@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/dist/storage/domains/audit/domain.js

@@ -0,0 +1,165 @@
+// src/storage/domains/audit/domain.ts
+import { registerApiRoute } from "@mastra/core/server";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var MAX_ACTION_FILTERS = 16;
+function loose(c) {
+  return c;
+}
+function parseActionsParam(raw) {
+  if (!raw) return void 0;
+  const actions = raw.split(",").map((action) => action.trim()).filter(Boolean).slice(0, MAX_ACTION_FILTERS);
+  return actions.length > 0 ? actions : void 0;
+}
+function parseLimitParam(raw) {
+  if (!raw) return void 0;
+  const limit = Number.parseInt(raw, 10);
+  return Number.isFinite(limit) ? limit : void 0;
+}
+function auditRequestContext(c) {
+  const location = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
+  const userAgent = c.req.header("user-agent");
+  return {
+    ...location ? { location } : {},
+    ...userAgent ? { userAgent } : {}
+  };
+}
+var AuditDomain = class {
+  #auth;
+  #audit;
+  #projects;
+  #sinks;
+  #agentTenant;
+  constructor({ auth, audit, projects, sinks = [], agentTenant }) {
+    this.#auth = auth;
+    this.#audit = audit;
+    this.#projects = projects;
+    this.#sinks = sinks;
+    this.#agentTenant = agentTenant;
+    const ids = /* @__PURE__ */ new Set();
+    for (const sink of this.#sinks) {
+      if (!sink.id) throw new Error("Audit integration id must not be empty");
+      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);
+      ids.add(sink.id);
+    }
+  }
+  async record(input) {
+    try {
+      await this.#audit.ensureReady();
+      const row = await this.#audit.record(input);
+      for (const sink of this.#sinks) {
+        if (!sink.audit) continue;
+        void Promise.resolve().then(() => sink.audit?.({ event: row })).catch((err) => {
+          console.warn("[Audit] Audit integration failed", {
+            integration: sink.id,
+            action: row.action,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        });
+      }
+      return row;
+    } catch (err) {
+      console.warn("[Audit] Failed to record audit event", {
+        action: input.action,
+        error: err instanceof Error ? err.message : String(err)
+      });
+      return null;
+    }
+  }
+  async list(input) {
+    await this.#audit.ensureReady();
+    return this.#audit.list(input);
+  }
+  async emit({ context, input }) {
+    try {
+      const tenant = this.#auth.tenant(context);
+      if (!tenant?.orgId) return;
+      await this.record({
+        orgId: tenant.orgId,
+        actorId: tenant.userId,
+        action: input.action,
+        targets: input.targets,
+        metadata: input.metadata,
+        factoryProjectId: input.factoryProjectId,
+        projectRepositoryId: input.projectRepositoryId,
+        context: auditRequestContext(context)
+      });
+    } catch (err) {
+      console.warn("[Audit] Failed to emit audit event", {
+        action: input.action,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  async emitAgent({
+    requestContext,
+    input
+  }) {
+    try {
+      const context = requestContext.get("controller");
+      const tenant = this.#agentTenant?.(requestContext);
+      const orgId = tenant?.orgId;
+      const userId = tenant?.userId;
+      const threadId = context?.threadId;
+      const state = context?.getState();
+      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;
+      await this.record({
+        orgId,
+        actorId: `agent:${threadId}`,
+        actorType: "agent",
+        action: input.action,
+        targets: input.targets,
+        metadata: { ...input.metadata, startedBy: userId },
+        factoryProjectId: state.factoryProjectId,
+        projectRepositoryId: state.projectRepositoryId,
+        context: {}
+      });
+    } catch (err) {
+      console.warn("[Audit] Failed to emit agent audit event", {
+        action: input.action,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  routes() {
+    return [
+      registerApiRoute("/web/factory/projects/:id/audit", {
+        method: "GET",
+        handler: async (cc) => {
+          const c = loose(cc);
+          const tenant = await this.#resolveTenant(c);
+          if ("response" in tenant) return tenant.response;
+          const projectId = c.req.param("id");
+          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: "Project not found" }, 404);
+          await this.#projects.ensureReady();
+          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });
+          if (!project) return c.json({ error: "Project not found" }, 404);
+          const page = await this.list({
+            orgId: tenant.orgId,
+            factoryProjectId: projectId,
+            actions: parseActionsParam(c.req.query("actions")),
+            actorId: c.req.query("actor") || void 0,
+            before: c.req.query("before") || void 0,
+            limit: parseLimitParam(c.req.query("limit"))
+          });
+          return c.json(page);
+        }
+      })
+    ];
+  }
+  async #resolveTenant(c) {
+    await this.#auth.ensureUser(c);
+    const tenant = this.#auth.tenant(c);
+    if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+    if (!tenant.orgId) {
+      return {
+        response: c.json({ error: "organization_required", message: "The audit trail requires an organization." }, 403)
+      };
+    }
+    return { orgId: tenant.orgId, userId: tenant.userId };
+  }
+};
+export {
+  AuditDomain,
+  auditRequestContext
+};
+//# sourceMappingURL=domain.js.map

package/dist/storage/domains/audit/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/storage/domains/audit/domain.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../../routes/route.js';\nimport type { FactoryProjectsStorage } from '../projects/base.js';\nimport type {\n  AuditContext,\n  AuditEventPage,\n  AuditEventRow,\n  AuditStorage,\n  AuditTarget,\n  ListAuditEventsInput,\n  RecordAuditEventInput,\n} from './base.js';\n\nexport interface EmitAuditInput {\n  action: string;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface EmitAgentAuditInput {\n  action: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface AuditEmitter {\n  emit(args: { context: Context; input: EmitAuditInput }): Promise<void>;\n}\n\nexport interface AuditAgentEmitter {\n  emitAgent(args: { requestContext: RequestContext; input: EmitAgentAuditInput }): Promise<void>;\n}\n\n/** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */\nexport interface AuditSink {\n  id: string;\n  audit?(args: { event: AuditEventRow }): Promise<void>;\n}\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n}\n\nexport interface AuditDomainOptions {\n  auth: RouteAuth;\n  /** Audit storage domain handle. */\n  audit: AuditStorage;\n  /** Projects domain handle, used to scope the audit trail route. */\n  projects: FactoryProjectsStorage;\n  /** Best-effort fan-out destinations notified after each recorded event. */\n  sinks?: AuditSink[];\n  /** Resolve the acting tenant for agent-emitted events from the request context. */\n  agentTenant?: (requestContext: RequestContext) => { orgId?: string; userId?: string } | undefined;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_ACTION_FILTERS = 16;\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction parseActionsParam(raw: string | undefined): string[] | undefined {\n  if (!raw) return undefined;\n  const actions = raw\n    .split(',')\n    .map(action => action.trim())\n    .filter(Boolean)\n    .slice(0, MAX_ACTION_FILTERS);\n  return actions.length > 0 ? actions : undefined;\n}\n\nfunction parseLimitParam(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const limit = Number.parseInt(raw, 10);\n  return Number.isFinite(limit) ? limit : undefined;\n}\n\nexport function auditRequestContext(c: Context): AuditContext {\n  const location = c.req.header('x-forwarded-for')?.split(',')[0]?.trim();\n  const userAgent = c.req.header('user-agent');\n  return {\n    ...(location ? { location } : {}),\n    ...(userAgent ? { userAgent } : {}),\n  };\n}\n\n/** Factory-owned audit behavior backed by the audit storage domain. */\nexport class AuditDomain implements AuditEmitter, AuditAgentEmitter {\n  readonly #auth: RouteAuth;\n  readonly #audit: AuditStorage;\n  readonly #projects: FactoryProjectsStorage;\n  readonly #sinks: AuditSink[];\n  readonly #agentTenant: AuditDomainOptions['agentTenant'];\n\n  constructor({ auth, audit, projects, sinks = [], agentTenant }: AuditDomainOptions) {\n    this.#auth = auth;\n    this.#audit = audit;\n    this.#projects = projects;\n    this.#sinks = sinks;\n    this.#agentTenant = agentTenant;\n\n    const ids = new Set<string>();\n    for (const sink of this.#sinks) {\n      if (!sink.id) throw new Error('Audit integration id must not be empty');\n      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);\n      ids.add(sink.id);\n    }\n  }\n\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow | null> {\n    try {\n      await this.#audit.ensureReady();\n      const row = await this.#audit.record(input);\n      for (const sink of this.#sinks) {\n        if (!sink.audit) continue;\n        void Promise.resolve()\n          .then(() => sink.audit?.({ event: row }))\n          .catch(err => {\n            console.warn('[Audit] Audit integration failed', {\n              integration: sink.id,\n              action: row.action,\n              error: err instanceof Error ? err.message : String(err),\n            });\n          });\n      }\n      return row;\n    } catch (err) {\n      console.warn('[Audit] Failed to record audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return null;\n    }\n  }\n\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    await this.#audit.ensureReady();\n    return this.#audit.list(input);\n  }\n\n  async emit({ context, input }: { context: Context; input: EmitAuditInput }): Promise<void> {\n    try {\n      const tenant = this.#auth.tenant(context);\n      if (!tenant?.orgId) return;\n      await this.record({\n        orgId: tenant.orgId,\n        actorId: tenant.userId,\n        action: input.action,\n        targets: input.targets,\n        metadata: input.metadata,\n        factoryProjectId: input.factoryProjectId,\n        projectRepositoryId: input.projectRepositoryId,\n        context: auditRequestContext(context),\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async emitAgent({\n    requestContext,\n    input,\n  }: {\n    requestContext: RequestContext;\n    input: EmitAgentAuditInput;\n  }): Promise<void> {\n    try {\n      const context = requestContext.get('controller') as\n        AgentControllerRequestContext<FactorySessionState> | undefined;\n      const tenant = this.#agentTenant?.(requestContext);\n      const orgId = tenant?.orgId;\n      const userId = tenant?.userId;\n      const threadId = context?.threadId;\n      const state = context?.getState();\n      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;\n\n      await this.record({\n        orgId,\n        actorId: `agent:${threadId}`,\n        actorType: 'agent',\n        action: input.action,\n        targets: input.targets,\n        metadata: { ...input.metadata, startedBy: userId },\n        factoryProjectId: state.factoryProjectId,\n        projectRepositoryId: state.projectRepositoryId,\n        context: {},\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit agent audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects/:id/audit', {\n        method: 'GET',\n        handler: async cc => {\n          const c = loose(cc);\n          const tenant = await this.#resolveTenant(c);\n          if ('response' in tenant) return tenant.response;\n\n          const projectId = c.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: 'Project not found' }, 404);\n          await this.#projects.ensureReady();\n          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });\n          if (!project) return c.json({ error: 'Project not found' }, 404);\n\n          const page = await this.list({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            actions: parseActionsParam(c.req.query('actions')),\n            actorId: c.req.query('actor') || undefined,\n            before: c.req.query('before') || undefined,\n            limit: parseLimitParam(c.req.query('limit')),\n          });\n          return c.json(page);\n        },\n      }),\n    ];\n  }\n\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.#auth.ensureUser(c);\n    const tenant = this.#auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json({ error: 'organization_required', message: 'The audit trail requires an organization.' }, 403),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n}\n"],"mappings":";AAGA,SAAS,wBAAwB;AA4DjC,IAAM,UAAU;AAChB,IAAM,qBAAqB;AAE3B,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAA+C;AACxE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IACb,MAAM,GAAG,EACT,IAAI,YAAU,OAAO,KAAK,CAAC,EAC3B,OAAO,OAAO,EACd,MAAM,GAAG,kBAAkB;AAC9B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,gBAAgB,KAA6C;AACpE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AAC1C;AAEO,SAAS,oBAAoB,GAA0B;AAC5D,QAAM,WAAW,EAAE,IAAI,OAAO,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtE,QAAM,YAAY,EAAE,IAAI,OAAO,YAAY;AAC3C,SAAO;AAAA,IACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC;AACF;AAGO,IAAM,cAAN,MAA6D;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,EAAE,MAAM,OAAO,UAAU,QAAQ,CAAC,GAAG,YAAY,GAAuB;AAClF,SAAK,QAAQ;AACb,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,eAAe;AAEpB,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,QAAQ,KAAK,QAAQ;AAC9B,UAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,wCAAwC;AACtE,UAAI,IAAI,IAAI,KAAK,EAAE,EAAG,OAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE,GAAG;AACnF,UAAI,IAAI,KAAK,EAAE;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,OAA6D;AACxE,QAAI;AACF,YAAM,KAAK,OAAO,YAAY;AAC9B,YAAM,MAAM,MAAM,KAAK,OAAO,OAAO,KAAK;AAC1C,iBAAW,QAAQ,KAAK,QAAQ;AAC9B,YAAI,CAAC,KAAK,MAAO;AACjB,aAAK,QAAQ,QAAQ,EAClB,KAAK,MAAM,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,EACvC,MAAM,SAAO;AACZ,kBAAQ,KAAK,oCAAoC;AAAA,YAC/C,aAAa,KAAK;AAAA,YAClB,QAAQ,IAAI;AAAA,YACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UACxD,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,cAAQ,KAAK,wCAAwC;AAAA,QACnD,QAAQ,MAAM;AAAA,QACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,OAAsD;AAC/D,UAAM,KAAK,OAAO,YAAY;AAC9B,WAAO,KAAK,OAAO,KAAK,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,KAAK,EAAE,SAAS,MAAM,GAA+D;AACzF,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO,OAAO;AACxC,UAAI,CAAC,QAAQ,MAAO;AACpB,YAAM,KAAK,OAAO;AAAA,QAChB,OAAO,OAAO;AAAA,QACd,SAAS,OAAO;AAAA,QAChB,QAAQ,MAAM;AAAA,QACd,SAAS,MAAM;AAAA,QACf,UAAU,MAAM;AAAA,QAChB,kBAAkB,MAAM;AAAA,QACxB,qBAAqB,MAAM;AAAA,QAC3B,SAAS,oBAAoB,OAAO;AAAA,MACtC,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,KAAK,sCAAsC;AAAA,QACjD,QAAQ,MAAM;AAAA,QACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,EACF,GAGkB;AAChB,QAAI;AACF,YAAM,UAAU,eAAe,IAAI,YAAY;AAE/C,YAAM,SAAS,KAAK,eAAe,cAAc;AACjD,YAAM,QAAQ,QAAQ;AACtB,YAAM,SAAS,QAAQ;AACvB,YAAM,WAAW,SAAS;AAC1B,YAAM,QAAQ,SAAS,SAAS;AAChC,UAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,iBAAkB;AAEhE,YAAM,KAAK,OAAO;AAAA,QAChB;AAAA,QACA,SAAS,SAAS,QAAQ;AAAA,QAC1B,WAAW;AAAA,QACX,QAAQ,MAAM;AAAA,QACd,SAAS,MAAM;AAAA,QACf,UAAU,EAAE,GAAG,MAAM,UAAU,WAAW,OAAO;AAAA,QACjD,kBAAkB,MAAM;AAAA,QACxB,qBAAqB,MAAM;AAAA,QAC3B,SAAS,CAAC;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,KAAK,4CAA4C;AAAA,QACvD,QAAQ,MAAM;AAAA,QACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,SAAqB;AACnB,WAAO;AAAA,MACL,iBAAiB,mCAAmC;AAAA,QAClD,QAAQ;AAAA,QACR,SAAS,OAAM,OAAM;AACnB,gBAAM,IAAI,MAAM,EAAE;AAClB,gBAAM,SAAS,MAAM,KAAK,eAAe,CAAC;AAC1C,cAAI,cAAc,OAAQ,QAAO,OAAO;AAExC,gBAAM,YAAY,EAAE,IAAI,MAAM,IAAI;AAClC,cAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,EAAG,QAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAC7F,gBAAM,KAAK,UAAU,YAAY;AACjC,gBAAM,UAAU,MAAM,KAAK,UAAU,IAAI,EAAE,OAAO,OAAO,OAAO,IAAI,UAAU,CAAC;AAC/E,cAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAE/D,gBAAM,OAAO,MAAM,KAAK,KAAK;AAAA,YAC3B,OAAO,OAAO;AAAA,YACd,kBAAkB;AAAA,YAClB,SAAS,kBAAkB,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,YACjD,SAAS,EAAE,IAAI,MAAM,OAAO,KAAK;AAAA,YACjC,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK;AAAA,YACjC,OAAO,gBAAgB,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UAC7C,CAAC;AACD,iBAAO,EAAE,KAAK,IAAI;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,GAAiF;AACpG,UAAM,KAAK,MAAM,WAAW,CAAC;AAC7B,UAAM,SAAS,KAAK,MAAM,OAAO,CAAC;AAClC,QAAI,CAAC,OAAQ,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACvE,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,UAAU,EAAE,KAAK,EAAE,OAAO,yBAAyB,SAAS,4CAA4C,GAAG,GAAG;AAAA,MAChH;AAAA,IACF;AACA,WAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AAAA,EACtD;AACF;","names":[]}

package/dist/storage/domains/credentials/base.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Model provider credentials domain — tenant-scoped OAuth tokens and API keys
+ * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,
+ * xAI, plus plain API-key providers).
+ *
+ * Tenancy is two-level:
+ * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and
+ *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are
+ *   personal subscriptions, and sharing one would bill/rate-limit a single
+ *   account for the whole org.
+ * - **org-scoped** rows (`userId` absent): shared API keys set by an org
+ *   admin, inherited by every member.
+ *
+ * Resolution order at model-call time is user > org (the caller layers server
+ * env vars underneath as a final fallback).
+ *
+ * Secrets posture: credentials are stored server-side only and never returned
+ * to the client (same as `linear_connections.access_token`). Encryption at
+ * rest is out of scope, matching the existing posture.
+ *
+ * The domain also owns `oauth_login_sessions`: pending web login flows
+ * (paste-code PKCE verifiers, device-code poll state) persisted server-side so
+ * any replica can complete or poll a flow started on another.
+ */
+import type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';
+import { FactoryStorageDomain } from '@mastra/core/storage';
+import type { CollectionSchema } from '@mastra/core/storage';
+/** Owning tenant of a credential row. `userId` absent = org-scoped row. */
+export interface CredentialTenant {
+    orgId: string;
+    userId?: string;
+}
+/** Which tenancy level a credential row lives at. */
+export type CredentialScope = 'user' | 'org';
+/** One stored credential, annotated with its scope. */
+export interface CredentialRecord {
+    provider: string;
+    scope: CredentialScope;
+    credential: AuthCredential;
+    updatedAt: Date;
+}
+/** Result of per-caller resolution: the winning credential and its scope. */
+export interface ResolvedCredential {
+    provider: string;
+    scope: CredentialScope;
+    credential: AuthCredential;
+}
+/** Kind of pending web login flow a session row tracks. */
+export type LoginSessionKind = 'paste-code' | 'device-code';
+/** One pending OAuth login flow, persisted so any replica can continue it. */
+export interface LoginSessionRow {
+    sessionId: string;
+    orgId: string;
+    userId: string;
+    provider: string;
+    kind: LoginSessionKind;
+    /** Serialized flow state (PKCE verifier, device-code pending state, ...). */
+    pending: Record<string, unknown>;
+    expiresAt: Date;
+    /** Earliest time the next upstream poll is allowed (device-code flows). */
+    nextPollAt: Date | null;
+    createdAt: Date;
+}
+export interface CreateLoginSessionInput {
+    sessionId: string;
+    orgId: string;
+    userId: string;
+    provider: string;
+    kind: LoginSessionKind;
+    pending: Record<string, unknown>;
+    expiresAt: Date;
+    nextPollAt?: Date | null;
+}
+/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */
+export declare function isOAuthCredentialExpired(credential: OAuthCredential, now?: number): boolean;
+/** OAuth plan credentials are personal and must always have an owning user. */
+export declare function assertCredentialScope(tenant: CredentialTenant, credential: AuthCredential): void;
+export declare const MODEL_CREDENTIALS_SCHEMA: CollectionSchema;
+export declare const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema;
+/**
+ * Model-credentials storage, written once against the generic
+ * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`
+ * ride `updateAtomic` so concurrent replicas serialize instead of
+ * invalidating each other's rotating tokens / double-claiming a flow.
+ */
+export declare class ModelCredentialsStorage extends FactoryStorageDomain {
+    #private;
+    constructor();
+    init(): Promise<void>;
+    dangerouslyClearAll(): Promise<void>;
+    /** Read the tenant's credential for a provider at exactly that scope. */
+    getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined>;
+    /** Upsert the tenant's credential (`created_at` is preserved on update). */
+    setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void>;
+    /** Delete the tenant's credential at exactly that scope. True when a row was removed. */
+    removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean>;
+    /** All credentials visible to a user: their own rows plus the org's shared rows. */
+    listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]>;
+    /**
+     * Resolve the credential a caller should use for a provider: the user's own
+     * row wins over the org's shared row.
+     */
+    resolveCredential(orgId: string, userId: string, provider: string): Promise<ResolvedCredential | undefined>;
+    /**
+     * Refresh the tenant's OAuth credential under the backend's atomic
+     * read-modify-write so concurrent replicas don't invalidate each other's
+     * rotating refresh tokens. The expiry is re-checked under the lock —
+     * another replica may have refreshed already, in which case `refreshFn` is
+     * skipped and the fresh credential is returned. Returns `undefined` when no
+     * OAuth row exists for the tenant.
+     */
+    refreshOAuth(tenant: CredentialTenant, provider: string, refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>): Promise<OAuthCredential | undefined>;
+    /** Persist a pending login flow started by a web route. */
+    createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow>;
+    /**
+     * Read a pending login flow. An expired session is deleted on read (TTL
+     * cleanup) and reported as absent.
+     */
+    getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined>;
+    /**
+     * Atomically claim a due login session for one upstream completion/poll attempt.
+     * Returns undefined when the session is missing, expired, owned by another
+     * tenant/provider, or already claimed by a concurrent request.
+     */
+    claimLoginSession(sessionId: string, owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>): Promise<LoginSessionRow | undefined>;
+    /** Update a pending flow's serialized state and/or next allowed poll time. */
+    touchLoginSession(sessionId: string, updates: {
+        pending?: Record<string, unknown>;
+        nextPollAt?: Date | null;
+    }): Promise<void>;
+    /** Remove a pending login flow (completed, cancelled, or failed). */
+    deleteLoginSession(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/credentials/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/credentials/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,aAAa,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAE/F;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAIhG;AAED,eAAO,MAAM,wBAAwB,EAAE,gBAsBtC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,gBAazC,CAAC;AA2CF;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;;;IAKzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1C,yEAAyE;IACnE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKpG,4EAA4E;IACtE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1G,yFAAyF;IACnF,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpF,oFAAoF;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAsBjF;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAgBjH;;;;;;;OAOG;IACG,YAAY,CAChB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,GAChE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAqBvC,2DAA2D;IACrD,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAelF;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC,GACrE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IA0BvC,8EAA8E;IACxE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GACvE,OAAO,CAAC,IAAI,CAAC;IAQhB,qEAAqE;IAC/D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}

package/dist/storage/domains/credentials/base.js

@@ -0,0 +1,257 @@
+// src/storage/domains/credentials/base.ts
+import { FactoryStorageDomain, UniqueViolationError } from "@mastra/core/storage";
+function isOAuthCredentialExpired(credential, now = Date.now()) {
+  return now >= credential.expires;
+}
+function assertCredentialScope(tenant, credential) {
+  if (credential.type === "oauth" && !tenant.userId) {
+    throw new Error("OAuth credentials must be user-scoped");
+  }
+}
+var MODEL_CREDENTIALS_SCHEMA = {
+  name: "model_provider_credentials",
+  columns: {
+    id: { type: "uuid-pk" },
+    org_id: { type: "text" },
+    user_id: { type: "text", nullable: true },
+    provider: { type: "text" },
+    type: { type: "text" },
+    data: { type: "json" },
+    created_at: { type: "timestamp" },
+    updated_at: { type: "timestamp" }
+  },
+  uniqueIndexes: [
+    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared
+    // row), enforced by two partial unique indexes.
+    {
+      name: "model_provider_credentials_user_unique",
+      columns: ["org_id", "user_id", "provider"],
+      whereNotNull: "user_id"
+    },
+    { name: "model_provider_credentials_org_unique", columns: ["org_id", "provider"], whereNull: "user_id" }
+  ]
+};
+var OAUTH_LOGIN_SESSIONS_SCHEMA = {
+  name: "oauth_login_sessions",
+  columns: {
+    session_id: { type: "text", primaryKey: true },
+    org_id: { type: "text" },
+    user_id: { type: "text" },
+    provider: { type: "text" },
+    kind: { type: "text" },
+    pending: { type: "json" },
+    expires_at: { type: "timestamp" },
+    next_poll_at: { type: "timestamp", nullable: true },
+    created_at: { type: "timestamp" }
+  }
+};
+function toSessionRow(db) {
+  return {
+    sessionId: db.session_id,
+    orgId: db.org_id,
+    userId: db.user_id,
+    provider: db.provider,
+    kind: db.kind,
+    pending: db.pending,
+    expiresAt: db.expires_at,
+    nextPollAt: db.next_poll_at,
+    createdAt: db.created_at
+  };
+}
+function tenantWhere(tenant, provider) {
+  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };
+}
+var ModelCredentialsStorage = class extends FactoryStorageDomain {
+  constructor() {
+    super("model-credentials");
+  }
+  async init() {
+    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);
+  }
+  async dangerouslyClearAll() {
+    await this.ops.deleteMany("oauth_login_sessions", {});
+    await this.ops.deleteMany("model_provider_credentials", {});
+  }
+  get #db() {
+    return this.ops;
+  }
+  /** Read the tenant's credential for a provider at exactly that scope. */
+  async getCredential(tenant, provider) {
+    const row = await this.#db.findOne("model_provider_credentials", tenantWhere(tenant, provider));
+    return row?.data;
+  }
+  /** Upsert the tenant's credential (`created_at` is preserved on update). */
+  async setCredential(tenant, provider, credential) {
+    assertCredentialScope(tenant, credential);
+    const where = tenantWhere(tenant, provider);
+    const update = async () => this.#db.updateMany("model_provider_credentials", where, {
+      type: credential.type,
+      data: credential,
+      updated_at: /* @__PURE__ */ new Date()
+    });
+    let lastError;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (await update() > 0) return;
+      const now = /* @__PURE__ */ new Date();
+      try {
+        await this.#db.insertOne("model_provider_credentials", {
+          org_id: tenant.orgId,
+          user_id: tenant.userId ?? null,
+          provider,
+          type: credential.type,
+          data: credential,
+          created_at: now,
+          updated_at: now
+        });
+        return;
+      } catch (error) {
+        if (!(error instanceof UniqueViolationError)) throw error;
+        lastError = error;
+      }
+    }
+    throw lastError;
+  }
+  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */
+  async removeCredential(tenant, provider) {
+    const deleted = await this.#db.deleteMany("model_provider_credentials", tenantWhere(tenant, provider));
+    return deleted > 0;
+  }
+  /** All credentials visible to a user: their own rows plus the org's shared rows. */
+  async listCredentials(orgId, userId) {
+    const [userRows, orgRows] = await Promise.all([
+      this.#db.findMany("model_provider_credentials", { org_id: orgId, user_id: userId }),
+      this.#db.findMany("model_provider_credentials", { org_id: orgId, user_id: null })
+    ]);
+    return [
+      ...userRows.map((row) => ({
+        provider: row.provider,
+        scope: "user",
+        credential: row.data,
+        updatedAt: row.updated_at
+      })),
+      ...orgRows.map((row) => ({
+        provider: row.provider,
+        scope: "org",
+        credential: row.data,
+        updatedAt: row.updated_at
+      }))
+    ];
+  }
+  /**
+   * Resolve the credential a caller should use for a provider: the user's own
+   * row wins over the org's shared row.
+   */
+  async resolveCredential(orgId, userId, provider) {
+    const userRow = await this.#db.findOne("model_provider_credentials", {
+      org_id: orgId,
+      provider,
+      user_id: userId
+    });
+    if (userRow) return { provider: userRow.provider, scope: "user", credential: userRow.data };
+    const orgRow = await this.#db.findOne("model_provider_credentials", {
+      org_id: orgId,
+      provider,
+      user_id: null
+    });
+    if (orgRow) return { provider: orgRow.provider, scope: "org", credential: orgRow.data };
+    return void 0;
+  }
+  /**
+   * Refresh the tenant's OAuth credential under the backend's atomic
+   * read-modify-write so concurrent replicas don't invalidate each other's
+   * rotating refresh tokens. The expiry is re-checked under the lock —
+   * another replica may have refreshed already, in which case `refreshFn` is
+   * skipped and the fresh credential is returned. Returns `undefined` when no
+   * OAuth row exists for the tenant.
+   */
+  async refreshOAuth(tenant, provider, refreshFn) {
+    let result;
+    await this.#db.updateAtomic(
+      "model_provider_credentials",
+      tenantWhere(tenant, provider),
+      async (row) => {
+        if (row.data.type !== "oauth") return null;
+        const current = row.data;
+        if (!isOAuthCredentialExpired(current)) {
+          result = current;
+          return null;
+        }
+        const next = await refreshFn(current);
+        result = next;
+        return { data: next, updated_at: /* @__PURE__ */ new Date() };
+      }
+    );
+    return result;
+  }
+  /** Persist a pending login flow started by a web route. */
+  async createLoginSession(input) {
+    const inserted = await this.#db.insertOne("oauth_login_sessions", {
+      session_id: input.sessionId,
+      org_id: input.orgId,
+      user_id: input.userId,
+      provider: input.provider,
+      kind: input.kind,
+      pending: input.pending,
+      expires_at: input.expiresAt,
+      next_poll_at: input.nextPollAt ?? null,
+      created_at: /* @__PURE__ */ new Date()
+    });
+    return toSessionRow(inserted);
+  }
+  /**
+   * Read a pending login flow. An expired session is deleted on read (TTL
+   * cleanup) and reported as absent.
+   */
+  async getLoginSession(sessionId) {
+    const row = await this.#db.findOne("oauth_login_sessions", { session_id: sessionId });
+    if (!row) return void 0;
+    if (row.expires_at.getTime() <= Date.now()) {
+      await this.#db.deleteMany("oauth_login_sessions", { session_id: sessionId });
+      return void 0;
+    }
+    return toSessionRow(row);
+  }
+  /**
+   * Atomically claim a due login session for one upstream completion/poll attempt.
+   * Returns undefined when the session is missing, expired, owned by another
+   * tenant/provider, or already claimed by a concurrent request.
+   */
+  async claimLoginSession(sessionId, owner) {
+    const now = Date.now();
+    let claimed = false;
+    const updated = await this.#db.updateAtomic(
+      "oauth_login_sessions",
+      { session_id: sessionId },
+      (row) => {
+        if (row.org_id !== owner.orgId || row.user_id !== owner.userId || row.provider !== owner.provider || row.kind !== owner.kind) {
+          return null;
+        }
+        if (row.expires_at.getTime() <= now) return null;
+        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;
+        claimed = true;
+        return { next_poll_at: row.expires_at };
+      }
+    );
+    return claimed && updated ? toSessionRow(updated) : void 0;
+  }
+  /** Update a pending flow's serialized state and/or next allowed poll time. */
+  async touchLoginSession(sessionId, updates) {
+    const set = {};
+    if (updates.pending !== void 0) set.pending = updates.pending;
+    if (updates.nextPollAt !== void 0) set.next_poll_at = updates.nextPollAt;
+    if (Object.keys(set).length === 0) return;
+    await this.#db.updateMany("oauth_login_sessions", { session_id: sessionId }, set);
+  }
+  /** Remove a pending login flow (completed, cancelled, or failed). */
+  async deleteLoginSession(sessionId) {
+    await this.#db.deleteMany("oauth_login_sessions", { session_id: sessionId });
+  }
+};
+export {
+  MODEL_CREDENTIALS_SCHEMA,
+  ModelCredentialsStorage,
+  OAUTH_LOGIN_SESSIONS_SCHEMA,
+  assertCredentialScope,
+  isOAuthCredentialExpired
+};
+//# sourceMappingURL=base.js.map

package/dist/storage/domains/credentials/base.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/storage/domains/credentials/base.ts"],"sourcesContent":["/**\n * Model provider credentials domain — tenant-scoped OAuth tokens and API keys\n * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,\n * xAI, plus plain API-key providers).\n *\n * Tenancy is two-level:\n * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and\n *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are\n *   personal subscriptions, and sharing one would bill/rate-limit a single\n *   account for the whole org.\n * - **org-scoped** rows (`userId` absent): shared API keys set by an org\n *   admin, inherited by every member.\n *\n * Resolution order at model-call time is user > org (the caller layers server\n * env vars underneath as a final fallback).\n *\n * Secrets posture: credentials are stored server-side only and never returned\n * to the client (same as `linear_connections.access_token`). Encryption at\n * rest is out of scope, matching the existing posture.\n *\n * The domain also owns `oauth_login_sessions`: pending web login flows\n * (paste-code PKCE verifiers, device-code poll state) persisted server-side so\n * any replica can complete or poll a flow started on another.\n */\n\nimport type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\n/** Owning tenant of a credential row. `userId` absent = org-scoped row. */\nexport interface CredentialTenant {\n  orgId: string;\n  userId?: string;\n}\n\n/** Which tenancy level a credential row lives at. */\nexport type CredentialScope = 'user' | 'org';\n\n/** One stored credential, annotated with its scope. */\nexport interface CredentialRecord {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n  updatedAt: Date;\n}\n\n/** Result of per-caller resolution: the winning credential and its scope. */\nexport interface ResolvedCredential {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n}\n\n/** Kind of pending web login flow a session row tracks. */\nexport type LoginSessionKind = 'paste-code' | 'device-code';\n\n/** One pending OAuth login flow, persisted so any replica can continue it. */\nexport interface LoginSessionRow {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  /** Serialized flow state (PKCE verifier, device-code pending state, ...). */\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  /** Earliest time the next upstream poll is allowed (device-code flows). */\n  nextPollAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateLoginSessionInput {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  nextPollAt?: Date | null;\n}\n\n/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */\nexport function isOAuthCredentialExpired(credential: OAuthCredential, now = Date.now()): boolean {\n  return now >= credential.expires;\n}\n\n/** OAuth plan credentials are personal and must always have an owning user. */\nexport function assertCredentialScope(tenant: CredentialTenant, credential: AuthCredential): void {\n  if (credential.type === 'oauth' && !tenant.userId) {\n    throw new Error('OAuth credentials must be user-scoped');\n  }\n}\n\nexport const MODEL_CREDENTIALS_SCHEMA: CollectionSchema = {\n  name: 'model_provider_credentials',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    user_id: { type: 'text', nullable: true },\n    provider: { type: 'text' },\n    type: { type: 'text' },\n    data: { type: 'json' },\n    created_at: { type: 'timestamp' },\n    updated_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared\n    // row), enforced by two partial unique indexes.\n    {\n      name: 'model_provider_credentials_user_unique',\n      columns: ['org_id', 'user_id', 'provider'],\n      whereNotNull: 'user_id',\n    },\n    { name: 'model_provider_credentials_org_unique', columns: ['org_id', 'provider'], whereNull: 'user_id' },\n  ],\n};\n\nexport const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema = {\n  name: 'oauth_login_sessions',\n  columns: {\n    session_id: { type: 'text', primaryKey: true },\n    org_id: { type: 'text' },\n    user_id: { type: 'text' },\n    provider: { type: 'text' },\n    kind: { type: 'text' },\n    pending: { type: 'json' },\n    expires_at: { type: 'timestamp' },\n    next_poll_at: { type: 'timestamp', nullable: true },\n    created_at: { type: 'timestamp' },\n  },\n};\n\n/** Column shape of one `model_provider_credentials` row as returned by ops. */\ninterface CredentialDbRow extends Record<string, unknown> {\n  id: string;\n  provider: string;\n  user_id: string | null;\n  data: AuthCredential;\n  updated_at: Date;\n}\n\n/** Column shape of one `oauth_login_sessions` row as returned by ops. */\ninterface LoginSessionDbRow extends Record<string, unknown> {\n  session_id: string;\n  org_id: string;\n  user_id: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expires_at: Date;\n  next_poll_at: Date | null;\n  created_at: Date;\n}\n\nfunction toSessionRow(db: LoginSessionDbRow): LoginSessionRow {\n  return {\n    sessionId: db.session_id,\n    orgId: db.org_id,\n    userId: db.user_id,\n    provider: db.provider,\n    kind: db.kind,\n    pending: db.pending,\n    expiresAt: db.expires_at,\n    nextPollAt: db.next_poll_at,\n    createdAt: db.created_at,\n  };\n}\n\n/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */\nfunction tenantWhere(tenant: CredentialTenant, provider: string): CollectionWhere {\n  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };\n}\n\n/**\n * Model-credentials storage, written once against the generic\n * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`\n * ride `updateAtomic` so concurrent replicas serialize instead of\n * invalidating each other's rotating tokens / double-claiming a flow.\n */\nexport class ModelCredentialsStorage extends FactoryStorageDomain {\n  constructor() {\n    super('model-credentials');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('oauth_login_sessions', {});\n    await this.ops.deleteMany('model_provider_credentials', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Read the tenant's credential for a provider at exactly that scope. */\n  async getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined> {\n    const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', tenantWhere(tenant, provider));\n    return row?.data;\n  }\n\n  /** Upsert the tenant's credential (`created_at` is preserved on update). */\n  async setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void> {\n    assertCredentialScope(tenant, credential);\n    const where = tenantWhere(tenant, provider);\n    const update = async () =>\n      this.#db.updateMany('model_provider_credentials', where, {\n        type: credential.type,\n        data: credential,\n        updated_at: new Date(),\n      });\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 2; attempt++) {\n      if ((await update()) > 0) return;\n\n      const now = new Date();\n      try {\n        await this.#db.insertOne<CredentialDbRow>('model_provider_credentials', {\n          org_id: tenant.orgId,\n          user_id: tenant.userId ?? null,\n          provider,\n          type: credential.type,\n          data: credential,\n          created_at: now,\n          updated_at: now,\n        });\n        return;\n      } catch (error) {\n        if (!(error instanceof UniqueViolationError)) throw error;\n        lastError = error;\n      }\n    }\n    throw lastError;\n  }\n\n  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */\n  async removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('model_provider_credentials', tenantWhere(tenant, provider));\n    return deleted > 0;\n  }\n\n  /** All credentials visible to a user: their own rows plus the org's shared rows. */\n  async listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]> {\n    // SQL `IN` never matches NULL, so the org rows need their own query.\n    const [userRows, orgRows] = await Promise.all([\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: userId }),\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: null }),\n    ]);\n    return [\n      ...userRows.map(row => ({\n        provider: row.provider,\n        scope: 'user' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n      ...orgRows.map(row => ({\n        provider: row.provider,\n        scope: 'org' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n    ];\n  }\n\n  /**\n   * Resolve the credential a caller should use for a provider: the user's own\n   * row wins over the org's shared row.\n   */\n  async resolveCredential(orgId: string, userId: string, provider: string): Promise<ResolvedCredential | undefined> {\n    const userRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: userId,\n    });\n    if (userRow) return { provider: userRow.provider, scope: 'user', credential: userRow.data };\n    const orgRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: null,\n    });\n    if (orgRow) return { provider: orgRow.provider, scope: 'org', credential: orgRow.data };\n    return undefined;\n  }\n\n  /**\n   * Refresh the tenant's OAuth credential under the backend's atomic\n   * read-modify-write so concurrent replicas don't invalidate each other's\n   * rotating refresh tokens. The expiry is re-checked under the lock —\n   * another replica may have refreshed already, in which case `refreshFn` is\n   * skipped and the fresh credential is returned. Returns `undefined` when no\n   * OAuth row exists for the tenant.\n   */\n  async refreshOAuth(\n    tenant: CredentialTenant,\n    provider: string,\n    refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>,\n  ): Promise<OAuthCredential | undefined> {\n    let result: OAuthCredential | undefined;\n    await this.#db.updateAtomic<CredentialDbRow>(\n      'model_provider_credentials',\n      tenantWhere(tenant, provider),\n      async row => {\n        if (row.data.type !== 'oauth') return null;\n        const current = row.data;\n        // Re-check under the lock: another replica may have refreshed while we waited.\n        if (!isOAuthCredentialExpired(current)) {\n          result = current;\n          return null;\n        }\n        const next = await refreshFn(current);\n        result = next;\n        return { data: next, updated_at: new Date() };\n      },\n    );\n    return result;\n  }\n\n  /** Persist a pending login flow started by a web route. */\n  async createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow> {\n    const inserted = await this.#db.insertOne<LoginSessionDbRow>('oauth_login_sessions', {\n      session_id: input.sessionId,\n      org_id: input.orgId,\n      user_id: input.userId,\n      provider: input.provider,\n      kind: input.kind,\n      pending: input.pending,\n      expires_at: input.expiresAt,\n      next_poll_at: input.nextPollAt ?? null,\n      created_at: new Date(),\n    });\n    return toSessionRow(inserted);\n  }\n\n  /**\n   * Read a pending login flow. An expired session is deleted on read (TTL\n   * cleanup) and reported as absent.\n   */\n  async getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined> {\n    const row = await this.#db.findOne<LoginSessionDbRow>('oauth_login_sessions', { session_id: sessionId });\n    if (!row) return undefined;\n    if (row.expires_at.getTime() <= Date.now()) {\n      await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n      return undefined;\n    }\n    return toSessionRow(row);\n  }\n\n  /**\n   * Atomically claim a due login session for one upstream completion/poll attempt.\n   * Returns undefined when the session is missing, expired, owned by another\n   * tenant/provider, or already claimed by a concurrent request.\n   */\n  async claimLoginSession(\n    sessionId: string,\n    owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>,\n  ): Promise<LoginSessionRow | undefined> {\n    const now = Date.now();\n    let claimed = false;\n    const updated = await this.#db.updateAtomic<LoginSessionDbRow>(\n      'oauth_login_sessions',\n      { session_id: sessionId },\n      row => {\n        if (\n          row.org_id !== owner.orgId ||\n          row.user_id !== owner.userId ||\n          row.provider !== owner.provider ||\n          row.kind !== owner.kind\n        ) {\n          return null;\n        }\n        if (row.expires_at.getTime() <= now) return null;\n        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;\n        claimed = true;\n        // Park the next poll at expiry so a concurrent claim loses until the\n        // claimer either touches the session forward or deletes it.\n        return { next_poll_at: row.expires_at };\n      },\n    );\n    return claimed && updated ? toSessionRow(updated) : undefined;\n  }\n\n  /** Update a pending flow's serialized state and/or next allowed poll time. */\n  async touchLoginSession(\n    sessionId: string,\n    updates: { pending?: Record<string, unknown>; nextPollAt?: Date | null },\n  ): Promise<void> {\n    const set: Record<string, unknown> = {};\n    if (updates.pending !== undefined) set.pending = updates.pending;\n    if (updates.nextPollAt !== undefined) set.next_poll_at = updates.nextPollAt;\n    if (Object.keys(set).length === 0) return;\n    await this.#db.updateMany('oauth_login_sessions', { session_id: sessionId }, set);\n  }\n\n  /** Remove a pending login flow (completed, cancelled, or failed). */\n  async deleteLoginSession(sessionId: string): Promise<void> {\n    await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n  }\n}\n"],"mappings":";AA0BA,SAAS,sBAAsB,4BAA4B;AAyDpD,SAAS,yBAAyB,YAA6B,MAAM,KAAK,IAAI,GAAY;AAC/F,SAAO,OAAO,WAAW;AAC3B;AAGO,SAAS,sBAAsB,QAA0B,YAAkC;AAChG,MAAI,WAAW,SAAS,WAAW,CAAC,OAAO,QAAQ;AACjD,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACF;AAEO,IAAM,2BAA6C;AAAA,EACxD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,IAAI,EAAE,MAAM,UAAU;AAAA,IACtB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,UAAU,EAAE,MAAM,OAAO;AAAA,IACzB,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,YAAY,EAAE,MAAM,YAAY;AAAA,EAClC;AAAA,EACA,eAAe;AAAA;AAAA;AAAA,IAGb;AAAA,MACE,MAAM;AAAA,MACN,SAAS,CAAC,UAAU,WAAW,UAAU;AAAA,MACzC,cAAc;AAAA,IAChB;AAAA,IACA,EAAE,MAAM,yCAAyC,SAAS,CAAC,UAAU,UAAU,GAAG,WAAW,UAAU;AAAA,EACzG;AACF;AAEO,IAAM,8BAAgD;AAAA,EAC3D,MAAM;AAAA,EACN,SAAS;AAAA,IACP,YAAY,EAAE,MAAM,QAAQ,YAAY,KAAK;AAAA,IAC7C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,SAAS,EAAE,MAAM,OAAO;AAAA,IACxB,UAAU,EAAE,MAAM,OAAO;AAAA,IACzB,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,SAAS,EAAE,MAAM,OAAO;AAAA,IACxB,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,cAAc,EAAE,MAAM,aAAa,UAAU,KAAK;AAAA,IAClD,YAAY,EAAE,MAAM,YAAY;AAAA,EAClC;AACF;AAwBA,SAAS,aAAa,IAAwC;AAC5D,SAAO;AAAA,IACL,WAAW,GAAG;AAAA,IACd,OAAO,GAAG;AAAA,IACV,QAAQ,GAAG;AAAA,IACX,UAAU,GAAG;AAAA,IACb,MAAM,GAAG;AAAA,IACT,SAAS,GAAG;AAAA,IACZ,WAAW,GAAG;AAAA,IACd,YAAY,GAAG;AAAA,IACf,WAAW,GAAG;AAAA,EAChB;AACF;AAGA,SAAS,YAAY,QAA0B,UAAmC;AAChF,SAAO,EAAE,QAAQ,OAAO,OAAO,UAAU,SAAS,OAAO,UAAU,KAAK;AAC1E;AAQO,IAAM,0BAAN,cAAsC,qBAAqB;AAAA,EAChE,cAAc;AACZ,UAAM,mBAAmB;AAAA,EAC3B;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,KAAK,kBAAkB,CAAC,0BAA0B,2BAA2B,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,sBAAqC;AACzC,UAAM,KAAK,IAAI,WAAW,wBAAwB,CAAC,CAAC;AACpD,UAAM,KAAK,IAAI,WAAW,8BAA8B,CAAC,CAAC;AAAA,EAC5D;AAAA,EAEA,IAAI,MAAyB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,cAAc,QAA0B,UAAuD;AACnG,UAAM,MAAM,MAAM,KAAK,IAAI,QAAyB,8BAA8B,YAAY,QAAQ,QAAQ,CAAC;AAC/G,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,cAAc,QAA0B,UAAkB,YAA2C;AACzG,0BAAsB,QAAQ,UAAU;AACxC,UAAM,QAAQ,YAAY,QAAQ,QAAQ;AAC1C,UAAM,SAAS,YACb,KAAK,IAAI,WAAW,8BAA8B,OAAO;AAAA,MACvD,MAAM,WAAW;AAAA,MACjB,MAAM;AAAA,MACN,YAAY,oBAAI,KAAK;AAAA,IACvB,CAAC;AAEH,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAK,MAAM,OAAO,IAAK,EAAG;AAE1B,YAAM,MAAM,oBAAI,KAAK;AACrB,UAAI;AACF,cAAM,KAAK,IAAI,UAA2B,8BAA8B;AAAA,UACtE,QAAQ,OAAO;AAAA,UACf,SAAS,OAAO,UAAU;AAAA,UAC1B;AAAA,UACA,MAAM,WAAW;AAAA,UACjB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAC;AACD;AAAA,MACF,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,sBAAuB,OAAM;AACpD,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,iBAAiB,QAA0B,UAAoC;AACnF,UAAM,UAAU,MAAM,KAAK,IAAI,WAAW,8BAA8B,YAAY,QAAQ,QAAQ,CAAC;AACrG,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,gBAAgB,OAAe,QAA6C;AAEhF,UAAM,CAAC,UAAU,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC5C,KAAK,IAAI,SAA0B,8BAA8B,EAAE,QAAQ,OAAO,SAAS,OAAO,CAAC;AAAA,MACnG,KAAK,IAAI,SAA0B,8BAA8B,EAAE,QAAQ,OAAO,SAAS,KAAK,CAAC;AAAA,IACnG,CAAC;AACD,WAAO;AAAA,MACL,GAAG,SAAS,IAAI,UAAQ;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,MACjB,EAAE;AAAA,MACF,GAAG,QAAQ,IAAI,UAAQ;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,OAAe,QAAgB,UAA2D;AAChH,UAAM,UAAU,MAAM,KAAK,IAAI,QAAyB,8BAA8B;AAAA,MACpF,QAAQ;AAAA,MACR;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,QAAS,QAAO,EAAE,UAAU,QAAQ,UAAU,OAAO,QAAQ,YAAY,QAAQ,KAAK;AAC1F,UAAM,SAAS,MAAM,KAAK,IAAI,QAAyB,8BAA8B;AAAA,MACnF,QAAQ;AAAA,MACR;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,OAAQ,QAAO,EAAE,UAAU,OAAO,UAAU,OAAO,OAAO,YAAY,OAAO,KAAK;AACtF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aACJ,QACA,UACA,WACsC;AACtC,QAAI;AACJ,UAAM,KAAK,IAAI;AAAA,MACb;AAAA,MACA,YAAY,QAAQ,QAAQ;AAAA,MAC5B,OAAM,QAAO;AACX,YAAI,IAAI,KAAK,SAAS,QAAS,QAAO;AACtC,cAAM,UAAU,IAAI;AAEpB,YAAI,CAAC,yBAAyB,OAAO,GAAG;AACtC,mBAAS;AACT,iBAAO;AAAA,QACT;AACA,cAAM,OAAO,MAAM,UAAU,OAAO;AACpC,iBAAS;AACT,eAAO,EAAE,MAAM,MAAM,YAAY,oBAAI,KAAK,EAAE;AAAA,MAC9C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,mBAAmB,OAA0D;AACjF,UAAM,WAAW,MAAM,KAAK,IAAI,UAA6B,wBAAwB;AAAA,MACnF,YAAY,MAAM;AAAA,MAClB,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM,cAAc;AAAA,MAClC,YAAY,oBAAI,KAAK;AAAA,IACvB,CAAC;AACD,WAAO,aAAa,QAAQ;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,WAAyD;AAC7E,UAAM,MAAM,MAAM,KAAK,IAAI,QAA2B,wBAAwB,EAAE,YAAY,UAAU,CAAC;AACvG,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC1C,YAAM,KAAK,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;AAC3E,aAAO;AAAA,IACT;AACA,WAAO,aAAa,GAAG;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,WACA,OACsC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,UAAM,UAAU,MAAM,KAAK,IAAI;AAAA,MAC7B;AAAA,MACA,EAAE,YAAY,UAAU;AAAA,MACxB,SAAO;AACL,YACE,IAAI,WAAW,MAAM,SACrB,IAAI,YAAY,MAAM,UACtB,IAAI,aAAa,MAAM,YACvB,IAAI,SAAS,MAAM,MACnB;AACA,iBAAO;AAAA,QACT;AACA,YAAI,IAAI,WAAW,QAAQ,KAAK,IAAK,QAAO;AAC5C,YAAI,IAAI,gBAAgB,IAAI,aAAa,QAAQ,IAAI,IAAK,QAAO;AACjE,kBAAU;AAGV,eAAO,EAAE,cAAc,IAAI,WAAW;AAAA,MACxC;AAAA,IACF;AACA,WAAO,WAAW,UAAU,aAAa,OAAO,IAAI;AAAA,EACtD;AAAA;AAAA,EAGA,MAAM,kBACJ,WACA,SACe;AACf,UAAM,MAA+B,CAAC;AACtC,QAAI,QAAQ,YAAY,OAAW,KAAI,UAAU,QAAQ;AACzD,QAAI,QAAQ,eAAe,OAAW,KAAI,eAAe,QAAQ;AACjE,QAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG;AACnC,UAAM,KAAK,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,GAAG,GAAG;AAAA,EAClF;AAAA;AAAA,EAGA,MAAM,mBAAmB,WAAkC;AACzD,UAAM,KAAK,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;AAAA,EAC7E;AACF;","names":[]}