@wular/coder 0.5.1 → 0.5.2

package/dist/{async-BS9tyhva.js → async-BP5q3Une.js}

@@ -1,3 +1,3 @@
-import{Ea as e}from"./args-CJsHYWbt.js";import{N as t,T as n,V as r,bt as i,gt as a,yt as o}from"./state-CxAUec80.js";import{t as s}from"./dispatch-BkoIU4GU.js";import{t as c}from"./discover-BfYHHJN_.js";import{g as l,l as u}from"./actions-DO8MvHwc.js";import{D as d,E as f,i as p,r as m,s as h,t as g,w as _}from"./executor-DBW7R7Tf.js";import{o as v}from"./mcp-cEIva8Pd.js";import y from"node:path";import b from"node:process";var x=e({claimCalls:()=>k,driveAsyncTool:()=>A,pendingCall:()=>D,startAsyncTool:()=>O,taskFlow:()=>E});const S=e=>y.join(e,`async.json`),C=e=>a(S(e))??[];function w(e,t){return o(`${S(e)}.lock`,()=>{let n=C(e),r=t(n);return i(S(e),n),r})}const T=(e,t)=>e.find(e=>e.landed?.turn===t)?.landed.budget??t,E=e=>e.flowRunId?d(e.flowRunId)?.name:void 0;function D(e,t){return C(e).find(e=>(!t||e.tool===t)&&!e.delivered&&(f(e.runId)?.status===`running`||e.pid!==void 0&&m(e.pid)))?.runId}async function O(e,n,r,i){let o=a(y.join(e,`job.json`));if(!o)throw Error(`This task has no record`);if(E(o)===n.flow)throw Error(`A ${n.name} task cannot start a ${n.name}`);if(i!==void 0&&!(i>0))throw Error(`timeout must be a positive number of seconds`);let c=o.cwd??b.cwd(),l=!!(n.platform&&(b.env[v(n.platform)]||b.env.CODER_MCP_MODE===`cloud`&&o.repo));return w(e,a=>{let u=D(e,n.name);if(u)throw Error(`${j(n.name)} ${u} is still running; its result arrives as a message.`);let d=T(a,t(c,o.id).length);if(a.filter(e=>e.tool===n.name&&e.turn===d).length>=n.limit)throw Error(`This turn has used all ${n.limit} of its ${n.name}s.`);let f=p(n.flow,{cwd:c,args:{...n.args(r,c,l?o.author:void 0),...o.pullRequest===void 0?{}:{eventPr:o.pullRequest}}});if(a.push({tool:n.name,runId:f.runId,turn:d,...i?{timeout:i}:{}}),b.env.CODER_MCP_MODE===`cloud`)return f.runId;let{[s]:m,...h}=b.env;return _(f,c,{env:h,drive:[`--task`,o.id,`--tool`,n.name,...i?[`--timeout`,String(i)]:[]]}),f.runId})}function k(e){return w(e,e=>e.flatMap(e=>e.pid!==void 0||e.delivered?[]:(e.pid=b.pid,[{...e}])))}async function A(e,i,a,o,s,f){let p=r(a,o),m=e=>w(p,t=>{let n=t.find(e=>e.runId===i);n&&Object.assign(n,e)}),_=j(e.name),x=e.platform&&v(e.platform),S=f?f.integrationToken:x?b.env[x]:void 0;x&&!f&&delete b.env[x];let E,D,O=()=>{},k=new Promise(e=>{s&&(D=setTimeout(()=>e(`timeout`),s*1e3)),O=()=>e(`stopped`),f?(f.stop.addEventListener(`abort`,O,{once:!0}),f.stop.aborted&&O()):(b.once(`SIGINT`,O),b.once(`SIGTERM`,O))}),A=!1,M;try{await m({pid:b.pid});let t=d(i);if(!t)throw Error(`No flow run "${i}".`);let r=t.script.startsWith(c()+y.sep),l=await Promise.race([g(t,a,{onStart:e=>E=e,...f?{onModel:f.onModel}:{}},r?S:void 0,f?.links,n(a,o)?.access,r?f?.checksToken:void 0),k]);typeof l==`string`?(E?.requestStop(),await h(i,E?.runningIds()),A=!0,M=l===`timeout`?`${_} timed out after ${s}s and was stopped`:`${_} was stopped`):M=`${_} finished\n\n${await e.render(l.result,i)}`}catch(e){M=`${_} ${i} failed: ${e instanceof Error?e.message:String(e)}`}finally{clearTimeout(D),A&&await Promise.all([...E?.stopHooks??[]].map(async e=>{try{await Promise.race([e(),new Promise(e=>setTimeout(e,1e4).unref())])}catch(e){console.error(`coder flow: stop hook failed`,e)}})),f?.stop.removeEventListener(`abort`,O),b.off(`SIGINT`,O),b.off(`SIGTERM`,O)}let N=n(a,o);if(!N)throw Error(`No task "${o}" to send ${e.name} ${i} to.`);let P=C(p),F=t(a,o).length,I=N.status===`running`,L=I?T(P,F):P.find(e=>e.runId===i)?.turn??F,R=e.limit-P.filter(t=>t.tool===e.name&&t.turn===L).length,[z,...B]=M.split(`
+import{Ea as e}from"./args-CJsHYWbt.js";import{N as t,T as n,V as r,bt as i,gt as a,yt as o}from"./state-CxAUec80.js";import{t as s}from"./dispatch-BkoIU4GU.js";import{t as c}from"./discover-BfYHHJN_.js";import{g as l,l as u}from"./actions-C35tq9KH.js";import{D as d,E as f,i as p,r as m,s as h,t as g,w as _}from"./executor-Ds4wDCzV.js";import{o as v}from"./mcp-cEIva8Pd.js";import y from"node:path";import b from"node:process";var x=e({claimCalls:()=>k,driveAsyncTool:()=>A,pendingCall:()=>D,startAsyncTool:()=>O,taskFlow:()=>E});const S=e=>y.join(e,`async.json`),C=e=>a(S(e))??[];function w(e,t){return o(`${S(e)}.lock`,()=>{let n=C(e),r=t(n);return i(S(e),n),r})}const T=(e,t)=>e.find(e=>e.landed?.turn===t)?.landed.budget??t,E=e=>e.flowRunId?d(e.flowRunId)?.name:void 0;function D(e,t){return C(e).find(e=>(!t||e.tool===t)&&!e.delivered&&(f(e.runId)?.status===`running`||e.pid!==void 0&&m(e.pid)))?.runId}async function O(e,n,r,i){let o=a(y.join(e,`job.json`));if(!o)throw Error(`This task has no record`);if(E(o)===n.flow)throw Error(`A ${n.name} task cannot start a ${n.name}`);if(i!==void 0&&!(i>0))throw Error(`timeout must be a positive number of seconds`);let c=o.cwd??b.cwd(),l=!!(n.platform&&(b.env[v(n.platform)]||b.env.CODER_MCP_MODE===`cloud`&&o.repo));return w(e,a=>{let u=D(e,n.name);if(u)throw Error(`${j(n.name)} ${u} is still running; its result arrives as a message.`);let d=T(a,t(c,o.id).length);if(a.filter(e=>e.tool===n.name&&e.turn===d).length>=n.limit)throw Error(`This turn has used all ${n.limit} of its ${n.name}s.`);let f=p(n.flow,{cwd:c,args:{...n.args(r,c,l?o.author:void 0),...o.pullRequest===void 0?{}:{eventPr:o.pullRequest}}});if(a.push({tool:n.name,runId:f.runId,turn:d,...i?{timeout:i}:{}}),b.env.CODER_MCP_MODE===`cloud`)return f.runId;let{[s]:m,...h}=b.env;return _(f,c,{env:h,drive:[`--task`,o.id,`--tool`,n.name,...i?[`--timeout`,String(i)]:[]]}),f.runId})}function k(e){return w(e,e=>e.flatMap(e=>e.pid!==void 0||e.delivered?[]:(e.pid=b.pid,[{...e}])))}async function A(e,i,a,o,s,f){let p=r(a,o),m=e=>w(p,t=>{let n=t.find(e=>e.runId===i);n&&Object.assign(n,e)}),_=j(e.name),x=e.platform&&v(e.platform),S=f?f.integrationToken:x?b.env[x]:void 0;x&&!f&&delete b.env[x];let E,D,O=()=>{},k=new Promise(e=>{s&&(D=setTimeout(()=>e(`timeout`),s*1e3)),O=()=>e(`stopped`),f?(f.stop.addEventListener(`abort`,O,{once:!0}),f.stop.aborted&&O()):(b.once(`SIGINT`,O),b.once(`SIGTERM`,O))}),A=!1,M;try{await m({pid:b.pid});let t=d(i);if(!t)throw Error(`No flow run "${i}".`);let r=t.script.startsWith(c()+y.sep),l=await Promise.race([g(t,a,{onStart:e=>E=e,...f?{onModel:f.onModel}:{}},r?S:void 0,f?.links,n(a,o)?.access,r?f?.checksToken:void 0),k]);typeof l==`string`?(E?.requestStop(),await h(i,E?.runningIds()),A=!0,M=l===`timeout`?`${_} timed out after ${s}s and was stopped`:`${_} was stopped`):M=`${_} finished\n\n${await e.render(l.result,i)}`}catch(e){M=`${_} ${i} failed: ${e instanceof Error?e.message:String(e)}`}finally{clearTimeout(D),A&&await Promise.all([...E?.stopHooks??[]].map(async e=>{try{await Promise.race([e(),new Promise(e=>setTimeout(e,1e4).unref())])}catch(e){console.error(`coder flow: stop hook failed`,e)}})),f?.stop.removeEventListener(`abort`,O),b.off(`SIGINT`,O),b.off(`SIGTERM`,O)}let N=n(a,o);if(!N)throw Error(`No task "${o}" to send ${e.name} ${i} to.`);let P=C(p),F=t(a,o).length,I=N.status===`running`,L=I?T(P,F):P.find(e=>e.runId===i)?.turn??F,R=e.limit-P.filter(t=>t.tool===e.name&&t.turn===L).length,[z,...B]=M.split(`
 `),V=[`${z} (${e.name}s left this turn ${R}/${e.limit}).`,...B].join(`
 `),{steered:H}=await l(N.cwd??a,N,V,(N.connectionSource??(N.connections?`server`:void 0))===`server`?{resolveConnections:u(N.mcp)}:{});await m({delivered:!0,...H===`live`?{}:{landed:{turn:I?F+1:F,budget:L}}})}const j=e=>e[0].toUpperCase()+e.slice(1);export{O as a,D as i,k as n,E as o,A as r,x as t};

package/dist/{auth-C16ylySv.js → auth-CJOm9_Vh.js}

@@ -1 +1 @@
-import{$ as e,A as t,B as n,C as r,D as i,E as a,F as o,G as s,H as c,I as l,J as u,K as d,L as f,M as p,N as m,O as h,P as g,Q as _,R as v,S as y,T as b,U as x,V as S,W as C,X as w,Y as T,Z as E,_ as D,a as O,at as k,b as ee,c as A,ct as j,d as M,dt as te,et as N,f as ne,ft as re,g as ie,gt as ae,ht as oe,i as se,it as ce,j as le,k as ue,lt as de,m as fe,mt as P,n as pe,nt as me,o as he,ot as F,p as ge,pt as _e,q as ve,r as ye,rt as be,s as xe,st as Se,tt as Ce,ut as we,v as Te,vt as Ee,w as De,x as Oe,y as ke,z as Ae}from"./build-CmtlB7pX.js";import{i as je,l as Me,m as Ne}from"./http-DRk8cDjf.js";import{_ as Pe,f as I,ht as Fe,p as L}from"./drizzle-orm-CYU7WOQS.js";import{platformLink as R,secret as z,workspace as B}from"./schema.js";import{J as Ie,Ur as Le,Wr as Re}from"./apps-BORri-28.js";import{h as ze,n as Be,s as Ve}from"./shared-BzNReirj.js";import{t as He}from"./store-BrnWdtRw.js";import{a as Ue,i as We,t as Ge}from"./metadata-D_bBfr3H.js";import{createECDH as Ke,hkdfSync as qe}from"node:crypto";import{isDeepStrictEqual as Je}from"node:util";function Ye(e,t,n){if(!S(e,t,n))throw new N(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function Xe(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new N(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,i,a,c,l,d,f,p,m]=e;if(l!==void 0&&v(l,`JWE Additional Authenticated Data`),d!==void 0&&v(d,`JWE Content Encryption Key`),f!==void 0&&v(f,`JWE Initialization Vector`),!n&&i!==void 0&&(i=s(N,i)[0],e[1]=i),a!==void 0&&(a=s(N,a)[0],e[2]=a),!n&&c!==void 0&&(c=s(N,c)[0],e[3]=c),p!==void 0&&!x(p))throw TypeError(`JWE Key Management Parameters must be an object`);Ye(i,a,c);let h={...i,...a,...c};T(N,i),u(N,o,m,i,h),ke(h,i);let{alg:g,enc:_}=h;if(typeof g!=`string`||!g)throw new N(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let y=Oe[g];if(y?.mode===`integrated-encryption`){if(_!==void 0)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(d!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${g}`);if(f!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${g}`);return[h,void 0,y]}if(typeof _!=`string`||!_)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[h,r(_),y]}async function Ze(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,m,,h]=e,g=s,_=c,v=a??y(r.alg),x,S,C;v.mode===`integrated-encryption`?C=await p(v,n,`encrypt`):[C,x,S]=await ee(v,i,n,r,d,m),S&&(h?_=_?{..._,...S}:S:g=g?{...g,...S}:S,Ye(g,_,l));let T=g?w(JSON.stringify(g)):``,E=u?.byteLength?w(u):void 0,D=P(E?`${T}.${E}`:T),O=o;r.zip===`DEF`&&(O=await Te(O).catch(e=>{throw new N(`Failed to compress plaintext`,{cause:e})}));let k,A,j;v.mode===`integrated-encryption`?[x,k]=await v.encrypt(C,O,D,g,r,m):{ciphertext:k,tag:A,iv:j}=await b(i,O,C,f,D);let M={ciphertext:w(k)};return j&&(M.iv=w(j)),A&&(M.tag=w(A)),x?.byteLength&&(M.encrypted_key=w(x)),E&&(M.aad=E),g&&(M.protected=T),l&&(M.unprotected=l),_&&(M.header=_),M}async function Qe(e,t,n){return Ze(e,Xe(e,n),t)}function $e(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}const V=[[`verify`],[`sign`]];function et(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:V}}function H(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:V,minRsaBits:2048}}function tt(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:V}}function nt(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:V}}function rt(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:V}}const it=De({HS256:et(256),HS384:et(384),HS512:et(512),RS256:H(256),RS384:H(384),RS512:H(512),PS256:H(256,32),PS384:H(384,48),PS512:H(512,64),ES256:tt(`P-256`,256),ES384:tt(`P-384`,384),ES512:tt(`P-521`,512),EdDSA:nt(),Ed25519:nt(),"ML-DSA-44":rt(44),"ML-DSA-65":rt(65),"ML-DSA-87":rt(87)});function at(t){let n=typeof t==`string`?it[t]:void 0;if(!n)throw new e(`alg ${t} is not supported either by JOSE or your javascript runtime`);return n}function ot(e){return[e&&d(`algorithms`,e.algorithms),e?.crit]}function st(e){return e===void 0?{}:C(e,F,`JWS Protected Header is invalid`)}function ct(e){try{return P(e)}catch{throw new F(`JWS Compact Serialization payload must use only ASCII characters`)}}async function lt(e,t,r,i,o){let{protected:s,header:c,payload:d}=e,f=o??st(s);if(!S(f,c))throw new F(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let h={...f,...c},g=ve(f,u(F,l,t[1],f,h)),{alg:_}=h;if(typeof _!=`string`||!_)throw new F(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(_))throw new E(`"alg" (Algorithm) Header Parameter value not allowed`);if(g){if(typeof d!=`string`)throw new F(`JWS Payload must be a string`)}else if(typeof d!=`string`&&!(d instanceof Uint8Array))throw new F(`JWS Payload must be a string or an Uint8Array instance`);let v=g||typeof d!=`string`?d:i(d),y=!1;typeof r==`function`&&(r=await r(f,e),y=!0);let b=at(_),x=te(s===void 0?new Uint8Array:P(s),P(`.`),typeof v==`string`?t[2]??=n(v,`payload`,F):v),C=Ae(e.signature,`signature`,F),w=await p(b,r,`verify`),T=await m(w,b.subtle,`verify`);b.minRsaBits&&a(b.alg,T);let D=!1;try{D=await crypto.subtle.verify(b.signing,T,C,x)}catch{}if(!D)throw new Se;let O={payload:typeof v==`string`?Ae(v,`payload`,F):v};return s!==void 0&&(O.protectedHeader=f),c!==void 0&&(O.unprotectedHeader=c),y?[{...O,key:w},g]:[O,g]}async function ut(e,t,n){if(e instanceof Uint8Array&&(e=re.decode(e)),typeof e!=`string`)throw new F(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new F(`Invalid Compact JWS`);return lt({payload:i,protected:r,signature:a},t,n,ct)}const U=e=>Math.floor(e.getTime()/1e3),dt={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},ft=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,W=`check_failed`;function pt(){throw TypeError(`Invalid time period format`)}function mt(e){typeof e!=`string`&&pt();let t=ft.exec(e);(!t||t[4]&&t[1])&&pt();let n=parseFloat(t[2]),r=Math.round(n*dt[t[3][0].toLowerCase()]);return Number.isFinite(r)||pt(),t[1]===`-`||t[4]===`ago`?-r:r}function G(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function ht(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function gt(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function _t(e,t){return typeof e==`number`?G(t,e):e instanceof Date?G(t,U(e)):U(new Date)+mt(e)}const vt=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},yt=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function bt(e,t,n=!1){let r=e[t];if(!(r===void 0&&!n)){if(typeof r!=`number`)throw new j(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function xt(e,t){throw new j(`unexpected "${t}" claim value`,e,t,W)}function St(e,t,n={}){let r;try{r=JSON.parse(ae.decode(t))}catch{}if(!x(r))throw new we(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||vt(e.typ)!==vt(i)))throw new j(`unexpected "typ" JWT header value`,r,`typ`,W);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new j(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&xt(r,`iss`),s!==void 0&&r.sub!==s&&xt(r,`sub`),c!==void 0&&!yt(r.aud,typeof c==`string`?[c]:c)&&xt(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=mt(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}G(`clockTolerance option`,f);let{currentDate:p}=n,m=G(`currentDate option`,U(p===void 0?new Date:p)),h=bt(r,`iat`,l!==void 0),g=bt(r,`nbf`);if(g!==void 0&&g>m+f)throw new j(`"nbf" claim timestamp check failed`,r,`nbf`,W);let _=bt(r,`exp`);if(_!==void 0&&_<=m-f)throw new de(`"exp" claim timestamp check failed`,r,`exp`,W);if(l!==void 0){let e=m-h,t=G(`maxTokenAge option`,typeof l==`number`?l:mt(l));if(e-f>t)throw new de(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,W);if(e<-f)throw new j(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,W)}return r}let Ct;function K(e){return Ct.get(e)}function wt(e){let t=K(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return oe.encode(JSON.stringify(t))}function Tt(e,t){return K(e)[t]}var Et=class{constructor(e={}){if(!x(e))throw TypeError(`JWT Claims Set MUST be an object`);(Ct||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return ht(`iss`,e),K(this).iss=e,this}setSubject(e){return ht(`sub`,e),K(this).sub=e,this}setAudience(e){return gt(e),K(this).aud=e,this}setJti(e){return ht(`jti`,e),K(this).jti=e,this}setNotBefore(e){return K(this).nbf=_t(e,`setNotBefore`),this}setExpirationTime(e){return K(this).exp=_t(e,`setExpirationTime`),this}setIssuedAt(e){let t=K(this);return t.iat=e===void 0?U(new Date):typeof e==`string`?G(`setIssuedAt`,U(new Date)+mt(e)):_t(e,`setIssuedAt`),this}};async function Dt(e,t,n){let[r,i]=await ut(e,ot(n),t);if(!i)throw new we(`JWTs MUST NOT use unencoded payload`);let a=St(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function Ot(e,t,n){let{plaintext:r,...i}=await ie(e,D(n),t),{protectedHeader:a}=i,o=St(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new j(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}const kt=Et;var At=class extends kt{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return f(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return f(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return f(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return f(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=wt(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?Tt(this,`iss`):void 0,sub:this.#n?Tt(this,`sub`):void 0,aud:this.#r?Tt(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,$e(await Qe(r,e,t))}};async function jt(e){if(t(e))if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`});if(e instanceof Uint8Array)return{kty:`oct`,k:w(e)};if(!h(e))throw TypeError(i(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let n=await crypto.subtle.exportKey(`jwk`,e);delete n.ext,delete n.key_ops,delete n.use,n.kty!==`AKP`&&delete n.alg;for(let e of Object.keys(n))n[e]===void 0&&delete n[e];return n}const q=(e,t)=>{if(typeof e!=`string`||!e)throw new Ce(`${t} missing or invalid`)};async function Mt(t,n){let r;if(x(t)){if(r=g(t),typeof r.kty!=`string`)throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(ue(t))r=g(await jt(t));else throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(n??=`sha256`,n!==`sha256`&&n!==`sha384`&&n!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let a;switch(r.kty){case`AKP`:q(r.alg,`"alg" (Algorithm) Parameter`),q(r.pub,`"pub" (Public key) Parameter`),a={alg:r.alg,kty:r.kty,pub:r.pub};break;case`EC`:q(r.crv,`"crv" (Curve) Parameter`),q(r.x,`"x" (X Coordinate) Parameter`),q(r.y,`"y" (Y Coordinate) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case`OKP`:q(r.crv,`"crv" (Subtype of Key Pair) Parameter`),q(r.x,`"x" (Public Key) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x};break;case`RSA`:q(r.e,`"e" (Exponent) Parameter`),q(r.n,`"n" (Modulus) Parameter`),a={e:r.e,kty:r.kty,n:r.n};break;case`oct`:if(typeof r.k!=`string`)throw new Ce(`"k" (Key Value) Parameter missing or invalid`);a={k:r.k,kty:r.kty};break;default:throw new e(`"kty" (Key Type) Parameter missing or unsupported`)}let o=P(JSON.stringify(a));return w(await _e(n,o))}function Nt(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function Pt(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=le(n,t,!0).then(e=>{if(e.type!==`public`)throw new me(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function Ft(t){let n;try{n=structuredClone(t)}catch{}if(!c(n))throw new me(`JSON Web Key Set malformed`);let r=n.keys.map(e=>{let t=g(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),i=new WeakMap;return Object.defineProperty(async(t,a)=>{let{alg:o,kid:s}={...t,...a?.header},c=typeof o==`string`?it[o]:void 0;if(!c||c.secret)throw new e(`Unsupported "alg" value for a JSON Web Key Set`);let l=n.keys.filter((e,t)=>Nt(r[t],c,o,s)),{0:u,length:d}=l;if(!d)throw new ce;if(d!==1){let e=new be;throw e[Symbol.asyncIterator]=async function*(){for(let e of l)try{yield await Pt(i,e,c)}catch{}},e}return Pt(i,u,c)},"jwks",{value:()=>structuredClone(n)})}function It(){return typeof WebSocketPair<`u`||typeof navigator<`u`&&navigator.userAgent===`Cloudflare-Workers`||typeof EdgeRuntime<`u`&&EdgeRuntime===`vercel`}let Lt;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(Lt=`jose/v6.2.12`);const Rt=Symbol();async function zt(e,t,n,r=fetch){let i=await r(e,{method:`GET`,signal:n,redirect:`manual`,headers:t}).catch(e=>{throw e.name===`TimeoutError`?new k:e});if(i.status!==200)throw new _(`Expected 200 OK from the JSON Web Key Set HTTP response`);try{return await i.json()}catch{throw new _(`Failed to parse the JSON Web Key Set HTTP response as JSON`)}}const Bt=Symbol();function J(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Vt(e,t,n){if(Number.isNaN(e))throw TypeError(`"${n}" option must not be NaN`);return typeof e==`number`?e:t}function Ht(e,t){if(!(e instanceof URL))throw TypeError(`url must be an instance of URL`);let n=new URL(e.href).href,r=t??{},i=r.timeoutDuration;if(typeof i==`number`&&(!Number.isInteger(i)||i<0))throw TypeError(`"timeoutDuration" option must be a non-negative integer`);let a=typeof i==`number`?i:5e3,o=Vt(r.cooldownDuration,3e4,`cooldownDuration`),s=Vt(r.cacheMaxAge,6e5,`cacheMaxAge`),l=new Headers(r.headers);Lt&&!l.has(`User-Agent`)&&l.set(`User-Agent`,Lt),l.has(`accept`)||l.set(`accept`,`application/json, application/jwk-set+json`);let u=r[Rt],d=r[Bt],f,p,m=0,h=0,g;if(d&&typeof d==`object`){let{uat:e,jwks:t}=d;J(e,s)&&c(t)&&(f=e,g=Ft(t))}let _=async()=>{if(p&&It()&&(p=void 0),!p){let e=++m,t=p=zt(n,l,AbortSignal.timeout(a),u).then(t=>{let n=Ft(t);if(e<=h)return;g=n;let r=Date.now();d&&(d.uat=r,d.jwks=t),f=r,h=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{(!g||!J(f,s))&&await _();try{return await g(e,t)}catch(n){if(n instanceof ce&&!J(f,o))return await _(),g(e,t);throw n}},{coolingDown:{get:()=>J(f,o),enumerable:!0},fresh:{get:()=>J(f,s),enumerable:!0},reload:{value:_,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}const Ut=`coder`,Y=`${Ut}.session`,X=`${Ut}.oidc`,Z=`${Ut}.operator`,Wt=3800,Gt=2592e3,Kt=3600,Q=()=>Math.floor(Date.now()/1e3);function $(e){let t=new Map;for(let n of(e.get(`cookie`)??``).split(/;\s*/)){let e=n.indexOf(`=`);e>0&&t.set(n.slice(0,e),n.slice(e+1))}return t}function qt(e){let t=[];for(;e.has(`${Y}.${t.length}`);)t.push(`${Y}.${t.length}`);return t}function Jt(e){let t=$(e);return t.get(Y)??(qt(t).map(e=>t.get(e)).join(``)||void 0)}function Yt(e){return Array.isArray(e)?e.flatMap(e=>typeof e?.id==`string`&&typeof e.role==`string`?[{id:e.id,slug:String(e.slug??e.id),name:String(e.name??e.slug??e.id),role:e.role}]:[]):[]}function Xt(e){let t=(e?.orgs.find(t=>t.id===e.org)??e?.orgs[0])?.slug;return t?`/dash/${encodeURIComponent(t)}/operator`:`/dash/operator`}function Zt(e,t,n){let r=e.get(`x-coder-organization`);if(r)return Le(t,r);let i=t.organizations.find(e=>e.id===n)??t.organizations[0];return i?{...t,organizationId:i.id,role:i.role}:t}async function Qt(e,t){let n=t.auth.wular.url,r=t.publicUrl,i=new URL(r).origin,a=r.startsWith(`https:`),o=await tn(t),s=`${r}${Ge}`,c=(e,t,n)=>`${e}=${t}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${n}${a?`; Secure`:``}`,l=(e,t)=>new At(e).setProtectedHeader({alg:`dir`,enc:`A256GCM`}).setIssuedAt().setExpirationTime(`${t}s`).encrypt(o.cookie[0]);async function u(e){if(e)for(let t of o.cookie)try{return(await Ot(e,t)).payload}catch{}}async function d(e,t){let n=await l(t,Gt),r=qt($(e));if(n.length<=Wt)return[c(Y,n,Gt),...r.map(e=>c(e,``,0))];let i=n.match(RegExp(`.{1,${Wt}}`,`g`));return[c(Y,``,0),...i.map((e,t)=>c(`${Y}.${t}`,e,Gt)),...r.slice(i.length).map(e=>c(e,``,0))]}let f=e=>[Y,...qt($(e))].map(e=>c(e,``,0)),p,m=()=>p??=A(new URL(n),`${r}${Ue}`,void 0,pe(o.client),new URL(n).protocol===`http:`?{execute:[ye]}:void 0).catch(e=>{throw p=void 0,e}),h,g=async()=>h??=Ht(new URL((await m()).serverMetadata().jwks_uri));function v(e,t){let n=e.claims();if(!n)throw Error(`Wular Auth returned no ID token`);let r=Yt(n.organizations),i=e=>r.find(t=>t.id===e)?.id;return{sub:n.sub,name:typeof n.name==`string`?n.name:``,email:typeof n.email==`string`?n.email:``,orgs:r,org:i(t?.org)??i(n.org)??r[0]?.id,exp_at:Q()+(e.expires_in??600),at:Q(),rt:e.refresh_token??t?.rt,idt:e.id_token??t?.idt}}let y=async t=>{try{t.length&&await e.insert(B).values(t.map(({id:e,slug:t,name:n})=>({organizationId:e,slug:t,name:n}))).onConflictDoUpdate({target:B.organizationId,set:{slug:Fe`excluded.slug`,name:Fe`excluded.name`}})}catch(e){console.error(`coder server: saving organizations failed`,e)}},b=new Map;function x(t){let n=t.rt;if(!n)return Promise.resolve(void 0);let r=b.get(n);return r||(r=m().then(e=>fe(e,n)).then(e=>v(e,t)).then(n=>(Je(n.orgs,t.orgs)||y(n.orgs),nn(e,n.sub,n.orgs),n)).catch(e=>(b.delete(n),e instanceof Ee&&e.error===`invalid_grant`?!1:void 0)),b.set(n,r),setTimeout(()=>b.delete(n),6e4).unref?.()),r.then(e=>e&&e.orgs.some(e=>e.id===t.org)?{...e,org:t.org}:e)}async function S(e,t,r){let a=(await g().then(t=>Dt(e,t,{issuer:n,audience:i,typ:`at+jwt`})).catch(e=>{(!(e instanceof _)||e instanceof k||e.code===`ERR_JOSE_GENERIC`)&&console.error(`coder server: bearer verification unavailable`,e)}))?.payload;if(!a?.sub)return;let o={user:{id:a.sub,name:``,email:``},organizations:Yt(a.organizations)};return r&&Q()-(a.iat??0)>60?{...o,stale:!0}:Zt(t,o,typeof a.org==`string`?a.org:void 0)}async function C(e){let t=await m().catch(()=>void 0);if(!t)return Response.redirect(`${r}/login?error=unavailable`,302);let n=e.searchParams.get(`operator`)===`1`,a=e.searchParams.get(`prompt`)===`login`,o={verifier:ne(),state:ge(),nonce:M(),return:n?`/dash`:Ne(e.searchParams.get(`return`),i),...n?{operator:n}:{}},u=O(t,{redirect_uri:s,...n?{scope:`openid`,prompt:`login`}:{scope:We},...a?{prompt:`login`}:{},code_challenge:await xe(o.verifier),code_challenge_method:`S256`,state:o.state,nonce:o.nonce});return new Response(null,{status:302,headers:{location:u.href,"set-cookie":c(X,await l(o,600),600)}})}async function w(t,n){let r=e=>{let t=new Headers({location:`/login?error=${encodeURIComponent(e)}`});return t.append(`set-cookie`,c(X,``,0)),new Response(null,{status:302,headers:t})},i=await u($(t.headers).get(X));if(!i)return r(`expired`);let a=n.searchParams.get(`error`);if(a)return r(a);let o,l;try{let e=await se(await m(),new URL(`${s}${n.search}`),{pkceCodeVerifier:i.verifier,expectedState:i.state,expectedNonce:i.nonce,idTokenExpected:!0});o=v(e),l=e.claims()?.auth_time}catch{return r(`sign_in_failed`)}if(i.operator)return E(t,o.sub,l);await Promise.all([y(o.orgs),nn(e,o.sub,o.orgs)]);let f=new Headers({location:i.return});f.append(`set-cookie`,c(X,``,0));for(let e of await d(t.headers,o))f.append(`set-cookie`,e);return new Response(null,{status:302,headers:f})}let T=e=>l(e,e.at+Kt-e.seen).then(t=>c(Z,t,e.at+Kt-e.seen));async function E(e,n,r){let a=await u(Jt(e.headers)),o=Q(),s=typeof r==`number`&&o-r<=60,l=s&&a?.sub===n&&t.operators?.includes(n);l||console.error(`coder server: operator sign-in refused: ${s?`not this session or not an operator`:`auth_time ${typeof r==`number`?`${o-r}s old`:`missing`}`}`);let d=new Headers({location:`${Xt(a)}?${l?`entered=1`:`error=${s?`denied`:`stale`}`}`});return d.append(`set-cookie`,c(X,``,0)),l&&d.append(`set-cookie`,await T({sub:n,aud:i,at:o,seen:o})),new Response(null,{status:302,headers:d})}async function D(e){if(!Ie(e,r))return je();let t=await u(Jt(e.headers)),n=await m().catch(()=>void 0),i=`${r}/?signed_out=1`,a=n?.serverMetadata().end_session_endpoint&&t?.idt?he(n,{id_token_hint:t.idt,post_logout_redirect_uri:i}).href:i,o=Response.json({url:a});for(let t of f(e.headers))o.headers.append(`set-cookie`,t);return o.headers.append(`set-cookie`,c(Z,``,0)),o}return{issuer:n,jwks:o.jwks,handler(e){let t=new URL(e.url);return t.pathname===`/api/auth/sign-in`&&e.method===`GET`?C(t):t.pathname===`/api/auth/callback`&&e.method===`GET`?w(e,t):t.pathname===`/api/auth/sign-out`&&e.method===`POST`?D(e):Promise.resolve(Me())},async session(e,t=!1,n=[]){let r=e.get(`authorization`);if(r?.startsWith(`Bearer `))return S(r.slice(7),e,t);let i=await u(Jt(e));if(i){if(i.exp_at<=Q()||t&&Q()-i.at>60){let t=await x(i);if(t===!1&&n.push(...f(e)),!t)return;i=t,n.push(...await d(e,i))}return Zt(e,{user:{id:i.sub,name:i.name,email:i.email},organizations:i.orgs},i.org)}},async operator(e,t=[]){let n=$(e).get(Z),r=await u(n),a=Q();if(!r||r.aud!==i||a-r.seen>900||a>=r.at+Kt){n&&t.push(c(Z,``,0));return}return t.push(await T({...r,seen:a})),r.sub},async setOrganization(e,t,n=[]){let r=await u(Jt(e));r&&r.exp_at<=Q()&&(r=await x(r)||void 0);let i=r?.orgs.find(e=>e.slug===t);if(!(!r||!i))return r.org!==i.id&&n.push(...await d(e,{...r,org:i.id})),i},async organization(t){let[n]=await e.select({slug:B.slug,name:B.name}).from(B).where(L(B.organizationId,t));return n?.slug?{slug:n.slug,name:n.name??``}:void 0}}}const $t=(e,t)=>new Uint8Array(qe(`sha256`,e,``,t,32));async function en(e){let t=$t(e,`coder oidc client key`),n=Ke(`prime256v1`);n.setPrivateKey(t);let r=n.getPublicKey(),i={kty:`EC`,crv:`P-256`,x:Buffer.from(r.subarray(1,33)).toString(`base64url`),y:Buffer.from(r.subarray(33)).toString(`base64url`)},a=await crypto.subtle.importKey(`jwk`,{...i,d:Buffer.from(t).toString(`base64url`)},{name:`ECDSA`,namedCurve:`P-256`},!1,[`sign`]),o=await Mt(i);return{key:a,kid:o,jwk:{...i,kid:o,alg:`ES256`,use:`sig`}}}async function tn(e){let t=[e.encryptionKey,e.previousEncryptionKey].filter(e=>!!e),n=await Promise.all(t.map(en));return{cookie:t.map(e=>$t(e,`coder session cookie`)),client:n[0],jwks:{keys:n.map(e=>e.jwk)}}}async function nn(e,t,n){let r=Re(n);try{await e.update(R).set(r).where(I(L(R.userId,t),Fe`(${R.organizations}, ${R.roles}) is distinct from (${JSON.stringify(r.organizations)}::jsonb, ${JSON.stringify(r.roles)}::jsonb)`))}catch(e){console.error(`coder server: updating linked accounts failed`,e)}}function rn(e){let t=t=>t instanceof He?t.db:e,n=(t,n,r)=>t instanceof He?t.transaction(n,e=>r(e.db)):e.transaction(e=>r(e)),r=async(e,n)=>(await t(e).select({row:R,token:z.value}).from(R).leftJoin(z,L(z.id,R.tokenSecretId)).where(n)).map(({row:e,token:t})=>({userId:e.userId,platform:e.platform,platformUserId:e.platformUserId,name:e.name,email:e.email,...e.organizations?{organizations:e.organizations}:{},...e.organizationId?{organizationId:e.organizationId}:{},...e.login?{login:e.login}:{},...t?{token:t}:{},...e.refusedAt?{refusedAt:e.refusedAt.getTime()}:{}}));return{link(e,t,r,i={},a){let o={name:e.name,email:e.email,...i.organizations?{organizations:i.organizations}:{},...i.roles?{roles:i.roles}:{},...i.login?{login:i.login}:{},...i.token?{organizationId:i.organizationId??null}:{}};return n(a,`link:${t}:${r}`,async n=>{let[a]=await n.insert(R).values({platform:t,platformUserId:r,userId:e.id,...o}).onConflictDoUpdate({target:[R.platform,R.platformUserId],set:{...o,...i.token?{refusedAt:null}:{}},setWhere:L(R.userId,e.id)}).returning({id:R.id,userId:R.userId,tokenSecretId:R.tokenSecretId});return a?.userId===e.id?(i.token&&a.tokenSecretId?await ze(n,a.tokenSecretId,i.token):i.token&&await n.update(R).set({tokenSecretId:await Be(n,i.token)}).where(L(R.id,a.id)),`linked`):`taken`})},linkedAccounts:(e,t)=>r(t,L(R.userId,e)),organizationAccounts:(e,t)=>r(t,Fe`${R.organizations} @> ${JSON.stringify([e])}::jsonb`),unlink(e,t,r,i){return n(i,`link:${t}:${r}`,async n=>{let i=await n.delete(R).where(I(L(R.userId,e),L(R.platform,t),L(R.platformUserId,r))).returning({secretId:R.tokenSecretId});await Ve(n,i.map(e=>e.secretId))})},async refreshLinkedToken(e,n,r,i,a,o){let s=t(o).select({id:R.tokenSecretId}).from(R).where(I(L(R.userId,e),L(R.platform,n),L(R.platformUserId,r))),[c]=await t(o).update(z).set({value:a}).where(I(Pe(z.id,s),L(z.value,i))).returning({id:z.id});return!!c},async refuseLinkedToken(e,n,r,i,a){await t(a).update(R).set({refusedAt:new Date}).where(I(L(R.userId,e),L(R.platform,n),L(R.platformUserId,r),Pe(R.tokenSecretId,t(a).select({id:z.id}).from(z).where(L(z.value,i)))))},async linkedUser(t,n){let[r]=await e.select({id:R.userId,name:R.name,email:R.email,organizations:R.organizations,roles:R.roles,login:R.login,token:z.value}).from(R).leftJoin(z,L(z.id,R.tokenSecretId)).where(I(L(R.platform,t),L(R.platformUserId,n)));return r&&{id:r.id,name:r.name,email:r.email,...r.organizations?{organizations:r.organizations}:{},...r.roles?{roles:r.roles}:{},...r.login?{login:r.login}:{},...r.token?{token:r.token}:{}}}}}async function an(e,t){return{...await Qt(e,t),...rn(e)}}export{an as createAuth};
+import{$ as e,A as t,B as n,C as r,D as i,E as a,F as o,G as s,H as c,I as l,J as u,K as d,L as f,M as p,N as m,O as h,P as g,Q as _,R as v,S as y,T as b,U as x,V as S,W as C,X as w,Y as T,Z as E,_ as D,a as O,at as k,b as ee,c as A,ct as j,d as M,dt as te,et as N,f as ne,ft as re,g as ie,gt as ae,ht as oe,i as se,it as ce,j as le,k as ue,lt as de,m as fe,mt as P,n as pe,nt as me,o as he,ot as F,p as ge,pt as _e,q as ve,r as ye,rt as be,s as xe,st as Se,tt as Ce,ut as we,v as Te,vt as Ee,w as De,x as Oe,y as ke,z as Ae}from"./build-CmtlB7pX.js";import{i as je,l as Me,m as Ne}from"./http-DRk8cDjf.js";import{_ as Pe,f as I,ht as Fe,p as L}from"./drizzle-orm-CYU7WOQS.js";import{platformLink as R,secret as z,workspace as B}from"./schema.js";import{Hr as Ie,J as Le,Ur as Re}from"./apps-CCqOsEZH.js";import{h as ze,n as Be,s as Ve}from"./shared-D-KqAi7b.js";import{t as He}from"./store-BpDipcKB.js";import{a as Ue,i as We,t as Ge}from"./metadata-D_bBfr3H.js";import{createECDH as Ke,hkdfSync as qe}from"node:crypto";import{isDeepStrictEqual as Je}from"node:util";function Ye(e,t,n){if(!S(e,t,n))throw new N(`JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint`)}function Xe(e,t,n=!1){if(!e[1]&&!e[2]&&!e[3])throw new N(`either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()`);t!==void 0&&(e[8]=t?.crit);let[,i,a,c,l,d,f,p,m]=e;if(l!==void 0&&v(l,`JWE Additional Authenticated Data`),d!==void 0&&v(d,`JWE Content Encryption Key`),f!==void 0&&v(f,`JWE Initialization Vector`),!n&&i!==void 0&&(i=s(N,i)[0],e[1]=i),a!==void 0&&(a=s(N,a)[0],e[2]=a),!n&&c!==void 0&&(c=s(N,c)[0],e[3]=c),p!==void 0&&!x(p))throw TypeError(`JWE Key Management Parameters must be an object`);Ye(i,a,c);let h={...i,...a,...c};T(N,i),u(N,o,m,i,h),ke(h,i);let{alg:g,enc:_}=h;if(typeof g!=`string`||!g)throw new N(`JWE "alg" (Algorithm) Header Parameter missing or invalid`);let y=Oe[g];if(y?.mode===`integrated-encryption`){if(_!==void 0)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption`);if(d!==void 0)throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${g}`);if(f!==void 0)throw TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${g}`);return[h,void 0,y]}if(typeof _!=`string`||!_)throw new N(`JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid`);return[h,r(_),y]}async function Ze(e,t,n){let[r,i,a]=t,[o,s,c,l,u,d,f,m,,h]=e,g=s,_=c,v=a??y(r.alg),x,S,C;v.mode===`integrated-encryption`?C=await p(v,n,`encrypt`):[C,x,S]=await ee(v,i,n,r,d,m),S&&(h?_=_?{..._,...S}:S:g=g?{...g,...S}:S,Ye(g,_,l));let T=g?w(JSON.stringify(g)):``,E=u?.byteLength?w(u):void 0,D=P(E?`${T}.${E}`:T),O=o;r.zip===`DEF`&&(O=await Te(O).catch(e=>{throw new N(`Failed to compress plaintext`,{cause:e})}));let k,A,j;v.mode===`integrated-encryption`?[x,k]=await v.encrypt(C,O,D,g,r,m):{ciphertext:k,tag:A,iv:j}=await b(i,O,C,f,D);let M={ciphertext:w(k)};return j&&(M.iv=w(j)),A&&(M.tag=w(A)),x?.byteLength&&(M.encrypted_key=w(x)),E&&(M.aad=E),g&&(M.protected=T),l&&(M.unprotected=l),_&&(M.header=_),M}async function Qe(e,t,n){return Ze(e,Xe(e,n),t)}function $e(e){return[e.protected,e.encrypted_key,e.iv,e.ciphertext,e.tag].join(`.`)}const V=[[`verify`],[`sign`]];function et(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:V}}function H(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:V,minRsaBits:2048}}function tt(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:V}}function nt(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:V}}function rt(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:V}}const it=De({HS256:et(256),HS384:et(384),HS512:et(512),RS256:H(256),RS384:H(384),RS512:H(512),PS256:H(256,32),PS384:H(384,48),PS512:H(512,64),ES256:tt(`P-256`,256),ES384:tt(`P-384`,384),ES512:tt(`P-521`,512),EdDSA:nt(),Ed25519:nt(),"ML-DSA-44":rt(44),"ML-DSA-65":rt(65),"ML-DSA-87":rt(87)});function at(t){let n=typeof t==`string`?it[t]:void 0;if(!n)throw new e(`alg ${t} is not supported either by JOSE or your javascript runtime`);return n}function ot(e){return[e&&d(`algorithms`,e.algorithms),e?.crit]}function st(e){return e===void 0?{}:C(e,F,`JWS Protected Header is invalid`)}function ct(e){try{return P(e)}catch{throw new F(`JWS Compact Serialization payload must use only ASCII characters`)}}async function lt(e,t,r,i,o){let{protected:s,header:c,payload:d}=e,f=o??st(s);if(!S(f,c))throw new F(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let h={...f,...c},g=ve(f,u(F,l,t[1],f,h)),{alg:_}=h;if(typeof _!=`string`||!_)throw new F(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);if(t[0]&&!t[0].has(_))throw new E(`"alg" (Algorithm) Header Parameter value not allowed`);if(g){if(typeof d!=`string`)throw new F(`JWS Payload must be a string`)}else if(typeof d!=`string`&&!(d instanceof Uint8Array))throw new F(`JWS Payload must be a string or an Uint8Array instance`);let v=g||typeof d!=`string`?d:i(d),y=!1;typeof r==`function`&&(r=await r(f,e),y=!0);let b=at(_),x=te(s===void 0?new Uint8Array:P(s),P(`.`),typeof v==`string`?t[2]??=n(v,`payload`,F):v),C=Ae(e.signature,`signature`,F),w=await p(b,r,`verify`),T=await m(w,b.subtle,`verify`);b.minRsaBits&&a(b.alg,T);let D=!1;try{D=await crypto.subtle.verify(b.signing,T,C,x)}catch{}if(!D)throw new Se;let O={payload:typeof v==`string`?Ae(v,`payload`,F):v};return s!==void 0&&(O.protectedHeader=f),c!==void 0&&(O.unprotectedHeader=c),y?[{...O,key:w},g]:[O,g]}async function ut(e,t,n){if(e instanceof Uint8Array&&(e=re.decode(e)),typeof e!=`string`)throw new F(`Compact JWS must be a string or Uint8Array`);let{0:r,1:i,2:a,length:o}=e.split(`.`);if(o!==3)throw new F(`Invalid Compact JWS`);return lt({payload:i,protected:r,signature:a},t,n,ct)}const U=e=>Math.floor(e.getTime()/1e3),dt={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},ft=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,W=`check_failed`;function pt(){throw TypeError(`Invalid time period format`)}function mt(e){typeof e!=`string`&&pt();let t=ft.exec(e);(!t||t[4]&&t[1])&&pt();let n=parseFloat(t[2]),r=Math.round(n*dt[t[3][0].toLowerCase()]);return Number.isFinite(r)||pt(),t[1]===`-`||t[4]===`ago`?-r:r}function G(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function ht(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function gt(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function _t(e,t){return typeof e==`number`?G(t,e):e instanceof Date?G(t,U(e)):U(new Date)+mt(e)}const vt=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},yt=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function bt(e,t,n=!1){let r=e[t];if(!(r===void 0&&!n)){if(typeof r!=`number`)throw new j(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function xt(e,t){throw new j(`unexpected "${t}" claim value`,e,t,W)}function St(e,t,n={}){let r;try{r=JSON.parse(ae.decode(t))}catch{}if(!x(r))throw new we(`JWT Claims Set must be a top-level JSON object`);let{typ:i}=n;if(i!==void 0&&(typeof e.typ!=`string`||vt(e.typ)!==vt(i)))throw new j(`unexpected "typ" JWT header value`,r,`typ`,W);let{requiredClaims:a=[],issuer:o,subject:s,audience:c,maxTokenAge:l}=n,u=[...a];l!==void 0&&u.push(`iat`),c!==void 0&&u.push(`aud`),s!==void 0&&u.push(`sub`),o!==void 0&&u.push(`iss`);for(let e of new Set(u.reverse()))if(!Object.hasOwn(r,e))throw new j(`missing required "${e}" claim`,r,e,`missing`);o!==void 0&&!(Array.isArray(o)?o:[o]).includes(r.iss)&&xt(r,`iss`),s!==void 0&&r.sub!==s&&xt(r,`sub`),c!==void 0&&!yt(r.aud,typeof c==`string`?[c]:c)&&xt(r,`aud`);let{clockTolerance:d}=n,f=0;if(typeof d==`string`)f=mt(d);else if(d!==void 0){if(typeof d!=`number`)throw TypeError(`Invalid clockTolerance option type`);f=d}G(`clockTolerance option`,f);let{currentDate:p}=n,m=G(`currentDate option`,U(p===void 0?new Date:p)),h=bt(r,`iat`,l!==void 0),g=bt(r,`nbf`);if(g!==void 0&&g>m+f)throw new j(`"nbf" claim timestamp check failed`,r,`nbf`,W);let _=bt(r,`exp`);if(_!==void 0&&_<=m-f)throw new de(`"exp" claim timestamp check failed`,r,`exp`,W);if(l!==void 0){let e=m-h,t=G(`maxTokenAge option`,typeof l==`number`?l:mt(l));if(e-f>t)throw new de(`"iat" claim timestamp check failed (too far in the past)`,r,`iat`,W);if(e<-f)throw new j(`"iat" claim timestamp check failed (it should be in the past)`,r,`iat`,W)}return r}let Ct;function K(e){return Ct.get(e)}function wt(e){let t=K(e);for(let e of[`iat`,`nbf`,`exp`]){let n=t[e];if(typeof n==`number`&&!Number.isFinite(n))throw TypeError(`"${e}" claim must be a finite number`)}return oe.encode(JSON.stringify(t))}function Tt(e,t){return K(e)[t]}var Et=class{constructor(e={}){if(!x(e))throw TypeError(`JWT Claims Set MUST be an object`);(Ct||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return ht(`iss`,e),K(this).iss=e,this}setSubject(e){return ht(`sub`,e),K(this).sub=e,this}setAudience(e){return gt(e),K(this).aud=e,this}setJti(e){return ht(`jti`,e),K(this).jti=e,this}setNotBefore(e){return K(this).nbf=_t(e,`setNotBefore`),this}setExpirationTime(e){return K(this).exp=_t(e,`setExpirationTime`),this}setIssuedAt(e){let t=K(this);return t.iat=e===void 0?U(new Date):typeof e==`string`?G(`setIssuedAt`,U(new Date)+mt(e)):_t(e,`setIssuedAt`),this}};async function Dt(e,t,n){let[r,i]=await ut(e,ot(n),t);if(!i)throw new we(`JWTs MUST NOT use unencoded payload`);let a=St(r.protectedHeader,r.payload,n);return{...r,payload:a}}async function Ot(e,t,n){let{plaintext:r,...i}=await ie(e,D(n),t),{protectedHeader:a}=i,o=St(a,r,n);for(let e of[`iss`,`sub`,`aud`])if(a[e]!==void 0&&(e===`aud`?JSON.stringify(a.aud)!==JSON.stringify(o.aud):a[e]!==o[e]))throw new j(`replicated "${e}" claim header parameter mismatch`,o,e,`mismatch`);return{payload:o,...i}}const kt=Et;var At=class extends kt{#e=[void 0];#t;#n;#r;setProtectedHeader(e){return f(this.#e[1],`setProtectedHeader`),this.#e[1]=e,this}setKeyManagementParameters(e){return f(this.#e[7],`setKeyManagementParameters`),this.#e[7]=e,this}setContentEncryptionKey(e){return f(this.#e[5],`setContentEncryptionKey`),this.#e[5]=e,this}setInitializationVector(e){return f(this.#e[6],`setInitializationVector`),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#n=!0,this}replicateAudienceAsHeader(){return this.#r=!0,this}async encrypt(e,t){let n=wt(this);this.#e[1]&&(this.#t||this.#n||this.#r)&&(this.#e[1]={...this.#e[1],iss:this.#t?Tt(this,`iss`):void 0,sub:this.#n?Tt(this,`sub`):void 0,aud:this.#r?Tt(this,`aud`):void 0});let r=[...this.#e];return r[0]=n,$e(await Qe(r,e,t))}};async function jt(e){if(t(e))if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`});if(e instanceof Uint8Array)return{kty:`oct`,k:w(e)};if(!h(e))throw TypeError(i(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let n=await crypto.subtle.exportKey(`jwk`,e);delete n.ext,delete n.key_ops,delete n.use,n.kty!==`AKP`&&delete n.alg;for(let e of Object.keys(n))n[e]===void 0&&delete n[e];return n}const q=(e,t)=>{if(typeof e!=`string`||!e)throw new Ce(`${t} missing or invalid`)};async function Mt(t,n){let r;if(x(t)){if(r=g(t),typeof r.kty!=`string`)throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`))}else if(ue(t))r=g(await jt(t));else throw TypeError(i(t,`CryptoKey`,`KeyObject`,`JSON Web Key`));if(n??=`sha256`,n!==`sha256`&&n!==`sha384`&&n!==`sha512`)throw TypeError(`digestAlgorithm must one of "sha256", "sha384", or "sha512"`);let a;switch(r.kty){case`AKP`:q(r.alg,`"alg" (Algorithm) Parameter`),q(r.pub,`"pub" (Public key) Parameter`),a={alg:r.alg,kty:r.kty,pub:r.pub};break;case`EC`:q(r.crv,`"crv" (Curve) Parameter`),q(r.x,`"x" (X Coordinate) Parameter`),q(r.y,`"y" (Y Coordinate) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case`OKP`:q(r.crv,`"crv" (Subtype of Key Pair) Parameter`),q(r.x,`"x" (Public Key) Parameter`),a={crv:r.crv,kty:r.kty,x:r.x};break;case`RSA`:q(r.e,`"e" (Exponent) Parameter`),q(r.n,`"n" (Modulus) Parameter`),a={e:r.e,kty:r.kty,n:r.n};break;case`oct`:if(typeof r.k!=`string`)throw new Ce(`"k" (Key Value) Parameter missing or invalid`);a={k:r.k,kty:r.kty};break;default:throw new e(`"kty" (Key Type) Parameter missing or unsupported`)}let o=P(JSON.stringify(a));return w(await _e(n,o))}function Nt(e,t,n,r){let{kty:i,key_ops:a,ext:o,kid:s,alg:c,use:l,crv:u}=e;return(o===void 0||typeof o==`boolean`)&&(a===void 0||Array.isArray(a)&&a.every((e,t)=>typeof e==`string`&&a.indexOf(e)===t)&&a.includes(`verify`))&&t.kty.includes(i)&&(r===void 0||typeof r==`string`&&r===s)&&(c===void 0?i!==`AKP`:n===c)&&(l===void 0||l===`sig`)&&(!t.crv||u===t.crv)}async function Pt(e,t,n){let r=e.get(t)||e.set(t,{}).get(t),{alg:i}=n;if(r[i]===void 0){let e=le(n,t,!0).then(e=>{if(e.type!==`public`)throw new me(`JSON Web Key Set members must be public keys`);return r[i]=e,e}).catch(t=>{throw r[i]===e&&delete r[i],t});r[i]=e}return r[i]}function Ft(t){let n;try{n=structuredClone(t)}catch{}if(!c(n))throw new me(`JSON Web Key Set malformed`);let r=n.keys.map(e=>{let t=g(e);return Array.isArray(t.key_ops)&&(t.key_ops=[...t.key_ops]),t}),i=new WeakMap;return Object.defineProperty(async(t,a)=>{let{alg:o,kid:s}={...t,...a?.header},c=typeof o==`string`?it[o]:void 0;if(!c||c.secret)throw new e(`Unsupported "alg" value for a JSON Web Key Set`);let l=n.keys.filter((e,t)=>Nt(r[t],c,o,s)),{0:u,length:d}=l;if(!d)throw new ce;if(d!==1){let e=new be;throw e[Symbol.asyncIterator]=async function*(){for(let e of l)try{yield await Pt(i,e,c)}catch{}},e}return Pt(i,u,c)},"jwks",{value:()=>structuredClone(n)})}function It(){return typeof WebSocketPair<`u`||typeof navigator<`u`&&navigator.userAgent===`Cloudflare-Workers`||typeof EdgeRuntime<`u`&&EdgeRuntime===`vercel`}let Lt;(typeof navigator>`u`||!navigator.userAgent?.startsWith?.(`Mozilla/5.0 `))&&(Lt=`jose/v6.2.12`);const Rt=Symbol();async function zt(e,t,n,r=fetch){let i=await r(e,{method:`GET`,signal:n,redirect:`manual`,headers:t}).catch(e=>{throw e.name===`TimeoutError`?new k:e});if(i.status!==200)throw new _(`Expected 200 OK from the JSON Web Key Set HTTP response`);try{return await i.json()}catch{throw new _(`Failed to parse the JSON Web Key Set HTTP response as JSON`)}}const Bt=Symbol();function J(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Vt(e,t,n){if(Number.isNaN(e))throw TypeError(`"${n}" option must not be NaN`);return typeof e==`number`?e:t}function Ht(e,t){if(!(e instanceof URL))throw TypeError(`url must be an instance of URL`);let n=new URL(e.href).href,r=t??{},i=r.timeoutDuration;if(typeof i==`number`&&(!Number.isInteger(i)||i<0))throw TypeError(`"timeoutDuration" option must be a non-negative integer`);let a=typeof i==`number`?i:5e3,o=Vt(r.cooldownDuration,3e4,`cooldownDuration`),s=Vt(r.cacheMaxAge,6e5,`cacheMaxAge`),l=new Headers(r.headers);Lt&&!l.has(`User-Agent`)&&l.set(`User-Agent`,Lt),l.has(`accept`)||l.set(`accept`,`application/json, application/jwk-set+json`);let u=r[Rt],d=r[Bt],f,p,m=0,h=0,g;if(d&&typeof d==`object`){let{uat:e,jwks:t}=d;J(e,s)&&c(t)&&(f=e,g=Ft(t))}let _=async()=>{if(p&&It()&&(p=void 0),!p){let e=++m,t=p=zt(n,l,AbortSignal.timeout(a),u).then(t=>{let n=Ft(t);if(e<=h)return;g=n;let r=Date.now();d&&(d.uat=r,d.jwks=t),f=r,h=e}).finally(()=>{p===t&&(p=void 0)})}await p};return Object.defineProperties(async(e,t)=>{(!g||!J(f,s))&&await _();try{return await g(e,t)}catch(n){if(n instanceof ce&&!J(f,o))return await _(),g(e,t);throw n}},{coolingDown:{get:()=>J(f,o),enumerable:!0},fresh:{get:()=>J(f,s),enumerable:!0},reload:{value:_,enumerable:!0},reloading:{get:()=>!!p,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}const Ut=`coder`,Y=`${Ut}.session`,X=`${Ut}.oidc`,Z=`${Ut}.operator`,Wt=3800,Gt=2592e3,Kt=3600,Q=()=>Math.floor(Date.now()/1e3);function $(e){let t=new Map;for(let n of(e.get(`cookie`)??``).split(/;\s*/)){let e=n.indexOf(`=`);e>0&&t.set(n.slice(0,e),n.slice(e+1))}return t}function qt(e){let t=[];for(;e.has(`${Y}.${t.length}`);)t.push(`${Y}.${t.length}`);return t}function Jt(e){let t=$(e);return t.get(Y)??(qt(t).map(e=>t.get(e)).join(``)||void 0)}function Yt(e){return Array.isArray(e)?e.flatMap(e=>typeof e?.id==`string`&&typeof e.role==`string`?[{id:e.id,slug:String(e.slug??e.id),name:String(e.name??e.slug??e.id),role:e.role}]:[]):[]}function Xt(e){let t=(e?.orgs.find(t=>t.id===e.org)??e?.orgs[0])?.slug;return t?`/dash/${encodeURIComponent(t)}/operator`:`/dash/operator`}function Zt(e,t,n){let r=e.get(`x-coder-organization`);if(r)return Ie(t,r);let i=t.organizations.find(e=>e.id===n)??t.organizations[0];return i?{...t,organizationId:i.id,role:i.role}:t}async function Qt(e,t){let n=t.auth.wular.url,r=t.publicUrl,i=new URL(r).origin,a=r.startsWith(`https:`),o=await tn(t),s=`${r}${Ge}`,c=(e,t,n)=>`${e}=${t}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${n}${a?`; Secure`:``}`,l=(e,t)=>new At(e).setProtectedHeader({alg:`dir`,enc:`A256GCM`}).setIssuedAt().setExpirationTime(`${t}s`).encrypt(o.cookie[0]);async function u(e){if(e)for(let t of o.cookie)try{return(await Ot(e,t)).payload}catch{}}async function d(e,t){let n=await l(t,Gt),r=qt($(e));if(n.length<=Wt)return[c(Y,n,Gt),...r.map(e=>c(e,``,0))];let i=n.match(RegExp(`.{1,${Wt}}`,`g`));return[c(Y,``,0),...i.map((e,t)=>c(`${Y}.${t}`,e,Gt)),...r.slice(i.length).map(e=>c(e,``,0))]}let f=e=>[Y,...qt($(e))].map(e=>c(e,``,0)),p,m=()=>p??=A(new URL(n),`${r}${Ue}`,void 0,pe(o.client),new URL(n).protocol===`http:`?{execute:[ye]}:void 0).catch(e=>{throw p=void 0,e}),h,g=async()=>h??=Ht(new URL((await m()).serverMetadata().jwks_uri));function v(e,t){let n=e.claims();if(!n)throw Error(`Wular Auth returned no ID token`);let r=Yt(n.organizations),i=e=>r.find(t=>t.id===e)?.id;return{sub:n.sub,name:typeof n.name==`string`?n.name:``,email:typeof n.email==`string`?n.email:``,orgs:r,org:i(t?.org)??i(n.org)??r[0]?.id,exp_at:Q()+(e.expires_in??600),at:Q(),rt:e.refresh_token??t?.rt,idt:e.id_token??t?.idt}}let y=async t=>{try{t.length&&await e.insert(B).values(t.map(({id:e,slug:t,name:n})=>({organizationId:e,slug:t,name:n}))).onConflictDoUpdate({target:B.organizationId,set:{slug:Fe`excluded.slug`,name:Fe`excluded.name`}})}catch(e){console.error(`coder server: saving organizations failed`,e)}},b=new Map;function x(t){let n=t.rt;if(!n)return Promise.resolve(void 0);let r=b.get(n);return r||(r=m().then(e=>fe(e,n)).then(e=>v(e,t)).then(n=>(Je(n.orgs,t.orgs)||y(n.orgs),nn(e,n.sub,n.orgs),n)).catch(e=>(b.delete(n),e instanceof Ee&&e.error===`invalid_grant`?!1:void 0)),b.set(n,r),setTimeout(()=>b.delete(n),6e4).unref?.()),r.then(e=>e&&e.orgs.some(e=>e.id===t.org)?{...e,org:t.org}:e)}async function S(e,t,r){let a=(await g().then(t=>Dt(e,t,{issuer:n,audience:i,typ:`at+jwt`})).catch(e=>{(!(e instanceof _)||e instanceof k||e.code===`ERR_JOSE_GENERIC`)&&console.error(`coder server: bearer verification unavailable`,e)}))?.payload;if(!a?.sub)return;let o={user:{id:a.sub,name:``,email:``},organizations:Yt(a.organizations)};return r&&Q()-(a.iat??0)>60?{...o,stale:!0}:Zt(t,o,typeof a.org==`string`?a.org:void 0)}async function C(e){let t=await m().catch(()=>void 0);if(!t)return Response.redirect(`${r}/login?error=unavailable`,302);let n=e.searchParams.get(`operator`)===`1`,a=e.searchParams.get(`prompt`)===`login`,o={verifier:ne(),state:ge(),nonce:M(),return:n?`/dash`:Ne(e.searchParams.get(`return`),i),...n?{operator:n}:{}},u=O(t,{redirect_uri:s,...n?{scope:`openid`,prompt:`login`}:{scope:We},...a?{prompt:`login`}:{},code_challenge:await xe(o.verifier),code_challenge_method:`S256`,state:o.state,nonce:o.nonce});return new Response(null,{status:302,headers:{location:u.href,"set-cookie":c(X,await l(o,600),600)}})}async function w(t,n){let r=e=>{let t=new Headers({location:`/login?error=${encodeURIComponent(e)}`});return t.append(`set-cookie`,c(X,``,0)),new Response(null,{status:302,headers:t})},i=await u($(t.headers).get(X));if(!i)return r(`expired`);let a=n.searchParams.get(`error`);if(a)return r(a);let o,l;try{let e=await se(await m(),new URL(`${s}${n.search}`),{pkceCodeVerifier:i.verifier,expectedState:i.state,expectedNonce:i.nonce,idTokenExpected:!0});o=v(e),l=e.claims()?.auth_time}catch{return r(`sign_in_failed`)}if(i.operator)return E(t,o.sub,l);await Promise.all([y(o.orgs),nn(e,o.sub,o.orgs)]);let f=new Headers({location:i.return});f.append(`set-cookie`,c(X,``,0));for(let e of await d(t.headers,o))f.append(`set-cookie`,e);return new Response(null,{status:302,headers:f})}let T=e=>l(e,e.at+Kt-e.seen).then(t=>c(Z,t,e.at+Kt-e.seen));async function E(e,n,r){let a=await u(Jt(e.headers)),o=Q(),s=typeof r==`number`&&o-r<=60,l=s&&a?.sub===n&&t.operators?.includes(n);l||console.error(`coder server: operator sign-in refused: ${s?`not this session or not an operator`:`auth_time ${typeof r==`number`?`${o-r}s old`:`missing`}`}`);let d=new Headers({location:`${Xt(a)}?${l?`entered=1`:`error=${s?`denied`:`stale`}`}`});return d.append(`set-cookie`,c(X,``,0)),l&&d.append(`set-cookie`,await T({sub:n,aud:i,at:o,seen:o})),new Response(null,{status:302,headers:d})}async function D(e){if(!Le(e,r))return je();let t=await u(Jt(e.headers)),n=await m().catch(()=>void 0),i=`${r}/?signed_out=1`,a=n?.serverMetadata().end_session_endpoint&&t?.idt?he(n,{id_token_hint:t.idt,post_logout_redirect_uri:i}).href:i,o=Response.json({url:a});for(let t of f(e.headers))o.headers.append(`set-cookie`,t);return o.headers.append(`set-cookie`,c(Z,``,0)),o}return{issuer:n,jwks:o.jwks,handler(e){let t=new URL(e.url);return t.pathname===`/api/auth/sign-in`&&e.method===`GET`?C(t):t.pathname===`/api/auth/callback`&&e.method===`GET`?w(e,t):t.pathname===`/api/auth/sign-out`&&e.method===`POST`?D(e):Promise.resolve(Me())},async session(e,t=!1,n=[]){let r=e.get(`authorization`);if(r?.startsWith(`Bearer `))return S(r.slice(7),e,t);let i=await u(Jt(e));if(i){if(i.exp_at<=Q()||t&&Q()-i.at>60){let t=await x(i);if(t===!1&&n.push(...f(e)),!t)return;i=t,n.push(...await d(e,i))}return Zt(e,{user:{id:i.sub,name:i.name,email:i.email},organizations:i.orgs},i.org)}},async operator(e,t=[]){let n=$(e).get(Z),r=await u(n),a=Q();if(!r||r.aud!==i||a-r.seen>900||a>=r.at+Kt){n&&t.push(c(Z,``,0));return}return t.push(await T({...r,seen:a})),r.sub},async setOrganization(e,t,n=[]){let r=await u(Jt(e));r&&r.exp_at<=Q()&&(r=await x(r)||void 0);let i=r?.orgs.find(e=>e.slug===t);if(!(!r||!i))return r.org!==i.id&&n.push(...await d(e,{...r,org:i.id})),i},async organization(t){let[n]=await e.select({slug:B.slug,name:B.name}).from(B).where(L(B.organizationId,t));return n?.slug?{slug:n.slug,name:n.name??``}:void 0}}}const $t=(e,t)=>new Uint8Array(qe(`sha256`,e,``,t,32));async function en(e){let t=$t(e,`coder oidc client key`),n=Ke(`prime256v1`);n.setPrivateKey(t);let r=n.getPublicKey(),i={kty:`EC`,crv:`P-256`,x:Buffer.from(r.subarray(1,33)).toString(`base64url`),y:Buffer.from(r.subarray(33)).toString(`base64url`)},a=await crypto.subtle.importKey(`jwk`,{...i,d:Buffer.from(t).toString(`base64url`)},{name:`ECDSA`,namedCurve:`P-256`},!1,[`sign`]),o=await Mt(i);return{key:a,kid:o,jwk:{...i,kid:o,alg:`ES256`,use:`sig`}}}async function tn(e){let t=[e.encryptionKey,e.previousEncryptionKey].filter(e=>!!e),n=await Promise.all(t.map(en));return{cookie:t.map(e=>$t(e,`coder session cookie`)),client:n[0],jwks:{keys:n.map(e=>e.jwk)}}}async function nn(e,t,n){let r=Re(n);try{await e.update(R).set(r).where(I(L(R.userId,t),Fe`(${R.organizations}, ${R.roles}) is distinct from (${JSON.stringify(r.organizations)}::jsonb, ${JSON.stringify(r.roles)}::jsonb)`))}catch(e){console.error(`coder server: updating linked accounts failed`,e)}}function rn(e){let t=t=>t instanceof He?t.db:e,n=(t,n,r)=>t instanceof He?t.transaction(n,e=>r(e.db)):e.transaction(e=>r(e)),r=async(e,n)=>(await t(e).select({row:R,token:z.value}).from(R).leftJoin(z,L(z.id,R.tokenSecretId)).where(n)).map(({row:e,token:t})=>({userId:e.userId,platform:e.platform,platformUserId:e.platformUserId,name:e.name,email:e.email,...e.organizations?{organizations:e.organizations}:{},...e.organizationId?{organizationId:e.organizationId}:{},...e.login?{login:e.login}:{},...t?{token:t}:{},...e.refusedAt?{refusedAt:e.refusedAt.getTime()}:{}}));return{link(e,t,r,i={},a){let o={name:e.name,email:e.email,...i.organizations?{organizations:i.organizations}:{},...i.roles?{roles:i.roles}:{},...i.login?{login:i.login}:{},...i.token?{organizationId:i.organizationId??null}:{}};return n(a,`link:${t}:${r}`,async n=>{let[a]=await n.insert(R).values({platform:t,platformUserId:r,userId:e.id,...o}).onConflictDoUpdate({target:[R.platform,R.platformUserId],set:{...o,...i.token?{refusedAt:null}:{}},setWhere:L(R.userId,e.id)}).returning({id:R.id,userId:R.userId,tokenSecretId:R.tokenSecretId});return a?.userId===e.id?(i.token&&a.tokenSecretId?await ze(n,a.tokenSecretId,i.token):i.token&&await n.update(R).set({tokenSecretId:await Be(n,i.token)}).where(L(R.id,a.id)),`linked`):`taken`})},linkedAccounts:(e,t)=>r(t,L(R.userId,e)),organizationAccounts:(e,t)=>r(t,Fe`${R.organizations} @> ${JSON.stringify([e])}::jsonb`),unlink(e,t,r,i){return n(i,`link:${t}:${r}`,async n=>{let i=await n.delete(R).where(I(L(R.userId,e),L(R.platform,t),L(R.platformUserId,r))).returning({secretId:R.tokenSecretId});await Ve(n,i.map(e=>e.secretId))})},async refreshLinkedToken(e,n,r,i,a,o){let s=t(o).select({id:R.tokenSecretId}).from(R).where(I(L(R.userId,e),L(R.platform,n),L(R.platformUserId,r))),[c]=await t(o).update(z).set({value:a}).where(I(Pe(z.id,s),L(z.value,i))).returning({id:z.id});return!!c},async refuseLinkedToken(e,n,r,i,a){await t(a).update(R).set({refusedAt:new Date}).where(I(L(R.userId,e),L(R.platform,n),L(R.platformUserId,r),Pe(R.tokenSecretId,t(a).select({id:z.id}).from(z).where(L(z.value,i)))))},async linkedUser(t,n){let[r]=await e.select({id:R.userId,name:R.name,email:R.email,organizations:R.organizations,roles:R.roles,login:R.login,token:z.value}).from(R).leftJoin(z,L(z.id,R.tokenSecretId)).where(I(L(R.platform,t),L(R.platformUserId,n)));return r&&{id:r.id,name:r.name,email:r.email,...r.organizations?{organizations:r.organizations}:{},...r.roles?{roles:r.roles}:{},...r.login?{login:r.login}:{},...r.token?{token:r.token}:{}}}}}async function an(e,t){return{...await Qt(e,t),...rn(e)}}export{an as createAuth};

package/dist/{chat-czruXAt3.js → chat-BD2Fu3jU.js}

@@ -1,4 +1,4 @@
-import{S as e,f as t,ht as n,m as r,p as i,w as a,y as o}from"./drizzle-orm-CYU7WOQS.js";import{chatItem as s,chatState as c}from"./schema.js";import{i as l}from"./client-nBo9Mhsr.js";import{p as u}from"./shared-BzNReirj.js";import{randomUUID as d}from"node:crypto";var f=class{db;now;constructor(e,t=Date.now){this.db=e,this.now=t}at(e){return e?new Date(this.now()+e):null}stamp(e){return e===void 0?null:new Date(this.now()+e).toISOString()}live(){return a(o(c.expiresAt),r(c.expiresAt,new Date(this.now())))}expired(){return e(c.expiresAt,new Date(this.now()))}async read(e){let[r]=await l(this.db,()=>this.db.select({value:n`${c.value}`}).from(c).where(t(i(c.key,e),this.live())));return r?.value}async claim(e,t,n){return(await this.db.insert(c).values({key:e,value:t,expiresAt:n}).onConflictDoUpdate({target:c.key,set:{value:t,expiresAt:n},setWhere:this.expired()}).returning({key:c.key})).length>0}async connect(){}async disconnect(){}async get(e){return await this.read(`k:${e}`)??null}async set(e,t,n){let r={value:t,expiresAt:this.at(n)};await this.db.insert(c).values({key:`k:${e}`,...r}).onConflictDoUpdate({target:c.key,set:r})}setIfNotExists(e,t,n){return this.claim(`k:${e}`,t,this.at(n))}async delete(e){await this.db.execute(n`with items as (delete from ${s} where key = ${`k:${e}`}) delete from ${c} where key = ${`k:${e}`}`)}async appendToList(e,t,r={}){let i=`k:${e}`,a=r.maxLength?n`or seq <= coalesce((select seq from ${s} where key = ${i} order by seq desc offset ${r.maxLength-1} limit 1), -1)`:n``;await this.db.execute(n`
+import{S as e,f as t,ht as n,m as r,p as i,w as a,y as o}from"./drizzle-orm-CYU7WOQS.js";import{chatItem as s,chatState as c}from"./schema.js";import{i as l}from"./client-nBo9Mhsr.js";import{p as u}from"./shared-D-KqAi7b.js";import{randomUUID as d}from"node:crypto";var f=class{db;now;constructor(e,t=Date.now){this.db=e,this.now=t}at(e){return e?new Date(this.now()+e):null}stamp(e){return e===void 0?null:new Date(this.now()+e).toISOString()}live(){return a(o(c.expiresAt),r(c.expiresAt,new Date(this.now())))}expired(){return e(c.expiresAt,new Date(this.now()))}async read(e){let[r]=await l(this.db,()=>this.db.select({value:n`${c.value}`}).from(c).where(t(i(c.key,e),this.live())));return r?.value}async claim(e,t,n){return(await this.db.insert(c).values({key:e,value:t,expiresAt:n}).onConflictDoUpdate({target:c.key,set:{value:t,expiresAt:n},setWhere:this.expired()}).returning({key:c.key})).length>0}async connect(){}async disconnect(){}async get(e){return await this.read(`k:${e}`)??null}async set(e,t,n){let r={value:t,expiresAt:this.at(n)};await this.db.insert(c).values({key:`k:${e}`,...r}).onConflictDoUpdate({target:c.key,set:r})}setIfNotExists(e,t,n){return this.claim(`k:${e}`,t,this.at(n))}async delete(e){await this.db.execute(n`with items as (delete from ${s} where key = ${`k:${e}`}) delete from ${c} where key = ${`k:${e}`}`)}async appendToList(e,t,r={}){let i=`k:${e}`,a=r.maxLength?n`or seq <= coalesce((select seq from ${s} where key = ${i} order by seq desc offset ${r.maxLength-1} limit 1), -1)`:n``;await this.db.execute(n`
       with added as (insert into ${s} (key, value, expires_at) values (${i}, ${JSON.stringify(t)}::jsonb, ${this.stamp(r.ttlMs)}::timestamptz))
       delete from ${s} where key = ${i} and ((select expires_at from ${s} where key = ${i} order by seq desc limit 1) <= ${this.stamp(0)}::timestamptz ${a})`)}async getList(e){let t=`k:${e}`;return(await l(this.db,()=>u(this.db,n`
       with newest as (select expires_at from ${s} where key = ${t} order by seq desc limit 1)

package/dist/cli.js

@@ -16,8 +16,8 @@ import{ba as e,da as t,ga as n,l as r,la as i,ma as a,nr as o,r as s,u as c,ya a
 `):o.layout===`inline`?e.slice(r,s).map(e=>`${l.bold(e.usage)}  ${l.dim(e.blurb)}`).join(`
 `):o.layout===`rows`?[l.bold(`${o.title??`Related`}:`),...n.slice(r,s)].join(`
 `):b(u,l,o.paint===`cyan`?l.cyan:l.blue,o.title);c.write(`${o.prefix??`
-`}${d}\n`),r=s}}async function V(e){let{DEFAULT_SERVER:t,validateServer:n}=await import(`./session-D7eeJIaH.js`).then(e=>e.s),r=n(e);return r===t?`Sign in: coder auth login`:`Sign in: coder auth login --server ${r}`}async function H(e,t=!1){let{isKnownServer:n,rememberServer:r,validateServer:i}=await import(`./session-D7eeJIaH.js`).then(e=>e.s),a=i(e);if(n(a))return a;if(!t){if(!S())throw new m(`invalid-option`,`First use of Coder server ${new URL(a).origin} needs confirmation.`,{hint:`Inspect the origin, then repeat with --yes.`});if((await x({title:`Connect to ${new URL(a).origin}?`,hint:`This server can receive task and agent data.`,options:[{value:`yes`,label:`Continue`},{value:`no`,label:`Cancel`}]}))[0]!==`yes`)throw new m(`invalid-option`,`Server connection cancelled.`)}return r(a),a}function U(e){T.stderr.write(`[coder] No engine could start. Follow fallback.instructions with a native subagent.
-`),g(e)}function W(e,t=!1){let n=`read-only unavailable on this host: the OS sandbox failed to start (Linux/WSL2 needs bubblewrap + socat). Re-dispatch with --access auto if writes are acceptable, or install the sandbox deps.`;t?g({error:n,code:`read-only-unavailable`,detail:e}):T.stderr.write(`[coder] ${n}\n`),T.exit(1)}function G(e,t,n,i){let a=r(i);return z([`Approve: coder task approve ${t} ${n.id}${a}`,`Deny: coder task approve ${t} ${n.id} --deny --reason "<why>"${a}`,`Then wait again in its own background shell, one per task: coder task result ${t} --wait${a}`,`The decision reaches the task as a message, any time.`])}function K(e,t){return Error(JSON.stringify({...typeof e==`object`&&e?e:{result:e},next:t.map(({usage:e,blurb:t})=>({usage:e,blurb:t}))}))}async function re(e,t,n,r){if(r.json)g({taskId:t,status:`awaiting-approval`,approval:n});else{let{actionLines:i}=await import(`./approvals-C8XV7CK2.js`).then(e=>e.u),a=G(e,t,n,r).map(e=>e.cli.text);T.stdout.write(`Approval needed for task ${t}: ${n.reason}\n`),T.stdout.write(`${i(n.actions)}\n`),T.stderr.write(`\n${b(a,y,y.blue,`Next steps`)}\n`)}T.exit(4)}async function ie(e,t,n){switch(e.code){case`chain-exhausted`:U(e.payload),T.exit(3);case`read-only-unavailable`:W(e.message,n.json);case`approval-pending`:return re(t,e.taskId,e.approval,n);case`startup-failed`:n.json&&(g({taskId:e.taskId,status:`failed`,detail:e.message}),T.exit(1)),_(`Task ${e.taskId} failed to start.${e.message?`\n${e.message}`:``}`,{hint:`See: coder task result ${e.taskId}`});case`login-failed`:_(e.message,{hint:[await V(n.server),`Or, for a memory server, set the same ADMIN_TOKEN it was started with`]});case`server`:_(e.message,{hint:e.hint??(e.status===401?await V(n.server):void 0)});default:_(e.message,e.hint?{hint:e.hint}:{})}}function ae(t){let n=Object.entries(R).filter(([e])=>t.globalFlags?.[e]!==!1),r={...t.args,...Object.fromEntries(n)},i=t.cli?.positional??[],a=(e,n)=>{let{cwd:r}=e,a=e;return{options:e,args:i.flatMap(e=>a[e]??[]),cwd:r?w.resolve(r):T.cwd(),tool:n,next(r,i){!n&&(!e.json||i?.force)&&B(t.next?.({result:r,args:e})??[],i)}}},o=async e=>{let n=e.options;return n.server!==void 0&&await H(n.server,n.yes),t.run(e)},s=e({name:t.name,description:t.description,...t.usage?{usage:t.usage}:{},access:t.access,args:r,...t.cli?{cli:t.cli}:{},...t.mcp===!1?{mcp:!1}:{},...t.mcp===!1?{}:{mcp:{text:e=>typeof e.output==`string`?e.output:JSON.stringify(e.output)??``}},async run(e){let n=a(e,!0),r;try{r=await o(n)}catch(e){throw e instanceof m&&e.code===`approval-pending`&&e.taskId&&e.approval?K({taskId:e.taskId,status:`awaiting-approval`,approval:e.approval},G(n.cwd,e.taskId,e.approval,n.options)):e}let i=t.json?t.json(r,n):r;if(t.exit?.(r,n))throw K(i,t.next?.({result:r,args:e})??[]);return{value:r,output:i}},next:({result:e,args:n})=>t.next?.({result:e.value,args:n})??[]}),c=async e=>{let n;try{n=u(s,e)}catch(e){if(!(e instanceof f))throw e;let{cli:n}=await import(`./cmd-C1gHyVG7.js`),r=p(n).commands.find(e=>e.command.run===s.run)?.path??[t.name];throw new m(`invalid-option`,e.message,{hint:`Help: coder ${r.join(` `)} --help`})}let r=a(n,!1),i;try{i=await o(r)}catch(e){throw e instanceof m&&await ie(e,r.cwd,r.options),e}if(n.json&&i!==void 0)g(t.json?t.json(i,r):i);else{let e=t.print?.(i,r);e&&typeof e.then==`function`&&await e,r.next(i),await t.afterNext?.(i,r)}let c=t.exit?.(i,r);c!==void 0&&(T.exitCode=c)};return Object.defineProperty(c,"name",{value:t.name,writable:!0,enumerable:!0}),Object.assign(c,s,t.approvalPolicy?{approvalPolicy:t.approvalPolicy}:{})}function oe({usage:e,...t}){let r=async e=>{let{cli:n}=await import(`./cmd-C1gHyVG7.js`);return Z([...p(n).namespaces.find(e=>e.namespace.name===t.name&&e.namespace.commands===t.commands)?.path??[t.name],...e])};return Object.defineProperty(r,"name",{value:t.name,writable:!0,enumerable:!0}),Object.assign(r,n({...t,...e?{usage:e}:{}}))}const q={"task worker":async()=>(await import(`./worker-DJANNSCT.js`)).commandWorker,"task mcp":async()=>(await import(`./mcp-CrtKQoVi.js`)).commandTaskMcp,"task hook":async()=>(await import(`./hook-DN__zYOG.js`)).commandTaskHook,"task tools":async()=>(await import(`./tools-Ck-ZWtmB.js`)).commandTools,"task tools-search":async()=>(await import(`./tools-search-BNDea9vZ.js`)).commandToolsSearch,"flow drive":async()=>(await import(`./drive-B7SBFfcb.js`)).commandDrive,"upgrade refresh":async()=>(await import(`./refresh-CWEpTAkD.js`)).commandRefreshUpdate};async function J(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-C1gHyVG7.js`),r=n[e[0]];return d(t,r?[...r,...e.slice(1)]:e)}async function Y(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-C1gHyVG7.js`);return`command`in e?P(e.command,t):N(e.namespace,t,n)}async function se(e){let t=await J(e.split(` `));return t&&!t.rest.length?Y(t):null}const X=()=>F({...ne,globals:[{usage:`-h, --help`,blurb:`show help (top-level, or for a command)`},{usage:`-v, --version`,blurb:`print the coder version`},...Object.entries(R).map(([e,t])=>k(e,t))]},a());async function ce(e){let{cloudApp:t}=await import(`./context-C1XBbfEL.js`),n=e[0]===`help`?e.slice(1):e,r=d(t,n),i=e=>{e!==void 0&&!I([e])&&_(`Unknown command "${e}".`,{hint:`See all commands: coder --help`})};if(!r){i(n[0]);let e=p(t).commands.flatMap(e=>e.command.mcp===!1?[]:[{usage:`coder ${e.path.join(` `)}`,blurb:e.command.description}]);T.stdout.write(`${[t.description,``,v.bold(`Commands:`),...j(e,v)].join(`
+`}${d}\n`),r=s}}async function V(e){let{DEFAULT_SERVER:t,validateServer:n}=await import(`./session-BMbMzzPu.js`).then(e=>e.s),r=n(e);return r===t?`Sign in: coder auth login`:`Sign in: coder auth login --server ${r}`}async function H(e,t=!1){let{isKnownServer:n,rememberServer:r,validateServer:i}=await import(`./session-BMbMzzPu.js`).then(e=>e.s),a=i(e);if(n(a))return a;if(!t){if(!S())throw new m(`invalid-option`,`First use of Coder server ${new URL(a).origin} needs confirmation.`,{hint:`Inspect the origin, then repeat with --yes.`});if((await x({title:`Connect to ${new URL(a).origin}?`,hint:`This server can receive task and agent data.`,options:[{value:`yes`,label:`Continue`},{value:`no`,label:`Cancel`}]}))[0]!==`yes`)throw new m(`invalid-option`,`Server connection cancelled.`)}return r(a),a}function U(e){T.stderr.write(`[coder] No engine could start. Follow fallback.instructions with a native subagent.
+`),g(e)}function W(e,t=!1){let n=`read-only unavailable on this host: the OS sandbox failed to start (Linux/WSL2 needs bubblewrap + socat). Re-dispatch with --access auto if writes are acceptable, or install the sandbox deps.`;t?g({error:n,code:`read-only-unavailable`,detail:e}):T.stderr.write(`[coder] ${n}\n`),T.exit(1)}function G(e,t,n,i){let a=r(i);return z([`Approve: coder task approve ${t} ${n.id}${a}`,`Deny: coder task approve ${t} ${n.id} --deny --reason "<why>"${a}`,`Then wait again in its own background shell, one per task: coder task result ${t} --wait${a}`,`The decision reaches the task as a message, any time.`])}function K(e,t){return Error(JSON.stringify({...typeof e==`object`&&e?e:{result:e},next:t.map(({usage:e,blurb:t})=>({usage:e,blurb:t}))}))}async function re(e,t,n,r){if(r.json)g({taskId:t,status:`awaiting-approval`,approval:n});else{let{actionLines:i}=await import(`./approvals-C8XV7CK2.js`).then(e=>e.u),a=G(e,t,n,r).map(e=>e.cli.text);T.stdout.write(`Approval needed for task ${t}: ${n.reason}\n`),T.stdout.write(`${i(n.actions)}\n`),T.stderr.write(`\n${b(a,y,y.blue,`Next steps`)}\n`)}T.exit(4)}async function ie(e,t,n){switch(e.code){case`chain-exhausted`:U(e.payload),T.exit(3);case`read-only-unavailable`:W(e.message,n.json);case`approval-pending`:return re(t,e.taskId,e.approval,n);case`startup-failed`:n.json&&(g({taskId:e.taskId,status:`failed`,detail:e.message}),T.exit(1)),_(`Task ${e.taskId} failed to start.${e.message?`\n${e.message}`:``}`,{hint:`See: coder task result ${e.taskId}`});case`login-failed`:_(e.message,{hint:[await V(n.server),`Or, for a memory server, set the same ADMIN_TOKEN it was started with`]});case`server`:_(e.message,{hint:e.hint??(e.status===401?await V(n.server):void 0)});default:_(e.message,e.hint?{hint:e.hint}:{})}}function ae(t){let n=Object.entries(R).filter(([e])=>t.globalFlags?.[e]!==!1),r={...t.args,...Object.fromEntries(n)},i=t.cli?.positional??[],a=(e,n)=>{let{cwd:r}=e,a=e;return{options:e,args:i.flatMap(e=>a[e]??[]),cwd:r?w.resolve(r):T.cwd(),tool:n,next(r,i){!n&&(!e.json||i?.force)&&B(t.next?.({result:r,args:e})??[],i)}}},o=async e=>{let n=e.options;return n.server!==void 0&&await H(n.server,n.yes),t.run(e)},s=e({name:t.name,description:t.description,...t.usage?{usage:t.usage}:{},access:t.access,args:r,...t.cli?{cli:t.cli}:{},...t.mcp===!1?{mcp:!1}:{},...t.mcp===!1?{}:{mcp:{text:e=>typeof e.output==`string`?e.output:JSON.stringify(e.output)??``}},async run(e){let n=a(e,!0),r;try{r=await o(n)}catch(e){throw e instanceof m&&e.code===`approval-pending`&&e.taskId&&e.approval?K({taskId:e.taskId,status:`awaiting-approval`,approval:e.approval},G(n.cwd,e.taskId,e.approval,n.options)):e}let i=t.json?t.json(r,n):r;if(t.exit?.(r,n))throw K(i,t.next?.({result:r,args:e})??[]);return{value:r,output:i}},next:({result:e,args:n})=>t.next?.({result:e.value,args:n})??[]}),c=async e=>{let n;try{n=u(s,e)}catch(e){if(!(e instanceof f))throw e;let{cli:n}=await import(`./cmd-BH1bmZGs.js`),r=p(n).commands.find(e=>e.command.run===s.run)?.path??[t.name];throw new m(`invalid-option`,e.message,{hint:`Help: coder ${r.join(` `)} --help`})}let r=a(n,!1),i;try{i=await o(r)}catch(e){throw e instanceof m&&await ie(e,r.cwd,r.options),e}if(n.json&&i!==void 0)g(t.json?t.json(i,r):i);else{let e=t.print?.(i,r);e&&typeof e.then==`function`&&await e,r.next(i),await t.afterNext?.(i,r)}let c=t.exit?.(i,r);c!==void 0&&(T.exitCode=c)};return Object.defineProperty(c,"name",{value:t.name,writable:!0,enumerable:!0}),Object.assign(c,s,t.approvalPolicy?{approvalPolicy:t.approvalPolicy}:{})}function oe({usage:e,...t}){let r=async e=>{let{cli:n}=await import(`./cmd-BH1bmZGs.js`);return Z([...p(n).namespaces.find(e=>e.namespace.name===t.name&&e.namespace.commands===t.commands)?.path??[t.name],...e])};return Object.defineProperty(r,"name",{value:t.name,writable:!0,enumerable:!0}),Object.assign(r,n({...t,...e?{usage:e}:{}}))}const q={"task worker":async()=>(await import(`./worker-DHNBRRl-.js`)).commandWorker,"task mcp":async()=>(await import(`./mcp-CTVOR7r6.js`)).commandTaskMcp,"task hook":async()=>(await import(`./hook-CVJU-ZD0.js`)).commandTaskHook,"task tools":async()=>(await import(`./tools-C69W1B6S.js`)).commandTools,"task tools-search":async()=>(await import(`./tools-search-BDaeCoWe.js`)).commandToolsSearch,"flow drive":async()=>(await import(`./drive-MggMiKA0.js`)).commandDrive,"upgrade refresh":async()=>(await import(`./refresh-CWEpTAkD.js`)).commandRefreshUpdate};async function J(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-BH1bmZGs.js`),r=n[e[0]];return d(t,r?[...r,...e.slice(1)]:e)}async function Y(e){let{cli:t,SHORTCUTS:n}=await import(`./cmd-BH1bmZGs.js`);return`command`in e?P(e.command,t):N(e.namespace,t,n)}async function se(e){let t=await J(e.split(` `));return t&&!t.rest.length?Y(t):null}const X=()=>F({...ne,globals:[{usage:`-h, --help`,blurb:`show help (top-level, or for a command)`},{usage:`-v, --version`,blurb:`print the coder version`},...Object.entries(R).map(([e,t])=>k(e,t))]},a());async function ce(e){let{cloudApp:t}=await import(`./context-DVGPu7f_.js`),n=e[0]===`help`?e.slice(1):e,r=d(t,n),i=e=>{e!==void 0&&!I([e])&&_(`Unknown command "${e}".`,{hint:`See all commands: coder --help`})};if(!r){i(n[0]);let e=p(t).commands.flatMap(e=>e.command.mcp===!1?[]:[{usage:`coder ${e.path.join(` `)}`,blurb:e.command.description}]);T.stdout.write(`${[t.description,``,v.bold(`Commands:`),...j(e,v)].join(`
 `)}\n`);return}if(`namespace`in r){i(r.rest[0]),T.stdout.write(N(r.namespace,t,{}));return}if(r.command.mcp===!1&&i(r.path.join(` `)),I(r.rest))return void T.stdout.write(P(r.command,t));let a;try{a=u(r.command,r.rest)}catch(e){if(!(e instanceof f))throw e;_(e.message,{hint:`Help: coder ${r.path.join(` `)} --help`})}let o=await r.command.run(a,{}),s=r.command.mcp?r.command.mcp.text?.(o):void 0,c=r.command.next?.({result:o,args:a})??[];T.stdout.write(`${[s??JSON.stringify(o),...c.map(e=>`${e.usage}  # ${e.blurb}`)].join(`
 `)}\n`)}async function Z(e){let[t,...n]=e;if(t===`--version`||t===`-v`){T.stdout.write(`${a()}\n`);return}let{taskSocket:r}=await import(`./http-615JJgHo.js`).then(e=>e.t);if(r()&&!q[e.slice(0,2).join(` `)])return ce(e);if(t===void 0||t===`help`||t===`--help`||t===`-h`){let e=n.length?await J(n):void 0;T.stdout.write(e?await Y(e):X());return}let o=e.slice(0,2).join(` `);if(!q[o]&&t!==`mcp`){let{newerVersion:e}=await import(`./update-check-Bap3dwaj.js`).then(e=>e.o),t=e(a(),i);t&&T.stderr.write(y.dim(`coder ${a()} -> `)+y.bold(t)+y.dim(` available. run: coder upgrade