@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/dist/routes/projects.d.ts

@@ -0,0 +1,19 @@
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { SourceControlStorage } from '../storage/domains/source-control/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+export interface ProjectRoutesDeps extends RouteDependencies {
+    /** Factory projects domain backing the CRUD surface. */
+    projects: FactoryProjectsStorage;
+    /** Source-control domain the connection/repository routes fan out over. */
+    sourceControl: SourceControlStorage;
+    /** Integration ids allowed as source-control connection targets. */
+    versionControlIntegrationIds?: string[];
+}
+export declare class ProjectRoutes extends Route<ProjectRoutesDeps> {
+    #private;
+    constructor(deps: ProjectRoutesDeps);
+    routes(): ApiRoute[];
+}
+//# sourceMappingURL=projects.d.ts.map

package/dist/routes/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EAEV,sBAAsB,EAEvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAEV,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAuInC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,wDAAwD;IACxD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,2EAA2E;IAC3E,aAAa,EAAE,oBAAoB,CAAC;IACpC,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;CACzC;AAED,qBAAa,aAAc,SAAQ,KAAK,CAAC,iBAAiB,CAAC;;gBAG7C,IAAI,EAAE,iBAAiB;IA8DnC,MAAM,IAAI,QAAQ,EAAE;CA4NrB"}

package/dist/routes/projects.js

@@ -0,0 +1,395 @@
+// src/routes/projects.ts
+import { registerApiRoute } from "@mastra/core/server";
+
+// src/routes/route.ts
+var Route = class {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+};
+
+// src/routes/projects.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var MAX_NAME_LENGTH = 200;
+var MAX_DESCRIPTION_LENGTH = 2e3;
+var MAX_SETUP_COMMAND_LENGTH = 2e3;
+var MAX_BRANCH_LENGTH = 255;
+var MAX_SANDBOX_PROVIDER_LENGTH = 100;
+var MAX_SANDBOX_WORKDIR_LENGTH = 1e3;
+var CONTROL_CHAR_RE = /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/;
+function loose(context) {
+  return context;
+}
+async function readJson(context) {
+  try {
+    return await context.req.json();
+  } catch {
+    return void 0;
+  }
+}
+function parseCreateInput(value) {
+  if (!value || typeof value !== "object") return null;
+  const input = value;
+  if (typeof input.name !== "string") return null;
+  const name = input.name.trim();
+  if (!name || name.length > MAX_NAME_LENGTH) return null;
+  if (input.description !== void 0 && input.description !== null && typeof input.description !== "string")
+    return null;
+  const description = typeof input.description === "string" ? input.description.trim() || null : null;
+  if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;
+  return { name, description };
+}
+function parseUpdateInput(value) {
+  if (!value || typeof value !== "object") return null;
+  const input = value;
+  const patch = {};
+  if (input.name !== void 0) {
+    if (typeof input.name !== "string") return null;
+    const name = input.name.trim();
+    if (!name || name.length > MAX_NAME_LENGTH) return null;
+    patch.name = name;
+  }
+  if (input.description !== void 0) {
+    if (input.description !== null && typeof input.description !== "string") return null;
+    const description = typeof input.description === "string" ? input.description.trim() || null : null;
+    if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;
+    patch.description = description;
+  }
+  if (input.defaultModelId !== void 0) {
+    const defaultModelId = parseOptionalString(input.defaultModelId, { maxLength: MAX_NAME_LENGTH, nullable: true });
+    if (defaultModelId === false) return null;
+    patch.defaultModelId = defaultModelId ?? null;
+  }
+  return Object.keys(patch).length > 0 ? patch : null;
+}
+function parseConnectionInput(value) {
+  if (!value || typeof value !== "object") return null;
+  const input = value;
+  if (typeof input.integrationId !== "string" || !input.integrationId.trim()) return null;
+  if (typeof input.installationId !== "string" || !UUID_RE.test(input.installationId)) return null;
+  return { integrationId: input.integrationId.trim(), installationId: input.installationId };
+}
+function parseOptionalString(value, { maxLength, nullable = false }) {
+  if (value === void 0) return void 0;
+  if (value === null) return nullable ? null : false;
+  if (typeof value !== "string") return false;
+  const normalized = value.trim();
+  if (!normalized) return nullable ? null : false;
+  if (normalized.length > maxLength || CONTROL_CHAR_RE.test(normalized)) return false;
+  return normalized;
+}
+function parseRepositoryLinkInput(value) {
+  if (!value || typeof value !== "object") return null;
+  const input = value;
+  if (typeof input.repositoryId !== "string" || !UUID_RE.test(input.repositoryId)) return null;
+  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });
+  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });
+  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });
+  const setupCommand = parseOptionalString(input.setupCommand, { maxLength: MAX_SETUP_COMMAND_LENGTH, nullable: true });
+  if (branch === false || typeof sandboxProvider !== "string" || typeof sandboxWorkdir !== "string" || setupCommand === false)
+    return null;
+  return {
+    repositoryId: input.repositoryId,
+    branch: branch ?? null,
+    sandboxProvider,
+    sandboxWorkdir,
+    setupCommand: setupCommand ?? null
+  };
+}
+function parseRepositoryUpdateInput(value) {
+  if (!value || typeof value !== "object") return null;
+  const input = value;
+  const patch = {};
+  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });
+  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });
+  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });
+  const setupCommand = parseOptionalString(input.setupCommand, { maxLength: MAX_SETUP_COMMAND_LENGTH, nullable: true });
+  if (branch === false || sandboxProvider === false || sandboxProvider === null || sandboxWorkdir === false || sandboxWorkdir === null || setupCommand === false)
+    return null;
+  if (branch !== void 0) patch.branch = branch;
+  if (sandboxProvider !== void 0) patch.sandboxProvider = sandboxProvider;
+  if (sandboxWorkdir !== void 0) patch.sandboxWorkdir = sandboxWorkdir;
+  if (setupCommand !== void 0) patch.setupCommand = setupCommand;
+  return Object.keys(patch).length > 0 ? patch : null;
+}
+var ProjectRoutes = class extends Route {
+  #versionControlIntegrationIds;
+  constructor(deps) {
+    super(deps);
+    this.#versionControlIntegrationIds = new Set(deps.versionControlIntegrationIds ?? []);
+  }
+  async #projects() {
+    await this.deps.projects.ensureReady();
+    return this.deps.projects;
+  }
+  async #sourceControl() {
+    await this.deps.sourceControl.ensureReady();
+    return this.deps.sourceControl;
+  }
+  async #handles() {
+    const storage = await this.#sourceControl();
+    return [...this.#versionControlIntegrationIds].map((integrationId) => storage.forIntegration(integrationId));
+  }
+  async #project(orgId, id) {
+    return (await this.#projects()).get({ orgId, id });
+  }
+  async #findConnection({ orgId, projectId, id }) {
+    for (const handle of await this.#handles()) {
+      const connection = await handle.connections.get({ orgId, id });
+      if (connection?.factoryProjectId === projectId) return { handle, connection };
+    }
+    return null;
+  }
+  async #findProjectRepository({ orgId, projectId, id }) {
+    for (const handle of await this.#handles()) {
+      const projectRepository = await handle.projectRepositories.get({ orgId, id });
+      if (!projectRepository) continue;
+      const connection = await handle.connections.get({ orgId, id: projectRepository.connectionId });
+      if (connection?.factoryProjectId === projectId) return { handle, connection, projectRepository };
+    }
+    return null;
+  }
+  async #repositoryPayload(handle, orgId, projectRepository) {
+    const repository = await handle.repositories.get({ orgId, id: projectRepository.repositoryId });
+    return { ...projectRepository, repository };
+  }
+  async #resolveTenant(context) {
+    await this.deps.auth.ensureUser(context);
+    const tenant = this.deps.auth.tenant(context);
+    if (!tenant) return { response: context.json({ error: "unauthorized" }, 401) };
+    if (!tenant.orgId) {
+      return {
+        response: context.json(
+          { error: "organization_required", message: "Factory projects require an organization." },
+          403
+        )
+      };
+    }
+    return { orgId: tenant.orgId, userId: tenant.userId };
+  }
+  routes() {
+    return [
+      registerApiRoute("/web/factory/projects", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          return context.json({ projects: await (await this.#projects()).list({ orgId: tenant.orgId }) });
+        }
+      }),
+      registerApiRoute("/web/factory/projects", {
+        method: "POST",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const input = parseCreateInput(await readJson(context));
+          if (!input) return context.json({ error: "invalid_project" }, 400);
+          const project = await (await this.#projects()).create({ orgId: tenant.orgId, userId: tenant.userId, input });
+          return context.json({ project }, 201);
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const id = context.req.param("id");
+          if (!id || !UUID_RE.test(id)) return context.json({ error: "Project not found" }, 404);
+          const project = await this.#project(tenant.orgId, id);
+          return project ? context.json({ project }) : context.json({ error: "Project not found" }, 404);
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id", {
+        method: "PATCH",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const id = context.req.param("id");
+          if (!id || !UUID_RE.test(id)) return context.json({ error: "Project not found" }, 404);
+          const input = parseUpdateInput(await readJson(context));
+          if (!input) return context.json({ error: "invalid_project" }, 400);
+          const project = await (await this.#projects()).update({ orgId: tenant.orgId, id, input });
+          return project ? context.json({ project }) : context.json({ error: "Project not found" }, 404);
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id", {
+        method: "DELETE",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const id = context.req.param("id");
+          if (!id || !UUID_RE.test(id)) return context.json({ error: "Project not found" }, 404);
+          if (!await this.#project(tenant.orgId, id)) return context.json({ error: "Project not found" }, 404);
+          for (const handle of await this.#handles()) {
+            for (const connection of await handle.connections.list({ orgId: tenant.orgId, factoryProjectId: id })) {
+              await handle.connections.delete({ orgId: tenant.orgId, id: connection.id });
+            }
+          }
+          await (await this.#projects()).delete({ orgId: tenant.orgId, id });
+          return context.body(null, 204);
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id/source-control-connections", {
+        method: "GET",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const projectId = context.req.param("id");
+          if (!projectId || !UUID_RE.test(projectId) || !await this.#project(tenant.orgId, projectId))
+            return context.json({ error: "Project not found" }, 404);
+          const connections = [];
+          for (const handle of await this.#handles()) {
+            for (const connection of await handle.connections.list({
+              orgId: tenant.orgId,
+              factoryProjectId: projectId
+            })) {
+              const installation = await handle.installations.get({
+                orgId: tenant.orgId,
+                id: connection.installationId
+              });
+              const links = await handle.projectRepositories.list({ orgId: tenant.orgId, connectionId: connection.id });
+              connections.push({
+                ...connection,
+                installation,
+                repositories: await Promise.all(links.map((link) => this.#repositoryPayload(handle, tenant.orgId, link)))
+              });
+            }
+          }
+          return context.json({ connections });
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id/source-control-connections", {
+        method: "POST",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const projectId = context.req.param("id");
+          if (!projectId || !UUID_RE.test(projectId) || !await this.#project(tenant.orgId, projectId))
+            return context.json({ error: "Project not found" }, 404);
+          const input = parseConnectionInput(await readJson(context));
+          if (!input) return context.json({ error: "invalid_source_control_connection" }, 400);
+          if (!this.#versionControlIntegrationIds.has(input.integrationId))
+            return context.json({ error: "Source-control integration not found" }, 404);
+          const handle = (await this.#sourceControl()).forIntegration(input.integrationId);
+          if (!await handle.installations.get({ orgId: tenant.orgId, id: input.installationId }))
+            return context.json({ error: "Source-control installation not found" }, 404);
+          const connection = await handle.connections.create({
+            orgId: tenant.orgId,
+            factoryProjectId: projectId,
+            installationId: input.installationId,
+            createdByUserId: tenant.userId
+          });
+          return context.json({ connection }, 201);
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id/source-control-connections/:connectionId", {
+        method: "DELETE",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const projectId = context.req.param("id");
+          const connectionId = context.req.param("connectionId");
+          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))
+            return context.json({ error: "Source-control connection not found" }, 404);
+          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });
+          if (!found) return context.json({ error: "Source-control connection not found" }, 404);
+          await found.handle.connections.delete({ orgId: tenant.orgId, id: connectionId });
+          return context.body(null, 204);
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id/source-control-connections/:connectionId/repositories", {
+        method: "POST",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const projectId = context.req.param("id");
+          const connectionId = context.req.param("connectionId");
+          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))
+            return context.json({ error: "Source-control connection not found" }, 404);
+          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });
+          if (!found) return context.json({ error: "Source-control connection not found" }, 404);
+          const input = parseRepositoryLinkInput(await readJson(context));
+          if (!input) return context.json({ error: "invalid_project_repository" }, 400);
+          const repository = await found.handle.repositories.get({ orgId: tenant.orgId, id: input.repositoryId });
+          if (!repository || repository.installationId !== found.connection.installationId)
+            return context.json({ error: "Source-control repository not found" }, 404);
+          const projectRepository = await found.handle.projectRepositories.link({
+            orgId: tenant.orgId,
+            connectionId,
+            createdByUserId: tenant.userId,
+            ...input
+          });
+          return context.json(
+            { projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository) },
+            201
+          );
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id/repositories/:projectRepositoryId", {
+        method: "PATCH",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const projectId = context.req.param("id");
+          const projectRepositoryId = context.req.param("projectRepositoryId");
+          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))
+            return context.json({ error: "Project repository not found" }, 404);
+          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });
+          if (!found) return context.json({ error: "Project repository not found" }, 404);
+          const input = parseRepositoryUpdateInput(await readJson(context));
+          if (!input) return context.json({ error: "invalid_project_repository" }, 400);
+          const projectRepository = await found.handle.projectRepositories.update({
+            orgId: tenant.orgId,
+            id: projectRepositoryId,
+            input
+          });
+          return context.json({
+            projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository)
+          });
+        }
+      }),
+      registerApiRoute("/web/factory/projects/:id/repositories/:projectRepositoryId", {
+        method: "DELETE",
+        requiresAuth: false,
+        handler: async (routeContext) => {
+          const context = loose(routeContext);
+          const tenant = await this.#resolveTenant(context);
+          if ("response" in tenant) return tenant.response;
+          const projectId = context.req.param("id");
+          const projectRepositoryId = context.req.param("projectRepositoryId");
+          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))
+            return context.json({ error: "Project repository not found" }, 404);
+          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });
+          if (!found) return context.json({ error: "Project repository not found" }, 404);
+          await found.handle.projectRepositories.unlink({ orgId: tenant.orgId, id: projectRepositoryId });
+          return context.body(null, 204);
+        }
+      })
+    ];
+  }
+};
+export {
+  ProjectRoutes
+};
+//# sourceMappingURL=projects.js.map

package/dist/routes/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/projects.ts","../../src/routes/route.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type {\n  CreateFactoryProjectInput,\n  FactoryProjectsStorage,\n  UpdateFactoryProjectInput,\n} from '../storage/domains/projects/base.js';\nimport type {\n  ProjectRepository,\n  SourceControlStorage,\n  SourceControlStorageHandle,\n  UpdateProjectRepositoryInput,\n} from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_NAME_LENGTH = 200;\nconst MAX_DESCRIPTION_LENGTH = 2_000;\nconst MAX_SETUP_COMMAND_LENGTH = 2_000;\nconst MAX_BRANCH_LENGTH = 255;\nconst MAX_SANDBOX_PROVIDER_LENGTH = 100;\nconst MAX_SANDBOX_WORKDIR_LENGTH = 1_000;\nconst CONTROL_CHAR_RE = /[\\0-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]/;\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nasync function readJson(context: Context): Promise<unknown | undefined> {\n  try {\n    return await context.req.json();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseCreateInput(value: unknown): CreateFactoryProjectInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.name !== 'string') return null;\n  const name = input.name.trim();\n  if (!name || name.length > MAX_NAME_LENGTH) return null;\n  if (input.description !== undefined && input.description !== null && typeof input.description !== 'string')\n    return null;\n  const description = typeof input.description === 'string' ? input.description.trim() || null : null;\n  if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;\n  return { name, description };\n}\n\nfunction parseUpdateInput(value: unknown): UpdateFactoryProjectInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  const patch: UpdateFactoryProjectInput = {};\n  if (input.name !== undefined) {\n    if (typeof input.name !== 'string') return null;\n    const name = input.name.trim();\n    if (!name || name.length > MAX_NAME_LENGTH) return null;\n    patch.name = name;\n  }\n  if (input.description !== undefined) {\n    if (input.description !== null && typeof input.description !== 'string') return null;\n    const description = typeof input.description === 'string' ? input.description.trim() || null : null;\n    if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;\n    patch.description = description;\n  }\n  if (input.defaultModelId !== undefined) {\n    const defaultModelId = parseOptionalString(input.defaultModelId, { maxLength: MAX_NAME_LENGTH, nullable: true });\n    if (defaultModelId === false) return null;\n    patch.defaultModelId = defaultModelId ?? null;\n  }\n  return Object.keys(patch).length > 0 ? patch : null;\n}\n\nfunction parseConnectionInput(value: unknown): { integrationId: string; installationId: string } | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.integrationId !== 'string' || !input.integrationId.trim()) return null;\n  if (typeof input.installationId !== 'string' || !UUID_RE.test(input.installationId)) return null;\n  return { integrationId: input.integrationId.trim(), installationId: input.installationId };\n}\n\nfunction parseOptionalString(\n  value: unknown,\n  { maxLength, nullable = false }: { maxLength: number; nullable?: boolean },\n): string | null | undefined | false {\n  if (value === undefined) return undefined;\n  if (value === null) return nullable ? null : false;\n  if (typeof value !== 'string') return false;\n  const normalized = value.trim();\n  if (!normalized) return nullable ? null : false;\n  if (normalized.length > maxLength || CONTROL_CHAR_RE.test(normalized)) return false;\n  return normalized;\n}\n\nfunction parseRepositoryLinkInput(value: unknown): {\n  repositoryId: string;\n  branch: string | null;\n  sandboxProvider: string;\n  sandboxWorkdir: string;\n  setupCommand: string | null;\n} | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.repositoryId !== 'string' || !UUID_RE.test(input.repositoryId)) return null;\n  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });\n  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });\n  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });\n  const setupCommand = parseOptionalString(input.setupCommand, { maxLength: MAX_SETUP_COMMAND_LENGTH, nullable: true });\n  if (\n    branch === false ||\n    typeof sandboxProvider !== 'string' ||\n    typeof sandboxWorkdir !== 'string' ||\n    setupCommand === false\n  )\n    return null;\n  return {\n    repositoryId: input.repositoryId,\n    branch: branch ?? null,\n    sandboxProvider,\n    sandboxWorkdir,\n    setupCommand: setupCommand ?? null,\n  };\n}\n\nfunction parseRepositoryUpdateInput(value: unknown): UpdateProjectRepositoryInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  const patch: UpdateProjectRepositoryInput = {};\n  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });\n  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });\n  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });\n  const setupCommand = parseOptionalString(input.setupCommand, { maxLength: MAX_SETUP_COMMAND_LENGTH, nullable: true });\n  if (\n    branch === false ||\n    sandboxProvider === false ||\n    sandboxProvider === null ||\n    sandboxWorkdir === false ||\n    sandboxWorkdir === null ||\n    setupCommand === false\n  )\n    return null;\n  if (branch !== undefined) patch.branch = branch;\n  if (sandboxProvider !== undefined) patch.sandboxProvider = sandboxProvider;\n  if (sandboxWorkdir !== undefined) patch.sandboxWorkdir = sandboxWorkdir;\n  if (setupCommand !== undefined) patch.setupCommand = setupCommand;\n  return Object.keys(patch).length > 0 ? patch : null;\n}\n\nexport interface ProjectRoutesDeps extends RouteDependencies {\n  /** Factory projects domain backing the CRUD surface. */\n  projects: FactoryProjectsStorage;\n  /** Source-control domain the connection/repository routes fan out over. */\n  sourceControl: SourceControlStorage;\n  /** Integration ids allowed as source-control connection targets. */\n  versionControlIntegrationIds?: string[];\n}\n\nexport class ProjectRoutes extends Route<ProjectRoutesDeps> {\n  readonly #versionControlIntegrationIds: Set<string>;\n\n  constructor(deps: ProjectRoutesDeps) {\n    super(deps);\n    this.#versionControlIntegrationIds = new Set(deps.versionControlIntegrationIds ?? []);\n  }\n\n  async #projects(): Promise<FactoryProjectsStorage> {\n    await this.deps.projects.ensureReady();\n    return this.deps.projects;\n  }\n\n  async #sourceControl(): Promise<SourceControlStorage> {\n    await this.deps.sourceControl.ensureReady();\n    return this.deps.sourceControl;\n  }\n\n  async #handles(): Promise<SourceControlStorageHandle[]> {\n    const storage = await this.#sourceControl();\n    return [...this.#versionControlIntegrationIds].map(integrationId => storage.forIntegration(integrationId));\n  }\n\n  async #project(orgId: string, id: string) {\n    return (await this.#projects()).get({ orgId, id });\n  }\n\n  async #findConnection({ orgId, projectId, id }: { orgId: string; projectId: string; id: string }) {\n    for (const handle of await this.#handles()) {\n      const connection = await handle.connections.get({ orgId, id });\n      if (connection?.factoryProjectId === projectId) return { handle, connection };\n    }\n    return null;\n  }\n\n  async #findProjectRepository({ orgId, projectId, id }: { orgId: string; projectId: string; id: string }) {\n    for (const handle of await this.#handles()) {\n      const projectRepository = await handle.projectRepositories.get({ orgId, id });\n      if (!projectRepository) continue;\n      const connection = await handle.connections.get({ orgId, id: projectRepository.connectionId });\n      if (connection?.factoryProjectId === projectId) return { handle, connection, projectRepository };\n    }\n    return null;\n  }\n\n  async #repositoryPayload(handle: SourceControlStorageHandle, orgId: string, projectRepository: ProjectRepository) {\n    const repository = await handle.repositories.get({ orgId, id: projectRepository.repositoryId });\n    return { ...projectRepository, repository };\n  }\n\n  async #resolveTenant(context: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(context);\n    const tenant = this.deps.auth.tenant(context);\n    if (!tenant) return { response: context.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: context.json(\n          { error: 'organization_required', message: 'Factory projects require an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          return context.json({ projects: await (await this.#projects()).list({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/factory/projects', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const input = parseCreateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project' }, 400);\n          const project = await (await this.#projects()).create({ orgId: tenant.orgId, userId: tenant.userId, input });\n          return context.json({ project }, 201);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          const project = await this.#project(tenant.orgId, id);\n          return project ? context.json({ project }) : context.json({ error: 'Project not found' }, 404);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'PATCH',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          const input = parseUpdateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project' }, 400);\n          const project = await (await this.#projects()).update({ orgId: tenant.orgId, id, input });\n          return project ? context.json({ project }) : context.json({ error: 'Project not found' }, 404);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          if (!(await this.#project(tenant.orgId, id))) return context.json({ error: 'Project not found' }, 404);\n          for (const handle of await this.#handles()) {\n            for (const connection of await handle.connections.list({ orgId: tenant.orgId, factoryProjectId: id })) {\n              await handle.connections.delete({ orgId: tenant.orgId, id: connection.id });\n            }\n          }\n          await (await this.#projects()).delete({ orgId: tenant.orgId, id });\n          return context.body(null, 204);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId) || !(await this.#project(tenant.orgId, projectId)))\n            return context.json({ error: 'Project not found' }, 404);\n          const connections = [];\n          for (const handle of await this.#handles()) {\n            for (const connection of await handle.connections.list({\n              orgId: tenant.orgId,\n              factoryProjectId: projectId,\n            })) {\n              const installation = await handle.installations.get({\n                orgId: tenant.orgId,\n                id: connection.installationId,\n              });\n              const links = await handle.projectRepositories.list({ orgId: tenant.orgId, connectionId: connection.id });\n              connections.push({\n                ...connection,\n                installation,\n                repositories: await Promise.all(links.map(link => this.#repositoryPayload(handle, tenant.orgId, link))),\n              });\n            }\n          }\n          return context.json({ connections });\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId) || !(await this.#project(tenant.orgId, projectId)))\n            return context.json({ error: 'Project not found' }, 404);\n          const input = parseConnectionInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_source_control_connection' }, 400);\n          if (!this.#versionControlIntegrationIds.has(input.integrationId))\n            return context.json({ error: 'Source-control integration not found' }, 404);\n          const handle = (await this.#sourceControl()).forIntegration(input.integrationId);\n          if (!(await handle.installations.get({ orgId: tenant.orgId, id: input.installationId })))\n            return context.json({ error: 'Source-control installation not found' }, 404);\n          const connection = await handle.connections.create({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            installationId: input.installationId,\n            createdByUserId: tenant.userId,\n          });\n          return context.json({ connection }, 201);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections/:connectionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const connectionId = context.req.param('connectionId');\n          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))\n            return context.json({ error: 'Source-control connection not found' }, 404);\n          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });\n          if (!found) return context.json({ error: 'Source-control connection not found' }, 404);\n          await found.handle.connections.delete({ orgId: tenant.orgId, id: connectionId });\n          return context.body(null, 204);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections/:connectionId/repositories', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const connectionId = context.req.param('connectionId');\n          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))\n            return context.json({ error: 'Source-control connection not found' }, 404);\n          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });\n          if (!found) return context.json({ error: 'Source-control connection not found' }, 404);\n          const input = parseRepositoryLinkInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project_repository' }, 400);\n          const repository = await found.handle.repositories.get({ orgId: tenant.orgId, id: input.repositoryId });\n          if (!repository || repository.installationId !== found.connection.installationId)\n            return context.json({ error: 'Source-control repository not found' }, 404);\n          const projectRepository = await found.handle.projectRepositories.link({\n            orgId: tenant.orgId,\n            connectionId,\n            createdByUserId: tenant.userId,\n            ...input,\n          });\n          return context.json(\n            { projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository) },\n            201,\n          );\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/repositories/:projectRepositoryId', {\n        method: 'PATCH',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const projectRepositoryId = context.req.param('projectRepositoryId');\n          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))\n            return context.json({ error: 'Project repository not found' }, 404);\n          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });\n          if (!found) return context.json({ error: 'Project repository not found' }, 404);\n          const input = parseRepositoryUpdateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project_repository' }, 400);\n          const projectRepository = await found.handle.projectRepositories.update({\n            orgId: tenant.orgId,\n            id: projectRepositoryId,\n            input,\n          });\n          return context.json({\n            projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository!),\n          });\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/repositories/:projectRepositoryId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const projectRepositoryId = context.req.param('projectRepositoryId');\n          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))\n            return context.json({ error: 'Project repository not found' }, 404);\n          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });\n          if (!found) return context.json({ error: 'Project repository not found' }, 404);\n          await found.handle.projectRepositories.unlink({ orgId: tenant.orgId, id: projectRepositoryId });\n          return context.body(null, 204);\n        },\n      }),\n    ];\n  }\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AACA,SAAS,wBAAwB;;;ACyC1B,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;ADjCA,IAAM,UAAU;AAChB,IAAM,kBAAkB;AACxB,IAAM,yBAAyB;AAC/B,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,8BAA8B;AACpC,IAAM,6BAA6B;AACnC,IAAM,kBAAkB;AAExB,SAAS,MAAM,SAA2B;AACxC,SAAO;AACT;AAEA,eAAe,SAAS,SAAgD;AACtE,MAAI;AACF,WAAO,MAAM,QAAQ,IAAI,KAAK;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,OAAkD;AAC1E,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,SAAS,SAAU,QAAO;AAC3C,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,MAAI,CAAC,QAAQ,KAAK,SAAS,gBAAiB,QAAO;AACnD,MAAI,MAAM,gBAAgB,UAAa,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB;AAChG,WAAO;AACT,QAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO;AAC/F,MAAI,eAAe,YAAY,SAAS,uBAAwB,QAAO;AACvE,SAAO,EAAE,MAAM,YAAY;AAC7B;AAEA,SAAS,iBAAiB,OAAkD;AAC1E,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,QAAM,QAAmC,CAAC;AAC1C,MAAI,MAAM,SAAS,QAAW;AAC5B,QAAI,OAAO,MAAM,SAAS,SAAU,QAAO;AAC3C,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,QAAI,CAAC,QAAQ,KAAK,SAAS,gBAAiB,QAAO;AACnD,UAAM,OAAO;AAAA,EACf;AACA,MAAI,MAAM,gBAAgB,QAAW;AACnC,QAAI,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,SAAU,QAAO;AAChF,UAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO;AAC/F,QAAI,eAAe,YAAY,SAAS,uBAAwB,QAAO;AACvE,UAAM,cAAc;AAAA,EACtB;AACA,MAAI,MAAM,mBAAmB,QAAW;AACtC,UAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,iBAAiB,UAAU,KAAK,CAAC;AAC/G,QAAI,mBAAmB,MAAO,QAAO;AACrC,UAAM,iBAAiB,kBAAkB;AAAA,EAC3C;AACA,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,IAAI,QAAQ;AACjD;AAEA,SAAS,qBAAqB,OAA0E;AACtG,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,kBAAkB,YAAY,CAAC,MAAM,cAAc,KAAK,EAAG,QAAO;AACnF,MAAI,OAAO,MAAM,mBAAmB,YAAY,CAAC,QAAQ,KAAK,MAAM,cAAc,EAAG,QAAO;AAC5F,SAAO,EAAE,eAAe,MAAM,cAAc,KAAK,GAAG,gBAAgB,MAAM,eAAe;AAC3F;AAEA,SAAS,oBACP,OACA,EAAE,WAAW,WAAW,MAAM,GACK;AACnC,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,KAAM,QAAO,WAAW,OAAO;AAC7C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,CAAC,WAAY,QAAO,WAAW,OAAO;AAC1C,MAAI,WAAW,SAAS,aAAa,gBAAgB,KAAK,UAAU,EAAG,QAAO;AAC9E,SAAO;AACT;AAEA,SAAS,yBAAyB,OAMzB;AACP,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,iBAAiB,YAAY,CAAC,QAAQ,KAAK,MAAM,YAAY,EAAG,QAAO;AACxF,QAAM,SAAS,oBAAoB,MAAM,QAAQ,EAAE,WAAW,mBAAmB,UAAU,KAAK,CAAC;AACjG,QAAM,kBAAkB,oBAAoB,MAAM,iBAAiB,EAAE,WAAW,4BAA4B,CAAC;AAC7G,QAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,2BAA2B,CAAC;AAC1G,QAAM,eAAe,oBAAoB,MAAM,cAAc,EAAE,WAAW,0BAA0B,UAAU,KAAK,CAAC;AACpH,MACE,WAAW,SACX,OAAO,oBAAoB,YAC3B,OAAO,mBAAmB,YAC1B,iBAAiB;AAEjB,WAAO;AACT,SAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB,QAAQ,UAAU;AAAA,IAClB;AAAA,IACA;AAAA,IACA,cAAc,gBAAgB;AAAA,EAChC;AACF;AAEA,SAAS,2BAA2B,OAAqD;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,QAAM,QAAsC,CAAC;AAC7C,QAAM,SAAS,oBAAoB,MAAM,QAAQ,EAAE,WAAW,mBAAmB,UAAU,KAAK,CAAC;AACjG,QAAM,kBAAkB,oBAAoB,MAAM,iBAAiB,EAAE,WAAW,4BAA4B,CAAC;AAC7G,QAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,2BAA2B,CAAC;AAC1G,QAAM,eAAe,oBAAoB,MAAM,cAAc,EAAE,WAAW,0BAA0B,UAAU,KAAK,CAAC;AACpH,MACE,WAAW,SACX,oBAAoB,SACpB,oBAAoB,QACpB,mBAAmB,SACnB,mBAAmB,QACnB,iBAAiB;AAEjB,WAAO;AACT,MAAI,WAAW,OAAW,OAAM,SAAS;AACzC,MAAI,oBAAoB,OAAW,OAAM,kBAAkB;AAC3D,MAAI,mBAAmB,OAAW,OAAM,iBAAiB;AACzD,MAAI,iBAAiB,OAAW,OAAM,eAAe;AACrD,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,IAAI,QAAQ;AACjD;AAWO,IAAM,gBAAN,cAA4B,MAAyB;AAAA,EACjD;AAAA,EAET,YAAY,MAAyB;AACnC,UAAM,IAAI;AACV,SAAK,gCAAgC,IAAI,IAAI,KAAK,gCAAgC,CAAC,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,YAA6C;AACjD,UAAM,KAAK,KAAK,SAAS,YAAY;AACrC,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,iBAAgD;AACpD,UAAM,KAAK,KAAK,cAAc,YAAY;AAC1C,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,WAAkD;AACtD,UAAM,UAAU,MAAM,KAAK,eAAe;AAC1C,WAAO,CAAC,GAAG,KAAK,6BAA6B,EAAE,IAAI,mBAAiB,QAAQ,eAAe,aAAa,CAAC;AAAA,EAC3G;AAAA,EAEA,MAAM,SAAS,OAAe,IAAY;AACxC,YAAQ,MAAM,KAAK,UAAU,GAAG,IAAI,EAAE,OAAO,GAAG,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,gBAAgB,EAAE,OAAO,WAAW,GAAG,GAAqD;AAChG,eAAW,UAAU,MAAM,KAAK,SAAS,GAAG;AAC1C,YAAM,aAAa,MAAM,OAAO,YAAY,IAAI,EAAE,OAAO,GAAG,CAAC;AAC7D,UAAI,YAAY,qBAAqB,UAAW,QAAO,EAAE,QAAQ,WAAW;AAAA,IAC9E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,EAAE,OAAO,WAAW,GAAG,GAAqD;AACvG,eAAW,UAAU,MAAM,KAAK,SAAS,GAAG;AAC1C,YAAM,oBAAoB,MAAM,OAAO,oBAAoB,IAAI,EAAE,OAAO,GAAG,CAAC;AAC5E,UAAI,CAAC,kBAAmB;AACxB,YAAM,aAAa,MAAM,OAAO,YAAY,IAAI,EAAE,OAAO,IAAI,kBAAkB,aAAa,CAAC;AAC7F,UAAI,YAAY,qBAAqB,UAAW,QAAO,EAAE,QAAQ,YAAY,kBAAkB;AAAA,IACjG;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBAAmB,QAAoC,OAAe,mBAAsC;AAChH,UAAM,aAAa,MAAM,OAAO,aAAa,IAAI,EAAE,OAAO,IAAI,kBAAkB,aAAa,CAAC;AAC9F,WAAO,EAAE,GAAG,mBAAmB,WAAW;AAAA,EAC5C;AAAA,EAEA,MAAM,eAAe,SAAuF;AAC1G,UAAM,KAAK,KAAK,KAAK,WAAW,OAAO;AACvC,UAAM,SAAS,KAAK,KAAK,KAAK,OAAO,OAAO;AAC5C,QAAI,CAAC,OAAQ,QAAO,EAAE,UAAU,QAAQ,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC7E,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,UAAU,QAAQ;AAAA,UAChB,EAAE,OAAO,yBAAyB,SAAS,4CAA4C;AAAA,UACvF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AAAA,EACtD;AAAA,EAEA,SAAqB;AACnB,WAAO;AAAA,MACL,iBAAiB,yBAAyB;AAAA,QACxC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,iBAAO,QAAQ,KAAK,EAAE,UAAU,OAAO,MAAM,KAAK,UAAU,GAAG,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;AAAA,QAChG;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,yBAAyB;AAAA,QACxC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,QAAQ,iBAAiB,MAAM,SAAS,OAAO,CAAC;AACtD,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;AACjE,gBAAM,UAAU,OAAO,MAAM,KAAK,UAAU,GAAG,OAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,QAAQ,MAAM,CAAC;AAC3G,iBAAO,QAAQ,KAAK,EAAE,QAAQ,GAAG,GAAG;AAAA,QACtC;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;AACjC,cAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AACrF,gBAAM,UAAU,MAAM,KAAK,SAAS,OAAO,OAAO,EAAE;AACpD,iBAAO,UAAU,QAAQ,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,QAC/F;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;AACjC,cAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AACrF,gBAAM,QAAQ,iBAAiB,MAAM,SAAS,OAAO,CAAC;AACtD,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;AACjE,gBAAM,UAAU,OAAO,MAAM,KAAK,UAAU,GAAG,OAAO,EAAE,OAAO,OAAO,OAAO,IAAI,MAAM,CAAC;AACxF,iBAAO,UAAU,QAAQ,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,QAC/F;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;AACjC,cAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AACrF,cAAI,CAAE,MAAM,KAAK,SAAS,OAAO,OAAO,EAAE,EAAI,QAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AACrG,qBAAW,UAAU,MAAM,KAAK,SAAS,GAAG;AAC1C,uBAAW,cAAc,MAAM,OAAO,YAAY,KAAK,EAAE,OAAO,OAAO,OAAO,kBAAkB,GAAG,CAAC,GAAG;AACrG,oBAAM,OAAO,YAAY,OAAO,EAAE,OAAO,OAAO,OAAO,IAAI,WAAW,GAAG,CAAC;AAAA,YAC5E;AAAA,UACF;AACA,iBAAO,MAAM,KAAK,UAAU,GAAG,OAAO,EAAE,OAAO,OAAO,OAAO,GAAG,CAAC;AACjE,iBAAO,QAAQ,KAAK,MAAM,GAAG;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,wDAAwD;AAAA,QACvE,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;AACxC,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAE,MAAM,KAAK,SAAS,OAAO,OAAO,SAAS;AACzF,mBAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AACzD,gBAAM,cAAc,CAAC;AACrB,qBAAW,UAAU,MAAM,KAAK,SAAS,GAAG;AAC1C,uBAAW,cAAc,MAAM,OAAO,YAAY,KAAK;AAAA,cACrD,OAAO,OAAO;AAAA,cACd,kBAAkB;AAAA,YACpB,CAAC,GAAG;AACF,oBAAM,eAAe,MAAM,OAAO,cAAc,IAAI;AAAA,gBAClD,OAAO,OAAO;AAAA,gBACd,IAAI,WAAW;AAAA,cACjB,CAAC;AACD,oBAAM,QAAQ,MAAM,OAAO,oBAAoB,KAAK,EAAE,OAAO,OAAO,OAAO,cAAc,WAAW,GAAG,CAAC;AACxG,0BAAY,KAAK;AAAA,gBACf,GAAG;AAAA,gBACH;AAAA,gBACA,cAAc,MAAM,QAAQ,IAAI,MAAM,IAAI,UAAQ,KAAK,mBAAmB,QAAQ,OAAO,OAAO,IAAI,CAAC,CAAC;AAAA,cACxG,CAAC;AAAA,YACH;AAAA,UACF;AACA,iBAAO,QAAQ,KAAK,EAAE,YAAY,CAAC;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,wDAAwD;AAAA,QACvE,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;AACxC,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAE,MAAM,KAAK,SAAS,OAAO,OAAO,SAAS;AACzF,mBAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AACzD,gBAAM,QAAQ,qBAAqB,MAAM,SAAS,OAAO,CAAC;AAC1D,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;AACnF,cAAI,CAAC,KAAK,8BAA8B,IAAI,MAAM,aAAa;AAC7D,mBAAO,QAAQ,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;AAC5E,gBAAM,UAAU,MAAM,KAAK,eAAe,GAAG,eAAe,MAAM,aAAa;AAC/E,cAAI,CAAE,MAAM,OAAO,cAAc,IAAI,EAAE,OAAO,OAAO,OAAO,IAAI,MAAM,eAAe,CAAC;AACpF,mBAAO,QAAQ,KAAK,EAAE,OAAO,wCAAwC,GAAG,GAAG;AAC7E,gBAAM,aAAa,MAAM,OAAO,YAAY,OAAO;AAAA,YACjD,OAAO,OAAO;AAAA,YACd,kBAAkB;AAAA,YAClB,gBAAgB,MAAM;AAAA,YACtB,iBAAiB,OAAO;AAAA,UAC1B,CAAC;AACD,iBAAO,QAAQ,KAAK,EAAE,WAAW,GAAG,GAAG;AAAA,QACzC;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,sEAAsE;AAAA,QACrF,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;AACxC,gBAAM,eAAe,QAAQ,IAAI,MAAM,cAAc;AACrD,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY;AACvF,mBAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAC3E,gBAAM,QAAQ,MAAM,KAAK,gBAAgB,EAAE,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC;AAC7F,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AACrF,gBAAM,MAAM,OAAO,YAAY,OAAO,EAAE,OAAO,OAAO,OAAO,IAAI,aAAa,CAAC;AAC/E,iBAAO,QAAQ,KAAK,MAAM,GAAG;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,mFAAmF;AAAA,QAClG,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;AACxC,gBAAM,eAAe,QAAQ,IAAI,MAAM,cAAc;AACrD,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY;AACvF,mBAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAC3E,gBAAM,QAAQ,MAAM,KAAK,gBAAgB,EAAE,OAAO,OAAO,OAAO,WAAW,IAAI,aAAa,CAAC;AAC7F,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AACrF,gBAAM,QAAQ,yBAAyB,MAAM,SAAS,OAAO,CAAC;AAC9D,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;AAC5E,gBAAM,aAAa,MAAM,MAAM,OAAO,aAAa,IAAI,EAAE,OAAO,OAAO,OAAO,IAAI,MAAM,aAAa,CAAC;AACtG,cAAI,CAAC,cAAc,WAAW,mBAAmB,MAAM,WAAW;AAChE,mBAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAC3E,gBAAM,oBAAoB,MAAM,MAAM,OAAO,oBAAoB,KAAK;AAAA,YACpE,OAAO,OAAO;AAAA,YACd;AAAA,YACA,iBAAiB,OAAO;AAAA,YACxB,GAAG;AAAA,UACL,CAAC;AACD,iBAAO,QAAQ;AAAA,YACb,EAAE,mBAAmB,MAAM,KAAK,mBAAmB,MAAM,QAAQ,OAAO,OAAO,iBAAiB,EAAE;AAAA,YAClG;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,+DAA+D;AAAA,QAC9E,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;AACxC,gBAAM,sBAAsB,QAAQ,IAAI,MAAM,qBAAqB;AACnE,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,uBAAuB,CAAC,QAAQ,KAAK,mBAAmB;AACrG,mBAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AACpE,gBAAM,QAAQ,MAAM,KAAK,uBAAuB,EAAE,OAAO,OAAO,OAAO,WAAW,IAAI,oBAAoB,CAAC;AAC3G,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AAC9E,gBAAM,QAAQ,2BAA2B,MAAM,SAAS,OAAO,CAAC;AAChE,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;AAC5E,gBAAM,oBAAoB,MAAM,MAAM,OAAO,oBAAoB,OAAO;AAAA,YACtE,OAAO,OAAO;AAAA,YACd,IAAI;AAAA,YACJ;AAAA,UACF,CAAC;AACD,iBAAO,QAAQ,KAAK;AAAA,YAClB,mBAAmB,MAAM,KAAK,mBAAmB,MAAM,QAAQ,OAAO,OAAO,iBAAkB;AAAA,UACjG,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,MACD,iBAAiB,+DAA+D;AAAA,QAC9E,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,iBAAgB;AAC7B,gBAAM,UAAU,MAAM,YAAY;AAClC,gBAAM,SAAS,MAAM,KAAK,eAAe,OAAO;AAChD,cAAI,cAAc,OAAQ,QAAO,OAAO;AACxC,gBAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;AACxC,gBAAM,sBAAsB,QAAQ,IAAI,MAAM,qBAAqB;AACnE,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,uBAAuB,CAAC,QAAQ,KAAK,mBAAmB;AACrG,mBAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AACpE,gBAAM,QAAQ,MAAM,KAAK,uBAAuB,EAAE,OAAO,OAAO,OAAO,WAAW,IAAI,oBAAoB,CAAC;AAC3G,cAAI,CAAC,MAAO,QAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AAC9E,gBAAM,MAAM,OAAO,oBAAoB,OAAO,EAAE,OAAO,OAAO,OAAO,IAAI,oBAAoB,CAAC;AAC9F,iBAAO,QAAQ,KAAK,MAAM,GAAG;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/routes/provider-credentials.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Per-request model-provider credential context.
+ *
+ * The provider config/OAuth routes serve two deployment shapes:
+ *
+ * - **Local** (no web auth adapter): credentials live in the server-global
+ *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.
+ * - **Tenant** (auth adapter active): credentials live in the
+ *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`
+ *   with optional org-wide rows (`userId` absent).
+ *
+ * `resolveCredentialContext` decides which shape a request is in: an
+ * authenticated user always gets the tenant path; an unauthenticated request
+ * is rejected when auth is enabled and falls back to local otherwise.
+ */
+import type { Context } from 'hono';
+import type { CredentialRecord, LoginSessionKind, ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import type { RouteAuth } from './route.js';
+/**
+ * OAuth credentials are stored under the auth provider id, which differs from
+ * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows
+ * use the same keying so one lookup serves both OAuth tokens and API keys.
+ */
+export declare function getAuthProviderId(provider: string): string;
+/**
+ * Providers that support a browser-driven OAuth sign-in flow, keyed by
+ * *catalog* provider id (what the routes and settings UI use). All flows need
+ * no inbound connection to the server: Anthropic uses paste-code PKCE, the
+ * rest use RFC 8628-style device codes.
+ */
+export declare const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>>;
+export type CredentialContext = {
+    mode: 'local';
+} | {
+    mode: 'tenant';
+    storage: ModelCredentialsStorage;
+    orgId: string;
+    userId: string;
+};
+/**
+ * The tenant credentials domain, when registered and ready. `undefined` means
+ * the factory never ran (no handle threaded in) or the domain's init failed
+ * (fail-soft — callers report the feature unavailable instead of crashing).
+ */
+export declare function getTenantCredentialsStorage(credentials: ModelCredentialsStorage | undefined): Promise<ModelCredentialsStorage | undefined>;
+/**
+ * Org key for tenant rows. Personal accounts get an org bootstrapped by the
+ * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a
+ * per-user synthetic org so credentials never become server-global.
+ */
+export declare function tenantOrgId(tenant: {
+    orgId?: string;
+    userId: string;
+}): string;
+/**
+ * Resolve the credential context for a request, or a ready-to-return error
+ * response. Mutating credential routes call this and hard-fail (401/503)
+ * when the tenant path is required but unavailable.
+ */
+export declare function resolveCredentialContext({ c, auth, credentials, }: {
+    c: Context;
+    auth: RouteAuth;
+    /** Tenant credential domain handle; absent in local (no-DB) mode. */
+    credentials?: ModelCredentialsStorage;
+}): Promise<CredentialContext | {
+    response: Response;
+}>;
+/**
+ * List the caller's tenant credential records for provider listing, or
+ * `undefined` in local mode (caller should fall back to `AuthStorage`).
+ * Read-only and degradation-friendly: an authenticated caller with the domain
+ * unavailable gets an empty list (sources show `env`/`none`) instead of a 503
+ * so the settings page still renders.
+ */
+export declare function listTenantCredentialsForRequest({ c, auth, credentials, }: {
+    c: Context;
+    auth: RouteAuth;
+    /** Tenant credential domain handle; absent in local (no-DB) mode. */
+    credentials?: ModelCredentialsStorage;
+}): Promise<CredentialRecord[] | undefined>;
+//# sourceMappingURL=provider-credentials.d.ts.map

package/dist/routes/provider-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/provider-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAK3E,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1G;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,uBAAuB,GAAG,SAAS,GAC/C,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAQ9C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,CAAC,EACD,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,CAAC,EAAE,OAAO,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GAAG,OAAO,CAAC,iBAAiB,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAuBtD;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,CAAC,EACD,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,CAAC,EAAE,OAAO,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAO1C"}

package/dist/routes/provider-credentials.js

@@ -0,0 +1,68 @@
+// src/routes/provider-credentials.ts
+function getAuthProviderId(provider) {
+  return provider === "openai" ? "openai-codex" : provider;
+}
+var WEB_OAUTH_FLOW_KINDS = {
+  anthropic: "paste-code",
+  openai: "device-code",
+  "github-copilot": "device-code",
+  xai: "device-code"
+};
+async function getTenantCredentialsStorage(credentials) {
+  if (!credentials) return void 0;
+  try {
+    await credentials.ensureReady();
+  } catch {
+    return void 0;
+  }
+  return credentials;
+}
+function tenantOrgId(tenant) {
+  return tenant.orgId ?? `user:${tenant.userId}`;
+}
+async function resolveCredentialContext({
+  c,
+  auth,
+  credentials
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) {
+    if (auth.enabled()) return { response: c.json({ error: "unauthorized" }, 401) };
+    return { mode: "local" };
+  }
+  const storage = await getTenantCredentialsStorage(credentials);
+  if (!storage) {
+    return {
+      response: c.json(
+        {
+          error: "credentials_unavailable",
+          message: "Tenant credential storage is unavailable \u2014 the app database is not configured or failed to start."
+        },
+        503
+      )
+    };
+  }
+  return { mode: "tenant", storage, orgId: tenantOrgId(tenant), userId: tenant.userId };
+}
+async function listTenantCredentialsForRequest({
+  c,
+  auth,
+  credentials
+}) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) return auth.enabled() ? [] : void 0;
+  const storage = await getTenantCredentialsStorage(credentials);
+  if (!storage) return [];
+  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);
+}
+export {
+  WEB_OAUTH_FLOW_KINDS,
+  getAuthProviderId,
+  getTenantCredentialsStorage,
+  listTenantCredentialsForRequest,
+  resolveCredentialContext,
+  tenantOrgId
+};
+//# sourceMappingURL=provider-credentials.js.map