@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/dist/routes/intake.d.ts

@@ -0,0 +1,23 @@
+import type { ApiRoute } from '@mastra/core/server';
+import type { Intake } from '../capabilities/intake.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { IntakeConfig, IntakeStorage } from '../storage/domains/intake/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+export interface IntakeIntegration {
+    id: string;
+    intake: Pick<Intake, 'listSources' | 'listItems'>;
+}
+export interface IntakeRoutesDeps extends RouteDependencies {
+    audit: AuditEmitter;
+    /** Intake selection domain handle. */
+    intake: IntakeStorage;
+    integrations?: IntakeIntegration[];
+}
+/** Validate a request body into an intake config, rejecting unknown shapes. */
+export declare function parseIntakeConfig(body: unknown): IntakeConfig | null;
+export declare class IntakeRoutes extends Route<IntakeRoutesDeps> {
+    #private;
+    routes(): ApiRoute[];
+}
+//# sourceMappingURL=intake.d.ts.map

package/dist/routes/intake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../../src/routes/intake.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC,CAAC;CACnD;AAYD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,KAAK,EAAE,YAAY,CAAC;IACpB,sCAAsC;IACtC,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAaD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAuBpE;AAmBD,qBAAa,YAAa,SAAQ,KAAK,CAAC,gBAAgB,CAAC;;IAgBvD,MAAM,IAAI,QAAQ,EAAE;CA6GrB"}

package/dist/routes/intake.js

@@ -0,0 +1,179 @@
+// src/routes/intake.ts
+import { registerApiRoute } from "@mastra/core/server";
+
+// src/routes/route.ts
+var Route = class {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+};
+
+// src/routes/intake.ts
+function loose(c) {
+  return c;
+}
+function sanitizeIdList(value) {
+  if (value === null) return null;
+  if (!Array.isArray(value) || value.length > 200) return void 0;
+  const ids = value.filter((item) => typeof item === "string" && item.length > 0 && item.length <= 256);
+  return ids.length === value.length && new Set(ids).size === ids.length ? ids : void 0;
+}
+function parseIntakeConfig(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+  const entries = Object.entries(body);
+  if (entries.length > 50) return null;
+  const config = {};
+  for (const [integrationId, value] of entries) {
+    if (!integrationId || integrationId.length > 128 || typeof value !== "object" || value === null || Array.isArray(value)) {
+      return null;
+    }
+    const selection = value;
+    if (typeof selection.enabled !== "boolean") return null;
+    const sourceIds = sanitizeIdList(selection.sourceIds ?? null);
+    if (sourceIds === void 0) return null;
+    config[integrationId] = { enabled: selection.enabled, sourceIds };
+  }
+  return config;
+}
+function encodeCursor(cursors) {
+  return Object.keys(cursors).length > 0 ? Buffer.from(JSON.stringify(cursors)).toString("base64url") : null;
+}
+function decodeCursor(value) {
+  if (!value) return {};
+  try {
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+    const entries = Object.entries(parsed);
+    if (entries.some(([key, cursor]) => !key || typeof cursor !== "string")) return null;
+    return Object.fromEntries(entries);
+  } catch {
+    return null;
+  }
+}
+var IntakeRoutes = class extends Route {
+  async #resolveTenant(c) {
+    await this.deps.auth.ensureUser(c);
+    const tenant = this.deps.auth.tenant(c);
+    if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+    if (!tenant.orgId) {
+      return {
+        response: c.json(
+          { error: "organization_required", message: "Intake configuration requires an organization." },
+          403
+        )
+      };
+    }
+    return { orgId: tenant.orgId, userId: tenant.userId };
+  }
+  routes() {
+    const { audit, intake, integrations = [] } = this.deps;
+    const integrationIds = integrations.map((integration) => integration.id);
+    return [
+      registerApiRoute("/web/intake/config", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          const tenant = await this.#resolveTenant(loose(c));
+          if ("response" in tenant) return tenant.response;
+          await intake.ensureReady();
+          const config = await intake.getConfig({ ...tenant, integrationIds });
+          return c.json({ config });
+        }
+      }),
+      registerApiRoute("/web/intake/config", {
+        method: "PUT",
+        requiresAuth: false,
+        handler: async (c) => {
+          const tenant = await this.#resolveTenant(loose(c));
+          if ("response" in tenant) return tenant.response;
+          let body;
+          try {
+            body = await c.req.json();
+          } catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+          }
+          const config = parseIntakeConfig(body);
+          if (!config || Object.keys(config).some((integrationId) => !integrationIds.includes(integrationId))) {
+            return c.json({ error: "invalid_config" }, 400);
+          }
+          await intake.ensureReady();
+          await intake.saveConfig({ ...tenant, config });
+          await audit.emit({
+            context: loose(c),
+            input: {
+              action: "factory.intake.config_updated",
+              targets: [{ type: "intake_config", id: tenant.orgId }],
+              metadata: Object.fromEntries(
+                Object.entries(config).map(([integrationId, selection]) => [
+                  integrationId,
+                  { enabled: selection.enabled, sources: selection.sourceIds?.length ?? null }
+                ])
+              )
+            }
+          });
+          return c.json({ config });
+        }
+      }),
+      registerApiRoute("/web/intake/sources", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          const tenant = await this.#resolveTenant(loose(c));
+          if ("response" in tenant) return tenant.response;
+          const pages = await Promise.all(
+            integrations.map(async (integration) => ({
+              integrationId: integration.id,
+              sources: await integration.intake.listSources(tenant)
+            }))
+          );
+          return c.json({
+            sources: pages.flatMap(
+              (page) => page.sources.map((source) => ({ integrationId: page.integrationId, ...source }))
+            )
+          });
+        }
+      }),
+      registerApiRoute("/web/intake/items", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (c) => {
+          const tenant = await this.#resolveTenant(loose(c));
+          if ("response" in tenant) return tenant.response;
+          const cursors = decodeCursor(c.req.query("cursor"));
+          if (!cursors) return c.json({ error: "invalid_cursor" }, 400);
+          await intake.ensureReady();
+          const config = await intake.getConfig({ ...tenant, integrationIds });
+          const items = [];
+          const nextCursors = {};
+          for (const integration of integrations) {
+            const selection = config[integration.id];
+            if (!selection?.enabled || !selection.sourceIds?.length) continue;
+            const page = await integration.intake.listItems({
+              ...tenant,
+              sourceIds: selection.sourceIds,
+              ...cursors[integration.id] ? { cursor: cursors[integration.id] } : {}
+            });
+            items.push(
+              ...page.items.map((item) => {
+                const { source, ...candidate } = item;
+                return {
+                  ...candidate,
+                  integrationId: integration.id,
+                  externalSource: { integrationId: integration.id, ...source }
+                };
+              })
+            );
+            if (page.nextCursor) nextCursors[integration.id] = page.nextCursor;
+          }
+          return c.json({ items, nextCursor: encodeCursor(nextCursors) });
+        }
+      })
+    ];
+  }
+};
+export {
+  IntakeRoutes,
+  parseIntakeConfig
+};
+//# sourceMappingURL=intake.js.map

package/dist/routes/intake.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/intake.ts","../../src/routes/route.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { Intake, IntakeItem } from '../capabilities/intake.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { IntakeConfig, IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface IntakeIntegration {\n  id: string;\n  intake: Pick<Intake, 'listSources' | 'listItems'>;\n}\n\ninterface AggregatedIntakeItem extends Omit<IntakeItem, 'source'> {\n  integrationId: string;\n  externalSource: {\n    integrationId: string;\n    type: string;\n    externalId: string;\n    url?: string;\n  };\n}\n\nexport interface IntakeRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Intake selection domain handle. */\n  intake: IntakeStorage;\n  integrations?: IntakeIntegration[];\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction sanitizeIdList(value: unknown): string[] | null | undefined {\n  if (value === null) return null;\n  if (!Array.isArray(value) || value.length > 200) return undefined;\n  const ids = value.filter((item): item is string => typeof item === 'string' && item.length > 0 && item.length <= 256);\n  return ids.length === value.length && new Set(ids).size === ids.length ? ids : undefined;\n}\n\n/** Validate a request body into an intake config, rejecting unknown shapes. */\nexport function parseIntakeConfig(body: unknown): IntakeConfig | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const entries = Object.entries(body);\n  if (entries.length > 50) return null;\n\n  const config: IntakeConfig = {};\n  for (const [integrationId, value] of entries) {\n    if (\n      !integrationId ||\n      integrationId.length > 128 ||\n      typeof value !== 'object' ||\n      value === null ||\n      Array.isArray(value)\n    ) {\n      return null;\n    }\n    const selection = value as { enabled?: unknown; sourceIds?: unknown };\n    if (typeof selection.enabled !== 'boolean') return null;\n    const sourceIds = sanitizeIdList(selection.sourceIds ?? null);\n    if (sourceIds === undefined) return null;\n    config[integrationId] = { enabled: selection.enabled, sourceIds };\n  }\n  return config;\n}\n\nfunction encodeCursor(cursors: Record<string, string>): string | null {\n  return Object.keys(cursors).length > 0 ? Buffer.from(JSON.stringify(cursors)).toString('base64url') : null;\n}\n\nfunction decodeCursor(value: string | undefined): Record<string, string> | null {\n  if (!value) return {};\n  try {\n    const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return null;\n    const entries = Object.entries(parsed);\n    if (entries.some(([key, cursor]) => !key || typeof cursor !== 'string')) return null;\n    return Object.fromEntries(entries) as Record<string, string>;\n  } catch {\n    return null;\n  }\n}\n\nexport class IntakeRoutes extends Route<IntakeRoutesDeps> {\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'Intake configuration requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    const { audit, intake, integrations = [] } = this.deps;\n    const integrationIds = integrations.map(integration => integration.id);\n\n    return [\n      registerApiRoute('/web/intake/config', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          const config = await intake.getConfig({ ...tenant, integrationIds });\n          return c.json({ config });\n        },\n      }),\n      registerApiRoute('/web/intake/config', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const config = parseIntakeConfig(body);\n          if (!config || Object.keys(config).some(integrationId => !integrationIds.includes(integrationId))) {\n            return c.json({ error: 'invalid_config' }, 400);\n          }\n\n          await intake.ensureReady();\n          await intake.saveConfig({ ...tenant, config });\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.config_updated',\n              targets: [{ type: 'intake_config', id: tenant.orgId }],\n              metadata: Object.fromEntries(\n                Object.entries(config).map(([integrationId, selection]) => [\n                  integrationId,\n                  { enabled: selection.enabled, sources: selection.sourceIds?.length ?? null },\n                ]),\n              ),\n            },\n          });\n          return c.json({ config });\n        },\n      }),\n      registerApiRoute('/web/intake/sources', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const pages = await Promise.all(\n            integrations.map(async integration => ({\n              integrationId: integration.id,\n              sources: await integration.intake.listSources(tenant),\n            })),\n          );\n          return c.json({\n            sources: pages.flatMap(page =>\n              page.sources.map(source => ({ integrationId: page.integrationId, ...source })),\n            ),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/items', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const cursors = decodeCursor(c.req.query('cursor'));\n          if (!cursors) return c.json({ error: 'invalid_cursor' }, 400);\n\n          await intake.ensureReady();\n          const config = await intake.getConfig({ ...tenant, integrationIds });\n          const items: AggregatedIntakeItem[] = [];\n          const nextCursors: Record<string, string> = {};\n          for (const integration of integrations) {\n            const selection = config[integration.id];\n            if (!selection?.enabled || !selection.sourceIds?.length) continue;\n            const page = await integration.intake.listItems({\n              ...tenant,\n              sourceIds: selection.sourceIds,\n              ...(cursors[integration.id] ? { cursor: cursors[integration.id] } : {}),\n            });\n            items.push(\n              ...page.items.map(item => {\n                const { source, ...candidate } = item;\n                return {\n                  ...candidate,\n                  integrationId: integration.id,\n                  externalSource: { integrationId: integration.id, ...source },\n                };\n              }),\n            );\n            if (page.nextCursor) nextCursors[integration.id] = page.nextCursor;\n          }\n          return c.json({ items, nextCursor: encodeCursor(nextCursors) });\n        },\n      }),\n    ];\n  }\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AACA,SAAS,wBAAwB;;;ACyC1B,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;ADnBA,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AAEA,SAAS,eAAe,OAA6C;AACnE,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,IAAK,QAAO;AACxD,QAAM,MAAM,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,KAAK,UAAU,GAAG;AACpH,SAAO,IAAI,WAAW,MAAM,UAAU,IAAI,IAAI,GAAG,EAAE,SAAS,IAAI,SAAS,MAAM;AACjF;AAGO,SAAS,kBAAkB,MAAoC;AACpE,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,EAAG,QAAO;AAC7E,QAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,MAAI,QAAQ,SAAS,GAAI,QAAO;AAEhC,QAAM,SAAuB,CAAC;AAC9B,aAAW,CAAC,eAAe,KAAK,KAAK,SAAS;AAC5C,QACE,CAAC,iBACD,cAAc,SAAS,OACvB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GACnB;AACA,aAAO;AAAA,IACT;AACA,UAAM,YAAY;AAClB,QAAI,OAAO,UAAU,YAAY,UAAW,QAAO;AACnD,UAAM,YAAY,eAAe,UAAU,aAAa,IAAI;AAC5D,QAAI,cAAc,OAAW,QAAO;AACpC,WAAO,aAAa,IAAI,EAAE,SAAS,UAAU,SAAS,UAAU;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,aAAa,SAAgD;AACpE,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW,IAAI;AACxG;AAEA,SAAS,aAAa,OAA0D;AAC9E,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM,CAAC;AAC1E,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnF,UAAM,UAAU,OAAO,QAAQ,MAAM;AACrC,QAAI,QAAQ,KAAK,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,OAAO,OAAO,WAAW,QAAQ,EAAG,QAAO;AAChF,WAAO,OAAO,YAAY,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,eAAN,cAA2B,MAAwB;AAAA,EACxD,MAAM,eAAe,GAAiF;AACpG,UAAM,KAAK,KAAK,KAAK,WAAW,CAAC;AACjC,UAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;AACtC,QAAI,CAAC,OAAQ,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACvE,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,UAAU,EAAE;AAAA,UACV,EAAE,OAAO,yBAAyB,SAAS,iDAAiD;AAAA,UAC5F;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AAAA,EACtD;AAAA,EAEA,SAAqB;AACnB,UAAM,EAAE,OAAO,QAAQ,eAAe,CAAC,EAAE,IAAI,KAAK;AAClD,UAAM,iBAAiB,aAAa,IAAI,iBAAe,YAAY,EAAE;AAErE,WAAO;AAAA,MACL,iBAAiB,sBAAsB;AAAA,QACrC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,SAAS,MAAM,KAAK,eAAe,MAAM,CAAC,CAAC;AACjD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,OAAO,YAAY;AACzB,gBAAM,SAAS,MAAM,OAAO,UAAU,EAAE,GAAG,QAAQ,eAAe,CAAC;AACnE,iBAAO,EAAE,KAAK,EAAE,OAAO,CAAC;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,sBAAsB;AAAA,QACrC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,SAAS,MAAM,KAAK,eAAe,MAAM,CAAC,CAAC;AACjD,cAAI,cAAc,OAAQ,QAAO,OAAO;AAExC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,SAAS,kBAAkB,IAAI;AACrC,cAAI,CAAC,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,mBAAiB,CAAC,eAAe,SAAS,aAAa,CAAC,GAAG;AACjG,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,UAChD;AAEA,gBAAM,OAAO,YAAY;AACzB,gBAAM,OAAO,WAAW,EAAE,GAAG,QAAQ,OAAO,CAAC;AAC7C,gBAAM,MAAM,KAAK;AAAA,YACf,SAAS,MAAM,CAAC;AAAA,YAChB,OAAO;AAAA,cACL,QAAQ;AAAA,cACR,SAAS,CAAC,EAAE,MAAM,iBAAiB,IAAI,OAAO,MAAM,CAAC;AAAA,cACrD,UAAU,OAAO;AAAA,gBACf,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,eAAe,SAAS,MAAM;AAAA,kBACzD;AAAA,kBACA,EAAE,SAAS,UAAU,SAAS,SAAS,UAAU,WAAW,UAAU,KAAK;AAAA,gBAC7E,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF,CAAC;AACD,iBAAO,EAAE,KAAK,EAAE,OAAO,CAAC;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,uBAAuB;AAAA,QACtC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,SAAS,MAAM,KAAK,eAAe,MAAM,CAAC,CAAC;AACjD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,QAAQ,MAAM,QAAQ;AAAA,YAC1B,aAAa,IAAI,OAAM,iBAAgB;AAAA,cACrC,eAAe,YAAY;AAAA,cAC3B,SAAS,MAAM,YAAY,OAAO,YAAY,MAAM;AAAA,YACtD,EAAE;AAAA,UACJ;AACA,iBAAO,EAAE,KAAK;AAAA,YACZ,SAAS,MAAM;AAAA,cAAQ,UACrB,KAAK,QAAQ,IAAI,aAAW,EAAE,eAAe,KAAK,eAAe,GAAG,OAAO,EAAE;AAAA,YAC/E;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,qBAAqB;AAAA,QACpC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,SAAS,MAAM,KAAK,eAAe,MAAM,CAAC,CAAC;AACjD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,UAAU,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;AAClD,cAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAE5D,gBAAM,OAAO,YAAY;AACzB,gBAAM,SAAS,MAAM,OAAO,UAAU,EAAE,GAAG,QAAQ,eAAe,CAAC;AACnE,gBAAM,QAAgC,CAAC;AACvC,gBAAM,cAAsC,CAAC;AAC7C,qBAAW,eAAe,cAAc;AACtC,kBAAM,YAAY,OAAO,YAAY,EAAE;AACvC,gBAAI,CAAC,WAAW,WAAW,CAAC,UAAU,WAAW,OAAQ;AACzD,kBAAM,OAAO,MAAM,YAAY,OAAO,UAAU;AAAA,cAC9C,GAAG;AAAA,cACH,WAAW,UAAU;AAAA,cACrB,GAAI,QAAQ,YAAY,EAAE,IAAI,EAAE,QAAQ,QAAQ,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,YACvE,CAAC;AACD,kBAAM;AAAA,cACJ,GAAG,KAAK,MAAM,IAAI,UAAQ;AACxB,sBAAM,EAAE,QAAQ,GAAG,UAAU,IAAI;AACjC,uBAAO;AAAA,kBACL,GAAG;AAAA,kBACH,eAAe,YAAY;AAAA,kBAC3B,gBAAgB,EAAE,eAAe,YAAY,IAAI,GAAG,OAAO;AAAA,gBAC7D;AAAA,cACF,CAAC;AAAA,YACH;AACA,gBAAI,KAAK,WAAY,aAAY,YAAY,EAAE,IAAI,KAAK;AAAA,UAC1D;AACA,iBAAO,EAAE,KAAK,EAAE,OAAO,YAAY,aAAa,WAAW,EAAE,CAAC;AAAA,QAChE;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/routes/oauth.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Web OAuth sign-in routes for model providers (Settings › Providers).
+ *
+ * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's
+ * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in
+ * HTTP routes. Flow state lives in login sessions — the `model-credentials`
+ * domain's `oauth_login_sessions` table in tenant mode (any replica can
+ * complete/poll), an in-memory store in local mode — so a flow can span
+ * requests. Completed credentials are always **user-scoped** (plan tokens are
+ * personal subscriptions) in tenant mode, or written to the file-backed
+ * `AuthStorage` in local mode.
+ *
+ * Tokens never leave the server; responses only carry flow metadata (URLs,
+ * user codes, poll delays).
+ */
+import type { AuthStorage } from '@mastra/code-sdk/auth/storage';
+import type { ApiRoute } from '@mastra/core/server';
+import { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import { Route } from './route.js';
+import type { RouteDependencies } from './route.js';
+export interface OAuthRoutesDeps extends RouteDependencies {
+    /** File-backed credential store; used in local (no-auth) mode. */
+    authStorage?: AuthStorage;
+    /** Tenant credential domain handle; absent in local (no-DB) mode. */
+    modelCredentials?: ModelCredentialsStorage;
+    /** Notifies the host after tenant credentials change so caches can be dropped. */
+    onCredentialsChanged?: (tenant: {
+        orgId: string;
+        userId?: string;
+    }) => void;
+}
+/**
+ * Provider OAuth sign-in routes as Mastra `apiRoutes`:
+ *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow
+ *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange
+ *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll
+ *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow
+ *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)
+ */
+export declare class OAuthRoutes extends Route<OAuthRoutesDeps> {
+    routes(): ApiRoute[];
+}
+//# sourceMappingURL=oauth.d.ts.map

package/dist/routes/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAIjF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAuMpD,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,kEAAkE;IAClE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC7E;AAED;;;;;;;GAOG;AACH,qBAAa,WAAY,SAAQ,KAAK,CAAC,eAAe,CAAC;IACrD,MAAM,IAAI,QAAQ,EAAE;CAuNrB"}