@mastra/code-sdk 1.15.0-alpha.11 → 1.15.0-alpha.12

package/dist/agents/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","names":[],"sources":["../../src/agents/tools.ts"],"sourcesContent":["import { createAnthropic } from '@ai-sdk/anthropic';\nimport { createOpenAI } from '@ai-sdk/openai';\nimport type { ToolsInput } from '@mastra/core/agent';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport { createNotificationInboxTool, NotificationsStorage } from '@mastra/core/notifications';\nimport type {\n  CreateNotificationInput,\n  ListDueNotificationsInput,\n  ListNotificationsInput,\n  UpdateNotificationInput,\n  UpdateNotificationsStatusInput,\n} from '@mastra/core/notifications';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MastraCompositeStore } from '@mastra/core/storage';\nimport type { ToolAfterHookContext, ToolHooks } from '@mastra/core/tools';\nimport type { HookManager } from '../hooks/index.js';\nimport type { McpManager } from '../mcp/index.js';\nimport type { MastraCodeComposedState } from '../schema.js';\nimport { MC_TOOLS } from '../tool-names.js';\nimport { createConfiguredWebTools, requestSandboxAccessTool } from '../tools/index.js';\nimport { createWorkflowTool } from '../tools/workflows/create-workflow.js';\nimport { deleteWorkflowTool } from '../tools/workflows/delete-workflow.js';\nimport { getWorkflowTool } from '../tools/workflows/get-workflow.js';\nimport { listWorkflowsTool } from '../tools/workflows/list-workflows.js';\nimport { runWorkflowTool } from '../tools/workflows/run-workflow.js';\nimport { WORKFLOW_MANAGEMENT_TOOL_IDS } from '../tools/workflows/tool-ids.js';\n\n/** Minimal shape for tools passed to createDynamicTools. */\nexport type ToolLike = {\n  execute?: (...args: any[]) => Promise<unknown> | unknown;\n} & Record<string, any>;\n\nfunction configurePluginTool(tool: ToolLike, backgroundToolsEnabled: boolean): ToolLike {\n  if (backgroundToolsEnabled || !tool.background) return tool;\n  return { ...tool, background: { ...tool.background, enabled: false } };\n}\n\nexport class LazyNotificationsStorage extends NotificationsStorage {\n  constructor(private readonly storage: MastraCompositeStore) {\n    super();\n  }\n\n  private async getNotificationsStorage(): Promise<NotificationsStorage> {\n    const notifications = await this.storage.getStore('notifications');\n    if (!notifications) {\n      throw new Error('notification_inbox requires a notifications storage domain');\n    }\n    return notifications;\n  }\n\n  async createNotification(input: CreateNotificationInput) {\n    return (await this.getNotificationsStorage()).createNotification(input);\n  }\n\n  async listNotifications(input: ListNotificationsInput) {\n    return (await this.getNotificationsStorage()).listNotifications(input);\n  }\n\n  async listDueNotifications(input: ListDueNotificationsInput) {\n    return (await this.getNotificationsStorage()).listDueNotifications(input);\n  }\n\n  async getNotification(input: { threadId: string; id: string }) {\n    return (await this.getNotificationsStorage()).getNotification(input);\n  }\n\n  async updateNotification(input: UpdateNotificationInput) {\n    return (await this.getNotificationsStorage()).updateNotification(input);\n  }\n\n  override async updateNotificationsStatus(input: UpdateNotificationsStatusInput) {\n    return (await this.getNotificationsStorage()).updateNotificationsStatus(input);\n  }\n\n  async dangerouslyClearAll() {\n    return (await this.getNotificationsStorage()).dangerouslyClearAll();\n  }\n}\n\nexport type PostToolObserver = (context: ToolAfterHookContext) => void | Promise<void>;\n\nexport function createToolHooks(hookManager?: HookManager, postToolObserver?: PostToolObserver): ToolHooks | undefined {\n  if (!hookManager && !postToolObserver) return undefined;\n\n  return {\n    beforeToolCall: async ({ toolName, input }) => {\n      if (!hookManager) return;\n      const preResult = await hookManager.runPreToolUse(toolName, input);\n      if (!preResult.allowed) {\n        return {\n          proceed: false as const,\n          output: {\n            error: preResult.blockReason ?? `Blocked by PreToolUse hook for tool \"${toolName}\"`,\n          },\n        };\n      }\n    },\n    afterToolCall: async context => {\n      const { toolName, input, output, error } = context;\n      if (hookManager) {\n        const failed = error !== undefined;\n        await hookManager\n          .runPostToolUse(\n            toolName,\n            input,\n            failed ? { error: error instanceof Error ? error.message : String(error) } : output,\n            failed,\n          )\n          .catch(() => undefined);\n      }\n      await Promise.resolve()\n        .then(() => postToolObserver?.(context))\n        .catch(error => {\n          console.warn(`[MastraCode] Post-tool observer failed for ${toolName}.`, error);\n        });\n    },\n  };\n}\n\ntype DynamicToolProvider =\n  | Record<string, ToolLike | undefined>\n  | ((ctx: {\n      requestContext: RequestContext;\n    }) => Record<string, ToolLike | undefined> | Promise<Record<string, ToolLike | undefined>>);\n\nexport function createDynamicTools(\n  mcpManager?: McpManager,\n  extraTools?: DynamicToolProvider,\n  disabledTools?: string[],\n  storage?: MastraCompositeStore,\n  pluginTools?: Record<string, ToolLike>,\n  backgroundToolsEnabled = false,\n  builtinTools?: Record<string, ToolLike>,\n) {\n  return function getDynamicTools({\n    requestContext,\n  }: {\n    requestContext: RequestContext;\n  }): ToolsInput | Promise<ToolsInput> {\n    const ctx = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeComposedState> | undefined;\n    const state = ctx?.getState();\n\n    const modelId = ctx?.session?.modelId;\n    const isAnthropicModel = modelId?.startsWith('anthropic/');\n    const isOpenAIModel = modelId?.startsWith('openai/');\n\n    // Filesystem, grep, glob, edit, write, execute_command, and process\n    // management tools are now provided by the workspace (see workspace.ts).\n    // Only tools without a workspace equivalent remain here.\n    const tools: Record<string, ToolLike> = {\n      request_access: requestSandboxAccessTool,\n      // Workflow surface. `create-workflow` delegates to the workflow-builder\n      // sub-agent; the other four are Dynamic Workflow management operations.\n      // Permission categories live in permissions.ts (TOOL_CATEGORY_MAP).\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.createWorkflow]: createWorkflowTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.listWorkflows]: listWorkflowsTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.getWorkflow]: getWorkflowTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.runWorkflow]: runWorkflowTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.deleteWorkflow]: deleteWorkflowTool,\n    };\n\n    // Opt-in built-ins (e.g. the experimental schedule tools).\n    if (builtinTools) Object.assign(tools, builtinTools);\n\n    if (storage) {\n      tools[MC_TOOLS.NOTIFICATION_INBOX] = createNotificationInboxTool({\n        storage: new LazyNotificationsStorage(storage),\n      });\n    }\n\n    const configuredWebTools = createConfiguredWebTools();\n    if (configuredWebTools) {\n      Object.assign(tools, configuredWebTools);\n    } else if (isAnthropicModel) {\n      const anthropic = createAnthropic({});\n      tools.web_search = anthropic.tools.webSearch_20250305();\n    } else if (isOpenAIModel) {\n      const openai = createOpenAI({});\n      tools.web_search = openai.tools.webSearch();\n    }\n\n    if (mcpManager) {\n      const mcpTools = mcpManager.getTools();\n      Object.assign(tools, mcpTools);\n    }\n\n    const finish = (resolvedExtra: Record<string, ToolLike | undefined> | undefined) => {\n      if (resolvedExtra) {\n        for (const [name, tool] of Object.entries(resolvedExtra)) {\n          if (tool && !(name in tools)) {\n            tools[name] = tool;\n          }\n        }\n      }\n\n      if (pluginTools) {\n        for (const [name, tool] of Object.entries(pluginTools)) {\n          if (!(name in tools)) {\n            tools[name] = configurePluginTool(tool, backgroundToolsEnabled);\n          }\n        }\n      }\n\n      // Remove tools explicitly disabled via config so the model never sees them.\n      if (disabledTools?.length) {\n        for (const toolName of disabledTools) {\n          delete tools[toolName];\n        }\n      }\n\n      // Remove tools that have a per-tool 'deny' policy so the model never sees them.\n      const permissionRules = state?.permissionRules;\n      if (permissionRules?.tools) {\n        for (const [name, policy] of Object.entries(permissionRules.tools)) {\n          if (policy === 'deny') {\n            delete tools[name];\n          }\n        }\n      }\n\n      return tools as ToolsInput;\n    };\n\n    if (typeof extraTools === 'function') {\n      const resolved = extraTools({ requestContext });\n      // Stay synchronous for sync providers; only go async when the provider does.\n      if (resolved && typeof (resolved as PromiseLike<unknown>).then === 'function') {\n        return Promise.resolve(resolved).then(finish);\n      }\n      return finish(resolved as Record<string, ToolLike | undefined>);\n    }\n\n    return finish(extraTools);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAgCA,SAAS,oBAAoB,MAAgB,wBAA2C;CACtF,IAAI,0BAA0B,CAAC,KAAK,YAAY,OAAO;CACvD,OAAO;EAAE,GAAG;EAAM,YAAY;GAAE,GAAG,KAAK;GAAY,SAAS;EAAM;CAAE;AACvE;AAEA,IAAa,2BAAb,cAA8C,qBAAqB;CACpC;CAA7B,YAAY,SAAgD;EAC1D,MAAM;EADqB,KAAA,UAAA;CAE7B;CAEA,MAAc,0BAAyD;EACrE,MAAM,gBAAgB,MAAM,KAAK,QAAQ,SAAS,eAAe;EACjE,IAAI,CAAC,eACH,MAAM,IAAI,MAAM,4DAA4D;EAE9E,OAAO;CACT;CAEA,MAAM,mBAAmB,OAAgC;EACvD,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,mBAAmB,KAAK;CACxE;CAEA,MAAM,kBAAkB,OAA+B;EACrD,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,kBAAkB,KAAK;CACvE;CAEA,MAAM,qBAAqB,OAAkC;EAC3D,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,qBAAqB,KAAK;CAC1E;CAEA,MAAM,gBAAgB,OAAyC;EAC7D,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,gBAAgB,KAAK;CACrE;CAEA,MAAM,mBAAmB,OAAgC;EACvD,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,mBAAmB,KAAK;CACxE;CAEA,MAAe,0BAA0B,OAAuC;EAC9E,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,0BAA0B,KAAK;CAC/E;CAEA,MAAM,sBAAsB;EAC1B,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,oBAAoB;CACpE;AACF;AAIA,SAAgB,gBAAgB,aAA2B,kBAA4D;CACrH,IAAI,CAAC,eAAe,CAAC,kBAAkB,OAAO,KAAA;CAE9C,OAAO;EACL,gBAAgB,OAAO,EAAE,UAAU,YAAY;GAC7C,IAAI,CAAC,aAAa;GAClB,MAAM,YAAY,MAAM,YAAY,cAAc,UAAU,KAAK;GACjE,IAAI,CAAC,UAAU,SACb,OAAO;IACL,SAAS;IACT,QAAQ,EACN,OAAO,UAAU,eAAe,wCAAwC,SAAS,GACnF;GACF;EAEJ;EACA,eAAe,OAAM,YAAW;GAC9B,MAAM,EAAE,UAAU,OAAO,QAAQ,UAAU;GAC3C,IAAI,aAAa;IACf,MAAM,SAAS,UAAU,KAAA;IACzB,MAAM,YACH,eACC,UACA,OACA,SAAS,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAI,QAC7E,MACF,CAAC,CACA,YAAY,KAAA,CAAS;GAC1B;GACA,MAAM,QAAQ,QAAQ,CAAC,CACpB,WAAW,mBAAmB,OAAO,CAAC,CAAC,CACvC,OAAM,UAAS;IACd,QAAQ,KAAK,8CAA8C,SAAS,IAAI,KAAK;GAC/E,CAAC;EACL;CACF;AACF;AAQA,SAAgB,mBACd,YACA,YACA,eACA,SACA,aACA,yBAAyB,OACzB,cACA;CACA,OAAO,SAAS,gBAAgB,EAC9B,kBAGmC;EACnC,MAAM,MAAM,eAAe,IAAI,YAAY;EAC3C,MAAM,QAAQ,KAAK,SAAS;EAE5B,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,mBAAmB,SAAS,WAAW,YAAY;EACzD,MAAM,gBAAgB,SAAS,WAAW,SAAS;EAKnD,MAAM,QAAkC;GACtC,gBAAgB;IAIf,6BAA6B,iBAAiB;IAC9C,6BAA6B,gBAAgB;IAC7C,6BAA6B,cAAc;IAC3C,6BAA6B,cAAc;IAC3C,6BAA6B,iBAAiB;EACjD;EAGA,IAAI,cAAc,OAAO,OAAO,OAAO,YAAY;EAEnD,IAAI,SACF,MAAM,SAAS,sBAAsB,4BAA4B,EAC/D,SAAS,IAAI,yBAAyB,OAAO,EAC/C,CAAC;EAGH,MAAM,qBAAqB,yBAAyB;EACpD,IAAI,oBACF,OAAO,OAAO,OAAO,kBAAkB;OAClC,IAAI,kBAET,MAAM,aADY,gBAAgB,CAAC,CACR,CAAC,CAAC,MAAM,mBAAmB;OACjD,IAAI,eAET,MAAM,aADS,aAAa,CAAC,CACL,CAAC,CAAC,MAAM,UAAU;EAG5C,IAAI,YAAY;GACd,MAAM,WAAW,WAAW,SAAS;GACrC,OAAO,OAAO,OAAO,QAAQ;EAC/B;EAEA,MAAM,UAAU,kBAAoE;GAClF,IAAI,eACG;SAAA,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,aAAa,GACrD,IAAI,QAAQ,EAAE,QAAQ,QACpB,MAAM,QAAQ;GAAA;GAKpB,IAAI,aACG;SAAA,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GACnD,IAAI,EAAE,QAAQ,QACZ,MAAM,QAAQ,oBAAoB,MAAM,sBAAsB;GAAA;GAMpE,IAAI,eAAe,QACjB,KAAK,MAAM,YAAY,eACrB,OAAO,MAAM;GAKjB,MAAM,kBAAkB,OAAO;GAC/B,IAAI,iBAAiB,OACd;SAAA,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,gBAAgB,KAAK,GAC/D,IAAI,WAAW,QACb,OAAO,MAAM;GAAA;GAKnB,OAAO;EACT;EAEA,IAAI,OAAO,eAAe,YAAY;GACpC,MAAM,WAAW,WAAW,EAAE,eAAe,CAAC;GAE9C,IAAI,YAAY,OAAQ,SAAkC,SAAS,YACjE,OAAO,QAAQ,QAAQ,QAAQ,CAAC,CAAC,KAAK,MAAM;GAE9C,OAAO,OAAO,QAAgD;EAChE;EAEA,OAAO,OAAO,UAAU;CAC1B;AACF"}
+{"version":3,"file":"tools.js","names":[],"sources":["../../src/agents/tools.ts"],"sourcesContent":["import { createAnthropic } from '@ai-sdk/anthropic';\nimport { createOpenAI } from '@ai-sdk/openai';\nimport type { ToolsInput } from '@mastra/core/agent';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport { createNotificationInboxTool, NotificationsStorage } from '@mastra/core/notifications';\nimport type {\n  CreateNotificationInput,\n  ListDueNotificationsInput,\n  ListNotificationsInput,\n  UpdateNotificationInput,\n  UpdateNotificationsStatusInput,\n} from '@mastra/core/notifications';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MastraCompositeStore } from '@mastra/core/storage';\nimport type { ToolAfterHookContext, ToolHooks } from '@mastra/core/tools';\nimport type { HookManager } from '../hooks/index.js';\nimport type { McpManager } from '../mcp/index.js';\nimport type { MastraCodeComposedState } from '../schema.js';\nimport { MC_TOOLS } from '../tool-names.js';\nimport { createConfiguredWebTools, requestSandboxAccessTool } from '../tools/index.js';\nimport { createWorkflowTool } from '../tools/workflows/create-workflow.js';\nimport { deleteWorkflowTool } from '../tools/workflows/delete-workflow.js';\nimport { getWorkflowTool } from '../tools/workflows/get-workflow.js';\nimport { listWorkflowsTool } from '../tools/workflows/list-workflows.js';\nimport { runWorkflowTool } from '../tools/workflows/run-workflow.js';\nimport { WORKFLOW_MANAGEMENT_TOOL_IDS } from '../tools/workflows/tool-ids.js';\n\n/** Minimal shape for tools passed to createDynamicTools. */\nexport type ToolLike = {\n  execute?: (...args: any[]) => Promise<unknown> | unknown;\n} & Record<string, any>;\n\nfunction configurePluginTool(tool: ToolLike, backgroundToolsEnabled: boolean): ToolLike {\n  if (backgroundToolsEnabled || !tool.background) return tool;\n  return { ...tool, background: { ...tool.background, enabled: false } };\n}\n\nexport class LazyNotificationsStorage extends NotificationsStorage {\n  constructor(private readonly storage: MastraCompositeStore) {\n    super();\n  }\n\n  private async getNotificationsStorage(): Promise<NotificationsStorage> {\n    const notifications = await this.storage.getStore('notifications');\n    if (!notifications) {\n      throw new Error('notification_inbox requires a notifications storage domain');\n    }\n    return notifications;\n  }\n\n  async createNotification(input: CreateNotificationInput) {\n    return (await this.getNotificationsStorage()).createNotification(input);\n  }\n\n  async listNotifications(input: ListNotificationsInput) {\n    return (await this.getNotificationsStorage()).listNotifications(input);\n  }\n\n  async listDueNotifications(input: ListDueNotificationsInput) {\n    return (await this.getNotificationsStorage()).listDueNotifications(input);\n  }\n\n  async getNotification(input: { threadId: string; id: string }) {\n    return (await this.getNotificationsStorage()).getNotification(input);\n  }\n\n  async updateNotification(input: UpdateNotificationInput) {\n    return (await this.getNotificationsStorage()).updateNotification(input);\n  }\n\n  override async updateNotificationsStatus(input: UpdateNotificationsStatusInput) {\n    return (await this.getNotificationsStorage()).updateNotificationsStatus(input);\n  }\n\n  async dangerouslyClearAll() {\n    return (await this.getNotificationsStorage()).dangerouslyClearAll();\n  }\n}\n\nexport type PostToolObserver = (context: ToolAfterHookContext) => void | Promise<void>;\n\nexport function createToolHooks(hookManager?: HookManager, postToolObserver?: PostToolObserver): ToolHooks | undefined {\n  if (!hookManager && !postToolObserver) return undefined;\n\n  return {\n    beforeToolCall: async ({ toolName, input }) => {\n      if (!hookManager) return;\n      const preResult = await hookManager.runPreToolUse(toolName, input);\n      if (!preResult.allowed) {\n        return {\n          proceed: false as const,\n          output: {\n            error: preResult.blockReason ?? `Blocked by PreToolUse hook for tool \"${toolName}\"`,\n          },\n        };\n      }\n    },\n    afterToolCall: async context => {\n      const { toolName, input, output, error } = context;\n      if (hookManager) {\n        const failed = error !== undefined;\n        await hookManager\n          .runPostToolUse(\n            toolName,\n            input,\n            failed ? { error: error instanceof Error ? error.message : String(error) } : output,\n            failed,\n          )\n          .catch(() => undefined);\n      }\n      await Promise.resolve()\n        .then(() => postToolObserver?.(context))\n        .catch(error => {\n          console.warn(`[MastraCode] Post-tool observer failed for ${toolName}.`, error);\n        });\n    },\n  };\n}\n\ntype DynamicToolProvider =\n  | Record<string, ToolLike | undefined>\n  | ((ctx: {\n      requestContext: RequestContext;\n    }) => Record<string, ToolLike | undefined> | Promise<Record<string, ToolLike | undefined>>);\n\nexport function createDynamicTools(\n  mcpManager?: McpManager,\n  extraTools?: DynamicToolProvider,\n  disabledTools?: string[],\n  storage?: MastraCompositeStore,\n  pluginTools?: Record<string, ToolLike>,\n  backgroundToolsEnabled = false,\n  builtinTools?: Record<string, ToolLike>,\n) {\n  return function getDynamicTools({\n    requestContext,\n  }: {\n    requestContext: RequestContext;\n  }): ToolsInput | Promise<ToolsInput> {\n    const ctx = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeComposedState> | undefined;\n    const state = ctx?.getState();\n\n    const modelId = ctx?.session?.modelId;\n    const isAnthropicModel = modelId?.startsWith('anthropic/');\n    const isOpenAIModel = modelId?.startsWith('openai/');\n\n    // Filesystem, grep, glob, edit, write, execute_command, and process\n    // management tools are now provided by the workspace (see workspace.ts).\n    // Only tools without a workspace equivalent remain here.\n    const tools: Record<string, ToolLike> = {\n      request_access: requestSandboxAccessTool,\n      // Workflow surface. `create-workflow` delegates to the workflow-builder\n      // sub-agent; the other four are Dynamic Workflow management operations.\n      // Permission categories live in permissions.ts (TOOL_CATEGORY_MAP).\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.createWorkflow]: createWorkflowTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.listWorkflows]: listWorkflowsTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.getWorkflow]: getWorkflowTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.runWorkflow]: runWorkflowTool,\n      [WORKFLOW_MANAGEMENT_TOOL_IDS.deleteWorkflow]: deleteWorkflowTool,\n    };\n\n    // Opt-in built-ins (e.g. the experimental schedule tools).\n    if (builtinTools) Object.assign(tools, builtinTools);\n\n    if (storage) {\n      tools[MC_TOOLS.NOTIFICATION_INBOX] = createNotificationInboxTool({\n        storage: new LazyNotificationsStorage(storage),\n      });\n    }\n\n    // Async only when a Tavily/Parallel key is set; otherwise the tool list stays synchronous.\n    const configuredWebTools = createConfiguredWebTools();\n    if (!configuredWebTools) {\n      if (isAnthropicModel) {\n        const anthropic = createAnthropic({});\n        tools.web_search = anthropic.tools.webSearch_20250305();\n      } else if (isOpenAIModel) {\n        const openai = createOpenAI({});\n        tools.web_search = openai.tools.webSearch();\n      }\n    }\n\n    const mcpTools = mcpManager?.getTools();\n    if (mcpTools) Object.assign(tools, mcpTools);\n\n    const finish = (resolvedExtra: Record<string, ToolLike | undefined> | undefined) => {\n      if (resolvedExtra) {\n        for (const [name, tool] of Object.entries(resolvedExtra)) {\n          if (tool && !(name in tools)) {\n            tools[name] = tool;\n          }\n        }\n      }\n\n      if (pluginTools) {\n        for (const [name, tool] of Object.entries(pluginTools)) {\n          if (!(name in tools)) {\n            tools[name] = configurePluginTool(tool, backgroundToolsEnabled);\n          }\n        }\n      }\n\n      // Remove tools explicitly disabled via config so the model never sees them.\n      if (disabledTools?.length) {\n        for (const toolName of disabledTools) {\n          delete tools[toolName];\n        }\n      }\n\n      // Remove tools that have a per-tool 'deny' policy so the model never sees them.\n      const permissionRules = state?.permissionRules;\n      if (permissionRules?.tools) {\n        for (const [name, policy] of Object.entries(permissionRules.tools)) {\n          if (policy === 'deny') {\n            delete tools[name];\n          }\n        }\n      }\n\n      return tools as ToolsInput;\n    };\n\n    const resolveExtra = (): ToolsInput | Promise<ToolsInput> => {\n      if (typeof extraTools === 'function') {\n        const resolved = extraTools({ requestContext });\n        // Stay synchronous for sync providers; only go async when the provider does.\n        if (resolved && typeof (resolved as PromiseLike<unknown>).then === 'function') {\n          return Promise.resolve(resolved).then(finish);\n        }\n        return finish(resolved as Record<string, ToolLike | undefined>);\n      }\n      return finish(extraTools);\n    };\n\n    if (configuredWebTools) {\n      return configuredWebTools.then(webTools => {\n        // MCP tools keep precedence over the web tools, as when both were assigned in order.\n        Object.assign(tools, webTools, mcpTools);\n        return resolveExtra();\n      });\n    }\n\n    return resolveExtra();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAgCA,SAAS,oBAAoB,MAAgB,wBAA2C;CACtF,IAAI,0BAA0B,CAAC,KAAK,YAAY,OAAO;CACvD,OAAO;EAAE,GAAG;EAAM,YAAY;GAAE,GAAG,KAAK;GAAY,SAAS;EAAM;CAAE;AACvE;AAEA,IAAa,2BAAb,cAA8C,qBAAqB;CACpC;CAA7B,YAAY,SAAgD;EAC1D,MAAM;EADqB,KAAA,UAAA;CAE7B;CAEA,MAAc,0BAAyD;EACrE,MAAM,gBAAgB,MAAM,KAAK,QAAQ,SAAS,eAAe;EACjE,IAAI,CAAC,eACH,MAAM,IAAI,MAAM,4DAA4D;EAE9E,OAAO;CACT;CAEA,MAAM,mBAAmB,OAAgC;EACvD,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,mBAAmB,KAAK;CACxE;CAEA,MAAM,kBAAkB,OAA+B;EACrD,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,kBAAkB,KAAK;CACvE;CAEA,MAAM,qBAAqB,OAAkC;EAC3D,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,qBAAqB,KAAK;CAC1E;CAEA,MAAM,gBAAgB,OAAyC;EAC7D,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,gBAAgB,KAAK;CACrE;CAEA,MAAM,mBAAmB,OAAgC;EACvD,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,mBAAmB,KAAK;CACxE;CAEA,MAAe,0BAA0B,OAAuC;EAC9E,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,0BAA0B,KAAK;CAC/E;CAEA,MAAM,sBAAsB;EAC1B,QAAQ,MAAM,KAAK,wBAAwB,EAAA,CAAG,oBAAoB;CACpE;AACF;AAIA,SAAgB,gBAAgB,aAA2B,kBAA4D;CACrH,IAAI,CAAC,eAAe,CAAC,kBAAkB,OAAO,KAAA;CAE9C,OAAO;EACL,gBAAgB,OAAO,EAAE,UAAU,YAAY;GAC7C,IAAI,CAAC,aAAa;GAClB,MAAM,YAAY,MAAM,YAAY,cAAc,UAAU,KAAK;GACjE,IAAI,CAAC,UAAU,SACb,OAAO;IACL,SAAS;IACT,QAAQ,EACN,OAAO,UAAU,eAAe,wCAAwC,SAAS,GACnF;GACF;EAEJ;EACA,eAAe,OAAM,YAAW;GAC9B,MAAM,EAAE,UAAU,OAAO,QAAQ,UAAU;GAC3C,IAAI,aAAa;IACf,MAAM,SAAS,UAAU,KAAA;IACzB,MAAM,YACH,eACC,UACA,OACA,SAAS,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAI,QAC7E,MACF,CAAC,CACA,YAAY,KAAA,CAAS;GAC1B;GACA,MAAM,QAAQ,QAAQ,CAAC,CACpB,WAAW,mBAAmB,OAAO,CAAC,CAAC,CACvC,OAAM,UAAS;IACd,QAAQ,KAAK,8CAA8C,SAAS,IAAI,KAAK;GAC/E,CAAC;EACL;CACF;AACF;AAQA,SAAgB,mBACd,YACA,YACA,eACA,SACA,aACA,yBAAyB,OACzB,cACA;CACA,OAAO,SAAS,gBAAgB,EAC9B,kBAGmC;EACnC,MAAM,MAAM,eAAe,IAAI,YAAY;EAC3C,MAAM,QAAQ,KAAK,SAAS;EAE5B,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,mBAAmB,SAAS,WAAW,YAAY;EACzD,MAAM,gBAAgB,SAAS,WAAW,SAAS;EAKnD,MAAM,QAAkC;GACtC,gBAAgB;IAIf,6BAA6B,iBAAiB;IAC9C,6BAA6B,gBAAgB;IAC7C,6BAA6B,cAAc;IAC3C,6BAA6B,cAAc;IAC3C,6BAA6B,iBAAiB;EACjD;EAGA,IAAI,cAAc,OAAO,OAAO,OAAO,YAAY;EAEnD,IAAI,SACF,MAAM,SAAS,sBAAsB,4BAA4B,EAC/D,SAAS,IAAI,yBAAyB,OAAO,EAC/C,CAAC;EAIH,MAAM,qBAAqB,yBAAyB;EACpD,IAAI,CAAC,oBAAoB;GACvB,IAAI,kBAEF,MAAM,aADY,gBAAgB,CAAC,CACR,CAAC,CAAC,MAAM,mBAAmB;QACjD,IAAI,eAET,MAAM,aADS,aAAa,CAAC,CACL,CAAC,CAAC,MAAM,UAAU;EAE9C;EAEA,MAAM,WAAW,YAAY,SAAS;EACtC,IAAI,UAAU,OAAO,OAAO,OAAO,QAAQ;EAE3C,MAAM,UAAU,kBAAoE;GAClF,IAAI,eACG;SAAA,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,aAAa,GACrD,IAAI,QAAQ,EAAE,QAAQ,QACpB,MAAM,QAAQ;GAAA;GAKpB,IAAI,aACG;SAAA,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GACnD,IAAI,EAAE,QAAQ,QACZ,MAAM,QAAQ,oBAAoB,MAAM,sBAAsB;GAAA;GAMpE,IAAI,eAAe,QACjB,KAAK,MAAM,YAAY,eACrB,OAAO,MAAM;GAKjB,MAAM,kBAAkB,OAAO;GAC/B,IAAI,iBAAiB,OACd;SAAA,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,gBAAgB,KAAK,GAC/D,IAAI,WAAW,QACb,OAAO,MAAM;GAAA;GAKnB,OAAO;EACT;EAEA,MAAM,qBAAuD;GAC3D,IAAI,OAAO,eAAe,YAAY;IACpC,MAAM,WAAW,WAAW,EAAE,eAAe,CAAC;IAE9C,IAAI,YAAY,OAAQ,SAAkC,SAAS,YACjE,OAAO,QAAQ,QAAQ,QAAQ,CAAC,CAAC,KAAK,MAAM;IAE9C,OAAO,OAAO,QAAgD;GAChE;GACA,OAAO,OAAO,UAAU;EAC1B;EAEA,IAAI,oBACF,OAAO,mBAAmB,MAAK,aAAY;GAEzC,OAAO,OAAO,OAAO,UAAU,QAAQ;GACvC,OAAO,aAAa;EACtB,CAAC;EAGH,OAAO,aAAa;CACtB;AACF"}

package/dist/agents/workspace.js

@@ -32,7 +32,8 @@ function collectSkillPaths(skillsDirs, allowedRoot) {
 	for (const skillsDir of skillsDirs) {
 		const skillsDirExists = fs.existsSync(skillsDir);
 		if (skillsDirExists && realAllowedRoot) try {
-			if (!isPathWithinRoot(fs.realpathSync(skillsDir), realAllowedRoot)) continue;
+			const realSkillsDir = fs.realpathSync(skillsDir);
+			if (!isPathWithinRoot(realSkillsDir, realAllowedRoot)) continue;
 		} catch {
 			continue;
 		}

package/dist/agents/workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.js","names":[],"sources":["../../src/agents/workspace.ts"],"sourcesContent":["import fs, { existsSync } from 'node:fs';\nimport os from 'node:os';\nimport path, { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport type { ToolsInput } from '@mastra/core/agent';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { Workspace, LocalFilesystem, LocalSandbox, createWorkspaceTools } from '@mastra/core/workspace';\nimport type { LSPConfig, SkillSource } from '@mastra/core/workspace';\nimport { DEFAULT_CONFIG_DIR } from '../constants.js';\nimport { loadSettings, resolveLspSetting } from '../onboarding/settings.js';\nimport type { MastraCodeState } from '../schema.js';\nimport { isPathWithinRoot } from '../utils/path-security.js';\nimport { getPlansDir } from '../utils/plans.js';\n\nimport { createMastraCodeWorkspaceTools, GOAL_JUDGE_READONLY_TOOLS } from './tool-availability.js';\n\n// =============================================================================\n// Sandbox Environment\n// =============================================================================\n\nfunction buildSandboxEnv(): NodeJS.ProcessEnv {\n  return {\n    ...process.env,\n    // Explicit overrides for non-interactive subprocess execution\n    FORCE_COLOR: '1',\n    CLICOLOR_FORCE: '1',\n    TERM: process.env.TERM || 'xterm-256color',\n    CI: 'true',\n    NONINTERACTIVE: '1',\n    DEBIAN_FRONTEND: 'noninteractive',\n  };\n}\n\n// =============================================================================\n// Create Workspace with Skills\n// =============================================================================\n\n// We support multiple skill locations for compatibility:\n// 1. Project-local: <configDir>/skills (project-specific mastracode skills)\n// 2. Project-local: .claude/skills (Claude Code compatible skills)\n// 3. Project-local: .agents/skills (Agent Skills spec compatible)\n// 4. Global: ~/<configDir>/skills (user-wide mastracode skills)\n// 5. Global: ~/.claude/skills (user-wide Claude Code skills)\n// 6. Global: ~/.agents/skills (user-wide Agent Skills spec compatible)\n\n// Mastra's LocalSkillSource.readdir uses Node's Dirent.isDirectory() which\n// returns false for symlinks. Tools like `npx skills add` install skills as\n// symlinks, so we need to resolve them. For each symlinked skill directory,\n// we add the real (resolved) parent path as an additional skill scan path.\nfunction collectSkillPaths(skillsDirs: string[], allowedRoot?: string): string[] {\n  const paths: string[] = [];\n  const seen = new Set<string>();\n  let realAllowedRoot: string | undefined;\n\n  if (allowedRoot) {\n    try {\n      realAllowedRoot = fs.realpathSync(allowedRoot);\n    } catch {\n      return [];\n    }\n  }\n\n  for (const skillsDir of skillsDirs) {\n    const skillsDirExists = fs.existsSync(skillsDir);\n    if (skillsDirExists && realAllowedRoot) {\n      try {\n        const realSkillsDir = fs.realpathSync(skillsDir);\n        if (!isPathWithinRoot(realSkillsDir, realAllowedRoot)) continue;\n      } catch {\n        continue;\n      }\n    }\n\n    const resolved = path.resolve(skillsDir);\n    if (!seen.has(resolved)) {\n      seen.add(resolved);\n      paths.push(skillsDir);\n    }\n\n    if (!skillsDirExists) continue;\n\n    try {\n      const entries = fs.readdirSync(skillsDir, { withFileTypes: true });\n      for (const entry of entries) {\n        if (entry.isSymbolicLink()) {\n          try {\n            const linkPath = path.join(skillsDir, entry.name);\n            const realPath = fs.realpathSync(linkPath);\n            if (realAllowedRoot && !isPathWithinRoot(realPath, realAllowedRoot)) continue;\n            const stat = fs.statSync(realPath);\n            if (stat.isDirectory()) {\n              const realParent = path.dirname(realPath);\n              if (realAllowedRoot && !isPathWithinRoot(realParent, realAllowedRoot)) continue;\n              if (!seen.has(realParent)) {\n                seen.add(realParent);\n                paths.push(realParent);\n              }\n            }\n          } catch {\n            continue;\n          }\n        }\n      }\n    } catch {\n      // Ignore errors during symlink resolution\n    }\n  }\n\n  return paths;\n}\n\n// Build skill paths dynamically based on configDir and projectPath\nexport function buildSkillPaths(\n  projectPath: string,\n  configDir: string,\n  homeDir = os.homedir(),\n  pluginSkillPaths: string[] = [],\n): string[] {\n  const mastraCodeLocalSkillsPath = path.join(projectPath, configDir, 'skills');\n  const claudeLocalSkillsPath = path.join(projectPath, '.claude', 'skills');\n  const agentSkillsLocalPath = path.join(projectPath, '.agents', 'skills');\n  const mastraCodeGlobalSkillsPath = path.join(homeDir, configDir, 'skills');\n  const claudeGlobalSkillsPath = path.join(homeDir, '.claude', 'skills');\n  const agentSkillsGlobalPath = path.join(homeDir, '.agents', 'skills');\n\n  const paths = [\n    ...collectSkillPaths([mastraCodeLocalSkillsPath, claudeLocalSkillsPath, agentSkillsLocalPath], projectPath),\n    ...collectSkillPaths([mastraCodeGlobalSkillsPath, claudeGlobalSkillsPath, agentSkillsGlobalPath]),\n    ...pluginSkillPaths.flatMap(pluginSkillPath => collectSkillPaths([pluginSkillPath], pluginSkillPath)),\n  ];\n\n  const seenPaths = new Set<string>();\n  return paths.filter(skillPath => {\n    let resolved: string;\n    try {\n      resolved = fs.realpathSync(skillPath);\n    } catch {\n      resolved = path.resolve(skillPath);\n    }\n    if (seenPaths.has(resolved)) return false;\n    seenPaths.add(resolved);\n    return true;\n  });\n}\n\nexport interface WorkspaceSkillExtension {\n  /** Distinguishes extended workspaces from the default resolver cache. */\n  id: string;\n  /** Additional read-only skill roots prepended to normal project/global skill roots. */\n  paths: string[];\n  /** Compose the additional roots with the workspace's normal skill source. */\n  createSource: (fallback: SkillSource, fallbackSkillRoots: string[]) => SkillSource;\n}\n\n/**\n * Paths the agent is always allowed to access (in addition to the project root\n * and any per-thread sandboxAllowedPaths). The OS temp directory is included\n * so the agent can use it as a scratchpad without requesting access every time.\n */\nconst DEFAULT_ALLOWED_PATHS: string[] = [os.tmpdir(), '/tmp', getPlansDir()].reduce<string[]>((acc, p) => {\n  const resolved = path.resolve(p);\n  if (!acc.includes(resolved)) acc.push(resolved);\n  return acc;\n}, []);\n\nconst WORKSPACE_ID_PREFIX = 'mastra-code-workspace';\n\n/**\n * Detect the project's package runner from lock files.\n * Used as a fallback packageRunner for LSP when no binary is found locally or on PATH.\n */\nfunction detectPackageRunner(projectPath: string): string | undefined {\n  if (existsSync(join(projectPath, 'pnpm-lock.yaml'))) return 'pnpm dlx';\n  if (existsSync(join(projectPath, 'bun.lockb')) || existsSync(join(projectPath, 'bun.lock'))) return 'bunx';\n  if (existsSync(join(projectPath, 'yarn.lock'))) return 'yarn dlx';\n  if (existsSync(join(projectPath, 'package-lock.json'))) return 'npx --yes';\n  return 'npx --yes';\n}\n\nexport async function getDynamicWorkspace({\n  requestContext,\n  mastra,\n  skillExtension,\n  backgroundToolsEnabled = false,\n}: {\n  requestContext: RequestContext;\n  mastra?: Mastra;\n  skillExtension?: WorkspaceSkillExtension;\n  backgroundToolsEnabled?: boolean;\n}) {\n  const ctx = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n  const state = ctx?.getState();\n\n  const rawProjectPath = state?.projectPath;\n\n  if (!rawProjectPath) {\n    throw new Error('Project path is required');\n  }\n\n  const projectPath = path.resolve(rawProjectPath);\n  const configDir = state?.configDir ?? DEFAULT_CONFIG_DIR;\n  const projectSkillPaths = buildSkillPaths(projectPath, configDir, state?.homeDir, state?.pluginSkillPaths ?? []);\n  const skillPaths = [...(skillExtension?.paths ?? []), ...projectSkillPaths];\n  const extensionId = skillExtension ? `-${skillExtension.id}` : '';\n  const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectPath}${extensionId}`;\n  const sandboxPaths = state?.sandboxAllowedPaths ?? [];\n  const allowedPaths = [\n    ...projectSkillPaths,\n    ...DEFAULT_ALLOWED_PATHS,\n    ...sandboxPaths.map((p: string) => path.resolve(p)),\n  ];\n\n  // All modes share the same workspace tool configuration.  Per-mode tool\n  // visibility is enforced at LLM-call time via `availableTools` /\n  // `activeTools` on the AgentController, not by mutating workspace capabilities.\n  const workspaceTools = createMastraCodeWorkspaceTools(backgroundToolsEnabled);\n\n  // Reuse existing workspace if already registered (preserves ProcessManager state)\n  let existing: Workspace<LocalFilesystem, LocalSandbox> | undefined;\n  try {\n    existing = mastra?.getWorkspaceById(workspaceId) as Workspace<LocalFilesystem, LocalSandbox>;\n  } catch {\n    // Not registered yet\n  }\n\n  if (existing) {\n    existing.filesystem.setAllowedPaths(allowedPaths);\n    existing.setToolsConfig(workspaceTools);\n    return existing;\n  }\n\n  // LSP is opt-in. When disabled we pass `false` so core skips the dependency\n  // check, the LSP manager, and the `lsp_inspect` tool entirely.\n  const userLsp = resolveLspSetting(loadSettings().lsp);\n  let lspConfig: LSPConfig | false = false;\n  if (userLsp !== false) {\n    const mcModulePath = join(dirname(fileURLToPath(import.meta.url)), '..');\n    lspConfig = {\n      maxOpenClients: 4,\n      ...userLsp,\n      packageRunner: userLsp.packageRunner || detectPackageRunner(projectPath), // Detected runner is the fallback — user's packageRunner always wins\n      searchPaths: [mcModulePath, ...(userLsp.searchPaths ?? [])],\n    };\n  }\n\n  // First call for this project — create the workspace\n  const filesystem = new LocalFilesystem({\n    basePath: projectPath,\n    allowedPaths,\n  });\n  return new Workspace({\n    id: workspaceId,\n    name: 'Mastra Code Workspace',\n    filesystem,\n    sandbox: new LocalSandbox({\n      timeout: 30_000,\n      workingDirectory: projectPath,\n      env: buildSandboxEnv(),\n    }),\n    tools: workspaceTools,\n    skills: skillPaths,\n    ...(skillExtension ? { skillSource: skillExtension.createSource(filesystem, projectSkillPaths) } : {}),\n    lsp: lspConfig,\n  });\n}\n\n/**\n * Resolver for the agent's `goal.tools` config. Builds the request's workspace\n * (same per-request resolution as the agent's own tools) and returns only the\n * read-only verification subset, remapped to mastracode's tool names (`view`,\n * `search_content`, etc.). Returns `undefined` when no workspace can be resolved\n * (e.g. no project path), keeping the default judge text-only rather than\n * throwing inside the goal step.\n */\nexport async function getGoalJudgeTools({\n  requestContext,\n  mastra,\n}: {\n  requestContext: RequestContext;\n  mastra?: Mastra;\n}): Promise<ToolsInput | undefined> {\n  let workspace: Workspace;\n  try {\n    workspace = await getDynamicWorkspace({ requestContext, mastra });\n  } catch {\n    return undefined;\n  }\n\n  const allTools = await createWorkspaceTools(workspace, { requestContext, workspace });\n  const readonly: ToolsInput = {};\n  for (const name of GOAL_JUDGE_READONLY_TOOLS) {\n    if (allTools[name]) readonly[name] = allTools[name];\n  }\n  return Object.keys(readonly).length > 0 ? readonly : undefined;\n}\n"],"mappings":";;;;;;;;;;;AAsBA,SAAS,kBAAqC;CAC5C,OAAO;EACL,GAAG,QAAQ;EAEX,aAAa;EACb,gBAAgB;EAChB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI;EACJ,gBAAgB;EAChB,iBAAiB;CACnB;AACF;AAkBA,SAAS,kBAAkB,YAAsB,aAAgC;CAC/E,MAAM,QAAkB,CAAC;CACzB,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI;CAEJ,IAAI,aACF,IAAI;EACF,kBAAkB,GAAG,aAAa,WAAW;CAC/C,QAAQ;EACN,OAAO,CAAC;CACV;CAGF,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,kBAAkB,GAAG,WAAW,SAAS;EAC/C,IAAI,mBAAmB,iBACrB,IAAI;GAEF,IAAI,CAAC,iBADiB,GAAG,aAAa,SACJ,GAAG,eAAe,GAAG;EACzD,QAAQ;GACN;EACF;EAGF,MAAM,WAAW,KAAK,QAAQ,SAAS;EACvC,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG;GACvB,KAAK,IAAI,QAAQ;GACjB,MAAM,KAAK,SAAS;EACtB;EAEA,IAAI,CAAC,iBAAiB;EAEtB,IAAI;GACF,MAAM,UAAU,GAAG,YAAY,WAAW,EAAE,eAAe,KAAK,CAAC;GACjE,KAAK,MAAM,SAAS,SAClB,IAAI,MAAM,eAAe,GACvB,IAAI;IACF,MAAM,WAAW,KAAK,KAAK,WAAW,MAAM,IAAI;IAChD,MAAM,WAAW,GAAG,aAAa,QAAQ;IACzC,IAAI,mBAAmB,CAAC,iBAAiB,UAAU,eAAe,GAAG;IAErE,IADa,GAAG,SAAS,QAClB,CAAC,CAAC,YAAY,GAAG;KACtB,MAAM,aAAa,KAAK,QAAQ,QAAQ;KACxC,IAAI,mBAAmB,CAAC,iBAAiB,YAAY,eAAe,GAAG;KACvE,IAAI,CAAC,KAAK,IAAI,UAAU,GAAG;MACzB,KAAK,IAAI,UAAU;MACnB,MAAM,KAAK,UAAU;KACvB;IACF;GACF,QAAQ;IACN;GACF;EAGN,QAAQ,CAER;CACF;CAEA,OAAO;AACT;AAGA,SAAgB,gBACd,aACA,WACA,UAAU,GAAG,QAAQ,GACrB,mBAA6B,CAAC,GACpB;CACV,MAAM,4BAA4B,KAAK,KAAK,aAAa,WAAW,QAAQ;CAC5E,MAAM,wBAAwB,KAAK,KAAK,aAAa,WAAW,QAAQ;CACxE,MAAM,uBAAuB,KAAK,KAAK,aAAa,WAAW,QAAQ;CACvE,MAAM,6BAA6B,KAAK,KAAK,SAAS,WAAW,QAAQ;CACzE,MAAM,yBAAyB,KAAK,KAAK,SAAS,WAAW,QAAQ;CACrE,MAAM,wBAAwB,KAAK,KAAK,SAAS,WAAW,QAAQ;CAEpE,MAAM,QAAQ;EACZ,GAAG,kBAAkB;GAAC;GAA2B;GAAuB;EAAoB,GAAG,WAAW;EAC1G,GAAG,kBAAkB;GAAC;GAA4B;GAAwB;EAAqB,CAAC;EAChG,GAAG,iBAAiB,SAAQ,oBAAmB,kBAAkB,CAAC,eAAe,GAAG,eAAe,CAAC;CACtG;CAEA,MAAM,4BAAY,IAAI,IAAY;CAClC,OAAO,MAAM,QAAO,cAAa;EAC/B,IAAI;EACJ,IAAI;GACF,WAAW,GAAG,aAAa,SAAS;EACtC,QAAQ;GACN,WAAW,KAAK,QAAQ,SAAS;EACnC;EACA,IAAI,UAAU,IAAI,QAAQ,GAAG,OAAO;EACpC,UAAU,IAAI,QAAQ;EACtB,OAAO;CACT,CAAC;AACH;;;;;;AAgBA,MAAM,wBAAkC;CAAC,GAAG,OAAO;CAAG;CAAQ,YAAY;AAAC,CAAC,CAAC,QAAkB,KAAK,MAAM;CACxG,MAAM,WAAW,KAAK,QAAQ,CAAC;CAC/B,IAAI,CAAC,IAAI,SAAS,QAAQ,GAAG,IAAI,KAAK,QAAQ;CAC9C,OAAO;AACT,GAAG,CAAC,CAAC;AAEL,MAAM,sBAAsB;;;;;AAM5B,SAAS,oBAAoB,aAAyC;CACpE,IAAI,WAAW,KAAK,aAAa,gBAAgB,CAAC,GAAG,OAAO;CAC5D,IAAI,WAAW,KAAK,aAAa,WAAW,CAAC,KAAK,WAAW,KAAK,aAAa,UAAU,CAAC,GAAG,OAAO;CACpG,IAAI,WAAW,KAAK,aAAa,WAAW,CAAC,GAAG,OAAO;CACvD,IAAI,WAAW,KAAK,aAAa,mBAAmB,CAAC,GAAG,OAAO;CAC/D,OAAO;AACT;AAEA,eAAsB,oBAAoB,EACxC,gBACA,QACA,gBACA,yBAAyB,SAMxB;CAED,MAAM,QADM,eAAe,IAAI,YACf,CAAC,EAAE,SAAS;CAE5B,MAAM,iBAAiB,OAAO;CAE9B,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,KAAK,QAAQ,cAAc;CAE/C,MAAM,oBAAoB,gBAAgB,aADxB,OAAO,aAAA,eACyC,OAAO,SAAS,OAAO,oBAAoB,CAAC,CAAC;CAC/G,MAAM,aAAa,CAAC,GAAI,gBAAgB,SAAS,CAAC,GAAI,GAAG,iBAAiB;CAC1E,MAAM,cAAc,iBAAiB,IAAI,eAAe,OAAO;CAC/D,MAAM,cAAc,GAAG,oBAAoB,GAAG,cAAc;CAC5D,MAAM,eAAe,OAAO,uBAAuB,CAAC;CACpD,MAAM,eAAe;EACnB,GAAG;EACH,GAAG;EACH,GAAG,aAAa,KAAK,MAAc,KAAK,QAAQ,CAAC,CAAC;CACpD;CAKA,MAAM,iBAAiB,+BAA+B,sBAAsB;CAG5E,IAAI;CACJ,IAAI;EACF,WAAW,QAAQ,iBAAiB,WAAW;CACjD,QAAQ,CAER;CAEA,IAAI,UAAU;EACZ,SAAS,WAAW,gBAAgB,YAAY;EAChD,SAAS,eAAe,cAAc;EACtC,OAAO;CACT;CAIA,MAAM,UAAU,kBAAkB,aAAa,CAAC,CAAC,GAAG;CACpD,IAAI,YAA+B;CACnC,IAAI,YAAY,OAAO;EACrB,MAAM,eAAe,KAAK,QAAQ,cAAc,OAAO,KAAK,GAAG,CAAC,GAAG,IAAI;EACvE,YAAY;GACV,gBAAgB;GAChB,GAAG;GACH,eAAe,QAAQ,iBAAiB,oBAAoB,WAAW;GACvE,aAAa,CAAC,cAAc,GAAI,QAAQ,eAAe,CAAC,CAAE;EAC5D;CACF;CAGA,MAAM,aAAa,IAAI,gBAAgB;EACrC,UAAU;EACV;CACF,CAAC;CACD,OAAO,IAAI,UAAU;EACnB,IAAI;EACJ,MAAM;EACN;EACA,SAAS,IAAI,aAAa;GACxB,SAAS;GACT,kBAAkB;GAClB,KAAK,gBAAgB;EACvB,CAAC;EACD,OAAO;EACP,QAAQ;EACR,GAAI,iBAAiB,EAAE,aAAa,eAAe,aAAa,YAAY,iBAAiB,EAAE,IAAI,CAAC;EACpG,KAAK;CACP,CAAC;AACH;;;;;;;;;AAUA,eAAsB,kBAAkB,EACtC,gBACA,UAIkC;CAClC,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,oBAAoB;GAAE;GAAgB;EAAO,CAAC;CAClE,QAAQ;EACN;CACF;CAEA,MAAM,WAAW,MAAM,qBAAqB,WAAW;EAAE;EAAgB;CAAU,CAAC;CACpF,MAAM,WAAuB,CAAC;CAC9B,KAAK,MAAM,QAAQ,2BACjB,IAAI,SAAS,OAAO,SAAS,QAAQ,SAAS;CAEhD,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,IAAI,WAAW,KAAA;AACvD"}
+{"version":3,"file":"workspace.js","names":[],"sources":["../../src/agents/workspace.ts"],"sourcesContent":["import fs, { existsSync } from 'node:fs';\nimport os from 'node:os';\nimport path, { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport type { ToolsInput } from '@mastra/core/agent';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { Workspace, LocalFilesystem, LocalSandbox, createWorkspaceTools } from '@mastra/core/workspace';\nimport type { LSPConfig, SkillSource } from '@mastra/core/workspace';\nimport { DEFAULT_CONFIG_DIR } from '../constants.js';\nimport { loadSettings, resolveLspSetting } from '../onboarding/settings.js';\nimport type { MastraCodeState } from '../schema.js';\nimport { isPathWithinRoot } from '../utils/path-security.js';\nimport { getPlansDir } from '../utils/plans.js';\n\nimport { createMastraCodeWorkspaceTools, GOAL_JUDGE_READONLY_TOOLS } from './tool-availability.js';\n\n// =============================================================================\n// Sandbox Environment\n// =============================================================================\n\nfunction buildSandboxEnv(): NodeJS.ProcessEnv {\n  return {\n    ...process.env,\n    // Explicit overrides for non-interactive subprocess execution\n    FORCE_COLOR: '1',\n    CLICOLOR_FORCE: '1',\n    TERM: process.env.TERM || 'xterm-256color',\n    CI: 'true',\n    NONINTERACTIVE: '1',\n    DEBIAN_FRONTEND: 'noninteractive',\n  };\n}\n\n// =============================================================================\n// Create Workspace with Skills\n// =============================================================================\n\n// We support multiple skill locations for compatibility:\n// 1. Project-local: <configDir>/skills (project-specific mastracode skills)\n// 2. Project-local: .claude/skills (Claude Code compatible skills)\n// 3. Project-local: .agents/skills (Agent Skills spec compatible)\n// 4. Global: ~/<configDir>/skills (user-wide mastracode skills)\n// 5. Global: ~/.claude/skills (user-wide Claude Code skills)\n// 6. Global: ~/.agents/skills (user-wide Agent Skills spec compatible)\n\n// Mastra's LocalSkillSource.readdir uses Node's Dirent.isDirectory() which\n// returns false for symlinks. Tools like `npx skills add` install skills as\n// symlinks, so we need to resolve them. For each symlinked skill directory,\n// we add the real (resolved) parent path as an additional skill scan path.\nfunction collectSkillPaths(skillsDirs: string[], allowedRoot?: string): string[] {\n  const paths: string[] = [];\n  const seen = new Set<string>();\n  let realAllowedRoot: string | undefined;\n\n  if (allowedRoot) {\n    try {\n      realAllowedRoot = fs.realpathSync(allowedRoot);\n    } catch {\n      return [];\n    }\n  }\n\n  for (const skillsDir of skillsDirs) {\n    const skillsDirExists = fs.existsSync(skillsDir);\n    if (skillsDirExists && realAllowedRoot) {\n      try {\n        const realSkillsDir = fs.realpathSync(skillsDir);\n        if (!isPathWithinRoot(realSkillsDir, realAllowedRoot)) continue;\n      } catch {\n        continue;\n      }\n    }\n\n    const resolved = path.resolve(skillsDir);\n    if (!seen.has(resolved)) {\n      seen.add(resolved);\n      paths.push(skillsDir);\n    }\n\n    if (!skillsDirExists) continue;\n\n    try {\n      const entries = fs.readdirSync(skillsDir, { withFileTypes: true });\n      for (const entry of entries) {\n        if (entry.isSymbolicLink()) {\n          try {\n            const linkPath = path.join(skillsDir, entry.name);\n            const realPath = fs.realpathSync(linkPath);\n            if (realAllowedRoot && !isPathWithinRoot(realPath, realAllowedRoot)) continue;\n            const stat = fs.statSync(realPath);\n            if (stat.isDirectory()) {\n              const realParent = path.dirname(realPath);\n              if (realAllowedRoot && !isPathWithinRoot(realParent, realAllowedRoot)) continue;\n              if (!seen.has(realParent)) {\n                seen.add(realParent);\n                paths.push(realParent);\n              }\n            }\n          } catch {\n            continue;\n          }\n        }\n      }\n    } catch {\n      // Ignore errors during symlink resolution\n    }\n  }\n\n  return paths;\n}\n\n// Build skill paths dynamically based on configDir and projectPath\nexport function buildSkillPaths(\n  projectPath: string,\n  configDir: string,\n  homeDir = os.homedir(),\n  pluginSkillPaths: string[] = [],\n): string[] {\n  const mastraCodeLocalSkillsPath = path.join(projectPath, configDir, 'skills');\n  const claudeLocalSkillsPath = path.join(projectPath, '.claude', 'skills');\n  const agentSkillsLocalPath = path.join(projectPath, '.agents', 'skills');\n  const mastraCodeGlobalSkillsPath = path.join(homeDir, configDir, 'skills');\n  const claudeGlobalSkillsPath = path.join(homeDir, '.claude', 'skills');\n  const agentSkillsGlobalPath = path.join(homeDir, '.agents', 'skills');\n\n  const paths = [\n    ...collectSkillPaths([mastraCodeLocalSkillsPath, claudeLocalSkillsPath, agentSkillsLocalPath], projectPath),\n    ...collectSkillPaths([mastraCodeGlobalSkillsPath, claudeGlobalSkillsPath, agentSkillsGlobalPath]),\n    ...pluginSkillPaths.flatMap(pluginSkillPath => collectSkillPaths([pluginSkillPath], pluginSkillPath)),\n  ];\n\n  const seenPaths = new Set<string>();\n  return paths.filter(skillPath => {\n    let resolved: string;\n    try {\n      resolved = fs.realpathSync(skillPath);\n    } catch {\n      resolved = path.resolve(skillPath);\n    }\n    if (seenPaths.has(resolved)) return false;\n    seenPaths.add(resolved);\n    return true;\n  });\n}\n\nexport interface WorkspaceSkillExtension {\n  /** Distinguishes extended workspaces from the default resolver cache. */\n  id: string;\n  /** Additional read-only skill roots prepended to normal project/global skill roots. */\n  paths: string[];\n  /** Compose the additional roots with the workspace's normal skill source. */\n  createSource: (fallback: SkillSource, fallbackSkillRoots: string[]) => SkillSource;\n}\n\n/**\n * Paths the agent is always allowed to access (in addition to the project root\n * and any per-thread sandboxAllowedPaths). The OS temp directory is included\n * so the agent can use it as a scratchpad without requesting access every time.\n */\nconst DEFAULT_ALLOWED_PATHS: string[] = [os.tmpdir(), '/tmp', getPlansDir()].reduce<string[]>((acc, p) => {\n  const resolved = path.resolve(p);\n  if (!acc.includes(resolved)) acc.push(resolved);\n  return acc;\n}, []);\n\nconst WORKSPACE_ID_PREFIX = 'mastra-code-workspace';\n\n/**\n * Detect the project's package runner from lock files.\n * Used as a fallback packageRunner for LSP when no binary is found locally or on PATH.\n */\nfunction detectPackageRunner(projectPath: string): string | undefined {\n  if (existsSync(join(projectPath, 'pnpm-lock.yaml'))) return 'pnpm dlx';\n  if (existsSync(join(projectPath, 'bun.lockb')) || existsSync(join(projectPath, 'bun.lock'))) return 'bunx';\n  if (existsSync(join(projectPath, 'yarn.lock'))) return 'yarn dlx';\n  if (existsSync(join(projectPath, 'package-lock.json'))) return 'npx --yes';\n  return 'npx --yes';\n}\n\nexport async function getDynamicWorkspace({\n  requestContext,\n  mastra,\n  skillExtension,\n  backgroundToolsEnabled = false,\n}: {\n  requestContext: RequestContext;\n  mastra?: Mastra;\n  skillExtension?: WorkspaceSkillExtension;\n  backgroundToolsEnabled?: boolean;\n}) {\n  const ctx = requestContext.get('controller') as AgentControllerRequestContext<MastraCodeState> | undefined;\n  const state = ctx?.getState();\n\n  const rawProjectPath = state?.projectPath;\n\n  if (!rawProjectPath) {\n    throw new Error('Project path is required');\n  }\n\n  const projectPath = path.resolve(rawProjectPath);\n  const configDir = state?.configDir ?? DEFAULT_CONFIG_DIR;\n  const projectSkillPaths = buildSkillPaths(projectPath, configDir, state?.homeDir, state?.pluginSkillPaths ?? []);\n  const skillPaths = [...(skillExtension?.paths ?? []), ...projectSkillPaths];\n  const extensionId = skillExtension ? `-${skillExtension.id}` : '';\n  const workspaceId = `${WORKSPACE_ID_PREFIX}-${projectPath}${extensionId}`;\n  const sandboxPaths = state?.sandboxAllowedPaths ?? [];\n  const allowedPaths = [\n    ...projectSkillPaths,\n    ...DEFAULT_ALLOWED_PATHS,\n    ...sandboxPaths.map((p: string) => path.resolve(p)),\n  ];\n\n  // All modes share the same workspace tool configuration.  Per-mode tool\n  // visibility is enforced at LLM-call time via `availableTools` /\n  // `activeTools` on the AgentController, not by mutating workspace capabilities.\n  const workspaceTools = createMastraCodeWorkspaceTools(backgroundToolsEnabled);\n\n  // Reuse existing workspace if already registered (preserves ProcessManager state)\n  let existing: Workspace<LocalFilesystem, LocalSandbox> | undefined;\n  try {\n    existing = mastra?.getWorkspaceById(workspaceId) as Workspace<LocalFilesystem, LocalSandbox>;\n  } catch {\n    // Not registered yet\n  }\n\n  if (existing) {\n    existing.filesystem.setAllowedPaths(allowedPaths);\n    existing.setToolsConfig(workspaceTools);\n    return existing;\n  }\n\n  // LSP is opt-in. When disabled we pass `false` so core skips the dependency\n  // check, the LSP manager, and the `lsp_inspect` tool entirely.\n  const userLsp = resolveLspSetting(loadSettings().lsp);\n  let lspConfig: LSPConfig | false = false;\n  if (userLsp !== false) {\n    const mcModulePath = join(dirname(fileURLToPath(import.meta.url)), '..');\n    lspConfig = {\n      maxOpenClients: 4,\n      ...userLsp,\n      packageRunner: userLsp.packageRunner || detectPackageRunner(projectPath), // Detected runner is the fallback — user's packageRunner always wins\n      searchPaths: [mcModulePath, ...(userLsp.searchPaths ?? [])],\n    };\n  }\n\n  // First call for this project — create the workspace\n  const filesystem = new LocalFilesystem({\n    basePath: projectPath,\n    allowedPaths,\n  });\n  return new Workspace({\n    id: workspaceId,\n    name: 'Mastra Code Workspace',\n    filesystem,\n    sandbox: new LocalSandbox({\n      timeout: 30_000,\n      workingDirectory: projectPath,\n      env: buildSandboxEnv(),\n    }),\n    tools: workspaceTools,\n    skills: skillPaths,\n    ...(skillExtension ? { skillSource: skillExtension.createSource(filesystem, projectSkillPaths) } : {}),\n    lsp: lspConfig,\n  });\n}\n\n/**\n * Resolver for the agent's `goal.tools` config. Builds the request's workspace\n * (same per-request resolution as the agent's own tools) and returns only the\n * read-only verification subset, remapped to mastracode's tool names (`view`,\n * `search_content`, etc.). Returns `undefined` when no workspace can be resolved\n * (e.g. no project path), keeping the default judge text-only rather than\n * throwing inside the goal step.\n */\nexport async function getGoalJudgeTools({\n  requestContext,\n  mastra,\n}: {\n  requestContext: RequestContext;\n  mastra?: Mastra;\n}): Promise<ToolsInput | undefined> {\n  let workspace: Workspace;\n  try {\n    workspace = await getDynamicWorkspace({ requestContext, mastra });\n  } catch {\n    return undefined;\n  }\n\n  const allTools = await createWorkspaceTools(workspace, { requestContext, workspace });\n  const readonly: ToolsInput = {};\n  for (const name of GOAL_JUDGE_READONLY_TOOLS) {\n    if (allTools[name]) readonly[name] = allTools[name];\n  }\n  return Object.keys(readonly).length > 0 ? readonly : undefined;\n}\n"],"mappings":";;;;;;;;;;;AAsBA,SAAS,kBAAqC;CAC5C,OAAO;EACL,GAAG,QAAQ;EAEX,aAAa;EACb,gBAAgB;EAChB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI;EACJ,gBAAgB;EAChB,iBAAiB;CACnB;AACF;AAkBA,SAAS,kBAAkB,YAAsB,aAAgC;CAC/E,MAAM,QAAkB,CAAC;CACzB,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI;CAEJ,IAAI,aACF,IAAI;EACF,kBAAkB,GAAG,aAAa,WAAW;CAC/C,QAAQ;EACN,OAAO,CAAC;CACV;CAGF,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,kBAAkB,GAAG,WAAW,SAAS;EAC/C,IAAI,mBAAmB,iBACrB,IAAI;GACF,MAAM,gBAAgB,GAAG,aAAa,SAAS;GAC/C,IAAI,CAAC,iBAAiB,eAAe,eAAe,GAAG;EACzD,QAAQ;GACN;EACF;EAGF,MAAM,WAAW,KAAK,QAAQ,SAAS;EACvC,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG;GACvB,KAAK,IAAI,QAAQ;GACjB,MAAM,KAAK,SAAS;EACtB;EAEA,IAAI,CAAC,iBAAiB;EAEtB,IAAI;GACF,MAAM,UAAU,GAAG,YAAY,WAAW,EAAE,eAAe,KAAK,CAAC;GACjE,KAAK,MAAM,SAAS,SAClB,IAAI,MAAM,eAAe,GACvB,IAAI;IACF,MAAM,WAAW,KAAK,KAAK,WAAW,MAAM,IAAI;IAChD,MAAM,WAAW,GAAG,aAAa,QAAQ;IACzC,IAAI,mBAAmB,CAAC,iBAAiB,UAAU,eAAe,GAAG;IAErE,IADa,GAAG,SAAS,QAClB,CAAC,CAAC,YAAY,GAAG;KACtB,MAAM,aAAa,KAAK,QAAQ,QAAQ;KACxC,IAAI,mBAAmB,CAAC,iBAAiB,YAAY,eAAe,GAAG;KACvE,IAAI,CAAC,KAAK,IAAI,UAAU,GAAG;MACzB,KAAK,IAAI,UAAU;MACnB,MAAM,KAAK,UAAU;KACvB;IACF;GACF,QAAQ;IACN;GACF;EAGN,QAAQ,CAER;CACF;CAEA,OAAO;AACT;AAGA,SAAgB,gBACd,aACA,WACA,UAAU,GAAG,QAAQ,GACrB,mBAA6B,CAAC,GACpB;CACV,MAAM,4BAA4B,KAAK,KAAK,aAAa,WAAW,QAAQ;CAC5E,MAAM,wBAAwB,KAAK,KAAK,aAAa,WAAW,QAAQ;CACxE,MAAM,uBAAuB,KAAK,KAAK,aAAa,WAAW,QAAQ;CACvE,MAAM,6BAA6B,KAAK,KAAK,SAAS,WAAW,QAAQ;CACzE,MAAM,yBAAyB,KAAK,KAAK,SAAS,WAAW,QAAQ;CACrE,MAAM,wBAAwB,KAAK,KAAK,SAAS,WAAW,QAAQ;CAEpE,MAAM,QAAQ;EACZ,GAAG,kBAAkB;GAAC;GAA2B;GAAuB;EAAoB,GAAG,WAAW;EAC1G,GAAG,kBAAkB;GAAC;GAA4B;GAAwB;EAAqB,CAAC;EAChG,GAAG,iBAAiB,SAAQ,oBAAmB,kBAAkB,CAAC,eAAe,GAAG,eAAe,CAAC;CACtG;CAEA,MAAM,4BAAY,IAAI,IAAY;CAClC,OAAO,MAAM,QAAO,cAAa;EAC/B,IAAI;EACJ,IAAI;GACF,WAAW,GAAG,aAAa,SAAS;EACtC,QAAQ;GACN,WAAW,KAAK,QAAQ,SAAS;EACnC;EACA,IAAI,UAAU,IAAI,QAAQ,GAAG,OAAO;EACpC,UAAU,IAAI,QAAQ;EACtB,OAAO;CACT,CAAC;AACH;;;;;;AAgBA,MAAM,wBAAkC;CAAC,GAAG,OAAO;CAAG;CAAQ,YAAY;AAAC,CAAC,CAAC,QAAkB,KAAK,MAAM;CACxG,MAAM,WAAW,KAAK,QAAQ,CAAC;CAC/B,IAAI,CAAC,IAAI,SAAS,QAAQ,GAAG,IAAI,KAAK,QAAQ;CAC9C,OAAO;AACT,GAAG,CAAC,CAAC;AAEL,MAAM,sBAAsB;;;;;AAM5B,SAAS,oBAAoB,aAAyC;CACpE,IAAI,WAAW,KAAK,aAAa,gBAAgB,CAAC,GAAG,OAAO;CAC5D,IAAI,WAAW,KAAK,aAAa,WAAW,CAAC,KAAK,WAAW,KAAK,aAAa,UAAU,CAAC,GAAG,OAAO;CACpG,IAAI,WAAW,KAAK,aAAa,WAAW,CAAC,GAAG,OAAO;CACvD,IAAI,WAAW,KAAK,aAAa,mBAAmB,CAAC,GAAG,OAAO;CAC/D,OAAO;AACT;AAEA,eAAsB,oBAAoB,EACxC,gBACA,QACA,gBACA,yBAAyB,SAMxB;CAED,MAAM,QADM,eAAe,IAAI,YACf,CAAC,EAAE,SAAS;CAE5B,MAAM,iBAAiB,OAAO;CAE9B,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,KAAK,QAAQ,cAAc;CAE/C,MAAM,oBAAoB,gBAAgB,aADxB,OAAO,aAAA,eACyC,OAAO,SAAS,OAAO,oBAAoB,CAAC,CAAC;CAC/G,MAAM,aAAa,CAAC,GAAI,gBAAgB,SAAS,CAAC,GAAI,GAAG,iBAAiB;CAC1E,MAAM,cAAc,iBAAiB,IAAI,eAAe,OAAO;CAC/D,MAAM,cAAc,GAAG,oBAAoB,GAAG,cAAc;CAC5D,MAAM,eAAe,OAAO,uBAAuB,CAAC;CACpD,MAAM,eAAe;EACnB,GAAG;EACH,GAAG;EACH,GAAG,aAAa,KAAK,MAAc,KAAK,QAAQ,CAAC,CAAC;CACpD;CAKA,MAAM,iBAAiB,+BAA+B,sBAAsB;CAG5E,IAAI;CACJ,IAAI;EACF,WAAW,QAAQ,iBAAiB,WAAW;CACjD,QAAQ,CAER;CAEA,IAAI,UAAU;EACZ,SAAS,WAAW,gBAAgB,YAAY;EAChD,SAAS,eAAe,cAAc;EACtC,OAAO;CACT;CAIA,MAAM,UAAU,kBAAkB,aAAa,CAAC,CAAC,GAAG;CACpD,IAAI,YAA+B;CACnC,IAAI,YAAY,OAAO;EACrB,MAAM,eAAe,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI;EACvE,YAAY;GACV,gBAAgB;GAChB,GAAG;GACH,eAAe,QAAQ,iBAAiB,oBAAoB,WAAW;GACvE,aAAa,CAAC,cAAc,GAAI,QAAQ,eAAe,CAAC,CAAE;EAC5D;CACF;CAGA,MAAM,aAAa,IAAI,gBAAgB;EACrC,UAAU;EACV;CACF,CAAC;CACD,OAAO,IAAI,UAAU;EACnB,IAAI;EACJ,MAAM;EACN;EACA,SAAS,IAAI,aAAa;GACxB,SAAS;GACT,kBAAkB;GAClB,KAAK,gBAAgB;EACvB,CAAC;EACD,OAAO;EACP,QAAQ;EACR,GAAI,iBAAiB,EAAE,aAAa,eAAe,aAAa,YAAY,iBAAiB,EAAE,IAAI,CAAC;EACpG,KAAK;CACP,CAAC;AACH;;;;;;;;;AAUA,eAAsB,kBAAkB,EACtC,gBACA,UAIkC;CAClC,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,oBAAoB;GAAE;GAAgB;EAAO,CAAC;CAClE,QAAQ;EACN;CACF;CAEA,MAAM,WAAW,MAAM,qBAAqB,WAAW;EAAE;EAAgB;CAAU,CAAC;CACpF,MAAM,WAAuB,CAAC;CAC9B,KAAK,MAAM,QAAQ,2BACjB,IAAI,SAAS,OAAO,SAAS,QAAQ,SAAS;CAEhD,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,IAAI,WAAW,KAAA;AACvD"}

package/dist/auth/account-rotation-processor.js

@@ -486,7 +486,8 @@ var AccountRotationProcessor = class {
 		const cascade = await this.getModelRouteCascade(args);
 		if (!cascade) return;
 		if (cascade.position >= cascade.entries.length - 1) return;
-		throw new TripWire(error instanceof Error ? error.message : String(error), {}, this.id);
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new TripWire(reason, {}, this.id);
 	}
 	/** Announce and persist the next model-route hop before core advances. */
 	async emitModelFallbackPart(args, reason) {

package/dist/auth/account-rotation-processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-rotation-processor.js","names":[],"sources":["../../src/auth/account-rotation-processor.ts"],"sourcesContent":["/**\n * Error-driven rotation across a provider's OAuth account registry.\n *\n * When the active account cannot serve a request (rate limit, quota\n * exhaustion, dead token, persistent outage), the next account in insertion\n * order is selected for the request and the request retried. OAuth fetch\n * wrappers read that request-scoped selection on every HTTP attempt, so\n * concurrent runs can't swap each other's credentials. Every switch is\n * persisted as a non-transient `data-mastracode-account-switch` part so it\n * shows in the transcript and survives history reload.\n *\n * Two classes, two lanes — the split is load-bearing. The processor runner\n * walks `[...inputProcessors, ...outputProcessors, ...errorProcessors]` when\n * running `processAPIError`, so a processor registered in the input lane that\n * also implemented `processAPIError` would run BEFORE\n * `StreamErrorRetryProcessor` and hop on 5xx errors before transient retries\n * had a chance. `AccountRotationProcessor` therefore implements\n * `processAPIError` only and is registered in `errorProcessors` after\n * `StreamErrorRetryProcessor`; `AccountStartNoticeProcessor` implements\n * `processInput` only and is registered in `inputProcessors`.\n */\nimport { TripWire } from '@mastra/core/agent';\nimport type { ProcessAPIErrorArgs, ProcessInputArgs, ProcessInputResult, Processor } from '@mastra/core/processors';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { resolveCredentialStore } from '../agents/credential-resolver.js';\nimport { resolveModel, resolveRequestThinkingLevel } from '../agents/model.js';\nimport { getCredentialProviderId, normalizeLegacyModelId } from '../providers/model-ids.js';\nimport { isThinkingLevelSetting } from '../thinking.js';\nimport type { ThinkingLevelSetting } from '../thinking.js';\nimport {\n  getRequestAccountSelection,\n  isRequestAccountRoutingExhausted,\n  markRequestAccountRoutingExhausted,\n  setRequestAccountSelection,\n} from './account-routing-context.js';\nimport { ProviderAuthRequiredError, PROVIDER_AUTH_REQUIRED_ERROR } from './provider-auth-error.js';\nimport { getOAuthProviders } from './storage.js';\nimport type { CredentialStore, OAuthAccountRecord } from './types.js';\n\nexport const ACCOUNT_SWITCH_PART_TYPE = 'data-mastracode-account-switch';\n\n/** Labels and instance ids only — never token material (do-not list). */\nexport interface AccountSwitchPartData {\n  provider: string;\n  from: { id: string; label: string } | null;\n  to: { id: string; label: string } | null;\n  reason:\n    | 'rate-limit'\n    | 'quota-exhausted'\n    | 'auth-failed'\n    | 'pool-exhausted'\n    | 'persistent-outage'\n    | 'preferred-routing';\n  at: string;\n  /**\n   * Set on a `to: null` part when a route pinned to a single account reported\n   * that account unusable. The provider's other subscriptions were never\n   * consulted (A12), so \"all accounts unavailable\" would misreport what\n   * happened.\n   */\n  exclusive?: boolean;\n}\n\n/** The store surface rotation needs; `AuthStorage` satisfies it structurally. */\nexport type RotationCredentialStore = CredentialStore & {\n  /**\n   * Force one refresh of the active account's tokens regardless of expiry\n   * (401/403 path — a rejected-but-unexpired token usually means clock skew\n   * or a refresh race). `AuthStorage` provides it; deployed per-tenant stores\n   * don't, and the auth path degrades to plain rotation (which itself no-ops\n   * without registry methods).\n   */\n  forceRefreshActiveAccount?(providerId: string, accountInstanceId?: string): Promise<string | undefined>;\n};\n\n/** Rotatable providers = the OAuth provider registry; API-key-only providers never rotate. */\nconst KNOWN_PROVIDER_IDS = new Set(getOAuthProviders().map(provider => provider.id));\n\n/** Hostname suffixes → provider ids, for `APICallError.url`. */\nconst PROVIDER_HOST_PATTERNS: Array<[RegExp, string]> = [\n  [/(^|\\.)api\\.anthropic\\.com$/i, 'anthropic'],\n  [/(^|\\.)api\\.kimi\\.com$/i, 'kimi-for-coding'],\n  [/(^|\\.)api\\.x\\.ai$/i, 'xai'],\n  [/(^|\\.)chatgpt\\.com$/i, 'openai-codex'],\n  [/(^|\\.)backend-api\\.codex\\.ai$/i, 'openai-codex'],\n  [/(^|\\.)githubcopilot\\.com$/i, 'github-copilot'],\n  [/(^|\\.)api\\.github\\.com$/i, 'github-copilot'],\n];\n\n/**\n * Provider usage/quota-limit wording (locked Q7 bucket 1). Statuses 429/402\n * are matched before this; some providers deliver quota errors as plain 400s,\n * which only the message reveals. Deliberately restricted to unambiguous\n * quota phrases — a generic \"exceeded your … limit\" can appear on non-quota\n * client errors (request size, context length) that must never rotate.\n */\nconst USAGE_LIMIT_MESSAGE_PATTERN =\n  /usage (?:limit|cap)|insufficient[_ ]quota|quota (?:exceeded|exhausted|reached)|exceeded (?:your )?current quota|insufficient (?:balance|credits?)|credits? exhausted|rate limit (?:exceeded|reached)|weekly limit|monthly limit/i;\n\nconst NETWORK_ERROR_CODES = new Set([\n  'ECONNRESET',\n  'EPIPE',\n  'ECONNREFUSED',\n  'ENOTFOUND',\n  'ETIMEDOUT',\n  'EAI_AGAIN',\n  'UND_ERR_CONNECT_TIMEOUT',\n  'UND_ERR_SOCKET',\n]);\n\nconst NETWORK_MESSAGE_PATTERN =\n  /fetch failed|network error|socket hang up|getaddrinfo|econnrefused|enotfound|etimedout|connection (?:refused|reset|closed|timed out)|other side closed|write epipe/i;\n\nconst MAX_CAUSE_DEPTH = 4;\n\n/** Persisted data-part type for a model-route hop. */\nexport const MODEL_FALLBACK_PART_TYPE = 'data-mastracode-model-fallback' as const;\n\n/** Non-secret transcript payload for a model-route hop. */\nexport interface ModelFallbackPartData {\n  from: { entryId: string; label: string };\n  to: { entryId: string; label: string };\n  reason: 'pool-exhausted' | 'persistent-outage';\n  at: string;\n}\n\n/** Session-state key set when account rotation advances the model route. */\nexport const MODEL_FALLBACK_STATE_KEY = 'mastracodePendingModelFallback' as const;\n\n/** Payload written to session state under MODEL_FALLBACK_STATE_KEY. */\nexport interface PendingModelFallback {\n  fromEntryId: string;\n  toEntryId: string;\n  toModelId: string;\n  threadId?: string;\n  reason: 'pool-exhausted' | 'persistent-outage';\n  at: string;\n}\n\nexport type RotationClassification =\n  | { kind: 'rotate'; reason: 'rate-limit' | 'quota-exhausted' | 'auth-failed' }\n  | { kind: 'hop' }\n  | { kind: 'never' };\n\nfunction isErrorWithCode(error: unknown): error is { code?: unknown } {\n  return typeof error === 'object' && error !== null && 'code' in error;\n}\n\nfunction readErrorStatus(error: unknown): number | undefined {\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (typeof current !== 'object') break;\n    const { statusCode, status } = current as { statusCode?: unknown; status?: unknown };\n    if (typeof statusCode === 'number') return statusCode;\n    if (typeof status === 'number') return status;\n    current = (current as { cause?: unknown }).cause;\n  }\n  return undefined;\n}\n\nfunction isProviderAuthRequiredError(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (\n      current instanceof ProviderAuthRequiredError ||\n      (current instanceof Error && current.name === PROVIDER_AUTH_REQUIRED_ERROR)\n    ) {\n      return true;\n    }\n    if (typeof current !== 'object') break;\n    current = (current as { cause?: unknown }).cause;\n  }\n  return false;\n}\n\n/** Concatenate the error's message with its cause chain (bounded). */\nfunction collectErrorText(error: unknown): string {\n  const parts: string[] = [];\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (current instanceof Error) {\n      parts.push(current.message);\n      current = current.cause;\n    } else if (typeof current === 'object' && 'message' in current) {\n      const message = (current as { message?: unknown }).message;\n      if (typeof message === 'string') parts.push(message);\n      current = (current as { cause?: unknown }).cause;\n    } else {\n      break;\n    }\n  }\n  return parts.join(' | ');\n}\n\nfunction isNetworkErrorLike(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (\n      isErrorWithCode(current) &&\n      typeof current.code === 'string' &&\n      NETWORK_ERROR_CODES.has(current.code.toUpperCase())\n    ) {\n      return true;\n    }\n    if (current instanceof Error) {\n      if (NETWORK_MESSAGE_PATTERN.test(current.message)) return true;\n      current = current.cause;\n    } else if (typeof current === 'object') {\n      current = (current as { cause?: unknown }).cause;\n    } else {\n      break;\n    }\n  }\n  return false;\n}\n\n/**\n * The locked Q7 taxonomy. 429/402/usage-limit rotate immediately (429 is not\n * covered by any transient matcher, so it arrives here on first occurrence);\n * 401/403 and `ProviderAuthRequiredError` rotate after one forced refresh;\n * 5xx/network hop only when the transient retry budget is already spent (they\n * reach this processor because `StreamErrorRetryProcessor` declined); 400 and\n * everything unknown never touch the registry.\n */\nexport function classifyRotationError(error: unknown): RotationClassification {\n  if (isProviderAuthRequiredError(error)) {\n    return { kind: 'rotate', reason: 'auth-failed' };\n  }\n\n  const status = readErrorStatus(error);\n\n  if (status === 429) return { kind: 'rotate', reason: 'rate-limit' };\n  if (status === 402) return { kind: 'rotate', reason: 'quota-exhausted' };\n  if (status === 401 || status === 403) return { kind: 'rotate', reason: 'auth-failed' };\n  if (status !== undefined && status >= 500 && status < 600) return { kind: 'hop' };\n\n  // Quota wording only rotates when it co-occurs with a statusless or 400\n  // error — the shapes providers actually use for message-only quota\n  // failures. Any other status keeps its own classification above (401/403\n  // auth, 5xx outage hop, 404/422 never), so limit-ish text riding a\n  // non-quota client error can no longer burn the whole pool.\n  if (status === undefined || status === 400) {\n    if (USAGE_LIMIT_MESSAGE_PATTERN.test(collectErrorText(error))) {\n      return { kind: 'rotate', reason: 'quota-exhausted' };\n    }\n  }\n  if (isNetworkErrorLike(error)) return { kind: 'hop' };\n\n  return { kind: 'never' };\n}\n\n/** Provider id off a router model id: `mastracode/<provider>/<model>` or `<provider>/<model>`. */\nexport function providerFromModelId(modelId: string): string | undefined {\n  const segments = normalizeLegacyModelId(modelId)\n    .replace(/^mastracode\\//, '')\n    .split('/');\n  const providerId = segments[0] ? getCredentialProviderId(segments[0]) : undefined;\n  return providerId && KNOWN_PROVIDER_IDS.has(providerId) ? providerId : undefined;\n}\n\nfunction providerFromHost(hostname: string): string | undefined {\n  for (const [pattern, providerId] of PROVIDER_HOST_PATTERNS) {\n    if (pattern.test(hostname)) return providerId;\n  }\n  return undefined;\n}\n\n/**\n * Identify the provider an error came from: the request URL's hostname\n * (`APICallError.url`, cause chain included), falling back to the router\n * model id. Unknown → undefined (caller treats as never-rotate).\n */\nexport function providerFromError(error: unknown): string | undefined {\n  const causeChain: object[] = [];\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (typeof current !== 'object') break;\n    causeChain.push(current);\n    current = (current as { cause?: unknown }).cause;\n  }\n\n  // A request URL identifies the provider that actually handled the failed\n  // call. Check every supported URL field throughout the cause chain before\n  // falling back to router model metadata, which may describe the original\n  // session model rather than the active cascade entry.\n  for (const item of causeChain) {\n    const urls = [\n      (item as { url?: unknown }).url,\n      (item as { requestURL?: unknown }).requestURL,\n      (item as { requestUrl?: unknown }).requestUrl,\n    ];\n    for (const url of urls) {\n      if (typeof url !== 'string') continue;\n      try {\n        const providerId = providerFromHost(new URL(url).hostname);\n        if (providerId) return providerId;\n      } catch {\n        // Not a parseable URL — try the other fields and causes.\n      }\n    }\n  }\n\n  for (const item of causeChain) {\n    const modelId = (item as { modelId?: unknown }).modelId;\n    if (typeof modelId !== 'string') continue;\n    const providerId = providerFromModelId(modelId);\n    if (providerId) return providerId;\n  }\n  return undefined;\n}\n\nfunction getTriedInstances(state: Record<string, unknown>): Set<string> {\n  const existing = state.triedInstances;\n  if (existing instanceof Set) return existing;\n  const created = new Set<string>();\n  state.triedInstances = created;\n  return created;\n}\n\nfunction getForcedRefreshInstances(state: Record<string, unknown>): Set<string> {\n  const existing = state.forcedAuthRefresh;\n  if (existing instanceof Set) return existing;\n  const created = new Set<string>();\n  state.forcedAuthRefresh = created;\n  return created;\n}\n\n/** Friendly names for the part/notice copy (display only — never auth data). */\nexport const PROVIDER_DISPLAY_NAMES: Record<string, string> = {\n  anthropic: 'Anthropic',\n  'kimi-for-coding': 'Kimi',\n  'openai-codex': 'Codex',\n  'github-copilot': 'GitHub Copilot',\n  xai: 'xAI',\n};\n\nconst REASON_TEXT: Record<AccountSwitchPartData['reason'], string> = {\n  'rate-limit': 'rate limit',\n  'quota-exhausted': 'quota exhausted',\n  'auth-failed': 'auth failed',\n  'pool-exhausted': 'pool exhausted',\n  'persistent-outage': 'persistent outage',\n  'preferred-routing': 'subscription routing',\n};\n\n/** Validates untrusted `reason` values (e.g. persisted message parts). */\nexport function isAccountSwitchReason(value: unknown): value is AccountSwitchPartData['reason'] {\n  // Own-property check: `in` would accept prototype names like 'toString',\n  // which would then interpolate the inherited function into the notice text.\n  return typeof value === 'string' && Object.prototype.hasOwnProperty.call(REASON_TEXT, value);\n}\n\n/**\n * One-line transcript copy for a switch part. Shared by the live `info`\n * controller event (the TUI shows controller `info` events as transcript\n * lines, and no message event carries data parts mid-run) and by the TUI's\n * history rendering of the persisted part — one formatter, identical text.\n */\nexport function accountSwitchNoticeText(data: AccountSwitchPartData): string {\n  const provider = PROVIDER_DISPLAY_NAMES[data.provider] ?? data.provider;\n  const reason = REASON_TEXT[data.reason];\n  if (data.to === null) {\n    // A12: a targeted route reports *its* account, not the pool — the other\n    // subscriptions were never tried, so \"all accounts unavailable\" would be\n    // wrong and would read as if the pool had been walked.\n    if (data.exclusive) {\n      return `Pinned ${provider} account unavailable (${reason})`;\n    }\n    return `All ${provider} accounts unavailable (${reason})`;\n  }\n  const from = data.from?.label ?? 'unknown';\n  return `Switched ${provider} account: ${from} → ${data.to.label} (${reason})`;\n}\n\n/** Transcript line for a model-route hop; shared by the live info event and the TUI's history render. */\nexport function modelFallbackNoticeText(data: ModelFallbackPartData): string {\n  const reason = REASON_TEXT[data.reason] ?? data.reason;\n  return `Switched model route: ${data.from.label} → ${data.to.label} (${reason})`;\n}\n\n/**\n * Whether a persisted model-fallback reason is one this build understands.\n * `REASON_TEXT` also covers the account-switch reasons, so the notice text\n * alone would happily render a foreign value such as `rate-limit` as a\n * model-fallback reason; history parsed from another build's part must be\n * rejected instead.\n */\nexport function isModelFallbackReason(value: unknown): value is ModelFallbackPartData['reason'] {\n  return value === 'pool-exhausted' || value === 'persistent-outage';\n}\n\nasync function emitAccountSwitchPart(\n  args: Pick<ProcessAPIErrorArgs, 'writer' | 'requestContext'> | Pick<ProcessInputArgs, 'writer' | 'requestContext'>,\n  data: AccountSwitchPartData,\n): Promise<void> {\n  // Non-transient on purpose (contrast the transient tool-progress parts):\n  // switches must persist into the assistant message and render from history.\n  await args.writer?.custom({\n    type: ACCOUNT_SWITCH_PART_TYPE,\n    data,\n  });\n  // Data parts surface in the TUI only on history reload; emit the same line\n  // as a controller `info` event so the switch is visible live (precedent:\n  // emitTransientRetry emits controller events from the retry matcher).\n  const controllerContext = args.requestContext?.get('controller') as\n    | { emitEvent?: (event: { type: 'info'; message: string }) => void }\n    | undefined;\n  controllerContext?.emitEvent?.({ type: 'info', message: accountSwitchNoticeText(data) });\n}\n\n/**\n * Provider of the model the controller session is currently running — the\n * fallback identification path for errors that carry neither a request URL\n * nor a model id (e.g. `ProviderAuthRequiredError` thrown by a fetch wrapper\n * before any HTTP request exists).\n */\nfunction providerFromSession(\n  args: Pick<ProcessAPIErrorArgs, 'requestContext'> | Pick<ProcessInputArgs, 'requestContext'>,\n): string | undefined {\n  const controller = args.requestContext?.get('controller') as { session?: { modelId?: unknown } } | undefined;\n  const modelId = controller?.session?.modelId;\n  return typeof modelId === 'string' ? providerFromModelId(modelId) : undefined;\n}\n\n/**\n * Rotates the active OAuth account on classified API errors.\n *\n * Registered in `errorProcessors` AFTER `StreamErrorRetryProcessor` — a\n * transient error reaching this processor means the transient budget is\n * spent, which is exactly the hop condition. Implements `processAPIError`\n * ONLY (see the file header for the runner-order rationale).\n */\n/** Cached per-request model route cascade. */\ninterface ModelRouteCascade {\n  entries: Array<{ id: string; label: string; modelId: string; accountId?: string }>;\n  position: number;\n}\n\ninterface AccountRoute {\n  entryId: string;\n  modelId: string;\n  providerId: string;\n  accountId?: string;\n}\n\ntype RoutingProcessorArgs = Pick<ProcessAPIErrorArgs, 'requestContext' | 'state' | 'writer'> | ProcessInputArgs;\n\nexport type RoutingControllerContext = {\n  session?: { modelId?: unknown; modeId?: unknown };\n  threadId?: unknown;\n  getState?: () => Record<string, unknown>;\n  setState?: (updates: Record<string, unknown>) => Promise<void>;\n  getThreadSetting?: (key: string) => Promise<unknown>;\n  setThreadSetting?: (setting: { key: string; value: unknown }) => Promise<void>;\n  isThreadActive?: () => boolean;\n};\n\nfunction getRoutingController(\n  args: Pick<RoutingProcessorArgs, 'requestContext'>,\n): RoutingControllerContext | undefined {\n  return args.requestContext?.get('controller') as RoutingControllerContext | undefined;\n}\n\n/** A targeted route is exclusive; an entry without accountId uses automatic pool rotation. */\nfunction getRouteTargetAccountId(route: AccountRoute | null): string | undefined {\n  return route?.accountId;\n}\n\nfunction getRequestActiveAccount(\n  args: Pick<RoutingProcessorArgs, 'requestContext'>,\n  store: CredentialStore,\n  providerId: string,\n) {\n  if (isRequestAccountRoutingExhausted(args.requestContext, providerId)) return undefined;\n  const selectedId = getRequestAccountSelection(args.requestContext, providerId);\n  if (selectedId) return store.listAccounts?.(providerId).find(account => account.id === selectedId);\n  return store.getActiveAccount?.(providerId) ?? store.listAccounts?.(providerId).find(account => account.active);\n}\n\nfunction resolveAccountRoute(\n  args: Pick<RoutingProcessorArgs, 'requestContext'>,\n  explicit?: { id: string; modelId: string; accountId?: string },\n): AccountRoute | null {\n  const controller = getRoutingController(args);\n  const state = controller?.getState?.();\n  const pending = state?.mastracodePendingModelFallback as\n    | { toEntryId?: unknown; toModelId?: unknown; threadId?: unknown }\n    | null\n    | undefined;\n  const pendingMatchesThread =\n    pending &&\n    typeof pending.toEntryId === 'string' &&\n    typeof pending.toModelId === 'string' &&\n    (pending.threadId === undefined || pending.threadId === controller?.threadId);\n  const routeEntries = Array.isArray((state?.modelRoute as { entries?: unknown } | undefined)?.entries)\n    ? ((state?.modelRoute as { entries: Array<{ id?: unknown; modelId?: unknown; accountId?: unknown }> }).entries ??\n      [])\n    : [];\n  const entry = explicit\n    ? explicit\n    : pendingMatchesThread\n      ? routeEntries.find(candidate => candidate.id === pending.toEntryId && candidate.modelId === pending.toModelId)\n      : routeEntries.find(candidate => candidate.modelId === controller?.session?.modelId);\n  if (!entry || typeof entry.id !== 'string' || typeof entry.modelId !== 'string') return null;\n  const providerId = providerFromModelId(entry.modelId);\n  if (!providerId) return null;\n  return {\n    entryId: entry.id,\n    modelId: entry.modelId,\n    providerId,\n    ...(typeof entry.accountId === 'string' ? { accountId: entry.accountId } : {}),\n  };\n}\n\n/**\n * A14: `Automatic` rotation starts *at* the persisted active account and walks\n * insertion order from there, wrapping once. The active account is the cursor\n * rotation last left at, so a turn that starts at index 0 regardless would\n * re-activate and re-try an account the previous turn already moved past —\n * which is the whole job the removed sticky-exclusion set was doing badly.\n * With no persisted active account the order is plain insertion order.\n */\nfunction orderAccountsFromActive(accounts: OAuthAccountRecord[], activeId: string | undefined) {\n  const index = activeId === undefined ? -1 : accounts.findIndex(account => account.id === activeId);\n  if (index <= 0) return accounts;\n  return [...accounts.slice(index), ...accounts.slice(0, index)];\n}\n\nasync function applyPreferredAccountRoute(\n  args: RoutingProcessorArgs,\n  store: CredentialStore,\n  route: AccountRoute,\n): Promise<boolean> {\n  store.reload();\n  const preferredId = getRouteTargetAccountId(route);\n  const accounts = store.listAccounts?.(route.providerId) ?? [];\n  if (accounts.length === 0 && preferredId === undefined) return false;\n  const tried = getTriedInstances(args.state);\n  const unavailable = new Set(accounts.filter(account => tried.has(account.id)).map(account => account.id));\n  const active = getRequestActiveAccount(args, store, route.providerId) ?? store.getActiveAccount?.(route.providerId);\n  const selected = // A12: a targeted route may use only the account it names. `Automatic`\n    // keeps insertion order with full pool rotation (A10), starting from the\n    // account the cursor already points at (A14).\n    (\n      preferredId\n        ? accounts.filter(account => account.id === preferredId)\n        : orderAccountsFromActive(accounts, active?.id)\n    ).find(account => !unavailable.has(account.id));\n\n  for (const accountId of unavailable) tried.add(accountId);\n  if (!selected) {\n    markRequestAccountRoutingExhausted(args.requestContext, route.providerId);\n    return false;\n  }\n\n  if (active?.id === selected.id) {\n    setRequestAccountSelection(args.requestContext, route.providerId, selected.id);\n    return false;\n  }\n  // Activate before recording the request-scoped selection: a failed\n  // activation must not leave the selection claiming an account that never\n  // became the provider's active credential.\n  const activated = store.activateAccount ? store.activateAccount(route.providerId, selected.id) : selected;\n  if (!activated) {\n    // Only a targeted route is out of options here. The exhausted marker is\n    // request-wide and fails every credential read closed, so setting it for\n    // `Automatic` would stop error recovery from retrying on a survivor.\n    if (preferredId !== undefined) markRequestAccountRoutingExhausted(args.requestContext, route.providerId);\n    return false;\n  }\n  setRequestAccountSelection(args.requestContext, route.providerId, activated.id);\n\n  // Applying an explicit account choice is routine, not a failover notice.\n  if (preferredId === undefined) {\n    await emitAccountSwitchPart(args, {\n      provider: route.providerId,\n      from: active ? { id: active.id, label: active.label } : null,\n      to: { id: activated.id, label: activated.label },\n      reason: 'preferred-routing',\n      at: new Date().toISOString(),\n    });\n  }\n  return true;\n}\n\nexport class AccountRotationProcessor implements Processor {\n  readonly id = 'mastracode-account-rotation' as const;\n\n  constructor(\n    private readonly options: {\n      credentialStore: RotationCredentialStore;\n      maxProcessorRetries: number;\n      settingsPath?: string;\n      /** The host has no modes, so per-mode thinking defaults never apply. */\n      modeless?: boolean;\n      /** Same host thinking default `getDynamicModel` uses, so a hop resolves at the same level. */\n      resolveDefaultThinkingLevel?: (ctx: {\n        requestContext: RequestContext;\n      }) => ThinkingLevelSetting | Promise<ThinkingLevelSetting>;\n    },\n  ) {}\n\n  async processAPIError(args: ProcessAPIErrorArgs): Promise<{ retry: boolean }> {\n    const { error, state } = args;\n\n    // Core runs error processors even after the shared retry budget is spent\n    // and silently discards `retry: true` then (llm-execution-step.ts\n    // canRetryError) — rotating the cursor or emitting a switch part for a\n    // retry that will never run would lie to both auth.json and the\n    // transcript. With a fallback chain configured, a bare `retry: false`\n    // here would silently advance the route for an error we never classified, so the\n    // chain gate surfaces the error instead.\n    if (args.retryCount >= this.options.maxProcessorRetries) {\n      await this.gateChainHop(args, error);\n      return { retry: false };\n    }\n\n    // Classify before attributing: an error from a provider outside the OAuth\n    // registry (API-key/router providers are valid route entries) still hops on\n    // rotate/hop classes — there is just no account cursor to advance.\n    const classification = classifyRotationError(error);\n    // Q14: 400/unknown errors never rotate and never advance routes. With a chain\n    // active, core's fallback array would still advance on a bare\n    // `retry: false` (it advances on any thrown non-TripWire error), so the\n    // gate converts that into a surfaced error instead of a silent hop.\n    if (classification.kind === 'never') {\n      await this.gateChainHop(args, error);\n      return { retry: false };\n    }\n\n    const cascade = await this.getModelRouteCascade(args);\n    const currentEntry = cascade?.entries[cascade.position];\n    const providerId =\n      providerFromError(error) ??\n      (currentEntry ? providerFromModelId(currentEntry.modelId) : undefined) ??\n      (cascade ? undefined : providerFromSession(args));\n    if (!providerId) {\n      await this.emitModelFallbackPart(args, classification.kind === 'hop' ? 'persistent-outage' : 'pool-exhausted');\n      return { retry: false };\n    }\n\n    // Deployed requests resolve the tenant-scoped store; local mode keeps the\n    // host storage. Reading the host registry here would rotate or announce\n    // host accounts for a tenant request. Annotated as the rotation surface:\n    // `resolveCredentialStore` returns a plain CredentialStore, and the 401\n    // path below uses the optional `forceRefreshActiveAccount` when the host\n    // provides it.\n    const store: RotationCredentialStore = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n    store.reload();\n    const accounts = store.listAccounts?.(providerId) ?? [];\n    const active = getRequestActiveAccount(args, store, providerId);\n    const route = currentEntry ? resolveAccountRoute(args, currentEntry) : resolveAccountRoute(args);\n\n    // Q7 bucket 2: force one refresh of the active instance before rotating.\n    // A 401 usually means a fresh-but-rejected token; the forced refresh\n    // covers server-side clock skew and refresh-token races. Success retries\n    // the same account — no rotation, no part. With no active account (e.g.\n    // `ProviderAuthRequiredError` from an empty registry) a refresh can never\n    // succeed, so skip it and fall through to the retry:false surface below,\n    // which rethrows the original auth error instead of a generic pool\n    // exhaustion message.\n    if (classification.kind === 'rotate' && classification.reason === 'auth-failed' && active) {\n      const forced = getForcedRefreshInstances(state);\n      const refreshKey = `${providerId}:${active?.id ?? 'active'}`;\n      if (!forced.has(refreshKey) && typeof store.forceRefreshActiveAccount === 'function') {\n        forced.add(refreshKey);\n        const token = await store.forceRefreshActiveAccount(providerId, active?.id);\n        if (token !== undefined) {\n          return { retry: true };\n        }\n      }\n    }\n\n    // A12: only a pin on the provider that actually failed makes this failure\n    // exclusive. `route.providerId` is derived from the route's model while\n    // `providerId` comes from the failed request's URL, which during a cascade\n    // can still describe the session model rather than the entry being retried;\n    // when they differ the pin belongs to an unrelated route, so the provider\n    // that failed keeps its normal pool handling.\n    const targetAccountId = route?.providerId === providerId ? getRouteTargetAccountId(route) : undefined;\n\n    if (classification.kind === 'hop') {\n      return this.declarePoolUnavailable(args, providerId, 'persistent-outage', targetAccountId !== undefined);\n    }\n\n    // A12: a targeted route never activates a sibling subscription. A\n    // rotate-classified failure on the account the route selected proceeds to\n    // the model route instead — the request hops, it does not spill\n    // onto another subscription's quota. A targeted route has nothing to\n    // rotate to at any pool size. A stale id for an account the user removed\n    // reads the same way: fail closed rather than silently land on a sibling.\n    if (targetAccountId !== undefined) {\n      return this.declarePoolUnavailable(args, providerId, 'pool-exhausted', true);\n    }\n\n    // Count only this provider's instances: `tried` spans the whole request\n    // (a cascade can visit several providers), so comparing its raw size to\n    // this provider's account count would falsely report exhaustion when an\n    // earlier provider in the same request already used up accounts.\n    const tried = getTriedInstances(state);\n    if (active) tried.add(active.id);\n    // The tried-set is request-global and shared across providers after a\n    // route hop, so exhaustion must count only this provider's ids.\n    const triedForProvider = accounts.filter(account => tried.has(account.id)).length;\n    if (triedForProvider >= accounts.length) {\n      return this.declarePoolUnavailable(args, providerId, 'pool-exhausted');\n    }\n\n    // If the selected account was removed elsewhere, even a single survivor\n    // is still untried. Resume from the freshly loaded global cursor.\n    const candidates = active ? accounts : orderAccountsFromActive(accounts, store.getActiveAccount?.(providerId)?.id);\n    const nextCandidate = candidates.find(account => !tried.has(account.id));\n\n    const next = nextCandidate ? store.activateAccount?.(providerId, nextCandidate.id) : undefined;\n    if (!next) {\n      return this.declarePoolUnavailable(args, providerId, 'pool-exhausted');\n    }\n    setRequestAccountSelection(args.requestContext, providerId, next.id);\n    tried.add(next.id);\n\n    // The retry replays the request from scratch (Q10): rotate the assistant\n    // message id so the retried response starts a fresh message instead of\n    // appending to the partially streamed one.\n    args.rotateResponseMessageId?.();\n\n    await emitAccountSwitchPart(args, {\n      provider: providerId,\n      from: active ? { id: active.id, label: active.label } : null,\n      to: { id: next.id, label: next.label },\n      reason: classification.reason,\n      at: new Date().toISOString(),\n    });\n\n    return { retry: true };\n  }\n\n  /**\n   * Resolve the request's host-supplied model route once and cache the reachable\n   * prefix in processor state. Resolution mirrors getDynamicModel so a hop is\n   * never announced for an entry core cannot reach.\n   */\n  private async getModelRouteCascade(args: ProcessAPIErrorArgs): Promise<ModelRouteCascade | null> {\n    if (args.state.modelRouteCascade !== undefined) {\n      return (args.state.modelRouteCascade as ModelRouteCascade | null) ?? null;\n    }\n    const controller = getRoutingController(args);\n    const state = controller?.getState?.();\n    const route = (\n      state?.modelRoute as\n        | { entries?: Array<{ id?: unknown; label?: unknown; modelId?: unknown; accountId?: unknown }> }\n        | undefined\n    )?.entries;\n    const pending = state?.mastracodePendingModelFallback as\n      | { toEntryId?: unknown; threadId?: unknown }\n      | null\n      | undefined;\n    const pendingMatchesThread =\n      pending &&\n      typeof pending.toEntryId === 'string' &&\n      (pending.threadId === undefined || pending.threadId === controller?.threadId);\n    const startIndex = pendingMatchesThread\n      ? route?.findIndex(entry => entry.id === pending.toEntryId)\n      : route?.findIndex(entry => entry.modelId === controller?.session?.modelId);\n    if (!route || startIndex === undefined || startIndex < 0 || route.length - startIndex < 2) {\n      args.state.modelRouteCascade = null;\n      return null;\n    }\n\n    const thinkingLevel = resolveRequestThinkingLevel(\n      {\n        state: { thinkingLevel: state?.thinkingLevel },\n        ...(!this.options.modeless && {\n          session: { modeId: typeof controller?.session?.modeId === 'string' ? controller.session.modeId : 'build' },\n        }),\n      },\n      this.options.settingsPath,\n      args.requestContext && !isThinkingLevelSetting(state?.thinkingLevel)\n        ? await this.options.resolveDefaultThinkingLevel?.({ requestContext: args.requestContext })\n        : undefined,\n    );\n    const entries: ModelRouteCascade['entries'] = [];\n    for (const entry of route.slice(startIndex)) {\n      if (\n        typeof entry.id !== 'string' ||\n        entry.id.length === 0 ||\n        typeof entry.modelId !== 'string' ||\n        entry.modelId.length === 0\n      ) {\n        break;\n      }\n      if (entries.length > 0) {\n        try {\n          resolveModel(entry.modelId, {\n            thinkingLevel,\n            remapForCodexOAuth: true,\n            requestContext: args.requestContext,\n          });\n        } catch {\n          break;\n        }\n      }\n      entries.push({\n        id: entry.id,\n        label: typeof entry.label === 'string' && entry.label.length > 0 ? entry.label : entry.id,\n        modelId: entry.modelId,\n        ...(typeof entry.accountId === 'string' ? { accountId: entry.accountId } : {}),\n      });\n    }\n    if (entries.length < 2) {\n      args.state.modelRouteCascade = null;\n      return null;\n    }\n    const cascade: ModelRouteCascade = { entries, position: 0 };\n    args.state.modelRouteCascade = cascade;\n    return cascade;\n  }\n\n  /**\n   * Q14 gate: 400/unknown/unattributable errors never advance routes. Core's\n   * fallback array advances on ANY thrown error except TripWire\n   * (llm-execution-step.ts), so when the session route has another entry and the\n   * current entry is non-last, a bare `retry: false` would silently hop on an\n   * error class the user excluded from hop triggers. TripWire is the only\n   * no-advance escape: the runner rethrows it and the fallback loop declines\n   * to advance. No chain (or already on the last entry) → return and let the\n   * plain `retry: false` surface the error exactly as before.\n   */\n  private async gateChainHop(args: ProcessAPIErrorArgs, error: unknown): Promise<void> {\n    const cascade = await this.getModelRouteCascade(args);\n    if (!cascade) return;\n    if (cascade.position >= cascade.entries.length - 1) return;\n    const reason = error instanceof Error ? error.message : String(error);\n    throw new TripWire(reason, {}, this.id);\n  }\n\n  /** Announce and persist the next model-route hop before core advances. */\n  private async emitModelFallbackPart(\n    args: ProcessAPIErrorArgs,\n    reason: 'pool-exhausted' | 'persistent-outage',\n  ): Promise<void> {\n    const cascade = await this.getModelRouteCascade(args);\n    if (!cascade) return;\n\n    const from = cascade.entries[cascade.position];\n    const to = cascade.entries[cascade.position + 1];\n    if (!from || !to) return;\n\n    const controller = args.requestContext?.get('controller') as\n      | {\n          threadId?: unknown;\n          setState?: (updates: Record<string, unknown>) => Promise<void>;\n          setThreadSetting?: (setting: { key: string; value: unknown }) => Promise<void>;\n          emitEvent?: (event: { type: 'info'; message: string }) => void;\n        }\n      | undefined;\n    const at = new Date().toISOString();\n    const threadId = typeof controller?.threadId === 'string' ? controller.threadId : undefined;\n    const pending = {\n      fromEntryId: from.id,\n      toEntryId: to.id,\n      toModelId: to.modelId,\n      ...(threadId ? { threadId } : {}),\n      reason,\n      at,\n    } satisfies PendingModelFallback;\n    await controller?.setThreadSetting?.({ key: MODEL_FALLBACK_STATE_KEY, value: pending });\n    const data: ModelFallbackPartData = {\n      from: { entryId: from.id, label: from.label },\n      to: { entryId: to.id, label: to.label },\n      reason,\n      at,\n    };\n    try {\n      await args.writer?.custom({ type: MODEL_FALLBACK_PART_TYPE, data });\n    } catch (error) {\n      await controller?.setThreadSetting?.({ key: MODEL_FALLBACK_STATE_KEY, value: undefined });\n      throw error;\n    }\n    await controller?.setState?.({ [MODEL_FALLBACK_STATE_KEY]: pending });\n    args.state.startNoticeEmitted = false;\n    const targetRoute = resolveAccountRoute(args, to);\n    if (targetRoute) {\n      const store = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n      await applyPreferredAccountRoute(args, store, targetRoute).catch(() => undefined);\n    }\n    controller?.emitEvent?.({ type: 'info', message: modelFallbackNoticeText(data) });\n    cascade.position++;\n  }\n\n  /**\n   * Pool done for this request: every instance recorded in the tried-set and\n   * a `to: null` part emitted. Returns `retry: false` so core's fallback\n   * array can hop to the next route entry (announced by `emitModelFallbackPart`).\n   * Silent on the account part when the provider has no registry at all —\n   * there are no accounts to declare unavailable, but the hop still applies.\n   */\n  private async declarePoolUnavailable(\n    args: ProcessAPIErrorArgs,\n    providerId: string,\n    reason: 'pool-exhausted' | 'persistent-outage',\n    exclusive = false,\n  ): Promise<{ retry: boolean }> {\n    const store = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n    const accounts = store.listAccounts?.(providerId) ?? [];\n    if (accounts.length === 0) {\n      // No account registry (API-key-only provider): nothing rotated, but the\n      // hop still happens — announce the model fallback before core advances.\n      await this.emitModelFallbackPart(args, reason);\n      return { retry: false };\n    }\n\n    const tried = getTriedInstances(args.state);\n    for (const account of accounts) tried.add(account.id);\n\n    const active = getRequestActiveAccount(args, store, providerId);\n\n    await emitAccountSwitchPart(args, {\n      provider: providerId,\n      from: active ? { id: active.id, label: active.label } : null,\n      to: null,\n      reason,\n      at: new Date().toISOString(),\n      ...(exclusive ? { exclusive: true } : {}),\n    });\n\n    await this.emitModelFallbackPart(args, reason);\n\n    return { retry: false };\n  }\n}\n\n/**\n * Applies the pack's preferred account route once per request, before the\n * first model call. Without a route it only reloads the credential store so\n * the request sees accounts changed by other processes.\n *\n * TYPE CONSTRAINT: this class must NEVER implement `processAPIError`. It\n * lives in `inputProcessors`; the runner walks input processors first when\n * running `processAPIError`, so adding the method here would classify and\n * rotate errors BEFORE `StreamErrorRetryProcessor`'s transient retries run.\n */\nexport class AccountStartNoticeProcessor implements Processor {\n  readonly id = 'mastracode-account-start-notice' as const;\n\n  constructor(private readonly options: { credentialStore: CredentialStore }) {}\n\n  async processInput(args: ProcessInputArgs): Promise<ProcessInputResult> {\n    if (args.state.startNoticeEmitted) return args.messageList;\n\n    // Deployed requests resolve the tenant-scoped store so host accounts are\n    // never listed, activated, or announced for a tenant run. Local mode keeps\n    // the constructor's storage.\n    const store = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n\n    const route = resolveAccountRoute(args);\n    if (!route) {\n      store.reload();\n      return args.messageList;\n    }\n\n    // A14: a route whose accounts are all unavailable is not a pre-emptive\n    // abort. `applyPreferredAccountRoute` marks the provider on the request so\n    // credential reads fail closed rather than falling through to the active\n    // account, and the request then runs and fails at the provider — which is\n    // what lets the error lane classify it and hand the turn to the route's\n    // configured fallback chain. The removed persisted set threw here instead,\n    // before any socket opened, so the chain was never reached.\n    const switched = await applyPreferredAccountRoute(args, store, route);\n    if (switched || getRouteTargetAccountId(route) !== undefined) {\n      args.state.startNoticeEmitted = true;\n    }\n    return args.messageList;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,2BAA2B;;AAqCxC,MAAM,qBAAqB,IAAI,IAAI,kBAAkB,CAAC,CAAC,KAAI,aAAY,SAAS,EAAE,CAAC;;AAGnF,MAAM,yBAAkD;CACtD,CAAC,+BAA+B,WAAW;CAC3C,CAAC,0BAA0B,iBAAiB;CAC5C,CAAC,sBAAsB,KAAK;CAC5B,CAAC,wBAAwB,cAAc;CACvC,CAAC,kCAAkC,cAAc;CACjD,CAAC,8BAA8B,gBAAgB;CAC/C,CAAC,4BAA4B,gBAAgB;AAC/C;;;;;;;;AASA,MAAM,8BACJ;AAEF,MAAM,sCAAsB,IAAI,IAAI;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,0BACJ;AAEF,MAAM,kBAAkB;;AAGxB,MAAa,2BAA2B;;AAWxC,MAAa,2BAA2B;AAiBxC,SAAS,gBAAgB,OAA6C;CACpE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU;AAClE;AAEA,SAAS,gBAAgB,OAAoC;CAC3D,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,EAAE,YAAY,WAAW;EAC/B,IAAI,OAAO,eAAe,UAAU,OAAO;EAC3C,IAAI,OAAO,WAAW,UAAU,OAAO;EACvC,UAAW,QAAgC;CAC7C;AAEF;AAEA,SAAS,4BAA4B,OAAyB;CAC5D,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IACE,mBAAmB,6BAClB,mBAAmB,SAAS,QAAQ,SAAA,6BAErC,OAAO;EAET,IAAI,OAAO,YAAY,UAAU;EACjC,UAAW,QAAgC;CAC7C;CACA,OAAO;AACT;;AAGA,SAAS,iBAAiB,OAAwB;CAChD,MAAM,QAAkB,CAAC;CACzB,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SACtD,IAAI,mBAAmB,OAAO;EAC5B,MAAM,KAAK,QAAQ,OAAO;EAC1B,UAAU,QAAQ;CACpB,OAAO,IAAI,OAAO,YAAY,YAAY,aAAa,SAAS;EAC9D,MAAM,UAAW,QAAkC;EACnD,IAAI,OAAO,YAAY,UAAU,MAAM,KAAK,OAAO;EACnD,UAAW,QAAgC;CAC7C,OACE;CAGJ,OAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,mBAAmB,OAAyB;CACnD,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IACE,gBAAgB,OAAO,KACvB,OAAO,QAAQ,SAAS,YACxB,oBAAoB,IAAI,QAAQ,KAAK,YAAY,CAAC,GAElD,OAAO;EAET,IAAI,mBAAmB,OAAO;GAC5B,IAAI,wBAAwB,KAAK,QAAQ,OAAO,GAAG,OAAO;GAC1D,UAAU,QAAQ;EACpB,OAAO,IAAI,OAAO,YAAY,UAC5B,UAAW,QAAgC;OAE3C;CAEJ;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,sBAAsB,OAAwC;CAC5E,IAAI,4BAA4B,KAAK,GACnC,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAc;CAGjD,MAAM,SAAS,gBAAgB,KAAK;CAEpC,IAAI,WAAW,KAAK,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAa;CAClE,IAAI,WAAW,KAAK,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAkB;CACvE,IAAI,WAAW,OAAO,WAAW,KAAK,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAc;CACrF,IAAI,WAAW,KAAA,KAAa,UAAU,OAAO,SAAS,KAAK,OAAO,EAAE,MAAM,MAAM;CAOhF,IAAI,WAAW,KAAA,KAAa,WAAW,KACjC;MAAA,4BAA4B,KAAK,iBAAiB,KAAK,CAAC,GAC1D,OAAO;GAAE,MAAM;GAAU,QAAQ;EAAkB;CAAA;CAGvD,IAAI,mBAAmB,KAAK,GAAG,OAAO,EAAE,MAAM,MAAM;CAEpD,OAAO,EAAE,MAAM,QAAQ;AACzB;;AAGA,SAAgB,oBAAoB,SAAqC;CACvE,MAAM,WAAW,uBAAuB,OAAO,CAAC,CAC7C,QAAQ,iBAAiB,EAAE,CAAC,CAC5B,MAAM,GAAG;CACZ,MAAM,aAAa,SAAS,KAAK,wBAAwB,SAAS,EAAE,IAAI,KAAA;CACxE,OAAO,cAAc,mBAAmB,IAAI,UAAU,IAAI,aAAa,KAAA;AACzE;AAEA,SAAS,iBAAiB,UAAsC;CAC9D,KAAK,MAAM,CAAC,SAAS,eAAe,wBAClC,IAAI,QAAQ,KAAK,QAAQ,GAAG,OAAO;AAGvC;;;;;;AAOA,SAAgB,kBAAkB,OAAoC;CACpE,MAAM,aAAuB,CAAC;CAC9B,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IAAI,OAAO,YAAY,UAAU;EACjC,WAAW,KAAK,OAAO;EACvB,UAAW,QAAgC;CAC7C;CAMA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,OAAO;GACV,KAA2B;GAC3B,KAAkC;GAClC,KAAkC;EACrC;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,OAAO,QAAQ,UAAU;GAC7B,IAAI;IACF,MAAM,aAAa,iBAAiB,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;IACzD,IAAI,YAAY,OAAO;GACzB,QAAQ,CAER;EACF;CACF;CAEA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,UAAW,KAA+B;EAChD,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,aAAa,oBAAoB,OAAO;EAC9C,IAAI,YAAY,OAAO;CACzB;AAEF;AAEA,SAAS,kBAAkB,OAA6C;CACtE,MAAM,WAAW,MAAM;CACvB,IAAI,oBAAoB,KAAK,OAAO;CACpC,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,iBAAiB;CACvB,OAAO;AACT;AAEA,SAAS,0BAA0B,OAA6C;CAC9E,MAAM,WAAW,MAAM;CACvB,IAAI,oBAAoB,KAAK,OAAO;CACpC,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,oBAAoB;CAC1B,OAAO;AACT;;AAGA,MAAa,yBAAiD;CAC5D,WAAW;CACX,mBAAmB;CACnB,gBAAgB;CAChB,kBAAkB;CAClB,KAAK;AACP;AAEA,MAAM,cAA+D;CACnE,cAAc;CACd,mBAAmB;CACnB,eAAe;CACf,kBAAkB;CAClB,qBAAqB;CACrB,qBAAqB;AACvB;;AAGA,SAAgB,sBAAsB,OAA0D;CAG9F,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,eAAe,KAAK,aAAa,KAAK;AAC7F;;;;;;;AAQA,SAAgB,wBAAwB,MAAqC;CAC3E,MAAM,WAAW,uBAAuB,KAAK,aAAa,KAAK;CAC/D,MAAM,SAAS,YAAY,KAAK;CAChC,IAAI,KAAK,OAAO,MAAM;EAIpB,IAAI,KAAK,WACP,OAAO,UAAU,SAAS,wBAAwB,OAAO;EAE3D,OAAO,OAAO,SAAS,yBAAyB,OAAO;CACzD;CAEA,OAAO,YAAY,SAAS,YADf,KAAK,MAAM,SAAS,UACY,KAAK,KAAK,GAAG,MAAM,IAAI,OAAO;AAC7E;;AAGA,SAAgB,wBAAwB,MAAqC;CAC3E,MAAM,SAAS,YAAY,KAAK,WAAW,KAAK;CAChD,OAAO,yBAAyB,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,OAAO;AAChF;;;;;;;;AASA,SAAgB,sBAAsB,OAA0D;CAC9F,OAAO,UAAU,oBAAoB,UAAU;AACjD;AAEA,eAAe,sBACb,MACA,MACe;CAGf,MAAM,KAAK,QAAQ,OAAO;EACxB,MAAM;EACN;CACF,CAAC;CAOD,CAH0B,KAAK,gBAAgB,IAAI,YAAY,EAAA,EAG5C,YAAY;EAAE,MAAM;EAAQ,SAAS,wBAAwB,IAAI;CAAE,CAAC;AACzF;;;;;;;AAQA,SAAS,oBACP,MACoB;CAEpB,MAAM,WADa,KAAK,gBAAgB,IAAI,YAAY,EAAA,EAC5B,SAAS;CACrC,OAAO,OAAO,YAAY,WAAW,oBAAoB,OAAO,IAAI,KAAA;AACtE;AAmCA,SAAS,qBACP,MACsC;CACtC,OAAO,KAAK,gBAAgB,IAAI,YAAY;AAC9C;;AAGA,SAAS,wBAAwB,OAAgD;CAC/E,OAAO,OAAO;AAChB;AAEA,SAAS,wBACP,MACA,OACA,YACA;CACA,IAAI,iCAAiC,KAAK,gBAAgB,UAAU,GAAG,OAAO,KAAA;CAC9E,MAAM,aAAa,2BAA2B,KAAK,gBAAgB,UAAU;CAC7E,IAAI,YAAY,OAAO,MAAM,eAAe,UAAU,CAAC,CAAC,MAAK,YAAW,QAAQ,OAAO,UAAU;CACjG,OAAO,MAAM,mBAAmB,UAAU,KAAK,MAAM,eAAe,UAAU,CAAC,CAAC,MAAK,YAAW,QAAQ,MAAM;AAChH;AAEA,SAAS,oBACP,MACA,UACqB;CACrB,MAAM,aAAa,qBAAqB,IAAI;CAC5C,MAAM,QAAQ,YAAY,WAAW;CACrC,MAAM,UAAU,OAAO;CAIvB,MAAM,uBACJ,WACA,OAAO,QAAQ,cAAc,YAC7B,OAAO,QAAQ,cAAc,aAC5B,QAAQ,aAAa,KAAA,KAAa,QAAQ,aAAa,YAAY;CACtE,MAAM,eAAe,MAAM,SAAS,OAAO,WAAA,EAAkD,OAAO,KAC9F,OAAO,WAAA,CAA4F,WACrG,CAAC,IACD,CAAC;CACL,MAAM,QAAQ,WACV,WACA,uBACE,aAAa,MAAK,cAAa,UAAU,OAAO,QAAQ,aAAa,UAAU,YAAY,QAAQ,SAAS,IAC5G,aAAa,MAAK,cAAa,UAAU,YAAY,YAAY,SAAS,OAAO;CACvF,IAAI,CAAC,SAAS,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,YAAY,UAAU,OAAO;CACxF,MAAM,aAAa,oBAAoB,MAAM,OAAO;CACpD,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO;EACL,SAAS,MAAM;EACf,SAAS,MAAM;EACf;EACA,GAAI,OAAO,MAAM,cAAc,WAAW,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CAC9E;AACF;;;;;;;;;AAUA,SAAS,wBAAwB,UAAgC,UAA8B;CAC7F,MAAM,QAAQ,aAAa,KAAA,IAAY,KAAK,SAAS,WAAU,YAAW,QAAQ,OAAO,QAAQ;CACjG,IAAI,SAAS,GAAG,OAAO;CACvB,OAAO,CAAC,GAAG,SAAS,MAAM,KAAK,GAAG,GAAG,SAAS,MAAM,GAAG,KAAK,CAAC;AAC/D;AAEA,eAAe,2BACb,MACA,OACA,OACkB;CAClB,MAAM,OAAO;CACb,MAAM,cAAc,wBAAwB,KAAK;CACjD,MAAM,WAAW,MAAM,eAAe,MAAM,UAAU,KAAK,CAAC;CAC5D,IAAI,SAAS,WAAW,KAAK,gBAAgB,KAAA,GAAW,OAAO;CAC/D,MAAM,QAAQ,kBAAkB,KAAK,KAAK;CAC1C,MAAM,cAAc,IAAI,IAAI,SAAS,QAAO,YAAW,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAI,YAAW,QAAQ,EAAE,CAAC;CACxG,MAAM,SAAS,wBAAwB,MAAM,OAAO,MAAM,UAAU,KAAK,MAAM,mBAAmB,MAAM,UAAU;CAClH,MAAM,YAIF,cACI,SAAS,QAAO,YAAW,QAAQ,OAAO,WAAW,IACrD,wBAAwB,UAAU,QAAQ,EAAE,EAAA,CAChD,MAAK,YAAW,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAC;CAEhD,KAAK,MAAM,aAAa,aAAa,MAAM,IAAI,SAAS;CACxD,IAAI,CAAC,UAAU;EACb,mCAAmC,KAAK,gBAAgB,MAAM,UAAU;EACxE,OAAO;CACT;CAEA,IAAI,QAAQ,OAAO,SAAS,IAAI;EAC9B,2BAA2B,KAAK,gBAAgB,MAAM,YAAY,SAAS,EAAE;EAC7E,OAAO;CACT;CAIA,MAAM,YAAY,MAAM,kBAAkB,MAAM,gBAAgB,MAAM,YAAY,SAAS,EAAE,IAAI;CACjG,IAAI,CAAC,WAAW;EAId,IAAI,gBAAgB,KAAA,GAAW,mCAAmC,KAAK,gBAAgB,MAAM,UAAU;EACvG,OAAO;CACT;CACA,2BAA2B,KAAK,gBAAgB,MAAM,YAAY,UAAU,EAAE;CAG9E,IAAI,gBAAgB,KAAA,GAClB,MAAM,sBAAsB,MAAM;EAChC,UAAU,MAAM;EAChB,MAAM,SAAS;GAAE,IAAI,OAAO;GAAI,OAAO,OAAO;EAAM,IAAI;EACxD,IAAI;GAAE,IAAI,UAAU;GAAI,OAAO,UAAU;EAAM;EAC/C,QAAQ;EACR,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;CAC7B,CAAC;CAEH,OAAO;AACT;AAEA,IAAa,2BAAb,MAA2D;CAItC;CAHnB,KAAc;CAEd,YACE,SAWA;EAXiB,KAAA,UAAA;CAWhB;CAEH,MAAM,gBAAgB,MAAwD;EAC5E,MAAM,EAAE,OAAO,UAAU;EASzB,IAAI,KAAK,cAAc,KAAK,QAAQ,qBAAqB;GACvD,MAAM,KAAK,aAAa,MAAM,KAAK;GACnC,OAAO,EAAE,OAAO,MAAM;EACxB;EAKA,MAAM,iBAAiB,sBAAsB,KAAK;EAKlD,IAAI,eAAe,SAAS,SAAS;GACnC,MAAM,KAAK,aAAa,MAAM,KAAK;GACnC,OAAO,EAAE,OAAO,MAAM;EACxB;EAEA,MAAM,UAAU,MAAM,KAAK,qBAAqB,IAAI;EACpD,MAAM,eAAe,SAAS,QAAQ,QAAQ;EAC9C,MAAM,aACJ,kBAAkB,KAAK,MACtB,eAAe,oBAAoB,aAAa,OAAO,IAAI,KAAA,OAC3D,UAAU,KAAA,IAAY,oBAAoB,IAAI;EACjD,IAAI,CAAC,YAAY;GACf,MAAM,KAAK,sBAAsB,MAAM,eAAe,SAAS,QAAQ,sBAAsB,gBAAgB;GAC7G,OAAO,EAAE,OAAO,MAAM;EACxB;EAQA,MAAM,QAAiC,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ;EACnG,MAAM,OAAO;EACb,MAAM,WAAW,MAAM,eAAe,UAAU,KAAK,CAAC;EACtD,MAAM,SAAS,wBAAwB,MAAM,OAAO,UAAU;EAC9D,MAAM,QAAQ,eAAe,oBAAoB,MAAM,YAAY,IAAI,oBAAoB,IAAI;EAU/F,IAAI,eAAe,SAAS,YAAY,eAAe,WAAW,iBAAiB,QAAQ;GACzF,MAAM,SAAS,0BAA0B,KAAK;GAC9C,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,MAAM;GAClD,IAAI,CAAC,OAAO,IAAI,UAAU,KAAK,OAAO,MAAM,8BAA8B,YAAY;IACpF,OAAO,IAAI,UAAU;IAErB,IAAI,MADgB,MAAM,0BAA0B,YAAY,QAAQ,EAAE,MAC5D,KAAA,GACZ,OAAO,EAAE,OAAO,KAAK;GAEzB;EACF;EAQA,MAAM,kBAAkB,OAAO,eAAe,aAAa,wBAAwB,KAAK,IAAI,KAAA;EAE5F,IAAI,eAAe,SAAS,OAC1B,OAAO,KAAK,uBAAuB,MAAM,YAAY,qBAAqB,oBAAoB,KAAA,CAAS;EASzG,IAAI,oBAAoB,KAAA,GACtB,OAAO,KAAK,uBAAuB,MAAM,YAAY,kBAAkB,IAAI;EAO7E,MAAM,QAAQ,kBAAkB,KAAK;EACrC,IAAI,QAAQ,MAAM,IAAI,OAAO,EAAE;EAI/B,IADyB,SAAS,QAAO,YAAW,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,UACnD,SAAS,QAC/B,OAAO,KAAK,uBAAuB,MAAM,YAAY,gBAAgB;EAMvE,MAAM,iBADa,SAAS,WAAW,wBAAwB,UAAU,MAAM,mBAAmB,UAAU,CAAC,EAAE,EAAE,EAAA,CAChF,MAAK,YAAW,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;EAEvE,MAAM,OAAO,gBAAgB,MAAM,kBAAkB,YAAY,cAAc,EAAE,IAAI,KAAA;EACrF,IAAI,CAAC,MACH,OAAO,KAAK,uBAAuB,MAAM,YAAY,gBAAgB;EAEvE,2BAA2B,KAAK,gBAAgB,YAAY,KAAK,EAAE;EACnE,MAAM,IAAI,KAAK,EAAE;EAKjB,KAAK,0BAA0B;EAE/B,MAAM,sBAAsB,MAAM;GAChC,UAAU;GACV,MAAM,SAAS;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM,IAAI;GACxD,IAAI;IAAE,IAAI,KAAK;IAAI,OAAO,KAAK;GAAM;GACrC,QAAQ,eAAe;GACvB,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;EAC7B,CAAC;EAED,OAAO,EAAE,OAAO,KAAK;CACvB;;;;;;CAOA,MAAc,qBAAqB,MAA8D;EAC/F,IAAI,KAAK,MAAM,sBAAsB,KAAA,GACnC,OAAQ,KAAK,MAAM,qBAAkD;EAEvE,MAAM,aAAa,qBAAqB,IAAI;EAC5C,MAAM,QAAQ,YAAY,WAAW;EACrC,MAAM,SACJ,OAAO,WAAA,EAGN;EACH,MAAM,UAAU,OAAO;EAQvB,MAAM,aAHJ,WACA,OAAO,QAAQ,cAAc,aAC5B,QAAQ,aAAa,KAAA,KAAa,QAAQ,aAAa,YAAY,YAElE,OAAO,WAAU,UAAS,MAAM,OAAO,QAAQ,SAAS,IACxD,OAAO,WAAU,UAAS,MAAM,YAAY,YAAY,SAAS,OAAO;EAC5E,IAAI,CAAC,SAAS,eAAe,KAAA,KAAa,aAAa,KAAK,MAAM,SAAS,aAAa,GAAG;GACzF,KAAK,MAAM,oBAAoB;GAC/B,OAAO;EACT;EAEA,MAAM,gBAAgB,4BACpB;GACE,OAAO,EAAE,eAAe,OAAO,cAAc;GAC7C,GAAI,CAAC,KAAK,QAAQ,YAAY,EAC5B,SAAS,EAAE,QAAQ,OAAO,YAAY,SAAS,WAAW,WAAW,WAAW,QAAQ,SAAS,QAAQ,EAC3G;EACF,GACA,KAAK,QAAQ,cACb,KAAK,kBAAkB,CAAC,uBAAuB,OAAO,aAAa,IAC/D,MAAM,KAAK,QAAQ,8BAA8B,EAAE,gBAAgB,KAAK,eAAe,CAAC,IACxF,KAAA,CACN;EACA,MAAM,UAAwC,CAAC;EAC/C,KAAK,MAAM,SAAS,MAAM,MAAM,UAAU,GAAG;GAC3C,IACE,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,WAAW,KACpB,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,WAAW,GAEzB;GAEF,IAAI,QAAQ,SAAS,GACnB,IAAI;IACF,aAAa,MAAM,SAAS;KAC1B;KACA,oBAAoB;KACpB,gBAAgB,KAAK;IACvB,CAAC;GACH,QAAQ;IACN;GACF;GAEF,QAAQ,KAAK;IACX,IAAI,MAAM;IACV,OAAO,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ,MAAM;IACvF,SAAS,MAAM;IACf,GAAI,OAAO,MAAM,cAAc,WAAW,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GAC9E,CAAC;EACH;EACA,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,oBAAoB;GAC/B,OAAO;EACT;EACA,MAAM,UAA6B;GAAE;GAAS,UAAU;EAAE;EAC1D,KAAK,MAAM,oBAAoB;EAC/B,OAAO;CACT;;;;;;;;;;;CAYA,MAAc,aAAa,MAA2B,OAA+B;EACnF,MAAM,UAAU,MAAM,KAAK,qBAAqB,IAAI;EACpD,IAAI,CAAC,SAAS;EACd,IAAI,QAAQ,YAAY,QAAQ,QAAQ,SAAS,GAAG;EAEpD,MAAM,IAAI,SADK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACzC,CAAC,GAAG,KAAK,EAAE;CACxC;;CAGA,MAAc,sBACZ,MACA,QACe;EACf,MAAM,UAAU,MAAM,KAAK,qBAAqB,IAAI;EACpD,IAAI,CAAC,SAAS;EAEd,MAAM,OAAO,QAAQ,QAAQ,QAAQ;EACrC,MAAM,KAAK,QAAQ,QAAQ,QAAQ,WAAW;EAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI;EAElB,MAAM,aAAa,KAAK,gBAAgB,IAAI,YAAY;EAQxD,MAAM,sBAAK,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,MAAM,WAAW,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW,KAAA;EAClF,MAAM,UAAU;GACd,aAAa,KAAK;GAClB,WAAW,GAAG;GACd,WAAW,GAAG;GACd,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;GAC/B;GACA;EACF;EACA,MAAM,YAAY,mBAAmB;GAAE,KAAK;GAA0B,OAAO;EAAQ,CAAC;EACtF,MAAM,OAA8B;GAClC,MAAM;IAAE,SAAS,KAAK;IAAI,OAAO,KAAK;GAAM;GAC5C,IAAI;IAAE,SAAS,GAAG;IAAI,OAAO,GAAG;GAAM;GACtC;GACA;EACF;EACA,IAAI;GACF,MAAM,KAAK,QAAQ,OAAO;IAAE,MAAM;IAA0B;GAAK,CAAC;EACpE,SAAS,OAAO;GACd,MAAM,YAAY,mBAAmB;IAAE,KAAK;IAA0B,OAAO,KAAA;GAAU,CAAC;GACxF,MAAM;EACR;EACA,MAAM,YAAY,WAAW,GAAG,2BAA2B,QAAQ,CAAC;EACpE,KAAK,MAAM,qBAAqB;EAChC,MAAM,cAAc,oBAAoB,MAAM,EAAE;EAChD,IAAI,aAEF,MAAM,2BAA2B,MADnB,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ,iBAC5B,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;EAElF,YAAY,YAAY;GAAE,MAAM;GAAQ,SAAS,wBAAwB,IAAI;EAAE,CAAC;EAChF,QAAQ;CACV;;;;;;;;CASA,MAAc,uBACZ,MACA,YACA,QACA,YAAY,OACiB;EAC7B,MAAM,QAAQ,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ;EAC1E,MAAM,WAAW,MAAM,eAAe,UAAU,KAAK,CAAC;EACtD,IAAI,SAAS,WAAW,GAAG;GAGzB,MAAM,KAAK,sBAAsB,MAAM,MAAM;GAC7C,OAAO,EAAE,OAAO,MAAM;EACxB;EAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK;EAC1C,KAAK,MAAM,WAAW,UAAU,MAAM,IAAI,QAAQ,EAAE;EAEpD,MAAM,SAAS,wBAAwB,MAAM,OAAO,UAAU;EAE9D,MAAM,sBAAsB,MAAM;GAChC,UAAU;GACV,MAAM,SAAS;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM,IAAI;GACxD,IAAI;GACJ;GACA,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;GAC3B,GAAI,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACzC,CAAC;EAED,MAAM,KAAK,sBAAsB,MAAM,MAAM;EAE7C,OAAO,EAAE,OAAO,MAAM;CACxB;AACF;;;;;;;;;;;AAYA,IAAa,8BAAb,MAA8D;CAG/B;CAF7B,KAAc;CAEd,YAAY,SAAgE;EAA/C,KAAA,UAAA;CAAgD;CAE7E,MAAM,aAAa,MAAqD;EACtE,IAAI,KAAK,MAAM,oBAAoB,OAAO,KAAK;EAK/C,MAAM,QAAQ,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ;EAE1E,MAAM,QAAQ,oBAAoB,IAAI;EACtC,IAAI,CAAC,OAAO;GACV,MAAM,OAAO;GACb,OAAO,KAAK;EACd;EAUA,IAAI,MADmB,2BAA2B,MAAM,OAAO,KAAK,KACpD,wBAAwB,KAAK,MAAM,KAAA,GACjD,KAAK,MAAM,qBAAqB;EAElC,OAAO,KAAK;CACd;AACF"}
+{"version":3,"file":"account-rotation-processor.js","names":[],"sources":["../../src/auth/account-rotation-processor.ts"],"sourcesContent":["/**\n * Error-driven rotation across a provider's OAuth account registry.\n *\n * When the active account cannot serve a request (rate limit, quota\n * exhaustion, dead token, persistent outage), the next account in insertion\n * order is selected for the request and the request retried. OAuth fetch\n * wrappers read that request-scoped selection on every HTTP attempt, so\n * concurrent runs can't swap each other's credentials. Every switch is\n * persisted as a non-transient `data-mastracode-account-switch` part so it\n * shows in the transcript and survives history reload.\n *\n * Two classes, two lanes — the split is load-bearing. The processor runner\n * walks `[...inputProcessors, ...outputProcessors, ...errorProcessors]` when\n * running `processAPIError`, so a processor registered in the input lane that\n * also implemented `processAPIError` would run BEFORE\n * `StreamErrorRetryProcessor` and hop on 5xx errors before transient retries\n * had a chance. `AccountRotationProcessor` therefore implements\n * `processAPIError` only and is registered in `errorProcessors` after\n * `StreamErrorRetryProcessor`; `AccountStartNoticeProcessor` implements\n * `processInput` only and is registered in `inputProcessors`.\n */\nimport { TripWire } from '@mastra/core/agent';\nimport type { ProcessAPIErrorArgs, ProcessInputArgs, ProcessInputResult, Processor } from '@mastra/core/processors';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { resolveCredentialStore } from '../agents/credential-resolver.js';\nimport { resolveModel, resolveRequestThinkingLevel } from '../agents/model.js';\nimport { getCredentialProviderId, normalizeLegacyModelId } from '../providers/model-ids.js';\nimport { isThinkingLevelSetting } from '../thinking.js';\nimport type { ThinkingLevelSetting } from '../thinking.js';\nimport {\n  getRequestAccountSelection,\n  isRequestAccountRoutingExhausted,\n  markRequestAccountRoutingExhausted,\n  setRequestAccountSelection,\n} from './account-routing-context.js';\nimport { ProviderAuthRequiredError, PROVIDER_AUTH_REQUIRED_ERROR } from './provider-auth-error.js';\nimport { getOAuthProviders } from './storage.js';\nimport type { CredentialStore, OAuthAccountRecord } from './types.js';\n\nexport const ACCOUNT_SWITCH_PART_TYPE = 'data-mastracode-account-switch';\n\n/** Labels and instance ids only — never token material (do-not list). */\nexport interface AccountSwitchPartData {\n  provider: string;\n  from: { id: string; label: string } | null;\n  to: { id: string; label: string } | null;\n  reason:\n    | 'rate-limit'\n    | 'quota-exhausted'\n    | 'auth-failed'\n    | 'pool-exhausted'\n    | 'persistent-outage'\n    | 'preferred-routing';\n  at: string;\n  /**\n   * Set on a `to: null` part when a route pinned to a single account reported\n   * that account unusable. The provider's other subscriptions were never\n   * consulted (A12), so \"all accounts unavailable\" would misreport what\n   * happened.\n   */\n  exclusive?: boolean;\n}\n\n/** The store surface rotation needs; `AuthStorage` satisfies it structurally. */\nexport type RotationCredentialStore = CredentialStore & {\n  /**\n   * Force one refresh of the active account's tokens regardless of expiry\n   * (401/403 path — a rejected-but-unexpired token usually means clock skew\n   * or a refresh race). `AuthStorage` provides it; deployed per-tenant stores\n   * don't, and the auth path degrades to plain rotation (which itself no-ops\n   * without registry methods).\n   */\n  forceRefreshActiveAccount?(providerId: string, accountInstanceId?: string): Promise<string | undefined>;\n};\n\n/** Rotatable providers = the OAuth provider registry; API-key-only providers never rotate. */\nconst KNOWN_PROVIDER_IDS = new Set(getOAuthProviders().map(provider => provider.id));\n\n/** Hostname suffixes → provider ids, for `APICallError.url`. */\nconst PROVIDER_HOST_PATTERNS: Array<[RegExp, string]> = [\n  [/(^|\\.)api\\.anthropic\\.com$/i, 'anthropic'],\n  [/(^|\\.)api\\.kimi\\.com$/i, 'kimi-for-coding'],\n  [/(^|\\.)api\\.x\\.ai$/i, 'xai'],\n  [/(^|\\.)chatgpt\\.com$/i, 'openai-codex'],\n  [/(^|\\.)backend-api\\.codex\\.ai$/i, 'openai-codex'],\n  [/(^|\\.)githubcopilot\\.com$/i, 'github-copilot'],\n  [/(^|\\.)api\\.github\\.com$/i, 'github-copilot'],\n];\n\n/**\n * Provider usage/quota-limit wording (locked Q7 bucket 1). Statuses 429/402\n * are matched before this; some providers deliver quota errors as plain 400s,\n * which only the message reveals. Deliberately restricted to unambiguous\n * quota phrases — a generic \"exceeded your … limit\" can appear on non-quota\n * client errors (request size, context length) that must never rotate.\n */\nconst USAGE_LIMIT_MESSAGE_PATTERN =\n  /usage (?:limit|cap)|insufficient[_ ]quota|quota (?:exceeded|exhausted|reached)|exceeded (?:your )?current quota|insufficient (?:balance|credits?)|credits? exhausted|rate limit (?:exceeded|reached)|weekly limit|monthly limit/i;\n\nconst NETWORK_ERROR_CODES = new Set([\n  'ECONNRESET',\n  'EPIPE',\n  'ECONNREFUSED',\n  'ENOTFOUND',\n  'ETIMEDOUT',\n  'EAI_AGAIN',\n  'UND_ERR_CONNECT_TIMEOUT',\n  'UND_ERR_SOCKET',\n]);\n\nconst NETWORK_MESSAGE_PATTERN =\n  /fetch failed|network error|socket hang up|getaddrinfo|econnrefused|enotfound|etimedout|connection (?:refused|reset|closed|timed out)|other side closed|write epipe/i;\n\nconst MAX_CAUSE_DEPTH = 4;\n\n/** Persisted data-part type for a model-route hop. */\nexport const MODEL_FALLBACK_PART_TYPE = 'data-mastracode-model-fallback' as const;\n\n/** Non-secret transcript payload for a model-route hop. */\nexport interface ModelFallbackPartData {\n  from: { entryId: string; label: string };\n  to: { entryId: string; label: string };\n  reason: 'pool-exhausted' | 'persistent-outage';\n  at: string;\n}\n\n/** Session-state key set when account rotation advances the model route. */\nexport const MODEL_FALLBACK_STATE_KEY = 'mastracodePendingModelFallback' as const;\n\n/** Payload written to session state under MODEL_FALLBACK_STATE_KEY. */\nexport interface PendingModelFallback {\n  fromEntryId: string;\n  toEntryId: string;\n  toModelId: string;\n  threadId?: string;\n  reason: 'pool-exhausted' | 'persistent-outage';\n  at: string;\n}\n\nexport type RotationClassification =\n  | { kind: 'rotate'; reason: 'rate-limit' | 'quota-exhausted' | 'auth-failed' }\n  | { kind: 'hop' }\n  | { kind: 'never' };\n\nfunction isErrorWithCode(error: unknown): error is { code?: unknown } {\n  return typeof error === 'object' && error !== null && 'code' in error;\n}\n\nfunction readErrorStatus(error: unknown): number | undefined {\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (typeof current !== 'object') break;\n    const { statusCode, status } = current as { statusCode?: unknown; status?: unknown };\n    if (typeof statusCode === 'number') return statusCode;\n    if (typeof status === 'number') return status;\n    current = (current as { cause?: unknown }).cause;\n  }\n  return undefined;\n}\n\nfunction isProviderAuthRequiredError(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (\n      current instanceof ProviderAuthRequiredError ||\n      (current instanceof Error && current.name === PROVIDER_AUTH_REQUIRED_ERROR)\n    ) {\n      return true;\n    }\n    if (typeof current !== 'object') break;\n    current = (current as { cause?: unknown }).cause;\n  }\n  return false;\n}\n\n/** Concatenate the error's message with its cause chain (bounded). */\nfunction collectErrorText(error: unknown): string {\n  const parts: string[] = [];\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (current instanceof Error) {\n      parts.push(current.message);\n      current = current.cause;\n    } else if (typeof current === 'object' && 'message' in current) {\n      const message = (current as { message?: unknown }).message;\n      if (typeof message === 'string') parts.push(message);\n      current = (current as { cause?: unknown }).cause;\n    } else {\n      break;\n    }\n  }\n  return parts.join(' | ');\n}\n\nfunction isNetworkErrorLike(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (\n      isErrorWithCode(current) &&\n      typeof current.code === 'string' &&\n      NETWORK_ERROR_CODES.has(current.code.toUpperCase())\n    ) {\n      return true;\n    }\n    if (current instanceof Error) {\n      if (NETWORK_MESSAGE_PATTERN.test(current.message)) return true;\n      current = current.cause;\n    } else if (typeof current === 'object') {\n      current = (current as { cause?: unknown }).cause;\n    } else {\n      break;\n    }\n  }\n  return false;\n}\n\n/**\n * The locked Q7 taxonomy. 429/402/usage-limit rotate immediately (429 is not\n * covered by any transient matcher, so it arrives here on first occurrence);\n * 401/403 and `ProviderAuthRequiredError` rotate after one forced refresh;\n * 5xx/network hop only when the transient retry budget is already spent (they\n * reach this processor because `StreamErrorRetryProcessor` declined); 400 and\n * everything unknown never touch the registry.\n */\nexport function classifyRotationError(error: unknown): RotationClassification {\n  if (isProviderAuthRequiredError(error)) {\n    return { kind: 'rotate', reason: 'auth-failed' };\n  }\n\n  const status = readErrorStatus(error);\n\n  if (status === 429) return { kind: 'rotate', reason: 'rate-limit' };\n  if (status === 402) return { kind: 'rotate', reason: 'quota-exhausted' };\n  if (status === 401 || status === 403) return { kind: 'rotate', reason: 'auth-failed' };\n  if (status !== undefined && status >= 500 && status < 600) return { kind: 'hop' };\n\n  // Quota wording only rotates when it co-occurs with a statusless or 400\n  // error — the shapes providers actually use for message-only quota\n  // failures. Any other status keeps its own classification above (401/403\n  // auth, 5xx outage hop, 404/422 never), so limit-ish text riding a\n  // non-quota client error can no longer burn the whole pool.\n  if (status === undefined || status === 400) {\n    if (USAGE_LIMIT_MESSAGE_PATTERN.test(collectErrorText(error))) {\n      return { kind: 'rotate', reason: 'quota-exhausted' };\n    }\n  }\n  if (isNetworkErrorLike(error)) return { kind: 'hop' };\n\n  return { kind: 'never' };\n}\n\n/** Provider id off a router model id: `mastracode/<provider>/<model>` or `<provider>/<model>`. */\nexport function providerFromModelId(modelId: string): string | undefined {\n  const segments = normalizeLegacyModelId(modelId)\n    .replace(/^mastracode\\//, '')\n    .split('/');\n  const providerId = segments[0] ? getCredentialProviderId(segments[0]) : undefined;\n  return providerId && KNOWN_PROVIDER_IDS.has(providerId) ? providerId : undefined;\n}\n\nfunction providerFromHost(hostname: string): string | undefined {\n  for (const [pattern, providerId] of PROVIDER_HOST_PATTERNS) {\n    if (pattern.test(hostname)) return providerId;\n  }\n  return undefined;\n}\n\n/**\n * Identify the provider an error came from: the request URL's hostname\n * (`APICallError.url`, cause chain included), falling back to the router\n * model id. Unknown → undefined (caller treats as never-rotate).\n */\nexport function providerFromError(error: unknown): string | undefined {\n  const causeChain: object[] = [];\n  let current: unknown = error;\n  for (let depth = 0; current && depth < MAX_CAUSE_DEPTH; depth++) {\n    if (typeof current !== 'object') break;\n    causeChain.push(current);\n    current = (current as { cause?: unknown }).cause;\n  }\n\n  // A request URL identifies the provider that actually handled the failed\n  // call. Check every supported URL field throughout the cause chain before\n  // falling back to router model metadata, which may describe the original\n  // session model rather than the active cascade entry.\n  for (const item of causeChain) {\n    const urls = [\n      (item as { url?: unknown }).url,\n      (item as { requestURL?: unknown }).requestURL,\n      (item as { requestUrl?: unknown }).requestUrl,\n    ];\n    for (const url of urls) {\n      if (typeof url !== 'string') continue;\n      try {\n        const providerId = providerFromHost(new URL(url).hostname);\n        if (providerId) return providerId;\n      } catch {\n        // Not a parseable URL — try the other fields and causes.\n      }\n    }\n  }\n\n  for (const item of causeChain) {\n    const modelId = (item as { modelId?: unknown }).modelId;\n    if (typeof modelId !== 'string') continue;\n    const providerId = providerFromModelId(modelId);\n    if (providerId) return providerId;\n  }\n  return undefined;\n}\n\nfunction getTriedInstances(state: Record<string, unknown>): Set<string> {\n  const existing = state.triedInstances;\n  if (existing instanceof Set) return existing;\n  const created = new Set<string>();\n  state.triedInstances = created;\n  return created;\n}\n\nfunction getForcedRefreshInstances(state: Record<string, unknown>): Set<string> {\n  const existing = state.forcedAuthRefresh;\n  if (existing instanceof Set) return existing;\n  const created = new Set<string>();\n  state.forcedAuthRefresh = created;\n  return created;\n}\n\n/** Friendly names for the part/notice copy (display only — never auth data). */\nexport const PROVIDER_DISPLAY_NAMES: Record<string, string> = {\n  anthropic: 'Anthropic',\n  'kimi-for-coding': 'Kimi',\n  'openai-codex': 'Codex',\n  'github-copilot': 'GitHub Copilot',\n  xai: 'xAI',\n};\n\nconst REASON_TEXT: Record<AccountSwitchPartData['reason'], string> = {\n  'rate-limit': 'rate limit',\n  'quota-exhausted': 'quota exhausted',\n  'auth-failed': 'auth failed',\n  'pool-exhausted': 'pool exhausted',\n  'persistent-outage': 'persistent outage',\n  'preferred-routing': 'subscription routing',\n};\n\n/** Validates untrusted `reason` values (e.g. persisted message parts). */\nexport function isAccountSwitchReason(value: unknown): value is AccountSwitchPartData['reason'] {\n  // Own-property check: `in` would accept prototype names like 'toString',\n  // which would then interpolate the inherited function into the notice text.\n  return typeof value === 'string' && Object.prototype.hasOwnProperty.call(REASON_TEXT, value);\n}\n\n/**\n * One-line transcript copy for a switch part. Shared by the live `info`\n * controller event (the TUI shows controller `info` events as transcript\n * lines, and no message event carries data parts mid-run) and by the TUI's\n * history rendering of the persisted part — one formatter, identical text.\n */\nexport function accountSwitchNoticeText(data: AccountSwitchPartData): string {\n  const provider = PROVIDER_DISPLAY_NAMES[data.provider] ?? data.provider;\n  const reason = REASON_TEXT[data.reason];\n  if (data.to === null) {\n    // A12: a targeted route reports *its* account, not the pool — the other\n    // subscriptions were never tried, so \"all accounts unavailable\" would be\n    // wrong and would read as if the pool had been walked.\n    if (data.exclusive) {\n      return `Pinned ${provider} account unavailable (${reason})`;\n    }\n    return `All ${provider} accounts unavailable (${reason})`;\n  }\n  const from = data.from?.label ?? 'unknown';\n  return `Switched ${provider} account: ${from} → ${data.to.label} (${reason})`;\n}\n\n/** Transcript line for a model-route hop; shared by the live info event and the TUI's history render. */\nexport function modelFallbackNoticeText(data: ModelFallbackPartData): string {\n  const reason = REASON_TEXT[data.reason] ?? data.reason;\n  return `Switched model route: ${data.from.label} → ${data.to.label} (${reason})`;\n}\n\n/**\n * Whether a persisted model-fallback reason is one this build understands.\n * `REASON_TEXT` also covers the account-switch reasons, so the notice text\n * alone would happily render a foreign value such as `rate-limit` as a\n * model-fallback reason; history parsed from another build's part must be\n * rejected instead.\n */\nexport function isModelFallbackReason(value: unknown): value is ModelFallbackPartData['reason'] {\n  return value === 'pool-exhausted' || value === 'persistent-outage';\n}\n\nasync function emitAccountSwitchPart(\n  args: Pick<ProcessAPIErrorArgs, 'writer' | 'requestContext'> | Pick<ProcessInputArgs, 'writer' | 'requestContext'>,\n  data: AccountSwitchPartData,\n): Promise<void> {\n  // Non-transient on purpose (contrast the transient tool-progress parts):\n  // switches must persist into the assistant message and render from history.\n  await args.writer?.custom({\n    type: ACCOUNT_SWITCH_PART_TYPE,\n    data,\n  });\n  // Data parts surface in the TUI only on history reload; emit the same line\n  // as a controller `info` event so the switch is visible live (precedent:\n  // emitTransientRetry emits controller events from the retry matcher).\n  const controllerContext = args.requestContext?.get('controller') as\n    | { emitEvent?: (event: { type: 'info'; message: string }) => void }\n    | undefined;\n  controllerContext?.emitEvent?.({ type: 'info', message: accountSwitchNoticeText(data) });\n}\n\n/**\n * Provider of the model the controller session is currently running — the\n * fallback identification path for errors that carry neither a request URL\n * nor a model id (e.g. `ProviderAuthRequiredError` thrown by a fetch wrapper\n * before any HTTP request exists).\n */\nfunction providerFromSession(\n  args: Pick<ProcessAPIErrorArgs, 'requestContext'> | Pick<ProcessInputArgs, 'requestContext'>,\n): string | undefined {\n  const controller = args.requestContext?.get('controller') as { session?: { modelId?: unknown } } | undefined;\n  const modelId = controller?.session?.modelId;\n  return typeof modelId === 'string' ? providerFromModelId(modelId) : undefined;\n}\n\n/**\n * Rotates the active OAuth account on classified API errors.\n *\n * Registered in `errorProcessors` AFTER `StreamErrorRetryProcessor` — a\n * transient error reaching this processor means the transient budget is\n * spent, which is exactly the hop condition. Implements `processAPIError`\n * ONLY (see the file header for the runner-order rationale).\n */\n/** Cached per-request model route cascade. */\ninterface ModelRouteCascade {\n  entries: Array<{ id: string; label: string; modelId: string; accountId?: string }>;\n  position: number;\n}\n\ninterface AccountRoute {\n  entryId: string;\n  modelId: string;\n  providerId: string;\n  accountId?: string;\n}\n\ntype RoutingProcessorArgs = Pick<ProcessAPIErrorArgs, 'requestContext' | 'state' | 'writer'> | ProcessInputArgs;\n\nexport type RoutingControllerContext = {\n  session?: { modelId?: unknown; modeId?: unknown };\n  threadId?: unknown;\n  getState?: () => Record<string, unknown>;\n  setState?: (updates: Record<string, unknown>) => Promise<void>;\n  getThreadSetting?: (key: string) => Promise<unknown>;\n  setThreadSetting?: (setting: { key: string; value: unknown }) => Promise<void>;\n  isThreadActive?: () => boolean;\n};\n\nfunction getRoutingController(\n  args: Pick<RoutingProcessorArgs, 'requestContext'>,\n): RoutingControllerContext | undefined {\n  return args.requestContext?.get('controller') as RoutingControllerContext | undefined;\n}\n\n/** A targeted route is exclusive; an entry without accountId uses automatic pool rotation. */\nfunction getRouteTargetAccountId(route: AccountRoute | null): string | undefined {\n  return route?.accountId;\n}\n\nfunction getRequestActiveAccount(\n  args: Pick<RoutingProcessorArgs, 'requestContext'>,\n  store: CredentialStore,\n  providerId: string,\n) {\n  if (isRequestAccountRoutingExhausted(args.requestContext, providerId)) return undefined;\n  const selectedId = getRequestAccountSelection(args.requestContext, providerId);\n  if (selectedId) return store.listAccounts?.(providerId).find(account => account.id === selectedId);\n  return store.getActiveAccount?.(providerId) ?? store.listAccounts?.(providerId).find(account => account.active);\n}\n\nfunction resolveAccountRoute(\n  args: Pick<RoutingProcessorArgs, 'requestContext'>,\n  explicit?: { id: string; modelId: string; accountId?: string },\n): AccountRoute | null {\n  const controller = getRoutingController(args);\n  const state = controller?.getState?.();\n  const pending = state?.mastracodePendingModelFallback as\n    | { toEntryId?: unknown; toModelId?: unknown; threadId?: unknown }\n    | null\n    | undefined;\n  const pendingMatchesThread =\n    pending &&\n    typeof pending.toEntryId === 'string' &&\n    typeof pending.toModelId === 'string' &&\n    (pending.threadId === undefined || pending.threadId === controller?.threadId);\n  const routeEntries = Array.isArray((state?.modelRoute as { entries?: unknown } | undefined)?.entries)\n    ? ((state?.modelRoute as { entries: Array<{ id?: unknown; modelId?: unknown; accountId?: unknown }> }).entries ??\n      [])\n    : [];\n  const entry = explicit\n    ? explicit\n    : pendingMatchesThread\n      ? routeEntries.find(candidate => candidate.id === pending.toEntryId && candidate.modelId === pending.toModelId)\n      : routeEntries.find(candidate => candidate.modelId === controller?.session?.modelId);\n  if (!entry || typeof entry.id !== 'string' || typeof entry.modelId !== 'string') return null;\n  const providerId = providerFromModelId(entry.modelId);\n  if (!providerId) return null;\n  return {\n    entryId: entry.id,\n    modelId: entry.modelId,\n    providerId,\n    ...(typeof entry.accountId === 'string' ? { accountId: entry.accountId } : {}),\n  };\n}\n\n/**\n * A14: `Automatic` rotation starts *at* the persisted active account and walks\n * insertion order from there, wrapping once. The active account is the cursor\n * rotation last left at, so a turn that starts at index 0 regardless would\n * re-activate and re-try an account the previous turn already moved past —\n * which is the whole job the removed sticky-exclusion set was doing badly.\n * With no persisted active account the order is plain insertion order.\n */\nfunction orderAccountsFromActive(accounts: OAuthAccountRecord[], activeId: string | undefined) {\n  const index = activeId === undefined ? -1 : accounts.findIndex(account => account.id === activeId);\n  if (index <= 0) return accounts;\n  return [...accounts.slice(index), ...accounts.slice(0, index)];\n}\n\nasync function applyPreferredAccountRoute(\n  args: RoutingProcessorArgs,\n  store: CredentialStore,\n  route: AccountRoute,\n): Promise<boolean> {\n  store.reload();\n  const preferredId = getRouteTargetAccountId(route);\n  const accounts = store.listAccounts?.(route.providerId) ?? [];\n  if (accounts.length === 0 && preferredId === undefined) return false;\n  const tried = getTriedInstances(args.state);\n  const unavailable = new Set(accounts.filter(account => tried.has(account.id)).map(account => account.id));\n  const active = getRequestActiveAccount(args, store, route.providerId) ?? store.getActiveAccount?.(route.providerId);\n  const selected = // A12: a targeted route may use only the account it names. `Automatic`\n    // keeps insertion order with full pool rotation (A10), starting from the\n    // account the cursor already points at (A14).\n    (\n      preferredId\n        ? accounts.filter(account => account.id === preferredId)\n        : orderAccountsFromActive(accounts, active?.id)\n    ).find(account => !unavailable.has(account.id));\n\n  for (const accountId of unavailable) tried.add(accountId);\n  if (!selected) {\n    markRequestAccountRoutingExhausted(args.requestContext, route.providerId);\n    return false;\n  }\n\n  if (active?.id === selected.id) {\n    setRequestAccountSelection(args.requestContext, route.providerId, selected.id);\n    return false;\n  }\n  // Activate before recording the request-scoped selection: a failed\n  // activation must not leave the selection claiming an account that never\n  // became the provider's active credential.\n  const activated = store.activateAccount ? store.activateAccount(route.providerId, selected.id) : selected;\n  if (!activated) {\n    // Only a targeted route is out of options here. The exhausted marker is\n    // request-wide and fails every credential read closed, so setting it for\n    // `Automatic` would stop error recovery from retrying on a survivor.\n    if (preferredId !== undefined) markRequestAccountRoutingExhausted(args.requestContext, route.providerId);\n    return false;\n  }\n  setRequestAccountSelection(args.requestContext, route.providerId, activated.id);\n\n  // Applying an explicit account choice is routine, not a failover notice.\n  if (preferredId === undefined) {\n    await emitAccountSwitchPart(args, {\n      provider: route.providerId,\n      from: active ? { id: active.id, label: active.label } : null,\n      to: { id: activated.id, label: activated.label },\n      reason: 'preferred-routing',\n      at: new Date().toISOString(),\n    });\n  }\n  return true;\n}\n\nexport class AccountRotationProcessor implements Processor {\n  readonly id = 'mastracode-account-rotation' as const;\n\n  constructor(\n    private readonly options: {\n      credentialStore: RotationCredentialStore;\n      maxProcessorRetries: number;\n      settingsPath?: string;\n      /** The host has no modes, so per-mode thinking defaults never apply. */\n      modeless?: boolean;\n      /** Same host thinking default `getDynamicModel` uses, so a hop resolves at the same level. */\n      resolveDefaultThinkingLevel?: (ctx: {\n        requestContext: RequestContext;\n      }) => ThinkingLevelSetting | Promise<ThinkingLevelSetting>;\n    },\n  ) {}\n\n  async processAPIError(args: ProcessAPIErrorArgs): Promise<{ retry: boolean }> {\n    const { error, state } = args;\n\n    // Core runs error processors even after the shared retry budget is spent\n    // and silently discards `retry: true` then (llm-execution-step.ts\n    // canRetryError) — rotating the cursor or emitting a switch part for a\n    // retry that will never run would lie to both auth.json and the\n    // transcript. With a fallback chain configured, a bare `retry: false`\n    // here would silently advance the route for an error we never classified, so the\n    // chain gate surfaces the error instead.\n    if (args.retryCount >= this.options.maxProcessorRetries) {\n      await this.gateChainHop(args, error);\n      return { retry: false };\n    }\n\n    // Classify before attributing: an error from a provider outside the OAuth\n    // registry (API-key/router providers are valid route entries) still hops on\n    // rotate/hop classes — there is just no account cursor to advance.\n    const classification = classifyRotationError(error);\n    // Q14: 400/unknown errors never rotate and never advance routes. With a chain\n    // active, core's fallback array would still advance on a bare\n    // `retry: false` (it advances on any thrown non-TripWire error), so the\n    // gate converts that into a surfaced error instead of a silent hop.\n    if (classification.kind === 'never') {\n      await this.gateChainHop(args, error);\n      return { retry: false };\n    }\n\n    const cascade = await this.getModelRouteCascade(args);\n    const currentEntry = cascade?.entries[cascade.position];\n    const providerId =\n      providerFromError(error) ??\n      (currentEntry ? providerFromModelId(currentEntry.modelId) : undefined) ??\n      (cascade ? undefined : providerFromSession(args));\n    if (!providerId) {\n      await this.emitModelFallbackPart(args, classification.kind === 'hop' ? 'persistent-outage' : 'pool-exhausted');\n      return { retry: false };\n    }\n\n    // Deployed requests resolve the tenant-scoped store; local mode keeps the\n    // host storage. Reading the host registry here would rotate or announce\n    // host accounts for a tenant request. Annotated as the rotation surface:\n    // `resolveCredentialStore` returns a plain CredentialStore, and the 401\n    // path below uses the optional `forceRefreshActiveAccount` when the host\n    // provides it.\n    const store: RotationCredentialStore = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n    store.reload();\n    const accounts = store.listAccounts?.(providerId) ?? [];\n    const active = getRequestActiveAccount(args, store, providerId);\n    const route = currentEntry ? resolveAccountRoute(args, currentEntry) : resolveAccountRoute(args);\n\n    // Q7 bucket 2: force one refresh of the active instance before rotating.\n    // A 401 usually means a fresh-but-rejected token; the forced refresh\n    // covers server-side clock skew and refresh-token races. Success retries\n    // the same account — no rotation, no part. With no active account (e.g.\n    // `ProviderAuthRequiredError` from an empty registry) a refresh can never\n    // succeed, so skip it and fall through to the retry:false surface below,\n    // which rethrows the original auth error instead of a generic pool\n    // exhaustion message.\n    if (classification.kind === 'rotate' && classification.reason === 'auth-failed' && active) {\n      const forced = getForcedRefreshInstances(state);\n      const refreshKey = `${providerId}:${active?.id ?? 'active'}`;\n      if (!forced.has(refreshKey) && typeof store.forceRefreshActiveAccount === 'function') {\n        forced.add(refreshKey);\n        const token = await store.forceRefreshActiveAccount(providerId, active?.id);\n        if (token !== undefined) {\n          return { retry: true };\n        }\n      }\n    }\n\n    // A12: only a pin on the provider that actually failed makes this failure\n    // exclusive. `route.providerId` is derived from the route's model while\n    // `providerId` comes from the failed request's URL, which during a cascade\n    // can still describe the session model rather than the entry being retried;\n    // when they differ the pin belongs to an unrelated route, so the provider\n    // that failed keeps its normal pool handling.\n    const targetAccountId = route?.providerId === providerId ? getRouteTargetAccountId(route) : undefined;\n\n    if (classification.kind === 'hop') {\n      return this.declarePoolUnavailable(args, providerId, 'persistent-outage', targetAccountId !== undefined);\n    }\n\n    // A12: a targeted route never activates a sibling subscription. A\n    // rotate-classified failure on the account the route selected proceeds to\n    // the model route instead — the request hops, it does not spill\n    // onto another subscription's quota. A targeted route has nothing to\n    // rotate to at any pool size. A stale id for an account the user removed\n    // reads the same way: fail closed rather than silently land on a sibling.\n    if (targetAccountId !== undefined) {\n      return this.declarePoolUnavailable(args, providerId, 'pool-exhausted', true);\n    }\n\n    // Count only this provider's instances: `tried` spans the whole request\n    // (a cascade can visit several providers), so comparing its raw size to\n    // this provider's account count would falsely report exhaustion when an\n    // earlier provider in the same request already used up accounts.\n    const tried = getTriedInstances(state);\n    if (active) tried.add(active.id);\n    // The tried-set is request-global and shared across providers after a\n    // route hop, so exhaustion must count only this provider's ids.\n    const triedForProvider = accounts.filter(account => tried.has(account.id)).length;\n    if (triedForProvider >= accounts.length) {\n      return this.declarePoolUnavailable(args, providerId, 'pool-exhausted');\n    }\n\n    // If the selected account was removed elsewhere, even a single survivor\n    // is still untried. Resume from the freshly loaded global cursor.\n    const candidates = active ? accounts : orderAccountsFromActive(accounts, store.getActiveAccount?.(providerId)?.id);\n    const nextCandidate = candidates.find(account => !tried.has(account.id));\n\n    const next = nextCandidate ? store.activateAccount?.(providerId, nextCandidate.id) : undefined;\n    if (!next) {\n      return this.declarePoolUnavailable(args, providerId, 'pool-exhausted');\n    }\n    setRequestAccountSelection(args.requestContext, providerId, next.id);\n    tried.add(next.id);\n\n    // The retry replays the request from scratch (Q10): rotate the assistant\n    // message id so the retried response starts a fresh message instead of\n    // appending to the partially streamed one.\n    args.rotateResponseMessageId?.();\n\n    await emitAccountSwitchPart(args, {\n      provider: providerId,\n      from: active ? { id: active.id, label: active.label } : null,\n      to: { id: next.id, label: next.label },\n      reason: classification.reason,\n      at: new Date().toISOString(),\n    });\n\n    return { retry: true };\n  }\n\n  /**\n   * Resolve the request's host-supplied model route once and cache the reachable\n   * prefix in processor state. Resolution mirrors getDynamicModel so a hop is\n   * never announced for an entry core cannot reach.\n   */\n  private async getModelRouteCascade(args: ProcessAPIErrorArgs): Promise<ModelRouteCascade | null> {\n    if (args.state.modelRouteCascade !== undefined) {\n      return (args.state.modelRouteCascade as ModelRouteCascade | null) ?? null;\n    }\n    const controller = getRoutingController(args);\n    const state = controller?.getState?.();\n    const route = (\n      state?.modelRoute as\n        | { entries?: Array<{ id?: unknown; label?: unknown; modelId?: unknown; accountId?: unknown }> }\n        | undefined\n    )?.entries;\n    const pending = state?.mastracodePendingModelFallback as\n      | { toEntryId?: unknown; threadId?: unknown }\n      | null\n      | undefined;\n    const pendingMatchesThread =\n      pending &&\n      typeof pending.toEntryId === 'string' &&\n      (pending.threadId === undefined || pending.threadId === controller?.threadId);\n    const startIndex = pendingMatchesThread\n      ? route?.findIndex(entry => entry.id === pending.toEntryId)\n      : route?.findIndex(entry => entry.modelId === controller?.session?.modelId);\n    if (!route || startIndex === undefined || startIndex < 0 || route.length - startIndex < 2) {\n      args.state.modelRouteCascade = null;\n      return null;\n    }\n\n    const thinkingLevel = resolveRequestThinkingLevel(\n      {\n        state: { thinkingLevel: state?.thinkingLevel },\n        ...(!this.options.modeless && {\n          session: { modeId: typeof controller?.session?.modeId === 'string' ? controller.session.modeId : 'build' },\n        }),\n      },\n      this.options.settingsPath,\n      args.requestContext && !isThinkingLevelSetting(state?.thinkingLevel)\n        ? await this.options.resolveDefaultThinkingLevel?.({ requestContext: args.requestContext })\n        : undefined,\n    );\n    const entries: ModelRouteCascade['entries'] = [];\n    for (const entry of route.slice(startIndex)) {\n      if (\n        typeof entry.id !== 'string' ||\n        entry.id.length === 0 ||\n        typeof entry.modelId !== 'string' ||\n        entry.modelId.length === 0\n      ) {\n        break;\n      }\n      if (entries.length > 0) {\n        try {\n          resolveModel(entry.modelId, {\n            thinkingLevel,\n            remapForCodexOAuth: true,\n            requestContext: args.requestContext,\n          });\n        } catch {\n          break;\n        }\n      }\n      entries.push({\n        id: entry.id,\n        label: typeof entry.label === 'string' && entry.label.length > 0 ? entry.label : entry.id,\n        modelId: entry.modelId,\n        ...(typeof entry.accountId === 'string' ? { accountId: entry.accountId } : {}),\n      });\n    }\n    if (entries.length < 2) {\n      args.state.modelRouteCascade = null;\n      return null;\n    }\n    const cascade: ModelRouteCascade = { entries, position: 0 };\n    args.state.modelRouteCascade = cascade;\n    return cascade;\n  }\n\n  /**\n   * Q14 gate: 400/unknown/unattributable errors never advance routes. Core's\n   * fallback array advances on ANY thrown error except TripWire\n   * (llm-execution-step.ts), so when the session route has another entry and the\n   * current entry is non-last, a bare `retry: false` would silently hop on an\n   * error class the user excluded from hop triggers. TripWire is the only\n   * no-advance escape: the runner rethrows it and the fallback loop declines\n   * to advance. No chain (or already on the last entry) → return and let the\n   * plain `retry: false` surface the error exactly as before.\n   */\n  private async gateChainHop(args: ProcessAPIErrorArgs, error: unknown): Promise<void> {\n    const cascade = await this.getModelRouteCascade(args);\n    if (!cascade) return;\n    if (cascade.position >= cascade.entries.length - 1) return;\n    const reason = error instanceof Error ? error.message : String(error);\n    throw new TripWire(reason, {}, this.id);\n  }\n\n  /** Announce and persist the next model-route hop before core advances. */\n  private async emitModelFallbackPart(\n    args: ProcessAPIErrorArgs,\n    reason: 'pool-exhausted' | 'persistent-outage',\n  ): Promise<void> {\n    const cascade = await this.getModelRouteCascade(args);\n    if (!cascade) return;\n\n    const from = cascade.entries[cascade.position];\n    const to = cascade.entries[cascade.position + 1];\n    if (!from || !to) return;\n\n    const controller = args.requestContext?.get('controller') as\n      | {\n          threadId?: unknown;\n          setState?: (updates: Record<string, unknown>) => Promise<void>;\n          setThreadSetting?: (setting: { key: string; value: unknown }) => Promise<void>;\n          emitEvent?: (event: { type: 'info'; message: string }) => void;\n        }\n      | undefined;\n    const at = new Date().toISOString();\n    const threadId = typeof controller?.threadId === 'string' ? controller.threadId : undefined;\n    const pending = {\n      fromEntryId: from.id,\n      toEntryId: to.id,\n      toModelId: to.modelId,\n      ...(threadId ? { threadId } : {}),\n      reason,\n      at,\n    } satisfies PendingModelFallback;\n    await controller?.setThreadSetting?.({ key: MODEL_FALLBACK_STATE_KEY, value: pending });\n    const data: ModelFallbackPartData = {\n      from: { entryId: from.id, label: from.label },\n      to: { entryId: to.id, label: to.label },\n      reason,\n      at,\n    };\n    try {\n      await args.writer?.custom({ type: MODEL_FALLBACK_PART_TYPE, data });\n    } catch (error) {\n      await controller?.setThreadSetting?.({ key: MODEL_FALLBACK_STATE_KEY, value: undefined });\n      throw error;\n    }\n    await controller?.setState?.({ [MODEL_FALLBACK_STATE_KEY]: pending });\n    args.state.startNoticeEmitted = false;\n    const targetRoute = resolveAccountRoute(args, to);\n    if (targetRoute) {\n      const store = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n      await applyPreferredAccountRoute(args, store, targetRoute).catch(() => undefined);\n    }\n    controller?.emitEvent?.({ type: 'info', message: modelFallbackNoticeText(data) });\n    cascade.position++;\n  }\n\n  /**\n   * Pool done for this request: every instance recorded in the tried-set and\n   * a `to: null` part emitted. Returns `retry: false` so core's fallback\n   * array can hop to the next route entry (announced by `emitModelFallbackPart`).\n   * Silent on the account part when the provider has no registry at all —\n   * there are no accounts to declare unavailable, but the hop still applies.\n   */\n  private async declarePoolUnavailable(\n    args: ProcessAPIErrorArgs,\n    providerId: string,\n    reason: 'pool-exhausted' | 'persistent-outage',\n    exclusive = false,\n  ): Promise<{ retry: boolean }> {\n    const store = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n    const accounts = store.listAccounts?.(providerId) ?? [];\n    if (accounts.length === 0) {\n      // No account registry (API-key-only provider): nothing rotated, but the\n      // hop still happens — announce the model fallback before core advances.\n      await this.emitModelFallbackPart(args, reason);\n      return { retry: false };\n    }\n\n    const tried = getTriedInstances(args.state);\n    for (const account of accounts) tried.add(account.id);\n\n    const active = getRequestActiveAccount(args, store, providerId);\n\n    await emitAccountSwitchPart(args, {\n      provider: providerId,\n      from: active ? { id: active.id, label: active.label } : null,\n      to: null,\n      reason,\n      at: new Date().toISOString(),\n      ...(exclusive ? { exclusive: true } : {}),\n    });\n\n    await this.emitModelFallbackPart(args, reason);\n\n    return { retry: false };\n  }\n}\n\n/**\n * Applies the pack's preferred account route once per request, before the\n * first model call. Without a route it only reloads the credential store so\n * the request sees accounts changed by other processes.\n *\n * TYPE CONSTRAINT: this class must NEVER implement `processAPIError`. It\n * lives in `inputProcessors`; the runner walks input processors first when\n * running `processAPIError`, so adding the method here would classify and\n * rotate errors BEFORE `StreamErrorRetryProcessor`'s transient retries run.\n */\nexport class AccountStartNoticeProcessor implements Processor {\n  readonly id = 'mastracode-account-start-notice' as const;\n\n  constructor(private readonly options: { credentialStore: CredentialStore }) {}\n\n  async processInput(args: ProcessInputArgs): Promise<ProcessInputResult> {\n    if (args.state.startNoticeEmitted) return args.messageList;\n\n    // Deployed requests resolve the tenant-scoped store so host accounts are\n    // never listed, activated, or announced for a tenant run. Local mode keeps\n    // the constructor's storage.\n    const store = resolveCredentialStore(args.requestContext) ?? this.options.credentialStore;\n\n    const route = resolveAccountRoute(args);\n    if (!route) {\n      store.reload();\n      return args.messageList;\n    }\n\n    // A14: a route whose accounts are all unavailable is not a pre-emptive\n    // abort. `applyPreferredAccountRoute` marks the provider on the request so\n    // credential reads fail closed rather than falling through to the active\n    // account, and the request then runs and fails at the provider — which is\n    // what lets the error lane classify it and hand the turn to the route's\n    // configured fallback chain. The removed persisted set threw here instead,\n    // before any socket opened, so the chain was never reached.\n    const switched = await applyPreferredAccountRoute(args, store, route);\n    if (switched || getRouteTargetAccountId(route) !== undefined) {\n      args.state.startNoticeEmitted = true;\n    }\n    return args.messageList;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,2BAA2B;;AAqCxC,MAAM,qBAAqB,IAAI,IAAI,kBAAkB,CAAC,CAAC,KAAI,aAAY,SAAS,EAAE,CAAC;;AAGnF,MAAM,yBAAkD;CACtD,CAAC,+BAA+B,WAAW;CAC3C,CAAC,0BAA0B,iBAAiB;CAC5C,CAAC,sBAAsB,KAAK;CAC5B,CAAC,wBAAwB,cAAc;CACvC,CAAC,kCAAkC,cAAc;CACjD,CAAC,8BAA8B,gBAAgB;CAC/C,CAAC,4BAA4B,gBAAgB;AAC/C;;;;;;;;AASA,MAAM,8BACJ;AAEF,MAAM,sCAAsB,IAAI,IAAI;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,0BACJ;AAEF,MAAM,kBAAkB;;AAGxB,MAAa,2BAA2B;;AAWxC,MAAa,2BAA2B;AAiBxC,SAAS,gBAAgB,OAA6C;CACpE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU;AAClE;AAEA,SAAS,gBAAgB,OAAoC;CAC3D,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,EAAE,YAAY,WAAW;EAC/B,IAAI,OAAO,eAAe,UAAU,OAAO;EAC3C,IAAI,OAAO,WAAW,UAAU,OAAO;EACvC,UAAW,QAAgC;CAC7C;AAEF;AAEA,SAAS,4BAA4B,OAAyB;CAC5D,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IACE,mBAAmB,6BAClB,mBAAmB,SAAS,QAAQ,SAAA,6BAErC,OAAO;EAET,IAAI,OAAO,YAAY,UAAU;EACjC,UAAW,QAAgC;CAC7C;CACA,OAAO;AACT;;AAGA,SAAS,iBAAiB,OAAwB;CAChD,MAAM,QAAkB,CAAC;CACzB,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SACtD,IAAI,mBAAmB,OAAO;EAC5B,MAAM,KAAK,QAAQ,OAAO;EAC1B,UAAU,QAAQ;CACpB,OAAO,IAAI,OAAO,YAAY,YAAY,aAAa,SAAS;EAC9D,MAAM,UAAW,QAAkC;EACnD,IAAI,OAAO,YAAY,UAAU,MAAM,KAAK,OAAO;EACnD,UAAW,QAAgC;CAC7C,OACE;CAGJ,OAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,mBAAmB,OAAyB;CACnD,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IACE,gBAAgB,OAAO,KACvB,OAAO,QAAQ,SAAS,YACxB,oBAAoB,IAAI,QAAQ,KAAK,YAAY,CAAC,GAElD,OAAO;EAET,IAAI,mBAAmB,OAAO;GAC5B,IAAI,wBAAwB,KAAK,QAAQ,OAAO,GAAG,OAAO;GAC1D,UAAU,QAAQ;EACpB,OAAO,IAAI,OAAO,YAAY,UAC5B,UAAW,QAAgC;OAE3C;CAEJ;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,sBAAsB,OAAwC;CAC5E,IAAI,4BAA4B,KAAK,GACnC,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAc;CAGjD,MAAM,SAAS,gBAAgB,KAAK;CAEpC,IAAI,WAAW,KAAK,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAa;CAClE,IAAI,WAAW,KAAK,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAkB;CACvE,IAAI,WAAW,OAAO,WAAW,KAAK,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAc;CACrF,IAAI,WAAW,KAAA,KAAa,UAAU,OAAO,SAAS,KAAK,OAAO,EAAE,MAAM,MAAM;CAOhF,IAAI,WAAW,KAAA,KAAa,WAAW,KACjC;MAAA,4BAA4B,KAAK,iBAAiB,KAAK,CAAC,GAC1D,OAAO;GAAE,MAAM;GAAU,QAAQ;EAAkB;CAAA;CAGvD,IAAI,mBAAmB,KAAK,GAAG,OAAO,EAAE,MAAM,MAAM;CAEpD,OAAO,EAAE,MAAM,QAAQ;AACzB;;AAGA,SAAgB,oBAAoB,SAAqC;CACvE,MAAM,WAAW,uBAAuB,OAAO,CAAC,CAC7C,QAAQ,iBAAiB,EAAE,CAAC,CAC5B,MAAM,GAAG;CACZ,MAAM,aAAa,SAAS,KAAK,wBAAwB,SAAS,EAAE,IAAI,KAAA;CACxE,OAAO,cAAc,mBAAmB,IAAI,UAAU,IAAI,aAAa,KAAA;AACzE;AAEA,SAAS,iBAAiB,UAAsC;CAC9D,KAAK,MAAM,CAAC,SAAS,eAAe,wBAClC,IAAI,QAAQ,KAAK,QAAQ,GAAG,OAAO;AAGvC;;;;;;AAOA,SAAgB,kBAAkB,OAAoC;CACpE,MAAM,aAAuB,CAAC;CAC9B,IAAI,UAAmB;CACvB,KAAK,IAAI,QAAQ,GAAG,WAAW,QAAQ,iBAAiB,SAAS;EAC/D,IAAI,OAAO,YAAY,UAAU;EACjC,WAAW,KAAK,OAAO;EACvB,UAAW,QAAgC;CAC7C;CAMA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,OAAO;GACV,KAA2B;GAC3B,KAAkC;GAClC,KAAkC;EACrC;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,OAAO,QAAQ,UAAU;GAC7B,IAAI;IACF,MAAM,aAAa,iBAAiB,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;IACzD,IAAI,YAAY,OAAO;GACzB,QAAQ,CAER;EACF;CACF;CAEA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,UAAW,KAA+B;EAChD,IAAI,OAAO,YAAY,UAAU;EACjC,MAAM,aAAa,oBAAoB,OAAO;EAC9C,IAAI,YAAY,OAAO;CACzB;AAEF;AAEA,SAAS,kBAAkB,OAA6C;CACtE,MAAM,WAAW,MAAM;CACvB,IAAI,oBAAoB,KAAK,OAAO;CACpC,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,iBAAiB;CACvB,OAAO;AACT;AAEA,SAAS,0BAA0B,OAA6C;CAC9E,MAAM,WAAW,MAAM;CACvB,IAAI,oBAAoB,KAAK,OAAO;CACpC,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,oBAAoB;CAC1B,OAAO;AACT;;AAGA,MAAa,yBAAiD;CAC5D,WAAW;CACX,mBAAmB;CACnB,gBAAgB;CAChB,kBAAkB;CAClB,KAAK;AACP;AAEA,MAAM,cAA+D;CACnE,cAAc;CACd,mBAAmB;CACnB,eAAe;CACf,kBAAkB;CAClB,qBAAqB;CACrB,qBAAqB;AACvB;;AAGA,SAAgB,sBAAsB,OAA0D;CAG9F,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,eAAe,KAAK,aAAa,KAAK;AAC7F;;;;;;;AAQA,SAAgB,wBAAwB,MAAqC;CAC3E,MAAM,WAAW,uBAAuB,KAAK,aAAa,KAAK;CAC/D,MAAM,SAAS,YAAY,KAAK;CAChC,IAAI,KAAK,OAAO,MAAM;EAIpB,IAAI,KAAK,WACP,OAAO,UAAU,SAAS,wBAAwB,OAAO;EAE3D,OAAO,OAAO,SAAS,yBAAyB,OAAO;CACzD;CAEA,OAAO,YAAY,SAAS,YADf,KAAK,MAAM,SAAS,UACY,KAAK,KAAK,GAAG,MAAM,IAAI,OAAO;AAC7E;;AAGA,SAAgB,wBAAwB,MAAqC;CAC3E,MAAM,SAAS,YAAY,KAAK,WAAW,KAAK;CAChD,OAAO,yBAAyB,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,OAAO;AAChF;;;;;;;;AASA,SAAgB,sBAAsB,OAA0D;CAC9F,OAAO,UAAU,oBAAoB,UAAU;AACjD;AAEA,eAAe,sBACb,MACA,MACe;CAGf,MAAM,KAAK,QAAQ,OAAO;EACxB,MAAM;EACN;CACF,CAAC;CAOD,CAH0B,KAAK,gBAAgB,IAAI,YAAY,EAAA,EAG5C,YAAY;EAAE,MAAM;EAAQ,SAAS,wBAAwB,IAAI;CAAE,CAAC;AACzF;;;;;;;AAQA,SAAS,oBACP,MACoB;CAEpB,MAAM,WADa,KAAK,gBAAgB,IAAI,YAAY,EAAA,EAC5B,SAAS;CACrC,OAAO,OAAO,YAAY,WAAW,oBAAoB,OAAO,IAAI,KAAA;AACtE;AAmCA,SAAS,qBACP,MACsC;CACtC,OAAO,KAAK,gBAAgB,IAAI,YAAY;AAC9C;;AAGA,SAAS,wBAAwB,OAAgD;CAC/E,OAAO,OAAO;AAChB;AAEA,SAAS,wBACP,MACA,OACA,YACA;CACA,IAAI,iCAAiC,KAAK,gBAAgB,UAAU,GAAG,OAAO,KAAA;CAC9E,MAAM,aAAa,2BAA2B,KAAK,gBAAgB,UAAU;CAC7E,IAAI,YAAY,OAAO,MAAM,eAAe,UAAU,CAAC,CAAC,MAAK,YAAW,QAAQ,OAAO,UAAU;CACjG,OAAO,MAAM,mBAAmB,UAAU,KAAK,MAAM,eAAe,UAAU,CAAC,CAAC,MAAK,YAAW,QAAQ,MAAM;AAChH;AAEA,SAAS,oBACP,MACA,UACqB;CACrB,MAAM,aAAa,qBAAqB,IAAI;CAC5C,MAAM,QAAQ,YAAY,WAAW;CACrC,MAAM,UAAU,OAAO;CAIvB,MAAM,uBACJ,WACA,OAAO,QAAQ,cAAc,YAC7B,OAAO,QAAQ,cAAc,aAC5B,QAAQ,aAAa,KAAA,KAAa,QAAQ,aAAa,YAAY;CACtE,MAAM,eAAe,MAAM,SAAS,OAAO,WAAA,EAAkD,OAAO,KAC9F,OAAO,WAAA,CAA4F,WACrG,CAAC,IACD,CAAC;CACL,MAAM,QAAQ,WACV,WACA,uBACE,aAAa,MAAK,cAAa,UAAU,OAAO,QAAQ,aAAa,UAAU,YAAY,QAAQ,SAAS,IAC5G,aAAa,MAAK,cAAa,UAAU,YAAY,YAAY,SAAS,OAAO;CACvF,IAAI,CAAC,SAAS,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,YAAY,UAAU,OAAO;CACxF,MAAM,aAAa,oBAAoB,MAAM,OAAO;CACpD,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO;EACL,SAAS,MAAM;EACf,SAAS,MAAM;EACf;EACA,GAAI,OAAO,MAAM,cAAc,WAAW,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CAC9E;AACF;;;;;;;;;AAUA,SAAS,wBAAwB,UAAgC,UAA8B;CAC7F,MAAM,QAAQ,aAAa,KAAA,IAAY,KAAK,SAAS,WAAU,YAAW,QAAQ,OAAO,QAAQ;CACjG,IAAI,SAAS,GAAG,OAAO;CACvB,OAAO,CAAC,GAAG,SAAS,MAAM,KAAK,GAAG,GAAG,SAAS,MAAM,GAAG,KAAK,CAAC;AAC/D;AAEA,eAAe,2BACb,MACA,OACA,OACkB;CAClB,MAAM,OAAO;CACb,MAAM,cAAc,wBAAwB,KAAK;CACjD,MAAM,WAAW,MAAM,eAAe,MAAM,UAAU,KAAK,CAAC;CAC5D,IAAI,SAAS,WAAW,KAAK,gBAAgB,KAAA,GAAW,OAAO;CAC/D,MAAM,QAAQ,kBAAkB,KAAK,KAAK;CAC1C,MAAM,cAAc,IAAI,IAAI,SAAS,QAAO,YAAW,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAI,YAAW,QAAQ,EAAE,CAAC;CACxG,MAAM,SAAS,wBAAwB,MAAM,OAAO,MAAM,UAAU,KAAK,MAAM,mBAAmB,MAAM,UAAU;CAClH,MAAM,YAIF,cACI,SAAS,QAAO,YAAW,QAAQ,OAAO,WAAW,IACrD,wBAAwB,UAAU,QAAQ,EAAE,EAAA,CAChD,MAAK,YAAW,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAC;CAEhD,KAAK,MAAM,aAAa,aAAa,MAAM,IAAI,SAAS;CACxD,IAAI,CAAC,UAAU;EACb,mCAAmC,KAAK,gBAAgB,MAAM,UAAU;EACxE,OAAO;CACT;CAEA,IAAI,QAAQ,OAAO,SAAS,IAAI;EAC9B,2BAA2B,KAAK,gBAAgB,MAAM,YAAY,SAAS,EAAE;EAC7E,OAAO;CACT;CAIA,MAAM,YAAY,MAAM,kBAAkB,MAAM,gBAAgB,MAAM,YAAY,SAAS,EAAE,IAAI;CACjG,IAAI,CAAC,WAAW;EAId,IAAI,gBAAgB,KAAA,GAAW,mCAAmC,KAAK,gBAAgB,MAAM,UAAU;EACvG,OAAO;CACT;CACA,2BAA2B,KAAK,gBAAgB,MAAM,YAAY,UAAU,EAAE;CAG9E,IAAI,gBAAgB,KAAA,GAClB,MAAM,sBAAsB,MAAM;EAChC,UAAU,MAAM;EAChB,MAAM,SAAS;GAAE,IAAI,OAAO;GAAI,OAAO,OAAO;EAAM,IAAI;EACxD,IAAI;GAAE,IAAI,UAAU;GAAI,OAAO,UAAU;EAAM;EAC/C,QAAQ;EACR,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;CAC7B,CAAC;CAEH,OAAO;AACT;AAEA,IAAa,2BAAb,MAA2D;CAItC;CAHnB,KAAc;CAEd,YACE,SAWA;EAXiB,KAAA,UAAA;CAWhB;CAEH,MAAM,gBAAgB,MAAwD;EAC5E,MAAM,EAAE,OAAO,UAAU;EASzB,IAAI,KAAK,cAAc,KAAK,QAAQ,qBAAqB;GACvD,MAAM,KAAK,aAAa,MAAM,KAAK;GACnC,OAAO,EAAE,OAAO,MAAM;EACxB;EAKA,MAAM,iBAAiB,sBAAsB,KAAK;EAKlD,IAAI,eAAe,SAAS,SAAS;GACnC,MAAM,KAAK,aAAa,MAAM,KAAK;GACnC,OAAO,EAAE,OAAO,MAAM;EACxB;EAEA,MAAM,UAAU,MAAM,KAAK,qBAAqB,IAAI;EACpD,MAAM,eAAe,SAAS,QAAQ,QAAQ;EAC9C,MAAM,aACJ,kBAAkB,KAAK,MACtB,eAAe,oBAAoB,aAAa,OAAO,IAAI,KAAA,OAC3D,UAAU,KAAA,IAAY,oBAAoB,IAAI;EACjD,IAAI,CAAC,YAAY;GACf,MAAM,KAAK,sBAAsB,MAAM,eAAe,SAAS,QAAQ,sBAAsB,gBAAgB;GAC7G,OAAO,EAAE,OAAO,MAAM;EACxB;EAQA,MAAM,QAAiC,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ;EACnG,MAAM,OAAO;EACb,MAAM,WAAW,MAAM,eAAe,UAAU,KAAK,CAAC;EACtD,MAAM,SAAS,wBAAwB,MAAM,OAAO,UAAU;EAC9D,MAAM,QAAQ,eAAe,oBAAoB,MAAM,YAAY,IAAI,oBAAoB,IAAI;EAU/F,IAAI,eAAe,SAAS,YAAY,eAAe,WAAW,iBAAiB,QAAQ;GACzF,MAAM,SAAS,0BAA0B,KAAK;GAC9C,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,MAAM;GAClD,IAAI,CAAC,OAAO,IAAI,UAAU,KAAK,OAAO,MAAM,8BAA8B,YAAY;IACpF,OAAO,IAAI,UAAU;IAErB,IAAI,MADgB,MAAM,0BAA0B,YAAY,QAAQ,EAAE,MAC5D,KAAA,GACZ,OAAO,EAAE,OAAO,KAAK;GAEzB;EACF;EAQA,MAAM,kBAAkB,OAAO,eAAe,aAAa,wBAAwB,KAAK,IAAI,KAAA;EAE5F,IAAI,eAAe,SAAS,OAC1B,OAAO,KAAK,uBAAuB,MAAM,YAAY,qBAAqB,oBAAoB,KAAA,CAAS;EASzG,IAAI,oBAAoB,KAAA,GACtB,OAAO,KAAK,uBAAuB,MAAM,YAAY,kBAAkB,IAAI;EAO7E,MAAM,QAAQ,kBAAkB,KAAK;EACrC,IAAI,QAAQ,MAAM,IAAI,OAAO,EAAE;EAI/B,IADyB,SAAS,QAAO,YAAW,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,UACnD,SAAS,QAC/B,OAAO,KAAK,uBAAuB,MAAM,YAAY,gBAAgB;EAMvE,MAAM,iBADa,SAAS,WAAW,wBAAwB,UAAU,MAAM,mBAAmB,UAAU,CAAC,EAAE,EAAE,EAAA,CAChF,MAAK,YAAW,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;EAEvE,MAAM,OAAO,gBAAgB,MAAM,kBAAkB,YAAY,cAAc,EAAE,IAAI,KAAA;EACrF,IAAI,CAAC,MACH,OAAO,KAAK,uBAAuB,MAAM,YAAY,gBAAgB;EAEvE,2BAA2B,KAAK,gBAAgB,YAAY,KAAK,EAAE;EACnE,MAAM,IAAI,KAAK,EAAE;EAKjB,KAAK,0BAA0B;EAE/B,MAAM,sBAAsB,MAAM;GAChC,UAAU;GACV,MAAM,SAAS;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM,IAAI;GACxD,IAAI;IAAE,IAAI,KAAK;IAAI,OAAO,KAAK;GAAM;GACrC,QAAQ,eAAe;GACvB,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;EAC7B,CAAC;EAED,OAAO,EAAE,OAAO,KAAK;CACvB;;;;;;CAOA,MAAc,qBAAqB,MAA8D;EAC/F,IAAI,KAAK,MAAM,sBAAsB,KAAA,GACnC,OAAQ,KAAK,MAAM,qBAAkD;EAEvE,MAAM,aAAa,qBAAqB,IAAI;EAC5C,MAAM,QAAQ,YAAY,WAAW;EACrC,MAAM,SACJ,OAAO,WAAA,EAGN;EACH,MAAM,UAAU,OAAO;EAQvB,MAAM,aAHJ,WACA,OAAO,QAAQ,cAAc,aAC5B,QAAQ,aAAa,KAAA,KAAa,QAAQ,aAAa,YAAY,YAElE,OAAO,WAAU,UAAS,MAAM,OAAO,QAAQ,SAAS,IACxD,OAAO,WAAU,UAAS,MAAM,YAAY,YAAY,SAAS,OAAO;EAC5E,IAAI,CAAC,SAAS,eAAe,KAAA,KAAa,aAAa,KAAK,MAAM,SAAS,aAAa,GAAG;GACzF,KAAK,MAAM,oBAAoB;GAC/B,OAAO;EACT;EAEA,MAAM,gBAAgB,4BACpB;GACE,OAAO,EAAE,eAAe,OAAO,cAAc;GAC7C,GAAI,CAAC,KAAK,QAAQ,YAAY,EAC5B,SAAS,EAAE,QAAQ,OAAO,YAAY,SAAS,WAAW,WAAW,WAAW,QAAQ,SAAS,QAAQ,EAC3G;EACF,GACA,KAAK,QAAQ,cACb,KAAK,kBAAkB,CAAC,uBAAuB,OAAO,aAAa,IAC/D,MAAM,KAAK,QAAQ,8BAA8B,EAAE,gBAAgB,KAAK,eAAe,CAAC,IACxF,KAAA,CACN;EACA,MAAM,UAAwC,CAAC;EAC/C,KAAK,MAAM,SAAS,MAAM,MAAM,UAAU,GAAG;GAC3C,IACE,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,WAAW,KACpB,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,WAAW,GAEzB;GAEF,IAAI,QAAQ,SAAS,GACnB,IAAI;IACF,aAAa,MAAM,SAAS;KAC1B;KACA,oBAAoB;KACpB,gBAAgB,KAAK;IACvB,CAAC;GACH,QAAQ;IACN;GACF;GAEF,QAAQ,KAAK;IACX,IAAI,MAAM;IACV,OAAO,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ,MAAM;IACvF,SAAS,MAAM;IACf,GAAI,OAAO,MAAM,cAAc,WAAW,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GAC9E,CAAC;EACH;EACA,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,oBAAoB;GAC/B,OAAO;EACT;EACA,MAAM,UAA6B;GAAE;GAAS,UAAU;EAAE;EAC1D,KAAK,MAAM,oBAAoB;EAC/B,OAAO;CACT;;;;;;;;;;;CAYA,MAAc,aAAa,MAA2B,OAA+B;EACnF,MAAM,UAAU,MAAM,KAAK,qBAAqB,IAAI;EACpD,IAAI,CAAC,SAAS;EACd,IAAI,QAAQ,YAAY,QAAQ,QAAQ,SAAS,GAAG;EACpD,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACpE,MAAM,IAAI,SAAS,QAAQ,CAAC,GAAG,KAAK,EAAE;CACxC;;CAGA,MAAc,sBACZ,MACA,QACe;EACf,MAAM,UAAU,MAAM,KAAK,qBAAqB,IAAI;EACpD,IAAI,CAAC,SAAS;EAEd,MAAM,OAAO,QAAQ,QAAQ,QAAQ;EACrC,MAAM,KAAK,QAAQ,QAAQ,QAAQ,WAAW;EAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI;EAElB,MAAM,aAAa,KAAK,gBAAgB,IAAI,YAAY;EAQxD,MAAM,sBAAK,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,MAAM,WAAW,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW,KAAA;EAClF,MAAM,UAAU;GACd,aAAa,KAAK;GAClB,WAAW,GAAG;GACd,WAAW,GAAG;GACd,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;GAC/B;GACA;EACF;EACA,MAAM,YAAY,mBAAmB;GAAE,KAAK;GAA0B,OAAO;EAAQ,CAAC;EACtF,MAAM,OAA8B;GAClC,MAAM;IAAE,SAAS,KAAK;IAAI,OAAO,KAAK;GAAM;GAC5C,IAAI;IAAE,SAAS,GAAG;IAAI,OAAO,GAAG;GAAM;GACtC;GACA;EACF;EACA,IAAI;GACF,MAAM,KAAK,QAAQ,OAAO;IAAE,MAAM;IAA0B;GAAK,CAAC;EACpE,SAAS,OAAO;GACd,MAAM,YAAY,mBAAmB;IAAE,KAAK;IAA0B,OAAO,KAAA;GAAU,CAAC;GACxF,MAAM;EACR;EACA,MAAM,YAAY,WAAW,GAAG,2BAA2B,QAAQ,CAAC;EACpE,KAAK,MAAM,qBAAqB;EAChC,MAAM,cAAc,oBAAoB,MAAM,EAAE;EAChD,IAAI,aAEF,MAAM,2BAA2B,MADnB,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ,iBAC5B,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;EAElF,YAAY,YAAY;GAAE,MAAM;GAAQ,SAAS,wBAAwB,IAAI;EAAE,CAAC;EAChF,QAAQ;CACV;;;;;;;;CASA,MAAc,uBACZ,MACA,YACA,QACA,YAAY,OACiB;EAC7B,MAAM,QAAQ,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ;EAC1E,MAAM,WAAW,MAAM,eAAe,UAAU,KAAK,CAAC;EACtD,IAAI,SAAS,WAAW,GAAG;GAGzB,MAAM,KAAK,sBAAsB,MAAM,MAAM;GAC7C,OAAO,EAAE,OAAO,MAAM;EACxB;EAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK;EAC1C,KAAK,MAAM,WAAW,UAAU,MAAM,IAAI,QAAQ,EAAE;EAEpD,MAAM,SAAS,wBAAwB,MAAM,OAAO,UAAU;EAE9D,MAAM,sBAAsB,MAAM;GAChC,UAAU;GACV,MAAM,SAAS;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM,IAAI;GACxD,IAAI;GACJ;GACA,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;GAC3B,GAAI,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACzC,CAAC;EAED,MAAM,KAAK,sBAAsB,MAAM,MAAM;EAE7C,OAAO,EAAE,OAAO,MAAM;CACxB;AACF;;;;;;;;;;;AAYA,IAAa,8BAAb,MAA8D;CAG/B;CAF7B,KAAc;CAEd,YAAY,SAAgE;EAA/C,KAAA,UAAA;CAAgD;CAE7E,MAAM,aAAa,MAAqD;EACtE,IAAI,KAAK,MAAM,oBAAoB,OAAO,KAAK;EAK/C,MAAM,QAAQ,uBAAuB,KAAK,cAAc,KAAK,KAAK,QAAQ;EAE1E,MAAM,QAAQ,oBAAoB,IAAI;EACtC,IAAI,CAAC,OAAO;GACV,MAAM,OAAO;GACb,OAAO,KAAK;EACd;EAUA,IAAI,MADmB,2BAA2B,MAAM,OAAO,KAAK,KACpD,wBAAwB,KAAK,MAAM,KAAA,GACjD,KAAK,MAAM,qBAAqB;EAElC,OAAO,KAAK;CACd;AACF"}

package/dist/auth/providers/anthropic.js

@@ -64,7 +64,7 @@ async function completeAnthropicLogin(input, verifier) {
 	});
 	if (!tokenResponse.ok) throw new Error(`Token exchange failed: ${tokenResponse.status}`);
 	const tokenData = await tokenResponse.json();
-	const expiresAt = Date.now() + tokenData.expires_in * 1e3 - 300 * 1e3;
+	const expiresAt = Date.now() + tokenData.expires_in * 1e3 - 3e5;
 	return {
 		refresh: tokenData.refresh_token,
 		access: tokenData.access_token,
@@ -98,7 +98,7 @@ async function refreshAnthropicToken(refreshToken) {
 	return {
 		refresh: data.refresh_token,
 		access: data.access_token,
-		expires: Date.now() + data.expires_in * 1e3 - 300 * 1e3
+		expires: Date.now() + data.expires_in * 1e3 - 3e5
 	};
 }
 const anthropicOAuthProvider = {

package/dist/auth/providers/anthropic.js.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic.js","names":[],"sources":["../../../src/auth/providers/anthropic.ts"],"sourcesContent":["/**\n * Anthropic OAuth flow (Claude Pro/Max)\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts\n *\n * The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted\n * callback page which displays `code#state` for the user to paste back. That\n * makes it deployable without any inbound connection to the server, so the\n * primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`\n * which can span separate HTTP requests (only the PKCE verifier needs to be\n * persisted in between).\n */\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');\nconst AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';\n// pi-mono uses `https://platform.claude.com/v1/oauth/token` with extra scopes\n// (user:sessions:claude_code, user:mcp_servers, user:file_upload); we keep the\n// console.anthropic.com endpoints that are known to work for our scope set.\nconst TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';\nconst REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';\nconst SCOPES = 'org:create_api_key user:profile user:inference';\n\nexport interface AnthropicLoginStart {\n  /** Authorization URL for the user to open. */\n  url: string;\n  /** PKCE code verifier — persist it to complete the login later. */\n  verifier: string;\n}\n\n/**\n * Start an Anthropic login: generate PKCE state and build the authorization URL.\n */\nexport async function startAnthropicLogin(): Promise<AnthropicLoginStart> {\n  const { verifier, challenge } = await generatePKCE();\n\n  const authParams = new URLSearchParams({\n    code: 'true',\n    client_id: CLIENT_ID,\n    response_type: 'code',\n    redirect_uri: REDIRECT_URI,\n    scope: SCOPES,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state: verifier,\n  });\n\n  return { url: `${AUTHORIZE_URL}?${authParams.toString()}`, verifier };\n}\n\n/**\n * Complete an Anthropic login: parse the pasted authorization input\n * (full URL, `code#state`, or query string), validate its state, and exchange\n * it for tokens using the verifier from `startAnthropicLogin()`.\n */\nexport async function completeAnthropicLogin(input: string, verifier: string): Promise<OAuthCredentials> {\n  const { code, state } = parseAuthorizationInput(input);\n  if (!code) {\n    throw new Error('Missing authorization code');\n  }\n  if (!state || state !== verifier) {\n    throw new Error('Invalid authorization state');\n  }\n\n  const tokenResponse = await fetch(TOKEN_URL, {\n    method: 'POST',\n    // Bound the OAuth exchange so an unresponsive upstream cannot pin the\n    // caller (and, in the shipyard server, the containing project lock)\n    // indefinitely. See 2025-07-23 shipyard latency incident.\n    signal: AbortSignal.timeout(15_000),\n    headers: {\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      grant_type: 'authorization_code',\n      client_id: CLIENT_ID,\n      code,\n      state,\n      redirect_uri: REDIRECT_URI,\n      code_verifier: verifier,\n    }),\n  });\n\n  if (!tokenResponse.ok) {\n    throw new Error(`Token exchange failed: ${tokenResponse.status}`);\n  }\n\n  const tokenData = (await tokenResponse.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  // Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n  const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n  return {\n    refresh: tokenData.refresh_token,\n    access: tokenData.access_token,\n    expires: expiresAt,\n  };\n}\n\n/**\n * Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.\n */\nexport async function loginAnthropic(\n  onAuthUrl: (url: string) => void,\n  onPromptCode: () => Promise<string>,\n): Promise<OAuthCredentials> {\n  const { url, verifier } = await startAnthropicLogin();\n\n  // Notify caller with URL to open\n  onAuthUrl(url);\n\n  // Wait for user to paste authorization code (format: code#state)\n  const authCode = await onPromptCode();\n\n  return completeAnthropicLogin(authCode, verifier);\n}\n\n/**\n * Refresh Anthropic OAuth token\n */\nexport async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    signal: AbortSignal.timeout(15_000),\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    }),\n  });\n\n  if (!response.ok) {\n    throw new Error(`Anthropic token refresh failed: ${response.status}`);\n  }\n\n  const data = (await response.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  return {\n    refresh: data.refresh_token,\n    access: data.access_token,\n    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n  };\n}\n\nexport const anthropicOAuthProvider: OAuthProviderInterface = {\n  id: 'anthropic',\n  name: 'Anthropic (Claude Pro/Max)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginAnthropic(\n      url => callbacks.onAuth({ url }),\n      () => callbacks.onPrompt({ message: 'Paste the authorization code:' }),\n    );\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshAnthropicToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,MAAM,UAAU,MAAc,KAAK,CAAC;AACpC,MAAM,YAAY,OAAO,kDAAkD;AAC3E,MAAM,gBAAgB;AAItB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,SAAS;;;;AAYf,eAAsB,sBAAoD;CACxE,MAAM,EAAE,UAAU,cAAc,MAAM,aAAa;CAEnD,MAAM,aAAa,IAAI,gBAAgB;EACrC,MAAM;EACN,WAAW;EACX,eAAe;EACf,cAAc;EACd,OAAO;EACP,gBAAgB;EAChB,uBAAuB;EACvB,OAAO;CACT,CAAC;CAED,OAAO;EAAE,KAAK,GAAG,cAAc,GAAG,WAAW,SAAS;EAAK;CAAS;AACtE;;;;;;AAOA,eAAsB,uBAAuB,OAAe,UAA6C;CACvG,MAAM,EAAE,MAAM,UAAU,wBAAwB,KAAK;CACrD,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,CAAC,SAAS,UAAU,UACtB,MAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,gBAAgB,MAAM,MAAM,WAAW;EAC3C,QAAQ;EAIR,QAAQ,YAAY,QAAQ,IAAM;EAClC,SAAS,EACP,gBAAgB,mBAClB;EACA,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,WAAW;GACX;GACA;GACA,cAAc;GACd,eAAe;EACjB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,MAAM,0BAA0B,cAAc,QAAQ;CAGlE,MAAM,YAAa,MAAM,cAAc,KAAK;CAO5C,MAAM,YAAY,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO,MAAS;CAEtE,OAAO;EACL,SAAS,UAAU;EACnB,QAAQ,UAAU;EAClB,SAAS;CACX;AACF;;;;AAKA,eAAsB,eACpB,WACA,cAC2B;CAC3B,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;CAGpD,UAAU,GAAG;CAKb,OAAO,uBAAuB,MAFP,aAAa,GAEI,QAAQ;AAClD;;;;AAKA,eAAsB,sBAAsB,cAAiD;CAC3F,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,QAAQ,YAAY,QAAQ,IAAM;EAClC,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,WAAW;GACX,eAAe;EACjB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;CAGtE,MAAM,OAAQ,MAAM,SAAS,KAAK;CAMlC,OAAO;EACL,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO,MAAS;CAC1D;AACF;AAEA,MAAa,yBAAiD;CAC5D,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,gBACL,QAAO,UAAU,OAAO,EAAE,IAAI,CAAC,SACzB,UAAU,SAAS,EAAE,SAAS,gCAAgC,CAAC,CACvE;CACF;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,sBAAsB,YAAY,OAAO;CAClD;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}
+{"version":3,"file":"anthropic.js","names":[],"sources":["../../../src/auth/providers/anthropic.ts"],"sourcesContent":["/**\n * Anthropic OAuth flow (Claude Pro/Max)\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/anthropic.ts\n *\n * The flow is a paste-code PKCE flow: the redirect lands on Anthropic's hosted\n * callback page which displays `code#state` for the user to paste back. That\n * makes it deployable without any inbound connection to the server, so the\n * primitives are split into `startAnthropicLogin()` / `completeAnthropicLogin()`\n * which can span separate HTTP requests (only the PKCE verifier needs to be\n * persisted in between).\n */\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst decode = (s: string) => atob(s);\nconst CLIENT_ID = decode('OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl');\nconst AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';\n// pi-mono uses `https://platform.claude.com/v1/oauth/token` with extra scopes\n// (user:sessions:claude_code, user:mcp_servers, user:file_upload); we keep the\n// console.anthropic.com endpoints that are known to work for our scope set.\nconst TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';\nconst REDIRECT_URI = 'https://console.anthropic.com/oauth/code/callback';\nconst SCOPES = 'org:create_api_key user:profile user:inference';\n\nexport interface AnthropicLoginStart {\n  /** Authorization URL for the user to open. */\n  url: string;\n  /** PKCE code verifier — persist it to complete the login later. */\n  verifier: string;\n}\n\n/**\n * Start an Anthropic login: generate PKCE state and build the authorization URL.\n */\nexport async function startAnthropicLogin(): Promise<AnthropicLoginStart> {\n  const { verifier, challenge } = await generatePKCE();\n\n  const authParams = new URLSearchParams({\n    code: 'true',\n    client_id: CLIENT_ID,\n    response_type: 'code',\n    redirect_uri: REDIRECT_URI,\n    scope: SCOPES,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state: verifier,\n  });\n\n  return { url: `${AUTHORIZE_URL}?${authParams.toString()}`, verifier };\n}\n\n/**\n * Complete an Anthropic login: parse the pasted authorization input\n * (full URL, `code#state`, or query string), validate its state, and exchange\n * it for tokens using the verifier from `startAnthropicLogin()`.\n */\nexport async function completeAnthropicLogin(input: string, verifier: string): Promise<OAuthCredentials> {\n  const { code, state } = parseAuthorizationInput(input);\n  if (!code) {\n    throw new Error('Missing authorization code');\n  }\n  if (!state || state !== verifier) {\n    throw new Error('Invalid authorization state');\n  }\n\n  const tokenResponse = await fetch(TOKEN_URL, {\n    method: 'POST',\n    // Bound the OAuth exchange so an unresponsive upstream cannot pin the\n    // caller (and, in the shipyard server, the containing project lock)\n    // indefinitely. See 2025-07-23 shipyard latency incident.\n    signal: AbortSignal.timeout(15_000),\n    headers: {\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify({\n      grant_type: 'authorization_code',\n      client_id: CLIENT_ID,\n      code,\n      state,\n      redirect_uri: REDIRECT_URI,\n      code_verifier: verifier,\n    }),\n  });\n\n  if (!tokenResponse.ok) {\n    throw new Error(`Token exchange failed: ${tokenResponse.status}`);\n  }\n\n  const tokenData = (await tokenResponse.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  // Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n  const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n  return {\n    refresh: tokenData.refresh_token,\n    access: tokenData.access_token,\n    expires: expiresAt,\n  };\n}\n\n/**\n * Login with Anthropic OAuth (paste-code flow), blocking on the prompt callback.\n */\nexport async function loginAnthropic(\n  onAuthUrl: (url: string) => void,\n  onPromptCode: () => Promise<string>,\n): Promise<OAuthCredentials> {\n  const { url, verifier } = await startAnthropicLogin();\n\n  // Notify caller with URL to open\n  onAuthUrl(url);\n\n  // Wait for user to paste authorization code (format: code#state)\n  const authCode = await onPromptCode();\n\n  return completeAnthropicLogin(authCode, verifier);\n}\n\n/**\n * Refresh Anthropic OAuth token\n */\nexport async function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials> {\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    signal: AbortSignal.timeout(15_000),\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    }),\n  });\n\n  if (!response.ok) {\n    throw new Error(`Anthropic token refresh failed: ${response.status}`);\n  }\n\n  const data = (await response.json()) as {\n    access_token: string;\n    refresh_token: string;\n    expires_in: number;\n  };\n\n  return {\n    refresh: data.refresh_token,\n    access: data.access_token,\n    expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n  };\n}\n\nexport const anthropicOAuthProvider: OAuthProviderInterface = {\n  id: 'anthropic',\n  name: 'Anthropic (Claude Pro/Max)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginAnthropic(\n      url => callbacks.onAuth({ url }),\n      () => callbacks.onPrompt({ message: 'Paste the authorization code:' }),\n    );\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshAnthropicToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,MAAM,UAAU,MAAc,KAAK,CAAC;AACpC,MAAM,YAAY,OAAO,kDAAkD;AAC3E,MAAM,gBAAgB;AAItB,MAAM,YAAY;AAClB,MAAM,eAAe;AACrB,MAAM,SAAS;;;;AAYf,eAAsB,sBAAoD;CACxE,MAAM,EAAE,UAAU,cAAc,MAAM,aAAa;CAEnD,MAAM,aAAa,IAAI,gBAAgB;EACrC,MAAM;EACN,WAAW;EACX,eAAe;EACf,cAAc;EACd,OAAO;EACP,gBAAgB;EAChB,uBAAuB;EACvB,OAAO;CACT,CAAC;CAED,OAAO;EAAE,KAAK,GAAG,cAAc,GAAG,WAAW,SAAS;EAAK;CAAS;AACtE;;;;;;AAOA,eAAsB,uBAAuB,OAAe,UAA6C;CACvG,MAAM,EAAE,MAAM,UAAU,wBAAwB,KAAK;CACrD,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,CAAC,SAAS,UAAU,UACtB,MAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,gBAAgB,MAAM,MAAM,WAAW;EAC3C,QAAQ;EAIR,QAAQ,YAAY,QAAQ,IAAM;EAClC,SAAS,EACP,gBAAgB,mBAClB;EACA,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,WAAW;GACX;GACA;GACA,cAAc;GACd,eAAe;EACjB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,MAAM,0BAA0B,cAAc,QAAQ;CAGlE,MAAM,YAAa,MAAM,cAAc,KAAK;CAO5C,MAAM,YAAY,KAAK,IAAI,IAAI,UAAU,aAAa,MAAO;CAE7D,OAAO;EACL,SAAS,UAAU;EACnB,QAAQ,UAAU;EAClB,SAAS;CACX;AACF;;;;AAKA,eAAsB,eACpB,WACA,cAC2B;CAC3B,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;CAGpD,UAAU,GAAG;CAKb,OAAO,uBAAuB,MAFP,aAAa,GAEI,QAAQ;AAClD;;;;AAKA,eAAsB,sBAAsB,cAAiD;CAC3F,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,QAAQ,YAAY,QAAQ,IAAM;EAClC,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU;GACnB,YAAY;GACZ,WAAW;GACX,eAAe;EACjB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;CAGtE,MAAM,OAAQ,MAAM,SAAS,KAAK;CAMlC,OAAO;EACL,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,MAAO;CACjD;AACF;AAEA,MAAa,yBAAiD;CAC5D,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,gBACL,QAAO,UAAU,OAAO,EAAE,IAAI,CAAC,SACzB,UAAU,SAAS,EAAE,SAAS,gCAAgC,CAAC,CACvE;CACF;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,sBAAsB,YAAY,OAAO;CAClD;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}

package/dist/auth/providers/github-copilot.js

@@ -222,7 +222,7 @@ async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, signal)
 	const credentials = {
 		refresh: refreshToken,
 		access: token,
-		expires: expiresAt * 1e3 - 300 * 1e3
+		expires: expiresAt * 1e3 - 3e5
 	};
 	if (enterpriseDomain) credentials.enterpriseUrl = enterpriseDomain;
 	return credentials;