@mastra/code-sdk 1.14.0-alpha.1 → 1.14.0-alpha.3

package/dist/agents/credential-resolver.d.ts

@@ -3,56 +3,60 @@
  *
  * Locally, model resolution reads the server-global file-backed `AuthStorage`.
  * A deployed web host registers a {@link CredentialStoreProvider} at boot; from
- * then on `resolveModel` derives the calling tenant from the request context
- * (the web auth gate stashes the authenticated user under the `user` key) and
- * resolves credentials through the tenant's own store — user credentials over
- * org credentials over server env vars, with OAuth refresh owned by the store.
+ * then on `resolveModel` uses the host's trusted execution policy, never mutable
+ * session state. Factory scope reads organization credentials only. User scope reads
+ * the Factory session owner's credentials only, or the authenticated principal
+ * for project-less personal sessions.
  *
  * When no provider is registered (TUI, local web), everything falls through to
  * the existing global behavior unchanged.
  */
 import type { RequestContext } from '@mastra/core/request-context';
 import type { CredentialStore } from '../auth/types.js';
-/** The identity a credential lookup is scoped to. */
+export type CredentialScope = 'factory' | 'user';
+/** The identity and exclusive scope a credential lookup is resolved against. */
 export interface CredentialTenant {
     /** Org tenant; absent for personal accounts (store impls may synthesize one). */
     orgId?: string;
-    /** Stable user id from the web auth adapter. */
+    /** Stable user id used for user-scoped credentials and tenant cache keys. */
     userId: string;
-    /**
-     * Resolve org-shared credentials over the user's personal ones. Set by
-     * trusted server code for automated (factory) runs so they ride the org's
-     * shared keys first and only fall back to the acting user's credentials.
-     */
-    orgFirst?: boolean;
+    /** Exclusive credential scope for this request. */
+    credentialScope: CredentialScope;
 }
 /**
- * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back
- * to the global store (e.g. tenant storage temporarily unavailable). Must be
- * synchronous — implementations serve from a primed snapshot and do
- * authoritative async work inside `getApiKey`.
+ * Returns a tenant-scoped {@link CredentialStore}, or `undefined` when tenant
+ * storage is unavailable. Must be synchronous — implementations serve from a
+ * primed snapshot and do authoritative async work inside `getApiKey`.
  */
 export type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;
+export type CredentialTenantResolver = (requestContext: RequestContext) => Promise<CredentialTenant | undefined>;
 /** Register (or clear) the tenant credential store provider. Deployed-web only. */
-export declare function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined): void;
+export declare function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined, resolveTenant?: CredentialTenantResolver): void;
+/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */
+export declare function prepareCredentialTenant(requestContext?: RequestContext): Promise<void>;
+export declare function withCredentialTenantPreparation<T>(resolve: (ctx: {
+    requestContext: RequestContext;
+}) => T): (ctx: {
+    requestContext: RequestContext;
+}) => Promise<T>;
 /**
  * Whether a tenant provider is registered. Used to disable the
  * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant
  * credentials must never leak into process-global env vars.
  */
 export declare function hasCredentialStoreProvider(): boolean;
+export declare function hasCredentialTenantResolver(): boolean;
+export declare function resolveCredentialScope(requestContext?: RequestContext): CredentialScope;
 /**
  * Derive the calling tenant from a request context, if an authenticated web
  * user was stashed on it. Mirrors the web layer's stable-id resolution
  * (`workosId` falling back to the provider `id`).
  *
- * The value under `user` is whatever the active auth provider's
- * `authenticateToken` returned, so its shape follows the provider: a flat user
- * (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the
- * flat shape resolves no tenant at all for the wrapper, which in deployed mode
- * fails closed to an empty credential store.
+ * Session state and HTTP-supplied policy values never establish credential authority.
  */
 export declare function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined;
+/** Authenticated principal only, for hosts resolving durable session ownership. */
+export declare function resolveAuthenticatedCredentialTenant(requestContext?: RequestContext): CredentialTenant | undefined;
 /**
  * Resolve the credential store for a request. Local mode returns `undefined`
  * and keeps the global `AuthStorage` behavior. Once deployed web registers a

package/dist/agents/credential-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAkBhG,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAAG,IAAI,CAE9F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAqCD;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAsB7G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAsBnG"}
+{"version":3,"file":"credential-resolver.d.ts","sourceRoot":"","sources":["../../src/agents/credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,eAAe,EAAE,eAAe,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,gBAAgB,KAAK,eAAe,GAAG,SAAS,CAAC;AAEhG,MAAM,MAAM,wBAAwB,GAAG,CAAC,cAAc,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAqBjH,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,EAC7C,aAAa,CAAC,EAAE,wBAAwB,GACvC,IAAI,CAIN;AAED,uGAAuG;AACvG,wBAAsB,uBAAuB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB5F;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAK,CAAC,IAC1F,KAAK;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,KAAG,OAAO,CAAC,CAAC,CAAC,CAInE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAkBD,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAI7G;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAclH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAsBnG"}

package/dist/agents/credential-resolver.js

@@ -1,5 +1,8 @@
 //#region src/agents/credential-resolver.ts
+const CREDENTIAL_POLICY_KEY = "mastracode__credentialPolicy";
 let credentialStoreProvider;
+let credentialTenantResolver;
+let trustedTenants = /* @__PURE__ */ new WeakMap();
 const unavailableTenantCredentialStore = {
 	allowEnvironmentFallback: false,
 	reload() {},
@@ -8,8 +11,34 @@ const unavailableTenantCredentialStore = {
 	async getApiKey() {}
 };
 /** Register (or clear) the tenant credential store provider. Deployed-web only. */
-function setCredentialStoreProvider(provider) {
+function setCredentialStoreProvider(provider, resolveTenant) {
 	credentialStoreProvider = provider;
+	credentialTenantResolver = provider ? resolveTenant : void 0;
+	trustedTenants = /* @__PURE__ */ new WeakMap();
+}
+/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */
+async function prepareCredentialTenant(requestContext) {
+	if (!credentialTenantResolver) return;
+	if (!requestContext) throw new Error("Tenant model resolution requires a request context.");
+	const inheritedToken = requestContext.get(CREDENTIAL_POLICY_KEY);
+	const inheritedPolicy = inheritedToken && typeof inheritedToken === "object" ? trustedTenants.get(inheritedToken) : void 0;
+	const sourceController = inheritedPolicy?.sourceContext.get("controller");
+	const sourceContext = inheritedPolicy && sourceController?.resourceId ? inheritedPolicy.sourceContext : requestContext;
+	const token = {};
+	requestContext.set(CREDENTIAL_POLICY_KEY, token);
+	trustedTenants.set(token, { sourceContext });
+	const tenant = await credentialTenantResolver(sourceContext);
+	if (!tenant) throw new Error("Tenant model credential policy could not be resolved.");
+	trustedTenants.set(token, {
+		tenant,
+		sourceContext
+	});
+}
+function withCredentialTenantPreparation(resolve) {
+	return async (ctx) => {
+		await prepareCredentialTenant(ctx.requestContext);
+		return resolve(ctx);
+	};
 }
 /**
 * Whether a tenant provider is registered. Used to disable the
@@ -19,47 +48,38 @@ function setCredentialStoreProvider(provider) {
 function hasCredentialStoreProvider() {
 	return credentialStoreProvider !== void 0;
 }
-/**
-* Whether the request context belongs to a run on a factory-owned session.
-*
-* The agent controller stamps the session's state onto the request context
-* under `controller`, and only trusted factory server code ever writes
-* `factoryProjectId` into session state (board-run creation) — interactive
-* chat sessions never carry it. Runs on such sessions resolve credentials
-* org > user regardless of who sent the message: a board run continued
-* interactively, or a model switch inside it, is still org work.
-*/
-function isFactorySessionContext(requestContext) {
-	const controller = requestContext?.get("controller");
-	if (!controller || typeof controller !== "object") return false;
-	const factoryProjectId = controller.state?.factoryProjectId;
-	return typeof factoryProjectId === "string" && factoryProjectId.length > 0;
+function hasCredentialTenantResolver() {
+	return credentialTenantResolver !== void 0;
+}
+function resolveCredentialScope(requestContext) {
+	return resolveTenantFromRequestContext(requestContext)?.credentialScope ?? "user";
 }
 /**
 * Derive the calling tenant from a request context, if an authenticated web
 * user was stashed on it. Mirrors the web layer's stable-id resolution
 * (`workosId` falling back to the provider `id`).
 *
-* The value under `user` is whatever the active auth provider's
-* `authenticateToken` returned, so its shape follows the provider: a flat user
-* (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the
-* flat shape resolves no tenant at all for the wrapper, which in deployed mode
-* fails closed to an empty credential store.
+* Session state and HTTP-supplied policy values never establish credential authority.
 */
 function resolveTenantFromRequestContext(requestContext) {
+	if (!credentialTenantResolver) return resolveAuthenticatedCredentialTenant(requestContext);
+	const token = requestContext?.get(CREDENTIAL_POLICY_KEY);
+	return token && typeof token === "object" ? trustedTenants.get(token)?.tenant : void 0;
+}
+/** Authenticated principal only, for hosts resolving durable session ownership. */
+function resolveAuthenticatedCredentialTenant(requestContext) {
 	const raw = requestContext?.get("user");
 	if (!raw || typeof raw !== "object") return void 0;
 	const wrapped = Boolean(raw.user && typeof raw.user === "object" && raw.session && typeof raw.session === "object");
 	const user = wrapped ? raw.user : raw;
-	const orgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;
-	const userId = user.workosId ?? user.id;
-	if (typeof userId !== "string" || !userId) return void 0;
-	if (orgId !== void 0 && typeof orgId !== "string") return void 0;
-	const orgFirst = raw.orgFirstCredentials === true || user.orgFirstCredentials === true || isFactorySessionContext(requestContext);
+	const principalOrgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;
+	const principalUserId = user.workosId ?? user.id;
+	if (typeof principalUserId !== "string" || !principalUserId) return void 0;
+	if (principalOrgId !== void 0 && typeof principalOrgId !== "string") return void 0;
 	return {
-		orgId,
-		userId,
-		...orgFirst ? { orgFirst } : {}
+		orgId: principalOrgId,
+		userId: principalUserId,
+		credentialScope: "user"
 	};
 }
 /**
@@ -74,9 +94,8 @@ function resolveCredentialStore(requestContext) {
 	if (!tenant) {
 		const rawUser = requestContext?.get("user");
 		console.warn("[MastraCode] Tenant credential resolution failed closed", {
-			reason: rawUser === void 0 ? "missing-user-context" : "invalid-principal-shape",
-			hasRequestContext: requestContext !== void 0,
-			factorySession: isFactorySessionContext(requestContext)
+			reason: rawUser === void 0 ? "missing-user-context" : "credential-policy-unavailable",
+			hasRequestContext: requestContext !== void 0
 		});
 		return unavailableTenantCredentialStore;
 	}
@@ -85,13 +104,14 @@ function resolveCredentialStore(requestContext) {
 		console.warn("[MastraCode] Tenant credential resolution failed closed", {
 			reason: "credential-store-unavailable",
 			hasOrganization: tenant.orgId !== void 0,
-			orgFirst: tenant.orgFirst === true
+			credentialScope: tenant.credentialScope,
+			ownerResolved: tenant.credentialScope === "factory" || tenant.userId !== void 0
 		});
 		return unavailableTenantCredentialStore;
 	}
 	return store;
 }
 //#endregion
-export { hasCredentialStoreProvider, resolveCredentialStore, resolveTenantFromRequestContext, setCredentialStoreProvider };
+export { hasCredentialStoreProvider, hasCredentialTenantResolver, prepareCredentialTenant, resolveAuthenticatedCredentialTenant, resolveCredentialScope, resolveCredentialStore, resolveTenantFromRequestContext, setCredentialStoreProvider, withCredentialTenantPreparation };
 
 //# sourceMappingURL=credential-resolver.js.map

package/dist/agents/credential-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` derives the calling tenant from the request context\n * (the web auth gate stashes the authenticated user under the `user` key) and\n * resolves credentials through the tenant's own store — user credentials over\n * org credentials over server env vars, with OAuth refresh owned by the store.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\n/** The identity a credential lookup is scoped to. */\nexport interface CredentialTenant {\n  /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n  orgId?: string;\n  /** Stable user id from the web auth adapter. */\n  userId: string;\n  /**\n   * Resolve org-shared credentials over the user's personal ones. Set by\n   * trusted server code for automated (factory) runs so they ride the org's\n   * shared keys first and only fall back to the acting user's credentials.\n   */\n  orgFirst?: boolean;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` to fall back\n * to the global store (e.g. tenant storage temporarily unavailable). Must be\n * synchronous — implementations serve from a primed snapshot and do\n * authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n  allowEnvironmentFallback: false,\n  reload() {},\n  get() {\n    return undefined;\n  },\n  getStoredApiKey() {\n    return undefined;\n  },\n  async getApiKey() {\n    return undefined;\n  },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(provider: CredentialStoreProvider | undefined): void {\n  credentialStoreProvider = provider;\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n  return credentialStoreProvider !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n  workosId?: string;\n  id?: string;\n  organizationId?: string;\n  /** Trusted server code marks automated runs to resolve org > user credentials. */\n  orgFirstCredentials?: boolean;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n  user?: RequestContextUser;\n  session?: { activeOrganizationId?: string };\n}\n\n/**\n * Whether the request context belongs to a run on a factory-owned session.\n *\n * The agent controller stamps the session's state onto the request context\n * under `controller`, and only trusted factory server code ever writes\n * `factoryProjectId` into session state (board-run creation) — interactive\n * chat sessions never carry it. Runs on such sessions resolve credentials\n * org > user regardless of who sent the message: a board run continued\n * interactively, or a model switch inside it, is still org work.\n */\nfunction isFactorySessionContext(requestContext?: RequestContext): boolean {\n  const controller = requestContext?.get('controller') as { state?: { factoryProjectId?: unknown } } | undefined;\n  if (!controller || typeof controller !== 'object') return false;\n  const factoryProjectId = controller.state?.factoryProjectId;\n  return typeof factoryProjectId === 'string' && factoryProjectId.length > 0;\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * The value under `user` is whatever the active auth provider's\n * `authenticateToken` returned, so its shape follows the provider: a flat user\n * (WorkOS) or a `{ session, user }` wrapper (better-auth). Reading only the\n * flat shape resolves no tenant at all for the wrapper, which in deployed mode\n * fails closed to an empty credential store.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n  const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n  if (!raw || typeof raw !== 'object') return undefined;\n\n  // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n  // comes from the session half only, never from the inner user. The two parsers\n  // cannot share code across the package boundary, so they must agree by rule.\n  const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n  const user = wrapped ? (raw.user as RequestContextUser) : raw;\n  const orgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n  const userId = user.workosId ?? user.id;\n  // The slot holds whatever the provider returned, so the declared string\n  // types are hopes, not guarantees. A non-string id must refuse the tenant\n  // (fail closed), not flow onward as a mistyped key.\n  if (typeof userId !== 'string' || !userId) return undefined;\n  if (orgId !== undefined && typeof orgId !== 'string') return undefined;\n  // Only an exact `true` flips precedence — anything else keeps user > org.\n  // Server code stamps the flag on the stashed value itself, so read it from\n  // the top level as well as the unwrapped user (better-auth wrapper shape).\n  const orgFirst =\n    raw.orgFirstCredentials === true || user.orgFirstCredentials === true || isFactorySessionContext(requestContext);\n  return { orgId, userId, ...(orgFirst ? { orgFirst } : {}) };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n  if (!credentialStoreProvider) return undefined;\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) {\n    const rawUser = requestContext?.get('user');\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: rawUser === undefined ? 'missing-user-context' : 'invalid-principal-shape',\n      hasRequestContext: requestContext !== undefined,\n      factorySession: isFactorySessionContext(requestContext),\n    });\n    return unavailableTenantCredentialStore;\n  }\n  const store = credentialStoreProvider(tenant);\n  if (!store) {\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: 'credential-store-unavailable',\n      hasOrganization: tenant.orgId !== undefined,\n      orgFirst: tenant.orgFirst === true,\n    });\n    return unavailableTenantCredentialStore;\n  }\n  return store;\n}\n"],"mappings":";AAuCA,IAAI;AAEJ,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BAA2B,UAAqD;CAC9F,0BAA0B;AAC5B;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;;;;;;;;;;;AA8BA,SAAS,wBAAwB,gBAA0C;CACzE,MAAM,aAAa,gBAAgB,IAAI,YAAY;CACnD,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO;CAC1D,MAAM,mBAAmB,WAAW,OAAO;CAC3C,OAAO,OAAO,qBAAqB,YAAY,iBAAiB,SAAS;AAC3E;;;;;;;;;;;;AAaA,SAAgB,gCAAgC,gBAA+D;CAC7G,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAK5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,QAAQ,UAAU,IAAI,SAAS,uBAAuB,KAAK;CACjE,MAAM,SAAS,KAAK,YAAY,KAAK;CAIrC,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAA;CAClD,IAAI,UAAU,KAAA,KAAa,OAAO,UAAU,UAAU,OAAO,KAAA;CAI7D,MAAM,WACJ,IAAI,wBAAwB,QAAQ,KAAK,wBAAwB,QAAQ,wBAAwB,cAAc;CACjH,OAAO;EAAE;EAAO;EAAQ,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CAAG;AAC5D;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;EACX,MAAM,UAAU,gBAAgB,IAAI,MAAM;EAC1C,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,YAAY,KAAA,IAAY,yBAAyB;GACzD,mBAAmB,mBAAmB,KAAA;GACtC,gBAAgB,wBAAwB,cAAc;EACxD,CAAC;EACD,OAAO;CACT;CACA,MAAM,QAAQ,wBAAwB,MAAM;CAC5C,IAAI,CAAC,OAAO;EACV,QAAQ,KAAK,2DAA2D;GACtE,QAAQ;GACR,iBAAiB,OAAO,UAAU,KAAA;GAClC,UAAU,OAAO,aAAa;EAChC,CAAC;EACD,OAAO;CACT;CACA,OAAO;AACT"}
+{"version":3,"file":"credential-resolver.js","names":[],"sources":["../../src/agents/credential-resolver.ts"],"sourcesContent":["/**\n * Per-tenant credential resolution seam for deployed (multi-user) servers.\n *\n * Locally, model resolution reads the server-global file-backed `AuthStorage`.\n * A deployed web host registers a {@link CredentialStoreProvider} at boot; from\n * then on `resolveModel` uses the host's trusted execution policy, never mutable\n * session state. Factory scope reads organization credentials only. User scope reads\n * the Factory session owner's credentials only, or the authenticated principal\n * for project-less personal sessions.\n *\n * When no provider is registered (TUI, local web), everything falls through to\n * the existing global behavior unchanged.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { CredentialStore } from '../auth/types.js';\n\nexport type CredentialScope = 'factory' | 'user';\n\n/** The identity and exclusive scope a credential lookup is resolved against. */\nexport interface CredentialTenant {\n  /** Org tenant; absent for personal accounts (store impls may synthesize one). */\n  orgId?: string;\n  /** Stable user id used for user-scoped credentials and tenant cache keys. */\n  userId: string;\n  /** Exclusive credential scope for this request. */\n  credentialScope: CredentialScope;\n}\n\n/**\n * Returns a tenant-scoped {@link CredentialStore}, or `undefined` when tenant\n * storage is unavailable. Must be synchronous — implementations serve from a\n * primed snapshot and do authoritative async work inside `getApiKey`.\n */\nexport type CredentialStoreProvider = (tenant: CredentialTenant) => CredentialStore | undefined;\n\nexport type CredentialTenantResolver = (requestContext: RequestContext) => Promise<CredentialTenant | undefined>;\n\nconst CREDENTIAL_POLICY_KEY = 'mastracode__credentialPolicy';\nlet credentialStoreProvider: CredentialStoreProvider | undefined;\nlet credentialTenantResolver: CredentialTenantResolver | undefined;\nlet trustedTenants = new WeakMap<object, { tenant?: CredentialTenant; sourceContext: RequestContext }>();\n\nconst unavailableTenantCredentialStore: CredentialStore = {\n  allowEnvironmentFallback: false,\n  reload() {},\n  get() {\n    return undefined;\n  },\n  getStoredApiKey() {\n    return undefined;\n  },\n  async getApiKey() {\n    return undefined;\n  },\n};\n\n/** Register (or clear) the tenant credential store provider. Deployed-web only. */\nexport function setCredentialStoreProvider(\n  provider: CredentialStoreProvider | undefined,\n  resolveTenant?: CredentialTenantResolver,\n): void {\n  credentialStoreProvider = provider;\n  credentialTenantResolver = provider ? resolveTenant : undefined;\n  trustedTenants = new WeakMap();\n}\n\n/** Refresh authority before a fresh model invocation; cloned contexts inherit only an opaque token. */\nexport async function prepareCredentialTenant(requestContext?: RequestContext): Promise<void> {\n  if (!credentialTenantResolver) return;\n  if (!requestContext) throw new Error('Tenant model resolution requires a request context.');\n  const inheritedToken = requestContext.get(CREDENTIAL_POLICY_KEY);\n  const inheritedPolicy =\n    inheritedToken && typeof inheritedToken === 'object' ? trustedTenants.get(inheritedToken) : undefined;\n  // Subagents and internal memory contexts can strip the controller's thread identity.\n  // Keep their billing origin outside those mutable context fields.\n  const sourceController = inheritedPolicy?.sourceContext.get('controller') as { resourceId?: string } | undefined;\n  const sourceContext =\n    inheritedPolicy && sourceController?.resourceId ? inheritedPolicy.sourceContext : requestContext;\n  const token = {};\n  requestContext.set(CREDENTIAL_POLICY_KEY, token);\n  trustedTenants.set(token, { sourceContext });\n  const tenant = await credentialTenantResolver(sourceContext);\n  if (!tenant) throw new Error('Tenant model credential policy could not be resolved.');\n  trustedTenants.set(token, { tenant, sourceContext });\n}\n\nexport function withCredentialTenantPreparation<T>(resolve: (ctx: { requestContext: RequestContext }) => T) {\n  return async (ctx: { requestContext: RequestContext }): Promise<T> => {\n    await prepareCredentialTenant(ctx.requestContext);\n    return resolve(ctx);\n  };\n}\n\n/**\n * Whether a tenant provider is registered. Used to disable the\n * `loadStoredApiKeysIntoEnv` side-channel in deployed mode — per-tenant\n * credentials must never leak into process-global env vars.\n */\nexport function hasCredentialStoreProvider(): boolean {\n  return credentialStoreProvider !== undefined;\n}\n\nexport function hasCredentialTenantResolver(): boolean {\n  return credentialTenantResolver !== undefined;\n}\n\n/** Shape the web auth gate stashes on the request context under `user`. */\ninterface RequestContextUser {\n  workosId?: string;\n  id?: string;\n  organizationId?: string;\n}\n\n/**\n * Session-shaped `authenticateToken` results (better-auth) arrive as a wrapper\n * whose active org lives on the session half rather than on the user.\n */\ninterface RequestContextSession {\n  user?: RequestContextUser;\n  session?: { activeOrganizationId?: string };\n}\n\nexport function resolveCredentialScope(requestContext?: RequestContext): CredentialScope {\n  return resolveTenantFromRequestContext(requestContext)?.credentialScope ?? 'user';\n}\n\n/**\n * Derive the calling tenant from a request context, if an authenticated web\n * user was stashed on it. Mirrors the web layer's stable-id resolution\n * (`workosId` falling back to the provider `id`).\n *\n * Session state and HTTP-supplied policy values never establish credential authority.\n */\nexport function resolveTenantFromRequestContext(requestContext?: RequestContext): CredentialTenant | undefined {\n  if (!credentialTenantResolver) return resolveAuthenticatedCredentialTenant(requestContext);\n  const token = requestContext?.get(CREDENTIAL_POLICY_KEY);\n  return token && typeof token === 'object' ? trustedTenants.get(token)?.tenant : undefined;\n}\n\n/** Authenticated principal only, for hosts resolving durable session ownership. */\nexport function resolveAuthenticatedCredentialTenant(requestContext?: RequestContext): CredentialTenant | undefined {\n  const raw = requestContext?.get('user') as (RequestContextUser & RequestContextSession) | undefined;\n  if (!raw || typeof raw !== 'object') return undefined;\n\n  // Precedence matches `toFactoryAuthUser` in `@mastra/factory`: a wrapper's org\n  // comes from the session half only, never from the inner user.\n  const wrapped = Boolean(raw.user && typeof raw.user === 'object' && raw.session && typeof raw.session === 'object');\n  const user = wrapped ? (raw.user as RequestContextUser) : raw;\n  const principalOrgId = wrapped ? raw.session?.activeOrganizationId : user.organizationId;\n  const principalUserId = user.workosId ?? user.id;\n  if (typeof principalUserId !== 'string' || !principalUserId) return undefined;\n  if (principalOrgId !== undefined && typeof principalOrgId !== 'string') return undefined;\n\n  return { orgId: principalOrgId, userId: principalUserId, credentialScope: 'user' };\n}\n\n/**\n * Resolve the credential store for a request. Local mode returns `undefined`\n * and keeps the global `AuthStorage` behavior. Once deployed web registers a\n * provider, missing tenant identity or unavailable tenant storage fails closed\n * through an empty store that also disables process-environment fallback.\n */\nexport function resolveCredentialStore(requestContext?: RequestContext): CredentialStore | undefined {\n  if (!credentialStoreProvider) return undefined;\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) {\n    const rawUser = requestContext?.get('user');\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: rawUser === undefined ? 'missing-user-context' : 'credential-policy-unavailable',\n      hasRequestContext: requestContext !== undefined,\n    });\n    return unavailableTenantCredentialStore;\n  }\n  const store = credentialStoreProvider(tenant);\n  if (!store) {\n    console.warn('[MastraCode] Tenant credential resolution failed closed', {\n      reason: 'credential-store-unavailable',\n      hasOrganization: tenant.orgId !== undefined,\n      credentialScope: tenant.credentialScope,\n      ownerResolved: tenant.credentialScope === 'factory' || tenant.userId !== undefined,\n    });\n    return unavailableTenantCredentialStore;\n  }\n  return store;\n}\n"],"mappings":";AAsCA,MAAM,wBAAwB;AAC9B,IAAI;AACJ,IAAI;AACJ,IAAI,iCAAiB,IAAI,QAA8E;AAEvG,MAAM,mCAAoD;CACxD,0BAA0B;CAC1B,SAAS,CAAC;CACV,MAAM,CAEN;CACA,kBAAkB,CAElB;CACA,MAAM,YAAY,CAElB;AACF;;AAGA,SAAgB,2BACd,UACA,eACM;CACN,0BAA0B;CAC1B,2BAA2B,WAAW,gBAAgB,KAAA;CACtD,iCAAiB,IAAI,QAAQ;AAC/B;;AAGA,eAAsB,wBAAwB,gBAAgD;CAC5F,IAAI,CAAC,0BAA0B;CAC/B,IAAI,CAAC,gBAAgB,MAAM,IAAI,MAAM,qDAAqD;CAC1F,MAAM,iBAAiB,eAAe,IAAI,qBAAqB;CAC/D,MAAM,kBACJ,kBAAkB,OAAO,mBAAmB,WAAW,eAAe,IAAI,cAAc,IAAI,KAAA;CAG9F,MAAM,mBAAmB,iBAAiB,cAAc,IAAI,YAAY;CACxE,MAAM,gBACJ,mBAAmB,kBAAkB,aAAa,gBAAgB,gBAAgB;CACpF,MAAM,QAAQ,CAAC;CACf,eAAe,IAAI,uBAAuB,KAAK;CAC/C,eAAe,IAAI,OAAO,EAAE,cAAc,CAAC;CAC3C,MAAM,SAAS,MAAM,yBAAyB,aAAa;CAC3D,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,uDAAuD;CACpF,eAAe,IAAI,OAAO;EAAE;EAAQ;CAAc,CAAC;AACrD;AAEA,SAAgB,gCAAmC,SAAyD;CAC1G,OAAO,OAAO,QAAwD;EACpE,MAAM,wBAAwB,IAAI,cAAc;EAChD,OAAO,QAAQ,GAAG;CACpB;AACF;;;;;;AAOA,SAAgB,6BAAsC;CACpD,OAAO,4BAA4B,KAAA;AACrC;AAEA,SAAgB,8BAAuC;CACrD,OAAO,6BAA6B,KAAA;AACtC;AAkBA,SAAgB,uBAAuB,gBAAkD;CACvF,OAAO,gCAAgC,cAAc,CAAC,EAAE,mBAAmB;AAC7E;;;;;;;;AASA,SAAgB,gCAAgC,gBAA+D;CAC7G,IAAI,CAAC,0BAA0B,OAAO,qCAAqC,cAAc;CACzF,MAAM,QAAQ,gBAAgB,IAAI,qBAAqB;CACvD,OAAO,SAAS,OAAO,UAAU,WAAW,eAAe,IAAI,KAAK,CAAC,EAAE,SAAS,KAAA;AAClF;;AAGA,SAAgB,qCAAqC,gBAA+D;CAClH,MAAM,MAAM,gBAAgB,IAAI,MAAM;CACtC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAI5C,MAAM,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,YAAY,IAAI,WAAW,OAAO,IAAI,YAAY,QAAQ;CAClH,MAAM,OAAO,UAAW,IAAI,OAA8B;CAC1D,MAAM,iBAAiB,UAAU,IAAI,SAAS,uBAAuB,KAAK;CAC1E,MAAM,kBAAkB,KAAK,YAAY,KAAK;CAC9C,IAAI,OAAO,oBAAoB,YAAY,CAAC,iBAAiB,OAAO,KAAA;CACpE,IAAI,mBAAmB,KAAA,KAAa,OAAO,mBAAmB,UAAU,OAAO,KAAA;CAE/E,OAAO;EAAE,OAAO;EAAgB,QAAQ;EAAiB,iBAAiB;CAAO;AACnF;;;;;;;AAQA,SAAgB,uBAAuB,gBAA8D;CACnG,IAAI,CAAC,yBAAyB,OAAO,KAAA;CACrC,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;EACX,MAAM,UAAU,gBAAgB,IAAI,MAAM;EAC1C,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,YAAY,KAAA,IAAY,yBAAyB;GACzD,mBAAmB,mBAAmB,KAAA;EACxC,CAAC;EACD,OAAO;CACT;CACA,MAAM,QAAQ,wBAAwB,MAAM;CAC5C,IAAI,CAAC,OAAO;EACV,QAAQ,KAAK,2DAA2D;GACtE,QAAQ;GACR,iBAAiB,OAAO,UAAU,KAAA;GAClC,iBAAiB,OAAO;GACxB,eAAe,OAAO,oBAAoB,aAAa,OAAO,WAAW,KAAA;EAC3E,CAAC;EACD,OAAO;CACT;CACA,OAAO;AACT"}

package/dist/agents/instructions.d.ts

@@ -1,6 +1,6 @@
 import type { MastraCodeState } from '../schema.js';
 import type { PromptSection } from './prompts/index.js';
-export declare function getDynamicInstructions({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents, }: {
+export declare function getDynamicInstructions({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents, disabledBuiltinTools, }: {
     requestContext: {
         get(key: string): unknown;
     };
@@ -11,13 +11,14 @@ export declare function getDynamicInstructions({ requestContext, hostInstruction
     };
     hasSubconscious?: boolean | ((state: MastraCodeState | undefined) => boolean);
     hasSubagents?: boolean;
+    disabledBuiltinTools?: readonly string[];
 }): Promise<string>;
 /**
  * The system instructions as labeled sections, so callers that attribute
  * context cost per source (the `/context` audit) measure the same strings that
  * `getDynamicInstructions` sends rather than reconstructing them.
  */
-export declare function getDynamicInstructionSections({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents, }: {
+export declare function getDynamicInstructionSections({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents, disabledBuiltinTools, }: {
     requestContext: {
         get(key: string): unknown;
     };
@@ -33,5 +34,7 @@ export declare function getDynamicInstructionSections({ requestContext, hostInst
      */
     hasSubconscious?: boolean | ((state: MastraCodeState | undefined) => boolean);
     hasSubagents?: boolean;
+    /** Controller built-in tools removed via `disableBuiltinTools`; their prompt guidance is omitted. */
+    disabledBuiltinTools?: readonly string[];
 }): Promise<PromptSection[]>;
 //# sourceMappingURL=instructions.d.ts.map

package/dist/agents/instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/agents/instructions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAC;AAG7E,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGvE,wBAAsB,sBAAsB,CAAC,EAC3C,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,GACb,EAAE;IACD,cAAc,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,eAAe,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlB;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,GACb,EAAE;IACD,cAAc,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAkD3B"}
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/agents/instructions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAC;AAG7E,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGvE,wBAAsB,sBAAsB,CAAC,EAC3C,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,EAAE;IACD,cAAc,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,eAAe,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GAAG,OAAO,CAAC,MAAM,CAAC,CAWlB;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,EAAE;IACD,cAAc,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qGAAqG;IACrG,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAmD3B"}

package/dist/agents/instructions.js

@@ -2,13 +2,14 @@ import { getCurrentGitBranchAsync } from "../utils/project.js";
 import { detectCommonBinariesAsync } from "../utils/binaries.js";
 import { buildFullPromptSections, joinPromptSections } from "./prompts/index.js";
 //#region src/agents/instructions.ts
-async function getDynamicInstructions({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents }) {
+async function getDynamicInstructions({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents, disabledBuiltinTools }) {
 	return joinPromptSections(await getDynamicInstructionSections({
 		requestContext,
 		hostInstructions,
 		coAuthor,
 		hasSubconscious,
-		hasSubagents
+		hasSubagents,
+		disabledBuiltinTools
 	}));
 }
 /**
@@ -16,7 +17,7 @@ async function getDynamicInstructions({ requestContext, hostInstructions, coAuth
 * context cost per source (the `/context` audit) measure the same strings that
 * `getDynamicInstructions` sends rather than reconstructing them.
 */
-async function getDynamicInstructionSections({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents }) {
+async function getDynamicInstructionSections({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents, disabledBuiltinTools }) {
 	const agentControllerContext = requestContext.get("controller");
 	const state = agentControllerContext?.getState();
 	const modeId = agentControllerContext?.session?.modeId ?? "build";
@@ -39,7 +40,8 @@ async function getDynamicInstructionSections({ requestContext, hostInstructions,
 		state,
 		hostInstructions,
 		hasSubagents,
-		hasSubconscious: typeof hasSubconscious === "function" ? hasSubconscious(state) : hasSubconscious
+		hasSubconscious: typeof hasSubconscious === "function" ? hasSubconscious(state) : hasSubconscious,
+		disabledBuiltinTools
 	});
 	const pluginInstructions = state?.pluginInstructions?.filter((instruction) => instruction.trim().length > 0) ?? [];
 	if (pluginInstructions.length === 0) return promptSections;

package/dist/agents/instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.js","names":[],"sources":["../../src/agents/instructions.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { MastraCodeComposedState, MastraCodeState } from '../schema.js';\nimport { detectCommonBinariesAsync } from '../utils/binaries.js';\nimport { getCurrentGitBranchAsync } from '../utils/project.js';\nimport type { PromptContext, PromptSection } from './prompts/index.js';\nimport { buildFullPromptSections, joinPromptSections } from './prompts/index.js';\n\nexport async function getDynamicInstructions({\n  requestContext,\n  hostInstructions,\n  coAuthor,\n  hasSubconscious,\n  hasSubagents,\n}: {\n  requestContext: { get(key: string): unknown };\n  hostInstructions?: string;\n  coAuthor?: { name?: string; email?: string };\n  hasSubconscious?: boolean | ((state: MastraCodeState | undefined) => boolean);\n  hasSubagents?: boolean;\n}): Promise<string> {\n  return joinPromptSections(\n    await getDynamicInstructionSections({ requestContext, hostInstructions, coAuthor, hasSubconscious, hasSubagents }),\n  );\n}\n\n/**\n * The system instructions as labeled sections, so callers that attribute\n * context cost per source (the `/context` audit) measure the same strings that\n * `getDynamicInstructions` sends rather than reconstructing them.\n */\nexport async function getDynamicInstructionSections({\n  requestContext,\n  hostInstructions,\n  coAuthor,\n  hasSubconscious,\n  hasSubagents,\n}: {\n  requestContext: { get(key: string): unknown };\n  hostInstructions?: string;\n  coAuthor?: { name?: string; email?: string };\n  /**\n   * The subconscious knowledge tools are registered on the agent. A function\n   * is resolved against the session state, since Factory sessions can refuse\n   * the subconscious per request.\n   */\n  hasSubconscious?: boolean | ((state: MastraCodeState | undefined) => boolean);\n  hasSubagents?: boolean;\n}): Promise<PromptSection[]> {\n  const agentControllerContext = requestContext.get('controller') as\n    | AgentControllerRequestContext<MastraCodeComposedState>\n    | undefined;\n  const state = agentControllerContext?.getState();\n  const modeId = agentControllerContext?.session?.modeId ?? 'build';\n  // No host fallback: when the session carries no project (hosted chat-only\n  // sessions), the prompt gets no working directory and no git probe — the\n  // server's own cwd/branch must never leak into a session's prompt.\n  const projectPath = state?.projectPath ?? '';\n\n  const promptCtx: PromptContext = {\n    projectPath,\n    projectName: state?.projectName ?? '',\n    gitBranch: projectPath ? ((await getCurrentGitBranchAsync(projectPath)) ?? state?.gitBranch) : undefined,\n    platform: process.platform,\n    commonBinaries: await detectCommonBinariesAsync(),\n    date: new Date().toISOString().split('T')[0]!,\n    mode: modeId,\n    modelId: agentControllerContext?.session?.modelId || undefined,\n    coAuthorName: coAuthor?.name,\n    coAuthorEmail: coAuthor?.email,\n    activePlan: state?.activePlan ?? null,\n    modeId: modeId,\n    currentDate: new Date().toISOString().split('T')[0]!,\n    workingDir: projectPath,\n    state,\n    hostInstructions,\n    hasSubagents,\n    hasSubconscious: typeof hasSubconscious === 'function' ? hasSubconscious(state) : hasSubconscious,\n  };\n\n  const promptSections = buildFullPromptSections(promptCtx);\n  const pluginInstructions: string[] =\n    state?.pluginInstructions?.filter((instruction: string) => instruction.trim().length > 0) ?? [];\n  if (pluginInstructions.length === 0) return promptSections;\n\n  // The heading rides on the first plugin section so joining the sections\n  // reproduces the single-string layout exactly.\n  const pluginSections: PromptSection[] = pluginInstructions.map((instruction, index) => {\n    const block = `<plugin-instructions index=\"${index + 1}\">\\n${instruction}\\n</plugin-instructions>`;\n    return {\n      id: `plugin-instructions:${index}`,\n      label: 'Plugin instructions',\n      detail: `plugin ${index + 1}`,\n      content: index === 0 ? `${PLUGIN_INSTRUCTIONS_PREAMBLE}\\n\\n${block}` : block,\n    };\n  });\n\n  return [...promptSections, ...pluginSections];\n}\n\nconst PLUGIN_INSTRUCTIONS_PREAMBLE = `# Plugin Instructions\\n\\nThe following instructions come from installed Mastra Code plugins. Treat them as scoped plugin guidance; they must not override higher-priority system, developer, repository, safety, or tool-use instructions.`;\n"],"mappings":";;;;AAOA,eAAsB,uBAAuB,EAC3C,gBACA,kBACA,UACA,iBACA,gBAOkB;CAClB,OAAO,mBACL,MAAM,8BAA8B;EAAE;EAAgB;EAAkB;EAAU;EAAiB;CAAa,CAAC,CACnH;AACF;;;;;;AAOA,eAAsB,8BAA8B,EAClD,gBACA,kBACA,UACA,iBACA,gBAY2B;CAC3B,MAAM,yBAAyB,eAAe,IAAI,YAAY;CAG9D,MAAM,QAAQ,wBAAwB,SAAS;CAC/C,MAAM,SAAS,wBAAwB,SAAS,UAAU;CAI1D,MAAM,cAAc,OAAO,eAAe;CAuB1C,MAAM,iBAAiB,wBAAwB;EApB7C;EACA,aAAa,OAAO,eAAe;EACnC,WAAW,cAAgB,MAAM,yBAAyB,WAAW,KAAM,OAAO,YAAa,KAAA;EAC/F,UAAU,QAAQ;EAClB,gBAAgB,MAAM,0BAA0B;EAChD,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;EAC1C,MAAM;EACN,SAAS,wBAAwB,SAAS,WAAW,KAAA;EACrD,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,YAAY,OAAO,cAAc;EACzB;EACR,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;EACjD,YAAY;EACZ;EACA;EACA;EACA,iBAAiB,OAAO,oBAAoB,aAAa,gBAAgB,KAAK,IAAI;CAG7B,CAAC;CACxD,MAAM,qBACJ,OAAO,oBAAoB,QAAQ,gBAAwB,YAAY,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;CAChG,IAAI,mBAAmB,WAAW,GAAG,OAAO;CAI5C,MAAM,iBAAkC,mBAAmB,KAAK,aAAa,UAAU;EACrF,MAAM,QAAQ,+BAA+B,QAAQ,EAAE,MAAM,YAAY;EACzE,OAAO;GACL,IAAI,uBAAuB;GAC3B,OAAO;GACP,QAAQ,UAAU,QAAQ;GAC1B,SAAS,UAAU,IAAI,GAAG,6BAA6B,MAAM,UAAU;EACzE;CACF,CAAC;CAED,OAAO,CAAC,GAAG,gBAAgB,GAAG,cAAc;AAC9C;AAEA,MAAM,+BAA+B"}
+{"version":3,"file":"instructions.js","names":[],"sources":["../../src/agents/instructions.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { MastraCodeComposedState, MastraCodeState } from '../schema.js';\nimport { detectCommonBinariesAsync } from '../utils/binaries.js';\nimport { getCurrentGitBranchAsync } from '../utils/project.js';\nimport type { PromptContext, PromptSection } from './prompts/index.js';\nimport { buildFullPromptSections, joinPromptSections } from './prompts/index.js';\n\nexport async function getDynamicInstructions({\n  requestContext,\n  hostInstructions,\n  coAuthor,\n  hasSubconscious,\n  hasSubagents,\n  disabledBuiltinTools,\n}: {\n  requestContext: { get(key: string): unknown };\n  hostInstructions?: string;\n  coAuthor?: { name?: string; email?: string };\n  hasSubconscious?: boolean | ((state: MastraCodeState | undefined) => boolean);\n  hasSubagents?: boolean;\n  disabledBuiltinTools?: readonly string[];\n}): Promise<string> {\n  return joinPromptSections(\n    await getDynamicInstructionSections({\n      requestContext,\n      hostInstructions,\n      coAuthor,\n      hasSubconscious,\n      hasSubagents,\n      disabledBuiltinTools,\n    }),\n  );\n}\n\n/**\n * The system instructions as labeled sections, so callers that attribute\n * context cost per source (the `/context` audit) measure the same strings that\n * `getDynamicInstructions` sends rather than reconstructing them.\n */\nexport async function getDynamicInstructionSections({\n  requestContext,\n  hostInstructions,\n  coAuthor,\n  hasSubconscious,\n  hasSubagents,\n  disabledBuiltinTools,\n}: {\n  requestContext: { get(key: string): unknown };\n  hostInstructions?: string;\n  coAuthor?: { name?: string; email?: string };\n  /**\n   * The subconscious knowledge tools are registered on the agent. A function\n   * is resolved against the session state, since Factory sessions can refuse\n   * the subconscious per request.\n   */\n  hasSubconscious?: boolean | ((state: MastraCodeState | undefined) => boolean);\n  hasSubagents?: boolean;\n  /** Controller built-in tools removed via `disableBuiltinTools`; their prompt guidance is omitted. */\n  disabledBuiltinTools?: readonly string[];\n}): Promise<PromptSection[]> {\n  const agentControllerContext = requestContext.get('controller') as\n    | AgentControllerRequestContext<MastraCodeComposedState>\n    | undefined;\n  const state = agentControllerContext?.getState();\n  const modeId = agentControllerContext?.session?.modeId ?? 'build';\n  // No host fallback: when the session carries no project (hosted chat-only\n  // sessions), the prompt gets no working directory and no git probe — the\n  // server's own cwd/branch must never leak into a session's prompt.\n  const projectPath = state?.projectPath ?? '';\n\n  const promptCtx: PromptContext = {\n    projectPath,\n    projectName: state?.projectName ?? '',\n    gitBranch: projectPath ? ((await getCurrentGitBranchAsync(projectPath)) ?? state?.gitBranch) : undefined,\n    platform: process.platform,\n    commonBinaries: await detectCommonBinariesAsync(),\n    date: new Date().toISOString().split('T')[0]!,\n    mode: modeId,\n    modelId: agentControllerContext?.session?.modelId || undefined,\n    coAuthorName: coAuthor?.name,\n    coAuthorEmail: coAuthor?.email,\n    activePlan: state?.activePlan ?? null,\n    modeId: modeId,\n    currentDate: new Date().toISOString().split('T')[0]!,\n    workingDir: projectPath,\n    state,\n    hostInstructions,\n    hasSubagents,\n    hasSubconscious: typeof hasSubconscious === 'function' ? hasSubconscious(state) : hasSubconscious,\n    disabledBuiltinTools,\n  };\n\n  const promptSections = buildFullPromptSections(promptCtx);\n  const pluginInstructions: string[] =\n    state?.pluginInstructions?.filter((instruction: string) => instruction.trim().length > 0) ?? [];\n  if (pluginInstructions.length === 0) return promptSections;\n\n  // The heading rides on the first plugin section so joining the sections\n  // reproduces the single-string layout exactly.\n  const pluginSections: PromptSection[] = pluginInstructions.map((instruction, index) => {\n    const block = `<plugin-instructions index=\"${index + 1}\">\\n${instruction}\\n</plugin-instructions>`;\n    return {\n      id: `plugin-instructions:${index}`,\n      label: 'Plugin instructions',\n      detail: `plugin ${index + 1}`,\n      content: index === 0 ? `${PLUGIN_INSTRUCTIONS_PREAMBLE}\\n\\n${block}` : block,\n    };\n  });\n\n  return [...promptSections, ...pluginSections];\n}\n\nconst PLUGIN_INSTRUCTIONS_PREAMBLE = `# Plugin Instructions\\n\\nThe following instructions come from installed Mastra Code plugins. Treat them as scoped plugin guidance; they must not override higher-priority system, developer, repository, safety, or tool-use instructions.`;\n"],"mappings":";;;;AAOA,eAAsB,uBAAuB,EAC3C,gBACA,kBACA,UACA,iBACA,cACA,wBAQkB;CAClB,OAAO,mBACL,MAAM,8BAA8B;EAClC;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;AACF;;;;;;AAOA,eAAsB,8BAA8B,EAClD,gBACA,kBACA,UACA,iBACA,cACA,wBAc2B;CAC3B,MAAM,yBAAyB,eAAe,IAAI,YAAY;CAG9D,MAAM,QAAQ,wBAAwB,SAAS;CAC/C,MAAM,SAAS,wBAAwB,SAAS,UAAU;CAI1D,MAAM,cAAc,OAAO,eAAe;CAwB1C,MAAM,iBAAiB,wBAAwB;EArB7C;EACA,aAAa,OAAO,eAAe;EACnC,WAAW,cAAgB,MAAM,yBAAyB,WAAW,KAAM,OAAO,YAAa,KAAA;EAC/F,UAAU,QAAQ;EAClB,gBAAgB,MAAM,0BAA0B;EAChD,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;EAC1C,MAAM;EACN,SAAS,wBAAwB,SAAS,WAAW,KAAA;EACrD,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,YAAY,OAAO,cAAc;EACzB;EACR,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;EACjD,YAAY;EACZ;EACA;EACA;EACA,iBAAiB,OAAO,oBAAoB,aAAa,gBAAgB,KAAK,IAAI;EAClF;CAGqD,CAAC;CACxD,MAAM,qBACJ,OAAO,oBAAoB,QAAQ,gBAAwB,YAAY,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;CAChG,IAAI,mBAAmB,WAAW,GAAG,OAAO;CAI5C,MAAM,iBAAkC,mBAAmB,KAAK,aAAa,UAAU;EACrF,MAAM,QAAQ,+BAA+B,QAAQ,EAAE,MAAM,YAAY;EACzE,OAAO;GACL,IAAI,uBAAuB;GAC3B,OAAO;GACP,QAAQ,UAAU,QAAQ;GAC1B,SAAS,UAAU,IAAI,GAAG,6BAA6B,MAAM,UAAU;EACzE;CACF,CAAC;CAED,OAAO,CAAC,GAAG,gBAAgB,GAAG,cAAc;AAC9C;AAEA,MAAM,+BAA+B"}

package/dist/agents/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agents/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAiC,MAAM,uBAAuB,CAAC;AAI9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAsLpD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AA8BlC;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAElH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,CAAC,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,SAAS,CAAC,EAAE,SAAS,yBAsBsB;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE;IAmJ3E;;;OAGG;eACc,OAAO,CAAC,IAAI,CAAC;EAKjC"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/agents/memory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAiC,MAAM,uBAAuB,CAAC;AAI9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAsLpD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AA8BlC;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAElH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,CAAC,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,SAAS,CAAC,EAAE,SAAS,yBAsBsB;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE;IAmJ3E;;;OAGG;eACc,OAAO,CAAC,IAAI,CAAC;EAKjC"}

package/dist/agents/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","names":[],"sources":["../../src/agents/memory.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { Knowledge } from '@mastra/core/knowledge';\nimport type { GatewayLanguageModel } from '@mastra/core/llm';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MastraCompositeStore } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport { fastembed } from '@mastra/fastembed';\nimport { Memory, Subconscious } from '@mastra/memory';\nimport { DEFAULT_OBS_THRESHOLD, DEFAULT_REF_THRESHOLD } from '../constants.js';\nimport { LOCAL_KNOWLEDGE_ORG_ID, resolveKnowledgeScopeIdentity } from '../knowledge-scope.js';\nimport { MASTRACODE_AUTO_OM_MODELS, resolveAutoOMModelId } from '../onboarding/packs.js';\nimport { loadSettings } from '../onboarding/settings.js';\nimport { ANTHROPIC_PROMPT_CACHE_TTL } from '../providers/anthropic-prompt-cache.js';\nimport type { MastraCodeState } from '../schema.js';\nimport { getOmScope } from '../utils/project.js';\nimport { getActiveMemoryRoute, resolveModel } from './model.js';\n\n/** Route-backed OM fallback entry. */\ntype MemoryModelRouteEntry = { id: string; model: GatewayLanguageModel };\n\n/**\n * Resolve the active model route's memory models, starting at a same-thread\n * pending fallback hop. Returns `'auto'` when the route's first memory model is\n * Auto, and `undefined` when the route sets no memory model.\n */\nfunction resolveRouteMemoryModels(\n  state: MastraCodeState | undefined,\n  threadId: string | null | undefined,\n  resolve: (modelId: string) => GatewayLanguageModel,\n): MemoryModelRouteEntry[] | 'auto' | undefined {\n  const memoryRoute = getActiveMemoryRoute(state, threadId);\n  if (memoryRoute[0]?.memoryModelId === 'auto') return 'auto';\n  const seenModelIds = new Set<string>();\n  const appearances = new Map<string, number>();\n  const entries: MemoryModelRouteEntry[] = [];\n  for (const entry of memoryRoute) {\n    if (!entry.memoryModelId || entry.memoryModelId === 'auto' || seenModelIds.has(entry.memoryModelId)) continue;\n    seenModelIds.add(entry.memoryModelId);\n    const occurrence = (appearances.get(entry.id) ?? 0) + 1;\n    appearances.set(entry.id, occurrence);\n    try {\n      entries.push({\n        id: `${entry.id}:memory${occurrence === 1 ? '' : `#${occurrence}`}`,\n        model: resolve(entry.memoryModelId),\n      });\n    } catch {\n      break;\n    }\n  }\n  return entries.length > 0 ? entries : undefined;\n}\n\n/**\n * The authoritative per-caller Factory memory-settings row, placed on the request\n * context before Factory's model-dependent processors run. `null` means the row\n * exists but is empty (every role auto). An unavailable sentinel or a missing\n * value on a Factory-owned session falls back to Auto roles and default\n * thresholds/attachments, so memory keeps working while Factory reports the error.\n */\ninterface FactoryMemorySettings {\n  observerModelId: string | null;\n  reflectorModelId: string | null;\n  observationThreshold: number | null;\n  reflectionThreshold: number | null;\n  observeAttachments: 'auto' | boolean | null;\n}\n\ntype FactoryMemorySettingsContext =\n  | FactoryMemorySettings\n  | null\n  | { status: 'unavailable'; reason: string }\n  | undefined;\n\nfunction getFactoryMemorySettingsContext(requestContext: RequestContext): FactoryMemorySettingsContext {\n  return requestContext.get('mastra__factoryMemorySettings') as FactoryMemorySettingsContext;\n}\n\nfunction isFactoryMemorySettingsUnavailable(\n  settings: FactoryMemorySettingsContext,\n): settings is { status: 'unavailable'; reason: string } {\n  return settings !== null && typeof settings === 'object' && 'status' in settings && settings.status === 'unavailable';\n}\n\nfunction getMainModelId(requestContext: RequestContext): string | undefined {\n  const controller = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n  return controller?.session.modelId || (controller?.getState()?.currentModelId as string | undefined);\n}\n\n/**\n * Resolve one OM role's model for this invocation. Returns `'auto'` for Memory's\n * auto policy, or a concrete model. Factory's DB row is authoritative for\n * Factory sessions (an unreadable row falls back to auto). Otherwise the active\n * model route's memory models win, then the per-role selection, then legacy\n * concrete settings.\n */\nfunction resolveOmRoleModelForRequest(\n  role: 'observer' | 'reflector',\n  requestContext: RequestContext,\n  settingsPath?: string,\n  options?: { disableSettingsOmSeed?: boolean },\n): 'auto' | GatewayLanguageModel | MemoryModelRouteEntry[] {\n  const controller = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n  const state = controller?.getState() as MastraCodeState | undefined;\n  const resolveOptions = { remapForCodexOAuth: true, requestContext, anthropicPromptCacheScope: 'system' } as const;\n  const factorySettingsContext = getFactoryMemorySettingsContext(requestContext);\n  const isFactory = typeof state?.factoryProjectId === 'string';\n\n  const useModel = (modelId: string) => {\n    requestContext.set(`om.${role}.selectionMode`, 'model');\n    requestContext.set(`om.${role}.effectiveModelId`, modelId);\n    return resolveModel(modelId, resolveOptions);\n  };\n  const useAuto = () => {\n    requestContext.set(`om.${role}.selectionMode`, 'auto');\n    // These two keys are declared in the span-context allowlist\n    // (`mastracode/sdk/src/index.ts`), so traces can report intent separately from\n    // the effective concrete model without either being mistaken for a model ID.\n    requestContext.set(`om.${role}.effectiveModelId`, resolveAutoOMModelId(getMainModelId(requestContext)));\n    return 'auto' as const;\n  };\n\n  if (\n    isFactoryMemorySettingsUnavailable(factorySettingsContext) ||\n    (factorySettingsContext === undefined && isFactory)\n  ) {\n    return useAuto();\n  }\n  if (factorySettingsContext !== undefined) {\n    const factoryModelId = factorySettingsContext?.[`${role}ModelId`];\n    return factoryModelId ? useModel(factoryModelId) : useAuto();\n  }\n\n  // The configured settings file, not the default one: a caller that points the\n  // agent at another settings path must get the same override resolution for\n  // observational memory as it does for the main model. Hosts that disable the\n  // settings seed never read it.\n  const settings = options?.disableSettingsOmSeed ? undefined : loadSettings(settingsPath);\n  const routeMemory = resolveRouteMemoryModels(state, controller?.threadId, modelId =>\n    resolveModel(modelId, resolveOptions),\n  );\n  if (routeMemory === 'auto') return useAuto();\n  if (routeMemory) {\n    requestContext.set(`om.${role}.selectionMode`, 'model');\n    requestContext.set(`om.${role}.effectiveModelId`, routeMemory[0]?.model.modelId);\n    return routeMemory.length === 1 ? routeMemory[0]!.model : routeMemory;\n  }\n\n  const selection: unknown = state?.[`${role}ModelSelection`];\n  if (selection === 'auto') return useAuto();\n  if (typeof selection === 'string' && selection) return useModel(selection);\n  if (\n    selection &&\n    typeof selection === 'object' &&\n    'modelId' in selection &&\n    typeof selection.modelId === 'string' &&\n    selection.modelId\n  ) {\n    return useModel(selection.modelId);\n  }\n\n  const roleOverride =\n    role === 'observer' ? settings?.models?.observerModelOverride : settings?.models?.reflectorModelOverride;\n  if (roleOverride) return useModel(roleOverride);\n  const legacyModelId = state?.[`${role}ModelId`];\n  if (typeof legacyModelId === 'string' && legacyModelId) return useModel(legacyModelId);\n  return useAuto();\n}\n\nconst DYNAMIC_AGENTS_MD_INSTRUCTION =\n  'Messages wrapped in <system-reminder type=\"dynamic-agents-md\" ...>...</system-reminder> are ephemeral project-context instructions injected from files on disk. Do NOT observe or extract information from these messages — they are reloaded automatically when needed and should not be stored in memory.';\n\n// Derived from https://github.com/JuliusBrussee/caveman and adapted for OM use with fixed full-level compression.\nconst CAVEMAN_OM_INSTRUCTION = `Respond terse like smart caveman. All technical substance stay. Only fluff die.\n\nUse full caveman compression style.\n\nDrop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Fragments OK. Short synonyms (big not extensive, fix not \"implement a solution for\"). Technical terms exact. Code blocks unchanged. Errors quoted exact. Leave out the words \"agent\" and \"assistant\" at the start of each observation line, it is assumed each line is referring to the assistant unless it specifically says it was about the user. Leave out parenthesis and other text characters like * that would not contribute to understanding the observations.\n\nPattern: \\`[thing] [action] [reason]. [next step]\\`\n\nNot: \"Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by...\"\nYes: \"Bug in auth middleware. Token expiry check use < not <=. Fix:\"\n\nExample 1\n🔴 14:31 user asks why React component rerenders\n🟡 14:32 saw inline object prop create new ref each render, cause rerender\n✅ 14:34 fixed render issue by wrap object in useMemo\n\nExample 2\n🟡 15:10 explained pool reuse DB connections, skip repeat handshake overhead\n\nDon't say \"Agent did x\", say \"did x\". It will be assumed the agent did what was observed. The who should only be specified for the user or other third parties: \"user asked x\"\n\nDrop caveman for: security warnings, irreversible action confirmations, multi-step sequences where fragment order risks misread, user asks to clarify or repeats question, and anything that requires remembering verbatim content. Resume caveman after clear part done`;\n\nexport { LOCAL_KNOWLEDGE_ORG_ID };\n\n// One error per session, not per memory resolution. Keyed on the session id\n// rather than the controller object: the controller is read off the request\n// context on every resolution, so it is a fresh object per request and would\n// dedupe nothing. Bounded so a long-running Factory process cannot grow this\n// without limit — refusing sessions are rare, and losing the oldest ids only\n// costs one extra log line.\nconst REPORTED_ORG_UNRESOLVED_LIMIT = 500;\nconst reportedOrgUnresolved = new Set<string>();\n\nfunction reportOrgUnresolved(\n  controller: AgentControllerRequestContext<MastraCodeState> | undefined,\n  factoryProjectId: string | undefined,\n  reason?: string,\n) {\n  const sessionId = controller?.session?.id;\n  if (sessionId) {\n    if (reportedOrgUnresolved.has(sessionId)) return;\n    if (reportedOrgUnresolved.size >= REPORTED_ORG_UNRESOLVED_LIMIT) {\n      reportedOrgUnresolved.delete(reportedOrgUnresolved.values().next().value as string);\n    }\n    reportedOrgUnresolved.add(sessionId);\n  }\n  const session = controller?.session;\n  console.error(\n    `[Subconscious] Knowledge curation disabled: no organization resolved for session ${session?.id ?? 'unknown'} (project ${factoryProjectId ?? 'none'})${reason ? `: ${reason}` : ''}. Knowledge is not written rather than written where it cannot be read.`,\n  );\n}\n\n/**\n * Whether the experimental subconscious (knowledge graph + reminder sidekick)\n * is switched on for this process: it needs a vector store and the opt-in flag.\n */\nexport function isSubconsciousEnabled(vector: MastraVector | undefined): boolean {\n  return Boolean(vector) && process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === '1';\n}\n\n/**\n * Whether the subconscious tools (`knowledge_*`, `ask_memory`) are registered\n * for a given session. Beyond the process-level switch, a Factory-owned\n * session that cannot resolve its org refuses the subconscious entirely (see\n * `getDynamicMemory`, which applies the same two checks inline because it also\n * needs the resolved identity). The system prompt's tool guidance calls here so\n * it never advertises tools that `getDynamicMemory` did not register.\n */\nexport function hasSubconsciousTools(vector: MastraVector | undefined, state: MastraCodeState | undefined): boolean {\n  return isSubconsciousEnabled(vector) && resolveKnowledgeScopeIdentity(state).resolved;\n}\n\n/**\n * Dynamic memory factory function.\n * Reads OM thresholds from controller state via requestContext.\n * Model functions also read from requestContext (no mutable bridge needed).\n */\nexport function getDynamicMemory(\n  storage: MastraCompositeStore,\n  vector?: MastraVector,\n  settingsPath?: string,\n  options?: { disableSettingsOmSeed?: boolean },\n  knowledge?: Knowledge,\n) {\n  // Cache is scoped per storage instance (per getDynamicMemory call) so a\n  // Memory bound to one storage is never reused after storage changes.\n  let cachedMemory: Memory | null = null;\n  let cachedMemoryKey: string | null = null;\n  // Instances replaced by a config change may still have background work in flight.\n  const retiredMemories = new Set<Memory>();\n\n  // Observer/reflector model functions — read the current model ID from\n  // controller state via requestContext (propagated by OM's agent.generate).\n  // Bound here so the configured settings path reaches role overrides and pack\n  // memory-model resolution.\n  const getObserverModel = ({ requestContext }: { requestContext: RequestContext }) =>\n    resolveOmRoleModelForRequest('observer', requestContext, settingsPath, options);\n  const getReflectorModel = ({ requestContext }: { requestContext: RequestContext }) =>\n    resolveOmRoleModelForRequest('reflector', requestContext, settingsPath, options);\n  // Routes the concrete model Memory's `'auto'` picks through Mastra Code's\n  // credential-aware resolver, like every other Mastra Code model.\n  const resolveMemoryModel = (modelId: string, { requestContext }: { requestContext?: RequestContext }) =>\n    resolveModel(modelId, { remapForCodexOAuth: true, requestContext, anthropicPromptCacheScope: 'system' });\n\n  const resolveMemory = ({ requestContext }: { requestContext: RequestContext }) => {\n    const controller = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n    const state = controller?.getState() as MastraCodeState | undefined;\n    const subconsciousEnabled = isSubconsciousEnabled(vector);\n    const factoryProjectId = state?.factoryProjectId;\n    const isFactory = typeof factoryProjectId === 'string' && factoryProjectId.trim().length > 0;\n\n    // A Factory-owned session that could not resolve its org refuses to curate:\n    // writing under a substituted identity produces knowledge the fail-closed\n    // read path can never see.\n    let orgUnresolvedRefusal = false;\n\n    if (subconsciousEnabled) {\n      const identity = resolveKnowledgeScopeIdentity(state);\n      if (identity.resolved) {\n        requestContext.set('organizationId', identity.organizationId);\n      } else {\n        orgUnresolvedRefusal = true;\n        reportOrgUnresolved(controller, identity.knowledgeResourceId, identity.reason);\n      }\n      if (identity.knowledgeResourceId) {\n        requestContext.set('knowledgeResourceId', identity.knowledgeResourceId);\n      }\n    }\n\n    const subconsciousAvailable = subconsciousEnabled && !orgUnresolvedRefusal;\n\n    const omScope = state?.omScope ?? getOmScope(state?.projectPath);\n\n    // The Factory row is authoritative and read per invocation, so a stored\n    // threshold/attachment change reaches the running Memory without a session.\n    const factorySettingsContext = getFactoryMemorySettingsContext(requestContext);\n    const factorySettingsUnavailable =\n      isFactoryMemorySettingsUnavailable(factorySettingsContext) || (factorySettingsContext === undefined && isFactory);\n    const factorySettings = factorySettingsUnavailable ? null : factorySettingsContext;\n    const obsThreshold =\n      factorySettings !== undefined\n        ? (factorySettings?.observationThreshold ?? DEFAULT_OBS_THRESHOLD)\n        : (state?.observationThreshold ?? DEFAULT_OBS_THRESHOLD);\n    const refThreshold =\n      factorySettings !== undefined\n        ? (factorySettings?.reflectionThreshold ?? DEFAULT_REF_THRESHOLD)\n        : (state?.reflectionThreshold ?? DEFAULT_REF_THRESHOLD);\n    const caveman = state?.cavemanObservations ?? false;\n\n    const observerPreviousObservationTokens = 1000;\n    // The row is authoritative: an absent value means the user left it on Auto,\n    // which the config API reports as 'auto' and Memory resolves by model\n    // capability.\n    const observeAttachments =\n      factorySettings !== undefined ? (factorySettings?.observeAttachments ?? 'auto') : state?.observeAttachments;\n    // Factory sessions get a factory-only Subconscious config, so the cache key\n    // carries Factory presence and settings availability to keep those configs\n    // from cross-serving.\n    const cacheKey = `${obsThreshold}:${refThreshold}:${omScope}:${observerPreviousObservationTokens}:${caveman ? 1 : 0}:${observeAttachments}:${isFactory ? 1 : 0}:${subconsciousAvailable ? 1 : 0}`;\n    if (cachedMemory && cachedMemoryKey === cacheKey) {\n      return cachedMemory;\n    }\n\n    // Async buffering is not supported with resource scope — disable it\n    const isResourceScope = omScope === 'resource';\n\n    const observerInstruction = caveman\n      ? `${DYNAMIC_AGENTS_MD_INSTRUCTION}\\n\\n${CAVEMAN_OM_INSTRUCTION}`\n      : DYNAMIC_AGENTS_MD_INSTRUCTION;\n    const reflectionInstruction = caveman ? CAVEMAN_OM_INSTRUCTION : undefined;\n\n    if (cachedMemory) {\n      const retired = cachedMemory;\n      retiredMemories.add(retired);\n      // settled() rejects if the instance's OM engine failed to start; that must not surface as\n      // an unhandled rejection from a background retirement.\n      void retired\n        .settled()\n        .catch(() => {})\n        .finally(() => retiredMemories.delete(retired));\n    }\n\n    cachedMemory = new Memory({\n      storage,\n      ...(knowledge ? { knowledge } : {}),\n      vector: vector || false,\n      embedder: vector ? fastembed.small : undefined,\n      options: {\n        // Generate a durable title from the first user message. Every client uses\n        // the same title in its thread list and active-session chrome. Title\n        // generation takes the primary OM model only — its model field does not\n        // accept fallback arrays.\n        generateTitle:\n          process.env.MASTRACODE_DISABLE_TITLE_GENERATION === '1'\n            ? false\n            : {\n                model: ({ requestContext }) => {\n                  const resolved = getObserverModel({ requestContext });\n                  if (resolved === 'auto') {\n                    return resolveMemoryModel(resolveAutoOMModelId(getMainModelId(requestContext)), { requestContext });\n                  }\n                  return Array.isArray(resolved) ? resolved[0]!.model : resolved;\n                },\n              },\n        observationalMemory:\n          process.env.MASTRACODE_DISABLE_OBSERVATIONAL_MEMORY === '1'\n            ? false\n            : {\n                enabled: true,\n                autoModels: MASTRACODE_AUTO_OM_MODELS,\n                resolveModel: resolveMemoryModel,\n                temporalMarkers: true,\n                retrieval: vector ? { vector: true } : true,\n                experimental_subconscious: subconsciousAvailable\n                  ? new Subconscious({\n                      defaultScope: 'resource',\n                      pins: true,\n                      ...(isFactory ? { maxSteps: 25 } : {}),\n                    })\n                  : undefined,\n                scope: omScope,\n                // The main agent writes Anthropic cache entries with this TTL; 'auto' can't see it.\n                activateAfterIdle: { default: 'auto', anthropic: ANTHROPIC_PROMPT_CACHE_TTL },\n                activateOnProviderChange: true,\n                observation: {\n                  bufferTokens: isResourceScope ? false : 1 / 5,\n                  bufferActivation: isResourceScope ? undefined : 2000,\n                  model: getObserverModel,\n                  messageTokens: obsThreshold,\n                  blockAfter: 2,\n                  previousObserverTokens: observerPreviousObservationTokens,\n                  threadTitle: true,\n                  instruction: observerInstruction,\n                  observeAttachments,\n                },\n                reflection: {\n                  bufferActivation: isResourceScope ? undefined : 1 / 2,\n                  blockAfter: 1.1,\n                  model: getReflectorModel,\n                  observationTokens: refThreshold,\n                  instruction: reflectionInstruction,\n                },\n              },\n      },\n    });\n    cachedMemoryKey = cacheKey;\n\n    return cachedMemory;\n  };\n\n  return Object.assign(resolveMemory, {\n    /**\n     * Wait for background memory work (buffered observations, reflections, indexing) in every\n     * instance this factory created. Await before closing storage.\n     */\n    async settled(): Promise<void> {\n      // Drain every instance even if one rejects, so teardown can still close storage.\n      await Promise.allSettled([cachedMemory?.settled(), ...[...retiredMemories].map(memory => memory.settled())]);\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyBA,SAAS,yBACP,OACA,UACA,SAC8C;CAC9C,MAAM,cAAc,qBAAqB,OAAO,QAAQ;CACxD,IAAI,YAAY,EAAE,EAAE,kBAAkB,QAAQ,OAAO;CACrD,MAAM,+BAAe,IAAI,IAAY;CACrC,MAAM,8BAAc,IAAI,IAAoB;CAC5C,MAAM,UAAmC,CAAC;CAC1C,KAAK,MAAM,SAAS,aAAa;EAC/B,IAAI,CAAC,MAAM,iBAAiB,MAAM,kBAAkB,UAAU,aAAa,IAAI,MAAM,aAAa,GAAG;EACrG,aAAa,IAAI,MAAM,aAAa;EACpC,MAAM,cAAc,YAAY,IAAI,MAAM,EAAE,KAAK,KAAK;EACtD,YAAY,IAAI,MAAM,IAAI,UAAU;EACpC,IAAI;GACF,QAAQ,KAAK;IACX,IAAI,GAAG,MAAM,GAAG,SAAS,eAAe,IAAI,KAAK,IAAI;IACrD,OAAO,QAAQ,MAAM,aAAa;GACpC,CAAC;EACH,QAAQ;GACN;EACF;CACF;CACA,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AAuBA,SAAS,gCAAgC,gBAA8D;CACrG,OAAO,eAAe,IAAI,+BAA+B;AAC3D;AAEA,SAAS,mCACP,UACuD;CACvD,OAAO,aAAa,QAAQ,OAAO,aAAa,YAAY,YAAY,YAAY,SAAS,WAAW;AAC1G;AAEA,SAAS,eAAe,gBAAoD;CAC1E,MAAM,aAAa,eAAe,IAAI,YAAY;CAClD,OAAO,YAAY,QAAQ,WAAY,YAAY,SAAS,CAAC,EAAE;AACjE;;;;;;;;AASA,SAAS,6BACP,MACA,gBACA,cACA,SACyD;CACzD,MAAM,aAAa,eAAe,IAAI,YAAY;CAClD,MAAM,QAAQ,YAAY,SAAS;CACnC,MAAM,iBAAiB;EAAE,oBAAoB;EAAM;EAAgB,2BAA2B;CAAS;CACvG,MAAM,yBAAyB,gCAAgC,cAAc;CAC7E,MAAM,YAAY,OAAO,OAAO,qBAAqB;CAErD,MAAM,YAAY,YAAoB;EACpC,eAAe,IAAI,MAAM,KAAK,iBAAiB,OAAO;EACtD,eAAe,IAAI,MAAM,KAAK,oBAAoB,OAAO;EACzD,OAAO,aAAa,SAAS,cAAc;CAC7C;CACA,MAAM,gBAAgB;EACpB,eAAe,IAAI,MAAM,KAAK,iBAAiB,MAAM;EAIrD,eAAe,IAAI,MAAM,KAAK,oBAAoB,qBAAqB,eAAe,cAAc,CAAC,CAAC;EACtG,OAAO;CACT;CAEA,IACE,mCAAmC,sBAAsB,KACxD,2BAA2B,KAAA,KAAa,WAEzC,OAAO,QAAQ;CAEjB,IAAI,2BAA2B,KAAA,GAAW;EACxC,MAAM,iBAAiB,yBAAyB,GAAG,KAAK;EACxD,OAAO,iBAAiB,SAAS,cAAc,IAAI,QAAQ;CAC7D;CAMA,MAAM,WAAW,SAAS,wBAAwB,KAAA,IAAY,aAAa,YAAY;CACvF,MAAM,cAAc,yBAAyB,OAAO,YAAY,WAAU,YACxE,aAAa,SAAS,cAAc,CACtC;CACA,IAAI,gBAAgB,QAAQ,OAAO,QAAQ;CAC3C,IAAI,aAAa;EACf,eAAe,IAAI,MAAM,KAAK,iBAAiB,OAAO;EACtD,eAAe,IAAI,MAAM,KAAK,oBAAoB,YAAY,EAAE,EAAE,MAAM,OAAO;EAC/E,OAAO,YAAY,WAAW,IAAI,YAAY,EAAE,CAAE,QAAQ;CAC5D;CAEA,MAAM,YAAqB,QAAQ,GAAG,KAAK;CAC3C,IAAI,cAAc,QAAQ,OAAO,QAAQ;CACzC,IAAI,OAAO,cAAc,YAAY,WAAW,OAAO,SAAS,SAAS;CACzE,IACE,aACA,OAAO,cAAc,YACrB,aAAa,aACb,OAAO,UAAU,YAAY,YAC7B,UAAU,SAEV,OAAO,SAAS,UAAU,OAAO;CAGnC,MAAM,eACJ,SAAS,aAAa,UAAU,QAAQ,wBAAwB,UAAU,QAAQ;CACpF,IAAI,cAAc,OAAO,SAAS,YAAY;CAC9C,MAAM,gBAAgB,QAAQ,GAAG,KAAK;CACtC,IAAI,OAAO,kBAAkB,YAAY,eAAe,OAAO,SAAS,aAAa;CACrF,OAAO,QAAQ;AACjB;AAEA,MAAM,gCACJ;AAGF,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;AA+B/B,MAAM,gCAAgC;AACtC,MAAM,wCAAwB,IAAI,IAAY;AAE9C,SAAS,oBACP,YACA,kBACA,QACA;CACA,MAAM,YAAY,YAAY,SAAS;CACvC,IAAI,WAAW;EACb,IAAI,sBAAsB,IAAI,SAAS,GAAG;EAC1C,IAAI,sBAAsB,QAAQ,+BAChC,sBAAsB,OAAO,sBAAsB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAe;EAEpF,sBAAsB,IAAI,SAAS;CACrC;CACA,MAAM,UAAU,YAAY;CAC5B,QAAQ,MACN,oFAAoF,SAAS,MAAM,UAAU,YAAY,oBAAoB,OAAO,GAAG,SAAS,KAAK,WAAW,GAAG,wEACrL;AACF;;;;;AAMA,SAAgB,sBAAsB,QAA2C;CAC/E,OAAO,QAAQ,MAAM,KAAK,QAAQ,IAAI,yCAAyC;AACjF;;;;;;;;;AAUA,SAAgB,qBAAqB,QAAkC,OAA6C;CAClH,OAAO,sBAAsB,MAAM,KAAK,8BAA8B,KAAK,CAAC,CAAC;AAC/E;;;;;;AAOA,SAAgB,iBACd,SACA,QACA,cACA,SACA,WACA;CAGA,IAAI,eAA8B;CAClC,IAAI,kBAAiC;CAErC,MAAM,kCAAkB,IAAI,IAAY;CAMxC,MAAM,oBAAoB,EAAE,qBAC1B,6BAA6B,YAAY,gBAAgB,cAAc,OAAO;CAChF,MAAM,qBAAqB,EAAE,qBAC3B,6BAA6B,aAAa,gBAAgB,cAAc,OAAO;CAGjF,MAAM,sBAAsB,SAAiB,EAAE,qBAC7C,aAAa,SAAS;EAAE,oBAAoB;EAAM;EAAgB,2BAA2B;CAAS,CAAC;CAEzG,MAAM,iBAAiB,EAAE,qBAAyD;EAChF,MAAM,aAAa,eAAe,IAAI,YAAY;EAClD,MAAM,QAAQ,YAAY,SAAS;EACnC,MAAM,sBAAsB,sBAAsB,MAAM;EACxD,MAAM,mBAAmB,OAAO;EAChC,MAAM,YAAY,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,CAAC,CAAC,SAAS;EAK3F,IAAI,uBAAuB;EAE3B,IAAI,qBAAqB;GACvB,MAAM,WAAW,8BAA8B,KAAK;GACpD,IAAI,SAAS,UACX,eAAe,IAAI,kBAAkB,SAAS,cAAc;QACvD;IACL,uBAAuB;IACvB,oBAAoB,YAAY,SAAS,qBAAqB,SAAS,MAAM;GAC/E;GACA,IAAI,SAAS,qBACX,eAAe,IAAI,uBAAuB,SAAS,mBAAmB;EAE1E;EAEA,MAAM,wBAAwB,uBAAuB,CAAC;EAEtD,MAAM,UAAU,OAAO,WAAW,WAAW,OAAO,WAAW;EAI/D,MAAM,yBAAyB,gCAAgC,cAAc;EAG7E,MAAM,kBADJ,mCAAmC,sBAAsB,KAAM,2BAA2B,KAAA,KAAa,YACpD,OAAO;EAC5D,MAAM,eACJ,oBAAoB,KAAA,IACf,iBAAiB,wBAAA,MACjB,OAAO,wBAAA;EACd,MAAM,eACJ,oBAAoB,KAAA,IACf,iBAAiB,uBAAA,MACjB,OAAO,uBAAA;EACd,MAAM,UAAU,OAAO,uBAAuB;EAE9C,MAAM,oCAAoC;EAI1C,MAAM,qBACJ,oBAAoB,KAAA,IAAa,iBAAiB,sBAAsB,SAAU,OAAO;EAI3F,MAAM,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,QAAQ,GAAG,kCAAkC,GAAG,UAAU,IAAI,EAAE,GAAG,mBAAmB,GAAG,YAAY,IAAI,EAAE,GAAG,wBAAwB,IAAI;EAC9L,IAAI,gBAAgB,oBAAoB,UACtC,OAAO;EAIT,MAAM,kBAAkB,YAAY;EAEpC,MAAM,sBAAsB,UACxB,GAAG,8BAA8B,MAAM,2BACvC;EACJ,MAAM,wBAAwB,UAAU,yBAAyB,KAAA;EAEjE,IAAI,cAAc;GAChB,MAAM,UAAU;GAChB,gBAAgB,IAAI,OAAO;GAG3B,QACG,QAAQ,CAAC,CACT,YAAY,CAAC,CAAC,CAAC,CACf,cAAc,gBAAgB,OAAO,OAAO,CAAC;EAClD;EAEA,eAAe,IAAI,OAAO;GACxB;GACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACjC,QAAQ,UAAU;GAClB,UAAU,SAAS,UAAU,QAAQ,KAAA;GACrC,SAAS;IAKP,eACE,QAAQ,IAAI,wCAAwC,MAChD,QACA,EACE,QAAQ,EAAE,qBAAqB;KAC7B,MAAM,WAAW,iBAAiB,EAAE,eAAe,CAAC;KACpD,IAAI,aAAa,QACf,OAAO,mBAAmB,qBAAqB,eAAe,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC;KAEpG,OAAO,MAAM,QAAQ,QAAQ,IAAI,SAAS,EAAE,CAAE,QAAQ;IACxD,EACF;IACN,qBACE,QAAQ,IAAI,4CAA4C,MACpD,QACA;KACE,SAAS;KACT,YAAY;KACZ,cAAc;KACd,iBAAiB;KACjB,WAAW,SAAS,EAAE,QAAQ,KAAK,IAAI;KACvC,2BAA2B,wBACvB,IAAI,aAAa;MACf,cAAc;MACd,MAAM;MACN,GAAI,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;KACtC,CAAC,IACD,KAAA;KACJ,OAAO;KAEP,mBAAmB;MAAE,SAAS;MAAQ,WAAA;KAAsC;KAC5E,0BAA0B;KAC1B,aAAa;MACX,cAAc,kBAAkB,QAAQ,IAAI;MAC5C,kBAAkB,kBAAkB,KAAA,IAAY;MAChD,OAAO;MACP,eAAe;MACf,YAAY;MACZ,wBAAwB;MACxB,aAAa;MACb,aAAa;MACb;KACF;KACA,YAAY;MACV,kBAAkB,kBAAkB,KAAA,IAAY,IAAI;MACpD,YAAY;MACZ,OAAO;MACP,mBAAmB;MACnB,aAAa;KACf;IACF;GACR;EACF,CAAC;EACD,kBAAkB;EAElB,OAAO;CACT;CAEA,OAAO,OAAO,OAAO,eAAe;;;;;AAKlC,MAAM,UAAyB;EAE7B,MAAM,QAAQ,WAAW,CAAC,cAAc,QAAQ,GAAG,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,KAAI,WAAU,OAAO,QAAQ,CAAC,CAAC,CAAC;CAC7G,EACF,CAAC;AACH"}
+{"version":3,"file":"memory.js","names":[],"sources":["../../src/agents/memory.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { Knowledge } from '@mastra/core/knowledge';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MastraCompositeStore } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport { fastembed } from '@mastra/fastembed';\nimport { Memory, Subconscious } from '@mastra/memory';\nimport { DEFAULT_OBS_THRESHOLD, DEFAULT_REF_THRESHOLD } from '../constants.js';\nimport { LOCAL_KNOWLEDGE_ORG_ID, resolveKnowledgeScopeIdentity } from '../knowledge-scope.js';\nimport { MASTRACODE_AUTO_OM_MODELS, resolveAutoOMModelId } from '../onboarding/packs.js';\nimport { loadSettings } from '../onboarding/settings.js';\nimport { ANTHROPIC_PROMPT_CACHE_TTL } from '../providers/anthropic-prompt-cache.js';\nimport type { MastraCodeState } from '../schema.js';\nimport { getOmScope } from '../utils/project.js';\nimport { getActiveMemoryRoute, resolveModel } from './model.js';\n\n/** Route-backed OM fallback entry. */\ntype MemoryModelRouteEntry = { id: string; model: ReturnType<typeof resolveModel> };\n\n/**\n * Resolve the active model route's memory models, starting at a same-thread\n * pending fallback hop. Returns `'auto'` when the route's first memory model is\n * Auto, and `undefined` when the route sets no memory model.\n */\nfunction resolveRouteMemoryModels(\n  state: MastraCodeState | undefined,\n  threadId: string | null | undefined,\n  resolve: (modelId: string) => ReturnType<typeof resolveModel>,\n): MemoryModelRouteEntry[] | 'auto' | undefined {\n  const memoryRoute = getActiveMemoryRoute(state, threadId);\n  if (memoryRoute[0]?.memoryModelId === 'auto') return 'auto';\n  const seenModelIds = new Set<string>();\n  const appearances = new Map<string, number>();\n  const entries: MemoryModelRouteEntry[] = [];\n  for (const entry of memoryRoute) {\n    if (!entry.memoryModelId || entry.memoryModelId === 'auto' || seenModelIds.has(entry.memoryModelId)) continue;\n    seenModelIds.add(entry.memoryModelId);\n    const occurrence = (appearances.get(entry.id) ?? 0) + 1;\n    appearances.set(entry.id, occurrence);\n    try {\n      entries.push({\n        id: `${entry.id}:memory${occurrence === 1 ? '' : `#${occurrence}`}`,\n        model: resolve(entry.memoryModelId),\n      });\n    } catch {\n      break;\n    }\n  }\n  return entries.length > 0 ? entries : undefined;\n}\n\n/**\n * The authoritative per-caller Factory memory-settings row, placed on the request\n * context before Factory's model-dependent processors run. `null` means the row\n * exists but is empty (every role auto). An unavailable sentinel or a missing\n * value on a Factory-owned session falls back to Auto roles and default\n * thresholds/attachments, so memory keeps working while Factory reports the error.\n */\ninterface FactoryMemorySettings {\n  observerModelId: string | null;\n  reflectorModelId: string | null;\n  observationThreshold: number | null;\n  reflectionThreshold: number | null;\n  observeAttachments: 'auto' | boolean | null;\n}\n\ntype FactoryMemorySettingsContext =\n  | FactoryMemorySettings\n  | null\n  | { status: 'unavailable'; reason: string }\n  | undefined;\n\nfunction getFactoryMemorySettingsContext(requestContext: RequestContext): FactoryMemorySettingsContext {\n  return requestContext.get('mastra__factoryMemorySettings') as FactoryMemorySettingsContext;\n}\n\nfunction isFactoryMemorySettingsUnavailable(\n  settings: FactoryMemorySettingsContext,\n): settings is { status: 'unavailable'; reason: string } {\n  return settings !== null && typeof settings === 'object' && 'status' in settings && settings.status === 'unavailable';\n}\n\nfunction getMainModelId(requestContext: RequestContext): string | undefined {\n  const controller = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n  return controller?.session.modelId || (controller?.getState()?.currentModelId as string | undefined);\n}\n\n/**\n * Resolve one OM role's model for this invocation. Returns `'auto'` for Memory's\n * auto policy, or a concrete model. Factory's DB row is authoritative for\n * Factory sessions (an unreadable row falls back to auto). Otherwise the active\n * model route's memory models win, then the per-role selection, then legacy\n * concrete settings.\n */\nfunction resolveOmRoleModelForRequest(\n  role: 'observer' | 'reflector',\n  requestContext: RequestContext,\n  settingsPath?: string,\n  options?: { disableSettingsOmSeed?: boolean },\n): 'auto' | ReturnType<typeof resolveModel> | MemoryModelRouteEntry[] {\n  const controller = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n  const state = controller?.getState() as MastraCodeState | undefined;\n  const resolveOptions = { remapForCodexOAuth: true, requestContext, anthropicPromptCacheScope: 'system' } as const;\n  const factorySettingsContext = getFactoryMemorySettingsContext(requestContext);\n  const isFactory = typeof state?.factoryProjectId === 'string';\n\n  const useModel = (modelId: string) => {\n    requestContext.set(`om.${role}.selectionMode`, 'model');\n    requestContext.set(`om.${role}.effectiveModelId`, modelId);\n    return resolveModel(modelId, resolveOptions);\n  };\n  const useAuto = () => {\n    requestContext.set(`om.${role}.selectionMode`, 'auto');\n    // These two keys are declared in the span-context allowlist\n    // (`mastracode/sdk/src/index.ts`), so traces can report intent separately from\n    // the effective concrete model without either being mistaken for a model ID.\n    requestContext.set(`om.${role}.effectiveModelId`, resolveAutoOMModelId(getMainModelId(requestContext)));\n    return 'auto' as const;\n  };\n\n  if (\n    isFactoryMemorySettingsUnavailable(factorySettingsContext) ||\n    (factorySettingsContext === undefined && isFactory)\n  ) {\n    return useAuto();\n  }\n  if (factorySettingsContext !== undefined) {\n    const factoryModelId = factorySettingsContext?.[`${role}ModelId`];\n    return factoryModelId ? useModel(factoryModelId) : useAuto();\n  }\n\n  // The configured settings file, not the default one: a caller that points the\n  // agent at another settings path must get the same override resolution for\n  // observational memory as it does for the main model. Hosts that disable the\n  // settings seed never read it.\n  const settings = options?.disableSettingsOmSeed ? undefined : loadSettings(settingsPath);\n  const routeMemory = resolveRouteMemoryModels(state, controller?.threadId, modelId =>\n    resolveModel(modelId, resolveOptions),\n  );\n  if (routeMemory === 'auto') return useAuto();\n  if (routeMemory) {\n    requestContext.set(`om.${role}.selectionMode`, 'model');\n    requestContext.set(`om.${role}.effectiveModelId`, routeMemory[0]?.model.modelId);\n    return routeMemory.length === 1 ? routeMemory[0]!.model : routeMemory;\n  }\n\n  const selection: unknown = state?.[`${role}ModelSelection`];\n  if (selection === 'auto') return useAuto();\n  if (typeof selection === 'string' && selection) return useModel(selection);\n  if (\n    selection &&\n    typeof selection === 'object' &&\n    'modelId' in selection &&\n    typeof selection.modelId === 'string' &&\n    selection.modelId\n  ) {\n    return useModel(selection.modelId);\n  }\n\n  const roleOverride =\n    role === 'observer' ? settings?.models?.observerModelOverride : settings?.models?.reflectorModelOverride;\n  if (roleOverride) return useModel(roleOverride);\n  const legacyModelId = state?.[`${role}ModelId`];\n  if (typeof legacyModelId === 'string' && legacyModelId) return useModel(legacyModelId);\n  return useAuto();\n}\n\nconst DYNAMIC_AGENTS_MD_INSTRUCTION =\n  'Messages wrapped in <system-reminder type=\"dynamic-agents-md\" ...>...</system-reminder> are ephemeral project-context instructions injected from files on disk. Do NOT observe or extract information from these messages — they are reloaded automatically when needed and should not be stored in memory.';\n\n// Derived from https://github.com/JuliusBrussee/caveman and adapted for OM use with fixed full-level compression.\nconst CAVEMAN_OM_INSTRUCTION = `Respond terse like smart caveman. All technical substance stay. Only fluff die.\n\nUse full caveman compression style.\n\nDrop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Fragments OK. Short synonyms (big not extensive, fix not \"implement a solution for\"). Technical terms exact. Code blocks unchanged. Errors quoted exact. Leave out the words \"agent\" and \"assistant\" at the start of each observation line, it is assumed each line is referring to the assistant unless it specifically says it was about the user. Leave out parenthesis and other text characters like * that would not contribute to understanding the observations.\n\nPattern: \\`[thing] [action] [reason]. [next step]\\`\n\nNot: \"Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by...\"\nYes: \"Bug in auth middleware. Token expiry check use < not <=. Fix:\"\n\nExample 1\n🔴 14:31 user asks why React component rerenders\n🟡 14:32 saw inline object prop create new ref each render, cause rerender\n✅ 14:34 fixed render issue by wrap object in useMemo\n\nExample 2\n🟡 15:10 explained pool reuse DB connections, skip repeat handshake overhead\n\nDon't say \"Agent did x\", say \"did x\". It will be assumed the agent did what was observed. The who should only be specified for the user or other third parties: \"user asked x\"\n\nDrop caveman for: security warnings, irreversible action confirmations, multi-step sequences where fragment order risks misread, user asks to clarify or repeats question, and anything that requires remembering verbatim content. Resume caveman after clear part done`;\n\nexport { LOCAL_KNOWLEDGE_ORG_ID };\n\n// One error per session, not per memory resolution. Keyed on the session id\n// rather than the controller object: the controller is read off the request\n// context on every resolution, so it is a fresh object per request and would\n// dedupe nothing. Bounded so a long-running Factory process cannot grow this\n// without limit — refusing sessions are rare, and losing the oldest ids only\n// costs one extra log line.\nconst REPORTED_ORG_UNRESOLVED_LIMIT = 500;\nconst reportedOrgUnresolved = new Set<string>();\n\nfunction reportOrgUnresolved(\n  controller: AgentControllerRequestContext<MastraCodeState> | undefined,\n  factoryProjectId: string | undefined,\n  reason?: string,\n) {\n  const sessionId = controller?.session?.id;\n  if (sessionId) {\n    if (reportedOrgUnresolved.has(sessionId)) return;\n    if (reportedOrgUnresolved.size >= REPORTED_ORG_UNRESOLVED_LIMIT) {\n      reportedOrgUnresolved.delete(reportedOrgUnresolved.values().next().value as string);\n    }\n    reportedOrgUnresolved.add(sessionId);\n  }\n  const session = controller?.session;\n  console.error(\n    `[Subconscious] Knowledge curation disabled: no organization resolved for session ${session?.id ?? 'unknown'} (project ${factoryProjectId ?? 'none'})${reason ? `: ${reason}` : ''}. Knowledge is not written rather than written where it cannot be read.`,\n  );\n}\n\n/**\n * Whether the experimental subconscious (knowledge graph + reminder sidekick)\n * is switched on for this process: it needs a vector store and the opt-in flag.\n */\nexport function isSubconsciousEnabled(vector: MastraVector | undefined): boolean {\n  return Boolean(vector) && process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === '1';\n}\n\n/**\n * Whether the subconscious tools (`knowledge_*`, `ask_memory`) are registered\n * for a given session. Beyond the process-level switch, a Factory-owned\n * session that cannot resolve its org refuses the subconscious entirely (see\n * `getDynamicMemory`, which applies the same two checks inline because it also\n * needs the resolved identity). The system prompt's tool guidance calls here so\n * it never advertises tools that `getDynamicMemory` did not register.\n */\nexport function hasSubconsciousTools(vector: MastraVector | undefined, state: MastraCodeState | undefined): boolean {\n  return isSubconsciousEnabled(vector) && resolveKnowledgeScopeIdentity(state).resolved;\n}\n\n/**\n * Dynamic memory factory function.\n * Reads OM thresholds from controller state via requestContext.\n * Model functions also read from requestContext (no mutable bridge needed).\n */\nexport function getDynamicMemory(\n  storage: MastraCompositeStore,\n  vector?: MastraVector,\n  settingsPath?: string,\n  options?: { disableSettingsOmSeed?: boolean },\n  knowledge?: Knowledge,\n) {\n  // Cache is scoped per storage instance (per getDynamicMemory call) so a\n  // Memory bound to one storage is never reused after storage changes.\n  let cachedMemory: Memory | null = null;\n  let cachedMemoryKey: string | null = null;\n  // Instances replaced by a config change may still have background work in flight.\n  const retiredMemories = new Set<Memory>();\n\n  // Observer/reflector model functions — read the current model ID from\n  // controller state via requestContext (propagated by OM's agent.generate).\n  // Bound here so the configured settings path reaches role overrides and pack\n  // memory-model resolution.\n  const getObserverModel = ({ requestContext }: { requestContext: RequestContext }) =>\n    resolveOmRoleModelForRequest('observer', requestContext, settingsPath, options);\n  const getReflectorModel = ({ requestContext }: { requestContext: RequestContext }) =>\n    resolveOmRoleModelForRequest('reflector', requestContext, settingsPath, options);\n  // Routes the concrete model Memory's `'auto'` picks through Mastra Code's\n  // credential-aware resolver, like every other Mastra Code model.\n  const resolveMemoryModel = (modelId: string, { requestContext }: { requestContext?: RequestContext }) =>\n    resolveModel(modelId, { remapForCodexOAuth: true, requestContext, anthropicPromptCacheScope: 'system' });\n\n  const resolveMemory = ({ requestContext }: { requestContext: RequestContext }) => {\n    const controller = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n    const state = controller?.getState() as MastraCodeState | undefined;\n    const subconsciousEnabled = isSubconsciousEnabled(vector);\n    const factoryProjectId = state?.factoryProjectId;\n    const isFactory = typeof factoryProjectId === 'string' && factoryProjectId.trim().length > 0;\n\n    // A Factory-owned session that could not resolve its org refuses to curate:\n    // writing under a substituted identity produces knowledge the fail-closed\n    // read path can never see.\n    let orgUnresolvedRefusal = false;\n\n    if (subconsciousEnabled) {\n      const identity = resolveKnowledgeScopeIdentity(state);\n      if (identity.resolved) {\n        requestContext.set('organizationId', identity.organizationId);\n      } else {\n        orgUnresolvedRefusal = true;\n        reportOrgUnresolved(controller, identity.knowledgeResourceId, identity.reason);\n      }\n      if (identity.knowledgeResourceId) {\n        requestContext.set('knowledgeResourceId', identity.knowledgeResourceId);\n      }\n    }\n\n    const subconsciousAvailable = subconsciousEnabled && !orgUnresolvedRefusal;\n\n    const omScope = state?.omScope ?? getOmScope(state?.projectPath);\n\n    // The Factory row is authoritative and read per invocation, so a stored\n    // threshold/attachment change reaches the running Memory without a session.\n    const factorySettingsContext = getFactoryMemorySettingsContext(requestContext);\n    const factorySettingsUnavailable =\n      isFactoryMemorySettingsUnavailable(factorySettingsContext) || (factorySettingsContext === undefined && isFactory);\n    const factorySettings = factorySettingsUnavailable ? null : factorySettingsContext;\n    const obsThreshold =\n      factorySettings !== undefined\n        ? (factorySettings?.observationThreshold ?? DEFAULT_OBS_THRESHOLD)\n        : (state?.observationThreshold ?? DEFAULT_OBS_THRESHOLD);\n    const refThreshold =\n      factorySettings !== undefined\n        ? (factorySettings?.reflectionThreshold ?? DEFAULT_REF_THRESHOLD)\n        : (state?.reflectionThreshold ?? DEFAULT_REF_THRESHOLD);\n    const caveman = state?.cavemanObservations ?? false;\n\n    const observerPreviousObservationTokens = 1000;\n    // The row is authoritative: an absent value means the user left it on Auto,\n    // which the config API reports as 'auto' and Memory resolves by model\n    // capability.\n    const observeAttachments =\n      factorySettings !== undefined ? (factorySettings?.observeAttachments ?? 'auto') : state?.observeAttachments;\n    // Factory sessions get a factory-only Subconscious config, so the cache key\n    // carries Factory presence and settings availability to keep those configs\n    // from cross-serving.\n    const cacheKey = `${obsThreshold}:${refThreshold}:${omScope}:${observerPreviousObservationTokens}:${caveman ? 1 : 0}:${observeAttachments}:${isFactory ? 1 : 0}:${subconsciousAvailable ? 1 : 0}`;\n    if (cachedMemory && cachedMemoryKey === cacheKey) {\n      return cachedMemory;\n    }\n\n    // Async buffering is not supported with resource scope — disable it\n    const isResourceScope = omScope === 'resource';\n\n    const observerInstruction = caveman\n      ? `${DYNAMIC_AGENTS_MD_INSTRUCTION}\\n\\n${CAVEMAN_OM_INSTRUCTION}`\n      : DYNAMIC_AGENTS_MD_INSTRUCTION;\n    const reflectionInstruction = caveman ? CAVEMAN_OM_INSTRUCTION : undefined;\n\n    if (cachedMemory) {\n      const retired = cachedMemory;\n      retiredMemories.add(retired);\n      // settled() rejects if the instance's OM engine failed to start; that must not surface as\n      // an unhandled rejection from a background retirement.\n      void retired\n        .settled()\n        .catch(() => {})\n        .finally(() => retiredMemories.delete(retired));\n    }\n\n    cachedMemory = new Memory({\n      storage,\n      ...(knowledge ? { knowledge } : {}),\n      vector: vector || false,\n      embedder: vector ? fastembed.small : undefined,\n      options: {\n        // Generate a durable title from the first user message. Every client uses\n        // the same title in its thread list and active-session chrome. Title\n        // generation takes the primary OM model only — its model field does not\n        // accept fallback arrays.\n        generateTitle:\n          process.env.MASTRACODE_DISABLE_TITLE_GENERATION === '1'\n            ? false\n            : {\n                model: ({ requestContext }) => {\n                  const resolved = getObserverModel({ requestContext });\n                  if (resolved === 'auto') {\n                    return resolveMemoryModel(resolveAutoOMModelId(getMainModelId(requestContext)), { requestContext });\n                  }\n                  return Array.isArray(resolved) ? resolved[0]!.model : resolved;\n                },\n              },\n        observationalMemory:\n          process.env.MASTRACODE_DISABLE_OBSERVATIONAL_MEMORY === '1'\n            ? false\n            : {\n                enabled: true,\n                autoModels: MASTRACODE_AUTO_OM_MODELS,\n                resolveModel: resolveMemoryModel,\n                temporalMarkers: true,\n                retrieval: vector ? { vector: true } : true,\n                experimental_subconscious: subconsciousAvailable\n                  ? new Subconscious({\n                      defaultScope: 'resource',\n                      pins: true,\n                      ...(isFactory ? { maxSteps: 25 } : {}),\n                    })\n                  : undefined,\n                scope: omScope,\n                // The main agent writes Anthropic cache entries with this TTL; 'auto' can't see it.\n                activateAfterIdle: { default: 'auto', anthropic: ANTHROPIC_PROMPT_CACHE_TTL },\n                activateOnProviderChange: true,\n                observation: {\n                  bufferTokens: isResourceScope ? false : 1 / 5,\n                  bufferActivation: isResourceScope ? undefined : 2000,\n                  model: getObserverModel,\n                  messageTokens: obsThreshold,\n                  blockAfter: 2,\n                  previousObserverTokens: observerPreviousObservationTokens,\n                  threadTitle: true,\n                  instruction: observerInstruction,\n                  observeAttachments,\n                },\n                reflection: {\n                  bufferActivation: isResourceScope ? undefined : 1 / 2,\n                  blockAfter: 1.1,\n                  model: getReflectorModel,\n                  observationTokens: refThreshold,\n                  instruction: reflectionInstruction,\n                },\n              },\n      },\n    });\n    cachedMemoryKey = cacheKey;\n\n    return cachedMemory;\n  };\n\n  return Object.assign(resolveMemory, {\n    /**\n     * Wait for background memory work (buffered observations, reflections, indexing) in every\n     * instance this factory created. Await before closing storage.\n     */\n    async settled(): Promise<void> {\n      // Drain every instance even if one rejects, so teardown can still close storage.\n      await Promise.allSettled([cachedMemory?.settled(), ...[...retiredMemories].map(memory => memory.settled())]);\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,SAAS,yBACP,OACA,UACA,SAC8C;CAC9C,MAAM,cAAc,qBAAqB,OAAO,QAAQ;CACxD,IAAI,YAAY,EAAE,EAAE,kBAAkB,QAAQ,OAAO;CACrD,MAAM,+BAAe,IAAI,IAAY;CACrC,MAAM,8BAAc,IAAI,IAAoB;CAC5C,MAAM,UAAmC,CAAC;CAC1C,KAAK,MAAM,SAAS,aAAa;EAC/B,IAAI,CAAC,MAAM,iBAAiB,MAAM,kBAAkB,UAAU,aAAa,IAAI,MAAM,aAAa,GAAG;EACrG,aAAa,IAAI,MAAM,aAAa;EACpC,MAAM,cAAc,YAAY,IAAI,MAAM,EAAE,KAAK,KAAK;EACtD,YAAY,IAAI,MAAM,IAAI,UAAU;EACpC,IAAI;GACF,QAAQ,KAAK;IACX,IAAI,GAAG,MAAM,GAAG,SAAS,eAAe,IAAI,KAAK,IAAI;IACrD,OAAO,QAAQ,MAAM,aAAa;GACpC,CAAC;EACH,QAAQ;GACN;EACF;CACF;CACA,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AAuBA,SAAS,gCAAgC,gBAA8D;CACrG,OAAO,eAAe,IAAI,+BAA+B;AAC3D;AAEA,SAAS,mCACP,UACuD;CACvD,OAAO,aAAa,QAAQ,OAAO,aAAa,YAAY,YAAY,YAAY,SAAS,WAAW;AAC1G;AAEA,SAAS,eAAe,gBAAoD;CAC1E,MAAM,aAAa,eAAe,IAAI,YAAY;CAClD,OAAO,YAAY,QAAQ,WAAY,YAAY,SAAS,CAAC,EAAE;AACjE;;;;;;;;AASA,SAAS,6BACP,MACA,gBACA,cACA,SACoE;CACpE,MAAM,aAAa,eAAe,IAAI,YAAY;CAClD,MAAM,QAAQ,YAAY,SAAS;CACnC,MAAM,iBAAiB;EAAE,oBAAoB;EAAM;EAAgB,2BAA2B;CAAS;CACvG,MAAM,yBAAyB,gCAAgC,cAAc;CAC7E,MAAM,YAAY,OAAO,OAAO,qBAAqB;CAErD,MAAM,YAAY,YAAoB;EACpC,eAAe,IAAI,MAAM,KAAK,iBAAiB,OAAO;EACtD,eAAe,IAAI,MAAM,KAAK,oBAAoB,OAAO;EACzD,OAAO,aAAa,SAAS,cAAc;CAC7C;CACA,MAAM,gBAAgB;EACpB,eAAe,IAAI,MAAM,KAAK,iBAAiB,MAAM;EAIrD,eAAe,IAAI,MAAM,KAAK,oBAAoB,qBAAqB,eAAe,cAAc,CAAC,CAAC;EACtG,OAAO;CACT;CAEA,IACE,mCAAmC,sBAAsB,KACxD,2BAA2B,KAAA,KAAa,WAEzC,OAAO,QAAQ;CAEjB,IAAI,2BAA2B,KAAA,GAAW;EACxC,MAAM,iBAAiB,yBAAyB,GAAG,KAAK;EACxD,OAAO,iBAAiB,SAAS,cAAc,IAAI,QAAQ;CAC7D;CAMA,MAAM,WAAW,SAAS,wBAAwB,KAAA,IAAY,aAAa,YAAY;CACvF,MAAM,cAAc,yBAAyB,OAAO,YAAY,WAAU,YACxE,aAAa,SAAS,cAAc,CACtC;CACA,IAAI,gBAAgB,QAAQ,OAAO,QAAQ;CAC3C,IAAI,aAAa;EACf,eAAe,IAAI,MAAM,KAAK,iBAAiB,OAAO;EACtD,eAAe,IAAI,MAAM,KAAK,oBAAoB,YAAY,EAAE,EAAE,MAAM,OAAO;EAC/E,OAAO,YAAY,WAAW,IAAI,YAAY,EAAE,CAAE,QAAQ;CAC5D;CAEA,MAAM,YAAqB,QAAQ,GAAG,KAAK;CAC3C,IAAI,cAAc,QAAQ,OAAO,QAAQ;CACzC,IAAI,OAAO,cAAc,YAAY,WAAW,OAAO,SAAS,SAAS;CACzE,IACE,aACA,OAAO,cAAc,YACrB,aAAa,aACb,OAAO,UAAU,YAAY,YAC7B,UAAU,SAEV,OAAO,SAAS,UAAU,OAAO;CAGnC,MAAM,eACJ,SAAS,aAAa,UAAU,QAAQ,wBAAwB,UAAU,QAAQ;CACpF,IAAI,cAAc,OAAO,SAAS,YAAY;CAC9C,MAAM,gBAAgB,QAAQ,GAAG,KAAK;CACtC,IAAI,OAAO,kBAAkB,YAAY,eAAe,OAAO,SAAS,aAAa;CACrF,OAAO,QAAQ;AACjB;AAEA,MAAM,gCACJ;AAGF,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;AA+B/B,MAAM,gCAAgC;AACtC,MAAM,wCAAwB,IAAI,IAAY;AAE9C,SAAS,oBACP,YACA,kBACA,QACA;CACA,MAAM,YAAY,YAAY,SAAS;CACvC,IAAI,WAAW;EACb,IAAI,sBAAsB,IAAI,SAAS,GAAG;EAC1C,IAAI,sBAAsB,QAAQ,+BAChC,sBAAsB,OAAO,sBAAsB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAe;EAEpF,sBAAsB,IAAI,SAAS;CACrC;CACA,MAAM,UAAU,YAAY;CAC5B,QAAQ,MACN,oFAAoF,SAAS,MAAM,UAAU,YAAY,oBAAoB,OAAO,GAAG,SAAS,KAAK,WAAW,GAAG,wEACrL;AACF;;;;;AAMA,SAAgB,sBAAsB,QAA2C;CAC/E,OAAO,QAAQ,MAAM,KAAK,QAAQ,IAAI,yCAAyC;AACjF;;;;;;;;;AAUA,SAAgB,qBAAqB,QAAkC,OAA6C;CAClH,OAAO,sBAAsB,MAAM,KAAK,8BAA8B,KAAK,CAAC,CAAC;AAC/E;;;;;;AAOA,SAAgB,iBACd,SACA,QACA,cACA,SACA,WACA;CAGA,IAAI,eAA8B;CAClC,IAAI,kBAAiC;CAErC,MAAM,kCAAkB,IAAI,IAAY;CAMxC,MAAM,oBAAoB,EAAE,qBAC1B,6BAA6B,YAAY,gBAAgB,cAAc,OAAO;CAChF,MAAM,qBAAqB,EAAE,qBAC3B,6BAA6B,aAAa,gBAAgB,cAAc,OAAO;CAGjF,MAAM,sBAAsB,SAAiB,EAAE,qBAC7C,aAAa,SAAS;EAAE,oBAAoB;EAAM;EAAgB,2BAA2B;CAAS,CAAC;CAEzG,MAAM,iBAAiB,EAAE,qBAAyD;EAChF,MAAM,aAAa,eAAe,IAAI,YAAY;EAClD,MAAM,QAAQ,YAAY,SAAS;EACnC,MAAM,sBAAsB,sBAAsB,MAAM;EACxD,MAAM,mBAAmB,OAAO;EAChC,MAAM,YAAY,OAAO,qBAAqB,YAAY,iBAAiB,KAAK,CAAC,CAAC,SAAS;EAK3F,IAAI,uBAAuB;EAE3B,IAAI,qBAAqB;GACvB,MAAM,WAAW,8BAA8B,KAAK;GACpD,IAAI,SAAS,UACX,eAAe,IAAI,kBAAkB,SAAS,cAAc;QACvD;IACL,uBAAuB;IACvB,oBAAoB,YAAY,SAAS,qBAAqB,SAAS,MAAM;GAC/E;GACA,IAAI,SAAS,qBACX,eAAe,IAAI,uBAAuB,SAAS,mBAAmB;EAE1E;EAEA,MAAM,wBAAwB,uBAAuB,CAAC;EAEtD,MAAM,UAAU,OAAO,WAAW,WAAW,OAAO,WAAW;EAI/D,MAAM,yBAAyB,gCAAgC,cAAc;EAG7E,MAAM,kBADJ,mCAAmC,sBAAsB,KAAM,2BAA2B,KAAA,KAAa,YACpD,OAAO;EAC5D,MAAM,eACJ,oBAAoB,KAAA,IACf,iBAAiB,wBAAA,MACjB,OAAO,wBAAA;EACd,MAAM,eACJ,oBAAoB,KAAA,IACf,iBAAiB,uBAAA,MACjB,OAAO,uBAAA;EACd,MAAM,UAAU,OAAO,uBAAuB;EAE9C,MAAM,oCAAoC;EAI1C,MAAM,qBACJ,oBAAoB,KAAA,IAAa,iBAAiB,sBAAsB,SAAU,OAAO;EAI3F,MAAM,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,QAAQ,GAAG,kCAAkC,GAAG,UAAU,IAAI,EAAE,GAAG,mBAAmB,GAAG,YAAY,IAAI,EAAE,GAAG,wBAAwB,IAAI;EAC9L,IAAI,gBAAgB,oBAAoB,UACtC,OAAO;EAIT,MAAM,kBAAkB,YAAY;EAEpC,MAAM,sBAAsB,UACxB,GAAG,8BAA8B,MAAM,2BACvC;EACJ,MAAM,wBAAwB,UAAU,yBAAyB,KAAA;EAEjE,IAAI,cAAc;GAChB,MAAM,UAAU;GAChB,gBAAgB,IAAI,OAAO;GAG3B,QACG,QAAQ,CAAC,CACT,YAAY,CAAC,CAAC,CAAC,CACf,cAAc,gBAAgB,OAAO,OAAO,CAAC;EAClD;EAEA,eAAe,IAAI,OAAO;GACxB;GACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACjC,QAAQ,UAAU;GAClB,UAAU,SAAS,UAAU,QAAQ,KAAA;GACrC,SAAS;IAKP,eACE,QAAQ,IAAI,wCAAwC,MAChD,QACA,EACE,QAAQ,EAAE,qBAAqB;KAC7B,MAAM,WAAW,iBAAiB,EAAE,eAAe,CAAC;KACpD,IAAI,aAAa,QACf,OAAO,mBAAmB,qBAAqB,eAAe,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC;KAEpG,OAAO,MAAM,QAAQ,QAAQ,IAAI,SAAS,EAAE,CAAE,QAAQ;IACxD,EACF;IACN,qBACE,QAAQ,IAAI,4CAA4C,MACpD,QACA;KACE,SAAS;KACT,YAAY;KACZ,cAAc;KACd,iBAAiB;KACjB,WAAW,SAAS,EAAE,QAAQ,KAAK,IAAI;KACvC,2BAA2B,wBACvB,IAAI,aAAa;MACf,cAAc;MACd,MAAM;MACN,GAAI,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;KACtC,CAAC,IACD,KAAA;KACJ,OAAO;KAEP,mBAAmB;MAAE,SAAS;MAAQ,WAAA;KAAsC;KAC5E,0BAA0B;KAC1B,aAAa;MACX,cAAc,kBAAkB,QAAQ,IAAI;MAC5C,kBAAkB,kBAAkB,KAAA,IAAY;MAChD,OAAO;MACP,eAAe;MACf,YAAY;MACZ,wBAAwB;MACxB,aAAa;MACb,aAAa;MACb;KACF;KACA,YAAY;MACV,kBAAkB,kBAAkB,KAAA,IAAY,IAAI;MACpD,YAAY;MACZ,OAAO;MACP,mBAAmB;MACnB,aAAa;KACf;IACF;GACR;EACF,CAAC;EACD,kBAAkB;EAElB,OAAO;CACT;CAEA,OAAO,OAAO,OAAO,eAAe;;;;;AAKlC,MAAM,UAAyB;EAE7B,MAAM,QAAQ,WAAW,CAAC,cAAc,QAAQ,GAAG,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,KAAI,WAAU,OAAO,QAAQ,CAAC,CAAC,CAAC;CAC7G,EACF,CAAC;AACH"}

package/dist/agents/model.d.ts

@@ -1,6 +1,7 @@
 import type { ModelWithRetries } from '@mastra/core/agent';
+import { ModelRouterLanguageModel } from '@mastra/core/llm';
 import type { GatewayLanguageModel, IdentifiedModelConfig, MastraModelGatewayInterface } from '@mastra/core/llm';
-import type { RequestContext } from '@mastra/core/request-context';
+import { RequestContext } from '@mastra/core/request-context';
 import type { CredentialStore } from '../auth/types.js';
 import type { AnthropicPromptCacheScope } from '../providers/anthropic-prompt-cache.js';
 import type { ThinkingLevelSetting } from '../thinking.js';
@@ -12,7 +13,7 @@ export { setCredentialStoreProvider, hasCredentialStoreProvider, resolveTenantFr
 export type { CredentialTenant, CredentialStoreProvider } from './credential-resolver.js';
 export { setCustomProvidersSource, hasCustomProvidersSource, resolveCustomProviders, } from './custom-provider-source.js';
 export type { CustomProvidersSource } from './custom-provider-source.js';
-type ResolvedModel = GatewayLanguageModel;
+type ResolvedModel = GatewayLanguageModel | ModelRouterLanguageModel;
 export declare function createRequestScopedCredentialStore(base: CredentialStore, requestContext?: RequestContext): CredentialStore;
 export declare function createMastraCodeGateway(options: MastraCodeGatewayOptions): MastraCodeGateway;
 export declare function createMastraCodeModelCatalogProvider(gateway: MastraModelGatewayInterface): import("@mastra/core/harness").CustomModelCatalogProvider;
@@ -36,7 +37,7 @@ export declare function resolveModel(modelId: string, options?: {
     remapForCodexOAuth?: boolean;
     requestContext?: RequestContext;
     anthropicPromptCacheScope?: AnthropicPromptCacheScope;
-}): GatewayLanguageModel;
+}): ResolvedModel;
 export interface ThinkingRequestContext {
     state?: {
         thinkingLevel?: unknown;

package/dist/agents/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/agents/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,kBAAkB,CAAC;AAS5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAGxF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAGL,iBAAiB,EAIlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,KAAK,aAAa,GAAG,oBAAoB,CAAC;AAkB1C,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,eAAe,EACrB,cAAc,CAAC,EAAE,cAAc,GAC9B,eAAe,CAqDjB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAE5F;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,2BAA2B,6DAIxF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD,GACA,oBAAoB,CAgGtB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AACD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,sBAAsB,EAAE,sBAAsB,GAAG,SAAS,EAC1D,YAAY,CAAC,EAAE,MAAM,GACpB,oBAAoB,CAKtB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,EACtD,YAAY,CAAC,EAAE,MAAM,EACrB,EAAE,QAAgB,EAAE,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChD,qBAAqB,GAAG,gBAAgB,EAAE,CAyE5C;AAMD,KAAK,gBAAgB,GAAG;IACtB,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,CAAC,EAAE,OAAO,CAAC;YAAC,aAAa,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC5E,8BAA8B,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CACrF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAS;IAAE,EAAE,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3F,KAAK,EACD;IACE,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpC,8BAA8B,CAAC,EAAE,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;CACrF,GACD,SAAS,EACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,EAAE,CASV;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACpD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,GAAG,SAAS,CAQpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,EACtD,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,GAAG,SAAS,CAI3B"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/agents/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,kBAAkB,CAAC;AAS5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAGxF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAQ3D,OAAO,EAGL,iBAAiB,EAIlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,KAAK,aAAa,GAAG,oBAAoB,GAAG,wBAAwB,CAAC;AAkBrE,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,eAAe,EACrB,cAAc,CAAC,EAAE,cAAc,GAC9B,eAAe,CAqDjB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAE5F;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,2BAA2B,6DAIxF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD,GACA,aAAa,CAoCf;AAuGD,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AACD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,sBAAsB,EAAE,sBAAsB,GAAG,SAAS,EAC1D,YAAY,CAAC,EAAE,MAAM,GACpB,oBAAoB,CAKtB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,EACtD,YAAY,CAAC,EAAE,MAAM,EACrB,EAAE,QAAgB,EAAE,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChD,qBAAqB,GAAG,gBAAgB,EAAE,CAyE5C;AAMD,KAAK,gBAAgB,GAAG;IACtB,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,CAAC,EAAE,OAAO,CAAC;YAAC,aAAa,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC5E,8BAA8B,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CACrF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAS;IAAE,EAAE,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3F,KAAK,EACD;IACE,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpC,8BAA8B,CAAC,EAAE,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;CACrF,GACD,SAAS,EACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,EAAE,CASV;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EACpD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,GAAG,SAAS,CAQpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,cAAc,EAAE,EAAE;IAAE,cAAc,EAAE,cAAc,CAAA;CAAE,EACtD,YAAY,CAAC,EAAE,MAAM,GACpB,aAAa,GAAG,SAAS,CAI3B"}