@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/oauth.js

@@ -0,0 +1,477 @@
+import { ModelCredentialsStorage } from "../storage/domains/credentials/base.js";
+import { getAuthProviderId, resolveCredentialContext } from "./provider-credentials.js";
+import { Route } from "./route.js";
+import { registerApiRoute } from "@mastra/core/server";
+import { nextPollDelayMs } from "@mastra/code-sdk/auth/device-code";
+import { completeAnthropicLogin, startAnthropicLogin } from "@mastra/code-sdk/auth/providers/anthropic";
+import { copilotNextPollDelayMs, pollGitHubCopilotDeviceLogin, startGitHubCopilotDeviceLogin } from "@mastra/code-sdk/auth/providers/github-copilot";
+import { pollCodexDeviceLogin, startCodexDeviceLogin } from "@mastra/code-sdk/auth/providers/openai-codex";
+import { pollXAIDeviceLogin, startXAIDeviceLogin } from "@mastra/code-sdk/auth/providers/xai";
+//#region src/routes/oauth.ts
+/**
+* Web OAuth sign-in routes for model providers (Settings › Providers).
+*
+* Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's
+* paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in
+* HTTP routes. Flow state lives in login sessions — the `model-credentials`
+* domain's `oauth_login_sessions` table in tenant mode (any replica can
+* complete/poll), an in-memory store in local mode — so a flow can span
+* requests. Completed credentials are **user-scoped by default**; org admins
+* can start a flow with `{ scope: 'org' }` to share the credential with the
+* whole org. Local mode writes to the file-backed `AuthStorage`.
+*
+* Tokens never leave the server; responses only carry flow metadata (URLs,
+* user codes, poll delays).
+*/
+/** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */
+const PASTE_CODE_TTL_MS = 600 * 1e3;
+/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_FLOW_KINDS}). */
+const OAUTH_FLOWS = {
+	anthropic: {
+		kind: "paste-code",
+		start: async () => {
+			const { url, verifier } = await startAnthropicLogin();
+			return {
+				url,
+				instructions: "Open the link, authorize, then paste the code shown on the final page.",
+				expiresAt: Date.now() + PASTE_CODE_TTL_MS,
+				pending: { verifier }
+			};
+		},
+		complete: (pending, code) => completeAnthropicLogin(code, String(pending.verifier ?? ""))
+	},
+	openai: {
+		kind: "device-code",
+		start: async () => {
+			const p = await startCodexDeviceLogin();
+			return {
+				url: p.url,
+				userCode: p.userCode,
+				instructions: p.instructions,
+				expiresAt: p.deadlineAt,
+				nextPollMs: p.intervalMs,
+				pending: { ...p }
+			};
+		},
+		poll: async (pending) => {
+			const r = await pollCodexDeviceLogin(pending);
+			if (r.status === "complete") return {
+				status: "complete",
+				credentials: r.credentials
+			};
+			if (r.status === "pending") return {
+				status: "pending",
+				nextPollMs: r.nextPollMs
+			};
+			return {
+				status: "failed",
+				error: r.error
+			};
+		}
+	},
+	"github-copilot": {
+		kind: "device-code",
+		start: async () => {
+			const p = await startGitHubCopilotDeviceLogin();
+			return {
+				url: p.url,
+				userCode: p.userCode,
+				instructions: p.instructions,
+				expiresAt: p.deadlineAt,
+				nextPollMs: copilotNextPollDelayMs(p),
+				pending: { ...p }
+			};
+		},
+		poll: async (pending) => {
+			const p = pending;
+			if (p.domain !== "github.com" || p.enterpriseDomain !== void 0) return {
+				status: "failed",
+				error: "Unsupported GitHub host"
+			};
+			const r = await pollGitHubCopilotDeviceLogin(p);
+			if (r.status === "complete") return {
+				status: "complete",
+				credentials: r.credentials
+			};
+			if (r.status === "pending") return {
+				status: "pending",
+				nextPollMs: r.nextPollMs,
+				pending: { ...r.pending }
+			};
+			return {
+				status: "failed",
+				error: r.error
+			};
+		}
+	},
+	xai: {
+		kind: "device-code",
+		start: async () => {
+			const p = await startXAIDeviceLogin();
+			return {
+				url: p.url,
+				userCode: p.userCode,
+				instructions: p.instructions,
+				expiresAt: p.state.deadlineAt,
+				nextPollMs: nextPollDelayMs(p.state),
+				pending: { ...p }
+			};
+		},
+		poll: async (pending) => {
+			const r = await pollXAIDeviceLogin(pending);
+			if (r.status === "complete") return {
+				status: "complete",
+				credentials: r.credentials
+			};
+			if (r.status === "pending") return {
+				status: "pending",
+				nextPollMs: r.nextPollMs,
+				pending: { ...r.pending }
+			};
+			return {
+				status: "failed",
+				error: r.error
+			};
+		}
+	}
+};
+function loose(c) {
+	return c;
+}
+/**
+* Local-mode login sessions. Flows in local mode are single-process, so a
+* process-local libsql `:memory:` database (which already handles TTL
+* cleanup) is sufficient.
+*/
+let localSessionsPromise;
+function localSessions() {
+	localSessionsPromise ??= (async () => {
+		const { LibSQLFactoryStorage } = await import("@mastra/libsql");
+		const storage = new LibSQLFactoryStorage({
+			id: "local-oauth-sessions",
+			url: ":memory:"
+		});
+		const store = storage.registerDomain(new ModelCredentialsStorage());
+		await storage.init();
+		return store;
+	})();
+	return localSessionsPromise;
+}
+const LOCAL_TENANT = {
+	orgId: "local",
+	userId: "local"
+};
+async function sessionStore(ctx) {
+	return ctx.mode === "tenant" ? ctx.storage : localSessions();
+}
+function sessionTenant(ctx) {
+	return ctx.mode === "tenant" ? {
+		orgId: ctx.orgId,
+		userId: ctx.userId
+	} : LOCAL_TENANT;
+}
+/** Load a session and verify it belongs to the caller + provider (else undefined). */
+async function loadOwnedSession({ ctx, provider, sessionId }) {
+	const session = await (await sessionStore(ctx)).getLoginSession(sessionId);
+	if (!session) return void 0;
+	const tenant = sessionTenant(ctx);
+	if (session.orgId !== tenant.orgId || session.userId !== tenant.userId) return void 0;
+	if (session.provider !== provider) return void 0;
+	return session;
+}
+/** Persist completed OAuth credentials — user-scoped unless the flow was started org-wide. */
+async function persistOAuthCredential({ ctx, provider, scope, credentials, authStorage, onCredentialsChanged }) {
+	const authProviderId = getAuthProviderId(provider);
+	if (ctx.mode === "tenant") {
+		const tenant = {
+			orgId: ctx.orgId,
+			...scope === "org" ? {} : { userId: ctx.userId }
+		};
+		await ctx.storage.setCredential(tenant, authProviderId, {
+			type: "oauth",
+			...credentials
+		});
+		onCredentialsChanged(tenant);
+		return;
+	}
+	if (!authStorage) throw new Error("Credential storage is not available");
+	await authStorage.addAccount(authProviderId, credentials);
+}
+async function readJsonBody(c) {
+	try {
+		const body = await c.req.json();
+		return body && typeof body === "object" ? body : {};
+	} catch {
+		return {};
+	}
+}
+/**
+* Provider OAuth sign-in routes as Mastra `apiRoutes`:
+*   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow
+*   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange
+*   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll
+*   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow
+*   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)
+*/
+var OAuthRoutes = class extends Route {
+	routes() {
+		const { auth, authStorage, modelCredentials } = this.deps;
+		const onCredentialsChanged = this.deps.onCredentialsChanged ?? (() => {});
+		return [
+			registerApiRoute("/web/config/providers/:provider/oauth/start", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					const flow = OAUTH_FLOWS[provider];
+					if (!flow) return c.json({
+						error: "oauth_not_supported",
+						message: `Provider does not support web sign-in`
+					}, 404);
+					const body = await readJsonBody(loose(c));
+					if (typeof body.mode === "string" && body.mode !== flow.kind) return c.json({
+						error: "invalid_mode",
+						message: `Unsupported mode for ${provider}: ${body.mode}`
+					}, 400);
+					const scope = body.scope === "org" ? "org" : "user";
+					if (scope === "org" && ctx.mode === "tenant" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({
+						error: "forbidden",
+						message: "Only org admins can sign in for the whole org"
+					}, 403);
+					let started;
+					try {
+						started = await flow.start();
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 502);
+					}
+					const sessionId = globalThis.crypto.randomUUID();
+					const tenant = sessionTenant(ctx);
+					await (await sessionStore(ctx)).createLoginSession({
+						sessionId,
+						orgId: tenant.orgId,
+						userId: tenant.userId,
+						provider,
+						kind: flow.kind,
+						...scope === "org" && ctx.mode === "tenant" ? { credentialScope: scope } : {},
+						pending: started.pending,
+						expiresAt: new Date(started.expiresAt),
+						nextPollAt: started.nextPollMs != null ? new Date(Date.now() + started.nextPollMs) : null
+					});
+					return c.json({
+						sessionId,
+						kind: flow.kind,
+						url: started.url,
+						...started.userCode ? { userCode: started.userCode } : {},
+						instructions: started.instructions,
+						expiresAt: started.expiresAt,
+						...started.nextPollMs != null ? { nextPollMs: started.nextPollMs } : {}
+					});
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/oauth/complete", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					const flow = OAUTH_FLOWS[provider];
+					if (!flow?.complete) return c.json({ error: "oauth_not_supported" }, 404);
+					const body = await readJsonBody(loose(c));
+					const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+					const code = typeof body.code === "string" ? body.code.trim() : "";
+					if (!sessionId || !code) return c.json({ error: "Missing required fields: sessionId, code" }, 400);
+					const session = await loadOwnedSession({
+						ctx,
+						provider,
+						sessionId
+					});
+					if (!session) return c.json({ error: "session_not_found" }, 404);
+					if (session.kind !== "paste-code") return c.json({ error: "wrong_session_kind" }, 400);
+					if (session.credentialScope === "org" && ctx.mode === "tenant" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({
+						error: "forbidden",
+						message: "Only org admins can sign in for the whole org"
+					}, 403);
+					const claimed = await (await sessionStore(ctx)).claimLoginSession(sessionId, {
+						orgId: session.orgId,
+						userId: session.userId,
+						provider,
+						kind: "paste-code"
+					});
+					if (!claimed) return c.json({ error: "oauth_in_progress" }, 409);
+					let credentials;
+					try {
+						credentials = await flow.complete(claimed.pending, code);
+					} catch (error) {
+						await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+					}
+					await persistOAuthCredential({
+						ctx,
+						provider,
+						scope: session.credentialScope,
+						credentials,
+						authStorage,
+						onCredentialsChanged
+					});
+					await (await sessionStore(ctx)).deleteLoginSession(sessionId);
+					return c.json({
+						status: "complete",
+						ok: true
+					});
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/oauth/poll", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					const flow = OAUTH_FLOWS[provider];
+					if (!flow?.poll) return c.json({ error: "oauth_not_supported" }, 404);
+					const body = await readJsonBody(loose(c));
+					const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+					if (!sessionId) return c.json({ error: "Missing required field: sessionId" }, 400);
+					const session = await loadOwnedSession({
+						ctx,
+						provider,
+						sessionId
+					});
+					if (!session) return c.json({ error: "session_not_found" }, 404);
+					if (session.kind !== "device-code") return c.json({ error: "wrong_session_kind" }, 400);
+					if (session.credentialScope === "org" && ctx.mode === "tenant" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({
+						error: "forbidden",
+						message: "Only org admins can sign in for the whole org"
+					}, 403);
+					const now = Date.now();
+					const nextPollAt = session.nextPollAt?.getTime();
+					const parkedByClaim = nextPollAt != null && nextPollAt >= session.expiresAt.getTime();
+					if (nextPollAt != null && now < nextPollAt && !parkedByClaim) return c.json({
+						status: "pending",
+						nextPollMs: nextPollAt - now
+					});
+					const claimed = await (await sessionStore(ctx)).claimLoginSession(sessionId, {
+						orgId: session.orgId,
+						userId: session.userId,
+						provider,
+						kind: "device-code"
+					});
+					if (!claimed) return c.json({
+						status: "pending",
+						nextPollMs: 250
+					});
+					let result;
+					try {
+						result = await flow.poll(claimed.pending);
+					} catch (error) {
+						await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });
+						throw error;
+					}
+					if (result.status === "complete") {
+						await persistOAuthCredential({
+							ctx,
+							provider,
+							scope: session.credentialScope,
+							credentials: result.credentials,
+							authStorage,
+							onCredentialsChanged
+						});
+						await (await sessionStore(ctx)).deleteLoginSession(sessionId);
+						return c.json({
+							status: "complete",
+							ok: true
+						});
+					}
+					if (result.status === "failed") {
+						await (await sessionStore(ctx)).deleteLoginSession(sessionId);
+						return c.json({
+							status: "failed",
+							error: result.error
+						});
+					}
+					await (await sessionStore(ctx)).touchLoginSession(sessionId, {
+						...result.pending ? { pending: result.pending } : {},
+						nextPollAt: new Date(now + result.nextPollMs)
+					});
+					return c.json({
+						status: "pending",
+						nextPollMs: result.nextPollMs
+					});
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/oauth/session/:sessionId", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const provider = c.req.param("provider");
+					const sessionId = c.req.param("sessionId");
+					if (await loadOwnedSession({
+						ctx,
+						provider,
+						sessionId
+					})) await (await sessionStore(ctx)).deleteLoginSession(sessionId);
+					return c.json({ ok: true });
+				}
+			}),
+			registerApiRoute("/web/config/providers/:provider/oauth", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (c) => {
+					const ctx = await resolveCredentialContext({
+						c: loose(c),
+						auth,
+						credentials: modelCredentials
+					});
+					if ("response" in ctx) return ctx.response;
+					const authProviderId = getAuthProviderId(c.req.param("provider"));
+					const scope = c.req.query("scope") === "org" ? "org" : "user";
+					try {
+						if (ctx.mode === "tenant") {
+							if (scope === "org" && !await auth.isOrganizationAdmin(loose(c), ctx.orgId)) return c.json({
+								error: "forbidden",
+								message: "Only org admins can remove an org-wide sign-in"
+							}, 403);
+							const tenant = {
+								orgId: ctx.orgId,
+								...scope === "org" ? {} : { userId: ctx.userId }
+							};
+							await ctx.storage.removeCredential(tenant, authProviderId);
+							onCredentialsChanged(tenant);
+						} else {
+							if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
+							authStorage.logout(authProviderId);
+						}
+						return c.json({ ok: true });
+					} catch (error) {
+						return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+					}
+				}
+			})
+		];
+	}
+};
+//#endregion
+export { OAuthRoutes };
+
+//# sourceMappingURL=oauth.js.map

package/dist/routes/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","names":[],"sources":["../../src/routes/oauth.ts"],"sourcesContent":["/**\n * Web OAuth sign-in routes for model providers (Settings › Providers).\n *\n * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's\n * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in\n * HTTP routes. Flow state lives in login sessions — the `model-credentials`\n * domain's `oauth_login_sessions` table in tenant mode (any replica can\n * complete/poll), an in-memory store in local mode — so a flow can span\n * requests. Completed credentials are **user-scoped by default**; org admins\n * can start a flow with `{ scope: 'org' }` to share the credential with the\n * whole org. Local mode writes to the file-backed `AuthStorage`.\n *\n * Tokens never leave the server; responses only carry flow metadata (URLs,\n * user codes, poll delays).\n */\n\nimport { nextPollDelayMs } from '@mastra/code-sdk/auth/device-code';\nimport { completeAnthropicLogin, startAnthropicLogin } from '@mastra/code-sdk/auth/providers/anthropic';\nimport {\n  copilotNextPollDelayMs,\n  pollGitHubCopilotDeviceLogin,\n  startGitHubCopilotDeviceLogin,\n} from '@mastra/code-sdk/auth/providers/github-copilot';\nimport type { CopilotDeviceLoginPending } from '@mastra/code-sdk/auth/providers/github-copilot';\nimport { pollCodexDeviceLogin, startCodexDeviceLogin } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport type { CodexDeviceLoginPending } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport { pollXAIDeviceLogin, startXAIDeviceLogin } from '@mastra/code-sdk/auth/providers/xai';\nimport type { XAIDeviceLoginPending } from '@mastra/code-sdk/auth/providers/xai';\nimport type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { OAuthCredentials } from '@mastra/code-sdk/auth/types';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { LoginCredentialScope, LoginSessionKind, LoginSessionRow } from '../storage/domains/credentials/base.js';\nimport { getAuthProviderId, resolveCredentialContext } from './provider-credentials.js';\nimport type { CredentialContext } from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\n/** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */\nconst PASTE_CODE_TTL_MS = 10 * 60 * 1000;\n\ninterface OAuthFlowStart {\n  url: string;\n  userCode?: string;\n  instructions: string;\n  /** ms epoch after which the flow expires. */\n  expiresAt: number;\n  /** Delay before the first upstream poll (device-code flows only). */\n  nextPollMs?: number;\n  /** Serializable flow state persisted in the login session. */\n  pending: Record<string, unknown>;\n}\n\ntype OAuthFlowPoll =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending?: Record<string, unknown> }\n  | { status: 'failed'; error: string };\n\ninterface OAuthFlow {\n  kind: LoginSessionKind;\n  start(): Promise<OAuthFlowStart>;\n  /** Paste-code flows: exchange the pasted code for credentials. Throws on bad input. */\n  complete?(pending: Record<string, unknown>, code: string): Promise<OAuthCredentials>;\n  /** Device-code flows: perform exactly one upstream poll. */\n  poll?(pending: Record<string, unknown>): Promise<OAuthFlowPoll>;\n}\n\n/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_FLOW_KINDS}). */\nconst OAUTH_FLOWS: Record<string, OAuthFlow> = {\n  anthropic: {\n    kind: 'paste-code',\n    start: async () => {\n      const { url, verifier } = await startAnthropicLogin();\n      return {\n        url,\n        instructions: 'Open the link, authorize, then paste the code shown on the final page.',\n        expiresAt: Date.now() + PASTE_CODE_TTL_MS,\n        pending: { verifier },\n      };\n    },\n    complete: (pending, code) => completeAnthropicLogin(code, String(pending.verifier ?? '')),\n  },\n  openai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startCodexDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: p.intervalMs,\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollCodexDeviceLogin(pending as unknown as CodexDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  'github-copilot': {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startGitHubCopilotDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: copilotNextPollDelayMs(p),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const p = pending as unknown as CopilotDeviceLoginPending;\n      // Web flows are always started against github.com (no Enterprise input).\n      // Never let deserialized session state redirect server-side polling to\n      // an arbitrary hostname.\n      if (p.domain !== 'github.com' || p.enterpriseDomain !== undefined) {\n        return { status: 'failed', error: 'Unsupported GitHub host' };\n      }\n      const r = await pollGitHubCopilotDeviceLogin(p);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  xai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startXAIDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.state.deadlineAt,\n        nextPollMs: nextPollDelayMs(p.state),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollXAIDeviceLogin(pending as unknown as XAIDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n};\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Local-mode login sessions. Flows in local mode are single-process, so a\n * process-local libsql `:memory:` database (which already handles TTL\n * cleanup) is sufficient.\n */\nlet localSessionsPromise: Promise<ModelCredentialsStorage> | undefined;\nfunction localSessions(): Promise<ModelCredentialsStorage> {\n  localSessionsPromise ??= (async () => {\n    const { LibSQLFactoryStorage } = await import('@mastra/libsql');\n    const storage = new LibSQLFactoryStorage({ id: 'local-oauth-sessions', url: ':memory:' });\n    const store = storage.registerDomain(new ModelCredentialsStorage());\n    await storage.init();\n    return store;\n  })();\n  return localSessionsPromise;\n}\nconst LOCAL_TENANT = { orgId: 'local', userId: 'local' } as const;\n\nasync function sessionStore(ctx: CredentialContext): Promise<ModelCredentialsStorage> {\n  return ctx.mode === 'tenant' ? ctx.storage : localSessions();\n}\n\nfunction sessionTenant(ctx: CredentialContext): { orgId: string; userId: string } {\n  return ctx.mode === 'tenant' ? { orgId: ctx.orgId, userId: ctx.userId } : LOCAL_TENANT;\n}\n\n/** Load a session and verify it belongs to the caller + provider (else undefined). */\nasync function loadOwnedSession({\n  ctx,\n  provider,\n  sessionId,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  sessionId: string;\n}): Promise<LoginSessionRow | undefined> {\n  const session = await (await sessionStore(ctx)).getLoginSession(sessionId);\n  if (!session) return undefined;\n  const tenant = sessionTenant(ctx);\n  if (session.orgId !== tenant.orgId || session.userId !== tenant.userId) return undefined;\n  if (session.provider !== provider) return undefined;\n  return session;\n}\n\n/** Persist completed OAuth credentials — user-scoped unless the flow was started org-wide. */\nasync function persistOAuthCredential({\n  ctx,\n  provider,\n  scope,\n  credentials,\n  authStorage,\n  onCredentialsChanged,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  scope: LoginCredentialScope | undefined;\n  credentials: OAuthCredentials;\n  authStorage: AuthStorage | undefined;\n  onCredentialsChanged: (tenant: { orgId: string; userId?: string }) => void;\n}): Promise<void> {\n  const authProviderId = getAuthProviderId(provider);\n  if (ctx.mode === 'tenant') {\n    const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n    await ctx.storage.setCredential(tenant, authProviderId, {\n      type: 'oauth',\n      ...credentials,\n    });\n    onCredentialsChanged(tenant);\n    return;\n  }\n  if (!authStorage) throw new Error('Credential storage is not available');\n  await authStorage.addAccount(authProviderId, credentials);\n}\n\nasync function readJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = (await c.req.json()) as unknown;\n    return body && typeof body === 'object' ? (body as Record<string, unknown>) : {};\n  } catch {\n    return {};\n  }\n}\n\nexport interface OAuthRoutesDeps extends RouteDependencies {\n  /** File-backed credential store; used in local (no-auth) mode. */\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n}\n\n/**\n * Provider OAuth sign-in routes as Mastra `apiRoutes`:\n *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow\n *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange\n *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll\n *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow\n *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)\n */\nexport class OAuthRoutes extends Route<OAuthRoutesDeps> {\n  routes(): ApiRoute[] {\n    const { auth, authStorage, modelCredentials } = this.deps;\n    const onCredentialsChanged = this.deps.onCredentialsChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers/:provider/oauth/start', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow) {\n            return c.json({ error: 'oauth_not_supported', message: `Provider does not support web sign-in` }, 404);\n          }\n          // Body may carry `{ mode }` for future multi-mode providers; each web\n          // flow currently has exactly one mode, so an unknown mode is rejected.\n          const body = await readJsonBody(loose(c));\n          if (typeof body.mode === 'string' && body.mode !== flow.kind) {\n            return c.json({ error: 'invalid_mode', message: `Unsupported mode for ${provider}: ${body.mode}` }, 400);\n          }\n\n          // Optional `{ scope: 'org' }` shares the completed credential with\n          // the whole org (admin-only, tenant mode). Anything else is personal.\n          const scope: LoginCredentialScope = body.scope === 'org' ? 'org' : 'user';\n          if (scope === 'org' && ctx.mode === 'tenant' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          let started: OAuthFlowStart;\n          try {\n            started = await flow.start();\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 502);\n          }\n\n          const sessionId = globalThis.crypto.randomUUID();\n          const tenant = sessionTenant(ctx);\n          await (\n            await sessionStore(ctx)\n          ).createLoginSession({\n            sessionId,\n            orgId: tenant.orgId,\n            userId: tenant.userId,\n            provider,\n            kind: flow.kind,\n            ...(scope === 'org' && ctx.mode === 'tenant' ? { credentialScope: scope } : {}),\n            pending: started.pending,\n            expiresAt: new Date(started.expiresAt),\n            nextPollAt: started.nextPollMs != null ? new Date(Date.now() + started.nextPollMs) : null,\n          });\n\n          return c.json({\n            sessionId,\n            kind: flow.kind,\n            url: started.url,\n            ...(started.userCode ? { userCode: started.userCode } : {}),\n            instructions: started.instructions,\n            expiresAt: started.expiresAt,\n            ...(started.nextPollMs != null ? { nextPollMs: started.nextPollMs } : {}),\n          });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/complete', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.complete) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          const code = typeof body.code === 'string' ? body.code.trim() : '';\n          if (!sessionId || !code) return c.json({ error: 'Missing required fields: sessionId, code' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'paste-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access at completion time — the\n          // caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'paste-code',\n          });\n          if (!claimed) return c.json({ error: 'oauth_in_progress' }, 409);\n\n          let credentials: OAuthCredentials;\n          try {\n            credentials = await flow.complete(claimed.pending, code);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);\n          }\n\n          await persistOAuthCredential({\n            ctx,\n            provider,\n            scope: session.credentialScope,\n            credentials,\n            authStorage,\n            onCredentialsChanged,\n          });\n          await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ status: 'complete', ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/poll', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.poll) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          if (!sessionId) return c.json({ error: 'Missing required field: sessionId' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'device-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access before the credential write —\n          // the caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          // Server-side rate limit: at most one upstream poll per interval,\n          // regardless of how eagerly the client calls this route.\n          const now = Date.now();\n          const nextPollAt = session.nextPollAt?.getTime();\n          // claimLoginSession parks next_poll_at at expires_at while another\n          // request owns the flow. That is a lock, not a schedule, so fall\n          // through to the claim and take its short retry instead.\n          const parkedByClaim = nextPollAt != null && nextPollAt >= session.expiresAt.getTime();\n          if (nextPollAt != null && now < nextPollAt && !parkedByClaim) {\n            return c.json({ status: 'pending', nextPollMs: nextPollAt - now });\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'device-code',\n          });\n          if (!claimed) return c.json({ status: 'pending', nextPollMs: 250 });\n\n          let result: OAuthFlowPoll;\n          try {\n            result = await flow.poll(claimed.pending);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            throw error;\n          }\n\n          if (result.status === 'complete') {\n            await persistOAuthCredential({\n              ctx,\n              provider,\n              scope: session.credentialScope,\n              credentials: result.credentials,\n              authStorage,\n              onCredentialsChanged,\n            });\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'complete', ok: true });\n          }\n\n          if (result.status === 'failed') {\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'failed', error: result.error });\n          }\n\n          await (\n            await sessionStore(ctx)\n          ).touchLoginSession(sessionId, {\n            ...(result.pending ? { pending: result.pending } : {}),\n            nextPollAt: new Date(now + result.nextPollMs),\n          });\n          return c.json({ status: 'pending', nextPollMs: result.nextPollMs });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/session/:sessionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const sessionId = c.req.param('sessionId');\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (session) await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const authProviderId = getAuthProviderId(provider);\n          // `?scope=org` removes the shared org credential (admin-only);\n          // default removes the caller's personal credential only.\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'forbidden', message: 'Only org admins can remove an org-wide sign-in' }, 403);\n              }\n              const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n              await ctx.storage.removeCredential(tenant, authProviderId);\n              onCredentialsChanged(tenant);\n            } else {\n              if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n              authStorage.logout(authProviderId);\n            }\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAM,oBAAoB,MAAU;;AA6BpC,MAAM,cAAyC;CAC7C,WAAW;EACT,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;GACpD,OAAO;IACL;IACA,cAAc;IACd,WAAW,KAAK,IAAI,IAAI;IACxB,SAAS,EAAE,SAAS;GACtB;EACF;EACA,WAAW,SAAS,SAAS,uBAAuB,MAAM,OAAO,QAAQ,YAAY,EAAE,CAAC;CAC1F;CACA,QAAQ;EACN,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,sBAAsB;GACtC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,EAAE;IACd,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,qBAAqB,OAA6C;GAClF,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;GAAW;GACjF,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,kBAAkB;EAChB,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,8BAA8B;GAC9C,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,uBAAuB,CAAC;IACpC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI;GAIV,IAAI,EAAE,WAAW,gBAAgB,EAAE,qBAAqB,KAAA,GACtD,OAAO;IAAE,QAAQ;IAAU,OAAO;GAA0B;GAE9D,MAAM,IAAI,MAAM,6BAA6B,CAAC;GAC9C,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,KAAK;EACH,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,oBAAoB;GACpC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE,MAAM;IACnB,YAAY,gBAAgB,EAAE,KAAK;IACnC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,mBAAmB,OAA2C;GAC9E,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;AACF;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;AAOA,IAAI;AACJ,SAAS,gBAAkD;CACzD,0BAA0B,YAAY;EACpC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,UAAU,IAAI,qBAAqB;GAAE,IAAI;GAAwB,KAAK;EAAW,CAAC;EACxF,MAAM,QAAQ,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAClE,MAAM,QAAQ,KAAK;EACnB,OAAO;CACT,EAAA,CAAG;CACH,OAAO;AACT;AACA,MAAM,eAAe;CAAE,OAAO;CAAS,QAAQ;AAAQ;AAEvD,eAAe,aAAa,KAA0D;CACpF,OAAO,IAAI,SAAS,WAAW,IAAI,UAAU,cAAc;AAC7D;AAEA,SAAS,cAAc,KAA2D;CAChF,OAAO,IAAI,SAAS,WAAW;EAAE,OAAO,IAAI;EAAO,QAAQ,IAAI;CAAO,IAAI;AAC5E;;AAGA,eAAe,iBAAiB,EAC9B,KACA,UACA,aAKuC;CACvC,MAAM,UAAU,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,gBAAgB,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,SAAS,cAAc,GAAG;CAChC,IAAI,QAAQ,UAAU,OAAO,SAAS,QAAQ,WAAW,OAAO,QAAQ,OAAO,KAAA;CAC/E,IAAI,QAAQ,aAAa,UAAU,OAAO,KAAA;CAC1C,OAAO;AACT;;AAGA,eAAe,uBAAuB,EACpC,KACA,UACA,OACA,aACA,aACA,wBAQgB;CAChB,MAAM,iBAAiB,kBAAkB,QAAQ;CACjD,IAAI,IAAI,SAAS,UAAU;EACzB,MAAM,SAAS;GAAE,OAAO,IAAI;GAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;EAAG;EACtF,MAAM,IAAI,QAAQ,cAAc,QAAQ,gBAAgB;GACtD,MAAM;GACN,GAAG;EACL,CAAC;EACD,qBAAqB,MAAM;EAC3B;CACF;CACA,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qCAAqC;CACvE,MAAM,YAAY,WAAW,gBAAgB,WAAW;AAC1D;AAEA,eAAe,aAAa,GAA8C;CACxE,IAAI;EACF,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK;EAC/B,OAAO,QAAQ,OAAO,SAAS,WAAY,OAAmC,CAAC;CACjF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;;;AAmBA,IAAa,cAAb,cAAiC,MAAuB;CACtD,SAAqB;EACnB,MAAM,EAAE,MAAM,aAAa,qBAAqB,KAAK;EACrD,MAAM,uBAAuB,KAAK,KAAK,+BAA+B,CAAC;EAEvE,OAAO;GACL,iBAAiB,+CAA+C;IAC9D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;MAAE,OAAO;MAAuB,SAAS;KAAwC,GAAG,GAAG;KAIvG,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,IAAI,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,KAAK,MACtD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAgB,SAAS,wBAAwB,SAAS,IAAI,KAAK;KAAO,GAAG,GAAG;KAKzG,MAAM,QAA8B,KAAK,UAAU,QAAQ,QAAQ;KACnE,IAAI,UAAU,SAAS,IAAI,SAAS,YAAY,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAClG,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,IAAI;KACJ,IAAI;MACF,UAAU,MAAM,KAAK,MAAM;KAC7B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,YAAY,WAAW,OAAO,WAAW;KAC/C,MAAM,SAAS,cAAc,GAAG;KAChC,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,mBAAmB;MACnB;MACA,OAAO,OAAO;MACd,QAAQ,OAAO;MACf;MACA,MAAM,KAAK;MACX,GAAI,UAAU,SAAS,IAAI,SAAS,WAAW,EAAE,iBAAiB,MAAM,IAAI,CAAC;MAC7E,SAAS,QAAQ;MACjB,WAAW,IAAI,KAAK,QAAQ,SAAS;MACrC,YAAY,QAAQ,cAAc,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,UAAU,IAAI;KACvF,CAAC;KAED,OAAO,EAAE,KAAK;MACZ;MACA,MAAM,KAAK;MACX,KAAK,QAAQ;MACb,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;MACzD,cAAc,QAAQ;MACtB,WAAW,QAAQ;MACnB,GAAI,QAAQ,cAAc,OAAO,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;KACzE,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,kDAAkD;IACjE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAExE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;KAChE,IAAI,CAAC,aAAa,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;KAEjG,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGrF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAE/D,IAAI;KACJ,IAAI;MACF,cAAc,MAAM,KAAK,SAAS,QAAQ,SAAS,IAAI;KACzD,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,uBAAuB;MAC3B;MACA;MACA,OAAO,QAAQ;MACf;MACA;MACA;KACF,CAAC;KACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KAC5D,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAY,IAAI;KAAK,CAAC;IAChD;GACF,CAAC;GAED,iBAAiB,8CAA8C;IAC7D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAEpE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,IAAI,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KAEjF,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGtF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAKrG,MAAM,MAAM,KAAK,IAAI;KACrB,MAAM,aAAa,QAAQ,YAAY,QAAQ;KAI/C,MAAM,gBAAgB,cAAc,QAAQ,cAAc,QAAQ,UAAU,QAAQ;KACpF,IAAI,cAAc,QAAQ,MAAM,cAAc,CAAC,eAC7C,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,aAAa;KAAI,CAAC;KAGnE,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY;KAAI,CAAC;KAElE,IAAI;KACJ,IAAI;MACF,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO;KAC1C,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,MAAM;KACR;KAEA,IAAI,OAAO,WAAW,YAAY;MAChC,MAAM,uBAAuB;OAC3B;OACA;OACA,OAAO,QAAQ;OACf,aAAa,OAAO;OACpB;OACA;MACF,CAAC;MACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAY,IAAI;MAAK,CAAC;KAChD;KAEA,IAAI,OAAO,WAAW,UAAU;MAC9B,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAU,OAAO,OAAO;MAAM,CAAC;KACzD;KAEA,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;MACpD,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU;KAC9C,CAAC;KACD,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,OAAO;KAAW,CAAC;IACpE;GACF,CAAC;GAED,iBAAiB,4DAA4D;IAC3E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;KAEzC,IAAI,MADkB,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC,GACtD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KACzE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;GAED,iBAAiB,yCAAyC;IACxD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAGlC,MAAM,iBAAiB,kBADN,EAAE,IAAI,MAAM,UACmB,CAAC;KAGjD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;KACvD,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK;QAAE,OAAO;QAAa,SAAS;OAAiD,GAAG,GAAG;OAEtG,MAAM,SAAS;QAAE,OAAO,IAAI;QAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;OAAG;OACtF,MAAM,IAAI,QAAQ,iBAAiB,QAAQ,cAAc;OACzD,qBAAqB,MAAM;MAC7B,OAAO;OACL,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;OACrF,YAAY,OAAO,cAAc;MACnC;MACA,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;KAC5B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;EACH;CACF;AACF"}

package/dist/routes/projects.d.ts

@@ -0,0 +1,68 @@
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactorySandbox } from '@mastra/core/workspace';
+import type { EnvironmentBuildRunner } from '../environment/build-runner.js';
+import type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { ProjectRepository, SourceControlRepository, SourceControlStorage } from '../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+interface ModelApplySession {
+    thread: {
+        getById: (args: {
+            threadId: string;
+        }) => Promise<{
+            metadata?: Record<string, unknown> | null;
+        } | null>;
+        setSettingOn: (args: {
+            threadId: string;
+            key: string;
+            value: unknown;
+        }) => Promise<unknown> | unknown;
+    };
+}
+interface ModelApplyController {
+    getSessionByResource: (resourceId: string) => Promise<ModelApplySession | undefined>;
+}
+export interface ProjectRoutesDeps extends RouteDependencies {
+    /** Factory projects domain backing the CRUD surface. */
+    projects: FactoryProjectsStorage;
+    /** Source-control domain the connection/repository routes fan out over. */
+    sourceControl: SourceControlStorage;
+    /** Integration ids allowed as source-control connection targets. */
+    versionControlIntegrationIds?: string[];
+    /** Validate and persist a repository selected from a provider-backed listing. */
+    resolveRepository?: (input: {
+        integrationId: string;
+        orgId: string;
+        userId: string;
+        installationId: string;
+        externalId: string;
+        slug: string;
+    }) => Promise<SourceControlRepository | null>;
+    /**
+     * Fire-and-forget hook invoked after a repository is linked to a project —
+     * kicks the initial base-checkpoint build. Must never throw.
+     */
+    onProjectRepositoryLinked?: (args: {
+        orgId: string;
+        projectRepository: ProjectRepository;
+    }) => void;
+    /** Shared lifecycle for retiring sessions before their owning records are deleted. */
+    sessionRetirement?: SessionRetirementCoordinator;
+    /** Work-items domain used by session retirement and running-thread model updates. */
+    workItems?: Pick<WorkItemsStorage, 'clearSessionReferences' | 'listRunBindings' | 'get'>;
+    /** Controller used to reach the thread store behind each active binding. */
+    controller?: ModelApplyController;
+    /** The factory's normalized sandbox; describes and validates the environment settings. */
+    sandbox?: FactorySandbox;
+    /** Environment builds, present only when the sandbox has a `builds` capability. */
+    environmentBuilds?: EnvironmentBuildRunner;
+}
+export declare class ProjectRoutes extends Route<ProjectRoutesDeps> {
+    #private;
+    constructor(deps: ProjectRoutesDeps);
+    routes(): ApiRoute[];
+}
+export {};
+//# sourceMappingURL=projects.d.ts.map

package/dist/routes/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAA6B,MAAM,wBAAwB,CAAC;AAGxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,KAAK,EAEV,sBAAsB,EAEvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAiInC,UAAU,iBAAiB;IACzB,MAAM,EAAE;QACN,OAAO,EAAE,CAAC,IAAI,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACvG,YAAY,EAAE,CAAC,IAAI,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;KACvG,CAAC;CACH;AAED,UAAU,oBAAoB;IAC5B,oBAAoB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,wDAAwD;IACxD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,2EAA2E;IAC3E,aAAa,EAAE,oBAAoB,CAAC;IACpC,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,iBAAiB,CAAA;KAAE,KAAK,IAAI,CAAC;IACpG,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,GAAG,iBAAiB,GAAG,KAAK,CAAC,CAAC;IACzF,4EAA4E;IAC5E,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,0FAA0F;IAC1F,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CAC5C;AAkBD,qBAAa,aAAc,SAAQ,KAAK,CAAC,iBAAiB,CAAC;;gBAK7C,IAAI,EAAE,iBAAiB;IAsSnC,MAAM,IAAI,QAAQ,EAAE;CA6gBrB"}