cwd,!1)],n=Ld(t.local.cwd,e,await t.queue.list(t.organizationId)).filter(e=>km(e,{...l,...u})).sort(o===void 0?Nm:Mm),i=mn(r,hn(r)?void 0:20);if(!hn(r))return C(f(n.slice(0,i)));let a=yn(r),s=n.filter(e=>Pm(e,a)),c=xn(s.slice(0,i+1),i,o===void 0?Am:jm);return C({...c,items:f(c.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>ke(e.status,e.approvals??e.task.context?.approvals)).length}}:{}})}if(!hn(r)){let e=mn(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return C(f(n))}let p=mn(r),m=yn(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,[g,_]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0]),v=xn(g,p,o===void 0?Am:jm);return C({...v,items:f(v.items),..._?{counts:_}:{}})}var zd=class extends Error{};const Bd=async e=>await e.get(`config`,`workspace`)??{};function Vd(){let e=o();if(!V.existsSync(e))return{};try{return JSON.parse(V.readFileSync(e,`utf8`))}catch(t){throw new zd(`Invalid JSON in ${e}: ${t.message}`)}}function Hd(e){let{mcp:t,...n}=e;return n}async function Ud(e){return e.local?Hd(Vd()):Bd(e.store)}const Wd=(e,t)=>e.local?Hd(m(e.local.cwd)):ze(t);async function Gd(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function Kd(e){let t=qe(e);if(t.length)throw new zd(t.join(`; `))}async function qd(e,t){if(Kd(t),t.mcp)throw new zd(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:n}=Vd();return Ae({...t,...n?{mcp:n}:{}}),Ud(e)}return await e.store.put(`config`,`workspace`,t),Hd(t)}async function Jd(e,t){return Gd(e,async e=>{let n=structuredClone(await Ud(e));return t(n),qd(e,n)})}function Yd(e,t){return Gd(e,async e=>qd(e,Qe(await Ud(e),t)))}async function Xd(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new zd(`A JSON body is required`);return t}async function Zd(e,t){return Jd(e,t).then(C).catch(yd)}async function Qd(e,t,n,r){return Ud(t).then(e=>C({config:e,effective:Wd(t,e)})).catch(yd)}async function $d(e,t,n,r){return e.json().catch(()=>{throw new zd(`A JSON body is required`)}).then(e=>Yd(t,e)).then(C).catch(yd)}function ef(e,t){return t.token?{...t,token:E(e.config,t.token)}:t}const tf=3e5;async function nf(e,t){await e.put(`snapshot`,tr(t),{drop:Hr()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:Hn(t)}))await e.delete(`snapshot`,n.id)}async function rf(e,t,n){await e.withAppLock(`installation:${t}`,async e=>{let r=await e.get(`installation`,t);!r||r.deletedAt||(await fo(e,`installation`,t,{deletedAt:n,uninstalled:!0}),await nf(e,t))})}async function af(e,t,n,r,i,a=0){let o=n.token,s=ef(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=Hn(n.id,t),o=await e.store.heldTokens([n.id],[n.app]),s=o.held.get(i),c=(e.now??Date.now)(),l=s?s.expiresAt-s.mintedAt:0,u=a+(a+tf<=l?tf:0);if(s&&s.expiresAt-c>Math.max(u,tf))try{return E(e.config,s.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let d=await r();return await e.store.holdToken({key:i,value:{token:T(e.config,d.token),expiresAt:d.expiresAt,mintedAt:c},ttlMs:Math.max(d.expiresAt-c-tf,0),drops:[n.id,n.app].map(e=>({key:tr(e),drop:o.drops.get(tr(e))}))}),d.token},async save(t){let r=T(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&E(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&E(e.config,i)}})}async function of(e,t,n,r){if(!t.auth.user||!e.auth)return;let i=await e.auth.linkedUser(t.id,n.actor.id);if(!i?.token||!i.organizations?.includes(e.organizationId))return;let a=qp(e.config,i.token),o=a.app&&a.app!==n.appId,s=o?await em(e,t.id,a.app):void 0;if(o&&!s)return;let c=await t.auth.user.access(a.token,s?E(e.config,s.credentials):r,{fetch:e.fetch??fetch,now:(e.now??Date.now)()});return c.refreshed&&await e.auth.link(i,t.id,n.actor.id,{token:T(e.config,a.app?{app:a.app,token:c.refreshed}:c.refreshed)}),c.accessToken}async function sf(e,t,n,r,i,a,o){return(o===`requester`?await of(e,t,r,i).catch(()=>void 0):void 0)??af(e,t,n,i,a,e.config.taskTimeoutMs)}function cf(e,t,n,r,i){let a=[],o,s={installation:n.id,record:n,fetch:e.fetch??fetch,token:()=>o??=af(e,t,n,i,{tools:t.tools.presets.read}).then(e=>(a.push(e),e))};return Object.assign(async e=>e===r.integration?s:void 0,{minted:a})}function lf(e,t){let n=(e.settings??={}).agentInstallations??=new Map,r=`${e.organizationId}:${t.id}`,i=n.get(r);return i||(i=e.store.list(`installation`,{agent:t.agent,active:!0}).then(e=>e.map(e=>e.value)),n.set(r,i),setTimeout(()=>n.delete(r),6e4).unref()),i}const uf=e=>t=>{console.error(`coder server: could not mint a token for ${e}`,t)};async function df(e,t){let n=t.event,r=e.integrations[n.integration];if(!r)throw Error(`Unknown integration "${n.integration}"`);let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i)throw Error(`Unknown app "${n.appId}"`);if(!a||a.deletedAt)throw Error(`Installation is gone`);let o=t.flow===`review`&&t.args?.post===!0,s=await sf(e,r,a,n,E(e.config,i.credentials),{tools:t.tools[n.integration]??(o?r.tools.presets.read:[])},ff(t)),c={[n.integration]:s},l=(await lf(e,t)).filter(e=>e.id!==a.id&&e.integration in t.tools),u=new Map((await e.store.getApps([...new Set(l.map(e=>e.app))])).map(e=>[e.id,e.value]));return await Promise.all(l.map(async n=>{let r=e.integrations[n.integration],i=u.get(n.app);if(!r||!i)return;let a=await af(e,r,n,E(e.config,i.credentials),{tools:t.tools[n.integration]??[]},e.config.taskTimeoutMs).catch(uf(n.id));a&&(c[Yt(n.integration,n.account.login)]=a)})),c}function ff(e){let t=e.event;return t.chat&&!t.chat.thread.isDM?void 0:St(e.definition.integrations[t.integration],t.type)?.actAs}async function pf(e,t){let n=t.task,[r,i,a]=await Promise.all([n.event?df(e,t.task):{},e.local?{}:Bd(e.store),mf(e,n)]),o,s=n.event;if(n.flow==="default"&&s?.chat&&n.source===s.integration){let t=e.integrations[s.integration],i=t.tools.presets.read,a=n.tools[s.integration]??[];if(!ff(n)&&a.length===i.length&&i.every(e=>a.includes(e)))o=r[s.integration];else{let[n,r]=await Promise.all([e.store.get(`app`,s.appId),e.store.get(`installation`,`${s.appId}:${s.installationId}`)]);if(!n||!r||r.deletedAt)throw Error(`Conversation installation is gone`);o=await af(e,t,r,E(e.config,n.credentials),{tools:i},e.config.taskTimeoutMs)}}let c=await bm(e,t,r),l=n.engineChain?.length?await hf(e,n):void 0,u={...c.env},d=[...c.warnings];for(let e of Object.keys(u))a.env[e]===void 0&&!l?.some(t=>t.credential.env[e]!==void 0)||(delete u[e],d.push(`${e} is temporarily unavailable; skipped for this task.`));let f=await Cm(e,n),p={...n,tools:c.tools},m=await Sm(e,n.id,[...c.secrets,...f,...Object.values(c.tokens),...Object.values(r),...o?[o]:[],...bf(a.env),...l?.flatMap(e=>bf(e.credential.env))??[]]);await ac(e,n.id,d);let h={task:p,tokens:{...c.tokens,...r},nativeTokens:c.nativeTokens,...o?{postToken:o}:{},credential:a,...l?{engineCredentials:l}:{},config:i,connections:c.mcp,connectionEnv:u,connectionSecrets:m};if(n.runner!==`vercel-sandbox`)return h;let g=e=>{let t=new Set(_f(i,n,e).map(e=>e.name));return{...e,env:Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,t.has(e)?jn:n]))}};return{...h,credential:g(a),...l?{engineCredentials:l.map(e=>({...e,credential:g(e.credential)}))}:{}}}async function mf(e,t){let n=t.usage?.engine??t.definition.engine??`claude`,r=t.credential?await e.store.get(`credential`,t.credential):(await yp(e,n,t.requester,{model:t.usage?.model}))?.value;if(r)return{engine:n,...Cn(e.config,r)};if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:n,env:{}}}async function hf(e,t){let n=t.usage?.engine??t.definition.engine,r=t.engineChain??[],i=r.slice(Math.max(0,r.indexOf(n??``))+1),a=await Promise.all(i.map(async n=>{let r=t.engineCredentials?.[n],i=r?await e.store.get(`credential`,r):void 0;return i&&(!i.owner||i.owner===t.requester)?{id:r,credential:{engine:n,...Cn(e.config,i)}}:void 0}));return[...t.credential?[{id:t.credential,credential:await mf(e,t)}]:[],...a.flatMap(e=>e?[e]:[])]}const gf=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];function _f(e,t,n){if(n.engine!==`custom`)return Mn;let r=e.models??{},i=t.usage?.model?r[t.usage.model]:void 0,a=(i&&`baseUrl`in i?[i]:Object.values(r)).flatMap(e=>`baseUrl`in e&&e.envKey&&URL.canParse(e.baseUrl)?[{name:e.envKey,host:new URL(e.baseUrl).hostname,header:`authorization`,prefix:`Bearer `}]:[]);return[...Mn,...a]}async function vf(e,t,n){if(t.permissions===`auto`)return;let r=e.local?{}:await Bd(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=Bn(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))`baseUrl`in e&&a.push(...gf(e.baseUrl));for(let n of t.connections??[]){let r=await Xp(e,n,t.requester);r?.provider===`mcp`?a.push(...gf(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...gf(e.url));for(let e of t.mcp??[])a.push(...gf(r.mcp?.[e]?.url));for(let e of r.approvals?.allowedNetworkHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...Wr.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}async function yf(e,t){let n=await mf(e,t);if(!n)return;let r=[n,...(await hf(e,t)).map(e=>e.credential)],i=await Promise.all(r.map(n=>vf(e,t,n))),a=await Bd(e.store);return{credential:Object.assign({},...r.map(e=>e.env).reverse()),hosts:i.some(e=>e===void 0)?void 0:[...new Set(i.flatMap(e=>e??[]))],brokered:r.flatMap(e=>_f(a,t,e))}}function bf(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!ye(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function xf(e,t){return t.event?(await lf(e,t)).flatMap(t=>t.token?[E(e.config,t.token)]:[]):[]}async function Sf(e,t){let[n,r,i]=await Promise.all([wm(e,t.task),mf(e,t.task).catch(e=>{if(e instanceof Error&&e.message===`no-credential`)return{engine:`codex`,env:{}};throw e}),xf(e,t.task)]),a=e.store instanceof $n&&t.task.event&&!(await e.store.list(`snapshot`,{prefix:`connection-secrets:${t.task.id}:`,limit:1})).length?Object.values(await df(e,t.task)):[];return a.length&&await Sm(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...bf(r.env)].filter(e=>e.length>=8)}var Cf=r({LOCAL_LOGINS:()=>ep,answerLocalApproval:()=>Kf,engineSignIn:()=>rp,engineSignOut:()=>ip,engineStatus:()=>op,inspectLocalTask:()=>Pf,isLoginEngine:()=>np,localLog:()=>Hf,localTask:()=>Uf,localTaskAction:()=>Gf,localTasks:()=>Df,localUsage:()=>qf,machineSignedIn:()=>sp,pushLocalInbox:()=>Vf,recoverLocalTasks:()=>If,resumeLocalTask:()=>Wf,runLocalTask:()=>Bf,startLocalTask:()=>jf,startQueuedLocalTask:()=>Nf,stopLocalTasks:()=>Lf,sweepLocalQueue:()=>Of,syncLocalApprovals:()=>kf,syncLocalUsage:()=>Xf});const wf=e=>!e.name?.startsWith(rn),Tf=e=>e?Date.parse(e):void 0;function Ef(e,t,n=!1){let r=Tf(t.createdAt)??0,i=ce(B.join(p(e,t.id),`answers.json`)),a=ft(p(e,t.id)),o=a.find(e=>!e.response),s=n?gt(e,t.id,t):null,c=n?v(e,t.id).filter(e=>!Ve.includes(t.status)||(Tf(e.at)??0)<(Tf(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:Tf(e.at)}}):[];n&&(Ve.includes(t.status)||!c.length||(c.at(-1)?.finishedAt??0)<(Tf(t.resumedAt)??r))&&c.push({prompt:t.currentPrompt??t.prompt??``,...s?{result:{ok:s.status===0,output:s.finalMessage??s.error?.message??``}}:{},...t.error?{error:t.error}:{},...Ve.includes(t.status)?{}:{finishedAt:Tf(t.completedAt)}});let l=t.flowRunId?Wt(t.flowRunId)?.name:void 0,u={task:{id:t.id,source:t.source??`cli`,agent:t.agentId??bt()??``,flow:l??`default`,...t.name?{name:t.name}:l?{name:l===`review`?`Review`:l}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.permissions?{permissions:t.permissions}:{},...t.prompt?{prompt:t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:o&&t.status===`running`?`waiting`:Je(e,t)?`running`:t.status,attempts:1,...o?{approval:o}:{},...a.length?{approvals:a}:{},...i?{answer:i}:{},...s?{result:{ok:s.status===0,exitCode:null,output:s.finalMessage??s.error?.message??``},...s.tokens?{tokens:s.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:Tf(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:Tf(t.resumedAt)??r,...t.completedAt&&!Ve.includes(t.status)?{finishedAt:Tf(t.completedAt)}:{},updatedAt:Tf(t.updatedAt)??r,local:!0,...n?{turns:at(c,a)}:{}};return{...u,...Em(u)}}function Df(e,t){let n=Ht(e);return(t?te(e,{migrate:!1}):n).filter(wf).map(n=>{let r=Ef(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function Of(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...we]})).filter(e=>Ee(e.finishedAt??e.updatedAt,n)&&d(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function kf(e){let t=await e.store.list(`delivery`,{prefix:`approval:`});for(let n of new Set(t.map(e=>e.value.notice.task))){let t=await e.store.get(`task`,n);if(!t)continue;let r=t.task.cwd??e.local.cwd,i=ft(p(r,n));await Af(e,r,n,i),await $l(e,t.task,i)}}async function Af(e,t,n,r){let i=(e.now??Date.now)();for(let a of r){if(!a.response||a.response.deliveredAt||a.response.decision===`closed`||i-Date.parse(a.response.answeredAt??``)<6e4)continue;let r=s(t,n);if(!r)return;await Ut(t,r,a.id,a.response.decision,{...a.response.reason?{reason:a.response.reason}:{},resume:r=>Wf(e,t,n,r)}).catch(e=>console.error(`coder server: could not deliver the answer to approval ${a.id}`,e))}}async function jf(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=fc(e,t)??e.local.cwd;await Jn(e.store,r,e.integrations);let i=bt(),a=t.agent??i;if(!a)throw new X(`Name an agent: this server has no default agent.`);let{record:o,version:s}=await Xn(e.store,a);dc(e,a,o);let c=await In(e,{requester:e.session?.user.id,runner:t.runner,agent:s?.definition.runner}).catch(e=>{throw new X(e.message)});if(!(c.runner!==`local`||c.runnerId)){if(gc(t),!n)return Mf(e,{id:se(),source:`dashboard`,agent:a,flow:`default`,runner:`local`,cwd:r,...t.name?{name:t.name}:{},prompt:t.prompt,definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{},connections:await Oa(e,void 0,We(o?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let c=n?await e.store.get(`task`,n):void 0,l=c?.task.connections??await Oa(e,void 0,We(o?.settings?.connections,t.connections)),u=await ym(e,c?.task??{connections:l,tools:{},definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}}),d=f(u.mcp,u.env),p=Xt({tools:u.tools},u.tokens,void 0,Object.keys(u.nativeTokens)),h=a===i?void 0:await en(r,a,t.mcp?.join(`,`),d.mcp),g=h??ct(t.mcp?.join(`,`),m(r).mcp,{},d.mcp),_=[],v=await it({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,name:t.name,appendSystem:t.appendSystem,addDirs:t.addDirs,engine:t.engine??h?.engine,model:t.model??(t.engine?void 0:h?.model),effort:t.effort??(t.engine?void 0:h?.effort),permissions:t.permissions??h?.permissions,...h?{agentPrompt:{developer:h.developer,access:wt({definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{}})}}:{},mcp:[...Object.values(p.mcp),...g.mcp],mcpBindings:g.mcpBindings,mcpWarnings:[...g.warnings??[],...u.warnings],connectionEnv:{...d.env,...p.env},connections:l,nativeMcp:g.nativeMcp,...h?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>_.push(e)},{waitForStartup:!1});return Ef(r,_.length?_e(r,v.taskId,{fallbacks:_}):v.task)}catch(e){throw e instanceof rt?new X(e.message,409):e}}}async function Mf(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await gu(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:Uf(n.cwd,t.id)??i}async function Nf(e,t,n){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;try{let i=t.task.id,a,o=r.resume?v(r.cwd,t.task.id).length:0,c=t.task.flow==="default"?s(r.cwd,t.task.id):void 0,l=n?Rf(e,t.task.id,n):void 0;if(c&&!r.resume)i=c.id;else if(r.resume){let n=s(r.cwd,t.task.id);if(!n)throw Error(`Local task is missing`);await zt(r.cwd,n,t.task.prompt??``,{onWorker:e=>{a=e},outputSchema:t.task.context?.outputSchema,...r.overrides,resolveConnections:n=>zf(e,t.task,n,l)})}else r.input?await jf(e,{...r.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??r.input.outputSchema},t.task.id):i=(await Bf(e,t.task,t.task.id,!0,l)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...r,startedId:i});let u={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${i}`},(e.now??Date.now)(),u)){let e=s(r.cwd,i);return e&&await Bt(r.cwd,e),!0}if(t.task.flow==="default"){let n={task:t.task,cwd:r.cwd,fence:u,turns:o};await e.store.put(`snapshot`,`completion:${i}`,n),Ff(e,i,n,a);let s=qm(e,t.task.id);e.waitUntil&&e.waitUntil(s)}}catch(n){if(await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})){let{reportTaskFailure:r}=await Promise.resolve().then(()=>vu);await r(e,t.task,n)}}return!0}async function Pf(e,t,n){if(t.status!==`running`&&t.status!==`waiting`||t.task.flow==="default"&&e.store.localFlows?.has(t.task.id)&&t.cancelRequestedAt===void 0&&(t.startedAt===void 0||n-t.startedAt<e.config.taskTimeoutMs))return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=Wt(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await Kt(t.task.id),r=Wt(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=Uf(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=s(r.cwd,r.startedId??t.task.id);e&&await Bt(r.cwd,e),a=Uf(r.cwd,t.task.id)}else return!1;let o=a.status;return o!==`completed`&&o!==`failed`&&o!==`cancelled`?!1:e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i)}function Ff(e,t,n,r){let i=e.store.completionWatches??=new Map;if(i.has(t))return;let a={stopped:!1,work:Promise.resolve()};i.set(t,a),a.work=(async()=>{let i=`completion:${t}:${n.fence?.generation??0}`,o=await e.store.get(`delivery`,i);if(o&&!o.owner)return;if(o?.posting!==void 0){console.error(`coder server: local completion ${t} has an interrupted post for turn ${o.posting+1}; retained for reconciliation`);return}if(o?.pid)try{process.kill(o.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let c=Hr(),l={owner:c,pid:process.pid,pending:!0,turns:o?.turns??n.turns??0};if(o?.owner){if(!await e.store.updateDelivery(i,o.owner,l))return}else if(!await e.store.create(`delivery`,i,l))return;let u=async(t=!1)=>{if(!n.fence)return!0;let r=await e.store.get(`task`,n.task.id);return r&&(r.generation??0)===n.fence.generation&&r.attempts===n.fence.attempts&&r.tokenHash===n.fence.tokenHash&&r.status!==`queued`&&(!t||[`running`,`waiting`].includes(r.status))},d,f=async t=>{let r=n.task.event;if(!r||n.task.source!==r.integration)throw Error(`The task has no conversation`);if(!await u(t))throw Error(`The conversation task is no longer running`);if(!d){let t=await e.store.get(`app`,r.appId);if(!t)throw Error(`Local completion has no app`);let{eventReplies:n}=await Promise.resolve().then(()=>Ou);d=await n(e,t,r)}return d},m=async(t,r=!1,i=!1)=>{let a=await f(i),o=await(r?a.problem(t):a.post(t,i));!i&&l.posting!==void 0&&(l={...l,turns:l.posting+1,posting:void 0}),o&&await qc(e,n.task.event,o.ids??(o.id?[o.id]:[]),Date.now())},h=b(),g=Ke(n.cwd,t,r),_=100,y=new Map;try{for(let r=0;r<5;r++)try{let r=async(e,r,i)=>{if(n.task.source!==n.task.event?.integration)return;Ze(`completion.reply`,{id:t});let a=an(n.task,e,r,i);a.skipped&&xe(n.cwd,t,{kind:`status`,message:Le}),a.text&&!a.duplicate&&await m(a.text,a.problem)};for(;;){if(a.stopped||!await u())return;let o=s(n.cwd,t);if(!o)return;let d=v(n.cwd,t);for(let a of d.slice(l.turns)){a.status!==0&&e.local&&(e.local.engineChecks=void 0);let o={finalMessage:a.finalMessage,error:a.error},s=an(n.task,o,!1,a),u=n.task.source===n.task.event?.integration&&s.text&&!s.duplicate;u&&await f(!1);let d=l.turns+1;if(l={...l,posting:u?l.turns:void 0},!await e.store.updateDelivery(i,c,l))return;let p=(e.now??Date.now)();if(await r(o,!1,a),u&&await ou(e,{...n.task,id:t},p),l={...l,turns:d,posting:void 0},!await e.store.updateDelivery(i,c,l))return}let m=ft(p(n.cwd,t)).filter(e=>y.get(e.id)!==`${e.response?.answeredAt??``}:${e.response?.deliveredAt??``}`);if(m.length){await $l(e,{...n.task,id:t},m);for(let e of ft(p(n.cwd,t)))y.set(e.id,`${e.response?.answeredAt??``}:${e.response?.deliveredAt??``}`)}let b=ae(n.cwd,o,h);if(!Ve.includes(b.status)&&!(b.pid&&Me(b.pid,b,h))&&!cn(p(n.cwd,t))&&(b.status!==`completed`||d.length>(n.turns??0))){let t=await e.store.get(`task`,n.task.id);n.fence&&t&&(t.generation??0)===n.fence.generation&&t.attempts===n.fence.attempts&&t.tokenHash===n.fence.tokenHash&&await Pf(e,t,(e.now??Date.now)())&&_u(e,!0);let a=b.status===`cancelled`;if((a||b.error)&&d.at(-1)?.prompt!==(b.currentPrompt??b.prompt??null)){if(!await e.store.updateDelivery(i,c,l))return;await r({error:{message:b.error??`Task cancelled`}},a)}break}await g.wait(_),_=Math.min(1e3,_*2)}await e.store.updateDelivery(i,c,{posted:!0,turns:l.turns,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(r===4)throw n;console.error(`coder server: local completion ${t} attempt ${r+1} failed, retrying`,n);let i=e.now??Date.now,o=i()+5e3*2**r;for(;!a.stopped&&i()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-i())))}}finally{g.close(),await e.store.updateDelivery(i,c,{...l,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{i.delete(t)})}async function If(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))s(n.cwd,t.slice(11))&&Ff(e,t.slice(11),n)}async function Lf(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}function Rf(e,t,n){return{url:`http://127.0.0.1:${e.local.port}/tasks/${encodeURIComponent(t)}`,token:n}}async function zf(e,t,n,r){let i=t.event?await df(e,t):{},a=await ym(e,{...t,connections:n},i);await Sm(e,t.id,[...a.secrets,...Object.values(a.tokens)]);let o=f(a.mcp,a.env),s=Xt({...t,tools:a.tools},a.tokens,r,Object.keys(a.nativeTokens));return{mcp:o.mcp,env:{...o.env,...s.env},warnings:a.warnings}}async function Bf(e,t,n,r=!1,i){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await gu(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=fc(e,t)??e.local.cwd;return Mf(e,{...t,id:n??se(),cwd:r},{cwd:r})}let a=t.event?await df(e,t):{},o=await ym(e,t,a);await ac(e,n??t.id,o.warnings),await Sm(e,n??t.id,[...o.secrets,...Object.values(o.tokens)]),t={...t,tools:o.tools};let c=o.tokens,l=t.event&&a[t.event.integration],u=fc(e,t)??e.local.cwd,d=await e.store.get(`task`,n??t.id),p={task:t,cwd:u,...d?{fence:{generation:d.generation??0,attempts:d.attempts,tokenHash:d.tokenHash,statuses:[`running`,`waiting`]}}:{}},m=t.flow!=="default"&&n?Wt(n):void 0;if(m){let r=Pe(u).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?Ef(u,r):{task:t,status:m.status===`running`?`running`:m.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=se();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&Fm(i.task)!==Fm(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,p)}let h=t.flow==="default"&&n?s(u,n):void 0;if(h){let n;return h.status===`queued`&&!h.pid&&(n=ot(u,h.id,{...f(o.mcp,o.env).env,...Xt(t,c,i,Object.keys(o.nativeTokens)).env})),Ff(e,h.id,p,n),Ef(u,h)}let g,_=new Promise(e=>g=e),v,y;v=nn({cwd:u,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:c,native:Object.keys(o.nativeTokens)},...i?{replyEndpoint:i}:{},connections:o.mcp,connectionEnv:o.env,availability:e.local?.engineChecks&&e.local.engineChecks.expiresAt>Date.now()?e.local.engineChecks.availability:void 0,...t.engineChain?{onEngine:t=>sp(e,t)}:{},post:t.flow!=="default"&&t.source===t.event?.integration,...l?{postToken:l}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await qt(n.runId,n.runningIds())},work:v}),g(t.id)},onWorker:(e,t)=>{y=t},onTask:e=>{g(e)}}).then(async n=>(t.flow==="default"&&n.taskId&&(p.turns=n.turn??p.turns,await e.store.put(`snapshot`,`completion:${n.taskId}`,p),Ff(e,n.taskId,p,y)),n)).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===p.fence?.attempts&&n.tokenHash===p.fence?.tokenHash&&(n.generation??0)===p.fence?.generation&&await Pf(e,n,(e.now??Date.now)()),_u(e,!0)}}),t.flow==="default"&&(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{let e=s(u,n??t.id);e&&await Bt(u,e)},work:v}),v.catch(()=>{e.local&&(e.local.engineChecks=void 0)});let b=await Promise.race([_,v.then(()=>void 0)]),ee=b?s(u,b):void 0,te=(e.now??Date.now)();return ee&&Ef(u,ee)||{task:t,status:t.flow!=="default"&&Wt(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:te,updatedAt:te,local:!0}}async function Vf(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let c=s(i.cwd,r);if(!c)throw Error(`Local task is missing`);let l=o.kind===`cancel`?await Bt(i.cwd,c):await sn(i.cwd,{...c,name:void 0},o,n=>zf(e,t.task,n));o.kind===`ask`&&a.answers.push({seq:o.seq,value:l}),a.seq=o.seq}return a}function Hf(e,t,n=-1,r){let i=``;try{i=V.readFileSync(B.join(p(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
-`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=Jt(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:Tf(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function Uf(e,t,n=!0){let r=s(e,t);return r&&wf(r)?Ef(e,ae(e,r),n):void 0}async function Wf(e,t,n,r,i,a={},o={}){let c=e.store.completionWatches?.get(n);c&&await c.work;let l=(e.now??Date.now)(),u=await e.store.get(`task`,n);u&&[`running`,`waiting`].includes(u.status)&&(await Pf(e,u,l),u=await e.store.get(`task`,n));let d={...u?await xc(e,u.task):{},prompt:r,context:{...u?.task.context,...o,...i?{outputSchema:i}:{}}};if(await e.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),u){if(!await e.queue.continueTask(e.organizationId,n,d,l,{attempts:u.attempts,generation:u.generation??0}))return!1}else{let r=s(t,n);if(!r)throw Error(`No task "${n}"`);await e.queue.enqueue(e.organizationId,{...Ef(t,r).task,...d},l,void 0,e.config.maxQueued??1e3)}return await gu(e,!1,!0,!0),!0}async function Gf(e,t,n,r,i){let a=s(t,n);if(!a||!wf(a))return Response.json({error:`No task "${n}"`},{status:404});let o=ae(t,a),c=Ve.includes(o.status),l=e.method===`POST`?await e.json().catch(()=>({})):{},u=(e,t=409)=>Response.json({error:e},{status:t});if(e.method===`DELETE`&&!r){if(c&&await Bt(t,o),Rt(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),_u(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return c?(await Bt(t,o),Response.json({ok:!0})):u(`No running or queued task "${n}"`,404);if(r===`archive`)return He(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(l.text??``);if(!e.trim())return u(`text is required`,400);let r=c?void 0:l.outputSchema,a=Object.fromEntries([`model`,`effort`,`permissions`].flatMap(e=>typeof l[e]==`string`&&l[e]?[[e,l[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return u(`outputSchema must be an object`,400);try{if(!c&&i){if(!await Wf(i,t,n,e,r,a))return u(`Task is already active`);let o=await i.store.get(`task`,n);return Response.json(o?.status===`queued`?{...o,statusReason:`Waiting for a task slot`}:Uf(t,n))}let s=await zt(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(c?s:Uf(t,n))}catch(e){return u(e.message)}}if(r===`ask`){let e=String(l.question??l.text??``);if(!e.trim())return u(`question is required`,400);let r=await Vt(t,o,e),i=r.finalMessage??r.error?.message??``,a=B.join(p(t,n),`answers.json`);return Fe(a,[...ce(a)??[],i]),Response.json({ok:!0,answer:i})}return r===`approve`?Kf(t,n,l,i):new Response(`Not found`,{status:404})}async function Kf(e,t,n,r){let i=s(e,t);if(!i||!wf(i))return Response.json({error:`No task "${t}"`},{status:404});let a=ae(e,i),o=ft(p(e,t)),c=o.filter(e=>e.response?.decision!==`accept`&&e.response?.decision!==`closed`),l=String(n.approvalId??n.id??tt(p(e,t))[0]?.id??``);if(o.some(e=>e.id===l&&e.response?.decision===`closed`))return Response.json({error:ut(l)},{status:409});if(!c.some(e=>e.id===l))return Response.json({error:`Task "${t}" has no approval "${l}" to answer`},{status:409});try{await Ut(e,a,l,n.decision===`deny`||n.decision===`decline`?`decline`:`accept`,{...typeof n.reason==`string`?{reason:n.reason}:{},...typeof n.by==`string`&&n.by?{by:n.by}:{},...r?{resume:n=>Wf(r,e,t,n)}:{}})}catch(e){if(e instanceof rt)return Response.json({error:e.message},{status:400});throw e}return Response.json({ok:!0})}function qf(e,t=new Set,n=!0){let r=Jf(t);return[...Pe(e),...n?te(e,{migrate:!1}):[]].filter(wf).flatMap(e=>Yf(e,r))}function Jf(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function Yf(e,t){let n=e.turnUsage??[],r=t.get(e.id)??[];t.set(e.id,r);let i=Tf(e.createdAt)??0;return n.flatMap(t=>{let n=Tf(t.at);if(n===void 0||!Number.isFinite(n))return[];let a=Tf(e.resumedAt),o=a!==void 0&&a>=i&&a<=n?a:i,s=r.includes(n);return i=n,s?[]:(r.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??bt()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-o),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function Xf(e){let t=e.local;return t.usageSync??=$f(e).finally(()=>t.usageSync=void 0)}async function Zf(e){try{return JSON.parse(await V.promises.readFile(e,`utf8`))}catch{return null}}async function Qf(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await V.promises.stat(B.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function $f(e){let t=e.local;await t.cacheMaintenance;let n=g(),r=await Zf(n),a=await e.store.list(`usage`,{prefix:`cli:`}),o=new Set(a.map(e=>e.id)),s=0,l=async()=>{++s%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))o.has(t)||(await e.store.put(`usage`,t,n),o.add(t)),await l();let u=Jf(o),d=(await V.promises.stat(c(t.cwd)).catch(()=>void 0))?.mtimeMs??0,f={},p=new Set,m=!1;for await(let{id:n,dir:a,archived:o}of i(t.cwd)){if(await l(),p.has(n))continue;let t=o?await Qf(a):void 0;if(o&&r?.counted?.[n]===t){f[n]=t,p.add(n);continue}let i=await Zf(B.join(a,`job.json`));if(i){if(i.agent&&(i.engine=i.agent),p.add(n),wf(i))for(let[t,n]of Yf(i,u))await e.store.put(`usage`,t,n),m=!0,await l();o&&(f[n]=t)}}if(m||r?.archive!==d||JSON.stringify(r?.counted)!==JSON.stringify(f)){let t=await e.store.list(`usage`,{prefix:`cli:`});await V.promises.mkdir(B.dirname(n),{recursive:!0});let r=Ue(n);try{await V.promises.writeFile(r,`${JSON.stringify({archive:d,counted:f,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await V.promises.rename(r,n)}finally{await V.promises.rm(r,{force:!0})}}t.archiveScan=d}const ep=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,tp={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},np=e=>e in tp;function rp(e){let t=tp[e];Rr(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function ip(e){let t=tp[e];return new Promise(e=>Lr(t.file,t.logout,{timeout:15e3},()=>e()))}function ap(e){return new Promise(t=>Lr(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function op(e){let t=e?.local;if(t?.engineChecks&&t.engineChecks.expiresAt>Date.now())return t.engineChecks.work;let n={},r=Promise.all([ap(tp.claude),ap(tp.codex)]).then(([e,r])=>(t&&(n.claude=et(`claude`,process.env,t.cwd),n.codex=dt(t.cwd)),{claude:{signedIn:e,command:tp.claude.command},codex:{signedIn:r,command:tp.codex.command}})).catch(e=>{throw t?.engineChecks?.work===r&&(t.engineChecks=void 0),e});return t&&(t.engineChecks={expiresAt:Date.now()+3e4,availability:n,work:r}),r}async function sp(e,t,n){if(!e.local)return!1;let r=t?[t]:m(e.local.cwd).chain,i=await op(e);return r.some(t=>{if(t!==`custom`)return i[t]?.signedIn===!0;let r=m(e.local.cwd);try{let e=st({engine:`custom`,model:n},r).model,t=e&&r.models?.[e];return!!(t&&`baseUrl`in t&&process.env[t.envKey??`OPENAI_API_KEY`])}catch{return!1}})}var cp=r({CredentialCheckError:()=>mp,addCredential:()=>Cp,checkCredential:()=>gp,completeLogin:()=>Tp,createCredential:()=>Ip,credentialEnv:()=>Sp,credentialFix:()=>Mp,credentialId:()=>dp,credentialSummary:()=>Dp,deleteCredential:()=>Lp,listCredentials:()=>Fp,parseCredentialId:()=>fp,removeCredential:()=>wp,reseal:()=>jp,resolveCredential:()=>yp,resolveEngine:()=>bp,signInEngine:()=>Rp,signOutEngine:()=>zp,visibleCredentials:()=>xp,writeBackCodexAuth:()=>kp});const lp={claude:`ANTHROPIC_API_KEY`,codex:`OPENAI_API_KEY`},up={claude:`CLAUDE_CODE_OAUTH_TOKEN`,codex:`CODEX_AUTH_JSON`};function dp(e,t){return e?`${e}/${t}`:t}function fp(e){let t=e.lastIndexOf(`/`);return t<0?{name:e}:{owner:e.slice(0,t),name:e.slice(t+1)}}function pp(e){let[t=``]=Object.keys(e);return Object.keys(up).find(e=>up[e]===t)??t}var mp=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function hp(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function gp(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=hp(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new mp(i.status,i.statusText)}function _p(e,t,n){if(e===`claude`||e===`codex`)return[e,lp[e]];let r=null;try{r=st({...n,engine:e},t).model}catch{return[]}let i=r?t.models?.[r]:void 0;return[i&&ue(i)&&i.envKey||lp.codex]}function vp(e,t,n){for(let r of n?[n,void 0]:[void 0])for(let n of t){let t=e.find(e=>e.id===dp(r,n));if(t)return t}}async function yp(e,t,n,r={}){let[i,a]=await Promise.all([Ud(e),e.store.listCredentials({owner:n})]);return vp(a,_p(t,Wd(e,i),r),n)}async function bp(e,t,n){let[r,i]=await Promise.all([Ud(e),e.store.listCredentials({owner:n})]),a=Wd(e,r),o=t.engine??(t.model?st(t,a).engine:void 0),s=o?[o]:a.chain,c=Object.fromEntries(s.flatMap(e=>{let r=_p(e,a,e===o?t:{}),s=vp(i,r,n);return s?[[e,s.id]]:[]}));for(let n of s){let r=c[n];if(r)return{engine:n,credential:r,usable:!0,chain:s,credentials:c};if(await sp(e,n,n===o?t.model:void 0))return{engine:n,usable:!0,chain:s,credentials:c}}return{engine:Object.values(a.models??{}).some(ue)||i.some(e=>![...Object.keys(lp),...Object.values(lp),...Object.values(up)].includes(fp(e.id).name))?`custom`:s[0]??Se,usable:!1,chain:s,credentials:c}}async function xp(e,t,n){return(await e.listCredentials({owner:t,limit:n})).filter(e=>!e.value.owner||e.value.owner===t)}async function Sp(e,t){let n=e.session?.user.id,r=vp(await xp(e.store,n),[t],n);return(r?Cn(e.config,r.value).env[t]:void 0)??(e.local?kr.env[t]:void 0)}async function Cp(e,t,n,r=Date.now){let i=n.owner||void 0,a=dp(i,pp(n.env)),o=!1;return await e.withCredential(`credential`,a,async e=>{o=!!e;let s={...En(t,{env:n.env}),...i?{owner:i}:{},...n.account?{account:n.account}:{},createdAt:r()};return[{id:a,value:s}]}),{id:a,replaced:o}}function wp(e,t){return e.withCredential(`credential`,t,async e=>e&&[{id:t,value:null}])}async function Tp(e,t,n,r){let i=await e.get(`login`,t);if(!i)return!1;let a=dp(i.owner,i.engine);return e.withCredential(`credential`,a,async(e,o,s)=>{if(await s.patchLogin(t,{state:`done`},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:i.owner}))return[{id:a,value:{...r,owner:i.owner}}]})}function Ep(e){if(e.CODEX_AUTH_JSON)return`auth.json`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,7)}…${t.slice(-4)}`:`••••`}function Dp(e,t,n){let{name:r}=fp(t);return{name:r,scope:n.owner?`personal`:`workspace`,subscription:Object.hasOwn(up,r),createdAt:n.createdAt??0,masked:Ep(Cn(e,n).env),...n.account?{account:n.account}:{}}}const Op=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function kp(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=Cn(t,e);if(!(!i.CODEX_AUTH_JSON||!(Op(r)>(Op(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...En(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function Ap(e,t){return Tn(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function jp(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=wn(t.encryptionKey),i=e=>Tn(t,e)!==r,a=e=>i(e)?T(t,E(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19).replace(/:[a-f0-9]{24}$/,``):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`secret`in o?`secret`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||Ap(t,e)===r))return[{id:n,value:{...e,...En(t,Cn(t,e))}}]})&&s++;return s}async function Mp(e,t,n){let r=Ag(n??await kg(e),t===`custom`?`/settings/models`:`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${r}${t===`custom`?``:`?engine=${encodeURIComponent(t)}`}`}const Np=Ce({env:Re(x().check(n(/^[A-Z_][A-Z0-9_]*$/)),x().check(t(1))),workspace:S(ge()),noCheck:S(ge())}),Pp=`Only an owner or admin of this workspace can change workspace credentials.`;async function Fp(e,t,n,r){let i=t.session?.user.id,a=e=>`${e.scope}/${e.name}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return C({error:`Invalid fields`},400);if(s===`id`){let e=yn(r),n=mn(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:hn(r)?n+1:n})).map(({id:e})=>({id:e}));return C(hn(r)?xn(a,n,e=>e.id):a)}let c=(await xp(t.store,i,hn(r)?void 0:mn(r,200))).map(e=>Dp(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!hn(r))return C(c.slice(0,mn(r,200)));let l=yn(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.name,e.account?.email??``].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return C(xn(d,mn(r),a))}async function Ip(e,t,n,r){let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=Np.safeParse(a);if(!o.success||Object.keys(o.data.env).length!==1)return C({error:`Invalid credential`},400);let{env:s}=o.data,c=!!o.data.workspace||!i;if(c&&!Ph(t))return C({error:Pp},403);if(s.CODEX_AUTH_JSON)return C({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&!t.config.subscriptions?.claude)return C({error:`Claude subscriptions are off on this server; add an API key.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&c&&t.auth)return C({error:`A Claude subscription is personal; add it without --workspace.`},400);let l=c?void 0:i,u=s.CLAUDE_CODE_OAUTH_TOKEN?`claude`:Object.keys(lp).find(e=>lp[e]in s)??`custom`;try{o.data.noCheck||await gp({engine:u,env:s},t.fetch??fetch);let{id:e,replaced:n}=await Cp(t.store,t.config,{...l?{owner:l}:{},env:s},t.now??Date.now);return C({ok:!0,name:fp(e).name,replaced:n})}catch(e){return e instanceof mp?C({error:e.message},e.status):(console.error(`coder server: could not save credential`,e),C({error:`Could not save credential. Please try again.`},500))}}async function Lp(e,t,n,r){let i=t.session?.user.id,a=r.searchParams.has(`workspace`)||!i;if(a&&!Ph(t))return C({error:Pp},403);let o=dp(a?void 0:i,n.name);return await wp(t.store,o)?C({ok:!0}):C({error:`Unknown credential`},404)}async function Rp(e,t,n,r){let i=n.engine;return rp(i),t.local&&(t.local.engineChecks=void 0),C(await op())}async function zp(e,t,n,r){let i=n.engine;return await ip(i),t.local&&(t.local.engineChecks=void 0),C(await op())}var Bp=r({ConnectionError:()=>nm,addConnection:()=>cm,authorizeConnection:()=>gm,changeConnection:()=>lm,completeNativeConnection:()=>Zp,connectionAllowed:()=>Qp,connectionAuthorization:()=>dm,connectionRow:()=>Kp,connectionRows:()=>am,createConnection:()=>pm,deleteConnection:()=>hm,findConnection:()=>Xp,listConnections:()=>fm,nativeApp:()=>em,nativeConnections:()=>Jp,nativeCredential:()=>qp,removeConnection:()=>um,updateConnection:()=>mm,visibleConnections:()=>Yp});const Vp=x().check(n(/^[a-z0-9][a-z0-9_-]*$/i)),Hp=ve([Oe({header:x().check(n(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),Oe({env:x().check(n(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),Up=Oe({name:x().check(t(1)),id:S(Vp),provider:S(Vp),owner:S(be(`me`)),access:S(Ge([`read`,`write`])),endpoint:S(_),auth:S(Ge([`none`,`key`,`oauth`])),key:S(x().check(t(1))),keyIn:S(Hp),credential:S(x().check(t(1)))}),Wp=Oe({name:S(x().check(t(1))),access:S(Ie(Ge([`read`,`write`]))),key:S(x().check(t(1)))});function Gp(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`write`&&!!t.keyIn&&`env`in t.keyIn&&ne(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`read`&&!n.tools?.length||n.tools?.some(e=>!$e(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!l(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(ye)}function Kp(e,t,n){let r=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{r=!!E(n,e.secret).accessToken}catch{r=!1}return{id:e.id,name:e.name,provider:e.provider,auth:e.auth,...e.access?{access:e.access}:{},...e.owner?{owner:e.owner,...t===e.owner?{mine:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.account}:{},status:e.broken?`reconnect`:e.auth===`oauth`&&!r?`authorize`:`ok`,createdAt:e.createdAt}}function qp(e,t){let n=E(e,t);return typeof n==`string`?{token:n,app:void 0}:n}async function Jp(e,t){return!t||!e.auth?.linkedAccounts?[]:(await e.auth.linkedAccounts(t,e.store)).filter(t=>t.token&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:`${t}:${n.platform}-${zr(`sha256`).update(n.platformUserId).digest(`hex`).slice(0,12)}`,name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,auth:`oauth`,secret:n.token,account:n.platformUserId,oauthApp:qp(e.config,n.token).app,createdAt:0}))}async function Yp(e,t,n){let r=await Jp(e,t),i=(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t).map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let t=r.find(t=>t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:t?.secret,account:t?.account??e.account}});return[...i,...r.filter(e=>!i.some(n=>n.id===e.id||n.owner===t&&n.provider===e.provider&&n.account===e.account))]}async function Xp(e,t,n){let r=await e.store.get(`connection`,t);return r?!r.owner||r.owner===n?r:void 0:(await Jp(e,n)).find(e=>e.id===t)}async function Zp(e,t,n,r){for(let{id:i,value:a}of await e.store.list(`connection`))a.owner!==t||a.provider!==n||a.auth!==`oauth`||a.account&&a.account!==r||await e.store.withAppLock(`connection:${i}`,async a=>{let o=await a.get(`connection`,i);!o||o.owner!==t||o.provider!==n||o.account&&o.account!==r||await a.put(`connection`,i,{...o,account:r,broken:void 0,secret:void 0,updatedAt:(e.now??Date.now)()})})}async function Qp(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await Xp(t,n.id,t.session?.user.id);if(!e)return C({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else if((await e.clone().json().catch(()=>void 0))?.owner===`me`)return t.auth&&t.session&&!t.local?t:C({error:`Personal connections need a signed-in member`},400);return Fh(t,`Only workspace owners and admins can manage workspace connections`)}var $p=class extends Error{};async function em(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([zg(e),e.store.list(`app`)]);r=[...t,...n.map(e=>e.value)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(E(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function tm(e,t,n){if(t.provider===`mcp`)return Ea(e,t,n);if(!await em(e,t.provider))throw new $p(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:Vr(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var nm=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const Z=(e,t)=>new nm(e,t);async function rm(e,t=200){try{return C(await e(),t)}catch(e){if(e instanceof nm)return C({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function im(e){return e.json().catch(()=>void 0)}async function am(e,t){let n=e.session?.user.id,r=await Yp(e,n,`oauth`),i=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0;return r.map(r=>{let a=Kp(r,n,e.config);return t&&r.auth===`oauth`&&(!i||!(`target`in i)||i.target!==`${r.id}:${r.createdAt}`)&&(a.status=`authorize`),a})}async function om(e,t,n,r){if(n.key&&n.credential)throw Z(400,`Give a key or a credential, not both`);if(n.key){let{id:i,replaced:a}=await Cp(e.store,e.config,{...r?{owner:r}:{},env:{[t]:n.key}},e.now??Date.now);return a?{id:i}:{id:i,created:!0}}let i=(await xp(e.store,r)).filter(n=>Cn(e.config,n.value).env[t]!==void 0),a=n.credential?i.find(e=>e.id===n.credential):i.find(e=>r&&e.value.owner===r)??i.find(e=>!e.value.owner);if(!a)throw Z(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:a.id}}async function sm(e,t,n){let r=t.keyIn.env;return(await om(e,r,{key:n},t.owner)).id}async function cm(e,t){let n=Up.safeParse(t);if(!n.success)throw Z(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!Vp.safeParse(i).success)throw Z(400,`Invalid connection id`);let a=r.provider??`mcp`,o=r.owner===`me`?e.session.user.id:void 0;if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw Z(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw Z(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw Z(400,`Only environment connections use a credential`);let s=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(s===`key`&&!r.key&&a!==`env`)throw Z(400,`A key is required`);if(r.key&&s!==`key`)throw Z(400,`A key needs key authentication`);let c={id:o?`${o}:${i}`:i,name:r.name,provider:a,...o?{owner:o}:{},...r.access||a===`env`?{access:r.access??`write`}:{},auth:s,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:T(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!Gp(e,c))throw Z(400,`Invalid endpoint or read-only tools`);if(await e.store.get(`connection`,c.id))throw Z(409,`Connection already exists`);let l;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(l=await ya(e,r.endpoint.url,!0),!l)try{await y({...c,access:`write`},void 0,e.fetch)}catch(t){if(!(t instanceof Ne)||!t.authenticate||(l=await ya(e,r.endpoint.url,!0,t.authenticate),!l))throw t}l&&(c.auth=`oauth`)}catch(e){throw e instanceof Ne?new nm(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):(console.error(`coder server: connection discovery failed`,e),Z(502,`Could not start authorization`))}if(c.auth===`oauth`&&e.local?.port===0)throw Z(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let u=a===`env`?await om(e,r.keyIn.env,r,o):void 0;if(u&&(c.credential=u.id),!await e.store.withAppLock(`connection:${c.id}`,e=>e.create(`connection`,c.id,c)))throw u?.created&&await wp(e.store,u.id),Z(409,`Connection already exists`);try{let t=c.auth===`oauth`?await tm(e,c,l):void 0;return{...Kp(c,o,e.config),...t?{authorize:t}:{}}}catch(t){throw t instanceof $p||console.error(`coder server: connection authorization failed`,t),await e.store.withAppLock(`connection:${c.id}`,async e=>{let t=await e.get(`connection`,c.id);Gr(t,c)&&await e.delete(`connection`,c.id)}),t instanceof $p?Z(400,t.message):Z(502,`Could not start authorization`)}}async function lm(e,t,n){let r=Wp.safeParse(n);if(!r.success)throw Z(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await Xp({...e,store:n},t,e.session?.user.id);if(!i)throw Z(404,`Unknown connection`);let{key:a,access:o,...s}=r.data;if(a&&i.auth!==`key`)throw Z(400,`This connection does not use a key`);let{access:c,...l}=i,u={...o===null?l:i,...s,...o?{access:o}:{},...a&&i.provider!==`env`?{secret:T(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!Gp(e,u))throw Z(400,`Invalid read-only tools`);return a&&i.provider===`env`&&(u.credential=await sm({...e,store:n},i,a)),await n.put(`connection`,u.id,u),Kp(u,e.session?.user.id,e.config)})}async function um(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await Xp({...e,store:n},t,e.session?.user.id);if(!r)throw Z(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function dm(e,t){let n=await Xp(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw Z(404,`Unknown OAuth connection`);try{return await tm(e,n)}catch(e){throw e instanceof $p||console.error(`coder server: connection authorization failed`,e),e instanceof $p?Z(400,e.message):Z(502,`Could not start authorization`)}}async function fm(e,t){let n=new URL(e.url),r=n.searchParams.get(`authorization`)??void 0,i=n.searchParams.get(`wait`);if(!r||!i)return C(await am(t,r));let a=await t.store.watch(`delivery`,`connection-authorized:${r}`),o=Date.now()+25e3;try{for(;;){let n=await am(t,r),s=n.find(e=>e.id===i);if(!s||s.status===`ok`||Date.now()>=o||e.signal.aborted)return C(n);await a.wait(Math.min(1e4,o-Date.now()),e.signal)}}finally{a.close()}}async function pm(e,t){let n=await im(e);return rm(()=>cm(t,n),201)}async function mm(e,t,n){let r=await im(e);return rm(()=>lm(t,n.id,r))}async function hm(e,t,n){return rm(async()=>(await um(t,n.id),{ok:!0}))}async function gm(e,t,n){return rm(async()=>({url:await dm(t,n.id)}))}function _m(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}async function vm(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=Cn(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}async function ym(e,t,n={}){let r={},i={},a={...n},o={...t.tools},s=wt(t),c={},l=[],u=[],d=[...new Set(t.connections??[])],f=d.length?await e.store.list(`connection`,{ids:d,visibleTo:t.requester,secrets:`all`}):[],p=new Set(f.map(e=>e.id)),m,g=d.some(e=>!p.has(e))?await Jp(e,t.requester).catch(e=>(console.error(`coder server: native connection lookup failed`,e),m=e,[])):[],_=new Map([...g.map(e=>[e.id,e]),...f.map(({id:e,value:t})=>[e,t])]),v=await Promise.allSettled(d.map(async e=>{if(!_.has(e)&&m)throw m;return{id:e,value:_.get(e)}})),b,te=v.sort((e,t)=>Number(t.status===`fulfilled`&&!!t.value.value?.owner)-Number(e.status===`fulfilled`&&!!e.value.value?.owner)),re=ee(te.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of te){let d,f=``;try{if(n.status===`rejected`)throw n.reason;if({id:f,value:d}=n.value,!d||d.owner&&d.owner!==t.requester)continue;if(d.provider===`env`&&(d.auth!==`key`||d.access!==`write`||d.endpoint||!d.credential||!d.keyIn||!(`env`in d.keyIn)||!ne(d.keyIn.env)||re.has(d.keyIn.env)||`local`in e&&e.local&&process.env[d.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(d.broken){l.push(`${d.name} needs reconnecting.`);continue}let p,m;if(d.provider!==`mcp`&&d.provider!==`env`&&d.auth===`oauth`){if(c[d.provider])continue;let n=d,r=e.integrations[n.provider];if(!r?.auth.user)throw Error(`Missing user OAuth`);let i=!n.owner&&n.secret?E(e.config,n.secret):void 0,a=n.owner?(await e.auth?.linkedAccounts?.(n.owner,e.store))?.find(t=>t.platform===n.provider&&t.token&&t.organizations?.includes(e.organizationId)&&(!n.account||t.platformUserId===n.account)):void 0,o=await em(e,n.provider,(a?.token?qp(e.config,a.token).app:void 0)??n.oauthApp??i?.app,await(b??=Promise.all([zg(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value)])));if(!o)throw Error(`Missing integration credentials`);let s=n.owner?n.account??a?.platformUserId:void 0;if(n.owner&&!s)throw Error(`Missing linked account`);let l=n.owner?`native:${n.owner}:${n.provider}:${s}`:`connection:${f}`;p=await e.store.withAppLock(l,async i=>{let a=await Xp({...e,store:i},f,t.requester);if(!a||a.owner!==n.owner||a.provider!==n.provider||a.broken)throw Error(`Connection changed during resolution`);d=a;let c=(a.owner?await e.auth?.linkedAccounts?.(a.owner,i):[])?.find(t=>t.platform===a.provider&&t.token&&t.organizations?.includes(e.organizationId)&&t.platformUserId===s&&(!a.account||t.platformUserId===a.account)),l=a.owner?void 0:a.secret&&E(e.config,a.secret),p=c?.token?qp(e.config,c.token):void 0,m=a.owner?p?.token:l&&l.token;if(!m)throw Error(`Missing native credential`);u.push(..._m(m));let h=p?.app??a.oauthApp??(l?l.app:void 0);if(h&&h!==o.id)throw Error(`OAuth client changed during resolution`);let g;try{g=await r.auth.user.access(m,E(e.config,o.credentials),{fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)})),now:(e.now??Date.now)()})}catch(e){throw e instanceof Mt&&[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`].includes(e.error??``)?new fe(`Native credential was revoked`):e}if(g.refreshed)if(u.push(..._m(g.refreshed)),a.owner){if(!c||!await e.auth?.refreshLinkedToken?.(a.owner,c.platform,c.platformUserId,c.token,T(e.config,{app:o.id,token:g.refreshed}),i))throw Error(`Linked account changed during refresh`)}else a.secret=T(e.config,{app:o.id,token:g.refreshed}),await i.put(`connection`,f,a);else if(a.owner&&!(await e.auth?.linkedAccounts?.(a.owner,i))?.some(e=>e.platform===c?.platform&&e.platformUserId===c.platformUserId&&e.token===c.token))throw Error(`Linked account changed during resolution`);return g.accessToken})}else if(d.provider===`env`)p=await vm(e,d);else if(d.auth!==`none`){if(!d.secret)throw Error(`Missing credential`);let t=E(e.config,d.secret);if(u.push(...[t.key,t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),d.auth===`key`){if(!t.key)throw Error(`Missing key`);p=t.key}else{let t=d.owner;m=async(n=!1,r)=>{let i=await e.store.withAppLock(`connection:${f}`,async i=>{let a=await i.get(`connection`,f);if(!a||a.owner!==t||a.broken||a.auth!==`oauth`)throw Error(`Connection changed during resolution`);if(!a.secret)throw Error(`Missing credential`);let o=E(e.config,a.secret);u.push(...[o.accessToken,o.refreshToken,o.clientSecret].filter(e=>!!e));let s=AbortSignal.timeout(5e3);return{connection:a,token:await de({secret:o,now:(e.now??Date.now)(),force:n&&o.accessToken===r,fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:s})),save:async t=>{u.push(...[t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),a.secret=T(e.config,t),await i.put(`connection`,f,a)}})}});return d=i.connection,i.token},p=await m()}}if(p&&u.push(p),d.provider===`env`)i[d.keyIn.env]=p;else if(d.provider===`mcp`){let t=d.access??s,n;try{n=await y({...d,access:t},p,e.fetch??fetch)}catch(r){if(!(r instanceof Ne)||!m)throw r;p=await m(!0,p),u.push(p),n=await y({...d,access:t},p,e.fetch??fetch)}n&&(r[f]={...n,description:d.name,access:t})}else if(!c[d.provider]&&p){let t=e.integrations[d.provider];if(!t)throw Error(`Unknown integration`);c[d.provider]=p,a[d.provider]=p,(d.access||!o[d.provider])&&(o[d.provider]=[...t.tools.presets[d.access??s]])}}catch(t){if(d&&oe(t)){let t=d;await e.store.withAppLock(`connection:${f}`,async n=>{let r=await n.get(`connection`,f);r&&r.secret===t.secret&&await n.put(`connection`,f,{...r,broken:{at:(e.now??Date.now)(),reason:`Needs reconnecting`}})})}l.push(h(d?.name??`A connection`,t))}}return{mcp:r,env:i,tokens:a,nativeTokens:c,tools:o,warnings:l,secrets:u}}async function bm(e,t,n){if(!t.task.connections?.length)return{mcp:{},env:{},tokens:n,nativeTokens:{},tools:t.task.tools,warnings:[],secrets:[]};let r=zr(`sha256`).update(JSON.stringify(t.task.connections)).digest(`hex`).slice(0,12),i=`connections:${t.task.id}:${t.generation??0}:${t.attempts}:${r}`,a=await e.store.get(`snapshot`,i);if(a&&`resolvedConnections`in a){let t=E(e.config,a.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n,...t.nativeTokens}}}let o=await e.store.get(`task`,t.task.id),s=await ym(e,t.task,n);return!s.warnings.length&&o&&await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0))return;let a=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,i,{resolvedConnections:T(e.config,s),expiresAt:a},{ttlMs:Math.max(1,a-(e.now??Date.now)())})}),s}function xm(e,t,n){let r=(e.now??Date.now)()+(e.config.taskTimeoutMs??36e5);return[...new Set(n)].filter(e=>e.length>=8).map(n=>({id:`connection-secrets:${t}:${zr(`sha256`).update(n).digest(`hex`).slice(0,24)}`,value:T(e.config,n),expiresAt:r}))}async function Sm(e,t,n){let r=xm(e,t,n);return r.length&&await e.store.saveTaskSecrets(t,r),[...new Set(n)].filter(e=>e.length>=8)}async function Cm(e,t){let n=[],r=[...new Set(t.connections??[])],i=r.length?await e.store.list(`connection`,{ids:r,visibleTo:t.requester,secrets:`all`}):[],a=r.some(e=>!i.some(t=>t.id===e))?await Jp(e,t.requester):[],o=new Map([...a.map(e=>[e.id,e]),...i.map(({id:e,value:t})=>[e,t])]);for(let t of r){let r=o.get(t);if(r?.provider===`env`){n.push(...await vm(e,r).then(e=>[e],()=>[]));continue}if(!r?.secret)continue;let i=E(e.config,r.secret);n.push(...typeof i==`string`?[i]:[...`token`in i&&typeof i.token==`string`?_m(i.token):[],i.key,i.accessToken,i.refreshToken,i.clientSecret].filter(e=>!!e))}return n}async function wm(e,t){let[n,r,i]=await Promise.all([e.store.get(`snapshot`,`connection-secrets:${t.id}`),e.store.list(`snapshot`,{prefix:`connection-secrets:${t.id}:`}),Cm(e,t)]);if(n)throw Error(`Task ${t.id} keeps its secrets in the old single-row layout`);let a=r.flatMap(t=>`secret`in t.value?[E(e.config,t.value.secret)]:[]);return[...new Set([...a,...i])]}async function Tm(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);for(let n of[`connection-secrets:${t}:`,`connections:${t}:`])for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id)})}function Em(e,t=Date.now()){let n=e.status===`running`||e.status===`waiting`?t:e.finishedAt??e.updatedAt;return{lastActivityAt:e.updatedAt,lastTurnMs:e.startedAt===void 0?0:Math.max(0,n-e.startedAt)}}const Dm=e=>({[e.key.slice(0,e.key.indexOf(`:`))]:e.through});var Om=class extends Error{};const Q=[`queued`,`running`,`waiting`];function km(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(t.status===`waiting`){if(!ke(e.status,e.approvals??e.task.context?.approvals))return!1}else if(n&&!n.includes(e.status))return!1;if(t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.reviewKey&&Lm(e.task)!==t.reviewKey||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const Am=e=>({rank:Xe(e.status),createdAt:e.createdAt,id:e.task.id}),jm=e=>({updatedAt:e.updatedAt,id:e.task.id}),Mm=(e,t)=>e.updatedAt-t.updatedAt||De(e.task.id,t.task.id),Nm=(e,t)=>he(Am(e),Am(t)),Pm=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:he(Am(e),t)>0);function Fm(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent])}function Im(e,t){return e.flow==="default"&&!!e.event?.chat&&Fm(e)===Fm(t)}function Lm(e){let t=e.event;if(e.flow!==`review`||!t)return;let n=Pt[t.integration]?.repos?.pullRequest(t);if(n!==void 0)return JSON.stringify([t.appId,t.installationId,t.repo?.owner,t.repo?.name,n])}const Rm=6e5;async function zm(e,t){let n=t.task.id,r={generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};return e.queue.deleteTask(e.organizationId,n,r)}const Bm=(e,t)=>({...e,context:{...e.context,approvals:lt(e.context?.approvals??[],t)}}),Vm=(e,t)=>({...e,context:{...e.context,admissions:{...e.context?.admissions,...t}}});async function Hm(e,t,n,r,i,a){let o=t.task.id,s=await e.queue.appendInbox(e.organizationId,o,n,r,(e.now??Date.now)(),t.generation??0,i,a);return s&&await qm(e,o,t.task,t),s}async function Um(e,t,n=-1,r){return r??=(await e.store.get(`task`,t))?.generation??0,e.queue.readInbox(e.organizationId,t,r,n)}const Wm=new Set([`completed`,`failed`,`cancelled`]);var Gm=class{store;lock=Promise.resolve();tombstones=new Map;constructor(e){this.store=e}async metrics(e,t){let n=await this.list(e),r={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0};for(let e of n)e.createdAt>=t&&r[e.status]++;return{tasks:r,queueDepth:n.filter(e=>e.status===`queued`).length}}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i?.pending?.task&&await this.store.put(`delivery`,n.key,{at:t,...n.owner?{owner:n.owner}:{},pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:e,status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}async admit(e,t,n){if(!t)return;let{conversation:r,unseen:i}=t;r&&await this.store.putMany(`delivery`,[{id:r.key,value:r.record},{id:r.root,value:{at:r.record.at}}],{ttlMs:r.ttlMs}),i&&await this.store.acknowledgeUnseen(i.key,i.version,i.epoch);for(let e of t.secrets??[])await this.store.put(`snapshot`,e.id,{secret:e.value,expiresAt:e.expiresAt},{ttlMs:Math.max(1,e.expiresAt-n)})}deliver(e,t,n,r,i,a,o=!0,s){return this.serial(async()=>{let c=await this.store.get(`delivery`,r.key);if(c&&!c.pending)return{};if(c?.pending?.inbox){let{taskId:e,id:i,entry:a}=c.pending.inbox,o=await this.read(e);if(o&&Q.includes(o.status)&&(o.generation??0)===a.generation&&Im(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),c=void 0}let l=i!==void 0&&!c?.pending?.task?(await this.list(e,{statuses:Q,agent:t.agent,source:t.source})).find(e=>Im(e.task,t)):void 0;if(!l)return!o||!await this.insert(t,n,r,a)?{}:(await this.admit(t,s,n),{taskId:t.id});let u=await this.nextSeq(l.task.id),d={seq:u,generation:l.generation??0,at:n,kind:`steer`,value:{text:i}},f=`${l.task.id}:${String(u).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:l.task.id,id:f,entry:d}}}),await this.store.put(`task`,l.task.id,{...l,inboxSeq:u,updatedAt:n}),await this.store.put(`inbox`,f,d),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=new Set(n.filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>Lm(e.task)).filter(e=>e!==void 0)),i=n.filter(e=>{let t=Lm(e.task);return e.status===`queued`&&(t===void 0||!r.has(t))}).sort((e,t)=>e.createdAt-t.createdAt),a=i[0];if(!a)return;let o=Us(a.task.id,`default`,a.attempts+1),s={...a,tokenHash:o.hash,lastSeenAt:e,status:`running`,attempts:a.attempts+1,startedAt:e,updatedAt:e};await this.store.put(`task`,s.task.id,s);let c=Lm(a.task);return{organizationId:`default`,status:s,token:o.token,more:i.some(e=>e!==a&&(c===void 0||Lm(e.task)!==c))&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&Wm.has(e.status)||e.status===`queued`)return;if(Wm.has(e.status))return e;let o={...e,lastSeenAt:i,updatedAt:i};return await this.store.put(`task`,t,o),o})}async authorize(e,t,n,r,i,a={}){let o=await this.touch(r,e,t,n,i,a.allowCompleted);return o&&{organizationId:`default`,status:o}}async archiveStopped(e,t,n){let r=e=>e!==void 0&&Wm.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&Ee(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,approvals:o,...s}=n;return await this.store.put(`task`,t,{...e,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...s,...a===void 0?{}:{answer:[...e.answer??[],a]},...o?{task:Bm(e.task,o)}:{},updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t),await Tm(this.store,t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);return!e||!Wm.has(e.status)||!this.allowed(e,i)?!1:(await this.store.put(`task`,t,{task:{...e.task,...n},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0)})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage);for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);await this.store.put(`task`,t,{...e,...n.outcome,...n.logsComplete?{logsComplete:!0}:{},lastSeenAt:r,finishedAt:r,updatedAt:r});for(let e of n.known??[])await this.store.put(`delivery`,e.id,{at:r},{ttlMs:e.ttlMs});return await Tm(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await Tm(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||Wm.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,error:Ye,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await Tm(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>km(e,t)).filter(e=>Pm(e,n)).sort(t.since===void 0?Nm:Mm).slice(0,t.limit)}tombstone(e){this.tombstones.set(e,Date.now())}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,t]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,e])=>e>t).map(([e,t])=>({organizationId:n,id:e,at:t}))}}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>km(e,t));return{all:n.length,active:n.filter(e=>Q.includes(e.status)).length,waiting:n.filter(e=>ke(e.status,e.task.context?.approvals)).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes,updatedAt:a}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!Q.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if(Wm.has(e.status))return n.seq<=i?e.status:void 0;if(![`running`,`waiting`].includes(e.status))return;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c),u=Object.assign({},...a.map(e=>e.value.value?.admissions)),d={...e,...Object.keys(u).length?{task:Vm(e.task,u)}:{},inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,error:Ye,finishedAt:Date.now()}:{},updatedAt:Date.now()};await this.store.put(`task`,t,d);for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await Tm(this.store,t),d.status})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a,o,s){let c=async()=>{if(o&&(await this.store.get(`delivery`,o.key))?.sending?.owner!==o.owner)throw new Om;let e=await this.read(t);if(!e||!Q.includes(e.status)||(e.generation??0)!==a)return;for(let t of s??[]){let n=yt(e.task.context?.approvals?.find(e=>e.id===t.id),t);if(n)throw new _t(n)}let c=await this.nextSeq(t),l=o&&Dm(o),u={seq:c,generation:a,at:i,kind:n,value:l?{...r,admissions:l}:r};await this.store.put(`inbox`,`${t}:${String(c).padStart(8,`0`)}`,u);let d=e.task;return l&&(d=Vm(d,l)),s&&(d=Bm(d,s)),await this.store.put(`task`,t,{...e,task:d,inboxSeq:c,updatedAt:i}),o&&await this.store.finishBatch(o.key,o.owner,!0,o.through),u};return this.serial(()=>o?this.store.withAppLock(`batch:${o.key}`,c):c())}};const Km=3e4;function qm(e,t,n,r){if(n&&!e.local&&!n.runnerId&&!e.runners[n.runner]?.push)return Promise.resolve();let i=e.queue.inboxDelivery??=new Map,a=JSON.stringify([e.organizationId,t]),o=i.get(a);if(o||i.set(a,o={}),o.work)return o.again=!0,o.work;let s=o,c=async()=>{let n,i=Hr(),a=0,o=0,c,l=r,u=async()=>{for(;;){s.again=!1;let r=l??await e.store.get(`task`,t);if(l=void 0,!r?.handle||![`running`,`waiting`].includes(r.status))return;let c=await kn(e,r.task),u=!!(e.local&&r.handle.startsWith(`cli:`));if(!u&&!c?.push)return;o=r.generation??0;let d={generation:o,attempts:r.attempts,tokenHash:r.tokenHash??null,handle:r.handle},f=`inbox:${JSON.stringify([t,d])}`;if(n!==f){n&&await e.store.updateDeliveryLease(n,i),n=void 0;let t=await e.store.claimDeliveryLease(f,i,Km);if(t===void 0)return;n=f,a=t}else if(!await e.store.updateDeliveryLease(n,i,{owner:i,failures:a},{ttlMs:Km}))return;let p=(await e.queue.readInbox(e.organizationId,t,r.generation??0,-1)).slice(0,100);if(!p.length){if(s.again)continue;return}let m=u?await Vf(e,r,p):await c.push(r.handle,p);if(m.generation!==(r.generation??0)||!p.some(e=>e.seq===m.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,m,d)||(a=0,p.length<100&&!s.again))return}};try{await u()}catch(r){if(console.error(`coder server: inbox delivery failed for ${t}`,r),n){let t=Math.min(3e4,1e3*2**Math.min(a,5)),r={owner:i,failures:a+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,i,r,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,i),c=o)}return c};return s.work=(async()=>{for(;;){let n=await c();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!s.again)break}i.delete(a)})().finally(()=>{i.get(a)===s&&i.delete(a)}),s.work}async function Jm(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>qm(H(e,t),n.task.id)))}function Ym(e,t){let n=Jm(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function Xm(){return(process.env.PATH??``).split(B.delimiter).some(e=>{try{let t=B.join(e,`docker`);return Mr(t,Nr.X_OK),Ir(t).isFile()}catch{return!1}})}function Zm(e){let t=!!e.local,n=t&&Xm();return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:Rn,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0}],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0}],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0}],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const Qm=x().check(t(1),e(80)),$m=Ge([`personal`,`workspace`]),eh=Re(x(),x()),th=Oe({kind:Ge([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:Qm,scope:$m,config:eh}),nh=Oe({name:S(Qm),default:S(be(!0)),config:S(eh)});function rh(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const ih=(e,t)=>({value:n})=>Nn(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function ah(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?Ph(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(ih(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return rh(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function oh(e,t,n,r){return C({items:sh(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:Zm(t)})}function sh(e,t,n){let r=t.filter(ih(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:zn(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>rh(e,t,n,e===i?.id))]}async function ch(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=ah(t);{let n=th.safeParse(await e.json().catch(()=>void 0));if(!n.success)return C({error:`Invalid runner`},400);if(!o(n.data.scope))return C({error:`This scope requires a member or workspace admin.`},403);let r=Zm(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return C({error:r.reason??`Pair this runner with runner serve.`},400);try{Fn(r,n.data.config)}catch(e){return C({error:e.message},400)}let s=fh(n.data.kind,n.data.config,t),l=`rnr_${Vr(9).toString(`base64url`)}`,u={...n.data,...s,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),C(await c(l,u))}}async function lh(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=ah(t);if(i===zn(t))return C(await An(t));let u=e=>{if(!e||!Nn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!Ph(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)},d=await t.store.get(`runner`,i),f=u(d);if(f)return f;let p=await An(t,d);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===d.secret&&JSON.stringify(n.config)===JSON.stringify(d.config)&&await e.put(`runner`,i,{...n,lastSeen:p.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),C(p)}async function uh(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=ah(t);if(i===zn(t)){if(Ph(t)){let n=nh.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return C({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{for(let{id:t,value:n}of await e.list(`runner`))n.scope===`workspace`&&n.default&&await e.put(`runner`,t,{...n,default:!1,updatedAt:o})});let r=(await c()).some(({value:e})=>e.scope===`personal`&&e.default);return C({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return C({error:`The server default cannot be renamed or removed.`},403)}let u=e=>{if(!e||!Nn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!Ph(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=u(r);if(a||!r)return a;{let a=nh.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return C({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...E(t.config,r.secret),...a.data.config};try{Fn(Zm(t).find(e=>e.kind===r.kind),e)}catch(e){return C({error:e.message},400)}s=fh(r.kind,e,t)}if(a.data.default)for(let e of await n.list(`runner`))e.id!==i&&e.value.scope===r.scope&&e.value.owner===r.owner&&e.value.default&&await n.put(`runner`,e.id,{...e.value,default:!1,updatedAt:o});let c={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,c),C(await l(i,c,n))}})}async function dh(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=ah(t);if(i===zn(t))return C({error:`The server default cannot be renamed or removed.`},403);let u=e=>{if(!e||!Nn(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return C({error:`Unknown runner`},404);if(e.scope===`workspace`&&!Ph(t))return C({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=u(n);if(r||!n)return r;{let n=(await e.list(`task`)).filter(({value:e})=>e.task.runnerId===i&&Q.includes(e.status)).length;return n?C({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),await e.delete(`snapshot`,Dn(i)),t.settings?.runnerInstances?.delete(i),C({ok:!0}))}})}function fh(e,t,n){let r=new Set(Zm(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:T(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const ph=Oe({name:S(Qm),scope:$m});async function mh(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=ah(t),l=ph.safeParse(await e.json().catch(()=>void 0));if(!l.success)return C({error:`Invalid pairing`},400);if(!o(l.data.scope))return C({error:`This scope requires a member or workspace admin.`},403);let u=`${Buffer.from(t.organizationId).toString(`base64url`)}.${Vr(32).toString(`base64url`)}`,d=a+9e5;await t.store.put(`snapshot`,`runner-pair:${At(u)}`,{...l.data,owner:l.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:d},{ttlMs:9e5});let f=t.config.publicUrl??r.origin;return C({token:u,expiresAt:d,command:`coder runner serve --url ${f} --token ${u}`})}const hh=Oe({token:S(x()),id:S(x()),organizationId:S(x()),name:S(x().check(t(1),e(80))),url:x(),secret:x().check(t(32)),offline:S(ge()),removed:S(je(x()))});async function gh(e,t,n,r){let i=hh.safeParse(await e.json().catch(()=>void 0));if(!i.success)return C({error:`Invalid runner registration`},400);let a=i.data;try{new On({url:a.url,secret:a.secret})}catch{return C({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return C({error:`Invalid runner token`},401);t=H(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${At(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return C({error:`Pairing token expired or already used`},401);r=`rnr_${Vr(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...fh(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!jt(E(t.config,i.secret).secret??``,a.secret))return C({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}await e.put(`runner`,r,n);let i=a.token?[]:await Pn(e,r,a.removed);return C({...rh(r,n,s),organizationId:o,...i.length?{deleted:i}:{}})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}async function _h(e,t,n,r=!1,i){let a=Lh(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=Ws(a);return o.task!==n||o.organization!==t.organizationId||!Number.isInteger(o.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.authorize(n,Hs(a),o.attempt,t.organizationId,(t.now??Date.now)(),{allowCompleted:r,include:i})??new Response(`Unauthorized`,{status:401})}function vh(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}async function yh(e,t,n,r){let i=n.id,a=Lh(e),o=Ws(a),s=Hs(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return C({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?C(l):new Response(`Unauthorized`,{status:401})}async function bh(e,t,n,r){let i=n.id,a=Lh(e),o=Ws(a),s=Hs(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return C({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u===`cancelled`){let e=await t.store.get(`task`,i);e&&await pu(t,e)}return u?C({ok:!0}):new Response(`Unauthorized`,{status:401})}async function xh(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return C({error:`Invalid task logs`},400);let i=await uc(t,t.callbackTask,r);return i===`ok`?C({ok:!0}):i===`gap`?C({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function Sh(e,t,n,r){let i=n.id,a=Lh(e),o=Ws(a),s=Hs(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?C({ok:!0}):new Response(`Unauthorized`,{status:401})}async function Ch(e,t,n,r){let i=n.id;Lh(e);let a=t.callbackTask,o=a.handle?await kn(t,a.task):void 0;if([`completed`,`failed`,`cancelled`].includes(a.status))return await pu(t,a,!1,o),C({ok:!0});let s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status)||s.installationRevoked!==void 0&&s.installationRevoked!==!0||s.machine!==void 0&&s.machine!==!0||s.approvals!==void 0&&(!Array.isArray(s.approvals)||s.approvals.some(e=>typeof e?.id!=`string`))||s.postedMessages!==void 0&&(!Array.isArray(s.postedMessages)||s.postedMessages.some(e=>typeof e!=`string`)))return C({error:`Invalid task result`},400);let c=await lc(t,a,!0);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c(t):t)));let l=(t.now??Date.now)(),u=a.task.event?Kc(a.task.event,s.postedMessages??[]):[];if(s.status===`running`||s.status===`waiting`)return u.length&&await qc(t,a.task.event,s.postedMessages,l),await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer},...s.approvals?{approvals:s.approvals}:{}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),(s.approvals||u.length)&&await wh(t,i,!!s.approvals,u.length?l:void 0),C({ok:!0});s.approvals&&await t.queue.patchTask(t.organizationId,i,{approvals:s.approvals},l,{attempts:a.attempts,tokenHash:a.tokenHash}),(s.approvals||u.length)&&await wh(t,i,!!s.approvals,u.length?l:void 0);let d=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),f={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:d,...typeof s.diff==`string`?{diff:s.diff}:{}},p=!o||o.kind===`vercel-sandbox`||o.kind===`local-docker`,m=await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,known:u.map(e=>({id:e,ttlMs:Ic})),logsComplete:!!a.handle&&!p,outcome:{status:s.status,result:f,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:vh(a.task),...a.task.usage?.engine??a.task.definition.engine?{engine:a.task.usage?.engine??a.task.definition.engine}:{},...a.task.usage?.model??a.task.definition.model?{model:a.task.usage?.model??a.task.definition.model}:{},credential:a.task.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l),h=a.task.event;if(m&&s.status===`failed`&&s.installationRevoked&&h&&t.integrations[h.integration]?.isUninstalled&&await rf(t.store,`${h.appId}:${h.installationId}`,l),m&&s.machine){let{reportTaskFailure:e}=await Promise.resolve().then(()=>vu);await e(t,a.task,s.error??`The machine failed`)}return m&&await pu(t,p?a:{...a,logsComplete:!0},!1,o),C({ok:!0})}async function wh(e,t,n,r){let i=(await e.store.get(`task`,t))?.task;i&&(e.waitUntil??(()=>{}))((async()=>{n&&i.context?.approvals&&await $l(e,i,i.context.approvals).catch(e=>console.error(`coder server: could not show the approvals of task ${t}`,e)),r!==void 0&&await ou(e,i,r).catch(e=>console.error(`coder server: could not ask the open approvals of task ${t} again`,e))})())}const Th=/^[a-f0-9-]{36}$/;async function Eh(e,t){let n=t.task.event;if(!n||t.task.source!==n.integration)throw Error(`The task has no conversation`);let r=await e.store.get(`app`,n.appId);if(!r)throw Error(`The conversation app is gone`);let{eventReplies:i}=await Promise.resolve().then(()=>Ou);return{event:n,replies:await i(e,r,n)}}async function Dh(e,t,n,r){let i=e.callbackTask,a=`${t}:${i.task.id}:${i.generation??0}:${n}`,o=(e.now??Date.now)();if(!await e.store.create(`delivery`,a,{at:o},{ttlMs:864e5}))return C({ok:!0,duplicate:!0});try{await r(await Eh(e,i))}catch(t){return await e.store.delete(`delivery`,a),C({error:t instanceof Error?t.message:String(t)},409)}return C({ok:!0})}async function Oh(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!Th.test(n.id))return C({error:`Invalid call id`},400);if(typeof n.text!=`string`||!n.text.trim())return C({error:`Reply text is required`},400);let r=n.text.trim();return Dh(t,`reply`,n.id,async({event:e,replies:n})=>{let i=await n.post(r,!0);i&&await qc(t,e,i.ids??(i.id?[i.id]:[]),(t.now??Date.now)())})}async function kh(e,t){let n=await e.json().catch(()=>void 0);if(typeof n?.id!=`string`||!Th.test(n.id))return C({error:`Invalid call id`},400);if(typeof n.emoji!=`string`||!n.emoji.trim())return C({error:`Emoji is required`},400);if(n.message!==void 0&&(typeof n.message!=`string`||!n.message.trim()))return C({error:`Message id must be a non-empty string`},400);let{emoji:r,message:i}=n;return Dh(t,`react`,n.id,async({replies:e})=>{if(!e.react)throw Error(`The conversation cannot add reactions`);await e.react(r.trim(),i)})}async function Ah(e,t,n,r){n.id,Lh(e);let i=t.callbackTask,a=await e.json().catch(()=>({}));if(typeof a.authJson!=`string`||!i.task.credential)return C({error:`Invalid credential update`},400);let o=typeof a.credentialId==`string`?a.credentialId:i.task.credential;return o!==i.task.credential&&o!==i.task.engineCredentials?.codex?C({error:`Invalid credential update`},400):C({kept:await kp(t.store,t.config,o,a.authJson)})}async function jh(e,t,n,r){n.id,Lh(e);let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await pf(t,i);return C({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return C({error:e instanceof Error?e.message:String(e)},409)}}async function Mh(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...H(t,n.organizationId),session:n}}const Nh=new Set([`owner`,`admin`]);function Ph(e){return!e.auth||Nh.has(e.session?.role??``)}function Fh(e,t){return Ph(e)?e:C({error:t},403)}function Ih(e,t){return!!(e&&t&&jt(e,t))}function Lh(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const Rh=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function zh(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return Rh.has(new URL(`http://${t}`).hostname)}catch{return!1}}const Bh=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,Vh=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,Hh=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function Uh(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(Rh.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||Vh(r)||Hh.some(e=>r.startsWith(e))}function Wh(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(zh(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!zh(e)&&(n.pathname===`/connections/oauth/client.json`||Vh(n.pathname)||Hh.some(e=>n.pathname.startsWith(e)))}function Gh(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function Kh(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function qh(e,t){if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!zh(e))return n();let r=Kh(e),i=Ih(Lh(e),t.config.adminToken),a=Ih(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||Gh(e)?{...t,authorizedRequest:e}:gn():n()}let n=await t.auth.session(e.headers,e.method!==`GET`);if(n?.stale)return C({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(n?.organizationDenied)return C({error:`You are not a member of that workspace.`},403);let r=n?.role;return!n?.organizationId||!r?C({error:`Sign in first.`,hint:`coder auth login`},401,Lh(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!Gh(e,t.config.publicUrl)?gn():{...H(t,n.organizationId),auth:t.auth,session:n,authorizedRequest:e}}async function Jh(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?vn(new URL(e.url)):{...H(t,i.organizationId),session:i}}async function Yh(e,t){if(e.method!==`POST`)return;let n=hh.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=H(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&jt(E(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function Xh(e,t,n,r){let i=n.id,a=Lh(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=Ws(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=H(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function Zh(e,t,n,r,i=!1,a){let o=n.id,s=Lh(e),c=s&&ng(s);c&&t.scope&&(t=H(t,c));let l=await _h(e,t,o,i,a);if(l instanceof Response)return l;let{status:u,loaded:d}=l;return{...t,...d?{store:jc(t.store,u,d)}:{},callbackTask:u}}const Qh=(e,t)=>(n,r,i,a)=>Zh(n,r,i,a,t(n),e),$h=Qh(`secrets`,e=>e.method===`POST`),eg=Qh(`secrets`,()=>!0),tg=Qh(`context`,()=>!1);function ng(e){let{organization:t}=Ws(e);return typeof t==`string`?t:void 0}async function rg(e,t,n){let r=Lh(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=ng(r),a=i&&t.scope&&i!==t.organizationId?H(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!jt(Hs(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function ig(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??bn(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function ag(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??n.id??``))return Yi(e,t);let i=await ig(e,r),a=t.serverOrganizationId??t.organizationId;return i&&oi(t,i)===`*`&&ai(t,i)===a?{...H(t,a),operatorApp:!0}:Jh(e,t)}function og(e,t,n,r){return/^[a-z0-9_-]+$/.test(n.integration??n.id??``)?Jh(e,t):Yi(e,t)}async function sg(e,t,n,r){if(!/^[a-z0-9_-]+$/.test(n.integration??``))return Yi(e,t);if(!t.integrations[n.integration]?.auth.user||!t.auth||!t.config.publicUrl)return _n();if(e.method!==`GET`)return t;let i=await Mh(e,t);return i?.session?i:vn(r)}async function cg(e,t,n,r){if(t.local&&!t.auth)return pg(e,t);if(!t.auth)return _n();let i=await Mh(e,t);return i?.session?i:vn(r)}function lg(e,t){return Fh(t,`Workspace admin access is required.`)}const ug=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function dg(e,t){return ug(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?C({error:`Operator mode ended. Sign in again to continue.`},401):t:_n()}async function fg(e,t,n,r){let i=await Sg(e,t,n,r);return i instanceof Response||!t.auth?i:ug(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):_n()}function pg(e,t){return t.local?t:_n()}function mg(e,t){return t.local?C({error:ep},400):t.session?.user.id?t:C({error:`Sign in to use a subscription.`},403)}function hg(e){return async(t,n,r,i)=>{let a=n.authorizedRequest===t?n:await qh(t,n);return a instanceof Response?a:e?e(t,a,r,i):a}}function gg(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!np(n.engine))?C({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function _g(e,t,n,r){return t.config.publicUrl&&t.auth?t:Yi(e,t)}async function vg(e,t,n,r){if(!t.auth)return qh(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?C({error:`You are not a member of that workspace.`},403):i?{...t,session:i}:C({error:`Sign in first.`,hint:`coder auth login`},401)}function yg(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!zh(e)?_n():Gh(e)?t:gn():t}async function bg(e,t,n,r){return e.method===`GET`?{...t,session:(await Mh(e,t))?.session}:t}async function xg(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await Mh(e,t))?.session?w(`/dash`):t}async function Sg(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return Ui(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return w(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await Oi(u,t.dashboardHosts)?w(`${u}${r.search}`):t.auth&&e.method===`GET`&&await Oi(`${c}${l}`,t.dashboardHosts)?w(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):_n()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...H(t,c.id),session:o}):t}function Cg(e,t,n,r){return e.method===`POST`&&t.local?C({error:ep},400):t}async function wg(e,t,n,r){if(![`GET`,`POST`].includes(e.method))return t;if(!t.auth)return _n();if(e.headers.get(`authorization`)?.startsWith(`Bearer `))return C({error:`Link your account from the browser.`},403);let i=await Mh(e,t);return i?.session?i:e.method===`GET`?vn(r):C({error:`Sign in first.`},401)}function Tg(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:_n()}async function Eg(e,t,n,r){if(!t.auth)return C({mode:Bh(t),organization:{id:t.organizationId,slug:`local`},server:Dg(t),operator:ug(t)});let i=t.session;return C({mode:Bh(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:Dg(t),operator:ug(t,i)})}function Dg(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function Og(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function kg(e,t){let n=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug??t?.slug;return n||!e.auth?n??`local`:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const Ag=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function jg(e,t,n){let r=e.integrations[n]?.events;return{name:e.name??t,...e.description?{description:e.description}:{},events:Array.isArray(r)?r:Object.keys(r??{}),...e.access?{access:e.access}:{},commands:[{command:`/setup`,description:`Configure this agent`,usage:`repo owner/name | model <name> | show`}]}}function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??Ag(Og(e),`/setup`);return w(`${Mg(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const Mg=e=>e.local?`http://localhost:${e.local.port}`:``,Ng=(e,t)=>Ag(Og(e),`/agents/${encodeURIComponent(t)}/platforms`);function Pg(e){let t=e.get(`agent`),n=e.get(`def`),r=bn(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const Fg=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,Ig=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function Lg(e,t,n,r){let i=await ui(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=bn(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await ci(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}var Rg=r({serverAppLink:()=>Bg,serverAppUrl:()=>Vg,sharedApps:()=>zg});async function zg(e,t){let n=e.serverOrganizationId&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store;return(await(n===e.store&&t?t:n.list(`app`))).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.shareable)}async function Bg(e,t={}){let n=Sn(t.env??kr.env),r=Nt(n.integrations);if(!r[e])throw new rt(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(!r[e].app.shareable)throw new rt(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new rt(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await uo(n);try{let a=i.defaultOrganizationId;return{url:await Vg({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function Vg(e,t,n){if(!e.integrations[t]?.app.shareable)throw new rt(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=bt();if(!r)throw new rt(`invalid-option`,`This server ships no default agent.`);let i={...Ct()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:dn(i),...n.owner?{owner:n.owner}:{},public:!0},o=await ni(e,`create`,`*`,Ig(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${Mg(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{xh as $,Na as $n,jd as $t,Wh as A,Oo as An,Rp as At,Fh as B,uo as Bn,Xf as Bt,ag as C,lc as Cn,ui as Cr,Ip as Ct,gg as D,Y as Dn,Fp as Dt,yg as E,ss as En,Lp as Et,_g as F,vo as Fn,Df as Ft,Uh as G,io as Gn,Zd as Gt,$h as H,za as Hn,ef as Ht,sg as I,Co as In,Cf as It,bh as J,Ra as Jn,Qd as Jt,Zh as K,eo as Kn,Wd as Kt,dg as L,xo as Ln,If as Lt,mg as M,Do as Mn,op as Mt,rg as N,ho as Nn,Hf as Nt,Xh as O,Vo as On,jp as Ot,eg as P,wo as Pn,Uf as Pt,Ah as Q,Aa as Qn,Id as Qt,fg as R,yo as Rn,Lf as Rt,tg as S,cc as Sn,fi as Sr,mm as St,Sg as T,Vs as Tn,cp as Tt,Bh as U,$a as Un,zd as Ut,Gh as V,po as Vn,af as Vt,xg as W,Qa as Wn,Xd as Wt,jh as X,ka as Xn,Jd as Xt,Sh as Y,La as Yn,Ud as Yt,yh as Z,Fa as Zn,vd as Zt,vg as _,fu as _n,_i as _r,Qp as _t,jg as a,Cd as an,ia as ar,dh as at,Tg as b,wc as bn,pi as br,fm as bt,Mg as c,Td as cn,H as cr,gh as ct,Pg as d,ud as dn,Vi as dr,Gm as dt,Nd as en,oa as er,Ch as et,Lg as f,fd as fn,Hi as fr,Rm as ft,Rh as g,xu as gn,Wi as gr,gm as gt,Og as h,ed as hn,Ri as hr,Em as ht,zg as i,Ld as in,ra as ir,ch as it,pg as j,mo as jn,zp as jt,og as k,Ho as kn,bp as kt,$ as l,gd as ln,Ti as lr,sh as lt,Eg as m,nd as mn,Ki as mr,Ym as mt,Bg as n,Md as nn,Sa as nr,Oh as nt,Fg as o,wd as on,na as or,oh as ot,Ag as p,dd as pn,Ji as pr,Jm as pt,wg as q,ao as qn,$d as qt,Vg as r,Rd as rn,aa as rr,lh as rt,Ig as s,Ed as sn,Zi as sr,mh as st,Rg as t,Ad as tn,Da as tr,kh as tt,Ng as u,ld as un,Yi as ur,uh as ut,hg as v,gu as vn,vi as vr,pm as vt,Cg as w,Us as wn,ni as wr,Sp as wt,cg as x,Ec as xn,mi as xr,Bp as xt,lg as y,_u as yn,gi as yr,hm as yt,bg as z,So as zn,Of as zt};