@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/routes/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","names":[],"sources":["../../src/routes/config.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport { DEFAULT_OM_MODEL_ID } from '@mastra/code-sdk/constants';\nimport { getAvailableModePacks, resolveProviderOMDefault } from '@mastra/code-sdk/onboarding/packs';\nimport type { ModePack, ProviderAccess, ProviderAccessLevel } from '@mastra/code-sdk/onboarding/packs';\nimport { getCustomProviderId, THREAD_ACTIVE_MODEL_PACK_ID_KEY } from '@mastra/code-sdk/onboarding/settings';\nimport type { CustomProviderSetting } from '@mastra/code-sdk/onboarding/settings';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { Context } from 'hono';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { CustomProviderRecord, CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type {\n  MemorySettingsFillIfUnset,\n  MemorySettingsPatch,\n  MemorySettingsRecord,\n  MemorySettingsStorage,\n} from '../storage/domains/memory-settings/base.js';\nimport type { ModelPackRecord, ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport {\n  getAuthProviderId,\n  listTenantCredentialsForRequest,\n  resolveCredentialContext,\n  tenantOrgId,\n  WEB_OAUTH_FLOW_KINDS,\n} from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteAuth, RouteDependencies } from './route.js';\n\n/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Server-side configuration routes for the web app.\n *\n * The browser has no access to the credential store or the model catalog, so\n * the web settings panel asks the server — which owns both — to list providers\n * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the\n * same `AuthStorage`-backed key management over HTTP.\n *\n * Keys are never returned to the client; only their presence and source.\n */\n\n/**\n * Where a provider's active credential comes from, as seen by the caller.\n * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode\n * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).\n */\nexport type ProviderCredentialSource =\n  | 'oauth'\n  | 'stored'\n  | 'env'\n  | 'none'\n  | 'oauth-user'\n  | 'stored-user'\n  | 'stored-org';\n\n/** A model provider with the current source of its credentials. */\nexport interface ProviderInfo {\n  provider: string;\n  /** Env var the provider's key is read from, if any. */\n  envVar?: string;\n  /** Where the active credential comes from. */\n  source: ProviderCredentialSource;\n  /**\n   * Tenant mode: whether an org-wide API key exists for this provider, even\n   * when the caller's personal credential shadows it. Lets the UI tell\n   * \"shared with the org\" apart from \"only works for me\".\n   */\n  orgKey?: boolean;\n  /** Web OAuth sign-in capability, when the provider supports it. */\n  oauth?: { supported: true; modes: LoginSessionKind[] };\n}\n\n/** Minimal session surface a pack activation touches. */\ninterface PackSession {\n  mode: { get: () => string };\n  model: { switch: (args: { modelId: string }) => Promise<void> };\n  subagents: { model: { set: (args: { modelId: string; agentType: string }) => Promise<void> } };\n  thread: {\n    getId: () => string | null;\n    setSetting: (args: { key: string; value: unknown }) => Promise<void>;\n    list: () => Promise<Array<{ id: string; metadata?: Record<string, unknown> }>>;\n  };\n}\n\n/** One observational-memory role's read/switch surface. */\ninterface OMRole {\n  modelId: () => string | undefined;\n  threshold: () => number | undefined;\n  switchModel: (args: { modelId: string }) => Promise<void>;\n}\n\n/**\n * Session-state fields the OM config routes write. The index signatures mirror\n * `MastraCodeState` so the concrete `Session.state.set(Partial<MastraCodeState>)`\n * stays assignable to this minimal surface (contravariant parameter check).\n */\ninterface OMStateWrites {\n  [key: string]: unknown;\n  [key: `subagentModelId_${string}`]: string | undefined;\n  observationThreshold?: number;\n  reflectionThreshold?: number;\n  observeAttachments?: 'auto' | boolean;\n}\n\n/** Minimal session surface the OM config routes touch. */\nexport interface OMSession extends PackSession {\n  state: {\n    get: () => Record<string, unknown> | undefined;\n    set: (updates: OMStateWrites) => Promise<void> | void;\n  };\n  om: { observer: OMRole; reflector: OMRole };\n}\n\n/** Minimal controller surface this module needs (model catalog + modes + sessions). */\ninterface ModelCatalog {\n  listAvailableModels: () => Promise<\n    Array<{ id?: string; modelName?: string; provider: string; hasApiKey: boolean; apiKeyEnvVar?: string }>\n  >;\n  listModes?: () => Array<{ id: string; defaultModelId?: string }>;\n  getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;\n}\n\n/**\n * Build a deduplicated, sorted list of providers from the model catalog,\n * annotated with where each provider's credential currently comes from.\n * Mirrors the TUI's `/api-keys` provider list.\n *\n * When `tenantCredentials` is given (deployed mode), sources reflect the\n * *caller's* tenant rows with user > org precedence and the server-global\n * `authStorage` is ignored; otherwise the local `auth.json` view is reported.\n */\nexport async function listProviders({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderInfo[]> {\n  const models = await controller.listAvailableModels();\n  const seen = new Map<string, ProviderInfo>();\n\n  for (const model of models) {\n    if (seen.has(model.provider)) continue;\n\n    const authProviderId = getAuthProviderId(model.provider);\n    let source: ProviderInfo['source'] = 'none';\n    let orgKey: boolean | undefined;\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      orgKey = orgRec?.credential.type === 'api_key';\n      if (userRec?.credential.type === 'oauth') {\n        source = 'oauth-user';\n      } else if (userRec?.credential.type === 'api_key') {\n        source = 'stored-user';\n      } else if (orgRec?.credential.type === 'api_key') {\n        source = 'stored-org';\n      }\n    } else if (authStorage?.isLoggedIn(authProviderId)) {\n      source = 'oauth';\n    } else if (authStorage?.hasStoredApiKey(model.provider)) {\n      source = 'stored';\n    } else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) {\n      source = 'env';\n    } else if (model.hasApiKey) {\n      source = 'env';\n    }\n\n    const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];\n    seen.set(model.provider, {\n      provider: model.provider,\n      envVar: model.apiKeyEnvVar,\n      source,\n      ...(orgKey !== undefined ? { orgKey } : {}),\n      ...(flowKind ? { oauth: { supported: true as const, modes: [flowKind] } } : {}),\n    });\n  }\n\n  return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));\n}\n\n/** A user-defined OpenAI-compatible provider, with key presence (never the key). */\nexport interface CustomProviderInfo {\n  id: string;\n  name: string;\n  url: string;\n  hasApiKey: boolean;\n  models: string[];\n}\n\n/** Redact a stored custom-provider row for the client (key presence only). */\nfunction toCustomProviderInfo(record: CustomProviderRecord): CustomProviderInfo {\n  return {\n    id: record.providerId,\n    name: record.name,\n    url: record.url,\n    hasApiKey: Boolean(record.apiKey),\n    models: record.models,\n  };\n}\n\n/** The resolved custom-providers storage scope for a request. */\ninterface CustomProvidersContext {\n  storage: CustomProvidersStorage;\n  orgId: string;\n  userId: string;\n}\n\n/**\n * Resolve the custom-providers context for a request, or a ready-to-return\n * error response. Same posture as memory settings: tenant rows in deployed\n * mode, a sentinel `local` org in no-auth mode — never settings.json.\n */\nasync function resolveCustomProvidersContext({\n  c,\n  auth,\n  customProviders,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  customProviders?: CustomProvidersStorage;\n}): Promise<CustomProvidersContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (customProviders) {\n    try {\n      await customProviders.ensureReady();\n      return tenant\n        ? { storage: customProviders, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: customProviders, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'custom_providers_unavailable',\n        message: 'Custom provider storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Validate + coerce a request body into a CustomProviderSetting. */\nfunction parseCustomProviderBody(body: unknown): CustomProviderSetting | { error: string } {\n  if (!body || typeof body !== 'object') return { error: 'Invalid JSON body' };\n  const b = body as Record<string, unknown>;\n  const name = typeof b.name === 'string' ? b.name.trim() : '';\n  if (!name) return { error: 'Missing required field: name' };\n  const url = typeof b.url === 'string' ? b.url.trim() : '';\n  if (!url) return { error: 'Missing required field: url' };\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n      return { error: 'url must be an http(s) URL' };\n    }\n  } catch {\n    return { error: 'url must be a valid URL' };\n  }\n  const apiKey = typeof b.apiKey === 'string' && b.apiKey.trim() ? b.apiKey.trim() : undefined;\n  const models = Array.isArray(b.models)\n    ? b.models.filter((m): m is string => typeof m === 'string' && m.trim().length > 0).map(m => m.trim())\n    : [];\n  return { name, url, apiKey, models };\n}\n\n// ── Model packs ──────────────────────────────────────────────────────────\n\n/** A model pack as surfaced to the web client, with an `active` flag. */\nexport interface ModelPackInfo extends ModePack {\n  custom: boolean;\n  active: boolean;\n}\n\n/**\n * Compute which providers the user can reach, mirroring the TUI's\n * `/models-pack` access derivation: OAuth/api-key from the credential store for\n * the named providers, plus any other provider that has a usable key.\n */\nexport async function buildProviderAccess({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderAccess> {\n  const models = await controller.listAvailableModels();\n  const hasModelKey = (provider: string) => models.some(m => m.provider === provider && m.hasApiKey);\n  const accessLevel = (provider: string): ProviderAccessLevel => {\n    const authProviderId = getAuthProviderId(provider);\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      const credential = userRec?.credential ?? orgRec?.credential;\n      if (credential?.type === 'oauth') return 'oauth';\n      if (credential?.type === 'api_key' && credential.key.trim().length > 0) return 'apikey';\n      return false;\n    }\n\n    const oauthCredential = authStorage?.get(authProviderId);\n    if (oauthCredential?.type === 'oauth') return 'oauth';\n    if (authStorage?.hasStoredApiKey(provider)) return 'apikey';\n    const directCredential = authStorage?.get(provider);\n    if (directCredential?.type === 'api_key' && directCredential.key.trim().length > 0) return 'apikey';\n    return hasModelKey(provider) ? 'apikey' : false;\n  };\n  const access: ProviderAccess = {\n    anthropic: accessLevel('anthropic'),\n    openai: accessLevel('openai'),\n    cerebras: accessLevel('cerebras'),\n    google: accessLevel('google'),\n    deepseek: accessLevel('deepseek'),\n    'github-copilot': accessLevel('github-copilot'),\n  };\n  const seen = new Set(Object.keys(access));\n  for (const m of models) {\n    if (!seen.has(m.provider)) {\n      access[m.provider] = accessLevel(m.provider);\n      seen.add(m.provider);\n    }\n  }\n  return access;\n}\n\nfunction canUseModelProvider(access: ProviderAccess, provider: string): boolean {\n  return Boolean(access[provider]);\n}\n\n/**\n * Where a request's custom model packs live. Same posture as memory settings\n * and custom providers: the `model-packs` factory storage domain, scoped per\n * org in deployed mode and to a sentinel `local` org in no-auth mode — never\n * settings.json.\n */\nexport interface PackContext {\n  storage: ModelPacksStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the pack context for a request, or a ready-to-return error response. */\nasync function resolvePackContext({\n  c,\n  auth,\n  modelPacks,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  modelPacks?: ModelPacksStorage;\n}): Promise<PackContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (modelPacks) {\n    try {\n      await modelPacks.ensureReady();\n      return tenant\n        ? { storage: modelPacks, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: modelPacks, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'model_packs_unavailable',\n        message: 'Model pack storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** DB row → the `ModePack` shape the packs list and activation flow consume. */\nfunction recordToModePack(record: ModelPackRecord): ModePack {\n  return { id: `custom:${record.id}`, name: record.name, description: 'Saved custom pack', models: record.models };\n}\n\n/**\n * List available model packs (built-in, gated by provider access, plus saved\n * custom packs from the request's pack context). Drops the synthetic\n * \"New Custom\" placeholder — the web client has its own create flow. `active`\n * is set from the given session's thread when a resourceId is supplied.\n */\nexport async function listModelPacks({\n  controller,\n  authStorage,\n  tenantCredentials,\n  packContext,\n  activePackId,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n  packContext: PackContext;\n  activePackId?: string | null;\n}): Promise<ModelPackInfo[]> {\n  const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });\n  const packs = [\n    ...getAvailableModePacks(access),\n    ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack),\n  ];\n  return packs\n    .filter(p => p.id !== 'custom') // synthetic \"choose each model\" placeholder\n    .map(p => ({\n      ...p,\n      custom: p.id.startsWith('custom:'),\n      active: activePackId != null && p.id === activePackId,\n    }));\n}\n\n/** Resolve the active pack id for a session by reading its current thread. */\nasync function resolveActivePackId(session: PackSession | undefined): Promise<string | null> {\n  if (!session) return null;\n  const threadId = session.thread.getId();\n  if (!threadId) return null;\n  const thread = (await session.thread.list()).find(t => t.id === threadId);\n  const value = thread?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];\n  return typeof value === 'string' ? value : null;\n}\n\n/**\n * Apply a pack to a session: seed each mode's default model, switch the current\n * mode's model, set per-subagent models, and tag the thread with the active\n * pack id. Mirrors the TUI `applyPack` orchestration.\n */\nasync function applyPackToSession({\n  controller,\n  session,\n  pack,\n}: {\n  controller: ModelCatalog;\n  session: PackSession;\n  pack: ModePack;\n}): Promise<void> {\n  const modes = controller.listModes?.() ?? [];\n  const packModels = pack.models as Record<string, string>;\n\n  for (const mode of modes) {\n    const modelId = packModels[mode.id];\n    if (modelId) {\n      mode.defaultModelId = modelId;\n      await session.thread.setSetting({ key: `modeModelId_${mode.id}`, value: modelId });\n    }\n  }\n\n  const currentModeModel = packModels[session.mode.get()];\n  if (currentModeModel) {\n    await session.model.switch({ modelId: currentModeModel });\n  }\n\n  const subagentModeMap: Record<string, string> = { explore: 'fast', plan: 'plan', execute: 'build' };\n  for (const [agentType, modeId] of Object.entries(subagentModeMap)) {\n    const saModelId = packModels[modeId];\n    if (saModelId) {\n      await session.subagents.model.set({ modelId: saModelId, agentType });\n    }\n  }\n\n  await session.thread.setSetting({ key: THREAD_ACTIVE_MODEL_PACK_ID_KEY, value: pack.id });\n}\n\n// ── Observational memory ────────────────────────────────────────────────────\n// Mirrors the TUI `/om` command. Settings are persisted per organization and\n// user in the Factory app database. Requests with an active session also apply\n// changes immediately to that session's state and thread settings.\n\n/** Default thresholds mirror the TUI `/om` fallbacks. */\nconst DEFAULT_OBSERVATION_THRESHOLD = 30_000;\nconst DEFAULT_REFLECTION_THRESHOLD = 40_000;\n\n/** Read the current OM config from a session. */\nexport interface OMConfigInfo {\n  observerModelId: string;\n  reflectorModelId: string;\n  observationThreshold: number;\n  reflectionThreshold: number;\n  observeAttachments: 'auto' | boolean;\n}\n\nexport interface ProviderOMDefaultsResponse {\n  ok: true;\n  config: OMConfigInfo;\n}\n\nexport function readOMConfig(session: OMSession): OMConfigInfo {\n  const state = session.state.get() ?? {};\n  const observeAttachments = state.observeAttachments;\n  return {\n    observerModelId: session.om.observer.modelId() ?? '',\n    reflectorModelId: session.om.reflector.modelId() ?? '',\n    observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : 'auto',\n  };\n}\n\nfunction readStoredOMConfig(record: MemorySettingsRecord | null): OMConfigInfo {\n  return {\n    observerModelId: record?.observerModelId ?? DEFAULT_OM_MODEL_ID,\n    reflectorModelId: record?.reflectorModelId ?? DEFAULT_OM_MODEL_ID,\n    observationThreshold: record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: record?.observeAttachments ?? 'auto',\n  };\n}\n\n/**\n * Where a request's OM settings live: the `memory-settings` factory storage\n * domain, one row per (org, user). Without a tenant (auth disabled), settings\n * land on a sentinel `(local, local)` row in the same table — the web surface\n * never reads or writes `settings.json` for memory settings.\n */\ninterface MemorySettingsContext {\n  storage: MemorySettingsStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the memory-settings context for a request, or a ready-to-return error response. */\nasync function resolveMemorySettingsContext({\n  c,\n  auth,\n  memorySettings,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  memorySettings?: MemorySettingsStorage;\n}): Promise<MemorySettingsContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (memorySettings) {\n    try {\n      await memorySettings.ensureReady();\n      return tenant\n        ? { storage: memorySettings, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: memorySettings, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'memory_settings_unavailable',\n        message: 'Memory settings storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Persist an OM knob change to the caller's memory-settings row. */\nasync function persistMemorySettings(\n  context: MemorySettingsContext,\n  patch: MemorySettingsPatch,\n  fillIfUnset?: MemorySettingsFillIfUnset,\n): Promise<void> {\n  await context.storage.patch({ orgId: context.orgId, userId: context.userId, patch, fillIfUnset });\n}\n\n/**\n * Apply the stored memory-settings row onto the session, so the DB — not\n * whatever happens to sit in persisted session state (e.g. a stale boot-time\n * seed from before memory settings moved to the DB) — is what the web surface\n * reads and what the session's OM actually runs with. The row is authoritative:\n * knobs without a stored value reset to the built-in defaults.\n */\nasync function hydrateSessionMemorySettings(session: OMSession, record: MemorySettingsRecord | null): Promise<void> {\n  for (const role of ['observer', 'reflector'] as const) {\n    const stored = role === 'observer' ? record?.observerModelId : record?.reflectorModelId;\n    const target = stored ?? DEFAULT_OM_MODEL_ID;\n    if (session.om[role].modelId() !== target) {\n      await session.om[role].switchModel({ modelId: target });\n    }\n  }\n  const state = session.state.get() ?? {};\n  const updates: OMStateWrites = {};\n  const observationThreshold = record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD;\n  if (state.observationThreshold !== observationThreshold) {\n    updates.observationThreshold = observationThreshold;\n  }\n  const reflectionThreshold = record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD;\n  if (state.reflectionThreshold !== reflectionThreshold) {\n    updates.reflectionThreshold = reflectionThreshold;\n  }\n  const observeAttachments = record?.observeAttachments ?? 'auto';\n  if ((state.observeAttachments ?? 'auto') !== observeAttachments) {\n    updates.observeAttachments = observeAttachments;\n  }\n  if (Object.keys(updates).length > 0) await session.state.set(updates);\n}\n\n/** Dependencies injected into {@link ConfigRoutes}. */\nexport interface ConfigRoutesDeps extends RouteDependencies {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Tenant model-packs domain handle; absent in local (no-DB) mode. */\n  modelPacks?: ModelPacksStorage;\n  /** Tenant memory-settings domain handle; absent in local (no-DB) mode. */\n  memorySettings?: MemorySettingsStorage;\n  /** Custom-providers domain handle; absent when the app database is missing. */\n  customProviders?: CustomProvidersStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n  /** Notifies the host after custom providers change so model-router caches can be dropped. */\n  onCustomProvidersChanged?: (tenant: { orgId: string }) => void;\n}\n\n/**\n * The web config routes as Mastra `apiRoutes`:\n *   - `GET    /web/config/providers`              — list providers + key source\n *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key\n *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key\n *   - `GET    /web/config/models`                  — list available models (credentialed providers)\n *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers\n *   - `POST   /web/config/custom-providers`        — create/update a custom provider\n *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider\n *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments\n *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model\n *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds\n *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)\n */\nexport class ConfigRoutes extends Route<ConfigRoutesDeps> {\n  routes(): ApiRoute[] {\n    const options = this.deps;\n    const { controller, authStorage, auth } = options;\n    const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});\n    const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            // Tenant mode lists the caller's rows and never exposes the\n            // server-global auth.json; local mode is unchanged.\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            // Tenant mode also reports whether the caller may write org-wide\n            // keys, so the settings UI can gate the \"Everyone in org\" option.\n            const tenant = auth.tenant(loose(c));\n            const orgKeyAdmin = tenant ? await auth.isOrganizationAdmin(loose(c), tenantOrgId(tenant)) : undefined;\n            return c.json({\n              providers: await listProviders({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n              ...(orgKeyAdmin !== undefined ? { orgKeyAdmin } : {}),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          let body: { key?: unknown; envVar?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const key = typeof body.key === 'string' ? body.key.trim() : '';\n          if (!key) return c.json({ error: 'Missing required field: key' }, 400);\n          const envVar = typeof body.envVar === 'string' ? body.envVar : undefined;\n          const scope = body.scope === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              // envVar is intentionally ignored: tenant credentials are resolved\n              // per-request, never written into process.env.\n              await ctx.storage.setCredential(tenant, getAuthProviderId(provider), { type: 'api_key', key });\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            // Local mode is single-user: scope is meaningless and ignored.\n            authStorage.setStoredApiKey(provider, key, envVar);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            authStorage.remove(`apikey:${provider}`);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────\n      // Mirrors the TUI's /custom-providers command, but backed by the\n      // `custom-providers` domain (org rows in tenant mode, a sentinel `local`\n      // org in no-auth mode) — the server never reads settings.json for these.\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          try {\n            const records = await ctx.storage.list({ orgId: ctx.orgId });\n            return c.json({ providers: records.map(toCustomProviderInfo) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const parsed = parseCustomProviderBody(body);\n          if ('error' in parsed) return c.json({ error: parsed.error }, 400);\n          // `previousId` lets a rename remove the old entry as well as any name clash.\n          const previousId =\n            body && typeof body === 'object' && typeof (body as Record<string, unknown>).previousId === 'string'\n              ? ((body as Record<string, unknown>).previousId as string)\n              : undefined;\n          try {\n            const record = await ctx.storage.upsert({\n              orgId: ctx.orgId,\n              userId: ctx.userId,\n              input: {\n                providerId: getCustomProviderId(parsed.name),\n                name: parsed.name,\n                url: parsed.url,\n                apiKey: parsed.apiKey,\n                models: parsed.models,\n              },\n              previousProviderId: previousId,\n            });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true, provider: toCustomProviderInfo(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          const id = c.req.param('id');\n          try {\n            await ctx.storage.delete({ orgId: ctx.orgId, providerId: id });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Available models ────────────────────────────────────────────────────\n      // Session-independent model catalog for settings pickers (Factory default\n      // model, pack editors). Only models whose provider has a credential are\n      // returned — the same filter the session-scoped hook applies client-side.\n\n      registerApiRoute('/web/config/models', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const [models, access] = await Promise.all([\n              controller.listAvailableModels(),\n              buildProviderAccess({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            ]);\n            const catalog = models\n              .filter(m => canUseModelProvider(access, m.provider) && typeof m.id === 'string')\n              .map(m => ({ id: m.id!, provider: m.provider, modelName: m.modelName, hasApiKey: true }));\n            // Append the caller's custom provider models (DB-backed, org rows in\n            // tenant mode / sentinel `local` org in no-auth mode). The boot-time\n            // gateway catalog only carries the local list, so tenant callers get\n            // theirs here. Dedupe against ids already present.\n            if (options.customProviders) {\n              try {\n                const ctx = await resolveCustomProvidersContext({\n                  c: loose(c),\n                  auth,\n                  customProviders: options.customProviders,\n                });\n                if (!('response' in ctx)) {\n                  const known = new Set(catalog.map(m => m.id));\n                  for (const record of await ctx.storage.list({ orgId: ctx.orgId })) {\n                    for (const model of record.models) {\n                      const id = `${record.providerId}/${model}`;\n                      if (known.has(id)) continue;\n                      known.add(id);\n                      catalog.push({ id, provider: record.providerId, modelName: model, hasApiKey: true });\n                    }\n                  }\n                }\n              } catch {\n                // Fail soft: the catalog still serves the built-in models.\n              }\n            }\n            return c.json({\n              models: catalog.sort((a, b) =>\n                a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider),\n              ),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Model packs ─────────────────────────────────────────────────────────\n      // Mirrors the TUI's /models-pack command. Custom-pack CRUD lives in the\n      // model-packs storage domain (org-scoped, sentinel `local` org in no-auth\n      // mode — never settings.json); activation is session-scoped and resolves\n      // the session from the controller registry by resourceId.\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const activePackId = await resolveActivePackId(session);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              packs: await listModelPacks({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n                packContext,\n                activePackId,\n              }),\n              activePackId,\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          let body: { name?: unknown; models?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const name = typeof body.name === 'string' ? body.name.trim() : '';\n          if (!name) return c.json({ error: 'Missing required field: name' }, 400);\n          const m = (body.models ?? {}) as Record<string, unknown>;\n          const build = typeof m.build === 'string' ? m.build.trim() : '';\n          const plan = typeof m.plan === 'string' ? m.plan.trim() : '';\n          const fast = typeof m.fast === 'string' ? m.fast.trim() : '';\n          if (!build || !plan || !fast) {\n            return c.json({ error: 'models.build, models.plan and models.fast are required' }, 400);\n          }\n          try {\n            const record = await packContext.storage.upsert({\n              orgId: packContext.orgId,\n              userId: packContext.userId,\n              input: { name, models: { build, plan, fast } },\n            });\n            return c.json({ ok: true, pack: recordToModePack(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          try {\n            const recordId = id.startsWith('custom:') ? id.slice('custom:'.length) : id;\n            const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });\n            return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack \"${id}\"` }, 404);\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id/activate', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          let body: { resourceId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const packs = await listModelPacks({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n              packContext,\n            });\n            const pack = packs.find(p => p.id === id);\n            if (!pack) return c.json({ error: `Unknown pack \"${id}\"` }, 404);\n            await applyPackToSession({ controller, session, pack });\n            return c.json({ ok: true, activePackId: pack.id });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/provider-defaults', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { providerId?: unknown; factoryModelId?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const providerId = typeof body.providerId === 'string' ? body.providerId.trim() : '';\n          const factoryModelId = typeof body.factoryModelId === 'string' ? body.factoryModelId.trim() : '';\n          if (!providerId) return c.json({ error: 'Missing required field: providerId' }, 400);\n\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const access = await buildProviderAccess({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n            });\n            if (!access[providerId]) return c.json({ error: `Provider \"${providerId}\" is not configured` }, 400);\n\n            const modelId = resolveProviderOMDefault(providerId, factoryModelId).modelId;\n            const record = await context.storage.patch({\n              orgId: context.orgId,\n              userId: context.userId,\n              patch: {},\n              fillIfUnset: { observerModelId: modelId, reflectorModelId: modelId },\n            });\n            return c.json({ ok: true, config: readStoredOMConfig(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Observational memory ──────────────────────────────────────────────────\n      // Mirrors the TUI's /om command. All five knobs are durably stored in the\n      // per-(org, user) `memory-settings` app table — never settings.json. When a\n      // session is supplied, changes are also applied to its state and thread.\n\n      registerApiRoute('/web/config/om', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });\n            if (!resourceId) return c.json({ config: readStoredOMConfig(record) });\n\n            // Session sync is best-effort: the stored row is authoritative and\n            // new sessions hydrate from it, so a resourceId without a live\n            // session (e.g. settings page after a restart) still reads the\n            // stored config instead of failing.\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ config: readStoredOMConfig(record) });\n            await hydrateSessionMemorySettings(session, record);\n            return c.json({ config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/:role/model', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const role = c.req.param('role');\n          if (role !== 'observer' && role !== 'reflector') {\n            return c.json({ error: `Unknown OM role \"${role}\"` }, 400);\n          }\n          let body: { resourceId?: unknown; modelId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const modelId = typeof body.modelId === 'string' ? body.modelId.trim() : '';\n          if (!modelId) return c.json({ error: 'Missing required field: modelId' }, 400);\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            // Best-effort session sync: persist regardless, apply to the live\n            // session only when one exists for the resourceId.\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const otherRole = session ? (role === 'observer' ? session.om.reflector : session.om.observer) : undefined;\n            const otherRoleCurrentModelId = otherRole?.modelId() ?? null;\n            await session?.om[role].switchModel({ modelId });\n            // Pin the other role's current model too, so a later restart\n            // doesn't drift it once this role is explicitly overridden. The\n            // \"only if still unset\" check runs inside the storage layer's\n            // atomic update, so a concurrent explicit switch of the other\n            // role is never clobbered by this fill.\n            const otherKey = role === 'observer' ? 'reflectorModelId' : 'observerModelId';\n            await persistMemorySettings(\n              context,\n              { [role === 'observer' ? 'observerModelId' : 'reflectorModelId']: modelId },\n              otherRoleCurrentModelId ? { [otherKey]: otherRoleCurrentModelId } : undefined,\n            );\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/thresholds', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: {\n            resourceId?: unknown;\n            observationThreshold?: unknown;\n            reflectionThreshold?: unknown;\n            scope?: unknown;\n          };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const observation =\n            typeof body.observationThreshold === 'number' && body.observationThreshold > 0\n              ? Math.round(body.observationThreshold)\n              : undefined;\n          const reflection =\n            typeof body.reflectionThreshold === 'number' && body.reflectionThreshold > 0\n              ? Math.round(body.reflectionThreshold)\n              : undefined;\n          if (observation === undefined && reflection === undefined) {\n            return c.json({ error: 'Provide observationThreshold and/or reflectionThreshold (positive numbers)' }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            // Best-effort session sync: persist regardless, apply to the live\n            // session only when one exists for the resourceId.\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (observation !== undefined && session) {\n              await session.state.set({ observationThreshold: observation });\n              await session.thread.setSetting({ key: 'observationThreshold', value: observation });\n            }\n            if (reflection !== undefined && session) {\n              await session.state.set({ reflectionThreshold: reflection });\n              await session.thread.setSetting({ key: 'reflectionThreshold', value: reflection });\n            }\n            await persistMemorySettings(context, {\n              ...(observation !== undefined ? { observationThreshold: observation } : {}),\n              ...(reflection !== undefined ? { reflectionThreshold: reflection } : {}),\n            });\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/observe-attachments', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { resourceId?: unknown; value?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const raw = body.value;\n          const value: 'auto' | boolean = raw === 'auto' || raw === true || raw === false ? raw : 'auto';\n          if (raw !== 'auto' && raw !== true && raw !== false) {\n            return c.json({ error: \"value must be 'auto', true, or false\" }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            // Best-effort session sync: persist regardless, apply to the live\n            // session only when one exists for the resourceId.\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (session) {\n              await session.state.set({ observeAttachments: value });\n              await session.thread.setSetting({ key: 'observeAttachments', value });\n            }\n            await persistMemorySettings(context, { observeAttachments: value });\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;AAkCA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;;;;;AAuGA,eAAsB,cAAc,EAClC,YACA,aACA,qBAK0B;CAC1B,MAAM,SAAS,MAAM,WAAW,oBAAoB;CACpD,MAAM,uBAAO,IAAI,IAA0B;CAE3C,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,KAAK,IAAI,MAAM,QAAQ,GAAG;EAE9B,MAAM,iBAAiB,kBAAkB,MAAM,QAAQ;EACvD,IAAI,SAAiC;EACrC,IAAI;EACJ,IAAI,mBAAmB;GACrB,MAAM,UAAU,kBAAkB,MAAK,MAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;GAC/F,MAAM,SAAS,kBAAkB,MAAK,MAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;GAC7F,SAAS,QAAQ,WAAW,SAAS;GACrC,IAAI,SAAS,WAAW,SAAS,SAC/B,SAAS;QACJ,IAAI,SAAS,WAAW,SAAS,WACtC,SAAS;QACJ,IAAI,QAAQ,WAAW,SAAS,WACrC,SAAS;EAEb,OAAO,IAAI,aAAa,WAAW,cAAc,GAC/C,SAAS;OACJ,IAAI,aAAa,gBAAgB,MAAM,QAAQ,GACpD,SAAS;OACJ,IAAI,MAAM,gBAAgB,QAAQ,IAAI,MAAM,eACjD,SAAS;OACJ,IAAI,MAAM,WACf,SAAS;EAGX,MAAM,WAAW,qBAAqB,MAAM;EAC5C,KAAK,IAAI,MAAM,UAAU;GACvB,UAAU,MAAM;GAChB,QAAQ,MAAM;GACd;GACA,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;GACzC,GAAI,WAAW,EAAE,OAAO;IAAE,WAAW;IAAe,OAAO,CAAC,QAAQ;GAAE,EAAE,IAAI,CAAC;EAC/E,CAAC;CACH;CAEA,OAAO,MAAM,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtF;;AAYA,SAAS,qBAAqB,QAAkD;CAC9E,OAAO;EACL,IAAI,OAAO;EACX,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,WAAW,QAAQ,OAAO,MAAM;EAChC,QAAQ,OAAO;CACjB;AACF;;;;;;AAcA,eAAe,8BAA8B,EAC3C,GACA,MACA,mBAK2D;CAC3D,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,UAAU,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACzF,IAAI,iBACF,IAAI;EACF,MAAM,gBAAgB,YAAY;EAClC,OAAO,SACH;GAAE,SAAS;GAAiB,OAAO,YAAY,MAAM;GAAG,QAAQ,OAAO;EAAO,IAC9E;GAAE,SAAS;GAAiB,OAAO;GAAS,QAAQ;EAAQ;CAClE,QAAQ,CAER;CAEF,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;AACF;;AAGA,SAAS,wBAAwB,MAA0D;CACzF,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU,OAAO,EAAE,OAAO,oBAAoB;CAC3E,MAAM,IAAI;CACV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;CAC1D,IAAI,CAAC,MAAM,OAAO,EAAE,OAAO,+BAA+B;CAC1D,MAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,IAAI,KAAK,IAAI;CACvD,IAAI,CAAC,KAAK,OAAO,EAAE,OAAO,8BAA8B;CACxD,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,OAAO,EAAE,OAAO,6BAA6B;CAEjD,QAAQ;EACN,OAAO,EAAE,OAAO,0BAA0B;CAC5C;CAKA,OAAO;EAAE;EAAM;EAAK,QAJL,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,KAAK,IAAI,KAAA;EAIvD,QAHb,MAAM,QAAQ,EAAE,MAAM,IACjC,EAAE,OAAO,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,IACnG,CAAC;CAC8B;AACrC;;;;;;AAeA,eAAsB,oBAAoB,EACxC,YACA,aACA,qBAK0B;CAC1B,MAAM,SAAS,MAAM,WAAW,oBAAoB;CACpD,MAAM,eAAe,aAAqB,OAAO,MAAK,MAAK,EAAE,aAAa,YAAY,EAAE,SAAS;CACjG,MAAM,eAAe,aAA0C;EAC7D,MAAM,iBAAiB,kBAAkB,QAAQ;EACjD,IAAI,mBAAmB;GACrB,MAAM,UAAU,kBAAkB,MAAK,MAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;GAC/F,MAAM,SAAS,kBAAkB,MAAK,MAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;GAC7F,MAAM,aAAa,SAAS,cAAc,QAAQ;GAClD,IAAI,YAAY,SAAS,SAAS,OAAO;GACzC,IAAI,YAAY,SAAS,aAAa,WAAW,IAAI,KAAK,CAAC,CAAC,SAAS,GAAG,OAAO;GAC/E,OAAO;EACT;EAGA,KADwB,aAAa,IAAI,cAAc,EAAA,EAClC,SAAS,SAAS,OAAO;EAC9C,IAAI,aAAa,gBAAgB,QAAQ,GAAG,OAAO;EACnD,MAAM,mBAAmB,aAAa,IAAI,QAAQ;EAClD,IAAI,kBAAkB,SAAS,aAAa,iBAAiB,IAAI,KAAK,CAAC,CAAC,SAAS,GAAG,OAAO;EAC3F,OAAO,YAAY,QAAQ,IAAI,WAAW;CAC5C;CACA,MAAM,SAAyB;EAC7B,WAAW,YAAY,WAAW;EAClC,QAAQ,YAAY,QAAQ;EAC5B,UAAU,YAAY,UAAU;EAChC,QAAQ,YAAY,QAAQ;EAC5B,UAAU,YAAY,UAAU;EAChC,kBAAkB,YAAY,gBAAgB;CAChD;CACA,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;CACxC,KAAK,MAAM,KAAK,QACd,IAAI,CAAC,KAAK,IAAI,EAAE,QAAQ,GAAG;EACzB,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ;EAC3C,KAAK,IAAI,EAAE,QAAQ;CACrB;CAEF,OAAO;AACT;AAEA,SAAS,oBAAoB,QAAwB,UAA2B;CAC9E,OAAO,QAAQ,OAAO,SAAS;AACjC;;AAeA,eAAe,mBAAmB,EAChC,GACA,MACA,cAKgD;CAChD,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,UAAU,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACzF,IAAI,YACF,IAAI;EACF,MAAM,WAAW,YAAY;EAC7B,OAAO,SACH;GAAE,SAAS;GAAY,OAAO,YAAY,MAAM;GAAG,QAAQ,OAAO;EAAO,IACzE;GAAE,SAAS;GAAY,OAAO;GAAS,QAAQ;EAAQ;CAC7D,QAAQ,CAER;CAEF,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;AACF;;AAGA,SAAS,iBAAiB,QAAmC;CAC3D,OAAO;EAAE,IAAI,UAAU,OAAO;EAAM,MAAM,OAAO;EAAM,aAAa;EAAqB,QAAQ,OAAO;CAAO;AACjH;;;;;;;AAQA,eAAsB,eAAe,EACnC,YACA,aACA,mBACA,aACA,gBAO2B;CAM3B,OAAO,CAHL,GAAG,sBAAsB,MAFN,oBAAoB;EAAE;EAAY;EAAa;CAAkB,CAAC,CAEtD,GAC/B,IAAI,MAAM,YAAY,QAAQ,KAAK,EAAE,OAAO,YAAY,MAAM,CAAC,EAAA,CAAG,IAAI,gBAAgB,CAE7E,CAAC,CACT,QAAO,MAAK,EAAE,OAAO,QAAQ,CAAC,CAC9B,KAAI,OAAM;EACT,GAAG;EACH,QAAQ,EAAE,GAAG,WAAW,SAAS;EACjC,QAAQ,gBAAgB,QAAQ,EAAE,OAAO;CAC3C,EAAE;AACN;;AAGA,eAAe,oBAAoB,SAA0D;CAC3F,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,WAAW,QAAQ,OAAO,MAAM;CACtC,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,SADU,MAAM,QAAQ,OAAO,KAAK,EAAA,CAAG,MAAK,MAAK,EAAE,OAAO,QAC7C,CAAC,EAAE,WAAW;CACjC,OAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;;;;;;AAOA,eAAe,mBAAmB,EAChC,YACA,SACA,QAKgB;CAChB,MAAM,QAAQ,WAAW,YAAY,KAAK,CAAC;CAC3C,MAAM,aAAa,KAAK;CAExB,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,UAAU,WAAW,KAAK;EAChC,IAAI,SAAS;GACX,KAAK,iBAAiB;GACtB,MAAM,QAAQ,OAAO,WAAW;IAAE,KAAK,eAAe,KAAK;IAAM,OAAO;GAAQ,CAAC;EACnF;CACF;CAEA,MAAM,mBAAmB,WAAW,QAAQ,KAAK,IAAI;CACrD,IAAI,kBACF,MAAM,QAAQ,MAAM,OAAO,EAAE,SAAS,iBAAiB,CAAC;CAI1D,KAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ;EADC,SAAS;EAAQ,MAAM;EAAQ,SAAS;CAC3B,CAAC,GAAG;EACjE,MAAM,YAAY,WAAW;EAC7B,IAAI,WACF,MAAM,QAAQ,UAAU,MAAM,IAAI;GAAE,SAAS;GAAW;EAAU,CAAC;CAEvE;CAEA,MAAM,QAAQ,OAAO,WAAW;EAAE,KAAK;EAAiC,OAAO,KAAK;CAAG,CAAC;AAC1F;;AAQA,MAAM,gCAAgC;AACtC,MAAM,+BAA+B;AAgBrC,SAAgB,aAAa,SAAkC;CAE7D,MAAM,sBADQ,QAAQ,MAAM,IAAI,KAAK,CAAC,EAAA,CACL;CACjC,OAAO;EACL,iBAAiB,QAAQ,GAAG,SAAS,QAAQ,KAAK;EAClD,kBAAkB,QAAQ,GAAG,UAAU,QAAQ,KAAK;EACpD,sBAAsB,QAAQ,GAAG,SAAS,UAAU,KAAK;EACzD,qBAAqB,QAAQ,GAAG,UAAU,UAAU,KAAK;EACzD,oBAAoB,uBAAuB,QAAQ,uBAAuB,QAAQ,qBAAqB;CACzG;AACF;AAEA,SAAS,mBAAmB,QAAmD;CAC7E,OAAO;EACL,iBAAiB,QAAQ,mBAAmB;EAC5C,kBAAkB,QAAQ,oBAAoB;EAC9C,sBAAsB,QAAQ,wBAAwB;EACtD,qBAAqB,QAAQ,uBAAuB;EACpD,oBAAoB,QAAQ,sBAAsB;CACpD;AACF;;AAeA,eAAe,6BAA6B,EAC1C,GACA,MACA,kBAK0D;CAC1D,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,UAAU,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACzF,IAAI,gBACF,IAAI;EACF,MAAM,eAAe,YAAY;EACjC,OAAO,SACH;GAAE,SAAS;GAAgB,OAAO,YAAY,MAAM;GAAG,QAAQ,OAAO;EAAO,IAC7E;GAAE,SAAS;GAAgB,OAAO;GAAS,QAAQ;EAAQ;CACjE,QAAQ,CAER;CAEF,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;AACF;;AAGA,eAAe,sBACb,SACA,OACA,aACe;CACf,MAAM,QAAQ,QAAQ,MAAM;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;EAAQ;EAAO;CAAY,CAAC;AAClG;;;;;;;;AASA,eAAe,6BAA6B,SAAoB,QAAoD;CAClH,KAAK,MAAM,QAAQ,CAAC,YAAY,WAAW,GAAY;EAErD,MAAM,UADS,SAAS,aAAa,QAAQ,kBAAkB,QAAQ,qBAC9C;EACzB,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,MAAM,QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,SAAS,OAAO,CAAC;CAE1D;CACA,MAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;CACtC,MAAM,UAAyB,CAAC;CAChC,MAAM,uBAAuB,QAAQ,wBAAwB;CAC7D,IAAI,MAAM,yBAAyB,sBACjC,QAAQ,uBAAuB;CAEjC,MAAM,sBAAsB,QAAQ,uBAAuB;CAC3D,IAAI,MAAM,wBAAwB,qBAChC,QAAQ,sBAAsB;CAEhC,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,KAAK,MAAM,sBAAsB,YAAY,oBAC3C,QAAQ,qBAAqB;CAE/B,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAAG,MAAM,QAAQ,MAAM,IAAI,OAAO;AACtE;;;;;;;;;;;;;;;AAkCA,IAAa,eAAb,cAAkC,MAAwB;CACxD,SAAqB;EACnB,MAAM,UAAU,KAAK;EACrB,MAAM,EAAE,YAAY,aAAa,SAAS;EAC1C,MAAM,uBAAuB,QAAQ,+BAA+B,CAAC;EACrE,MAAM,2BAA2B,QAAQ,mCAAmC,CAAC;EAE7E,OAAO;GACL,iBAAiB,yBAAyB;IACxC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,IAAI;MAGF,MAAM,oBAAoB,MAAM,gCAAgC;OAC9D,GAAG,MAAM,CAAC;OACV;OACA,aAAa,QAAQ;MACvB,CAAC;MAGD,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;MACnC,MAAM,cAAc,SAAS,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,YAAY,MAAM,CAAC,IAAI,KAAA;MAC7F,OAAO,EAAE,KAAK;OACZ,WAAW,MAAM,cAAc;QAC7B;QACA,aAAa,oBAAoB,KAAA,IAAY;QAC7C;OACF,CAAC;OACD,GAAI,gBAAgB,KAAA,IAAY,EAAE,YAAY,IAAI,CAAC;MACrD,CAAC;KACH,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,uCAAuC;IACtD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa,QAAQ;KAAiB,CAAC;KACvG,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,IAAI,KAAK,IAAI;KAC7D,IAAI,CAAC,KAAK,OAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;KACrE,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;KAC/D,MAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;KAC7C,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;OAE7D,MAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI;QAAE,OAAO,IAAI;QAAO,QAAQ,IAAI;OAAO;OAG/F,MAAM,IAAI,QAAQ,cAAc,QAAQ,kBAAkB,QAAQ,GAAG;QAAE,MAAM;QAAW;OAAI,CAAC;OAC7F,qBAAqB,MAAM;OAC3B,MAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;OACvE,MAAM,YAAY,MAAM,cAAc;QAAE;QAAY,mBAAmB;OAAQ,CAAC;OAChF,OAAO,EAAE,KAAK;QAAE,IAAI;QAAM,UAAU,UAAU,MAAK,MAAK,EAAE,aAAa,QAAQ;OAAE,CAAC;MACpF;MACA,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;MAErF,YAAY,gBAAgB,UAAU,KAAK,MAAM;MACjD,MAAM,YAAY,MAAM,cAAc;OAAE;OAAY;MAAY,CAAC;MACjE,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM,UAAU,UAAU,MAAK,MAAK,EAAE,aAAa,QAAQ;MAAE,CAAC;KACpF,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,uCAAuC;IACtD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa,QAAQ;KAAiB,CAAC;KACvG,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;KACvD,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;OAE7D,MAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI;QAAE,OAAO,IAAI;QAAO,QAAQ,IAAI;OAAO;OAC/F,MAAM,IAAI,QAAQ,iBAAiB,QAAQ,kBAAkB,QAAQ,CAAC;OACtE,qBAAqB,MAAM;OAC3B,MAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;OACvE,MAAM,YAAY,MAAM,cAAc;QAAE;QAAY,mBAAmB;OAAQ,CAAC;OAChF,OAAO,EAAE,KAAK;QAAE,IAAI;QAAM,UAAU,UAAU,MAAK,MAAK,EAAE,aAAa,QAAQ;OAAE,CAAC;MACpF;MACA,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;MACrF,YAAY,OAAO,UAAU,UAAU;MACvC,MAAM,YAAY,MAAM,cAAc;OAAE;OAAY;MAAY,CAAC;MACjE,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM,UAAU,UAAU,MAAK,MAAK,EAAE,aAAa,QAAQ;MAAE,CAAC;KACpF,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAOD,iBAAiB,gCAAgC;IAC/C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,8BAA8B;MAC9C,GAAG,MAAM,CAAC;MACV;MACA,iBAAiB,QAAQ;KAC3B,CAAC;KACD,IAAI,cAAc,KAAK,OAAO,IAAI;KAClC,IAAI;MACF,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC;MAC3D,OAAO,EAAE,KAAK,EAAE,WAAW,QAAQ,IAAI,oBAAoB,EAAE,CAAC;KAChE,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,gCAAgC;IAC/C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,8BAA8B;MAC9C,GAAG,MAAM,CAAC;MACV;MACA,iBAAiB,QAAQ;KAC3B,CAAC;KACD,IAAI,cAAc,KAAK,OAAO,IAAI;KAClC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,SAAS,wBAAwB,IAAI;KAC3C,IAAI,WAAW,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,GAAG;KAEjE,MAAM,aACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,eAAe,WACtF,KAAiC,aACnC,KAAA;KACN,IAAI;MACF,MAAM,SAAS,MAAM,IAAI,QAAQ,OAAO;OACtC,OAAO,IAAI;OACX,QAAQ,IAAI;OACZ,OAAO;QACL,YAAY,oBAAoB,OAAO,IAAI;QAC3C,MAAM,OAAO;QACb,KAAK,OAAO;QACZ,QAAQ,OAAO;QACf,QAAQ,OAAO;OACjB;OACA,oBAAoB;MACtB,CAAC;MACD,yBAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;MAC7C,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM,UAAU,qBAAqB,MAAM;MAAE,CAAC;KACpE,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,oCAAoC;IACnD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,8BAA8B;MAC9C,GAAG,MAAM,CAAC;MACV;MACA,iBAAiB,QAAQ;KAC3B,CAAC;KACD,IAAI,cAAc,KAAK,OAAO,IAAI;KAClC,MAAM,KAAK,EAAE,IAAI,MAAM,IAAI;KAC3B,IAAI;MACF,MAAM,IAAI,QAAQ,OAAO;OAAE,OAAO,IAAI;OAAO,YAAY;MAAG,CAAC;MAC7D,yBAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;MAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;KAC5B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAOD,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,IAAI;MACF,MAAM,oBAAoB,MAAM,gCAAgC;OAC9D,GAAG,MAAM,CAAC;OACV;OACA,aAAa,QAAQ;MACvB,CAAC;MACD,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CACzC,WAAW,oBAAoB,GAC/B,oBAAoB;OAClB;OACA,aAAa,oBAAoB,KAAA,IAAY;OAC7C;MACF,CAAC,CACH,CAAC;MACD,MAAM,UAAU,OACb,QAAO,MAAK,oBAAoB,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,CAChF,KAAI,OAAM;OAAE,IAAI,EAAE;OAAK,UAAU,EAAE;OAAU,WAAW,EAAE;OAAW,WAAW;MAAK,EAAE;MAK1F,IAAI,QAAQ,iBACV,IAAI;OACF,MAAM,MAAM,MAAM,8BAA8B;QAC9C,GAAG,MAAM,CAAC;QACV;QACA,iBAAiB,QAAQ;OAC3B,CAAC;OACD,IAAI,EAAE,cAAc,MAAM;QACxB,MAAM,QAAQ,IAAI,IAAI,QAAQ,KAAI,MAAK,EAAE,EAAE,CAAC;QAC5C,KAAK,MAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,GAC9D,KAAK,MAAM,SAAS,OAAO,QAAQ;SACjC,MAAM,KAAK,GAAG,OAAO,WAAW,GAAG;SACnC,IAAI,MAAM,IAAI,EAAE,GAAG;SACnB,MAAM,IAAI,EAAE;SACZ,QAAQ,KAAK;UAAE;UAAI,UAAU,OAAO;UAAY,WAAW;UAAO,WAAW;SAAK,CAAC;QACrF;OAEJ;MACF,QAAQ,CAER;MAEF,OAAO,EAAE,KAAK,EACZ,QAAQ,QAAQ,MAAM,GAAG,MACvB,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,cAAc,EAAE,QAAQ,CAC5F,EACF,CAAC;KACH,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAQD,iBAAiB,2BAA2B;IAC1C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,cAAc,MAAM,mBAAmB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,YAAY,QAAQ;KAAW,CAAC;KAClG,IAAI,cAAc,aAAa,OAAO,YAAY;KAClD,MAAM,aAAa,EAAE,IAAI,MAAM,YAAY;KAC3C,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACtC,IAAI;MAEF,MAAM,eAAe,MAAM,oBADX,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI,KAAA,CACpC;MACtD,MAAM,oBAAoB,MAAM,gCAAgC;OAC9D,GAAG,MAAM,CAAC;OACV;OACA,aAAa,QAAQ;MACvB,CAAC;MACD,OAAO,EAAE,KAAK;OACZ,OAAO,MAAM,eAAe;QAC1B;QACA,aAAa,oBAAoB,KAAA,IAAY;QAC7C;QACA;QACA;OACF,CAAC;OACD;MACF,CAAC;KACH,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,2BAA2B;IAC1C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,cAAc,MAAM,mBAAmB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,YAAY,QAAQ;KAAW,CAAC;KAClG,IAAI,cAAc,aAAa,OAAO,YAAY;KAClD,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;KAChE,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KACvE,MAAM,IAAK,KAAK,UAAU,CAAC;KAC3B,MAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,KAAK,IAAI;KAC7D,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;KAC1D,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;KAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MACtB,OAAO,EAAE,KAAK,EAAE,OAAO,yDAAyD,GAAG,GAAG;KAExF,IAAI;MACF,MAAM,SAAS,MAAM,YAAY,QAAQ,OAAO;OAC9C,OAAO,YAAY;OACnB,QAAQ,YAAY;OACpB,OAAO;QAAE;QAAM,QAAQ;SAAE;SAAO;SAAM;QAAK;OAAE;MAC/C,CAAC;MACD,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM,MAAM,iBAAiB,MAAM;MAAE,CAAC;KAC5D,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,+BAA+B;IAC9C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,cAAc,MAAM,mBAAmB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,YAAY,QAAQ;KAAW,CAAC;KAClG,IAAI,cAAc,aAAa,OAAO,YAAY;KAClD,MAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;KAC/C,IAAI;MACF,MAAM,WAAW,GAAG,WAAW,SAAS,IAAI,GAAG,MAAM,CAAgB,IAAI;MAEzE,OAAO,MADe,YAAY,QAAQ,OAAO;OAAE,OAAO,YAAY;OAAO,IAAI;MAAS,CAAC,IAC1E,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,GAAG;KACvF,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,wCAAwC;IACvD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,cAAc,MAAM,mBAAmB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,YAAY,QAAQ;KAAW,CAAC;KAClG,IAAI,cAAc,aAAa,OAAO,YAAY;KAClD,MAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;KAC/C,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;KAC3E,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ,KAAA;KAC1E,IAAI,CAAC,YAAY,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;KACnF,IAAI;MACF,MAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;MACzE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,WAAW,GAAG,GAAG,GAAG;MACvF,MAAM,oBAAoB,MAAM,gCAAgC;OAC9D,GAAG,MAAM,CAAC;OACV;OACA,aAAa,QAAQ;MACvB,CAAC;MAOD,MAAM,QAAO,MANO,eAAe;OACjC;OACA,aAAa,oBAAoB,KAAA,IAAY;OAC7C;OACA;MACF,CAAC,EAAA,CACkB,MAAK,MAAK,EAAE,OAAO,EAAE;MACxC,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,GAAG;MAC/D,MAAM,mBAAmB;OAAE;OAAY;OAAS;MAAK,CAAC;MACtD,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM,cAAc,KAAK;MAAG,CAAC;KACnD,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,oCAAoC;IACnD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,KAAK,IAAI;KAClF,MAAM,iBAAiB,OAAO,KAAK,mBAAmB,WAAW,KAAK,eAAe,KAAK,IAAI;KAC9F,IAAI,CAAC,YAAY,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;KAEnF,MAAM,UAAU,MAAM,6BAA6B;MACjD,GAAG,MAAM,CAAC;MACV;MACA,gBAAgB,QAAQ;KAC1B,CAAC;KACD,IAAI,cAAc,SAAS,OAAO,QAAQ;KAE1C,IAAI;MACF,MAAM,oBAAoB,MAAM,gCAAgC;OAC9D,GAAG,MAAM,CAAC;OACV;OACA,aAAa,QAAQ;MACvB,CAAC;MAMD,IAAI,EAAC,MALgB,oBAAoB;OACvC;OACA,aAAa,oBAAoB,KAAA,IAAY;OAC7C;MACF,CAAC,EAAA,CACW,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,aAAa,WAAW,qBAAqB,GAAG,GAAG;MAEnG,MAAM,UAAU,yBAAyB,YAAY,cAAc,CAAC,CAAC;MACrE,MAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM;OACzC,OAAO,QAAQ;OACf,QAAQ,QAAQ;OAChB,OAAO,CAAC;OACR,aAAa;QAAE,iBAAiB;QAAS,kBAAkB;OAAQ;MACrE,CAAC;MACD,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM,QAAQ,mBAAmB,MAAM;MAAE,CAAC;KAChE,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAOD,iBAAiB,kBAAkB;IACjC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,aAAa,EAAE,IAAI,MAAM,YAAY;KAC3C,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACtC,MAAM,UAAU,MAAM,6BAA6B;MACjD,GAAG,MAAM,CAAC;MACV;MACA,gBAAgB,QAAQ;KAC1B,CAAC;KACD,IAAI,cAAc,SAAS,OAAO,QAAQ;KAC1C,IAAI;MACF,MAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI;OAAE,OAAO,QAAQ;OAAO,QAAQ,QAAQ;MAAO,CAAC;MACzF,IAAI,CAAC,YAAY,OAAO,EAAE,KAAK,EAAE,QAAQ,mBAAmB,MAAM,EAAE,CAAC;MAMrE,MAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;MACzE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,QAAQ,mBAAmB,MAAM,EAAE,CAAC;MAClE,MAAM,6BAA6B,SAAS,MAAM;MAClD,OAAO,EAAE,KAAK,EAAE,QAAQ,aAAa,OAAO,EAAE,CAAC;KACjD,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,8BAA8B;IAC7C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;KAC/B,IAAI,SAAS,cAAc,SAAS,aAClC,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,KAAK,GAAG,GAAG,GAAG;KAE3D,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;KAC3E,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ,KAAA;KAC1E,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,KAAK,IAAI;KACzE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,kCAAkC,GAAG,GAAG;KAC7E,MAAM,UAAU,MAAM,6BAA6B;MACjD,GAAG,MAAM,CAAC;MACV;MACA,gBAAgB,QAAQ;KAC1B,CAAC;KACD,IAAI,cAAc,SAAS,OAAO,QAAQ;KAC1C,IAAI;MAGF,MAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI,KAAA;MAE1F,MAAM,2BADY,UAAW,SAAS,aAAa,QAAQ,GAAG,YAAY,QAAQ,GAAG,WAAY,KAAA,EAAA,EACtD,QAAQ,KAAK;MACxD,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC;MAM/C,MAAM,WAAW,SAAS,aAAa,qBAAqB;MAC5D,MAAM,sBACJ,SACA,GAAG,SAAS,aAAa,oBAAoB,qBAAqB,QAAQ,GAC1E,0BAA0B,GAAG,WAAW,wBAAwB,IAAI,KAAA,CACtE;MACA,MAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI;OAAE,OAAO,QAAQ;OAAO,QAAQ,QAAQ;MAAO,CAAC,CAAC;MAClG,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM;MAAO,CAAC;KACpC,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,IAAI;KAMJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;KAC3E,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ,KAAA;KAC1E,MAAM,cACJ,OAAO,KAAK,yBAAyB,YAAY,KAAK,uBAAuB,IACzE,KAAK,MAAM,KAAK,oBAAoB,IACpC,KAAA;KACN,MAAM,aACJ,OAAO,KAAK,wBAAwB,YAAY,KAAK,sBAAsB,IACvE,KAAK,MAAM,KAAK,mBAAmB,IACnC,KAAA;KACN,IAAI,gBAAgB,KAAA,KAAa,eAAe,KAAA,GAC9C,OAAO,EAAE,KAAK,EAAE,OAAO,6EAA6E,GAAG,GAAG;KAE5G,MAAM,UAAU,MAAM,6BAA6B;MACjD,GAAG,MAAM,CAAC;MACV;MACA,gBAAgB,QAAQ;KAC1B,CAAC;KACD,IAAI,cAAc,SAAS,OAAO,QAAQ;KAC1C,IAAI;MAGF,MAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI,KAAA;MAC1F,IAAI,gBAAgB,KAAA,KAAa,SAAS;OACxC,MAAM,QAAQ,MAAM,IAAI,EAAE,sBAAsB,YAAY,CAAC;OAC7D,MAAM,QAAQ,OAAO,WAAW;QAAE,KAAK;QAAwB,OAAO;OAAY,CAAC;MACrF;MACA,IAAI,eAAe,KAAA,KAAa,SAAS;OACvC,MAAM,QAAQ,MAAM,IAAI,EAAE,qBAAqB,WAAW,CAAC;OAC3D,MAAM,QAAQ,OAAO,WAAW;QAAE,KAAK;QAAuB,OAAO;OAAW,CAAC;MACnF;MACA,MAAM,sBAAsB,SAAS;OACnC,GAAI,gBAAgB,KAAA,IAAY,EAAE,sBAAsB,YAAY,IAAI,CAAC;OACzE,GAAI,eAAe,KAAA,IAAY,EAAE,qBAAqB,WAAW,IAAI,CAAC;MACxE,CAAC;MACD,MAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI;OAAE,OAAO,QAAQ;OAAO,QAAQ,QAAQ;MAAO,CAAC,CAAC;MAClG,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM;MAAO,CAAC;KACpC,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;GAED,iBAAiB,sCAAsC;IACrD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;KAC3E,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ,KAAA;KAC1E,MAAM,MAAM,KAAK;KACjB,MAAM,QAA0B,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;KACxF,IAAI,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,OAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;KAEtE,MAAM,UAAU,MAAM,6BAA6B;MACjD,GAAG,MAAM,CAAC;MACV;MACA,gBAAgB,QAAQ;KAC1B,CAAC;KACD,IAAI,cAAc,SAAS,OAAO,QAAQ;KAC1C,IAAI;MAGF,MAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI,KAAA;MAC1F,IAAI,SAAS;OACX,MAAM,QAAQ,MAAM,IAAI,EAAE,oBAAoB,MAAM,CAAC;OACrD,MAAM,QAAQ,OAAO,WAAW;QAAE,KAAK;QAAsB;OAAM,CAAC;MACtE;MACA,MAAM,sBAAsB,SAAS,EAAE,oBAAoB,MAAM,CAAC;MAClE,MAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI;OAAE,OAAO,QAAQ;OAAO,QAAQ,QAAQ;MAAO,CAAC,CAAC;MAClG,OAAO,EAAE,KAAK;OAAE,IAAI;OAAM;MAAO,CAAC;KACpC,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;EACH;CACF;AACF"}

package/dist/routes/custom-provider-source.d.ts

@@ -0,0 +1,52 @@
+/**
+ * DB-backed custom providers source for model resolution (factory mode).
+ *
+ * The SDK's `resolveModel` and gateway catalog ask the registered
+ * `CustomProvidersSource` synchronously, so this module keeps a small per-org
+ * **snapshot** of custom provider rows hydrated from the `custom-providers`
+ * domain. Once registered the source is authoritative — the factory never
+ * reads `settings.json` custom providers, in either auth mode:
+ *
+ * - tenant mode: rows are scoped per org (`tenantOrgId`); calls without an
+ *   authenticated tenant (boot-time catalog) resolve to an empty list.
+ * - no-auth/local mode: rows live under the sentinel `local` org, matching the
+ *   custom provider routes.
+ *
+ * Snapshots are primed per request by `createCustomProvidersPrimer` (mounted
+ * after the web auth gate) and invalidated on writes via
+ * `invalidateCustomProvidersSnapshots` so changes are visible immediately.
+ */
+import type { MiddlewareHandler } from 'hono';
+import type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';
+import type { RouteAuth } from './route.js';
+/**
+ * Register the DB-backed custom providers source with the SDK. Called by the
+ * factory after storage init with the `custom-providers` domain handle; from
+ * then on model resolution and the gateway catalog never read settings.json
+ * custom providers.
+ */
+export declare function registerCustomProvidersSource({ storage, authEnabled, }: {
+    storage: CustomProvidersStorage;
+    authEnabled: boolean;
+}): void;
+/**
+ * Drop the org's cached snapshot after a custom provider write so the change
+ * is visible to the next model call immediately instead of after the TTL.
+ */
+export declare function invalidateCustomProvidersSnapshots(tenant: {
+    orgId: string;
+}): void;
+/** Test hook: clear registration and cached org snapshots. */
+export declare function resetCustomProvidersSourceForTests(): void;
+/**
+ * Middleware mounted after the web auth gate: primes the caller's org snapshot
+ * so the request's first model call sees their custom providers without an
+ * async seam in model resolution. Cheap when fresh (TTL check), best-effort
+ * when not — a failed hydrate serves the last snapshot, never blocks a request.
+ */
+export declare function createCustomProvidersPrimer({ auth, storage, authEnabled, }: {
+    auth: RouteAuth;
+    storage: CustomProvidersStorage;
+    authEnabled: boolean;
+}): MiddlewareHandler;
+//# sourceMappingURL=custom-provider-source.d.ts.map

package/dist/routes/custom-provider-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-source.d.ts","sourceRoot":"","sources":["../../src/routes/custom-provider-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAE1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA6E5C;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACP,WAAW,GACZ,EAAE;IACD,OAAO,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAMP;AAED;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAElF;AAED,8DAA8D;AAC9D,wBAAgB,kCAAkC,IAAI,IAAI,CAGzD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,IAAI,EACJ,OAAO,EACP,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,iBAAiB,CAYpB"}

package/dist/routes/custom-provider-source.js

@@ -0,0 +1,124 @@
+import { tenantOrgId } from "./provider-credentials.js";
+import { setCustomProvidersSource } from "@mastra/code-sdk/agents/custom-provider-source";
+//#region src/routes/custom-provider-source.ts
+/**
+* DB-backed custom providers source for model resolution (factory mode).
+*
+* The SDK's `resolveModel` and gateway catalog ask the registered
+* `CustomProvidersSource` synchronously, so this module keeps a small per-org
+* **snapshot** of custom provider rows hydrated from the `custom-providers`
+* domain. Once registered the source is authoritative — the factory never
+* reads `settings.json` custom providers, in either auth mode:
+*
+* - tenant mode: rows are scoped per org (`tenantOrgId`); calls without an
+*   authenticated tenant (boot-time catalog) resolve to an empty list.
+* - no-auth/local mode: rows live under the sentinel `local` org, matching the
+*   custom provider routes.
+*
+* Snapshots are primed per request by `createCustomProvidersPrimer` (mounted
+* after the web auth gate) and invalidated on writes via
+* `invalidateCustomProvidersSnapshots` so changes are visible immediately.
+*/
+/** How long a hydrated snapshot is considered fresh. */
+const SNAPSHOT_TTL_MS = 15e3;
+/** Cap on cached org snapshots; oldest-inserted evicted beyond this. */
+const MAX_CACHED_ORGS = 1e3;
+/** Sentinel org for no-auth mode — must match the custom provider routes. */
+const LOCAL_ORG = "local";
+var OrgCustomProvidersSnapshot = class {
+	#orgId;
+	#storage;
+	#snapshot = [];
+	#fetchedAt = 0;
+	#hydrating;
+	constructor(orgId, storage) {
+		this.#orgId = orgId;
+		this.#storage = storage;
+	}
+	/** Hydrate the snapshot when stale; coalesces concurrent callers. */
+	async ensureFresh(now = Date.now()) {
+		if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+		this.#hydrating ??= this.#hydrate().finally(() => {
+			this.#hydrating = void 0;
+		});
+		await this.#hydrating;
+	}
+	async #hydrate() {
+		await this.#storage.ensureReady();
+		const records = await this.#storage.list({ orgId: this.#orgId });
+		this.#snapshot = records.map((record) => ({
+			name: record.name,
+			url: record.url,
+			apiKey: record.apiKey ?? void 0,
+			models: record.models
+		}));
+		this.#fetchedAt = Date.now();
+	}
+	/** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+	get() {
+		if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) this.ensureFresh().catch(() => {});
+		return this.#snapshot;
+	}
+};
+const orgSnapshots = /* @__PURE__ */ new Map();
+function snapshotFor(orgId, storage) {
+	let snapshot = orgSnapshots.get(orgId);
+	if (!snapshot) {
+		if (orgSnapshots.size >= MAX_CACHED_ORGS) {
+			const oldest = orgSnapshots.keys().next().value;
+			if (oldest !== void 0) orgSnapshots.delete(oldest);
+		}
+		snapshot = new OrgCustomProvidersSnapshot(orgId, storage);
+		orgSnapshots.set(orgId, snapshot);
+	}
+	return snapshot;
+}
+/** The org a call resolves to, or `undefined` to fail closed (tenant mode without identity). */
+function orgForTenant(tenant, authEnabled) {
+	if (!authEnabled) return LOCAL_ORG;
+	return tenant ? tenantOrgId(tenant) : void 0;
+}
+/**
+* Register the DB-backed custom providers source with the SDK. Called by the
+* factory after storage init with the `custom-providers` domain handle; from
+* then on model resolution and the gateway catalog never read settings.json
+* custom providers.
+*/
+function registerCustomProvidersSource({ storage, authEnabled }) {
+	setCustomProvidersSource((tenant) => {
+		const orgId = orgForTenant(tenant, authEnabled);
+		if (!orgId) return [];
+		return snapshotFor(orgId, storage).get();
+	});
+}
+/**
+* Drop the org's cached snapshot after a custom provider write so the change
+* is visible to the next model call immediately instead of after the TTL.
+*/
+function invalidateCustomProvidersSnapshots(tenant) {
+	orgSnapshots.delete(tenant.orgId);
+}
+/** Test hook: clear registration and cached org snapshots. */
+function resetCustomProvidersSourceForTests() {
+	setCustomProvidersSource(void 0);
+	orgSnapshots.clear();
+}
+/**
+* Middleware mounted after the web auth gate: primes the caller's org snapshot
+* so the request's first model call sees their custom providers without an
+* async seam in model resolution. Cheap when fresh (TTL check), best-effort
+* when not — a failed hydrate serves the last snapshot, never blocks a request.
+*/
+function createCustomProvidersPrimer({ auth, storage, authEnabled }) {
+	return async (c, next) => {
+		const orgId = orgForTenant(auth.tenant(c), authEnabled);
+		if (orgId) try {
+			await snapshotFor(orgId, storage).ensureFresh();
+		} catch {}
+		await next();
+	};
+}
+//#endregion
+export { createCustomProvidersPrimer, invalidateCustomProvidersSnapshots, registerCustomProvidersSource, resetCustomProvidersSourceForTests };
+
+//# sourceMappingURL=custom-provider-source.js.map

package/dist/routes/custom-provider-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-source.js","names":["#orgId","#storage","#fetchedAt","#hydrating","#hydrate","#snapshot"],"sources":["../../src/routes/custom-provider-source.ts"],"sourcesContent":["/**\n * DB-backed custom providers source for model resolution (factory mode).\n *\n * The SDK's `resolveModel` and gateway catalog ask the registered\n * `CustomProvidersSource` synchronously, so this module keeps a small per-org\n * **snapshot** of custom provider rows hydrated from the `custom-providers`\n * domain. Once registered the source is authoritative — the factory never\n * reads `settings.json` custom providers, in either auth mode:\n *\n * - tenant mode: rows are scoped per org (`tenantOrgId`); calls without an\n *   authenticated tenant (boot-time catalog) resolve to an empty list.\n * - no-auth/local mode: rows live under the sentinel `local` org, matching the\n *   custom provider routes.\n *\n * Snapshots are primed per request by `createCustomProvidersPrimer` (mounted\n * after the web auth gate) and invalidated on writes via\n * `invalidateCustomProvidersSnapshots` so changes are visible immediately.\n */\n\nimport { setCustomProvidersSource } from '@mastra/code-sdk/agents/custom-provider-source';\nimport type { MastraCodeCustomProvider } from '@mastra/code-sdk/agents/mastracode-gateway';\nimport type { MiddlewareHandler } from 'hono';\n\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport { tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached org snapshots; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_ORGS = 1000;\n\n/** Sentinel org for no-auth mode — must match the custom provider routes. */\nconst LOCAL_ORG = 'local';\n\nclass OrgCustomProvidersSnapshot {\n  readonly #orgId: string;\n  readonly #storage: CustomProvidersStorage;\n  #snapshot: MastraCodeCustomProvider[] = [];\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(orgId: string, storage: CustomProvidersStorage) {\n    this.#orgId = orgId;\n    this.#storage = storage;\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    await this.#storage.ensureReady();\n    const records = await this.#storage.list({ orgId: this.#orgId });\n    this.#snapshot = records.map(record => ({\n      name: record.name,\n      url: record.url,\n      apiKey: record.apiKey ?? undefined,\n      models: record.models,\n    }));\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  get(): MastraCodeCustomProvider[] {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n    return this.#snapshot;\n  }\n}\n\nconst orgSnapshots = new Map<string, OrgCustomProvidersSnapshot>();\n\nfunction snapshotFor(orgId: string, storage: CustomProvidersStorage): OrgCustomProvidersSnapshot {\n  let snapshot = orgSnapshots.get(orgId);\n  if (!snapshot) {\n    if (orgSnapshots.size >= MAX_CACHED_ORGS) {\n      const oldest = orgSnapshots.keys().next().value;\n      if (oldest !== undefined) orgSnapshots.delete(oldest);\n    }\n    snapshot = new OrgCustomProvidersSnapshot(orgId, storage);\n    orgSnapshots.set(orgId, snapshot);\n  }\n  return snapshot;\n}\n\n/** The org a call resolves to, or `undefined` to fail closed (tenant mode without identity). */\nfunction orgForTenant(\n  tenant: { orgId?: string; userId: string } | undefined,\n  authEnabled: boolean,\n): string | undefined {\n  if (!authEnabled) return LOCAL_ORG;\n  return tenant ? tenantOrgId(tenant) : undefined;\n}\n\n/**\n * Register the DB-backed custom providers source with the SDK. Called by the\n * factory after storage init with the `custom-providers` domain handle; from\n * then on model resolution and the gateway catalog never read settings.json\n * custom providers.\n */\nexport function registerCustomProvidersSource({\n  storage,\n  authEnabled,\n}: {\n  storage: CustomProvidersStorage;\n  authEnabled: boolean;\n}): void {\n  setCustomProvidersSource(tenant => {\n    const orgId = orgForTenant(tenant, authEnabled);\n    if (!orgId) return [];\n    return snapshotFor(orgId, storage).get();\n  });\n}\n\n/**\n * Drop the org's cached snapshot after a custom provider write so the change\n * is visible to the next model call immediately instead of after the TTL.\n */\nexport function invalidateCustomProvidersSnapshots(tenant: { orgId: string }): void {\n  orgSnapshots.delete(tenant.orgId);\n}\n\n/** Test hook: clear registration and cached org snapshots. */\nexport function resetCustomProvidersSourceForTests(): void {\n  setCustomProvidersSource(undefined);\n  orgSnapshots.clear();\n}\n\n/**\n * Middleware mounted after the web auth gate: primes the caller's org snapshot\n * so the request's first model call sees their custom providers without an\n * async seam in model resolution. Cheap when fresh (TTL check), best-effort\n * when not — a failed hydrate serves the last snapshot, never blocks a request.\n */\nexport function createCustomProvidersPrimer({\n  auth,\n  storage,\n  authEnabled,\n}: {\n  auth: RouteAuth;\n  storage: CustomProvidersStorage;\n  authEnabled: boolean;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const orgId = orgForTenant(auth.tenant(c), authEnabled);\n    if (orgId) {\n      try {\n        await snapshotFor(orgId, storage).ensureFresh();\n      } catch {\n        // Fail open: model calls serve the last snapshot (or none).\n      }\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,kBAAkB;;AAGxB,MAAM,kBAAkB;;AAGxB,MAAM,YAAY;AAElB,IAAM,6BAAN,MAAiC;CAC/B;CACA;CACA,YAAwC,CAAC;CACzC,aAAa;CACb;CAEA,YAAY,OAAe,SAAiC;EAC1D,KAAKA,SAAS;EACd,KAAKC,WAAW;CAClB;;CAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;EACjD,IAAI,MAAM,KAAKC,aAAa,iBAAiB;EAC7C,KAAKC,eAAe,KAAKC,SAAS,CAAC,CAAC,cAAc;GAChD,KAAKD,aAAa,KAAA;EACpB,CAAC;EACD,MAAM,KAAKA;CACb;CAEA,MAAMC,WAA0B;EAC9B,MAAM,KAAKH,SAAS,YAAY;EAChC,MAAM,UAAU,MAAM,KAAKA,SAAS,KAAK,EAAE,OAAO,KAAKD,OAAO,CAAC;EAC/D,KAAKK,YAAY,QAAQ,KAAI,YAAW;GACtC,MAAM,OAAO;GACb,KAAK,OAAO;GACZ,QAAQ,OAAO,UAAU,KAAA;GACzB,QAAQ,OAAO;EACjB,EAAE;EACF,KAAKH,aAAa,KAAK,IAAI;CAC7B;;CAGA,MAAkC;EAChC,IAAI,KAAK,IAAI,IAAI,KAAKA,cAAc,iBAClC,KAAU,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;EAExC,OAAO,KAAKG;CACd;AACF;AAEA,MAAM,+BAAe,IAAI,IAAwC;AAEjE,SAAS,YAAY,OAAe,SAA6D;CAC/F,IAAI,WAAW,aAAa,IAAI,KAAK;CACrC,IAAI,CAAC,UAAU;EACb,IAAI,aAAa,QAAQ,iBAAiB;GACxC,MAAM,SAAS,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,IAAI,WAAW,KAAA,GAAW,aAAa,OAAO,MAAM;EACtD;EACA,WAAW,IAAI,2BAA2B,OAAO,OAAO;EACxD,aAAa,IAAI,OAAO,QAAQ;CAClC;CACA,OAAO;AACT;;AAGA,SAAS,aACP,QACA,aACoB;CACpB,IAAI,CAAC,aAAa,OAAO;CACzB,OAAO,SAAS,YAAY,MAAM,IAAI,KAAA;AACxC;;;;;;;AAQA,SAAgB,8BAA8B,EAC5C,SACA,eAIO;CACP,0BAAyB,WAAU;EACjC,MAAM,QAAQ,aAAa,QAAQ,WAAW;EAC9C,IAAI,CAAC,OAAO,OAAO,CAAC;EACpB,OAAO,YAAY,OAAO,OAAO,CAAC,CAAC,IAAI;CACzC,CAAC;AACH;;;;;AAMA,SAAgB,mCAAmC,QAAiC;CAClF,aAAa,OAAO,OAAO,KAAK;AAClC;;AAGA,SAAgB,qCAA2C;CACzD,yBAAyB,KAAA,CAAS;CAClC,aAAa,MAAM;AACrB;;;;;;;AAQA,SAAgB,4BAA4B,EAC1C,MACA,SACA,eAKoB;CACpB,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,QAAQ,aAAa,KAAK,OAAO,CAAC,GAAG,WAAW;EACtD,IAAI,OACF,IAAI;GACF,MAAM,YAAY,OAAO,OAAO,CAAC,CAAC,YAAY;EAChD,QAAQ,CAER;EAEF,MAAM,KAAK;CACb;AACF"}

package/dist/routes/fs.d.ts

@@ -0,0 +1,151 @@
+import type { ApiRoute } from '@mastra/core/server';
+import type { SandboxFleet } from '../sandbox/fleet.js';
+import type { SourceControlSession } from '../storage/domains/source-control/base.js';
+import type { RouteAuth } from './route.js';
+/**
+ * Server-side directory browser for the web project picker.
+ *
+ * The browser cannot read absolute filesystem paths (the File System Access API
+ * only exposes a directory *name*), so the picker must ask the server — which
+ * does have filesystem access — to enumerate directories. The result is real
+ * absolute paths the user can select without typing.
+ *
+ * All access is confined to a configured `root` (default: the user's home
+ * directory). Requests that try to escape the root via `..` or symlinks are
+ * clamped back to the root.
+ */
+export interface DirectoryEntry {
+    name: string;
+    /** Absolute path to the entry. */
+    path: string;
+}
+export interface DirectoryListing {
+    /** The allowed root; clients cannot browse above this. */
+    root: string;
+    /** The absolute path that was listed. */
+    path: string;
+    /** Parent directory path, or null when `path` is the root. */
+    parent: string | null;
+    /** Subdirectories of `path` (directories only, sorted, hidden excluded). */
+    entries: DirectoryEntry[];
+}
+export interface WorkspaceRenderedEntry {
+    name: string;
+    /** Path relative to the configured rendered root. */
+    path: string;
+    type: 'file' | 'directory';
+    size: number;
+    updatedAt: string;
+}
+export interface WorkspaceRenderedListing {
+    /** The confined workspace/project root. */
+    workspacePath: string;
+    /** Configured workspace-relative rendered root, e.g. `.artifacts`. */
+    root: string;
+    /** The confined absolute path for the rendered root. */
+    rootPath: string;
+    entries: WorkspaceRenderedEntry[];
+}
+export interface WorkspaceFile {
+    /** The confined workspace/project root. */
+    workspacePath: string;
+    /** Workspace-relative file path. */
+    path: string;
+    name: string;
+    size: number;
+    updatedAt: string;
+    contentType: 'text' | 'unsupported';
+    content?: string;
+    truncated?: boolean;
+}
+export type WorkspaceChangeStatus = 'modified' | 'added' | 'deleted' | 'renamed' | 'copied' | 'untracked' | 'conflicted';
+export interface WorkspaceChange {
+    path: string;
+    previousPath?: string;
+    status: WorkspaceChangeStatus;
+    additions?: number;
+    deletions?: number;
+    binary?: boolean;
+}
+export interface WorkspaceChanges {
+    workspacePath: string;
+    available: boolean;
+    changes: WorkspaceChange[];
+    additions?: number;
+    deletions?: number;
+}
+export interface WorkspaceDiff {
+    workspacePath: string;
+    path: string;
+    patch: string;
+    truncated: boolean;
+}
+export type ArtifactEntry = WorkspaceRenderedEntry;
+export interface ArtifactListing {
+    /** The confined workspace/project root. */
+    rootPath: string;
+    /** The workspace artifact directory. */
+    artifactsPath: string;
+    entries: ArtifactEntry[];
+}
+/** Resolve the browsable root, defaulting to the user's home directory. */
+export declare function resolveFsRoot(root?: string): string;
+/**
+ * List the directories inside `requestedPath`, confined to `root`. An absent or
+ * out-of-root path is clamped to the root, so the worst a malicious client can
+ * do is browse within the allowed root.
+ */
+export declare function listDirectory(root: string, requestedPath?: string): Promise<DirectoryListing>;
+export declare function listWorkspaceRenderedPath(root: string, workspacePath: string, renderedRoot: string): Promise<WorkspaceRenderedListing>;
+export declare function readWorkspaceFile(root: string, workspacePath: string, path: string): Promise<WorkspaceFile>;
+export declare function listArtifacts(root: string, workspacePath: string): Promise<ArtifactListing>;
+/** Dependencies for resolving a `workspacePath` that is a Factory session id. */
+export interface SessionFsDeps {
+    auth: RouteAuth;
+    fleet: SandboxFleet;
+    sessions: {
+        getBySessionId(sessionId: string): Promise<SourceControlSession | null>;
+    };
+}
+/** List an approved rendered root inside a Factory session's sandbox workdir. */
+export declare function listSessionRenderedPath(fleet: SandboxFleet, session: SourceControlSession, renderedRoot: string): Promise<WorkspaceRenderedListing>;
+/** Read a file under an approved rendered root inside a session's sandbox. */
+export declare function readSessionWorkspaceFile(fleet: SandboxFleet, session: SourceControlSession, path: string): Promise<WorkspaceFile>;
+export declare function parseWorkspaceChanges(output: string): WorkspaceChange[];
+export declare function parseWorkspaceChangeStats(output: string): Map<string, {
+    additions?: number;
+    deletions?: number;
+    binary?: boolean;
+}>;
+export declare function listSessionWorkspaceChanges(fleet: SandboxFleet, session: SourceControlSession): Promise<WorkspaceChanges>;
+export declare function readSessionWorkspaceDiff(fleet: SandboxFleet, session: SourceControlSession, path: string, previousPath?: string): Promise<WorkspaceDiff>;
+export interface ResolvedCodebase {
+    /**
+     * The resourceId the TUI would use for this path — derived identically so a
+     * project opened in the terminal and in the web app resolve to the SAME
+     * session (and therefore the same threads).
+     */
+    resourceId: string;
+    name: string;
+    rootPath: string;
+    gitUrl?: string;
+    gitBranch?: string;
+}
+/**
+ * Resolve a project path to the same resourceId the TUI uses. Mirrors
+ * `createMastraCode`: detect the project, then apply any resourceId override
+ * (MASTRA_RESOURCE_ID env var or `.mastracode/database.json`). This is the
+ * shared continuity point — start in the TUI, continue on the web, same path
+ * → same resourceId → same session.
+ */
+export declare function resolveCodebase(projectPath: string): ResolvedCodebase;
+/**
+ * Build the web filesystem routes as Mastra `apiRoutes`:
+ *   - `GET /web/fs/list?path=...`        — browse directories (confined to root)
+ *   - `GET /web/codebase/resolve?path=...` — TUI-compatible codebase resourceId
+ */
+export declare function buildFsRoutes(options?: {
+    root?: string;
+    sessionFs?: SessionFsDeps;
+}): ApiRoute[];
+//# sourceMappingURL=fs.d.ts.map

package/dist/routes/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/routes/fs.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,EAA0B,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4EAA4E;IAC5E,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,aAAa,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAC7B,UAAU,GACV,OAAO,GACP,SAAS,GACT,SAAS,GACT,QAAQ,GACR,WAAW,GACX,YAAY,CAAC;AAEjB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAiDD,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AA0ED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuCnG;AAqCD,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAkBnC;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA4CjH;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAOjG;AAUD,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE;QAAE,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;KAAE,CAAC;CACvF;AA6DD,iFAAiF;AACjF,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,oBAAoB,EAC7B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAuCnC;AAED,8EAA8E;AAC9E,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,CAAC,CAyBxB;AAYD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE,CAoBvE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM;gBAEV,MAAM;gBAAc,MAAM;aAAW,OAAO;GA+BzF;AAMD,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAiBD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC,CA2DxB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAUrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAAO,GAAG,QAAQ,EAAE,CA0JpG"}