@mastra/code-sdk 0.0.0-livekit-beta-v3-20260709031728

package/dist/auth/storage.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Credential storage for API keys and OAuth tokens.
+ * Handles loading, saving, and refreshing credentials from auth.json.
+ */
+import type { AuthCredential, OAuthLoginCallbacks, OAuthProviderId, OAuthProviderInterface } from './types.js';
+/**
+ * Best/default models for each OAuth provider.
+ * Used when auto-selecting a model after login.
+ */
+export declare const PROVIDER_DEFAULT_MODELS: Record<OAuthProviderId, string>;
+/**
+ * Get an OAuth provider by ID
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Get all registered OAuth providers
+ */
+export declare function getOAuthProviders(): OAuthProviderInterface[];
+/**
+ * Credential storage backed by a JSON file.
+ */
+export declare class AuthStorage {
+    private authPath;
+    private data;
+    constructor(authPath?: string);
+    /**
+     * Reload credentials from disk.
+     */
+    reload(): void;
+    /**
+     * Save credentials to disk.
+     */
+    private save;
+    /**
+     * Get credential for a provider.
+     */
+    get(provider: string): AuthCredential | undefined;
+    /**
+     * Set credential for a provider.
+     */
+    set(provider: string, credential: AuthCredential): void;
+    /**
+     * Remove credential for a provider.
+     */
+    remove(provider: string): void;
+    /**
+     * List all providers with credentials.
+     */
+    list(): string[];
+    /**
+     * Check if credentials exist for a provider.
+     */
+    has(provider: string): boolean;
+    /**
+     * Check if logged in via OAuth for a provider.
+     */
+    isLoggedIn(provider: string): boolean;
+    /**
+     * Check if a stored API key exists for a provider.
+     * Keys are stored under `apikey:<provider>` in auth.json.
+     */
+    hasStoredApiKey(provider: string): boolean;
+    /**
+     * Get a stored API key for a provider, if any.
+     */
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Store an API key for a provider.
+     * Also sets the corresponding environment variable so model resolution can find it.
+     */
+    setStoredApiKey(provider: string, key: string, envVar?: string): void;
+    /**
+     * Load all stored API keys into process.env.
+     * Called at startup so model resolution can find stored keys.
+     * Only sets env vars that aren't already set (env vars take precedence).
+     */
+    loadStoredApiKeysIntoEnv(providerEnvVars: Record<string, string | undefined>): void;
+    /**
+     * Login to an OAuth provider.
+     */
+    login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void>;
+    /**
+     * Logout from a provider.
+     */
+    logout(provider: string): void;
+    /**
+     * Get API key for a provider, auto-refreshing OAuth tokens if needed.
+     */
+    getApiKey(providerId: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/auth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,KAAK,EACV,cAAc,EAEd,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAOnE,CAAC;AASF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,sBAAsB,GAAG,SAAS,CAExF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,sBAAsB,EAAE,CAE5D;AAED;;GAEG;AACH,qBAAa,WAAW;IAGV,OAAO,CAAC,QAAQ;IAF5B,OAAO,CAAC,IAAI,CAAuB;gBAEf,QAAQ,GAAE,MAA2C;IAIzE;;OAEG;IACH,MAAM,IAAI,IAAI;IAYd;;OAEG;IACH,OAAO,CAAC,IAAI;IASZ;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI;IAKvD;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAK9B;;OAEG;IACH,IAAI,IAAI,MAAM,EAAE;IAIhB;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKrC;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAK1C;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAOrE;;;;OAIG;IACH,wBAAwB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI;IAWnF;;OAEG;IACG,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvF;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI9B;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA8BjE"}

package/dist/auth/storage.js

@@ -0,0 +1,187 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getAppDataDir } from "../utils/project.js";
+import { anthropicOAuthProvider } from "./providers/anthropic.js";
+import { githubCopilotOAuthProvider } from "./providers/github-copilot.js";
+import { openaiCodexOAuthProvider } from "./providers/openai-codex.js";
+const PROVIDER_DEFAULT_MODELS = {
+  anthropic: "anthropic/claude-opus-4-6",
+  "openai-codex": "openai/gpt-5.5",
+  // gpt-4.1 routes through `/chat/completions` (which our OpenAI-compatible
+  // adapter handles); Anthropic-shaped Copilot models (Claude on `/v1/messages`)
+  // are not yet wired up, so picking one as the post-login default would error.
+  "github-copilot": "github-copilot/gpt-4.1"
+};
+const oauthProviderRegistry = /* @__PURE__ */ new Map([
+  [anthropicOAuthProvider.id, anthropicOAuthProvider],
+  [openaiCodexOAuthProvider.id, openaiCodexOAuthProvider],
+  [githubCopilotOAuthProvider.id, githubCopilotOAuthProvider]
+]);
+function getOAuthProvider(id) {
+  return oauthProviderRegistry.get(id);
+}
+function getOAuthProviders() {
+  return Array.from(oauthProviderRegistry.values());
+}
+class AuthStorage {
+  constructor(authPath = join(getAppDataDir(), "auth.json")) {
+    this.authPath = authPath;
+    this.reload();
+  }
+  authPath;
+  data = {};
+  /**
+   * Reload credentials from disk.
+   */
+  reload() {
+    if (!existsSync(this.authPath)) {
+      this.data = {};
+      return;
+    }
+    try {
+      this.data = JSON.parse(readFileSync(this.authPath, "utf-8"));
+    } catch {
+      this.data = {};
+    }
+  }
+  /**
+   * Save credentials to disk.
+   */
+  save() {
+    const dir = dirname(this.authPath);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true, mode: 448 });
+    }
+    writeFileSync(this.authPath, JSON.stringify(this.data, null, 2), "utf-8");
+    chmodSync(this.authPath, 384);
+  }
+  /**
+   * Get credential for a provider.
+   */
+  get(provider) {
+    return this.data[provider] ?? void 0;
+  }
+  /**
+   * Set credential for a provider.
+   */
+  set(provider, credential) {
+    this.data[provider] = credential;
+    this.save();
+  }
+  /**
+   * Remove credential for a provider.
+   */
+  remove(provider) {
+    delete this.data[provider];
+    this.save();
+  }
+  /**
+   * List all providers with credentials.
+   */
+  list() {
+    return Object.keys(this.data);
+  }
+  /**
+   * Check if credentials exist for a provider.
+   */
+  has(provider) {
+    return provider in this.data;
+  }
+  /**
+   * Check if logged in via OAuth for a provider.
+   */
+  isLoggedIn(provider) {
+    const cred = this.data[provider];
+    return cred?.type === "oauth";
+  }
+  /**
+   * Check if a stored API key exists for a provider.
+   * Keys are stored under `apikey:<provider>` in auth.json.
+   */
+  hasStoredApiKey(provider) {
+    const cred = this.data[`apikey:${provider}`];
+    return cred?.type === "api_key" && cred.key.length > 0;
+  }
+  /**
+   * Get a stored API key for a provider, if any.
+   */
+  getStoredApiKey(provider) {
+    const cred = this.data[`apikey:${provider}`];
+    return cred?.type === "api_key" && cred.key.length > 0 ? cred.key : void 0;
+  }
+  /**
+   * Store an API key for a provider.
+   * Also sets the corresponding environment variable so model resolution can find it.
+   */
+  setStoredApiKey(provider, key, envVar) {
+    this.set(`apikey:${provider}`, { type: "api_key", key });
+    if (envVar) {
+      process.env[envVar] = key;
+    }
+  }
+  /**
+   * Load all stored API keys into process.env.
+   * Called at startup so model resolution can find stored keys.
+   * Only sets env vars that aren't already set (env vars take precedence).
+   */
+  loadStoredApiKeysIntoEnv(providerEnvVars) {
+    for (const [key, cred] of Object.entries(this.data)) {
+      if (!key.startsWith("apikey:") || cred.type !== "api_key" || !cred.key) continue;
+      const provider = key.substring("apikey:".length);
+      const envVar = providerEnvVars[provider];
+      if (envVar && !process.env[envVar]) {
+        process.env[envVar] = cred.key;
+      }
+    }
+  }
+  /**
+   * Login to an OAuth provider.
+   */
+  async login(providerId, callbacks) {
+    const provider = getOAuthProvider(providerId);
+    if (!provider) {
+      throw new Error(`Unknown OAuth provider: ${providerId}`);
+    }
+    const credentials = await provider.login(callbacks);
+    this.set(providerId, { type: "oauth", ...credentials });
+  }
+  /**
+   * Logout from a provider.
+   */
+  logout(provider) {
+    this.remove(provider);
+  }
+  /**
+   * Get API key for a provider, auto-refreshing OAuth tokens if needed.
+   */
+  async getApiKey(providerId) {
+    const cred = this.data[providerId];
+    if (cred?.type === "api_key") {
+      return cred.key;
+    }
+    if (cred?.type === "oauth") {
+      const provider = getOAuthProvider(providerId);
+      if (!provider) {
+        return void 0;
+      }
+      if (Date.now() >= cred.expires) {
+        try {
+          const newCreds = await provider.refreshToken(cred);
+          this.set(providerId, { type: "oauth", ...newCreds });
+          return provider.getApiKey(newCreds);
+        } catch {
+          return void 0;
+        }
+      }
+      return provider.getApiKey(cred);
+    }
+    return void 0;
+  }
+}
+export {
+  AuthStorage,
+  PROVIDER_DEFAULT_MODELS,
+  getOAuthProvider,
+  getOAuthProviders
+};
+//# sourceMappingURL=storage.js.map

package/dist/auth/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/storage.ts"],"sourcesContent":["/**\n * Credential storage for API keys and OAuth tokens.\n * Handles loading, saving, and refreshing credentials from auth.json.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { getAppDataDir } from '../utils/project.js';\nimport { anthropicOAuthProvider } from './providers/anthropic.js';\nimport { githubCopilotOAuthProvider } from './providers/github-copilot.js';\nimport { openaiCodexOAuthProvider } from './providers/openai-codex.js';\nimport type {\n  AuthCredential,\n  AuthStorageData,\n  OAuthLoginCallbacks,\n  OAuthProviderId,\n  OAuthProviderInterface,\n} from './types.js';\n\n/**\n * Best/default models for each OAuth provider.\n * Used when auto-selecting a model after login.\n */\nexport const PROVIDER_DEFAULT_MODELS: Record<OAuthProviderId, string> = {\n  anthropic: 'anthropic/claude-opus-4-6',\n  'openai-codex': 'openai/gpt-5.5',\n  // gpt-4.1 routes through `/chat/completions` (which our OpenAI-compatible\n  // adapter handles); Anthropic-shaped Copilot models (Claude on `/v1/messages`)\n  // are not yet wired up, so picking one as the post-login default would error.\n  'github-copilot': 'github-copilot/gpt-4.1',\n};\n\n// Provider registry\nconst oauthProviderRegistry = new Map<string, OAuthProviderInterface>([\n  [anthropicOAuthProvider.id, anthropicOAuthProvider],\n  [openaiCodexOAuthProvider.id, openaiCodexOAuthProvider],\n  [githubCopilotOAuthProvider.id, githubCopilotOAuthProvider],\n]);\n\n/**\n * Get an OAuth provider by ID\n */\nexport function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined {\n  return oauthProviderRegistry.get(id);\n}\n\n/**\n * Get all registered OAuth providers\n */\nexport function getOAuthProviders(): OAuthProviderInterface[] {\n  return Array.from(oauthProviderRegistry.values());\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage {\n  private data: AuthStorageData = {};\n\n  constructor(private authPath: string = join(getAppDataDir(), 'auth.json')) {\n    this.reload();\n  }\n\n  /**\n   * Reload credentials from disk.\n   */\n  reload(): void {\n    if (!existsSync(this.authPath)) {\n      this.data = {};\n      return;\n    }\n    try {\n      this.data = JSON.parse(readFileSync(this.authPath, 'utf-8'));\n    } catch {\n      this.data = {};\n    }\n  }\n\n  /**\n   * Save credentials to disk.\n   */\n  private save(): void {\n    const dir = dirname(this.authPath);\n    if (!existsSync(dir)) {\n      mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    writeFileSync(this.authPath, JSON.stringify(this.data, null, 2), 'utf-8');\n    chmodSync(this.authPath, 0o600);\n  }\n\n  /**\n   * Get credential for a provider.\n   */\n  get(provider: string): AuthCredential | undefined {\n    return this.data[provider] ?? undefined;\n  }\n\n  /**\n   * Set credential for a provider.\n   */\n  set(provider: string, credential: AuthCredential): void {\n    this.data[provider] = credential;\n    this.save();\n  }\n\n  /**\n   * Remove credential for a provider.\n   */\n  remove(provider: string): void {\n    delete this.data[provider];\n    this.save();\n  }\n\n  /**\n   * List all providers with credentials.\n   */\n  list(): string[] {\n    return Object.keys(this.data);\n  }\n\n  /**\n   * Check if credentials exist for a provider.\n   */\n  has(provider: string): boolean {\n    return provider in this.data;\n  }\n\n  /**\n   * Check if logged in via OAuth for a provider.\n   */\n  isLoggedIn(provider: string): boolean {\n    const cred = this.data[provider];\n    return cred?.type === 'oauth';\n  }\n\n  /**\n   * Check if a stored API key exists for a provider.\n   * Keys are stored under `apikey:<provider>` in auth.json.\n   */\n  hasStoredApiKey(provider: string): boolean {\n    const cred = this.data[`apikey:${provider}`];\n    return cred?.type === 'api_key' && cred.key.length > 0;\n  }\n\n  /**\n   * Get a stored API key for a provider, if any.\n   */\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.data[`apikey:${provider}`];\n    return cred?.type === 'api_key' && cred.key.length > 0 ? cred.key : undefined;\n  }\n\n  /**\n   * Store an API key for a provider.\n   * Also sets the corresponding environment variable so model resolution can find it.\n   */\n  setStoredApiKey(provider: string, key: string, envVar?: string): void {\n    this.set(`apikey:${provider}`, { type: 'api_key', key });\n    if (envVar) {\n      process.env[envVar] = key;\n    }\n  }\n\n  /**\n   * Load all stored API keys into process.env.\n   * Called at startup so model resolution can find stored keys.\n   * Only sets env vars that aren't already set (env vars take precedence).\n   */\n  loadStoredApiKeysIntoEnv(providerEnvVars: Record<string, string | undefined>): void {\n    for (const [key, cred] of Object.entries(this.data)) {\n      if (!key.startsWith('apikey:') || cred.type !== 'api_key' || !cred.key) continue;\n      const provider = key.substring('apikey:'.length);\n      const envVar = providerEnvVars[provider];\n      if (envVar && !process.env[envVar]) {\n        process.env[envVar] = cred.key;\n      }\n    }\n  }\n\n  /**\n   * Login to an OAuth provider.\n   */\n  async login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void> {\n    const provider = getOAuthProvider(providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth provider: ${providerId}`);\n    }\n\n    const credentials = await provider.login(callbacks);\n    this.set(providerId, { type: 'oauth', ...credentials });\n  }\n\n  /**\n   * Logout from a provider.\n   */\n  logout(provider: string): void {\n    this.remove(provider);\n  }\n\n  /**\n   * Get API key for a provider, auto-refreshing OAuth tokens if needed.\n   */\n  async getApiKey(providerId: string): Promise<string | undefined> {\n    const cred = this.data[providerId];\n\n    if (cred?.type === 'api_key') {\n      return cred.key;\n    }\n\n    if (cred?.type === 'oauth') {\n      const provider = getOAuthProvider(providerId);\n      if (!provider) {\n        return undefined;\n      }\n\n      // Check if token needs refresh\n      if (Date.now() >= cred.expires) {\n        try {\n          const newCreds = await provider.refreshToken(cred);\n          this.set(providerId, { type: 'oauth', ...newCreds });\n          return provider.getApiKey(newCreds);\n        } catch {\n          // Refresh failed - user needs to re-login\n          return undefined;\n        }\n      }\n\n      return provider.getApiKey(cred);\n    }\n\n    return undefined;\n  }\n}\n"],"mappings":"AAKA,SAAS,YAAY,WAAW,cAAc,eAAe,iBAAiB;AAC9E,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;AAalC,MAAM,0BAA2D;AAAA,EACtE,WAAW;AAAA,EACX,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,kBAAkB;AACpB;AAGA,MAAM,wBAAwB,oBAAI,IAAoC;AAAA,EACpE,CAAC,uBAAuB,IAAI,sBAAsB;AAAA,EAClD,CAAC,yBAAyB,IAAI,wBAAwB;AAAA,EACtD,CAAC,2BAA2B,IAAI,0BAA0B;AAC5D,CAAC;AAKM,SAAS,iBAAiB,IAAyD;AACxF,SAAO,sBAAsB,IAAI,EAAE;AACrC;AAKO,SAAS,oBAA8C;AAC5D,SAAO,MAAM,KAAK,sBAAsB,OAAO,CAAC;AAClD;AAKO,MAAM,YAAY;AAAA,EAGvB,YAAoB,WAAmB,KAAK,cAAc,GAAG,WAAW,GAAG;AAAvD;AAClB,SAAK,OAAO;AAAA,EACd;AAAA,EAFoB;AAAA,EAFZ,OAAwB,CAAC;AAAA;AAAA;AAAA;AAAA,EASjC,SAAe;AACb,QAAI,CAAC,WAAW,KAAK,QAAQ,GAAG;AAC9B,WAAK,OAAO,CAAC;AACb;AAAA,IACF;AACA,QAAI;AACF,WAAK,OAAO,KAAK,MAAM,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,IAC7D,QAAQ;AACN,WAAK,OAAO,CAAC;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,OAAa;AACnB,UAAM,MAAM,QAAQ,KAAK,QAAQ;AACjC,QAAI,CAAC,WAAW,GAAG,GAAG;AACpB,gBAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,IACjD;AACA,kBAAc,KAAK,UAAU,KAAK,UAAU,KAAK,MAAM,MAAM,CAAC,GAAG,OAAO;AACxE,cAAU,KAAK,UAAU,GAAK;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAA8C;AAChD,WAAO,KAAK,KAAK,QAAQ,KAAK;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAAkB,YAAkC;AACtD,SAAK,KAAK,QAAQ,IAAI;AACtB,SAAK,KAAK;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,UAAwB;AAC7B,WAAO,KAAK,KAAK,QAAQ;AACzB,SAAK,KAAK;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,OAAiB;AACf,WAAO,OAAO,KAAK,KAAK,IAAI;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,UAA2B;AAC7B,WAAO,YAAY,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,UAA2B;AACpC,UAAM,OAAO,KAAK,KAAK,QAAQ;AAC/B,WAAO,MAAM,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,UAA2B;AACzC,UAAM,OAAO,KAAK,KAAK,UAAU,QAAQ,EAAE;AAC3C,WAAO,MAAM,SAAS,aAAa,KAAK,IAAI,SAAS;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,UAAsC;AACpD,UAAM,OAAO,KAAK,KAAK,UAAU,QAAQ,EAAE;AAC3C,WAAO,MAAM,SAAS,aAAa,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,UAAkB,KAAa,QAAuB;AACpE,SAAK,IAAI,UAAU,QAAQ,IAAI,EAAE,MAAM,WAAW,IAAI,CAAC;AACvD,QAAI,QAAQ;AACV,cAAQ,IAAI,MAAM,IAAI;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAyB,iBAA2D;AAClF,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,IAAI,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,SAAS,KAAK,KAAK,SAAS,aAAa,CAAC,KAAK,IAAK;AACxE,YAAM,WAAW,IAAI,UAAU,UAAU,MAAM;AAC/C,YAAM,SAAS,gBAAgB,QAAQ;AACvC,UAAI,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG;AAClC,gBAAQ,IAAI,MAAM,IAAI,KAAK;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,YAA6B,WAA+C;AACtF,UAAM,WAAW,iBAAiB,UAAU;AAC5C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,MAAM,2BAA2B,UAAU,EAAE;AAAA,IACzD;AAEA,UAAM,cAAc,MAAM,SAAS,MAAM,SAAS;AAClD,SAAK,IAAI,YAAY,EAAE,MAAM,SAAS,GAAG,YAAY,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,UAAwB;AAC7B,SAAK,OAAO,QAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,YAAiD;AAC/D,UAAM,OAAO,KAAK,KAAK,UAAU;AAEjC,QAAI,MAAM,SAAS,WAAW;AAC5B,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,MAAM,SAAS,SAAS;AAC1B,YAAM,WAAW,iBAAiB,UAAU;AAC5C,UAAI,CAAC,UAAU;AACb,eAAO;AAAA,MACT;AAGA,UAAI,KAAK,IAAI,KAAK,KAAK,SAAS;AAC9B,YAAI;AACF,gBAAM,WAAW,MAAM,SAAS,aAAa,IAAI;AACjD,eAAK,IAAI,YAAY,EAAE,MAAM,SAAS,GAAG,SAAS,CAAC;AACnD,iBAAO,SAAS,UAAU,QAAQ;AAAA,QACpC,QAAQ;AAEN,iBAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO,SAAS,UAAU,IAAI;AAAA,IAChC;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/auth/types.d.ts

@@ -0,0 +1,68 @@
+/**
+ * OAuth types for authentication providers
+ */
+export interface OAuthCredentials {
+    refresh: string;
+    access: string;
+    expires: number;
+    [key: string]: unknown;
+}
+export type OAuthProviderId = string;
+export interface OAuthAuthInfo {
+    url: string;
+    instructions?: string;
+}
+export interface OAuthPrompt {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+}
+/**
+ * A selectable authentication mode for an OAuth provider.
+ * Providers that support multiple flows (e.g. browser callback vs. device code)
+ * advertise them via `OAuthProviderInterface.authModes`. The TUI shows a
+ * sub-selector when more than one mode is available so users don't need to
+ * discover the flow through environment variables.
+ */
+export interface AuthMode {
+    id: string;
+    name: string;
+    description?: string;
+}
+export interface OAuthLoginCallbacks {
+    onAuth: (info: OAuthAuthInfo) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    signal?: AbortSignal;
+    /** Selected authentication mode id (matches one of `OAuthProviderInterface.authModes`). */
+    authMode?: string;
+}
+export interface OAuthProviderInterface {
+    readonly id: OAuthProviderId;
+    readonly name: string;
+    /** Whether this provider uses a local callback server (vs manual code paste) */
+    readonly usesCallbackServer?: boolean;
+    /**
+     * Optional list of selectable auth flows. When set with two or more entries,
+     * the TUI prompts the user to pick a mode before starting the login flow and
+     * forwards the choice via `OAuthLoginCallbacks.authMode`.
+     */
+    readonly authModes?: ReadonlyArray<AuthMode>;
+    /** Run the login flow, return credentials to persist */
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+    /** Refresh expired credentials, return updated credentials to persist */
+    refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    /** Convert credentials to API key string for the provider */
+    getApiKey(credentials: OAuthCredentials): string;
+}
+export type ApiKeyCredential = {
+    type: 'api_key';
+    key: string;
+};
+export type OAuthCredential = {
+    type: 'oauth';
+} & OAuthCredentials;
+export type AuthCredential = ApiKeyCredential | OAuthCredential;
+export type AuthStorageData = Record<string, AuthCredential>;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,gFAAgF;IAChF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE7C,wDAAwD;IACxD,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjE,yEAAyE;IACzE,YAAY,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvE,6DAA6D;IAC7D,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CAClD;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,gBAAgB,CAAC;AAErB,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC"}

package/dist/auth/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/clipboard/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Platform-specific clipboard image extraction.
+ *
+ * Checks the system clipboard for image data and returns it as base64.
+ * Uses synchronous execution (execSync) since this only runs on paste events.
+ */
+export interface ClipboardImage {
+    data: string;
+    mimeType: string;
+}
+/**
+ * Read plain text from the system clipboard.
+ * Returns null if clipboard is empty or reading fails.
+ */
+export declare function getClipboardText(): string | null;
+/**
+ * Write plain text to the system clipboard.
+ * Returns true on success, false on failure.
+ */
+export declare function setClipboardText(text: string): boolean;
+/**
+ * Check the system clipboard for image data and return it as base64.
+ * Returns null if no image data is found or extraction fails.
+ */
+export declare function getClipboardImage(): ClipboardImage | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/clipboard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clipboard/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAgChD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA+BtD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAYzD"}

package/dist/clipboard/index.js

@@ -0,0 +1,192 @@
+import { execSync } from "node:child_process";
+import { readFileSync, unlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+function getClipboardText() {
+  try {
+    if (process.platform === "darwin") {
+      const text = execSync("pbpaste", {
+        encoding: "utf-8",
+        timeout: 3e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      return text.length > 0 ? text : null;
+    }
+    if (process.platform === "linux") {
+      try {
+        const text = execSync("xclip -selection clipboard -o", {
+          encoding: "utf-8",
+          timeout: 3e3,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        return text.length > 0 ? text : null;
+      } catch {
+        const text = execSync("wl-paste", {
+          encoding: "utf-8",
+          timeout: 3e3,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        return text.length > 0 ? text : null;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function setClipboardText(text) {
+  try {
+    if (process.platform === "darwin") {
+      execSync("pbcopy", {
+        input: text,
+        timeout: 3e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      return true;
+    }
+    if (process.platform === "linux") {
+      try {
+        execSync("xclip -selection clipboard", {
+          input: text,
+          timeout: 3e3,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        return true;
+      } catch {
+        execSync("wl-copy", {
+          input: text,
+          timeout: 3e3,
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function getClipboardImage() {
+  try {
+    if (process.platform === "darwin") {
+      return getMacClipboardImage();
+    }
+    if (process.platform === "linux") {
+      return getLinuxClipboardImage();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function getMacClipboardImage() {
+  return tryReadMacClipboardImage({
+    coercion: "\xABclass PNGf\xBB",
+    extension: "png",
+    mimeType: "image/png"
+  }) ?? tryReadMacClipboardImage({
+    coercion: "TIFF picture",
+    extension: "tiff",
+    mimeType: "image/tiff"
+  }) ?? tryReadMacClipboardImage({
+    coercion: "\xABclass TIFF\xBB",
+    extension: "tiff",
+    mimeType: "image/tiff"
+  });
+}
+function tryReadMacClipboardImage({
+  coercion,
+  extension,
+  mimeType
+}) {
+  const tmpFile = join(tmpdir(), `mastra-clipboard-${Date.now()}.${extension}`);
+  try {
+    const script = `
+			set theImage to the clipboard as ${coercion}
+			set theFile to open for access POSIX file "${tmpFile}" with write permission
+			write theImage to theFile
+			close access theFile
+		`;
+    execSync(`osascript -e '${script.replace(/'/g, "'\\''")}'`, {
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const buffer = readFileSync(tmpFile);
+    if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
+      return null;
+    }
+    return {
+      data: buffer.toString("base64"),
+      mimeType
+    };
+  } catch {
+    return null;
+  } finally {
+    try {
+      unlinkSync(tmpFile);
+    } catch {
+    }
+  }
+}
+function getLinuxClipboardImage() {
+  return getLinuxClipboardImageXclip() ?? getLinuxClipboardImageWlPaste();
+}
+function getLinuxClipboardImageXclip() {
+  try {
+    const targets = execSync("xclip -selection clipboard -target TARGETS -o", {
+      encoding: "utf-8",
+      timeout: 3e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (!targets.includes("image/png")) {
+      return null;
+    }
+    const buffer = execSync("xclip -selection clipboard -target image/png -o", {
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: 50 * 1024 * 1024
+      // 50MB max
+    });
+    if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
+      return null;
+    }
+    return {
+      data: buffer.toString("base64"),
+      mimeType: "image/png"
+    };
+  } catch {
+    return null;
+  }
+}
+function getLinuxClipboardImageWlPaste() {
+  try {
+    const types = execSync("wl-paste --list-types", {
+      encoding: "utf-8",
+      timeout: 3e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (!types.includes("image/png")) {
+      return null;
+    }
+    const buffer = execSync("wl-paste --type image/png", {
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: 50 * 1024 * 1024
+    });
+    if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
+      return null;
+    }
+    return {
+      data: buffer.toString("base64"),
+      mimeType: "image/png"
+    };
+  } catch {
+    return null;
+  }
+}
+export {
+  getClipboardImage,
+  getClipboardText,
+  setClipboardText
+};
+//# sourceMappingURL=index.js.map

package/dist/clipboard/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/clipboard/index.ts"],"sourcesContent":["/**\n * Platform-specific clipboard image extraction.\n *\n * Checks the system clipboard for image data and returns it as base64.\n * Uses synchronous execution (execSync) since this only runs on paste events.\n */\n\nimport { execSync } from 'node:child_process';\nimport { readFileSync, unlinkSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\nexport interface ClipboardImage {\n  data: string; // base64-encoded image data or a remote image URL\n  mimeType: string;\n}\n\n/**\n * Read plain text from the system clipboard.\n * Returns null if clipboard is empty or reading fails.\n */\nexport function getClipboardText(): string | null {\n  try {\n    if (process.platform === 'darwin') {\n      const text = execSync('pbpaste', {\n        encoding: 'utf-8',\n        timeout: 3000,\n        stdio: ['pipe', 'pipe', 'pipe'],\n      });\n      return text.length > 0 ? text : null;\n    }\n    if (process.platform === 'linux') {\n      // Try xclip first, then wl-paste\n      try {\n        const text = execSync('xclip -selection clipboard -o', {\n          encoding: 'utf-8',\n          timeout: 3000,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        });\n        return text.length > 0 ? text : null;\n      } catch {\n        const text = execSync('wl-paste', {\n          encoding: 'utf-8',\n          timeout: 3000,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        });\n        return text.length > 0 ? text : null;\n      }\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Write plain text to the system clipboard.\n * Returns true on success, false on failure.\n */\nexport function setClipboardText(text: string): boolean {\n  try {\n    if (process.platform === 'darwin') {\n      execSync('pbcopy', {\n        input: text,\n        timeout: 3000,\n        stdio: ['pipe', 'pipe', 'pipe'],\n      });\n      return true;\n    }\n    if (process.platform === 'linux') {\n      try {\n        execSync('xclip -selection clipboard', {\n          input: text,\n          timeout: 3000,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        });\n        return true;\n      } catch {\n        execSync('wl-copy', {\n          input: text,\n          timeout: 3000,\n          stdio: ['pipe', 'pipe', 'pipe'],\n        });\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check the system clipboard for image data and return it as base64.\n * Returns null if no image data is found or extraction fails.\n */\nexport function getClipboardImage(): ClipboardImage | null {\n  try {\n    if (process.platform === 'darwin') {\n      return getMacClipboardImage();\n    }\n    if (process.platform === 'linux') {\n      return getLinuxClipboardImage();\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n// =============================================================================\n// macOS\n// =============================================================================\n\nfunction getMacClipboardImage(): ClipboardImage | null {\n  return (\n    tryReadMacClipboardImage({\n      coercion: '«class PNGf»',\n      extension: 'png',\n      mimeType: 'image/png',\n    }) ??\n    tryReadMacClipboardImage({\n      coercion: 'TIFF picture',\n      extension: 'tiff',\n      mimeType: 'image/tiff',\n    }) ??\n    tryReadMacClipboardImage({\n      coercion: '«class TIFF»',\n      extension: 'tiff',\n      mimeType: 'image/tiff',\n    })\n  );\n}\n\nfunction tryReadMacClipboardImage({\n  coercion,\n  extension,\n  mimeType,\n}: {\n  coercion: string;\n  extension: string;\n  mimeType: string;\n}): ClipboardImage | null {\n  const tmpFile = join(tmpdir(), `mastra-clipboard-${Date.now()}.${extension}`);\n\n  try {\n    const script = `\n\t\t\tset theImage to the clipboard as ${coercion}\n\t\t\tset theFile to open for access POSIX file \"${tmpFile}\" with write permission\n\t\t\twrite theImage to theFile\n\t\t\tclose access theFile\n\t\t`;\n    execSync(`osascript -e '${script.replace(/'/g, \"'\\\\''\")}'`, {\n      timeout: 5000,\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    const buffer = readFileSync(tmpFile);\n    if (!Buffer.isBuffer(buffer) || buffer.length === 0) {\n      return null;\n    }\n\n    return {\n      data: buffer.toString('base64'),\n      mimeType,\n    };\n  } catch {\n    return null;\n  } finally {\n    try {\n      unlinkSync(tmpFile);\n    } catch {\n      // ignore cleanup errors\n    }\n  }\n}\n\n// =============================================================================\n// Linux\n// =============================================================================\n\nfunction getLinuxClipboardImage(): ClipboardImage | null {\n  // Try xclip first, then wl-paste (Wayland)\n  return getLinuxClipboardImageXclip() ?? getLinuxClipboardImageWlPaste();\n}\n\nfunction getLinuxClipboardImageXclip(): ClipboardImage | null {\n  try {\n    // Check available targets\n    const targets = execSync('xclip -selection clipboard -target TARGETS -o', {\n      encoding: 'utf-8',\n      timeout: 3000,\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    if (!targets.includes('image/png')) {\n      return null;\n    }\n\n    // Extract PNG data\n    const buffer = execSync('xclip -selection clipboard -target image/png -o', {\n      timeout: 5000,\n      stdio: ['pipe', 'pipe', 'pipe'],\n      maxBuffer: 50 * 1024 * 1024, // 50MB max\n    });\n\n    if (!Buffer.isBuffer(buffer) || buffer.length === 0) {\n      return null;\n    }\n\n    return {\n      data: buffer.toString('base64'),\n      mimeType: 'image/png',\n    };\n  } catch {\n    return null;\n  }\n}\n\nfunction getLinuxClipboardImageWlPaste(): ClipboardImage | null {\n  try {\n    // Check if wl-paste is available and clipboard has image\n    const types = execSync('wl-paste --list-types', {\n      encoding: 'utf-8',\n      timeout: 3000,\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    if (!types.includes('image/png')) {\n      return null;\n    }\n\n    // Extract PNG data\n    const buffer = execSync('wl-paste --type image/png', {\n      timeout: 5000,\n      stdio: ['pipe', 'pipe', 'pipe'],\n      maxBuffer: 50 * 1024 * 1024,\n    });\n\n    if (!Buffer.isBuffer(buffer) || buffer.length === 0) {\n      return null;\n    }\n\n    return {\n      data: buffer.toString('base64'),\n      mimeType: 'image/png',\n    };\n  } catch {\n    return null;\n  }\n}\n"],"mappings":"AAOA,SAAS,gBAAgB;AACzB,SAAS,cAAc,kBAAkB;AACzC,SAAS,cAAc;AACvB,SAAS,YAAY;AAWd,SAAS,mBAAkC;AAChD,MAAI;AACF,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,OAAO,SAAS,WAAW;AAAA,QAC/B,UAAU;AAAA,QACV,SAAS;AAAA,QACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAChC,CAAC;AACD,aAAO,KAAK,SAAS,IAAI,OAAO;AAAA,IAClC;AACA,QAAI,QAAQ,aAAa,SAAS;AAEhC,UAAI;AACF,cAAM,OAAO,SAAS,iCAAiC;AAAA,UACrD,UAAU;AAAA,UACV,SAAS;AAAA,UACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAChC,CAAC;AACD,eAAO,KAAK,SAAS,IAAI,OAAO;AAAA,MAClC,QAAQ;AACN,cAAM,OAAO,SAAS,YAAY;AAAA,UAChC,UAAU;AAAA,UACV,SAAS;AAAA,UACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAChC,CAAC;AACD,eAAO,KAAK,SAAS,IAAI,OAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,iBAAiB,MAAuB;AACtD,MAAI;AACF,QAAI,QAAQ,aAAa,UAAU;AACjC,eAAS,UAAU;AAAA,QACjB,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAChC,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,UAAI;AACF,iBAAS,8BAA8B;AAAA,UACrC,OAAO;AAAA,UACP,SAAS;AAAA,UACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAChC,CAAC;AACD,eAAO;AAAA,MACT,QAAQ;AACN,iBAAS,WAAW;AAAA,UAClB,OAAO;AAAA,UACP,SAAS;AAAA,UACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAChC,CAAC;AACD,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,oBAA2C;AACzD,MAAI;AACF,QAAI,QAAQ,aAAa,UAAU;AACjC,aAAO,qBAAqB;AAAA,IAC9B;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,uBAAuB;AAAA,IAChC;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,uBAA8C;AACrD,SACE,yBAAyB;AAAA,IACvB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU;AAAA,EACZ,CAAC,KACD,yBAAyB;AAAA,IACvB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU;AAAA,EACZ,CAAC,KACD,yBAAyB;AAAA,IACvB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU;AAAA,EACZ,CAAC;AAEL;AAEA,SAAS,yBAAyB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAI0B;AACxB,QAAM,UAAU,KAAK,OAAO,GAAG,oBAAoB,KAAK,IAAI,CAAC,IAAI,SAAS,EAAE;AAE5E,MAAI;AACF,UAAM,SAAS;AAAA,sCACmB,QAAQ;AAAA,gDACE,OAAO;AAAA;AAAA;AAAA;AAInD,aAAS,iBAAiB,OAAO,QAAQ,MAAM,OAAO,CAAC,KAAK;AAAA,MAC1D,SAAS;AAAA,MACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AAED,UAAM,SAAS,aAAa,OAAO;AACnC,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,OAAO,WAAW,GAAG;AACnD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,QAAI;AACF,iBAAW,OAAO;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAMA,SAAS,yBAAgD;AAEvD,SAAO,4BAA4B,KAAK,8BAA8B;AACxE;AAEA,SAAS,8BAAqD;AAC5D,MAAI;AAEF,UAAM,UAAU,SAAS,iDAAiD;AAAA,MACxE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AAED,QAAI,CAAC,QAAQ,SAAS,WAAW,GAAG;AAClC,aAAO;AAAA,IACT;AAGA,UAAM,SAAS,SAAS,mDAAmD;AAAA,MACzE,SAAS;AAAA,MACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,WAAW,KAAK,OAAO;AAAA;AAAA,IACzB,CAAC;AAED,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,OAAO,WAAW,GAAG;AACnD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,UAAU;AAAA,IACZ;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,gCAAuD;AAC9D,MAAI;AAEF,UAAM,QAAQ,SAAS,yBAAyB;AAAA,MAC9C,UAAU;AAAA,MACV,SAAS;AAAA,MACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AAED,QAAI,CAAC,MAAM,SAAS,WAAW,GAAG;AAChC,aAAO;AAAA,IACT;AAGA,UAAM,SAAS,SAAS,6BAA6B;AAAA,MACnD,SAAS;AAAA,MACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AAED,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,OAAO,WAAW,GAAG;AACnD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,UAAU;AAAA,IACZ;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/constants.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_CONFIG_DIR = ".mastracode";
+/**
+ * Validate that a configDirName is a safe single directory name.
+ * Rejects absolute paths, path separators, and traversal components.
+ */
+export declare function validateConfigDirName(configDirName: string): void;
+export declare const DEFAULT_OM_MODEL_ID: string;
+export declare const DEFAULT_OBS_THRESHOLD = 30000;
+export declare const DEFAULT_REF_THRESHOLD = 40000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAgBjE;AAGD,eAAO,MAAM,mBAAmB,QAA+D,CAAC;AAGhG,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,qBAAqB,QAAS,CAAC"}

package/dist/constants.js

@@ -0,0 +1,23 @@
+import * as path from "node:path";
+const DEFAULT_CONFIG_DIR = ".mastracode";
+function validateConfigDirName(configDirName) {
+  if (configDirName.trim().length === 0) {
+    throw new Error("configDirName must be a non-empty directory name");
+  }
+  if (path.isAbsolute(configDirName) || configDirName.includes("/") || configDirName.includes("\\") || configDirName === ".." || configDirName === ".") {
+    throw new Error(
+      `configDirName must be a single directory name without path separators or traversal components, got: "${configDirName}"`
+    );
+  }
+}
+const DEFAULT_OM_MODEL_ID = process.env.DEFAULT_OM_MODEL_ID ?? "google/gemini-2.5-flash";
+const DEFAULT_OBS_THRESHOLD = 3e4;
+const DEFAULT_REF_THRESHOLD = 4e4;
+export {
+  DEFAULT_CONFIG_DIR,
+  DEFAULT_OBS_THRESHOLD,
+  DEFAULT_OM_MODEL_ID,
+  DEFAULT_REF_THRESHOLD,
+  validateConfigDirName
+};
+//# sourceMappingURL=constants.js.map