@wular/coder 0.4.6 → 0.4.8

package/dist/archive-BhfGdyuC.js

@@ -0,0 +1,3 @@
+import{i as e}from"./cli-D5hyqGq0.js";import{p as t}from"./output-BKeyLbvt.js";import{n,t as r}from"./args-CxsMr9Un.js";import i from"node:process";const a=e=>e===1?``:`s`,o=e({name:`flow archive`,help:{usage:`coder flow archive <run-id> | coder flow archive --all-stopped`,summary:`Archive a flow run so it drops out of the default list (see it again with
+\`coder flow list --archived [--limit N]\`). Pass --all-stopped to archive every
+finished run. A running run must be stopped first.`,flags:[[`--all-stopped`,`archive every stopped (finished) run`]]},options:{...r,"all-stopped":n},args:1,run:async({options:e,args:[t]})=>{let{archiveRuns:n}=await import(`./executor-5j-Ewzzb.js`).then(e=>e.b);return n(t,{allStopped:e[`all-stopped`]})},print(e){if(!(`count`in e))return void i.stdout.write(`Archived run ${t.cyan(e.runId)}.\n`);i.stdout.write(e.count?`Archived ${e.count} stopped run${a(e.count)}.\n`:`${t.dim(`No stopped runs to archive.`)}\n`)}});export{o as commandArchive,a as plural};

package/dist/archive-DxWYJ7Zi.js

@@ -0,0 +1,4 @@
+import{i as e,r as t}from"./cli-D5hyqGq0.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-CxsMr9Un.js";import s from"node:process";const c={server:r,workspace:a,yes:i},l=e=>e===1?``:`s`,u=e({name:`task archive`,help:{usage:`coder task archive <task-id> | coder task archive --all-stopped [--server [url]]`,summary:`Archive a task session so it drops out of the default list (see it again with
+\`coder task list --archived [--limit N]\`). Pass --all-stopped to archive every
+finished task. A running task keeps running; steering an archived task
+brings it back.`,flags:[[`--all-stopped`,`archive every stopped (finished) task`],t]},options:{...o,"all-stopped":i,...c},args:1,run:async({options:e,args:[t]})=>{let{tasks:n}=await import(`./task-IoBYe7ok.js`).then(e=>e.t);return n.archive(t,{...e,organization:e.workspace,allStopped:e[`all-stopped`]})},print(e,{options:t}){if(e.count===void 0)return void s.stdout.write(`Archived task ${n.cyan(e.taskId)}.\n`);s.stdout.write(t.server===void 0?e.count?`Archived ${e.count} stopped task${l(e.count)}.\n`:`${n.dim(`No stopped tasks to archive.`)}\n`:`Archived ${e.count} server task${l(e.count)}.\n`)}});export{u as commandArchive,l as plural};

package/dist/archive-sweep-CqTQUafj.js

@@ -0,0 +1 @@
+import{i as e}from"./cli-D5hyqGq0.js";import{n as t,s as n}from"./args-CxsMr9Un.js";const r=e({name:`task archive-sweep`,options:{cwd:n,flows:t},args:1/0,run:async({options:e,args:t,cwd:n})=>{let{archiveFlagged:r}=await import(`./actions-5TDwmn_z.js`).then(e=>e.t),{archiveFlaggedRuns:i}=await import(`./executor-5j-Ewzzb.js`).then(e=>e.b);return e.flows?i(t):r(n,t)}});export{r as commandArchiveSweep};

package/dist/args-CxsMr9Un.js

@@ -0,0 +1 @@
+import{Gt as e,Zt as t}from"./core-DwsAMCnL.js";import{An as n,Dn as r,Hn as i,Ln as a,Mn as o,Nn as s,On as c,Wn as l,jn as u}from"./config-D2FxHWwi.js";import{H as d}from"./dispatch-D3Dqxijf.js";const f=a(u()),p=a(i()),m=a(n(i())),h=a(l([i(),s(!0)])),g=c(h,!0),_={cwd:p,json:f},v=a(l([s(`all`),r().check(o(),t())],{error:`expected a positive integer or "all"`})),y=a(l([s(`all`),r().check(o(),e())],{error:`expected a number or "all"`}));function b(e){let t=e.def;for(;t;){if(t.type===`union`)return t.options.some(e=>e.def.type===`literal`);let e=t.innerType??t.in;t=e?e.def:void 0}return!1}function x(e,t){let n=e.def;for(;n;){if(n.type===t)return!0;let e=n.innerType??n.in;n=e?e.def:void 0}return!1}const S=e=>x(e,`boolean`);function C(e,t,n={}){let r=t.shape,i={},a=[],o=!1,s=(e,t,n,a)=>{let o=r[t],s=a?`-`:`--`;if(!o)throw Error(`Unknown option ${s}${e} (use -- to pass literal text starting with -)`);if(S(o))return i[t]=n===void 0||n!==`false`,0;if(b(o)&&(n===void 0||n.startsWith(`-`)))return i[t]=!0,0;if(n===void 0)throw Error(`Missing value for ${s}${e}`);return i[t]=x(o,`array`)?[...i[t]??[],n]:n,1};for(let t=0;t<e.length;t+=1){let n=e[t];if(o){a.push(n);continue}if(n===`--`){o=!0;continue}if(!n.startsWith(`-`)||n===`-`){a.push(n);continue}if(n.startsWith(`--`)){let[i,a]=n.slice(2).split(`=`,2);a===void 0&&r[i]&&!S(r[i])?t+=s(i,i,e[t+1],!1):s(i,i,a,!1);continue}let i=n.slice(1);r[i]&&!S(r[i])?t+=s(i,i,e[t+1],!0):s(i,i,void 0,!0)}let c=t.safeParse(i);if(!c.success){let e=c.error.issues[0],t=String(e.path[0]??``),n=i[t];throw Error(n===void 0?`Missing required --${t}.`:`Invalid --${t} value ${JSON.stringify(n)}: ${e.message}`)}let l=n.positionals??0;if(a.length>l){let e=a.slice(l);throw new d(`invalid-option`,`Unexpected argument${e.length>1?`s`:``}: ${e.join(` `)}`,n.command?{hint:`Help: coder ${n.command} --help`}:{})}return{options:c.data,positionals:a}}export{C as a,m as c,h as i,y as l,f as n,g as o,v as r,p as s,_ as t};

package/dist/ask-B_si1yM4.js

@@ -0,0 +1,4 @@
+import{i as e,r as t}from"./cli-D5hyqGq0.js";import{p as n}from"./output-BKeyLbvt.js";import{i as r,n as i,s as a,t as o}from"./args-CxsMr9Un.js";import{idAndText as s}from"./steer-DwSC8AO4.js";import c from"node:process";const l={server:r,workspace:a,yes:i},u=e({name:`task ask`,help:{usage:`coder task ask <task-id> "<question>" [--server [url]]`,summary:`Answer a question ABOUT a task without touching it: a read-only sidecar reads
+the task's progress log, result, and workspace and answers; the task never
+sees the question and its thread is not steered. Works whether the task is
+running or stopped. To change what the task does, use \`coder task steer\`.`,flags:[[`--model <alias|slug>`,`sidecar model (default: the task's own)`],[`--effort <low|medium|high>`,`sidecar reasoning effort`],t],examples:[[`coder task ask task-abc "what approach did you take and why?"`,`probe a decision without derailing the task`]]},options:{...o,model:a,effort:a,...l},args:1/0,async run({options:e,args:t}){let{tasks:r}=await import(`./task-IoBYe7ok.js`).then(e=>e.t),{id:i,text:a}=s(t,`Missing task id or question.`,[`Usage: coder task ask <task-id> "<question>"`,`Help: coder task ask --help`]);return r.ask(i,a,{...e,organization:e.workspace,onAsking:t=>e.json||c.stderr.write(`${n.dim(`[coder]`)} asking about task ${n.cyan(t)} (read-only sidecar; the task is not interrupted)...\n`)})},json:({ok:e,...t})=>t,print(e,{options:t,args:[r]}){if(t.server!==void 0)return void c.stdout.write(`Asked server task ${n.cyan(r)}.\n`);let{answer:i,error:a}=e;i?c.stdout.write(`\n${i}\n`):c.stdout.write(`${n.dim(`(no answer)`)}${a?` ${n.red(a)}`:``}\n`)},exit:(e,{options:t})=>t.server===void 0?+!e.ok:void 0});export{u as commandAsk};

package/dist/auth-B3RiDPMI.js

@@ -0,0 +1 @@
+import{$ as e,A as t,B as n,C as r,D as i,E as a,F as o,G as s,H as c,I as l,J as u,K as d,L as f,M as p,N as m,O as h,P as g,Q as _,R as v,S as y,T as b,U as x,V as S,W as C,X as w,Y as T,Z as E,_ as D,a as O,at as k,b as ee,c as A,ct as j,d as M,dt as te,et as N,f as ne,ft as re,g as ie,gt as ae,ht as oe,i as se,it as ce,j as le,k as ue,lt as de,m as fe,mt as P,n as pe,nt as me,o as he,ot as F,p as ge,pt as _e,q as ve,r as ye,rt as be,s as xe,st as Se,tt as Ce,ut as we,v as Te,vt as Ee,w as De,x as Oe,y as ke,z as Ae}from"./build-CmtlB7pX.js";import{i as je,l as Me}from"./http-BYMXT_p6.js";import{Cr as Ne,_n as Pe,pr as Fe,wr as Ie,z as Le}from"./apps-aj_JtpAm.js";import{M as I,j as L,l as R}from"./schema-BSlHRFSP.js";import{a as Re,i as ze,o as Be}from"./serve-HNXk3HMY.js";import{createECDH as Ve,hkdfSync as He}from"node:crypto";function Ue(e,t,n){if(!S(e,t,n))throw new N(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function We(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new N(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,i,a,c,l,d,f,p,m]=e;if(l!==void 0&&v(l,`JWE Additional Authenticated Data`),d!==void 0&&v(d,`JWE Content Encryption Key`),f!==void 0&&v(f,`JWE Initialization Vector`),!n&&i!==void 0&&(i=s(N,i)[0],e[1]=i),a!==void 0&&(a=s(N,a)[0],e[2]=a),!n&&c!==void 0&&(c=s(N,c)[0],e[3]=c),p!==void 0&&!x(p))throw TypeError(`JWE Key Management Parameters must be an object`);Ue(i,a,c);let h={...i,...a,...c};T(N,i),u(N,o,m,i,h),ke(h,i);let{alg:g,enc:_}=h;if(typeof g!=`string`||!g)throw new N(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let y=Oe[g];if(y?.mode===`integrated-encryption`){if(_!==void 0)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(d!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${g}`);if(f!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${g}`);return[h,void 0,y]}if(typeof _!=`string`||!_)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[h,r(_),y]}async function Ge(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,m,,h]=e,g=s,_=c,v=a??y(r.alg),x,S,C;v.mode===`integrated-encryption`?C=await p(v,n,`encrypt`):[C,x,S]=await ee(v,i,n,r,d,m),S&&(h?_=_?{..._,...S}:S:g=g?{...g,...S}:S,Ue(g,_,l));let T=g?w(JSON.stringify(g)):``,E=u?.byteLength?w(u):void 0,D=P(E?`${T}.${E}`:T),O=o;r.zip===`DEF`&&(O=await Te(O).catch(e=>{throw new N(`Failed to compress plaintext`,{cause:e})}));let k,A,j;v.mode===`integrated-encryption`?[x,k]=await v.encrypt(C,O,D,g,r,m):{ciphertext:k,tag:A,iv:j}=await b(i,O,C,f,D);let M={ciphertext:w(k)};return j&&(M.iv=w(j)),A&&(M.tag=w(A)),x?.byteLength&&(M.encrypted_key=w(x)),E&&(M.aad=E),g&&(M.protected=T),l&&(M.unprotected=l),_&&(M.header=_),M}async function Ke(e,t,n){return Ge(e,We(e,n),t)}function qe(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}const z=[[`verify`],[`sign`]];function Je(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:z}}function B(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:z,minRsaBits:2048}}function Ye(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:z}}function Xe(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:z}}function Ze(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:z}}const Qe=De({HS256:Je(256),HS384:Je(384),HS512:Je(512),RS256:B(256),RS384:B(384),RS512:B(512),PS256:B(256,32),PS384:B(384,48),PS512:B(512,64),ES256:Ye(`P-256`,256),ES384:Ye(`P-384`,384),ES512:Ye(`P-521`,512),EdDSA:Xe(),Ed25519:Xe(),"ML-DSA-44":Ze(44),"ML-DSA-65":Ze(65),"ML-DSA-87":Ze(87)});function $e(t){let n=typeof t==`string`?Qe[t]:void 0;if(!n)throw new e(`alg ${t} is not supported either by JOSE or your javascript runtime`);return n}function et(e){return[e&&d(`algorithms`,e.algorithms),e?.crit]}function tt(e){return e===void 0?{}:C(e,F,`JWS Protected Header is invalid`)}function nt(e){try{return P(e)}catch{throw new F(`JWS Compact Serialization payload must use only ASCII characters`)}}async function rt(e,t,r,i,o){let{protected:s,header:c,payload:d}=e,f=o??tt(s);if(!S(f,c))throw new F(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let h={...f,...c},g=ve(f,u(F,l,t[1],f,h)),{alg:_}=h;if(typeof _!=`string`||!_)throw new F(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(_))throw new E(`"alg" (Algorithm) Header Parameter value not allowed`);if(g){if(typeof d!=`string`)throw new F(`JWS Payload must be a string`)}else if(typeof d!=`string`&&!(d instanceof Uint8Array))throw new F(`JWS Payload must be a string or an Uint8Array instance`);let v=g||typeof d!=`string`?d:i(d),y=!1;typeof r==`function`&&(r=await r(f,e),y=!0);let b=$e(_),x=te(s===void 0?new Uint8Array:P(s),P(`.`),typeof v==`string`?t[2]??=n(v,`payload`,F):v),C=Ae(e.signature,`signature`,F),w=await p(b,r,`verify`),T=await m(w,b.subtle,`verify`);b.minRsaBits&&a(b.alg,T);let D=!1;try{D=await crypto.subtle.verify(b.signing,T,C,x)}catch{}if(!D)throw new Se;let O={payload:typeof v==`string`?Ae(v,`payload`,F):v};return s!==void 0&&(O.protectedHeader=f),c!==void 0&&(O.unprotectedHeader=c),y?[{...O,key:w},g]:[O,g]}async function it(e,t,n){if(e instanceof Uint8Array&&(e=re.decode(e)),typeof e!=`string`)throw new F(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new F(`Invalid Compact JWS`);return rt({payload:i,protected:r,signature:a},t,n,nt)}const V=e=>Math.floor(e.getTime()/1e3),at={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},ot=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,H=`check_failed`;function st(){throw TypeError(`Invalid time period format`)}function U(e){typeof e!=`string`&&st();let t=ot.exec(e);(!t||t[4]&&t[1])&&st();let n=parseFloat(t[2]),r=Math.round(n*at[t[3][0].toLowerCase()]);return Number.isFinite(r)||st(),t[1]===`-`||t[4]===`ago`?-r:r}function W(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function ct(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function lt(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function ut(e,t){return typeof e==`number`?W(t,e):e instanceof Date?W(t,V(e)):V(new Date)+U(e)}const dt=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},ft=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function pt(e,t,n=!1){let r=e[t];if(!(r===void 0&&!n)){if(typeof r!=`number`)throw new j(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function mt(e,t){throw new j(`unexpected "${t}" claim value`,e,t,H)}function ht(e,t,n={}){let r;try{r=JSON.parse(ae.decode(t))}catch{}if(!x(r))throw new we(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||dt(e.typ)!==dt(i)))throw new j(`unexpected "typ" JWT header value`,r,`typ`,H);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new j(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&mt(r,`iss`),s!==void 0&&r.sub!==s&&mt(r,`sub`),c!==void 0&&!ft(r.aud,typeof c==`string`?[c]:c)&&mt(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=U(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}W(`clockTolerance option`,f);let{currentDate:p}=n,m=W(`currentDate option`,V(p===void 0?new Date:p)),h=pt(r,`iat`,l!==void 0),g=pt(r,`nbf`);if(g!==void 0&&g>m+f)throw new j(`"nbf" claim timestamp check failed`,r,`nbf`,H);let _=pt(r,`exp`);if(_!==void 0&&_<=m-f)throw new de(`"exp" claim timestamp check failed`,r,`exp`,H);if(l!==void 0){let e=m-h,t=W(`maxTokenAge option`,typeof l==`number`?l:U(l));if(e-f>t)throw new de(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,H);if(e<-f)throw new j(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,H)}return r}let gt;function G(e){return gt.get(e)}function _t(e){let t=G(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return oe.encode(JSON.stringify(t))}function vt(e,t){return G(e)[t]}var yt=class{constructor(e={}){if(!x(e))throw TypeError(`JWT Claims Set MUST be an object`);(gt||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return ct(`iss`,e),G(this).iss=e,this}setSubject(e){return ct(`sub`,e),G(this).sub=e,this}setAudience(e){return lt(e),G(this).aud=e,this}setJti(e){return ct(`jti`,e),G(this).jti=e,this}setNotBefore(e){return G(this).nbf=ut(e,`setNotBefore`),this}setExpirationTime(e){return G(this).exp=ut(e,`setExpirationTime`),this}setIssuedAt(e){let t=G(this);return t.iat=e===void 0?V(new Date):typeof e==`string`?W(`setIssuedAt`,V(new Date)+U(e)):ut(e,`setIssuedAt`),this}};async function bt(e,t,n){let[r,i]=await it(e,et(n),t);if(!i)throw new we(`JWTs MUST NOT use unencoded payload`);let a=ht(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function xt(e,t,n){let{plaintext:r,...i}=await ie(e,D(n),t),{protectedHeader:a}=i,o=ht(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new j(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}const St=yt;var Ct=class extends St{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return f(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return f(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return f(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return f(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=_t(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?vt(this,`iss`):void 0,sub:this.#n?vt(this,`sub`):void 0,aud:this.#r?vt(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,qe(await Ke(r,e,t))}};async function wt(e){if(t(e))if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`});if(e instanceof Uint8Array)return{kty:`oct`,k:w(e)};if(!h(e))throw TypeError(i(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let n=await crypto.subtle.exportKey(`jwk`,e);delete n.ext,delete n.key_ops,delete n.use,n.kty!==`AKP`&&delete n.alg;for(let e of Object.keys(n))n[e]===void 0&&delete n[e];return n}const K=(e,t)=>{if(typeof e!=`string`||!e)throw new Ce(`${t} missing or invalid`)};async function Tt(t,n){let r;if(x(t)){if(r=g(t),typeof r.kty!=`string`)throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(ue(t))r=g(await wt(t));else throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(n??=`sha256`,n!==`sha256`&&n!==`sha384`&&n!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let a;switch(r.kty){case`AKP`:K(r.alg,`"alg" (Algorithm) Parameter`),K(r.pub,`"pub" (Public key) Parameter`),a={alg:r.alg,kty:r.kty,pub:r.pub};break;case`EC`:K(r.crv,`"crv" (Curve) Parameter`),K(r.x,`"x" (X Coordinate) Parameter`),K(r.y,`"y" (Y Coordinate) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case`OKP`:K(r.crv,`"crv" (Subtype of Key Pair) Parameter`),K(r.x,`"x" (Public Key) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x};break;case`RSA`:K(r.e,`"e" (Exponent) Parameter`),K(r.n,`"n" (Modulus) Parameter`),a={e:r.e,kty:r.kty,n:r.n};break;case`oct`:if(typeof r.k!=`string`)throw new Ce(`"k" (Key Value) Parameter missing or invalid`);a={k:r.k,kty:r.kty};break;default:throw new e(`"kty" (Key Type) Parameter missing or unsupported`)}let o=P(JSON.stringify(a));return w(await _e(n,o))}function Et(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function Dt(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=le(n,t,!0).then(e=>{if(e.type!==`public`)throw new me(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function Ot(t){let n;try{n=structuredClone(t)}catch{}if(!c(n))throw new me(`JSON Web Key Set malformed`);let r=n.keys.map(e=>{let t=g(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),i=new WeakMap;return Object.defineProperty(async(t,a)=>{let{alg:o,kid:s}={...t,...a?.header},c=typeof o==`string`?Qe[o]:void 0;if(!c||c.secret)throw new e(`Unsupported "alg" value for a JSON Web Key Set`);let l=n.keys.filter((e,t)=>Et(r[t],c,o,s)),{0:u,length:d}=l;if(!d)throw new ce;if(d!==1){let e=new be;throw e[Symbol.asyncIterator]=async function*(){for(let e of l)try{yield await Dt(i,e,c)}catch{}},e}return Dt(i,u,c)},"jwks",{value:()=>structuredClone(n)})}function kt(){return typeof WebSocketPair<`u`||typeof navigator<`u`&&navigator.userAgent===`Cloudflare-Workers`||typeof EdgeRuntime<`u`&&EdgeRuntime===`vercel`}let At;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(At=`jose/v6.2.12`);const jt=Symbol();async function Mt(e,t,n,r=fetch){let i=await r(e,{method:`GET`,signal:n,redirect:`manual`,headers:t}).catch(e=>{throw e.name===`TimeoutError`?new k:e});if(i.status!==200)throw new _(`Expected 200 OK from the JSON Web Key Set HTTP response`);try{return await i.json()}catch{throw new _(`Failed to parse the JSON Web Key Set HTTP response as JSON`)}}const Nt=Symbol();function q(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Pt(e,t,n){if(Number.isNaN(e))throw TypeError(`"${n}" option must not be NaN`);return typeof e==`number`?e:t}function Ft(e,t){if(!(e instanceof URL))throw TypeError(`url must be an instance of URL`);let n=new URL(e.href).href,r=t??{},i=r.timeoutDuration;if(typeof i==`number`&&(!Number.isInteger(i)||i<0))throw TypeError(`"timeoutDuration" option must be a non-negative integer`);let a=typeof i==`number`?i:5e3,o=Pt(r.cooldownDuration,3e4,`cooldownDuration`),s=Pt(r.cacheMaxAge,6e5,`cacheMaxAge`),l=new Headers(r.headers);At&&!l.has(`User-Agent`)&&l.set(`User-Agent`,At),l.has(`accept`)||l.set(`accept`,`application/json, application/jwk-set+json`);let u=r[jt],d=r[Nt],f,p,m=0,h=0,g;if(d&&typeof d==`object`){let{uat:e,jwks:t}=d;q(e,s)&&c(t)&&(f=e,g=Ot(t))}let _=async()=>{if(p&&kt()&&(p=void 0),!p){let e=++m,t=p=Mt(n,l,AbortSignal.timeout(a),u).then(t=>{let n=Ot(t);if(e<=h)return;g=n;let r=Date.now();d&&(d.uat=r,d.jwks=t),f=r,h=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{(!g||!q(f,s))&&await _();try{return await g(e,t)}catch(n){if(n instanceof ce&&!q(f,o))return await _(),g(e,t);throw n}},{coolingDown:{get:()=>q(f,o),enumerable:!0},fresh:{get:()=>q(f,s),enumerable:!0},reload:{value:_,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}const It=(e,t)=>new Uint8Array(He(`sha256`,e,``,t,32));async function Lt(e){let t=It(e,`coder oidc client key`),n=Ve(`prime256v1`);n.setPrivateKey(t);let r=n.getPublicKey(),i={kty:`EC`,crv:`P-256`,x:Buffer.from(r.subarray(1,33)).toString(`base64url`),y:Buffer.from(r.subarray(33)).toString(`base64url`)},a=await crypto.subtle.importKey(`jwk`,{...i,d:Buffer.from(t).toString(`base64url`)},{name:`ECDSA`,namedCurve:`P-256`},!1,[`sign`]),o=await Tt(i);return{key:a,kid:o,jwk:{...i,kid:o,alg:`ES256`,use:`sig`}}}async function Rt(e){let t=[e.encryptionKey,e.previousEncryptionKey].filter(e=>!!e),n=await Promise.all(t.map(Lt));return{cookie:t.map(e=>It(e,`coder session cookie`)),client:n[0],jwks:{keys:n.map(e=>e.jwk)}}}const J=`${Ne}.session`,Y=`${Ne}.oidc`,X=`${Ne}.operator`,zt=3800,Bt=2592e3,Vt=3600,Z=()=>Math.floor(Date.now()/1e3);function Q(e){let t=new Map;for(let n of(e.get(`cookie`)??``).split(/;\s*/)){let e=n.indexOf(`=`);e>0&&t.set(n.slice(0,e),n.slice(e+1))}return t}function Ht(e){let t=[];for(;e.has(`${J}.${t.length}`);)t.push(`${J}.${t.length}`);return t}function $(e){let t=Q(e);return t.get(J)??(Ht(t).map(e=>t.get(e)).join(``)||void 0)}function Ut(e){return Array.isArray(e)?e.flatMap(e=>typeof e?.id==`string`&&typeof e.role==`string`?[{id:e.id,slug:String(e.slug??e.id),name:String(e.name??e.slug??e.id),role:e.role}]:[]):[]}function Wt(e){let t=(e?.orgs.find(t=>t.id===e.org)??e?.orgs[0])?.slug;return t?`/dash/${encodeURIComponent(t)}/operator`:`/dash/operator`}function Gt(e,t,n){let r=e.get(`x-coder-organization`);if(r)return Fe(t,r);let i=t.organizations.find(e=>e.id===n)??t.organizations[0];return i?{...t,organizationId:i.id,role:i.role}:t}async function Kt(e,t){let n=t.auth.wular.url,r=t.publicUrl,i=new URL(r).origin,a=r.startsWith(`https:`),o=await Rt(t),s=t=>t instanceof Pe?t.db:e,c=`${r}${ze}`,l=(e,t,n)=>`${e}=${t}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${n}${a?`; Secure`:``}`,u=(e,t)=>new Ct(e).setProtectedHeader({alg:`dir`,enc:`A256GCM`}).setIssuedAt().setExpirationTime(`${t}s`).encrypt(o.cookie[0]);async function d(e){if(e)for(let t of o.cookie)try{return(await xt(e,t)).payload}catch{}}async function f(e,t){let n=await u(t,Bt),r=Ht(Q(e));if(n.length<=zt)return[l(J,n,Bt),...r.map(e=>l(e,``,0))];let i=n.match(RegExp(`.{1,${zt}}`,`g`));return[l(J,``,0),...i.map((e,t)=>l(`${J}.${t}`,e,Bt)),...r.slice(i.length).map(e=>l(e,``,0))]}let p=e=>[J,...Ht(Q(e))].map(e=>l(e,``,0)),m,h=()=>m??=A(new URL(n),`${r}${Be}`,void 0,pe(o.client),new URL(n).protocol===`http:`?{execute:[ye]}:void 0).catch(e=>{throw m=void 0,e}),g,_=async()=>g??=Ft(new URL((await h()).serverMetadata().jwks_uri));function v(e,t){let n=e.claims();if(!n)throw Error(`Wular Auth returned no ID token`);let r=Ut(n.organizations),i=e=>r.find(t=>t.id===e)?.id;return{sub:n.sub,name:typeof n.name==`string`?n.name:``,email:typeof n.email==`string`?n.email:``,orgs:r,org:i(t?.org)??i(n.org)??r[0]?.id,exp_at:Z()+(e.expires_in??600),at:Z(),rt:e.refresh_token??t?.rt,idt:e.id_token??t?.idt}}let y=async t=>{try{await Promise.all(t.map(({id:t,slug:n,name:r})=>new Pe(e,t).put(`delivery`,`workspace`,{slug:n,name:r})))}catch(e){console.error(`coder server: saving organizations failed`,e)}},b=new Map;function x(e){let t=e.rt;if(!t)return Promise.resolve(void 0);let n=b.get(t);return n||(n=h().then(e=>fe(e,t)).then(t=>v(t,e)).then(e=>(y(e.orgs),e)).catch(e=>(b.delete(t),e instanceof Ee&&e.error===`invalid_grant`?!1:void 0)),b.set(t,n),setTimeout(()=>b.delete(t),6e4).unref?.()),n.then(t=>t&&t.orgs.some(t=>t.id===e.org)?{...t,org:e.org}:t)}async function S(e,t,r){let a=(await _().then(t=>bt(e,t,{issuer:n,audience:i,typ:`at+jwt`})).catch(()=>void 0))?.payload;if(!a?.sub)return;let o={user:{id:a.sub,name:``,email:``},organizations:Ut(a.organizations)};return r&&Z()-(a.iat??0)>60?{...o,stale:!0}:Gt(t,o,typeof a.org==`string`?a.org:void 0)}async function C(e){let t=await h().catch(()=>void 0);if(!t)return Response.redirect(`${r}/login?error=unavailable`,302);let n=e.searchParams.get(`operator`)===`1`,a=e.searchParams.get(`prompt`)===`login`,o={verifier:ne(),state:ge(),nonce:M(),return:n?`/dash`:Ie(e.searchParams.get(`return`),i),...n?{operator:n}:{}},s=O(t,{redirect_uri:c,...n?{scope:`openid`,prompt:`login`}:{scope:Re},...a?{prompt:`login`}:{},code_challenge:await xe(o.verifier),code_challenge_method:`S256`,state:o.state,nonce:o.nonce});return new Response(null,{status:302,headers:{location:s.href,"set-cookie":l(Y,await u(o,600),600)}})}async function w(e,t){let n=e=>{let t=new Headers({location:`/login?error=${encodeURIComponent(e)}`});return t.append(`set-cookie`,l(Y,``,0)),new Response(null,{status:302,headers:t})},r=await d(Q(e.headers).get(Y));if(!r)return n(`expired`);let i=t.searchParams.get(`error`);if(i)return n(i);let a,o;try{let e=await se(await h(),new URL(`${c}${t.search}`),{pkceCodeVerifier:r.verifier,expectedState:r.state,expectedNonce:r.nonce,idTokenExpected:!0});a=v(e),o=e.claims()?.auth_time}catch{return n(`sign_in_failed`)}if(r.operator)return E(e,a.sub,o);await y(a.orgs);let s=new Headers({location:r.return});s.append(`set-cookie`,l(Y,``,0));for(let t of await f(e.headers,a))s.append(`set-cookie`,t);return new Response(null,{status:302,headers:s})}let T=e=>u(e,e.at+Vt-e.seen).then(t=>l(X,t,e.at+Vt-e.seen));async function E(e,n,r){let a=await d($(e.headers)),o=Z(),s=typeof r==`number`&&o-r<=60,c=s&&a?.sub===n&&t.operators?.includes(n),u=new Headers({location:c?Wt(a):`${Wt(a)}?error=${s?`denied`:`stale`}`});return u.append(`set-cookie`,l(Y,``,0)),c&&u.append(`set-cookie`,await T({sub:n,aud:i,at:o,seen:o})),new Response(null,{status:302,headers:u})}async function D(e){if(!Le(e,r))return je();let t=await d($(e.headers)),n=await h().catch(()=>void 0),i=`${r}/?signed_out=1`,a=n?.serverMetadata().end_session_endpoint&&t?.idt?he(n,{id_token_hint:t.idt,post_logout_redirect_uri:i}).href:i,o=Response.json({url:a});for(let t of p(e.headers))o.headers.append(`set-cookie`,t);return o.headers.append(`set-cookie`,l(X,``,0)),o}return{issuer:n,jwks:o.jwks,handler(e){let t=new URL(e.url);return t.pathname===`/api/auth/sign-in`&&e.method===`GET`?C(t):t.pathname===`/api/auth/callback`&&e.method===`GET`?w(e,t):t.pathname===`/api/auth/sign-out`&&e.method===`POST`?D(e):Promise.resolve(Me())},async session(e,t=!1,n=[]){let r=e.get(`authorization`);if(r?.startsWith(`Bearer `))return S(r.slice(7),e,t);let i=await d($(e));if(i){if(i.exp_at<=Z()||t&&Z()-i.at>60){let t=await x(i);if(t===!1&&n.push(...p(e)),!t)return;i=t,n.push(...await f(e,i))}return Gt(e,{user:{id:i.sub,name:i.name,email:i.email},organizations:i.orgs},i.org)}},async operator(e,t=[]){let n=Q(e).get(X),r=await d(n),a=Z();if(!r||r.aud!==i||a-r.seen>900||a>=r.at+Vt){n&&t.push(l(X,``,0));return}return t.push(await T({...r,seen:a})),r.sub},async setOrganization(e,t,n=[]){let r=await d($(e));r&&r.exp_at<=Z()&&(r=await x(r)||void 0);let i=r?.orgs.find(e=>e.slug===t);if(!(!r||!i))return r.org!==i.id&&n.push(...await f(e,{...r,org:i.id})),i},async organization(t){let n=await new Pe(e,t).get(`delivery`,`workspace`);return n&&`slug`in n?n:void 0},async link(e,t,n,r={},i){let a={name:e.name,email:e.email,...r.organizations?{organizations:r.organizations}:{},...r.token?{token:r.token}:{}};await s(i).insert(R).values({platform:t,platformUserId:n,userId:e.id,...a}).onConflictDoUpdate({target:[R.platform,R.platformUserId],set:a,setWhere:I(R.userId,e.id)});let[o]=await s(i).select({userId:R.userId}).from(R).where(L(I(R.platform,t),I(R.platformUserId,n)));return o?.userId===e.id?`linked`:`taken`},async linkedAccounts(e,t){return(await s(t).select().from(R).where(I(R.userId,e))).map(e=>({platform:e.platform,platformUserId:e.platformUserId,name:e.name,email:e.email,...e.organizations?{organizations:e.organizations}:{},...e.token?{token:e.token}:{}}))},async unlink(e,t,n,r){await s(r).delete(R).where(L(I(R.userId,e),I(R.platform,t),I(R.platformUserId,n)))},async refreshLinkedToken(e,t,n,r,i,a){let[o]=await s(a).update(R).set({token:i}).where(L(I(R.userId,e),I(R.platform,t),I(R.platformUserId,n),I(R.token,r))).returning({userId:R.userId});return!!o},async linkedUser(t,n){let[r]=await e.select({id:R.userId,name:R.name,email:R.email,organizations:R.organizations,token:R.token}).from(R).where(L(I(R.platform,t),I(R.platformUserId,n)));return r&&{id:r.id,name:r.name,email:r.email,...r.organizations?{organizations:r.organizations}:{},...r.token?{token:r.token}:{}}}}}export{Kt as createAuth};

package/dist/auth-Cx4ePjWG.js

@@ -0,0 +1 @@
+import{s as e}from"./cli-D5hyqGq0.js";const t=e(`auth`,{login:async()=>(await import(`./login-CCA0uLsW.js`)).commandLogin,logout:async()=>(await import(`./logout-Cv0cm9F8.js`)).commandLogout,status:async()=>(await import(`./status-ZN0HYtLa.js`)).commandStatus},{menu:[{usage:`login`,blurb:`sign in through the browser`},{usage:`logout`,blurb:`sign out and forget the saved session`},{usage:`status`,blurb:`show where you are signed in`}],description:[`Sign in to Coder and manage saved server sessions.`],exampleCommand:`auth login`});export{t as commandAuth};

package/dist/build-CmtlB7pX.js

@@ -0,0 +1 @@
+let e;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(e=`oauth4webapi/v3.8.8`);function t(e,t){if(e==null)return!1;try{return e instanceof t||Object.getPrototypeOf(e)[Symbol.toStringTag]===t.prototype[Symbol.toStringTag]}catch{return!1}}const n=`ERR_INVALID_ARG_VALUE`,r=`ERR_INVALID_ARG_TYPE`;function i(e,t,n){let r=TypeError(e,{cause:n});return Object.assign(r,{code:t}),r}const a=Symbol(),o=Symbol(),s=Symbol(),c=Symbol(),l=Symbol(),u=Symbol(),d=new TextEncoder,f=new TextDecoder;function p(e){return typeof e==`string`?d.encode(e):f.decode(e)}let m;if(Uint8Array.prototype.toBase64)m=e=>(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),e.toBase64({alphabet:`base64url`,omitPadding:!0}));else{let e=32768;m=t=>{t instanceof ArrayBuffer&&(t=new Uint8Array(t));let n=[];for(let r=0;r<t.byteLength;r+=e)n.push(String.fromCharCode.apply(null,t.subarray(r,r+e)));return btoa(n.join(``)).replace(/=/g,``).replace(/\+/g,`-`).replace(/\//g,`_`)}}let h;h=Uint8Array.fromBase64?e=>{try{return Uint8Array.fromBase64(e,{alphabet:`base64url`})}catch(e){throw i(`The input to be decoded is not correctly encoded.`,n,e)}}:e=>{try{let t=atob(e.replace(/-/g,`+`).replace(/_/g,`/`).replace(/\s/g,``)),n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}catch(e){throw i(`The input to be decoded is not correctly encoded.`,n,e)}};function g(e){return typeof e==`string`?h(e):m(e)}var _=class extends Error{code;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=yt,Error.captureStackTrace?.(this,this.constructor)}},v=class extends Error{code;constructor(e,t){super(e,t),this.name=this.constructor.name,t?.code&&(this.code=t?.code),Error.captureStackTrace?.(this,this.constructor)}};function y(e,t,n){return new v(e,{code:t,cause:n})}function b(e,t){if(!(e instanceof CryptoKey))throw i(`${t} must be a CryptoKey`,r)}function x(e,t){if(b(e,t),e.type!==`private`)throw i(`${t} must be a private CryptoKey`,n)}function S(e){return!(typeof e!=`object`||!e||Array.isArray(e))}function C(r){t(r,Headers)&&(r=Object.fromEntries(r.entries()));let a=new Headers(r??{});if(e&&!a.has(`user-agent`)&&a.set(`user-agent`,e),a.has(`authorization`))throw i(`"options.headers" must not include the "authorization" header name`,n);return a}function w(e,t){if(t!==void 0){if(typeof t==`function`&&(t=t(e.href)),!(t instanceof AbortSignal))throw i(`"options.signal" must return or be an instance of AbortSignal`,r);return t}}function ee(e){return e.includes(`//`)?e.replace(`//`,`/`):e}function T(e,t,n=!1){return e.pathname=e.pathname===`/`?t:ee(`${t}/${n?e.pathname:e.pathname.replace(/(\/)$/,``)}`),e}function te(e,t){return e.pathname=ee(`${e.pathname}/${t}`),e}async function E(e,t,n,o){if(!(e instanceof URL))throw i(`"${t}" must be an instance of URL`,r);Ee(e,o?.[a]!==!0);let s=n(new URL(e.href)),l=C(o?.headers);return l.set(`accept`,`application/json`),(o?.[c]||fetch)(s.href,{body:void 0,headers:Object.fromEntries(l.entries()),method:`GET`,redirect:`manual`,signal:w(s,o?.signal)})}async function ne(e,t){return E(e,`issuerIdentifier`,e=>{switch(t?.algorithm){case void 0:case`oidc`:te(e,`.well-known/openid-configuration`);break;case`oauth2`:T(e,`.well-known/oauth-authorization-server`);break;default:throw i(`"options.algorithm" must be "oidc" (default), or "oauth2"`,n)}return e},t)}function D(e,t,a,o,s){try{if(typeof e!=`number`||!Number.isFinite(e))throw i(`${a} must be a number`,r,s);if(e>0)return;if(t){if(e!==0)throw i(`${a} must be a non-negative number`,n,s);return}throw i(`${a} must be a positive number`,n,s)}catch(e){throw o?y(e.message,o,s):e}}function O(e,t,a,o){try{if(typeof e!=`string`)throw i(`${t} must be a string`,r,o);if(e.length===0)throw i(`${t} must not be empty`,n,o)}catch(e){throw a?y(e.message,a,o):e}}async function re(e,n){let a=e;if(!(a instanceof URL)&&a!==Jt)throw i(`"expectedIssuerIdentifier" must be an instance of URL`,r);if(!t(n,Response))throw i(`"response" must be an instance of Response`,r);if(n.status!==200)throw y(`"response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)`,Ct,n);Mt(n);let o=await qt(n);if(O(o.issuer,`"response" body "issuer" property`,j,{body:o}),a!==Jt&&new URL(o.issuer).href!==a.href)throw y(`"response" body "issuer" property does not match the expected value`,Dt,{expected:a.href,body:o,attribute:`issuer`});return o}function ie(e){oe(e,`application/json`)}function ae(e,...t){let n=`"response" content-type must be `;if(t.length>2){let e=t.pop();n+=`${t.join(`, `)}, or ${e}`}else t.length===2?n+=`${t[0]} or ${t[1]}`:n+=t[0];return y(n,St,e)}function oe(e,t){if(Ve(e)!==t)throw ae(e,t)}function se(){return g(crypto.getRandomValues(new Uint8Array(32)))}function ce(){return se()}function le(){return se()}function ue(){return se()}async function de(e){return O(e,`codeVerifier`),g(await crypto.subtle.digest(`SHA-256`,p(e)))}function fe(e){return e instanceof CryptoKey?{key:e}:e?.key instanceof CryptoKey?(e.kid!==void 0&&O(e.kid,`"kid"`),{key:e.key,kid:e.kid}):{}}function pe(e){switch(e.algorithm.hash.name){case`SHA-256`:return`PS256`;case`SHA-384`:return`PS384`;case`SHA-512`:return`PS512`;default:throw new _(`unsupported RsaHashedKeyAlgorithm hash name`,{cause:e})}}function me(e){switch(e.algorithm.hash.name){case`SHA-256`:return`RS256`;case`SHA-384`:return`RS384`;case`SHA-512`:return`RS512`;default:throw new _(`unsupported RsaHashedKeyAlgorithm hash name`,{cause:e})}}function he(e){switch(e.algorithm.namedCurve){case`P-256`:return`ES256`;case`P-384`:return`ES384`;case`P-521`:return`ES512`;default:throw new _(`unsupported EcKeyAlgorithm namedCurve`,{cause:e})}}function ge(e){switch(e.algorithm.name){case`RSA-PSS`:return pe(e);case`RSASSA-PKCS1-v1_5`:return me(e);case`ECDSA`:return he(e);case`Ed25519`:case`ML-DSA-44`:case`ML-DSA-65`:case`ML-DSA-87`:return e.algorithm.name;case`EdDSA`:return`Ed25519`;default:throw new _(`unsupported CryptoKey algorithm name`,{cause:e})}}function _e(e){let t=e?.[o];return typeof t==`number`&&Number.isFinite(t)?t:0}function ve(e){let t=e?.[s];return typeof t==`number`&&Number.isFinite(t)&&Math.sign(t)!==-1?t:30}function ye(){return Math.floor(Date.now()/1e3)}function k(e){if(typeof e!=`object`||!e)throw i(`"as" must be an object`,r);O(e.issuer,`"as.issuer"`)}function A(e){if(typeof e!=`object`||!e)throw i(`"client" must be an object`,r);O(e.client_id,`"client.client_id"`)}function be(e){return O(e,`"clientSecret"`),(t,n,r,i)=>{r.set(`client_id`,n.client_id),r.set(`client_secret`,e)}}function xe(e,t){let n=ye()+_e(t);return{jti:se(),aud:e.issuer,exp:n+60,iat:n,nbf:n,iss:t.client_id,sub:t.client_id}}function Se(e,t){let{key:n,kid:r}=fe(e);return x(n,`"clientPrivateKey.key"`),async(e,i,a,o)=>{let s={alg:ge(n),kid:r},c=xe(e,i);t?.[l]?.(s,c),a.set(`client_id`,i.client_id),a.set(`client_assertion_type`,`urn:ietf:params:oauth:client-assertion-type:jwt-bearer`),a.set(`client_assertion`,await we(s,c,n))}}function Ce(){return(e,t,n,r)=>{n.set(`client_id`,t.client_id)}}async function we(e,t,r){if(!r.usages.includes(`sign`))throw i(`CryptoKey instances used for signing assertions must include "sign" in their "usages"`,n);let a=`${g(p(JSON.stringify(e)))}.${g(p(JSON.stringify(t)))}`;return`${a}.${g(await crypto.subtle.sign(Ft(r),r,p(a)))}`}const Te=URL.parse?(e,t)=>URL.parse(e,t):(e,t)=>{try{return new URL(e,t)}catch{return null}};function Ee(e,t){if(t&&e.protocol!==`https:`)throw y(`only requests to HTTPS are allowed`,wt,e);if(e.protocol!==`https:`&&e.protocol!==`http:`)throw y(`only HTTP and HTTPS requests are allowed`,Tt,e)}function De(e,t,n,r){let i;if(typeof e!=`string`||!(i=Te(e)))throw y(`authorization server metadata does not contain a valid ${n?`"as.mtls_endpoint_aliases.${t}"`:`"as.${t}"`}`,e===void 0?Ot:kt,{attribute:n?`mtls_endpoint_aliases.${t}`:t});return Ee(i,r),i}function Oe(e,t,n,r){return n&&e.mtls_endpoint_aliases&&t in e.mtls_endpoint_aliases?De(e.mtls_endpoint_aliases[t],t,n,r):De(e[t],t,n,r)}function ke(e){return e instanceof Me?e.cause.some(e=>e.scheme===`dpop`&&e.parameters.error===`use_dpop_nonce`):e instanceof Ae&&e.error===`use_dpop_nonce`}var Ae=class extends Error{cause;code;error;status;error_description;response;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=vt,this.cause=t.cause,this.error=t.cause.error,this.status=t.response.status,this.error_description=t.cause.error_description,Object.defineProperty(this,"response",{enumerable:!1,value:t.response}),Error.captureStackTrace?.(this,this.constructor)}},je=class extends Error{cause;code;error;error_description;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=bt,this.cause=t.cause,this.error=t.cause.get(`error`),this.error_description=t.cause.get(`error_description`)??void 0,Error.captureStackTrace?.(this,this.constructor)}},Me=class extends Error{cause;code;response;status;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=_t,this.cause=t.cause,this.status=t.response.status,this.response=t.response,Object.defineProperty(this,"response",{enumerable:!1}),Error.captureStackTrace?.(this,this.constructor)}};const Ne=RegExp("^[,\\s]*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)"),Pe=RegExp(`^[,\\s]*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_\`\\|~]+)\\s*=\\s*"((?:[^"\\\\]|\\\\[\\s\\S])*)"[,\\s]*(.*)`),Fe=RegExp("^[,\\s]*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)\\s*=\\s*([a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+)[,\\s]*(.*)"),Ie=RegExp(`^([a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2})(?:$|[,\\s])(.*)`);function Le(e){if(!t(e,Response))throw i(`"response" must be an instance of Response`,r);let n=e.headers.get(`www-authenticate`);if(n===null)return;let a=[],o=n;for(;o;){let e=o.match(Ne),t=e?.[`1`].toLowerCase();if(!t)return;let n=o.substring(e[0].length);if(n&&!n.match(/^[\s,]/))return;let r=n.match(/^\s+(.*)$/),i=!!r;o=r?r[1]:void 0;let s={},c;if(i)for(;o;){let t,n;if(e=o.match(Pe)){[,t,n,o]=e,n.includes(`\\`)&&(n=n.replace(/\\([\s\S])/g,`$1`)),s[t.toLowerCase()]=n;continue}if(e=o.match(Fe)){[,t,n,o]=e,s[t.toLowerCase()]=n;continue}if(e=o.match(Ie)){if(Object.keys(s).length)break;[,c,o]=e;break}return}else o=n||void 0;let l={scheme:t,parameters:s};c&&(l.token68=c),a.push(l)}if(a.length)return a}async function Re(e){if(e.status>399&&e.status<500){Mt(e),ie(e);try{let t=await e.clone().json();if(S(t)&&typeof t.error==`string`&&t.error.length)return t}catch{}}}async function ze(e,t,n){if(e.status!==t){Ye(e);let t;throw(t=await Re(e))?(await e.body?.cancel(),new Ae(`server responded with an error in the response body`,{cause:t,response:e})):y(`"response" is not a conform ${n} response (unexpected HTTP status code)`,Ct,e)}}function Be(e){if(!$e.has(e))throw i(`"options.DPoP" is not a valid DPoPHandle`,n)}function Ve(e){return e.headers.get(`content-type`)?.split(`;`)[0]}async function He(e,t,n,r,i,a,o){return await n(e,t,i,a),a.set(`content-type`,`application/x-www-form-urlencoded;charset=UTF-8`),(o?.[c]||fetch)(r.href,{body:i,headers:Object.fromEntries(a.entries()),method:`POST`,redirect:`manual`,signal:w(r,o?.signal)})}async function Ue(e,t,n,r,i,o){let s=Oe(e,`token_endpoint`,t.use_mtls_endpoint_aliases,o?.[a]!==!0);i.set(`grant_type`,r);let c=C(o?.headers);c.set(`accept`,`application/json`),o?.DPoP!==void 0&&(Be(o.DPoP),await o.DPoP.addProof(s,c,`POST`));let l=await He(e,t,n,s,i,c,o);return o?.DPoP?.cacheNonce(l,s),l}async function We(e,t,n,r,i){k(e),A(t),O(r,`"refreshToken"`);let a=new URLSearchParams(i?.additionalParameters);return a.set(`refresh_token`,r),Ue(e,t,n,`refresh_token`,a,i)}const Ge=new WeakMap,Ke=new WeakMap;function qe(e){if(!e.id_token)return;let t=Ge.get(e);if(!t)throw i(`"ref" was already garbage collected or did not resolve from the proper sources`,n);return t}async function Je(e,n,a,o,s,c){if(k(e),A(n),!t(a,Response))throw i(`"response" must be an instance of Response`,r);await ze(a,200,`Token Endpoint`),Mt(a);let l=await qt(a);if(O(l.access_token,`"response" body "access_token" property`,j,{body:l}),O(l.token_type,`"response" body "token_type" property`,j,{body:l}),l.token_type=l.token_type.toLowerCase(),l.expires_in!==void 0){let e=typeof l.expires_in==`number`?l.expires_in:parseFloat(l.expires_in);D(e,!0,`"response" body "expires_in" property`,j,{body:l}),l.expires_in=e}if(l.refresh_token!==void 0&&O(l.refresh_token,`"response" body "refresh_token" property`,j,{body:l}),l.scope!==void 0&&typeof l.scope!=`string`)throw y(`"response" body "scope" property must be a string`,j,{body:l});if(l.id_token!==void 0){O(l.id_token,`"response" body "id_token" property`,j,{body:l});let t=[];n.require_auth_time===!0&&t.push(`auth_time`),n.default_max_age!==void 0&&(D(n.default_max_age,!0,`"client.default_max_age"`),t.push(`auth_time`)),o?.length&&t.push(...o);let{claims:r,jwt:i}=await ot(e,n,l.id_token,t,s);dt(n,r),ct(r),Ke.set(a,i),Ge.set(l,r)}if(c?.[l.token_type]!==void 0)c[l.token_type](a,l);else if(l.token_type!==`dpop`&&l.token_type!==`bearer`)throw new _("unsupported `token_type` value",{cause:{body:l}});return l}function Ye(e){let t;if(t=Le(e))throw new Me(`server responded with a challenge in the WWW-Authenticate HTTP Header`,{cause:t,response:e})}async function Xe(e,t,n,r){return Je(e,t,n,void 0,r?.[u],r?.recognizedTokenTypes)}function Ze(e,t){if(Array.isArray(t.claims.aud)){if(!t.claims.aud.includes(e))throw y(`unexpected JWT "aud" (audience) claim value`,M,{expected:e,claims:t.claims,claim:`aud`})}else if(t.claims.aud!==e)throw y(`unexpected JWT "aud" (audience) claim value`,M,{expected:e,claims:t.claims,claim:`aud`});return t}function Qe(e,t){let n=e[Yt]?.(t)??e.issuer;if(t.claims.iss!==n)throw y(`unexpected JWT "iss" (issuer) claim value`,M,{expected:n,claims:t.claims,claim:`iss`});return t}const $e=new WeakSet;function et(e){return $e.add(e),e}const tt=Symbol();async function nt(e,t,r,a,o,s,c){if(k(e),A(t),!$e.has(a))throw i(`"callbackParameters" must be an instance of URLSearchParams obtained from "validateAuthResponse()", or "validateJwtAuthResponse()`,n);O(o,`"redirectUri"`);let l=N(a,`code`);if(!l)throw y(`no authorization code in "callbackParameters"`,j);let u=new URLSearchParams(c?.additionalParameters);return u.set(`redirect_uri`,o),u.set(`code`,l),s!==tt&&(O(s,`"codeVerifier"`),u.set(`code_verifier`,s)),Ue(e,t,r,`authorization_code`,u,c)}const rt={aud:`audience`,c_hash:`code hash`,client_id:`client id`,exp:`expiration time`,iat:`issued at`,iss:`issuer`,jti:`jwt id`,nonce:`nonce`,s_hash:`state hash`,sub:`subject`,ath:`access token hash`,htm:`http method`,htu:`http uri`,cnf:`confirmation`,auth_time:`authentication time`};function it(e,t){for(let n of e)if(t.claims[n]===void 0)throw y(`JWT "${n}" (${rt[n]}) claim missing`,j,{claims:t.claims});return t}function at(e,t){if(typeof t.claims[e]!=`string`)throw y(`unexpected JWT "${e}" (${rt[e]}) claim type`,j,{claims:t.claims});return t}function ot(e,t,n,r,i){return It(n,zt.bind(void 0,t.id_token_signed_response_alg,e.id_token_signing_alg_values_supported,`RS256`),_e(t),ve(t),i).then(it.bind(void 0,[`aud`,`exp`,`iat`,`iss`,`sub`,...r])).then(Qe.bind(void 0,e)).then(Ze.bind(void 0,t.client_id)).then(at.bind(void 0,`sub`))}function st(e,t){if(t===pt)return t;let n=t===void 0;return n&&(t=e.default_max_age),t===void 0?pt:(D(t,!0,n?`"client.default_max_age"`:`"maxAge" argument`),t)}function ct(e){e.auth_time!==void 0&&D(e.auth_time,!0,`ID Token "auth_time" (authentication time)`,j,{claims:e})}function lt(e,t,n){if(n===pt)return;let r=ye()+_e(e),i=ve(e);if(t.auth_time+n<r-i)throw y(`too much time has elapsed since the last End-User authentication`,Et,{claims:t,now:r,tolerance:i,claim:`auth_time`})}function ut(e,t){let n=t===ft?void 0:t;if(e.nonce!==n)throw y(`unexpected ID Token "nonce" claim value`,M,{expected:n,claims:e,claim:`nonce`})}function dt(e,t){if(Array.isArray(t.aud)&&t.aud.length!==1){if(t.azp===void 0)throw y(`ID Token "aud" (audience) claim includes additional untrusted audiences`,M,{claims:t,claim:`aud`});if(t.azp!==e.client_id)throw y(`unexpected ID Token "azp" (authorized party) claim value`,M,{expected:e.client_id,claims:t,claim:`azp`})}}const ft=Symbol(),pt=Symbol();async function mt(e,t,n,r){return typeof r?.expectedNonce==`string`||typeof r?.maxAge==`number`||r?.requireIdToken?ht(e,t,n,r.expectedNonce,r.maxAge,r[u],r.recognizedTokenTypes):gt(e,t,n,r?.maxAge,r?.[u],r?.recognizedTokenTypes)}async function ht(e,t,n,r,i,a,o){let s=[];switch(r){case void 0:r=ft;break;case ft:break;default:O(r,`"expectedNonce" argument`),s.push(`nonce`)}i=st(t,i),i!==pt&&s.push(`auth_time`);let c=await Je(e,t,n,s,a,o);O(c.id_token,`"response" body "id_token" property`,j,{body:c});let l=qe(c);return lt(t,l,i),ut(l,r),c}async function gt(e,t,n,r,i,a){let o=await Je(e,t,n,void 0,i,a),s=qe(o);return s&&(lt(t,s,st(t,r)),ut(s,ft)),o}const _t=`OAUTH_WWW_AUTHENTICATE_CHALLENGE`,vt=`OAUTH_RESPONSE_BODY_ERROR`,yt=`OAUTH_UNSUPPORTED_OPERATION`,bt=`OAUTH_AUTHORIZATION_RESPONSE_ERROR`,xt=`OAUTH_PARSE_ERROR`,j=`OAUTH_INVALID_RESPONSE`,St=`OAUTH_RESPONSE_IS_NOT_JSON`,Ct=`OAUTH_RESPONSE_IS_NOT_CONFORM`,wt=`OAUTH_HTTP_REQUEST_FORBIDDEN`,Tt=`OAUTH_REQUEST_PROTOCOL_FORBIDDEN`,Et=`OAUTH_JWT_TIMESTAMP_CHECK_FAILED`,M=`OAUTH_JWT_CLAIM_COMPARISON_FAILED`,Dt=`OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED`,Ot=`OAUTH_MISSING_SERVER_METADATA`,kt=`OAUTH_INVALID_SERVER_METADATA`;async function At(e,t,n,r,i){k(e),A(t),O(r,`"token"`);let o=Oe(e,`revocation_endpoint`,t.use_mtls_endpoint_aliases,i?.[a]!==!0),s=new URLSearchParams(i?.additionalParameters);s.set(`token`,r);let c=C(i?.headers);return c.delete(`accept`),He(e,t,n,o,s,c,i)}async function jt(e){if(!t(e,Response))throw i(`"response" must be an instance of Response`,r);await ze(e,200,`Revocation Endpoint`)}function Mt(e){if(e.bodyUsed)throw i(`"response" body has been used already`,n)}function Nt(e){let{algorithm:t}=e;if(typeof t.modulusLength!=`number`||t.modulusLength<2048)throw new _(`unsupported ${t.name} modulusLength`,{cause:e})}function Pt(e){let{algorithm:t}=e;switch(t.namedCurve){case`P-256`:return`SHA-256`;case`P-384`:return`SHA-384`;case`P-521`:return`SHA-512`;default:throw new _(`unsupported ECDSA namedCurve`,{cause:e})}}function Ft(e){switch(e.algorithm.name){case`ECDSA`:return{name:e.algorithm.name,hash:Pt(e)};case`RSA-PSS`:switch(Nt(e),e.algorithm.hash.name){case`SHA-256`:case`SHA-384`:case`SHA-512`:return{name:e.algorithm.name,saltLength:parseInt(e.algorithm.hash.name.slice(-3),10)>>3};default:throw new _(`unsupported RSA-PSS hash name`,{cause:e})}case`RSASSA-PKCS1-v1_5`:return Nt(e),e.algorithm.name;case`ML-DSA-44`:case`ML-DSA-65`:case`ML-DSA-87`:case`Ed25519`:return e.algorithm.name}throw new _(`unsupported CryptoKey algorithm name`,{cause:e})}async function It(e,t,n,r,i){let{0:a,1:o,length:s}=e.split(`.`);if(s===5)if(i!==void 0)e=await i(e),{0:a,1:o,length:s}=e.split(`.`);else throw new _(`JWE decryption is not configured`,{cause:e});if(s!==3)throw y(`Invalid JWT`,j,e);let c;try{c=JSON.parse(p(g(a)))}catch(e){throw y(`failed to parse JWT Header body as base64url encoded JSON`,xt,e)}if(!S(c))throw y(`JWT Header must be a top level object`,j,e);if(t(c),c.crit!==void 0)throw new _(`no JWT "crit" header parameter extensions are supported`,{cause:{header:c}});let l;try{l=JSON.parse(p(g(o)))}catch(e){throw y(`failed to parse JWT Payload body as base64url encoded JSON`,xt,e)}if(!S(l))throw y(`JWT Payload must be a top level object`,j,e);let u=ye()+n;if(l.exp!==void 0){if(typeof l.exp!=`number`)throw y(`unexpected JWT "exp" (expiration time) claim type`,j,{claims:l});if(l.exp<=u-r)throw y(`unexpected JWT "exp" (expiration time) claim value, expiration is past current timestamp`,Et,{claims:l,now:u,tolerance:r,claim:`exp`})}if(l.iat!==void 0&&typeof l.iat!=`number`)throw y(`unexpected JWT "iat" (issued at) claim type`,j,{claims:l});if(l.iss!==void 0&&typeof l.iss!=`string`)throw y(`unexpected JWT "iss" (issuer) claim type`,j,{claims:l});if(l.nbf!==void 0){if(typeof l.nbf!=`number`)throw y(`unexpected JWT "nbf" (not before) claim type`,j,{claims:l});if(l.nbf>u+r)throw y(`unexpected JWT "nbf" (not before) claim value`,Et,{claims:l,now:u,tolerance:r,claim:`nbf`})}if(l.aud!==void 0&&typeof l.aud!=`string`&&!Array.isArray(l.aud))throw y(`unexpected JWT "aud" (audience) claim type`,j,{claims:l});return{header:c,claims:l,jwt:e}}async function Lt(e){if(e.bodyUsed)throw i(`form_post Request instances must contain a readable body`,n,{cause:e});return e.text()}async function Rt(e){if(e.method!==`POST`)throw i(`form_post responses are expected to use the POST method`,n,{cause:e});if(Ve(e)!==`application/x-www-form-urlencoded`)throw i(`form_post responses are expected to use the application/x-www-form-urlencoded content-type`,n,{cause:e});return Lt(e)}function zt(e,t,n,r){if(e!==void 0){if(typeof e==`string`?r.alg!==e:!e.includes(r.alg))throw y(`unexpected JWT "alg" header parameter`,j,{header:r,expected:e,reason:`client configuration`});return}if(Array.isArray(t)){if(!t.includes(r.alg))throw y(`unexpected JWT "alg" header parameter`,j,{header:r,expected:t,reason:`authorization server metadata`});return}if(n!==void 0){if(typeof n==`string`?r.alg!==n:typeof n==`function`?!n(r.alg):!n.includes(r.alg))throw y(`unexpected JWT "alg" header parameter`,j,{header:r,expected:n,reason:`default value`});return}throw y(`missing client or server configuration to verify used JWT "alg" header parameter`,void 0,{client:e,issuer:t,fallback:n})}function N(e,t){let{0:n,length:r}=e.getAll(t);if(r>1)throw y(`"${t}" parameter must be provided only once`,j);return n}const Bt=Symbol(),Vt=Symbol();function Ht(e,t,n,a){if(k(e),A(t),n instanceof URL&&(n=n.searchParams),!(n instanceof URLSearchParams))throw i(`"parameters" must be an instance of URLSearchParams, or URL`,r);if(N(n,`response`))throw y(`"parameters" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()`,j,{parameters:n});let o=N(n,`iss`),s=N(n,`state`);if(!o&&e.authorization_response_iss_parameter_supported)throw y(`response parameter "iss" (issuer) missing`,j,{parameters:n});if(o&&o!==e.issuer)throw y(`unexpected "iss" (issuer) response parameter value`,j,{expected:e.issuer,parameters:n});switch(a){case void 0:case Vt:if(s!==void 0)throw y(`unexpected "state" response parameter encountered`,j,{expected:void 0,parameters:n});break;case Bt:break;default:if(O(a,`"expectedState" argument`),s!==a)throw y(s===void 0?`response parameter "state" missing`:`unexpected "state" response parameter value`,j,{expected:a,parameters:n})}if(N(n,`error`))throw new je(`authorization response from the server is an error`,{cause:n});let c=N(n,`id_token`),l=N(n,`token`);if(c!==void 0||l!==void 0)throw new _(`implicit and hybrid flows are not supported`);return et(new URLSearchParams(n))}async function Ut(e,t,n,r,i){k(e),A(t);let o=Oe(e,`device_authorization_endpoint`,t.use_mtls_endpoint_aliases,i?.[a]!==!0),s=new URLSearchParams(r);s.set(`client_id`,t.client_id);let c=C(i?.headers);return c.set(`accept`,`application/json`),He(e,t,n,o,s,c,i)}async function Wt(e,n,a){if(k(e),A(n),!t(a,Response))throw i(`"response" must be an instance of Response`,r);await ze(a,200,`Device Authorization Endpoint`),Mt(a);let o=await qt(a);O(o.device_code,`"response" body "device_code" property`,j,{body:o}),O(o.user_code,`"response" body "user_code" property`,j,{body:o}),O(o.verification_uri,`"response" body "verification_uri" property`,j,{body:o});let s=typeof o.expires_in==`number`?o.expires_in:parseFloat(o.expires_in);return D(s,!0,`"response" body "expires_in" property`,j,{body:o}),o.expires_in=s,o.verification_uri_complete!==void 0&&O(o.verification_uri_complete,`"response" body "verification_uri_complete" property`,j,{body:o}),o.interval!==void 0&&D(o.interval,!1,`"response" body "interval" property`,j,{body:o}),o}async function Gt(e,t,n,r,i){k(e),A(t),O(r,`"deviceCode"`);let a=new URLSearchParams(i?.additionalParameters);return a.set(`device_code`,r),Ue(e,t,n,`urn:ietf:params:oauth:grant-type:device_code`,a,i)}async function Kt(e,t,n,r){return Je(e,t,n,void 0,r?.[u],r?.recognizedTokenTypes)}async function qt(e,t=ie){let n;try{n=await e.json()}catch(n){throw t(e),y(`failed to parse "response" body as JSON`,xt,n)}if(!S(n))throw y(`"response" body must be a top level object`,j,{body:n});return n}const Jt=Symbol(),Yt=Symbol(),Xt=new TextEncoder,Zt=new TextDecoder,Qt=new TextDecoder(`utf-8`,{fatal:!0}),$t=2**32;function P(...e){let t=e.reduce((e,{length:t})=>e+t,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function en(e,t,n){if(t<0||t>=$t)throw RangeError(`value must be >= 0 and <= ${$t-1}. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],n)}function tn(e){let t=Math.floor(e/$t),n=e%$t,r=new Uint8Array(8);return en(r,t,0),en(r,n,4),r}function nn(e){let t=new Uint8Array(4);return en(t,e),t}const rn=/[^\x00-\x7f]/;function an(e){if(typeof e==`string`&&e.length>=128){if(rn.test(e))throw TypeError(`non-ASCII string encountered in encode()`);return Xt.encode(e)}let t=new Uint8Array(e.length);for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);if(r>127)throw TypeError(`non-ASCII string encountered in encode()`);t[n]=r}return t}function on(e,t=!1){if(Uint8Array.prototype.toBase64)return e.toBase64({alphabet:t?`base64url`:`base64`,omitPadding:t});let n=32768,r=[];for(let t=0;t<e.length;t+=n)r.push(String.fromCharCode.apply(null,e.subarray(t,t+n)));let i=btoa(r.join(``));return t?i.replace(/=/g,``).replace(/\+/g,`-`).replace(/\//g,`_`):i}function sn(e,t=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e,{alphabet:t?`base64url`:`base64`});if(t){if(e.includes(`+`)||e.includes(`/`))throw TypeError(`Invalid base64url`);e=e.replace(/-/g,`+`).replace(/_/g,`/`)}let n=atob(e),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}async function cn(e,t){let n=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(n,t))}var F=class extends Error{static code=`ERR_JOSE_GENERIC`;code=`ERR_JOSE_GENERIC`;constructor(e,t){super(e,t),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ln=class extends F{static code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},un=class extends F{static code=`ERR_JWT_EXPIRED`;code=`ERR_JWT_EXPIRED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},dn=class extends F{static code=`ERR_JOSE_ALG_NOT_ALLOWED`;code=`ERR_JOSE_ALG_NOT_ALLOWED`},I=class extends F{static code=`ERR_JOSE_NOT_SUPPORTED`;code=`ERR_JOSE_NOT_SUPPORTED`},fn=class extends F{static code=`ERR_JWE_DECRYPTION_FAILED`;code=`ERR_JWE_DECRYPTION_FAILED`;constructor(e=`decryption operation failed`,t){super(e,t)}},L=class extends F{static code=`ERR_JWE_INVALID`;code=`ERR_JWE_INVALID`},pn=class extends F{static code=`ERR_JWS_INVALID`;code=`ERR_JWS_INVALID`},mn=class extends F{static code=`ERR_JWT_INVALID`;code=`ERR_JWT_INVALID`},hn=class extends F{static code=`ERR_JWK_INVALID`;code=`ERR_JWK_INVALID`},gn=class extends F{static code=`ERR_JWKS_INVALID`;code=`ERR_JWKS_INVALID`},_n=class extends F{static code=`ERR_JWKS_NO_MATCHING_KEY`;code=`ERR_JWKS_NO_MATCHING_KEY`;constructor(e=`no applicable key found in the JSON Web Key Set`,t){super(e,t)}},vn=class extends F{[Symbol.asyncIterator]=async function*(){};static code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;constructor(e=`multiple matching keys found in the JSON Web Key Set`,t){super(e,t)}},yn=class extends F{static code=`ERR_JWKS_TIMEOUT`;code=`ERR_JWKS_TIMEOUT`;constructor(e=`request timed out`,t){super(e,t)}},bn=class extends F{static code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;constructor(e=`signature verification failed`,t){super(e,t)}};function xn(e){try{return sn(typeof e==`string`?e:Zt.decode(e),!0)}catch(e){throw TypeError(`The input to be decoded is not correctly encoded.`,{cause:e})}}function R(e){return on(typeof e==`string`?Xt.encode(e):e,!0)}function Sn(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function z(e){if(typeof e!=`object`||!e||Object.prototype.toString.call(e)!==`[object Object]`)return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Cn(e){return z(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(z)}function wn(...e){let t=new Set;for(let n of e)if(n)for(let e of Object.keys(n)){if(t.has(e))return!1;t.add(e)}return!0}function Tn(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function B(e,t,n){try{return xn(e)}catch{throw new n(`Failed to base64url decode the ${t}`)}}function En(e,t,n){try{return an(e)}catch{throw new n(`The ${t} is not a valid base64url string`)}}function Dn(e,t,n){let r;try{r=JSON.parse(Qt.decode(xn(e)))}catch{throw new t(n)}if(!z(r))throw new t(n);return r}const On={__proto__:null,b64:!0},kn={__proto__:null};function An(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some(e=>typeof e!=`string`)))throw TypeError(`"${e}" option must be an array of strings`);return t===void 0?void 0:new Set(t)}function jn(e,t){let{crit:n}=t??{};if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e(`"crit" (Critical) Header Parameter MUST NOT contain duplicate values`)}function Mn(e,t,n,r,i){if(i.crit!==void 0&&r?.crit===void 0)throw new e(`"crit" (Critical) Header Parameter MUST be integrity protected`);if(!r||r.crit===void 0)return[];if(!Array.isArray(r.crit)||r.crit.length===0||r.crit.some(e=>typeof e!=`string`||e.length===0))throw new e(`"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present`);let a=n===void 0?t:{__proto__:null,...n,...t};for(let t of r.crit){if(!(t in a))throw new I(`Extension Header Parameter "${t}" is not recognized`);if(!Object.hasOwn(i,t)||i[t]===void 0)throw new e(`Extension Header Parameter "${t}" is missing`);if(a[t]&&(!Object.hasOwn(r,t)||r[t]===void 0))throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`)}return r.crit}function Nn(e,t){if(t.includes(`b64`)){let t=e.b64;if(typeof t!=`boolean`)throw new pn(`The "b64" (base64url-encode payload) Header Parameter must be a boolean`);return t}return!0}function Pn(e,t){let n,r;try{n=JSON.stringify(t),r=JSON.parse(n)}catch(t){throw new e(`JOSE Header is not valid JSON`,{cause:t})}if(!z(r))throw new e(`JOSE Header is not a JSON object`);return[r,n]}const Fn=e=>e[Symbol.toStringTag],In=(e,t,n)=>{let{alg:r}=e;if(t.use!==void 0){let e=n===`sign`||n===`verify`?`sig`:`enc`;if(t.use!==e)throw TypeError(`Invalid key for this operation, its "use" must be "${e}" when present`)}if(t.alg!==void 0&&t.alg!==r)throw TypeError(`Invalid key for this operation, its "alg" must be "${r}" when present`);if(Array.isArray(t.key_ops)){let r=n===`encrypt`||n===`decrypt`?e.ops?.[n===`encrypt`?0:1]:n;if(r&&!t.key_ops.includes(r))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${r}" when present`)}};async function Ln(e,t,n){let{alg:r,secret:i}=e,a=n===`decrypt`||n===`sign`;if(i&&t instanceof Uint8Array)return t;let o,s;if(z(t)){if(o=Zn(t),typeof o.kty!=`string`)throw Gn(r,t,i);if(!(i?o.kty===`oct`&&typeof o.k==`string`:o.kty!==`oct`&&(a?o.kty===`AKP`&&typeof o.priv==`string`||typeof o.d==`string`:o.d===void 0&&o.priv===void 0)))throw TypeError(i?`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`:`JSON Web Key for this operation must be a ${a?`private`:`public`} JWK`);if(In(e,o,n),o.kty===`oct`)return xn(o.k);if(!Object.isFrozen(t)){let{key_ops:e}=t;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}}else{if(!Hn(t))throw Gn(r,t,i);let e=i?`secret`:a?`private`:`public`;if(t.type!==e&&(i||[`secret`,`public`,`private`].includes(t.type)))throw TypeError(`${Fn(t)} instances must be of type "${e}" for the ${r} algorithm`);if(V(t))return t;if(s=t,s.type===`secret`)return s.export()}Rn||=new WeakMap;let c=t,l=Rn.get(c);if(l?.[r])return l[r];if(l||Rn.set(c,l={}),s&&typeof s.toCryptoKey==`function`){let t=s.type===`public`,n=zn[s.asymmetricKeyDetails?.namedCurve],i=e.resolve?.({crv:n,asymmetricKeyType:s.asymmetricKeyType})??e.subtle;return l[r]=s.toCryptoKey(i,t,e.usages[+!t])}return o??=s.export({format:`jwk`}),o.alg=r,l[r]=await Qn(e,o)}let Rn;const zn={__proto__:null,prime256v1:`P-256`,secp384r1:`P-384`,secp521r1:`P-521`};function Bn(e){if(!V(e))throw Error(`CryptoKey instance expected`)}const V=e=>{if(e?.[Symbol.toStringTag]===`CryptoKey`)return!0;try{return e instanceof CryptoKey}catch{return!1}},Vn=e=>e?.[Symbol.toStringTag]===`KeyObject`,Hn=e=>V(e)||Vn(e);function Un(e,t,...n){if(n.length>2){let t=n.pop();e+=`one of type ${n.join(`, `)}, or ${t}.`}else n.length===2?e+=`one of type ${n[0]} or ${n[1]}.`:e+=`of type ${n[0]}.`;return t==null?e+=` Received ${t}`:typeof t==`function`&&t.name?e+=` Received function ${t.name}`:typeof t==`object`&&t&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}const Wn=(e,...t)=>Un(`Key must be `,e,...t);function Gn(e,t,n){let r=[`CryptoKey`,`KeyObject`,`JSON Web Key`];return n&&r.push(`Uint8Array`),TypeError(Un(`Key for the ${e} algorithm must be `,t,...r))}const Kn=(e,t=`algorithm.name`)=>TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function qn(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function Jn(e,t){let{modulusLength:n}=t.algorithm;if(typeof n!=`number`||n<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function Yn(e,t,n){let r=e.algorithm;if(r.name!==t.name)throw Kn(t.name);if(t.hash&&r.hash?.name!==t.hash)throw Kn(t.hash,`algorithm.hash`);if(t.namedCurve&&r.namedCurve!==t.namedCurve)throw Kn(t.namedCurve,`algorithm.namedCurve`);if(t.length!==void 0&&r.length!==t.length)throw Kn(t.length,`algorithm.length`);qn(e,n)}function Xn(e){return{__proto__:null,...e}}function Zn(e){let t=Xn(e);if(t.ext!==void 0&&typeof t.ext!=`boolean`)throw TypeError(`"ext" (Extractable) Parameter must be a boolean`);if(t.key_ops!==void 0){let e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>typeof e!=`string`)||new Set(n).size!==n.length)throw TypeError(`"key_ops" (Key Operations) Parameter must be an array of unique strings`);t.key_ops=n}return t}async function Qn(e,t,n){if(!e.kty.includes(t.kty))throw new I(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,i=!!(t.d||t.priv),a={...t,ext:n??t.ext};return a.kty!==`AKP`&&delete a.alg,delete a.use,crypto.subtle.importKey(`jwk`,a,r,a.ext??!i,t.key_ops??e.usages[+!!i])}async function H(e,t,n,r=!1){return e instanceof Uint8Array&&(e=await crypto.subtle.importKey(`raw`,e,t,r,[n])),Yn(e,t,n),e}const $n=e=>crypto.getRandomValues(new Uint8Array(e.cekBits>>3));function er(e,t){let n=e.byteLength<<3;if(n!==t)throw new L(`Invalid Content Encryption Key length. Expected ${t} bits, got ${n} bits`)}const tr=e=>crypto.getRandomValues(new Uint8Array(e.ivBits>>3));function nr(e,t){if(t.length<<3!==e.ivBits)throw new L(`Invalid Initialization Vector length`)}async function rr(e,t,n){if(!(t instanceof Uint8Array))throw TypeError(Wn(t,`Uint8Array`));let r=e.cekBits>>1;return[await crypto.subtle.importKey(`raw`,t.subarray(r>>3),`AES-CBC`,!1,[n]),await crypto.subtle.importKey(`raw`,t.subarray(0,r>>3),{hash:`SHA-${r<<1}`,name:`HMAC`},!1,[`sign`]),r]}async function ir(e,t,n){return new Uint8Array((await crypto.subtle.sign(`HMAC`,e,t)).slice(0,n>>3))}async function ar(e,t,n,r,i){let[a,o,s]=await rr(e,n,`encrypt`),c=new Uint8Array(await crypto.subtle.encrypt({iv:r,name:`AES-CBC`},a,t));return{ciphertext:c,tag:await ir(o,P(i,r,c,tn(i.length*8)),s),iv:r}}async function or(e,t){let n={name:`HMAC`,hash:`SHA-256`},r=await crypto.subtle.generateKey(n,!1,[`sign`,`verify`]),i=await crypto.subtle.sign(n,r,e);return crypto.subtle.verify(n,r,i,t)}async function sr(e,t,n,r,i,a){let[o,s,c]=await rr(e,t,`decrypt`),l=await ir(s,P(a,r,n,tn(a.length*8)),c);try{if(await or(i,l))return new Uint8Array(await crypto.subtle.decrypt({iv:r,name:`AES-CBC`},o,n))}catch{}throw new fn}async function cr(e,t,n,r,i){if(!V(n)&&!(n instanceof Uint8Array))throw TypeError(Wn(n,`CryptoKey`,`KeyObject`,`Uint8Array`,`JSON Web Key`));if(r?nr(e,r):r=tr(e),n instanceof Uint8Array&&er(n,e.cekBits),e.cbc)return ar(e,t,n,r,i);let a=await H(n,e.subtle,`encrypt`),o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:r,name:`AES-GCM`,tagLength:128},a,t));return{ciphertext:o.subarray(0,-16),tag:o.subarray(-16),iv:r}}async function lr(e,t,n,r,i,a){if(!V(t)&&!(t instanceof Uint8Array))throw TypeError(Wn(t,`CryptoKey`,`KeyObject`,`Uint8Array`,`JSON Web Key`));if(!r)throw new L(`JWE Initialization Vector missing`);if(!i)throw new L(`JWE Authentication Tag missing`);if(!e.cbc&&i.length!==16)throw new L(`Invalid Authentication Tag length`);if(nr(e,r),t instanceof Uint8Array&&er(t,e.cekBits),e.cbc)return sr(e,t,n,r,i,a);let o=await H(t,e.subtle,`decrypt`);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:a,iv:r,name:`AES-GCM`,tagLength:128},o,P(n,i)))}catch{throw new fn}}function ur(e){let t={__proto__:null};for(let n in e)t[n]={...e[n],alg:n};return t}const dr=[[`encrypt`,`wrapKey`],[`decrypt`,`unwrapKey`]],fr=[[],[`deriveBits`]],pr=[[],[]];function mr(e){return{kty:[`RSA`],mode:`key-encryption`,subtle:{name:`RSA-OAEP`,hash:`SHA-${e}`},usages:dr,ops:[`wrapKey`,`unwrapKey`]}}function hr(e){return{kty:[`EC`,`OKP`],mode:e,subtle:{name:`ECDH`},resolve:({kty:e,crv:t,asymmetricKeyType:n})=>{if(t===`X25519`||n===`x25519`)return{name:`X25519`};if(e===`OKP`)throw new I(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);return{name:`ECDH`,namedCurve:t}},usages:fr,ops:[void 0,`deriveBits`]}}function U(e,t=!1){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:t?`AES-GCM`:`AES-KW`,length:e},usages:pr,ops:t?[`encrypt`,`decrypt`]:[`wrapKey`,`unwrapKey`]}}function gr(){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:`PBKDF2`},usages:pr,ops:[`deriveBits`,`deriveBits`]}}const _r=ur({dir:{kty:[`oct`],mode:`direct-encryption`,secret:!0,subtle:{name:`AES-GCM`},usages:pr,ops:[`encrypt`,`decrypt`]},"RSA-OAEP":mr(1),"RSA-OAEP-256":mr(256),"RSA-OAEP-384":mr(384),"RSA-OAEP-512":mr(512),"ECDH-ES":hr(`direct-key-agreement`),"ECDH-ES+A128KW":hr(`key-agreement-with-key-wrapping`),"ECDH-ES+A192KW":hr(`key-agreement-with-key-wrapping`),"ECDH-ES+A256KW":hr(`key-agreement-with-key-wrapping`),A128KW:U(128),A192KW:U(192),A256KW:U(256),A128GCMKW:U(128,!0),A192GCMKW:U(192,!0),A256GCMKW:U(256,!0),"PBES2-HS256+A128KW":gr(),"PBES2-HS384+A192KW":gr(),"PBES2-HS512+A256KW":gr()}),vr=[`encrypt`,`decrypt`];function W(e,t=!1){return{kty:[`oct`],secret:!0,subtle:{name:t?`AES-CBC`:`AES-GCM`,length:e},usages:pr,ops:vr,cekBits:e,ivBits:t?128:96,cbc:t}}const yr=ur({A128GCM:W(128),A192GCM:W(192),A256GCM:W(256),"A128CBC-HS256":W(256,!0),"A192CBC-HS384":W(384,!0),"A256CBC-HS512":W(512,!0)});function br(e,t){throw new I(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function G(e){return(typeof e==`string`?_r[e]:void 0)??br(`alg`,`Algorithm`)}function xr(e){return e.mode===`key-wrapping`||e.mode===`key-encryption`||e.mode===`key-agreement-with-key-wrapping`}function Sr(e){return(typeof e==`string`?yr[e]:void 0)??br(`enc`,`Encryption Algorithm`)}function Cr(e,t){if(e.algorithm.name!==`ECDH`&&e.algorithm.name!==`X25519`)throw TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519`);qn(e,t)}async function wr(e,t,n){let r=await H(t,G(e).subtle,`wrapKey`,!0),i=await crypto.subtle.importKey(`raw`,n,{hash:`SHA-256`,name:`HMAC`},!0,[`sign`]);return new Uint8Array(await crypto.subtle.wrapKey(`raw`,i,r,`AES-KW`))}async function Tr(e,t,n){let r=await H(t,G(e).subtle,`unwrapKey`,!0),i=await crypto.subtle.unwrapKey(`raw`,n,r,`AES-KW`,{hash:`SHA-256`,name:`HMAC`},!0,[`sign`]);return new Uint8Array(await crypto.subtle.exportKey(`raw`,i))}function Er(e,t,n){Yn(t,G(e).subtle,n),Jn(e,t)}async function Dr(e,t,n,r){if(!(e instanceof Uint8Array)||e.length<8)throw new L(`PBES2 Salt Input must be 8 or more octets`);if(!Number.isSafeInteger(n)||Math.sign(n)!==1)throw new L(`PBES2 Count Input must be a positive integer`);let i=P(an(t),Uint8Array.of(0),e),a=parseInt(t.slice(13,16),10),o={hash:`SHA-${t.slice(8,11)}`,iterations:n,name:`PBKDF2`,salt:i},s=await H(r,G(t).subtle,`deriveBits`);return new Uint8Array(await crypto.subtle.deriveBits(o,s,a))}function Or(e){return P(nn(e.length),e)}async function kr(e,t,n){let r=t>>3,i=Math.ceil(r/32),a=new Uint8Array(i*32);for(let t=1;t<=i;t++){let r=await cn(`sha256`,P(nn(t),e,n));a.set(r,(t-1)*32)}return a.slice(0,r)}async function Ar(e,t,n,r,i=new Uint8Array,a=new Uint8Array){Cr(e),Cr(t,`deriveBits`);let o=P(Or(an(n)),Or(i),Or(a),nn(r));return kr(new Uint8Array(await crypto.subtle.deriveBits({name:e.algorithm.name,public:e},t,e.algorithm.name===`X25519`?256:Math.ceil(parseInt(e.algorithm.namedCurve.slice(-3),10)/8)<<3)),r,o)}function jr(e){Bn(e);let t=e.algorithm.namedCurve;if(t!==`P-256`&&t!==`P-384`&&t!==`P-521`&&e.algorithm.name!==`X25519`)throw new I(`ECDH with the provided key is not allowed or not supported by your javascript runtime`)}function Mr(e,t){let n=e[t];if(n!==void 0){if(typeof n!=`string`)throw new L(`JOSE Header "${t}" (Agreement Party${t===`apu`?`U`:`V`}Info) invalid`);return B(n,t,L)}}function Nr(e,t){if(e!==void 0&&t!==void 0&&e.byteLength===t.byteLength){for(let n=0;n<e.byteLength;n++)if(e[n]!==t[n])return;throw new L(`JOSE Header "apu" and "apv" values must be distinct`)}}function Pr(e){if(e===void 0)throw new L(`JWE Encrypted Key missing`)}function Fr(e){if(e!==void 0)throw new L(`Encountered unexpected JWE Encrypted Key`)}function Ir(e){if(e!==void 0&&e!==1/0&&(!Number.isSafeInteger(e)||e<1))throw TypeError(`maxPBES2Count must be a positive safe integer or Infinity`)}async function Lr(e,t,n,r,i,a){let{alg:o}=e,s=e.mode;if(s===`direct-encryption`)return Fr(r),n;let c=s===`direct-key-agreement`;switch(c?Fr(r):Pr(r),e.subtle.name){case`ECDH`:{let{epk:r}=i;if(!z(r)||[`d`,`k`,`p`,`q`,`dp`,`dq`,`qi`,`oth`,`priv`].some(e=>Object.hasOwn(r,e)))throw new L(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);jr(n);let a=await Qn(e,r),s=Mr(i,`apu`),l=Mr(i,`apv`);Nr(s,l);let u=await Ar(a,n,c?t.alg:o,c?t.cekBits:parseInt(o.slice(-5,-2),10),s,l);if(c)return u;n=u;break}case`RSA-OAEP`:return Bn(n),Er(o,n,`decrypt`),new Uint8Array(await crypto.subtle.decrypt(`RSA-OAEP`,n,r));case`PBKDF2`:{if(typeof i.p2c!=`number`)throw new L(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);Ir(a);let e=a??1e4;if(i.p2c>e)throw new L(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);if(typeof i.p2s!=`string`)throw new L(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);n=await Dr(B(i.p2s,`p2s`,L),o,i.p2c,n);break}case`AES-GCM`:{if(typeof i.iv!=`string`)throw new L(`JOSE Header "iv" (Initialization Vector) missing or invalid`);if(typeof i.tag!=`string`)throw new L(`JOSE Header "tag" (Authentication Tag) missing or invalid`);let e=B(i.iv,`iv`,L),t=B(i.tag,`tag`,L);if(e.byteLength!==12)throw new L(`Invalid Initialization Vector length`);if(t.byteLength!==16)throw new L(`Invalid Authentication Tag length`);return lr(Sr(o.slice(0,-2)),n,r,e,t,new Uint8Array)}}return Tr(o.slice(-6),n,r)}async function Rr(e,t,n,r,i,a={}){let{alg:o,mode:s}=e,c=xr(e);if(i!==void 0&&!c)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${o}`);let l=await Ln(s===`direct-encryption`?t:e,n,`encrypt`);if(s===`direct-encryption`)return[l,void 0,void 0];let u=c?i??$n(t):void 0;u&&er(u,t.cekBits);let d,f;switch(e.subtle.name){case`ECDH`:{jr(l);let{apu:n,apv:i}=a;n!==void 0&&Sn(n,`"apu"`),i!==void 0&&Sn(i,`"apv"`);let c=n??Mr(r,`apu`),u=i??Mr(r,`apv`);Nr(c,u);let d;d=a.epk===void 0?(await crypto.subtle.generateKey(l.algorithm,!0,[`deriveBits`])).privateKey:await Ln(e,a.epk,`decrypt`);let p=crypto.subtle,m=d;if(!m.extractable){if(typeof p.getPublicKey!=`function`)throw TypeError(`CryptoKey for "epk" must be extractable`);m=await p.getPublicKey(d,[])}let{x:h,y:g,crv:_,kty:v}=await p.exportKey(`jwk`,m),y=s===`direct-key-agreement`,b=await Ar(l,d,y?t.alg:o,y?t.cekBits:parseInt(o.slice(-5,-2),10),c,u),x={x:h,crv:_,kty:v};if(v===`EC`&&(x.y=g),f={epk:x},n!==void 0&&(f.apu=R(n)),i!==void 0&&(f.apv=R(i)),y)return[b,void 0,f];l=b;break}case`RSA-OAEP`:Bn(l),Er(o,l,`encrypt`),d=new Uint8Array(await crypto.subtle.encrypt(`RSA-OAEP`,l,u));break;case`PBKDF2`:{let{p2c:e=2048,p2s:t=crypto.getRandomValues(new Uint8Array(16))}=a;l=await Dr(t,o,e,l),f={p2c:e,p2s:R(t)};break}case`AES-GCM`:{let e=a.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):a.iv;if(!(e instanceof Uint8Array))throw TypeError(`"iv" must be an instance of Uint8Array`);let t=await cr(Sr(o.slice(0,-2)),u,l,e,new Uint8Array);d=t.ciphertext,f={iv:R(t.iv),tag:R(t.tag)}}}if(d??=await wr(o.slice(-6),l,u),!(d instanceof Uint8Array)||!d.byteLength)throw TypeError(`JWE key management algorithm did not produce an Encrypted Key`);return[u,d,f]}function zr(e,t){if(e.zip!==void 0&&e.zip!==`DEF`)throw new I(`Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.`);if(e.zip!==void 0&&!t?.zip)throw new L(`JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.`)}function Br(e){if(typeof globalThis[e]>`u`)throw new I(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${e} API.`)}async function Vr(e,t,n=1/0){let r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let i=[],a=0,o=e.readable.getReader();for(;;){let{value:e,done:t}=await o.read();if(t)break;if(i.push(e),a+=e.byteLength,n!==1/0&&a>n)throw new L(`Decompressed plaintext exceeded the configured limit`)}return P(...i)}async function Hr(e){return Br(`CompressionStream`),Vr(new CompressionStream(`deflate-raw`),e)}async function Ur(e,t){return Br(`DecompressionStream`),Vr(new DecompressionStream(`deflate-raw`),e,t)}function Wr(e){let{protected:t,ciphertext:n,iv:r,tag:i,aad:a}=e,o;return t!==void 0&&(o=Dn(t,L,`JWE Protected Header is invalid`)),[o,B(n,`ciphertext`,L),r===void 0?void 0:B(r,`iv`,L),i===void 0?void 0:B(i,`tag`,L),En((t??``)+(a===void 0?``:`.${a}`),`aad`,L)]}function Gr(e){return[e&&An(`keyManagementAlgorithms`,e.keyManagementAlgorithms),e&&An(`contentEncryptionAlgorithms`,e.contentEncryptionAlgorithms),e?.crit,e?.maxPBES2Count,e?.maxDecompressedLength]}async function Kr(e,t,n,r=Wr(e)){let[i,a,o,s,c]=r,{header:l,unprotected:u,aad:d}=e,f;if(l!==void 0||u!==void 0){if(!wn(i,l,u))throw new L(`JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint`);f={...i,...l,...u}}else f=i??{};let[p,m,h,g,_]=t,{encrypted_key:v}=e;Mn(L,kn,h,i,f),zr(f,i);let{alg:y,enc:b}=f;if(typeof y!=`string`||!y)throw new L(`missing JWE Algorithm (alg) in JWE Header`);let x=_r[y];if(v===``&&(!x||!xr(x)))throw new L(`JWE Encrypted Key incorrect type`);let S=x?.mode===`integrated-encryption`;if(!S&&(typeof b!=`string`||!b))throw new L(`missing JWE Encryption Algorithm (enc) in JWE Header`);if(p&&!p.has(y)||!p&&y.startsWith(`PBES2`))throw new dn(`"alg" (Algorithm) Header Parameter value not allowed`);let C;if(S){if(b!==void 0)throw new L(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(o?.byteLength)throw new L(`JWE Initialization Vector must be empty for integrated encryption`);if(s?.byteLength)throw new L(`JWE Authentication Tag must be empty for integrated encryption`)}else{if(m&&!m.has(b))throw new dn(`"enc" (Encryption Algorithm) Header Parameter value not allowed`);C=Sr(b)}let w;if(v!==void 0)try{w=B(v,`encrypted_key`,L)}catch(e){if(!x||!xr(x))throw e;w=new Uint8Array}let ee=!1;typeof n==`function`&&(n=await n(i,e),ee=!0);let T=x??G(y);xr(T)&&w===void 0&&(w=new Uint8Array);let te=await Ln(T.mode===`direct-encryption`?C:T,n,`decrypt`),E;if(T.mode===`integrated-encryption`)E=await T.decrypt(te,w,a,c,i,f);else{let e=C,t;try{t=await Lr(T,e,te,w,f,g),xr(T)&&t instanceof Uint8Array&&t.byteLength<<3!==e.cekBits&&(t=$n(e))}catch(n){if(n instanceof TypeError||n instanceof L||n instanceof I)throw n;t=$n(e)}E=await lr(e,t,a,o,s,c)}if(f.zip===`DEF`){let e=_??25e4;if(e===0)throw new I(`JWE "zip" (Compression Algorithm) Header Parameter is not supported.`);if(e!==1/0&&(!Number.isSafeInteger(e)||e<1))throw TypeError(`maxDecompressedLength must be 0, a positive safe integer, or Infinity`);E=await Ur(E,e).catch(e=>{throw e instanceof L?e:new L(`Failed to decompress plaintext`,{cause:e})})}return{plaintext:E,...i&&{protectedHeader:i},...d!==void 0&&{additionalAuthenticatedData:B(d,`aad`,L)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...ee&&{key:te}}}async function qr(e,t,n){if(e instanceof Uint8Array&&(e=Zt.decode(e)),typeof e!=`string`)throw new L(`Compact JWE must be a string or Uint8Array`);let{0:r,1:i,2:a,3:o,4:s,length:c}=e.split(`.`);if(c!==5)throw new L(`Invalid Compact JWE`);return Kr({ciphertext:o,iv:a||void 0,protected:r,tag:s||void 0,encrypted_key:i||void 0},t,n)}let K,Jr;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(Jr=`openid-client/v6.8.8`,K={"user-agent":Jr});const q=e=>Yr.get(e);let Yr;function Xr(e){if(e!==void 0)return be(e);let t=new WeakMap;return(e,n,r,i)=>{let a;return(a=t.get(n))||(Zr(n.client_secret,`"metadata.client_secret"`),a=be(n.client_secret),t.set(n,a)),a(e,n,r,i)}}function Zr(e,t){if(typeof e!=`string`)throw Y(`${t} must be a string`,ti);if(e.length===0)throw Y(`${t} must not be empty`,ei)}function Qr(){return Ce()}function $r(e,t){return Se(e,t)}const J=c,ei=`ERR_INVALID_ARG_VALUE`,ti=`ERR_INVALID_ARG_TYPE`;function Y(e,t,n){let r=TypeError(e,{cause:n});return Object.assign(r,{code:t}),r}function ni(e){return de(e)}function ri(){return ce()}function ii(){return ue()}function ai(){return le()}var oi=class extends Error{code;constructor(e,t){super(e,t),this.name=this.constructor.name,this.code=t?.code,Error.captureStackTrace?.(this,this.constructor)}};new TextDecoder;function X(e,t,n){return new oi(e,{cause:t,code:n})}function Z(e){if(e instanceof TypeError||e instanceof oi||e instanceof Ae||e instanceof je||e instanceof Me)throw e;if(e instanceof v)switch(e.code){case wt:throw X(`only requests to HTTPS are allowed`,e,e.code);case Tt:throw X(`only requests to HTTP or HTTPS are allowed`,e,e.code);case Ct:throw X(`unexpected HTTP response status code`,e.cause,e.code);case St:throw X(`unexpected response content-type`,e.cause,e.code);case xt:throw X(`parsing error occured`,e,e.code);case j:throw X(`invalid response encountered`,e,e.code);case M:throw X(`unexpected JWT claim value encountered`,e,e.code);case Dt:throw X(`unexpected JSON attribute value encountered`,e,e.code);case Et:throw X(`JWT timestamp claim value failed validation`,e,e.code);default:throw X(e.message,e,e.code)}if(e instanceof _)throw X(`unsupported operation`,e,e.code);if(e instanceof DOMException)switch(e.name){case`OperationError`:throw X(`runtime operation error`,e,yt);case`NotSupportedError`:throw X(`runtime unsupported operation`,e,yt);case`TimeoutError`:throw X(`operation timed out`,e,`OAUTH_TIMEOUT`);case`AbortError`:throw X(`operation aborted`,e,`OAUTH_ABORT`)}throw new oi(`something went wrong`,{cause:e})}function si(e,t,n){return e.origin===`https://login.microsoftonline.com`&&(!n?.algorithm||n.algorithm===`oidc`)&&(t[pi]=!0,!0)}function ci(e,t){return!!(e.hostname.endsWith(`.b2clogin.com`)&&(!t?.algorithm||t.algorithm===`oidc`))}async function li(e,t,n,r,i){let a=new mi(await ui(e,i),t,n,r),o=q(a);if(i?.[J]&&(o.fetch=i[J]),i?.timeout!==void 0&&(o.timeout=i.timeout),i?.execute)for(let e of i.execute)e(a);return a}async function ui(e,t){if(!(e instanceof URL))throw Y(`"server" must be an instance of URL`,ti);let n=!e.href.includes(`/.well-known/`),r=t?.timeout??30,i=AbortSignal.timeout(r*1e3),o=await(n?ne(e,{algorithm:t?.algorithm,[c]:t?.[J],[a]:t?.execute?.includes(Ci),signal:i,headers:new Headers(K)}):(t?.[J]||fetch)((Ee(e,!t?.execute?.includes(Ci)),e.href),{headers:Object.fromEntries(new Headers({accept:`application/json`,...K}).entries()),body:void 0,method:`GET`,redirect:`manual`,signal:i})).then(e=>re(Jt,e)).catch(Z);return n&&new URL(o.issuer).href!==e.href&&(si(e,o,t)||ci(e,t)||(()=>{throw new oi(`discovered metadata issuer does not match the expected issuer`,{code:`OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED`,cause:{expected:e.href,body:o,attribute:`issuer`}})})()),o}function di(e){return{supportsPKCE:{__proto__:null,value(t=`S256`){return e.code_challenge_methods_supported?.includes(t)===!0}}}}function fi(e){Object.defineProperties(e,di(e))}const pi=Symbol();var mi=class{constructor(e,t,n,r){if(typeof t!=`string`||!t.length)throw Y(`"clientId" must be a non-empty string`,ti);if(typeof n==`string`&&(n={client_secret:n}),n?.client_id!==void 0&&t!==n.client_id)throw Y(`"clientId" and "metadata.client_id" must be the same`,ei);let i={...structuredClone(n),client_id:t};i[o]=n?.[o]??0,i[s]=n?.[s]??30;let a;a=r||(typeof i.client_secret==`string`&&i.client_secret.length?Xr(i.client_secret):Qr());let c=Object.freeze(i),l=structuredClone(e);pi in e&&(l[Yt]=({claims:{tid:t}})=>e.issuer.replace(`{tenantid}`,t));let u=Object.freeze(l);Yr||=new WeakMap,Yr.set(this,{__proto__:null,as:u,c,auth:a,tlsOnly:!0,timeout:30,jwksCache:{}})}serverMetadata(){let e=structuredClone(q(this).as);return fi(e),e}clientMetadata(){return structuredClone(q(this).c)}get timeout(){return q(this).timeout}set timeout(e){q(this).timeout=e}get[J](){return q(this).fetch}set[J](e){q(this).fetch=e}};Object.freeze(mi.prototype);function hi(e){let t;return e.expires_in!==void 0&&(t=Date.now()+e.expires_in*1e3),{expiresIn:{__proto__:null,value(){if(t){let e=Date.now();return t>e?Math.floor((t-e)/1e3):0}}},claims:{__proto__:null,value(){return qe(e)}}}}function gi(e){Object.defineProperties(e,hi(e))}async function _i(e,t,n,r=!1){let i=e.headers.get(`retry-after`)?.trim();if(i===void 0)return;let a;if(/^\d+$/.test(i))a=parseInt(i,10);else{let e=new Date(i);if(Number.isFinite(e.getTime())){let t=new Date,n=e.getTime()-t.getTime();n>0&&(a=Math.ceil(n/1e3))}}if(r&&!Number.isFinite(a))throw new v(`invalid Retry-After header value`,{cause:e});a>t&&await vi(a-t,n)}function vi(e,t){return new Promise((n,r)=>{let i=e=>{try{t.throwIfAborted()}catch(e){r(e);return}if(e<=0){n();return}let a=Math.min(e,5);setTimeout(()=>i(e-a),a*1e3)};i(e)})}function yi(e,t){let n=Ai(t);if(!n)return{signal:e,cleanup(){}};let r=new AbortController,i=e=>{let t=e.target;r.abort(t.reason)};return e.aborted?r.abort(e.reason):n.aborted?r.abort(n.reason):(e.addEventListener(`abort`,i,{once:!0}),n.addEventListener(`abort`,i,{once:!0})),{signal:r.signal,cleanup(){e.removeEventListener(`abort`,i),n.removeEventListener(`abort`,i)}}}async function bi(e,t,n,r,i,o,s){let l=new URLSearchParams(o),d=t.interval??5,f=s?.signal??AbortSignal.timeout(t.expires_in*1e3);for(;;){try{await vi(d,f)}catch(e){Z(e)}let{as:t,c:o,auth:p,fetch:m,tlsOnly:h,nonRepudiation:g,timeout:_,decrypt:v}=q(e),y=yi(f,_);try{let e=await r(t,o,p,n,{[c]:m,[a]:!h,additionalParameters:l,DPoP:s?.DPoP,headers:new Headers(K),signal:y.signal}).catch(Z);if(e.status===503&&e.headers.has(`retry-after`)){await e.body?.cancel(),await _i(e,d,f,!0),s={...s,flag:void 0};continue}let _;try{_=await i(t,o,e,{[u]:v})}catch(e){if(ji(e,s)){s={...s,flag:$};continue}if(e instanceof Ae&&(e.error===`slow_down`||e.error===`authorization_pending`)){e.error===`slow_down`&&(d+=5),await _i(e.response,d,f),s={...s,flag:void 0};continue}Z(e)}return _.id_token&&await g?.(e),gi(_),_}finally{y.cleanup()}}}async function xi(e,t,n,r){return Q(e),bi(e,t,t.device_code,Gt,Kt,n,r)}async function Si(e,t){Q(e);let{as:n,c:r,auth:i,fetch:o,tlsOnly:s,timeout:l}=q(e);return Ut(n,r,i,t,{[c]:o,[a]:!s,headers:new Headers(K),signal:Ai(l)}).then(e=>Wt(n,r,e)).catch(Z)}function Ci(e){q(e).tlsOnly=!1}function wi(e){return e=new URL(e),e.search=``,e.hash=``,e.href}function Ti(e,t){try{return Object.getPrototypeOf(e)[Symbol.toStringTag]===t}catch{return!1}}async function Ei(e,t,n,r,i){if(Q(e),i?.flag!==$&&!(t instanceof URL)&&!Ti(t,`Request`))throw Y(`"currentUrl" must be an instance of URL, or Request`,ti);let o,s,{as:l,c:d,auth:f,fetch:p,tlsOnly:m,jarm:h,hybrid:g,nonRepudiation:_,timeout:v,decrypt:y,implicit:b}=q(e);if(i?.flag===$)o=i.authResponse,s=i.redirectUri;else{if(!(t instanceof URL)){let e=t;switch(t=new URL(t.url),e.method){case`GET`:break;case`POST`:let n=new URLSearchParams(await Rt(e));if(g)t.hash=n.toString();else for(let[e,r]of n.entries())t.searchParams.append(e,r);break;default:throw Y(`unexpected Request HTTP method`,ei)}}switch(s=wi(t),!0){case!!h:o=await h(t,n?.expectedState);break;case!!g:o=await g(t,n?.expectedNonce,n?.expectedState,n?.maxAge);break;case!!b:throw TypeError(`authorizationCodeGrant() cannot be used by response_type=id_token clients`);default:try{o=Ht(l,d,t.searchParams,n?.expectedState)}catch(e){Z(e)}}}let x=await nt(l,d,f,o,s,n?.pkceCodeVerifier||tt,{additionalParameters:r,[c]:p,[a]:!m,DPoP:i?.DPoP,headers:new Headers(K),signal:Ai(v)}).catch(Z);(typeof n?.expectedNonce==`string`||typeof n?.maxAge==`number`)&&(n.idTokenExpected=!0);let S=mt(l,d,x,{expectedNonce:n?.expectedNonce,maxAge:n?.maxAge,requireIdToken:n?.idTokenExpected,[u]:y}),C;try{C=await S}catch(t){if(ji(t,i))return Ei(e,void 0,n,r,{...i,flag:$,authResponse:o,redirectUri:s});Z(t)}return C.id_token&&await _?.(x),gi(C),C}async function Di(e,t,n,r){Q(e),n=new URLSearchParams(n);let{as:i,c:o,auth:s,fetch:l,tlsOnly:d,nonRepudiation:f,timeout:p,decrypt:m}=q(e),h=await We(i,o,s,t,{[c]:l,[a]:!d,additionalParameters:n,DPoP:r?.DPoP,headers:new Headers(K),signal:Ai(p)}).catch(Z),g=Xe(i,o,h,{[u]:m}),_;try{_=await g}catch(i){if(ji(i,r))return Di(e,t,n,{...r,flag:$});Z(i)}return _.id_token&&await f?.(h),gi(_),_}function Oi(e,t){Q(e);let{as:n,c:r,tlsOnly:i,hybrid:a,jarm:o,implicit:s}=q(e),c=Oe(n,`authorization_endpoint`,!1,i);if(t=new URLSearchParams(t),t.has(`client_id`)||t.set(`client_id`,r.client_id),!t.has(`request_uri`)&&!t.has(`request`)){if(t.has(`response_type`)||t.set(`response_type`,a?`code id_token`:s?`id_token`:`code`),s&&!t.has(`nonce`))throw Y(`response_type=id_token clients must provide a nonce parameter in their authorization request parameters`,ei);o&&t.set(`response_mode`,`jwt`)}for(let[e,n]of t.entries())c.searchParams.append(e,n);return c}function ki(e,t){Q(e);let{as:n,c:r,tlsOnly:i}=q(e),a=Oe(n,`end_session_endpoint`,!1,i);t=new URLSearchParams(t),t.has(`client_id`)||t.set(`client_id`,r.client_id);for(let[e,n]of t.entries())a.searchParams.append(e,n);return a}function Q(e){if(!(e instanceof mi))throw Y(`"config" must be an instance of Configuration`,ti);if(Object.getPrototypeOf(e)!==mi.prototype)throw Y(`subclassing Configuration is not allowed`,ei)}function Ai(e){return e?AbortSignal.timeout(e*1e3):void 0}function ji(e,t){return t?.DPoP&&t.flag!==$?ke(e):!1}const $=Symbol();async function Mi(e,t,n){Q(e);let{as:r,c:i,auth:o,fetch:s,tlsOnly:l,timeout:u}=q(e);return At(r,i,o,t,{[c]:s,[a]:!l,additionalParameters:new URLSearchParams(n),headers:new Headers(K),signal:Ai(u)}).then(jt).catch(Z)}export{I as $,Vn as A,En as B,Sr as C,Wn as D,Jn as E,kn as F,Pn as G,Cn as H,On as I,Mn as J,An as K,Tn as L,Ln as M,H as N,V as O,Xn as P,F as Q,Sn as R,G as S,cr as T,z as U,wn as V,Dn as W,R as X,jn as Y,dn as Z,Gr as _,je as _t,Oi as a,yn as at,Rr as b,li as c,ln as ct,ii as d,P as dt,L as et,ri as f,Zt as ft,qr as g,Qt as gt,Mi as h,Xt as ht,Ei as i,_n as it,Qn as j,Hn as k,Si as l,un as lt,Di as m,an as mt,$r as n,gn as nt,ki as o,pn as ot,ai as p,cn as pt,Nn as q,Ci as r,vn as rt,ni as s,bn as st,Qr as t,hn as tt,xi as u,mn as ut,Hr as v,Ae as vt,ur as w,_r as x,zr as y,B as z};

package/dist/builtin/coder/agent.json

@@ -1,22 +1,37 @@
 {
   "name": "Coder",
+  "default": true,
   "description": "Answers engineering questions, reviews pull requests, and makes requested changes.",
   "permissions": "workspace-write",
   "integrations": {
     "github": {
-      "triggers": {
+      "events": {
         "pull_request": {
           "flow": "review",
           "permissions": "read-only"
         },
-        "mention": true
+        "mention": true,
+        "issue": true,
+        "comment": {
+          "match": "[Cc]oder"
+        }
       },
       "tools": "write"
     },
     "slack": {
-      "triggers": {
+      "events": {
         "mention": true,
-        "message": true
+        "command": true,
+        "reaction": true,
+        "message": {
+          "match": "[Cc]oder"
+        }
+      },
+      "tools": "comment"
+    },
+    "linear": {
+      "events": {
+        "mention": true
       },
       "tools": "comment"
     }

package/dist/chat-Bbzlea60.js

@@ -0,0 +1 @@
+import{qi as e}from"./core-DwsAMCnL.js";import t from"node:path";import n from"node:fs";import{randomUUID as r}from"node:crypto";var i=e({LocalChatState:()=>a,appChatState:()=>l}),a=class{file;now;memory=new Map;constructor(e,t=Date.now){this.file=e,this.now=t}change(e){let r=this.now(),i=this.load(r),a=e(i,r);if(this.file){n.mkdirSync(t.dirname(this.file),{recursive:!0});let e=`${this.file}.${process.pid}.tmp`;n.writeFileSync(e,JSON.stringify(Object.fromEntries(i)),{mode:384}),n.renameSync(e,this.file)}return a}load(e){let t=this.memory;if(this.file)try{t=new Map(Object.entries(JSON.parse(n.readFileSync(this.file,`utf8`))))}catch(e){if(e.code!==`ENOENT`)throw e;t=new Map}for(let[n,r]of t)r.expiresAt!==void 0&&r.expiresAt<=e&&t.delete(n);return t}read(e){return this.load(this.now()).get(e)?.value}async connect(){}async disconnect(){}async get(e){return this.read(`k:${e}`)??null}async set(e,t,n){this.change((r,i)=>r.set(`k:${e}`,o(t,i,n)))}async setIfNotExists(e,t,n){return this.change((r,i)=>!r.has(`k:${e}`)&&(r.set(`k:${e}`,o(t,i,n)),!0))}async delete(e){this.change(t=>t.delete(`k:${e}`))}async appendToList(e,t,n={}){this.change((r,i)=>{let a=[...s(r.get(`k:${e}`)?.value),t],c=n.maxLength?a.slice(-n.maxLength):a;r.set(`k:${e}`,o(c,i,n.ttlMs))})}async getList(e){return s(this.read(`k:${e}`))}async acquireLock(e,t){return this.change((n,i)=>{if(n.has(`l:${e}`))return null;let a={threadId:e,token:r(),expiresAt:i+t};return n.set(`l:${e}`,{value:a.token,expiresAt:a.expiresAt}),a})}async extendLock(e,t){return this.change((n,r)=>n.get(`l:${e.threadId}`)?.value===e.token&&(n.set(`l:${e.threadId}`,{value:e.token,expiresAt:r+t}),!0))}async releaseLock(e){this.change(t=>{t.get(`l:${e.threadId}`)?.value===e.token&&t.delete(`l:${e.threadId}`)})}async forceReleaseLock(e){this.change(t=>t.delete(`l:${e}`))}async enqueue(e,t,n){return this.change((r,i)=>{let a=[...c(r.get(`q:${e}`)?.value,i),t].slice(-n);return r.set(`q:${e}`,{value:a,expiresAt:Math.max(...a.map(e=>e.expiresAt))}),a.length})}async dequeue(e){return this.change((t,n)=>{let r=t.get(`q:${e}`),[i,...a]=c(r?.value,n);return a.length?t.set(`q:${e}`,{...r,value:a}):t.delete(`q:${e}`),i??null})}async queueDepth(e){return c(this.read(`q:${e}`),this.now()).length}async subscribe(e){this.change(t=>t.set(`s:${e}`,{value:!0}))}async unsubscribe(e){this.change(t=>t.delete(`s:${e}`))}async isSubscribed(e){return this.read(`s:${e}`)===!0}};const o=(e,t,n)=>n?{value:e,expiresAt:t+n}:{value:e},s=e=>Array.isArray(e)?e:[],c=(e,t)=>s(e).filter(e=>e.expiresAt>t);function l(e,t){let n=`${encodeURIComponent(t)}/`,r=e=>n+e,i=e=>({...e,threadId:r(e.threadId)}),a=e=>e&&{...e,threadId:e.threadId.slice(n.length)};return{connect:()=>e.connect(),disconnect:()=>e.disconnect(),get:t=>e.get(r(t)),set:(t,n,i)=>e.set(r(t),n,i),setIfNotExists:(t,n,i)=>e.setIfNotExists(r(t),n,i),delete:t=>e.delete(r(t)),appendToList:(t,n,i)=>e.appendToList(r(t),n,i),getList:t=>e.getList(r(t)),acquireLock:async(t,n)=>a(await e.acquireLock(r(t),n)),extendLock:(t,n)=>e.extendLock(i(t),n),releaseLock:t=>e.releaseLock(i(t)),forceReleaseLock:t=>e.forceReleaseLock(r(t)),enqueue:(t,n,i)=>e.enqueue(r(t),n,i),dequeue:t=>e.dequeue(r(t)),queueDepth:t=>e.queueDepth(r(t)),subscribe:t=>e.subscribe(r(t)),unsubscribe:t=>e.unsubscribe(r(t)),isSubscribed:t=>e.isSubscribed(r(t))}}export{l as n,i as r,a as t};

package/dist/chat-DLolwsuq.js

@@ -0,0 +1,13 @@
+import{Cn as e}from"./apps-aj_JtpAm.js";import{M as t,N as n,R as r,U as i,V as a,X as o,i as s,j as c,r as l}from"./schema-BSlHRFSP.js";import{randomUUID as u}from"node:crypto";var d=class{db;now;constructor(e,t=Date.now){this.db=e,this.now=t}at(e){return e?new Date(this.now()+e):null}stamp(e){return e===void 0?null:new Date(this.now()+e).toISOString()}async rows(e){let t=await this.db.execute(e);return Array.isArray(t)?t:t.rows}live(){return i(r(s.expiresAt),n(s.expiresAt,new Date(this.now())))}expired(){return a(s.expiresAt,new Date(this.now()))}async read(n){let[r]=await e(this.db,()=>this.db.select({value:o`${s.value}`}).from(s).where(c(t(s.key,n),this.live())));return r?.value}async claim(e,t,n){return(await this.db.insert(s).values({key:e,value:t,expiresAt:n}).onConflictDoUpdate({target:s.key,set:{value:t,expiresAt:n},setWhere:this.expired()}).returning({key:s.key})).length>0}async connect(){}async disconnect(){}async get(e){return await this.read(`k:${e}`)??null}async set(e,t,n){let r={value:t,expiresAt:this.at(n)};await this.db.insert(s).values({key:`k:${e}`,...r}).onConflictDoUpdate({target:s.key,set:r})}setIfNotExists(e,t,n){return this.claim(`k:${e}`,t,this.at(n))}async delete(e){await this.db.execute(o`with items as (delete from ${l} where key = ${`k:${e}`}) delete from ${s} where key = ${`k:${e}`}`)}async appendToList(e,t,n={}){let r=`k:${e}`,i=n.maxLength?o`or seq <= coalesce((select seq from ${l} where key = ${r} order by seq desc offset ${n.maxLength-1} limit 1), -1)`:o``;await this.db.execute(o`
+      with added as (insert into ${l} (key, value, expires_at) values (${r}, ${JSON.stringify(t)}::jsonb, ${this.stamp(n.ttlMs)}::timestamptz))
+      delete from ${l} where key = ${r} and ((select expires_at from ${l} where key = ${r} order by seq desc limit 1) <= ${this.stamp(0)}::timestamptz ${i})`)}async getList(t){let n=`k:${t}`;return(await e(this.db,()=>this.rows(o`
+      with newest as (select expires_at from ${l} where key = ${n} order by seq desc limit 1)
+      select value from ${l}, newest where key = ${n} and (newest.expires_at is null or newest.expires_at > ${this.stamp(0)}::timestamptz) order by seq`))).map(e=>e.value)}async acquireLock(e,t){let n={threadId:e,token:u(),expiresAt:this.now()+t};return await this.claim(`l:${e}`,n.token,new Date(n.expiresAt))?n:null}async extendLock(e,n){return(await this.db.update(s).set({expiresAt:this.at(n)}).where(c(t(s.key,`l:${e.threadId}`),t(s.value,e.token),this.live())).returning({key:s.key})).length>0}async releaseLock(e){await this.db.delete(s).where(c(t(s.key,`l:${e.threadId}`),t(s.value,e.token)))}async forceReleaseLock(e){await this.db.delete(s).where(t(s.key,`l:${e}`))}async enqueue(e,t,n){let r=`q:${e}`,i=this.stamp(0),[a]=await this.rows(o`
+      with added as (insert into ${l} (key, value, expires_at) values (${r}, ${JSON.stringify(t)}::jsonb, ${new Date(t.expiresAt).toISOString()}::timestamptz)),
+      dropped as (delete from ${l} where key = ${r} and (expires_at <= ${i}::timestamptz
+        or seq <= coalesce((select seq from ${l} where key = ${r} and expires_at > ${i}::timestamptz order by seq desc offset ${n-1} limit 1), -1)))
+      select least((select count(*) from ${l} where key = ${r} and expires_at > ${i}::timestamptz) + 1, ${n})::int as depth`);return Number(a?.depth??0)}async dequeue(e){let t=`q:${e}`,n=this.stamp(0);return(await this.rows(o`
+      delete from ${l} where key = ${t} and (expires_at <= ${n}::timestamptz
+        or seq = (select seq from ${l} where key = ${t} and expires_at > ${n}::timestamptz order by seq limit 1 for update skip locked))
+      returning value, expires_at > ${n}::timestamptz as live`)).find(e=>e.live)?.value??null}async queueDepth(t){let[n]=await e(this.db,()=>this.rows(o`
+      select count(*)::int as depth from ${l} where key = ${`q:${t}`} and expires_at > ${this.stamp(0)}::timestamptz`));return Number(n?.depth??0)}async subscribe(e){let t={value:!0,expiresAt:null};await this.db.insert(s).values({key:`s:${e}`,...t}).onConflictDoUpdate({target:s.key,set:t})}async unsubscribe(e){await this.db.delete(s).where(t(s.key,`s:${e}`))}async isSubscribed(e){return await this.read(`s:${e}`)===!0}};export{d as PgChatState};

package/dist/chat-bridge-CvspGKBc.js

@@ -0,0 +1,2 @@
+import{h as e}from"./config-D2FxHWwi.js";import t from"node:process";import n from"node:crypto";import r from"node:http";function i(e){let t=[];typeof e.instructions==`string`&&e.instructions&&t.push({role:`system`,content:e.instructions});let n=Array.isArray(e.input)?e.input:[];for(let e of n)switch(e?.type){case`message`:{let n=Array.isArray(e.content)?e.content.map(e=>e?.text??``).join(``):String(e.content??``);t.push({role:e.role===`developer`?`system`:e.role,content:n});break}case`function_call`:{let n={id:e.call_id,type:`function`,function:{name:e.name,arguments:e.arguments??`{}`}},r=t.at(-1);r?.role===`assistant`&&r.tool_calls?r.tool_calls.push(n):t.push({role:`assistant`,content:null,tool_calls:[n]});break}case`function_call_output`:{let n=e.output;t.push({role:`tool`,tool_call_id:e.call_id,content:typeof n==`string`?n:JSON.stringify(n??``)});break}}return t}function a(e){let t=(Array.isArray(e.tools)?e.tools:[]).filter(e=>e?.type===`function`).map(e=>({type:`function`,function:{name:e.name,description:e.description??``,parameters:e.parameters??{type:`object`,properties:{}}}})),n=e.text?.format;return{model:e.model,messages:i(e),...t.length?{tools:t,tool_choice:e.tool_choice??`auto`}:{},...typeof e.parallel_tool_calls==`boolean`?{parallel_tool_calls:e.parallel_tool_calls}:{},...n?.type===`json_schema`?{response_format:{type:`json_schema`,json_schema:{name:n.name,schema:n.schema,strict:n.strict??!1}}}:{},stream:!0,stream_options:{include_usage:!0}}}var o=class{send;model;responseId=`resp_bridge_${n.randomUUID()}`;text=``;textOpen=!1;toolCalls=new Map;usage=null;buffer=``;constructor(e,t){this.model=e,this.send=t,this.send({type:`response.created`,response:{id:this.responseId,object:`response`,status:`in_progress`,model:e,output:[]}})}push(e){this.buffer+=e;let t=this.buffer.split(`
+`);this.buffer=t.pop()??``;for(let e of t){let t=e.trim();if(!t.startsWith(`data:`))continue;let n=t.slice(5).trim();if(!n||n===`[DONE]`)continue;let r;try{r=JSON.parse(n)}catch{continue}r.usage&&(this.usage=r.usage);let i=r.choices?.[0]?.delta;if(i){typeof i.content==`string`&&i.content&&(this.textOpen||(this.textOpen=!0,this.send({type:`response.output_item.added`,output_index:0,item:{type:`message`,id:`msg_bridge_0`,status:`in_progress`,role:`assistant`,content:[]}})),this.text+=i.content,this.send({type:`response.output_text.delta`,item_id:`msg_bridge_0`,output_index:0,content_index:0,delta:i.content}));for(let e of i.tool_calls??[]){let t=this.toolCalls.get(e.index)??{id:``,name:``,args:``};e.id&&(t.id=e.id),e.function?.name&&(t.name+=e.function.name),e.function?.arguments&&(t.args+=e.function.arguments),this.toolCalls.set(e.index,t)}}}}finish(){let e=[];if(this.text){let t={type:`message`,id:`msg_bridge_0`,status:`completed`,role:`assistant`,content:[{type:`output_text`,text:this.text,annotations:[]}]};e.push(t),this.send({type:`response.output_item.done`,output_index:0,item:t})}let t=e.length;for(let n of this.toolCalls.values()){let r={type:`function_call`,id:`fc_bridge_${t}`,call_id:n.id||`call_bridge_${t}`,name:n.name,arguments:n.args||`{}`,status:`completed`};e.push(r),this.send({type:`response.output_item.done`,output_index:t,item:r}),t+=1}this.send({type:`response.completed`,response:{id:this.responseId,object:`response`,status:`completed`,model:this.model,output:e,usage:{input_tokens:this.usage?.prompt_tokens??0,input_tokens_details:{cached_tokens:this.usage?.prompt_tokens_details?.cached_tokens??0},output_tokens:this.usage?.completion_tokens??0,output_tokens_details:{reasoning_tokens:this.usage?.completion_tokens_details?.reasoning_tokens??0},total_tokens:this.usage?.total_tokens??0}}})}};async function s(s,c=`chat`){let l=c===`responses`,u=e(s.baseUrl,l?`responses`:`chat/completions`),d=null,f=!0,p=s.envKey?t.env[s.envKey]:void 0;async function m(e){let t=d?[d]:u,n=null;for(let r of t)if(n=await fetch(r,{method:`POST`,headers:{"content-type":`application/json`,...p?{authorization:`Bearer ${p}`}:{}},body:e}),n.status!==404)return d=r,n;return n}async function h(e){let t=e.text?.format,n=l?e:a(e),r=()=>{let r=`Reply with only a single JSON object matching this JSON Schema:\n${JSON.stringify(t.schema)}\nUse no prose or markdown fences.`;if(l){let{format:t,...n}=e.text;return{...e,text:n,input:[...e.input??[],{type:`message`,role:`user`,content:[{type:`input_text`,text:r}]}]}}let{response_format:a,...o}=n;return{...o,messages:[...i(e),{role:`user`,content:r}]}};if(t?.type!==`json_schema`)return m(JSON.stringify(n));if(!f)return m(JSON.stringify(r()));let o=await m(JSON.stringify(n));if(![400,422,501].includes(o.status))return o;let s=await o.clone().text();return/(invalid.{0,30}schema|schema.{0,30}invalid|unsupported.{0,30}(keyword|constraint)|(keyword|constraint).{0,30}unsupported)/i.test(s)||!/(response_format|json_schema|text[.\s]format)/i.test(s)||!/(not supported|unsupported|unknown parameter|unrecognized|not available)/i.test(s)?o:(f=!1,await o.body?.cancel(),m(JSON.stringify(r())))}let g=n.randomBytes(16).toString(`hex`),_=r.createServer((e,t)=>{if(e.method!==`POST`||!e.url?.startsWith(`/${g}/`)||!e.url.replace(/\/+$/,``).endsWith(`/responses`)){t.writeHead(404,{"content-type":`application/json`}),t.end(JSON.stringify({error:{message:`coder chat bridge: only POST /responses is supported`}}));return}let n=``;e.on(`data`,e=>n+=e),e.on(`end`,async()=>{let e;try{e=JSON.parse(n)}catch{t.writeHead(400,{"content-type":`application/json`}),t.end(JSON.stringify({error:{message:`invalid JSON`}}));return}try{if(l){let n=await h(e);if(t.writeHead(n.status,{"content-type":n.headers.get(`content-type`)??`application/json`,"cache-control":`no-store`}),n.body)for await(let e of n.body)t.write(e);t.end();return}let n=await h(e);if(!n.ok||!n.body){let e=await n.text().catch(()=>``);t.writeHead(n.status,{"content-type":`application/json`}),t.end(e||JSON.stringify({error:{message:`upstream HTTP ${n.status}`}}));return}t.writeHead(200,{"content-type":`text/event-stream`,"cache-control":`no-store`});let r=new o(e.model,e=>t.write(`data: ${JSON.stringify(e)}\n\n`)),i=new TextDecoder;for await(let e of n.body)r.push(i.decode(e,{stream:!0}));r.finish(),t.end()}catch(e){let n=e instanceof Error?e.message:String(e);t.writeHead(502,{"content-type":`application/json`}),t.end(JSON.stringify({error:{message:`coder chat bridge: ${n}`}}))}})});await new Promise(e=>_.listen(0,`127.0.0.1`,e));let v=_.address();return{url:`http://127.0.0.1:${typeof v==`object`&&v?v.port:0}/${g}/v1`,close:()=>new Promise(e=>{_.close(()=>e()),_.closeAllConnections?.()})}}export{s as t};

package/dist/chunk-7WDLOIRP-B_IWkVtZ.js

@@ -0,0 +1 @@
+var e=new Set([`https://files.slack.com`,`https://files.slack-gov.com`,`https://slack-files.com`,`https://slack-files-gov.com`,`https://slack.com`,`https://slack-gov.com`]);function t(t,n){try{let r=new URL(t).origin;return e.has(r)||n!==void 0&&r===new URL(n).origin}catch{return!1}}export{t};

package/dist/cli-D5hyqGq0.js

@@ -0,0 +1,9 @@
+import{In as e,Yt as t,qt as n,y as r}from"./config-D2FxHWwi.js";import{D as i,H as a}from"./dispatch-D3Dqxijf.js";import{a as o,l as s,m as c,r as l,t as u,u as d}from"./prompt-C--TI1qn.js";import{h as f,i as p,p as m,r as h,s as g}from"./output-BKeyLbvt.js";import{a as _}from"./args-CxsMr9Un.js";import v from"node:path";import y from"node:process";import{pathToFileURL as b}from"node:url";const x=async()=>(await import(`./task-4gw9OZun.js`)).commandTaskGroup,S=async()=>(await import(`./setup-host-DExG-bWZ.js`)).commandSetupHost,C=async()=>(await import(`./server-B1x8gx33.js`)).commandServer,w=async()=>(await import(`./upgrade-DRPBwDYe.js`)).commandUpgrade,T={task:x,flow:async()=>(await import(`./flow-4Rr-2NUz.js`)).commandFlow,run:async()=>(await import(`./run-CoTg7SkY.js`)).commandTask,list:async()=>(await import(`./list-CLqNS8_q.js`)).commandTasks,result:async()=>(await import(`./result-DXL9N9Ip.js`).then(e=>e.s)).commandResult,config:async()=>(await import(`./config-BdeKsCPh.js`)).commandConfig,"setup-host":S,"host-setup":S,setup:S,model:async()=>(await import(`./model-0sxp5GdI.js`)).commandModel,connection:async()=>(await import(`./connection-CQPndo-u.js`)).commandConnection,docs:async()=>(await import(`./docs-CYMICGEv.js`)).commandDocs,review:async()=>(await import(`./review-vlPAshsb.js`)).commandReview,agent:async()=>(await import(`./agent-B2Ikhp7u.js`)).commandAgent,server:C,dash:async()=>{let e=await C(),t=await e.subcommands.serve();return Object.assign(t=>e([`serve`,...t]),{commandName:t.commandName,help:t.help})},runner:async()=>(await import(`./runner-D0TLZrrO.js`)).commandRunner,auth:async()=>(await import(`./auth-Cx4ePjWG.js`)).commandAuth,credentials:async()=>(await import(`./credentials-BOAy2_-6.js`)).commandCredentials,upgrade:w,update:w},E={title:`Coder`,usageLine:`coder <command>`,description:`Delegate a coding task to the best available engine and steer it while it runs.`,commands:[{usage:`dash`,blurb:`your tasks, agents and settings in the browser`},{usage:`run "<text>"`,blurb:`run a task (background; --wait blocks)`},{usage:`list`,blurb:`list recent tasks (by default running + just stopped)`},{usage:`result [task-id]`,blurb:`status + final answer (--wait blocks)`},{usage:`task <cmd>`,blurb:`run, list, result, watch, steer, stop, approve, ...`},{usage:`flow <cmd>`,blurb:`run, list, watch, result, resume, stop, discover, ...`},{usage:`agent <cmd>`,blurb:`list, show, init, push, run, usage, integrations`},{usage:`credentials <cmd>`,blurb:`engine credentials: list, add, login, remove, default`},{usage:`server <cmd>`,blurb:`self-host Coder: serve, rotate-key`},{usage:`runner <cmd>`,blurb:`run your server's tasks on this machine: serve, list, ...`},{usage:`auth <cmd>`,blurb:`sign in to Coder: login, logout, status`},{usage:`review [--base <ref> | --pr <n>]`,blurb:`review changed code with a built-in flow`},{usage:`config <list|get|set|unset> [<key> [value]]`,blurb:`read or write config`},{usage:`model <list|add|alias|disable>`,blurb:`manage models: built-ins, aliases, custom endpoints`},{usage:`connection <cmd>`,blurb:`platform accounts, API keys and MCP servers tasks use: add, list, rm, ...`},{usage:`docs [topic]`,blurb:`print bundled documentation (for agents to read)`},{usage:`upgrade [--cli-only|--plugins-only]`,blurb:`update the CLI and host plugins (alias: update)`}],start:[{usage:`coder setup-host [claude|agents]`,blurb:`"claude" for Claude Code, "agents" for any ~/.agents host (Codex, Pi, ...)`},{usage:`coder run --engine [codex|claude] "<task>"`,blurb:`run a task on that engine's default model`},{usage:`coder task result <task-id> --wait`,blurb:`wait for the answer; returns early if the task needs your approval`}],agents:[{usage:`coder docs skill [--claude]`,blurb:`load the skill once`}],usage:[{usage:`coder <command> --help`,blurb:`flags and details for any command`}]};function D(e,t,n=t.cyan){let r=Math.max(0,...e.map(e=>e.usage.length))+2;return e.map(e=>`  ${n(e.usage.padEnd(r))}${t.dim(e.blurb)}${e.note?` ${t.light(e.note)}`:``}`)}function O(e,t,n){return[``,n.bold(`${e}:`),...t]}function k(e,t,n={}){let r=m;return`${[r.bold(`Usage:`),`  ${n.usage??`coder ${e} <subcommand>`}`,...n.description?.length?[``,...n.description]:[],...O(`Subcommands`,D(t,r),r),...n.examples?.length?O(`Examples`,n.examples.flatMap(([e,t])=>[`  ${r.cyan(e)}`,`    ${r.dim(t)}`]),r):[],...n.seeAlso?O(`Related`,n.seeAlso.split(` · `).map(e=>`  ${r.cyan(`coder ${e}`)}`),r):[],``,g([`Details on a subcommand: coder ${e} <subcommand> --help`],r,r.cyan)].join(`
+`)}\n`}function A(e,t){if(!t)return null;let n=m,r=([e,t])=>({usage:e,blurb:t}),i=[n.bold(`Usage:`),`  ${t.usage}`];t.summary&&i.push(``,t.summary),t.flags?.length&&i.push(...O(`Flags`,D(t.flags.map(r),n),n)),t.globalFlags?.length&&i.push(...O(`Global flags`,D(t.globalFlags.map(r),n),n)),t.exitCodes?.length&&i.push(...O(`Exit codes`,D(t.exitCodes.map(r),n),n)),t.env?.length&&i.push(...O(`Environment`,D(t.env.map(r),n),n)),t.examples?.length&&i.push(...O(`Examples`,t.examples.flatMap(([e,t])=>[`  ${n.cyan(e)}`,`    ${n.dim(t)}`]),n));let a=e.includes(` `)?[`${e.slice(0,e.lastIndexOf(` `))} --help`]:t.seeAlso?.split(` · `)??[];return a.length&&i.push(...O(`Related`,a.map(e=>`  ${n.cyan(`coder ${e}`)}`),n)),`${i.join(`
+`)}\n`}function j(e,t){let n=m,{start:r,agents:i,usage:a,commands:o,globals:s}=e,c=D([...r,...i,...a,...o,...s],n),l=(e,t)=>c.slice(e,e+t);return`${[`${n.bold(e.title)} ${n.dim(`v${t}`)}`,e.description,...O(`Get started`,l(0,r.length),n),...O(`Agents`,l(r.length,i.length),n),...O(`Usage`,[`  ${e.usageLine}`,...l(r.length+i.length,a.length)],n),...O(`Commands`,l(r.length+i.length+a.length,o.length),n),...O(`Global`,c.slice(-s.length),n)].join(`
+`)}\n`}function M(e){let t=e.indexOf(`--`),n=t===-1?e:e.slice(0,t);return n.includes(`-h`)||n.includes(`--help`)}const N=`Use luna or sonnet for mechanical work; sol or opus is the default.
+Use astra or fable for the hardest work; they cost the most.`,P={json:[`--json`,`JSON output`],cwd:[`--cwd <dir>`,`workspace directory (default: current)`]},F=[`--server [url] [--workspace <slug>]`,`act on your Coder server; --workspace overrides the saved workspace for this command`],I=[`--server [url]`,`act on your Coder server, in the saved workspace`],L=e=>e===`https://coder.wular.ai`?`Sign in: coder auth login`:`Sign in: coder auth login --server ${e}`;async function R(e,t=!1){let n=c(e);if(s(n))return n;if(!t){if(!l())throw new a(`invalid-option`,`First use of Coder server ${new URL(n).origin} needs confirmation.`,{hint:`Inspect the origin, then repeat with --yes.`});if((await o({title:`Connect to ${new URL(n).origin}?`,hint:`This server can receive task and agent data.`,options:[{value:`yes`,label:`Continue`},{value:`no`,label:`Cancel`}]}))[0]!==`yes`)throw new a(`invalid-option`,`Server connection cancelled.`)}return d(n),n}function z(e){return e.cwd?v.resolve(String(e.cwd)):y.cwd()}function B(e){y.stderr.write(`[coder] No engine could start. Follow fallback.instructions with a native subagent.
+`),f(e)}function V(e,t=!1){let n=`read-only unavailable on this host: the OS sandbox failed to start (Linux/WSL2 needs bubblewrap + socat). Re-dispatch with --permissions auto (or workspace-write) if writes are acceptable, or install the sandbox deps.`;t?f({error:n,code:`read-only-unavailable`,detail:e}):y.stderr.write(`[coder] ${n}\n`),y.exit(1)}function H(e,t,n,i=!1){if(i)f({taskId:t,status:`awaiting-approval`,approval:n});else{let i=r(e).approvals.escalationTimeoutMs/1e3,a=[`Approve: coder task approve ${t} ${n.id}`,`Deny: coder task approve ${t} ${n.id} --deny`,`Then wait again in its own background shell, one per task: coder task result ${t} --wait`,`Unanswered approvals auto-deny after ${i} seconds.`];n.networkHost&&a.push(`Network access to ${n.networkHost} can be pre-approved with approvals.allowedNetworkHosts.`),y.stdout.write(`Approval needed for task ${t}: ${n.summary}\n`),n.cwd&&y.stdout.write(`Runs in: ${n.cwd}\n`),y.stderr.write(`\n${g(a,h,h.blue,`Next steps`)}\n`)}y.exit(4)}function U(e,t,n){switch(e.code){case`chain-exhausted`:B(e.payload),y.exit(3);case`read-only-unavailable`:V(e.message,n.json);case`approval-pending`:H(t,e.taskId,e.approval,n.json);case`startup-failed`:n.json&&(f({taskId:e.taskId,status:`failed`,detail:e.message}),y.exit(1)),p(`Task ${e.taskId} failed to start.${e.message?`\n${e.message}`:``}`,{hint:`See: coder task result ${e.taskId}`});case`login-failed`:p(e.message,{hint:[L(c(n.server)),`Or, for a memory server, set the same ADMIN_TOKEN it was started with`]});case`server`:p(e.message,{hint:e.hint??(e.status===401?L(c(n.server)):void 0)});default:p(e.message,e.hint?{hint:e.hint}:{})}}function W(t){return Object.assign(async n=>{let{options:r,positionals:i}=_(n,e(t.options),{positionals:t.args??0,command:t.name}),o={options:r,args:i,cwd:z(r)},s=r,c;try{s.server!==void 0&&await R(s.server,s.yes),c=await t.run(o)}catch(e){throw e instanceof a&&U(e,o.cwd,s),e}s.json&&c!==void 0?f(t.json?t.json(c,o):c):await t.print?.(c,o);let l=t.exit?.(c,o);l!==void 0&&(y.exitCode=l)},{commandName:t.helpName??t.name,help:t.help&&{...t.help,globalFlags:Object.keys(P).filter(e=>t.globalFlags?.[e]!==!1).map(e=>P[e])}})}function G(e,t,n,{aliases:r={},nested:i=[],hint:a=`Help: coder ${e} --help`,help:o}={}){return Object.assign(async n=>{let[o,...s]=n;if(!o||o===`help`||o===`-h`||o===`--help`)return void y.stdout.write(await J(e));let c=t[o];if(c||(y.stdout.write(await J(e)),p(`Unknown ${e} subcommand "${o}".`,{hint:a})),!i.includes(o)&&M(s)){let t=`${e} ${r[o]??o}`;y.stdout.write(A(t,await q(t))??await J(e));return}await(await c())(s)},{commandName:e,help:o,groupHelp:n,subcommands:t})}async function K(e){let[t,...n]=e.split(` `),r=T[t];if(!r)return;let i=await r();for(let e of n){let t=i.subcommands?.[e];if(!t)return;i=await t()}return i}async function q(e){let t=await K(e);return t&&(t.commandName===e||T[e])?t.help:void 0}async function J(e){let t=await K(e);if(!t)return null;if(!t.groupHelp)return A(t.commandName??e,t.help);let n=t.groupHelp;return k(e,n.menu,{...n,...n.details?{description:[t.help.summary],examples:t.help.examples,seeAlso:t.help.seeAlso}:{},...n.exampleCommand?{examples:(await q(n.exampleCommand))?.examples}:{}})}const Y=()=>j({...E,globals:[{usage:`-h, --help`,blurb:`show help (top-level, or for a command)`},{usage:`-v, --version`,blurb:`print the coder version`},...Object.values(P).map(([e,t])=>({usage:e,blurb:t}))]},t()),X=new Set([`task`,`model`,`flow`,`agent`,`server`,`runner`,`auth`,`credentials`,`connection`]);async function Z(){let[e,...r]=y.argv.slice(2);if(e===`--version`||e===`-v`){y.stdout.write(`${t()}\n`);return}if(e===void 0||e===`help`||e===`--help`||e===`-h`){if(r[0]&&X.has(r[0])&&r[1]===void 0)return void y.stdout.write(await J(r[0]));for(let e of[r.slice(0,3),r.slice(0,2),...r.map(e=>[e])]){let t=e.join(` `),n=await q(t);if(n){let e=await K(t);y.stdout.write(A(e.commandName,n));return}}y.stdout.write(Y());return}if(![`task worker`,`task archive-sweep`,`task mcp`,`agent tools`,`upgrade refresh`,`update refresh`].includes(`${e} ${r[0]}`)){let e=i(t(),n);e&&y.stderr.write(h.dim(`coder ${t()} -> `)+h.bold(e)+h.dim(` available. run: coder upgrade
+
+`))}let o=T[e];if(o||(y.stdout.write(Y()),y.stdout.write(`
+`),p(`Unknown command "${e}".`,{hint:`See all commands: coder --help`})),!X.has(e)&&M(r)){let t=await o();y.stdout.write(A(t.commandName??e,t.help)??Y());return}try{await(await o())(r)}catch(t){let n=t instanceof Error?t.message:String(t);throw/^(Unknown option|Missing value)/.test(n)&&await q(e)&&p(n,{hint:`Help: coder ${e} --help`}),t instanceof a&&t.hint&&p(t.message,{hint:t.hint}),t}}function Q(){return y.stdout.on(`error`,e=>{throw e.code===`EPIPE`&&y.exit(0),e}),Z().catch(e=>{e instanceof u&&y.exit(130);let t=e instanceof Error&&e.cause instanceof Error?`: ${e.cause.message}`:``;y.stderr.write(`${e instanceof Error?e.message:String(e)}${t}\n`),y.exit(1)})}const $=y.argv[1]&&b(y.argv[1]).href;$&&[import.meta.url,new URL(`./cli.js`,import.meta.url).href].includes($)&&Q();export{R as a,Q as c,D as d,A as f,W as i,J as l,N as n,q as o,O as p,F as r,G as s,I as t,Y as u};

package/dist/cli.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./cli-IfrPgeYz.js";export{c as CREDENTIAL_SERVER_FLAG,i as MODEL_HINT,o as SERVER_FLAG,n as command,e as confirmServer,a as getCommandHelp,s as group,t as main,r as renderHelp,l as renderTopHelp};
+import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./cli-D5hyqGq0.js";export{c as CREDENTIAL_SERVER_FLAG,i as MODEL_HINT,o as SERVER_FLAG,n as command,e as confirmServer,a as getCommandHelp,s as group,t as main,r as renderHelp,l as renderTopHelp};

package/dist/config-BdeKsCPh.js

@@ -0,0 +1,3 @@
+import{O as e,m as t,p as n,y as r}from"./config-D2FxHWwi.js";import{H as i}from"./dispatch-D3Dqxijf.js";import{f as a,i as o}from"./cli-D5hyqGq0.js";import{h as s,p as c}from"./output-BKeyLbvt.js";import{n as l,t as u}from"./args-CxsMr9Un.js";import d from"node:process";const f=e=>new i(`invalid-option`,`Usage: ${e}`);function p(e){try{return JSON.parse(e)}catch{return e.includes(`,`)?e.split(`,`).map(e=>e.trim()).filter(Boolean):e}}const m=o({name:`config`,help:{usage:`coder config <list|get|set|unset> [<key> [value]] [--workspace]`,summary:"Read or write configuration. `list` prints the effective config; get/set/unset\ntarget a dotted key (e.g. engines.codex.model). Writes go to ~/.coder/config.json.",flags:[[`--workspace`,`target <repo>/.coder/config.json instead of the user file`]],examples:[[`coder config list`,`print the effective config`],[`coder config set chain codex,claude`,`set the engine fallback chain`],[`coder config get engines.codex.model`,`read one value`]]},options:{...u,workspace:l},args:1/0,run({options:e,args:[i,a,...o],cwd:s}){if(!(!i||i===`help`)){if(i===`list`)return{action:i,config:r(s)};if(i===`get`){if(!a)throw f(`coder config get <key>  (e.g. chain, engines.codex.model)`);return{action:i,value:n(s,a)}}if(i!==`set`&&i!==`unset`)throw f(`coder config <list|get|set|unset> [<key> [value]] [--workspace]`);if(!a||i===`set`&&o.length===0)throw f(`coder config ${i} <key>${i===`set`?` <value>`:``}`);return{action:i,set:t(s,a,p(o.join(` `)),{workspace:e.workspace,unset:i===`unset`})}}},json(e){let t=e;return t.action===`list`?t.config:t.action===`get`?t.value??null:t.set},print(t){if(!t)return void d.stdout.write(a(`config`,m.help));if(t.action===`list`)return h(t.config,e());if(t.action===`get`)return g(t.value);_(t.set)}});function h(e,t){let n=c,r=e=>[e?.model,e?.effort,e?.permissions].filter(Boolean).join(`/`)||`-`;d.stdout.write([`${n.dim(`chain`)}      ${e.chain.join(` -> `)}`,`${n.dim(`codex`)}      ${r(e.engines.codex)}`,`${n.dim(`claude`)}     ${r(e.engines.claude)}`,`${n.dim(`approvals`)}  timeout=${e.approvals.escalationTimeoutMs}ms  hosts=[${e.approvals.allowedNetworkHosts.join(`, `)}]`,`${n.dim(`file`)}       ${t}`].join(`
+`)+`
+`)}function g(e){if(e===null||typeof e==`object`&&e!==void 0)return s(e);d.stdout.write(`${e===void 0?`(unset)`:String(e)}\n`)}function _(e){let t=c,n=e.unset?`unset ${t.cyan(e.key)}`:`${t.cyan(e.key)} = ${JSON.stringify(e.value)}`;d.stdout.write(`${n}  ${t.dim(`(${e.file})`)}\n`)}export{m as commandConfig};

package/dist/config-D2FxHWwi.js

@@ -0,0 +1,14 @@
+import{$t as e,Cr as t,Di as n,Ei as r,Er as i,Fi as a,Gr as o,Ir as s,Jr as c,Kn as l,Lr as u,Ni as d,Oi as f,Or as ee,Pn as te,Pr as ne,Rt as p,Tr as re,Ui as m,Ur as ie,Vr as ae,Wt as oe,X as se,Yn as ce,Yt as le,Zt as ue,_i as de,bi as fe,br as pe,en as me,er as he,gt as ge,hr as _e,in as ve,kr as ye,nt as be,vi as xe,vn as Se,wr as Ce,yi as we,yt as Te,zi as Ee,zn as De}from"./core-DwsAMCnL.js";import h from"node:path";import g from"node:process";import{fileURLToPath as Oe}from"node:url";import _ from"node:fs";import{execFileSync as v,spawn as y,spawnSync as ke}from"node:child_process";import{createHash as Ae,randomUUID as b}from"node:crypto";import x from"node:os";import S from"node:net";import je from"node:readline";const C=m(`ZodMiniType`,(e,t)=>{if(!e._zod)throw Error(`Uninitialized schema in ZodMiniType.`);ie.init(e,t),e.def=t,e.type=t.type,e.parse=(t,n)=>de(e,t,n,{callee:e.parse}),e.safeParse=(t,n)=>we(e,t,n),e.parseAsync=async(t,n)=>xe(e,t,n,{callee:e.parseAsync}),e.safeParseAsync=async(t,n)=>fe(e,t,n),e.check=(...n)=>e.clone({...t,checks:[...t.checks??[],...n.map(e=>typeof e==`function`?{_zod:{check:e,def:{check:`custom`},onattach:[]}}:e)]},{parent:!0}),e.with=e.check,e.clone=(t,n)=>r(e,t,n),e.brand=()=>e,e.register=((t,n)=>(t.add(e,n),e)),e.apply=t=>t(e)}),Me=m(`ZodMiniString`,(e,t)=>{s.init(e,t),C.init(e,t)});function w(e){return ve(Me,e)}const Ne=m(`ZodMiniStringFormat`,(e,t)=>{u.init(e,t),Me.init(e,t)}),Pe=m(`ZodMiniURL`,(e,t)=>{o.init(e,t),Ne.init(e,t)});function Fe(e){return Se(Pe,e)}const Ie=m(`ZodMiniNumber`,(e,t)=>{Ce.init(e,t),C.init(e,t)});function Le(e){return le(Ie,e)}const Re=m(`ZodMiniNumberFormat`,(e,t)=>{re.init(e,t),Ie.init(e,t)});function ze(e){return Te(Re,e)}const Be=m(`ZodMiniBoolean`,(e,t)=>{De.init(e,t),C.init(e,t)});function T(e){return se(Be,e)}const Ve=m(`ZodMiniNever`,(e,t)=>{pe.init(e,t),C.init(e,t)});function He(e){return oe(Ve,e)}const Ue=m(`ZodMiniArray`,(e,t)=>{te.init(e,t),C.init(e,t)});function E(e,t){return new Ue({type:`array`,element:e,...d(t)})}const We=m(`ZodMiniObject`,(e,t)=>{i.init(e,t),C.init(e,t),n(e,`shape`,()=>t.shape)});function Ge(e,t){let n={type:`object`,shape:e??{},...d(t)};return new We(n)}function D(e,t){return new We({type:`object`,shape:e,catchall:He(),...d(t)})}function Ke(e,t){return f(e,t)}function O(e,t){return a(tt,e,t)}const qe=m(`ZodMiniUnion`,(e,t)=>{c.init(e,t),C.init(e,t)});function Je(e,t){return new qe({type:`union`,options:e,...d(t)})}const Ye=m(`ZodMiniRecord`,(e,t)=>{ne.init(e,t),C.init(e,t)});function k(e,t,n){return!t||!t._zod?new Ye({type:`record`,keyType:w(),valueType:e,...d(t)}):new Ye({type:`record`,keyType:e,valueType:t,...d(n)})}const Xe=m(`ZodMiniEnum`,(e,t)=>{he.init(e,t),C.init(e,t),e.options=Object.values(t.entries)});function A(e,t){let n=Array.isArray(e)?Object.fromEntries(e.map(e=>[e,e])):e;return new Xe({type:`enum`,entries:n,...d(t)})}const Ze=m(`ZodMiniLiteral`,(e,t)=>{_e.init(e,t),C.init(e,t)});function Qe(e,t){return new Ze({type:`literal`,values:Array.isArray(e)?e:[e],...d(t)})}const $e=m(`ZodMiniTransform`,(e,t)=>{ae.init(e,t),C.init(e,t)});function et(e){return new $e({type:`transform`,transform:e})}const tt=m(`ZodMiniOptional`,(e,t)=>{ee.init(e,t),C.init(e,t)});function j(e){return new tt({type:`optional`,innerType:e})}const nt=m(`ZodMiniNullable`,(e,n)=>{t.init(e,n),C.init(e,n)});function rt(e){return new nt({type:`nullable`,innerType:e})}const it=m(`ZodMiniDefault`,(e,t)=>{ce.init(e,t),C.init(e,t)});function at(e,t){return new it({type:`default`,innerType:e,get defaultValue(){return typeof t==`function`?t():Ee(t)}})}const ot=m(`ZodMiniPipe`,(e,t)=>{ye.init(e,t),C.init(e,t)});function st(e,t){return new ot({type:`pipe`,in:e,out:t})}const ct=m(`ZodMiniCustom`,(e,t)=>{l.init(e,t),C.init(e,t)});function lt(t,n={}){return e(ct,t,n)}function ut(e){return be(Ie,e)}function dt(e,t){if(!t)return``;if(!h.isAbsolute(t))return t;let n=h.relative(e,t);return n&&!n.startsWith(`..`)?n:t}function ft(e){try{return JSON.parse(_.readFileSync(e,`utf8`))}catch{return null}}function pt(e,t){_.mkdirSync(h.dirname(e),{recursive:!0});let n=`${e}.${process.pid}.${b()}.tmp`;try{_.writeFileSync(n,`${JSON.stringify(t,null,2)}\n`,{encoding:`utf8`,flag:`wx`}),_.renameSync(n,e)}finally{_.rmSync(n,{force:!0})}}function mt(e,t){if(_.mkdirSync(h.dirname(t),{recursive:!0}),_.existsSync(t))throw Object.assign(Error(`Directory already exists: ${t}`),{code:`EEXIST`});try{_.renameSync(e,t);return}catch(e){if(e.code!==`EXDEV`)throw e}let n=`${t}.${process.pid}.${b()}.tmp`;try{_.cpSync(e,n,{recursive:!0,preserveTimestamps:!0,verbatimSymlinks:!0,errorOnExist:!0,force:!1}),_.renameSync(n,t),_.rmSync(e,{recursive:!0})}finally{_.rmSync(n,{recursive:!0,force:!0})}}async function ht(e,t){if(await _.promises.mkdir(h.dirname(t),{recursive:!0}),await _.promises.lstat(t).catch(e=>{if(e.code!==`ENOENT`)throw e}))throw Object.assign(Error(`Directory already exists: ${t}`),{code:`EEXIST`});try{await _.promises.rename(e,t);return}catch(e){if(e.code!==`EXDEV`)throw e}let n=`${t}.${process.pid}.${b()}.tmp`;try{await _.promises.cp(e,n,{recursive:!0,preserveTimestamps:!0,verbatimSymlinks:!0,errorOnExist:!0,force:!1}),await _.promises.rename(n,t),await _.promises.rm(e,{recursive:!0})}finally{await _.promises.rm(n,{recursive:!0,force:!0})}}function gt(e){let t=0,n=``;return()=>{let r;try{r=_.statSync(e).size}catch{return[]}if(r<t&&(t=0,n=``),r===t)return[];let i;try{i=_.openSync(e,`r`)}catch{return[]}try{let e=Buffer.alloc(r-t),a=_.readSync(i,e,0,e.length,t);t+=a;let o=(n+e.toString(`utf8`,0,a)).split(`
+`);return n=o.pop()??``,o.filter(Boolean)}finally{_.closeSync(i)}}}const M=w().check(p(1)),_t=Ge({access_token:M,token_type:w().check(lt(e=>e.toLowerCase()===`bearer`)),refresh_token:j(M),expires_in:j(Le().check(ge(0))),scope:j(w()),name:j(M),preferred_username:j(M),email:j(M)}),vt=Ge({error:M});function yt(e){let t=new URL(e),n=t.hostname===`localhost`||t.hostname===`[::1]`||/^127\.(?:\d{1,3}\.){2}\d{1,3}$/.test(t.hostname);if(t.protocol!==`https:`&&!(t.protocol===`http:`&&n)||t.username||t.password||t.hash)throw Error(`OAuth URLs require HTTPS or loopback and no credentials or fragment.`);return t}async function bt(e,t,n={}){let r=yt(t).origin;for(let i=0;i<5;i++){let i=await e(t,{...n,redirect:`manual`,signal:n.signal??AbortSignal.timeout(15e3)});if(i.status<300||i.status>=400)return i;let a=i.headers.get(`location`);if(!a)throw Error(`OAuth redirect has no location.`);let o=yt(new URL(a,t).href);if(o.origin!==r)throw Error(`OAuth redirect changed origin.`);if(await i.body?.cancel(),i.status===303||(i.status===301||i.status===302)&&n.method===`POST`)throw Error(`OAuth redirect would discard the request body.`);t=o.href}throw Error(`Too many OAuth redirects.`)}function xt(e,t){let n=new Headers({"content-type":`application/x-www-form-urlencoded`,accept:`application/json`}),r=e.tokenEndpointAuthMethod??(e.clientSecret?`client_secret_basic`:`none`);if(r!==`none`&&!e.clientSecret)throw Error(`OAuth client secret is missing.`);if(r===`client_secret_basic`){let t=e=>new URLSearchParams({v:e}).toString().slice(2);n.set(`authorization`,`Basic ${Buffer.from(`${t(e.clientId)}:${t(e.clientSecret)}`).toString(`base64`)}`)}else t.set(`client_id`,e.clientId),r===`client_secret_post`&&t.set(`client_secret`,e.clientSecret);return n}async function St(e,t,n){n.set(`resource`,t.resource);let r=xt(t,n),i=await bt(e,t.tokenEndpoint,{method:`POST`,headers:r,body:n}),a=await i.json();if(!i.ok){let e=vt.safeParse(a);throw n.get(`grant_type`)===`refresh_token`&&i.status>=400&&i.status<500&&e.success&&[`invalid_grant`,`invalid_client`].includes(e.data.error)?new N(`The OAuth connection must be reconnected.`):Error(`OAuth token request failed.`)}return _t.parse(a)}function Ct(e,t,n){return{...e,accessToken:t.access_token,refreshToken:t.refresh_token??e.refreshToken,expiresAt:t.expires_in===void 0?void 0:n+t.expires_in*1e3,scope:t.scope??e.scope}}async function wt(e){let{secret:t,now:n}=e;if(!e.force&&t.accessToken&&(t.expiresAt===void 0?!t.refreshToken:t.expiresAt-n>=6e4))return t.accessToken;if(!t.refreshToken)throw new N(`The OAuth connection must be reconnected.`);let r=Ct(t,await St(e.fetch,t,new URLSearchParams({grant_type:`refresh_token`,refresh_token:t.refreshToken})),n);return await e.save(r),r.accessToken}var N=class extends Error{},P=class extends Error{authenticate;constructor(e,t){super(e),this.authenticate=t}};function F(e){return/^[A-Z][A-Z0-9_]*$/.test(e)&&!/^(CODER_|CODEX_|LD_|DYLD_|GIT_|APP_TOKEN(?:_|$))/.test(e)&&![`PATH`,`HOME`,`SHELL`,`USER`,`PWD`,`TMPDIR`,`NODE_OPTIONS`,`NODE_PATH`,`BASH_ENV`,`ENV`,`OPENAI_API_KEY`,`ANTHROPIC_API_KEY`,`CLAUDE_CODE_OAUTH_TOKEN`,`CODEX_AUTH_JSON`,`CODEX_HOME`,`CLAUDE_CONFIG_DIR`,`OPENAI_BASE_URL`,`ANTHROPIC_BASE_URL`].includes(e)}function Tt(e,t){return t?e?t.filter(t=>e.includes(t)):t:e}function Et(e){let t=new Set,n=new Set;for(let r of e){if(r.provider!==`env`||!r.keyIn||!(`env`in r.keyIn))continue;let e=r.keyIn.env;t.has(e)&&n.add(e),t.add(e)}return n}function I(e=process.env){let t=JSON.parse(e.CODER_CONNECTION_ENV_VALUES??`{}`);return Object.fromEntries(Object.entries(t).filter(e=>F(e[0])&&typeof e[1]==`string`))}function Dt(e=process.env){let t=Object.entries(I(e)).sort(([e],[t])=>e.localeCompare(t));return t.length?Ae(`sha256`).update(JSON.stringify(t)).digest(`hex`):void 0}function L(e=process.env){return{...Object.fromEntries(Object.entries(e).filter(([e])=>!e.startsWith(`CODER_CONNECTION_`)&&e!==`CODER_MCP_CONNECTION_ENV`)),...Object.fromEntries(Object.entries(I(e)).filter(([t])=>e[t]===void 0))}}function Ot(e){let t={};for(let n of Object.values(e))for(let[e,r]of Object.entries(n.env??{}))t[e]=Object.hasOwn(t,e)?null:r;return t}const kt=e=>e instanceof P||e instanceof N,At=(e,t)=>kt(t)?`${e} needs reconnecting.`:`${e} is temporarily unavailable; skipped for this task.`;function jt(e){if(e.status===401||e.status===403)throw new P(`MCP credential was refused`,e.headers.get(`www-authenticate`)??void 0);if(!e.ok)throw Error(`MCP did not answer`)}const Mt=e=>/^[a-zA-Z0-9_.-]{1,128}$/.test(e);function Nt(e,t){return!e.username&&!e.password&&(t||!/^(?:(?:[a-z0-9_-]+\.)*localhost\.?|127\.\d+\.\d+\.\d+|\[::1\]|\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\])$/i.test(e.hostname))&&(e.protocol===`https:`||e.protocol===`http:`&&[`localhost`,`127.0.0.1`,`[::1]`].includes(e.hostname))}function R(e,t){try{return JSON.parse(_.readFileSync(e,`utf8`))}catch(e){if(e.code===`ENOENT`)return t;throw e}}function z(e,t){_.mkdirSync(h.dirname(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;try{_.writeFileSync(n,`${JSON.stringify(t,null,2)}\n`,{mode:384}),_.chmodSync(n,384),_.renameSync(n,e)}finally{_.rmSync(n,{force:!0})}}var Pt=class{secrets;file;credentialFile;lock;constructor(e=V(),t=process.platform,n){this.file=h.join(e,`connections.json`),this.credentialFile=h.join(e,`local-credentials.json`),this.lock=h.join(e,`state`,`global`,`connections.lock`);let r=h.join(e,`credentials.json`);this.secrets=n??(t===`darwin`?{get(e){try{return v(`security`,[`find-generic-password`,`-s`,`coder`,`-a`,e,`-w`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`pipe`]}).trimEnd()}catch(e){if(e.status===44)return;throw Error(`Could not read the connection keychain`)}},put(e,t){try{let n=e=>`"`+e.replaceAll(`\\`,`\\\\`).replaceAll(`"`,`\\"`)+`"`;if(/[\r\n\0]/.test(e+t))throw Error(`Invalid keychain value`);v(`security`,[`-i`],{input:`add-generic-password -U -s coder -a ${n(e)} -w ${n(t)}\n`,stdio:[`pipe`,`pipe`,`pipe`]})}catch{throw Error(`Could not save the connection keychain`)}},delete(e){try{v(`security`,[`delete-generic-password`,`-s`,`coder`,`-a`,e],{stdio:[`ignore`,`pipe`,`pipe`]})}catch(e){if(e.status!==44)throw Error(`Could not remove the connection keychain`)}}}:{get:e=>R(r,{})[e],put(e,t){z(r,{...R(r,{}),[e]:t})},delete(e){let t=R(r,{});delete t[e],z(r,t)}})}async withLock(e,t){let n=t===void 0?this.lock:`${this.lock}-${Ae(`sha256`).update(t).digest(`hex`)}`;_.mkdirSync(h.dirname(n),{recursive:!0});let r=_.mkdtempSync(`${n}-`),i=`${process.pid}-${Date.now()}-${b()}`;_.mkdirSync(h.join(r,i),{mode:448});let a=!1,o;try{for(;;)try{_.renameSync(r,n),a=!0;break}catch(e){if(![`EEXIST`,`ENOTEMPTY`].includes(e.code??``))throw e;let t=(()=>{try{return _.readdirSync(n)}catch(e){if(e.code===`ENOENT`)return[];throw e}})();for(let e of t){let t=h.join(n,e),r=Number(e.split(`-`)[0]);try{let e=Date.now()-_.statSync(t).mtimeMs>3e4;if(Number.isInteger(r)&&r>0)try{process.kill(r,0)}catch(t){e||=t.code===`ESRCH`}e&&_.rmdirSync(t)}catch{}}try{_.rmdirSync(n)}catch{}await new Promise(e=>setTimeout(e,25))}return o=setInterval(()=>{try{_.utimesSync(h.join(n,i),new Date,new Date)}catch{}},1e3),o.unref(),await e()}finally{if(clearInterval(o),a){try{_.rmdirSync(h.join(n,i))}catch{}try{_.rmdirSync(n)}catch{}}else _.rmSync(r,{recursive:!0,force:!0})}}list(){return Object.values(R(this.file,{}))}get(e){let t=this.list().find(t=>t.id===e);if(!t)return;let n;try{n=t.auth===`none`?void 0:this.secrets.get(e)}catch{return{...t,broken:{at:Date.now(),reason:`Needs reconnecting`}}}return{...t,...n?{secret:n}:{}}}put(e){if(e.provider===`env`&&(e.auth!==`key`||e.access!==`write`||e.endpoint||e.secret||!e.credential||!e.keyIn||!(`env`in e.keyIn)||!F(e.keyIn.env)))throw Error(`Invalid environment connection`);let{secret:t,...n}=e,r=R(this.file,{});t?this.secrets.put(e.id,t):r[e.id]?.auth!==`none`&&r[e.id]&&this.secrets.delete(e.id),r[e.id]=n,z(this.file,r)}delete(e){let t=R(this.file,{}),n=t[e]&&t[e].auth!==`none`;delete t[e],z(this.file,t),n&&this.secrets.delete(e)}credentials(){return Object.entries(R(this.credentialFile,{})).flatMap(([e,t])=>{let n=this.secrets.get(`credential/${e}`);return n?[{id:e,value:{...t,...JSON.parse(n)}}]:[]})}putCredential(e,t){let{iv:n,tag:r,ciphertext:i,...a}=t;this.secrets.put(`credential/${e}`,JSON.stringify({iv:n,tag:r,ciphertext:i})),z(this.credentialFile,{...R(this.credentialFile,{}),[e]:a})}deleteCredential(e){let t=R(this.credentialFile,{});delete t[e],z(this.credentialFile,t),this.secrets.delete(`credential/${e}`)}};async function Ft(e,t,n){let r=await t(e.url,{redirect:`manual`,signal:n,headers:{...e.headers,accept:`text/event-stream`}});if(!r.ok||!r.body)throw await r.body?.cancel(),jt(r),Error(`MCP did not answer`);let i=r.body.getReader(),a=new Map,o,s,c=new Promise((e,t)=>{o=e,s=t});c.catch(()=>{});let l,u=e=>{l=e,s(e);for(let t of a.values())t.reject(e);a.clear()},d=()=>{u(n.reason),i.cancel().catch(()=>{})};n.addEventListener(`abort`,d,{once:!0}),n.aborted&&d();let f=(async()=>{let t=new TextDecoder,n=``;for(;;){let r=await i.read();if(r.done)throw Error(`MCP stream closed`);n=(n+t.decode(r.value,{stream:!0})).replaceAll(`\r
+`,`
+`);let s;for(;(s=n.indexOf(`
+
+`))>=0;){let t=n.slice(0,s).split(`
+`);n=n.slice(s+2);let r=t.find(e=>e.startsWith(`event:`))?.slice(6).trim(),i=t.filter(e=>e.startsWith(`data:`)).map(e=>e.slice(5).trimStart()).join(`
+`);if(r===`endpoint`){let t=new URL(i,e.url);if(t.origin!==new URL(e.url).origin||t.username||t.password)throw Error(`MCP endpoint changed origin`);o(t.href)}else if(i){let e=JSON.parse(i),t=a.get(e.id);if(!t)continue;a.delete(e.id),e.error||!e.result?t.reject(Error(`Invalid MCP response`)):t.resolve(e.result)}}}})().catch(u);return{async rpc(r,i,o){let s=await c;if(n.throwIfAborted(),l)throw l;let u=o===void 0?void 0:new Promise((e,t)=>{a.set(o,{resolve:e,reject:t})});u?.catch(()=>{});try{let a=await t(s,{method:`POST`,redirect:`manual`,signal:n,headers:{...e.headers,"content-type":`application/json`},body:JSON.stringify({jsonrpc:`2.0`,method:r,...o===void 0?{}:{id:o},...i?{params:i}:{}})});return jt(a),await a.body?.cancel(),await u}catch(e){throw o!==void 0&&(a.get(o)?.reject(e),a.delete(o)),e}},async close(){await i.cancel().catch(()=>{}),await f,n.removeEventListener(`abort`,d)}}}async function It(e,t,n=fetch){if(!e.endpoint)throw Error(`Missing endpoint`);let r={...e.endpoint,name:e.id};if(t)if(r.command){if(!e.keyIn||!(`env`in e.keyIn))throw Error(`Missing key env`);r.env={...r.env,[e.keyIn.env]:t},r.credentialFields={env:e.keyIn.env}}else{let n=e.keyIn&&`header`in e.keyIn?e.keyIn.header:`Authorization`;r.headers={...r.headers,[n]:n.toLowerCase()===`authorization`?`Bearer ${t}`:t},r.credentialFields={header:n}}if(r.command){if(e.access===`observe`&&!r.tools?.length)throw Error(`Observe requires tools`);return r}let i=AbortSignal.timeout(5e3),a,o=r.type===`sse`?`2024-11-05`:`2025-11-25`,s=async(e,t,s)=>{let c=await n(r.url,{method:`POST`,redirect:`manual`,signal:i,headers:{...r.headers,"content-type":`application/json`,accept:`application/json, text/event-stream`,"mcp-protocol-version":o,...a?{"mcp-session-id":a}:{}},body:JSON.stringify({jsonrpc:`2.0`,method:e,...s===void 0?{}:{id:s},...t?{params:t}:{}})});if(jt(c),a=c.headers.get(`mcp-session-id`)??a,s===void 0){await c.body?.cancel();return}let l=await c.text(),u=(c.headers.get(`content-type`)?.includes(`text/event-stream`)?l.split(/\r?\n\r?\n/).flatMap(e=>{let t=e.split(/\r?\n/).filter(e=>e.startsWith(`data:`)).map(e=>e.slice(5).trimStart()).join(`
+`);return t?[JSON.parse(t)]:[]}):[JSON.parse(l)]).find(e=>e.id===s);if(!u?.result||u.error)throw Error(`Invalid MCP response`);return u.result},c=r.type===`sse`?await Ft(r,n,i):void 0,l=c?.rpc??s;try{if(o=(await l(`initialize`,{protocolVersion:o,capabilities:{},clientInfo:{name:`coder`,version:`1`}},1)).protocolVersion??o,await l(`notifications/initialized`),e.access===`write`)return r;r.tools=[];let t,n=2,a=new Set;do{i.throwIfAborted();let o=await l(`tools/list`,t===void 0?{}:{cursor:t},n++);if(!Array.isArray(o.tools))throw Error(`Invalid tools`);if(r.tools.push(...o.tools.filter(t=>typeof t.name==`string`&&Mt(t.name)&&t.annotations?.readOnlyHint===!0&&(!e.endpoint?.tools?.length||e.endpoint.tools.includes(t.name))).map(e=>e.name)),t=o.nextCursor,t!==void 0){if(typeof t!=`string`||a.has(t))throw Error(`Invalid tools cursor`);a.add(t)}}while(t!==void 0);return r.tools.length?r:void 0}finally{c&&await c.close(),a&&await n(r.url,{method:`DELETE`,redirect:`manual`,signal:i,headers:{...r.headers,"mcp-session-id":a,"mcp-protocol-version":o}}).then(e=>e.body?.cancel()).catch(()=>{})}}function Lt(e,t={}){let n=new Set(zt()),r=Object.keys(t).length?{CODER_CONNECTION_ENV_VALUES:JSON.stringify(t)}:{};return{mcp:Object.fromEntries(Object.entries(e).map(([e,t])=>{let{credentialFields:i,...a}=t,o=a=>t[a]&&Object.fromEntries(Object.entries(t[a]).map(([t,o])=>{if(!(t===i?.[a===`env`?`env`:`header`]||n.has(o)))return[t,o];let s=`CODER_CONNECTION_${Ae(`sha256`).update(`${e}:${a}:${t}`).digest(`hex`).slice(0,24).toUpperCase()}`;return r[s]=o,[t,"${"+s+`}`]}));return[e,{...a,...t.env?{env:o(`env`)}:{},...t.headers?{headers:o(`headers`)}:{}}]})),env:r}}async function Rt(e,t,n=new Pt){let r=t??n.list().filter(t=>!t.owner&&(e===void 0||e.includes(t.id))).map(e=>e.id),i={},a={},o=[],s=Et(n.list().filter(e=>r.includes(e.id)&&!e.owner));return await Promise.all(r.map(async e=>{let t=n.get(e);if(!t||t.owner||![`mcp`,`env`].includes(t.provider))return;if(t.provider===`env`&&(t.auth!==`key`||t.access!==`write`||t.endpoint||!t.credential||!t.keyIn||!(`env`in t.keyIn)||!F(t.keyIn.env)||s.has(t.keyIn.env)||process.env[t.keyIn.env]!==void 0)){o.push(At(t.name,Error(`Invalid environment connection`)));return}if(t.broken){o.push(`${t.name} needs reconnecting.`);return}if(t.provider===`env`){let e=t.keyIn.env;try{let r=n.credentials().find(e=>e.id===t.credential)?.value,i=r?.iv===`plain`?JSON.parse(Buffer.from(r.ciphertext,`base64`).toString(`utf8`)).env[e]:void 0;if(!i)throw Error(`Missing credential`);a[e]=i}catch(e){o.push(At(t.name,e))}return}let r=async(r=!1,i)=>n.withLock(async()=>{let a=n.get(e);if(!a||a.owner||a.broken||a.auth!==t.auth)throw Error(`Connection changed during resolution`);if(t=a,!a.secret)throw Error(`Missing credential`);let o=a.secret.startsWith(`plain.`)?JSON.parse(Buffer.from(a.secret.slice(6),`base64`).toString(`utf8`)):{key:a.secret};return a.auth===`key`?o.key:wt({secret:o,fetch,now:Date.now(),force:r&&o.accessToken===i,save:async t=>n.withLock(async()=>{let r=n.get(e);if(!r||r.secret!==a.secret||r.auth!==a.auth||r.owner!==a.owner)throw Error(`Connection changed during refresh`);a.secret=`plain.${Buffer.from(JSON.stringify(t)).toString(`base64`)}`,n.put(a)})})},e);try{let n=t.auth===`none`?void 0:await r();if(t.auth!==`none`&&!n)throw Error(`Missing credential`);let a;try{a=await It(t,n)}catch(e){if(!(e instanceof P)||t.auth!==`oauth`)throw e;n=await r(!0,n),a=await It(t,n)}a&&(i[e]=a)}catch(r){kt(r)&&await n.withLock(async()=>{let r=n.get(e);r&&r.secret===t.secret&&n.put({...r,broken:{at:Date.now(),reason:`Needs reconnecting`}})}),o.push(At(t.name,r))}})),{...Lt(i,a),ids:r,warnings:o}}function zt(){return Object.entries(process.env).filter(([e,t])=>/^CODER_CONNECTION_[A-F0-9]{24}$/.test(e)&&t).flatMap(([,e])=>[e,...e.startsWith(`Bearer `)?[e.slice(7)]:[]])}function Bt(e,t=[]){let n=Object.entries(I()).filter(([,e])=>e.length>=8).map(([e,t])=>[t,`[${e}]`]),r=[...t,...zt()].filter(Boolean).map(e=>[e,`[REDACTED]`]),i=[...n,...r].sort(([e],[t])=>t.length-e.length);return JSON.stringify(e,(e,t)=>typeof t==`string`?i.reduce((e,[t,n])=>e.replaceAll(t,n),t):t)}function Vt(e){return String(e??``).replace(/[^A-Za-z0-9._-]/g,`-`).replace(/^-+|-+$/g,``)}function Ht(e,t=g.platform){return t===`win32`?`pipe:\\\\.\\pipe\\${Vt(`${h.win32.basename(e)}-codex-app-server`)}`:`unix:${h.join(e,`broker.sock`)}`}function Ut(e){if(typeof e!=`string`||e.length===0)throw Error(`Missing broker endpoint.`);if(e.startsWith(`pipe:`)){let t=e.slice(5);if(!t)throw Error(`Broker pipe endpoint is missing its path.`);return{kind:`pipe`,path:t}}if(e.startsWith(`unix:`)){let t=e.slice(5);if(!t)throw Error(`Broker Unix socket endpoint is missing its path.`);return{kind:`unix`,path:t}}throw Error(`Unsupported broker endpoint: ${e}`)}function Wt(){let e=h.dirname(Oe(import.meta.url));for(let t=0;t<10;t++){let t=h.join(e,`package.json`);try{if(JSON.parse(_.readFileSync(t,`utf8`)).name===`@wular/coder`)return e}catch{}let n=h.dirname(e);if(n===e)break;e=n}return h.resolve(h.dirname(Oe(import.meta.url)),`..`)}const B=Wt(),Gt=_.existsSync(h.join(B,`dist/cli.js`))?h.join(B,`dist/cli.js`):h.join(B,`src/cli.ts`);function Kt(){try{return JSON.parse(_.readFileSync(h.join(B,`package.json`),`utf8`)).version??`unknown`}catch{return`unknown`}}function qt(e){try{return JSON.parse(_.readFileSync(e,`utf8`)).version??null}catch{return null}}function Jt(){return B}const Yt={false:`broker.json`,true:`broker-network.json`};function Xt(e=`coder-`){return _.mkdtempSync(h.join(x.tmpdir(),e))}function Zt(e){let t=Ut(e);return S.createConnection({path:t.path})}async function Qt(e,t=2e3){let n=Date.now();for(;Date.now()-n<t;){if(await new Promise(t=>{let n=Zt(e);n.on(`connect`,()=>{n.end(),t(!0)}),n.on(`error`,()=>t(!1))}))return!0;await new Promise(e=>setTimeout(e,50))}return!1}function $t({scriptPath:e,cwd:t,endpoint:n,pidFile:r,logFile:i,networkAccess:a=!1,env:o=g.env}){let s=_.openSync(i,`a`),c=y(g.execPath,[e,`serve`,`--endpoint`,n,`--cwd`,t,`--pid-file`,r,`--network-access`,String(a)],{cwd:t,env:{...L(o),...o.CODER_CONNECTION_ENV_VALUES?{CODER_CONNECTION_ENV_VALUES:o.CODER_CONNECTION_ENV_VALUES}:{}},detached:!0,stdio:[`ignore`,s,s]});return c.unref(),_.closeSync(s),c}function en(){let e=[new URL(`./lib/broker.js`,import.meta.url),new URL(`./main.js`,import.meta.url)];for(let t of e){let e=Oe(t);if(_.existsSync(e))return e}throw Error("Coder broker script not found next to the runtime. Rebuild with `bun run build`.")}function tn(e,t=!1,n){let r=Yt[t?`true`:`false`];return h.join(U(e),n?r.replace(`.json`,`-${n}.json`):r)}function nn(e,t=!1,n){let r=tn(e,t,n);if(!_.existsSync(r))return null;try{let e=JSON.parse(_.readFileSync(r,`utf8`));return(e.networkAccess??!1)===t?e:null}catch{return null}}function rn(e){let t=U(e),n;try{n=_.readdirSync(t)}catch{return[]}return n.flatMap(e=>{if(!/^broker(?:-network)?(?:-[a-f0-9]{64})?\.json$/.test(e))return[];try{let n=JSON.parse(_.readFileSync(h.join(t,e),`utf8`));return typeof n.endpoint==`string`?[n]:[]}catch{return[]}})}function an(e,t,n=t.networkAccess??!1,r){let i=U(e);_.mkdirSync(i,{recursive:!0}),_.writeFileSync(tn(e,n,r),`${JSON.stringify(t,null,2)}\n`,`utf8`)}function on(e,t=!1,n){let r=tn(e,t,n);_.existsSync(r)&&_.unlinkSync(r)}async function sn(e){if(!e)return!1;try{return await Qt(e,150)}catch{return!1}}async function cn(e,t={}){let n=t.scriptPath??en(),r=Kt(),i=t.networkAccess??!1,a=nn(e,i,t.connectionKey),o=a?.version===r&&a?.scriptPath===n&&(a?.networkAccess??!1)===i;if(a&&o&&await sn(a.endpoint))return a;a&&(ln({endpoint:a.endpoint??null,pidFile:a.pidFile??null,logFile:a.logFile??null,sessionDir:a.sessionDir??null,pid:a.pid??null,killProcess:t.killProcess??null}),on(e,i,t.connectionKey));let s=Xt(),c=(t.createBrokerEndpoint??Ht)(s,t.platform),l=h.join(s,`broker.pid`),u=h.join(s,`broker.log`),d=$t({scriptPath:n,cwd:e,endpoint:c,pidFile:l,logFile:u,networkAccess:i,env:t.env??g.env});if(!await Qt(c,t.timeoutMs??2e3))return ln({endpoint:c,pidFile:l,logFile:u,sessionDir:s,pid:d.pid??null,killProcess:t.killProcess??null}),null;let f={endpoint:c,pidFile:l,logFile:u,sessionDir:s,pid:d.pid??null,networkAccess:i,version:r,scriptPath:n};return an(e,f,i,t.connectionKey),f}function ln({endpoint:e=null,pidFile:t,logFile:n,sessionDir:r=null,pid:i=null,killProcess:a=null}){if(Number.isFinite(i)&&a)try{a(i)}catch{}if(t&&_.existsSync(t)&&_.unlinkSync(t),n&&_.existsSync(n)&&_.unlinkSync(n),e)try{let t=Ut(e);t.kind===`unix`&&_.existsSync(t.path)&&_.unlinkSync(t.path)}catch{}let o=r??(t?h.dirname(t):n?h.dirname(n):null);if(o&&_.existsSync(o))try{_.rmdirSync(o)}catch{}}function un(e,t=[],n={}){let r=ke(e,t,{cwd:n.cwd,env:n.env,encoding:`utf8`,input:n.input,maxBuffer:n.maxBuffer,stdio:n.stdio??`pipe`,shell:g.platform===`win32`?g.env.SHELL||!0:!1,windowsHide:!0});return{command:e,args:t,status:r.status??0,signal:r.signal??null,stdout:r.stdout??``,stderr:r.stderr??``,error:r.error??null}}function dn(e,t=[`--version`],n={}){let r=un(e,t,n);return r.error&&r.error.code===`ENOENT`?{available:!1,detail:`not found`}:r.error?{available:!1,detail:r.error.message}:r.status===0?{available:!0,detail:r.stdout.trim()||r.stderr.trim()||`ok`}:{available:!1,detail:r.stderr.trim()||r.stdout.trim()||`exit ${r.status}`}}function fn(e){return/not found|no running instance|cannot find|does not exist|no such process/i.test(e)}function pn(e,t={}){if(!Number.isFinite(e))return{attempted:!1,delivered:!1,method:null};let n=e,r=t.platform??g.platform,i=t.runCommandImpl??un,a=t.killImpl??g.kill.bind(g);if(r===`win32`){let e=i(`taskkill`,[`/PID`,String(n),`/T`,`/F`],{cwd:t.cwd,env:t.env});if(!e.error&&e.status===0)return{attempted:!0,delivered:!0,method:`taskkill`,result:e};let r=`${e.stderr}\n${e.stdout}`.trim();if(!e.error&&fn(r))return{attempted:!0,delivered:!1,method:`taskkill`,result:e};if(e.error?.code===`ENOENT`)try{return a(n),{attempted:!0,delivered:!0,method:`kill`}}catch(e){if(e?.code===`ESRCH`)return{attempted:!0,delivered:!1,method:`kill`};throw e}throw e.error?e.error:Error(mn(e))}try{return a(-n,`SIGTERM`),{attempted:!0,delivered:!0,method:`process-group`}}catch(e){if(e?.code!==`ESRCH`)try{return a(n,`SIGTERM`),{attempted:!0,delivered:!0,method:`process`}}catch(e){if(e?.code===`ESRCH`)return{attempted:!0,delivered:!1,method:`process`};throw e}return{attempted:!0,delivered:!1,method:`process-group`}}}function mn(e){let t=[`${e.command} ${e.args.join(` `)}`.trim()];e.signal?t.push(`signal=${e.signal}`):t.push(`exit=${e.status}`);let n=(e.stderr||``).trim(),r=(e.stdout||``).trim();return n?t.push(n):r&&t.push(r),t.join(`: `)}function hn(e){return new Promise(t=>{let n=y(e,g.argv.slice(1),{env:g.env,shell:!1,stdio:`inherit`}),r=()=>n.kill(`SIGINT`),i=()=>n.kill(`SIGTERM`);g.once(`SIGINT`,r),g.once(`SIGTERM`,i);let a=e=>{g.off(`SIGINT`,r),g.off(`SIGTERM`,i),t(e)};n.once(`error`,e=>a({error:e,status:null,signal:null})),n.once(`close`,(e,t)=>a({status:e,signal:t}))})}const gn=`CODER_APP_SERVER_ENDPOINT`,_n=-32001,vn=`coder/notice`,yn=`coder/appServerExited`,bn=`broker/recycle`;function xn(){let e=un(`codex`,[`--version`],{env:L()}),t=/(\d+\.\d+\.\d+(?:-[\w.]+)?)/.exec(`${e.stdout} ${e.stderr}`);return t?t[1]:`0.144.1`}function Sn(){return{title:`Coder`,name:`coder`,version:xn()}}const Cn={experimentalApi:!1,requestAttestation:!1,optOutNotificationMethods:[`item/agentMessage/delta`,`item/reasoning/summaryTextDelta`,`item/reasoning/summaryPartAdded`,`item/reasoning/textDelta`]};function wn(e,t,n){return n===void 0?{code:e,message:t}:{code:e,message:t,data:n}}function Tn(e,t){let n=Error(e);return n.data=t,t?.code!==void 0&&(n.rpcCode=t.code),n}var En=class{cwd;options;pending;nextId;stderr;closed;exitError;notificationHandler;serverRequestHandler;noticeHandler;lineBuffer;transport;exitPromise;exitResolved;resolveExit;handleServerRequest;constructor(e,t={}){this.cwd=e,this.options=t,this.pending=new Map,this.nextId=1,this.stderr=``,this.closed=!1,this.exitError=null,this.notificationHandler=null,this.serverRequestHandler=null,this.noticeHandler=null,this.lineBuffer=``,this.transport=`unknown`,this.handleServerRequest=e=>this.defaultHandleServerRequest(e),this.exitPromise=new Promise(e=>{this.resolveExit=e})}setNotificationHandler(e){this.notificationHandler=e}setServerRequestHandler(e){this.serverRequestHandler=e}setNoticeHandler(e){this.noticeHandler=e}request(e,t){if(this.closed)throw Error(`codex app-server client is closed.`);if(this.exitResolved)return Promise.reject(this.exitError??Error(`codex app-server connection closed.`));let n=this.nextId;return this.nextId+=1,new Promise((r,i)=>{this.pending.set(n,{resolve:r,reject:i,method:e}),this.sendMessage({id:n,method:e,params:t})})}notify(e,t={}){this.closed||this.sendMessage({method:e,params:t})}handleChunk(e){this.lineBuffer+=e;let t=this.lineBuffer.indexOf(`
+`);for(;t!==-1;){let e=this.lineBuffer.slice(0,t);this.lineBuffer=this.lineBuffer.slice(t+1),this.handleLine(e),t=this.lineBuffer.indexOf(`
+`)}}handleLine(e){if(!e.trim())return;let t;try{t=JSON.parse(e)}catch(t){this.handleExit(Tn(`Failed to parse codex app-server JSONL: ${t instanceof Error?t.message:String(t)}`,{line:e}));return}if(t.id!==void 0&&t.method){this.handleServerRequest(t);return}if(t.id!==void 0){let e=this.pending.get(t.id);if(!e)return;this.pending.delete(t.id),t.error?e.reject(Tn(t.error.message??`codex app-server ${e.method} failed.`,t.error)):e.resolve(t.result??{});return}if(t.method===`coder/notice`){this.noticeHandler?.(String(t.params?.message??``));return}if(t.method===`coder/appServerExited`){this.handleExit(Tn(String(t.params?.message??`codex app-server exited.`)));return}t.method&&this.notificationHandler&&this.notificationHandler(t)}defaultHandleServerRequest(e){let t=this.serverRequestHandler;if(!t){this.sendMessage({id:e.id,error:wn(-32601,`Unsupported server request: ${e.method}`)});return}Promise.resolve().then(()=>t(e.method,e.params??{})).then(t=>{this.sendMessage({id:e.id,result:t??{}})}).catch(t=>{this.sendMessage({id:e.id,error:wn(-32e3,t instanceof Error?t.message:String(t))})})}handleExit(e){if(!this.exitResolved){this.exitResolved=!0,this.exitError=e??null;for(let e of this.pending.values())e.reject(this.exitError??Error(`codex app-server connection closed.`));this.pending.clear(),this.resolveExit(void 0)}}sendMessage(e){throw Error(`sendMessage must be implemented by subclasses.`)}},Dn=class extends En{proc;readline;constructor(e,t={}){super(e,t),this.transport=`direct`}async initialize(){let e=this.options.networkAccess??!1;this.proc=y(`codex`,On(e,this.options.nativeMcp),{cwd:this.cwd,env:L(this.options.env??g.env),stdio:[`pipe`,`pipe`,`pipe`],shell:g.platform===`win32`?g.env.SHELL||!0:!1,windowsHide:!0});let t=this.proc.stdout,n=this.proc.stderr;if(!t||!n)throw Error(`codex app-server did not expose stdio streams.`);t.setEncoding(`utf8`),n.setEncoding(`utf8`),n.on(`data`,e=>{this.stderr+=e}),this.proc.on(`error`,e=>{this.handleExit(e)}),this.proc.stdin?.on(`error`,()=>{}),this.proc.on(`exit`,(e,t)=>{let n=this.stderr.trim(),r=e===0?null:Tn(`codex app-server exited unexpectedly (${t?`signal ${t}`:`exit ${e}`}).${n?`\n${n}`:``}`);this.handleExit(r)}),this.readline=je.createInterface({input:t}),this.readline.on(`line`,e=>{this.handleLine(e)}),await this.request(`initialize`,{clientInfo:this.options.clientInfo??Sn(),capabilities:this.options.capabilities??Cn}),this.notify(`initialized`,{})}async close(){if(this.closed){await this.exitPromise;return}this.closed=!0,this.readline&&this.readline.close(),this.proc&&!this.proc.killed&&(this.proc.stdin?.end(),setTimeout(()=>{if(this.proc&&!this.proc.killed&&this.proc.exitCode===null)if(g.platform===`win32`)try{pn(this.proc.pid)}catch{}else this.proc.kill(`SIGTERM`)},50).unref?.()),await this.exitPromise}sendMessage(e){let t=`${JSON.stringify(e)}\n`,n=this.proc?.stdin;if(!n)throw Error(`codex app-server stdin is not available.`);n.write(t)}};function On(e,t=!1){return[`-c`,`sandbox_workspace_write.network_access=${e}`,`app-server`,...t?[]:[`--disable`,`plugins`,`--disable`,`apps`]]}var kn=class extends En{endpoint;socket;constructor(e,t={}){super(e,t),this.transport=`broker`,this.endpoint=t.brokerEndpoint}async initialize(){await new Promise((e,t)=>{let n=Ut(this.endpoint);this.socket=S.createConnection({path:n.path}),this.socket.setEncoding(`utf8`),this.socket.on(`connect`,e),this.socket.on(`data`,e=>{this.handleChunk(e)}),this.socket.on(`error`,e=>{this.exitResolved||t(e),this.handleExit(e)}),this.socket.on(`close`,()=>{this.handleExit(this.exitError)})}),await this.request(`initialize`,{clientInfo:this.options.clientInfo??Sn(),capabilities:this.options.capabilities??Cn}),this.notify(`initialized`,{})}async close(){if(this.closed){await this.exitPromise;return}this.closed=!0,this.socket&&this.socket.end(),await this.exitPromise}sendMessage(e){let t=`${JSON.stringify(e)}\n`,n=this.socket;if(!n)throw Error(`codex app-server broker connection is not connected.`);n.write(t)}},An=class{static async connect(e,t={}){let n=t.env??g.env,r=Dt(n);t={...t,env:L(n)};let i=t.networkAccess??!1,a=null;!t.disableBroker&&!t.nativeMcp&&(a=r?null:t.brokerEndpoint??t.env?.CODER_APP_SERVER_ENDPOINT??g.env.CODER_APP_SERVER_ENDPOINT??null,!a&&t.reuseExistingBroker&&(a=nn(e,i,r)?.endpoint??null),!a&&!t.reuseExistingBroker&&(a=(await cn(e,{env:n,networkAccess:i,connectionKey:r}))?.endpoint??null));let o=a?new kn(e,{...t,brokerEndpoint:a}):new Dn(e,t);return await o.initialize(),o}};async function jn(e,t,n){for(let r of rn(e)){let i=null;try{return i=await An.connect(e,{env:L(),brokerEndpoint:r.endpoint,networkAccess:r.networkAccess??!1,reuseExistingBroker:!0}),await i.request(t,{threadId:n}),!0}catch{}finally{await i?.close().catch(()=>{})}}return!1}function Mn(e){try{let t=y(`codex`,e,{detached:!0,stdio:`ignore`,env:L()});t.on(`error`,()=>{}),t.unref()}catch{}}async function Nn(e,t){await jn(e,`thread/archive`,t)||Mn([`archive`,t])}function Pn(e){let t=h.join(process.env.CODEX_HOME||h.join(x.homedir(),`.codex`),`archived_sessions`);try{return _.readdirSync(t).some(t=>t.endsWith(`-${e}.jsonl`))}catch{return!1}}function Fn(e){return new Promise(t=>{try{let n=y(`codex`,[`unarchive`,e],{stdio:`ignore`,env:L()});n.on(`error`,()=>t(!1)),n.on(`close`,e=>t(e===0))}catch{t(!1)}})}async function In(e,t){return await jn(e,`thread/delete`,t)?!0:ke(`codex`,[`delete`,`--force`,t],{encoding:`utf8`,env:L()}).status===0}const Ln=[`completed`,`failed`,`cancelled`],Rn=[`queued`,`running`],zn=/^[a-z0-9][a-z0-9_-]*$/i;function Bn(e){return zn.test(e)}function Vn(e,t){if(!Bn(e))throw Error(`Invalid ${t} "${e}".`)}function V(...e){return h.join(h.resolve(process.env.CODER_HOME||h.join(x.homedir(),`.coder`)),...e)}function H(...e){let t=x.homedir(),n=x.platform(),r=process.env.CODER_CACHE_HOME||(n===`darwin`?h.join(t,`Library`,`Caches`,`wular-coder`):n===`win32`?h.join(process.env.LOCALAPPDATA||h.join(t,`AppData`,`Local`),`wular-coder`,`cache`):h.join(process.env.XDG_CACHE_HOME||h.join(t,`.cache`),`wular-coder`));return h.join(h.resolve(r),...e)}function Hn(){return V()}function Un(e){return e?h.join(e,`flows`):V(`state`,`global`,`flows`)}function Wn(){return H(`flows-archived`)}function Gn(){return H(`usage.json`)}function Kn(e=Gn()){return`${e}.${process.pid}.${b()}.tmp`}function qn(){return H(`runner`,`usage.json`)}function Jn(e){try{return v(`git`,[`rev-parse`,`--show-toplevel`],{cwd:e,encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return e}}const Yn=`global`;function U(e){return V(`state`,Yn)}function Xn(){let e=V(`state`),t=[];try{t=_.readdirSync(e,{withFileTypes:!0})}catch{}return t.filter(e=>e.isDirectory()&&e.name!==Yn).map(t=>h.join(e,t.name))}function W(e){return h.join(U(e),`jobs`)}const Zn=18e5,Qn=(e,t=Date.now())=>t-e>Zn;function G(e){return H(`archive`)}function K(e,t){Vn(t,`task id`);let n=h.join(W(e),t);if(_.existsSync(h.join(n,`job.json`)))return n;let r=h.join(G(e),t);if(_.existsSync(h.join(r,`job.json`)))return r;for(let e of Xn()){let n=h.join(e,`jobs`,t);if(_.existsSync(h.join(n,`job.json`)))return n}return n}function $n(e,t,n={}){return t.archived&&(n.auto||!t.autoArchived)?t:t.archived?q(e,t.id,{autoArchived:void 0}):q(e,t.id,{archived:!0,archivedAt:new Date().toISOString(),...n.auto?{autoArchived:!0}:{}},{touch:!n.auto})}function er(e,t,n={}){if(Rn.includes(t.status))return $n(e,t,n);let r=K(e,t.id),i=h.join(G(e),t.id);r!==i&&mt(r,i);let a=$n(e,t,n);return t.engine!==`claude`&&t.threadId&&Nn(e,t.threadId),a}function tr(e){return!!e.archived&&(e.resumedAt??``)>(e.archivedAt??``)}function nr(e,t){let n=K(e,t.id),r=h.join(W(e),t.id);return n!==r&&mt(n,r),q(e,t.id,{archived:void 0,archivedAt:void 0,autoArchived:void 0})}function rr(){let e=Math.random().toString(36).slice(2,8);return`task-${Date.now().toString(36)}-${e}`}function q(e,t,n,r={}){let i=K(e,t);_.mkdirSync(i,{recursive:!0});let a=h.join(i,`job.json`),o=ar(e,t)??{id:t,createdAt:new Date().toISOString(),status:`queued`},s={...o,...n,updatedAt:r.touch===!1?o.updatedAt:new Date().toISOString()};return _.writeFileSync(a,`${JSON.stringify(JSON.parse(Bt(s)),null,2)}\n`,`utf8`),s}function ir(e){return e.agent&&(e.engine=e.agent),delete e.agent,e}function ar(e,t){if(!Bn(t))return null;let n=h.join(K(e,t),`job.json`);if(!_.existsSync(n))return null;try{return ir(JSON.parse(_.readFileSync(n,`utf8`)))}catch{return null}}function or(e,t){let n=K(e,t);return _.existsSync(n)?(_.rmSync(n,{recursive:!0,force:!0}),!0):!1}function sr(e){if(!e)return!1;try{return process.kill(e,0),!0}catch(e){return e.code===`EPERM`}}function cr(e){try{let t=v(`ps`,[`-o`,`lstart=`,`-p`,String(e)],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`],env:{...process.env,TZ:Intl.DateTimeFormat().resolvedOptions().timeZone}}).trim(),n=t?Date.parse(t):NaN;return Number.isFinite(n)?n:null}catch{return null}}function lr(e,t,n){if(!sr(e))return!1;let r=n(e),i=Date.parse(t.resumedAt??t.createdAt??``);return r===null||!Number.isFinite(i)||r<=i+6e4}function J(e,t,n=cr){if(t.status!==`running`&&t.status!==`queued`)return t;let r;if(t.pid)r=!lr(t.pid,t,n);else{let e=Date.parse(t.updatedAt??t.createdAt??``);r=Number.isFinite(e)&&Date.now()-e>6e4}return r?q(e,t.id,{status:`failed`,error:`worker exited without finishing`,completedAt:new Date().toISOString()}):t}function ur(e,t){let n=[];for(let r of e){let e=[];try{e=_.readdirSync(r)}catch{continue}for(let i of e){if(t.has(i))continue;let e=h.join(r,i,`job.json`);try{let r=ir(JSON.parse(_.readFileSync(e,`utf8`)));t.add(i),n.push(r)}catch{}}}return n}async function*dr(e){let t=await _.promises.readdir(h.dirname(U(e)),{withFileTypes:!0}).catch(()=>[]),n=[{dir:W(e),archived:!1},{dir:G(e),archived:!0},...t.filter(e=>e.isDirectory()&&e.name!==Yn).map(t=>({dir:h.join(h.dirname(U(e)),t.name,`jobs`),archived:!1}))];for(let{dir:e,archived:t}of n){let n=await _.promises.readdir(e,{withFileTypes:!0}).catch(()=>[]);for(let r of n)r.isDirectory()&&Bn(r.name)&&(yield{id:r.name,dir:h.join(e,r.name),archived:t})}}const fr=(e,t)=>String(t.updatedAt??``).localeCompare(String(e.updatedAt??``));function pr(){let e=new Map;return t=>(e.has(t)||e.set(t,cr(t)),e.get(t))}function mr(e){let t=pr(),n=[W(e),...Xn().map(e=>h.join(e,`jobs`))],r=[];for(let i of ur(n,new Set)){let n=J(e,i,t);n.archived&&!tr(n)?er(e,n,{auto:!0}):r.push(n.archived?nr(e,n):n)}return r.sort(fr)}function hr(e,t,n=!1){if(t.status===`queued`)return!0;let r=t.generation??0;if(n&&!r)return!1;let i=ar(e,t.task.id);return i?r?t.startedAt===void 0||(Date.parse(i.resumedAt??``)||0)<t.startedAt:!1:!0}function gr(e){let t=ft(h.join(U(e),`runner`,`task.json`))??{},n=e=>e===void 0?void 0:new Date(e).toISOString();return Object.values(t).map(({value:e})=>e).filter(t=>hr(e,t)).map(e=>{let t=e.status===`waiting`?`running`:e.status,r=e.archivedAt??(Ln.includes(t)&&Qn(e.finishedAt??e.updatedAt)?e.finishedAt??e.updatedAt:void 0);return{id:e.task.id,status:t,...e.task.name?{name:e.task.name}:{},...e.task.prompt?{prompt:e.task.prompt}:{},...e.task.cwd?{cwd:e.task.cwd}:{},...e.task.agent?{agentId:e.task.agent}:{},source:e.task.source??`dashboard`,...e.error?{error:e.error}:{},createdAt:n(e.createdAt),updatedAt:n(e.updatedAt),...e.finishedAt?{completedAt:n(e.finishedAt)}:{},...r===void 0?{}:{archived:!0,archivedAt:n(r)}}})}function _r(e,t){let n=pr(),r=t?.migrate??!0,i=new Set,a=[];for(let t of ur([G(e)],i))tr(t)?r&&nr(e,J(e,t,n)):a.push(J(e,t,n));let o=[W(e),...Xn().map(e=>h.join(e,`jobs`))];for(let t of ur(o,i))if(t.archived&&!tr(t)){let i=J(e,t,n);a.push(r?er(e,i,{auto:!0}):i)}return a.sort(fr)}function vr(e,t){let n=_r(e),r=[...mr(e),...n].sort(fr);if(!t)return r[0]??null;let i=r.find(e=>e.id===t);if(i)return i;let a=r.filter(e=>e.id.startsWith(t));if(a.length===1)return a[0];if(a.length>1)throw Error(`Task reference "${t}" is ambiguous. Use a longer id.`);return null}function yr(e,t){let n=K(e,t);try{_.mkdirSync(n,{recursive:!0}),_.writeFileSync(h.join(n,`heartbeat`),``,`utf8`)}catch{}}function br(e,t){let n=K(e,t.id),r=Date.parse(t.updatedAt??``)||0;for(let e of[`log.jsonl`,`heartbeat`])try{r=Math.max(r,_.statSync(h.join(n,e)).mtimeMs)}catch{}return r?new Date(r).toISOString():void 0}async function xr(e,t,n=400){let r=t;for(;!Ln.includes(r.status);)await new Promise(e=>setTimeout(e,n)),r=J(e,ar(e,r.id)??r);return r}const Sr=`steer-queue.jsonl`;function Cr(e,t,n){let r=K(e,t);_.mkdirSync(r,{recursive:!0}),_.appendFileSync(h.join(r,Sr),`${JSON.stringify({at:new Date().toISOString(),text:n})}\n`,`utf8`)}function wr(e,t){let n=K(e,t),r=h.join(n,Sr),i=h.join(n,`steer-claim-${process.pid}-${Date.now()}.tmp`);try{_.renameSync(r,i)}catch{return[]}try{return _.readFileSync(i,`utf8`).split(/\r?\n/).filter(Boolean).map(e=>{try{return String(JSON.parse(e).text??``)}catch{return``}}).filter(Boolean)}finally{try{_.unlinkSync(i)}catch{}}}function Tr(e,t,n){let r=K(e,t);_.mkdirSync(r,{recursive:!0}),_.appendFileSync(h.join(r,`log.jsonl`),`${Bt({at:new Date().toISOString(),...n})}\n`,`utf8`)}function Er(e,t){let n=h.join(K(e,t),`results.jsonl`);return _.existsSync(n)?_.readFileSync(n,`utf8`).split(/\r?\n/).filter(Boolean).flatMap(e=>{try{return[JSON.parse(e)]}catch{return[]}}):[]}function Dr(e,t){if(t<=0)return[];let n=0;for(let r=e.length-1;r>=0;--r)if(e[r]?.kind!==`usage`&&(n+=1)===t)return e.slice(r);return e}function Or(e,t,n=40){let r=h.join(K(e,t),`log.jsonl`);return _.existsSync(r)?_.readFileSync(r,`utf8`).split(/\r?\n/).filter(Boolean).slice(-n).map(e=>{try{return JSON.parse(e)}catch{return{message:e}}}):[]}function kr(e){return[e.engine??`-`,e.model,e.model?e.effort:null].filter(Boolean).join(`/`)}function Ar(e){let t=Date.parse(e??``);return Number.isFinite(t)?Math.max(0,Date.now()-t):0}const jr=6e5,Y={chain:[`codex`,`claude`],engines:{codex:{model:`gpt-6.1-sol`,effort:`high`,permissions:`auto`},claude:{model:`opus`,effort:`medium`,permissions:`auto`}},models:{},approvals:{escalationTimeoutMs:12e4,allowedNetworkHosts:[]}},Mr=Y.chain[0],Nr=e=>e===`failed`?0:e===`completed`?3:e===`cancelled`?2:1,Pr=(e,t)=>e<t?-1:+(e>t),Fr=(e,t)=>e.rank-t.rank||t.createdAt-e.createdAt||Pr(t.id,e.id);function Ir(e,t){for(let n of Object.values(e??{}))Object.defineProperty(n,"repository",{value:t,configurable:!0})}function Lr(e){let t={...e.url?{url:e.url}:{command:e.command,args:e.args??[]},headers:Object.keys(e.headers??{}).sort(),env:Object.keys(e.env??{}).sort()};return Ae(`sha256`).update(JSON.stringify(t)).digest(`hex`)}function Rr(){try{let e=JSON.parse(_.readFileSync(V(`state`,`global`,`mcp-approvals.json`),`utf8`));return e&&typeof e==`object`&&!Array.isArray(e)?e:{}}catch(e){if(e.code===`ENOENT`||e instanceof SyntaxError)return{};throw e}}function zr(e){return Rr()[Lr(e)]===!0}async function Br(e,t,n){if(!t)throw Error(`Usage: coder connection approve <name> [--agent <id>]`);let r=$(e).mcp?.[t],i=[];r&&!n&&i.push(r);let{loadAgents:a}=await import(`./load-CRmQB1LD.js`).then(e=>e.o),{INTEGRATIONS:o}=await import(`./integrations-D3OgJk6Y.js`).then(e=>e.r);for(let r of await a(e,o,{includeDisabled:!0})){let e=r.definition.mcp?.[t];e&&(!n||r.id===n)&&i.push(e)}if(!i.length)throw Error(`No MCP server "${t}". Use --cwd to select its repository.`);if(i.some(e=>e.connection))throw Error(`MCP server "${t}" uses a connection and needs no repository approval.`);let s=new Set(i.map(Lr));if(s.size!==1)throw Error(`MCP server "${t}" has different definitions. Select one with --agent <id>.`);let c=V(`state`,`global`,`mcp-approvals.json`);_.mkdirSync(h.dirname(c),{recursive:!0});let l=Rr();return l[[...s][0]]=!0,pt(c,l),_.chmodSync(c,384),{name:t,file:c}}function Vr(e){return!/\$\{[^}]+\}/.test(e)&&(/^(?:Bearer\s+\S+|ghp_|github_pat_|xox[a-z]-|sk-|lin_api_)/i.test(e)||/^[A-Za-z0-9_+\/.=-]{32,}$/.test(e))}function Hr(e,t){if(!t||typeof t!=`object`)return[];let{url:n,headers:r,env:i}=t,a=e=>e&&typeof e==`object`&&!Array.isArray(e)?Object.entries(e).filter(e=>typeof e[1]==`string`):[],o=[];typeof n==`string`&&[n,...a(r).map(([,e])=>e)].some(e=>/\$\{[^}]+\}/.test(e))&&o.push(`MCP server "${e}" keeps remote URL and header variables literal. Use a connection for credentials.`);for(let[t,n]of[[`headers`,r],[`env`,i]])for(let[r,i]of a(n))Vr(i)&&o.push(`MCP server "${e}" has a literal secret in ${t}.${r}. Use a connection instead.`);return o}const Ur={luna:`gpt-6-luna`,sol:`gpt-6.1-sol`,astra:`gpt-6-astra`},Wr=new Set([`low`,`medium`,`high`]),Gr={sonnet:`sonnet`,opus:`opus`,fable:`fable`},Kr=new Set([`low`,`medium`,`high`]),qr={"read-only":{sandbox:`read-only`,approvalPolicy:`never`,approvalMode:null},"workspace-write":{sandbox:`workspace-write`,approvalPolicy:`never`,approvalMode:null},auto:{sandbox:`workspace-write`,approvalPolicy:`on-request`,approvalMode:`auto`}},Jr={"read-only":[`--permission-mode`,`dontAsk`,`--disallowedTools`,`Edit`,`Write`,`MultiEdit`,`NotebookEdit`],"workspace-write":[`--permission-mode`,`acceptEdits`],auto:[`--permission-mode`,`auto`]},Yr=[`--permission-mode`,`dontAsk`,`--disallowedTools`,`Edit`,`Write`,`MultiEdit`,`NotebookEdit`,`Bash`,`WebFetch`,`WebSearch`,`Task`],Xr=/failIfUnavailable|sandbox\b[^.\n]*?(?:failed|could ?n[o']t|cannot|unavailable|not available|not supported)/i,Zr=`CODER_MACHINE_SANDBOX`,Qr=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function $r(e){return e.flatMap(e=>S.isIPv6(e)?[`[${e}]`]:e.startsWith(`[`)||e.includes(`:`)||S.isIP(e)?[e]:[e,`*.${e}`])}function ei(e,t,n=[],r=[],i=[],a=!0){let o=e===`read-only`?r:[...r,...i],s=o.length?{permissions:{additionalDirectories:o}}:{};return JSON.stringify(a?e===`read-only`?{...s,sandbox:{enabled:!0,failIfUnavailable:!0,autoAllowBashIfSandboxed:!0,filesystem:{denyWrite:[t,...r],...i.length?{allowWrite:i}:{}}}}:{...s,sandbox:{enabled:!0,autoAllowBashIfSandboxed:!0,...e===`auto`&&n.length?{network:{allowedDomains:$r(n),...n.some(e=>Qr.has(e))?{allowLocalBinding:!0}:{}}}:{}}}:{permissions:{additionalDirectories:o,allow:[`Bash`],...e===`read-only`?{deny:[`Edit`,`Write`,`MultiEdit`,`NotebookEdit`]}:{}},sandbox:{enabled:!1}})}const ti=A([`codex`,`claude`]),ni=A([`codex`,`claude`,`custom`]),ri=A([`low`,`medium`,`high`]),ii=A([`read-only`,`workspace-write`,`auto`]),ai=O(D({model:w().check(p(1)),effort:ri,permissions:ii})),oi=O(D({model:w().check(p(1)),effort:ri,permissions:ii,network:T()})),si=Je([D({baseUrl:Fe(),model:w().check(p(1)),envKey:j(w().check(p(1))),wireApi:j(A([`chat`,`responses`])),disabled:j(T())}),D({provider:ti,model:w().check(p(1)),effort:j(ri),disabled:j(T())}),D({disabled:T()})]),ci=D({escalationTimeoutMs:Le().check(ue()),allowedNetworkHosts:E(w())}),li=A([`observe`,`comment`,`write`]),ui=w().check(me(/^[a-z0-9][a-z0-9_-]*$/i,`agent or flow name`)),di=Je([T(),D({engine:j(w()),model:j(w()),effort:j(ri),permissions:j(ii),runner:j(A([`local`,`local-docker`,`vercel-sandbox`,`github-actions`])),integrations:j(k(w(),D({allowedTools:j(Je([li,E(w())])),allowedEvents:j(E(w()))}))),connections:j(E(w())),disabled:j(T())})]),fi=D({connection:j(w().check(p(1))),command:j(w().check(p(1))),args:j(E(w())),env:j(k(w(),w())),url:j(w().check(p(1))),type:j(A([`stdio`,`http`,`sse`])),headers:j(k(w(),w())),tools:j(E(w())),description:j(w())}).check(lt(e=>e.connection?[e.url,e.command,e.args,e.env,e.headers,e.type].every(e=>e===void 0):!!e.command!=!!e.url,`Use a connection alone, without url, command, args, env, headers or type; otherwise supply one of command or url`)),pi=O(Ke(D({chain:E(ni).check(p(1)),engines:O(D({codex:oi,claude:ai,custom:ai})),models:j(k(w().check(me(/^[a-z0-9][a-z0-9./_-]*$/i,`model name`)),si)),agents:j(k(ui,di)),mcp:j(k(ui,fi)),approvals:ci}),{approvals:O(ci)}));function X(e){return`baseUrl`in e}function mi(e){return`provider`in e}function hi(e,t){return t??e===`auto`}const gi=/^(?!-)[a-z0-9-]{1,63}(?<!-)(?:\.(?!-)[a-z0-9-]{1,63}(?<!-))*(?::\d{1,5})?$/i;function _i(e){if(S.isIP(e))return!0;let t=/^\[([^\]]+)\](?::\d{1,5})?$/.exec(e);return t?S.isIPv6(t[1]):e.length<=253&&gi.test(e)}function vi(e,t){delete e.models?.[t];for(let n of Object.values(e.engines??{}))n?.model===t&&delete n.model}function Z(e){let t=Object.keys(e?.agents??{}).filter(e=>[`codex`,`claude`,`custom`].includes(e));if(t.length)return t.map(e=>`agents.${e}: engine defaults moved to engines.${e}`);let n=pi.safeParse(e);if(!n.success)return n.error.issues.map(e=>`${e.path.join(`.`)||`config`}: ${e.message}`);let r=xi(Y,n.data),i=[];for(let[e,t]of(n.data.approvals?.allowedNetworkHosts??[]).entries())_i(t)||i.push(`approvals.allowedNetworkHosts.${e}: "${t}" is not a host name or IP address`);for(let[e,t]of Object.entries(n.data.models??{})){if(e===`codex`||e===`claude`||e===`custom`){i.push(`models.${e}: reserved engine name`);continue}if(mi(t)){let n=r.models?.[t.model];n&&!X(n)&&i.push(`models.${e}: alias target "${t.model}" is itself a config entry`)}}return i}function yi(e){if(!_.existsSync(e))return null;try{return JSON.parse(_.readFileSync(e,`utf8`))}catch(t){let n=t instanceof Error?t.message:String(t);throw Error(`Invalid JSON in ${e}: ${n}`)}}function bi(e){return xi(Y,e)}function xi(e,t){if(!t||typeof t!=`object`||Array.isArray(t))return t??e;let n={...e},r=e;for(let[e,i]of Object.entries(t))n[e]=i&&typeof i==`object`&&!Array.isArray(i)&&r?.[e]&&typeof r[e]==`object`?xi(r[e],i):i;return n}function Q(){return V(`config.json`)}const Si=[`coder.config.json`,`coder.json`];function Ci(e){let t=h.join(e,`.coder`,`config.json`);if(_.existsSync(t))return t;for(let n of Si){let r=h.join(e,n);if(_.existsSync(r)){_.mkdirSync(h.dirname(t),{recursive:!0}),_.renameSync(r,t),process.stderr.write(`coder: moved ${n} to .coder/config.json\n`);break}}return t}const wi=`CODER_WORKSPACE_CONFIG`;function Ti(e,t){let n=t.approvals?.allowedNetworkHosts?.filter(t=>e.approvals.allowedNetworkHosts.includes(t)),r=Object.fromEntries(Object.entries(t.engines??{}).map(([e,t])=>[e,{...t?.model?{model:t.model}:{},...t?.effort?{effort:t.effort}:{}}])),i=Object.entries(t.models??{}).filter(([,e])=>e.disabled===!0);return{...t.mcp?{mcp:t.mcp}:{},...t.chain?{chain:t.chain.filter(t=>e.chain.includes(t))}:{},engines:r,models:Object.fromEntries(i.map(([e])=>[e,{disabled:!0}])),...n?{approvals:{...e.approvals,allowedNetworkHosts:n}}:{}}}function $(e){let t=Jn(e),n=process.env[wi],r=[[Q(),yi(Q())],...n?[[`the workspace config`,JSON.parse(n)]]:[]],i=Ci(t);r.push([i,yi(i)]);let a=Y,o=new Set;for(let[e,t]of r){if(!t)continue;let r=Z(t);if(r.length)throw Error(`Invalid config in ${e}:\n  ${r.join(`
+  `)}`);let s=n&&e===i?Ti(a,t):t,c={...a.mcp,...s.mcp};for(let t of Object.keys(s.mcp??{}))e===i?o.add(t):o.delete(t);a={...xi(a,s),...Object.keys(c).length?{mcp:c}:{}}}let s=Z(a);if(s.length)throw Error(`Invalid merged config:\n  ${s.join(`
+  `)}`);for(let[e,t]of Object.entries(a.mcp??{}))Ir({[e]:t},o.has(e));return a}function Ei(e){return e.replace(/\/+$/,``).replace(/\/(chat\/completions|completions|responses)$/,``)}function Di(e,t,n){let r=[Ci(Jn(e)),Q()];for(let e of r){let r;try{r=yi(e)}catch{continue}if(r?.models?.[t])return Object.assign(r.models[t],n),!Z(r).length&&(_.writeFileSync(e,`${JSON.stringify(r,null,2)}\n`,`utf8`),!0)}return!1}function Oi(e){return/\/(chat\/completions|completions|responses)\/*$/.test(e)}function ki(e,t){let n=Ei(e);return Oi(e)||/\/v\d+(alpha|beta)?$/.test(n)?[`${n}/${t}`]:[`${n}/${t}`,`${n}/v1/${t}`]}function Ai(e,t,n){let r=t?e.models?.[t]:void 0;if(!t||!r||!X(r))return null;let i=`coder-${t}`;return{model:r.model,modelProvider:i,configOverrides:{[`model_providers.${i}`]:{name:t,base_url:n?.url??Ei(r.baseUrl),...r.envKey&&!n?{env_key:r.envKey}:{},wire_api:`responses`}}}}function ji(e){return e?Ur[e]??e:null}function Mi(e){return e in Ur||e in Gr}function Ni(e,t){return!!(t&&e.models?.[t]?.disabled)}function Pi(e,t){if(Ni(e,t))throw Error(`model "${t}" is disabled in config`)}function Fi(e,t){if(!e)return null;let n=String(e).trim().split(`:`).map(e=>e.trim());if(!n.length||n.length>3||n.some(e=>!e))throw Error(`Invalid engine spec "${e}".`);let r=null,i=null,a=null,o=e=>Wr.has(e)||Kr.has(e);for(let t of n)if(t===`codex`||t===`claude`||t===`custom`){if(r)throw Error(`Invalid engine spec "${e}".`);r=t}else if(o(t)&&!a)a=t;else if(!i)i=t;else throw Error(`Invalid engine spec "${e}".`);let s=i?t.models?.[i]:void 0;if(s&&mi(s)){if(s.disabled)throw Error(`model "${i}" is disabled in config`);if(r&&r!==s.provider)throw Error(`Alias "${i}" runs on ${s.provider}, not ${r}.`);r=s.provider,a=a??s.effort??null,i=s.model}r||=i&&i in Gr?`claude`:i&&s&&X(s)?`custom`:`codex`;let c=t.engines[r]??{},l=i??c.model??null;return Pi(t,l),{engine:r,model:l,effort:a??c.effort??null}}function Ii(e){let t=Q();return _.mkdirSync(h.dirname(t),{recursive:!0}),_.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,`utf8`),t}function Li(e,t){return t.split(`.`).reduce((e,t)=>e?.[t],e)}function Ri(e,t){return t?Ci(Jn(e)):Q()}function zi(e,t){let n=$(e);return t?Li(n,t):n}function Bi(e,t,n,r={}){let i=Ri(e,r.workspace);Vi(i,e=>{let i=t.split(`.`),a=i.at(-1),o=e;for(let e of i.slice(0,-1))(typeof o[e]!=`object`||o[e]===null)&&(o[e]={}),o=o[e];r.unset?delete o[a]:o[a]=n});let a=Li($(e),t)??null;return{file:i,key:t,...r.unset?{unset:!0}:{value:n},effective:a}}function Vi(e,t){let n=_.existsSync(e)?JSON.parse(_.readFileSync(e,`utf8`)):{};t(n),n.models&&Object.keys(n.models).length===0&&delete n.models;let r=Z(n);if(r.length)throw Error(`Refusing to write invalid config:\n  ${r.join(`
+  `)}`);_.mkdirSync(h.dirname(e),{recursive:!0}),_.writeFileSync(e,`${JSON.stringify(n,null,2)}\n`,`utf8`)}export{V as $,Pt as $t,Z as A,E as An,nr as At,Mr as B,lt as Bn,gn as Bt,Di as C,ht as Cn,K as Ct,Ai as D,ut as Dn,Dr as Dt,hi as E,pt as En,Jn as Et,Br as F,Le as Fn,In as Ft,jr as G,hn as Gt,Fr as H,w as Hn,bn as Ht,zr as I,Ge as In,Pn as It,Qn as J,qt as Jt,Ar as K,nn as Kt,Vr as L,j as Ln,Fn as Lt,Vi as M,ze as Mn,q as Mt,Ii as N,Qe as Nn,Rn as Nt,Q as O,at as On,dr as Ot,Ir as P,rt as Pn,Ln as Pt,H as Q,P as Qt,Hr as R,st as Rn,yn as Rt,Fi as S,mt as Sn,U as St,ji as T,dt as Tn,Kn as Tt,Nr as U,et as Un,An as Ut,Pr as V,D as Vn,vn as Vt,Zn as W,Je as Wn,dn as Wt,Vn as X,Jt as Xt,er as Y,Kt as Yt,wr as Z,Ut as Zt,Mi as _,bt as _n,G as _t,Yr as a,kt as an,br as at,fi as b,Ct as bn,Un as bt,Zr as c,Ot as cn,ar as ct,Pi as d,I as dn,gr as dt,Et as en,Cr as et,ei as f,Rt as fn,hr as ft,mi as g,wt as gn,or as gt,ki as h,N as hn,J as ht,Xr as i,It as in,Bn as it,bi as j,T as jn,xr as jt,Ci as k,A as kn,yr as kt,qr as l,At as ln,$n as lt,Bi as m,Bt as mn,Er as mt,Gr as n,Lt as nn,kr as nt,Wr as o,Mt as on,_r as ot,zi as p,Tt as pn,Or as pt,Tr as q,Gt as qt,Jr as r,Dt as rn,rr as rt,Ur as s,Nt as sn,mr as st,Kr as t,F as tn,vr as tt,wi as u,L as un,cr as ut,X as v,yt as vn,Hn as vt,vi as w,ft as wn,Gn as wt,Ei as x,gt as xn,qn as xt,$ as y,St as yn,Wn as yt,Y as z,k as zn,_n as zt};

package/dist/connection-CQPndo-u.js

@@ -0,0 +1 @@
+import{s as e}from"./cli-D5hyqGq0.js";const t=e(`connection`,{add:async()=>(await import(`./add-Df1Ezy3y.js`)).commandConnectionAdd,list:async()=>(await import(`./list-D3LCULQt.js`)).commandConnectionList,ls:async()=>(await import(`./list-D3LCULQt.js`)).commandConnectionList,rm:async()=>(await import(`./remove-C9eahMDh.js`)).commandConnectionRemove,remove:async()=>(await import(`./remove-C9eahMDh.js`)).commandConnectionRemove,reconnect:async()=>(await import(`./reconnect-CR3RaXX0.js`)).commandConnectionReconnect,approve:async()=>(await import(`./approve-DAuvq9Eq.js`)).commandConnectionApprove},{menu:[{usage:`add <name> [--env <NAME> | --url <url> | -- <command>]`,blurb:`connect a platform account, an API key or an MCP server`},{usage:`list`,blurb:`list connections and the MCP servers this repository declares`},{usage:`rm <name>`,blurb:`remove a connection`},{usage:`reconnect <name>`,blurb:`give a connection a new key, or sign in again`},{usage:`approve <name>`,blurb:`approve a repository MCP server on this machine`}],details:!0},{aliases:{ls:`list`,remove:`rm`},help:{usage:`coder connection <add|list|rm|reconnect|approve>`,summary:"Connections give tasks access to a service without a handle: a platform account, an API key tasks read from the environment, or an MCP server. They live in ~/.coder, or on your Coder server with --server, and every task of yours may use them unless its agent or `coder task run --connections` narrows the set.",examples:[[`coder connection add groq --env GROQ_API_KEY`,`an API key, kept as a credential`],[`coder connection add docs --key --env DOCS_TOKEN -- npx -y docs-mcp`,`a stdio MCP server; the key is read from stdin or a prompt`],[`coder connection add linear --url https://mcp.linear.app/mcp --server`,`a remote MCP server; signs in with OAuth in the browser`],[`coder connection add github --me --server`,`your own GitHub account`],[`coder connection approve docs`,`approve a repository server before its first local use`]],seeAlso:`task run`}});export{t as commandConnection};

package/dist/connection-wq0CJZKh.js

@@ -0,0 +1 @@
+import{qi as e}from"./core-DwsAMCnL.js";import{F as t,I as n,y as r}from"./config-D2FxHWwi.js";import{H as i}from"./dispatch-D3Dqxijf.js";import{n as a,o}from"./remote-oQs6My_3.js";import s from"node:path";import c from"node:process";import{createHash as l}from"node:crypto";var u=e({connection:()=>T});const d=(e,t)=>new i(`invalid-option`,e,t?{hint:t}:{}),f=e=>e.cwd?s.resolve(e.cwd):c.cwd(),p=e=>e.server!==void 0,m=e=>a({...e,organization:e.organization??e.workspace}),h=e=>m(e).connections,g=()=>d(`Signing in needs a Coder server.`,`Repeat with --server <url>, or add it in coder dash`);async function _(e){let[{LocalStore:t},{INTEGRATIONS:n},r]=await Promise.all([import(`./apps-aj_JtpAm.js`).then(e=>e.Vn),import(`./integrations-D3OgJk6Y.js`).then(e=>e.r),import(`./apps-aj_JtpAm.js`).then(e=>e.ht)]),a={store:new t,config:{store:`memory`,runner:`local`},integrations:n,organizationId:`default`,local:{cwd:e,port:0}},o=async e=>{try{return await e()}catch(e){throw e instanceof r.ConnectionError?new i(`invalid-option`,e.message,{needs:e.needs}):e}};return{ctx:a,list:()=>r.connectionRows(a),add:e=>o(()=>r.addConnection(a,e)),update:(e,t)=>o(()=>r.changeConnection(a,e,t)),remove:e=>o(()=>r.removeConnection(a,e))}}async function v(e){return p(e)?h(e).list():(await _(f(e))).list()}async function y(e,t){if(p(e))return(await m(e).credentials.list()).some(n=>n.env.includes(t)&&(e.me||n.scope===`workspace`));let{credentialSummary:n}=await import(`./apps-aj_JtpAm.js`).then(e=>e.yt),{ctx:r}=await _(f(e));return(await r.store.list(`credential`)).some(e=>n(r.config,e.id,e.value).env.includes(t))}async function b(e,t){let n=e.key??(await e.askKey?.())?.trim();if(!n)throw d(`${t} needs a key.`,`Give it with --key, on stdin or at the prompt`);return n}async function x(e,t,n){let r=new URL(n,o(e)),i=r.searchParams.get(`state`)??r.searchParams.get(`attempt`);if(!i)throw d(`Sign-in did not start.`);let a=l(`sha256`).update(i).digest(`hex`);e.onAuthorize(r.href);for(let n=0;n<600;n++){await new Promise(e=>setTimeout(e,1e3));let n=(await h(e).list(a)).find(e=>e.id===t);if(!n)throw d(`The connection was removed before sign-in finished.`);if(n.status===`ok`)return n}throw d(`Sign-in did not finish.`,`Try again: coder connection reconnect ${t}`)}async function S(e,t){let[n,...r]=t.command??[],i=t.access&&{access:t.access===`read`?`observe`:`write`},a=t.me?{owner:`me`}:{};if(n&&t.url)throw d(`Use either --url or a command, not both.`);if(t.access&&![`read`,`write`].includes(t.access))throw d(`Invalid --access value.`,`Use read or write`);if(n||t.url){let o=t.auth??(t.key?`key`:t.url?void 0:`none`);if(o!==void 0&&![`oauth`,`key`,`none`].includes(o))throw d(`Invalid --auth value.`,`Use oauth, key or none`);if(o===`oauth`&&!p(t))throw g();if(n&&o===`key`&&!t.env)throw d(`Name the variable the key goes in with --env.`);let s=t.tools?.length?{tools:t.tools}:{};return{name:e,provider:`mcp`,...a,...i,...o?{auth:o}:{},endpoint:t.url?{url:t.url,...t.transport?{type:t.transport}:{},...s}:{command:n,...r.length?{args:r}:{},...s},...o===`key`?{key:await b(t,e),keyIn:t.url?{header:t.header??`Authorization`}:{env:t.env}}:{}}}if(t.env){let n=t.key??(t.credential||await y(t,t.env)?void 0:c.env[t.env]??await b(t,e));return{name:e,provider:`env`,...a,keyIn:{env:t.env},...n?{key:n}:{},...t.credential?{credential:t.credential}:{}}}let{INTEGRATIONS:o}=await import(`./integrations-D3OgJk6Y.js`).then(e=>e.r);if(!p(t)&&!o[e]?.auth.user)throw d(`Say what to connect.`,`Give --env <NAME> for an API key, --url <url> or -- <command> for an MCP server, or a platform name`);if(!p(t))throw g();return{name:e,provider:e,...a}}async function C(e,t){if(!e)throw d(`Name the connection.`,`See them: coder connection list`);let n=await v(t),r=n.find(t=>t.id===e)??n.find(t=>t.mine&&t.id.endsWith(`:${e}`));if(!r)throw d(`No connection "${e}".`,`See them: coder connection list`);return r}async function w(e){let{loadAgents:t}=await import(`./load-CRmQB1LD.js`).then(e=>e.o),{INTEGRATIONS:i}=await import(`./integrations-D3OgJk6Y.js`).then(e=>e.r),a=(e,t,r)=>({name:e,source:t,target:r.connection?`connection ${r.connection}`:r.url??[r.command,...r.args??[]].join(` `),approved:!!r.connection||n(r)}),o=(e={})=>Object.entries(e).filter(([,e])=>e.repository);return[...o(r(e).mcp).map(([e,t])=>a(e,`repo`,t)),...(await t(e,i,{includeDisabled:!0})).flatMap(e=>o(e.definition.mcp).map(([t,n])=>a(t,`agent ${e.id}`,n)))]}const T={async add(e,t={}){if(!e)throw d(`Name the connection.`,`Usage: coder connection add <name> ...`);let n=await S(e,t),r=p(t)?h(t):await _(f(t)),a;try{a=await r.add(n)}catch(o){if(!(o instanceof i)||o.needs!==`key`||!n.endpoint?.url||n.auth||n.key||!t.askKey)throw o;a=await r.add({...n,auth:`key`,key:await b(t,e),keyIn:{header:t.header??`Authorization`}})}return a.authorize&&t.onAuthorize?x(t,a.id,a.authorize):a},async list(e={}){return{connections:await v(e),declared:await w(f(e))}},async remove(e,t={}){let n=await C(e,t);return p(t)?await h(t).remove(n.id):await(await _(f(t))).remove(n.id),n},async reconnect(e,t={}){let n=await C(e,t);if(n.auth===`oauth`){if(!p(t))throw g();let{url:e}=await h(t).authorize(n.id);return t.onAuthorize?x(t,n.id,e):{...n,authorize:e}}if(n.auth!==`key`)throw d(`${n.name} uses no key or sign-in.`);let r=await b(t,n.name);return p(t)?h(t).update(n.id,{key:r}):(await _(f(t))).update(n.id,{key:r})},approve:(e,n={})=>t(f(n),e,n.agent)};export{u as n,T as t};