@wular/coder 0.4.7 → 0.4.8

package/dist/apps-aj_JtpAm.js

@@ -0,0 +1,242 @@
+import{Ft as e,Rt as t,en as n,qi as r}from"./core-DwsAMCnL.js";import{$ as i,$t as a,A as o,An as s,B as c,Ct as l,En as u,H as d,Hn as f,In as p,J as m,L as h,Ln as g,Mt as _,N as v,Nn as y,Nt as b,O as x,Ot as ee,Pt as te,Q as ne,Qt as re,St as ie,Tt as S,U as ae,V as oe,Vn as C,W as se,Wn as ce,Y as le,Yt as ue,_n as de,_t as fe,an as pe,b as me,bn as he,ct as ge,en as _e,et as ve,ft as ye,gn as be,hn as xe,ht as Se,in as Ce,j as we,jn as Te,kn as Ee,l as w,ln as De,mt as Oe,nn as ke,on as T,ot as Ae,pn as E,q as je,rt as Me,sn as Ne,st as Pe,tn as Fe,vn as Ie,wn as Le,wt as Re,xt as ze,y as Be,yn as Ve,zn as He}from"./config-D2FxHWwi.js";import{H as Ue,b as We,d as Ge,h as Ke,o as qe,r as Je,u as Ye}from"./dispatch-D3Dqxijf.js";import{t as Xe}from"./types-B42Oh0zF.js";import{a as Ze,c as Qe,f as $e,i as et,l as tt,n as nt,r as rt,t as it,u as at}from"./load-CRmQB1LD.js";import{l as ot,s as st,u as ct}from"./slack-C_RlVDz7.js";import{i as lt,n as ut,t as dt}from"./integrations-D3OgJk6Y.js";import{i as ft,t as pt}from"./discover-CBP4Uw0N.js";import{a as mt,c as ht,l as gt,n as _t,o as vt}from"./actions-5TDwmn_z.js";import{_ as yt,g as bt,i as xt,r as St}from"./executor-5j-Ewzzb.js";import{i as Ct}from"./mcp-YhyTUMIM.js";import{n as wt,o as Tt,r as Et,t as Dt}from"./exec-BsXFIdTl.js";import{f as Ot,r as kt}from"./task-CB-j4EO8.js";import{t as At}from"./match-Kt3vFTl1.js";import{a as jt,i as Mt}from"./local-XNsjb-UM.js";import{a as D,c as Nt,d as O,f as Pt,i as Ft,l as It,m as Lt,n as Rt,p as zt,r as Bt,u as Vt}from"./http-BYMXT_p6.js";import{n as Ht}from"./env-C_DoQYl5.js";import{C as Ut,S as k,b as A,c as Wt,d as Gt,f as Kt,g as qt,l as Jt,m as Yt,o as Xt,r as Zt,s as Qt,t as $t,u as en,w as tn,x as nn,y as rn}from"./runners-UNKPlmYE.js";import{t as an}from"./log-view-DB4nXHXO.js";import{n as on,t as sn}from"./chat-Bbzlea60.js";import{A as cn,B as ln,C as un,D as dn,F as fn,G as pn,H as mn,I as hn,J as gn,K as _n,L as vn,M as j,N as yn,O as bn,P as xn,Q as Sn,R as Cn,S as wn,T as Tn,U as En,V as Dn,W as On,X as M,Y as kn,Z as An,_ as jn,b as Mn,c as Nn,d as N,f as Pn,g as Fn,h as In,i as P,j as F,k as I,m as L,n as R,o as Ln,p as z,q as Rn,r as zn,s as Bn,t as B,u as Vn,v as Hn,w as Un,x as Wn,y as Gn}from"./schema-BSlHRFSP.js";import{t as Kn,u as qn}from"./dist-BTornX7Y.js";import V from"node:path";import Jn from"node:process";import{fileURLToPath as Yn,pathToFileURL as Xn}from"node:url";import H,{accessSync as Zn,constants as Qn,existsSync as $n,readFileSync as er,statSync as tr}from"node:fs";import{execFile as nr,spawn as rr}from"node:child_process";import{createHash as ir,createHmac as ar,randomBytes as or,randomUUID as sr}from"node:crypto";import cr from"node:os";import lr from"node:net";import{isDeepStrictEqual as ur,promisify as dr}from"node:util";import{AsyncLocalStorage as fr}from"node:async_hooks";import{brotliDecompressSync as pr,constants as mr,createGzip as hr,gunzipSync as gr,gzipSync as _r,inflateSync as vr}from"node:zlib";import yr from"os";import br from"fs";import xr from"net";import Sr from"tls";import Cr from"crypto";import wr from"stream";import{performance as Tr}from"perf_hooks";const Er=e=>`nonce:${ct(e)}`;function Dr(e){let t=e.config.encryptionKey??e.config.adminToken;if(!t)throw Error(`A server secret is required to issue browser transactions.`);return t}function Or(e,t){return ar(`sha256`,Dr(e)).update(t).digest(`base64url`)}async function kr(e,t,n,r,i=6e5){let a=(e.now??Date.now)(),o={kind:t,user:n,organization:e.organizationId,nonce:or(18).toString(`base64url`),exp:a+i},s=jt(o),c=`${s}.${Or(e,s)}`;return await e.store.put(`delivery`,Er(c),{at:a,target:r},{ttlMs:i}),c}function Ar(e,t){let[n,r,i]=t.split(`.`);if(!(!n||!r||i!==void 0)&&ot(Or(e,n),r))try{return Mt(n)}catch{return}}async function jr(e,t){let n=await e.store.get(`delivery`,Er(t));return n&&`target`in n?n.target:void 0}function Mr(e,t){return Ar(e,t)?.organization}function Nr(e,t){return Ar(e,t)?.user}async function Pr(e,t,n,r,i){let a=Ar(e,t),o=(e.now??Date.now)();return!a||a.kind!==n||a.user!==r||a.organization!==e.organizationId||a.exp<o||await jr(e,t)!==i?!1:e.store.take(`delivery`,Er(t))}async function Fr(e,t,n,r){let i=Ar(e,t),a=(e.now??Date.now)();if(!i||i.kind!==n||i.user!==`*`&&i.user!==r||i.organization!==e.organizationId||i.exp<a)return;let o=await jr(e,t);return o!==void 0&&await e.store.take(`delivery`,Er(t))?o:void 0}async function Ir(e,t,n,r){let i=Ar(e,t),a=(e.now??Date.now)();if(!(!i||i.kind!==n||i.user!==`*`&&i.user!==r||i.organization!==e.organizationId||i.exp<a))return jr(e,t)}const Lr=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`];function Rr(e,t,n,r){return{method:e,pattern:t,handler:n,...r?{guard:r}:{}}}function zr(e,t,n){return t.map(t=>({...t,pattern:e+t.pattern,...n&&!t.guard?{guard:n}:{}}))}function Br(e,t,n){return[e,`${e}/*`].flatMap(e=>Lr.map(r=>Rr(r,e,t,n)))}function Vr(e,t){let[n,r]=[e.split(`/`),t.split(`/`)],i=n.at(-1)===`*`;if(i?r.length<n.length:r.length!==n.length)return;let a={};for(let e=0;e<n.length;e++){let[t,o]=[n[e],r[e]];if(t===`*`&&i){a[`*`]=r.slice(e).join(`/`);break}if(t[0]===`:`){if(!o)return;a[t.slice(1)]=o}else if(t!==o)return}return a}async function Hr(e,t,n,r){for(let i of e){let a=Vr(i.pattern,r.pathname);if(!a)continue;for(let e of Object.keys(a))e!==`*`&&(a[e]=decodeURIComponent(a[e]));let o=e.filter(e=>e.pattern===i.pattern),s=o.find(e=>e.method===t.method),c=(s??i).guard;if(c){let e=await c(t,n,a,r);if(e instanceof Response)return e;n=e}if(s)return s.handler(t,n,a,r);let l=Nt();return l.headers.set(`allow`,[...new Set(o.map(e=>e.method))].join(`, `)),l}}const Ur=`coder`;function Wr(e,t){let n=e??`/dash`;try{let e=new URL(n,t);return e.origin===t&&!n.includes(`\\`)&&!/^\/[/\\]/.test(e.pathname)?`${e.pathname}${e.search}${e.hash}`:`/dash`}catch{return`/dash`}}const Gr=`The Coder dashboard is not built; run bun run build.`,Kr=[`default-src 'self'`,`style-src 'self' 'unsafe-inline'`,`img-src 'self' data:`,`connect-src 'self'`,`object-src 'none'`,`base-uri 'none'`,`frame-ancestors 'none'`,`form-action ${[`'self'`,...new Set(Object.values(dt).flatMap(e=>e.app.postOrigins??[]))].join(` `)}`];function qr(e){let t=V.dirname(Yn(e));for(;;){let e=V.join(t,`package.json`);if($n(e))try{if(JSON.parse(er(e,`utf8`)).name===`@wular/coder`)return t}catch{}let n=V.dirname(t);if(n===t)break;t=n}throw Error(`Cannot locate the Coder package root.`)}function Jr(e=import.meta.url){let t=V.dirname(Yn(e)),n=qr(e),r=Yn(new URL(`./dash/standalone/server/entry.js`,import.meta.url));return[V.resolve(r,`../../..`),V.join(n,`dist/dash`),V.join(t,`../dash`)].find(e=>$n(Yr(e)))}const Yr=e=>V.join(e,`standalone/server/manifest.json`);function Xr(e){let t=V.join(e,`standalone/server/entry.js`);if(!$n(t))throw Error(`The Coder dashboard server bundle is missing.`);return t}async function Zr(e){let t=Jr(e);if(!t)throw Error(Gr);let n=JSON.parse(er(Yr(t),`utf8`));return{handler:await(await import(Xn(Xr(t)).href)).createRequestHandler({root:V.join(t,`standalone`)}),manifest:n}}var Qr=class{hosts=new Map};function $r(e){let t=Jr(e);if(t)try{return tr(Yr(t)).mtimeMs}catch{return}}function ei(e,{hosts:t}){let n=Date.now(),r=t.get(e);if(r&&n-r.checked<1e3)return r.host;let i=$r(e);if(r&&(r.checked=n,i===void 0||i===r.build))return r.host;let a={build:i,checked:n,host:Zr(e)};return t.set(e,a),a.host}function ti(e,t){let n=e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;return!!(Vr(`/assets/*`,n)||Vr(`/dash/*`,n)||t.routes.some(e=>Vr(e.route,n)))}async function ni(e,t=new Qr){let n=await ei(import.meta.url,t).catch(()=>{t.hosts.delete(import.meta.url)}),r=e.length>1&&e.endsWith(`/`)?e.slice(0,-1):e;return!!n?.manifest.routes.some(e=>Vr(e.route,r))}const ri=/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi,ii=e=>`'sha256-${ir(`sha256`).update(e).digest(`base64`)}'`;function ai(e){let t=[...e.matchAll(ri)].map(e=>ii(e[1]));return[...Kr,`script-src 'self' ${t.join(` `)}`.trim()].join(`; `)}function oi(e,t){return t===`gzip`?gr(e).toString(`utf8`):t===`br`?pr(e).toString(`utf8`):t===`deflate`?vr(e).toString(`utf8`):e.toString(`utf8`)}const si=e=>(e.headers.get(`accept-encoding`)??``).split(`,`).some(e=>{let[t,...n]=e.split(`;`).map(e=>e.trim()),r=n.find(e=>e.startsWith(`q=`));return t===`gzip`&&(!r||Number(r.slice(2))>0)});function ci(e){e.set(`content-encoding`,`gzip`),/accept-encoding/i.test(e.get(`vary`)??``)||e.append(`vary`,`accept-encoding`)}function li(e){let t=hr(),n=e=>new Promise(n=>{t.write(e),t.flush(mr.Z_SYNC_FLUSH,()=>n())}),r=!1;return new ReadableStream({start(e){t.on(`data`,t=>e.enqueue(new Uint8Array(t))),t.on(`end`,()=>e.close()),t.on(`error`,t=>e.error(t))},async pull(){if(r)return;let{done:i,value:a}=await e.read();if(!i)return n(a);r=!0,t.end()},cancel(n){return t.destroy(),e.cancel(n)}})}function ui(e,t,n,r){n.set(`content-security-policy`,[...Kr,`script-src 'self' 'nonce-${r}'`].join(`; `));let i=t.body;return si(e)&&(ci(n),i=li(i.getReader())),new Response(i,{status:t.status,statusText:t.statusText,headers:n})}async function di(e,t,n){let r=new Headers(t.headers);if(r.set(`x-content-type-options`,`nosniff`),!(r.get(`content-type`)??``).includes(`text/html`))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:r});r.set(`cache-control`,`no-store`),r.delete(`content-length`);let i=r.get(`content-encoding`);if(!i&&t.body)return ui(e,t,r,n);let a=Buffer.from(await t.arrayBuffer()),o=oi(a,i);r.set(`content-security-policy`,ai(o));let s=i?new Uint8Array(a):o;return!i&&o.length>1024&&si(e)&&(s=new Uint8Array(_r(o)),ci(r)),new Response(s,{status:t.status,statusText:t.statusText,headers:r})}async function fi(e,t=import.meta.url,n=new Qr){let r;try{r=await ei(t,n)}catch(e){if(n.hosts.delete(t),e instanceof Error&&e.message===Gr)return;throw e}if(!ti(new URL(e.url).pathname,r.manifest))return;let i=or(16).toString(`base64`),a=new Headers(e.headers);return a.set(`content-security-policy`,`script-src 'nonce-${i}'`),di(e,await r.handler(new Request(e,{headers:a})),i)}const pi=(e,t,n=!1)=>`coder_admin=${encodeURIComponent(t)}; HttpOnly; SameSite=Strict; Path=/${new URL(e.url).protocol===`https:`?`; Secure`:``}${n?`; Max-Age=0`:``}`;function mi(e,t){let n=e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim();if(!n)return t.origin;let r=e.headers.get(`x-forwarded-proto`)?.split(`,`,1)[0]?.trim()??t.protocol.slice(0,-1);try{return new URL(`${r}://${n}`).origin}catch{return t.origin}}async function hi(e,t,n,r){let i=await e.formData(),a=i.get(`token`),o=i.get(`return`),s=Wr(typeof o==`string`&&o.startsWith(`/`)?o:null,new URL(e.url).origin);return typeof a==`string`?a?Gh(a,t.config.adminToken)?new Response(null,{status:303,headers:{location:s,"set-cookie":pi(e,a)}}):zt(`/dash?token=rejected`,303):new Response(null,{status:303,headers:{location:s,"set-cookie":pi(e,``,!0)}}):zt(`/dash?token=rejected`,303)}async function gi(e,t,n,r){return zt(!t.auth||t.session?`/dash`:r.searchParams.has(`signed_out`)?`/login?signed_out=1`:`/login`)}async function _i(e,t,n,r){let i=`/api/auth/sign-in?return=${encodeURIComponent(Wr(r,n.origin))}`,a=t.config.publicUrl;return a&&new URL(mi(e,n)).host!==new URL(a).host?zt(new URL(i,a).href):t.auth.handler(new Request(`${n.origin}${i}`))}async function vi(e,t,n,r){return t.auth&&!r.searchParams.has(`signed_out`)&&!r.searchParams.has(`error`)?_i(e,t,r,r.searchParams.get(`return`)):await fi(xi(e,t),void 0,t.dashboardHosts)??new Response(`UI is not built`,{status:503})}async function yi(e,t,n,r){return await fi(xi(e,t),void 0,t.dashboardHosts)??new Response(`UI is not built`,{status:503})}async function bi(e,t,n,r){return await fi(xi(e,t),void 0,t.dashboardHosts)??It()}function xi(e,t){let n=new Headers(e.headers);n.set(`x-coder-mode`,Yh(t));let r=t.session?.organizations.find(e=>e.id===t.organizationId);return r?n.set(`x-coder-organization`,r.slug):n.delete(`x-coder-organization`),new Request(e,{headers:n})}async function Si(e,t,n){return await fi(xi(e,t),void 0,t.dashboardHosts)??It()}function Ci(e,t){let n=e.organizations.find(e=>e.slug===t||e.id===t);return n?{...e,organizationId:n.id,role:n.role}:{...e,organizationId:void 0,role:void 0,organizationDenied:!0}}function U(e,t){return t===e.organizationId||!e.scope?e:e.scope(t)}async function wi(e,t){if(!e.appRecord){let n=await e.store.get(`app`,t);return n&&{ctx:e,app:n}}let n=await e.appRecord(t);return n&&{ctx:U(e,n.organizationId),app:n.app}}async function Ti(e,t){if(e.boundInstallation?.installation.id===t)return{...U(e,e.boundInstallation.organizationId),boundInstallation:e.boundInstallation};if(!e.installationOrganization)return e;let n=await e.installationOrganization(t);return n===void 0?void 0:U(e,n)}const Ei=`/connections/oauth/client.json`,Di=`/connections/oauth/callback`,Oi=6e5,ki=e=>`connection-oauth:${e}`;async function Ai(e,t,n){await e.store.put(`delivery`,`connection-authorized:${ir(`sha256`).update(n).digest(`hex`)}`,{at:(e.now??Date.now)(),target:`${t.id}:${t.createdAt}`},{ttlMs:Oi})}const ji=f().check(t(1)),Mi=p({resource:ji,authorization_servers:s(ji).check(t(1)),scopes_supported:g(s(ji))}),Ni=p({issuer:ji,authorization_endpoint:ji,token_endpoint:ji,registration_endpoint:g(ji),userinfo_endpoint:g(ji),scopes_supported:g(s(ji)),code_challenge_methods_supported:g(s(ji)),client_id_metadata_document_supported:g(Te()),authorization_response_iss_parameter_supported:g(Te())}),Pi=Ee([`none`,`client_secret_basic`,`client_secret_post`]),Fi=p({client_id:ji,client_secret:g(ji),token_endpoint_auth_method:g(Pi),redirect_uris:g(s(ji))}),Ii=p({name:g(ji),preferred_username:g(ji),email:g(ji)});function Li(e,t){let n=Ie(t);if(!Ne(n,!!e.local))throw Error(`OAuth endpoint is not allowed.`);return n}async function Ri(e,t,n,r=!1){for(let i of[...new Set(n)]){Li(e,i);let n=await de(t,i,{headers:{accept:`application/json`}});if(n.status!==404&&n.status!==405&&!(r&&(n.status===401||n.status===403))){if(!n.ok)throw Error(`OAuth metadata discovery failed.`);return n.json()}}if(!r)throw Error(`OAuth metadata is unavailable.`)}function zi(e){let t={},n=``;for(let r of e?.matchAll(/(?:^|,)\s*(?:([\w-]+)\s+)?([\w-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))/g)??[]){if(r[1]){if(n===`bearer`)break;n=r[1].toLowerCase()}n===`bearer`&&(t[r[2].toLowerCase()]=r[3]?.replace(/\\(.)/g,`$1`)??r[4])}return t}async function Bi(e,t,n=!1,r){let i=Li(e,t),a=e.fetch??fetch;if(r===void 0){let e=await de(a,i.href);r=e.status===401?e.headers.get(`www-authenticate`)??``:``,await e.body?.cancel()}let o=zi(r),s=await Ri(e,a,o.resource_metadata?[o.resource_metadata]:[i.origin+`/.well-known/oauth-protected-resource`+(i.pathname===`/`?``:i.pathname),i.origin+`/.well-known/oauth-protected-resource`],n&&!o.resource_metadata);if(s===void 0)return;let c=Mi.parse(s);if(Li(e,c.resource).origin!==i.origin)throw Error(`OAuth resource changed origin.`);return{resource:c,params:o}}function Vi(e){if(e.local)return`http://localhost:${e.local.port}`;if(e.config.publicUrl)return Ie(e.config.publicUrl).origin;throw Error(`PUBLIC_URL or a local server is required for OAuth.`)}function Hi(e){let t=Vi(e);return{client_name:e.config.name??`Coder`,redirect_uris:[t+Di],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`none`}}function Ui(e,t){return!t.config.publicUrl||Ie(t.config.publicUrl).protocol!==`https:`?It():D({client_id:Ie(t.config.publicUrl).origin+Ei,...Hi(t)})}function Wi(e){if(e.session)return e.session.user.id;if(e.local&&!e.auth)return`local`;throw Error(`Sign in before authorizing a connection.`)}function Gi(e,t){if(!e||e.createdAt!==t.createdAt||e.owner!==t.owner||e.auth!==`oauth`||e.provider!==`mcp`||JSON.stringify(e.endpoint)!==JSON.stringify(t.endpoint))throw Error(`The connection changed during authorization.`)}async function Ki(e,t,n){let r=await e.get(`delivery`,ki(t));if(!r||!(`target`in r)||r.target!==n)throw Error(`The authorization attempt was superseded or expired.`)}async function qi(e,t,n){let r=Wi(e);if(t.auth!==`oauth`||t.provider!==`mcp`||!t.endpoint||!(`url`in t.endpoint)||typeof t.endpoint.url!=`string`||t.owner&&t.owner!==r)throw Error(`This connection cannot be authorized.`);let i=e.fetch??fetch,{resource:a,params:o}=n??await Bi(e,t.endpoint.url),s=a.authorization_servers[0],c=Li(e,s);if(c.search)throw Error(`OAuth issuer cannot contain a query.`);let l=c.pathname.replace(/\/$/,``),u=Ni.parse(await Ri(e,i,[c.origin+`/.well-known/oauth-authorization-server`+l,c.origin+`/.well-known/openid-configuration`+l,c.origin+l+`/.well-known/openid-configuration`]));if(u.issuer!==s)throw Error(`OAuth issuer mismatch.`);if(!u.code_challenge_methods_supported?.includes(`S256`))throw Error(`OAuth server does not support PKCE S256.`);Li(e,u.authorization_endpoint),Li(e,u.token_endpoint),u.registration_endpoint&&Li(e,u.registration_endpoint),u.userinfo_endpoint&&Li(e,u.userinfo_endpoint);let d=t.secret?A(e.config,t.secret):void 0,f=d?.issuer===s&&d.clientId?{clientId:d.clientId,clientSecret:d.clientSecret,tokenEndpointAuthMethod:d.tokenEndpointAuthMethod}:void 0;if(!f&&u.client_id_metadata_document_supported&&e.config.publicUrl&&Ie(e.config.publicUrl).protocol===`https:`&&(f={clientId:Ie(e.config.publicUrl).origin+Ei,tokenEndpointAuthMethod:`none`}),!f){if(!u.registration_endpoint)throw Error(`OAuth server does not support client registration.`);let t=await de(i,u.registration_endpoint,{method:`POST`,headers:{"content-type":`application/json`,accept:`application/json`},body:JSON.stringify(Hi(e))});if(!t.ok)throw Error(`OAuth client registration failed.`);let n=Fi.parse(await t.json()),r=n.token_endpoint_auth_method??`client_secret_basic`;if(r!==`none`&&!n.client_secret)throw Error(`OAuth registration omitted the client secret.`);if(n.redirect_uris&&!n.redirect_uris.includes(Vi(e)+Di))throw Error(`OAuth registration changed the redirect URI.`);f={clientId:n.client_id,clientSecret:n.client_secret,tokenEndpointAuthMethod:r}}let p={issuer:s,authorizationEndpoint:u.authorization_endpoint,tokenEndpoint:u.token_endpoint,resource:a.resource,...f,scope:o.scope??a.scopes_supported?.join(` `)??u.scopes_supported?.join(` `)},m=k(e.config,p),h=or(18).toString(`base64url`);await e.store.withAppLock(`connection:${t.id}`,async n=>{Gi(await n.get(`connection`,t.id),t),await n.put(`delivery`,ki(t.id),{at:(e.now??Date.now)(),target:h},{ttlMs:Oi})});let g=or(32).toString(`base64url`),_=await kr(e,`connection-oauth`,r,k(e.config,{id:t.id,attempt:h,secret:m,createdAt:t.createdAt,endpoint:t.endpoint,owner:t.owner,verifier:g,redirectUri:Vi(e)+Di,userinfo:u.userinfo_endpoint,requireIssuer:u.authorization_response_iss_parameter_supported===!0}),Oi),v=new URL(p.authorizationEndpoint),y={response_type:`code`,client_id:p.clientId,redirect_uri:Vi(e)+Di,state:_,code_challenge:ir(`sha256`).update(g).digest(`base64url`),code_challenge_method:`S256`,resource:p.resource};for(let[e,t]of Object.entries(y))v.searchParams.set(e,t);return p.scope!==void 0&&v.searchParams.set(`scope`,p.scope),v.href}async function Ji(e,t,n){let r=t,i=e=>zt(`${Ig(Pg(r),`/settings/connections`)}?outcome=${e}`);try{let e=n.searchParams.get(`state`)??``,a=Mr(t,e);if(t.auth&&(!a||!t.session?.organizations.some(e=>e.id===a)))return i(`invalid-state`);let o=t.session?.organizations.find(e=>e.id===a),s=a?{...U(t,a),session:t.session&&{...t.session,organizationId:a,role:a===t.session.organizationId?t.session.role:o.role}}:t;r=s;let c=await Fr(s,e,`connection-oauth`,Wi(s));if(!c)return i(`invalid-state`);let l=A(s.config,c);if(!l.owner&&!Uh(s))return i(`failed`);let u=A(s.config,l.secret),d=n.searchParams.get(`iss`);if((l.requireIssuer||d!==null)&&d!==u.issuer)return i(`failed`);if(n.searchParams.has(`error`))return i(n.searchParams.get(`error`)===`access_denied`?`denied`:`failed`);let f=n.searchParams.get(`code`);if(!f)return i(`failed`);Gi(await s.store.get(`connection`,l.id),l),await Ki(s.store,l.id,l.attempt);let p=s.fetch??fetch,m=await Ve(p,u,new URLSearchParams({grant_type:`authorization_code`,code:f,redirect_uri:l.redirectUri,code_verifier:l.verifier})),h=m.preferred_username??m.email??m.name;if(!h&&l.userinfo)try{let e=await de(p,l.userinfo,{headers:{authorization:`Bearer ${m.access_token}`,accept:`application/json`}});if(e.ok){let t=Ii.parse(await e.json());h=t.preferred_username??t.email??t.name}}catch{}return await s.store.withAppLock(`connection:${l.id}`,async t=>{let n=await t.get(`connection`,l.id);Gi(n,l),await Ki(t,l.id,l.attempt),await t.put(`connection`,n.id,{...n,secret:k(s.config,he(u,m,(s.now??Date.now)())),account:h??n.account,broken:void 0,updatedAt:(s.now??Date.now)()}),await t.delete(`delivery`,ki(l.id)),await Ai({...s,store:t},n,e)}),i(`connected`)}catch{return i(`failed`)}}async function Yi(e,t,n,r=!1){return r?[]:(await gm(e,t)).filter(e=>n===void 0||n.includes(e.id)).map(e=>e.id)}function Xi(e){if(typeof e!=`string`||!e)return{ok:!1,detail:`A folder path is required`};let t=e===`~`?cr.homedir():e.startsWith(`~/`)?V.join(cr.homedir(),e.slice(2)):e;if(!V.isAbsolute(t))return{ok:!1,detail:`The folder path must be absolute`};let n=V.normalize(t);try{return H.statSync(n).isDirectory()?(H.accessSync(n,H.constants.R_OK),{ok:!0,folder:{path:n,name:V.basename(n)}}):{ok:!1,detail:`The path is not a directory`}}catch{return{ok:!1,detail:`The folder does not exist or is not readable`}}}function Zi(e){let t=new Map,n=[...Pe(e),...Ae(e,{migrate:!1})].sort((e,t)=>Date.parse(t.createdAt)-Date.parse(e.createdAt));for(let e of n){let n=Xi(e.cwd);if(!(!n.ok||t.has(n.folder.path))&&(t.set(n.folder.path,{...n.folder,recent:Date.parse(e.createdAt)}),t.size===8))break}return{current:{path:e,name:V.basename(e)},recent:[...t.values()],picker:!!$i()}}const Qi=e=>(process.env.PATH??``).split(V.delimiter).some(t=>t&&H.existsSync(V.join(t,e)));function $i(){let e=`Choose a folder for the task`;if(process.platform===`darwin`)return[`osascript`,[`-e`,`tell application "System Events"`,`-e`,`activate`,`-e`,`POSIX path of (choose folder with prompt "${e}")`,`-e`,`end tell`]];if(process.platform===`win32`)return[`powershell`,[`-NoProfile`,`-Command`,`Add-Type -AssemblyName System.Windows.Forms; $d = New-Object System.Windows.Forms.FolderBrowserDialog; $d.Description = '${e}'; if ($d.ShowDialog() -eq 'OK') { $d.SelectedPath }`]];if(Qi(`zenity`))return[`zenity`,[`--file-selection`,`--directory`,`--title=${e}`]];if(Qi(`kdialog`))return[`kdialog`,[`--getexistingdirectory`,cr.homedir(),`--title`,e]]}async function ea(){let e=$i();if(!e)return{ok:!1,detail:`This machine has no folder dialog; type a path instead`};try{let{stdout:t}=await dr(nr)(e[0],e[1],{timeout:6e5}),n=t.trim().replace(/(.)[\\/]+$/,`$1`);return n?Xi(n):{ok:!1,detail:``}}catch{return{ok:!1,detail:``}}}function ta(e){let t=/^\w[\w.-]*@([\w.-]+):(?!\/)([^?#]+)$/.exec(e),n=t||!URL.canParse(e)?void 0:new URL(e);if(!t&&(!n||![`https:`,`ssh:`].includes(n.protocol)||n.password||n.search||n.hash))return;let[r,i]=t?[t[1],t[2]]:[n.port?`${n.hostname}_${n.port}`:n.hostname,n.pathname],a=i.replace(/(\.git)?\/?$/,``).split(`/`).filter(Boolean);if(!(!/^[a-z0-9][a-z0-9._-]*$/i.test(r)||a.length<2||!a.every(e=>/^[\w.-]+$/.test(e)&&!/^\.+$/.test(e))))return[r.toLowerCase(),...a]}async function na(e){let t=typeof e==`string`?e.trim():``,n=ta(t);if(!n)return{ok:!1,detail:`Use an https or ssh git URL, like https://github.com/owner/repo`};let r=ne(`checkouts`,...n),i=AbortSignal.timeout(6e5),a={...process.env,GIT_TERMINAL_PROMPT:`0`,GIT_SSH_COMMAND:process.env.GIT_SSH_COMMAND??`ssh -o BatchMode=yes`},o=e=>dr(nr)(`git`,e,{env:a,signal:i,maxBuffer:67108864});try{await Ot(r,async()=>{if(H.existsSync(V.join(r,`.git`))){await o([`-C`,r,`remote`,`set-url`,`origin`,t]),await o([`-C`,r,`fetch`,`origin`]);return}let e=await H.promises.mkdtemp(`${r}-clone-`);try{await o([`clone`,`--`,t,e]),await H.promises.rename(e,r)}finally{await H.promises.rm(e,{recursive:!0,force:!0})}})}catch(e){let t=e;if(i.aborted)return{ok:!1,detail:`The clone took longer than 10 minutes`};if(t.code===`ENOENT`&&!t.stderr)return{ok:!1,detail:`Git is not installed on this machine`};let n=String(t.stderr??t.message).split(`
+`).map(e=>e.trim()).filter(Boolean),r=(n.find(e=>e.startsWith(`fatal:`))??n.at(-1)??`The clone failed`).replace(/^fatal:\s*/,``);return{ok:!1,detail:r[0].toUpperCase()+r.slice(1)}}return{ok:!0,folder:{path:r,name:n.at(-1),url:t}}}const ra=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;function ia(e,t){return e.get(`agent`,t)}async function aa(e){return(await e.list(`agent`)).map(e=>e.value)}async function oa(e,t,n){let r=n??(await ia(e,t))?.currentVersion;return r===void 0?void 0:e.get(`agentversion`,ra(t,r))}async function sa(e,t){if(e.listAgentsWithVersions)return(await e.listAgentsWithVersions(t))[0]??{};let n=await ia(e,t);return{record:n,version:n&&await oa(e,t,n.currentVersion)}}async function ca(e){if(e.listAgentsWithVersions)return e.listAgentsWithVersions();let t=await aa(e);return Promise.all(t.map(async t=>({record:t,version:await oa(e,t.id,t.currentVersion)})))}async function la(e,t,n){if(e.publishAgent){let r=$e(t.id,t.definition),i=t.files&&Object.keys(t.files).length?t.files:void 0;return e.publishAgent({id:t.id,name:t.name??r.name??t.id,...t.description??r.description?{description:t.description??r.description}:{},source:t.source,...t.repo?{repo:t.repo}:{},...t.path?{path:t.path}:{},currentVersion:0,createdAt:n,updatedAt:n},{agent:t.id,version:0,definition:r,systemPrompt:t.systemPrompt,...i?{files:i}:{},...t.commit?{commit:t.commit}:{},...t.origin?{source:t.origin}:{},importedFrom:t.importedFrom,createdAt:n})}let r=await sa(e,t.id),i=await ua(e,t,n,r);return{record:await ia(e,t.id),version:i,unchanged:r.record?.currentVersion===i.version}}async function ua(e,t,n,r){if(!r&&e.publishAgent)return(await la(e,t,n)).version;let i=$e(t.id,t.definition),a=t.files&&Object.keys(t.files).length?t.files:void 0,o=r?r.record:await ia(e,t.id),s=r?r.version:o?await oa(e,t.id,o.currentVersion):void 0,c=(e,r)=>({id:t.id,name:t.name??i.name??t.id,...t.description??i.description?{description:t.description??i.description}:{},source:t.source,...t.repo?{repo:t.repo}:{},...t.path?{path:t.path}:{},currentVersion:e,...o?.settings?{settings:o.settings}:{},createdAt:o?.createdAt??n,updatedAt:r}),l=e=>ur(e.definition,i)&&e.systemPrompt===t.systemPrompt&&ur(e.files,a);if(s&&l(s)){let r=c(s.version,o.updatedAt);return ur(o,r)||await e.put(`agent`,t.id,c(s.version,n)),s}o||await e.put(`agent`,t.id,c(0,n));let u;for(let r=(o?.currentVersion??0)+1;u={agent:t.id,version:r,definition:i,systemPrompt:t.systemPrompt,...a?{files:a}:{},...t.commit?{commit:t.commit}:{},...t.origin?{source:t.origin}:{},importedFrom:t.importedFrom,createdAt:n},!await e.create(`agentversion`,ra(t.id,r),u);r++){let n=await e.get(`agentversion`,ra(t.id,r));if(n&&l(n)){u=n;break}}let d=await ia(e,t.id);return(!d||d.currentVersion<u.version)&&await e.put(`agent`,t.id,c(u.version,n)),u}async function da(e,t,n,r=Date.now()){let i=await ia(e,t);if(!i)throw Error(`No agent named "${t}".`);let a={...i,settings:n,updatedAt:r};return await e.put(`agent`,t,a),a}const fa=[`read-only`,`workspace-write`,`auto`];function pa(e,t){if(Array.isArray(e))return[...new Set(e)];let n=Xe.indexOf(e);return[...new Set(Xe.slice(0,n+1).flatMap(e=>t?.tools.presets[e]??[]))]}function ma(e,t,n,r){if(!t&&!n)return;let i=t??{},a=n??{},o=new Set([...Object.keys(i.integrations??{}),...Object.keys(a.integrations??{})]),s=Object.fromEntries([...o].map(e=>{let t=i.integrations?.[e],n=a.integrations?.[e],o=t?.allowedEvents&&n?.allowedEvents?t.allowedEvents.filter(e=>n.allowedEvents.includes(e)):n?.allowedEvents??t?.allowedEvents,s=t?.allowedTools&&n?.allowedTools?pa(t.allowedTools,r[e]).filter(t=>new Set(pa(n.allowedTools,r[e])).has(t)):n?.allowedTools??t?.allowedTools;return[e,{...o?{allowedEvents:o}:{},...s?{allowedTools:s}:{}}]})),c=i.permissions??e.permissions??`read-only`,l=a.permissions,u=l&&fa.indexOf(l)<=fa.indexOf(c)?l:c;return{...i,...a,permissions:u,...o.size?{integrations:s}:{},...i.connections!==void 0||a.connections!==void 0?{connections:i.connections&&a.connections?i.connections.filter(e=>a.connections.includes(e)):a.connections??i.connections}:{}}}function ha(e,t,n,r=dt){let i=ma(t.definition,void 0,e.settings,r),a=ma(t.definition,i,n,r),[o]=it({definitions:{[e.id]:{json:t.definition,builtin:e.source===`builtin`}},usage:a?{[e.id]:a}:void 0},r);if(!o)throw Error(`Agent "${e.id}" is disabled.`);return{...o,files:{...t.files??{},"system.md":t.systemPrompt}}}function ga(e,t=``){let n={};for(let r of H.readdirSync(V.join(e,t),{withFileTypes:!0})){let i=t?`${t}/${r.name}`:r.name;r.isDirectory()?Object.assign(n,ga(e,i)):r.isFile()&&i!==`agent.json`&&i!==`system.md`&&(n[i]=H.readFileSync(V.join(e,i),`utf8`))}return n}async function _a(e,t,n,r){let i=rt()[n];return i?await ua(e,{id:n,source:`builtin`,definition:i.json,systemPrompt:H.readFileSync(V.join(i.dir,`system.md`),`utf8`),files:ga(i.dir),importedFrom:`builtin:${ue()}`},t,r)!==r.version:!1}async function va(e,t,n){let r=n??await Promise.all(Object.keys(rt()).map(t=>sa(e,t))),i=!1;for(let n of Object.keys(rt()))await _a(e,t,n,r.find(({record:e})=>e?.id===n)??{})&&(i=!0);return i}const ya=`.coder/agents`,ba=2592e6;function xa(e){return e.repo?`${e.repo.owner}/${e.repo.name}`:void 0}const Sa=(e,t,n)=>`repo-file:${e}@${t}@${n}:`,Ca=(e,t,n)=>`repo-push:${e}@${t}@${n}`;function wa(e,t,n,r,i,a){let o=`${Sa(n.installation,r,a??``)}${i}`,s=e.fileReads??=new Map,c=s.get(o);if(!c){let l=AbortSignal.timeout(1e4),u=new Promise((e,t)=>l.addEventListener(`abort`,()=>t(l.reason),{once:!0}));c=Promise.race([Ta(e.store,t,n,r,i,a,o,l),u]).catch(e=>{throw l.aborted&&console.error(`coder server: repository file read timed out for ${r}/${i}`,e),e}).finally(()=>s.delete(o)),s.set(o,c)}return c}async function Ta(e,t,n,r,i,a,o,s){let c=await e.get(`snapshot`,o);s.throwIfAborted();let l=/^[0-9a-f]{40}$/i.test(a??``),u=Date.now();if(c&&!c.stale&&(l||u-(c.readAt??0)<6e5))return c.text;let d=Ca(n.installation,r,a??``),[f,p]=await Promise.all([n.token(r),l?void 0:e.get(`snapshot`,d)]);if(s.throwIfAborted(),!f||!t.repos)return;let m=t.repos.revalidate?await t.repos.revalidate(r,i,f,{...a?{ref:a}:{},...c?.etag?{etag:c.etag}:{},fetch:((e,t)=>n.fetch(e,{...t,signal:s}))}):{text:await t.repos.readFile(r,i,f,a)};s.throwIfAborted();let{stale:h,...g}=c??{},_={...m===`unchanged`?g:m,...l?{}:{readAt:u}};return await e.put(`snapshot`,o,_,{ttlMs:ba}),!l&&(await e.get(`snapshot`,d))?.push!==p?.push&&await e.put(`snapshot`,o,{..._,stale:!0},{ttlMs:ba}),_.text}async function Ea(e,t){let n=[t.branch,...t.branch===t.defaultBranch?[``]:[]];for(let r of n){await e.put(`snapshot`,Ca(t.installation,t.repo,r),{push:sr()},{ttlMs:36e5});for(let{id:n,value:i}of await e.list(`snapshot`,{prefix:Sa(t.installation,t.repo,r)}))i.stale||await e.put(`snapshot`,n,{...i,stale:!0},{ttlMs:ba})}}async function Da(e,t,n,r,i){let a=await wa(e,t,n,r,`.coder/config.json`,i);return a===void 0?void 0:JSON.parse(a).agents}async function Oa(e,t,n,r,i=async()=>void 0){for(let t of Object.values(e)){if(!r.repo&&t.id===r.integration||!t.repos)continue;let e=await(await i(t.id))?.token(n);if(e)return{contents:t,token:e}}let[a,o]=n.split(`/`);for(let{value:r}of await t.store.list(`app`)){if(r.agentsRepo!==n)continue;let i=e[r.integration];if(!i?.repos)continue;let s=(await t.store.list(`installation`,{prefix:`${r.id}:`})).find(e=>!e.value.deletedAt)?.value;if(s)try{let e=s.token?{...s,token:A(t.config,s.token)}:s;return{contents:i,token:await i.auth.token(e,A(t.config,r.credentials),{...a&&o?{repo:{owner:a,name:o}}:{},tools:i.tools.presets.observe}),app:r,installation:s}}catch{continue}}}function ka(e,t){let n=t.cwd??Jn.cwd(),r=t.now??Date.now;async function i(n,r,i){let a=lt(e),o=a?.repos&&await i(a.id);if(!a||!o)return;let s=xa(r);if(r.integration===a.id&&s)return Da(t,a,o,s,r.repo?.ref);let c=n.settings?.configRepo;if(c)return Da(t,a,o,c)}async function a(n,a,o,s){let c=await sa(t.store,n.agent);c.record&&await _a(t.store,r(),n.agent,c)&&(c=await sa(t.store,n.agent));let{record:l,version:u}=c;if(!l)return;if(!u)throw Error(`No version ${l.currentVersion} for agent "${l.id}".`);let d=await i(a,o,s),f=d&&typeof d==`object`?d[n.agent]:void 0;if(f===!1||f?.disabled)throw Error(`Agent "${n.agent}" is disabled in ${xa(o)??a.settings?.configRepo??n.agentsRepo}.`);return ha(l,u,f&&typeof f==`object`?f:void 0,e)}return async(i,o,s,c)=>{let l=(await Ze(n,e)).find(e=>e.id===i.agent&&!e.builtin);if(l)return l;let u=await a(i,o,s,c);if(u)return u;if(i.agentsRepo){let n=await Oa(e,t,i.agentsRepo,s,c);if(n){await ja(t.store,n.contents,i.agentsRepo,xa(s)===i.agentsRepo?s.repo?.ref??`HEAD`:`HEAD`,n.token,r());let e=await a(i,o,s,c);if(e)return e;throw Error(`No agent "${i.agent}" in ${i.agentsRepo}.`)}}if(await _a(t.store,r(),i.agent,{})){let e=await a(i,o,s,c);if(e)return e}throw Error(i.agentsRepo?`No agent named "${i.agent}".`:`No built-in agent "${i.agent}".`)}}async function Aa(e,t,n,r,i,a=``,o,s=0){let c={},l=o??await e.repos.listDir(t,a?`${n}/${a}`:n,r,i);for(let o of l){let u=a?`${a}/${o}`:o;if(u===`agent.json`||u===`system.md`)continue;let d=await e.repos.readFile(t,`${n}/${u}`,r,i);if(d!==void 0)c[u]=d;else if(s<20){let a=await e.repos.listDir(t,`${n}/${u}`,r,i);a.length&&!ur(a,l)&&Object.assign(c,await Aa(e,t,n,r,i,u,a,s+1))}}return c}async function ja(e,t,n,r,i,a,o={}){let s=o.path??`.coder/agents`,c=/^[0-9a-f]{40}$/i.test(r)?r:await t.repos.commit(n,r,i)??r,l={repo:n,ref:o.branch??r,commit:c};r=c;let u=o.slugs??await t.repos.listDir(n,s,i,r);nt(u);let d=[];for(let o of u){let u=`${s}/${o}`,f=await t.repos.readFile(n,`${u}/agent.json`,i,r);if(f===void 0)continue;let p=JSON.parse(f),[m]=it({definitions:{[o]:{json:p,builtin:!1}},usage:void 0},{...dt,[t.id]:t});m&&d.push(await ua(e,{id:o,name:m.name,description:m.definition.description,source:`repo`,repo:n,path:u,definition:m.definition,systemPrompt:await t.repos.readFile(n,`${u}/system.md`,i,r)??``,files:await Aa(t,n,u,i,r),commit:c,origin:l,importedFrom:`repo:${n}@${l.ref}`},a))}return d}const Ma=e=>`app-sync:${e}`,Na=(e,t,n,r)=>e.manifest?.(t,{publicUrl:n,definition:r})??r,Pa=(e,t,n)=>!!(e&&!e.pending&&e.version>=t&&ur(e.manifest,n));async function Fa(e,t,n,r){let i=e.integrations[n.integration]?.app,a=e.config.publicUrl,o=await t.get(`delivery`,Ma(n.id));if(i?.values){let e=i.values(n,{publicUrl:a,definition:r.definition}),s=o?.manifest??[],c=e.lines.map(e=>s.some(t=>t.text===e.text&&t.copy===e.copy)?e:{...e,changed:!0}),l=c.some(e=>`changed`in e);return l!==o?.changed&&await t.put(`delivery`,Ma(n.id),{...o,version:r.version,changed:l}),{...e,lines:c,changed:l,confirm:!0}}if(!i?.drift)return;let s=await i.drift(n,A(e.config,n.credentials),{publicUrl:a,definition:r.definition,fetch:e.fetch??fetch}),c=s.lines.length>0;return await t.put(`delivery`,Ma(n.id),{version:r.version,changed:c}),{...s,changed:c}}async function Ia(e,t,n){let r=e.config.publicUrl;if(!r||!t.length)return[];let i=new Map(t.map(e=>[e.agent,e])),a=await e.store.list(`app`);return(await Promise.all(a.filter(({id:e,value:t})=>i.has(t.agent)&&(!n||e===n)).map(async({id:t})=>e.store.withAppLock(t,async a=>{let o=await a.get(`app`,t);if(!o||!i.has(o.agent))return;let s=await oa(a,o.agent)??i.get(o.agent),c=e.integrations[o.integration]?.app;if(!c||!s.definition.integrations[o.integration]||!c.update&&(o.builtin||o.shared))return;if(!c.update)return Fa(e,a,o,s).then(e=>e&&{app:o,check:e},e=>(console.error(`coder server: checking ${o.id} on its platform failed`,e),{app:o,error:e instanceof Error?e.message:String(e)}));let{update:l}=c,u=Na(c,o,r,s.definition),d=Ma(t),f=await a.get(`delivery`,d);if(!n&&Pa(f,s.version,u)||f&&f.version>s.version)return;let p={version:s.version,manifest:u,pending:!0};await a.put(`delivery`,d,p);try{let t=await l(o,A(e.config,o.credentials),{publicUrl:r,definition:s.definition,fetch:e.fetch??fetch,saveCredentials:async t=>{await a.put(`app`,o.id,{...o,credentials:k(e.config,t)})}});return t&&await a.put(`app`,o.id,{...o,credentials:k(e.config,t)}),await a.put(`delivery`,d,{...p,pending:!1}),{app:o}}catch(e){let t=`Could not sync ${o.integration} app ${o.id}. ${e instanceof Error?e.message:String(e)}`;return await a.put(`delivery`,d,{...p,error:t}),{app:o,error:t}}})))).filter(e=>e!==void 0)}async function La(e,t){let n=(await Ia(e,t)).flatMap(({app:t,error:n})=>n&&e.integrations[t.integration]?.app.update?[n]:[]);if(n.length)throw Error(n.join(`
+`))}function Ra(){return{integration:`source`,type:`import`,appId:``,installationId:``,deliveryId:``,actor:{id:`admin`},text:``}}async function za(e,t,n,r=Ra(),i){let a=await Oa(e.integrations,{config:e.config,store:e.store},t,r);if(!a)return;let o=await ja(e.store,a.contents,t,n,a.token,(e.now??Date.now)(),i?{branch:i}:{});return await La(e,o),o}var Ba=class extends Error{};function Va(e,t,n,r){let i=t;return(!n.runner||n.runner===e||n.runner===i.name)&&(!n.defaults||!!i.default)&&(!n.ids||n.ids.includes(e))&&(!n.agent||(r??i.agent)===n.agent)&&(!Object.hasOwn(n,`visibleTo`)||!i.owner||i.owner===n.visibleTo)&&(!n.active||i.deletedAt===void 0)&&(!n.installation||i.installationId===n.installation)&&(!n.apps||!!i.app&&n.apps.includes(i.app))}const Ha=(e,t)=>e===`credential`?`credential:${Op(t).owner??``}`:e===`runner`?`runners:`:`installation:${t}`;async function Ua(e,t,n,r){let i=Op(n).owner,a=(await e.list(t)).filter(e=>t===`credential`?Op(e.id).owner===i:e.id===n),o=await r(a.find(e=>e.id===n)?.value,a,e);for(let n of o??[])n.value===null?await e.delete(t,n.id):await e.put(t,n.id,n.value);return!!o?.length}function Wa(e,t,n){if(n.deletedAt!==void 0)return;let r=n.app.split(`/`)[0],i=(e,t)=>[e.slice(t.app.length+1),...t.covers??[]],a=new Set(i(t,n));if(e.some(([e,n])=>{let o=n;return e!==t&&!o.deletedAt&&(o.app===r||o.app.startsWith(`${r}/`))&&i(e,o).some(e=>a.has(e))}))throw new Ba(`Installation "${t}" is bound through another app.`)}var Ga=class{now;appUpdates=new Map;values=new Map;configUpdate;constructor(e=Date.now){this.now=e}async withAppLock(e,t){e.startsWith(`runners:`)&&(e=`runners:`);let n=(this.appUpdates.get(e)??Promise.resolve()).catch(()=>{}).then(()=>t(this));this.appUpdates.set(e,n);try{return await n}finally{this.appUpdates.get(e)===n&&this.appUpdates.delete(e)}}async withConfigLock(e){let t=(this.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e(this));this.configUpdate=t;try{return await t}finally{this.configUpdate===t&&delete this.configUpdate}}withCredential(e,t,n){return this.withAppLock(Ha(e,t),()=>Ua(this,e,t,n))}bucket(e){let t=this.values.get(e);return t||(t=new Map,this.values.set(e,t)),t}read(e,t){let n=t;if(e!==`app`||!n.shared)return t;let r=this.live(`app`).get(n.shared)?.value;return{...n,credentials:r?.credentials??``}}live(e){let t=this.bucket(e),n=this.now();for(let[e,r]of t)r.expiresAt!==void 0&&r.expiresAt<=n&&t.delete(e);return t}async get(e,t){let n=this.live(e).get(t);return n&&this.read(e,n.value)}async patchLogin(e,t,n={}){let r=this.live(`login`).get(e),i=r?.value;if(!i||!(i.expiresAt>this.now())||Object.entries(n).some(([e,t])=>Array.isArray(t)?!t.includes(i[e]):i[e]!==t))return;let a={...i,...t};return a.input===null&&delete a.input,r.value=a,a}completeLogin(e,t,n,r){return Up(this,e,t,n,r)}async put(e,t,n,r={}){e===`installation`&&Wa([...this.live(e)].map(([e,t])=>[e,t.value]),t,n);let i=r.ttlMs===void 0?void 0:this.now()+r.ttlMs,a=this.bucket(e),o=e===`task`&&!r.unarchive?a.get(t)?.value?.archivedAt:void 0;a.set(t,{value:o===void 0?e===`app`&&n.shared?{...n,credentials:``}:n:Object.assign({},n,{archivedAt:o}),expiresAt:i})}async putMany(e,t){if(e===`task`){await Promise.all(t.map(t=>this.put(e,t.id,t.value)));return}let n=this.bucket(e);for(let e of t)n.set(e.id,{value:e.value})}async list(e,t={}){let n=e===`installation`&&t.agent?this.live(`app`):void 0;return[...this.live(e).entries()].filter(([e])=>!t.prefix||e.startsWith(t.prefix)).filter(([e])=>!t.after||e>t.after).filter(([r,i])=>Va(r,i.value,t,e===`agent`?r:n?.get(i.value.app)?.value?.agent)).sort(([e],[t])=>e.localeCompare(t)).slice(0,t.limit).map(([t,n])=>({id:t,value:this.read(e,n.value)}))}async delete(e,t){this.bucket(e).delete(t)}async create(e,t,n,r={}){let i=this.live(e);if(i.has(t))return!1;let a=r.ttlMs===void 0?void 0:this.now()+r.ttlMs;return i.set(t,{value:n,expiresAt:a}),!0}async claimDeliveryLease(e,t,n){let r=this.live(`delivery`);if(r.has(e))return;let i=this.live(`snapshot`).get(`delivery:${e}`)?.value?.failures??0;return r.set(e,{value:{owner:t,failures:i},expiresAt:this.now()+n}),i}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=this.live(`delivery`);if(i.get(e)?.value?.owner!==t)return!1;if(!n)i.delete(e),this.bucket(`snapshot`).delete(`delivery:${e}`);else{let t=n.next===void 0?n:{...n,next:this.now()+r.ttlMs};i.set(e,{value:t,expiresAt:this.now()+r.ttlMs}),n.next!==void 0&&this.bucket(`snapshot`).set(`delivery:${e}`,{value:t,expiresAt:this.now()+864e5})}return!0}async updateDelivery(e,t,n,r={}){let i=this.live(`delivery`);return i.get(e)?.value?.owner===t&&(n===void 0?i.delete(e):i.set(e,{value:n,...r.ttlMs===void 0?{}:{expiresAt:this.now()+r.ttlMs}}),!0)}async take(e,t){let n=this.live(e),r=n.has(t);return r&&n.delete(t),r}},Ka=r({LocalStore:()=>$a,deleteLocalAgent:()=>ro,syncLocalAgents:()=>to,writeLocalAgent:()=>no});const qa=new Set([`app`,`installation`,`runner`]),Ja=new Set([`task`,`tasklog`,`inbox`,`usage`]),Ya=new Set([`connection`,`credential`]),Xa=new Set([`agent`,`agentversion`]);function Za(e,t){try{return JSON.parse(H.readFileSync(e,`utf8`))}catch(e){if(e.code===`ENOENT`)return t;throw e}}function Qa(e,t){H.mkdirSync(V.dirname(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;try{H.writeFileSync(n,t,{mode:384}),H.renameSync(n,e)}finally{H.rmSync(n,{force:!0})}}var $a=class{now;connections;connectionContexts;connectionSecrets;derived=new Ga;writes=Promise.resolve();constructor(e=Date.now,t=()=>new a){this.now=e,this.connections=t}withAppLock(e,t){return e.startsWith(`connection:`)||e.startsWith(`connection-import:`)?this.connections().withLock(()=>t(this),e.replace(/^connection:/,``)):this.derived.withAppLock(e,()=>t(this))}withConfigLock(e){return this.derived.withConfigLock(()=>e(this))}withCredential(e,t,n){let r=()=>Ua(this,e,t,n);return e===`credential`?this.connections().withLock(r,Ha(e,t)):this.derived.withAppLock(Ha(e,t),r)}get appsFile(){return i(`apps.json`)}get deliveriesFile(){return V.join(ie(``),`deliveries.json`)}get notesDir(){return V.join(ie(``),`notes`)}noteFile(e){return V.join(this.notesDir,`${encodeURIComponent(e)}.md`)}serial(e,t=!1){let n=this.writes.then(()=>t?this.connections().withLock(async()=>e()):e());return this.writes=n.catch(()=>{}),n}apps(){return Za(this.appsFile,{})}recordsFile(e){return e===`delivery`?this.deliveriesFile:e===`usage`?ze():e===`snapshot`?V.join(ie(``),`snapshots.json`):V.join(ie(``),`runner`,`${e}.json`)}deliveries(e=`delivery`){let t=this.now();return Object.fromEntries(Object.entries(Za(this.recordsFile(e),{})).filter(([,e])=>e.expiresAt===void 0||e.expiresAt>t))}entries(e){if(e===`connection`)return this.connections().list().map(e=>[e.id,e]);if(e===`credential`)return this.connections().credentials().map(e=>[e.id,e.value]);if(qa.has(e)){let t=this.apps(),n=Object.entries(t[e]??{});return e===`app`?n.map(([e,n])=>{let r=n,i=r.shared?t.app?.[r.shared]:void 0;return[e,r.shared?{...r,credentials:i?.credentials??``}:r]}):n}if(e===`delivery`||e===`snapshot`||Ja.has(e))return Object.entries(this.deliveries(e)).map(([e,t])=>[e,t.value]);if(e===`note`){let e=[];try{e=H.readdirSync(this.notesDir).filter(e=>e.endsWith(`.md`))}catch{}return e.map(e=>[decodeURIComponent(e.slice(0,-3)),H.readFileSync(V.join(this.notesDir,e),`utf8`)])}return[]}refuse(e){throw Error(`A local server keeps no ${e} records`)}async get(e,t){if(e===`connection`)return this.connections().get(t);if(Xa.has(e))return this.derived.get(e,t);if(e===`note`)try{return H.readFileSync(this.noteFile(t),`utf8`)}catch{return}return this.entries(e).find(([e])=>e===t)?.[1]}async completeLogin(){return this.refuse(`login`)}async patchLogin(){return this.refuse(`login`)}async put(e,t,n,r={}){if(Xa.has(e))return this.derived.put(e,t,n,r);await this.serial(()=>this.write(e,t,n,r.ttlMs),Ya.has(e))}write(e,t,n,r){if(e===`connection`){this.connections().put(n);return}if(e===`credential`&&n.engine===`custom`){this.connections().putCredential(t,n);return}if(qa.has(e)){let r=this.apps();e===`installation`&&Wa(Object.entries(r.installation??{}),t,n),e===`app`&&n.shared&&(n={...n,credentials:``}),r[e]={...r[e],[t]:n},Qa(this.appsFile,`${JSON.stringify(r,null,2)}\n`)}else if(e===`delivery`||e===`snapshot`||Ja.has(e)){let i=this.deliveries(e);i[t]={value:n,...r===void 0?{}:{expiresAt:this.now()+r}},Qa(this.recordsFile(e),`${JSON.stringify(i)}\n`)}else e===`note`?Qa(this.noteFile(t),String(n)):this.refuse(e)}remove(e,t){if(e===`connection`){let e=this.connections(),n=!!e.get(t);return e.delete(t),n}if(e===`credential`){let e=this.connections(),n=e.credentials().some(e=>e.id===t);return e.deleteCredential(t),n}if(qa.has(e)){let n=this.apps(),r=n[e];return!r||!(t in r)?!1:(delete r[t],Qa(this.appsFile,`${JSON.stringify(n,null,2)}\n`),!0)}if(e===`delivery`||e===`snapshot`||Ja.has(e)){let n=this.deliveries(e);return t in n&&(delete n[t],Qa(this.recordsFile(e),`${JSON.stringify(n)}\n`),!0)}if(e===`note`){let e=this.noteFile(t),n=H.existsSync(e);return H.rmSync(e,{force:!0}),n}return!1}async putMany(e,t){for(let n of t)await this.put(e,n.id,n.value)}async list(e,t={}){if(Xa.has(e))return this.derived.list(e,t);let n=e===`installation`&&t.agent?this.apps().app:void 0;return this.entries(e).filter(([e])=>(!t.prefix||e.startsWith(t.prefix))&&(!t.after||e>t.after)).filter(([e,r])=>Va(e,r,t,n?.[r.app]?.agent)).sort(([e],[t])=>e.localeCompare(t)).slice(0,t.limit).map(([n,r])=>{let i=r;return{id:n,value:(e===`connection`&&t.secrets&&(t.secrets===`all`||i.provider===`mcp`&&i.auth===`oauth`)?this.connections().get(n):void 0)??r}})}async delete(e,t){if(Xa.has(e))return this.derived.delete(e,t);await this.serial(()=>this.remove(e,t),Ya.has(e))}async create(e,t,n,r={}){return Xa.has(e)?this.derived.create(e,t,n,r):this.serial(()=>!this.entries(e).some(([e])=>e===t)&&(this.write(e,t,n,r.ttlMs),!0),Ya.has(e))}claimDeliveryLease(e,t,n){return this.serial(()=>{if(this.deliveries()[e])return;let r=this.deliveries(`snapshot`)[`delivery:${e}`]?.value?.failures??0;return this.write(`delivery`,e,{owner:t,failures:r},n),r})}updateDeliveryLease(e,t,n,r={ttlMs:3e4}){return this.serial(()=>{if(this.deliveries()[e]?.value?.owner!==t)return!1;if(!n)this.remove(`delivery`,e),this.remove(`snapshot`,`delivery:${e}`);else{let t=n.next===void 0?n:{...n,next:this.now()+r.ttlMs};this.write(`delivery`,e,t,r.ttlMs),n.next!==void 0&&this.write(`snapshot`,`delivery:${e}`,t,864e5)}return!0})}async updateDelivery(e,t,n,r={}){return this.serial(()=>this.entries(`delivery`).find(([t])=>t===e)?.[1]?.owner===t&&(n===void 0?this.remove(`delivery`,e):this.write(`delivery`,e,n,r.ttlMs),!0))}async take(e,t){return Xa.has(e)?this.derived.take(e,t):this.serial(()=>this.remove(e,t),Ya.has(e))}};function eo(e){let t=V.resolve(e);for(;!H.existsSync(V.join(t,`.git`));){let e=V.dirname(t);if(e===t)return Promise.resolve(void 0);t=e}return new Promise(t=>nr(`git`,[`log`,`-1`,`--format=%H`,`--`,`.`],{cwd:e},(e,n)=>t(e?void 0:n.trim()||void 0)))}async function to(e,t,n,r){let a=await Ze(t,n,{includeDisabled:!0}),o=await Promise.all(a.filter(e=>!r||e.id===r).map(async t=>{let n=t.usage?{settings:t.usage}:{};if(t.builtin){let{record:r,version:i}=await sa(e,t.id);if(!r)return;let a={...r,settings:void 0,...n,local:!0};return await e.put(`agent`,t.id,a),{record:a,version:i}}if(!t.dir)return;let r=await eo(t.dir),a=H.statSync(V.join(t.dir,`agent.json`)),o=V.join(t.dir,`system.md`),s={agent:t.id,version:1,definition:t.definition,systemPrompt:H.existsSync(o)?H.readFileSync(o,`utf8`):``,files:ga(t.dir),...r?{commit:r}:{},importedFrom:`local:${t.dir}`,createdAt:a.mtimeMs},c={id:t.id,name:t.name,...t.definition.description?{description:t.definition.description}:{},source:V.resolve(t.dir)===i(`agents`,t.id)?`home`:`repo`,path:t.dir,currentVersion:1,...n,local:!0,...r?{commit:r}:{},createdAt:a.birthtimeMs||a.mtimeMs,updatedAt:a.mtimeMs};return await e.put(`agentversion`,ra(t.id,1),s),await e.put(`agent`,t.id,c),{record:c,version:s}}));if(!r){let t=new Set(a.map(e=>e.id));for(let n of await aa(e))n.local&&n.path&&!t.has(n.id)&&await e.delete(`agent`,n.id)}return o.filter(e=>!!e).sort((e,t)=>e.record.id<t.record.id?-1:+(e.record.id>t.record.id))}async function no(e,t,n,r){let a=(await Ze(e,t,{includeDisabled:!0})).find(e=>e.id===n&&!e.builtin)?.dir??i(`agents`,n),o={...r.files,"agent.json":`${JSON.stringify(r.definition,null,2)}\n`,"system.md":r.systemPrompt};for(let[e,t]of Object.entries(o))H.mkdirSync(V.dirname(V.join(a,e)),{recursive:!0}),H.writeFileSync(V.join(a,e),t)}async function ro(e,t,n){let r=(await Ze(e,t,{includeDisabled:!0})).find(e=>e.id===n&&!e.builtin);if(!r?.dir)throw Error(`No local agent named "${n}".`);return V.resolve(r.dir)===i(`agents`,n)&&(H.rmSync(r.dir,{recursive:!0}),!0)}const io=`default`;async function ao(e){if(!e.databaseUrl)throw Error(`DATABASE_URL is required for the Postgres store`);let{connect:t}=await Promise.resolve().then(()=>Hc);return t(e.databaseUrl,e.databasePool)}async function oo(e,t={}){if(e.store!==`postgres`){let e=t.local?new $a:new Ga;return{store:()=>e,queue:new oh(e),chatState:new sn(t.local?V.join(ie(``),`chat.json`):void 0),defaultOrganizationId:io,webhookTarget:async(t,n)=>{let r=await e.get(`app`,t),i=n?await e.get(`installation`,n):void 0;if(r&&n&&(!i||i.deletedAt))for(let{value:r}of await e.list(`app`,{prefix:`${t}/`})){let i=await e.get(`installation`,`${r.id}${n.slice(t.length)}`);if(i&&!i.deletedAt)return{organizationId:io,app:r,bound:{organizationId:io,installation:i}}}return r&&{organizationId:io,app:r,...i&&i.app===t&&!i.deletedAt?{bound:{organizationId:io,installation:i}}:{}}},appRecord:async t=>{let n=await e.get(`app`,t);return n&&{organizationId:io,app:n}},apps:async t=>(await e.list(`app`,{prefix:`${t}:`})).map(e=>({organizationId:io,app:e.value})),installationOrganization:async t=>await e.get(`installation`,t)?io:void 0,installations:async t=>(await e.list(`installation`,{prefix:`${t}:`})).filter(e=>!e.value.deletedAt).map(e=>({key:e.id,organizationId:io})),taskOrganization:async(t,n)=>(await e.get(`task`,t))?.tokenHash===n?io:void 0,sweep:async()=>{},close:async()=>{}}}let n=await ao(e),[{DrizzleStore:r},{DrizzleQueue:i},{UNSCOPED_ORGANIZATION:a},{PgChatState:o}]=await Promise.all([Promise.resolve().then(()=>nu),Promise.resolve().then(()=>su),Promise.resolve().then(()=>ul),import(`./chat-DLolwsuq.js`)]);return{store:t=>new r(n.db,t,Date.now,e),queue:new i(n.db),chatState:new o(n.db),defaultOrganizationId:a,webhookTarget:(e,t)=>r.webhookTarget(n.db,e,t),appRecord:e=>r.appRecord(n.db,e),apps:e=>r.apps(n.db,e),installationOrganization:e=>r.installationOrganization(n.db,e),installations:e=>r.installations(n.db,e),taskOrganization:(e,t)=>r.taskOrganization(n.db,e,t),connection:n,sweep:e=>new r(n.db,a).sweep(e),close:()=>n.close()}}async function so(e,t,n,r){if(e.updateMetadata)return e.updateMetadata(t,n,r);let i=await e.get(t,n);return i?(await e.put(t,n,{...i,...r}),!0):!1}async function co(e,t){let n=[...new Set(t)];return e.getApps?e.getApps(n):(await Promise.all(n.map(async t=>({id:t,value:await e.get(`app`,t)})))).filter(e=>!!e.value)}async function lo(e,t,n,r,i){let a=await t.store.get(`app`,n);if(!a)return D({error:`Unknown app`},404);let o=t.config.publicUrl;if(!o)return D({error:`PUBLIC_URL is not set on this server`},400);let s=await kr(t,`install`,t.session?.user.id??`anonymous`,a.id),c=jt({tx:s,...r?{back:r}:{},...i?{link:i}:{}});return D({url:`${o.replace(/\/$/,``)}/install/${a.integration}?app=${encodeURIComponent(a.id)}&state=${c}`})}async function uo(e,t){let n=e.serverOrganizationId,[r,i]=await Promise.all([e.store.list(`app`),n!==void 0&&n!==e.organizationId&&e.scope?e.scope(n).store.list(`app`).then(t=>t.filter(({value:t})=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)):[]]);return[...r,...i].filter(({value:n})=>(!n.builtin||e.integrations[n.integration]?.app.builtin===`shared`)&&(!t||n.agent===t))}function fo(e,t){let{credentials:n,...r}=t,i=t.builtin?void 0:e.integrations[t.integration]?.app.settingsUrl?.(t,A(e.config,n));return{...r,...i?{settingsUrl:i}:{}}}async function po(e,t){let n=e.config.publicUrl,r=t.filter(t=>!t.builtin&&!t.shared&&e.integrations[t.integration]?.app);if(!n||!r.length)return new Set;let[i,a]=await Promise.all([e.store.list(`delivery`,{ids:r.map(e=>Ma(e.id))}),Promise.all([...new Set(r.map(e=>e.agent))].map(t=>oa(e.store,t)))]),o=e=>i.find(t=>t.id===Ma(e))?.value;return new Set(r.filter(t=>{let r=e.integrations[t.integration].app,i=a.find(e=>e?.agent===t.agent);return i?.definition.integrations[t.integration]?r.update?!Pa(o(t.id),i.version,Na(r,t,n,i.definition)):o(t.id)?.changed===!0:!1}).map(e=>e.id))}async function mo(e,t,n,r){let i=await uo(t,r.searchParams.get(`agent`)),a=await po(t,i.map(({value:e})=>e));return D(i.map(({id:e,value:n})=>({id:e,value:{...fo(t,n),...a.has(e)?{changed:!0}:{}}})))}async function ho(e,t,n){let r=await t.store.get(`app`,n.id);if(!r)return D({error:`Unknown app`},404);if(r.builtin)return D({error:`Only whoever runs this server can remove its shared apps.`},403);let i=t.now?.()??Date.now(),a=await t.store.list(`installation`),o=new Set(a.filter(({value:e})=>e.app===r.id).map(({id:e})=>e));for(let{id:e,value:n}of a){if(o.has(e)){n.deletedAt||await so(t.store,`installation`,e,{deletedAt:i});continue}let r=Object.entries(n.connections??{}),a=r.filter(([,e])=>!o.has(e.id));a.length<r.length&&await so(t.store,`installation`,e,{connections:a.length?Object.fromEntries(a):void 0})}return await t.store.delete(`app`,r.id),await Af(t.store,r.id),D({ok:!0})}async function go(e,t){let n=await e.store.get(`app`,t);if(!n)return D({error:`Unknown app`},404);if(n.builtin||n.shared)return D({error:`Only whoever runs this server can update its shared apps.`},403);if(!e.config.publicUrl)return D({error:`PUBLIC_URL is not set on this server`},400);let r=e.integrations[n.integration];if(!r||!(r.app.update||r.app.drift||r.app.values))return D({error:`Coder cannot update ${r?.name??n.integration} apps.`},400);let i=await oa(e.store,n.agent);return i?.definition.integrations[n.integration]?{app:n,version:i,integration:r}:D({error:`The agent no longer listens on ${r.name}.`},400)}async function _o(e,t,n){let r=await go(t,n.id);if(r instanceof Response)return r;if(r.integration.app.update)return D({error:`Coder updates ${r.integration.name} apps itself.`},400);try{return D(await Fa(t,t.store,r.app,r.version))}catch(e){return console.error(`coder server: reading ${r.app.id} on ${r.integration.name} failed`,e),D({error:e instanceof Error?e.message:String(e)},502)}}async function vo(e,t,n){let r=await go(t,n.id);if(r instanceof Response)return r;let{app:i,version:a,integration:o}=r;if(o.app.values){let{lines:e}=o.app.values(i,{publicUrl:t.config.publicUrl,definition:a.definition});return await t.store.put(`delivery`,Ma(i.id),{version:a.version,manifest:e,changed:!1}),D({updated:!0})}if(!o.app.update)return D({error:`Change the app on ${o.name}; Coder cannot.`},400);let[s]=await Ia(t,[a],i.id);return s?.error?D({error:s.error},502):D({updated:!0})}async function yo(e,t,n,r){let i=r.searchParams.get(`agent`),a=await t.store.list(`installation`,{...i?{agent:i}:{},...r.searchParams.get(`active`)===`1`?{active:!0}:{},limit:O(r,200)});return D(a.map(({id:e,value:n})=>{let{token:r,connections:i,...a}=n,o=n.account.url??t.integrations[n.integration]?.app.accountUrl?.(n.account);return{id:e,value:{...a,account:{...a.account,...o?{url:o}:{}}}}}))}async function bo(e,t){let n=e.config.publicUrl,r=n?qh.has(new URL(n).hostname):!1,i=r?`https://<public address>`:n,a=t.searchParams.get(`agent`),[o,s,c]=await Promise.all([a?ia(e.store,a):void 0,qg(e),e.store.list(`app`)]),l=new Set(s.map(e=>e.integration));return D(await Promise.all(Object.values(e.integrations).map(async n=>({id:n.id,name:n.name,brand:n.brand,description:n.description,installLabel:n.installLabel??`Connect ${n.id}`,...n.use?{use:n.use}:{},...n.covered?{covered:n.covered}:{},...n.featured?{featured:!0}:{},builtinApp:n.app.builtin,...n.auth.user?{personal:!0}:{},...await xm(e,n.id,void 0,[...s,...c.map(e=>e.value)])?{connectable:!0}:{},organizationApps:n.organizationApps===!0,publicApps:n.publicApps===!0,events:Object.fromEntries(Object.entries(n.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),presets:n.tools.presets,repositories:!!n.repos,...n.app.createStep&&i?{create:n.app.createStep(i,{name:o?.name,shared:l.has(n.id),public:n.publicApps===!0&&t.searchParams.get(`public`)===`1`})}:{},...r?{unreachable:!0}:{},...n.app.update?{appUpdate:`push`}:n.app.drift?{appUpdate:`drift`}:n.app.values?{appUpdate:`confirm`}:{}}))))}async function xo(e,t,n=!1,r){let i=await e.store.get(`installation`,t.id);if(!i||i.deletedAt)return;if(!n&&i.repos!=null&&(!r||i.repos.includes(r.repo)))return i;let a=e.integrations[i.integration];if(!a?.repos)return i;let o=e.repositoryLists??=new Map,s=o.get(i.id);return s||(s=So(e,a,i,r).finally(()=>o.delete(i.id)),o.set(i.id,s)),s}async function So(e,t,n,r){let i=r?.app??await e.store.get(`app`,n.app);if(!i)throw Error(`Missing app for installation ${n.id}`);let a=r?.token??await jf(e,t,n,A(e.config,i.credentials)),o=await t.repos.list(Tf(e,n),a,e.fetch??fetch);return e.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!(!t||t.deletedAt))return JSON.stringify(t.repos)===JSON.stringify(n.repos)?(await so(e,`installation`,t.id,{repos:o}),{...t,repos:o}):{...t,repos:t.repos??o}})}async function Co(e,t=!1){let n=new Map;for(let{value:r}of await e.store.list(`installation`,{active:!0})){if(r.deletedAt||!e.integrations[r.integration]?.repos)continue;let i=t||r.repos==null?await xo(e,r,t).catch(e=>(console.error(`coder server: repositories for installation ${r.id} failed`,e),r)):r;if(!(!i||i.deletedAt))for(let e of i.repos??[])n.has(e)||n.set(e,{repo:e,integration:i.integration})}return D([...n.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}var W=class extends Error{status;fix;constructor(e,t=400,n){super(e),this.status=t,this.fix=n}};function wo(e,t,n){if(n?.settings?.disabled)throw new W(`Agent "${t}" is disabled in this workspace. Enable it in its settings to start tasks.`,409,`${e.config.publicUrl?.replace(/\/$/,``)??``}${Ig(Pg(e),`/agents/${encodeURIComponent(t)}/settings`)}`)}function To(e,t){if(t.cwd===void 0)return;if(!e.local)throw new W(`cwd is available on a local server only`);let n=Xi(t.cwd);if(!n.ok)throw new W(n.detail);return n.folder.path}const Eo=65536,Do=/^[a-z0-9][a-z0-9_-]*$/i,Oo=new Set([`claude`,`codex`,`custom`]),ko=new Set([`low`,`medium`,`high`]);function Ao(e){let t=e.flow??`default`;if(!Do.test(t))throw new W(`Invalid flow "${t}"`);if(e.prompt!==void 0&&typeof e.prompt!=`string`)throw new W(`prompt must be text`);if(t==="default"&&!e.prompt?.trim())throw new W(`prompt is required`);if((e.prompt?.length??0)>Eo)throw new W(`prompt is longer than 64 KB`);if(e.repo!==void 0&&!/^[\w.-]+\/[\w.-]+$/.test(e.repo))throw new W(`repo must be owner/name`);if(e.pr!==void 0&&(!Number.isInteger(e.pr)||e.pr<1||!e.repo))throw new W(`pr needs a repo and a pull request number`);if(e.engine!==void 0&&!Oo.has(e.engine))throw new W(`Unknown engine "${e.engine}"`);if(e.effort!==void 0&&!ko.has(e.effort))throw new W(`Unknown effort "${e.effort}"`);if(e.permissions!==void 0&&!(e.permissions in w))throw new W(`Unknown permissions "${e.permissions}"`);if(e.mcp!==void 0&&(!Array.isArray(e.mcp)||!e.mcp.every(e=>Do.test(e))))throw new W(`mcp must list server names`);if(e.connections!==void 0&&(!Array.isArray(e.connections)||!e.connections.every(e=>typeof e==`string`&&e.length>0)))throw new W(`connections must list connection ids`);if(e.outputSchema!==void 0&&(!e.outputSchema||typeof e.outputSchema!=`object`||Array.isArray(e.outputSchema)))throw new W(`outputSchema must be an object`);if(e.args!==void 0&&(typeof e.args!=`object`||Array.isArray(e.args)))throw new W(`args must be an object`)}async function jo(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos).sort((e,n)=>Number(n.value.repos?.includes(t)??!1)-Number(e.value.repos?.includes(t)??!1)),r=new Map((await co(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(a)try{let r=await jf(e,n,i,A(e.config,a.credentials)),o=i.repos?.includes(t)?i:await xo(e,i,!1,{app:a,token:r,repo:t});if(!o?.repos?.includes(t))continue;return{integration:n,installation:o,app:a,token:r}}catch(e){console.error(`coder server: repository token for ${i.id} failed`,e)}}throw new W(`No install in this workspace reaches ${t}`,404)}async function Mo(e,t,n,r){let i=n.repo,{integration:a,installation:o,app:s,token:c}=await jo(e,i),l=await a.repos.get(i,c);return{event:{integration:a.id,type:n.pr?`pull_request`:`task`,appId:s.id,installationId:o.id.slice(s.id.length+1),deliveryId:t,actor:{id:r??``},text:n.prompt??``,...n.pr?{chat:{thread:a.repos.pullRequestThread(i,n.pr)}}:{},repo:n.pr?{...l,ref:`refs/pull/${n.pr}/head`}:l},author:a.author?.(s.name)??s.name}}async function No(e,t,n){Ao(n);let r=To(e,n),i=(e.now??Date.now)(),a=e.session?.user.id,o=n.agent||et();if(!o)throw new W(`Name an agent: this server has no default agent.`);e.local&&await to(e.store,e.local.cwd,e.integrations);let s=()=>e.store.taskInputs?e.store.taskInputs(o,a,n.engine):sa(e.store,o),l=await s();await _a(e.store,i,o,l)&&(l=await s());let{record:u,version:d}=l,f=await Zt(e,{requester:a,runner:n.runner,agent:d?.definition.runner}).catch(e=>{throw new W(e.message)});if(!u||!d)throw new W(`No agent "${o}"`,404);wo(e,o,u);let p=ha(u,d,{...n.engine?{engine:n.engine}:{},...n.model?{model:n.model}:{},...n.effort?{effort:n.effort}:{},...n.permissions?{permissions:n.permissions}:{}},e.integrations),m=tt(p),h=e.store.taskInputs?l.credential:(await Mp(e.store,m.engine,a))?.id,g=m.engine??c;if(!h&&f.runner!==`http`&&!await Tp(e,m.engine))throw new W(`No ${g} credential is connected`,409,await Zp(e,g));let _=`${i.toString(36)}-${or(4).toString(`hex`)}`,v=n.repo?await Mo(e,_,n,a):void 0,y={id:_,source:t,agent:p.id,flow:n.flow??`default`,...f,permissions:m.permissions,...v?{event:v.event,author:v.author}:{},...r&&!v?{cwd:r}:{},...n.prompt?{prompt:n.prompt}:{},...n.args?{args:n.args}:{},...n.mcp?.length?{mcp:n.mcp}:{},definition:p.definition,...h?{credential:h}:{},...a?{requester:a}:{},...p.files?{files:p.files}:{},...p.usage?{usage:p.usage}:{},tools:{},connections:await Yi(e,a,E(p.usage?.connections,n.connections)),...e.session||n.outputSchema?{context:{...e.session?{user:{name:e.session.user.name,email:e.session.user.email}}:{},...n.outputSchema?{outputSchema:n.outputSchema}:{}}}:{}};return e.local&&f.runner===`local`&&!f.runnerId?op(e,y):(await e.queue.enqueue(e.organizationId,y,i,void 0,e.config.maxQueued??1e3),{task:y,status:`queued`,attempts:0,createdAt:i,updatedAt:i})}function Po(e){return e.turns?e.turns:[...e.task.context?.turns??[],{prompt:e.task.prompt??e.task.event?.text??e.task.name??``,result:e.result,error:e.error,finishedAt:e.finishedAt,...[`completed`,`failed`,`cancelled`].includes(e.status)?{logSeq:e.logSeq}:{}}]}async function Fo(e,t,n,r,i={}){if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))throw new W(`outputSchema must be an object`);if(!n.trim())throw new W(`text is required`);if(n.length>Eo)throw new W(`text is longer than 64 KB`);let{model:a,effort:o,permissions:s}=i;if(a!==void 0&&(typeof a!=`string`||!a.trim()))throw new W(`model must be text`);if(o!==void 0&&!ko.has(o))throw new W(`Unknown effort "${o}"`);if(s!==void 0&&!(s in w))throw new W(`Unknown permissions "${s}"`);let c=e=>Object.keys(w).indexOf(e??`auto`);if(s!==void 0&&c(s)>c(t.task.permissions))throw new W(`permissions can only be lowered on a resumed task (it runs ${t.task.permissions??`auto`})`);if(e.session&&t.task.requester&&t.task.requester!==e.session.user.id)throw new W(`Only the member who asked can continue this task`,403);let l=(e.now??Date.now)(),u=t.task.context?.messages??[],d=String(t.finishedAt??l),f=[...u,{user:`user`,text:t.task.prompt??t.task.event?.text??``,ts:String(t.createdAt)},{user:`agent`,text:t.result?.output??t.error??``,ts:d}].slice(-20),{note:p,...m}=t.task.context??{},h=Po(t);h.at(-1).finishedAt??=l;let g={task:{...t.task,prompt:n,...a||o?{usage:{...t.task.usage,...a?{model:a}:{},...o?{effort:o}:{}}}:{},...s?{permissions:s}:{},context:{...m,...r?{outputSchema:r}:{},messages:f,turns:h}},status:`queued`,attempts:0,generation:(t.generation??0)+1,...t.logSeq===void 0?{}:{logSeq:t.logSeq},...t.logBytes===void 0?{}:{logBytes:t.logBytes},createdAt:t.createdAt,updatedAt:l};if(!await e.queue.continueTask(e.organizationId,t.task.id,g.task,l,{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0}))throw new W(`Task is already active`,409);return g}const Io={principalPerMinute:300,ipPerMinute:60,authPerMinute:20,registerPerMinute:10,pairingPerMinute:5,concurrentTasks:10};var Lo=class{buckets=new Map;sweptAt;startedAt;requests=0;rejections=0;constructor(e=Date.now()){this.startedAt=this.sweptAt=e}consume(e,t,n){if(n-this.sweptAt>=6e4){for(let[e,t]of this.buckets)n-t.at>=6e4&&this.buckets.delete(e);this.sweptAt=n}let r=this.buckets.get(e),i=r?Math.min(t,r.tokens+Math.max(0,n-r.at)*t/6e4):t,a=i<1;if(this.buckets.set(e,{tokens:a?i:i-1,at:n}),!a)return;this.rejections++;let o=Math.max(1,Math.ceil((1-i)*60/t));return D({error:`Too many requests. Try again in ${o} seconds.`},429,{"retry-after":String(o)})}};const Ro=[[e=>e===`/admin/runners/pair`,`pairing`],[e=>e===`/runners/register`,`register`],[e=>e.startsWith(`/admin/`)||e.startsWith(`/runners/`)],[e=>e.startsWith(`/api/auth`)||e===`/login`||e===`/dash/token`,`auth`]];async function zo(e,t,n){let r=new URL(e.url).pathname,i=Ro.find(([e])=>e(r));if(!i)return(r===`/dash`||r.startsWith(`/dash/`))&&t.auth&&!await t.auth.session(e.headers)?Bo(t,void 0,n,`auth`)??{}:{};let a=r.startsWith(`/admin/`)?await ng(e,t):void 0;return Bo(t,r===`/runners/register`?await ig(e,t):a&&!(a instanceof Response)?a.session?`user:${a.session.user.id}`:`admin`:void 0,n,i[1])??{scope:a}}function Bo(e,t,n,r){let i=e.limits??=new Lo((e.now??Date.now)()),a={...Io,...e.config.limits},o=(e.now??Date.now)(),s=t??`ip:${n}`,c=i.consume(s,t?a.principalPerMinute:a.ipPerMinute,o);return c||!r?c:r===`pairing`?i.consume(`pair:${s}`,a.pairingPerMinute,o):i.consume(`${r}:ip:${n}`,r===`auth`?a.authPerMinute:a.registerPerMinute,o)}function Vo(e,t,n){let r;return Promise.race([e,new Promise((e,i)=>{r=setTimeout(()=>i(Error(`${n} timed out`)),t),r.unref?.()})]).finally(()=>clearTimeout(r))}async function Ho(e,t,n,r){try{await Vo(t.stop(n),e.runnerTimeoutMs??1e4,`runner stop`)}catch(e){return console.error(`coder server: runner stop ${r} failed`,e),!1}return!0}async function Uo(e,t,n,r={}){let i=t.handle?await Qt(e,t.task):void 0,a=await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash??null,generation:t.generation??0,...r});return a&&await Ko(e,t,!0,i),a}async function Wo(e,t,n){if(e.local&&t.handle?.startsWith(`cli:`))return np(e,t,n);let r=t.handle?await Qt(e,t.task):void 0,i={handle:t.handle??null,lastSeenAt:t.lastSeenAt??null,updatedAt:t.updatedAt};if(t.cancelRequestedAt!==void 0&&n-t.cancelRequestedAt>=3e4){let i=await e.queue.finish(e.organizationId,t.task.id,{status:`cancelled`,error:`The runner did not acknowledge cancellation within 30 seconds`},n,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0});return i&&await Ko(e,t,!0,r),i}if(!t.handle)return n-(t.lastSeenAt??t.startedAt??t.updatedAt)<(e.config.taskStallMs??3e5)?!1:t.attempts>=(e.config.taskAttempts??2)?Uo(e,t,`runner start was interrupted`,i):e.queue.requeue(e.organizationId,t.task.id,n,{generation:t.generation??0,attempts:t.attempts,tokenHash:t.tokenHash??null,...i});if(t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)return Uo(e,t,`timeout`);if(!r||n-(t.lastSeenAt??t.startedAt??t.updatedAt)<Math.min(e.config.taskStallMs??6e4,6e4)||!await e.store.withAppLock(`runner-status:${e.organizationId}:${t.task.id}`,async e=>{let r=`runner-status:${t.task.id}:${t.generation??0}:${t.attempts}`,i=await e.get(`delivery`,r);return i&&`at`in i&&i.at!==void 0&&n-i.at<3e4?!1:(await e.put(`delivery`,r,{at:n},{ttlMs:6e4}),!0)}))return!1;let a=await Vo(r.status(t.handle),e.runnerTimeoutMs??1e4,`runner status`);return a.state===`exited`?Uo(e,t,`runner exited${a.code===void 0?``:` with code ${a.code}`}`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null}):Uo(e,t,`The runner stopped reporting heartbeats`,{handle:t.handle,lastSeenAt:t.lastSeenAt??null})}async function Go(e,t){return[`running`,`waiting`].includes(t.status)&&await Wo(e,t,(e.now??Date.now)()).catch(()=>!1)?await e.store.get(`task`,t.task.id)??t:t}async function Ko(e,t,n=!1,r){let i=`${e.organizationId}:${t.task.id}:${t.attempts}`,a=e.settings?.cancelChecks?.get(i);if(a&&(clearTimeout(a.timer),a.finish(),e.settings.cancelChecks.delete(i)),!t.handle||t.logsComplete)return;let o=r??await Qt(e,t.task);o&&(n||o.kind===`vercel-sandbox`||o.kind===`local-docker`)&&!await Ho(e,o,t.handle,t.task.id)||await e.queue.patchTask(e.organizationId,t.task.id,{logsComplete:!0},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,handle:t.handle})}function qo(e,t){let n=`${e.organizationId}:${t.task.id}:${t.attempts}`,r=(e.settings??={}).cancelChecks??=new Map;if(r.has(n))return;let i=new Promise(e=>{let t=setTimeout(e,3e4);r.set(n,{timer:t,finish:e})}).then(async()=>{r.delete(n);let i=await e.store.get(`task`,t.task.id);i&&i.attempts===t.attempts&&i.tokenHash===t.tokenHash&&await Go(e,i)}).catch(e=>console.error(`coder server: cancellation check failed`,e));e.waitUntil&&e.waitUntil(i)}async function Jo(e,t,n){let r=e.now??Date.now,i=e.config.limits?.concurrentTasks??Io.concurrentTasks,a=e.config.store===`postgres`?e.config.maxTasks:Math.min(i,e.config.maxTasks??i);{t&&e.local?await Qf(e,e.local.cwd):t&&await e.queue.archiveStopped(void 0,r());let n=await e.queue.running(),i=0;for(let t of n)await Wo(U(e,t.organizationId),t.status,r()).catch(()=>!1)&&i++;if(a!==void 0&&n.length-i>=a)return}let o=[];for(;;){let t=e.local?Zf(e.local.cwd,!1).filter(e=>e.status===`running`||e.status===`waiting`):[],s=t.length?new Set((await e.queue.running()).flatMap(e=>[e.status.task.id,...e.status.handle?.startsWith(`cli:`)?[e.status.handle.slice(4)]:[]])):new Set,c=t.filter(t=>!s.has(t.task.id)&&!s.has(ge(t.task.cwd??e.local.cwd,t.task.id)?.flowRunId??``)).length,l=a===void 0?void 0:a-c;if(l!==void 0&&l<=0)break;let u=await e.queue.claim(r(),l,n,i);if(n=!1,!u)break;let d=U(e,u.organizationId),f=u.status;if(await tp(d,f)){if(n=u.more,!u.more)break;continue}let p=await Qt(d,f.task);if(!p){await Uo(d,f,`No runner available: ${f.task.runner}`);continue}let m=f,h={generation:f.generation??0,attempts:f.attempts,tokenHash:f.tokenHash??null,statuses:[`running`,`waiting`]},g;try{let e=p.kind===`vercel-sandbox`?await Vf(d,f.task):void 0,t=p.start(f.task,{CODER_SERVER:d.local&&p.kind===`local`?`http://localhost:${d.local.port}`:d.config.publicUrl??``,CODER_TASK_TOKEN:u.token,CODER_INBOX_MODE:p.push?`push`:`poll`},e?.env,{timeoutMs:d.config.taskTimeoutMs+6e4,waitUntil:d.waitUntil,...e?{hosts:await Uf(d,f.task,e)}:{}});if(g=await Vo(t,d.runnerTimeoutMs??3e4,`runner start`).catch(e=>{throw t.then(e=>Ho(d,p,e,f.task.id),()=>{}),e}),await d.queue.patchTask(u.organizationId,f.task.id,{handle:g},r(),h)||await Ho(d,p,g,f.task.id),n=u.more,!u.more)break}catch(e){g!==void 0&&await Ho(d,p,g,f.task.id);let t=e instanceof Error?e.message:String(e);if(f.attempts<(d.config.taskAttempts??2)){o.push({...u,status:m});continue}await Uo(d,m,t)}}for(let t of o)await U(e,t.organizationId).queue.requeue(t.organizationId,t.status.task.id,r(),{attempts:t.status.attempts,tokenHash:t.status.tokenHash})}function Yo(e,t=!1,n=!1,r=!1){let i=e.queue.scheduler??={},a=t?i.waiting:void 0;if(a)return a;let o=i.running??Promise.resolve(),s=()=>(i.waiting===c&&delete i.waiting,Jo(e,n,r)),c=o.then(s,s);return i.waiting=c,i.running=c.catch(()=>{}),c}function Xo(e,t=!1){let n=Yo(e,!0,!1,t).catch(()=>{});e.waitUntil&&e.waitUntil(n)}const Zo=new Map,Qo=new Map,$o=Symbol(`OriginError`),es={};var ts=class extends Promise{constructor(e,t,n,r,i={}){let a,o;super((e,t)=>{a=e,o=t}),this.tagged=Array.isArray(e.raw),this.strings=e,this.args=t,this.handler=n,this.canceller=r,this.options=i,this.state=null,this.statement=null,this.resolve=e=>(this.active=!1,a(e)),this.reject=e=>(this.active=!1,o(e)),this.active=!1,this.cancelled=null,this.executed=!1,this.signature=``,this[$o]=this.handler.debug?Error():this.tagged&&ns(this.strings)}get origin(){return(this.handler.debug?this[$o].stack:this.tagged&&Qo.has(this.strings)?Qo.get(this.strings):Qo.set(this.strings,this[$o].stack).get(this.strings))||``}static get[Symbol.species](){return Promise}cancel(){return this.canceller&&=(this.canceller(this),null)}simple(){return this.options.simple=!0,this.options.prepare=!1,this}async readable(){return this.simple(),this.streaming=!0,this}async writable(){return this.simple(),this.streaming=!0,this}cursor(e=1,t){if(this.options.simple=!1,typeof e==`function`&&(t=e,e=1),this.cursorRows=e,typeof t==`function`)return this.cursorFn=t,this;let n;return{[Symbol.asyncIterator]:()=>({next:()=>{if(this.executed&&!this.active)return{done:!0};n&&n();let e=new Promise((e,t)=>{this.cursorFn=t=>(e({value:t,done:!1}),new Promise(e=>n=e)),this.resolve=()=>(this.active=!1,e({done:!0})),this.reject=e=>(this.active=!1,t(e))});return this.execute(),e},return(){return n&&n(es),{done:!0}}})}}describe(){return this.options.simple=!1,this.onlyDescribe=this.options.prepare=!0,this}stream(){throw Error(`.stream has been renamed to .forEach`)}forEach(e){return this.forEachFn=e,this.handle(),this}raw(){return this.isRaw=!0,this}values(){return this.isRaw=`values`,this}async handle(){!this.executed&&(this.executed=!0)&&await 1&&this.handler(this)}execute(){return this.handle(),this}then(){return this.handle(),super.then.apply(this,arguments)}catch(){return this.handle(),super.catch.apply(this,arguments)}finally(){return this.handle(),super.finally.apply(this,arguments)}};function ns(e){if(Zo.has(e))return Zo.get(e);let t=Error.stackTraceLimit;return Error.stackTraceLimit=4,Zo.set(e,Error()),Error.stackTraceLimit=t,Zo.get(e)}var rs=class extends Error{constructor(e){super(e.message),this.name=this.constructor.name,Object.assign(this,e)}};const G={connection:is,postgres:as,generic:os,notSupported:ss};function is(e,t,n){let{host:r,port:i}=n||t,a=Object.assign(Error(`write `+e+` `+(t.path||r+`:`+i)),{code:e,errno:e,address:t.path||r},t.path?{}:{port:i});return Error.captureStackTrace(a,is),a}function as(e){let t=new rs(e);return Error.captureStackTrace(t,as),t}function os(e,t){let n=Object.assign(Error(e+`: `+t),{code:e});return Error.captureStackTrace(n,os),n}function ss(e){let t=Object.assign(Error(e+` (B) is not supported`),{code:`MESSAGE_NOT_SUPPORTED`,name:e});return Error.captureStackTrace(t,ss),t}const cs={string:{to:25,from:null,serialize:e=>``+e},number:{to:0,from:[21,23,26,700,701],serialize:e=>``+e,parse:e=>+e},json:{to:114,from:[114,3802],serialize:e=>JSON.stringify(e),parse:e=>JSON.parse(e)},boolean:{to:16,from:16,serialize:e=>e===!0?`t`:`f`,parse:e=>e===`t`},date:{to:1184,from:[1082,1114,1184],serialize:e=>(e instanceof Date?e:new Date(e)).toISOString(),parse:e=>new Date(e)},bytea:{to:17,from:17,serialize:e=>`\\x`+Buffer.from(e).toString(`hex`),parse:e=>Buffer.from(e.slice(2),`hex`)}};var ls=class{then(){Ss()}catch(){Ss()}finally(){Ss()}},us=class extends ls{constructor(e){super(),this.value=ks(e)}},ds=class extends ls{constructor(e,t,n){super(),this.value=e,this.type=t,this.array=n}},fs=class extends ls{constructor(e,t){super(),this.first=e,this.rest=t}build(e,t,n,r){let i=xs.map(([t,n])=>({fn:n,i:e.search(t)})).sort((e,t)=>e.i-t.i).pop();return i.i===-1?Os(this.first,r):i.fn(this.first,this.rest,t,n,r)}};function ps(e,t,n,r){let i=e instanceof ds?e.value:e;if(i===void 0&&(e instanceof ds?e.value=r.transform.undefined:i=e=r.transform.undefined,i===void 0))throw G.generic(`UNDEFINED_VALUE`,`Undefined values are not allowed`);return`$`+n.push(e instanceof ds?(t.push(e.value),e.array?e.array[e.type||As(e.value)]||e.type||Ts(e.value):e.type):(t.push(e),As(e)))}const ms=Ds(cs);function hs(e,t,n,r,i,a){for(let o=1;o<e.strings.length;o++)t+=gs(t,n,r,i,a)+e.strings[o],n=e.args[o];return t}function gs(e,t,n,r,i){return t instanceof fs?t.build(e,n,r,i):t instanceof ts?_s(t,n,r,i):t instanceof us?t.value:t&&t[0]instanceof ts?t.reduce((e,t)=>e+` `+_s(t,n,r,i),``):ps(t,n,r,i)}function _s(e,t,n,r){return e.fragment=!0,hs(e,e.strings[0],e.args[0],t,n,r)}function vs(e,t,n,r,i){return e.map(e=>`(`+r.map(r=>gs(`values`,e[r],t,n,i)).join(`,`)+`)`).join(`,`)}function ys(e,t,n,r,i){let a=Array.isArray(e[0]),o=t.length?t.flat():Object.keys(a?e[0]:e);return vs(a?e:[e],n,r,o,i)}function bs(e,t,n,r,i){if(typeof e==`string`&&(e=[e].concat(t)),Array.isArray(e))return Os(e,i);let a;return(t.length?t.flat():Object.keys(e)).map(t=>(a=e[t],(a instanceof ts?_s(a,n,r,i):a instanceof us?a.value:ps(a,n,r,i))+` as `+ks(i.transform.column.to?i.transform.column.to(t):t))).join(`,`)}const xs=Object.entries({values:ys,in:(...e)=>{let t=ys(...e);return t===`()`?`(null)`:t},select:bs,as:bs,returning:bs,"\\(":bs,update(e,t,n,r,i){return(t.length?t.flat():Object.keys(e)).map(t=>ks(i.transform.column.to?i.transform.column.to(t):t)+`=`+gs(`values`,e[t],n,r,i))},insert(e,t,n,r,i){let a=t.length?t.flat():Object.keys(Array.isArray(e)?e[0]:e);return`(`+Os(a,i)+`)values`+vs(Array.isArray(e)?e:[e],n,r,a,i)}}).map(([e,t])=>[RegExp(`((?:^|[\\s(])`+e+`(?:$|[\\s(]))(?![\\s\\S]*\\1)`,`i`),t]);function Ss(){throw G.generic(`NOT_TAGGED_CALL`,`Query not called as a tagged template literal`)}const Cs=ms.serializers,ws=ms.parsers;function Ts(e){return Array.isArray(e)?Ts(e[0]):typeof e==`string`?1009:0}const Es=function(e){let t=Ds(e||{});return{serializers:Object.assign({},Cs,t.serializers),parsers:Object.assign({},ws,t.parsers)}};function Ds(e){return Object.keys(e).reduce((t,n)=>(e[n].from&&[].concat(e[n].from).forEach(r=>t.parsers[r]=e[n].parse),e[n].serialize&&(t.serializers[e[n].to]=e[n].serialize,e[n].from&&[].concat(e[n].from).forEach(r=>t.serializers[r]=e[n].serialize)),t),{parsers:{},serializers:{}})}function Os(e,{transform:{column:t}}){return e.map(e=>ks(t.to?t.to(e):e)).join(`,`)}const ks=function(e){return`"`+e.replace(/"/g,`""`).replace(/\./g,`"."`)+`"`},As=function e(t){return t instanceof ds?t.type:t instanceof Date?1184:t instanceof Uint8Array?17:t===!0||t===!1?16:typeof t==`bigint`?20:Array.isArray(t)?e(t[0]):0},js=/\\/g,Ms=/"/g;function Ns(e){return e.replace(js,`\\\\`).replace(Ms,`\\"`)}const Ps=function e(t,n,r,i){if(Array.isArray(t)===!1)return t;if(!t.length)return`{}`;let a=t[0],o=i===1020?`;`:`,`;return Array.isArray(a)&&!a.type?`{`+t.map(t=>e(t,n,r,i)).join(o)+`}`:`{`+t.map(e=>{if(e===void 0&&(e=r.transform.undefined,e===void 0))throw G.generic(`UNDEFINED_VALUE`,`Undefined values are not allowed`);return e===null?`null`:`"`+Ns(n?n(e.type?e.value:e):``+e)+`"`}).join(o)+`}`},Fs={i:0,char:null,str:``,quoted:!1,last:0},Is=function(e,t,n){return Fs.i=Fs.last=0,Ls(Fs,e,t,n)};function Ls(e,t,n,r){let i=[],a=r===1020?`;`:`,`;for(;e.i<t.length;e.i++){if(e.char=t[e.i],e.quoted)e.char===`\\`?e.str+=t[++e.i]:e.char===`"`?(i.push(n?n(e.str):e.str),e.str=``,e.quoted=t[e.i+1]===`"`,e.last=e.i+2):e.str+=e.char;else if(e.char===`"`)e.quoted=!0;else if(e.char===`{`)e.last=++e.i,i.push(Ls(e,t,n,r));else if(e.char===`}`){e.quoted=!1,e.last<e.i&&i.push(n?n(t.slice(e.last,e.i)):t.slice(e.last,e.i)),e.last=e.i+1;break}else e.char===a&&e.p!==`}`&&e.p!==`"`&&(i.push(n?n(t.slice(e.last,e.i)):t.slice(e.last,e.i)),e.last=e.i+1);e.p=e.char}return e.last<e.i&&i.push(n?n(t.slice(e.last,e.i+1)):t.slice(e.last,e.i+1)),i}const Rs=e=>{let t=e[0];for(let n=1;n<e.length;n++)t+=e[n]===`_`?e[++n].toUpperCase():e[n];return t},zs=e=>{let t=e[0].toUpperCase();for(let n=1;n<e.length;n++)t+=e[n]===`_`?e[++n].toUpperCase():e[n];return t},Bs=e=>e.replace(/_/g,`-`),Vs=e=>e.replace(/([A-Z])/g,`_$1`).toLowerCase(),Hs=e=>(e.slice(0,1)+e.slice(1).replace(/([A-Z])/g,`_$1`)).toLowerCase(),Us=e=>e.replace(/-/g,`_`);function Ws(e){return function t(n,r){return typeof n==`object`&&n&&(r.type===114||r.type===3802)?Array.isArray(n)?n.map(e=>t(e,r)):Object.entries(n).reduce((n,[i,a])=>Object.assign(n,{[e(i)]:t(a,r)}),{}):n}}Rs.column={from:Rs},Rs.value={from:Ws(Rs)},Vs.column={to:Vs};const Gs={...Rs};Gs.column.to=Vs,zs.column={from:zs},zs.value={from:Ws(zs)},Hs.column={to:Hs};const Ks={...zs};Ks.column.to=Hs,Bs.column={from:Bs},Bs.value={from:Ws(Bs)},Us.column={to:Us};const qs={...Bs};qs.column.to=Us;var Js=class extends Array{constructor(){super(),Object.defineProperties(this,{count:{value:null,writable:!0},state:{value:null,writable:!0},command:{value:null,writable:!0},columns:{value:null,writable:!0},statement:{value:null,writable:!0}})}static get[Symbol.species](){return Array}},Ys=Xs;function Xs(e=[]){let t=e.slice(),n=0;return{get length(){return t.length-n},remove:e=>{let n=t.indexOf(e);return n===-1?null:(t.splice(n,1),e)},push:e=>(t.push(e),e),shift:()=>{let e=t[n++];return n===t.length?(n=0,t=[]):t[n-1]=void 0,e}}}let Zs=Buffer.allocUnsafe(256);const Qs=`BCcDdEFfHPpQSX`.split(``).reduce((e,t)=>{let n=t.charCodeAt(0);return e[t]=()=>(Zs[0]=n,K.i=5,K),e},{}),K=Object.assign(ec,Qs,{N:`\0`,i:0,inc(e){return K.i+=e,K},str(e){let t=Buffer.byteLength(e);return $s(t),K.i+=Zs.write(e,K.i,t,`utf8`),K},i16(e){return $s(2),Zs.writeUInt16BE(e,K.i),K.i+=2,K},i32(e,t){return t||t===0?(Zs.writeUInt32BE(e,t),K):($s(4),Zs.writeUInt32BE(e,K.i),K.i+=4,K)},z(e){return $s(e),Zs.fill(0,K.i,K.i+e),K.i+=e,K},raw(e){return Zs=Buffer.concat([Zs.subarray(0,K.i),e]),K.i=Zs.length,K},end(e=1){Zs.writeUInt32BE(K.i-e,e);let t=Zs.subarray(0,K.i);return K.i=0,Zs=Buffer.allocUnsafe(256),t}});function $s(e){if(Zs.length-K.i<e){let t=Zs,n=t.length;Zs=Buffer.allocUnsafe(n+(n>>1)+e),t.copy(Zs)}}function ec(){return K.i=0,K}var tc=dc;let nc=1;const rc=K().S().end(),ic=K().H().end(),ac=K().i32(8).i32(80877103).end(8),oc=Buffer.concat([K().E().str(K.N).i32(0).end(),rc]),sc=K().D().str(`S`).str(K.N).end(),cc=()=>{},lc=new Set([`FetchPreparedStatement`,`RevalidateCachedQuery`,`transformAssignedExpr`]),uc={83:`severity_local`,86:`severity`,67:`code`,77:`message`,68:`detail`,72:`hint`,80:`position`,112:`internal_position`,113:`internal_query`,87:`where`,115:`schema_name`,116:`table_name`,99:`column_name`,100:`data type_name`,110:`constraint_name`,70:`file`,76:`line`,82:`routine`};function dc(e,t={},{onopen:n=cc,onend:r=cc,onclose:i=cc}={}){let{sslnegotiation:a,ssl:o,max:s,user:c,host:l,port:u,database:d,parsers:f,transform:p,onnotice:m,onnotify:h,onparameter:g,max_pipeline:_,keep_alive:v,backoff:y,target_session_attrs:b}=e,x=Ys(),ee=nc++,te={pid:null,secret:null},ne=_c(Ze,e.idle_timeout),re=_c(Ze,e.max_lifetime),ie=_c(Ve,e.connect_timeout),S=null,ae,oe=null,C=new Js,se=Buffer.alloc(0),ce=e.fetch_types,le={},ue={},de=Math.random().toString(36).slice(2),fe=1,pe=0,me=0,he=0,ge=0,_e=0,ve=0,ye=0,be=null,xe=null,Se=!1,Ce=null,we=null,Te=null,Ee=null,w=null,De=null,Oe=null,ke=null,T=null,Ae=null,E={queue:t.closed,idleTimer:ne,connect(e){Te=e,Ke()},terminate:Qe,execute:Ne,cancel:Me,end:Ze,count:0,id:ee};return t.closed&&t.closed.push(E),E;async function je(){let t;try{t=e.socket?await Promise.resolve(e.socket(e)):new xr.Socket}catch(e){Je(e);return}return t.on(`error`,Je),t.on(`close`,$e),t.on(`drain`,Ue),t}async function Me({pid:e,secret:t},n,r){try{ae=K().i32(16).i32(80877102).i32(e).i32(t).end(16),await Ge(),S.once(`error`,r),S.once(`close`,n)}catch(e){r(e)}}function Ne(t){if(Se)return Xe(t,G.connection(`CONNECTION_DESTROYED`,e));if(w)return Xe(t,G.generic(`COPY_IN_PROGRESS`,`You cannot execute queries during copy`));if(!t.cancelled)try{return t.state=te,T?x.push(t):(T=t,T.active=!0),Re(t),ze(Pe(t))&&!t.describeFirst&&!t.cursorFn&&x.length<_&&(!t.options.onexecute||t.options.onexecute(E))}catch(e){return x.length===0&&ze(rc),Ye(e),!0}}function Pe(e){if(e.parameters.length>=65534)throw G.generic(`MAX_PARAMETERS_EXCEEDED`,`Max number of parameters (65534) exceeded`);return e.options.simple?K().Q().str(e.statement.string+K.N).end():e.describeFirst?Buffer.concat([Fe(e),ic]):e.prepare?e.prepared?Ie(e):Buffer.concat([Fe(e),Ie(e)]):Le(e)}function Fe(e){return Buffer.concat([Lt(e.statement.string,e.parameters,e.statement.types,e.statement.name),Rt(`S`,e.statement.name)])}function Ie(e){return Buffer.concat([It(e.parameters,e.statement.types,e.statement.name,e.cursorName),e.cursorFn?zt(``,e.cursorRows):oc])}function Le(e){return Buffer.concat([Lt(e.statement.string,e.parameters,e.statement.types),sc,Ie(e)])}function Re(t){let n=[],r=[],i=hs(t,t.strings[0],t.args[0],n,r,e);!t.tagged&&t.args.forEach(t=>ps(t,n,r,e)),t.prepare=e.prepare&&(`prepare`in t.options?t.options.prepare:!0),t.string=i,t.signature=t.prepare&&r+i,t.onlyDescribe&&delete ue[t.signature],t.parameters=t.parameters||n,t.prepared=t.prepare&&t.signature in ue,t.describeFirst=t.onlyDescribe||n.length&&!t.prepared,t.statement=t.prepared?ue[t.signature]:{string:i,types:r,name:t.prepare?de+fe++:``},typeof e.debug==`function`&&e.debug(ee,i,n,r)}function ze(e,t){return De=De?Buffer.concat([De,e]):Buffer.from(e),t||De.length>=1024?Be(t):(xe===null&&(xe=setImmediate(Be)),!0)}function Be(e){let t=S.write(De,e);return xe!==null&&clearImmediate(xe),De=xe=null,t}function Ve(){Ye(G.connection(`CONNECT_TIMEOUT`,e,S)),S.destroy()}async function He(){if(a!==`direct`&&(ze(ac),!await new Promise(e=>S.once(`data`,t=>e(t[0]===83)))&&o===`prefer`))return qe();let e={socket:S,servername:xr.isIP(S.host)?void 0:S.host};a===`direct`&&(e.ALPNProtocols=[`postgresql`]),o===`require`||o===`allow`||o===`prefer`?e.rejectUnauthorized=!1:typeof o==`object`&&Object.assign(e,o),S.removeAllListeners(),S=Sr.connect(e),S.on(`secureConnect`,qe),S.on(`error`,Je),S.on(`close`,$e),S.on(`drain`,Ue)}function Ue(){!T&&n(E)}function We(e){if(!(Ce&&(Ce.push(e),me-=e.length,me>0)))for(se=Ce?Buffer.concat(Ce,_e-me):se.length===0?e:Buffer.concat([se,e],se.length+e.length);se.length>4;){if(_e=se.readUInt32BE(1),_e>=se.length){me=_e-se.length,Ce=[se];break}try{et(se.subarray(0,_e+1))}catch(e){T&&(T.cursorFn||T.describeFirst)&&ze(rc),Ye(e)}se=se.subarray(_e+1),me=0,Ce=null}}async function Ge(){if(Se=!1,le={},S||=await je(),S){if(ie.start(),e.socket)return o?He():qe();if(S.on(`connect`,o?He:qe),e.path)return S.connect(e.path);S.ssl=o,S.connect(u[he],l[he]),S.host=l[he],S.port=u[he],he=(he+1)%u.length}}function Ke(){setTimeout(Ge,pe?Math.max(0,pe+ve-Tr.now()):0)}function qe(){try{ue={},ce=e.fetch_types,de=Math.random().toString(36).slice(2),fe=1,re.start(),S.on(`data`,We),v&&S.setKeepAlive&&S.setKeepAlive(!0,1e3*v),ze(Vt())}catch(e){Je(e)}}function Je(n){if(!(E.queue===t.connecting&&e.host[ge+1]))for(Ye(n);x.length;)Xe(x.shift(),n)}function Ye(e){w&&=(w.destroy(e),null),T&&Xe(T,e),Te&&=(Xe(Te,e),null)}function Xe(t,n){if(t.reserve)return t.reject(n);(!n||typeof n!=`object`)&&(n=Error(n)),`query`in n||`parameters`in n||Object.defineProperties(n,{stack:{value:n.stack+t.origin.replace(/.*\n/,`
+`),enumerable:e.debug},query:{value:t.string,enumerable:e.debug},parameters:{value:t.parameters,enumerable:e.debug},args:{value:t.args,enumerable:e.debug},types:{value:t.statement&&t.statement.types,enumerable:e.debug}}),t.reject(n)}function Ze(){return Ee||(!E.reserved&&r(E),!E.reserved&&!Te&&!T&&x.length===0?(Qe(),new Promise(e=>S&&S.readyState!==`closed`?S.once(`close`,e):e())):Ee=new Promise(e=>Oe=e))}function Qe(){Se=!0,(w||T||Te||x.length)&&Je(G.connection(`CONNECTION_DESTROYED`,e)),clearImmediate(xe),S&&(S.removeListener(`data`,We),S.removeListener(`connect`,qe),S.readyState===`open`&&S.end(K().X().end())),Oe&&(Oe(),Ee=Oe=null)}async function $e(t){if(se=Buffer.alloc(0),me=0,Ce=null,clearImmediate(xe),S.removeListener(`data`,We),S.removeListener(`connect`,qe),ne.cancel(),re.cancel(),ie.cancel(),S.removeAllListeners(),S=null,Te)return Ke();!t&&(T||x.length)&&Je(G.connection(`CONNECTION_CLOSED`,e,S)),pe=Tr.now(),t&&e.shared.retries++,ve=(typeof y==`function`?y(e.shared.retries):y)*1e3,i(E,G.connection(`CONNECTION_CLOSED`,e,S))}function et(e,t=e[0]){(t===68?tt:t===100?At:t===65?wt:t===83?nt:t===90?rt:t===67?it:t===50?ot:t===49?at:t===116?st:t===84?ct:t===82?lt:t===110?gt:t===75?_t:t===69?St:t===115?Tt:t===51?Et:t===71?Dt:t===78?Mt:t===72?Ot:t===99?jt:t===73?D:t===86?Nt:t===118?O:t===87?kt:Pt)(e)}function tt(e){let t=7,n,r,i,a=T.isRaw?Array(T.statement.columns.length):{};for(let o=0;o<T.statement.columns.length;o++)r=T.statement.columns[o],n=e.readInt32BE(t),t+=4,i=n===-1?null:T.isRaw===!0?e.subarray(t,t+=n):r.parser===void 0?e.toString(`utf8`,t,t+=n):r.parser.array===!0?r.parser(e.toString(`utf8`,t+1,t+=n)):r.parser(e.toString(`utf8`,t,t+=n)),T.isRaw?a[o]=T.isRaw===!0?i:p.value.from?p.value.from(i,r):i:a[r.name]=p.value.from?p.value.from(i,r):i;T.forEachFn?T.forEachFn(p.row.from?p.row.from(a):a,C):C[ye++]=p.row.from?p.row.from(a):a}function nt(t){let[n,r]=t.toString(`utf8`,5,t.length-1).split(K.N);le[n]=r,e.parameters[n]!==r&&(e.parameters[n]=r,g&&g(n,r))}function rt(t){if(T?oe?T.retried?Ye(T.retried):T.prepared&&lc.has(oe.routine)?Ct(T,oe):Ye(oe):T.resolve(we||C):oe&&Ye(oe),T=we=oe=null,C=new Js,ie.cancel(),Te){if(b){if(!le.in_hot_standby||!le.default_transaction_read_only)return xt();if(bt(b,le))return Qe()}if(ce)return Te.reserve&&(Te=null),vt();Te&&!Te.reserve&&Ne(Te),e.shared.retries=ge=0,Te=null;return}for(;x.length&&(T=x.shift())&&(T.active=!0,T.cancelled);)dc(e).cancel(T.state,T.cancelled.resolve,T.cancelled.reject);T||(E.reserved?!E.reserved.release&&t[5]===73?Ee?Qe():(E.reserved=null,n(E)):E.reserved():Ee?Qe():n(E))}function it(e){ye=0;for(let t=e.length-1;t>0;t--)if(e[t]===32&&e[t+1]<58&&C.count===null&&(C.count=+e.toString(`utf8`,t+1,e.length-1)),e[t-1]>=65){C.command=e.toString(`utf8`,5,t),C.state=te;break}if(Ae&&=(Ae(),null),C.command===`BEGIN`&&s!==1&&!E.reserved)return Ye(G.generic(`UNSAFE_TRANSACTION`,`Only use sql.begin, sql.reserved or max: 1`));if(T.options.simple)return ot();T.cursorFn&&(C.count&&T.cursorFn(C),ze(rc))}function at(){T.parsing=!1}function ot(){!C.statement&&(C.statement=T.statement),C.columns=T.statement.columns}function st(e){let t=e.readUInt16BE(5);for(let n=0;n<t;++n)!T.statement.types[n]&&(T.statement.types[n]=e.readUInt32BE(7+n*4));T.prepare&&(ue[T.signature]=T.statement),T.describeFirst&&!T.onlyDescribe&&(ze(Ie(T)),T.describeFirst=!1)}function ct(e){C.command&&(we||=[C],we.push(C=new Js),C.count=null,T.statement.columns=null);let t=e.readUInt16BE(5),n=7,r;T.statement.columns=Array(t);for(let i=0;i<t;++i){for(r=n;e[n++]!==0;);let t=e.readUInt32BE(n),a=e.readUInt16BE(n+4),o=e.readUInt32BE(n+6);T.statement.columns[i]={name:p.column.from?p.column.from(e.toString(`utf8`,r,n-1)):e.toString(`utf8`,r,n-1),parser:f[o],table:t,number:a,type:o},n+=18}if(C.statement=T.statement,T.onlyDescribe)return T.resolve(T.statement),ze(rc)}async function lt(e,t=e.readUInt32BE(5)){(t===3?ut:t===5?dt:t===10?ft:t===11?pt:t===12?mt:t===0?cc:Ft)(e,t)}async function ut(){let e=await ht();ze(K().p().str(e).z(1).end())}async function dt(e){let t=`md5`+await pc(Buffer.concat([Buffer.from(await pc(await ht()+c)),e.subarray(9)]));ze(K().p().str(t).z(1).end())}async function ft(){ke=(await Cr.randomBytes(18)).toString(`base64`),K().p().str(`SCRAM-SHA-256`+K.N);let e=K.i;ze(K.inc(4).str(`n,,n=*,r=`+ke).i32(K.i-e-4,e).end())}async function pt(e){let t=e.toString(`utf8`,9).split(`,`).reduce((e,t)=>(e[t[0]]=t.slice(2),e),{}),n=await Cr.pbkdf2Sync(await ht(),Buffer.from(t.s,`base64`),parseInt(t.i),32,`sha256`),r=await mc(n,`Client Key`),i=`n=*,r=`+ke+`,r=`+t.r+`,s=`+t.s+`,i=`+t.i+`,c=biws,r=`+t.r;be=(await mc(await mc(n,`Server Key`),i)).toString(`base64`);let a=`c=biws,r=`+t.r+`,p=`+gc(r,Buffer.from(await mc(await hc(r),i))).toString(`base64`);ze(K().p().str(a).end())}function mt(e){e.toString(`utf8`,9).split(K.N,1)[0].slice(2)!==be&&(Ye(G.generic(`SASL_SIGNATURE_MISMATCH`,`The server did not return the correct signature`)),S.destroy())}function ht(){return Promise.resolve(typeof e.pass==`function`?e.pass():e.pass)}function gt(){if(C.statement=T.statement,C.statement.columns=[],T.onlyDescribe)return T.resolve(T.statement),ze(rc)}function _t(e){te.pid=e.readUInt32BE(5),te.secret=e.readUInt32BE(9)}async function vt(){ce=!1,(await new ts([`
+      select b.oid, b.typarray
+      from pg_catalog.pg_type a
+      left join pg_catalog.pg_type b on b.oid = a.typelem
+      where a.typcategory = 'A'
+      group by b.oid, b.typarray
+      order by b.oid
+    `],[],Ne)).forEach(({oid:e,typarray:t})=>yt(e,t))}function yt(t,n){if(e.parsers[n]&&e.serializers[n])return;let r=e.parsers[t];e.shared.typeArrayMap[t]=n,e.parsers[n]=e=>Is(e,r,n),e.parsers[n].array=!0,e.serializers[n]=r=>Ps(r,e.serializers[t],e,n)}function bt(t,n){return t===`read-write`&&n.default_transaction_read_only===`on`||t===`read-only`&&n.default_transaction_read_only===`off`||t===`primary`&&n.in_hot_standby===`on`||t===`standby`&&n.in_hot_standby===`off`||t===`prefer-standby`&&n.in_hot_standby===`off`&&e.host[ge]}function xt(){let e=new ts([`
+      show transaction_read_only;
+      select pg_catalog.pg_is_in_recovery()
+    `],[],Ne,null,{simple:!0});e.resolve=([[e],[t]])=>{le.default_transaction_read_only=e.transaction_read_only,le.in_hot_standby=t.pg_is_in_recovery?`on`:`off`},e.execute()}function St(e){T?((T.cursorFn||T.describeFirst)&&ze(rc),oe=G.postgres(fc(e))):Ye(G.postgres(fc(e)))}function Ct(e,t){delete ue[e.signature],e.retried=t,Ne(e)}function wt(e){if(!h)return;let t=9;for(;e[t++]!==0;);h(e.toString(`utf8`,9,t-1),e.toString(`utf8`,t,e.length-1))}async function Tt(){try{let e=await Promise.resolve(T.cursorFn(C));ye=0,e===es?ze(Bt(T.portal)):(C=new Js,ze(zt(``,T.cursorRows)))}catch(e){ze(rc),T.reject(e)}}function Et(){C.count&&T.cursorFn(C),T.resolve(C)}function Dt(){w=new wr.Writable({autoDestroy:!0,write(e,t,n){S.write(K().d().raw(e).end(),n)},destroy(e,t){t(e),S.write(K().f().str(e+K.N).end()),w=null},final(e){S.write(K().c().end()),Ae=e,w=null}}),T.resolve(w)}function Ot(){w=new wr.Readable({read(){S.resume()}}),T.resolve(w)}function kt(){w=new wr.Duplex({autoDestroy:!0,read(){S.resume()},write(e,t,n){S.write(K().d().raw(e).end(),n)},destroy(e,t){t(e),S.write(K().f().str(e+K.N).end()),w=null},final(e){S.write(K().c().end()),Ae=e}}),T.resolve(w)}function At(e){w&&(w.push(e.subarray(5))||S.pause())}function jt(){w&&w.push(null),w=null}function Mt(e){m?m(fc(e)):console.log(fc(e))}function D(){}function Nt(){Ye(G.notSupported(`FunctionCallResponse`))}function O(){Ye(G.notSupported(`NegotiateProtocolVersion`))}function Pt(e){console.error(`Postgres.js : Unknown Message:`,e[0])}function Ft(e,t){console.error(`Postgres.js : Unknown Auth:`,t)}function It(t,n,r=``,i=``){let a,o;return K().B().str(i+K.N).str(r+K.N).i16(0).i16(t.length),t.forEach((r,i)=>{if(r===null)return K.i32(4294967295);o=n[i],t[i]=r=o in e.serializers?e.serializers[o](r):``+r,a=K.i,K.inc(4).str(r).i32(K.i-a-4,a)}),K.i16(0),K.end()}function Lt(e,t,n,r=``){return K().P().str(r+K.N).str(e+K.N).i16(t.length),t.forEach((e,t)=>K.i32(n[t]||0)),K.end()}function Rt(e,t=``){return K().D().str(e).str(t+K.N).end()}function zt(e=``,t=0){return Buffer.concat([K().E().str(e+K.N).i32(t).end(),ic])}function Bt(e=``){return Buffer.concat([K().C().str(`P`).str(e+K.N).end(),K().S().end()])}function Vt(){return ae||K().inc(4).i16(3).z(2).str(Object.entries(Object.assign({user:c,database:d,client_encoding:`UTF8`},e.connection)).filter(([,e])=>e).map(([e,t])=>e+K.N+t).join(K.N)).z(2).end(0)}}function fc(e){let t={},n=5;for(let r=5;r<e.length-1;r++)e[r]===0&&(t[uc[e[n]]]=e.toString(`utf8`,n+1,r),n=r+1);return t}function pc(e){return Cr.createHash(`md5`).update(e).digest(`hex`)}function mc(e,t){return Cr.createHmac(`sha256`,e).update(t).digest()}function hc(e){return Cr.createHash(`sha256`).update(e).digest()}function gc(e,t){let n=Math.max(e.length,t.length),r=Buffer.allocUnsafe(n);for(let i=0;i<n;i++)r[i]=e[i]^t[i];return r}function _c(e,t){if(t=typeof t==`function`?t():t,!t)return{cancel:cc,start:cc};let n;return{cancel(){n&&=(clearTimeout(n),null)},start(){n&&clearTimeout(n),n=setTimeout(r,t*1e3,arguments)}};function r(t){e.apply(null,t),n=null}}const vc=()=>{};function yc(e,t){let n=new Map,r=`postgresjs_`+Math.random().toString(36).slice(2),i={},a,o,s=!1,c=d.sql=e({...t,transform:{column:{},value:{},row:{}},max:1,fetch_types:!1,idle_timeout:null,max_lifetime:null,connection:{...t.connection,replication:`database`},onclose:async function(){s||(o=null,i.pid=i.secret=void 0,f(await p(c,r,t.publications)),n.forEach(e=>e.forEach(({onsubscribe:e})=>e())))},no_subscribe:!0}),l=c.end,u=c.close;return c.end=async()=>(s=!0,o&&await new Promise(e=>(o.once(`close`,e),o.end())),l()),c.close=async()=>(o&&await new Promise(e=>(o.once(`close`,e),o.end())),u()),d;async function d(e,s,l=vc,u=vc){e=Cc(e),a||=p(c,r,t.publications);let d={fn:s,onsubscribe:l},m=n.has(e)?n.get(e).add(d):n.set(e,new Set([d])).get(e),h=()=>{m.delete(d),m.size===0&&n.delete(e)};return a.then(e=>(f(e),l(),o&&o.on(`error`,u),{unsubscribe:h,state:i,sql:c}))}function f(e){o=e.stream,i.pid=e.state.pid,i.secret=e.state.secret}async function p(e,n,r){if(!r)throw Error(`Missing publication names`);let i=await e.unsafe(`CREATE_REPLICATION_SLOT ${n} TEMPORARY LOGICAL pgoutput NOEXPORT_SNAPSHOT`),[a]=i,o=await e.unsafe(`START_REPLICATION SLOT ${n} LOGICAL ${a.consistent_point} (proto_version '1', publication_names '${r}')`).writable(),s={lsn:Buffer.concat(a.consistent_point.split(`/`).map(e=>Buffer.from((`00000000`+e).slice(-8),`hex`)))};return o.on(`data`,l),o.on(`error`,c),o.on(`close`,e.close),{stream:o,state:i.state};function c(e){console.error(`Unexpected error during logical streaming - reconnecting`,e)}function l(n){n[0]===119?xc(n.subarray(25),s,e.options.parsers,u,t.transform):n[0]===107&&n[17]&&(s.lsn=n.subarray(1,9),d())}function u(e,t){let n=t.relation.schema+`.`+t.relation.table;m(`*`,e,t),m(`*:`+n,e,t),t.relation.keys.length&&m(`*:`+n+`=`+t.relation.keys.map(t=>e[t.name]),e,t),m(t.command,e,t),m(t.command+`:`+n,e,t),t.relation.keys.length&&m(t.command+`:`+n+`=`+t.relation.keys.map(t=>e[t.name]),e,t)}function d(){let e=Buffer.alloc(34);e[0]=114,e.fill(s.lsn,1),e.writeBigInt64BE(BigInt(Date.now()-Date.UTC(2e3,0,1))*BigInt(1e3),25),o.write(e)}}function m(e,t,r){n.has(e)&&n.get(e).forEach(({fn:n})=>n(t,r,e))}}function bc(e){return new Date(Date.UTC(2e3,0,1)+Number(e/BigInt(1e3)))}function xc(e,t,n,r,i){Object.entries({R:e=>{let r=1,a=t[e.readUInt32BE(r)]={schema:e.toString(`utf8`,r+=4,r=e.indexOf(0,r))||`pg_catalog`,table:e.toString(`utf8`,r+1,r=e.indexOf(0,r+1)),columns:Array(e.readUInt16BE(r+=2)),keys:[]};r+=2;let o=0,s;for(;r<e.length;)s=a.columns[o++]={key:e[r++],name:i.column.from?i.column.from(e.toString(`utf8`,r,r=e.indexOf(0,r))):e.toString(`utf8`,r,r=e.indexOf(0,r)),type:e.readUInt32BE(r+=1),parser:n[e.readUInt32BE(r)],atttypmod:e.readUInt32BE(r+=4)},s.key&&a.keys.push(s),r+=4},Y:()=>{},O:()=>{},B:e=>{t.date=bc(e.readBigInt64BE(9)),t.lsn=e.subarray(1,9)},I:e=>{let n=1,a=t[e.readUInt32BE(n)],{row:o}=Sc(e,a.columns,n+=7,i);r(o,{command:`insert`,relation:a})},D:e=>{let n=1,a=t[e.readUInt32BE(n)];n+=4;let o=e[n]===75;r(o||e[n]===79?Sc(e,a.columns,n+=3,i).row:null,{command:`delete`,relation:a,key:o})},U:e=>{let n=1,a=t[e.readUInt32BE(n)];n+=4;let o=e[n]===75,s=o||e[n]===79?Sc(e,a.columns,n+=3,i):null;s&&(n=s.i);let{row:c}=Sc(e,a.columns,n+3,i);r(c,{command:`update`,relation:a,key:o,old:s&&s.row})},T:()=>{},C:()=>{}}).reduce((e,[t,n])=>(e[t.charCodeAt(0)]=n,e),{})[e[0]](e)}function Sc(e,t,n,r){let i,a,o,s=r.raw?Array(t.length):{};for(let c=0;c<t.length;c++)i=e[n++],a=t[c],o=i===110?null:i===117?void 0:a.parser===void 0?e.toString(`utf8`,n+4,n+=4+e.readUInt32BE(n)):a.parser.array===!0?a.parser(e.toString(`utf8`,n+5,n+=4+e.readUInt32BE(n))):a.parser(e.toString(`utf8`,n+4,n+=4+e.readUInt32BE(n))),r.raw?s[c]=r.raw===!0?o:r.value.from?r.value.from(o,a):o:s[a.name]=r.value.from?r.value.from(o,a):o;return{i:n,row:r.row.from?r.row.from(s):s}}function Cc(e){let t=e.match(/^(\*|insert|update|delete)?:?([^.]+?\.?[^=]+)?=?(.+)?/i)||[];if(!t)throw Error(`Malformed subscribe pattern: `+e);let[,n,r,i]=t;return(n||`*`)+(r?`:`+(r.indexOf(`.`)===-1?`public.`+r:r):``)+(i?`=`+i:``)}function wc(e,t,n=393216){return new Promise(async(r,i)=>{await e.begin(async e=>{let i;!t&&([{oid:t}]=await e`select lo_creat(-1) as oid`);let[{fd:a}]=await e`select lo_open(${t}, ${n}) as fd`,o={writable:c,readable:s,close:()=>e`select lo_close(${a})`.then(i),tell:()=>e`select lo_tell64(${a})`,read:t=>e`select loread(${a}, ${t}) as data`,write:t=>e`select lowrite(${a}, ${t})`,truncate:t=>e`select lo_truncate64(${a}, ${t})`,seek:(t,n=0)=>e`select lo_lseek64(${a}, ${t}, ${n})`,size:()=>e`
+          select
+            lo_lseek64(${a}, location, 0) as position,
+            seek.size
+          from (
+            select
+              lo_lseek64($1, 0, 2) as size,
+              tell.location
+            from (select lo_tell64($1) as location) tell
+          ) seek
+        `};return r(o),new Promise(async e=>i=e);async function s({highWaterMark:e=16384,start:t=0,end:n=1/0}={}){let r=n-t;return t&&await o.seek(t),new wr.Readable({highWaterMark:e,async read(e){let t=e>r?e-r:e;r-=e;let[{data:n}]=await o.read(t);this.push(n),n.length<e&&this.push(null)}})}async function c({highWaterMark:e=16384,start:t=0}={}){return t&&await o.seek(t),new wr.Writable({highWaterMark:e,write(e,t,n){o.write(e).then(()=>n(),n)}})}}).catch(i)})}Object.assign(Ec,{PostgresError:rs,toPascal:zs,pascal:Ks,toCamel:Rs,camel:Gs,toKebab:Bs,kebab:qs,fromPascal:Hs,fromCamel:Vs,fromKebab:Us,BigInt:{to:20,from:[20],parse:e=>BigInt(e),serialize:e=>e.toString()}});var Tc=Ec;function Ec(e,t){let n=Dc(e,t),r=n.no_subscribe||yc(Ec,{...n}),i=!1,a=Ys(),o=Ys(),s=Ys(),c=Ys(),l=Ys(),u=Ys(),d=Ys(),f=Ys(),p={connecting:o,reserved:s,closed:c,ended:l,open:u,busy:d,full:f},m=[...Array(n.max)].map(()=>tc(n,p,{onopen:ce,onend:se,onclose:le})),h=g(ne);return Object.assign(h,{get parameters(){return n.parameters},largeObject:wc.bind(null,h),subscribe:r,CLOSE:es,END:es,PostgresError:rs,options:n,reserve:y,listen:_,begin:b,close:ae,end:S}),h;function g(e){return e.debug=n.debug,Object.entries(n.types).reduce((e,[t,n])=>(e[t]=e=>new ds(e,n.to),e),t),Object.assign(r,{types:t,typed:t,unsafe:i,notify:v,array:te,json:ee,file:a}),r;function t(e,t){return new ds(e,t)}function r(t,...r){return t&&Array.isArray(t.raw)?new ts(t,r,e,ie):typeof t==`string`&&!r.length?new us(n.transform.column.to?n.transform.column.to(t):t):new fs(t,r)}function i(t,n=[],r={}){return arguments.length===2&&!Array.isArray(n)&&(r=n,n=[]),new ts([t],n,e,ie,{prepare:!1,...r,simple:`simple`in r?r.simple:n.length===0})}function a(t,n=[],r={}){return arguments.length===2&&!Array.isArray(n)&&(r=n,n=[]),new ts([],n,n=>{br.readFile(t,`utf8`,(t,r)=>{if(t)return n.reject(t);n.strings=[r],e(n)})},ie,{...r,simple:`simple`in r?r.simple:n.length===0})}}async function _(e,t,r){let i={fn:t,onlisten:r},a=_.sql||=Ec({...n,max:1,idle_timeout:null,max_lifetime:null,fetch_types:!1,onclose(){Object.entries(_.channels).forEach(([e,{listeners:t}])=>{delete _.channels[e],Promise.all(t.map(t=>_(e,t.fn,t.onlisten).catch(()=>{})))})},onnotify(e,t){e in _.channels&&_.channels[e].listeners.forEach(e=>e.fn(t))}}),o=_.channels||={};if(e in o){o[e].listeners.push(i);let t=await o[e].result;return i.onlisten&&i.onlisten(),{state:t.state,unlisten:c}}o[e]={result:a`listen ${a.unsafe(`"`+e.replace(/"/g,`""`)+`"`)}`,listeners:[i]};let s=await o[e].result;return i.onlisten&&i.onlisten(),{state:s.state,unlisten:c};async function c(){if(e in o&&(o[e].listeners=o[e].listeners.filter(e=>e!==i),!o[e].listeners.length))return delete o[e],a`unlisten ${a.unsafe(`"`+e.replace(/"/g,`""`)+`"`)}`}}async function v(e,t){return await h`select pg_notify(${e}, ${``+t})`}async function y(){let e=Ys(),t=u.length?u.shift():await new Promise((e,t)=>{let n={reserve:e,reject:t};a.push(n),c.length&&C(c.shift(),n)});x(t,s),t.reserved=()=>e.length?t.execute(e.shift()):x(t,s),t.reserved.release=!0;let n=g(r);return n.release=()=>{t.reserved=null,ce(t)},n;function r(n){t.queue===f?e.push(n):t.execute(n)||x(t,f)}}async function b(e,t){!t&&(t=e,e=``);let n=Ys(),r=0,i,a=null;try{return await h.unsafe(`begin `+e.replace(/[^a-z ]/gi,``),[],{onexecute:c}).execute(),await Promise.race([o(i,t),new Promise((e,t)=>i.onclose=t)])}catch(e){throw e}async function o(e,t,i){let s=g(d);s.savepoint=u,s.prepare=e=>a=e.replace(/[^a-z0-9$-_. ]/gi);let c,l;i&&await s`savepoint ${s(i)}`;try{if(l=await new Promise((e,n)=>{let r=t(s);Promise.resolve(Array.isArray(r)?Promise.all(r):r).then(e,n)}),c)throw c}catch(e){throw await(i?s`rollback to ${s(i)}`:s`rollback`),e instanceof rs&&e.code===`25P02`&&c||e}return i||(a?await s`prepare transaction '${s.unsafe(a)}'`:await s`commit`),l;function u(t,n){return t&&Array.isArray(t.raw)?u(e=>e.apply(e,arguments)):(arguments.length===1&&(n=t,t=null),o(e,n,`s`+r+++(t?`_`+t:``)))}function d(t){t.catch(e=>c||=e),e.queue===f?n.push(t):e.execute(t)||x(e,f)}}function c(e){i=e,x(e,s),e.reserved=()=>n.length?e.execute(n.shift()):x(e,s)}}function x(e,t){return e.queue.remove(e),t.push(e),e.queue=t,t===u?e.idleTimer.start():e.idleTimer.cancel(),e}function ee(e){return new ds(e,3802)}function te(e,t){return Array.isArray(e)?new ds(e,t||(e.length?As(e)||25:0),n.shared.typeArrayMap):te(Array.from(arguments))}function ne(e){if(i)return e.reject(G.connection(`CONNECTION_ENDED`,n,n));if(u.length)return re(u.shift(),e);if(c.length)return C(c.shift(),e);d.length?re(d.shift(),e):a.push(e)}function re(e,t){return e.execute(t)?x(e,d):x(e,f)}function ie(e){return new Promise((t,r)=>{e.state?e.active?tc(n).cancel(e.state,t,r):e.cancelled={resolve:t,reject:r}:(a.remove(e),e.cancelled=!0,e.reject(G.generic(`57014`,`canceling statement due to user request`)),t())})}async function S({timeout:e=null}={}){if(i)return i;await 1;let t;return i=Promise.race([new Promise(n=>e!==null&&(t=setTimeout(oe,e*1e3,n))),Promise.all(m.map(e=>e.end()).concat(_.sql?_.sql.end({timeout:0}):[],r.sql?r.sql.end({timeout:0}):[]))]).then(()=>clearTimeout(t))}async function ae(){await Promise.all(m.map(e=>e.end()))}async function oe(e){for(await Promise.all(m.map(e=>e.terminate()));a.length;)a.shift().reject(G.connection(`CONNECTION_DESTROYED`,n));e()}function C(e,t){return x(e,o),e.connect(t),e}function se(e){x(e,l)}function ce(e){if(a.length===0)return x(e,u);let t=Math.ceil(a.length/(o.length+1)),n=!0;for(;n&&a.length&&t-->0;){let t=a.shift();if(t.reserve)return t.reserve(e);n=e.execute(t)}n?x(e,d):x(e,f)}function le(e,t){x(e,c),e.reserved=null,e.onclose&&=(e.onclose(t),null),n.onclose&&n.onclose(e.id),a.length&&C(e,a.shift())}}function Dc(e,t){if(e&&e.shared)return e;let n=process.env,r=(!e||typeof e==`string`?t:e)||{},{url:i,multihost:a}=Mc(e),o=[...i.searchParams].reduce((e,[t,n])=>(e[t]=n,e),{}),s=r.hostname||r.host||a||i.hostname||n.PGHOST||`localhost`,c=r.port||i.port||n.PGPORT||5432,l=r.user||r.username||i.username||n.PGUSERNAME||n.PGUSER||Nc();r.no_prepare&&(r.prepare=!1),o.sslmode&&(o.ssl=o.sslmode,delete o.sslmode),`timeout`in r&&(console.log(`The timeout option is deprecated, use idle_timeout instead`),r.idle_timeout=r.timeout),o.sslrootcert===`system`&&(o.ssl=`verify-full`);let u=[`idle_timeout`,`connect_timeout`,`max_lifetime`,`max_pipeline`,`backoff`,`keep_alive`],d={max:globalThis.Cloudflare?3:10,ssl:!1,sslnegotiation:null,idle_timeout:null,connect_timeout:30,max_lifetime:Ac,max_pipeline:100,backoff:kc,keep_alive:60,prepare:!0,debug:!1,fetch_types:!0,publications:`alltables`,target_session_attrs:null};return{host:Array.isArray(s)?s:s.split(`,`).map(e=>e.split(`:`)[0]),port:Array.isArray(c)?c:s.split(`,`).map(e=>parseInt(e.split(`:`)[1]||c)),path:r.path||s.indexOf(`/`)>-1&&s+`/.s.PGSQL.`+c,database:r.database||r.db||(i.pathname||``).slice(1)||n.PGDATABASE||l,user:l,pass:r.pass||r.password||i.password||n.PGPASSWORD||``,...Object.entries(d).reduce((e,[t,i])=>{let a=t in r?r[t]:t in o?o[t]===`disable`||o[t]===`false`?!1:o[t]:n[`PG`+t.toUpperCase()]||i;return e[t]=typeof a==`string`&&u.includes(t)?+a:a,e},{}),connection:{application_name:n.PGAPPNAME||`postgres.js`,...r.connection,...Object.entries(o).reduce((e,[t,n])=>(t in d||(e[t]=n),e),{})},types:r.types||{},target_session_attrs:Oc(r,i,n),onnotice:r.onnotice,onnotify:r.onnotify,onclose:r.onclose,onparameter:r.onparameter,socket:r.socket,transform:jc(r.transform||{undefined:void 0}),parameters:{},shared:{retries:0,typeArrayMap:{}},...Es(r.types)}}function Oc(e,t,n){let r=e.target_session_attrs||t.searchParams.get(`target_session_attrs`)||n.PGTARGETSESSIONATTRS;if(!r||[`read-write`,`read-only`,`primary`,`standby`,`prefer-standby`].includes(r))return r;throw Error(`target_session_attrs `+r+` is not supported`)}function kc(e){return(.5+Math.random()/2)*Math.min(3**e/100,20)}function Ac(){return 60*(30+Math.random()*30)}function jc(e){return{undefined:e.undefined,column:{from:typeof e.column==`function`?e.column:e.column&&e.column.from,to:e.column&&e.column.to},value:{from:typeof e.value==`function`?e.value:e.value&&e.value.from,to:e.value&&e.value.to},row:{from:typeof e.row==`function`?e.row:e.row&&e.row.from,to:e.row&&e.row.to}}}function Mc(e){if(!e||typeof e!=`string`)return{url:{searchParams:new Map}};let t=e;t=t.slice(t.indexOf(`://`)+3).split(/[?/]/)[0],t=decodeURIComponent(t.slice(t.indexOf(`@`)+1));let n=new URL(e.replace(t,t.split(`,`)[0]));return{url:{username:decodeURIComponent(n.username),password:decodeURIComponent(n.password),host:n.host,hostname:n.hostname,port:n.port,pathname:n.pathname,searchParams:n.searchParams},multihost:t.indexOf(`,`)>-1&&t}}function Nc(){try{return yr.userInfo().username}catch{return process.env.USERNAME||process.env.USER||process.env.LOGNAME}}var Pc=class extends Hn{constructor(e,t,n,r,i,a,o,s,c,l){super({sql:t,params:n},i,a,o),this.client=e,this.queryString=t,this.params=n,this.logger=r,this.fields=s,this._isResponseInArrayMode=c,this.customResultMapper=l}static[Sn]=`PostgresJsPreparedQuery`;async execute(e={}){return An.startActiveSpan(`drizzle.execute`,async t=>{let n=kn(this.params,e);t?.setAttributes({"drizzle.query.text":this.queryString,"drizzle.query.params":JSON.stringify(n)}),this.logger.logQuery(this.queryString,n);let{fields:r,queryString:i,client:a,joinsNotNullableMap:o,customResultMapper:s}=this;if(!r&&!s)return An.startActiveSpan(`drizzle.driver.execute`,()=>this.queryWithCache(i,n,async()=>await a.unsafe(i,n)));let c=await An.startActiveSpan(`drizzle.driver.execute`,()=>(t?.setAttributes({"drizzle.query.text":i,"drizzle.query.params":JSON.stringify(n)}),this.queryWithCache(i,n,async()=>await a.unsafe(i,n).values())));return An.startActiveSpan(`drizzle.mapResponse`,()=>s?s(c):c.map(e=>_n(r,e,o)))})}all(e={}){return An.startActiveSpan(`drizzle.execute`,async t=>{let n=kn(this.params,e);return t?.setAttributes({"drizzle.query.text":this.queryString,"drizzle.query.params":JSON.stringify(n)}),this.logger.logQuery(this.queryString,n),An.startActiveSpan(`drizzle.driver.execute`,()=>(t?.setAttributes({"drizzle.query.text":this.queryString,"drizzle.query.params":JSON.stringify(n)}),this.queryWithCache(this.queryString,n,async()=>this.client.unsafe(this.queryString,n))))})}isResponseInArrayMode(){return this._isResponseInArrayMode}},Fc=class e extends Gn{constructor(e,t,n,r={}){super(t),this.client=e,this.schema=n,this.options=r,this.logger=r.logger??new gn,this.cache=r.cache??new Wn}static[Sn]=`PostgresJsSession`;logger;cache;prepareQuery(e,t,n,r,i,a,o){return new Pc(this.client,e.sql,e.params,this.logger,this.cache,a,o,t,r,i)}query(e,t){return this.logger.logQuery(e,t),this.client.unsafe(e,t).values()}queryObjects(e,t){return this.client.unsafe(e,t)}transaction(t,n){return this.client.begin(async r=>{let i=new e(r,this.dialect,this.schema,this.options),a=new Ic(this.dialect,i,this.schema);return n&&await a.setTransaction(n),t(a)})}},Ic=class e extends Mn{constructor(e,t,n,r=0){super(e,t,n,r),this.session=t}static[Sn]=`PostgresJsTransaction`;transaction(t){return this.session.client.savepoint(n=>{let r=new Fc(n,this.dialect,this.schema,this.session.options);return t(new e(this.dialect,r,this.schema))})}},Lc=class extends wn{static[Sn]=`PostgresJsDatabase`};function Rc(e,t={}){let n=e=>e;for(let t of[`1184`,`1082`,`1083`,`1114`,`1182`,`1185`,`1115`,`1231`])e.options.parsers[t]=n,e.options.serializers[t]=n;e.options.serializers[114]=n,e.options.serializers[3802]=n;let r=new un({casing:t.casing}),i;t.logger===!0?i=new Rn:t.logger!==!1&&(i=t.logger);let a;if(t.schema){let e=bn(t.schema,dn);a={fullSchema:t.schema,schema:e.tables,tableNamesMap:e.tableNamesMap}}let o=new Lc(r,new Fc(e,r,a,{logger:i,cache:t.cache}),a);return o.$client=e,o.$cache=t.cache,o.$cache&&(o.$cache.invalidate=t.cache?.onMutate),o}function zc(...e){if(typeof e[0]==`string`)return Rc(Tc(e[0]),e[1]);if(pn(e[0])){let{connection:t,client:n,...r}=e[0];if(n)return Rc(n,r);if(typeof t==`object`&&t.url!==void 0){let{url:e,...n}=t;return Rc(Tc(e,n),r)}return Rc(Tc(t),r)}return Rc(e[0],e[1])}(e=>{function t(e){return Rc({options:{parsers:{},serializers:{}}},e)}e.mock=t})(zc||={});function Bc(e){return e.replace(/\$(\w*)\$[\s\S]*?\$\1\$|[eE]'(?:\\.|''|[^'])*'|'(?:''|[^'])*'|--[^\n]*|\/\*[\s\S]*?\*\//g,e=>e.startsWith(`--`)||e.startsWith(`/*`)?` `:`?`).replace(/\b\d+(?:\.\d+)?\b/g,`?`).replace(/\s+/g,` `).trim()}var Vc=class{requests=new fr;request(e,t){if(process.env.CODER_DB_PROFILE!==`1`)return t();let n=e&&this.requests.getStore()||sr();return this.requests.run(n,()=>t(n))}statement(e,t=this.requests.getStore()??`background`){let n=performance.now();return(r,i=!1,a=e)=>console.info(JSON.stringify({type:`coder.db`,requestId:t,sql:Bc(a),start:n,ms:performance.now()-n,rows:r,failed:i}))}query(e,t){if(process.env.CODER_DB_PROFILE!==`1`)return e;let n=this,r=this.requests.getStore()??`background`,i;return new Proxy(e,{get(e,a,o){return a===`then`?(a,o)=>(i??=(()=>{let i=n.statement(t,r);return Promise.resolve(e).then(e=>{let t=e;return i(t?.count??t?.length??null),e},e=>{throw i(null,!0),e})})(),i.then(a,o)):Reflect.get(e,a,o)}})}},Hc=r({CASING:()=>Uc,connect:()=>Yc,describeDatabase:()=>Wc,pipeline:()=>Kc,prepared:()=>qc,readQuery:()=>q});const Uc=`snake_case`;function Wc(e){try{let t=new URL(e);return`${t.hostname}${t.pathname}`}catch{return`the database`}}function Gc(e){return e?.severity===`FATAL`||[`CONNECTION_CLOSED`,`CONNECTION_ENDED`,`CONNECTION_DESTROYED`,`ECONNRESET`,`EPIPE`].includes(e?.code??``)}async function Kc(e,t,n){let r=e.$client;if(!r?.begin)return e.transaction(async e=>{for(let n of t)await e.execute(n);let r=await e.execute(n);return Array.isArray(r)?r:r.rows});let i=new un({casing:Uc}),a=e._.session.logger,o=await r.begin(e=>Promise.all([...t,n].map(t=>{let n=i.sqlToQuery(t);return a?.logQuery(n.sql,n.params),e.unsafe(n.sql,n.params)})).catch(e=>{if(Gc(e))return new Promise(()=>{});throw e}));return o[o.length-1]}function qc(e,t,n=new Vc){let r=e.unsafe;e.unsafe=((e,i,a)=>n.query(r(e,i,{prepare:t,...a}),e));for(let r of[`begin`,`savepoint`]){let i=e[r];i&&(e[r]=(...a)=>{let o=a.pop();if(process.env.CODER_DB_PROFILE===`1`){let s=r===`savepoint`?n.statement(`savepoint`):void 0,c;return Promise.resolve(i.call(e,...a,async e=>{s?.(null);try{let r=o(qc(e,t,n));return await(Array.isArray(r)?Promise.all(r):r)}finally{c=n.statement(r===`begin`?`commit`:`release savepoint`)}})).then(e=>(c?.(null),e),e=>{throw c?c(null,!0,r===`begin`?`rollback`:`rollback to savepoint`):s?.(null,!0),e})}return i.call(e,...a,e=>o(qc(e,t,n)))})}return e}function q(e,t){let n=e.$client?.reads;return n?n.run(!0,async()=>t()):Promise.resolve(t())}function Jc(e,t,n){let r=e.begin;e.begin=((...t)=>n.exit(()=>r.apply(e,t)));let i=e.unsafe;return e.unsafe=((...r)=>{let a=t.getStore()===!0,o=n.getStore(),s=i(...r),c=[],l=()=>o?n.exit(()=>e.begin(e=>[e.unsafe(`set local statement_timeout = ${Math.ceil(o)}`),c.reduce((e,t)=>e[t](),e.unsafe(...r))])).then(e=>e[1]):c.reduce((e,t)=>e[t](),i(...r)),u=()=>new Promise(e=>setTimeout(e)).then(l),d=new Proxy(s,{get:(e,t,n)=>t===`values`||t===`raw`?()=>(c.push(t),e[t](),d):t===`then`?(t,n)=>(o?l():e).then(void 0,e=>Gc(e)&&a?u():Promise.reject(e)).then(t,n):Reflect.get(e,t,n)});return d}),e}function Yc(e,t={}){let n=Tc(e,{max:t.max??10,idle_timeout:t.idleTimeout??240,onnotice:()=>{}}),r=new Vc,i=new fr,a=new fr,o=Object.assign(Jc(qc(n,n.options.prepare,r),i,a),{reads:i});return{db:zc(o,{schema:Pn,casing:Uc}),profile:r,statementTimeout:(e,t)=>a.run(e,t),close:()=>o.end()}}var Xc=r({addUsage:()=>$c,leaders:()=>tl,readUsage:()=>cl,readUsageTotals:()=>ll,timeZone:()=>Qc,usageReport:()=>sl,usageSummary:()=>il,usageTotals:()=>el});function Zc(e){return typeof e==`number`?e:!e||typeof e!=`object`||Array.isArray(e)?0:`total`in e&&typeof e.total==`number`?e.total:Object.values(e).reduce((e,t)=>e+Zc(t),0)}function Qc(e){if(!e)return`UTC`;try{return new Intl.DateTimeFormat(`en`,{timeZone:e}),e}catch{return`UTC`}}const $c=(e,t)=>{e.tasks+=t.tasks,e.runnerMs+=t.runnerMs,e.tokenCount+=t.tokenCount};async function el(e,t){if(e.usageTotals)return e.usageTotals(t);if(t.top){let{top:n,...r}=t,i=(await el(e,{...r,by:`agent`,parts:void 0})).sort((e,t)=>t[n.by]-e[n.by]||e.key.localeCompare(t.key)).slice(0,n.count).map(e=>e.key);return el(e,{...r,parts:i})}let n=Qc(t.tz),r=new Intl.DateTimeFormat(`en-CA`,{timeZone:n,year:`numeric`,month:`2-digit`,day:`2-digit`}),i=new Set(t.parts),a=new Map;for(let{value:n}of await e.list(`usage`)){if(n.at<t.since||t.until!==void 0&&n.at>=t.until||t.agent&&n.agent!==t.agent)continue;let e=t.by===`agent`?n.agent:t.by===`installation`?n.installationId??`none`:t.by===`engine`?n.engine??`unknown`:r.format(n.at),o={tasks:1,runnerMs:n.runnerElapsedMs,tokenCount:Zc(n.tokens)},s=a.get(e)??{key:e,tasks:0,runnerMs:0,tokenCount:0};$c(s,o),i.has(n.agent)&&(s.parts??={},$c(s.parts[n.agent]??={tasks:0,runnerMs:0,tokenCount:0},o)),a.set(e,s)}return[...a.values()].sort((e,t)=>e.key.localeCompare(t.key))}function tl(e,t){let n=new Map;for(let r of e)for(let[e,i]of Object.entries(r.parts??{}))n.set(e,(n.get(e)??0)+i[t]);return[...n].sort((e,t)=>t[1]-e[1]||e[0].localeCompare(t[0])).map(([e])=>e)}function nl(e,t){if(typeof t==`number`)return(typeof e==`number`?e:0)+t;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=e&&typeof e==`object`&&!Array.isArray(e)?{...e}:{};for(let[e,r]of Object.entries(t))n[e]=nl(n[e],r);return n}function rl(e,t){let n=new Map;for(let r of e){let e=t===`agent`?r.agent:t===`installation`?r.installationId??`none`:r.engine??`unknown`,i=n.get(e)??{key:e,tasks:0,runnerMs:0};i.tasks++,i.runnerMs+=r.runnerElapsedMs,r.tokens!==void 0&&(i.tokens=nl(i.tokens,r.tokens)),n.set(e,i)}return[...n.values()].sort((e,t)=>e.key.localeCompare(t.key))}function il(e,t,n){let r=e.filter(e=>e.at>=t);return{since:t,totals:n?rl(r,n):{agent:rl(r,`agent`),installation:rl(r,`installation`),engine:rl(r,`engine`)}}}const al={tasks:`tasks`,runner:`runnerMs`,tokens:`tokenCount`},ol={tokens:e=>e.tokenCount,tasks:e=>e.tasks,runner:e=>e.runnerMs,name:e=>e.key};async function sl(e,t){let n=e=>t.searchParams.get(e),r=Number(n(`since`)??0),i=n(`until`)===null?void 0:Number(n(`until`)),a=n(`by`)??`agent`;if(!Number.isFinite(r)||i!==void 0&&!Number.isFinite(i)||![`agent`,`installation`,`engine`,`day`].includes(a))return D({error:`Invalid usage query`},400);let o=n(`parts`)?.split(`,`).filter(Boolean),s=Math.min(Number(n(`top`)??0),8),c=al[n(`sort`)??`tokens`]??`tokenCount`,l=await el(e.store,{by:a,since:r,...i===void 0?{}:{until:i},...n(`agent`)?{agent:n(`agent`)}:{},...a===`day`?{tz:Qc(n(`tz`))}:{},...o?.length?{parts:o.slice(0,20)}:{},...s>0?{top:{count:s,by:c}}:{}}),u={since:r,...i===void 0?{}:{until:i}};if(a===`agent`){let t=new Set(e.local?(await Ze(e.local.cwd,e.integrations)).map(e=>e.id):(await e.store.list(`agent`)).map(e=>e.id));for(let e of Object.keys(rt()))t.add(e);for(let e of l)t.has(e.key)||(e.deleted=!0)}if(s>0)return D({...u,totals:l,top:tl(l,c)});if(!Pt(t)||a!==`agent`)return D({...u,totals:l});let d=ol[n(`sort`)??`tokens`]??ol.tokens,f=n(`sort`)===`name`,p=n(`q`)?.trim().toLowerCase(),m=([e,t],[n,r])=>(e<n?-1:+(e>n))*(f?1:-1)||t.localeCompare(r),h=e=>[d(e),e.key],g=Rt(t),_=l.filter(e=>!p||e.key.toLowerCase().includes(p)).filter(e=>!g||m(h(e),g)>0).sort((e,t)=>m(h(e),h(t))),v=O(t),y=e=>l.reduce((t,n)=>t+e(n),0);return D({...u,...Vt(_.slice(0,v+1),v,h),summary:{agents:l.length,tasks:y(e=>e.tasks),runnerMs:y(e=>e.runnerMs),tokenCount:y(e=>e.tokenCount)}})}async function cl(e,t,n,r){t.local&&await mp(t);let i=r.searchParams.get(`installation`),a=await t.store.list(`usage`,{limit:O(r,200),...i?{installation:i}:{}});return D(i?a.filter(e=>e.value.installationId===i):a)}async function ll(e,t,n,r){t.local&&await mp(t);let i=Number(r.searchParams.get(`since`)??0),a=r.searchParams.get(`by`);if([`until`,`agent`,`tz`,`parts`,`top`,`cursor`].some(e=>r.searchParams.has(e))||a===`day`)return sl(t,r);if(!Number.isFinite(i)||a&&![`agent`,`installation`,`engine`].includes(a))return D({error:`Invalid usage query`},400);if(t.store.usageSummary)return D({since:i,totals:await t.store.usageSummary(i,a)});let o=(await t.store.list(`usage`)).map(e=>e.value);return D(il(o,i,a))}var ul=r({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>kl,agentRowId:()=>wl,agentValue:()=>vl,app:()=>J,appRowId:()=>Cl,date:()=>Z,defined:()=>hl,escapeLike:()=>ml,install:()=>Y,installationRowId:()=>Tl,ms:()=>X,opaque:()=>Ol,readTaskContext:()=>fl,rows:()=>Nl,setSecret:()=>Al,splitKey:()=>pl,stateKey:()=>Ml,statePrefix:()=>jl,storedTaskContext:()=>dl,taskRecord:()=>Sl,taskRowId:()=>El,versionColumns:()=>bl,versionSummary:()=>xl,versionValue:()=>yl});function dl(e){return e.connections===void 0?e.context:{...e.context,connections:e.connections}}function fl(e){let{connections:t,runnerLogs:n,...r}=e??{};return{connections:t,runnerLogs:n,context:Object.keys(r).length?r:void 0}}function pl(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const J=Bn,Y=Nn,X=e=>e.getTime(),Z=e=>new Date(e),ml=e=>e.replace(/[\\%_]/g,`\\$&`),hl=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),gl=e=>e?X(e):void 0,_l=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},vl=e=>hl({id:e.slug,name:e.name,description:e.description,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:X(e.createdAt),updatedAt:X(e.updatedAt)}),yl=(e,t)=>hl({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:_l(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:X(e.createdAt)}),bl={id:R.id,agentId:R.agentId,version:R.version,definition:R.definition,commit:R.commit,importedFrom:R.importedFrom,createdAt:R.createdAt},xl=(e,t)=>{let{systemPrompt:n,files:r,...i}=yl({...e,systemPrompt:``,files:null},t);return i};function Sl(e){let t=fl(e.context);return hl({task:hl({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,connections:t.connections,author:e.author,definition:e.definition,credential:e.credential,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,toolScopes:e.toolScopes,context:t.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:gl(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,...t.runnerLogs?.handle===e.handle&&t.runnerLogs?.attempts===e.attempts&&t.runnerLogs?.generation===e.generation?{logsComplete:t.runnerLogs?.complete}:{},archivedAt:gl(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:X(e.createdAt),startedAt:gl(e.startedAt),finishedAt:gl(e.finishedAt),cancelRequestedAt:gl(e.cancelRequestedAt),updatedAt:X(e.updatedAt)})}async function Cl(e,t){let[n]=await e.db.select({id:J.id}).from(J).where(F(En(e.mine(J.organizationId),j(J.organizationId,``)),j(J.key,t)));if(!n)throw Error(`Unknown app "${t}".`);return n.id}async function wl(e,t){let[n]=await e.db.select({id:B.id}).from(B).where(F(e.mine(B.organizationId),j(B.slug,t)));if(!n)throw Error(`Unknown agent "${t}".`);return n.id}async function Tl(e,t){let[n]=await e.db.select({id:Y.id}).from(Y).where(F(e.mine(Y.organizationId),j(Y.key,t)));if(!n)throw Error(`Unknown installation "${t}".`);return n.id}async function El(e,t){let[n]=await e.db.select({id:z.id}).from(z).where(F(e.mine(z.organizationId),j(z.publicId,t)));if(!n)throw Error(`Unknown task "${t}".`);return n.id}function Dl(e,t){if(t.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:t.slice(6),keyVersion:0};let[n,r,i]=t.split(`.`);if(!n||!r||!i)throw Error(`Invalid encrypted secret`);return{iv:n,tag:r,ciphertext:i,keyVersion:tn(e.encryption,t)}}function Ol(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function kl(e,t,n){let[r]=await e.db.insert(N).values({organizationId:e.organizationId,kind:t,...Dl(e,n)}).returning({id:N.id});return r.id}async function Al(e,t,n){await e.db.update(N).set({...Dl(e,n),updatedAt:e.at()}).where(F(e.mine(N.organizationId),j(N.id,t)))}const jl=(e,t)=>`o:${JSON.stringify([e,t])}:`,Ml=(e,t,n)=>jl(e,t)+n;async function Nl(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}function Pl(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(B).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:Z(t.createdAt),updatedAt:Z(t.updatedAt)}).onConflictDoUpdate({target:[B.organizationId,B.slug],set:{slug:t.id}}).returning(),a=vl(i),[o]=a.currentVersion?await r.select().from(R).where(F(j(R.agentId,i.id),j(R.version,a.currentVersion))):[],s=o&&yl(o,t.id),c=!!(s&&ur(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&ur(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&ur(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let d=c?M``:M`with published as (
+      insert into ${R} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
+      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
+        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${Z(l.createdAt).toISOString()}::timestamptz)
+      returning version
+    )`;return await r.execute(M`${d} update ${B} set
+      name = ${u.name}, description = ${u.description??null}, source = ${u.source},
+      repo = ${u.repo??null}, path = ${u.path??null},
+      current_version = ${c?M`${l.version}`:M`(select version from published)`}, updated_at = ${Z(u.updatedAt).toISOString()}::timestamptz
+      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function Fl(e){let t=B;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(F(e.mine(t.organizationId),n)).orderBy(I(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:vl(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:Z(r.createdAt),updatedAt:Z(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(F(e.mine(t.organizationId),j(t.slug,n)))}}}async function Il(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(R).values({agentId:await wl(e,t.slice(0,r)),version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:Z(n.createdAt)}).onConflictDoNothing().returning({id:R.id})).length>0}function Ll(e){let t=R,n=M`${B.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>F(j(B.slug,e),n===void 0?void 0:r?j(t.version,n):yn(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:B.slug,key:n}).from(t).innerJoin(B,j(B.id,t.agentId)).where(F(e.mine(B.organizationId),r)).orderBy(I(B.slug),I(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:yl(e,t)}))},put:async(t,n)=>{await Il(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=await wl(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(F(j(t.agentId,i),j(t.version,Number(n.slice(r+1)))))}}}const Rl=(e,t)=>hl({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:Ol(t),createdAt:X(e.createdAt)});function zl(e){let t=J;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:N}).from(t).innerJoin(N,j(N.id,t.credentialsSecretId)).where(F(e.mine(t.organizationId),n)).orderBy(I(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:Rl(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:N}).from(t).innerJoin(N,j(N.id,t.credentialsSecretId)).where(F(e.mine(t.organizationId),j(t.key,n))),[a]=r.shared?await e.db.select({secretId:t.credentialsSecretId}).from(t).where(F(j(t.organizationId,``),j(t.key,r.shared))):[];if(r.shared&&!a)throw Error(`No shared app ${r.shared}`);let o=i?.secretId??a?.secretId??await kl(e,`app`,r.credentials);i&&!r.shared&&Ol(i.sealed)!==r.credentials&&await Al(e,o,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:o,createdAt:Z(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(F(e.mine(t.organizationId),j(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(N).where(F(j(N.id,r.secretId),e.mine(N.organizationId)))})}}function Bl(e,t,n){return hl({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?Ol(n):void 0,installer:e.installer,self:e.self,covers:e.covers,repos:e.repos,connections:e.connections,settings:e.settings,createdAt:X(e.createdAt),deletedAt:e.deletedAt?X(e.deletedAt):void 0})}function Vl(e,t,n){let r=n.app.split(`/`)[0],i=[t.slice(n.app.length+1),...n.covers??[]],a=M`array[${M.join(i.map(e=>M`${e}`),M`, `)}]::text[]`;return e.transaction(`binding:${r}`,async e=>{let[n]=await e.db.select({id:Y.id}).from(Y).innerJoin(J,j(J.id,Y.appId)).where(F(En(hn(Y.platformInstallId,i),M`${Y.covers} ?| ${a}`),Cn(Y.deletedAt),mn(Y.key,t),En(j(J.key,r),M`left(${J.key}, ${r.length+1}) = ${`${r}/`}`))).limit(1);if(n)throw new Ba(`Installation "${t}" is bound through another app.`)})}function Hl(e){let t=Y;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:J.key,integration:J.integration},sealed:N}).from(t).innerJoin(J,j(J.id,t.appId)).leftJoin(N,j(N.id,t.tokenSecretId)).where(F(e.mine(t.organizationId),n)).orderBy(I(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:Bl(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({secretId:t.tokenSecretId,organizationId:t.organizationId,sealed:N}).from(t).leftJoin(N,j(N.id,t.tokenSecretId)).where(j(t.key,n)),a=()=>Error(`Installation "${n}" belongs to another workspace.`);if(i&&i.organizationId!==e.organizationId)throw a();r.deletedAt===void 0&&await Vl(e,n,r);let o=i?.secretId??null;r.token&&(o?(!i?.sealed||Ol(i.sealed)!==r.token)&&await Al(e,o,r.token):o=await kl(e,`installation`,r.token));let s={appId:await Cl(e,r.app),platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?o:null,installer:r.installer??null,self:r.self??null,covers:r.covers??null,repos:r.repos??null,connections:r.connections??null,settings:r.settings??null,createdAt:Z(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:Z(r.deletedAt)},[c]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:t.key,set:s,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!c)throw a();!r.token&&i?.secretId&&await e.db.delete(N).where(j(N.id,i.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(F(e.mine(t.organizationId),j(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(N).where(j(N.id,r.secretId))})}}async function Ul(e,t){let n=Tn(Y,`locked`),[r]=await e.db.select({row:n,app:{key:J.key,integration:J.integration},sealed:N}).from(n).innerJoin(J,j(J.id,n.appId)).leftJoin(N,j(N.id,n.tokenSecretId)).where(F(e.mine(n.organizationId),j(n.key,t))).for(`update`,{of:n});return r&&Bl(r.row,r.app,r.sealed)}const Wl=(e,t)=>hl({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,engine:e.engine,owner:e.owner,account:e.account,isDefault:e.isDefault,createdAt:X(e.createdAt)}),Gl=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function Kl(e,t){let n=Ln;return(await e.db.select({row:n,sealed:N}).from(n).innerJoin(N,j(N.id,n.secretId)).where(F(e.mine(n.organizationId),t?j(n.owner,t):Cn(n.owner))).orderBy(I(n.label)).for(`update`)).map(({row:e,sealed:t})=>({id:Dp(e.owner??void 0,e.label),value:Wl(e,t),row:e,sealed:t}))}async function ql(e,t,n,r){let i=Ln;if(!r){if(!t)return;await e.db.delete(i).where(j(i.id,t.row.id)),await e.db.delete(N).where(j(N.id,t.row.secretId));return}let a=Ol(r),o={engine:r.engine,isDefault:r.isDefault??!1,account:r.account??null,createdAt:r.createdAt===void 0?t?.row.createdAt??e.at():Z(r.createdAt),updatedAt:e.at()};if(t){Ol(t.sealed)!==a&&await Al(e,t.row.secretId,a),await e.db.update(i).set(o).where(j(i.id,t.row.id));return}let{owner:s,label:c}=Op(n);await e.db.insert(i).values({organizationId:e.organizationId,owner:s??null,label:c,secretId:await kl(e,`engine`,a),...o})}function Jl(e){let t=Ln,n=(t,n)=>{let{owner:r}=Op(t);return e.transaction(Gl(e,r),async e=>ql(e,(await Kl(e,r)).find(e=>e.id===t),t,n))};return{key:M`coalesce(${t.owner} || '/', '') || ${t.label}`,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:N}).from(t).innerJoin(N,j(N.id,t.secretId)).where(F(e.mine(t.organizationId),n)).orderBy(I(M`coalesce(${t.owner} || '/', '') || ${t.label}`));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:Dp(e.owner??void 0,e.label),value:Wl(e,t)}))},put:(e,t)=>n(e,t),delete:e=>n(e,null)}}function Yl(e,t){let n=P,r=jl(e.organizationId,t),i=n.key;return{key:i,where:e=>F(e.id===void 0?M`${n.key} like ${`${ml(r+(e.prefix??``))}%`}`:j(n.key,r+e.id),e.after===void 0?void 0:yn(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:M`${n.value}`}).from(n).where(F(M`${n.key} like ${`${ml(r)}%`}`,e.live(n.expiresAt),t)).orderBy(I(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o;await e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?M`${n.expiresAt}`:s}})},delete:async i=>{await e.db.delete(n).where(j(n.key,r+(t===`config`?`workspace`:i)))}}}function Xl(e){let t=Vn,n=n=>F(e.mine(t.organizationId),j(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:N}).from(t).innerJoin(N,j(N.id,t.secretId)).where(F(e.mine(t.organizationId),n)).orderBy(I(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:hl({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?X(e.lastSeen):void 0,secret:Ol(t),createdAt:X(e.createdAt),updatedAt:X(e.updatedAt)})}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[a]=await e.db.select({id:t.id,secretId:t.secretId,sealed:N}).from(t).innerJoin(N,j(N.id,t.secretId)).where(n(r)),o={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:Z(i.lastSeen),updatedAt:Z(i.updatedAt)};if(a){Ol(a.sealed)!==i.secret&&await Al(e,a.secretId,i.secret),await e.db.update(t).set(o).where(j(t.id,a.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await kl(e,`runner`,i.secret),createdAt:Z(i.createdAt),...o})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(N).where(j(N.id,i.secretId))})}}function Zl(e,t){let n=Ml(e,`snapshot`,`connection-secrets:${t}`),r=Ml(e,`snapshot`,`connections:${t}:`);return M`(${P.key} = ${n} or ${P.key} like ${`${ml(r)}%`})`}function Ql(e){let t=z;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(F(e.mine(t.organizationId),n)).orderBy(I(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:Sl(e)}))},put:async(n,r,i,a={})=>{let{task:o}=r,s={source:o.source,status:r.status,agent:o.agent,flow:o.flow,runner:o.runner,permissions:o.permissions??null,appId:o.event?await Cl(e,o.event.appId):null,installationId:o.event?await Tl(e,`${o.event.appId}:${o.event.installationId}`):null,event:o.event??null,prompt:o.prompt??null,args:o.args??null,mcp:o.mcp??null,author:o.author??null,definition:o.definition,credential:o.credential??null,requester:o.requester??null,runnerId:o.runnerId??null,usage:o.usage??null,tools:o.tools,toolScopes:o.toolScopes??null,context:r.logsComplete===void 0?dl(o)??null:{...dl(o),runnerLogs:{complete:r.logsComplete,handle:r.handle,attempts:r.attempts,generation:r.generation??0}},files:o.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:Z(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:Z(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:Z(r.createdAt),startedAt:r.startedAt===void 0?null:Z(r.startedAt),finishedAt:r.finishedAt===void 0?null:Z(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:Z(r.cancelRequestedAt),updatedAt:Z(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...s,archivedAt:a.unarchive?s.archivedAt:M`coalesce(${t.archivedAt}, ${s.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(F(e.mine(t.organizationId),j(t.publicId,n)))}}}function $l(e){let t=In,n=M`${z.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>F(e.mine(z.organizationId),j(z.publicId,n),r===void 0?void 0:i?j(t.seq,r):yn(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(z,j(z.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(I(z.publicId),I(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:X(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:Z(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:await El(e,n.slice(0,i)),seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=await El(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(F(j(t.taskId,i),j(t.seq,Number(n.slice(r+1)))))}}}function eu(e){let t=L,n=M`${z.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>F(e.mine(z.organizationId),j(z.publicId,n),r===void 0?void 0:i?j(t.seq,r):yn(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(z,j(z.id,t.taskId)).where(F(e.mine(t.organizationId),r)).orderBy(I(z.publicId),I(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:X(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:await El(e,n.slice(0,i)),seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:Z(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=await El(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(F(j(t.taskId,i),j(t.seq,Number(n.slice(r+1)))))}}}function tu(e){let t=jn;return{key:z.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:z.publicId,installationId:Y.key}).from(t).innerJoin(z,j(z.id,t.taskId)).leftJoin(Y,j(Y.id,t.installationId)).where(F(e.mine(t.organizationId),n)).orderBy(I(z.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:hl({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:X(e.at)})}))},put:async(n,r)=>{let i=await El(e,n),a={installationId:r.installationId?await Tl(e,r.installationId):null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:Z(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=await El(e,n).catch(()=>void 0);r!==void 0&&await e.db.delete(t).where(j(t.taskId,r))}}}var nu=r({DrizzleStore:()=>ru}),ru=class e{db;organizationId;now;encryption;publishAgent=(e,t)=>Pl(this,e,t);kinds;constructor(e,t,n=Date.now,r={}){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.kinds={agent:Fl(this),agentversion:Ll(this),app:zl(this),installation:Hl(this),credential:Jl(this),task:Ql(this),tasklog:$l(this),inbox:eu(this),usage:tu(this),delivery:Yl(this,`delivery`),note:Yl(this,`note`),login:Yl(this,`login`),config:Yl(this,`config`),runner:Xl(this),snapshot:Yl(this,`snapshot`),connection:Yl(this,`connection`)}}static async webhookTarget(e,t,n){let r=Tn(N,`installation_secret`),[i]=await q(e,()=>e.select({app:J,credentials:N,installation:Y,token:r}).from(J).innerJoin(N,j(N.id,J.credentialsSecretId)).leftJoin(Y,F(j(Y.appId,J.id),j(Y.key,n??``),Cn(Y.deletedAt))).leftJoin(r,j(r.id,Y.tokenSecretId)).where(F(j(J.integration,t.slice(0,t.indexOf(`:`))),j(J.platformAppId,t.slice(t.indexOf(`:`)+1)))));if(i&&!i.installation&&n){let a=`${i.app.platformAppId}/`,[o]=await q(e,()=>e.select({app:J,credentials:N,installation:Y,token:r}).from(Y).innerJoin(J,j(J.id,Y.appId)).innerJoin(N,j(N.id,J.credentialsSecretId)).leftJoin(r,j(r.id,Y.tokenSecretId)).where(F(j(J.integration,i.app.integration),M`left(${J.platformAppId}, ${a.length}) = ${a}`,j(Y.platformInstallId,n.slice(t.length+1)),Cn(Y.deletedAt))).limit(1));if(o)return{organizationId:o.app.organizationId,app:Rl(o.app,o.credentials),bound:{organizationId:o.installation.organizationId,installation:Bl(o.installation,o.app,o.token)}}}return i&&{organizationId:i.app.organizationId,app:Rl(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:Bl(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await q(e,()=>e.select({row:J,sealed:N}).from(J).innerJoin(N,j(N.id,J.credentialsSecretId)).where(F(j(J.integration,t.slice(0,t.indexOf(`:`))),j(J.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:Rl(n.row,n.sealed)}}static async apps(e,t){return(await q(e,()=>e.select({row:J,sealed:N}).from(J).innerJoin(N,j(N.id,J.credentialsSecretId)).where(j(J.integration,t)))).map(({row:e,sealed:t})=>({organizationId:e.organizationId,app:Rl(e,t)}))}static async installationOrganization(e,t){let[n]=await q(e,()=>e.select({organizationId:Y.organizationId}).from(Y).where(j(Y.key,t)));return n?.organizationId}static async installations(e,t){return q(e,()=>e.select({key:Y.key,organizationId:Y.organizationId}).from(Y).where(F(M`${Y.key} like ${`${ml(t)}:%`}`,Cn(Y.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await q(e,()=>e.select({organizationId:z.organizationId}).from(z).where(F(j(z.publicId,t),j(z.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await q(this.db,()=>this.db.select({row:J,sealed:N}).from(J).innerJoin(N,j(N.id,J.credentialsSecretId)).where(F(hn(J.organizationId,[this.organizationId,``]),hn(J.key,e))))).map(e=>({id:e.row.key,value:Rl(e.row,e.sealed)})):[]}async listCredentials(e){let t=Ln,n=this.db.select({row:t,sealed:N}).from(t).innerJoin(N,j(N.id,t.secretId)).where(F(this.mine(t.organizationId),e.owner?En(Cn(t.owner),j(t.owner,e.owner)):Cn(t.owner),e.engine?j(t.engine,e.engine):void 0)).orderBy(I(t.engine),I(M`case when ${t.owner} is null then 'workspace' else 'personal' end`),I(t.label));return(await q(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({row:e,sealed:t})=>({id:Dp(e.owner??void 0,e.label),value:Wl(e,t)}))}async updateMetadata(e,t,n){return e===`installation`&&(`covers`in n||`deletedAt`in n)?this.transaction(`installation:${t}`,async r=>{let i=await r.get(`installation`,t);if(!i)return!1;let a={...i,...n};return a.deletedAt===void 0&&await Vl(r,t,a),r.writeMetadata(e,t,n)}):this.writeMetadata(e,t,n)}async writeMetadata(e,t,n){let r=e===`app`?J:e===`installation`?Y:Vn,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`self`,`covers`,`repos`,`connections`,`settings`,`deletedAt`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?Z(t):t])),o=e===`runner`?Vn.publicId:e===`app`?J.key:Y.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?Z(n.updatedAt):this.at()}).where(F(this.mine(r.organizationId),j(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){let n=/^connections?[:-]/.test(e)?`${this.organizationId}:${e}`:e;return this.transaction(`app:${n}`,t)}withConfigLock(t){return this.db.transaction(async n=>{let r=Ml(this.organizationId,`config`,`workspace`);return await n.insert(P).values({key:r,value:{},expiresAt:null}).onConflictDoNothing(),await n.select({key:P.key}).from(P).where(j(P.key,r)).for(`update`),t(new e(n,this.organizationId,this.now,this.encryption))})}transaction(t,n){return this.db.transaction(async r=>(await r.execute(M`select pg_advisory_xact_lock(3, hashtext(${t}))`),n(new e(r,this.organizationId,this.now,this.encryption))))}withCredential(e,t,n){if(e===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>Ua(e,`runner`,t,n));if(e===`installation`)return this.transaction(`installation:${t}`,async e=>{let r=await Ul(e,t),i=await n(r,r?[{id:t,value:r}]:[],e);for(let t of i??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!i?.length});let{owner:r}=Op(t);return this.transaction(Gl(this,r),async e=>{let i=await Kl(e,r),a=i.map(({id:e,value:t})=>({id:e,value:t})),o=await n(a.find(e=>e.id===t)?.value,a,e);for(let t of o??[])await ql(e,i.find(e=>e.id===t.id),t.id,t.value);return!!o?.length})}at(){return Z(this.now())}live(e){return En(Cn(e),yn(e,this.at()))}mine(e){return j(e,this.organizationId)}async get(t,n){let r=this.kinds[t],i=pl(n),a=r.where?r.where({id:n}):r.split&&i?r.split(i[0],i[1],!0):M`${r.key} = ${n}`,o=(await q(this.db,async()=>await r.rows(a,1)))[0]?.value;return o||t!==`app`||this.organizationId===``?o:new e(this.db,``,this.now,this.encryption).get(t,n)}async patchLogin(e,t,n={}){let[r]=await this.db.update(P).set({value:M`jsonb_strip_nulls(${P.value} || ${JSON.stringify(t)}::jsonb)`}).where(F(j(P.key,Ml(this.organizationId,`login`,e)),this.live(P.expiresAt),M`(${P.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?hn(M`${P.value}->>${e}`,t):M`${P.value}->>${e} = ${t}`))).returning({value:M`${P.value}`});return r?.value}completeLogin(e,t,n,r){return Up(this,e,t,n,r)}async taskInputs(e,t,n){let r=M`coalesce(${n??null}, ${B.settings}->>'engine', ${R.definition}->>'engine')`,i=this.db.select({owner:Ln.owner,label:Ln.label}).from(Ln).where(F(this.mine(Ln.organizationId),t?En(Cn(Ln.owner),j(Ln.owner,t)):Cn(Ln.owner),M`(${r} is null or ${Ln.engine} = ${r})`)).orderBy(M`${Ln.owner} is not null desc`,cn(Ln.isDefault),I(Ln.label)).limit(1).as(`selected_credential`),[a]=await q(this.db,()=>this.db.select({record:B,version:R,credentialLabel:i.label,credentialOwner:i.owner}).from(B).leftJoin(R,F(j(R.agentId,B.id),j(R.version,B.currentVersion))).leftJoinLateral(i,M`true`).where(F(this.mine(B.organizationId),j(B.slug,e))));return a?{record:vl(a.record),...a.version?{version:yl(a.version,a.record.slug)}:{},...a.credentialLabel?{credential:Dp(a.credentialOwner??void 0,a.credentialLabel)}:{}}:{}}async listAgentsWithVersions(e){return(await q(this.db,()=>this.db.select({record:B,version:R}).from(B).leftJoin(R,F(j(R.agentId,B.id),j(R.version,B.currentVersion))).where(F(this.mine(B.organizationId),e===void 0?void 0:j(B.slug,e))).orderBy(I(B.slug)))).map(({record:e,version:t})=>({record:vl(e),...t?{version:yl(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${ml(e.q)}%`:void 0,n=this.db.select({record:B,version:bl}).from(B).leftJoin(R,F(j(R.agentId,B.id),j(R.version,B.currentVersion))).where(F(this.mine(B.organizationId),e.slug===void 0?void 0:j(B.slug,e.slug),e.after?yn(B.slug,e.after):void 0,e.source?j(B.source,e.source):void 0,t?En(fn(B.slug,t),fn(B.name,t),fn(B.description,t),fn(B.repo,t)):void 0,e.platform?M`${R.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(I(B.slug));return(await q(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({record:e,version:t})=>({record:vl(e),...t?{version:xl(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:bl}).from(R).innerJoin(B,j(B.id,R.agentId)).where(F(this.mine(B.organizationId),j(B.slug,e),n===void 0?t===void 0?void 0:Dn(R.version,B.currentVersion):ln(R.version,n),t===void 0?void 0:xn(R.version,n===void 0?M`${B.currentVersion} + 1 - ${t}`:n-t))).orderBy(I(R.version));return(await q(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:xl(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:Z(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i,r)}async putMany(e,t){if(!t.length)return;if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value)));return}let n=t[0].id.lastIndexOf(`:`),r=t[0].id.slice(0,n),i=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==r)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:M`(select ${z.id} from ${z} where ${z.organizationId} = ${this.organizationId} and ${z.publicId} = ${r})`,seq:Number(e.id.slice(t+1)),at:Z(n.at),level:n.level,line:n.line}});await this.db.insert(In).values(i).onConflictDoUpdate({target:[In.taskId,In.seq],set:{at:M`excluded.at`,level:M`excluded.level`,line:M`excluded.line`}})}async list(e,t={}){let n=this.kinds[e],r=[];if(t.ids&&r.push(t.ids.length?hn(M`${n.key}`,t.ids.map(t=>n.where?Ml(this.organizationId,e,t):t)):M`false`),t.runner&&r.push(e===`runner`?En(j(Vn.publicId,t.runner),j(Vn.name,t.runner)):M`false`),t.defaults&&r.push(e===`runner`?j(Vn.isDefault,!0):M`false`),t.installation&&r.push(e===`usage`?j(Y.key,t.installation):M`false`),t.agent&&r.push(e===`app`||e===`installation`?j(J.agent,t.agent):e===`agent`?j(B.slug,t.agent):M`false`),t.active&&r.push(e===`installation`?Cn(Y.deletedAt):void 0),t.apps&&r.push(e===`installation`&&t.apps.length?hn(J.key,t.apps):M`false`),Object.hasOwn(t,`visibleTo`)){let n=e===`runner`?Vn.owner:e===`credential`?Ln.owner:M`${P.value}->>'owner'`;r.push(En(Cn(n),t.visibleTo?j(M`${n}`,t.visibleTo):void 0))}if(n.where)return q(this.db,async()=>await n.rows(F(n.where(t),...r),t.limit));let i=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,a=t.after===void 0?void 0:pl(t.after);if(n.split&&i&&!i.includes(`:`)&&(t.after===void 0||a?.[0]===i))return q(this.db,async()=>await n.rows(n.split(i,a?.[1]),t.limit));let o=t.prefix?M`${n.key} like ${`${ml(t.prefix)}%`}`:void 0,s=t.after?M`${n.key} > ${t.after}`:void 0,c=F(o,s,...r);return q(this.db,async()=>await n.rows(c,t.limit))}async delete(e,t){await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return Il(this,t,n);if(e!==`delivery`&&e!==`connection`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:Z(this.now()+r.ttlMs);return(await this.db.insert(P).values({key:Ml(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:P.key,set:{value:n,expiresAt:i},setWhere:Dn(P.expiresAt,this.at())}).returning({key:P.key})).length>0}async claimDeliveryLease(e,t,n){let r=M`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(P).values({key:Ml(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:P.key,set:{value:M`${P.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:M`${P.expiresAt} <= clock_timestamp()`}).returning({value:P.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=F(j(P.key,Ml(this.organizationId,`delivery`,e)),M`${P.value}->>'owner' = ${t} and ${P.expiresAt} > clock_timestamp()`),a=M`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(P).where(i).returning({key:P.key}):await this.db.update(P).set({value:n.next===void 0?n:M`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:P.key})).length>0}async updateDelivery(e,t,n,r={}){let i=F(j(P.key,Ml(this.organizationId,`delivery`,e)),M`${P.value}->>'owner' = ${t}`,this.live(P.expiresAt));return(n===void 0?await this.db.delete(P).where(i).returning({key:P.key}):await this.db.update(P).set({value:n,expiresAt:r.ttlMs===void 0?null:Z(this.now()+r.ttlMs)}).where(i).returning({key:P.key})).length>0}async take(e,t){return e===`delivery`?(await this.db.delete(P).where(F(j(P.key,Ml(this.organizationId,e,t)),this.live(P.expiresAt))).returning({key:P.key})).length>0:await this.get(e,t)!==void 0&&(await this.delete(e,t),!0)}async usageSummary(e,t){let n=M`case groups.kind when 'agent' then ${jn.agent} when 'engine' then coalesce(${jn.engine}, 'unknown') else coalesce(${Y.key}, 'none') end`,r=t?n:M`groups.kind || ':' || (${n})`,i=await q(this.db,()=>this.db.execute(M`
+      with recursive records as (
+        select ${r} as key, ${jn.runnerMs} as runner_ms, ${jn.tokens} as tokens,
+          row_number() over (partition by ${r} order by ${z.publicId}) as n
+        from ${jn} inner join ${z} on ${z.id} = ${jn.taskId}
+        left join ${Y} on ${Y.id} = ${jn.installationId}
+        cross join unnest(${M.param(t?[t]:[`agent`,`installation`,`engine`])}::text[]) groups(kind)
+        where ${this.mine(jn.organizationId)} and ${jn.at} >= ${new Date(e).toISOString()}::timestamptz
+      ), nodes(key, path, n, value) as (
+        select key, '{}'::text[], n, tokens from records where tokens is not null
+        union all
+        select nodes.key, nodes.path || child.key, nodes.n, child.value from nodes
+        cross join lateral jsonb_each(case when jsonb_typeof(nodes.value) = 'object' then nodes.value else '{}'::jsonb end) child
+      ), resolved(key, path, kind, cutoff) as (
+        select keys.key, '{}'::text[], latest.kind, coalesce((
+          select max(n) from nodes where nodes.key = keys.key and path = '{}'::text[]
+            and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
+        ), 0) from (select distinct key from records) keys
+        cross join lateral (
+          select jsonb_typeof(value) as kind from nodes where nodes.key = keys.key and path = '{}'::text[]
+            and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
+        ) latest
+        union all
+        select parent.key, child.path, latest.kind, greatest(parent.cutoff, coalesce((
+          select max(n) from nodes where nodes.key = parent.key and nodes.path = child.path
+            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') and jsonb_typeof(value) <> latest.kind
+        ), 0)) from resolved parent
+        cross join lateral (
+          select distinct path[1:cardinality(parent.path) + 1] as path from nodes
+          where nodes.key = parent.key and n > parent.cutoff and cardinality(path) > cardinality(parent.path)
+            and path[1:cardinality(parent.path)] = parent.path
+        ) child
+        cross join lateral (
+          select jsonb_typeof(value) as kind from nodes where nodes.key = parent.key and nodes.path = child.path
+            and n > parent.cutoff and jsonb_typeof(value) in ('number', 'object') order by n desc limit 1
+        ) latest where parent.kind = 'object'
+      ), sums as (
+        select key, path, case when kind = 'object' then '{}'::jsonb else to_jsonb((
+          select sum(case when jsonb_typeof(value) = 'number' then (value #>> '{}')::numeric end)::float8
+          from nodes where nodes.key = resolved.key and nodes.path = resolved.path and n > cutoff
+        )) end as value from resolved
+      ) select key, count(*)::int as tasks, sum(runner_ms)::float8 as runner_ms,
+        (select jsonb_agg(jsonb_build_object('path', path, 'value', value) order by path) from sums where sums.key = records.key) as tokens
+        from records group by key order by key
+    `)),a=(Array.isArray(i)?i:i.rows).map(e=>{let t;for(let n of e.tokens??[]){if(!n.path.length){t=typeof n.value==`number`?n.value:Object.create(null);continue}let e=t&&typeof t==`object`?t:Object.create(null);t=e;let r=e;for(let e of n.path.slice(0,-1))r=r[e]??=Object.create(null);Object.defineProperty(r,n.path.at(-1),{value:typeof n.value==`number`?n.value:Object.create(null),enumerable:!0,configurable:!0,writable:!0})}return{key:e.key,tasks:e.tasks,runnerMs:e.runner_ms,...t===void 0?{}:{tokens:t}}});if(t)return a;let o={agent:[],installation:[],engine:[]};for(let e of a){let t=e.key.indexOf(`:`);o[e.key.slice(0,t)].push({...e,key:e.key.slice(t+1)})}return o}async usageTotals(e){let t=jn,n=e.by===`agent`?M`${t.agent}`:e.by===`engine`?M`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?M`coalesce(${Y.key}, 'none')`:M`to_char(${t.at} at time zone ${Qc(e.tz)}, 'YYYY-MM-DD')`,r=F(this.mine(t.organizationId),xn(t.at,Z(e.since)),e.until===void 0?void 0:ln(t.at,Z(e.until)),e.agent?j(t.agent,e.agent):void 0),i=M`coalesce(
+      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
+      (select sum((v #>> '{}')::numeric)
+        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
+        where jsonb_typeof(v) = 'number')
+    )`,a={tasks:M`count(*)`,runnerMs:M`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:M`coalesce(sum(${i}), 0)`},o=e.top?M`case when ${t.agent} in (
+          select ${t.agent} from ${t} where ${r} group by ${t.agent}
+          order by ${a[e.top.by]} desc, ${t.agent} limit ${e.top.count}
+        ) then ${t.agent} end`:e.parts?.length?M`case when ${hn(t.agent,e.parts)} then ${t.agent} end`:M`null::text`,s=e.by===`installation`?M`left join ${Y} on ${Y.id} = ${t.installationId}`:M``,c=await q(this.db,()=>this.db.execute(M`
+      select ${n} as key, ${o} as part, ${a.tasks}::int as tasks,
+        ${a.runnerMs}::float8 as runner_ms,
+        ${a.tokenCount}::float8 as token_count
+      from ${t} ${s}
+      where ${r}
+      group by 1, 2
+    `)),l=Array.isArray(c)?c:c.rows,u=new Map;for(let e of l){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=u.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};$c(n,t),e.part&&((n.parts??={})[e.part]=t),u.set(e.key,n)}return[...u.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(M`
+      with expired_state as (
+        delete from ${P} where expires_at <= clock_timestamp() and key in (
+          select key from ${P} where expires_at <= clock_timestamp() order by expires_at limit ${e}
+        )
+      ), lists as (
+        select expired.key from ${zn} as expired
+        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
+          and not exists (select 1 from ${zn} as newer where newer.key = expired.key and newer.seq > expired.seq)
+        order by expired.expires_at limit ${e}
+      ), expired_items as (
+        select key, seq from ${zn} where key in (select key from lists) order by seq limit ${e}
+      ), expired_queue as (
+        select key, seq from ${zn} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
+      )
+      delete from ${zn} where (key, seq) in (
+        select key, seq from expired_items union all select key, seq from expired_queue
+      )`)}};const iu=ct;function au(e,t,n,r=or(32).toString(`base64url`)){let i=`${jt({task:e,organization:t,attempt:n})}.${r}`;return{token:i,hash:iu(i)}}function ou(e){try{return Mt(e.slice(0,e.indexOf(`.`)))}catch{return{}}}var su=r({DrizzleQueue:()=>mu});function cu(e,t){if(typeof t==`number`)return M`to_jsonb(coalesce(case when jsonb_typeof(${e}) = 'number' then (${e} #>> '{}')::numeric end, 0) + ${t}::numeric)`;if(!t||typeof t!=`object`||Array.isArray(t))return e;let n=Object.entries(t).map(([t,n])=>M`${t}::text, ${cu(M`(${e} -> ${t}::text)`,n)}`);return M`(case when jsonb_typeof(${e}) = 'object' then ${e} else '{}'::jsonb end || jsonb_build_object(${M.join(n,M`, `)}))`}const lu=e=>M`(case ${e} ${M.join([...qm,...te].map(e=>M`when ${e} then ${M.raw(String(ae(e)))}`),M` `)} end)`,uu=e=>M`date_trunc('milliseconds', ${e})`,du=e=>M`${e} collate "C"`,fu=e=>[I(lu(e.status)),cn(uu(e.createdAt)),cn(du(e.publicId))],pu=e=>[I(e.updatedAt),I(du(e.publicId))];var mu=class{db;constructor(e){this.db=e}async metrics(e,t){let n=await this.db.select({status:z.status,total:M`count(*)::int`,recent:M`count(*) filter (where ${z.createdAt} >= ${new Date(t).toISOString()}::timestamptz)::int`}).from(z).where(j(z.organizationId,e)).groupBy(z.status),r={tasks:{queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},queueDepth:0};for(let e of n)r.tasks[e.status]=e.recent,e.status===`queued`&&(r.queueDepth=e.total);return r}where(e,t){return F(j(z.organizationId,e),j(z.publicId,t))}fence(e,t,n={}){return F(this.where(e,t),n.generation===void 0?void 0:j(z.generation,n.generation),n.attempts===void 0?void 0:j(z.attempts,n.attempts),n.tokenHash===void 0?void 0:n.tokenHash===null?Cn(z.tokenHash):j(z.tokenHash,n.tokenHash),n.handle===void 0?void 0:n.handle===null?Cn(z.handle):j(z.handle,n.handle),n.lastSeenAt===void 0?void 0:n.lastSeenAt===null?Cn(z.lastSeenAt):j(z.lastSeenAt,new Date(n.lastSeenAt)),n.updatedAt===void 0?void 0:j(z.updatedAt,new Date(n.updatedAt)),n.statuses?hn(z.status,n.statuses):void 0)}async enqueue(e,t,n,r,i){let a=this.insertion(e,t,n,r,i),[o]=i===void 0?await Nl(this.db,a):await Kc(this.db,[M`select pg_advisory_xact_lock(1, hashtext(${e}))`],a);if(!o?.allowed)throw Error(`Organization task queue is full`);return!!o.inserted}insertion(e,t,n,r,i,a){let o=t.event,s=new Date(n).toISOString(),c=e=>M`${e===void 0?null:JSON.stringify(e)}::jsonb`,l=r?M`
+      receipt as (
+        insert into ${P} (key, value, expires_at)
+        select ${Ml(e,`delivery`,r.key)}, ${c({at:n})}, ${new Date(n+r.ttlMs).toISOString()}::timestamptz
+        from capacity where allowed ${a?M`and (${a.create} or exists (select 1 from target))`:M``}
+        on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
+          where ${P.expiresAt} <= ${s}::timestamptz
+        returning key
+      ),`:M``;return M`
+      with ${a?M`target as materialized (${a.target}),`:M``} capacity as (
+        select ${i===void 0?M`true`:M`(select count(*) from ${z} where organization_id = ${e} and status = 'queued') < ${i} ${r?M`or exists (select 1 from ${P} where key = ${Ml(e,`delivery`,r.key)} and expires_at > ${s}::timestamptz)`:M``}`} ${a?M`or exists (select 1 from target) or not ${a.create}`:M``} as allowed
+      ), ${l} ${a?M`advanced as (
+        update ${z} set inbox_seq = inbox_seq + 1, updated_at = ${s}::timestamptz where id in (select id from target) and exists (select 1 from receipt)
+        returning id, inbox_seq, generation
+      ), forwarded as (
+        insert into ${L} (organization_id, task_id, seq, generation, at, kind, value)
+        select ${e}, id, inbox_seq, generation, ${s}::timestamptz, 'steer', ${c({text:o?.text})} from advanced returning seq
+      ),`:M``} inserted as (
+        insert into ${z} (organization_id, public_id, source, status, agent, flow, runner, permissions,
+          app_id, installation_id, event, prompt, args, mcp, author, definition, credential, requester,
+          runner_id, usage, tools, tool_scopes, context, files, attempts, created_at, updated_at)
+        select ${e}, ${t.id}, ${t.source}, 'queued', ${t.agent}, ${t.flow}, ${t.runner}, ${t.permissions??null},
+          ${o?M`coalesce((select id from ${Bn} where key = ${o.appId} and organization_id in (${e}, '')), 0)`:M`null`},
+          ${o?M`coalesce((select id from ${Nn} where key = ${`${o.appId}:${o.installationId}`} and organization_id = ${e}), 0)`:M`null`},
+          ${c(o)}, ${t.prompt??null}, ${c(t.args)}, ${c(t.mcp)}, ${t.author??null}, ${c(t.definition)},
+          ${t.credential??null}, ${t.requester??null}, ${t.runnerId??null}, ${c(t.usage)}, ${c(t.tools)},
+          ${c(t.toolScopes)}, ${c(dl(t))}, ${c(t.files)}, 0, ${s}::timestamptz, ${s}::timestamptz
+        from capacity where allowed ${a?M`and ${a.create} and not exists (select 1 from target)`:M``} ${r?M`and exists (select 1 from receipt)`:M``}
+        returning id
+      ) select allowed, exists (select 1 from inserted) as inserted ${a?M`, exists (select 1 from forwarded) as steered`:M``} from capacity`}async deliver(e,t,n,r,i,a,o=!0){if(!i)return o&&await this.enqueue(e,t,n,r,a)?{taskId:t.id}:{};let s=t.event,c=M`select id from ${z} where organization_id = ${e} and status in ('queued', 'running', 'waiting')
+      and agent = ${t.agent} and source = ${t.source} and flow = 'default'
+      and requester is not distinct from ${t.requester??null}
+      and event->>'appId' is not distinct from ${s?.appId??null}
+      and event->>'installationId' is not distinct from ${s?.installationId??null}
+      and event->'chat'->'thread'->>'id' is not distinct from ${s?.chat?.thread.id??null}
+      and event->'actor'->>'id' = ${s?.actor.id||null}
+      order by created_at desc, public_id desc limit 1 for update`,l=this.insertion(e,t,n,r,a,{target:c,create:o}),u=[M`select pg_advisory_xact_lock(3, hashtext(${JSON.stringify([e,eh(t)])}))`];a!==void 0&&o&&u.push(M`select pg_advisory_xact_lock(1, hashtext(${e}))`);let[d]=await Kc(this.db,u,l);if(!d?.allowed)throw Error(`Organization task queue is full`);return d.inserted?{taskId:t.id}:d.steered?{steered:!0}:{}}async claim(e,t,n=!1,r){let i=r===void 0?M`true`:M`(select count(*) from ${z} active where active.organization_id = ${z.organizationId} and active.status in ('running', 'waiting')) < ${r}`;if(!n){let[e]=await q(this.db,()=>Nl(this.db,M`select exists (select 1 from ${z} where status = 'queued' and ${i})
+        and ${t===void 0?M`true`:M`(select count(*) from ${z} where status in ('running', 'waiting')) < ${t}`} as ready`));if(!e?.ready)return}let a=or(32).toString(`base64url`),o=M`translate(rtrim(replace(encode(convert_to(format('{"task":%s,"organization":%s,"attempt":%s}',
+      to_json(public_id), to_json(organization_id), attempts + 1), 'UTF8'), 'base64'), E'\\n', ''), '='), '+/', '-_') || '.' || ${a}`,s=M`with stamp as materialized (select date_trunc('milliseconds', clock_timestamp()) as at), picked as materialized (
+      select id, ${o} as bearer from ${z} where status = 'queued'
+        and ${i}
+        ${t===void 0?M``:M`and (select count(*) from ${z} where status in ('running', 'waiting')) < ${t}`}
+        order by created_at, id limit 1 for update
+      ), claimed as (
+        update ${z} set status = 'running', attempts = attempts + 1, locked_at = (select at from stamp),
+          started_at = (select at from stamp), updated_at = (select at from stamp), last_seen_at = (select at from stamp),
+          token_hash = translate(rtrim(encode(sha256(convert_to(picked.bearer, 'UTF8')), 'base64'), '='), '+/', '-_')
+        from picked where ${z.id} = picked.id returning ${z}.*
+      ) select to_jsonb(claimed) as record, exists (select 1 from ${z} where status = 'queued' and id <> claimed.id
+        and ${r===void 0?M`true`:M`(select count(*) from ${z} active where active.organization_id = ${z.organizationId} and active.status in ('running', 'waiting')) + case when ${z.organizationId} = claimed.organization_id then 1 else 0 end < ${r}`})
+        and ${t===void 0?M`true`:M`(select count(*) from ${z} where status in ('running', 'waiting')) + 1 < ${t}`} as more from claimed`,[c]=await Kc(this.db,t===void 0&&r===void 0?[]:[M`select pg_advisory_xact_lock(2, 0)`],s);if(!c)return;let l=new Un(Uc),u=Object.fromEntries(Object.entries(On(z)).map(([e,t])=>{let n=c.record[l.getColumnCasing(t)];return[e,n===null?null:t.mapFromDriverValue(n)]}));return{organizationId:u.organizationId,status:Sl(u),token:au(u.publicId,u.organizationId,u.attempts,a).token,more:c.more}}async touch(e,t,n,r,i,a=!1){let o=hn(z.status,[`running`,`waiting`]),s=new Date(i).toISOString(),[c]=await this.db.update(z).set({lastSeenAt:M`case when ${o} then ${s}::timestamptz else ${z.lastSeenAt} end`,updatedAt:M`case when ${o} then ${s}::timestamptz else ${z.updatedAt} end`}).where(this.fence(e,t,{tokenHash:n,attempts:r,statuses:a?[`running`,`waiting`,`completed`,`failed`,`cancelled`]:[`running`,`waiting`]})).returning();return c&&Sl(c)}async patchTask(e,t,n,r,i={}){let{answer:a,archivedAt:o,autoArchived:s,lastSeenAt:c,logsComplete:l,...u}=n,[d]=await this.db.update(z).set({...Object.fromEntries(Object.entries(u).map(([e,t])=>[e,t??null])),...l===void 0?{}:{context:M`jsonb_set(coalesce(${z.context}, '{}'::jsonb), '{runnerLogs}', coalesce(${z.context}->'runnerLogs', '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object('complete', ${l??null}::boolean, 'handle', ${z.handle}, 'attempts', ${z.attempts}, 'generation', ${z.generation})))`},...a===void 0?{}:{answer:M`coalesce(${z.answer}, '[]'::jsonb) || ${JSON.stringify([a])}::jsonb`},...Object.hasOwn(n,`archivedAt`)?{archivedAt:o===void 0?null:new Date(o)}:{},...Object.hasOwn(n,`lastSeenAt`)?{lastSeenAt:c===void 0?null:new Date(c)}:{},updatedAt:new Date(r)}).where(this.fence(e,t,i)).returning({id:z.id});return!!d}async archiveStopped(e,t,n){await this.db.update(z).set({archivedAt:new Date(t),updatedAt:new Date(t)}).where(F(e===void 0?void 0:j(z.organizationId,e),n?hn(z.publicId,n):void 0,Cn(z.archivedAt),hn(z.status,[...te]),ln(M`coalesce(${z.finishedAt}, ${z.updatedAt})`,M`${new Date(t-se).toISOString()}::timestamptz`)))}async requeue(e,t,n,r={}){let[i]=await this.db.update(z).set({status:`queued`,lockedAt:null,handle:null,tokenHash:null,lastSeenAt:null,updatedAt:new Date(n)}).where(this.fence(e,t,{...r,statuses:[`running`,`waiting`]})).returning({id:z.id});return!!i}withConnections(e,t,n){return this.db.transaction(async r=>(await r.execute(M`select pg_advisory_xact_lock(3, hashtext(${`app:${e}:connections:${t}`}))`),n(r)))}async finish(e,t,n,r,i={}){let a=new Date(r);return this.withConnections(e,t,async r=>{let[o]=await r.update(z).set({status:n.status,result:n.result??null,error:n.error??null,tokens:n.tokens??null,lastSeenAt:a,lockedAt:null,finishedAt:a,updatedAt:a}).where(this.fence(e,t,{...i,statuses:[`queued`,`running`,`waiting`]})).returning({id:z.id});return o&&await r.delete(P).where(Zl(e,t)),!!o})}async continueTask(e,t,n,r,i){let a=M`(select value from ${P} where key = ${jl(e,`note`)} ||
+      case when ${z.source} = ${z.event}->>'integration' then
+        (${z.event}->>'appId') || ':' || (${z.event}->>'installationId') || ':' || coalesce(${z.event}->'chat'->'thread'->>'id', ${z.event}->>'deliveryId')
+        else 'task:' || ${z.publicId} end
+      and (${P.expiresAt} is null or ${P.expiresAt} > ${new Date(r).toISOString()}::timestamptz))`,o=M`(${JSON.stringify(n.context??{})}::jsonb - 'note' - 'connections') || jsonb_strip_nulls(jsonb_build_object('connections', ${z.context}->'connections', 'note', nullif(${a}, '""'::jsonb)))`,[s]=await this.db.update(z).set({prompt:n.prompt??null,context:o,status:`queued`,attempts:0,generation:M`${z.generation} + 1`,inboxAck:-1,result:null,error:null,tokens:null,handle:null,tokenHash:null,lastSeenAt:null,logCursor:null,lockedAt:null,startedAt:null,finishedAt:null,cancelRequestedAt:null,approval:null,answer:null,archivedAt:null,updatedAt:new Date(r)}).where(this.fence(e,t,{...i,statuses:[`completed`,`failed`,`cancelled`]})).returning({context:z.context});return s&&(n.context=fl(s.context).context),!!s}async completeTask(e,t,n,r){return this.withConnections(e,t,async i=>{let{outcome:a,usage:o,note:s}=n,c=new Date(r).toISOString(),l=s&&Ml(e,`note`,s.key),u=s?s.value?M`, note as (
+      insert into ${P} (key, value, expires_at)
+      select ${l}, ${JSON.stringify(s.value)}::jsonb, ${new Date(r+s.ttlMs).toISOString()}::timestamptz from finished
+      on conflict (key) do update set value = excluded.value, expires_at = excluded.expires_at
+    )`:M`, note as (delete from ${P} where key = ${l} and exists (select 1 from finished))`:M``,[d]=await Nl(i,M`
+      with finished as (
+        update ${z} set status = ${a.status}, result = ${JSON.stringify(a.result??null)}::jsonb,
+          error = ${a.error??null}, tokens = ${JSON.stringify(a.tokens??null)}::jsonb,
+          last_seen_at = ${c}::timestamptz, locked_at = null, finished_at = ${c}::timestamptz, updated_at = ${c}::timestamptz
+        where ${this.fence(e,t,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]})}
+        returning id, installation_id, generation
+      ), connections as (delete from ${P} where ${Zl(e,t)} and exists (select 1 from finished)), inbox as (delete from ${L} where (task_id, generation) in (select id, generation from finished)), recorded as (
+        insert into ${jn} (organization_id, task_id, installation_id, agent, target, engine, model, credential, runner_ms, tokens, at, updated_at)
+        select ${e}, id, installation_id, ${o.agent}, ${o.target}, ${o.engine??null}, ${o.model??null},
+          ${o.credential}, ${o.runnerElapsedMs}, ${JSON.stringify(o.tokens??null)}::jsonb, ${new Date(o.at).toISOString()}::timestamptz, ${c}::timestamptz from finished
+        on conflict (task_id) do update set installation_id = excluded.installation_id, agent = excluded.agent, target = excluded.target,
+          engine = excluded.engine, model = excluded.model, credential = excluded.credential, runner_ms = ${jn.runnerMs} + excluded.runner_ms,
+          tokens = ${cu(M`${jn.tokens}`,o.tokens)}, at = excluded.at, updated_at = excluded.updated_at
+      ) ${u}
+      select exists (select 1 from finished) as completed`);return!!d?.completed})}async cancel(e,t,n,r={}){return this.withConnections(e,t,async i=>{let a=new Date(n).toISOString(),[o]=await Nl(i,M`
+      with cancelled as (
+        update ${z} set status = case when status = 'queued' then 'cancelled' else status end,
+          finished_at = case when status = 'queued' then ${a}::timestamptz else finished_at end,
+          inbox_seq = case when status = 'queued' then inbox_seq else inbox_seq + 1 end,
+          cancel_requested_at = ${a}::timestamptz, updated_at = ${a}::timestamptz
+        where ${this.fence(e,t,{...r,statuses:qm})} returning id, generation, inbox_seq, status
+      ), connections as (delete from ${P} where ${Zl(e,t)} and exists (select 1 from cancelled where status = 'cancelled')), message as (
+        insert into ${L} (organization_id, task_id, seq, generation, kind, value, at)
+        select ${e}, id, inbox_seq, generation, 'cancel', 'null'::jsonb, ${a}::timestamptz from cancelled where status in ('running', 'waiting')
+      ) select exists(select 1 from cancelled) as accepted`);return!!o?.accepted})}async cancelRequested(e,t){let[n]=await q(this.db,()=>this.db.select({at:z.cancelRequestedAt}).from(z).where(this.where(e,t)));return!!n?.at}filter(e,t){let n=t.status?[t.status]:t.statuses,r=t.q?.trim(),i=r&&`%${r.replace(/[\\%_]/g,`\\$&`)}%`;return F(j(z.organizationId,e),n?hn(z.status,n):void 0,t.agent?j(z.agent,t.agent):void 0,t.source?j(z.source,t.source):void 0,t.archived===void 0?void 0:t.archived?vn(z.archivedAt):Cn(z.archivedAt),i?En(fn(M`${z.event}->>'text'`,i),fn(z.prompt,i),fn(z.agent,i),fn(z.publicId,i)):void 0)}pageQuery(e,t){let{before:n}=t,r=t.summary?{publicId:z.publicId,source:z.source,agent:z.agent,flow:z.flow,prompt:z.prompt,event:M`case when ${z.event} is not null then jsonb_build_object('integration', ${z.event}->>'integration', 'type', ${z.event}->>'type', 'text', ${z.event}->>'text') end`.as(`event`),status:z.status,attempts:z.attempts,approval:z.approval,archivedAt:z.archivedAt,createdAt:z.createdAt,startedAt:z.startedAt,finishedAt:z.finishedAt,updatedAt:z.updatedAt}:On(z),i=this.db.select(r).from(z).where(F(this.filter(e,t),t.since===void 0?void 0:En(yn(z.updatedAt,new Date(t.since)),t.sinceId?F(j(z.updatedAt,new Date(t.since)),yn(du(z.publicId),t.sinceId)):void 0),n?this.after(n):void 0)).orderBy(...t.since===void 0?fu(z):pu(z));return t.limit===void 0?i:i.limit(t.limit)}after(e){if(`updatedAt`in e)return En(yn(z.updatedAt,new Date(e.updatedAt)),F(j(z.updatedAt,new Date(e.updatedAt)),yn(du(z.publicId),e.id)));let t=M`(${uu(z.createdAt)}, ${du(z.publicId)}) < (${new Date(e.createdAt).toISOString()}::timestamptz, ${e.id})`;return En(yn(lu(z.status),e.rank),F(j(lu(z.status),e.rank),t))}record(e,t){return t?hl({task:hl({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,prompt:e.prompt,event:e.event}),status:e.status,attempts:e.attempts,approval:e.approval,archivedAt:e.archivedAt?X(e.archivedAt):void 0,createdAt:X(e.createdAt),startedAt:e.startedAt?X(e.startedAt):void 0,finishedAt:e.finishedAt?X(e.finishedAt):void 0,updatedAt:X(e.updatedAt)}):Sl(e)}async list(e,t={}){return(await q(this.db,()=>this.pageQuery(e,t))).map(e=>this.record(e,t.summary))}async changes(e,t){if(!e.length)return{rows:[],deleted:[]};let n=e.map(e=>e.organizationId),r=e.flatMap(e=>e.ids.map(()=>e.organizationId)),i=e.flatMap(e=>e.ids),a=i.length?M`(${z.organizationId}, ${z.publicId}) in (select * from unnest(${M.param(r)}::text[], ${M.param(i)}::text[]))`:M`false`,[o,s]=await Promise.all([q(this.db,()=>this.db.select({organizationId:z.organizationId,publicId:z.publicId,source:z.source,agent:z.agent,flow:z.flow,status:z.status,approval:z.approval,answer:M`case when ${a} then ${z.answer} end`,result:M`case when ${a} then ${z.result} end`,error:M`case when ${a} then ${z.error} end`,attempts:z.attempts,archivedAt:z.archivedAt,createdAt:z.createdAt,startedAt:z.startedAt,finishedAt:z.finishedAt,updatedAt:z.updatedAt}).from(z).where(En(F(hn(z.organizationId,n),yn(z.updatedAt,new Date(t))),i.length?a:void 0))),q(this.db,()=>this.db.select().from(Fn).where(F(hn(Fn.organizationId,n),yn(Fn.deletedAt,new Date(t)))))]);return{rows:o.map(e=>({organizationId:e.organizationId,status:hl({task:{id:e.publicId,source:e.source,agent:e.agent,flow:e.flow},status:e.status,approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,result:e.result,error:e.error,attempts:e.attempts,archivedAt:e.archivedAt&&X(e.archivedAt),createdAt:X(e.createdAt),startedAt:e.startedAt&&X(e.startedAt),finishedAt:e.finishedAt&&X(e.finishedAt),updatedAt:X(e.updatedAt)})})),deleted:s.map(e=>({organizationId:e.organizationId,id:e.publicId,at:X(e.deletedAt)}))}}countQuery(e,t){return this.db.select({all:M`count(*)::int`.as(`all`),active:M`(count(*) filter (where ${hn(z.status,qm)}))::int`.as(`active`),waiting:M`(count(*) filter (where ${j(z.status,`waiting`)}))::int`.as(`waiting`)}).from(z).where(this.filter(e,t))}async counts(e,t={}){let[n]=await q(this.db,()=>this.countQuery(e,t));return n??{all:0,active:0,waiting:0}}async listWithCounts(e,t){let n=this.db.$with(`totals`).as(this.countQuery(e,t)),r=this.db.$with(`page`).as(this.pageQuery(e,{...t,limit:t.limit??20})),i=Object.fromEntries(Object.keys(r._.selectedFields).map(e=>[e,r[e]])),a=await q(this.db,()=>this.db.with(n,r).select({...i,all:n.all,active:n.active,waiting:n.waiting}).from(n).leftJoin(r,M`true`).orderBy(...t.since===void 0?fu({status:i.status,createdAt:i.createdAt,publicId:i.publicId}):pu({updatedAt:i.updatedAt,publicId:i.publicId}))),{all:o=0,active:s=0,waiting:c=0}=a[0]??{};return{items:a.filter(e=>e.publicId!==null&&e.publicId!==void 0).map(e=>this.record(e,t.summary)),counts:{all:o,active:s,waiting:c}}}async runningCount(){let[e]=await q(this.db,()=>this.db.select({value:M`count(*)::int`}).from(z).where(hn(z.status,[`running`,`waiting`])));return e?.value??0}async running(){return(await q(this.db,()=>this.db.select().from(z).where(hn(z.status,[`running`,`waiting`])))).map(e=>({organizationId:e.organizationId,status:Sl(e)}))}async appendLogs(e,t,n,r,i,a,o){let s=n.length?M`, inserted as (
+      insert into ${In} (organization_id, task_id, seq, at, level, line)
+      select ${e}, accepted.id, entry.seq, to_timestamp(entry.at / 1000.0), entry.level, entry.line
+      from accepted cross join jsonb_to_recordset(${JSON.stringify(n)}::jsonb) as entry(seq int, at bigint, level text, line text)
+    )`:M``,[c]=await Nl(this.db,M`
+      with accepted as (
+        update ${z} set log_cursor = ${i.cursor}, log_seq = ${i.seq}, log_bytes = ${i.bytes}, updated_at = ${new Date(a).toISOString()}::timestamptz
+        where ${this.fence(e,t,o)} and coalesce(log_seq, 0) = ${r.seq} and coalesce(log_cursor, -1) = ${r.cursor}
+        returning id
+      ) ${s} select exists (select 1 from accepted) as accepted`);return!!c?.accepted}async readInbox(e,t,n,r){return(await q(this.db,()=>this.db.select({seq:L.seq,generation:L.generation,at:L.at,kind:L.kind,value:L.value}).from(L).innerJoin(z,j(z.id,L.taskId)).where(F(this.where(e,t),j(z.generation,n),hn(z.status,qm),j(L.generation,n),M`${L.seq} > ${r}`)).orderBy(I(L.seq)).limit(100))).map(e=>({...e,at:X(e.at)}))}async appendInbox(e,t,n,r,i,a){let[o]=await Nl(this.db,M`
+      with next as (
+        update ${z} set inbox_seq = inbox_seq + 1, updated_at = ${new Date(i).toISOString()}::timestamptz where ${this.fence(e,t,{generation:a,statuses:qm})} returning id, inbox_seq, generation
+      ) insert into ${L} (organization_id, task_id, seq, generation, kind, value, at)
+        select ${e}, id, inbox_seq, generation, ${n}, ${JSON.stringify(r??null)}::jsonb, ${new Date(i).toISOString()}::timestamptz from next returning seq`);return o&&{seq:o.seq,generation:a,at:i,kind:n,value:r}}async fetchInbox(e,t,n,r,i){let[a]=await q(this.db,()=>Nl(this.db,M`
+      select coalesce(jsonb_agg(jsonb_build_object('seq', i.seq, 'generation', i.generation, 'at', extract(epoch from i.at) * 1000, 'kind', i.kind, 'value', i.value) order by i.seq) filter (where i.seq is not null), '[]'::jsonb) as entries
+      from ${z} left join ${L} i on i.task_id = ${z.id} and i.generation = ${z.generation} and i.seq > ${i}
+      where ${this.fence(e,t,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})} group by ${z.id}`));return a?.entries}async ackInbox(e,t,n,r){return r.generation!==void 0&&r.generation!==n.generation?!1:this.withConnections(e,t,async i=>{let[a]=await Nl(i,M`
+      with current as (
+        select id from ${z} where ${this.fence(e,t,{...r,generation:n.generation,statuses:void 0})}
+          and inbox_seq >= ${n.seq} and (status in ('running', 'waiting') or (status in ('completed', 'failed', 'cancelled') and inbox_ack >= ${n.seq})) for update
+      ), applied as (
+        delete from ${L} where task_id in (select id from current) and generation = ${n.generation} and seq <= ${n.seq} returning seq, kind, value
+      ), answers as (
+        select jsonb_agg(a.value order by a.seq) as value from jsonb_to_recordset(${JSON.stringify(n.answers??[])}::jsonb) a(seq int, value jsonb)
+        where exists (select 1 from applied where applied.seq = a.seq and applied.kind = 'ask')
+      ), updated as (
+        update ${z} set inbox_ack = greatest(inbox_ack, ${n.seq}), answer = coalesce(answer, '[]'::jsonb) || coalesce(answers.value, '[]'::jsonb),
+          status = case when exists(select 1 from applied where kind = 'cancel') then 'cancelled'
+            when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${z.approval}->>'id') then 'running' else status end,
+          approval = case when exists(select 1 from applied where kind = 'approve' and value->>'approvalId' = ${z.approval}->>'id') then null else approval end,
+          finished_at = case when exists(select 1 from applied where kind = 'cancel') then now() else finished_at end,
+          updated_at = now()
+        from answers where id in (select id from current) returning status
+      ), connections as (delete from ${P} where ${Zl(e,t)} and exists (select 1 from updated where status = 'cancelled')) select exists (select 1 from current) as accepted`);return!!a?.accepted})}async pendingInbox(e){return(await q(this.db,()=>this.db.select().from(z).where(F(e===void 0?void 0:j(z.organizationId,e),hn(z.status,[`running`,`waiting`]),M`exists (select 1 from ${L} where ${L.taskId} = ${z.id} and ${L.generation} = ${z.generation})`)))).map(e=>({organizationId:e.organizationId,status:Sl(e)}))}};const hu=(e,t)=>`${e}:${String(t).padStart(6,`0`)}`;async function gu(e,t,n){n.length&&await e.store.withAppLock(`connection-warnings:${t}`,async r=>{let i=r instanceof ru?new mu(r.db):e.queue,a=[];for(let e of new Set(n))await r.get(`delivery`,`connection-warning:${t}:${e}`)||a.push(e);if(a.length)for(let n=0;n<3;n++){let n=await r.get(`task`,t);if(!n)return;let o=n.logSeq??0,s=n.logCursor??-1,c=(e.now??Date.now)();if(await i.appendLogs(e.organizationId,t,a.map((e,t)=>({seq:o+t,at:c,level:`sys`,line:e})),{seq:o,cursor:s},{seq:o+a.length,cursor:s,bytes:(n.logBytes??0)+a.reduce((e,t)=>e+Buffer.byteLength(t),0)},c,{attempts:n.attempts,tokenHash:n.tokenHash??null,handle:n.handle,generation:n.generation??0})){for(let e of a)await r.put(`delivery`,`connection-warning:${t}:${e}`,{at:c});return}}})}function _u(e,t,n,r){let i=t,a=r,o=[];for(let t of e){let e=Buffer.byteLength(t.line);if(a+e>2097152)break;o.push({seq:i,at:t.at??n,level:t.level,line:t.line}),a+=e,i+=1}return{lines:o,seq:i,bytes:a}}async function vu(e,t,n=-1,r){return(await e.list(`tasklog`,{prefix:`${t}:`,...n>=0?{after:hu(t,n)}:{},...r?{limit:r}:{}})).map(e=>{let t=an(e.value.line);return{seq:Number(e.id.slice(e.id.lastIndexOf(`:`)+1)),...e.value,...t?{entry:t}:{}}})}async function yu(e,t,n){let r=e.settings??={},i=r.taskLogSecrets??=new Map,a=JSON.stringify([e.organizationId,t.task.id,t.attempts,t.generation,t.tokenHash]),o=i.get(a);o||(o=Kf(e,t).catch(e=>{throw i.delete(a),e}),i.set(a,o),setTimeout(()=>{i.get(a)===o&&i.delete(a)},(e.config.taskTimeoutMs??18e5)+6e4).unref?.());let s=(await o).sort((e,t)=>t.length-e.length),c=e=>s.reduce((e,t)=>t?e.replaceAll(t,`[REDACTED]`):e,e),l=e=>typeof e==`string`?c(e):Array.isArray(e)?e.map(l):e&&typeof e==`object`?Object.fromEntries(Object.entries(e).map(([e,t])=>[c(e),l(t)])):e,u=e=>{try{return JSON.stringify(l(JSON.parse(e)))}catch{return c(e)}};for(let r=0;r<5;r++){let r=await e.store.get(`task`,t.task.id);if(!r||r.attempts!==t.attempts||r.tokenHash!==t.tokenHash||r.generation!==t.generation)return`stale`;let i=r.logCursor??-1,a=n.filter(e=>e.seq>i);if(!a.length)return`ok`;if(r.logsComplete||a[0].seq!==i+1)return`gap`;let o=(e.now??Date.now)(),s=_u(a.map(e=>({...e,line:u(e.line)})),r.logSeq??0,o,r.logBytes??0);if(await e.queue.appendLogs(e.organizationId,t.task.id,s.lines,{seq:r.logSeq??0,cursor:i},{seq:s.seq,cursor:a.at(-1).seq,bytes:s.bytes},o,{attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0}))return`ok`}return`stale`}function bu(e,t){return kr(e,`link-start`,`*`,JSON.stringify(t),3e5)}function xu(e){return`${e.appId}:${e.installationId}:${e.chat?.thread.id??e.deliveryId}`}function Su(e,t,n){return`thread:${e}:${t}:${n}`}function Cu(e){return e.event&&e.source===e.event.integration?xu(e.event):`task:${e.id}`}async function wu(e,t,n,r,i,a,o,s){let c={},l=lt(e.integrations),u=n.settings?.configRepo,[d,f,p]=await Promise.all([o?.().catch(()=>void 0),e.store.get(`note`,xu(r)).catch(()=>void 0),l&&u?i(l.id).then(t=>t?wa(e,l,t,u,`.coder/${a.id}.md`):void 0).catch(()=>void 0):void 0]);if(d?.length&&(c.messages=d),f&&(c.note=f),p?.trim()&&(c.instructions=p.trim()),s)c.user={name:s.name,email:s.email};else if(s===void 0&&e.auth&&r.actor.id){let n=await e.auth.linkedUser(t.id,r.actor.id).catch(()=>void 0);n&&(c.user={name:n.name,email:n.email})}return c}const Tu=6e4,Eu=864e5,Du=262144,Ou=[`model`,`engine`,`effort`],ku=[`Usage:`,"• `/setup model <name>`. Sets the engine model. Also accepts `engine` and `effort`.","• `/setup show`. Shows the current settings."].join(`
+`);function Au(e){return e.type===`command`}function ju(e){let t=Object.entries(e??{}).filter(([,e])=>e);return t.length?`Current settings:\n${t.map(([e,t])=>`• ${e}: \`${t}\``).join(`
+`)}`:`No settings yet. A workspace admin can configure this agent in the dashboard.`}function Mu(e){let[t=``,...n]=e.text.trim().split(/\s+/);return Ou.includes(t)&&n.join(` `).trim()!==``}async function Nu(e,t,n){let[r=``,...i]=e.text.trim().split(/\s+/),a=i.join(` `).trim(),o={...t.settings},s;return r?r===`show`?s=ju(t.settings):Ou.includes(r)?a?(o[r]=a,s=`${r} set to \`${a}\`.`):s=`Give a value: \`/setup ${r} <name>\`.`:s=`Unknown setting \`${r}\`.\n${ku}`:s=ku,JSON.stringify(o)!==JSON.stringify(t.settings??{})&&await so(n,`installation`,t.id,{settings:o}),s}async function Pu(e,t,n){let r=`${t.id}:${n.installationId}`,i=e.boundInstallation?.installation.id===r?e.boundInstallation.installation:await e.store.get(`installation`,r);return i&&!i.deletedAt?i:void 0}async function Fu(e,t,n){let r=await e.auth.linkedUser(t.id,n.actor.id).catch(()=>void 0);return r?.organizations?.includes(e.organizationId)?r:void 0}function Iu(e,t,n){return e.auth?!t:n===!1}async function Lu(e,t,n,r){if(!t.auth.canWrite)return;let i=await(await r(n.integration)).token();return t.auth.canWrite(n,i,e.fetch).catch(e=>(console.error(`coder server: ${t.id} write check failed`,e),!1))}async function Ru(e,t,n,r,i,a,o=!1){let s=e.config.publicUrl?.replace(/\/$/,``),c=sr(),l=o||await e.store.create(`delivery`,`link:${t.id}:${r.actor.id}`,{at:a,owner:c},{ttlMs:864e5});if(!s||!l)return;let u=e=>`Link your Coder account so I can work for you here: ${e}`;try{if(t.auth.user){await i.post(u(`${s}/connect/${t.id}?installation=${encodeURIComponent(n.id)}`));return}let a=await bu(e,{platform:t.id,platformUserId:r.actor.id});await i.whisper(u(`${s}/connect?token=${encodeURIComponent(a)}`))}catch(n){throw o||await e.store.updateDelivery(`link:${t.id}:${r.actor.id}`,c,void 0).catch(()=>{}),n}}async function zu(e,t,n){if(!t.chat)return;let r=Su(t.appId,t.installationId,t.chat.thread.id);await e.store.put(`delivery`,r,{at:n},{ttlMs:2592e6})}async function Bu(e,t){let n=Object.keys(t.definition.integrations),r=await Promise.all(n.map(t=>e(t)));return new Set(n.filter((e,t)=>r[t]))}async function Vu(e,t,n){let r={};n.repo?r[n.integration]={repo:{owner:n.repo.owner,name:n.repo.name}}:n.chat&&(r[n.integration]={thread:n.chat.thread.id,...n.within?{within:n.within}:{}});for(let[n,i]of Object.entries(t.connections??{})){if(i.kind!==`installation`)continue;let t=(await e.store.get(`installation`,i.id))?.settings?.configRepo,a=t&&/^([^/]+)\/([^/]+)$/.exec(t);a&&(r[n]={repo:{owner:a[1],name:a[2]}})}return r}async function Hu(e,t){return`No model is configured yet. If you have access to it, [add one here](${await Zp(e,t)}).`}async function Uu(e,t){return`There was a problem with your connected model. If you have access to it, [check it here](${await Zp(e,t)}).`}const Wu=(e,t)=>e.events[t.type]?.on===`mention`||t.chat?.thread.isDM===!0||t.chat?.message?.isMention===!0;async function Gu(e,t,n,r){let i=eh({agent:n,requester:r,event:t}),a=await qu(e,i)??await e.store.get(`snapshot`,`session:${i}`);if(!a||a.requester!==r||!t.actor.id||a.actor!==t.actor.id)return;let o=await e.store.get(`task`,a.id);if(o&&[`queued`,`running`,`waiting`].includes(o.status)&&eh(o.task)===i)return o.task.id;let s=ge(e.local.cwd,a.id);if(!s){let t=(await e.store.list(`delivery`,{prefix:`delivery:`})).find(e=>e.value.session?.key===i&&e.value.session.id===a.id)?.value.pending;if(!t?.task||t.taskId!==a.id||eh(t.task)!==i)return;await op(e,t.task,t.taskId),s=ge(e.local.cwd,a.id)}if(!s||s.agentId!==n)return;let c=Se(e.local.cwd,s);return c.status===`running`||c.status===`queued`?c.id:void 0}async function Ku(e,t,n,r,i,a,o){let s=`delivery:${t.id}:${n.id}:${i.installationId}:${i.chat?.thread.id??``}:${i.deliveryId}`,c=await Pu(e,n,i);if(!c||(e.local&&await to(e.store,e.local.cwd,e.integrations,n.agent).catch(()=>{}),(await e.store.get(`agent`,n.agent))?.settings?.disabled)||e.local&&await e.store.get(`delivery`,s).then(e=>e&&!e.pending))return{};if(!e.local){let l=`claim:${s.slice(9)}`,u=sr();if(!await e.store.create(`delivery`,l,{owner:u,at:a()},{ttlMs:Tu}))return{};try{let d=await e.store.get(`delivery`,s);if(d&&(!d.pending||`owner`in d&&d.owner))return await e.store.updateDelivery(l,u,void 0),{};let f=await Yu(e,t,n,r,i,c,a,o,s);return await e.store.updateDelivery(l,u,f.work?void 0:{at:a()},{ttlMs:Eu}),await f.work,f.taskId?{taskId:f.taskId}:{}}catch(t){throw await e.store.updateDelivery(l,u,void 0),t}}let l=JSON.stringify([i.appId,i.installationId,i.chat?.thread.id]),u=e.store.handoffs??=new Map,d=(u.get(l)??Promise.resolve()).catch(()=>{}).then(async()=>{let l=await Yu(e,t,n,r,i,c,a,o,s);return await l.work,l});u.set(l,d);try{return await d}finally{u.get(l)===d&&u.delete(l)}}async function qu(e,t){let n=await e.store.list(`delivery`,{prefix:`delivery:`}),r=await e.store.get(`snapshot`,`session:${t}`);return[...n.map(e=>e.value.session),r&&{...r,key:t}].filter(e=>e?.key===t).sort((e,t)=>(t.version??0)-(e.version??0))[0]}async function Ju(e,t,n,r,i,a,o=!1){let s=sr(),c={event:n,...a?{task:a,taskId:a.flow==="default"?Me():bt()}:{}},l;if(e.local&&!n.repo){let n=await e.store.get(`delivery`,t);if(n&&!n.pending)return{};if(c=n?.pending??c,c.task&&!c.taskId)throw Error(`Local delivery has no task binding`);if(l=n?.session,!l&&o&&c.task){let t=eh(c.task);l={key:t,id:c.taskId,version:((await qu(e,t))?.version??0)+1,requester:c.task.requester,actor:c.task.event.actor.id}}await e.store.put(`delivery`,t,{at:r(),owner:s,pending:c,...l?{session:l}:{}})}else if(!await e.store.create(`delivery`,t,{at:r(),owner:s,pending:c},{ttlMs:Tu}))return{};return{work:(async()=>{let n=Promise.resolve(),a=e.local?void 0:setInterval(()=>{n=n.then(async()=>{await e.store.updateDelivery(t,s,{at:r(),owner:s,pending:c},{ttlMs:Tu})}).catch(()=>{})},Tu/3);try{await i(c),a&&clearInterval(a),await n,await e.store.updateDelivery(t,s,{at:r(),...l?{session:l}:{}},{ttlMs:Eu})}catch(r){throw a&&clearInterval(a),await n,(!e.local||!c.task)&&await e.store.updateDelivery(t,s,void 0).catch(()=>{}),r}})()}}async function Yu(e,t,n,r,i,a,o,s,l){let u=t=>Ju(e,l,i,o,t);if(Au(i))return e.auth&&Mu(i)&&!await Fu(e,t,i)?u(()=>Ru(e,t,a,i,s,o(),!0)):u(()=>Nu(i,a,e.store).then(e=>s.whisper(e)).then(()=>{}));let d=Rf(e,t,a,i,r),[f,p]=await Promise.all([e.loadAgent(n,a,i,d),e.auth&&i.actor.id?Fu(e,t,i):void 0]),m=!!(e.auth&&i.actor.id&&t.events[i.type]?.addressed),h=m&&!p?await Lu(e,t,i,d):void 0;if(m&&!p&&!h)return u(()=>Ru(e,t,a,i,s,o()));let g=p?.id,_=At(i,f);if(!_)return{};let v=i.chat&&_.flow==="default"&&t.events[i.type]?.steers,y=(t,n,r)=>Ju(e,l,i,o,async t=>{let a=t.task,s=await op(e,a,t.taskId);if(await zu(e,i,o()),await Um(e,s.task.id,[...d.minted,...r?[r]:[]]),n&&je(e.local.cwd,s.task.id,{kind:`status`,message:n}),v){let n=await qu(e,eh(a));n&&n.id===t.taskId&&await e.store.put(`snapshot`,`session:${n.key}`,{...n,id:s.task.id})}},t,!!v);if(e.local&&!i.repo){let t=await e.store.get(`delivery`,l);if(t?.pending?.task){let e=t.pending.task;return eh(e)!==eh({agent:f.id,requester:g,event:i})||e.flow!==_.flow?{}:y(e)}}let b=e.local&&!i.repo&&v?await Gu(e,i,f.id,g):void 0;if(b){let t=await e.store.get(`task`,b),n=ge(e.local.cwd,b);return!n||t?.status===`queued`?u(async()=>{t&&await ih(e,b,`steer`,{text:i.text},t.generation??0)}):n.threadId?u(()=>ht(e.local.cwd,n,i.text).then(()=>{})):u(async()=>{ve(e.local.cwd,b,i.text)})}let x=tt(f),ee=await Bu(d,f),[te,ne,re,ie,S,ae]=await Promise.all([Zt(e,{requester:g,agent:f.definition.runner}),Mp(e.store,x.engine,g),Vu(e,a,i),wu(e,t,a,i,async e=>ee.has(e)?d(e):void 0,f,t.events[i.type]?.addressed?s.recent:void 0,p??null),Yi(e,g,f.usage?.connections,!!(e.auth&&!p&&!h)),_.actAs===`requester`?Mf(e,t,i,r).catch(()=>void 0):void 0]);if(!ne&&te.runner!==`http`&&!await Tp(e,x.engine))return(!e.local||i.repo)&&v&&(await e.queue.deliver(e.organizationId,{id:`${i.deliveryId}-${f.id}`,source:i.integration,agent:f.id,flow:_.flow,...te,event:i,requester:g,definition:f.definition,tools:{}},o(),{key:l,ttlMs:864e5},!0,void 0,!1)).steered||!Wu(t,i)?{}:u(async()=>{let r=`setup:${n.id}:${i.chat?.thread.id??i.deliveryId}`,a=i.deliveryId;if(!(!(t.answersEveryPrompt||await e.store.create(`delivery`,r,{at:o(),owner:a},{ttlMs:6048e5}))&&(await e.store.get(`delivery`,r))?.owner!==a))try{await s.problem(await Hu(e,x.engine??c))}catch(n){throw t.answersEveryPrompt||await e.store.updateDelivery(r,a,void 0),n}});let oe=new Set(t.tools.presets.observe),C=_.tools[i.integration]??[],se=!!e.auth&&_.actAs===`requester`&&!ae,ce=C.some(e=>!oe.has(e)),le=e.auth?p&&(ce||se):ce||S.length>0||Object.entries(_.tools).some(([e,t])=>e!==i.integration&&ee.has(e)&&t.length),ue=h??(le?await Lu(e,t,i,d):void 0),de=Iu(e,p||h,ue),fe=se?`Acting as the app because the requester's account has no usable ${t.name} token. ${ue===!0&&!de?`The platform write check passed.`:`Only reads are allowed.`} [Connect your account](${e.config.publicUrl?.replace(/\/$/,``)??``}${Ig(await Fg(e),`/settings/connections`)}).`:void 0;if(fe&&(ie.instructions=[ie.instructions,fe,`Include the account connection link in your reply.`].filter(Boolean).join(`
+
+`)),de){let e=new Set(t.tools.presets.comment);for(let t of Object.keys(_.tools))_.tools[t]=t===i.integration?C.filter(t=>e.has(t)):[]}else(p&&ue===!1||se&&ue!==!0)&&(_.tools[i.integration]=C.filter(e=>oe.has(e)));let pe=Object.fromEntries(Object.entries(_.tools).filter(([e])=>ee.has(e)).map(([t,n])=>{if(re[t])return[t,n];if(t!==i.integration)return[t,[]];let r=new Set(e.integrations[t]?.tools.presets.observe??[]);return[t,n.filter(e=>r.has(e))]}).filter(([,e])=>e.length));if(Buffer.byteLength(JSON.stringify(i))>Du)throw Error(`Event exceeds 256 KB`);if(Buffer.byteLength(JSON.stringify(ie))>Du)throw Error(`Task context exceeds 256 KB`);let me={id:`${i.deliveryId}-${f.id}`,source:i.integration,agent:f.id,flow:_.flow,...te,permissions:_.permissions??x.permissions,event:i,failureReply:await Uu(e,x.engine??c),author:t.author?.(n.name)??n.name,definition:f.definition,...ne?{credential:ne.id}:{},...g?{requester:g}:{},...f.files?{files:f.files}:{},...f.usage?{usage:f.usage}:{},tools:pe,connections:de?[]:S,...Object.keys(re).length?{toolScopes:re}:{},...Object.keys(ie).length?{context:ie}:{}};if(e.local&&!i.repo&&te.runner===`local`&&!te.runnerId)return y(me,fe,ae);let he=await e.queue.deliver(e.organizationId,me,o(),{key:l,ttlMs:Eu},!!v,e.config.maxQueued??1e3);return he.taskId&&(await zu(e,i,o()),await Um(e,he.taskId,[...d.minted,...ae?[ae]:[]])),fe&&he.taskId&&await gu(e,he.taskId,[fe]),he}async function Xu(e,t,n,r,i,a){let o=e.integrations[t.integration],s=i?.repo&&`${i.repo.owner}/${i.repo.name}`,c=i&&(o?.link?.(i)??(s&&o?.repos?.url(s))),l=!1;try{let a=r&&await Ti(e,`${t.id}:${r}`)||e,o={at:(e.now??Date.now)(),organization:a.organizationId,integration:t.integration,app:t.id,agent:t.agent,error:(n instanceof Error?n.message:String(n)).split(`
+`)[0].slice(0,500),...i?{type:i.type,delivery:i.deliveryId}:{},...i?.chat?{thread:i.chat.thread.id}:{},...s?{repo:s}:{},...c?{url:c}:{}},u=`failed:${t.agent}:${i?.deliveryId??sr()}`;l=await a.store.create(`delivery`,u,o,{ttlMs:Eu})}catch(e){console.error(`coder server: could not record a failed delivery for ${t.id}`,e)}if(!(!l||!a))try{await(await a()).problem(`Coder could not handle this message. If you run this server, check its logs. Otherwise report it at ${e.config.issuesUrl}.`)}catch(e){console.error(`coder server: could not tell ${t.id}'s thread about a failed delivery`,e)}}async function Zu(e,t){let n=(await e.list(`delivery`,{prefix:`failed:${t}:`})).map(e=>e.value).sort((e,t)=>t.at-e.at);return{failed:n.length,recent:n.slice(0,50)}}var Qu=r({adapterContext:()=>gd,addressedTo:()=>sd,chatFor:()=>_d,dashUrl:()=>hd,deliver:()=>ud,eventReplies:()=>fd,later:()=>ld,threadReplies:()=>dd});async function $u(e,t,n){let r=`${t.id}:${n}`,i=await Ti(e,r),a=i?.boundInstallation?.installation.id===r?i.boundInstallation.installation:await i?.store.get(`installation`,r);return{tenant:i,installation:a?.deletedAt?void 0:a}}async function ed(e,t,n,r,i){let{tenant:a,installation:o}=await $u(e,t,r);if(!a||!o)throw Error(`${t.integration} installation ${r} is not bound to this server`);return jf(a,e.integrations[t.integration],o,n,i)}function td(e){if(e._type===`chat:Thread`)return{...e,currentMessage:void 0};let{raw:t,replyTo:n,...r}=e;return{...r,raw:null,id:r.id.startsWith(`ephemeral:`)?``:r.id}}const nd=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),rd=(e,t)=>Object.keys(e.events).find(n=>e.events[n].on===t),id=`(?![\\w-]|\\.\\w)`,ad=e=>e.replace(/[ \t]{2,}/g,` `).trim();function od(e,t){let n=t.reduce((e,t)=>e.replace(RegExp(`(^|[^\\w-])@${nd(t)}${id}`,`gi`),`$1`),e);return n===e?void 0:ad(n)}function sd(e,t){let n=od(e,[t]);if(n!==void 0)return n;let r=RegExp(`^\\s*${nd(t)}${id}[\\s,:;!.?-]*`,`i`);return r.test(e)?ad(e.replace(r,``)):void 0}async function cd(e,t,n,r,i){if(n.builtin)return sd(i,n.agent)!==void 0;let a=rd(t,`message`),o=await Ti(e,`${n.id}:${r.id}`);if(!a||!o)return!1;if(o.local)return!0;let{record:s,version:c}=await sa(o.store,n.agent);return!s||!c||!s.settings?.disabled&&at(c.definition.integrations[t.id],a)!==void 0}function ld(e,t,n,r,i){let a=r.catch(r=>(console.error(`coder server: dispatch failed for ${t.id} event ${n.deliveryId}`,r),Xu(e,t,r,n.installationId,n,()=>i??fd(e,t,n))));e.waitUntil&&e.waitUntil(a)}async function ud(e,t,n,r,i,a){if(n.builtin&&t.app.builtin!==`shared`)return;let o=`${n.id}:${i.installationId}`,s=await Ti(e,o);if(!s||!n.builtin&&s.organizationId!==e.organizationId)return;let c=s.boundInstallation?.installation.id===o?s.boundInstallation.installation:await s.store.get(`installation`,o);if(c?.covers&&!c.covers.includes(i.within??``))return;let l=await Ku(s,t,n,r,i,e.now??Date.now,a);return await l.work,l.taskId&&await Yo(s,!0,!1,!0),l.taskId}function dd(e,t,n){let r=t=>n&&e.adapter.reply?e.reply(n,t):e.post(t),i=e.adapter.postProblem;return{post:r,problem:t=>i?i.call(e.adapter,e.id,t):r(t),whisper:n=>t?e.postEphemeral(t,n,{fallbackToDM:!1}):Promise.resolve(null),async recent(){let t=[],n=0;for await(let r of e.allMessages)if(t.push({user:r.author.userName||r.author.userId,text:r.text,ts:r.metadata.dateSent.toISOString()}),t.length>10&&t.shift(),++n===1e3)break;return t}}}async function fd(e,t,n){if(!n.chat)return{post:async()=>{},problem:async()=>{},whisper:async()=>{}};let r=await _d(e,t,{id:n.installationId,...n.repo?{repo:n.repo}:{}});return await r.initialize(),dd(r.thread(n.chat.thread.id),n.actor.id||void 0,n.chat.message?.id||void 0)}function pd(e,t,n,r,i,a,o=a.id){let s=r===`message`&&t.builtin?sd(a.text,t.agent):void 0;if(r===`message`&&t.builtin&&s===void 0)return;let c=rd(e,s===void 0?r:`mention`);if(!c||a.author.isBot===!0)return;let l=e.event?e.event(c,i,a,t):{};if(!l)return;let u=(l.type??c)===rd(e,`mention`)?s??od(a.text,[t.name,...n.self?[n.self]:[]])??a.text:a.text;return{integration:e.id,type:c,appId:t.id,installationId:n.id,deliveryId:ir(`sha256`).update(`${t.id}\n${n.id}\n${i.id}\n${o}`).digest(`base64url`).slice(0,22),actor:{id:a.author.userId,...a.author.userName?{login:a.author.userName}:{}},text:u,chat:{thread:td(i.toJSON()),message:td(a.toJSON())},...n.within?{within:n.within}:{},...n.repo?{repo:n.repo}:{},...l}}async function md(e,t,n){let{tenant:r,installation:i}=await $u(e,t,n.id),a=(t.builtin||r?.organizationId===e.organizationId)&&(!i?.covers||i.covers.includes(n.within??``));return i&&a?r:void 0}async function hd(e){let t=e.config.publicUrl?.replace(/\/$/,``);return t&&`${t}${Ig(await Fg(e))}`}function gd(e,t,n,r,i,a){return{fetch:e.fetch??fetch,appId:n.id.slice(t.id.length+1),name:n.name,credentials:r,...i?{installationId:i.id,...i.self?{self:i.self}:{}}:{},token:(t,a)=>ed(e,n,r,t,{...i?.repo?{repo:{owner:i.repo.owner,name:i.repo.name}}:{},...a}),installedSelf:async t=>(await $u(e,n,t)).installation?.self,saveSelf:async(t,r)=>{let{tenant:i,installation:a}=await $u(e,n,t);!i||!a||a.self||await so(i.store,`installation`,a.id,{self:r}).catch(e=>console.error(`coder server: could not save ${a.id}'s app user`,e))},...i?{hears:r=>cd(e,t,n,i,r).catch(e=>(console.error(`coder server: could not read ${n.id}'s agent for a message`,e),!0)),active:async t=>{let r=await Ti(e,`${n.id}:${i.id}`),a=Su(n.id,i.id,t);return!!await r?.store.get(`delivery`,a)},agent:async t=>{let r=await md(e,n,i),{record:a,version:o}=r?await sa(r.store,t??n.agent):{};if(!a||!o)return;let{definition:s}=o,c=a.description??s.description;return{slug:a.id,name:a.name,...c?{description:c}:{},listens:Object.entries(s.integrations).flatMap(([t,n])=>{let r=Qe(n),i=e.integrations[t];return i&&r.length?[{integration:t,name:i.name,events:r}]:[]})}},task:async t=>{let r=await md(e,n,i),a=r&&await r.store.get(`task`,t);if(!a)return;let{task:o}=a,s=o.event?.integration;return{id:o.id,title:o.name?.trim()||o.prompt?.trim()||o.event?.text?.trim()||`${o.event?.type??`task`} on ${o.agent}`,agent:o.agent,status:a.status,from:s&&e.integrations[s]?.name||o.source,startedAt:a.startedAt??a.createdAt}}}:{},privateState:()=>new sn,...e.config.publicUrl?{publicUrl:e.config.publicUrl}:{},...a?{dashUrl:a}:{}}}async function _d(e,t,n){let r=e.integrations[t.integration];if(!r)throw Error(`Unknown integration "${t.integration}"`);let i=A(e.config,t.credentials),a=await r.adapter(gd(e,r,t,i,n)),o=on(e.chatState??new sn,t.id),s=new Kn({userName:t.name,adapters:{[r.id]:a},state:{...o,isSubscribed:async()=>!1},concurrency:`concurrent`,dedupeTtlMs:Eu,logger:`error`});if(!n)return s;let c=async(a,o,s,c)=>{let l=pd(r,t,n,a,o,s,c);if(!l)return;let u=dd(o,s.author,s);ld(e,t,l,ud(e,r,t,i,l,u),u)};return s.onNewMention((e,t)=>c(`mention`,e,t)),s.onNewMessage(/[\s\S]*/,(e,t)=>c(`message`,e,t)),s.onReaction(async e=>{if(!e.added)return;let t=r.reactionId?.(e);if(!t)return;let n=new qn({id:e.messageId,threadId:e.threadId,text:e.message?.text??``,formatted:e.message?.formatted??{type:`root`,children:[]},raw:e.raw,author:e.user,metadata:e.message?.metadata??{dateSent:new Date,edited:!1},attachments:[]});await c(`reaction`,e.thread,n,`reaction\n${t}\n${e.user.userId}\n${e.rawEmoji}`)}),s.onSlashCommand(`/setup`,async a=>{let o=rd(r,`command`);if(!o)return;let s=e=>a.channel.postEphemeral(a.user,e,{fallbackToDM:!1}),c={integration:r.id,type:o,appId:t.id,installationId:n.id,deliveryId:ir(`sha256`).update(`${t.id}\n${n.id}\n${a.channel.id}\n${a.triggerId??a.text}`).digest(`base64url`).slice(0,22),actor:{id:a.user.userId,...a.user.userName?{login:a.user.userName}:{}},text:a.text.trim(),...n.within?{within:n.within}:{}},l={post:s,problem:s,whisper:s};ld(e,t,c,ud(e,r,t,i,c,l),l)}),s}function vd(e,t,n){let r=n&&t.organizations.find(e=>e.id===n);return r?{...U(e,r.id),session:{...t,organizationId:r.id,role:r.id===t.organizationId?t.role:r.role}}:void 0}async function yd(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function bd(e,t,n,r){let i=t.linkContext,a=i.session,o=e=>{let t=Mr(i,e);return t&&a.organizations.some(e=>e.id===t)?{...U(i,t),session:a}:i},s=r.searchParams.get(`token`)??``,c=o(s);if(await Ir(c,s,`link`,a.user.id))return await fi(e,void 0,t.dashboardHosts)??new Response(`UI is not built`,{status:503});let l=await Fr(c,s,`link-start`,a.user.id);if(!l)return new Response(`This link is invalid or has expired.`,{status:400});let u=await kr(c,`link`,a.user.id,l,3e5);return zt(`/connect?token=${encodeURIComponent(u)}`)}async function xd(e,t,n,r){let i=t.linkContext,a=i.session,o=e=>{let t=Mr(i,e);return t&&a.organizations.some(e=>e.id===t)?{...U(i,t),session:a}:i},s=await e.json().catch(()=>({})),c=typeof s.token==`string`?await Fr(o(s.token),s.token,`link`,a.user.id):void 0;if(!c)return D({error:`This link is invalid or has expired.`},400);let l=JSON.parse(c);return await t.auth.link(a.user,l.platform,l.platformUserId,{organizations:a.organizations.map(e=>e.id)})===`taken`?D({error:`That platform account is connected to someone else.`},409):D({ok:!0,...l})}async function Sd(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.linkContext.session,c=r.searchParams.get(`connection`);if(c){let e=vd(t,s,r.searchParams.get(`organization`)??s.organizationId),n=e&&await e.store.get(`connection`,c);if(!e||!n||n.provider!==i.id||n.auth!==`oauth`||n.owner&&n.owner!==s.user.id)return D({error:`Unknown OAuth connection`},404);if(!n.owner){let t=Wh(e,`Only workspace owners and admins can authorize workspace connections`);if(t instanceof Response)return t}let l=await xm(e,i.id);if(!l)return D({error:`No OAuth client is available for ${i.name}.`},400);let u=await kr(e,`native-oauth`,s.user.id,JSON.stringify({connection:n,app:l.id,attempt:r.searchParams.get(`attempt`)}));return zt(a.authorizeUrl(A(t.config,l.credentials),{publicUrl:o,state:u,access:n.access}))}let l=r.searchParams.get(`installation`)??``,u=vd(t,s,l?await t.installationOrganization?.(l):void 0),d=u??{...t,session:s};if(!u)return $(d,`not-member`,{platform:i.id});let f=await yd(u,l);if(!f||f.integration!==i.id)return $(d,`disconnected`,{platform:i.id});let p=await kr(u,`link-oauth`,s.user.id,l);return zt(a.authorizeUrl(A(t.config,f.credentials),{publicUrl:o,state:p}))}async function Cd(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.linkContext.session,c=r.searchParams.get(`state`)??``,l=vd(t,s,Mr(t,c)),u=l??{...t,session:s},d=l&&await Fr(l,c,`native-oauth`,s.user.id);if(l&&d){let n=JSON.parse(d),r=n.connection;if(r.provider!==i.id)return $(u,`link-expired`,{platform:i.id});if(!r.owner){let e=Wh(l,`Only workspace owners and admins can authorize workspace connections`);if(e instanceof Response)return e}else if(r.owner!==s.user.id)return $(u,`link-expired`,{platform:i.id});let c=await xm(l,i.id,n.app);return c?l.store.withAppLock(`connection:${r.id}`,async d=>{let f=await d.get(`connection`,r.id);if(!f||JSON.stringify(f)!==JSON.stringify(r))return $(u,`link-expired`,{platform:i.id});let p=await a.exchange(e,A(t.config,c.credentials),{publicUrl:o,access:f.access,fetch:((e,n)=>(t.fetch??fetch)(e,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)}))}).catch(e=>{console.error(`coder server: ${i.id} connection sign-in failed`,e)});return p?.token?f.owner&&await t.auth.link(s.user,i.id,p.id,{organizations:s.organizations.map(e=>e.id),token:k(t.config,{app:c.id,token:p.token})},d)===`taken`?$(u,`account-taken`,{platform:i.id}):(await d.put(`connection`,f.id,{...f,account:f.owner?p.id:p.login??p.id,oauthApp:f.owner?c.id:void 0,secret:f.owner?void 0:k(t.config,{app:c.id,token:p.token}),broken:void 0,updatedAt:(t.now??Date.now)()}),n.attempt&&await Ai({...l,store:d},f,n.attempt),$(u,`linked`,{platform:i.id,account:p.login??p.id})):$(u,`failed`,{platform:i.id})}):$(u,`link-expired`,{platform:i.id})}let f=l&&await Fr(l,c,`link-oauth`,s.user.id),p=l&&f?await yd(l,f):void 0;if(!l||!p||p.integration!==i.id)return $(u,`link-expired`,{platform:i.id});let m=await a.exchange(e,A(t.config,p.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return m instanceof st?$(u,m.code,{platform:i.id,error:m.error}):m instanceof Error?(console.error(`coder server: ${i.id} sign-in failed`,m),$(u,`failed`,{platform:i.id})):await t.auth.link(s.user,i.id,m.id,{organizations:s.organizations.map(e=>e.id),...m.token?{token:k(t.config,{app:p.id,token:m.token})}:{}})===`taken`?$(u,`account-taken`,{platform:i.id}):(await vm(l,s.user.id,i.id,m.id),$(u,`linked`,{platform:i.id,account:m.login??m.id}))}function wd(e,t,n,r){return e.withAppLock(`installation:${t}`,async e=>{let i=n(await e.get(`installation`,t));if(!i)return;let a=await e.list(`installation`),o=a.filter(e=>e.id!==t&&e.value.app===i.app&&!e.value.deletedAt&&i.covers?.includes(e.id.slice(i.app.length+1))),s=new Set(o.map(e=>e.id));Wa(a.map(e=>[e.id,s.has(e.id)?{...e.value,deletedAt:r}:e.value]),t,i);for(let t of o)await e.put(`installation`,t.id,{...t.value,deletedAt:r});return await e.put(`installation`,t,i),i})}async function Td(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=Bt(r.searchParams.get(`state`)),c=Bg(s?.back),l=t.integrations[i];if(!l)return $(t,`unknown-integration`,{platform:i},c);let u=t.config.publicUrl;if(!u)return $(t,`no-public-url`,{},c);let d=r.searchParams.get(`app`),f=s?.tx?await Ir(t,s.tx,`install`,o):void 0;if(!f||d&&d!==f)return $(t,`install-expired`,{platform:i,appId:d??void 0},c);let p=await t.store.get(`app`,d??f);if(!p)return $(t,`unknown-app`,{platform:i},c);let m=A(t.config,p.credentials);return zt(l.app.installUrl(p,m,{publicUrl:u,state:r.searchParams.get(`state`)??jt({})}))}async function Ed(e,t,n,r){let i=n.id,a=t.apps?await t.apps(i):(await t.store.list(`app`,{prefix:`${i}:`})).map(e=>({organizationId:t.organizationId,app:e.value})),o=await n.app.installedApp(e,{apps:a.map(({app:e})=>({app:e,credentials:A(t.config,e.credentials)})),fetch:r}).catch(e=>(console.error(`coder server: finding the ${i} app of an install failed`,e),e instanceof Error?e:Error(String(e))));if(o instanceof Error)return $(t,`failed`,{platform:i});if(!o)return $(t,`unknown-app`,{platform:i});let{app:s,installation:c}=o,l=a.find(e=>e.app.id===s.id).organizationId,u=s.builtin||!t.session?t:vd(t,t.session,l);if(!u)return $(t,`other-workspace`,{platform:i});let d=await kr(u,`install`,t.session?.user.id??`anonymous`,s.id);return zt(n.app.installUrl(s,A(t.config,s.credentials),{publicUrl:t.config.publicUrl,state:jt({tx:d,installation:c}),installation:c}))}async function Dd(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=Bt(r.searchParams.get(`state`)),c=s?.tx&&t.session?vd(t,t.session,Mr(t,s.tx)):void 0,l=c?{...t,...c}:t,u=Bg(s?.back),d=l.integrations[i];if(!d)return $(l,`unknown-integration`,{platform:i},u);if(!l.config.publicUrl)return $(l,`no-public-url`,{},u);let f=l.fetch??fetch,p=r.searchParams.get(`app`),m=s?.tx?await Ir(l,s.tx,`install`,o):void 0,h={platform:i,appId:p??m},g=r.searchParams.get(`error`);if(g)return g===`access_denied`?$(l,`cancelled`,h,u):$(l,`platform-error`,{...h,error:g},u);if(!r.searchParams.has(`state`)&&d.app.installedApp&&!a)return Ed(e,l,d,f);if(!m||p&&p!==m||!await Pr(l,s.tx,`install`,o,m))return $(l,`install-expired`,h,u);let _=await l.store.get(`app`,p??m),v=s?.link?await l.store.get(`installation`,s.link):void 0,y=_??(v&&await Gg(l,v,i));return y?Od(e,l,d,y,v,u,s?.installation):s&&!s.link?$(l,`connected`,{platform:i},u):$(l,`unknown-app`,{platform:i},u)}async function Od(e,t,n,r,i,a,o){let s=n.id,c=t.fetch??fetch,l=t.now?.()??Date.now(),u=t.config.publicUrl;if(r.builtin&&n.app.builtin!==`shared`)return $(t,`unknown-app`,{platform:s},a);let d=a??(r.builtin?void 0:Rg(t,r.agent)),f=A(t.config,r.credentials),p=await n.app.installCallback(e,{app:r,credentials:f,publicUrl:u,fetch:c,...o?{installation:o}:{}}).catch(e=>e instanceof st?$(t,e.code,{platform:s,appId:r.id,error:e.error},d):(console.error(`coder server: installing ${r.id} failed`,e),$(t,`failed`,{platform:s,appId:r.id},d)));if(p instanceof Response)return p;let m=`${r.id}:${p.platformInstallId}`,h=t.session;p.user&&h&&t.auth&&await t.auth.link(h.user,s,p.user.id,{organizations:h.organizations.map(e=>e.id),...p.user.token?{token:k(t.config,p.user.token)}:{}});let g=await t.store.get(`installation`,m),_={...g,id:m,app:r.id,integration:s,account:p.account??g?.account??i?.account??{login:`unknown`},...p.token?{token:k(t.config,p.token)}:{},...p.installer?{installer:p.installer}:{},...p.self?{self:p.self}:{},...p.covers?{covers:p.covers}:{},createdAt:g?.createdAt??l};if(delete _.deletedAt,n.repos){let e=await n.auth.token(_.token?{..._,token:A(t.config,_.token)}:_,f,void 0,{fetch:c});_.repos=await n.repos.list(_,e,c)}let v=i&&!i.deletedAt?i:void 0;v&&(_=Wg(_,v.integration,v.id));try{_=await wd(t.store,m,e=>p.covers===null?{..._,covers:e?.covers??[]}:_,l)}catch(e){return e instanceof Ba?$(t,`installation-bound`,{platform:s,account:_.account.login},d):$(t,`installation-taken`,{platform:s},d)}return v&&await t.store.put(`installation`,v.id,Wg(v,s,m)),_.installer&&n.welcome&&await kd(t,n,r,f,p.platformInstallId,_.installer),$(t,`connected`,{platform:s,account:_.account.login},d)}async function kd(e,t,n,r,i,a){try{let[{adapterContext:o,dashUrl:s},{record:l,version:u}]=await Promise.all([Promise.resolve().then(()=>Qu),sa(e.store,n.agent)]),d=l?.settings?.engine??u?.definition.engine??c,f=!!await Mp(e.store,d,e.session?.user.id)||await Tp(e,l?.settings?.engine??u?.definition.engine),p=o(e,t,n,r,{id:i},await s(e)),m=`${e.config.publicUrl.replace(/\/$/,``)}${Rg(e,n.agent)}`;await t.welcome(p,a,{open:m,...f?{}:{setup:await Zp(e,d)}})}catch(e){console.error(`coder server: could not greet the installer of ${n.id}`,e)}}const Ad=/^[a-z0-9][a-z0-9_-]*$/i;async function jd(e,t){let n=ft(pt(),`builtin`).map(({name:e})=>({name:e,scope:`builtin`}));if(!t)return D(n);try{let{integration:r,token:i}=await jo(e,t),a=(r.repos?await r.repos.listDir(t,`.coder/flows`,i):[]).map(e=>e.replace(/\.(ts|mjs|js)$/,``)).filter(e=>Ad.test(e));return D([...a.map(e=>({name:e,scope:`workspace`})),...n.filter(e=>!a.includes(e.name))])}catch(e){return Hd(e)}}async function Md(e,t){if(!t)throw new W(`repo is required`);let{integration:n,token:r}=await jo(e,t);return D(await n.repos?.pullRequests(t,r)??[])}async function Nd(e,t){try{return D(Wd(await No(e,`dashboard`,t)),201)}catch(e){return Hd(e)}}async function Pd(e,t,n,r){try{return jd(t,r.searchParams.get(`repo`))}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}async function Fd(e,t,n,r){try{return await Md(t,r.searchParams.get(`repo`))}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}async function Id(e,t,n,r){let i=n.name;try{return Nd(t,{...await bf(e),flow:i})}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}async function Ld(e,t,n,r){try{{let{post:n,...r}=await bf(e);if(!r.repo||!r.pr)throw new W(`repo and pr are required`);return Nd(t,{...r,flow:`review`,args:{post:n===!0}})}}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}function Rd(e,t,n){return(e.waitUntil??(e=>void e.catch(()=>{})))(t),Promise.resolve(D({tasks:n},202))}async function zd(e,t,n,r,i,a,o){if(`ack`in i)return new Response(null,{status:200});if(`unhandled`in i)return console.warn(`coder server: ${n.id} sent ${i.unhandled}, which Coder does not handle yet`),new Response(null,{status:200});if(`work`in i){if(o){let a=hd(e).then(a=>i.work(gd(e,t,n,r,o,a))).catch(t=>(console.error(`coder server: webhook work failed for ${n.id}`,t),Xu(e,n,t,o.id)));(e.waitUntil??(()=>{}))(a)}return D({ok:!0})}if(`installation`in i){let t=await Ti(e,i.installation.installation.id),n=await t?.store.get(`installation`,i.installation.installation.id);return!t||!n?D({ok:!0}):(await t.store.withAppLock(`repositories:${n.id}`,async e=>{let t=await e.get(`installation`,n.id);if(!t||i.installation.repos&&t.deletedAt)return;let r=i.installation.repos,o=r?r.refresh||t.repos==null?void 0:[...new Set([...t.repos,...r.add])].filter(e=>!r.remove.includes(e)):i.installation.installation.repos;await so(e,`installation`,n.id,{account:i.installation.installation.account,...r||o?{repos:o}:{},deletedAt:i.installation.op===`delete`?a:void 0})}),await Af(t.store,n.id),D({ok:!0}))}if(`covers`in i){let{installation:t,add:n=[],remove:r=[]}=i.covers,o=await Ti(e,t),s=!1;try{o&&await wd(o.store,t,e=>{if(s=!!e,!e||e.deletedAt)return;let t=[...new Set([...e.covers??[],...n])];return{...e,covers:t.filter(e=>!r.includes(e))}},a)}catch(e){if(!(e instanceof Ba))throw e;console.error(`coder server: ${t} covers an account bound elsewhere; grant ignored`)}return s?D({ok:!0}):new Response(`Installation not stored yet`,{status:503})}if(`pushed`in i&&i.pushed){let t=await Ti(e,i.pushed.installation);t&&await Ea(t.store,i.pushed)}if(!(`changes`in i)&&`pushed`in i)return D({ok:!0});if(`changes`in i){let r=i.changes;try{n.branch||await so(e.store,`app`,n.id,{branch:r.branch});let i=await za(e,r.repo,r.ref,{...Ra(),integration:t.id,appId:n.id},r.branch);return i?D({imported:i.map(e=>e.agent)}):D({error:`No installed app can read ${r.repo}`},400)}catch(e){return D({error:e instanceof Error?e.message:String(e)},400)}}for(let a of i.events)ld(e,n,a,fd(e,n,a).then(i=>ud(e,t,n,r,a,i)));return D({accepted:i.events.length},202)}async function Bd(e,t,n){let r=t.integrations[n],i=await e.text(),a=r.target(e,i);if(a instanceof Response)return a;if(!a)return new Response(`Not addressed to an app`,{status:400});let o=`${r.id}:${a.app}`,s=t.webhookTarget?await t.webhookTarget(o,a.installation?`${o}:${a.installation}`:void 0):void 0,c=t.webhookTarget?s&&{ctx:{...U(t,s.organizationId),...s.bound?{boundInstallation:s.bound}:{}},app:s.app}:await wi(t,o);if(!c)return new Response(`Unknown app`,{status:404});let{ctx:l,app:u}=c,d=A(l.config,u.credentials),f=a.installation?{...a,id:a.installation}:void 0,p=r.ownEvents?.(e,i,u,d);if(p&&`invalid`in p)return new Response(`Invalid signature`,{status:401});if(p)return zd(l,r,u,d,p,(l.now??Date.now)(),f);let m=(await _d(l,u,f)).webhooks[r.id];return m(new Request(e.url,{method:`POST`,headers:e.headers,body:i}),{deduplicate:!1,propagateHandlerErrors:!0,waitUntil:e=>{let t=e.catch(e=>(console.error(`coder server: webhook work failed for ${u.id}`,e),Xu(l,u,e,a.installation)));l.waitUntil&&l.waitUntil(t)}})}const Vd=new Set([`completed`,`failed`,`cancelled`]);function Hd(e){if(e instanceof W)return D({error:e.message,...e.fix?{fix:e.fix}:{}},e.status);throw e}function Ud(e){let{id:t,name:n,source:r,agent:i,flow:a,event:o,prompt:s,cwd:c}=e.task;return{task:{id:t,...n?{name:n}:{},source:r,agent:i,flow:a,...c?{cwd:c}:{},...s?{prompt:s}:{},...o?{event:{integration:o.integration,type:o.type,text:o.text}}:{}},status:e.status,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},attempts:e.attempts,...e.approval===void 0?{}:{approval:e.approval},...e.archivedAt===void 0?{}:{archivedAt:e.archivedAt},createdAt:e.createdAt,startedAt:e.startedAt,finishedAt:e.finishedAt,updatedAt:e.updatedAt}}function Wd(e){let{tokenHash:t,handle:n,...r}=e;return{...r,...e.status===`queued`?{statusReason:`Waiting for a task slot`}:{},turns:Po(e),...e.task.credential?{credential:Op(e.task.credential).label}:{}}}async function Gd(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?O(r,500,2e3):void 0,c=vu(t.store,i,o,s??500);c?.catch(()=>{});let l=await t.store.get(`task`,i);if(!l||t.local&&l.handle?.startsWith(`cli:`)&&l.task.flow==="default"){let e=l?.task.cwd??t.local?.cwd;if(!e)return D({error:`No task "${i}"`},404);let n=lp(e,i,!0);return n?D({...n,...l?.answer?{answer:l.answer}:{},logs:cp(e,i,-1,s??500)}):D({error:`No task "${i}"`},404)}return D({...Wd(await Go(t,l)),logs:await c})}async function Kd(e,t,n,r){let i=n.id;Number(r.searchParams.get(`after`)??-1),r.searchParams.has(`limit`)&&O(r,500,2e3);let a=await t.store.get(`task`,i);if(!a||t.local&&a.handle?.startsWith(`cli:`)&&a.task.flow==="default"){let n=a?.task.cwd??t.local?.cwd;if(!n)return D({error:`No task "${i}"`},404);let r=await up(e,n,i,void 0,t);return r.ok&&t.queue instanceof oh&&t.queue.tombstone(i),r}if(t.local&&a.handle?.startsWith(`cli:`)){let e=(t.now??Date.now)();await t.queue.cancel(t.organizationId,i,e,{attempts:a.attempts,tokenHash:a.tokenHash,generation:a.generation??0});let n=await t.store.get(`task`,i);if(n&&qm.includes(n.status)){await np(t,n,e);let r=await t.store.get(`task`,i);if(r&&qm.includes(r.status))return D({error:`Task is still stopping. Try again.`},409)}}else if([`running`,`waiting`].includes(a.status)&&a.handle)try{let e=await Qt(t,a.task);if(!e)return D({error:`Task runner is unavailable. Try again.`},409);await e.stop(a.handle)}catch{return D({error:`Task is still stopping. Try again.`},409)}return await rh(t,a)?(await Km(t.store,i),t.local&&(await t.store.delete(`snapshot`,`local-start:${i}`),await t.store.delete(`snapshot`,`completion:${i}`)),Xo(t,!0),D({ok:!0})):D({error:`Task changed while deleting. Try again.`},409)}async function qd(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1,s=r.searchParams.has(`limit`)?O(r,500,2e3):void 0,c=vu(t.store,i,o,s??void 0);c?.catch(()=>{});let l=await t.store.get(`task`,i);if(!l||t.local&&l.handle?.startsWith(`cli:`)&&l.task.flow==="default"){let e=l?.task.cwd??t.local?.cwd;return!e||!lp(e,i,!1)?D({error:`No task "${i}"`},404):D(cp(e,i,o,s))}return await Go(t,l),D(await c)}async function Jd(e,t,n,r){let i=n.id;Number(r.searchParams.get(`after`)??-1),r.searchParams.has(`limit`)&&O(r,500,2e3);let a=await t.store.get(`task`,i);if(!a||t.local&&a.handle?.startsWith(`cli:`)&&a.task.flow==="default"){let n=a?.task.cwd??t.local?.cwd;return n?up(e,n,i,`steer`,t):D({error:`No task "${i}"`},404)}if(a.task.flow!=="default")return D({error:`steer is available only for default-flow tasks`},409);let o=await e.json().catch(()=>void 0);if(Vd.has(a.status)){let{text:e,outputSchema:n,model:r,effort:i,permissions:s}=o??{};try{let o=await Fo(t,a,String(e??``),n,{model:r,effort:i,permissions:s});return Xo(t,!0),D(Wd(o))}catch(e){return Hd(e)}}let s=await ih(t,i,`steer`,o,a.generation??0);return s?D(s):D({error:`Task "${i}" is no longer active`},409)}async function Yd(e,t,n,r){let i=n.id;Number(r.searchParams.get(`after`)??-1),r.searchParams.has(`limit`)&&O(r,500,2e3);let a=await t.store.get(`task`,i);if(!a||t.local&&a.handle?.startsWith(`cli:`)&&a.task.flow==="default"){let n=a?.task.cwd??t.local?.cwd;return n?up(e,n,i,`ask`,t):D({error:`No task "${i}"`},404)}if(a.task.flow!=="default")return D({error:`ask is available only for default-flow tasks`},409);if(![`queued`,`running`,`waiting`].includes(a.status))return D({error:`Task "${i}" is not active`},409);let o=await ih(t,i,`ask`,await e.json().catch(()=>void 0),a.generation??0);return o?D(o):D({error:`Task "${i}" is no longer active`},409)}async function Xd(e,t,n,r){let i=n.id;Number(r.searchParams.get(`after`)??-1),r.searchParams.has(`limit`)&&O(r,500,2e3);let a=await t.store.get(`task`,i);if(!a||t.local&&a.handle?.startsWith(`cli:`)&&a.task.flow==="default"){let n=a?.task.cwd??t.local?.cwd;return n?up(e,n,i,`approve`,t):D({error:`No task "${i}"`},404)}if(a.task.flow!=="default")return D({error:`approve is available only for default-flow tasks`},409);if(![`queued`,`running`,`waiting`].includes(a.status))return D({error:`Task "${i}" is not active`},409);if(!a.approval)return D({error:`Task "${i}" has no pending approval`},409);let o=await ih(t,i,`approve`,await e.json().catch(()=>void 0),a.generation??0);return o?D(o):D({error:`Task "${i}" is no longer active`},409)}async function Zd(e,t,n,r){let i=n.id;Number(r.searchParams.get(`after`)??-1),r.searchParams.has(`limit`)&&O(r,500,2e3);let a=await t.store.get(`task`,i);if(!a||t.local&&a.handle?.startsWith(`cli:`)&&a.task.flow==="default"){let n=a?.task.cwd??t.local?.cwd;return n?up(e,n,i,`cancel`,t):D({error:`No task "${i}"`},404)}let o=await t.queue.cancel(t.organizationId,i,(t.now??Date.now)(),{attempts:a.attempts,tokenHash:a.tokenHash??null,generation:a.generation??0});if(o&&a.status!==`queued`){await ch(t,i);let e=await t.store.get(`task`,i);e&&!Vd.has(e.status)&&qo(t,a)}return o?D({ok:!0}):D({error:`No running or queued task "${i}"`},404)}async function Qd(e,t,n,r){let i=n.id;Number(r.searchParams.get(`after`)??-1),r.searchParams.has(`limit`)&&O(r,500,2e3);let a=await t.store.get(`task`,i);if(!a||t.local&&a.handle?.startsWith(`cli:`)&&a.task.flow==="default"){let n=a?.task.cwd??t.local?.cwd;return n?up(e,n,i,`archive`,t):D({error:`No task "${i}"`},404)}let o=(t.now??Date.now)();return await t.queue.patchTask(t.organizationId,i,{archivedAt:o,autoArchived:void 0},o),D({ok:!0})}async function $d(e,t){if(!e.agent||!e.event?.integration)return D({error:`agent and event are required`},400);let n=t.integrations[e.event.integration];if(!n)return D({error:`Unknown integration "${e.event.integration}"`},400);let r=e.event.actor?.id;if(t.auth&&r){let e=await t.auth.linkedUser(n.id,r);if(e&&e.id!==t.session?.user.id)return D({error:`The event's actor is linked to another member`},403)}let i=(await t.store.list(`app`)).map(e=>e.value).find(t=>t.agent===e.agent&&t.integration===n.id);if(!i)return D({error:`No ${n.id} app for agent "${e.agent}" on this server.`},404);let a=(await t.store.list(`installation`)).map(e=>e.value).filter(e=>e.app===i.id&&!e.deletedAt),o=a.find(t=>t.id===`${i.id}:${e.event.installationId}`)??a[0];if(!o)return D({error:`The ${n.id} app for "${e.agent}" is not installed anywhere yet`},404);let s=t.now??Date.now,c={...e.event,appId:i.id,installationId:o.id.slice(i.id.length+1),deliveryId:`admin-${s()}-${sr()}`},l=await Ku(t,n,i,A(t.config,i.credentials),c,s,await fd(t,i,c));return Rd(t,l.work??Promise.resolve(),l.taskId?[l.taskId]:[])}const ef=new Set([`queued`,`running`,`waiting`,`completed`,`failed`,`cancelled`]);async function tf(e,t,n,r){let i=await e.json().catch(()=>void 0);if(!i||typeof i!=`object`)return D({error:`A JSON body is required`},400);try{if(To(t,i),i.event)return $d(i,t);let e=(i.source===`cli`?void 0:await $f(t,i))??await No(t,i.source===`cli`?`cli`:`dashboard`,i);return D(Wd(e),201)}catch(e){return Hd(e)}}function nf(e,t,n){let r=new Map(t.map(e=>[e.task.id,e]));for(let t of n)ye(e,t,r.has(t.task.id))&&r.set(t.task.id,t);return[...r.values()]}async function rf(e,t,n,r){n.id;let i=r.searchParams.get(`status`);if(i&&i!==`active`&&!ef.has(i))return D({error:`Unknown status "${i}"`},400);let a=r.searchParams.get(`source`);if(a&&![`dashboard`,`cli`,`schedule`,...Object.keys(t.integrations)].includes(a))return D({error:`Unknown source "${a}"`},400);let o=r.searchParams.has(`since`)?Number(r.searchParams.get(`since`)):void 0;if(o!==void 0&&(!Number.isFinite(o)||o<0))return D({error:`Invalid since`},400);let s=r.searchParams.get(`agent`),c=r.searchParams.get(`q`)?.trim(),l={...s?{agent:s}:{},...a?{source:a}:{},...c?{q:c}:{},archived:o===void 0?r.searchParams.get(`archived`)===`1`:void 0,...o===void 0?{}:{since:o,...r.searchParams.get(`sinceId`)?{sinceId:r.searchParams.get(`sinceId`)}:{}}},u=i===`active`?{statuses:qm}:i?{status:i}:{},d=r.searchParams.get(`summary`)===`1`||o!==void 0&&!r.searchParams.has(`summary`),f=e=>d?e.map(Ud):e.map(Wd);if(t.local){let e=o===void 0?Zf(t.local.cwd,l.archived):[...Zf(t.local.cwd,!0).map(e=>({...e,updatedAt:Math.max(e.updatedAt,e.archivedAt)})),...Zf(t.local.cwd,!1)],n=nf(t.local.cwd,e,await t.queue.list(t.organizationId)).filter(e=>Jm(e,{...l,...u})).sort(o===void 0?Qm:Zm),i=O(r,Pt(r)?void 0:20);if(!Pt(r))return D(f(n.slice(0,i)));let a=Rt(r),s=n.filter(e=>$m(e,a)),c=Vt(s.slice(0,i+1),i,o===void 0?Ym:Xm);return D({...c,items:f(c.items),...r.searchParams.get(`counts`)===`1`?{counts:{all:n.length,active:n.filter(e=>qm.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}:{}})}if(!Pt(r)){let e=O(r,20),n=await t.queue.list(t.organizationId,{...l,...u,limit:e,summary:d});return D(f(n))}let p=O(r),m=Rt(r),h=r.searchParams.get(`counts`)===`1`&&!i&&!m&&t.queue.listWithCounts?await t.queue.listWithCounts(t.organizationId,{...l,limit:p+1,summary:d}):void 0,[g,_]=await Promise.all([h?h.items:t.queue.list(t.organizationId,{...l,...u,summary:d,...m?{before:m}:{},limit:p+1}),h?h.counts:r.searchParams.get(`counts`)===`1`?t.queue.counts(t.organizationId,{...l,...u}):void 0]),v=Vt(g,p,o===void 0?Ym:Xm);return D({...v,items:f(v.items),..._?{counts:_}:{}})}var af=class extends Error{};const of=async e=>await e.get(`config`,`workspace`)??{};async function sf(e){return of(e)}function cf(){let e=x();if(!H.existsSync(e))return{};try{return JSON.parse(H.readFileSync(e,`utf8`))}catch(t){throw new af(`Invalid JSON in ${e}: ${t.message}`)}}function lf(e){let{mcp:t,...n}=e;return n}async function uf(e){return e.local?lf(cf()):of(e.store)}const df=(e,t)=>e.local?lf(Be(e.local.cwd)):we(t);async function ff(e,t){return pf(e,e=>hf(e,t))}async function pf(e,t){let n=e.settings??={},r=(n.configUpdate??Promise.resolve()).catch(()=>{}).then(()=>e.local?t(e):e.store.withConfigLock(n=>t({...e,store:n})));n.configUpdate=r;try{return await r}finally{n.configUpdate===r&&delete n.configUpdate}}function mf(e){let t=o(e);if(t.length)throw new af(t.join(`; `))}async function hf(e,t){if(mf(t),t.mcp)throw new af(`Add a connection in Settings to attach an MCP server`);if(e.local){let{mcp:n}=cf();return v({...t,...n?{mcp:n}:{}}),uf(e)}return await e.store.put(`config`,`workspace`,t),uf(e)}const gf=async e=>e.local?lf(cf()):sf(e.store);async function _f(e,t){return pf(e,async e=>{let n=structuredClone(await gf(e));return t(n),hf(e,n)})}function vf(e,t){return pf(e,async e=>hf(e,yf(await gf(e),t)))}function yf(e,t){if(!t||typeof t!=`object`||Array.isArray(t))return t;let n=e&&typeof e==`object`&&!Array.isArray(e)?Object.fromEntries(Object.entries(e)):{};for(let[e,r]of Object.entries(t))r===null?delete n[e]:Object.defineProperty(n,e,{value:yf(Object.hasOwn(n,e)?n[e]:void 0,r),writable:!0,enumerable:!0,configurable:!0});return n}async function bf(e){let t=await e.json().catch(()=>void 0);if(!t||typeof t!=`object`)throw new af(`A JSON body is required`);return t}async function xf(e,t){try{return D(await _f(e,t))}catch(e){if(e instanceof af)return D({error:e.message},400);throw e}}async function Sf(e,t,n,r){try{{let e=await uf(t);return D({config:e,effective:df(t,e)})}}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}async function Cf(e,t,n,r){try{{let n=await e.json().catch(()=>{throw new af(`A JSON body is required`)});return D(await vf(t,n))}}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}async function wf(e,t,n,r){try{return D(await ff(t,await bf(e)))}catch(e){return e instanceof af?D({error:e.message},400):Hd(e)}}function Tf(e,t){return t.token?{...t,token:A(e.config,t.token)}:t}const Ef=3e5,Df=(e,t=``)=>`token:${e}:${t}`,Of=e=>`token-drop:${e}`,kf=(e,t)=>Promise.all([t.id,t.app].map(t=>e.get(`snapshot`,Of(t)))).then(e=>e.map(e=>e?.drop).join());async function Af(e,t){await e.put(`snapshot`,Of(t),{drop:sr()},{ttlMs:36e5});for(let n of await e.list(`snapshot`,{prefix:Df(t)}))await e.delete(`snapshot`,n.id)}async function jf(e,t,n,r,i,a=0){let o=n.token,s=Tf(e,n);return t.auth.token(s,r,i,{fetch:e.fetch,async hold(t,r){let i=Df(n.id,t),o=await e.store.get(`snapshot`,i),s=(e.now??Date.now)(),c=o?o.expiresAt-o.mintedAt:0,l=a+(a+Ef<=c?Ef:0);if(o&&o.expiresAt-s>Math.max(l,Ef))try{return A(e.config,o.token)}catch(e){console.error(`coder server: held token unreadable, minting again`,e)}let u=await kf(e.store,n),d=await r();return await kf(e.store,n)===u?(await e.store.put(`snapshot`,i,{token:k(e.config,d.token),expiresAt:d.expiresAt,mintedAt:s},{ttlMs:Math.max(d.expiresAt-s-Ef,0)}),await kf(e.store,n)!==u&&await e.store.delete(`snapshot`,i),d.token):d.token},async save(t){let r=k(e.config,t),i;return await e.store.withCredential(`installation`,n.id,async t=>{if(t){if(!(t.token===o||t.token&&A(e.config,t.token)===s.token)){i=t.token;return}return[{id:n.id,value:{...t,token:r}}]}}),n.token=i??r,i&&A(e.config,i)}})}async function Mf(e,t,n,r){if(!t.auth.user||!e.auth)return;let i=await e.auth.linkedUser(t.id,n.actor.id);if(!i?.token||!i.organizations?.includes(e.organizationId))return;let a=mm(e.config,i.token),o=a.app&&a.app!==n.appId,s=o?await xm(e,t.id,a.app):void 0;if(o&&!s)return;let c=await t.auth.user.access(a.token,s?A(e.config,s.credentials):r,{fetch:e.fetch??fetch,now:(e.now??Date.now)()});return c.refreshed&&await e.auth.link(i,t.id,n.actor.id,{token:k(e.config,a.app?{app:a.app,token:c.refreshed}:c.refreshed)}),c.accessToken}function Nf(e,t){return{...e?{repo:{owner:e.owner,name:e.name}}:{},tools:t}}async function Pf(e,t,n,r,i,a,o){return(o===`requester`?await Mf(e,t,r,i).catch(()=>void 0):void 0)??jf(e,t,n,i,a,e.config.taskTimeoutMs)}const Ff=e=>{let t=e&&/^([^/]+)\/([^/]+)$/.exec(e);return t?{owner:t[1],name:t[2]}:void 0};async function If(e,t,n,r){let i=await e.store.get(`installation`,n.id);if(!i||i.deletedAt)return;let a=await e.store.get(`app`,i.app),o=e.integrations[t];if(!a||!o)return;let s=r?r.toolScopes?.[t]?.repo:Ff(i.settings?.configRepo);if(s)return{installation:i.id,repo:s,mint:async(n=s)=>jf(e,o,i,A(e.config,a.credentials),Nf(n,r?r.tools[t]??[]:o.tools.presets.observe),r&&e.config.taskTimeoutMs)}}const Lf=e=>t=>{console.error(`coder server: could not mint a connected ${e} token`,t)};function Rf(e,t,n,r,i){let a=[],o=(e,t)=>{let n=new Map;return r=>{let i=r?Ff(r):e;if(r&&!i)return Promise.resolve(void 0);let o=i?`${i.owner}/${i.name}`:``,s=n.get(o);return s||(s=t(i).then(e=>(e&&a.push(e),e)),n.set(o,s)),s}},s=async a=>{let s=e.fetch??fetch;if(a===r.integration)return{installation:n.id,fetch:s,token:o(r.repo,r=>jf(e,t,n,i,Nf(r,t.tools.presets.observe)))};let c=n.connections?.[a],l=c&&await If(e,a,c);return l&&{installation:l.installation,fetch:s,token:o(l.repo,e=>l.mint(e).catch(Lf(a)))}},c=new Map;return Object.assign(e=>(c.has(e)||c.set(e,s(e)),c.get(e)),{minted:a})}async function zf(e,t){let n=t.event,r=e.integrations[n.integration];if(!r)throw Error(`Unknown integration "${n.integration}"`);let[i,a]=await Promise.all([e.store.get(`app`,n.appId),e.store.get(`installation`,`${n.appId}:${n.installationId}`)]);if(!i)throw Error(`Unknown app "${n.appId}"`);if(!a||a.deletedAt)throw Error(`Installation is gone`);let o=t.flow===`review`&&t.args?.post===!0,s=await Pf(e,r,a,n,A(e.config,i.credentials),Nf(t.toolScopes?.[n.integration]?.repo??n.repo,t.tools[n.integration]??(o?r.tools.presets.comment:[])),at(t.definition.integrations[n.integration],n.type)?.actAs),c={[n.integration]:s};return await Promise.all(Object.entries(a.connections??{}).map(async([r,i])=>{if(r===n.integration||!(r in t.tools))return;let a=await(await If(e,r,i,t))?.mint().catch(Lf(r));a&&(c[r]=a)})),c}async function Bf(e,t){let n=t.task,[r,i,a]=await Promise.all([n.event?zf(e,t.task):{},e.local?{}:sf(e.store),Vf(e,n)]),o=await Hm(e,t,r),s={...o.env},c=[...o.warnings];for(let e of Object.keys(s))a.env[e]!==void 0&&(delete s[e],c.push(`${e} is temporarily unavailable; skipped for this task.`));let l=await Wm(e,n),u={...n,tools:o.tools,toolScopes:o.toolScopes},d=await Um(e,n.id,[...o.secrets,...l,...Object.values(o.tokens),...Object.values(r),...Wf(a.env)]);await gu(e,n.id,c);let f={task:u,tokens:{...o.tokens,...r},nativeTokens:o.nativeTokens,credential:a,config:i,connections:o.mcp,connectionEnv:s,connectionSecrets:d};if(n.runner!==`vercel-sandbox`)return f;let p=Object.fromEntries(Object.entries(a.env).map(([e,t])=>[e,e in Gt?Kt:t]));return{...f,credential:{...a,env:p}}}async function Vf(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):(await Mp(e.store,t.usage?.engine??t.definition.engine,t.requester))?.value;if(n)return Wp(e.config,n);if(!t.runnerId&&!e.local)throw Error(`no-credential`);return{engine:t.usage?.engine??t.definition.engine??`claude`,env:{}}}const Hf=e=>e&&URL.canParse(e)?[new URL(e).hostname]:[];async function Uf(e,t,n){if(t.permissions===`auto`)return;let r=e.local?{}:await sf(e.store),i=new Set([...t.event?[t.event.integration]:[],...Object.keys(t.tools)]),a=Yt(n.engine,n.env);if(n.engine===`custom`)for(let e of Object.values(r.models??{}))`baseUrl`in e&&a.push(...Hf(e.baseUrl));for(let n of t.connections??[]){let r=await _m(e,n,t.requester);r?.provider===`mcp`?a.push(...Hf(r.endpoint?.url)):r&&i.add(r.provider)}for(let t of i)a.push(...e.integrations[t]?.hosts??[]);for(let e of Object.values(t.definition.mcp??{}))a.push(...Hf(e.url));for(let e of t.mcp??[])a.push(...Hf(r.mcp?.[e]?.url));for(let e of r.approvals?.allowedNetworkHosts??[]){let t=e.replace(/^\[(.*)\](?::\d+)?$/,`$1`).replace(/^([^:]+):\d+$/,`$1`);a.push(t,...lr.isIP(t)?[]:[`*.${t}`])}return[...new Set(a)]}function Wf(e){let t=[];for(let[n,r]of Object.entries(e))if(!(!/(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH)/i.test(n)&&!h(r))&&(t.push(r),n.endsWith(`_AUTH_JSON`))){let e=JSON.parse(r);t.push(...[e.OPENAI_API_KEY,...Object.entries(e.tokens??{}).filter(([e])=>/TOKEN|KEY|SECRET/i.test(e)).map(([,e])=>e)].filter(e=>typeof e==`string`))}return t}async function Gf(e,t){if(!t.event)return[];let n=await e.store.get(`installation`,`${t.event.appId}:${t.event.installationId}`),r=[];for(let t of[n,...await Promise.all(Object.values(n?.connections??{}).filter(e=>e.kind===`installation`).map(t=>e.store.get(`installation`,t.id)))])t?.token&&r.push(A(e.config,t.token));return r}async function Kf(e,t){let[n,r,i]=await Promise.all([Gm(e,t.task),Vf(e,t.task).catch(e=>{if(e instanceof Error&&e.message===`no-credential`)return{engine:`codex`,env:{}};throw e}),Gf(e,t.task)]),a=e.store instanceof $a&&t.task.event&&!e.store.connectionSecrets?.get(t.task.id)?.length?Object.values(await zf(e,t.task)):[];return a.length&&await Um(e,t.task.id,[...n,...i,...a]),[...n,...i,...a,...Wf(r.env)].filter(e=>e.length>=8)}var qf=r({LOCAL_LOGINS:()=>vp,engineSignIn:()=>xp,engineSignOut:()=>Sp,engineStatus:()=>wp,inspectLocalTask:()=>np,isLoginEngine:()=>bp,localLog:()=>cp,localTask:()=>lp,localTaskAction:()=>up,localTasks:()=>Zf,localUsage:()=>dp,machineSignedIn:()=>Tp,pushLocalInbox:()=>sp,recoverLocalTasks:()=>ip,runLocalTask:()=>op,startLocalTask:()=>$f,startQueuedLocalTask:()=>tp,stopLocalTasks:()=>ap,sweepLocalQueue:()=>Qf,syncLocalUsage:()=>mp});const Jf=e=>!e.name?.startsWith(Dt),Yf=e=>e?Date.parse(e):void 0;function Xf(e,t,n=!1){let r=Yf(t.createdAt)??0,i=Le(V.join(l(e,t.id),`answers.json`)),a=t.status===`running`?We(l(e,t.id)).find(e=>!e.response):void 0,o=n&&!b.includes(t.status)?qe(e,t.id):null,s=n?Oe(e,t.id).filter(e=>!b.includes(t.status)||(Yf(e.at)??0)<(Yf(t.resumedAt)??r)).map(e=>{let n=e.error&&typeof e.error==`object`?e.error.message:void 0;return{prompt:e.prompt??t.prompt??``,result:{ok:e.status===0,output:e.finalMessage??n??``},...n?{error:n}:{},finishedAt:Yf(e.at)}}):[];n&&(b.includes(t.status)||!s.length||(s.at(-1)?.finishedAt??0)<(Yf(t.resumedAt)??r))&&s.push({prompt:t.currentPrompt??t.prompt??``,...o?{result:{ok:o.status===0,output:o.finalMessage??o.error?.message??``}}:{},...t.error?{error:t.error}:{},...b.includes(t.status)?{}:{finishedAt:Yf(t.completedAt)}});let c=t.flowRunId?yt(t.flowRunId)?.name:void 0;return{task:{id:t.id,source:t.source??`cli`,agent:t.agentId??et()??``,flow:c??`default`,...t.name?{name:t.name}:c?{name:c===`review`?`Review`:c}:{},runner:`local`,...t.cwd?{cwd:t.cwd}:{},...t.permissions?{permissions:t.permissions}:{},...t.prompt?{prompt:t.currentPrompt??t.prompt}:{},definition:{integrations:{}},...t.engine?{usage:{engine:t.engine,...t.model?{model:t.model}:{},...t.effort?{effort:t.effort}:{}}}:{},tools:{}},status:a?`waiting`:t.status,attempts:1,...a?{approval:a}:{},...i?{answer:i}:{},...o?{result:{ok:o.status===0,exitCode:null,output:o.finalMessage??o.error?.message??``},...o.tokens?{tokens:o.tokens}:{}}:{},...t.error?{error:t.error}:{},...t.fallbacks?.length?{fallbacks:t.fallbacks}:{},...t.archivedAt?{archivedAt:Yf(t.archivedAt)}:{},...t.autoArchived?{autoArchived:!0}:{},createdAt:r,startedAt:Yf(t.resumedAt)??r,...t.completedAt&&!b.includes(t.status)?{finishedAt:Yf(t.completedAt)}:{},updatedAt:Yf(t.updatedAt)??r,local:!0,...n?{turns:s}:{}}}function Zf(e,t){let n=vt(e);return(t?Ae(e,{migrate:!1}):n).filter(Jf).map(n=>{let r=Xf(e,n);return t?{...r,archivedAt:r.archivedAt??r.updatedAt}:r})}async function Qf(e,t){let n=(e.now??Date.now)(),r=(await e.queue.list(e.organizationId,{archived:!1,statuses:[...te]})).filter(e=>m(e.finishedAt??e.updatedAt,n)&&ye(t,e)).map(e=>e.task.id);r.length&&await e.queue.archiveStopped(e.organizationId,n,r)}async function $f(e,t,n){if(!e.local||t.repo||(t.flow??`default`)!=="default"||t.runner&&t.runner!==`local`)return;let r=To(e,t)??e.local.cwd;await to(e.store,r,e.integrations);let i=et(),a=t.agent??i;if(!a)throw new W(`Name an agent: this server has no default agent.`);let{record:o,version:s}=await sa(e.store,a);wo(e,a,o);let c=await Zt(e,{requester:e.session?.user.id,runner:t.runner,agent:s?.definition.runner}).catch(e=>{throw new W(e.message)});if(!(c.runner!==`local`||c.runnerId)){if(Ao(t),!n)return ep(e,{id:Me(),source:`dashboard`,agent:a,flow:`default`,runner:`local`,cwd:r,prompt:t.prompt,definition:s?.definition??{integrations:{}},...o?.settings?{usage:o.settings}:{},connections:await Yi(e,void 0,E(o?.settings?.connections,t.connections)),tools:{}},{input:t,cwd:r});try{let s=n?await e.store.get(`task`,n):void 0,c=s?.task.connections??await Yi(e,void 0,E(o?.settings?.connections,t.connections)),l=await Vm(e,s?.task??{connections:c,tools:{}}),u=ke(l.mcp,l.env),d=ke(Object.fromEntries(Ct({tools:l.tools},l.tokens).map(e=>[`native:${e.name}`,{...e,resolved:!0}]))),f=a===i?void 0:await wt(r,a,t.mcp?.join(`,`),u.mcp),p=f??Ye(t.mcp?.join(`,`),Be(r).mcp,{},u.mcp),m=[],h=await Je({taskId:n,prompt:t.prompt??``,outputSchema:t.outputSchema,cwd:r,engine:t.engine??f?.engine,model:t.model??(t.engine?void 0:f?.model),effort:t.effort??(t.engine?void 0:f?.effort),permissions:t.permissions??f?.permissions,system:f?.system,mcp:[...Object.values(d.mcp),...p.mcp],mcpBindings:p.mcpBindings,mcpWarnings:[...p.warnings??[],...l.warnings],connectionEnv:{...u.env,...d.env},connections:c,nativeMcp:p.nativeMcp,...f?{agentId:t.agent}:{},source:`dashboard`,onFallback:e=>m.push(e)},{waitForStartup:!1});return Xf(r,m.length?_(r,h.taskId,{fallbacks:m}):h.task)}catch(e){throw e instanceof Ue?new W(e.message,409):e}}}async function ep(e,t,n){let r=(e.now??Date.now)();await e.store.put(`snapshot`,`local-start:${t.id}`,n),await e.queue.enqueue(e.organizationId,t,r,void 0,e.config.maxQueued??1e3),await Yo(e,!1,!0,!0);let i=await e.store.get(`task`,t.id);return i?.status===`queued`?i:lp(n.cwd,t.id)??i}async function tp(e,t){if(!e.local||t.task.runner!==`local`||t.task.runnerId||t.task.event?.repo)return!1;let n=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!n)return!1;try{let r=t.task.id,i=t.task.flow==="default"?ge(n.cwd,t.task.id):void 0;if(i&&!n.resume)r=i.id;else if(n.resume){let e=ge(n.cwd,t.task.id);if(!e)throw Error(`Local task is missing`);await ht(n.cwd,e,t.task.prompt??``,{outputSchema:t.task.context?.outputSchema,...n.overrides})}else n.input?await $f(e,{...n.input,prompt:t.task.prompt,outputSchema:t.task.context?.outputSchema??n.input.outputSchema},t.task.id):r=(await op(e,t.task,t.task.id,!0)).task.id;await e.store.put(`snapshot`,`local-start:${t.task.id}`,{...n,startedId:r});let a={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(!await e.queue.patchTask(e.organizationId,t.task.id,{handle:`cli:${r}`},(e.now??Date.now)(),a)){let e=ge(n.cwd,r);return e&&await gt(n.cwd,e),!0}if(t.task.flow==="default"){let i={task:t.task,cwd:n.cwd,fence:a};await e.store.put(`snapshot`,`completion:${r}`,i),rp(e,r,i);let o=ch(e,t.task.id);e.waitUntil&&e.waitUntil(o)}}catch(n){await e.queue.finish(e.organizationId,t.task.id,{status:`failed`,error:n instanceof Error?n.message:String(n)},(e.now??Date.now)(),{attempts:t.attempts,tokenHash:t.tokenHash})}return!0}async function np(e,t,n){if(t.status!==`running`&&t.status!==`waiting`)return!1;let r=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!r)return!1;let i={attempts:t.attempts,tokenHash:t.tokenHash,generation:t.generation??0,statuses:[`running`,`waiting`]};if(t.task.flow!=="default"){let r=yt(t.task.id);if(r?.status===`running`&&(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs)){let n=e.store.localFlows?.get(t.task.id);n?(await n.stop(),await n.work.catch(()=>{})):r.pid!==process.pid&&await xt(t.task.id),r=yt(t.task.id)}return!r||r.status===`running`?!1:e.queue.finish(e.organizationId,t.task.id,{status:t.cancelRequestedAt===void 0?r.status===`completed`?`completed`:`failed`:`cancelled`,error:r.error},n,i)}let a=lp(r.cwd,r.startedId??t.task.id);if(!a)return!1;if([`queued`,`running`,`waiting`].includes(a.status))if(t.cancelRequestedAt!==void 0||t.startedAt!==void 0&&n-t.startedAt>=e.config.taskTimeoutMs){let e=ge(r.cwd,r.startedId??t.task.id);e&&await gt(r.cwd,e),a=lp(r.cwd,t.task.id)}else return!1;let o=a.status;return o!==`completed`&&o!==`failed`&&o!==`cancelled`?!1:e.queue.finish(e.organizationId,t.task.id,{status:o,result:a.result,error:a.error},n,i)}function rp(e,t,n){let r=e.store.completionWatches??=new Map;if(r.has(t))return;let i={stopped:!1,work:Promise.resolve()};r.set(t,i),i.work=(async()=>{let r=`completion:${t}:${n.fence?.generation??0}`,a=await e.store.get(`delivery`,r);if(a&&!a.owner)return;if(a?.pid)try{process.kill(a.pid,0);return}catch(e){if(e.code!==`ESRCH`)return}let o=sr(),s={owner:o,pid:process.pid,pending:!0,posted:a?.posted??!1};if(a?.owner){if(!await e.store.updateDelivery(r,a.owner,s))return}else if(!await e.store.create(`delivery`,r,s))return;try{for(let a=0;a<5;a++)try{let a=null,c=!1;for(;;){if(i.stopped)return;if(n.fence){let t=await e.store.get(`task`,n.task.id);if(!t||(t.generation??0)!==n.fence.generation||t.attempts!==n.fence.attempts||t.tokenHash!==n.fence.tokenHash||t.status===`queued`)return}let r=ge(n.cwd,t);if(!r)return;let o=Se(n.cwd,r);if(!b.includes(o.status)){c=o.status===`cancelled`;let e=V.join(l(n.cwd,t),`result.json`),r=Math.max(Yf(o.completedAt)??0,Yf(o.resumedAt)??Yf(o.createdAt)??0);if(H.existsSync(e)&&H.statSync(e).mtimeMs>=r&&(a=qe(n.cwd,t)),a)break;if(o.error||o.status===`cancelled`){a={status:1,threadId:o.threadId??null,error:{message:o.error??`Task cancelled`}};break}}await new Promise(e=>setTimeout(e,100))}let u=await e.store.get(`task`,n.task.id);if(n.fence&&u&&(u.generation??0)===n.fence.generation&&u.attempts===n.fence.attempts&&u.tokenHash===n.fence.tokenHash&&await np(e,u,(e.now??Date.now)())&&Xo(e,!0),!await e.store.updateDelivery(r,o,s))return;if(!s.posted&&n.task.source===n.task.event?.integration){let t=await e.store.get(`app`,n.task.event.appId);if(!t)throw Error(`Local completion has no app`);let{eventReplies:i}=await Promise.resolve().then(()=>Qu),l=await i(e,t,n.task.event);if(!await e.store.updateDelivery(r,o,s))return;let u=Tt(n.task,a,c);if(u.text&&await(u.problem?l.problem:l.post)(u.text),s={...s,posted:!0},!await e.store.updateDelivery(r,o,s))return}let d=V.join(l(n.cwd,t),`agent-note`),f=H.existsSync(d)?H.readFileSync(d,`utf8`).trim():(n.task.context?.note??``).trim();if(!await e.store.updateDelivery(r,o,s))return;f!==(n.task.context?.note??``).trim()&&(f?await e.store.put(`note`,Cu(n.task),f):await e.store.delete(`note`,Cu(n.task))),await e.store.updateDelivery(r,o,{posted:s.posted,at:Date.now()})&&(await e.store.get(`snapshot`,`completion:${t}`))?.fence?.generation===n.fence?.generation&&await e.store.delete(`snapshot`,`completion:${t}`);return}catch(n){if(a===4)throw n;console.error(`coder server: local completion ${t} attempt ${a+1} failed, retrying`,n);let r=e.now??Date.now,o=r()+5e3*2**a;for(;!i.stopped&&r()<o;)await new Promise(e=>setTimeout(e,Math.min(100,o-r())))}}finally{await e.store.updateDelivery(r,o,{...s,pid:void 0})}})().catch(e=>{console.error(`coder server: local completion ${t} failed`,e)}).finally(()=>{r.delete(t)})}async function ip(e){if(e.local)for(let{id:t,value:n}of await e.store.list(`snapshot`,{prefix:`completion:`}))ge(n.cwd,t.slice(11))&&rp(e,t.slice(11),n)}async function ap(e){await Promise.all([...e.store.localFlows?.values()??[]].map(async e=>{await e.stop(),await e.work.catch(()=>{})}));let t=e.store.completionWatches;if(t){for(let e of t.values())e.stopped=!0;await Promise.all([...t.values()].map(e=>e.work))}}async function op(e,t,n,r=!1){if(t.event?.repo){let r=(e.now??Date.now)(),i=n??t.id;return await e.store.get(`task`,i)||await e.queue.enqueue(e.organizationId,{...t,id:i},r,void 0,e.config.maxQueued??1e3),await Yo(e,!1,!1,!0),await e.store.get(`task`,i)}if(!r){let r=To(e,t)??e.local.cwd;return ep(e,{...t,id:n??Me(),cwd:r},{cwd:r})}let i=t.event?await zf(e,t):{},a=await Vm(e,t,i);await gu(e,n??t.id,a.warnings),await Um(e,n??t.id,[...a.secrets,...Object.values(a.tokens)]),t={...t,tools:a.tools,toolScopes:a.toolScopes};let o=a.tokens,s=t.event&&i[t.event.integration],c=To(e,t)??e.local.cwd,u=await e.store.get(`task`,n??t.id),d={task:t,cwd:c,...u?{fence:{generation:u.generation??0,attempts:u.attempts,tokenHash:u.tokenHash,statuses:[`running`,`waiting`]}}:{}},f=t.flow!=="default"&&n?yt(n):void 0;if(f){let r=Pe(c).find(e=>e.flowRunId===n),i=(e.now??Date.now)();return r?Xf(c,r):{task:t,status:f.status===`running`?`running`:f.status===`completed`?`completed`:`failed`,attempts:1,createdAt:i,updatedAt:i,local:!0}}if(t.flow==="default"){n??=Me();let r=`completion:${n}`,i=await e.store.get(`snapshot`,r);if(i&&eh(i.task)!==eh(t))throw Error(`Local completion belongs to another session`);i||await e.store.create(`snapshot`,r,d);let a=V.join(l(c,n),`agent-note`);H.existsSync(a)||(H.mkdirSync(V.dirname(a),{recursive:!0}),H.writeFileSync(a,t.context?.note??``,{mode:384}))}let p=t.flow==="default"&&n?ge(c,n):void 0;if(p)return p.status===`queued`&&!p.pid&&Ge(c,p.id,ke(a.mcp,a.env).env),rp(e,p.id,d),Xf(c,p);let m,h=new Promise(e=>m=e),g;g=Et({cwd:c,agent:t.agent,flow:t.flow,task:t,taskId:n,toolEnvironment:{tokens:o},connections:a.mcp,connectionEnv:a.env,post:t.flow!=="default"&&t.source===t.event?.integration,...t.flow==="default"?{noteFile:V.join(l(c,n),`agent-note`)}:{},...s?{postToken:s}:{},source:t.source,onStart:n=>{(e.store.localFlows??=new Map).set(t.id,{stop:async()=>{n.requestStop(),await St(n.runId,n.runningIds())},work:g}),m(t.id)},onTask:n=>{t.flow==="default"&&rp(e,n,d),m(n)}}).then(async n=>{t.flow!=="default"&&n.note!==void 0&&(n.note?await e.store.put(`note`,Cu(t),n.note):await e.store.delete(`note`,Cu(t)))}).finally(async()=>{if(e.store.localFlows?.delete(t.id),t.flow!=="default"){let n=await e.store.get(`task`,t.id);n&&n.attempts===d.fence?.attempts&&n.tokenHash===d.fence?.tokenHash&&(n.generation??0)===d.fence?.generation&&await np(e,n,(e.now??Date.now)()),Xo(e,!0)}}),g.catch(()=>{});let _=await Promise.race([h,g.then(()=>void 0)]),v=_?ge(c,_):void 0,y=(e.now??Date.now)();return v&&Xf(c,v)||{task:t,status:t.flow!=="default"&&yt(t.id)?.status===`running`?`running`:`completed`,attempts:1,createdAt:y,updatedAt:y,local:!0}}async function sp(e,t,n){let r=t.handle.slice(4),i=await e.store.get(`snapshot`,`local-start:${t.task.id}`);if(!i)throw Error(`Local task launch is missing`);let a={generation:t.generation??0,seq:-1,answers:[]};for(let o of n){let n=await e.store.get(`task`,t.task.id);if(!n||n.attempts!==t.attempts||n.tokenHash!==t.tokenHash||(n.generation??0)!==o.generation||![`running`,`waiting`].includes(n.status))break;let s=ge(i.cwd,r);if(!s)throw Error(`Local task is missing`);let c=o.kind===`cancel`?await gt(i.cwd,s):await kt(i.cwd,{...s,name:void 0},o);o.kind===`ask`&&a.answers.push({seq:o.seq,value:c}),a.seq=o.seq}return a}function cp(e,t,n=-1,r){let i=``;try{i=H.readFileSync(V.join(l(e,t),`log.jsonl`),`utf8`)}catch{}let a=i.split(`
+`).flatMap((e,t)=>{if(!e||t<=n)return[];let r=an(e);if(!r)return[{seq:t,at:0,level:`out`,line:e}];let i=r.kind===`error`?`err`:[`status`,`info`,`steer`].includes(r.kind??``)?`sys`:`out`;return[{seq:t,at:Yf(r.at)??0,level:i,line:r.message??``,entry:r}]});return r===void 0?a:a.slice(0,r)}function lp(e,t,n=!0){let r=ge(e,t);return r&&Jf(r)?Xf(e,Se(e,r),n):void 0}async function up(e,t,n,r,i){let a=ge(t,n);if(!a||!Jf(a))return Response.json({error:`No task "${n}"`},{status:404});let o=Se(t,a),s=b.includes(o.status),c=e.method===`POST`?await e.json().catch(()=>({})):{},d=(e,t=409)=>Response.json({error:e},{status:t});if(e.method===`DELETE`&&!r){if(s&&await gt(t,o),mt(t,o),i){let e=i.store.completionWatches?.get(n);e&&(e.stopped=!0,await e.work),await i.store.delete(`task`,n),await i.store.delete(`snapshot`,`local-start:${n}`),await i.store.delete(`snapshot`,`completion:${n}`),Xo(i,!0)}return Response.json({ok:!0})}if(e.method!==`POST`)return new Response(`Method not allowed`,{status:405});if(r===`cancel`)return s?(await gt(t,o),Response.json({ok:!0})):d(`No running or queued task "${n}"`,404);if(r===`archive`)return le(t,o),i&&await i.queue.patchTask(i.organizationId,n,{archivedAt:(i.now??Date.now)(),autoArchived:void 0},(i.now??Date.now)()),Response.json({ok:!0});if(r===`steer`){let e=String(c.text??``);if(!e.trim())return d(`text is required`,400);let r=s?void 0:c.outputSchema,a=Object.fromEntries([`model`,`effort`,`permissions`].flatMap(e=>typeof c[e]==`string`&&c[e]?[[e,c[e]]]:[]));if(r!==void 0&&(!r||typeof r!=`object`||Array.isArray(r)))return d(`outputSchema must be an object`,400);try{if(!s&&i){let s=i.store.completionWatches?.get(n);s&&await s.work;let c=(i.now??Date.now)(),l=await i.store.get(`task`,n);l&&[`running`,`waiting`].includes(l.status)&&(await np(i,l,c),l=await i.store.get(`task`,n));let u={prompt:e,context:{...l?.task.context,...r?{outputSchema:r}:{}}};if(await i.store.put(`snapshot`,`local-start:${n}`,{cwd:t,resume:!0,...Object.keys(a).length?{overrides:a}:{}}),l){if(!await i.queue.continueTask(i.organizationId,n,u,c,{attempts:l.attempts,generation:l.generation??0}))return d(`Task is already active`)}else await i.queue.enqueue(i.organizationId,{...Xf(t,o).task,...u},c,void 0,i.config.maxQueued??1e3);await Yo(i,!1,!0,!0);let f=await i.store.get(`task`,n);return Response.json(f?.status===`queued`?{...f,statusReason:`Waiting for a task slot`}:lp(t,n))}let c=await ht(t,o,e,{...typeof r==`object`&&r?{outputSchema:r}:{},...a});return Response.json(s?c:lp(t,n))}catch(e){return d(e.message)}}if(r===`ask`){let e=String(c.question??c.text??``);if(!e.trim())return d(`question is required`,400);let r=await _t(t,o,e),i=r.finalMessage??r.error?.message??``,a=V.join(l(t,n),`answers.json`);return u(a,[...Le(a)??[],i]),Response.json({ok:!0,answer:i})}if(r===`approve`){let e=We(l(t,n)).filter(e=>!e.response),r=String(c.approvalId??c.id??e[0]?.id??``);return e.some(e=>e.id===r)?(Ke(l(t,n),r,c.decision===`deny`||c.decision===`decline`?`decline`:`accept`),Response.json({ok:!0})):d(`Task "${n}" has no pending approval`)}return new Response(`Not found`,{status:404})}function dp(e,t=new Set,n=!0){let r=fp(t);return[...Pe(e),...n?Ae(e,{migrate:!1}):[]].filter(Jf).flatMap(t=>{let n=Oe(e,t.id);return pp(t,n,!n.length&&!b.includes(t.status)?qe(e,t.id):null,r)})}function fp(e){let t=new Map;for(let n of e){let e=n.lastIndexOf(`:`),r=n.slice(4,e),i=t.get(r)??[];i.push(Number(n.slice(e+1))),t.set(r,i)}return t}function pp(e,t,n,r){let i=t.length?t:n?[{...n,at:e.completedAt??e.updatedAt??e.createdAt}]:[],a=r.get(e.id)??[];r.set(e.id,a);let o=Yf(e.createdAt)??0;return i.flatMap(t=>{let n=Yf(t.at);if(n===void 0||!Number.isFinite(n))return[];let r=Yf(e.resumedAt),i=r!==void 0&&r>=o&&r<=n?r:o,s=a.some(e=>e===n||e>o&&e<=n);return o=n,s?[]:(a.push(n),[[`cli:${e.id}:${n}`,{taskId:e.id,agent:e.agentId??et()??``,target:e.source??`cli`,...e.engine?{engine:e.engine}:{},...t.model??e.model?{model:t.model??e.model}:{},credential:`local`,runnerElapsedMs:Math.max(0,n-i),...t.tokens?{tokens:t.tokens}:{},at:n}]])})}function mp(e){let t=e.local;return t.usageSync??=_p(e).finally(()=>t.usageSync=void 0)}async function hp(e){try{return JSON.parse(await H.promises.readFile(e,`utf8`))}catch{return null}}async function gp(e){return(await Promise.all([`job.json`,`results.jsonl`,`result.json`].map(async t=>{let n=await H.promises.stat(V.join(e,t)).catch(()=>void 0);return n?`${n.mtimeMs}:${n.ctimeMs}:${n.size}`:``}))).join(`|`)}async function _p(e){let t=e.local;await t.cacheMaintenance;let n=Re(),r=await hp(n),i=await e.store.list(`usage`,{prefix:`cli:`}),a=new Set(i.map(e=>e.id)),o=0,s=async()=>{++o%4==0&&await new Promise(e=>setImmediate(e))};if(t.archiveScan===void 0)for(let[t,n]of Object.entries(r?.rows??{}))a.has(t)||(await e.store.put(`usage`,t,n),a.add(t)),await s();let c=fp(a),l=(await H.promises.stat(fe(t.cwd)).catch(()=>void 0))?.mtimeMs??0,u={},d=new Set,f=!1;for await(let{id:n,dir:i,archived:a}of ee(t.cwd)){if(await s(),d.has(n))continue;let t=a?await gp(i):void 0;if(a&&r?.counted?.[n]===t){u[n]=t,d.add(n);continue}let o=await hp(V.join(i,`job.json`));if(o){if(o.agent&&(o.engine=o.agent),d.add(n),Jf(o)){let t=(await H.promises.readFile(V.join(i,`results.jsonl`),`utf8`).catch(()=>``)).split(/\r?\n/).flatMap(e=>{try{return e?[JSON.parse(e)]:[]}catch{return[]}}),n=!t.length&&!b.includes(o.status)?await hp(V.join(i,`result.json`)):null;for(let[r,i]of pp(o,t,n,c))await e.store.put(`usage`,r,i),f=!0,await s()}a&&(u[n]=t)}}if(f||r?.archive!==l||JSON.stringify(r?.counted)!==JSON.stringify(u)){let t=await e.store.list(`usage`,{prefix:`cli:`});await H.promises.mkdir(V.dirname(n),{recursive:!0});let r=S(n);try{await H.promises.writeFile(r,`${JSON.stringify({archive:l,counted:u,rows:Object.fromEntries(t.map(e=>[e.id,e.value]))})}\n`),await H.promises.rename(r,n)}finally{await H.promises.rm(r,{force:!0})}}t.archiveScan=l}const vp=`A local server stores no engine credentials. Tasks use this machine's own claude and codex sign-in.`,yp={claude:{file:`claude`,args:[`auth`,`status`,`--json`],command:`claude auth login`,login:[`auth`,`login`],logout:[`auth`,`logout`],ok:e=>JSON.parse(e).loggedIn===!0},codex:{file:`codex`,args:[`login`,`status`],command:`codex login`,login:[`login`],logout:[`logout`],ok:()=>!0}},bp=e=>e in yp;function xp(e){let t=yp[e];rr(t.file,t.login,{detached:!0,stdio:`ignore`}).on(`error`,()=>{}).unref()}function Sp(e){let t=yp[e];return new Promise(e=>nr(t.file,t.logout,{timeout:15e3},()=>e()))}function Cp(e){return new Promise(t=>nr(e.file,e.args,{timeout:15e3},(n,r)=>{try{t(!n&&e.ok(r))}catch{t(!1)}}))}async function wp(){let[e,t]=await Promise.all([Cp(yp.claude),Cp(yp.codex)]);return{claude:{signedIn:e,command:yp.claude.command},codex:{signedIn:t,command:yp.codex.command}}}async function Tp(e,t){if(!e.local)return!1;let n=t?[t]:Be(e.local.cwd).chain,r=await wp();return n.some(e=>e===`custom`||r[e]?.signedIn===!0)}var Ep=r({CredentialCheckError:()=>kp,addCredential:()=>Bp,checkCredential:()=>jp,completeLogin:()=>Up,createCredential:()=>nm,credentialEnv:()=>Pp,credentialFix:()=>Zp,credentialId:()=>Dp,credentialSummary:()=>Kp,credentialValue:()=>Wp,defaultCredential:()=>im,deleteCredential:()=>rm,listCredentials:()=>tm,parseCredentialId:()=>Op,removeCredential:()=>Vp,reseal:()=>Xp,resolveCredential:()=>Mp,setDefault:()=>Hp,signInEngine:()=>am,signOutEngine:()=>om,visibleCredentials:()=>Np,writeBackCodexAuth:()=>Jp});function Dp(e,t){return e?`${e}/${t}`:t}function Op(e){let t=e.lastIndexOf(`/`);return t<0?{label:e}:{owner:e.slice(0,t),label:e.slice(t+1)}}var kp=class extends Error{status;constructor(e,t){super(`Credential check failed: ${e}${t?` ${t}`:``}`),this.status=e}};function Ap(e){if(e.OPENAI_API_KEY)return e.OPENAI_API_KEY;if(e.CODEX_AUTH_JSON)try{let t=JSON.parse(e.CODEX_AUTH_JSON);return t.OPENAI_API_KEY??t.tokens?.access_token??t.access_token}catch{throw Error(`CODEX_AUTH_JSON is not valid JSON`)}}async function jp(e,t=fetch){if(e.engine===`custom`)return;let n,r;if(e.engine===`claude`){let t=e.env.ANTHROPIC_API_KEY,i=e.env.CLAUDE_CODE_OAUTH_TOKEN;if(!t&&!i)throw Error(`Claude credentials need ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN`);n=`https://api.anthropic.com/v1/models`,r={"anthropic-version":`2023-06-01`,...t?{"x-api-key":t}:{authorization:`Bearer ${i}`,"anthropic-beta":`oauth-2025-04-20`}}}else{let t=Ap(e.env);if(!t)throw Error(`Codex credentials need OPENAI_API_KEY or CODEX_AUTH_JSON`);n=`https://api.openai.com/v1/models`,r={authorization:`Bearer ${t}`}}let i=await t(n,{method:`GET`,headers:r});if(!i.ok)throw new kp(i.status,i.statusText)}async function Mp(e,t,n){let r=e.listCredentials?await e.listCredentials({owner:n,engine:t}):await e.list(`credential`),i=e=>{let n=r.filter(n=>n.value.owner===e&&(!t||n.value.engine===t));return n.find(e=>e.value.isDefault)??n[0]};return(n?i(n):void 0)??i(void 0)}async function Np(e,t,n){return(e.listCredentials?await e.listCredentials({owner:t,limit:n}):await e.list(`credential`)).filter(e=>!e.value.owner||e.value.owner===t)}async function Pp(e,t){let n=e.session?.user.id,r=await Np(e.store,n),i=n=>r.filter(e=>e.value.owner===n).sort((e,t)=>Number(!!t.value.isDefault)-Number(!!e.value.isDefault)).map(n=>Wp(e.config,n.value).env[t]).find(Boolean);return(n?i(n):void 0)??i(void 0)??(e.local?Jn.env[t]:void 0)}function Fp(e,t){let n=new Set(e.map(e=>Op(e.id).label)),r=t;for(let e=2;n.has(r);e++)r=`${t}-${e}`;return r}const Ip=(e,t,n)=>e.filter(e=>e.id!==t&&e.value.engine===n),Lp=(e,t)=>({id:e.id,value:{...e.value,isDefault:t}});function Rp(e,t,n){return Ip(e,t,n).filter(e=>e.value.isDefault).map(e=>Lp(e,!1))}function zp(e,t,n){let r=Ip(e,t,n)[0];return r?[Lp(r,!0)]:[]}async function Bp(e,t,n,r=Date.now){let i=n.owner||void 0,a=n.credential.engine,o=n.label?.trim(),s=o||n.base||(n.credential.env.CLAUDE_CODE_OAUTH_TOKEN?`claude-token`:`${a}-key`);return await e.withCredential(`credential`,Dp(i,s),async(e,c)=>{o||(s=Fp(c,s));let l=Dp(i,s),u=c.find(e=>e.id===l)?.value,d=!!(n.makeDefault||u?.isDefault&&u.engine===a||!Ip(c,l,a).some(e=>e.value.isDefault));return[{id:l,value:{...nn(t,{env:n.credential.env}),engine:a,...i?{owner:i}:{},...n.account?{account:n.account}:{},isDefault:d,createdAt:u?.createdAt??r()}},...d?Rp(c,l,a):[],...u?.isDefault&&u.engine!==a?zp(c,l,u.engine):[]]}),s}function Vp(e,t){return e.withCredential(`credential`,t,async(e,n)=>e&&[{id:t,value:null},...e.isDefault?zp(n,t,e.engine):[]])}function Hp(e,t){return e.withCredential(`credential`,t,async(e,n)=>e&&[Lp({id:t,value:e},!0),...Rp(n,t,e.engine)])}async function Up(e,t,n,r,i){let a=await e.get(`login`,t);if(!a)return!1;let o=Dp(a.owner,r);return e.withCredential(`credential`,o,async(e,s,c)=>{if(!await c.patchLogin(t,{state:`done`,label:r},{state:[`starting`,`open`,`verifying`],tokenHash:n,owner:a.owner}))return;let l={...i,owner:a.owner,engine:a.engine,isDefault:!0,createdAt:e?.createdAt??i.createdAt};return[{id:o,value:l},...Rp(s,o,a.engine)]})}function Wp(e,t){return{...rn(e,t),engine:t.engine}}function Gp(e){if(e.CODEX_AUTH_JSON)return`auth.json`;let t=Object.values(e)[0]??``;return t.length>16?`${t.slice(0,7)}…${t.slice(-4)}`:`••••`}function Kp(e,t,n){let r=Wp(e,n);return{label:Op(t).label,engine:n.engine,scope:n.owner?`personal`:`workspace`,isDefault:!!n.isDefault,createdAt:n.createdAt??0,env:Object.keys(r.env).sort(),masked:Gp(r.env),...n.account?{account:n.account}:{}}}const qp=e=>{try{return Date.parse(JSON.parse(e??``).last_refresh??``)}catch{return NaN}};function Jp(e,t,n,r){return e.withCredential(`credential`,n,async e=>{if(!e)return;let{env:i}=Wp(t,e);if(!(!i.CODEX_AUTH_JSON||!(qp(r)>(qp(i.CODEX_AUTH_JSON)||0))))return[{id:n,value:{...e,...nn(t,{env:{...i,CODEX_AUTH_JSON:r}})}}]})}function Yp(e,t){return tn(e,t.iv===`plain`?`plain.${t.ciphertext}`:`${t.iv}.${t.tag}.${t.ciphertext}`)}async function Xp(e,t,n=Date.now){if(!t.encryptionKey)throw Error(`SERVER_ENCRYPTION_KEY is required to rotate keys`);let r=Ut(t.encryptionKey),i=e=>tn(t,e)!==r,a=e=>i(e)?k(t,A(t,e)):e,o=e=>{let t=e.token&&a(e.token);if(t!==e.token)return{...e,token:t}},s=0;for(let{id:t}of await e.list(`app`))await e.withAppLock(t,async e=>{let n=await e.get(`app`,t);return!n||!i(n.credentials)?!1:(await e.put(`app`,t,{...n,credentials:a(n.credentials)}),!0)})&&s++;for(let{id:t}of await e.list(`installation`))await e.withCredential(`installation`,t,async e=>{let n=e&&o(e);return n&&[{id:t,value:n}]})&&s++;for(let{id:t}of await e.list(`connection`))await e.withAppLock(`connection:${t}`,async e=>{let n=await e.get(`connection`,t);return!n?.secret||!i(n.secret)?!1:(await e.put(`connection`,t,{...n,secret:a(n.secret)}),!0)})&&s++;for(let{id:t}of await e.list(`snapshot`)){let r=t.startsWith(`connection-secrets:`)?t.slice(19):t.startsWith(`connections:`)?t.slice(12).replace(/:\d+:\d+:[a-f0-9]{12}$/,``):void 0;await e.withAppLock(r?`connections:${r}`:t,async e=>{let o=await e.get(`snapshot`,t);if(!o)return!1;let s=`resolvedConnections`in o?`resolvedConnections`:`connectionSecrets`in o?`connectionSecrets`:void 0;if(!s)return!1;let c=r?await e.get(`task`,r):void 0;if(!c||[`completed`,`failed`,`cancelled`].includes(c.status))return await e.delete(`snapshot`,t),!1;let l=o[s];return i(l)?(await e.put(`snapshot`,t,{...o,[s]:a(l)},{ttlMs:`expiresAt`in o&&typeof o.expiresAt==`number`?Math.max(1,o.expiresAt-n()):36e5}),!0):!1})&&s++}for(let{id:t}of await e.list(`runner`))await e.withCredential(`runner`,t,async e=>{if(!(!e||!i(e.secret)))return[{id:t,value:{...e,secret:a(e.secret)}}]})&&s++;for(let{id:n}of await e.list(`credential`))await e.withCredential(`credential`,n,async e=>{if(!(!e||Yp(t,e)===r))return[{id:n,value:{...e,...nn(t,{env:Wp(t,e).env})}}]})&&s++;return s}async function Zp(e,t){let n=Ig(await Fg(e),`/settings/credentials`);return`${e.config.publicUrl?.replace(/\/$/,``)??``}${n}?engine=${encodeURIComponent(t)}`}const Qp=p({label:g(f().check(n(/^[^/\s][^/]*$/))),env:He(f(),f().check(t(1))),engine:Ee([`claude`,`codex`,`custom`]),workspace:g(Te()),default:g(Te()),noCheck:g(Te())}),$p=`Only an owner or admin of this workspace can change workspace credentials.`;function em(e,t,n){let r=e.session?.user.id,i=t.searchParams.has(`workspace`)||!r;return{workspace:i,id:Dp(i?void 0:r,n)}}async function tm(e,t,n,r){n.label;let i=t.session?.user.id,a=e=>`${e.engine}/${e.scope}/${e.label}`,o=(e,t)=>e.localeCompare(t)||(e<t?-1:+(e>t)),s=r.searchParams.get(`fields`);if(s&&s!==`id`)return D({error:`Invalid fields`},400);if(s===`id`){let e=Rt(r),n=O(r,200),a=(await t.store.list(`credential`,{visibleTo:i,...e?{after:e}:{},limit:Pt(r)?n+1:n})).map(({id:e})=>({id:e}));return D(Pt(r)?Vt(a,n,e=>e.id):a)}let c=(await Np(t.store,i,Pt(r)?void 0:O(r,200))).map(e=>Kp(t.config,e.id,e.value)).sort((e,t)=>o(a(e),a(t)));if(!Pt(r))return D(c.slice(0,O(r,200)));let l=Rt(r),u=r.searchParams.get(`q`)?.trim().toLowerCase(),d=c.filter(e=>!u||[e.label,e.engine,e.account?.email??``,...e.env].some(e=>e.toLowerCase().includes(u))).filter(e=>!l||o(a(e),l)>0);return D(Vt(d,O(r),a))}async function nm(e,t,n,r){n.label;let i=t.session?.user.id,a=await e.json().catch(()=>void 0),o=Qp.safeParse(a);if(!o.success||!Object.keys(o.data.env).length||Object.keys(o.data.env).some(e=>!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)))return D({error:`Invalid credential`},400);let{env:s,engine:c}=o.data,l=!!o.data.workspace||!i;if(l&&!Uh(t))return D({error:$p},403);if(s.CODEX_AUTH_JSON)return D({error:`Sign in with Codex on the Credentials page instead.`},400);if(s.CLAUDE_CODE_OAUTH_TOKEN&&(l&&t.auth||t.config.subscriptions?.claude))return D({error:`Sign in with Claude on the Credentials page instead.`},400);let u=l?void 0:i;try{o.data.noCheck||await jp({engine:c,env:s},t.fetch??fetch);let e=await Bp(t.store,t.config,{label:o.data.label?.trim()||void 0,...u?{owner:u}:{},credential:{env:s,engine:c},makeDefault:o.data.default},t.now??Date.now);return D({ok:!0,label:e})}catch(e){return D({error:e instanceof Error?e.message:String(e)},e instanceof kp?e.status:400)}}async function rm(e,t,n,r){let i=n.label;t.session?.user.id;let{workspace:a,id:o}=em(t,r,i);return a&&!Uh(t)?D({error:$p},403):await Vp(t.store,o)?D({ok:!0}):D({error:`Unknown credential`},404)}async function im(e,t,n,r){let i=n.label;t.session?.user.id;let{workspace:a,id:o}=em(t,r,i);return a&&!Uh(t)?D({error:$p},403):await Hp(t.store,o)?D({ok:!0}):D({error:`Unknown credential`},404)}async function am(e,t,n,r){let i=n.engine;return xp(i),D(await wp())}async function om(e,t,n,r){let i=n.engine;return await Sp(i),D(await wp())}var sm=r({ConnectionError:()=>Cm,addConnection:()=>Am,authorizeConnection:()=>Rm,changeConnection:()=>jm,completeNativeConnection:()=>vm,connectionAllowed:()=>ym,connectionAuthorization:()=>Nm,connectionRow:()=>pm,connectionRows:()=>Em,createConnection:()=>Fm,deleteConnection:()=>Lm,findConnection:()=>_m,listConnections:()=>Pm,nativeApp:()=>xm,nativeConnections:()=>hm,nativeCredential:()=>mm,removeConnection:()=>Mm,updateConnection:()=>Im,visibleConnections:()=>gm});const cm=f().check(n(/^[a-z0-9][a-z0-9_-]*$/i)),lm=ce([C({header:f().check(n(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/))}),C({env:f().check(n(/^[A-Za-z_][A-Za-z0-9_]*$/))})]),um=C({name:f().check(t(1)),id:g(cm),provider:g(cm),owner:g(y(`me`)),access:g(Ee([`observe`,`write`])),endpoint:g(me),auth:g(Ee([`none`,`key`,`oauth`])),key:g(f().check(t(1))),keyIn:g(lm),credential:g(f().check(t(1)))}),dm=C({name:g(f().check(t(1))),access:g(Ee([`observe`,`write`])),key:g(f().check(t(1)))});function fm(e,t){let n=t.endpoint;if(t.provider===`env`)return!n&&t.auth===`key`&&t.access===`write`&&!!t.keyIn&&`env`in t.keyIn&&Fe(t.keyIn.env);if(t.provider!==`mcp`)return!n;if(!n||n.command&&t.access===`observe`&&!n.tools?.length||n.tools?.some(e=>!T(e)))return!1;if(n.url){let r=URL.parse(n.url);if(!r||!Ne(r,!!e.local)||t.keyIn&&`env`in t.keyIn)return!1}else if(t.auth!==`none`&&(!t.keyIn||!(`env`in t.keyIn)))return!1;return t.auth===`oauth`&&!n.url?!1:![...Object.values(n.headers??{}),...Object.values(n.env??{})].some(h)}function pm(e,t,n){let r=!!e.secret;if(e.auth===`oauth`&&e.provider===`mcp`&&e.secret&&n)try{r=!!A(n,e.secret).accessToken}catch{r=!1}return{id:e.id,name:e.name,provider:e.provider,auth:e.auth,access:e.access,...e.owner?{owner:e.owner,...t===e.owner?{mine:!0}:{}}:{},...e.endpoint?.url?{url:e.endpoint.url}:{},...e.endpoint?.command?{command:e.endpoint.command}:{},...e.provider===`env`&&e.keyIn&&`env`in e.keyIn?{env:e.keyIn.env}:{},...e.account?{account:e.account}:{},status:e.broken?`reconnect`:e.auth===`oauth`&&!r?`authorize`:`ok`,createdAt:e.createdAt}}function mm(e,t){let n=A(e,t);return typeof n==`string`?{token:n,app:void 0}:n}async function hm(e,t){return!t||!e.auth?.linkedAccounts?[]:(await e.auth.linkedAccounts(t,e.store)).filter(t=>t.token&&t.organizations?.includes(e.organizationId)&&e.integrations[t.platform]?.auth.user).map(n=>({id:`${t}:${n.platform}-${ir(`sha256`).update(n.platformUserId).digest(`hex`).slice(0,12)}`,name:e.integrations[n.platform].name??n.platform,provider:n.platform,owner:t,access:`observe`,auth:`oauth`,secret:n.token,account:n.platformUserId,oauthApp:mm(e.config,n.token).app,createdAt:0}))}async function gm(e,t,n){let r=await hm(e,t),i=(await e.store.list(`connection`,{visibleTo:t,secrets:n})).map(e=>e.value).filter(e=>!e.owner||e.owner===t).map(e=>{if(!e.owner||e.provider===`mcp`||e.auth!==`oauth`)return e;let t=r.find(t=>t.provider===e.provider&&(!e.account||e.account===t.account));return{...e,secret:t?.secret,account:t?.account??e.account}});return[...i,...r.filter(e=>!i.some(n=>n.id===e.id||n.owner===t&&n.provider===e.provider&&n.account===e.account))]}async function _m(e,t,n){let r=await e.store.get(`connection`,t);return r?!r.owner||r.owner===n?r:void 0:(await hm(e,n)).find(e=>e.id===t)}async function vm(e,t,n,r){for(let{id:i,value:a}of await e.store.list(`connection`))a.owner!==t||a.provider!==n||a.auth!==`oauth`||a.account&&a.account!==r||await e.store.withAppLock(`connection:${i}`,async a=>{let o=await a.get(`connection`,i);!o||o.owner!==t||o.provider!==n||o.account&&o.account!==r||await a.put(`connection`,i,{...o,account:r,broken:void 0,secret:void 0,updatedAt:(e.now??Date.now)()})})}async function ym(e,t,n){if(e.method===`GET`)return t;if(n.id){let e=await _m(t,n.id,t.session?.user.id);if(!e)return D({error:`Unknown connection`},404);if(e.owner===t.session?.user.id&&e.owner)return t}else if((await e.clone().json().catch(()=>void 0))?.owner===`me`)return t.auth&&t.session&&!t.local?t:D({error:`Personal connections need a signed-in member`},400);return Wh(t,`Only workspace owners and admins can manage workspace connections`)}var bm=class extends Error{};async function xm(e,t,n,r){let i=e.integrations[t]?.auth.user;if(i){if(!r){let[t,n]=await Promise.all([qg(e),e.store.list(`app`)]);r=[...t,...n.map(e=>e.value)]}return r.find(r=>{if(r.integration!==t||n&&r.id!==n)return!1;try{return i.authorizeUrl(A(e.config,r.credentials),{publicUrl:e.config.publicUrl??`https://coder.invalid`,state:``}),!0}catch{return!1}})}}async function Sm(e,t,n){if(t.provider===`mcp`)return qi(e,t,n);if(!await xm(e,t.provider))throw new bm(`No OAuth client is available for ${e.integrations[t.provider]?.name??t.provider}.`);let r=new URLSearchParams({connection:t.id,organization:e.organizationId,attempt:or(18).toString(`base64url`)});return`/connect/${encodeURIComponent(t.provider)}?${r}`}var Cm=class extends Error{status;needs;constructor(e,t,n){super(t),this.status=e,this.needs=n}};const Q=(e,t)=>new Cm(e,t);async function wm(e,t=200){try{return D(await e(),t)}catch(e){if(e instanceof Cm)return D({error:e.message,...e.needs?{needs:e.needs}:{}},e.status);throw e}}async function Tm(e){return e.json().catch(()=>void 0)}async function Em(e,t){let n=e.session?.user.id,r=await gm(e,n,`oauth`),i=t?await e.store.get(`delivery`,`connection-authorized:${t}`):void 0;return Promise.all(r.map(async r=>{let a=r,o=pm(a,n,e.config);return t&&a.auth===`oauth`&&(!i||!(`target`in i)||i.target!==`${a.id}:${a.createdAt}`)&&(o.status=`authorize`),o}))}const Dm=(e,t,n)=>Wp(e.config,t.value).env[n]!==void 0;async function Om(e,t,n,r,i){if(n.key&&n.credential)throw Q(400,`Give a key or a credential, not both`);if(n.key){let a=await Bp(e.store,e.config,{base:r,...i?{owner:i}:{},credential:{engine:`custom`,env:{[t]:n.key}}},e.now??Date.now);return{id:i?`${i}/${a}`:a,created:!0}}let a=(await Np(e.store,i)).filter(n=>Dm(e,n,t)),o=n.credential?a.find(e=>e.id===n.credential):a.find(e=>i&&e.value.owner===i)??a.find(e=>!e.value.owner);if(!o)throw Q(400,n.credential?`Credential ${n.credential} does not hold ${t}`:`No credential holds ${t}; give its key`);return{id:o.id}}async function km(e,t,n){let r=t.keyIn.env;return t.credential&&await e.store.withCredential(`credential`,t.credential,async i=>{if(!(!i||i.owner!==t.owner))return[{id:t.credential,value:{...i,...nn(e.config,{env:{...Wp(e.config,i).env,[r]:n}})}}]})?t.credential:(await Om(e,r,{key:n},t.id.split(`:`).pop(),t.owner)).id}async function Am(e,t){let n=um.safeParse(t);if(!n.success)throw Q(400,`Invalid connection`);let r=n.data,i=r.id??r.name.toLowerCase().replace(/[^a-z0-9_-]+/g,`-`).replace(/^-+|-+$/g,``);if(!cm.safeParse(i).success)throw Q(400,`Invalid connection id`);let a=r.provider??`mcp`,o=r.owner===`me`?e.session.user.id:void 0;if(a!==`mcp`&&a!==`env`&&!e.integrations[a]?.auth.user)throw Q(400,`This integration does not support user OAuth`);if(a===`env`&&r.auth&&r.auth!==`key`)throw Q(400,`Environment connections require a key`);if(a!==`env`&&r.credential)throw Q(400,`Only environment connections use a credential`);let s=a===`env`?`key`:a===`mcp`?r.auth??(r.key?`key`:`none`):`oauth`;if(s===`key`&&!r.key&&a!==`env`)throw Q(400,`A key is required`);if(r.key&&s!==`key`)throw Q(400,`A key needs key authentication`);let c={id:o?`${o}:${i}`:i,name:r.name,provider:a,...o?{owner:o}:{},access:r.access??(a===`env`?`write`:`observe`),auth:s,...r.endpoint?{endpoint:r.endpoint}:{},...r.keyIn?{keyIn:r.keyIn}:{},...r.key&&a!==`env`?{secret:k(e.config,{key:r.key})}:{},createdAt:(e.now??Date.now)()};if(!fm(e,c))throw Q(400,`Invalid endpoint or observe tools`);if(await e.store.get(`connection`,c.id))throw Q(409,`Connection already exists`);let l;if(a===`mcp`&&r.endpoint?.url&&!r.auth&&!r.key){try{if(l=await Bi(e,r.endpoint.url,!0),!l)try{await Ce({...c,access:`write`},void 0,e.fetch)}catch(t){if(!(t instanceof re)||!t.authenticate||(l=await Bi(e,r.endpoint.url,!0,t.authenticate),!l))throw t}l&&(c.auth=`oauth`)}catch(e){throw e instanceof re?new Cm(400,`${new URL(r.endpoint.url).hostname} takes a key, not a sign-in.`,`key`):Q(502,`Could not start authorization`)}if(c.auth===`oauth`&&e.local?.port===0)throw Q(400,`Signing in needs a Coder server. Repeat with --server <url>, or add it in coder dash.`)}let u=a===`env`?await Om(e,r.keyIn.env,r,i,o):void 0;if(u&&(c.credential=u.id),!await e.store.withAppLock(`connection:${c.id}`,e=>e.create(`connection`,c.id,c)))throw u?.created&&await Vp(e.store,u.id),Q(409,`Connection already exists`);try{let t=c.auth===`oauth`?await Sm(e,c,l):void 0;return{...pm(c,o,e.config),...t?{authorize:t}:{}}}catch(t){throw await e.store.withAppLock(`connection:${c.id}`,async e=>{let t=await e.get(`connection`,c.id);ur(t,c)&&await e.delete(`connection`,c.id)}),t instanceof bm?Q(400,t.message):Q(502,`Could not start authorization`)}}async function jm(e,t,n){let r=dm.safeParse(n);if(!r.success)throw Q(400,`Invalid connection settings`);return e.store.withAppLock(`connection:${t}`,async n=>{let i=await _m({...e,store:n},t,e.session?.user.id);if(!i)throw Q(404,`Unknown connection`);let{key:a,...o}=r.data;if(a&&i.auth!==`key`)throw Q(400,`This connection does not use a key`);let s={...i,...o,...a&&i.provider!==`env`?{secret:k(e.config,{key:a})}:{},...a?{broken:void 0}:{},updatedAt:(e.now??Date.now)()};if(!fm(e,s))throw Q(400,`Invalid observe tools`);return a&&i.provider===`env`&&(s.credential=await km({...e,store:n},i,a)),await n.put(`connection`,s.id,s),pm(s,e.session?.user.id,e.config)})}async function Mm(e,t){await e.store.withAppLock(`connection:${t}`,async n=>{let r=await _m({...e,store:n},t,e.session?.user.id);if(!r)throw Q(404,`Unknown connection`);if(r.owner&&r.provider!==`mcp`&&r.provider!==`env`){let t=await e.auth?.linkedAccounts?.(r.owner,n)??[];for(let i of t.filter(e=>e.platform===r.provider&&(!r.account||e.platformUserId===r.account)))await e.auth?.unlink?.(r.owner,i.platform,i.platformUserId,n)}await n.delete(`connection`,r.id)})}async function Nm(e,t){let n=await _m(e,t,e.session?.user.id);if(!n||n.auth!==`oauth`)throw Q(404,`Unknown OAuth connection`);try{return await Sm(e,n)}catch(e){throw e instanceof bm?Q(400,e.message):Q(502,`Could not start authorization`)}}async function Pm(e,t){return D(await Em(t,new URL(e.url).searchParams.get(`authorization`)??void 0))}async function Fm(e,t){let n=await Tm(e);return wm(()=>Am(t,n),201)}async function Im(e,t,n){let r=await Tm(e);return wm(()=>jm(t,n.id,r))}async function Lm(e,t,n){return wm(async()=>(await Mm(t,n.id),{ok:!0}))}async function Rm(e,t,n){return wm(async()=>({url:await Nm(t,n.id)}))}function zm(e){try{let t=JSON.parse(e);return[e,t.accessToken,t.refreshToken].filter(e=>typeof e==`string`&&!!e)}catch{return[e]}}async function Bm(e,t){let n=t.credential?await e.store.get(`credential`,t.credential):void 0;if(!n||n.owner&&n.owner!==t.owner)throw Error(`Missing credential`);let r=Wp(e.config,n).env[t.keyIn.env];if(!r)throw Error(`Missing key`);return r}async function Vm(e,t,n={}){let r={},i={},a={...n},o={...t.tools},s={},c=[],l=[],u=[...new Set(t.connections??[])],d=u.length?await e.store.list(`connection`,{ids:u,visibleTo:t.requester,secrets:`all`}):[],f=new Set(d.map(e=>e.id)),p,m=u.some(e=>!f.has(e))?await hm(e,t.requester).catch(e=>(console.error(`coder server: native connection lookup failed`,e),p=e,[])):[],h=new Map([...m.map(e=>[e.id,e]),...d.map(({id:e,value:t})=>[e,t])]),g=await Promise.allSettled(u.map(async e=>{if(!h.has(e)&&p)throw p;return{id:e,value:h.get(e)}})),_,v=g.sort((e,t)=>Number(t.status===`fulfilled`&&!!t.value.value?.owner)-Number(e.status===`fulfilled`&&!!e.value.value?.owner)),y=_e(v.flatMap(e=>e.status===`fulfilled`&&e.value.value?[e.value.value]:[]));for(let n of v){let u,d=``;try{if(n.status===`rejected`)throw n.reason;if({id:d,value:u}=n.value,!u||u.owner&&u.owner!==t.requester)continue;if(u.provider===`env`&&(u.auth!==`key`||u.access!==`write`||u.endpoint||!u.credential||!u.keyIn||!(`env`in u.keyIn)||!Fe(u.keyIn.env)||y.has(u.keyIn.env)||`local`in e&&e.local&&process.env[u.keyIn.env]!==void 0))throw Error(`Invalid environment connection`);if(u.broken){c.push(`${u.name} needs reconnecting.`);continue}let f,p;if(u.provider!==`mcp`&&u.provider!==`env`&&u.auth===`oauth`){if(s[u.provider])continue;let n=u,r=e.integrations[n.provider];if(!r?.auth.user)throw Error(`Missing user OAuth`);let i=!n.owner&&n.secret?A(e.config,n.secret):void 0,a=n.owner?(await e.auth?.linkedAccounts?.(n.owner,e.store))?.find(t=>t.platform===n.provider&&t.token&&t.organizations?.includes(e.organizationId)&&(!n.account||t.platformUserId===n.account)):void 0,o=await xm(e,n.provider,(a?.token?mm(e.config,a.token).app:void 0)??n.oauthApp??i?.app,await(_??=Promise.all([qg(e),e.store.list(`app`)]).then(([e,t])=>[...e,...t.map(e=>e.value)])));if(!o)throw Error(`Missing integration credentials`);let c=n.owner?n.account??a?.platformUserId:void 0;if(n.owner&&!c)throw Error(`Missing linked account`);let p=n.owner?`native:${n.owner}:${n.provider}:${c}`:`connection:${d}`;f=await e.store.withAppLock(p,async i=>{let a=await _m({...e,store:i},d,t.requester);if(!a||a.owner!==n.owner||a.provider!==n.provider||a.broken)throw Error(`Connection changed during resolution`);u=a;let s=(a.owner?await e.auth?.linkedAccounts?.(a.owner,i):[])?.find(t=>t.platform===a.provider&&t.token&&t.organizations?.includes(e.organizationId)&&t.platformUserId===c&&(!a.account||t.platformUserId===a.account)),f=a.owner?void 0:a.secret&&A(e.config,a.secret),p=a.owner?s?.token&&mm(e.config,s.token).token:f&&f.token;if(!p)throw Error(`Missing native credential`);l.push(...zm(p));let m=(s?.token?mm(e.config,s.token).app:void 0)??a.oauthApp??(f?f.app:void 0);if(m&&m!==o.id)throw Error(`OAuth client changed during resolution`);let h;try{h=await r.auth.user.access(p,A(e.config,o.credentials),{fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:AbortSignal.timeout(5e3)})),now:(e.now??Date.now)()})}catch(e){throw e instanceof st&&[`invalid_grant`,`invalid_token`,`bad_refresh_token`,`expired_token`].includes(e.error??``)?new xe(`Native credential was revoked`):e}if(h.refreshed)if(l.push(...zm(h.refreshed)),a.owner){if(!s||!await e.auth?.refreshLinkedToken?.(a.owner,s.platform,s.platformUserId,s.token,k(e.config,{app:o.id,token:h.refreshed}),i))throw Error(`Linked account changed during refresh`)}else a.secret=k(e.config,{app:o.id,token:h.refreshed}),await i.put(`connection`,d,a);else if(a.owner&&!(await e.auth?.linkedAccounts?.(a.owner,i))?.some(e=>e.platform===s?.platform&&e.platformUserId===s.platformUserId&&e.token===s.token))throw Error(`Linked account changed during resolution`);return h.accessToken})}else if(u.provider===`env`)f=await Bm(e,u);else if(u.auth!==`none`){if(!u.secret)throw Error(`Missing credential`);let t=A(e.config,u.secret);if(l.push(...[t.key,t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),u.auth===`key`){if(!t.key)throw Error(`Missing key`);f=t.key}else{let t=u.owner;p=async(n=!1,r)=>{let i=await e.store.withAppLock(`connection:${d}`,async i=>{let a=await i.get(`connection`,d);if(!a||a.owner!==t||a.broken||a.auth!==`oauth`)throw Error(`Connection changed during resolution`);if(!a.secret)throw Error(`Missing credential`);let o=A(e.config,a.secret);l.push(...[o.accessToken,o.refreshToken,o.clientSecret].filter(e=>!!e));let s=AbortSignal.timeout(5e3);return{connection:a,token:await be({secret:o,now:(e.now??Date.now)(),force:n&&o.accessToken===r,fetch:((t,n)=>(e.fetch??fetch)(t,{...n,redirect:`manual`,signal:s})),save:async t=>{l.push(...[t.accessToken,t.refreshToken,t.clientSecret].filter(e=>!!e)),a.secret=k(e.config,t),await i.put(`connection`,d,a)}})}});return u=i.connection,i.token},f=await p()}}if(f&&l.push(f),u.provider===`env`)i[u.keyIn.env]=f;else if(u.provider===`mcp`){let t;try{t=await Ce(u,f,e.fetch??fetch)}catch(n){if(!(n instanceof re)||!p)throw n;f=await p(!0,f),l.push(f),t=await Ce(u,f,e.fetch??fetch)}t&&(r[d]=t)}else if(!s[u.provider]&&f){let t=e.integrations[u.provider];if(!t)throw Error(`Unknown integration`);s[u.provider]=f,a[u.provider]=f,o[u.provider]=[...t.tools.presets[u.access]]}}catch(t){if(u&&pe(t)){let t=u;await e.store.withAppLock(`connection:${d}`,async n=>{let r=await n.get(`connection`,d);r&&r.secret===t.secret&&await n.put(`connection`,d,{...r,broken:{at:(e.now??Date.now)(),reason:`Needs reconnecting`}})})}c.push(De(u?.name??`A connection`,t))}}let b={...t.toolScopes};for(let e of Object.keys(s))b[e]={};return{mcp:r,env:i,tokens:a,nativeTokens:s,tools:o,toolScopes:b,warnings:c,secrets:l}}async function Hm(e,t,n){if(!t.task.connections?.length)return{mcp:{},env:{},tokens:n,nativeTokens:{},tools:t.task.tools,toolScopes:t.task.toolScopes,warnings:[],secrets:[]};let r=ir(`sha256`).update(JSON.stringify(t.task.connections)).digest(`hex`).slice(0,12),i=`connections:${t.task.id}:${t.generation??0}:${t.attempts}:${r}`,a=e.store instanceof $a,o=a?e.store.connectionContexts?.get(i):void 0;if(o&&!o.warnings.length)return{...o,tokens:{...o.tokens,...n,...o.nativeTokens}};let s=a?void 0:await e.store.get(`snapshot`,i);if(s&&`resolvedConnections`in s){let t=A(e.config,s.resolvedConnections);if(!t.warnings.length)return{...t,tokens:{...t.tokens,...n,...t.nativeTokens}}}let c=await e.store.get(`task`,t.task.id),l=await Vm(e,t.task,n);return!l.warnings.length&&c&&await e.store.withAppLock(`connections:${t.task.id}`,async n=>{let r=await n.get(`task`,t.task.id);if(!(!r||[`completed`,`failed`,`cancelled`].includes(r.status)||r.attempts!==t.attempts||(r.generation??0)!==(t.generation??0)))if(n instanceof $a)(n.connectionContexts??=new Map).set(i,l);else{let r=(t.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);await n.put(`snapshot`,i,{resolvedConnections:k(e.config,l),expiresAt:r},{ttlMs:Math.max(1,r-(e.now??Date.now)())})}}),l}async function Um(e,t,n){let r=`connection-secrets:${t}`;return e.store.withAppLock(`connections:${t}`,async i=>{let a=await i.get(`task`,t),o=a&&![`completed`,`failed`,`cancelled`].includes(a.status);if(i instanceof $a){let e=i.connectionSecrets??=new Map,r=[...new Set([...e.get(t)??[],...n])].filter(e=>e.length>=8);return o&&e.set(t,r),r}let s=await i.get(`snapshot`,r),c=s&&`connectionSecrets`in s?A(e.config,s.connectionSecrets):[],l=[...new Set([...c,...n])].filter(e=>e.length>=8),u=(a?.startedAt??(e.now??Date.now)())+(e.config.taskTimeoutMs??36e5);return l.length&&o&&await i.put(`snapshot`,r,{connectionSecrets:k(e.config,l),expiresAt:u},{ttlMs:Math.max(1,u-(e.now??Date.now)())}),l})}async function Wm(e,t){let n=[];for(let r of t.connections??[]){let i=await _m(e,r,t.requester);if(i?.provider===`env`){n.push(...await Bm(e,i).then(e=>[e],()=>[]));continue}if(!i?.secret)continue;let a=A(e.config,i.secret);n.push(...typeof a==`string`?[a]:[...`token`in a&&typeof a.token==`string`?zm(a.token):[],a.key,a.accessToken,a.refreshToken,a.clientSecret].filter(e=>!!e))}return n}async function Gm(e,t){let[n,r]=await Promise.all([e.store instanceof $a?void 0:e.store.get(`snapshot`,`connection-secrets:${t.id}`),Wm(e,t)]),i=e.store instanceof $a?e.store.connectionSecrets?.get(t.id)??[]:n&&`connectionSecrets`in n?A(e.config,n.connectionSecrets):[];return[...new Set([...i,...r])]}async function Km(e,t){await e.withAppLock(`connections:${t}`,async e=>{await e.delete(`snapshot`,`connection-secrets:${t}`);let n=`connections:${t}:`;for(let t of await e.list(`snapshot`,{prefix:n}))await e.delete(`snapshot`,t.id);if(e instanceof $a){e.connectionSecrets?.delete(t);for(let t of e.connectionContexts?.keys()??[])t.startsWith(n)&&e.connectionContexts.delete(t)}})}const qm=[`queued`,`running`,`waiting`];function Jm(e,t){if(t.since!==void 0&&(e.updatedAt<t.since||e.updatedAt===t.since&&(!t.sinceId||e.task.id<=t.sinceId)))return!1;let n=t.status?[t.status]:t.statuses;if(n&&!n.includes(e.status)||t.agent&&e.task.agent!==t.agent||t.source&&e.task.source!==t.source||t.archived!==void 0&&t.archived!==(e.archivedAt!==void 0))return!1;let r=t.q?.trim().toLowerCase();return!r||[e.task.prompt??e.task.event?.text,e.task.agent,e.task.id].some(e=>e?.toLowerCase().includes(r))}const Ym=e=>({rank:ae(e.status),createdAt:e.createdAt,id:e.task.id}),Xm=e=>({updatedAt:e.updatedAt,id:e.task.id}),Zm=(e,t)=>e.updatedAt-t.updatedAt||oe(e.task.id,t.task.id),Qm=(e,t)=>d(Ym(e),Ym(t)),$m=(e,t)=>!t||(`updatedAt`in t?e.updatedAt>t.updatedAt||e.updatedAt===t.updatedAt&&e.task.id>t.id:d(Ym(e),t)>0);function eh(e){let t=e.event;return JSON.stringify([t?.appId,t?.installationId,t?.chat?.thread.id,e.agent,e.requester,t?.actor.id])}function th(e,t){return e.flow==="default"&&!!e.event?.actor.id&&eh(e)===eh(t)}const nh=6e5;async function rh(e,t){let n=t.task.id,r=t.generation??0,i={generation:r,attempts:t.attempts,tokenHash:t.tokenHash??null,handle:t.handle??null};if(e.queue instanceof oh)return e.queue.deleteTask(e.organizationId,n,i);let[{DrizzleStore:a},{task:o,taskTombstone:s},{and:c,eq:l,isNull:u,sql:d},{rows:f}]=await Promise.all([Promise.resolve().then(()=>nu),import(`./schema.js`),import(`./schema-BSlHRFSP.js`).then(e=>e.E),Promise.resolve().then(()=>ul)]);if(!(e.store instanceof a))throw Error(`Task store does not support fenced deletion`);let p=(e.now??Date.now)(),[m]=await f(e.store.db,d`with gone as (
+      delete from ${o}
+      where ${c(l(o.organizationId,e.organizationId),l(o.publicId,n),l(o.generation,r),l(o.attempts,i.attempts),i.tokenHash===null?u(o.tokenHash):l(o.tokenHash,i.tokenHash),i.handle===null?u(o.handle):l(o.handle,i.handle))}
+      returning organization_id, public_id
+    ), marked as (
+      insert into ${s} (organization_id, public_id, deleted_at)
+      select organization_id, public_id, ${new Date(p).toISOString()}::timestamptz from gone
+    ), pruned as (
+      delete from ${s}
+      where deleted_at < ${new Date(p-nh).toISOString()}::timestamptz
+    )
+    select count(*)::int as deleted from gone`);return!!m?.deleted}async function ih(e,t,n,r,i){let a=await e.queue.appendInbox(e.organizationId,t,n,r,(e.now??Date.now)(),i);return a&&await ch(e,t),a}const ah=new Set([`completed`,`failed`,`cancelled`]);var oh=class{store;lock=Promise.resolve();tombstones=new Map;constructor(e){this.store=e}serial(e){let t=this.lock.then(e,e);return this.lock=t.catch(()=>{}),t}async read(e){return this.store.get(`task`,e)}async enqueue(e,t,n,r,i){return this.serial(()=>this.insert(t,n,r,i))}async insert(e,t,n,r){let i=n&&await this.store.get(`delivery`,n.key);if(i&&!i.pending)return!1;e=i?.pending?.task??e;let a=await this.read(e.id);if(!a&&r!==void 0&&(await this.store.list(`task`)).filter(e=>e.value.status===`queued`).length>=r)throw Error(`Organization task queue is full`);return n&&!i&&await this.store.put(`delivery`,n.key,{at:t,pending:{task:e}}),a||await this.store.put(`task`,e.id,{task:e,status:`queued`,attempts:0,createdAt:t,updatedAt:t}),n&&await this.store.put(`delivery`,n.key,{at:t},{ttlMs:n.ttlMs}),!0}async nextSeq(e){let t=await this.store.list(`inbox`,{prefix:`${e}:`}),n=(await this.store.list(`delivery`)).flatMap(t=>t.value.pending?.inbox?.id.startsWith(`${e}:`)?[t.value.pending.inbox.entry.seq]:[]);return Math.max((await this.read(e))?.inboxSeq??-1,...t.map(e=>e.value.seq),...n)+1}deliver(e,t,n,r,i,a,o=!0){return this.serial(async()=>{let s=await this.store.get(`delivery`,r.key);if(s&&!s.pending)return{};if(s?.pending?.inbox){let{taskId:e,id:i,entry:a}=s.pending.inbox,o=await this.read(e);if(o&&qm.includes(o.status)&&(o.generation??0)===a.generation&&th(o.task,t))return await this.store.put(`task`,e,{...o,inboxSeq:Math.max(o.inboxSeq??-1,a.seq),updatedAt:n}),await this.store.put(`inbox`,i,a),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0};await this.store.delete(`delivery`,r.key),s=void 0}let c=i&&!s?.pending?.task?(await this.list(e,{statuses:qm,agent:t.agent,source:t.source})).find(e=>th(e.task,t)):void 0;if(!c)return o&&await this.insert(t,n,r,a)?{taskId:t.id}:{};let l=await this.nextSeq(c.task.id),u={seq:l,generation:c.generation??0,at:n,kind:`steer`,value:{text:t.event.text}},d=`${c.task.id}:${String(l).padStart(8,`0`)}`;return await this.store.put(`delivery`,r.key,{at:n,pending:{inbox:{taskId:c.task.id,id:d,entry:u}}}),await this.store.put(`task`,c.task.id,{...c,inboxSeq:l,updatedAt:n}),await this.store.put(`inbox`,d,u),await this.store.put(`delivery`,r.key,{at:n},{ttlMs:r.ttlMs}),{steered:!0}})}claim(e,t){return this.serial(async()=>{let n=(await this.store.list(`task`)).map(e=>e.value);if(t!==void 0&&n.filter(e=>[`running`,`waiting`].includes(e.status)).length>=t)return;let r=n.filter(e=>e.status===`queued`).sort((e,t)=>e.createdAt-t.createdAt),i=r[0];if(!i)return;let a=au(i.task.id,`default`,i.attempts+1),o={...i,tokenHash:a.hash,lastSeenAt:e,status:`running`,attempts:i.attempts+1,startedAt:e,updatedAt:e};return await this.store.put(`task`,o.task.id,o),{organizationId:`default`,status:o,token:a.token,more:r.length>1&&(t===void 0||n.filter(e=>[`running`,`waiting`].includes(e.status)).length+1<t)}})}allowed(e,t){return(t.generation===void 0||(e.generation??0)===t.generation)&&(t.attempts===void 0||e.attempts===t.attempts)&&(t.tokenHash===void 0||(e.tokenHash??null)===t.tokenHash)&&(t.handle===void 0||(e.handle??null)===t.handle)&&(t.lastSeenAt===void 0||(e.lastSeenAt??null)===t.lastSeenAt)&&(t.updatedAt===void 0||e.updatedAt===t.updatedAt)&&(!t.statuses||t.statuses.includes(e.status))}touch(e,t,n,r,i,a=!1){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{tokenHash:n,attempts:r})||!a&&ah.has(e.status)||e.status===`queued`)return;if(ah.has(e.status))return e;let o={...e,lastSeenAt:i,updatedAt:i};return await this.store.put(`task`,t,o),o})}async archiveStopped(e,t,n){let r=e=>e!==void 0&&ah.has(e.status)&&e.archivedAt===void 0&&(!n||n.includes(e.task.id))&&m(e.finishedAt??e.updatedAt,t);for(let{value:e}of await this.store.list(`task`))r(e)&&await this.serial(async()=>{let n=await this.read(e.task.id);r(n)&&await this.store.put(`task`,n.task.id,{...n,archivedAt:t,updatedAt:t,autoArchived:!0})})}patchTask(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,i))return!1;let{answer:a,...o}=n;return await this.store.put(`task`,t,{...e,...Object.hasOwn(n,`handle`)&&n.handle!==e.handle?{logsComplete:void 0}:{},...o,...a===void 0?{}:{answer:[...e.answer??[],a]},updatedAt:r}),!0})}deleteTask(e,t,n){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,n)?!1:(await this.store.delete(`task`,t),this.tombstone(t),!0)})}continueTask(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!e||!ah.has(e.status)||!this.allowed(e,i))return!1;let{note:a,...o}=n.context??{},s=await this.store.get(`note`,Cu(e.task));return n.context={...o,...s?{note:s}:{}},await this.store.put(`task`,t,{task:{...e.task,...n},status:`queued`,attempts:0,logSeq:e.logSeq,logBytes:e.logBytes,generation:(e.generation??0)+1,inboxSeq:e.inboxSeq,createdAt:e.createdAt,updatedAt:r},{unarchive:!0}),!0})}completeTask(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);if(!e||!this.allowed(e,{attempts:n.attempts,tokenHash:n.tokenHash,statuses:[`running`,`waiting`]}))return!1;if(await this.store.put(`usage`,`${t}:${e.generation??0}`,n.usage),n.note){let{key:e,value:t,ttlMs:r}=n.note;t?await this.store.put(`note`,e,t,{ttlMs:r}):await this.store.delete(`note`,e)}for(let n of await this.store.list(`inbox`,{prefix:`${t}:`}))n.value.generation===(e.generation??0)&&await this.store.delete(`inbox`,n.id);return await this.store.put(`task`,t,{...e,...n.outcome,lastSeenAt:r,finishedAt:r,updatedAt:r}),await Km(this.store,t),!0})}requeue(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...r,statuses:[`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,status:`queued`,handle:void 0,tokenHash:void 0,lastSeenAt:void 0,updatedAt:n}),!0)})}finish(e,t,n,r,i={}){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,{...i,statuses:[`queued`,`running`,`waiting`]})?!1:(await this.store.put(`task`,t,{...e,...n,lastSeenAt:r,finishedAt:r,updatedAt:r}),await Km(this.store,t),!0)})}cancel(e,t,n,r={}){return this.serial(async()=>{let e=await this.read(t);if(!e||ah.has(e.status)||!this.allowed(e,r))return!1;let i=e.status===`queued`?void 0:{seq:await this.nextSeq(t),generation:e.generation??0,kind:`cancel`,value:null,at:n};return i&&await this.store.put(`inbox`,`${t}:${String(i.seq).padStart(8,`0`)}`,i),await this.store.put(`task`,t,{...e,...e.status===`queued`?{status:`cancelled`,finishedAt:n}:{},cancelRequestedAt:n,...i?{inboxSeq:i.seq}:{},updatedAt:n}),e.status===`queued`&&await Km(this.store,t),!0})}async cancelRequested(e,t){return(await this.read(t))?.cancelRequestedAt!==void 0}async list(e,t={}){let{before:n}=t;return(await this.store.list(`task`)).map(e=>e.value).filter(e=>Jm(e,t)).filter(e=>$m(e,n)).sort(t.since===void 0?Qm:Zm).slice(0,t.limit)}tombstone(e){this.tombstones.set(e,Date.now())}async changes(e,t){let n=e[0]?.organizationId;if(!n)return{rows:[],deleted:[]};for(let[e,t]of this.tombstones)t<Date.now()-6e5&&this.tombstones.delete(e);return{rows:(await this.store.list(`task`)).map(e=>({organizationId:n,status:e.value})),deleted:[...this.tombstones].filter(([,e])=>e>t).map(([e,t])=>({organizationId:n,id:e,at:t}))}}async counts(e,t={}){let n=(await this.store.list(`task`)).map(e=>e.value).filter(e=>Jm(e,t));return{all:n.length,active:n.filter(e=>qm.includes(e.status)).length,waiting:n.filter(e=>e.status===`waiting`).length}}async runningCount(){return(await this.store.list(`task`)).filter(e=>[`running`,`waiting`].includes(e.value.status)).length}async running(){return(await this.store.list(`task`)).map(e=>e.value).filter(e=>[`running`,`waiting`].includes(e.status)).map(e=>({organizationId:`default`,status:e}))}appendLogs(e,t,n,r,i,a,o){return this.serial(async()=>{let e=await this.read(t);return!e||!this.allowed(e,o)||(e.logSeq??0)!==r.seq||(e.logCursor??-1)!==r.cursor?!1:(await this.store.putMany(`tasklog`,n.map(({seq:e,...n})=>({id:`${t}:${String(e).padStart(6,`0`)}`,value:n}))),await this.store.put(`task`,t,{...e,logCursor:i.cursor,logSeq:i.seq,logBytes:i.bytes,updatedAt:a}),!0)})}readInbox(e,t,n,r){return this.serial(async()=>{let e=await this.read(t);return!e||!qm.includes(e.status)||(e.generation??0)!==n?[]:(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(e=>e.generation===n&&e.seq>r).slice(0,100)})}fetchInbox(e,t,n,r,i){return this.serial(async()=>{let e=await this.read(t);if(!(!e||!this.allowed(e,{tokenHash:n,attempts:r,statuses:[`running`,`waiting`]})))return(await this.store.list(`inbox`,{prefix:`${t}:`})).map(e=>e.value).filter(t=>t.generation===(e.generation??0)&&t.seq>i).sort((e,t)=>e.seq-t.seq)})}ackInbox(e,t,n,r){return this.serial(async()=>{if(r.generation!==void 0&&r.generation!==n.generation)return!1;let e=await this.read(t);if(!e||!this.allowed(e,{...r,generation:n.generation,statuses:void 0})||n.seq>(e.inboxSeq??-1))return!1;let i=e.inboxAck?.generation===n.generation?e.inboxAck.seq:-1;if(ah.has(e.status))return n.seq<=i;if(![`running`,`waiting`].includes(e.status))return!1;let a=(await this.store.list(`inbox`,{prefix:`${t}:`})).filter(e=>e.value.generation===n.generation&&e.value.seq<=n.seq),o=(n.answers??[]).filter(e=>e.seq>i&&a.some(t=>t.value.kind===`ask`&&t.value.seq===e.seq)).map(e=>e.value),s=a.some(e=>e.value.kind===`cancel`),c=e.approval?.id,l=c&&a.some(e=>e.value.kind===`approve`&&e.value.value?.approvalId===c);await this.store.put(`task`,t,{...e,inboxAck:{generation:n.generation,seq:Math.max(i,n.seq)},...o.length?{answer:[...e.answer??[],...o]}:{},...l?{status:`running`,approval:void 0}:{},...s?{status:`cancelled`,finishedAt:Date.now()}:{},updatedAt:Date.now()});for(let e of a)await this.store.delete(`inbox`,e.id);return s&&await Km(this.store,t),!0})}async pendingInbox(e){let t=await this.store.list(`inbox`);return(await this.running()).filter(({status:e})=>t.some(t=>t.id.startsWith(`${e.task.id}:`)&&t.value.generation===(e.generation??0)))}appendInbox(e,t,n,r,i,a){return this.serial(async()=>{let e=await this.read(t);if(!e||!qm.includes(e.status)||(e.generation??0)!==a)return;let o=await this.nextSeq(t),s={seq:o,generation:a,at:i,kind:n,value:r};return await this.store.put(`inbox`,`${t}:${String(o).padStart(8,`0`)}`,s),await this.store.put(`task`,t,{...e,inboxSeq:o,updatedAt:i}),s})}};const sh=3e4;function ch(e,t){let n=e.queue.inboxDelivery??=new Map,r=JSON.stringify([e.organizationId,t]),i=n.get(r);if(i||n.set(r,i={}),i.work)return i.again=!0,i.work;let a=i,o=async()=>{let n,r=sr(),i=0,o=0,s,c=async()=>{for(;;){a.again=!1;let s=await e.store.get(`task`,t);if(!s?.handle||![`running`,`waiting`].includes(s.status))return;let c=await Qt(e,s.task),l=!!(e.local&&s.handle.startsWith(`cli:`));if(!l&&!c?.push)return;o=s.generation??0;let u={generation:o,attempts:s.attempts,tokenHash:s.tokenHash??null,handle:s.handle},d=`inbox:${JSON.stringify([t,u])}`;if(n!==d){n&&await e.store.updateDeliveryLease(n,r),n=void 0;let t=await e.store.claimDeliveryLease(d,r,sh);if(t===void 0)return;n=d,i=t}else if(!await e.store.updateDeliveryLease(n,r,{owner:r,failures:i},{ttlMs:sh}))return;let f=(await e.queue.readInbox(e.organizationId,t,s.generation??0,-1)).slice(0,100);if(!f.length){if(a.again)continue;return}let p=l?await sp(e,s,f):await c.push(s.handle,f);if(p.generation!==(s.generation??0)||!f.some(e=>e.seq===p.seq))throw Error(`Invalid inbox acknowledgement`);if(!await e.queue.ackInbox(e.organizationId,t,p,u)||(i=0,f.length<100&&!a.again))return}};try{await c()}catch{if(n){let t=Math.min(3e4,1e3*2**Math.min(i,5)),a={owner:r,failures:i+1,next:(e.now??Date.now)()+t};await e.store.updateDeliveryLease(n,r,a,{ttlMs:t}),n=void 0}}finally{n&&(await e.store.updateDeliveryLease(n,r),s=o)}return s};return a.work=(async()=>{for(;;){let n=await o();if(n===void 0||!(await e.queue.readInbox(e.organizationId,t,n,-1)).length&&!a.again)break}n.delete(r)})().finally(()=>{n.get(r)===a&&n.delete(r)}),a.work}async function lh(e,t){let n=await e.queue.pendingInbox(t);await Promise.allSettled(n.map(({organizationId:t,status:n})=>ch(U(e,t),n.task.id)))}function uh(e,t){let n=lh(e,t).catch(e=>console.error(`coder server: inbox flush failed`,e));e.waitUntil&&e.waitUntil(n)}function dh(){return(process.env.PATH??``).split(V.delimiter).some(e=>{try{let t=V.join(e,`docker`);return Zn(t,Qn.X_OK),tr(t).isFile()}catch{return!1}})}function fh(e){let t=!!e.local,n=t&&dh(),r={key:`tarballUrl`,label:`Package URL`,hint:`Leave empty for this server's published version.`,optional:!0};return[{kind:`local`,name:t?`Another machine`:`Your machine`,description:t?`Pair another computer; it runs tasks with its own logins.`:`Run tasks with your own machine and logins.`,connect:`pair`,fields:[],available:!0},{kind:`local-docker`,name:`Docker on the server`,description:`Run each task in a Docker container.`,connect:`fields`,help:`Each task runs in a fresh container on this server, using the Docker installed here. Leave fields empty for the defaults.`,fields:[{key:`image`,label:`Image`,placeholder:$t,hint:`Needs Bun, Node, Git, curl, tar, Claude Code, Codex and GitHub MCP server.`,optional:!0},{key:`memory`,label:`Memory limit`,placeholder:`4g`,optional:!0},{key:`cpus`,label:`CPU limit`,placeholder:`2`,optional:!0},r],available:n,...n?{}:{reason:t?`Docker is not on PATH.`:`Available on a local server only.`}},{kind:`vercel-sandbox`,name:`Vercel Sandbox`,description:`Run tasks in an isolated sandbox.`,connect:`fields`,help:`Each task gets a fresh Vercel Sandbox. Create an access token at vercel.com/account/tokens with Sandbox access for the team that pays for it.`,fields:[{key:`token`,label:`Access token`,placeholder:`vcp_…`,hint:`with Sandbox access`,secret:!0},{key:`team`,label:`Team`,placeholder:`team_…`,hint:`VERCEL_TEAM_ID if empty`,optional:!0},{key:`projectId`,label:`Project`,placeholder:`prj_…`,hint:`VERCEL_PROJECT_ID if empty`,optional:!0},{key:`region`,label:`Region`,placeholder:`iad1`,hint:`nearest if empty`,optional:!0},r],available:!0},{kind:`github-actions`,name:`GitHub Actions`,description:`Run tasks through a repository workflow.`,connect:`fields`,help:`Each task starts a workflow run in a repository you choose. Save coder server workflow as .github/workflows/coder-agent.yml. It runs coder agent run --task; the token needs Actions read and write on that repository.`,fields:[{key:`repo`,label:`Repository`,placeholder:`acme/runners`,hint:`owner/name`},{key:`workflow`,label:`Workflow file`,placeholder:`coder-agent.yml`,hint:`in .github/workflows`},{key:`token`,label:`Token`,placeholder:`github_pat_…`,hint:`Actions read and write`,secret:!0},{key:`ref`,label:`Branch`,placeholder:`main`,hint:`default branch if empty`,optional:!0},r],available:!0},{kind:`http`,name:`HTTP runner`,description:`Connect a runner at a public HTTPS address.`,connect:`fields`,help:`A machine already running coder runner serve. Copy the address and secret it printed; pairing from the Another machine or Your machine option does this for you.`,fields:[{key:`url`,label:`Address`,placeholder:`https://runner.example.com`,hint:`its https address`},{key:`secret`,label:`Secret`,placeholder:`printed by coder runner serve`,hint:`32 characters or more`,secret:!0}],available:!0}]}const ph=f().check(t(1),e(80)),mh=Ee([`personal`,`workspace`]),hh=He(f(),f()),gh=C({kind:Ee([`local`,`local-docker`,`github-actions`,`vercel-sandbox`,`http`]),name:ph,scope:mh,config:hh}),_h=C({name:g(ph),default:g(y(!0)),config:g(hh)});function vh(e,t,n,r=t.default){return{id:e,kind:t.kind,name:t.name,scope:t.scope,default:r,online:t.lastSeen!==void 0&&n-t.lastSeen<3e5,...t.lastSeen===void 0?{}:{lastSeen:t.lastSeen},config:t.config,createdAt:t.createdAt}}const yh=(e,t)=>({value:n})=>en(n,t)&&(e.local||n.kind!==`local`&&n.kind!==`local-docker`);function bh(e){let t=e.session?.user.id,n=(e.now??Date.now)(),r=n=>n===`workspace`?Uh(e):!!t,i=async(n=e.store)=>(await n.list(`runner`)).filter(yh(e,t));return{user:t,now:n,canCreate:r,rows:i,row:async(t,r,a=e.store)=>{let o=(await i(a)).some(({value:e})=>e.scope===`personal`&&e.default);return vh(t,r,n,r.default&&(r.scope===`personal`||!o))}}}async function xh(e,t,n,r){return D({items:Sh(t,await t.store.list(`runner`),(t.now??Date.now)()),catalog:fh(t)})}function Sh(e,t,n){let r=t.filter(yh(e,e.session?.user.id)),i=r.find(({value:e})=>e.scope===`personal`&&e.default)??r.find(({value:e})=>e.default);return[{id:Xt(e),kind:e.config.runner,name:e.local?`This machine`:`Default runner`,scope:`workspace`,default:!i,online:!0,config:{},createdAt:0},...r.map(({id:e,value:t})=>vh(e,t,n,e===i?.id))]}async function Ch(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=bh(t);{let n=gh.safeParse(await e.json().catch(()=>void 0));if(!n.success)return D({error:`Invalid runner`},400);if(!o(n.data.scope))return D({error:`This scope requires a member or workspace admin.`},403);let r=fh(t).find(e=>e.kind===n.data.kind);if(!r.available||r.connect===`pair`)return D({error:r.reason??`Pair this runner with runner serve.`},400);try{Jt(r,n.data.config)}catch(e){return D({error:e.message},400)}let s=Dh(n.data.kind,n.data.config,t),l=`rnr_${or(9).toString(`base64url`)}`,u={...n.data,...s,owner:n.data.scope===`personal`?i:void 0,createdBy:i,default:!1,createdAt:a,updatedAt:a};return await t.store.put(`runner`,l,u),D(await c(l,u))}}async function wh(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=bh(t);if(i===Xt(t))return D(await Wt(t));let u=e=>{if(!e||!en(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return D({error:`Unknown runner`},404);if(e.scope===`workspace`&&!Uh(t))return D({error:`Only a workspace owner or admin can change this runner.`},403)},d=await t.store.get(`runner`,i),f=u(d);if(f)return f;let p=await Wt(t,d);return await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i);n&&n.secret===d.secret&&JSON.stringify(n.config)===JSON.stringify(d.config)&&await e.put(`runner`,i,{...n,lastSeen:p.ok?(t.now??Date.now)():void 0,updatedAt:(t.now??Date.now)()})}),D(p)}async function Th(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=bh(t);if(i===Xt(t)){if(Uh(t)){let n=_h.safeParse(await e.json().catch(()=>void 0));if(!n.success||!n.data.default||n.data.name||n.data.config)return D({error:`Only the default can change for the built-in runner.`},400);await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{for(let{id:t,value:n}of await e.list(`runner`))n.scope===`workspace`&&n.default&&await e.put(`runner`,t,{...n,default:!1,updatedAt:o})});let r=(await c()).some(({value:e})=>e.scope===`personal`&&e.default);return D({id:i,kind:t.config.runner,name:t.local?`This machine`:`Default runner`,scope:`workspace`,default:!r,online:!0,config:{},createdAt:0})}return D({error:`The server default cannot be renamed or removed.`},403)}let u=e=>{if(!e||!en(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return D({error:`Unknown runner`},404);if(e.scope===`workspace`&&!Uh(t))return D({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async n=>{let r=await n.get(`runner`,i),a=u(r);if(a||!r)return a;{let a=_h.safeParse(await e.json().catch(()=>void 0));if(!a.success||!Object.keys(a.data).length)return D({error:`Invalid runner update`},400);let s={};if(a.data.config){let e={...r.config,...A(t.config,r.secret),...a.data.config};try{Jt(fh(t).find(e=>e.kind===r.kind),e)}catch(e){return D({error:e.message},400)}s=Dh(r.kind,e,t)}if(a.data.default)for(let e of await n.list(`runner`))e.id!==i&&e.value.scope===r.scope&&e.value.owner===r.owner&&e.value.default&&await n.put(`runner`,e.id,{...e.value,default:!1,updatedAt:o});let c={...r,...a.data.name?{name:a.data.name}:{},...a.data.default?{default:!0}:{},...s,updatedAt:o};return await n.put(`runner`,i,c),D(await l(i,c,n))}})}async function Eh(e,t,n,r){let i=n.id,{user:a,now:o,canCreate:s,rows:c,row:l}=bh(t);if(i===Xt(t))return D({error:`The server default cannot be renamed or removed.`},403);let u=e=>{if(!e||!en(e,a)||!t.local&&(e.kind===`local`||e.kind===`local-docker`))return D({error:`Unknown runner`},404);if(e.scope===`workspace`&&!Uh(t))return D({error:`Only a workspace owner or admin can change this runner.`},403)};return t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n=await e.get(`runner`,i),r=u(n);if(r||!n)return r;{let n=(await e.list(`task`)).filter(({value:e})=>e.task.runnerId===i&&qm.includes(e.status)).length;return n?D({error:n===1?`1 task still runs on this runner. Stop it or wait.`:`${n} tasks still run on this runner. Stop them or wait.`},409):(await e.delete(`runner`,i),t.settings?.runnerInstances?.delete(i),D({ok:!0}))}})}function Dh(e,t,n){let r=new Set(fh(n).find(t=>t.kind===e).fields.filter(e=>e.secret).map(e=>e.key)),i=Object.entries(t);return{config:Object.fromEntries(i.filter(([e])=>!r.has(e))),secret:k(n.config,Object.fromEntries(i.filter(([e])=>r.has(e))))}}const Oh=C({name:g(ph),scope:mh});async function kh(e,t,n,r){n.id;let{user:i,now:a,canCreate:o,rows:s,row:c}=bh(t),l=Oh.safeParse(await e.json().catch(()=>void 0));if(!l.success)return D({error:`Invalid pairing`},400);if(!o(l.data.scope))return D({error:`This scope requires a member or workspace admin.`},403);let u=`${Buffer.from(t.organizationId).toString(`base64url`)}.${or(32).toString(`base64url`)}`,d=a+9e5;await t.store.put(`snapshot`,`runner-pair:${ct(u)}`,{...l.data,owner:l.data.scope===`personal`?i:void 0,createdBy:i,expiresAt:d},{ttlMs:9e5});let f=t.config.publicUrl??r.origin;return D({token:u,expiresAt:d,command:`coder runner serve --url ${f} --token ${u}`})}const Ah=C({token:g(f()),id:g(f()),organizationId:g(f()),name:g(f().check(t(1),e(80))),url:f(),secret:f().check(t(32)),offline:g(Te())});async function jh(e,t,n,r){let i=Ah.safeParse(await e.json().catch(()=>void 0));if(!i.success)return D({error:`Invalid runner registration`},400);let a=i.data;try{new qt({url:a.url,secret:a.secret})}catch{return D({error:`A public HTTPS runner URL is required`},400)}let o=a.token?Buffer.from(a.token.split(`.`)[0],`base64url`).toString():a.organizationId;if(!o||o!==t.organizationId&&!t.scope)return D({error:`Invalid runner token`},401);t=U(t,o);let s=(t.now??Date.now)(),c=await t.store.withAppLock(`runners:${t.organizationId}`,async e=>{let n,r;if(a.token){let i=`runner-pair:${ct(a.token)}`,o=await e.get(`snapshot`,i);if(!o||o.expiresAt<=s||!await e.take(`snapshot`,i))return D({error:`Pairing token expired or already used`},401);r=`rnr_${or(9).toString(`base64url`)}`,n={kind:`http`,name:o.name??a.name??`Your machine`,scope:o.scope,owner:o.owner,createdBy:o.createdBy,default:!1,createdAt:s,updatedAt:s,...Dh(`http`,{url:a.url,secret:a.secret},t),lastSeen:s}}else{r=a.id??``;let i=await e.get(`runner`,r);if(!i||i.kind!==`http`||!ot(A(t.config,i.secret).secret??``,a.secret))return D({error:`Invalid runner token`},401);n={...i,config:{...i.config,url:a.url},lastSeen:a.offline?void 0:s,updatedAt:s}}return await e.put(`runner`,r,n),D({...vh(r,n,s),organizationId:o})});return c.ok&&t.taskWatcher?.runnersChanged(t.organizationId),c}async function Mh(e,t,n,r=!1){let i=Kh(e);if(!i)return new Response(`Unauthorized`,{status:401});let a=ou(i);return a.task!==n||a.organization!==t.organizationId||!Number.isInteger(a.attempt)?new Response(`Unauthorized`,{status:401}):await t.queue.touch(t.organizationId,n,iu(i),a.attempt,(t.now??Date.now)(),r)??new Response(`Unauthorized`,{status:401})}function Nh(e){let t=e.event;return t?t.repo?`${t.repo.owner}/${t.repo.name}`:t.chat?.thread.channelId??t.integration:e.source}async function Ph(e,t,n,r){let i=n.id,a=Kh(e),o=ou(a),s=iu(a),c=Number(r.searchParams.get(`after`)??-1);if(!Number.isInteger(c)||c<-1)return D({error:`Invalid cursor`},400);let l=await t.queue.fetchInbox(t.organizationId,i,s,o.attempt,c);return l?D(l):new Response(`Unauthorized`,{status:401})}async function Fh(e,t,n,r){let i=n.id,a=Kh(e),o=ou(a),s=iu(a),c=await e.json().catch(()=>void 0);if(!c||!Number.isInteger(c.seq)||c.seq<-1||!Number.isInteger(c.generation)||c.generation<0||c.answers!==void 0&&(!Array.isArray(c.answers)||c.answers.some(e=>!e||!Number.isInteger(e.seq)||e.seq<0||e.seq>c.seq)))return D({error:`Invalid acknowledgement`},400);let l={tokenHash:s,attempts:o.attempt,generation:c.generation},u=await t.queue.ackInbox(t.organizationId,i,c,l);if(u){let e=await t.store.get(`task`,i);e?.status===`cancelled`&&await Ko(t,e)}return u?D({ok:!0}):new Response(`Unauthorized`,{status:401})}async function Ih(e,t,n){let r=(await e.json().catch(()=>void 0))?.entries;if(!Array.isArray(r)||r.length>100||r.some((e,t)=>!e||!Number.isSafeInteger(e.seq)||e.seq<0||!Number.isSafeInteger(e.at)||e.at<0||![`out`,`err`].includes(e.level)||typeof e.line!=`string`||Buffer.byteLength(e.line)>65536||t>0&&e.seq!==r[t-1].seq+1))return D({error:`Invalid task logs`},400);let i=await yu(t,t.callbackTask,r);return i===`ok`?D({ok:!0}):i===`gap`?D({error:`Task log sequence has a gap`},409):new Response(`Unauthorized`,{status:401})}async function Lh(e,t,n,r){let i=n.id,a=Kh(e),o=ou(a),s=iu(a);return await t.queue.touch(t.organizationId,i,s,o.attempt,(t.now??Date.now)())?D({ok:!0}):new Response(`Unauthorized`,{status:401})}async function Rh(e,t,n,r){let i=n.id;Kh(e);let a=t.callbackTask;if([`completed`,`failed`,`cancelled`].includes(a.status))return await Ko(t,a),D({ok:!0});let o=a.handle?await Qt(t,a.task):void 0,s=await e.json().catch(()=>void 0);if(!s?.status||![`running`,`waiting`,`completed`,`failed`,`cancelled`].includes(s.status))return D({error:`Invalid task result`},400);let c=(await Kf(t,a)).sort((e,t)=>t.length-e.length);Object.assign(s,JSON.parse(JSON.stringify(s,(e,t)=>typeof t==`string`?c.reduce((e,t)=>e.replaceAll(t,`[REDACTED]`),t):t)));let l=(t.now??Date.now)();if(s.status===`running`||s.status===`waiting`)return await t.queue.patchTask(t.organizationId,i,{status:s.status,lastSeenAt:l,...s.approval===void 0?s.status===`running`?{approval:void 0}:{}:{approval:s.approval},...s.answer===void 0?{}:{answer:s.answer}},l,{attempts:a.attempts,tokenHash:a.tokenHash,statuses:[`running`,`waiting`]}),D({ok:!0});let u=typeof s.result==`string`?s.result:JSON.stringify(s.result??``),d={ok:s.status===`completed`,exitCode:s.status===`completed`?0:1,output:u,...typeof s.diff==`string`?{diff:s.diff}:{}};return await t.queue.completeTask(t.organizationId,i,{attempts:a.attempts,tokenHash:a.tokenHash,outcome:{status:s.status,result:d,...s.error?{error:s.error}:{},...s.tokens===void 0?{}:{tokens:s.tokens}},...typeof s.note==`string`?{note:{key:Cu(a.task),value:s.note,ttlMs:2592e6}}:{},usage:{...a.task.event?{installationId:`${a.task.event.appId}:${a.task.event.installationId}`}:{},taskId:i,agent:a.task.agent,target:Nh(a.task),...a.task.usage?.engine??a.task.definition.engine?{engine:a.task.usage?.engine??a.task.definition.engine}:{},...a.task.usage?.model??a.task.definition.model?{model:a.task.usage?.model??a.task.definition.model}:{},credential:a.task.credential??`unknown`,runnerElapsedMs:Math.max(0,l-(a.startedAt??l)),...s.tokens===void 0?{}:{tokens:s.tokens},at:l}},l)&&await Ko(t,a,!1,o),D({ok:!0})}async function zh(e,t,n,r){n.id,Kh(e);let i=t.callbackTask,a=await e.json().catch(()=>({}));return typeof a.authJson!=`string`||!i.task.credential?D({error:`Invalid credential update`},400):D({kept:await Jp(t.store,t.config,i.task.credential,a.authJson)})}async function Bh(e,t,n,r){n.id,Kh(e);let i=t.callbackTask;try{let{connectionSecrets:e,...n}=await Bf(t,i);return D({...n,generation:i.generation??0,logCursor:i.logCursor??-1,timeoutMs:Math.max(1,t.config.taskTimeoutMs-((t.now??Date.now)()-(i.startedAt??(t.now??Date.now)())))})}catch(e){return D({error:e instanceof Error?e.message:String(e)},409)}}async function Vh(e,t){if(!t.auth)return t;let n=await t.auth.session(e.headers);if(!(!n?.organizationId||n.organizationDenied))return{...U(t,n.organizationId),session:n}}const Hh=new Set([`owner`,`admin`]);function Uh(e){return!e.auth||Hh.has(e.session?.role??``)}function Wh(e,t){return Uh(e)?e:D({error:t},403)}function Gh(e,t){return!!(e&&t&&ot(e,t))}function Kh(e){let t=e.headers.get(`authorization`);return t?.startsWith(`Bearer `)?t.slice(7):null}const qh=new Set([`localhost`,`127.0.0.1`,`::1`,`[::1]`]);function Jh(e){if(e.headers.has(`x-forwarded-for`)||e.headers.has(`x-forwarded-host`))return!1;let t=e.headers.get(`host`)??new URL(e.url).host;try{return qh.has(new URL(`http://${t}`).hostname)}catch{return!1}}const Yh=e=>e.local?`local`:e.config.store===`postgres`?`cloud`:`memory`,Xh=e=>e.startsWith(`/tasks/`)||e.startsWith(`/logins/`)||e===`/runners/register`,Zh=[`/hooks/`,`/create/`,`/install/`,`/connect/`];function Qh(e,t){let n=e?.replace(/^::ffff:/,``)??``;if(qh.has(n)||n.startsWith(`127.`))return!0;let r=URL.parse(`http://localhost${t}`)?.pathname??``;return r===`/connections/oauth/client.json`||Xh(r)||Zh.some(e=>r.startsWith(e))}function $h(e,t){if(!t.local)return!0;let n=new URL(e.url),r=e.headers.get(`host`)??n.host,i=URL.parse(`http://${r}`)?.port||`80`;if(Jh(e)&&i===String(t.local.port))return!0;let a=t.config.publicUrl?new URL(t.config.publicUrl).host:void 0;return(e.headers.get(`x-forwarded-host`)?.split(`,`,1)[0]?.trim()??r)===a&&!Jh(e)&&(n.pathname===`/connections/oauth/client.json`||Xh(n.pathname)||Zh.some(e=>n.pathname.startsWith(e)))}function eg(e,t){let n=e.headers.get(`origin`)??e.headers.get(`referer`);if(!n)return!1;try{return new URL(n).origin===new URL(t??e.url).origin}catch{return!1}}function tg(e){let t=e.headers.get(`cookie`)?.split(`;`).map(e=>e.trim()).find(e=>e.startsWith(`coder_admin=`))?.slice(12);if(!t)return null;try{return decodeURIComponent(t)}catch{return null}}async function ng(e,t){if(!t.auth){let n=()=>new Response(`Unauthorized`,{status:401,headers:{"www-authenticate":`Bearer`}});if(t.config.store!==`memory`||!Jh(e))return n();let r=tg(e),i=Gh(Kh(e),t.config.adminToken),a=Gh(r,t.config.adminToken);return i?{...t,authorizedRequest:e}:a?e.method===`GET`||eg(e)?{...t,authorizedRequest:e}:Ft():n()}let n=await t.auth.session(e.headers,e.method!==`GET`);if(n?.stale)return D({error:`Token too old for this action.`},401,{"www-authenticate":`Bearer error="invalid_token", error_description="Token too old for this action"`});if(n?.organizationDenied)return D({error:`You are not a member of that workspace.`},403);let r=n?.role;return!n?.organizationId||!r?D({error:`Sign in first.`,hint:`coder auth login`},401,Kh(e)?{"www-authenticate":`Bearer error="invalid_token"`}:{}):e.method!==`GET`&&e.headers.has(`cookie`)&&!eg(e,t.config.publicUrl)?Ft():{...U(t,n.organizationId),auth:t.auth,session:n,authorizedRequest:e}}async function rg(e,t){if(!t.auth)return t;let n=new Headers(e.headers),r=new URL(e.url).searchParams.get(`organization`);r&&n.set(`x-coder-organization`,r);let i=await t.auth.session(n,!0);if(i?.organizationDenied)return new Response(`You are not a member of that workspace.`,{status:403});let a=i?.role;return!i?.organizationId||!a?Lt(new URL(e.url)):{...U(t,i.organizationId),session:i}}async function ig(e,t){if(e.method!==`POST`)return;let n=Ah.safeParse(await e.clone().json().catch(()=>void 0));if(!n.success||n.data.token)return;let{id:r,organizationId:i,secret:a}=n.data;if(!r||!i||i!==t.organizationId&&!t.scope)return;let o=U(t,i),s=await o.store.get(`runner`,r);if(s?.kind===`http`&&ot(A(o.config,s.secret).secret??``,a))return`runner:${i}:${r}`}async function ag(e,t,n,r){let i=n.id,a=Kh(e);if(!a)return new Response(`Unauthorized`,{status:401});let o=ou(a);return o.task!==i||typeof o.organization!=`string`||!o.organization||!Number.isInteger(o.attempt)||(t.scope&&(t=U(t,o.organization)),t.organizationId!==o.organization)?new Response(`Unauthorized`,{status:401}):t}async function og(e,t,n,r,i=!1){let a=n.id,o=Kh(e);if(o&&t.taskOrganization&&t.scope){let e=await t.taskOrganization(a,iu(o));e&&(t=U(t,e))}let s=await Mh(e,t,a,i);return s instanceof Response?s:{...t,callbackTask:s}}function sg(e,t,n,r){return og(e,t,n,r,e.method===`POST`)}function cg(e){let{organization:t}=ou(e);return typeof t==`string`?t:void 0}async function lg(e,t,n){let r=Kh(e);if(!r)return new Response(`Unauthorized`,{status:401});let i=cg(r),a=i&&t.scope&&i!==t.organizationId?U(t,i):t,o=n.id,s=await a.store.get(`login`,o);return!s||!ot(iu(r),s.tokenHash)?new Response(`Unauthorized`,{status:401}):{...a,callbackLogin:s}}async function ug(e,t){let n=e.method===`POST`?new URLSearchParams(await e.clone().text()):void 0;return t.searchParams.get(`tx`)??Bt(t.searchParams.get(`state`))?.tx??n?.get(`tx`)??void 0}async function dg(e,t,n,r){let i=await ug(e,r),a=t.serverOrganizationId??t.organizationId;return i&&Nr(t,i)===`*`&&Mr(t,i)===a?{...U(t,a),operatorApp:!0}:rg(e,t)}function fg(e,t,n,r){return rg(e,t)}async function pg(e,t,n,r){let i=r.pathname.split(`/`)[2];if(!(/^[a-z0-9_-]+$/.test(i)?t.integrations[n.integration]:void 0)?.auth.user||!t.auth||!t.config.publicUrl)return It();if(e.method!==`GET`)return t;let a=await Vh(e,t);return a?.session?{...t,linkContext:a}:Lt(r)}async function mg(e,t,n,r){if(t.local&&!t.auth)return yg(e,t);if(!t.auth)return It();let i=await Vh(e,t);return i?.session?i:Lt(r)}function hg(e,t){return Wh(t,`Workspace admin access is required.`)}const gg=(e,t=e.session)=>!e.auth||!!(t&&e.config.operators?.includes(t.user.id));async function _g(e,t){return gg(t)?t.auth&&await t.auth.operator(e.headers)!==t.session.user.id?D({error:`Operator mode ended. Sign in again to continue.`},401):t:It()}async function vg(e,t,n,r){let i=await Og(e,t,n,r);return i instanceof Response||!t.auth?i:gg(t,await t.auth.session(e.headers))?(await t.auth.operator(e.headers),i):It()}function yg(e,t){return t.local?t:It()}function bg(e,t){return t.local?D({error:vp},400):t.session?.user.id?t:D({error:`Sign in to use a subscription.`},403)}function xg(e){return async(t,n,r,i)=>{let a=n.authorizedRequest===t?n:await ng(t,n);return a instanceof Response?a:e?e(t,a,r,i):a}}function Sg(e,t,n,r){return e.method===(n.engine?`POST`:`GET`)&&(!t.local||n.engine&&!bp(n.engine))?D({error:n.engine?`Engine sign-in is available on a local server only`:`Engine status is available on a local server only`},404):t}async function Cg(e,t,n,r){return t.config.publicUrl&&t.auth?t:Si(e,t,r)}async function wg(e,t,n,r){if(!t.auth)return ng(e,t);if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=await t.auth.session(e.headers);return i?.organizationDenied?D({error:`You are not a member of that workspace.`},403):i?{...t,session:i}:D({error:`Sign in first.`,hint:`coder auth login`},401)}function Tg(e,t,n,r){return e.method===`POST`?t.auth||t.config.store!==`memory`||!Jh(e)?It():eg(e)?t:Ft():t}async function Eg(e,t,n,r){return e.method===`GET`?{...t,session:(await Vh(e,t))?.session}:t}async function Dg(e,t,n,r){return[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)&&t.auth&&(await Vh(e,t))?.session?zt(`/dash`):t}async function Og(e,t,n,r){if(![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method))return t;let i=r.pathname.split(`/`)[2]??``,a=new Headers(e.headers);a.delete(`x-coder-organization`),i&&a.set(`x-coder-organization`,i);let o=await t.auth?.session(a);if(o&&!o.organizations.length)return t.auth.handler(new Request(r.origin+`/api/auth/sign-in?return=`+encodeURIComponent(r.pathname+r.search)));if(t.auth&&!o)return _i(e,t,r,r.pathname+r.search);let s=o?.organizations??[{id:t.organizationId,slug:`local`,name:``,role:`owner`}],c=s.find(e=>encodeURIComponent(e.slug)===i);if(!c){let n=s.find(e=>encodeURIComponent(e.id)===i),a=(await t.auth?.session(e.headers))?.organizationId,o=n??s.find(e=>e.id===a)??s[0],c=`/dash/${encodeURIComponent(o.slug)}`,l=r.pathname.slice(`/dash/${i}`.length);if(n)return zt(`${c}${l}${r.search}`);let u=`${c}${r.pathname.slice(5)}`;return await ni(u,t.dashboardHosts)?zt(`${u}${r.search}`):t.auth&&e.method===`GET`&&await ni(`${c}${l}`,t.dashboardHosts)?zt(`${c}/agents?${new URLSearchParams({link:r.pathname+r.search})}`):It()}return t.auth?(await t.auth.setOrganization(e.headers,c.slug),{...U(t,c.id),session:o}):t}function kg(e,t,n,r){return e.method===`POST`&&t.local?D({error:vp},400):t}async function Ag(e,t,n,r){if(![`GET`,`POST`].includes(e.method))return t;if(!t.auth)return It();if(e.headers.get(`authorization`)?.startsWith(`Bearer `))return D({error:`Link your account from the browser.`},403);let i=await Vh(e,t);return i?.session?{...t,linkContext:i}:e.method===`GET`?Lt(r):D({error:`Sign in first.`},401)}function jg(e,t,n,r){return![`GET`,`POST`,`PUT`,`PATCH`,`DELETE`].includes(e.method)||t.auth?t:It()}async function Mg(e,t,n,r){if(!t.auth)return D({mode:Yh(t),organization:{id:t.organizationId,slug:`local`},server:Ng(t),operator:gg(t)});let i=t.session;return D({mode:Yh(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:Ng(t),operator:gg(t,i)})}function Ng(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},issuesUrl:e.config.issuesUrl,subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}function Pg(e){let t=e.session?.organizations??[];return(t.find(t=>t.id===e.organizationId)??t.find(t=>t.id===e.session?.organizationId))?.slug??(e.auth?e.organizationId:`local`)}async function Fg(e){let t=e.session?.organizations.find(t=>t.id===e.organizationId)?.slug;return t||!e.auth?t??`local`:(await e.auth.organization?.(e.organizationId))?.slug??e.organizationId}const Ig=(e,t=``)=>e?`/dash/${encodeURIComponent(e)}${t}`:`/dash${t}`;function $(e,t,n={},r){let i=new URLSearchParams({status:t});for(let[e,t]of Object.entries(n))t?.length&&i.set(e,Array.isArray(t)?t.join(`,`):t);/^[\w.-]{1,64}$/.test(i.get(`error`)??``)||i.delete(`error`);let a=r??Ig(Pg(e),`/setup`);return zt(`${Lg(e)}${a.replace(/[?#].*$/,``)}?${i}`)}const Lg=e=>e.local?`http://localhost:${e.local.port}`:``,Rg=(e,t)=>Ig(Pg(e),`/agents/${encodeURIComponent(t)}/platforms`);function zg(e){let t=e.get(`agent`),n=e.get(`def`),r=Bt(n);if(!(!t||!n||!r?.integrations))return{state:{agent:t,repo:e.get(`repo`)??void 0,branch:e.get(`branch`)??void 0,def:n,tx:e.get(`tx`)??void 0,owner:e.get(`owner`)||void 0,...[`1`,`true`].includes(e.get(`public`)??``)?{public:!0}:{}},definition:r}}const Bg=e=>typeof e==`string`&&/^\/dash(?:[/?#]|$)/.test(e)?e:void 0,Vg=(e,t)=>JSON.stringify({integration:e,agent:t.agent,repo:t.repo??null,branch:t.branch??null,def:t.def,owner:t.owner??null,public:t.public??!1});async function Hg(e,t,n,r){let i=await Ir(e,t,`create`,r),a=i?JSON.parse(i):void 0,o=Bt(a?.def??null);if(!(a?.integration!==n||!o?.integrations||!await Pr(e,t,`create`,r,i)))return{state:{agent:a.agent,repo:a.repo??void 0,branch:a.branch??void 0,def:a.def,tx:t,owner:a.owner??void 0,...a.public?{public:!0}:{}},definition:o}}async function Ug(e,t,n){return(await e.store.list(`app`,{prefix:`${n}:`})).find(e=>e.value.integration===n&&e.value.agent===t.agent)?.value}function Wg(e,t,n){let r={kind:`installation`,id:n};return{...e,connections:{...e.connections,[t]:r}}}async function Gg(e,t,n){let r=await e.store.get(`app`,t.app);return r&&Ug(e,r,n)}var Kg=r({serverAppLink:()=>Jg,serverAppUrl:()=>Yg,sharedApps:()=>qg});async function qg(e){return(await(e.serverOrganizationId&&e.serverOrganizationId!==e.organizationId?e.scope?.(e.serverOrganizationId).store??e.store:e.store).list(`app`)).map(({value:e})=>e).filter(t=>t.builtin&&e.integrations[t.integration]?.app.builtin===`shared`)}async function Jg(e,t={}){let n=Ht(t.env??Jn.env),r=ut(n.integrations);if(!r[e])throw new Ue(`invalid-option`,`Unknown integration "${e}".`,{hint:`Pick one of ${Object.keys(r).join(`, `)}.`});if(r[e].app.builtin!==`shared`)throw new Ue(`invalid-option`,`Create ${e} apps in your workspace from the agent's Platforms tab.`);if(!n.databaseUrl||!n.publicUrl)throw new Ue(`invalid-option`,`Built-in apps need the server database and address.`,{hint:`Set DATABASE_URL and PUBLIC_URL as the server has them.`});let i=await oo(n);try{let a=i.defaultOrganizationId;return{url:await Yg({config:n,integrations:r,organizationId:a,store:i.store(a)},e,t)}}finally{await i.close()}}async function Yg(e,t,n){if(e.integrations[t]?.app.builtin!==`shared`)throw new Ue(`invalid-option`,`Create ${t} apps in your workspace from the agent's Platforms tab.`);let r=et();if(!r)throw new Ue(`invalid-option`,`This server ships no default agent.`);let i={...rt()[r].json,...n.name?{name:n.name}:{}},a={agent:r,def:jt(i),...n.owner?{owner:n.owner}:{},public:!0},o=await kr(e,`create`,`*`,Vg(t,a)),s=new URLSearchParams({agent:a.agent,def:a.def,...a.owner?{owner:a.owner}:{},public:`1`,tx:o});return`${Lg(e)||e.config.publicUrl.replace(/\/$/,``)}/create/${t}?${s}`}export{Ch as $,oa as $n,Gd as $t,yg as A,Co as An,kr as Ar,qf as At,Yh as B,ro as Bn,Cf as Bt,kg as C,q as Cn,Ur as Cr,Xp as Ct,ag as D,Lo as Dn,Br as Dr,cp as Dt,Sg as E,Xo as En,zr as Er,wp as Et,_g as F,_o as Fn,mp as Ft,Fh as G,ja as Gn,Vd as Gt,Qh as H,to as Hn,wf as Ht,vg as I,ho as In,af as It,Ph as J,Ma as Jn,Qd as Jt,Lh as K,ka as Kn,tf as Kt,Eg as L,vo as Ln,bf as Lt,lg as M,bo as Mn,ip as Mt,Cg as N,mo as Nn,ap as Nt,fg as O,zo as On,Rr as Or,lp as Ot,pg as P,yo as Pn,Qf as Pt,wh as Q,ia as Qn,nf as Qt,Wh as R,oo as Rn,xf as Rt,dg as S,Wc as Sn,vi as Sr,tm as St,Tg as T,Yo as Tn,Hr as Tr,om as Tt,og as U,no as Un,uf as Ut,Dg as V,Ka as Vn,Sf as Vt,Ag as W,ya as Wn,_f as Wt,Ih as X,sa as Xn,Zd as Xt,zh as Y,La as Yn,Yd as Yt,Rh as Z,ca as Zn,rf as Zt,xg as _,ru as _n,hi as _r,nm as _t,Bg as a,Fd as an,ra as ar,Th as at,sg as b,ll as bn,Si as br,im as bt,$ as c,Dd as cn,Zi as cr,lh as ct,Hg as d,xd as dn,Ji as dr,ym as dt,Kd as en,la as er,Eh as et,Ig as f,Sd as fn,Ui as fr,Fm as ft,wg as g,au as gn,bi as gr,Im as gt,qh as h,vu as hn,Qr as hr,sm as ht,qg as i,Pd as in,ha as ir,Sh as it,bg as j,uo as jn,Tp as jt,$h as k,lo as kn,Ir as kr,Zf as kt,Rg as l,Td as ln,ea as lr,uh as lt,Pg as m,Zu as mn,U as mr,Pm as mt,Jg as n,qd as nn,va as nr,kh as nt,Vg as o,Ld as on,Xi as or,oh as ot,Mg as p,bd as pn,Ci as pr,Lm as pt,Bh as q,Ia as qn,Xd as qt,Yg as r,Bd as rn,da as rr,jh as rt,Lg as s,Id as sn,na as sr,nh as st,Kg as t,Jd as tn,_a as tr,xh as tt,zg as u,Cd as un,Ei as ur,Rm as ut,hg as v,Ml as vn,gi as vr,Pp as vt,Og as w,Go as wn,Wr as wr,am as wt,mg as x,Xc as xn,fi as xr,rm as xt,jg as y,cl as yn,yi as yr,Ep as yt,eg as z,co as zn,df as zt};