@wular/coder 0.4.7 → 0.4.9

package/dist/serve-CcqX_2qk.js

@@ -1,8 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{$ as t,G as n,H as r,K as i,Mt as a,Q as o,St as s,U as c,Vt as l,_t as u,ct as d,et as f,jt as p,kn as m,nn as h,ut as g}from"./dispatch-YW1aqjEg.js";import{i as _,n as v,r as y,u as b}from"./load-DDZfByUe.js";import{c as x,d as S,l as C,n as w}from"./integrations-B2CavXR1.js";import{c as ee}from"./models-DGPrMV51.js";import{o as T}from"./local-B0GiaLV0.js";import{a as E,d as D,f as O,l as k,n as te,o as ne,p as A,r as j,s as re,t as ie,u as ae}from"./http-DG54kyx4.js";import{$ as oe,$n as M,$t as se,A as ce,An as le,At as N,B as ue,Bt as de,C as fe,Cn as pe,Ct as me,D as he,Dn as ge,Dt as P,E as _e,En as ve,Et as ye,F as be,Fn as xe,Ft as Se,G as Ce,Gn as we,Gt as Te,H as Ee,Hn as De,Ht as Oe,I as ke,In as F,It as Ae,J as je,Jn as I,Jt as Me,K as Ne,Kn as Pe,Kt as Fe,L as Ie,Ln as Le,M as Re,Mn as ze,Mt as Be,N as Ve,Nn as He,Nt as Ue,O as L,On as We,Ot as Ge,P as Ke,Pn as qe,Pt as Je,Q as Ye,Qn as R,Qt as Xe,R as Ze,Rn as z,Rt as Qe,S as B,Sn as $e,St as et,T as tt,Tn as nt,Tt as rt,U as it,Un as at,Ut as ot,V as st,Vn as ct,Vt as lt,W as ut,Wn as dt,Wt as ft,X as pt,Xn as mt,Xt as ht,Yn as V,Yt as gt,Z as _t,Zn as vt,Zt as yt,_ as bt,_n as H,_t as xt,an as St,at as Ct,b as U,bn as W,bt as wt,c as Tt,cn as Et,ct as Dt,d as Ot,dn as kt,en as At,er as jt,et as Mt,f as Nt,g as Pt,gn as Ft,gt as It,hn as G,ht as Lt,i as Rt,in as zt,j as Bt,jn as Vt,jt as Ht,k as Ut,kn as Wt,kt as Gt,l as Kt,ln as qt,lt as Jt,m as Yt,mn as Xt,mt as Zt,nn as Qt,nt as $t,o as en,on as tn,ot as nn,p as rn,pt as an,q as on,qn as sn,qt as cn,r as ln,rn as un,sn as dn,t as fn,tn as pn,tt as mn,un as hn,ut as gn,v as _n,vn,vt as yn,w as bn,wn as xn,wt as Sn,x as K,xn as Cn,xt as wn,y as Tn,yn as En,yt as Dn,z as On,zt as kn}from"./store-Cxc2GYyj.js";import{n as An,r as jn}from"./env-LsVTi18f.js";import{r as Mn,t as Nn}from"./migrate-rwTojdkz.js";import{n as Pn,r as Fn}from"./usage-Bw7fQeFC.js";import q from"node:path";import J from"node:process";import*as Y from"zod/mini";import In from"node:fs";import{createHash as Ln,randomBytes as Rn,randomUUID as zn}from"node:crypto";import X from"node:fs/promises";import{isDeepStrictEqual as Bn}from"node:util";import Vn from"node:http";import{sql as Hn}from"drizzle-orm";async function Un(e){try{return await X.readdir(e,{withFileTypes:!0})}catch(e){if(e.code===`ENOENT`)return[];throw e}}async function Wn(e){try{return await X.lstat(e),!0}catch(e){if(e.code===`ENOENT`)return!1;throw e}}async function Gn(e,t){if(e===t||!await Wn(e))return 0;let n=await Un(e),r=n.filter(e=>e.isDirectory()).length;if(!await Wn(t))return await m(e,t),r;for(let r of n)await m(q.join(e,r.name),q.join(t,r.name));return await X.rmdir(e),r}async function Kn(e){let t=q.dirname(e),n=q.basename(e);for(let e of await Un(t)){let r=e.name.startsWith(n)?e.name.slice(n.length):``;if(!e.isFile()||!(r===`.tmp`||/^\.\d+(?:\.[a-f0-9-]{36})?\.tmp$/.test(r)))continue;let i=Number(e.name.slice(n.length+1).split(`.`)[0]);if(Number.isInteger(i)&&i>0)try{process.kill(i,0);continue}catch(e){if(e.code!==`ESRCH`)continue}await X.unlink(q.join(t,e.name)).catch(e=>{if(e.code!==`ENOENT`)throw e})}}async function qn(e,t){if(await Kn(e),e===t||!await Wn(e))return 0;if(!await Wn(t))return await m(e,t),1;let n=JSON.parse(await X.readFile(e,`utf8`)),r=JSON.parse(await X.readFile(t,`utf8`)),i={...n,...r,...n.rows||r.rows?{rows:{...n.rows,...r.rows}}:{}},a=`${t}.${process.pid}.${zn()}.tmp`;try{await X.writeFile(a,`${JSON.stringify(i)}\n`,{mode:384,flag:`wx`}),await X.rename(a,t),await X.unlink(e)}finally{await X.rm(a,{force:!0})}return 1}async function Jn(){let e=p(),t=a(`state`),n=p(`archive`),r=p(`flows-archived`),i=p(`usage.json`),o=p(`runner`,`usage.json`),s={from:a(`checkouts`),to:p(`checkouts`)},c={from:a(`update-check.json`),to:p(`update-check.json`)},l={cache:e,tasks:0,flows:0,files:0},u=(await Un(t)).filter(e=>e.isDirectory()).map(e=>({archive:a(`state`,e.name,`archive`),flows:a(`state`,e.name,`flows-archived`),usage:a(`state`,e.name,`usage.json`),runnerUsage:a(`state`,e.name,`runner`,`usage.json`)}));await Kn(i),await Kn(o);for(let e of u)l.tasks+=await Gn(e.archive,n),l.flows+=await Gn(e.flows,r),l.files+=await qn(e.usage,i),l.files+=await qn(e.runnerUsage,o);return await Gn(s.from,s.to),l.files+=await qn(c.from,c.to),l}async function Yn(e){let t=(e.now??Date.now)(),n=await e.store.list(`runner`);return{online:1+n.filter(({value:e})=>e.lastSeen!==void 0&&t-e.lastSeen<3e5).length,total:1+n.length}}async function Xn(e){let t=(e.now??Date.now)(),n=e.healthyAt!==void 0&&t-e.healthyAt<5e3,r=n||await Zn(e);return e.healthyAt=r?n?e.healthyAt:t:void 0,E({ok:r},r?200:503,{"cache-control":`no-store`})}async function Zn(e){return e.config.store===`postgres`?e.databaseHealth?e.databaseHealth().then(()=>!0,()=>!1):!1:!0}async function Qn(e){let t=(e.now??Date.now)();if(e.queue.metrics&&!e.local)return{...await e.queue.metrics(e.organizationId,t-864e5),runnersOnline:(await Yn(e)).online,requests:e.limits?.requests??0,rateLimitRejections:e.limits?.rejections??0};let n=await e.queue.list(e.organizationId),r=e.local?[...Yt(e.local.cwd,!1),...Yt(e.local.cwd,!0)]:[],i=new Map([...r,...n.map(e=>e.status===`queued`?e:r.find(t=>t.task.id===e.task.id)??e)].map(e=>[e.task.id,e])),a={queued:0,running:0,waiting:0,completed:0,failed:0,cancelled:0},o=0;for(let e of i.values())e.createdAt>=t-864e5&&a[e.status]++,e.status===`queued`&&o++;return{tasks:a,queueDepth:o,runnersOnline:(await Yn(e)).online,requests:e.limits?.requests??0,rateLimitRejections:e.limits?.rejections??0}}async function $n(e,t,n,r){if(!t.auth)return E({mode:Qe(t),organization:{id:t.organizationId},server:er(t)});let i=t.session;return E({mode:Qe(t),user:i.user,organization:i.organizations.find(e=>e.id===i.organizationId)??null,organizations:i.organizations,manageMembersUrl:`${t.auth.issuer}/auth/onboarding`,server:er(t)})}function er(e){return{name:e.config.name??`Coder`,store:e.config.store,...e.config.publicUrl?{url:e.config.publicUrl}:{},subscriptions:{claude:!!e.config.subscriptions?.claude,codex:!!e.config.subscriptions?.codex}}}async function tr(e,t,n,r){let i=e.headers.get(`content-type`)??``,a=i.includes(`application/json`)?await e.json().catch(()=>void 0):await e.formData().then(e=>Object.fromEntries(e.entries()),()=>void 0);if(!a||typeof a!=`object`)return E({error:`Send the workspace as a form or JSON body.`},400);let o=typeof a.organization==`string`?a.organization:``,s=o?await t.auth.setOrganization(e.headers,o):void 0;if(!s)return E({error:`You are not a member of that workspace.`},403);let{cookies:c,...l}=s,u=i.includes(`application/json`)?E({organization:l}):A(`/dash`,303);for(let e of c)u.headers.append(`set-cookie`,e);return u}async function nr(e,t,n,r){let i=t.session.user.id;n.id;let a=(await e.json().catch(()=>({}))).engine??``;if(!sr.has(a)||!t.config.subscriptions?.[a])return E({error:`Sign in with ${a||`that engine`} is off on this server.`},403);let o=t.runners[t.config.runner];if(!o||o.kind===`github-actions`)return E({error:`Sign-in cannot run on the ${t.config.runner} runner.`},409);let s=`login-${Rn(12).toString(`base64url`)}`,c=De(s,t.organizationId,0),l={owner:i,engine:a,state:`starting`,tokenHash:c.hash,runner:o.kind,createdAt:cr(t),expiresAt:cr(t)+or};await lr(t,s,l);let u;try{let e=await o.start({id:s},{CODER_SERVER:t.config.publicUrl??``,CODER_TASK_TOKEN:c.token,CODER_LOGIN:a}),n=await t.store.patchLogin(s,{handle:e},{tokenHash:l.tokenHash});if(!n)return await o.stop(e).catch(()=>{}),E({error:`This sign-in is gone. Start again.`},409);u=n}catch(e){return await t.store.delete(`login`,s),E({error:e instanceof Error?e.message:String(e)},502)}return E(ur(s,u),201)}async function rr(e,t,n,r){t.session.user.id;let i=n.id??``,a=i&&!i.includes(`/`)?await dr(t,i):void 0;return a?E(ur(i,a)):E({error:`This sign-in is gone. Start again.`},404)}async function ir(e,t,n,r){t.session.user.id;let i=n.id??``,a=i&&!i.includes(`/`)?await dr(t,i):void 0;if(!a)return E({error:`This sign-in is gone. Start again.`},404);let o=await e.json().catch(()=>({})),s=typeof o.code==`string`?o.code.trim():``;return a.engine!==`claude`||a.state!==`open`||!s||!await t.store.patchLogin(i,{state:`verifying`,input:z(t.config,s)},{state:`open`,tokenHash:a.tokenHash})?E({error:`This sign-in is not waiting for a code.`},409):E({ok:!0})}async function ar(e,t,n,r){t.session.user.id;let i=n.id??``,a=i&&!i.includes(`/`)?await dr(t,i):void 0;return a?(await t.store.delete(`login`,i),a.handle&&await t.runners[a.runner]?.stop(a.handle).catch(()=>{}),E({ok:!0})):E({error:`This sign-in is gone. Start again.`},404)}const or=6e5,sr=new Set([`claude`,`codex`]),cr=e=>(e.now??Date.now)();function lr(e,t,n){return e.store.put(`login`,t,n,{ttlMs:Math.max(1,n.expiresAt-cr(e))})}function ur(e,t){return{id:e,engine:t.engine,state:t.state,expiresAt:t.expiresAt,...t.url?{url:t.url}:{},...t.code?{code:t.code}:{},...t.error?{error:t.error}:{},...t.label?{label:t.label}:{}}}async function dr(e,t){let n=await e.store.get(`login`,t);return n&&n.owner===e.session?.user.id?n:void 0}async function fr(e,t,n,r){let i=n.id,a=t.callbackLogin,o=Date.now()+25e3;for(;!a.input&&Date.now()<o&&!e.signal.aborted;){await new Promise(e=>setTimeout(e,250));let e=await t.store.get(`login`,i);if(!e)return new Response(`Unauthorized`,{status:401});a=e}if(!a.input)return E({});let s=await t.store.patchLogin(i,{input:null},{input:a.input,tokenHash:a.tokenHash});return E(s?{code:F(t.config,a.input)}:{})}async function pr(e,t,n,r){n.id;let i=t.callbackLogin;return E({engine:i.engine})}async function mr(e,t,n,r){let i=n.id,a=t.callbackLogin,o=await e.json().catch(()=>({}));if(a.state===`done`||a.state===`failed`)return E({ok:!0});let s={state:[`starting`,`open`,`verifying`],tokenHash:a.tokenHash};if(typeof o.error==`string`)return await t.store.patchLogin(i,{state:`failed`,error:o.error.slice(0,500)},s),E({ok:!0});let c=o.result?.env;if(c){let e=a.engine===`claude`?`CLAUDE_CODE_OAUTH_TOKEN`:`CODEX_AUTH_JSON`;if(Object.keys(c).join()!==e||typeof c[e]!=`string`)return E({error:`Invalid sign-in result`},400);let n=`${a.engine}-subscription`,r=o.result?.account;return await t.store.completeLogin(i,a.tokenHash,n,{...Le(t.config,{env:c}),engine:a.engine,createdAt:(t.now??Date.now)(),...r?.email||r?.plan?{account:{...typeof r.email==`string`?{email:r.email}:{},...typeof r.plan==`string`?{plan:r.plan}:{}}}:{}})?E({ok:!0}):E({error:`This sign-in changed. Try again.`},409)}let l={...typeof o.url==`string`&&/^https:\/\//.test(o.url)?{url:o.url}:{},...typeof o.code==`string`?{code:o.code.slice(0,64)}:{}};return(a.state===`starting`?await t.store.patchLogin(i,{...l,state:`open`},{state:`starting`,tokenHash:a.tokenHash})??await t.store.patchLogin(i,l,{...s,state:[`open`,`verifying`]}):await t.store.patchLogin(i,l,s))?E({ok:!0}):E({error:`This sign-in changed. Try again.`},409)}async function hr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return I(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return I(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);t.fetch,t.now?.();let l=V(r.searchParams);if(!l)return I(`Setup link is missing or malformed; start again from the agent's Platforms tab`,400);if(!l.definition.integrations[i])return I(`This agent declares no ${i} integration in its agent.json`,400);if(l.state.public&&!a)return I(`Only the server operator creates public apps`,403);let u=we(i,l.state),d=l.state.tx?await R(t,l.state.tx,`create`,o)===u?l.state.tx:void 0:await M(t,`create`,o,u);if(!d)return I(`This app creation link is invalid, expired, or already used`,403);let f={...l.state,tx:d};return s.app.createPage({publicUrl:c,state:f,definition:l.definition,encodedState:T(f)})}async function gr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return I(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return I(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);let l=t.fetch??fetch,u=t.now?.()??Date.now(),d=j(r.searchParams.get(`state`)),f=V(r.searchParams)??(d&&V(new URLSearchParams(Object.entries(d).filter(([,e])=>e!==void 0))))??void 0;if(!f)return I(`Setup state was lost between the platform and this server; start again`,400);if(!f.state.tx||!await vt(t,f.state.tx,`create`,o,we(i,f.state)))return I(`This app creation link is invalid, expired, or already used`,403);let p=await s.app.createCallback(e,{publicUrl:c,...f,fetch:l}).catch(e=>I(`Creating the ${i} app failed: ${e instanceof Error?e.message:e}`,400));if(p instanceof Response)return p;let m={id:`${i}:${p.platformAppId}`,integration:i,agent:f.state.agent,name:p.name,...f.state.repo?{agentsRepo:f.state.repo}:{},...f.state.repo?{branch:f.state.branch??`main`}:{},...a?{builtin:!0}:{},credentials:z(t.config,p.credentials),createdAt:u};if(await t.store.put(`app`,m.id,m),a)return I(`Created ${p.name}. Every workspace on this server can now connect it from its dashboard.`);let h=await M(t,`install`,o,m.id),g=`/dash/agents/${encodeURIComponent(m.agent)}/platforms`;return A(`${c}/install/${i}?app=${encodeURIComponent(m.id)}&state=${T({tx:h,back:g})}`)}async function _r(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return I(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return I(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);let l=t.fetch??fetch,u=t.now?.()??Date.now(),d=new URLSearchParams(await e.clone().text()),f=j(r.searchParams.get(`state`)),p=V(r.searchParams)??(f&&V(new URLSearchParams(Object.entries(f).filter(([,e])=>e!==void 0))))??(d&&V(d));if(!p)return I(`Setup state was lost between the platform and this server; start again`,400);if(!p.state.tx||!await vt(t,p.state.tx,`create`,o,we(i,p.state)))return I(`This app creation link is invalid, expired, or already used`,403);let m=await s.app.createCallback(e,{publicUrl:c,...p,fetch:l}).catch(e=>I(`Creating the ${i} app failed: ${e instanceof Error?e.message:e}`,400));if(m instanceof Response)return m;let h={id:`${i}:${m.platformAppId}`,integration:i,agent:p.state.agent,name:m.name,...p.state.repo?{agentsRepo:p.state.repo}:{},...p.state.repo?{branch:p.state.branch??`main`}:{},...a?{builtin:!0}:{},credentials:z(t.config,m.credentials),createdAt:u};if(await t.store.put(`app`,h.id,h),a)return I(`Created ${m.name}. Every workspace on this server can now connect it from its dashboard.`);let g=await M(t,`install`,o,h.id),_=`/dash/agents/${encodeURIComponent(h.agent)}/platforms`;return A(`${c}/install/${i}?app=${encodeURIComponent(h.id)}&state=${T({tx:g,back:_})}`)}async function vr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return I(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return I(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);t.fetch,t.now?.();let l=j(r.searchParams.get(`state`)),u=r.searchParams.get(`app`),d=l?.tx?await R(t,l.tx,`install`,o):void 0;if(!d||u&&u!==d)return I(`This installation link is invalid, expired, or already used`,403);let f=await t.store.get(`app`,u??d);if(!f)return I(`This app is not known to this server; create it first`,400);let p=F(t.config,f.credentials);return A(s.app.installUrl(f,p,{publicUrl:c,state:r.searchParams.get(`state`)??T({})}))}async function yr(e,t,n,r){let i=n.id,a=t.operatorApp??!1;if(!/^[a-z0-9_-]+$/.test(r.pathname.split(`/`)[2]))return;let o=a?`*`:t.session?.user.id??`anonymous`,s=t.integrations[i];if(!s)return I(`Unknown integration "${i}"; run coder agent integrations list to see them`,404);let c=t.config.publicUrl;if(!c)return I(`PUBLIC_URL is not set on this server; set it to the address platforms should call and restart`,400);let l=t.fetch??fetch,u=t.now?.()??Date.now(),d=j(r.searchParams.get(`state`)),f=r.searchParams.get(`app`),p=d?.tx?await R(t,d.tx,`install`,o):void 0;if(!p||f&&f!==p||!await vt(t,d.tx,`install`,o,p))return I(`This installation link is invalid, expired, or already used`,403);let m=await t.store.get(`app`,f??p),h=d?.link?await t.store.get(`installation`,d.link):void 0,g=m??(h&&await sn(t,h,i));if(!g)return d&&!d.link?I(`Connected.`):I(`This install does not match any app on this server; create the app first`,400);let _=F(t.config,g.credentials),v=await s.app.installCallback(e,{app:g,credentials:_,publicUrl:c,fetch:l,connect:dt(t,g,c)}).catch(e=>I(e instanceof Error?e.message:String(e),400));if(v instanceof Response)return v;let y=`${g.id}:${v.platformInstallId}`,b=t.session;v.user&&b&&t.auth&&await t.auth.link(b.user,i,v.user.id,{organizations:b.organizations.map(e=>e.id),...v.user.token?{token:z(t.config,v.user.token)}:{}});let x=await t.store.get(`installation`,y),S={...x,id:y,app:g.id,integration:i,account:v.account??x?.account??h?.account??{login:`unknown`},...v.token?{token:z(t.config,v.token)}:{},...v.installer?{installer:v.installer}:{},createdAt:x?.createdAt??u};delete S.deletedAt;let C=h&&!h.deletedAt?h:void 0;C&&(S=Pe(S,C.integration,C.id));try{await t.store.put(`installation`,y,S)}catch{return I(`This ${i} installation is already connected to another workspace; disconnect it there first`,409)}if(C&&await t.store.put(`installation`,C.id,Pe(C,i,y)),s.renew){let e=await(await import(`./store-Cxc2GYyj.js`).then(e=>e.Y)).renewInstallation({...t,fetch:l},g,v.platformInstallId).then(()=>void 0,e=>e instanceof Error?e.message:String(e));if(e)return I(`Connected, but ${i} did not start sending events yet. ${e}. Coder tries again within the hour.`,502)}let w=at(d?.back);return w?A(`${c.replace(/\/$/,``)}${w}`):v.response}const Z=(e,t=200)=>C(`<title>Coder</title><p>${x(e)}</p>`,t);function br(e,t,n){return n&&t.organizations.some(e=>e.id===n)?{...ct(e,n),session:t}:void 0}async function xr(e,t){let n=await e.store.get(`installation`,t);return n&&!n.deletedAt?e.store.get(`app`,n.app):void 0}async function Sr(e,t,n,r){let i=t.linkContext,a=i.session,o=e=>{let t=jt(i,e);return t&&a.organizations.some(e=>e.id===t)?{...ct(i,t),session:a}:i},s=r.searchParams.get(`token`)??``,c=o(s);if(await R(c,s,`link`,a.user.id))return await hn(e,void 0,t.dashboardHosts)??new Response(`UI is not built`,{status:503});let l=await mt(c,s,`link-start`,a.user.id);if(!l)return new Response(`This link is invalid or has expired.`,{status:400});let u=await M(c,`link`,a.user.id,l,3e5);return A(`/connect?token=${encodeURIComponent(u)}`)}async function Cr(e,t,n,r){let i=t.linkContext,a=i.session,o=e=>{let t=jt(i,e);return t&&a.organizations.some(e=>e.id===t)?{...ct(i,t),session:a}:i},s=await e.json().catch(()=>({})),c=typeof s.token==`string`?await mt(o(s.token),s.token,`link`,a.user.id):void 0;if(!c)return E({error:`This link is invalid or has expired.`},400);let l=JSON.parse(c);return await t.auth.link(a.user,l.platform,l.platformUserId,{organizations:a.organizations.map(e=>e.id)})===`taken`?E({error:`That platform account is connected to someone else.`},409):E({ok:!0,...l})}async function wr(e,t,n,r){let i=t.integrations[n.integration].auth.user,a=t.config.publicUrl,o=t.linkContext.session,s=r.searchParams.get(`installation`)??``,c=br(t,o,s?await t.installationOrganization?.(s):void 0);if(!c)return Z(`Only members of the workspace this agent works for can link here.`,403);let l=await xr(c,s);if(!l)return Z(`This installation is no longer connected.`,404);let u=await M(c,`link-oauth`,o.user.id,s);return A(i.authorizeUrl(F(t.config,l.credentials),{publicUrl:a,state:u}))}async function Tr(e,t,n,r){let i=t.integrations[n.integration],a=i.auth.user,o=t.config.publicUrl,s=t.linkContext.session,c=r.searchParams.get(`state`)??``,l=br(t,s,jt(t,c)),u=l&&await mt(l,c,`link-oauth`,s.user.id),d=l&&u?await xr(l,u):void 0;if(!l||!d)return Z(`This link is invalid or has expired.`,400);let f=await a.exchange(e,F(t.config,d.credentials),{publicUrl:o,fetch:t.fetch??fetch}).catch(e=>e instanceof Error?e:Error(String(e)));return f instanceof Error?Z(f.message,400):await t.auth.link(s.user,i.id,f.id,{organizations:s.organizations.map(e=>e.id),...f.token?{token:z(t.config,f.token)}:{}})===`taken`?Z(`That ${i.id} account is connected to someone else.`,409):Z(`Linked ${f.login??f.id} on ${i.id} to your Coder account. Mention the agent again to start.`)}const Er=Y.object({installation:Y.string().check(Y.minLength(1)),integration:Y.string().check(Y.minLength(1)),token:Y.string().check(Y.minLength(1)),account:Y.optional(Y.string())});async function Dr(e,t){let n;try{n=await e.json()}catch{return new Response(`Invalid JSON`,{status:400})}let r=Er.safeParse(n);if(!r.success)return new Response(`Invalid connection`,{status:400});let{installation:i,integration:a,token:o,account:s}=r.data,c=await t.store.get(`installation`,i);if(!c||c.deletedAt)return new Response(`Unknown installation`,{status:404});let l={kind:`oauth`,token:z(t.config,o),...s?{account:s}:{}};return await Rt(t.store,`installation`,i,{connections:{...c.connections,[a]:l}}),E({ok:!0})}async function Or(e,t,n,r){let i=await t.store.get(`app`,n);if(!i)return E({error:`Unknown app`},404);let a=t.config.publicUrl;if(!a)return E({error:`PUBLIC_URL is not set on this server`},400);let o=await M(t,`install`,t.session?.user.id??`anonymous`,i.id),s=T({tx:o,...r?{back:r}:{}});return E({url:`${a.replace(/\/$/,``)}/install/${i.integration}?app=${encodeURIComponent(i.id)}&state=${s}`})}async function kr(e,t,n,r){let i=r.searchParams.get(`agent`),a=t.serverOrganizationId,[o,s]=await Promise.all([t.store.list(`app`),a!==void 0&&a!==t.organizationId&&t.scope?t.scope(a).store.list(`app`).then(e=>e.map(({id:e,value:t})=>({id:e,value:{...t,builtin:!0}}))):[]]),c=[...o,...s];return E(c.filter(({value:e})=>!i||e.agent===i).map(({id:e,value:t})=>{let{credentials:n,...r}=t;return{id:e,value:r}}))}async function Ar(e,t,n,r){let i=r.searchParams.get(`agent`),[a,o]=await Promise.all([t.store.list(`installation`),i?t.store.list(`app`):[]]),s=new Set(o.filter(({value:e})=>e.agent===i).map(({id:e})=>e));return E(a.filter(({value:e})=>!i||s.has(e.app)).map(({id:e,value:t})=>{let{token:n,connections:r,...i}=t;return{id:e,value:i}}))}function jr(e){return E(Object.values(e.integrations).map(e=>({id:e.id,name:e.name,brand:e.brand,description:e.description,installLabel:e.installLabel??`Connect ${e.id}`,organizationApps:e.organizationApps===!0,events:Object.fromEntries(Object.entries(e.events).map(([e,{description:t,noisy:n,addressed:r}])=>[e,{description:t,...n?{noisy:n}:{},...r?{addressed:r}:{}}])),presets:e.tools.presets,repositories:!!e.repos})))}async function Mr(e){let t=new Map;for(let{value:n}of await e.store.list(`installation`)){let r=e.integrations[n.integration];if(n.deletedAt||!r?.repos)continue;let i=await e.store.get(`app`,n.app);if(i)try{let a=await r.auth.token(n.token?{...n,token:F(e.config,n.token)}:n,F(e.config,i.credentials));for(let e of await r.repos.list(n,a))t.has(e)||t.set(e,{repo:e,integration:r.id})}catch{}}return E([...t.values()].sort((e,t)=>e.repo.localeCompare(t.repo)))}async function Nr(e,t){let n=(await e.store.list(`installation`)).filter(({value:t})=>!t.deletedAt&&e.integrations[t.integration]?.repos),r=new Map((await ln(e.store,n.map(({value:e})=>e.app))).map(({id:e,value:t})=>[e,t]));for(let{value:i}of n){let n=e.integrations[i.integration];if(i.deletedAt||!n?.repos)continue;let a=r.get(i.app);if(!(!a||a.integration!==n.id))try{let r=i.token?{...i,token:F(e.config,i.token)}:i,o=await n.auth.token(r,F(e.config,a.credentials));if((await n.repos.list(r,o)).includes(t))return{contents:n,token:o,app:a,installation:i}}catch{}}}async function Pr(e,t,n){let r=await Nr(e,t);if(!r)return E({error:`No installed app can read ${t}`},400);let i=await r.contents.repos.listDir(t,Ce,r.token,n).catch(()=>[]),a=await Promise.all(i.map(async i=>{let a=await r.contents.repos.readFile(t,`${Ce}/${i}/agent.json`,r.token,n).catch(()=>void 0);if(a===void 0)return;let o={};try{o=JSON.parse(a)}catch{}let s=await W(e.store,i),c=s?.source===`repo`&&s.repo===t,l=c?await Cn(e.store,i):void 0;return{id:i,name:typeof o.name==`string`?o.name:i,...typeof o.description==`string`?{description:o.description}:{},...c?{version:s.currentVersion,...l?.source?{commit:l.source.commit}:{}}:{},...s&&!c?{taken:!0}:{}}}));return E({repo:t,agents:a.filter(Boolean)})}async function Fr(e,t,n,r){let i=r.searchParams.get(`repo`);return i?Pr(t,i,r.searchParams.get(`ref`)||`HEAD`):E({error:`repo is required`},400)}async function Ir(e,t,n,r){let i=await e.json().catch(()=>void 0),a=i?.agents;if(typeof i?.repo!=`string`||i.ref!==void 0&&typeof i.ref!=`string`||a!==void 0&&!(Array.isArray(a)&&a.every(e=>typeof e==`string`)))return E({error:`repo is required, ref must be a string and agents a list of ids`},400);try{let e=await Nr(t,i.repo);if(!e)return E({error:`No installed app can read ${i.repo}`},400);let n=i.ref??`HEAD`,r=a??await e.contents.repos.listDir(i.repo,`.coder/agents`,e.token,n);for(let e of r){let n=await W(t.store,e);if(n&&(n.source!==`repo`||n.repo!==i.repo))return E({error:`Agent id "${e}" is already taken`},409)}let o=await Ne(t.store,e.contents,i.repo,n,e.token,(t.now??Date.now)(),{slugs:r});return await je(t,o),E({imported:o.map(e=>e.agent)})}catch(e){return E({error:e instanceof Error?e.message:String(e)},400)}}async function Lr(e,t,n,r){if(t.source!==`repo`||!t.repo)return;let i=(await(r??e.store.list(`app`))).find(({value:e})=>e.agent===t.id&&e.agentsRepo===t.repo)?.value;return((i&&e.integrations[i.integration])??Object.values(e.integrations).find(e=>e.repos))?.repos?.url(t.repo,t.path,i?.branch??n?.commit)}async function Rr(e,t,n){let r=await vn(e.store,t);return await pe(e.store,n,t,r)?vn(e.store,t):r}async function Q(e,t){let n=(e.now??Date.now)(),r=e.local?await mn(e.store,e.local.cwd,e.integrations,t).catch(()=>void 0):void 0;return{now:n,local:r,loadCurrent:()=>r?Promise.resolve(r.find(({record:e})=>e.id===t)??{}):Rr(e,t,n)}}async function zr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:a,local:o,loadCurrent:s}=await Q(t,i);if(!o&&t.store.listAgentSummaries&&(await xn(t.store,a),O(r)))return E(await Wr(t,r));let c=o??(t.store.listAgentSummaries?await t.store.listAgentSummaries():await En(t.store));if(!o&&!t.store.listAgentSummaries&&await xn(t.store,a,c)&&(c=await En(t.store)),O(r))return E(await Wr(t,r,c));let l;return E(await Promise.all(c.map(async({record:e,version:n})=>{e.source===`repo`&&e.repo&&(l??=t.store.list(`app`));let r=await Lr(t,e,n,l);return{...e,definition:n?.definition,...r?{sourceUrl:r}:{}}})))}async function Br(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:a,local:o,loadCurrent:s}=await Q(t,i),c=D(r,10,50),l=te(r),[u,d]=await Promise.all([o?s().then(e=>e.record):W(t.store,i),o?Promise.resolve(o.flatMap(({version:e})=>e?[{value:e}]:[])):t.store.listVersions?.(i,c+1,l)]);return u?E(await Gr(t,u,c,l??u.currentVersion+1,d)):E({error:`No agent named "${i}"`},404)}async function Vr(e,t,n,r){let i=n.slug,a=n.version?Number(n.version):void 0;if(n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:o,local:s,loadCurrent:c}=await Q(t,i),l=s?s.find(({version:e})=>e?.version===a)?.version:await Cn(t.store,i,a);return l?E(l):E({error:`No version ${a} for agent "${i}"`},404)}async function Hr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:a,local:o,loadCurrent:s}=await Q(t,i),c=r.searchParams.get(`versions`)!==`0`,l=r.searchParams.get(`content`)!==`0`,[{record:u,version:d},f]=await Promise.all([!l&&!o&&t.store.listAgentSummaries&&!_()[i]?t.store.listAgentSummaries({slug:i}).then(e=>e[0]??{}):s(),c?o?o.flatMap(({version:e})=>e?[{value:e}]:[]):t.store.listVersions?t.store.listVersions(i):t.store.list(`agentversion`,{prefix:`${i}:`}):[]]);if(!u)return E({error:`No agent named "${i}"`},404);let p=f.map(({value:e})=>{let{systemPrompt:t,files:n,...r}=e;return r}),m=await Lr(t,u,d);return E({...u,...d?{definition:d.definition,...l&&`systemPrompt`in d?{systemPrompt:d.systemPrompt,...d.files?{files:d.files}:{}}:{}}:{},...m?{sourceUrl:m}:{},...c?{versions:p}:{}})}const Ur={builtin:`builtin`,dashboard:`upload`,repository:`repo`};async function Wr(e,t,n){let r=D(t,24,100),i=te(t),a=t.searchParams.get(`q`)?.trim().toLowerCase(),o=Ur[t.searchParams.get(`type`)??``],s=t.searchParams.get(`platform`),c=t.searchParams.get(`connect`)===`1`,l=e.serverOrganizationId,u=e.store.list(`app`),[d,f,p,m]=await Promise.all([u,e.store.list(`installation`),c&&l!==void 0&&l!==e.organizationId&&e.scope?e.scope(l).store.list(`app`):[],n?n.filter(({record:e})=>(!i||e.id>i)&&(!o||e.source===o)&&(!a||[e.id,e.name,e.description,e.repo].some(e=>e?.toLowerCase().includes(a)))):e.store.listAgentSummaries({after:i,source:o,q:a,platform:s??void 0,limit:r+1})]),h=new Set(f.filter(({value:e})=>!e.deletedAt).map(({value:e})=>e.app)),g=(e,t)=>{let n=d.filter(({value:n})=>n.agent===e&&n.integration===t);return n.length?n.some(({value:e})=>h.has(e.id))?`installed`:`created`:`none`},_=[];for(let{record:e,version:t}of m){let n=Object.keys(t?.definition?.integrations??{}).sort();if(!(s&&!n.includes(s))&&(_.push({record:e,version:t,ids:n}),_.length>r))break}let v=ae(_,r,e=>e.record.id);return{...v,...c?{connectable:[...d,...p.map(e=>({...e,value:{...e.value,builtin:!0}}))].filter(({value:e})=>e.builtin&&!h.has(e.id)).map(({value:e})=>({id:e.id,integration:e.integration}))}:{},items:await Promise.all(v.items.map(async({record:t,version:n,ids:r})=>{let i=await Lr(e,t,n,u);return{...t,definition:n?.definition,...i?{sourceUrl:i}:{},platforms:r.map(e=>({id:e,state:g(t.id,e)}))}}))}}async function Gr(e,t,n,r,i){let a=r-n-2,o=(i??await e.store.list(`agentversion`,{prefix:`${t.id}:`,...a>0?{after:ge(t.id,a)}:{},limit:n+1})).map(({value:e})=>{let{systemPrompt:t,files:n,definition:r,...i}=e;return i}).filter(e=>e.version<r).reverse();return ae(o,n,e=>e.version)}function Kr(e){if(!e||Array.isArray(e)||typeof e!=`object`)return!1;let t=Object.entries(e);if(t.length>100)return!1;let n=0;for(let[e,r]of t){if(typeof r!=`string`||e.startsWith(`/`)||e.includes(`\\`)||e.includes(`\0`)||e.split(`/`).includes(`..`)||e===`agent.json`||e===`system.md`)return!1;n+=Buffer.byteLength(e)+Buffer.byteLength(r)}return n<=262144}async function qr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:a,local:o,loadCurrent:s}=await Q(t,i),c=await e.json().catch(()=>void 0);try{let e=b({[i]:c})[i];if(!e||typeof e!=`object`)throw Error(`settings must be an object`);let{record:n,version:r}=await s();if(!n||!r)throw Error(`No agent named "${i}".`);return ve({...n,settings:void 0},r,e,t.integrations),t.local?(await he(t,t=>{t.agents={...t.agents,[i]:e}}),await mn(t.store,t.local.cwd,t.integrations),E(await W(t.store,i))):E(await nt(t.store,i,e,(t.now??Date.now)()))}catch(e){return E({error:e instanceof Error?e.message:String(e)},400)}}async function Jr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:a,local:o,loadCurrent:s}=await Q(t,i),{record:c}=await s();if(!c)return E({error:`No agent named "${i}"`},404);if(c.source===`builtin`)return E({error:`Built-in agents cannot be deleted.`},400);if(t.local&&!await Mt(t.local.cwd,t.integrations,i))return E({error:`Delete .coder/agents/${i} in the repo`},409);for(let{id:e}of await t.store.list(`agentversion`,{prefix:`${i}:`}))await t.store.delete(`agentversion`,e);return await t.store.delete(`agent`,i),E({ok:!0})}async function Yr(e,t,n,r){let i=n.slug;if(n.version&&Number(n.version),n.version&&!/^\d+$/.test(r.pathname.split(`/`).at(-1)))return k();let{now:a,local:o,loadCurrent:s}=await Q(t,i),c=await e.json().catch(()=>void 0);if(!c||typeof c.systemPrompt!=`string`||c.files!==void 0&&!Kr(c.files)||c.name!==void 0&&typeof c.name!=`string`||c.description!==void 0&&typeof c.description!=`string`)return E({error:`definition and systemPrompt are required; files must contain strings`},400);try{y([i]);let[e]=v({definitions:{[i]:{json:c.definition,builtin:!1}},usage:void 0},t.integrations);if(!e)throw Error(`No agent named "${i}".`);let n=t.local?await W(t.store,i):void 0,r=t.local&&n?await Cn(t.store,i):void 0,a=c.files;t.local&&(await $t(t.local.cwd,t.integrations,i,{definition:{...c.definition,...c.name===void 0?{}:{name:c.name},...c.description===void 0?{}:{description:c.description}},systemPrompt:c.systemPrompt,...a?{files:a}:{}}),await mn(t.store,t.local.cwd,t.integrations));let o=t.local?void 0:await $e(t.store,{id:i,name:c.name??e.name,description:c.description??e.definition.description,source:`upload`,definition:e.definition,systemPrompt:c.systemPrompt,files:a,importedFrom:`upload`},(t.now??Date.now)()),s=o?.version??await Cn(t.store,i),l=o?.unchanged??Bn(r&&{...r,createdAt:0},{...s,createdAt:0});await je(t,[s]);let u=o?.record??await W(t.store,i);return E({...u,definition:s.definition,version:s.version,unchanged:l})}catch(e){return E({error:e instanceof Error?e.message:String(e)},400)}}async function Xr(e,t,n,r){let i=n.id,a=Number(r.searchParams.get(`after`)??-1),o=Number.isFinite(a)?a:-1;r.searchParams.has(`limit`)&&D(r,500,2e3);let s=await t.store.get(`task`,i);if(!s||t.local&&s.handle?.startsWith(`cli:`)&&s.task.flow==="default"){let n=s?.task.cwd??t.local?.cwd;if(!n||!rn(n,i,!1))return E({error:`No task "${i}"`},404);{let r=Number(e.headers.get(`last-event-id`)??o);return ii(e,t,`cli:${n}:${i}`,Number.isFinite(r)?r:o,async e=>{let t=rn(n,i);if(t)return{status:t,lines:Nt(n,i,e,500),pendingResult:Zr(n,t,!t.result)}})}}let c=Number(e.headers.get(`last-event-id`)??o),l=t.statementTimeout??((e,t)=>t());return ii(e,t,i,Number.isFinite(c)?c:o,e=>l(ni,async()=>{let n=await t.store.get(`task`,i);if(!n)return;let r=n.task.runner===`github-actions`&&n.handle,a=r&&L.has(n.status)?(await(await qe(t,n.task))?.status(n.handle).catch(()=>void 0))?.state===`running`:!1;return{status:n,lines:([`running`,`waiting`].includes(n.status)||r)&&n.handle?await gt(t,n,e,500).catch(()=>ht(t.store,i,e,500)):await ht(t.store,i,e,500),pendingLogs:a}}))}function Zr(e,t,n=!1){if(!L.has(t.status)||t.error||t.status===`cancelled`)return!1;let r=l(e,t.task.id),i=Math.max(t.finishedAt??0,Date.parse(r?.resumedAt??r?.createdAt??``)||0);return n||(In.statSync(q.join(h(e,t.task.id),`result.json`),{throwIfNoEntry:!1})?.mtimeMs??0)<i}const Qr=1e3,$=3e4;function $r(e,t,n,r){let i=[...new Set((r.searchParams.get(`tasks`)??``).split(`,`).filter(Boolean))].slice(0,100),a=Date.now(),o=t.taskWatcher??new ti,s=o.tag(t),[c,l]=(e.headers.get(`last-event-id`)??``).split(`-`),u=Number(c),d=u>0&&`-${l}`===s,f=d?Math.min(Math.max(u,a-29e4),a):a,p=u>0&&(!d||u<f)?`event: reset
-data: {}
-
-`:``,m=new TextEncoder,h=()=>{},g=new ReadableStream({start(n){n.enqueue(m.encode(`retry: ${Qr}\nid: ${f}${s}\n\n${p}`)),h=o.watch(t,i,f,e=>n.enqueue(m.encode(e)),()=>n.close());let r=()=>{h();try{n.close()}catch{}};e.signal.aborted?r():e.signal.addEventListener(`abort`,r)},cancel(){h()}});return new Response(g,{headers:{"content-type":`text/event-stream; charset=utf-8`,"cache-control":`no-cache, no-transform`}})}function ei(e,t){let{task:n,approval:r,archivedAt:i,createdAt:a,startedAt:o,finishedAt:s}=e;return{id:n.id,agent:n.agent,status:e.status,approval:r??null,archivedAt:e.autoArchived&&!t?void 0:i,createdAt:a,startedAt:o,finishedAt:s,...t?{result:e.result??null,error:e.error??null,answer:e.answer??null}:{}}}var ti=class{options;watches=new Set;timer;reading=!1;closed=!1;last=Date.now();scans=new Map;left=new Map;archived=new Map;reads=0;generation=zn().slice(0,8);constructor(e={}){this.options=e}watch(e,t,n,r,i){if(this.closed)return queueMicrotask(i),()=>{};let a=Date.now();this.watches.size||(this.last=a);let o={ctx:e,ids:new Set(t),sent:new Map,gone:new Set,from:n,fresh:!0,tag:this.tag(e),beat:a,marked:a,until:a+(this.options.lifeMs??29e4),send:r,close:i};return this.watches.add(o),this.timer||(this.timer=setInterval(()=>this.tick(),this.options.pollMs??1e3),this.timer.unref?.()),this.tick(),()=>this.drop(o)}tag(e){return`-${Ln(`sha256`).update(e.organizationId).digest(`hex`).slice(0,8)}${e.queue instanceof en?`.${this.generation}`:``}`}close(){this.closed=!0;for(let e of[...this.watches]){this.drop(e);try{e.close()}catch{}}}drop(e){this.watches.delete(e)&&(this.watches.size||(clearInterval(this.timer),this.timer=void 0))}tick(){let e=Date.now();for(let t of[...this.watches])if(e>=t.until){this.drop(t);try{t.close()}catch{}}else e-t.beat>=(this.options.heartbeatMs??2e4)&&(t.beat=e,this.send(t,`: ping
-
-`));this.reading||!this.watches.size||(this.reading=!0,this.read(e).finally(()=>this.reading=!1))}send(e,t){try{e.send(t)}catch{this.drop(e)}}async read(e){let t=[...this.watches],n=new Map;for(let e of t){let t=n.get(e.ctx.organizationId)??{ctx:e.ctx,ids:new Set};for(let n of e.ids)t.ids.add(n);n.set(e.ctx.organizationId,t)}let r=Math.min(this.last,...t.flatMap(e=>e.fresh?[e.from]:[]));this.reads++;let i=await this.changes(n,r-$,e).catch(()=>void 0);if(i){this.last=e;for(let n of t){if(!this.watches.has(n))continue;let t=[];try{t=this.news(n,i,e)}catch{}!t.length&&e-n.marked>=(this.options.heartbeatMs??2e4)&&t.push(`id: ${e}${n.tag}\n\n`),t.length&&(n.marked=e,this.send(n,t.join(``)))}}}async changes(e,t,n){let r=await[...e.values()][0].ctx.queue.changes([...e].map(([e,t])=>({organizationId:e,ids:[...t.ids]})),t),i=new Map;for(let{organizationId:e,status:t}of r.rows){let n=i.get(e)??new Map;i.set(e,n.set(t.task.id,t))}let a=new Map;for(let{organizationId:e,id:t,at:n}of r.deleted){let r=a.get(e)??new Map;a.set(e,r.set(t,n))}for(let[t,{ctx:r}]of e){if(!r.local)continue;let e=[...i.get(t)?.values()??[]],a=this.scans.get(r.local.cwd);if(!a||n-a.at>=4e3||e.some(e=>e.updatedAt>a.at)){let e=!a||n-a.archivedAt>=15e3;await _n(r,r.local.cwd);let t=e?Yt(r.local.cwd,!0):a.archived,i=Yt(r.local.cwd,!1),o=new Set(i.map(e=>e.task.id)),s=[...i,...t.filter(e=>!o.has(e.task.id))],c=new Set(s.map(e=>e.task.id)),u=this.left.get(r.local.cwd)??new Map;for(let e of a?.rows??[])c.has(e.task.id)||u.set(e.task.id,a.at);for(let[e,t]of u)(t<n-6e5||c.has(e))&&u.delete(e);let d=this.archived.get(r.local.cwd)??new Set;for(let e of d)c.has(e)?d.delete(e):l(r.local.cwd,e)||(u.set(e,a?.at??n),d.delete(e));this.left.set(r.local.cwd,u),this.scans.set(r.local.cwd,a={at:n,rows:s,archived:t,archivedAt:e?n:a.archivedAt})}i.set(t,new Map(be(r.local.cwd,a.rows,e).map(e=>[e.task.id,e])))}return{rows:i,deleted:a}}news(e,{rows:t,deleted:n},r){let{ctx:i}=e,a=t.get(i.organizationId)??new Map,o=[],s=(t,n)=>{let i=JSON.stringify(n);e.sent.get(t)!==i&&(e.sent.set(t,i),o.push(`id: ${r}${e.tag}\nevent: task\ndata: ${i}\n\n`))},c=e=>({id:e,deleted:!0}),l=t=>{let n=i.local&&rn(i.local.cwd,t,e.ids.has(t));if(s(t,n?ei(n,e.ids.has(t)):c(t)),e.gone.add(t),n&&i.local){let e=this.archived.get(i.local.cwd)??new Set;this.archived.set(i.local.cwd,e.add(t))}};for(let[t,n]of a){let a=e.ids.has(t);e.gone.delete(t);let o=ei(a&&i.local&&n.local&&L.has(n.status)?rn(i.local.cwd,t)??n:n,a);if(i.local&&n.local&&e.sent.get(t)!==JSON.stringify(o)&&r-(n.finishedAt??0)<$&&Zr(i.local.cwd,n)){e.sent.has(t)||e.sent.set(t,``);continue}a||i.local&&!e.fresh||n.updatedAt>e.from-$?s(t,o):e.fresh&&e.sent.set(t,JSON.stringify(o))}for(let t of e.ids)a.has(t)||l(t);for(let[t,r]of n.get(i.organizationId)??[])r>e.from-$&&s(t,c(t));if(i.local){for(let t of e.sent.keys())!a.has(t)&&!e.ids.has(t)&&!e.gone.has(t)&&l(t);for(let[t,n]of this.left.get(i.local.cwd)??[])n>e.from-$&&!a.has(t)&&e.sent.get(t)!==JSON.stringify(c(t))&&l(t)}return e.fresh=!1,e.from=r,o}};const ni=1e4;var ri=class{options;feeds=new Map;closed=!1;reads=0;constructor(e={}){this.options=e}watch(e,t,n,r,i){if(this.closed)return queueMicrotask(i),()=>{};let a=this.feeds.get(e),o=a?.reading!==void 0&&Date.now()-a.reading>=(this.options.stallMs??1e4);if(!a||o){let t={key:e,read:n,watches:new Set,head:1/0};if(a){clearTimeout(a.timer);for(let e of a.watches)t.watches.add(Object.assign(e,{feed:t}));a.watches.clear()}this.feeds.set(e,a=t)}let s={cursor:t,feed:a,timers:[],send:r,close:i};s.timers=[setTimeout(()=>this.end(s),this.options.lifeMs??5e4),setInterval(()=>this.send(s,`: ping
-
-`),this.options.heartbeatMs??2e4)];for(let e of s.timers)e.unref?.();return a.watches.add(s),a.reading===void 0&&t<a.head&&(clearTimeout(a.timer),this.read(a)),()=>this.drop(s)}close(){this.closed=!0;for(let e of[...this.feeds.values()])for(let t of[...e.watches])this.end(t)}drop(e){let{feed:t}=e;for(let t of e.timers)clearTimeout(t);!t.watches.delete(e)||t.watches.size||(clearTimeout(t.timer),this.feeds.get(t.key)===t&&this.feeds.delete(t.key))}end(e,t=``){try{t&&e.send(t),e.close()}catch{}this.drop(e)}send(e,t){try{e.send(t)}catch{this.drop(e)}}async read(e){if(e.timer=void 0,this.feeds.get(e.key)!==e||!e.watches.size)return;let t=[...e.watches],n=Math.min(...t.map(e=>e.cursor));e.reading=Date.now(),this.reads++;let r=await e.read(n).catch(()=>null);if(e.reading=void 0,this.feeds.get(e.key)!==e)return;let i=t.filter(t=>e.watches.has(t)),a=i.length<e.watches.size?0:this.options.pollMs??1e3;if(r===void 0)for(let e of i)this.end(e);else if(r){let{status:t,lines:o,pendingLogs:s,pendingResult:c}=r,l=o.length===500,u=L.has(t.status)&&!l&&!s&&!c,d=o.map(e=>[e.seq,`id: ${e.seq}\nevent: log\ndata: ${JSON.stringify(e)}\n\n`]);e.head=Math.max(n,o.at(-1)?.seq??n),l&&(a=0);for(let e of i){let t=d.flatMap(([t,n])=>t>e.cursor?[n]:[]).join(``);e.cursor=Math.max(e.cursor,o.at(-1)?.seq??-1),u?this.end(e,`${t}event: end\ndata: {}\n\n`):t&&this.send(e,t)}}this.feeds.get(e.key)===e&&(e.timer=setTimeout(()=>void this.read(e),a),e.timer.unref?.())}};function ii(e,t,n,r,i){let a=t.logWatcher??new ri,o=new TextEncoder,s=()=>{},c=new ReadableStream({start(c){c.enqueue(o.encode(`retry: ${Qr}\n\n`)),s=a.watch(`${t.organizationId}:${n}`,r,i,e=>c.enqueue(o.encode(e)),()=>c.close());let l=()=>{s();try{c.close()}catch{}};e.signal.aborted?l():e.signal.addEventListener(`abort`,l)},cancel(){s()}});return new Response(c,{headers:{"content-type":`text/event-stream; charset=utf-8`,"cache-control":`no-cache, no-transform`}})}var ai=class{options;entries=new Map;pending=new Map;constructor(e={ttlMs:6e5,max:100}){this.options=e}get size(){return this.entries.size}get inFlight(){return this.pending.size}has(e){return this.entries.has(e)}keys(){return this.entries.keys()}async get(e,t){let n=this.options.now??Date.now,r=n(),i=this.entries.get(e);if(i&&r-i.at<this.options.ttlMs)return i.value;for(let[t,n]of this.entries)t!==e&&r-n.at>=this.options.ttlMs&&this.entries.delete(t);let a=this.pending.get(e);return a||(a=Promise.resolve().then(t).then(t=>{if(t===void 0)return i?.value;if(this.options.accept&&!this.options.accept(t))return i?.value??t;this.entries.set(e,{value:t,at:n()});let r=this.entries.keys().next().value;return this.entries.size>this.options.max&&r!==void 0&&this.entries.delete(r),t}).catch(()=>i?.value).finally(()=>this.pending.delete(e)),this.pending.set(e,a)),a}};const oi=/^[a-z0-9][a-z0-9-]*$/,si=new Set([`openrouter.ai`,`ai-gateway.vercel.sh`,`api.groq.com`,`api.together.xyz`]);function ci(e){return{builtin:{codex:i,claude:c},models:e.models??{}}}async function li(e,t){let{baseUrl:n,envKey:r,key:i}=await K(e);if(!n||!/^https?:\/\//.test(n)||!URL.canParse(n))return E({error:`An http or https base URL is required`},400);let a=!i&&r&&await ui(t,n,r)?await nn(t,r):void 0,o=i||a,s=t.settings??={},c=s.probes??=new ai({ttlMs:6e5,max:100,now:t.now,accept:e=>e.reachable}),l=`${new URL(n).host}|${r??``}|${S(String(o??``))}`;return E(await c.get(l,()=>ee({baseUrl:n},{key:o,fetch:t.fetch})))}async function ui(e,t,n){let r=new URL(t).host;if(si.has(r))return!0;let i=(await _e(e)).models??{};return Object.values(i).some(e=>`baseUrl`in e&&e.envKey===n&&new URL(e.baseUrl).host===r)}async function di(e,t,n,r){return E(ci(await _e(t)))}async function fi(e,n,r,i){let{name:a=``,...o}=await K(e);return!oi.test(a)||t(a)?E({error:`Invalid model name "${a}"`},400):B(n,e=>{if(e.models?.[a])throw new U(`"${a}" already exists`);e.models={...e.models,[a]:o}})}async function pi(e,t,n,r){let i=n.name;return B(t,e=>{if(!e.models?.[i])throw new U(`No model "${i}"`);g(e,i)})}async function mi(e,t,a,o){let s=a.name,{spec:l}=await K(e);return B(t,e=>{if(!oi.test(s))throw new U(`Invalid alias name "${s}"`);let t=e.models?.[s];if(t&&f(t))throw new U(`"${s}" is a custom model name`);let a=d(l,u(e));if(!a?.model||a.engine===`custom`)throw new U(`"${l}" does not name a codex or claude model`);let o=a.engine===`claude`?c:i,p=l.split(`:`).some(e=>n.has(e)||r.has(e));e.models={...e.models,[s]:{provider:a.engine,model:o[a.model]??a.model,...p&&a.effort?{effort:a.effort}:{}}}})}async function hi(e,t,n,r){let i=n.name;return B(t,e=>{let t=e.models??={},n=t[i];n&&(f(n)||o(n))?n.disabled=!0:t[i]={disabled:!0}})}async function gi(e,t,n,r){let i=n.name;return B(t,e=>{let t=e.models??={},n=t[i];n&&(f(n)||o(n))?delete n.disabled:delete t[i]})}const _i=/^[a-z0-9][a-z0-9_-]*$/i;async function vi(e,t,n,r){return E((await _e(t)).mcp??{})}async function yi(e,t,n,r){let{name:i=``,...a}=await K(e);return _i.test(i)?B(t,e=>{e.mcp={...e.mcp,[i]:a}}):E({error:`Invalid server name "${i}"`},400)}async function bi(e,t,n,r){let i=n.name;return B(t,e=>{if(!e.mcp?.[i])throw new U(`No MCP server "${i}"`);delete e.mcp[i]})}const xi={npm:[`npx`,`-y`],pypi:[`uvx`],oci:[`docker`,`run`,`-i`,`--rm`]},Si=(e=[])=>e.map(({name:e,description:t,isRequired:n,isSecret:r,value:i,default:a})=>({name:e,...t?{description:t}:{},...i??a?{placeholder:i??a}:{},required:n===!0,secret:r===!0}));function Ci(e=[],t,n){return e.flatMap((e,r)=>{let i=`${t}:${r}`,a=Object.entries(e.variables??{}),o=e.value??e.default,s=(e,t,r)=>{let[i]=Si([{...r,name:e}]);return n.push({...i,label:t}),`{${e}}`};if(a.length)for(let[e,t]of a)o=o?.replaceAll(`{${e}}`,s(`${i}:${e}`,e,t));else o===void 0&&(e.valueHint||e.isRequired)&&(o=s(i,e.valueHint??e.name??i,e));return[...e.type===`named`&&e.name?[e.name]:[],...o===void 0?[]:[o]]})}function wi(e){let t=e.remotes?.find(e=>e.type===`streamable-http`||e.type===`sse`);if(t)return{type:t.type===`sse`?`sse`:`http`,url:t.url,env:[],headers:Si(t.headers)};let n=e.packages?.find(e=>xi[e.registryType]&&(e.transport?.type??`stdio`)===`stdio`);if(!n)return;let[r,...i]=xi[n.registryType],a=[],o=Ci(n.runtimeArguments,`runtime`,a),s=Ci(n.packageArguments,`package`,a);return{type:`stdio`,command:n.runtimeHint??r,args:[...!n.runtimeHint||n.runtimeHint===r?i:[],...o,n.identifier,...s],...a.length?{argumentInputs:a}:{},env:Si(n.environmentVariables),headers:[]}}async function Ti(e,t,n){let r=n.searchParams.get(`q`)?.trim()??``,i=t.settings??={},a=await(i.registry??=new ai({ttlMs:6e5,max:100,now:t.now})).get(r,()=>Ei(t,r));return a?E(a):E({error:`The MCP registry did not answer. Try again.`},502)}async function Ei(e,t){let n=new URLSearchParams({version:`latest`,limit:`30`});t&&n.set(`search`,t);try{let t=await(e.fetch??fetch)(`https://registry.modelcontextprotocol.io/v0.1/servers?${n}`,{headers:{accept:`application/json`},signal:AbortSignal.timeout(2e4)});if(!t.ok)return;let{servers:r=[]}=await t.json();return r.flatMap(({server:e})=>{let t=wi(e);return t?[{name:e.name,title:e.title??e.name.split(`/`).pop()??e.name,description:e.description??``,...t}]:[]})}catch{return}}const Di=`/api/auth/callback`,Oi=`/.well-known/oauth-client.json`,ki=`/.well-known/oauth-cli-client.json`,Ai=`openid profile email offline_access organizations:read`;function ji(e,t){return{client_id:`${e}${Oi}`,client_name:`Coder at ${new URL(e).host}`,redirect_uris:[`${e}${Di}`],post_logout_redirect_uris:[`${e}/?signed_out=1`],grant_types:[`authorization_code`,`refresh_token`],response_types:[`code`],token_endpoint_auth_method:`private_key_jwt`,token_endpoint_auth_signing_alg:`ES256`,jwks:t,scope:Ai}}function Mi(e){return{client_id:`${e}${ki}`,client_name:`Coder CLI for ${new URL(e).host}`,redirect_uris:[`http://127.0.0.1/callback`],grant_types:[`authorization_code`,`refresh_token`,`urn:ietf:params:oauth:grant-type:device_code`],response_types:[`code`],token_endpoint_auth_method:`none`,scope:Ai}}function Ni(e,t){return{resource:new URL(e).origin,authorization_servers:[t],bearer_methods_supported:[`header`],scopes_supported:Ai.split(` `)}}function Pi(e){let t=E(e);return t.headers.set(`cache-control`,`public, max-age=3600`),t}function Fi(e,t,n,r){return t.config.publicUrl&&t.auth?Pi(ji(t.config.publicUrl,t.auth.jwks)):void 0}function Ii(e,t,n,r){return t.config.publicUrl&&t.auth?Pi(Mi(t.config.publicUrl)):void 0}function Li(e,t,n,r){return t.config.publicUrl&&t.auth?Pi(Ni(t.config.publicUrl,t.auth.issuer)):void 0}const Ri=[H(`GET`,Oi,Fi,Be),H(`GET`,ki,Ii,Be),H(`GET`,`/.well-known/oauth-protected-resource`,Li,Be),H(`GET`,`/health`,(e,t)=>Xn(t)),H(`GET`,`/`,dn,Se),H(`GET`,`/login`,kt,kn),...Ft(`/login`,Et,kn).filter(e=>e.method!==`GET`),H(`POST`,`/dash/token`,tn,Sn),...Ft(`/dash`,St,me)],zi=[H(`GET`,`/api/auth/capabilities`,(e,t)=>E({wular:t.auth?.issuer??null})),...Ft(`/api/auth`,(e,t)=>t.auth.handler(e),Dn),H(`GET`,`/me`,$n,It),H(`POST`,`/me/organization`,tr,Je)],Bi=[...G(`/tasks`,[H(`GET`,`/:id/messages`,Fe,ye),H(`POST`,`/:id/ack`,ot,ye),H(`POST`,`/:id/heartbeat`,ft,ye),H(`POST`,`/:id/result`,Me,wt),H(`POST`,`/:id/credential`,cn,wt),H(`GET`,`/:id`,Te,lt)]),...G(`/logins`,[H(`GET`,`/:id/input`,fr,Ht),H(`GET`,`/:id`,pr,Ht),H(`POST`,`/:id`,mr,Ht)]),...G(`/runners`,[H(`POST`,`/register`,Qt)])],Vi=[...G(`/create`,[H(`GET`,`/:id`,hr,wn),H(`POST`,`/:id`,hr,wn),H(`GET`,`/:id/callback`,gr,wn),H(`POST`,`/:id/callback`,_r,wn)]),...G(`/install`,[H(`GET`,`/:id`,vr,P),H(`POST`,`/:id`,vr,P),H(`GET`,`/:id/callback`,yr,P),H(`POST`,`/:id/callback`,yr,P)])],Hi=G(`/connect`,[H(`GET`,``,Sr,Oe),H(`POST`,``,Cr,Oe),H(`GET`,`/:integration`,wr,Ue),H(`GET`,`/:integration/callback`,Tr,Ue)]),Ui=[...G(`/hooks`,[H(`POST`,`/*`,(e,t,n)=>ue(e,t,n[`*`]),(e,t,n)=>t.integrations[n[`*`]]?t:k())]),...Vi,...Hi],Wi=[H(`GET`,`/metrics`,async(e,t)=>E(await Qn(t),200,{"cache-control":`no-store`}),yn),H(`GET`,`/usage`,Pn),H(`GET`,`/usage/totals`,Fn)],Gi=G(``,[H(`GET`,`/folders`,(e,t)=>E(le(t.local.cwd))),H(`POST`,`/folders/check`,async(e,t)=>{let n=await e.json().catch(()=>void 0);return E(We(n?.path))}),H(`POST`,`/folders/clone`,async(e,t)=>{let n=await e.json().catch(()=>void 0);return E(await Wt(n?.url))}),H(`POST`,`/folders/pick`,async(e,t)=>E(await Vt()))],Gt),Ki=G(``,[H(`GET`,`/engines/status`,async(e,t)=>E(await Ot())),H(`POST`,`/engines/:engine/login`,an),H(`POST`,`/engines/:engine/logout`,Zt)],rt),qi=[H(`POST`,`/apps/:id/install`,(e,t,n,r)=>Or(e,t,n.id,r.searchParams.get(`back`))),H(`GET`,`/apps`,kr),H(`GET`,`/installations`,Ar),H(`POST`,`/connections`,(e,t)=>Dr(e,t)),H(`GET`,`/integrations`,(e,t)=>jr(t)),H(`GET`,`/repositories`,(e,t)=>Mr(t))],Ji=[H(`GET`,`/agents/import`,Fr),H(`POST`,`/agents/import`,Ir),H(`GET`,`/agents`,zr),H(`PATCH`,`/agents/:slug/settings`,qr),H(`GET`,`/agents/:slug/versions`,Br),H(`GET`,`/agents/:slug/versions/:version`,Vr),H(`GET`,`/agents/:slug`,Hr),H(`DELETE`,`/agents/:slug`,Jr,(e,t)=>Ae(t,`Only an owner or admin can delete an agent.`)),H(`PUT`,`/agents/:slug`,Yr)],Yi=[H(`GET`,`/credentials`,gn),H(`POST`,`/credentials`,Ct,et),H(`POST`,`/credentials/:label/default`,Dt),H(`DELETE`,`/credentials/:label`,Jt),H(`POST`,`/logins`,nr,N),H(`GET`,`/logins/:id`,rr,N),H(`POST`,`/logins/:id`,ir,N),H(`DELETE`,`/logins/:id`,ar,N)],Xi=[H(`GET`,`/runners`,At),H(`POST`,`/runners`,Xe),H(`POST`,`/runners/pair`,pn),H(`POST`,`/runners/:id/test`,yt),H(`PATCH`,`/runners/:id`,un),H(`DELETE`,`/runners/:id`,se)],Zi=[H(`GET`,`/tasks`,Ke),H(`POST`,`/tasks`,Ut),H(`GET`,`/tasks/:id`,ke),H(`DELETE`,`/tasks/:id`,Ie),H(`GET`,`/tasks/:id/logs`,On),H(`GET`,`/tasks/:id/stream`,Xr),H(`POST`,`/tasks/:id/steer`,Ze),H(`POST`,`/tasks/:id/ask`,Re),H(`POST`,`/tasks/:id/approve`,ce),H(`POST`,`/tasks/:id/cancel`,Ve),H(`POST`,`/tasks/:id/archive`,Bt),H(`GET`,`/events`,$r)],Qi=[H(`GET`,`/config`,bn),H(`PATCH`,`/config`,fe),H(`PUT`,`/config`,tt)],$i=[H(`POST`,`/models/probe`,(e,t)=>li(e,t)),H(`GET`,`/models`,di),H(`POST`,`/models`,fi),H(`DELETE`,`/models/:name`,pi),H(`POST`,`/models/:name/alias`,mi),H(`POST`,`/models/:name/disable`,hi),H(`POST`,`/models/:name/enable`,gi)],ea=[H(`GET`,`/mcp`,vi),H(`POST`,`/mcp`,yi),H(`DELETE`,`/mcp/:name`,bi),H(`GET`,`/mcp-registry`,(e,t,n,r)=>Ti(e,t,r))],ta=[H(`GET`,`/flows`,st),H(`GET`,`/pulls`,Ee),H(`POST`,`/flows/:name/run`,ut),H(`POST`,`/review`,it)],na=G(`/admin`,[...Wi,...Gi,...Ki,...qi,...Ji,...Yi,...Xi,...Zi,...Qi,...$i,...ea,...ta]).map(e=>({...e,guard:xt(e.guard)})),ra=[...Bi,...na,...zi,...Ui,...Ri];async function ia(e,t,n){if(!Ge(e,t))return k();let r=new URL(e.url);return n.scope instanceof Response?n.scope:(t=n.scope??t,await Xt(ra,e,t,r)??qt(e,t,r))}const aa=`x-coder-request-scope`;function oa(e,{sessions:t,cookies:n}){let r=e.auth;return r?{...e,auth:{...r,session(e,i){let a=JSON.stringify([...[`cookie`,`authorization`,`x-coder-organization`].map(t=>e.get(t)),!!i]),o=t.get(a);return o||(o=r.session(e,i,n),t.set(a,o)),o}}}:e}function sa(e,t,n){let r=t.requestScopes??=new Map,i=e.headers.get(aa),a=n&&i?r.get(i):void 0;if(a)return{req:e,ctx:oa(t,a),end(){}};let o=new Headers(e.headers);if(o.delete(aa),!t.auth)return{req:i?new Request(e,{headers:o}):e,ctx:t,end(){}};let s=zn(),c={sessions:new Map,cookies:[]};return r.set(s,c),o.set(aa,s),{req:new Request(e,{headers:o}),ctx:oa(t,c),cookies:c.cookies,end:()=>r.delete(s)}}async function ca(e,t,n={}){t.limits??=new Ye((t.now??Date.now)()),t.limits.requests++,t.settings??={},t.taskWatcher??=new ti,t.logWatcher??=new ri,t.dashboardHosts??=new zt;let r=()=>la(e,t,n);return t.dbProfile?t.dbProfile.request(n.inProcess===!0,r):r()}async function la(e,t,n){let r=await ne(e,ie(new URL(e.url).pathname));if(r instanceof Response)return r;let i=sa(r,t,n.inProcess===!0),a=!1;try{let r=n.clientIp??`unknown`,o=await oe(i.req,i.ctx,r),s=ua(o instanceof Response?o:await ia(i.req,i.ctx,o),i.cookies),c=new URL(e.url).pathname.split(`/`),l=c[1]===`tasks`,u=c[1]===`admin`&&c[2]===`tasks`;return e.method!==`GET`&&s.ok&&![`hooks`,`tasks`,`logins`].includes(c[1])&&Kt(t),e.method!==`GET`&&s.ok&&!(l&&c.length===4&&c[2]&&c[3]===`heartbeat`)&&!(u&&c.length===5&&c[3]&&[`steer`,`ask`,`approve`,`archive`].includes(c[4]))&&(l||u||c[1]===`admin`&&c[2]===`review`||c[1]===`admin`&&c[2]===`flows`&&c.length===5&&c[3]&&c[4]===`run`)&&_t(t,u&&c.length===3&&e.method===`POST`),a=!!s.body&&(s.headers.get(`content-type`)??``).includes(`text/html`),a?da(s,i.end):s}finally{a||i.end()}}function ua(e,t=[]){if(!t.length)return e;let n=new Headers(e.headers);for(let e of t)n.append(`set-cookie`,e);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:n})}function da(e,t){let n=e.body.getReader(),r=new ReadableStream({async pull(e){try{let{done:r,value:i}=await n.read();r?(t(),e.close()):e.enqueue(i)}catch(n){t(),e.error(n)}},cancel(e){return t(),n.cancel(e)}});return new Response(r,e)}async function fa(e={}){let t=e.env??J.env,n=An(t,e.host??`node`),r=e.runner??n.runner;if((e.host===`vercel`||t.VERCEL)&&(r===`local`||r===`local-docker`))throw new s(`invalid-option`,`The ${r} runner cannot run on Vercel.`,{hint:`Leave RUNNER unset to use vercel-sandbox.`});if(n.store===`memory`&&r!==`local`&&r!==`local-docker`)throw new s(`invalid-option`,`The ${r} runner needs a database.`,{hint:`Set DATABASE_URL, or use RUNNER=local for a memory server.`});if(!n.publicUrl)throw new s(`invalid-option`,`PUBLIC_URL is required to start a Coder server.`,{hint:`Set PUBLIC_URL to the address platforms and browsers use.`});let i=[];if(n.store===`memory`&&!e.local&&i.push(`test server, not for production: everything is in memory, nothing survives a restart, no sign-in; set DATABASE_URL for a real deployment`),!t.SERVER_ENCRYPTION_KEY&&!e.local&&i.push(`secrets are stored unencrypted; set SERVER_ENCRYPTION_KEY (openssl rand -base64 32)`),n.store===`postgres`&&!n.encryptionKey)throw new s(`invalid-option`,`SERVER_ENCRYPTION_KEY is required for a Postgres server.`,{hint:`Set SERVER_ENCRYPTION_KEY (openssl rand -base64 32); sign-in keys derive from it.`});let a=w(n.integrations),o=n.store===`memory`&&!n.adminToken?Rn(18).toString(`base64url`):void 0;n.store===`postgres`&&n.adminToken&&i.push(`ADMIN_TOKEN is ignored with Postgres; owners and admins sign in with coder auth login`);let c={...n,...n.store===`postgres`?{adminToken:void 0}:{},...o?{adminToken:o}:{},...e.runner?{runner:e.runner}:{}},l=await fn(c,{local:!!e.local});if(l.connection)try{let e=await Mn(l.connection.db);if(!e.applied)throw new s(`server`,`The database is not set up yet.`,{hint:`Create the tables: coder server migrate`});e.pending&&i.push(`database is ${e.pending} migration${e.pending===1?``:`s`} behind; run coder server migrate`)}catch(e){throw await l.close(),e}try{c.store===`memory`&&await xn(l.store(l.defaultOrganizationId),Date.now());let n=l.connection&&c.auth?await(await import(`./auth-DSE3SIuI.js`)).createAuth(l.connection.db,c):void 0,r=e.cwd??J.cwd(),u=l.store(l.defaultOrganizationId),d=He({kind:c.runner,workDir:c.workDir,config:c.runnerConfig,local:!(e.host===`vercel`||t.VERCEL),sandbox:{region:xe(c.databaseUrl),snapshots:{get:e=>u.get(`snapshot`,e),put:(e,t)=>u.put(`snapshot`,e,t)}}});if(!d[c.runner])throw await l.close(),new s(`invalid-option`,`Runner ${c.runner} is not configured.`,{hint:`Set RUNNER_CONFIG to JSON containing url and secret.`});let f=new zt,p=new Ye,m=new Map,h=new Map,g=new ti,_=new ri,v=t=>{let i=m.get(t);if(i)return i;let o=l.store(t),s={limits:p,...l.connection?{databaseHealth:async()=>{await l.connection.db.execute(Hn`select 1`)},statementTimeout:l.connection.statementTimeout}:{},config:c,settings:{},organizationId:t,integrations:a,runners:d,store:o,queue:l.queue,requestScopes:h,taskWatcher:g,logWatcher:_,dashboardHosts:f,dbProfile:l.connection?.profile,chatState:l.chatState,loadAgent:on(a,{cwd:r,config:c,store:o}),...n?{auth:n}:{},scope:v,webhookTarget:(e,t)=>l.webhookTarget(e,t),appRecord:e=>l.appRecord(e),installationOrganization:e=>l.installationOrganization(e),installations:e=>l.installations(e),serverOrganizationId:l.defaultOrganizationId,taskOrganization:(e,t)=>l.taskOrganization(e,t),...e.local?{local:e.local}:{}};return m.set(t,s),s};globalThis.__coder={handle:e=>ca(e,v(l.defaultOrganizationId),{inProcess:!0})};let y=v(l.defaultOrganizationId),b;return e.local&&(await Pt(y),b=setImmediate(()=>{Tn(y).catch(()=>void 0)})),{config:c,context:v,defaultContext:y,warnings:i,...o?{mintedToken:o}:{},sweep:l.sweep,close:async()=>{g.close(),_.close(),b&&clearImmediate(b),await y.local?.usageSync?.catch(()=>void 0),await bt(y),await l.close()}}}catch(e){throw await l.close(),e}}var pa=e({serve:()=>_a,serverHandler:()=>ha});function ma(e){try{let t=new URL(e);return Lt.has(t.hostname)?Number(t.port||(t.protocol===`https:`?443:80)):void 0}catch{return}}function ha(e=J.env,t=e.VERCEL?`vercel`:`node`){jn();let n,r=()=>n??=fa({env:e,host:t}).catch(e=>{throw n=void 0,e});return Object.assign(async(t,n)=>{let i=await r(),a=n?e=>n(e):e=>void e.catch(()=>{}),o=e=>({...i.context(e),waitUntil:a,scope:o});return ca(t,o(i.defaultContext.organizationId),{clientIp:e.VERCEL?t.headers.get(`x-forwarded-for`)?.split(`,`,1)[0]?.trim():void 0})},{scheduled:async()=>{let e=await r();await Promise.all([e.sweep(),import(`./store-Cxc2GYyj.js`).then(e=>e.Y).then(t=>t.renewInstallations(e.defaultContext)),pt(e.defaultContext,!1,!0),Tt(e.defaultContext)])},close:async()=>{let e=n;n=void 0,await(await e)?.close()}})}async function ga(e={}){jn();let t=e.env??J.env;if(e.runner&&!ze.includes(e.runner))throw new s(`invalid-option`,`Invalid --runner value: use ${ze.join(`, `)}`);if(e.port!==void 0&&(!Number.isInteger(e.port)||e.port<1||e.port>65535))throw new s(`invalid-option`,`Invalid port: use 1 through 65535.`);let n=t.PORT&&/^\d+$/.test(t.PORT)?Number(t.PORT):void 0,r=ma(t.PUBLIC_URL),i=e.port??n??r??8787;if(!Number.isInteger(i)||i<1||i>65535)throw new s(`invalid-option`,`Invalid PORT: use 1 through 65535.`);let a=t.PUBLIC_URL?t:{...t,PUBLIC_URL:`http://localhost:${i}`},o=!!(t.DATABASE_URL||t.POSTGRES_URL);if(o&&e.memory)throw new s(`invalid-option`,`A memory server cannot use DATABASE_URL.`,{hint:`Unset DATABASE_URL, or drop --memory.`});let c=(e.host??t.HOST??(o?void 0:`127.0.0.1`))?.replace(/^\[(.*)\]$/,`$1`),l=!o&&!e.memory;if(l&&!Lt.has(c))throw new s(`invalid-option`,`A local server listens on loopback only.`,{hint:`Reach it through a tunnel or a proxy on this machine; set DATABASE_URL for a deployment, or use --memory for a test server.`});if(e.memory&&t.VERCEL)throw new s(`invalid-option`,`A memory server cannot run on Vercel.`,{hint:`Set DATABASE_URL for a real deployment.`});let u,d,f=l?new Promise((e,t)=>{d=t,u=()=>{Jn().then(e,t)}}):void 0,p=f?.then(()=>void 0).catch(()=>void 0),m=l?{cwd:e.cwd??J.cwd(),port:i,cacheMaintenance:p}:void 0,h=await fa({cwd:e.cwd,env:a,runner:e.runner,...m?{local:m}:{}}),g=h.defaultContext,_=()=>{h.sweep().catch(()=>{}),import(`./store-Cxc2GYyj.js`).then(e=>e.Y).then(e=>e.renewInstallations(g)).catch(()=>{})};_();let v=setInterval(_,36e5);v.unref();let y=setInterval(()=>{pt(g,!1,!0).catch(()=>{}),Tt(g).catch(()=>{}),t.PUBLIC_URL||import(`./store-Cxc2GYyj.js`).then(e=>e.Y).then(e=>e.renewInstallations(g,`sync`)).catch(()=>{})},6e4);y.unref();let b=Vn.createServer(re((e,t)=>ca(e,g,{clientIp:t}),{limit:ie,admit:e=>o||de(e.socket.remoteAddress,e.url??`/`)})),x=h.config.publicUrl;r!==void 0&&r!==i&&h.warnings.push(`PUBLIC_URL points at port ${r} but the server listens on ${i}`),await new Promise((e,t)=>{b.once(`error`,t),b.listen(i,c,e)}).catch(async e=>{throw d?.(e),clearInterval(y),clearInterval(v),await h.close(),e});let S=u?setTimeout(u,0):void 0,C=!1,w=async()=>{C||(C=!0,clearInterval(y),clearInterval(v),g.taskWatcher?.close(),g.logWatcher?.close(),await new Promise((e,t)=>b.close(n=>n?t(n):e())),await p,S&&clearTimeout(S),await h.close())},ee=g.auth?`Wular Auth (${g.auth.issuer})`:void 0,T=`http://localhost:${i}`,E=Qe(g),D=E===`local`?T:x,O=h.config.store===`memory`?h.mintedToken??t.ADMIN_TOKEN:void 0;return{address:T,publicUrl:x,warnings:h.warnings,close:w,runner:h.config.runner,store:h.config.store,mode:E,...f?{cacheMigration:f}:{},maxTasks:h.config.maxTasks??h.config.limits?.concurrentTasks??10,...ee?{signIn:ee}:{},...h.mintedToken?{mintedToken:h.mintedToken}:{},...h.config.store===`postgres`&&t.DATABASE_URL?{database:Nn(t.DATABASE_URL)}:{},...Lt.has(new URL(D).hostname)?{dashboard:`${D}/dash${O?`#token=${encodeURIComponent(O)}`:``}`}:{}}}async function _a(e={}){try{return await ga(e)}catch(e){if(e instanceof s)throw e;let t=e instanceof Error&&e.cause instanceof Error?`: ${e.cause.message}`:``;throw new s(`server`,`${e instanceof Error?e.message:String(e)}${t}`)}}export{Ai as a,Di as i,pa as n,Oi as o,ha as r,_a as t};

package/dist/serve-Ci0AFWtY.js

@@ -1,2 +0,0 @@
-import{St as e,Zt as t}from"./dispatch-YW1aqjEg.js";import{i as n}from"./prompt-K7-bKcTC.js";import{i as r}from"./cli-DtTdpTy3.js";import{p as i,s as a}from"./output-BKeyLbvt.js";import{n as o,s,t as c}from"./args-DEMOfLz2.js";import l from"node:process";import*as u from"zod/mini";function d(e){let r=i,o=[...e.publicUrl===e.address?[]:[[`public`,e.publicUrl]],[`store`,e.database??(e.mode===`local`?t():e.store)],[`runner`,e.runner],...e.signIn?[[`sign-in`,e.signIn]]:[],...e.mintedToken?[[`token`,e.mintedToken]]:[]],s=Math.max(...o.map(([e])=>e.length))+2;l.stdout.write(`${r.bold({local:`Coder local server`,memory:`Coder test server`,cloud:`Coder server`}[e.mode])} ${r.dim(`listening on ${e.address}`)}\n`);for(let[e,t]of o)l.stdout.write(`  ${r.light(e.padEnd(s))}${t}\n`);e.warnings.length&&l.stdout.write(`
-`);for(let t of e.warnings)l.stdout.write(`  ${r.yellow(`!`)} ${t}\n`);if(e.cacheMigration?.then(e=>{(e.tasks||e.flows||e.files)&&l.stdout.write(`\n  moved ${e.tasks.toLocaleString(`en-US`)} archived tasks to ${e.cache}\n`)}).catch(e=>l.stderr.write(`\n  Cache migration failed: ${e instanceof Error?e.message:String(e)}\n`)),e.mode===`memory`&&l.stdout.write(`\n${a([`the CLI reaches this server with its token in ADMIN_TOKEN: coder task list --server ${e.publicUrl}`],r)}\n`),e.dashboard){let t=l.stdout.isTTY&&n(e.dashboard);l.stdout.write(t?`\nOpening the dashboard in your browser. If it doesn't open, go to:\n  ${e.dashboard}\n`:`\n  ${r.light(`dashboard`)}  ${e.dashboard}\n`)}}const f=r({name:`server serve`,help:{usage:`coder server serve [--port <n>] [--host <address>] [--memory] [--runner <name>] [--json] [--cwd <dir>]`,summary:`Run the Coder server on Bun: the address platforms deliver events to, the dashboard, and the worker that runs tasks. With DATABASE_URL it is a full server with sign-in and workspaces. Without one it is the dashboard for this machine's CLI: its config, agents, tasks and engine logins, on loopback only. --memory makes a throwaway test server that keeps everything in memory. Configured through the environment; every variable is in coder docs self-host. It never migrates the database itself: coder server migrate does.`,flags:[[`--port <n>`,`listen port (default: PORT, else the port in a localhost PUBLIC_URL, else 8787)`],[`--host <address>`,`listen address (default: HOST, else 127.0.0.1 without a database, else every interface)`],[`--memory`,`a throwaway test server: everything in memory, no sign-in, admin token only`],[`--runner <name>`,`local, local-docker, vercel-sandbox, github-actions, or http`]],env:[[`PUBLIC_URL`,`the address platforms and browsers reach the server at (default http://localhost:<port>)`],[`PORT`,`listen port, as hosts set it (default 8787)`],[`HOST`,`listen address, as --host`],[`DATABASE_URL`,`Postgres, set up by coder server migrate; turns on sign-in and workspaces`],[`AUTH_WULAR_URL`,`the Wular Auth issuer people sign in with (default https://auth.wular.ai)`],[`SERVER_ENCRYPTION_KEY`,`encrypts stored secrets and derives the sign-in keys; required with DATABASE_URL (openssl rand -base64 32)`],[`RUNNER`,`where tasks run: local (default), local-docker, vercel-sandbox, github-actions, http`],[`MAX_TASKS, TASK_TIMEOUT, TASK_STALL, TASK_ATTEMPTS`,`runner capacity and lifecycle limits`],[`ADMIN_TOKEN`,`local and memory servers: the dashboard and CLI key; minted and shown when unset`],[`CODER_CACHE_HOME`,`archived tasks, flows and usage (default OS cache directory/wular-coder)`],[`WORK_DIR`,`where tasks check out repositories`],[`SERVER_NAME`,`what the dashboard calls this server (default Coder)`]],examples:[[`PUBLIC_URL=https://abc.ngrok.app coder server serve`,`receive GitHub and Slack events through a tunnel; the tunnel serves only their webhooks and callbacks`],[`PUBLIC_URL=https://agents.example.com DATABASE_URL=postgres://... coder server serve`,`on your own host, backed by Postgres`]]},options:{...c,port:u.optional(u.coerce.number().check(u.int(),u.positive())),host:s,runner:s,memory:o},async run({options:t,cwd:n}){let{rerunUnderBun:r}=await import(`./env-LsVTi18f.js`).then(e=>e.t);if(await r(),t.memory&&!l.env.ADMIN_TOKEN&&!l.stdout.isTTY)throw new e(`invalid-option`,`Memory server needs an admin token: set ADMIN_TOKEN, or run in a terminal to get a printed one.`);let{serve:i}=await import(`./serve-CcqX_2qk.js`).then(e=>e.n),a=await i({cwd:n,port:t.port,...t.host?{host:t.host}:{},...t.runner?{runner:t.runner}:{},...t.memory?{memory:!0}:{}}),o=()=>void a.close().finally(()=>l.exit(0));return l.once(`SIGINT`,o),l.once(`SIGTERM`,o),a},json:e=>({ok:!0,address:e.address,publicUrl:e.publicUrl,runner:e.runner,store:e.store,mode:e.mode,maxTasks:e.maxTasks,...e.signIn?{signIn:e.signIn}:{},...e.mintedToken?{adminToken:e.mintedToken}:{},warnings:e.warnings}),print:d});export{f as commandServerServe};

package/dist/serve-DeX0lpXj.js

@@ -1,12 +0,0 @@
-import{An as e,Et as t,Mn as n,Vt as r,W as i,_ as a,an as o,nn as s,tt as c,v as l,wn as u,y as d}from"./dispatch-YW1aqjEg.js";import{i as f}from"./cli-DtTdpTy3.js";import{s as p}from"./args-DEMOfLz2.js";import{n as m}from"./mcp-server-DGzme0YX.js";import h from"node:path";import g from"node:fs";import{spawn as _}from"node:child_process";import{randomUUID as v}from"node:crypto";function y(e){return h.join(e,`sidecar.json`)}function b(t){return e(y(t))??{sessionId:null,declineStreak:0}}async function x(e){let t=h.join(e,`sidecar.lock`),n=Date.now()+12e4;for(;;)try{return g.mkdirSync(t),()=>{try{g.rmdirSync(t)}catch{}}}catch{try{if(Date.now()-g.statSync(t).mtimeMs>9e4){g.rmdirSync(t);continue}}catch{continue}if(Date.now()>n)throw Error(`sidecar lock wait timed out`);await new Promise(e=>setTimeout(e,250))}}function S(e,t,n,r){return[`-p`,r,`--output-format`,`json`,`--model`,`sonnet`,`--effort`,`low`,`--strict-mcp-config`,`--no-chrome`,`--mcp-config`,`{"mcpServers":{}}`,`--settings`,`{"disableClaudeAiConnectors":true}`,n?`--resume`:`--session-id`,t,...i,`--add-dir`,e]}function C(e,t,n,r,i){let a=S(t,n,r,i);return new Promise((t,n)=>{let r=_(`claude`,a,{cwd:e,stdio:[`ignore`,`pipe`,`pipe`]}),i=``,o=``,s=setTimeout(()=>{r.kill(`SIGKILL`),n(Error(`sidecar call timed out`))},12e4);r.stdout.on(`data`,e=>i+=e),r.stderr.on(`data`,e=>o+=e),r.on(`error`,e=>{clearTimeout(s),n(e)}),r.on(`close`,e=>{if(clearTimeout(s),e!==0){n(Error(`sidecar claude exited ${e}: ${o.trim().slice(0,200)}`));return}try{let e=JSON.parse(i);if(e.is_error){n(Error(`sidecar turn errored: ${String(e.result??``).slice(0,200)}`));return}t(String(e.result??``))}catch{n(Error(`sidecar returned unparseable output`))}})})}function w(e){let t=e.match(/\{[^{}]*"decision"[^{}]*\}/);if(!t)return null;try{let e=JSON.parse(t[0]);if(e.decision===`accept`||e.decision===`decline`||e.decision===`escalate`)return{decision:e.decision,reason:String(e.reason??``)}}catch{}return null}async function T(e,t,r){let i=null;try{i=await x(t);let a=b(t);if(a.declineStreak>=3)return{decision:`escalate`,reason:`sidecar decline streak; needs human review`};if(!a.sessionId){let i=v();await C(e,t,i,!1,`You are the approval reviewer for a "coder" background coding task. The task runs inside an OS sandbox; you review only actions that escape it.
-
-Rules:
-- git stays read-only: decline any git write (commit/push/checkout/reset/...).
-- Decline anything destructive or system-level (sudo, rm -rf outside workspace, killing processes, changing system config, piping downloads to shells).
-- Temp locations (/tmp, \$TMPDIR, os temp dirs) and paths this task created are workspace scratch. They can be deleted after checking the progress log.
-- Accept actions clearly needed for the task goal (package installs in the workspace, running tests/builds/linters, reading system info, network to well-known package registries).
-- Escalate when genuinely uncertain, when the action is irreversible beyond the workspace, or when it touches credentials/secrets.
-
-You may Read/Grep workspace files and the task progress log to inform a decision. Do this only when the action line alone is not enough. Most decisions should not need it.
-
-Reply with ONLY one line of JSON: {"decision":"accept"|"decline"|"escalate","reason":"<short>"}. Acknowledge now with {"decision":"escalate","reason":"ready"}.${r.taskGoal?`\n\nTask goal: ${r.taskGoal.replace(/\s+/g,` `).slice(0,500)}`:``}${`\nTask progress log: ${h.join(t,`log.jsonl`)}`}`),a.sessionId=i,n(y(t),a)}let o=w(await C(e,t,a.sessionId,!0,`action: ${r.summary.slice(0,500)}`));return o?.decision===`decline`?a.declineStreak+=1:o?.decision===`accept`&&(a.declineStreak=0),n(y(t),a),o??{decision:`escalate`,reason:`sidecar verdict unparseable`}}catch(e){return{decision:`escalate`,reason:`sidecar unavailable: ${e instanceof Error?e.message:String(e)}`}}finally{i?.()}}const E=new Set([`Write`,`Edit`,`MultiEdit`,`NotebookEdit`]);async function D(e,n,i){let u=String(i.tool_name??``),f=i.input??i.tool_input??{},p=o(e),m=s(e,n),h=c(e),g=r=>t(e,n,r),_,v;if(u===`Bash`){let e=String(f.command??``);v=`run command: ${e||`(unknown command)`}`,_=a(e,{allowedNetworkHosts:h.approvals.allowedNetworkHosts})}else if(E.has(u)){let e=String(f.file_path??f.notebook_path??``);v=`${u}: ${e||`(unknown path)`}`,_=l(e?[e]:[],p)}else v=`${u||`(unknown tool)`}: ${JSON.stringify(f).slice(0,200)}`,_={decision:`escalate`,reason:`tool needs approval: ${u}`};g({kind:`approval-decision`,method:u,decision:_.decision,reason:_.reason,summary:v});let y=_.decision,b=_.reason;if(y===`escalate`){let t=await T(e,m,{taskGoal:r(e,n)?.prompt??null,summary:v});g({kind:`sidecar-decision`,decision:t.decision,reason:t.reason,summary:v}),t.decision===`escalate`?(y=await d(m,{method:`claude/${u}`,summary:v,params:{tool_name:u,input:f}},{timeoutMs:h.approvals.escalationTimeoutMs,onEvent:g}),b=`escalated for human review`):(y=t.decision,b=t.reason)}return y===`accept`?{behavior:`allow`,updatedInput:f}:{behavior:`deny`,message:`Denied by coder policy: ${b}`}}const O={approval_prompt:{description:`Coder approval policy for claude permission prompts.`,inputSchema:{type:`object`,additionalProperties:!0},handler:(e,{cwd:t,taskId:n})=>D(t,n,e).catch(e=>({behavior:`deny`,message:`coder mcp tool failed: ${e instanceof Error?e.message:String(e)}`}))}},k=f({name:`mcp serve`,options:{cwd:p},args:1,run:({args:e,cwd:t})=>m(`coder`,O,{cwd:t,taskId:e[0]},void 0,u())});export{k as commandMcp};

package/dist/serve-SWjydoBC.js

@@ -1 +0,0 @@
-import{i as e,t}from"./cli-DtTdpTy3.js";import{p as n,s as r}from"./output-BKeyLbvt.js";import{n as i,o as a,s as o,t as s}from"./args-DEMOfLz2.js";import c from"node:process";import*as l from"zod/mini";const u=e({name:`runner serve`,help:{usage:`coder runner serve --url <public url> [--token <token>] [--runner-url <url>] [--port <n>] [--name <name>] [--workspace] [--server [url]] [--json]`,summary:`Run tasks on this machine with its own claude and codex logins. Expose the port with any tunnel (cloudflared, ngrok, Tailscale Funnel or a public VS Code port) and pass the tunnel's URL; each start registers the current URL, so a changing tunnel URL is fine. Choose a default with coder runner default. Tasks use their named runner, the agent setting, your default, the workspace default, then the server default.`,flags:[[`--url <public url>`,`the HTTPS address the server reaches this runner at`],[`--token <token>`,`one-use pairing token, --url is the Coder server`],[`--runner-url <url>`,`public tunnel address when pairing, or CODER_RUNNER_URL`],[`--port <n>`,`local port the tunnel forwards to (default 4100)`],[`--name <name>`,`shown in the dashboard (default: this machine's hostname)`],[`--workspace`,`run every member's tasks, not only yours (owners and admins)`],t],examples:[[`cloudflared tunnel --url http://localhost:4100`,`expose the port in one terminal`],[`coder runner serve --url https://abc.trycloudflare.com`,`then serve through it`]]},options:{...s,port:l.optional(l.coerce.number().check(l.int(),l.positive())),url:o,name:o,token:o,"runner-url":o,workspace:i,server:a,yes:i},async run({options:e}){let{serveRunner:t}=await import(`./serve-xMihn4g-.js`).then(e=>e.n),n=await t({...e,runnerUrl:e[`runner-url`]}),r=()=>void n.close().finally(()=>c.exit(0));return c.once(`SIGINT`,r),c.once(`SIGTERM`,r),n},json:({server:e,close:t,...n})=>({ok:!0,...n}),print:e=>c.stdout.write(`Runner ${n.bold(e.name)} serves ${e.server} at ${n.cyan(e.config.url??``)} (${e.scope}), listening on localhost:${e.port}.\n${r([`Tasks run here with this machine's own claude and codex logins`,`Stop with Ctrl-C; the server marks the runner offline`],n,n.cyan)}\n`)});export{u as commandRunnerServe};

package/dist/serve-xMihn4g-.js

@@ -1 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{Mt as t,St as n}from"./dispatch-YW1aqjEg.js";import{n as r,o as i}from"./remote-AcWWfKVS.js";import{u as a}from"./integrations-B2CavXR1.js";import{t as o}from"./local-B0GiaLV0.js";import{s,t as c}from"./http-DG54kyx4.js";import l from"node:path";import u from"node:fs";import{createHmac as d,randomBytes as f}from"node:crypto";import p from"node:os";import m from"node:http";var h=e({runnerController:()=>C,serveRunner:()=>b});const g=()=>t(`runners.json`);function _(){try{return JSON.parse(u.readFileSync(g(),`utf8`))}catch{return{}}}function v(e){u.mkdirSync(l.dirname(g()),{recursive:!0}),u.writeFileSync(g(),JSON.stringify(e,null,2),{mode:384})}const y=e=>[`cloudflared tunnel --url http://localhost:${e}`,`ngrok http ${e}`,`tailscale funnel ${e}`,`VS Code: forward port ${e} in the Ports view and set its visibility to Public`];async function b(e={}){let a=e.port??4100,l=e.token?e.runnerUrl??process.env.CODER_RUNNER_URL:e.url;if(!l)throw new n(`invalid-option`,e.token?`Expose this runner and set CODER_RUNNER_URL or --runner-url to its public HTTPS address.`:`Expose this runner with a tunnel, then pass its public URL with --url.`,{hint:y(a)});let u=e.token?i({...e,server:e.url??e.server,yes:!0}):i(e),d=_(),h=d[u]??{secret:f(32).toString(`base64url`)},g=new o(t(`runner`)),b=C({secret:h.secret,server:u,runner:g}),x=m.createServer(s(b,{limit:c}));await new Promise((e,t)=>{x.once(`error`,t),x.listen(a,`127.0.0.1`,e)});let S=()=>new Promise(e=>x.close(()=>e())),w=e.name??p.hostname(),T=async(e,t)=>{let r=await fetch(`${u}/runners/register`,{method:`POST`,redirect:`manual`,signal:AbortSignal.timeout(5e3),headers:{"content-type":`application/json`},body:JSON.stringify({...e?{token:e}:{id:h.id,organizationId:h.organizationId},name:w,url:l,secret:h.secret,...t?{offline:t}:{}})});if(!r.ok)throw new n(`server`,`Runner registration failed`,{status:r.status});return r.json()},E;try{if(e.token){let t=await T(e.token);E=t,h.organizationId=t.organizationId}else{let t=h.id&&h.organizationId?await T().catch(e=>{if(!(e instanceof n&&e.status===401))throw e}):void 0;if(t)E=t;else{let t=r(e),n=await t.me();E=await t.runners.add({kind:`http`,name:w,scope:e.workspace||!n.user?`workspace`:`personal`,config:{url:l,secret:h.secret}}),h.organizationId=n.organization?.id,h.id=E.id,E=await T()}}h.id=E.id,v({...d,[u]:h})}catch(e){throw await S(),e}let D=Promise.resolve(),O=setInterval(()=>{D=D.then(()=>T().then(()=>{})).catch(()=>{})},6e4);return{...E,port:a,server:u,close:async()=>{clearInterval(O),await D,await T(void 0,!0).catch(()=>{}),await S()}}}const x=3e5,S=(e,t=200)=>new Response(JSON.stringify(e),{status:t,headers:{"content-type":`application/json`}});function C(e){let t=e.now??Date.now,n=new Map,r=(r,i)=>{let o=r.headers.get(`x-coder-timestamp`)??``,s=r.headers.get(`x-coder-nonce`)??``,c=r.headers.get(`x-coder-signature`)??``,l=Number(o);if(!s||!Number.isFinite(l)||Math.abs(t()-l)>x)return!1;let u=d(`sha256`,e.secret).update(`${i}.${o}.${s}`).digest(`base64url`);if(!a(c,u))return!1;for(let[e,r]of n)r<t()&&n.delete(e);return!n.has(s)&&(n.set(s,l+x),!0)};return async t=>{let n=t.method===`GET`?``:await t.text();if(!r(t,n))return S({error:`Unauthorized`},401);let i=new URL(t.url),[,a,o]=i.pathname.split(`/`).map(decodeURIComponent);try{if(t.method===`POST`&&a===`start`&&!o){let t=JSON.parse(n);if(typeof t.task!=`string`||!t.env)return S({error:`Invalid start`},400);let r=t.env.CODER_TASK_TOKEN;if(typeof r!=`string`)return S({error:`Invalid start`},400);let i={CODER_SERVER:e.server,CODER_TASK_TOKEN:r,CODER_INBOX_MODE:e.runner.push?`push`:`poll`,...t.env.CODER_LOGIN===`claude`||t.env.CODER_LOGIN===`codex`?{CODER_LOGIN:t.env.CODER_LOGIN}:{}};return S({handle:await e.runner.start({id:t.task},i)})}if(t.method===`GET`&&a===`health`&&!o)return S({ok:!0});if(!o)return S({error:`Not found`},404);if(t.method===`POST`&&a===`messages`&&e.runner.push){let{entries:t}=JSON.parse(n);return!Array.isArray(t)||!t.length?S({error:`Invalid messages`},400):S(await e.runner.push(o,t))}return t.method===`GET`&&a===`status`?S(await e.runner.status(o)):t.method===`GET`&&a===`logs`?S(await e.runner.logs(o,Number(i.searchParams.get(`after`)??-1))):t.method===`POST`&&a===`stop`?(await e.runner.stop(o),new Response(null,{status:204})):S({error:`Not found`},404)}catch(e){return S({error:e instanceof Error?e.message:String(e)},400)}}}export{h as n,b as t};

package/dist/server-CWbtW4W_.js

@@ -1 +0,0 @@
-import{s as e}from"./cli-DtTdpTy3.js";const t=e(`server`,{serve:async()=>(await import(`./serve-Ci0AFWtY.js`)).commandServerServe,migrate:async()=>(await import(`./migrate-CSwkAInI.js`)).commandServerMigrate,"rotate-key":async()=>(await import(`./rotate-key-pIfcaeCd.js`)).commandServerRotateKey,app:async()=>(await import(`./app-CE5j7IDN.js`)).commandServerApp,workflow:async()=>(await import(`./workflow-BOPHazbM.js`)).commandServerWorkflow},{menu:[{usage:`serve [--port <n>]`,blurb:`run the server`},{usage:`migrate`,blurb:`apply pending database migrations`},{usage:`rotate-key`,blurb:`re-seal secrets with SERVER_ENCRYPTION_KEY`},{usage:`app create <integration>`,blurb:`create the built-in agent's public app`},{usage:`workflow`,blurb:`print the GitHub Actions workflow for RUNNER=github-actions`}],description:[`Self-host Coder: the server your agents and platform apps talk to, with a dashboard and sign-in. We run one as the hosted service; you can run your own.`],exampleCommand:`server serve`},{nested:[`app`]});export{t as commandServer};

package/dist/shared-D64pQ0XU.js

@@ -1 +0,0 @@
-import{t as e}from"./rolldown-runtime-DT7IzrpZ.js";import{Bn as t}from"./store-Cxc2GYyj.js";import{d as n,n as r,o as i,p as a,s as o,t as s}from"./schema-DoNO0dPh.js";import{and as c,eq as l,or as u}from"drizzle-orm";var d=e({UNSCOPED_ORGANIZATION:()=>``,addSecret:()=>N,agentRowId:()=>O,agentValue:()=>S,app:()=>m,appRowId:()=>D,date:()=>_,defined:()=>y,escapeLike:()=>v,install:()=>h,installationRowId:()=>k,ms:()=>g,opaque:()=>M,rows:()=>L,setSecret:()=>P,splitKey:()=>p,stateKey:()=>I,statePrefix:()=>F,taskRecord:()=>E,taskRowId:()=>A,versionColumns:()=>w,versionSummary:()=>T,versionValue:()=>C});const f=``;function p(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);return t>0&&/^\d+$/.test(n)?[e.slice(0,t),Number(n)]:void 0}const m=i,h=o,g=e=>e.getTime(),_=e=>new Date(e),v=e=>e.replace(/[\\%_]/g,`\\$&`),y=e=>Object.fromEntries(Object.entries(e).filter(([,e])=>e!=null)),b=e=>e?g(e):void 0,x=(e,t)=>{let n=/^repo:([^@]+)@(.+)$/.exec(e);return n&&t?{repo:n[1],ref:n[2],commit:t}:void 0},S=e=>y({id:e.slug,name:e.name,description:e.description,source:e.source,repo:e.repo,path:e.path,currentVersion:e.currentVersion,settings:e.settings,createdAt:g(e.createdAt),updatedAt:g(e.updatedAt)}),C=(e,t)=>y({agent:t,version:e.version,definition:e.definition,systemPrompt:e.systemPrompt,files:e.files,commit:e.commit,source:x(e.importedFrom,e.commit),importedFrom:e.importedFrom,createdAt:g(e.createdAt)}),w={id:r.id,agentId:r.agentId,version:r.version,definition:r.definition,commit:r.commit,importedFrom:r.importedFrom,createdAt:r.createdAt},T=(e,t)=>{let{systemPrompt:n,files:r,...i}=C({...e,systemPrompt:``,files:null},t);return i};function E(e){return y({task:y({id:e.publicId,source:e.source,agent:e.agent,flow:e.flow,runner:e.runner,permissions:e.permissions,event:e.event,prompt:e.prompt,args:e.args,mcp:e.mcp,author:e.author,definition:e.definition,credential:e.credential,requester:e.requester,runnerId:e.runnerId,usage:e.usage,tools:e.tools,toolScopes:e.toolScopes,context:e.context,files:e.files}),status:e.status,attempts:e.attempts,generation:e.generation,inboxSeq:e.inboxSeq,inboxAck:e.inboxAck<0?void 0:{generation:e.generation,seq:e.inboxAck},result:e.result,error:e.error,tokens:e.tokens,handle:e.handle,tokenHash:e.tokenHash,lastSeenAt:b(e.lastSeenAt),logCursor:e.logCursor??void 0,logSeq:e.logSeq??void 0,logBytes:e.logBytes??void 0,archivedAt:b(e.archivedAt),approval:e.approval,answer:Array.isArray(e.answer)?e.answer:void 0,createdAt:g(e.createdAt),startedAt:b(e.startedAt),finishedAt:b(e.finishedAt),cancelRequestedAt:b(e.cancelRequestedAt),updatedAt:g(e.updatedAt)})}async function D(e,t){let[n]=await e.db.select({id:m.id}).from(m).where(c(u(e.mine(m.organizationId),l(m.organizationId,``)),l(m.key,t)));if(!n)throw Error(`Unknown app "${t}".`);return n.id}async function O(e,t){let[n]=await e.db.select({id:s.id}).from(s).where(c(e.mine(s.organizationId),l(s.slug,t)));if(!n)throw Error(`Unknown agent "${t}".`);return n.id}async function k(e,t){let[n]=await e.db.select({id:h.id}).from(h).where(c(e.mine(h.organizationId),l(h.key,t)));if(!n)throw Error(`Unknown installation "${t}".`);return n.id}async function A(e,t){let[n]=await e.db.select({id:a.id}).from(a).where(c(e.mine(a.organizationId),l(a.publicId,t)));if(!n)throw Error(`Unknown task "${t}".`);return n.id}function j(e,n){if(n.startsWith(`plain.`))return{iv:`plain`,tag:``,ciphertext:n.slice(6),keyVersion:0};let[r,i,a]=n.split(`.`);if(!r||!i||!a)throw Error(`Invalid encrypted secret`);return{iv:r,tag:i,ciphertext:a,keyVersion:t(e.encryption,n)}}function M(e){return e.iv===`plain`?`plain.${e.ciphertext}`:`${e.iv}.${e.tag}.${e.ciphertext}`}async function N(e,t,r){let[i]=await e.db.insert(n).values({organizationId:e.organizationId,kind:t,...j(e,r)}).returning({id:n.id});return i.id}async function P(e,t,r){await e.db.update(n).set({...j(e,r),updatedAt:e.at()}).where(c(e.mine(n.organizationId),l(n.id,t)))}const F=(e,t)=>`o:${JSON.stringify([e,t])}:`,I=(e,t,n)=>F(e,t)+n;async function L(e,t){let n=await e.execute(t);return Array.isArray(n)?n:n.rows}export{T as C,w as S,p as _,m as a,E as b,y as c,k as d,g as f,d as g,P as h,S as i,v as l,L as m,N as n,D as o,M as p,O as r,_ as s,f as t,h as u,I as v,C as w,A as x,F as y};

package/dist/show-U0XPh927.js

@@ -1 +0,0 @@
-import{i as e,r as t}from"./cli-DtTdpTy3.js";import{g as n,p as r}from"./output-BKeyLbvt.js";import{i,n as a,s as o,t as s}from"./args-DEMOfLz2.js";import{isLocal as c}from"./list-CJhHYVb2.js";import l from"node:path";import u from"node:process";const d={server:i,workspace:o,yes:a};function f(e,t){return c(e)?{id:e.id,name:e.name,source:e.builtin?`builtin`:`repo`,...e.dir&&!e.builtin?{dir:l.relative(t,e.dir)}:{},definition:e.definition,...e.usage?{usage:e.usage}:{}}:{id:e.id,name:e.name,source:e.source,definition:e.definition,...e.settings?{usage:e.settings}:{}}}function p(e){let t=r,{definition:i,usage:a}=e,o=`dir`in e?e.dir:void 0,s=[[`name`,e.name],[`source`,o?`${e.source} (${o})`:e.source],[`description`,i.description],[`permissions`,a?.permissions??i.permissions],[`engine`,a?.engine??i.engine],[`model`,a?.model??i.model],[`effort`,a?.effort??i.effort]],c=Math.max(...s.map(([e])=>e.length))+2;for(let[e,n]of s)n&&u.stdout.write(`${t.dim(e.padEnd(c))}${n}\n`);let l=Object.entries(i.integrations).map(([e,t])=>{let n=a?.integrations?.[e],r=Array.isArray(t.triggers)?t.triggers:Object.keys(t.triggers??{}),i=n?.allowedEvents?r.filter(e=>n.allowedEvents.includes(e)):r,o=n?.allowedTools??t.tools;return{id:e,events:i.join(`, `)||`-`,tools:Array.isArray(o)?o.join(`, `):o??`-`}});u.stdout.write(`\n${n([{header:`integration`,value:e=>e.id,paint:e=>t.cyan(e)},{header:`events`,value:e=>e.events},{header:`tools`,value:e=>e.tools}],l,{style:t,border:!0})}`)}const m=e({name:`agent show`,help:{usage:`coder agent show <id> [--server [url]] [--json] [--cwd <dir>]`,summary:`Describe one agent as it will run here, or its active version on a server: its settings and per-integration triggers and tools.`,flags:[t],examples:[[`coder agent show coder`,`what the built-in agent listens to and may do`]]},options:{...s,...d},args:1,run:async({options:e,args:[t],cwd:n})=>{let{agents:r}=await import(`./agent-D0pQ_ewc.js`).then(e=>e.t);return r.show(t,{...e,cwd:n,organization:e.workspace})},json:(e,{cwd:t})=>f(e,t),print:(e,{cwd:t})=>p(f(e,t))});export{m as commandAgentShow};

package/dist/steer-DwSAYYqb.js

@@ -1,4 +0,0 @@
-import{St as e}from"./dispatch-YW1aqjEg.js";import{i as t,r as n}from"./cli-DtTdpTy3.js";import{p as r,r as i,s as a}from"./output-BKeyLbvt.js";import{i as o,n as s,s as c,t as l}from"./args-DEMOfLz2.js";import{i as u,r as d}from"./result-DtVw6XYk.js";import f from"node:process";const p={server:o,workspace:c,yes:s};function m(t,n,r){let[i,...a]=t,o=a.join(` `).trim();if(!i||!o)throw new e(`invalid-option`,n,{hint:r});return{id:i,text:o}}function h(e,t=!1){let{taskId:n,steered:o}=e;if(o===`queued`){f.stdout.write(`${r.dim(`[coder]`)} follow-up queued for task ${r.cyan(n)}; it runs when the current turn finishes.\n`),t&&f.stdout.write(`\n${r.dim(`[coder] --wait is not available for a queued follow-up.`)}\n\n${a([`Wait in its own background shell, one per task: coder task result ${n} --wait`],r)}\n`);return}if(!t){f.stdout.write(o===`live`?`${r.dim(`[coder]`)} steered follow-up into running task ${r.cyan(n)}.\n`:`${r.dim(`[coder]`)} resumed task ${r.cyan(n)} with the follow-up (same thread, same id).\n`),f.stdout.write(`\n${a([`Wait in its own background shell, one per task: coder task result ${n} --wait`],r)}\n`);return}f.stdout.write(`\n${e.finalMessage||`(no final message)`}\n\n`),f.stderr.write(`${r.dim(`[coder] task=${n} status=${e.status??`unknown`}`)}\n\n${d(n,i)}\n`)}const g=t({name:`task steer`,help:{usage:`coder task steer <task-id> "<follow-up instructions>" [--wait] [--server [url]]`,summary:`Continue a task's thread with new instructions. They are injected into a live Codex or
-Claude turn at its next tool boundary and queued across a startup or completion race.
-A stopped, finished, or archived task resumes on the same task id. It reuses the
-task's engine, model, and permissions unless overridden.`,flags:[[`--wait`,`run in the foreground and block until the answer is ready`],[`--model <alias|slug>`,`override the task's model for this follow-up`],[`--effort <low|medium|high>`,`override the task's reasoning effort`],[`--permissions <mode>`,`read-only · workspace-write · auto`],n],examples:[[`coder task steer task-abc "now add tests"`,`continue that task with a follow-up`]]},options:{...l,model:c,effort:c,permissions:c,wait:s,...p},args:1/0,async run({options:e,args:t}){let{tasks:n}=await import(`./task-DEp3GHwH.js`).then(e=>e.t),{id:r,text:i}=m(t,`Missing task id or follow-up text.`,[`Usage: coder task steer <task-id> "<follow-up>" [--wait]`,`Help: coder task steer --help`]);return n.steer(r,i,{...e,organization:e.workspace})},json(e,{options:t}){let n=e;return t.server!==void 0||!t.wait||n.steered===`queued`?e:{taskId:n.taskId,status:n.status??null,finalMessage:n.finalMessage??null}},print(e,{options:t,args:[n]}){if(t.server===void 0)return h(e,t.wait);if(t.wait)return u(e,r);f.stdout.write(`Steered server task ${r.cyan(n)}.\n`)},exit(e,{options:t}){let n=e;if(t.wait&&(t.server!==void 0||n.steered!==`queued`))return n.status===`completed`?0:1}});export{g as commandSteer,m as idAndText};

package/dist/store-B0RLMUR9.js

@@ -1,42 +0,0 @@
-import{dt as e,it as t,rt as n,st as r}from"./store-Cxc2GYyj.js";import{_ as i,a,d as o,h as s,i as c,l,m as u,n as d,p as f,r as p,t as m}from"./schema-DoNO0dPh.js";import{i as h}from"./client-31YzOj-i.js";import{C as g,S as _,_ as v,a as y,b as ee,c as b,d as x,f as S,h as C,i as w,l as T,n as E,o as D,p as O,r as k,s as A,u as j,v as M,w as N,x as P,y as te}from"./shared-D64pQ0XU.js";import{i as ne,t as re}from"./usage-Bw7fQeFC.js";import{isDeepStrictEqual as F}from"node:util";import{and as I,asc as L,desc as ie,eq as R,gt as z,gte as B,ilike as V,inArray as H,isNull as U,lt as W,lte as G,or as K,sql as q}from"drizzle-orm";import{alias as J}from"drizzle-orm/pg-core";function ae(e,t,n){return e.db.transaction(async r=>{let[i]=await r.insert(m).values({organizationId:e.organizationId,slug:t.id,name:t.name,description:t.description??null,source:t.source,repo:t.repo??null,path:t.path??null,currentVersion:0,createdAt:A(t.createdAt),updatedAt:A(t.updatedAt)}).onConflictDoUpdate({target:[m.organizationId,m.slug],set:{slug:t.id}}).returning(),a=w(i),[o]=a.currentVersion?await r.select().from(d).where(I(R(d.agentId,i.id),R(d.version,a.currentVersion))):[],s=o&&N(o,t.id),c=!!(s&&F(s.definition,n.definition)&&s.systemPrompt===n.systemPrompt&&F(s.files,n.files)),l=c?s:{...n,version:a.currentVersion+1},u={...t,currentVersion:l.version,createdAt:a.createdAt,...a.settings?{settings:a.settings}:{},updatedAt:a.updatedAt};if(c&&F(u,a))return{record:a,version:l,unchanged:c};u={...u,updatedAt:t.updatedAt};let f=c?q``:q`with published as (
-      insert into ${d} (agent_id, version, definition, system_prompt, files, commit, imported_from, created_at)
-      values (${i.id}, ${l.version}, ${JSON.stringify(l.definition)}::jsonb, ${l.systemPrompt},
-        ${l.files?JSON.stringify(l.files):null}::jsonb, ${l.commit??null}, ${l.importedFrom}, ${A(l.createdAt).toISOString()}::timestamptz)
-      returning version
-    )`;return await r.execute(q`${f} update ${m} set
-      name = ${u.name}, description = ${u.description??null}, source = ${u.source},
-      repo = ${u.repo??null}, path = ${u.path??null},
-      current_version = ${c?q`${l.version}`:q`(select version from published)`}, updated_at = ${A(u.updatedAt).toISOString()}::timestamptz
-      where id = ${i.id}`),{record:u,version:l,unchanged:c}})}function oe(e){let t=m;return{key:t.slug,rows:async(n,r)=>{let i=e.db.select().from(t).where(I(e.mine(t.organizationId),n)).orderBy(L(t.slug));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.slug,value:w(e)}))},put:async(n,r)=>{let i={name:r.name,description:r.description??null,source:r.source,repo:r.repo??null,path:r.path??null,currentVersion:r.currentVersion,settings:r.settings??null,createdAt:A(r.createdAt),updatedAt:A(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,slug:n,...i}).onConflictDoUpdate({target:[t.organizationId,t.slug],set:i})},delete:async n=>{await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.slug,n)))}}}async function Y(e,t,n){let r=t.lastIndexOf(`:`);return(await e.db.insert(d).values({agentId:await k(e,t.slice(0,r)),version:Number(t.slice(r+1)),definition:n.definition,systemPrompt:n.systemPrompt,files:n.files??null,commit:n.commit??null,importedFrom:n.importedFrom,createdAt:A(n.createdAt)}).onConflictDoNothing().returning({id:d.id})).length>0}function se(e){let t=d,n=q`${m.slug} || ':' || lpad(${t.version}::text, 6, '0')`;return{key:n,split:(e,n,r)=>I(R(m.slug,e),n===void 0?void 0:r?R(t.version,n):z(t.version,n)),rows:async(r,i)=>{let a=e.db.select({row:t,slug:m.slug,key:n}).from(t).innerJoin(m,R(m.id,t.agentId)).where(I(e.mine(m.organizationId),r)).orderBy(L(m.slug),L(t.version));return(await(i===void 0?a:a.limit(i))).map(({row:e,slug:t,key:n})=>({id:n,value:N(e,t)}))},put:async(t,n)=>{await Y(e,t,n)},delete:async n=>{let r=n.lastIndexOf(`:`),i=await k(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(I(R(t.agentId,i),R(t.version,Number(n.slice(r+1)))))}}}const X=(e,t)=>b({id:e.key,integration:e.integration,agent:e.agent,name:e.name,agentsRepo:e.agentsRepo,branch:e.branch,builtin:e.organizationId===``||void 0,credentials:O(t),createdAt:S(e.createdAt)});function ce(e){let t=y;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:o}).from(t).innerJoin(o,R(o.id,t.credentialsSecretId)).where(I(e.mine(t.organizationId),n)).orderBy(L(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.key,value:X(e,t)}))},put:(n,r)=>e.transaction(`app:${n}`,async e=>{let[i]=await e.db.select({secretId:t.credentialsSecretId,sealed:o}).from(t).innerJoin(o,R(o.id,t.credentialsSecretId)).where(I(e.mine(t.organizationId),R(t.key,n))),a=i?.secretId??await E(e,`app`,r.credentials);i&&O(i.sealed)!==r.credentials&&await C(e,a,r.credentials);let s={integration:r.integration,platformAppId:n.slice(n.indexOf(`:`)+1),agent:r.agent,name:r.name,agentsRepo:r.agentsRepo??null,branch:r.branch??null,credentialsSecretId:a,createdAt:A(r.createdAt),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,key:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.key],set:s})}),delete:n=>e.transaction(`app:${n}`,async e=>{let[r]=await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.key,n))).returning({secretId:t.credentialsSecretId});r&&await e.db.delete(o).where(R(o.id,r.secretId))})}}function Z(e,t,n){return b({id:e.key,app:t.key,integration:t.integration,account:e.account,token:n?O(n):void 0,installer:e.installer,connections:e.connections,settings:e.settings,createdAt:S(e.createdAt),deletedAt:e.deletedAt?S(e.deletedAt):void 0})}function le(e){let t=j;return{key:t.key,rows:async(n,r)=>{let i=e.db.select({row:t,app:{key:y.key,integration:y.integration},sealed:o}).from(t).innerJoin(y,R(y.id,t.appId)).leftJoin(o,R(o.id,t.tokenSecretId)).where(I(e.mine(t.organizationId),n)).orderBy(L(t.key));return(await(r===void 0?i:i.limit(r))).map(({row:e,app:t,sealed:n})=>({id:e.key,value:Z(e,t,n)}))},put:(n,r)=>e.transaction(`installation:${n}`,async e=>{let[i]=await e.db.select({secretId:t.tokenSecretId,organizationId:t.organizationId,sealed:o}).from(t).leftJoin(o,R(o.id,t.tokenSecretId)).where(R(t.key,n)),a=()=>Error(`Installation "${n}" belongs to another workspace.`);if(i&&i.organizationId!==e.organizationId)throw a();let s=i?.secretId??null;r.token&&(s?(!i?.sealed||O(i.sealed)!==r.token)&&await C(e,s,r.token):s=await E(e,`installation`,r.token));let c={appId:await D(e,r.app),platformInstallId:n.slice(r.app.length+1),account:r.account,tokenSecretId:r.token?s:null,installer:r.installer??null,connections:r.connections??null,settings:r.settings??null,createdAt:A(r.createdAt),updatedAt:e.at(),deletedAt:r.deletedAt===void 0?null:A(r.deletedAt)},[l]=await e.db.insert(t).values({organizationId:e.organizationId,key:n,...c}).onConflictDoUpdate({target:t.key,set:c,setWhere:e.mine(t.organizationId)}).returning({id:t.id});if(!l)throw a();!r.token&&i?.secretId&&await e.db.delete(o).where(R(o.id,i.secretId))}),delete:n=>e.transaction(`installation:${n}`,async e=>{let[r]=await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.key,n))).returning({secretId:t.tokenSecretId});r?.secretId&&await e.db.delete(o).where(R(o.id,r.secretId))})}}async function ue(e,t){let n=J(j,`locked`),[r]=await e.db.select({row:n,app:{key:y.key,integration:y.integration},sealed:o}).from(n).innerJoin(y,R(y.id,n.appId)).leftJoin(o,R(o.id,n.tokenSecretId)).where(I(e.mine(n.organizationId),R(n.key,t))).for(`update`,{of:n});return r&&Z(r.row,r.app,r.sealed)}const Q=(e,t)=>b({iv:t.iv,tag:t.tag,ciphertext:t.ciphertext,engine:e.engine,owner:e.owner,account:e.account,isDefault:e.isDefault,createdAt:S(e.createdAt)}),de=(e,t)=>`credential:${JSON.stringify([e.organizationId,t??null])}`;async function fe(e,t){let n=a;return(await e.db.select({row:n,sealed:o}).from(n).innerJoin(o,R(o.id,n.secretId)).where(I(e.mine(n.organizationId),t?R(n.owner,t):U(n.owner))).orderBy(L(n.label)).for(`update`)).map(({row:e,sealed:t})=>({id:r(e.owner??void 0,e.label),value:Q(e,t),row:e,sealed:t}))}async function pe(t,n,r,i){let s=a;if(!i){if(!n)return;await t.db.delete(s).where(R(s.id,n.row.id)),await t.db.delete(o).where(R(o.id,n.row.secretId));return}let c=O(i),l={engine:i.engine,isDefault:i.isDefault??!1,account:i.account??null,createdAt:i.createdAt===void 0?n?.row.createdAt??t.at():A(i.createdAt),updatedAt:t.at()};if(n){O(n.sealed)!==c&&await C(t,n.row.secretId,c),await t.db.update(s).set(l).where(R(s.id,n.row.id));return}let{owner:u,label:d}=e(r);await t.db.insert(s).values({organizationId:t.organizationId,owner:u??null,label:d,secretId:await E(t,`engine`,c),...l})}function me(t){let n=a,i=(n,r)=>{let{owner:i}=e(n);return t.transaction(de(t,i),async e=>pe(e,(await fe(e,i)).find(e=>e.id===n),n,r))};return{key:q`coalesce(${n.owner} || '/', '') || ${n.label}`,rows:async(e,i)=>{let a=t.db.select({row:n,sealed:o}).from(n).innerJoin(o,R(o.id,n.secretId)).where(I(t.mine(n.organizationId),e)).orderBy(L(n.owner),L(n.label));return(await(i===void 0?a:a.limit(i))).map(({row:e,sealed:t})=>({id:r(e.owner??void 0,e.label),value:Q(e,t)}))},put:(e,t)=>i(e,t),delete:e=>i(e,null)}}function $(e,t){let n=c,r=te(e.organizationId,t),i=n.key;return{key:i,where:e=>I(e.id===void 0?q`${n.key} like ${`${T(r+(e.prefix??``))}%`}`:R(n.key,r+e.id),e.after===void 0?void 0:z(n.key,r+e.after)),rows:async(t,a)=>{let o=e.db.select({id:i,value:q`${n.value}`}).from(n).where(I(q`${n.key} like ${`${T(r)}%`}`,e.live(n.expiresAt),t)).orderBy(L(n.key));return(await(a===void 0?o:o.limit(a))).map(e=>({id:e.id.slice(r.length),value:e.value}))},put:async(i,a,o)=>{let s=t===`login`?o??e.at():o;await e.db.insert(n).values({key:r+(t===`config`?`workspace`:i),value:a,expiresAt:t===`config`?null:s}).onConflictDoUpdate({target:n.key,set:{value:a,expiresAt:t===`config`?null:t===`login`&&!o?q`${n.expiresAt}`:s}})},delete:async i=>{await e.db.delete(n).where(R(n.key,r+(t===`config`?`workspace`:i)))}}}function he(e){let t=l,n=n=>I(e.mine(t.organizationId),R(t.publicId,n));return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,sealed:o}).from(t).innerJoin(o,R(o.id,t.secretId)).where(I(e.mine(t.organizationId),n)).orderBy(L(t.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,sealed:t})=>({id:e.publicId,value:b({name:e.name,owner:e.owner,kind:e.kind,scope:e.scope,config:e.config,createdBy:e.createdBy,default:e.isDefault,lastSeen:e.lastSeen?S(e.lastSeen):void 0,secret:O(t),createdAt:S(e.createdAt),updatedAt:S(e.updatedAt)})}))},put:(r,i)=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[a]=await e.db.select({id:t.id,secretId:t.secretId,sealed:o}).from(t).innerJoin(o,R(o.id,t.secretId)).where(n(r)),s={owner:i.owner??null,name:i.name,kind:i.kind,scope:i.scope,config:i.config,createdBy:i.createdBy??null,isDefault:i.default,lastSeen:i.lastSeen===void 0?null:A(i.lastSeen),updatedAt:A(i.updatedAt)};if(a){O(a.sealed)!==i.secret&&await C(e,a.secretId,i.secret),await e.db.update(t).set(s).where(R(t.id,a.id));return}await e.db.insert(t).values({organizationId:e.organizationId,publicId:r,secretId:await E(e,`runner`,i.secret),createdAt:A(i.createdAt),...s})}),delete:r=>e.transaction(`runner:${e.organizationId}:${r}`,async e=>{let[i]=await e.db.delete(t).where(n(r)).returning({secretId:t.secretId});i&&await e.db.delete(o).where(R(o.id,i.secretId))})}}function ge(e){let t=f;return{key:t.publicId,rows:async(n,r)=>{let i=e.db.select().from(t).where(I(e.mine(t.organizationId),n)).orderBy(L(t.publicId));return(await(r===void 0?i:i.limit(r))).map(e=>({id:e.publicId,value:ee(e)}))},put:async(n,r,i,a={})=>{let{task:o}=r,s={source:o.source,status:r.status,agent:o.agent,flow:o.flow,runner:o.runner,permissions:o.permissions??null,appId:o.event?await D(e,o.event.appId):null,installationId:o.event?await x(e,`${o.event.appId}:${o.event.installationId}`):null,event:o.event??null,prompt:o.prompt??null,args:o.args??null,mcp:o.mcp??null,author:o.author??null,definition:o.definition,credential:o.credential??null,requester:o.requester??null,runnerId:o.runnerId??null,usage:o.usage??null,tools:o.tools,toolScopes:o.toolScopes??null,context:o.context??null,files:o.files??null,result:r.result??null,error:r.error??null,tokens:r.tokens??null,handle:r.handle??null,tokenHash:r.tokenHash??null,lastSeenAt:r.lastSeenAt===void 0?null:A(r.lastSeenAt),logCursor:r.logCursor??null,logSeq:r.logSeq??null,logBytes:r.logBytes??null,archivedAt:r.archivedAt===void 0?null:A(r.archivedAt),approval:r.approval??null,answer:r.answer??null,attempts:r.attempts,generation:r.generation??0,inboxSeq:r.inboxSeq??-1,inboxAck:r.inboxAck?.generation===(r.generation??0)?r.inboxAck.seq:-1,createdAt:A(r.createdAt),startedAt:r.startedAt===void 0?null:A(r.startedAt),finishedAt:r.finishedAt===void 0?null:A(r.finishedAt),cancelRequestedAt:r.cancelRequestedAt===void 0?null:A(r.cancelRequestedAt),updatedAt:A(r.updatedAt)};await e.db.insert(t).values({organizationId:e.organizationId,publicId:n,...s}).onConflictDoUpdate({target:[t.organizationId,t.publicId],set:{...s,archivedAt:a.unarchive?s.archivedAt:q`coalesce(${t.archivedAt}, ${s.archivedAt})`}})},delete:async n=>{await e.db.delete(t).where(I(e.mine(t.organizationId),R(t.publicId,n)))}}}function _e(e){let t=s,n=q`${f.publicId} || ':' || lpad(${t.seq}::text, 6, '0')`;return{key:n,split:(n,r,i)=>I(e.mine(f.organizationId),R(f.publicId,n),r===void 0?void 0:i?R(t.seq,r):z(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(f,R(f.id,t.taskId)).where(I(e.mine(t.organizationId),r)).orderBy(L(f.publicId),L(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{at:S(e.at),level:e.level,line:e.line}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`),a={at:A(r.at),level:r.level,line:r.line};await e.db.insert(t).values({organizationId:e.organizationId,taskId:await P(e,n.slice(0,i)),seq:Number(n.slice(i+1)),...a}).onConflictDoUpdate({target:[t.taskId,t.seq],set:a})},delete:async n=>{let r=n.lastIndexOf(`:`),i=await P(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(I(R(t.taskId,i),R(t.seq,Number(n.slice(r+1)))))}}}function ve(e){let t=u,n=q`${f.publicId} || ':' || lpad(${t.seq}::text, 8, '0')`;return{key:n,split:(n,r,i)=>I(e.mine(f.organizationId),R(f.publicId,n),r===void 0?void 0:i?R(t.seq,r):z(t.seq,r)),rows:async(r,i)=>{let a=e.db.select({row:t,key:n}).from(t).innerJoin(f,R(f.id,t.taskId)).where(I(e.mine(t.organizationId),r)).orderBy(L(f.publicId),L(t.seq));return(await(i===void 0?a:a.limit(i))).map(({row:e,key:t})=>({id:t,value:{seq:e.seq,generation:e.generation,at:S(e.at),kind:e.kind,value:e.value}}))},put:async(n,r)=>{let i=n.lastIndexOf(`:`);await e.db.insert(t).values({organizationId:e.organizationId,taskId:await P(e,n.slice(0,i)),seq:r.seq,generation:r.generation,kind:r.kind,value:r.value,at:A(r.at)})},delete:async n=>{let r=n.lastIndexOf(`:`),i=await P(e,n.slice(0,r)).catch(()=>void 0);i!==void 0&&await e.db.delete(t).where(I(R(t.taskId,i),R(t.seq,Number(n.slice(r+1)))))}}}function ye(e){let t=i;return{key:f.publicId,rows:async(n,r)=>{let i=e.db.select({row:t,taskId:f.publicId,installationId:j.key}).from(t).innerJoin(f,R(f.id,t.taskId)).leftJoin(j,R(j.id,t.installationId)).where(I(e.mine(t.organizationId),n)).orderBy(L(f.publicId));return(await(r===void 0?i:i.limit(r))).map(({row:e,taskId:t,installationId:n})=>({id:t,value:b({installationId:n,taskId:t,agent:e.agent,target:e.target,engine:e.engine,model:e.model,credential:e.credential,runnerElapsedMs:e.runnerMs,tokens:e.tokens,at:S(e.at)})}))},put:async(n,r)=>{let i=await P(e,n),a={installationId:r.installationId?await x(e,r.installationId):null,agent:r.agent,target:r.target,engine:r.engine??null,model:r.model??null,credential:r.credential,runnerMs:r.runnerElapsedMs,tokens:r.tokens??null,at:A(r.at),updatedAt:e.at()};await e.db.insert(t).values({organizationId:e.organizationId,taskId:i,...a}).onConflictDoUpdate({target:t.taskId,set:a})},delete:async n=>{let r=await P(e,n).catch(()=>void 0);r!==void 0&&await e.db.delete(t).where(R(t.taskId,r))}}}var be=class u{db;organizationId;now;encryption;publishAgent=(e,t)=>ae(this,e,t);kinds;constructor(e,t,n=Date.now,r={}){this.db=e,this.organizationId=t,this.now=n,this.encryption=r,this.kinds={agent:oe(this),agentversion:se(this),app:ce(this),installation:le(this),credential:me(this),task:ge(this),tasklog:_e(this),inbox:ve(this),usage:ye(this),delivery:$(this,`delivery`),note:$(this,`note`),login:$(this,`login`),config:$(this,`config`),runner:he(this),snapshot:$(this,`snapshot`)}}static async webhookTarget(e,t,n){let r=J(o,`installation_secret`),[i]=await h(e,()=>e.select({app:y,credentials:o,installation:j,token:r}).from(y).innerJoin(o,R(o.id,y.credentialsSecretId)).leftJoin(j,I(R(j.appId,y.id),R(j.key,n??``),U(j.deletedAt))).leftJoin(r,R(r.id,j.tokenSecretId)).where(I(R(y.integration,t.slice(0,t.indexOf(`:`))),R(y.platformAppId,t.slice(t.indexOf(`:`)+1)))));return i&&{organizationId:i.app.organizationId,app:X(i.app,i.credentials),...i.installation?{bound:{organizationId:i.installation.organizationId,installation:Z(i.installation,i.app,i.token)}}:{}}}static async appRecord(e,t){let[n]=await h(e,()=>e.select({row:y,sealed:o}).from(y).innerJoin(o,R(o.id,y.credentialsSecretId)).where(I(R(y.integration,t.slice(0,t.indexOf(`:`))),R(y.platformAppId,t.slice(t.indexOf(`:`)+1)))));return n&&{organizationId:n.row.organizationId,app:X(n.row,n.sealed)}}static async installationOrganization(e,t){let[n]=await h(e,()=>e.select({organizationId:j.organizationId}).from(j).where(R(j.key,t)));return n?.organizationId}static async installations(e,t){return h(e,()=>e.select({key:j.key,organizationId:j.organizationId}).from(j).where(I(q`${j.key} like ${`${T(t)}:%`}`,U(j.deletedAt))))}static async taskOrganization(e,t,n){let[r]=await h(e,()=>e.select({organizationId:f.organizationId}).from(f).where(I(R(f.publicId,t),R(f.tokenHash,n))));return r?.organizationId}async getApps(e){return e.length?(await h(this.db,()=>this.db.select({row:y,sealed:o}).from(y).innerJoin(o,R(o.id,y.credentialsSecretId)).where(I(H(y.organizationId,[this.organizationId,``]),H(y.key,e))))).map(e=>({id:e.row.key,value:X(e.row,e.sealed)})):[]}async listCredentials(e){let t=a;return(await h(this.db,()=>this.db.select({row:t,sealed:o}).from(t).innerJoin(o,R(o.id,t.secretId)).where(I(this.mine(t.organizationId),e.owner?K(U(t.owner),R(t.owner,e.owner)):U(t.owner),e.engine?R(t.engine,e.engine):void 0)).orderBy(L(t.owner),L(t.label)))).map(({row:e,sealed:t})=>({id:r(e.owner??void 0,e.label),value:Q(e,t)}))}async updateMetadata(e,t,n){let r=e===`app`?y:e===`installation`?j:l,i=e===`app`?[`name`,`agentsRepo`,`branch`]:e===`installation`?[`account`,`connections`,`settings`,`deletedAt`]:[`name`,`config`,`lastSeen`,`updatedAt`];if(Object.keys(n).some(e=>!i.includes(e)))throw Error(`Invalid metadata fields`);let a=Object.fromEntries(Object.entries(n).map(([e,t])=>[e,t===void 0?null:[`deletedAt`,`updatedAt`,`lastSeen`].includes(e)?A(t):t])),o=e===`runner`?l.publicId:e===`app`?y.key:j.key,[s]=await this.db.update(r).set({...a,updatedAt:typeof n.updatedAt==`number`?A(n.updatedAt):this.at()}).where(I(this.mine(r.organizationId),R(o,t))).returning({id:r.id});return!!s}withAppLock(e,t){return this.transaction(`app:${e}`,t)}withConfigLock(e){return this.db.transaction(async t=>{let n=M(this.organizationId,`config`,`workspace`);return await t.insert(c).values({key:n,value:{},expiresAt:null}).onConflictDoNothing(),await t.select({key:c.key}).from(c).where(R(c.key,n)).for(`update`),e(new u(t,this.organizationId,this.now,this.encryption))})}transaction(e,t){return this.db.transaction(async n=>(await n.execute(q`select pg_advisory_xact_lock(3, hashtext(${e}))`),t(new u(n,this.organizationId,this.now,this.encryption))))}withCredential(t,r,i){if(t===`runner`)return this.withAppLock(`runners:${this.organizationId}`,e=>n(e,`runner`,r,i));if(t===`installation`)return this.transaction(`installation:${r}`,async e=>{let t=await ue(e,r),n=await i(t,t?[{id:r,value:t}]:[],e);for(let t of n??[])t.value===null?await e.delete(`installation`,t.id):await e.put(`installation`,t.id,t.value);return!!n?.length});let{owner:a}=e(r);return this.transaction(de(this,a),async e=>{let t=await fe(e,a),n=t.map(({id:e,value:t})=>({id:e,value:t})),o=await i(n.find(e=>e.id===r)?.value,n,e);for(let n of o??[])await pe(e,t.find(e=>e.id===n.id),n.id,n.value);return!!o?.length})}at(){return A(this.now())}live(e){return K(U(e),z(e,this.at()))}mine(e){return R(e,this.organizationId)}async get(e,t){let n=this.kinds[e],r=v(t),i=n.where?n.where({id:t}):n.split&&r?n.split(r[0],r[1],!0):q`${n.key} = ${t}`,a=(await h(this.db,async()=>await n.rows(i,1)))[0]?.value;return a||e!==`app`||this.organizationId===``?a:new u(this.db,``,this.now,this.encryption).get(e,t)}async patchLogin(e,t,n={}){let[r]=await this.db.update(c).set({value:q`jsonb_strip_nulls(${c.value} || ${JSON.stringify(t)}::jsonb)`}).where(I(R(c.key,M(this.organizationId,`login`,e)),this.live(c.expiresAt),q`(${c.value}->>'expiresAt')::bigint > ${this.now()}`,...Object.entries(n).map(([e,t])=>Array.isArray(t)?H(q`${c.value}->>${e}`,t):q`${c.value}->>${e} = ${t}`))).returning({value:q`${c.value}`});return r?.value}completeLogin(e,n,r,i){return t(this,e,n,r,i)}async taskInputs(e,t,n){let i=q`coalesce(${n??null}, ${m.settings}->>'engine', ${d.definition}->>'engine')`,o=this.db.select({owner:a.owner,label:a.label}).from(a).where(I(this.mine(a.organizationId),t?K(U(a.owner),R(a.owner,t)):U(a.owner),q`(${i} is null or ${a.engine} = ${i})`)).orderBy(q`${a.owner} is not null desc`,ie(a.isDefault),L(a.label)).limit(1).as(`selected_credential`),[s]=await h(this.db,()=>this.db.select({record:m,version:d,credentialLabel:o.label,credentialOwner:o.owner}).from(m).leftJoin(d,I(R(d.agentId,m.id),R(d.version,m.currentVersion))).leftJoinLateral(o,q`true`).where(I(this.mine(m.organizationId),R(m.slug,e))));return s?{record:w(s.record),...s.version?{version:N(s.version,s.record.slug)}:{},...s.credentialLabel?{credential:r(s.credentialOwner??void 0,s.credentialLabel)}:{}}:{}}async listAgentsWithVersions(e){return(await h(this.db,()=>this.db.select({record:m,version:d}).from(m).leftJoin(d,I(R(d.agentId,m.id),R(d.version,m.currentVersion))).where(I(this.mine(m.organizationId),e===void 0?void 0:R(m.slug,e))).orderBy(L(m.slug)))).map(({record:e,version:t})=>({record:w(e),...t?{version:N(t,e.slug)}:{}}))}async listAgentSummaries(e={}){let t=e.q?`%${T(e.q)}%`:void 0,n=this.db.select({record:m,version:_}).from(m).leftJoin(d,I(R(d.agentId,m.id),R(d.version,m.currentVersion))).where(I(this.mine(m.organizationId),e.slug===void 0?void 0:R(m.slug,e.slug),e.after?z(m.slug,e.after):void 0,e.source?R(m.source,e.source):void 0,t?K(V(m.slug,t),V(m.name,t),V(m.description,t),V(m.repo,t)):void 0,e.platform?q`${d.definition}->'integrations' ? ${e.platform}`:void 0)).orderBy(L(m.slug));return(await h(this.db,()=>e.limit===void 0?n:n.limit(e.limit))).map(({record:e,version:t})=>({record:w(e),...t?{version:g(t,e.slug)}:{}}))}async listVersions(e,t,n){let r=this.db.select({version:_}).from(d).innerJoin(m,R(m.id,d.agentId)).where(I(this.mine(m.organizationId),R(m.slug,e),n===void 0?t===void 0?void 0:G(d.version,m.currentVersion):W(d.version,n),t===void 0?void 0:B(d.version,n===void 0?q`${m.currentVersion} + 1 - ${t}`:n-t))).orderBy(L(d.version));return(await h(this.db,()=>r)).map(({version:t})=>({id:`${e}:${String(t.version).padStart(6,`0`)}`,value:g(t,e)}))}async put(e,t,n,r={}){let i=r.ttlMs===void 0?null:A(this.now()+r.ttlMs);await this.kinds[e].put(t,n,i,r)}async putMany(e,t){if(!t.length)return;if(e!==`tasklog`){await Promise.all(t.map(t=>this.put(e,t.id,t.value)));return}let n=t[0].id.lastIndexOf(`:`),r=t[0].id.slice(0,n),i=t.map(e=>{let t=e.id.lastIndexOf(`:`),n=e.value;if(e.id.slice(0,t)!==r)throw Error(`A log batch must belong to one task`);return{organizationId:this.organizationId,taskId:q`(select ${f.id} from ${f} where ${f.organizationId} = ${this.organizationId} and ${f.publicId} = ${r})`,seq:Number(e.id.slice(t+1)),at:A(n.at),level:n.level,line:n.line}});await this.db.insert(s).values(i).onConflictDoUpdate({target:[s.taskId,s.seq],set:{at:q`excluded.at`,level:q`excluded.level`,line:q`excluded.line`}})}async list(e,t={}){let n=this.kinds[e];if(n.where)return h(this.db,async()=>await n.rows(n.where(t),t.limit));let r=t.prefix?.endsWith(`:`)?t.prefix.slice(0,-1):void 0,i=t.after===void 0?void 0:v(t.after);if(n.split&&r&&!r.includes(`:`)&&(t.after===void 0||i?.[0]===r))return h(this.db,async()=>await n.rows(n.split(r,i?.[1]),t.limit));let a=t.prefix?q`${n.key} like ${`${T(t.prefix)}%`}`:void 0,o=t.after?q`${n.key} > ${t.after}`:void 0,s=a&&o?I(a,o):a??o;return h(this.db,async()=>await n.rows(s,t.limit))}async delete(e,t){await this.kinds[e].delete(t)}async create(e,t,n,r={}){if(e===`agentversion`)return Y(this,t,n);if(e!==`delivery`)throw Error(`Atomic create is not supported for ${e}`);let i=r.ttlMs===void 0?null:A(this.now()+r.ttlMs);return(await this.db.insert(c).values({key:M(this.organizationId,e,t),value:n,expiresAt:i}).onConflictDoUpdate({target:c.key,set:{value:n,expiresAt:i},setWhere:G(c.expiresAt,this.at())}).returning({key:c.key})).length>0}async claimDeliveryLease(e,t,n){let r=q`clock_timestamp() + ${n}::int * interval '1 millisecond'`,[i]=await this.db.insert(c).values({key:M(this.organizationId,`delivery`,e),value:{owner:t,failures:0},expiresAt:r}).onConflictDoUpdate({target:c.key,set:{value:q`${c.value} || ${JSON.stringify({owner:t})}::jsonb`,expiresAt:r},setWhere:q`${c.expiresAt} <= clock_timestamp()`}).returning({value:c.value});return i?i.value.failures:void 0}async updateDeliveryLease(e,t,n,r={ttlMs:3e4}){let i=I(R(c.key,M(this.organizationId,`delivery`,e)),q`${c.value}->>'owner' = ${t} and ${c.expiresAt} > clock_timestamp()`),a=q`clock_timestamp() + ${r.ttlMs}::int * interval '1 millisecond'`;return(n===void 0?await this.db.delete(c).where(i).returning({key:c.key}):await this.db.update(c).set({value:n.next===void 0?n:q`${JSON.stringify(n)}::jsonb || jsonb_build_object('next', floor(extract(epoch from (${a})) * 1000))`,expiresAt:a}).where(i).returning({key:c.key})).length>0}async updateDelivery(e,t,n,r={}){let i=I(R(c.key,M(this.organizationId,`delivery`,e)),q`${c.value}->>'owner' = ${t}`,this.live(c.expiresAt));return(n===void 0?await this.db.delete(c).where(i).returning({key:c.key}):await this.db.update(c).set({value:n,expiresAt:r.ttlMs===void 0?null:A(this.now()+r.ttlMs)}).where(i).returning({key:c.key})).length>0}async take(e,t){return e===`delivery`?(await this.db.delete(c).where(I(R(c.key,M(this.organizationId,e,t)),this.live(c.expiresAt))).returning({key:c.key})).length>0:await this.get(e,t)!==void 0&&(await this.delete(e,t),!0)}async usageTotals(e){let t=i,n=e.by===`agent`?q`${t.agent}`:e.by===`engine`?q`coalesce(${t.engine}, 'unknown')`:e.by===`installation`?q`coalesce(${j.key}, 'none')`:q`to_char(${t.at} at time zone ${ne(e.tz)}, 'YYYY-MM-DD')`,r=I(this.mine(t.organizationId),B(t.at,A(e.since)),e.until===void 0?void 0:W(t.at,A(e.until)),e.agent?R(t.agent,e.agent):void 0),a=q`coalesce(
-      case when jsonb_typeof(${t.tokens} -> 'total') = 'number' then (${t.tokens} ->> 'total')::numeric end,
-      (select sum((v #>> '{}')::numeric)
-        from jsonb_path_query(coalesce(${t.tokens}, 'null'::jsonb), 'strict $.**') v
-        where jsonb_typeof(v) = 'number')
-    )`,o={tasks:q`count(*)`,runnerMs:q`coalesce(sum(${t.runnerMs}), 0)`,tokenCount:q`coalesce(sum(${a}), 0)`},s=e.top?q`case when ${t.agent} in (
-          select ${t.agent} from ${t} where ${r} group by ${t.agent}
-          order by ${o[e.top.by]} desc, ${t.agent} limit ${e.top.count}
-        ) then ${t.agent} end`:e.parts?.length?q`case when ${H(t.agent,e.parts)} then ${t.agent} end`:q`null::text`,c=e.by===`installation`?q`left join ${j} on ${j.id} = ${t.installationId}`:q``,l=await h(this.db,()=>this.db.execute(q`
-      select ${n} as key, ${s} as part, ${o.tasks}::int as tasks,
-        ${o.runnerMs}::float8 as runner_ms,
-        ${o.tokenCount}::float8 as token_count
-      from ${t} ${c}
-      where ${r}
-      group by 1, 2
-    `)),u=Array.isArray(l)?l:l.rows,d=new Map;for(let e of u){let t={tasks:Number(e.tasks),runnerMs:Number(e.runner_ms),tokenCount:Number(e.token_count)},n=d.get(e.key)??{key:e.key,tasks:0,runnerMs:0,tokenCount:0};re(n,t),e.part&&((n.parts??={})[e.part]=t),d.set(e.key,n)}return[...d.values()].sort((e,t)=>e.key.localeCompare(t.key))}async sweep(e=1e3){if(!Number.isInteger(e)||e<1)throw Error(`Sweep batch must be positive`);let t=this.at().toISOString();await this.db.execute(q`
-      with expired_state as (
-        delete from ${c} where expires_at <= clock_timestamp() and key in (
-          select key from ${c} where expires_at <= clock_timestamp() order by expires_at limit ${e}
-        )
-      ), lists as (
-        select expired.key from ${p} as expired
-        where expired.key like 'k:%' and expired.expires_at <= ${t}::timestamptz
-          and not exists (select 1 from ${p} as newer where newer.key = expired.key and newer.seq > expired.seq)
-        order by expired.expires_at limit ${e}
-      ), expired_items as (
-        select key, seq from ${p} where key in (select key from lists) order by seq limit ${e}
-      ), expired_queue as (
-        select key, seq from ${p} where key like 'q:%' and expires_at <= ${t}::timestamptz order by expires_at limit ${e}
-      )
-      delete from ${p} where (key, seq) in (
-        select key, seq from expired_items union all select key, seq from expired_queue
-      )`)}};export{be as DrizzleStore};