@mastra/factory 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/routes/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/config.ts","../../src/routes/provider-credentials.ts","../../src/routes/route.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport { removeCustomPackFromSettings } from '@mastra/code-sdk/onboarding/custom-packs';\nimport {\n  removeCustomProviderFromSettings,\n  upsertCustomProviderInSettings,\n} from '@mastra/code-sdk/onboarding/custom-providers';\nimport { applyOmRoleOverride, persistOmObserveAttachments } from '@mastra/code-sdk/onboarding/om-settings';\nimport { getAvailableModePacks } from '@mastra/code-sdk/onboarding/packs';\nimport type { ModePack, ProviderAccess, ProviderAccessLevel } from '@mastra/code-sdk/onboarding/packs';\nimport {\n  getCustomProviderId,\n  loadSettings,\n  saveSettings,\n  THREAD_ACTIVE_MODEL_PACK_ID_KEY,\n} from '@mastra/code-sdk/onboarding/settings';\nimport type { CustomProviderSetting } from '@mastra/code-sdk/onboarding/settings';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { Context } from 'hono';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { ModelPackRecord, ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport {\n  getAuthProviderId,\n  listTenantCredentialsForRequest,\n  resolveCredentialContext,\n  tenantOrgId,\n  WEB_OAUTH_FLOW_KINDS,\n} from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteAuth, RouteDependencies } from './route.js';\n\n/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Server-side configuration routes for the web app.\n *\n * The browser has no access to the credential store or the model catalog, so\n * the web settings panel asks the server — which owns both — to list providers\n * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the\n * same `AuthStorage`-backed key management over HTTP.\n *\n * Keys are never returned to the client; only their presence and source.\n */\n\n/**\n * Where a provider's active credential comes from, as seen by the caller.\n * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode\n * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).\n */\nexport type ProviderCredentialSource =\n  'oauth' | 'stored' | 'env' | 'none' | 'oauth-user' | 'stored-user' | 'stored-org';\n\n/** A model provider with the current source of its credentials. */\nexport interface ProviderInfo {\n  provider: string;\n  /** Env var the provider's key is read from, if any. */\n  envVar?: string;\n  /** Where the active credential comes from. */\n  source: ProviderCredentialSource;\n  /** Web OAuth sign-in capability, when the provider supports it. */\n  oauth?: { supported: true; modes: LoginSessionKind[] };\n}\n\n/** Minimal session surface a pack activation touches. */\ninterface PackSession {\n  mode: { get: () => string };\n  model: { switch: (args: { modelId: string }) => Promise<void> };\n  subagents: { model: { set: (args: { modelId: string; agentType: string }) => Promise<void> } };\n  thread: {\n    getId: () => string | null;\n    setSetting: (args: { key: string; value: unknown }) => Promise<void>;\n    list: () => Promise<Array<{ id: string; metadata?: Record<string, unknown> }>>;\n  };\n}\n\n/** One observational-memory role's read/switch surface. */\ninterface OMRole {\n  modelId: () => string | undefined;\n  threshold: () => number | undefined;\n  switchModel: (args: { modelId: string }) => Promise<void>;\n}\n\n/**\n * Session-state fields the OM config routes write. The index signatures mirror\n * `MastraCodeState` so the concrete `Session.state.set(Partial<MastraCodeState>)`\n * stays assignable to this minimal surface (contravariant parameter check).\n */\ninterface OMStateWrites {\n  [key: string]: unknown;\n  [key: `subagentModelId_${string}`]: string | undefined;\n  observationThreshold?: number;\n  reflectionThreshold?: number;\n  observeAttachments?: 'auto' | boolean;\n}\n\n/** Minimal session surface the OM config routes touch. */\nexport interface OMSession extends PackSession {\n  state: {\n    get: () => Record<string, unknown> | undefined;\n    set: (updates: OMStateWrites) => Promise<void> | void;\n  };\n  om: { observer: OMRole; reflector: OMRole };\n}\n\n/** Minimal controller surface this module needs (model catalog + modes + sessions). */\ninterface ModelCatalog {\n  listAvailableModels: () => Promise<\n    Array<{ id?: string; modelName?: string; provider: string; hasApiKey: boolean; apiKeyEnvVar?: string }>\n  >;\n  listModes?: () => Array<{ id: string; defaultModelId?: string }>;\n  getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;\n}\n\n/**\n * Build a deduplicated, sorted list of providers from the model catalog,\n * annotated with where each provider's credential currently comes from.\n * Mirrors the TUI's `/api-keys` provider list.\n *\n * When `tenantCredentials` is given (deployed mode), sources reflect the\n * *caller's* tenant rows with user > org precedence and the server-global\n * `authStorage` is ignored; otherwise the local `auth.json` view is reported.\n */\nexport async function listProviders({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderInfo[]> {\n  const models = await controller.listAvailableModels();\n  const seen = new Map<string, ProviderInfo>();\n\n  for (const model of models) {\n    if (seen.has(model.provider)) continue;\n\n    const authProviderId = getAuthProviderId(model.provider);\n    let source: ProviderInfo['source'] = 'none';\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      if (userRec?.credential.type === 'oauth') {\n        source = 'oauth-user';\n      } else if (userRec?.credential.type === 'api_key') {\n        source = 'stored-user';\n      } else if (orgRec?.credential.type === 'api_key') {\n        source = 'stored-org';\n      }\n    } else if (authStorage?.isLoggedIn(authProviderId)) {\n      source = 'oauth';\n    } else if (authStorage?.hasStoredApiKey(model.provider)) {\n      source = 'stored';\n    } else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) {\n      source = 'env';\n    } else if (model.hasApiKey) {\n      source = 'env';\n    }\n\n    const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];\n    seen.set(model.provider, {\n      provider: model.provider,\n      envVar: model.apiKeyEnvVar,\n      source,\n      ...(flowKind ? { oauth: { supported: true as const, modes: [flowKind] } } : {}),\n    });\n  }\n\n  return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));\n}\n\n/** A user-defined OpenAI-compatible provider, with key presence (never the key). */\nexport interface CustomProviderInfo {\n  id: string;\n  name: string;\n  url: string;\n  hasApiKey: boolean;\n  models: string[];\n}\n\n/** Read the saved custom providers from global settings (keys redacted). */\nexport function listCustomProviders(): CustomProviderInfo[] {\n  const settings = loadSettings();\n  return settings.customProviders.map(p => ({\n    id: getCustomProviderId(p.name),\n    name: p.name,\n    url: p.url,\n    hasApiKey: Boolean(p.apiKey),\n    models: p.models,\n  }));\n}\n\n/** Validate + coerce a request body into a CustomProviderSetting. */\nfunction parseCustomProviderBody(body: unknown): CustomProviderSetting | { error: string } {\n  if (!body || typeof body !== 'object') return { error: 'Invalid JSON body' };\n  const b = body as Record<string, unknown>;\n  const name = typeof b.name === 'string' ? b.name.trim() : '';\n  if (!name) return { error: 'Missing required field: name' };\n  const url = typeof b.url === 'string' ? b.url.trim() : '';\n  if (!url) return { error: 'Missing required field: url' };\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n      return { error: 'url must be an http(s) URL' };\n    }\n  } catch {\n    return { error: 'url must be a valid URL' };\n  }\n  const apiKey = typeof b.apiKey === 'string' && b.apiKey.trim() ? b.apiKey.trim() : undefined;\n  const models = Array.isArray(b.models)\n    ? b.models.filter((m): m is string => typeof m === 'string' && m.trim().length > 0).map(m => m.trim())\n    : [];\n  return { name, url, apiKey, models };\n}\n\n// ── Model packs ──────────────────────────────────────────────────────────\n\n/** A model pack as surfaced to the web client, with an `active` flag. */\nexport interface ModelPackInfo extends ModePack {\n  custom: boolean;\n  active: boolean;\n}\n\n/**\n * Compute which providers the user can reach, mirroring the TUI's\n * `/models-pack` access derivation: OAuth/api-key from the credential store for\n * the named providers, plus any other provider that has a usable key.\n */\nexport async function buildProviderAccess({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderAccess> {\n  const models = await controller.listAvailableModels();\n  const hasModelKey = (provider: string) => models.some(m => m.provider === provider && m.hasApiKey);\n  const accessLevel = (provider: string): ProviderAccessLevel => {\n    const authProviderId = getAuthProviderId(provider);\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      const credential = userRec?.credential ?? orgRec?.credential;\n      if (credential?.type === 'oauth') return 'oauth';\n      if (credential?.type === 'api_key' && credential.key.trim().length > 0) return 'apikey';\n      return false;\n    }\n\n    const oauthCredential = authStorage?.get(authProviderId);\n    if (oauthCredential?.type === 'oauth') return 'oauth';\n    if (authStorage?.hasStoredApiKey(provider)) return 'apikey';\n    const directCredential = authStorage?.get(provider);\n    if (directCredential?.type === 'api_key' && directCredential.key.trim().length > 0) return 'apikey';\n    return hasModelKey(provider) ? 'apikey' : false;\n  };\n  const access: ProviderAccess = {\n    anthropic: accessLevel('anthropic'),\n    openai: accessLevel('openai'),\n    cerebras: accessLevel('cerebras'),\n    google: accessLevel('google'),\n    deepseek: accessLevel('deepseek'),\n    'github-copilot': accessLevel('github-copilot'),\n  };\n  const seen = new Set(Object.keys(access));\n  for (const m of models) {\n    if (!seen.has(m.provider)) {\n      access[m.provider] = accessLevel(m.provider);\n      seen.add(m.provider);\n    }\n  }\n  return access;\n}\n\nfunction canUseModelProvider(access: ProviderAccess, provider: string): boolean {\n  return Boolean(access[provider]);\n}\n\n/**\n * Where a request's custom model packs live. Local mode (no auth adapter)\n * keeps the file-backed `settings.json` store — unchanged TUI behavior. Tenant\n * mode (auth adapter active) uses the `model-packs` factory storage domain,\n * scoped per org. Mirrors `resolveCredentialContext`.\n */\nexport type PackContext =\n  { mode: 'local' } | { mode: 'tenant'; storage: ModelPacksStorage; orgId: string; userId: string };\n\n/** The tenant model-packs domain, when registered and ready (fail-soft). */\nasync function getTenantModelPacksStorage(\n  modelPacks: ModelPacksStorage | undefined,\n): Promise<ModelPacksStorage | undefined> {\n  if (!modelPacks) return undefined;\n  try {\n    await modelPacks.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return modelPacks;\n}\n\n/** Resolve the pack context for a request, or a ready-to-return error response. */\nasync function resolvePackContext({\n  c,\n  auth,\n  modelPacks,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  modelPacks?: ModelPacksStorage;\n}): Promise<PackContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantModelPacksStorage(modelPacks);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'model_packs_unavailable',\n          message: 'Model pack storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/** DB row → the `ModePack` shape the packs list and activation flow consume. */\nfunction recordToModePack(record: ModelPackRecord): ModePack {\n  return { id: `custom:${record.id}`, name: record.name, description: 'Saved custom pack', models: record.models };\n}\n\n/**\n * List available model packs (built-in, gated by provider access, plus saved\n * custom packs from the request's pack context). Drops the synthetic\n * \"New Custom\" placeholder — the web client has its own create flow. `active`\n * is set from the given session's thread when a resourceId is supplied.\n */\nexport async function listModelPacks({\n  controller,\n  authStorage,\n  tenantCredentials,\n  packContext,\n  activePackId,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n  packContext: PackContext;\n  activePackId?: string | null;\n}): Promise<ModelPackInfo[]> {\n  const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });\n  const packs =\n    packContext.mode === 'local'\n      ? getAvailableModePacks(access, loadSettings().customModelPacks)\n      : [\n          ...getAvailableModePacks(access),\n          ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack),\n        ];\n  return packs\n    .filter(p => p.id !== 'custom') // synthetic \"choose each model\" placeholder\n    .map(p => ({\n      ...p,\n      custom: p.id.startsWith('custom:'),\n      active: activePackId != null && p.id === activePackId,\n    }));\n}\n\n/** Resolve the active pack id for a session by reading its current thread. */\nasync function resolveActivePackId(session: PackSession | undefined): Promise<string | null> {\n  if (!session) return null;\n  const threadId = session.thread.getId();\n  if (!threadId) return null;\n  const thread = (await session.thread.list()).find(t => t.id === threadId);\n  const value = thread?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];\n  return typeof value === 'string' ? value : null;\n}\n\n/**\n * Apply a pack to a session: seed each mode's default model, switch the current\n * mode's model, set per-subagent models, and tag the thread with the active\n * pack id. Mirrors the TUI `applyPack` orchestration.\n */\nasync function applyPackToSession({\n  controller,\n  session,\n  pack,\n}: {\n  controller: ModelCatalog;\n  session: PackSession;\n  pack: ModePack;\n}): Promise<void> {\n  const modes = controller.listModes?.() ?? [];\n  const packModels = pack.models as Record<string, string>;\n\n  for (const mode of modes) {\n    const modelId = packModels[mode.id];\n    if (modelId) {\n      mode.defaultModelId = modelId;\n      await session.thread.setSetting({ key: `modeModelId_${mode.id}`, value: modelId });\n    }\n  }\n\n  const currentModeModel = packModels[session.mode.get()];\n  if (currentModeModel) {\n    await session.model.switch({ modelId: currentModeModel });\n  }\n\n  const subagentModeMap: Record<string, string> = { explore: 'fast', plan: 'plan', execute: 'build' };\n  for (const [agentType, modeId] of Object.entries(subagentModeMap)) {\n    const saModelId = packModels[modeId];\n    if (saModelId) {\n      await session.subagents.model.set({ modelId: saModelId, agentType });\n    }\n  }\n\n  await session.thread.setSetting({ key: THREAD_ACTIVE_MODEL_PACK_ID_KEY, value: pack.id });\n}\n\n// ── Observational memory ────────────────────────────────────────────────────\n// Mirrors the TUI `/om` command. Observer/reflector model + threshold reads come\n// from the session (state, falling back to omConfig defaults); writes go to both\n// the session (state + thread setting, via the same session methods the TUI uses)\n// and GlobalSettings (settings.json), so the choice survives restarts and stays\n// in sync with the terminal.\n\n/** Default thresholds mirror the TUI `/om` fallbacks. */\nconst DEFAULT_OBSERVATION_THRESHOLD = 30_000;\nconst DEFAULT_REFLECTION_THRESHOLD = 40_000;\n\n/** Read the current OM config from a session. */\nexport interface OMConfigInfo {\n  observerModelId: string;\n  reflectorModelId: string;\n  observationThreshold: number;\n  reflectionThreshold: number;\n  observeAttachments: 'auto' | boolean;\n}\n\nexport function readOMConfig(session: OMSession): OMConfigInfo {\n  const state = session.state.get() ?? {};\n  const observeAttachments = state.observeAttachments;\n  return {\n    observerModelId: session.om.observer.modelId() ?? '',\n    reflectorModelId: session.om.reflector.modelId() ?? '',\n    observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : 'auto',\n  };\n}\n\n/** Persist an OM threshold to GlobalSettings (settings.json), mirroring `/om`. */\nfunction persistOmThreshold({ role, value }: { role: 'observation' | 'reflection'; value: number }): void {\n  const settings = loadSettings();\n  if (role === 'observation') settings.models.omObservationThreshold = value;\n  else settings.models.omReflectionThreshold = value;\n  saveSettings(settings);\n}\n\n/** Persist an OM role model override to GlobalSettings, snapshotting the other role. */\nfunction persistOmRoleOverride({\n  role,\n  modelId,\n  otherRoleCurrentModelId,\n}: {\n  role: 'observer' | 'reflector';\n  modelId: string;\n  otherRoleCurrentModelId: string | null;\n}): void {\n  const settings = loadSettings();\n  applyOmRoleOverride(settings, role, modelId, otherRoleCurrentModelId);\n  saveSettings(settings);\n}\n\n/** Dependencies injected into {@link ConfigRoutes}. */\nexport interface ConfigRoutesDeps extends RouteDependencies {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Tenant model-packs domain handle; absent in local (no-DB) mode. */\n  modelPacks?: ModelPacksStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n}\n\n/**\n * The web config routes as Mastra `apiRoutes`:\n *   - `GET    /web/config/providers`              — list providers + key source\n *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key\n *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key\n *   - `GET    /web/config/models`                  — list available models (credentialed providers)\n *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers\n *   - `POST   /web/config/custom-providers`        — create/update a custom provider\n *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider\n *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments\n *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model\n *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds\n *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)\n */\nexport class ConfigRoutes extends Route<ConfigRoutesDeps> {\n  routes(): ApiRoute[] {\n    const options = this.deps;\n    const { controller, authStorage, auth } = options;\n    const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            // Tenant mode lists the caller's rows and never exposes the\n            // server-global auth.json; local mode is unchanged.\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              providers: await listProviders({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          let body: { key?: unknown; envVar?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const key = typeof body.key === 'string' ? body.key.trim() : '';\n          if (!key) return c.json({ error: 'Missing required field: key' }, 400);\n          const envVar = typeof body.envVar === 'string' ? body.envVar : undefined;\n          const scope = body.scope === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              // envVar is intentionally ignored: tenant credentials are resolved\n              // per-request, never written into process.env.\n              await ctx.storage.setCredential(tenant, getAuthProviderId(provider), { type: 'api_key', key });\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            // Local mode is single-user: scope is meaningless and ignored.\n            authStorage.setStoredApiKey(provider, key, envVar);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            authStorage.remove(`apikey:${provider}`);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────\n      // Mirrors the TUI's /custom-providers command. Backed by GlobalSettings\n      // (settings.json), not session state — these are user-global definitions.\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c => {\n          try {\n            return c.json({ providers: listCustomProviders() });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const parsed = parseCustomProviderBody(body);\n          if ('error' in parsed) return c.json({ error: parsed.error }, 400);\n          // `previousId` lets a rename remove the old entry as well as any name clash.\n          const previousId =\n            body && typeof body === 'object' && typeof (body as Record<string, unknown>).previousId === 'string'\n              ? ((body as Record<string, unknown>).previousId as string)\n              : undefined;\n          try {\n            const settings = loadSettings();\n            upsertCustomProviderInSettings(settings, parsed, previousId);\n            saveSettings(settings);\n            const id = getCustomProviderId(parsed.name);\n            return c.json({ ok: true, provider: listCustomProviders().find(p => p.id === id) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: c => {\n          const id = c.req.param('id');\n          try {\n            const settings = loadSettings();\n            removeCustomProviderFromSettings(settings, id);\n            saveSettings(settings);\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Available models ────────────────────────────────────────────────────\n      // Session-independent model catalog for settings pickers (Factory default\n      // model, pack editors). Only models whose provider has a credential are\n      // returned — the same filter the session-scoped hook applies client-side.\n\n      registerApiRoute('/web/config/models', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const [models, access] = await Promise.all([\n              controller.listAvailableModels(),\n              buildProviderAccess({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            ]);\n            return c.json({\n              models: models\n                .filter(m => canUseModelProvider(access, m.provider) && typeof m.id === 'string')\n                .map(m => ({ id: m.id, provider: m.provider, modelName: m.modelName, hasApiKey: true }))\n                .sort((a, b) =>\n                  a.provider === b.provider ? a.id!.localeCompare(b.id!) : a.provider.localeCompare(b.provider),\n                ),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Model packs ─────────────────────────────────────────────────────────\n      // Mirrors the TUI's /models-pack command. Custom-pack CRUD is DB-backed in\n      // tenant mode (model-packs storage domain, org-scoped) and settings.json in\n      // local mode; activation is session-scoped and resolves the session from\n      // the controller registry by resourceId.\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const activePackId = await resolveActivePackId(session);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              packs: await listModelPacks({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n                packContext,\n                activePackId,\n              }),\n              activePackId,\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          let body: { name?: unknown; models?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const name = typeof body.name === 'string' ? body.name.trim() : '';\n          if (!name) return c.json({ error: 'Missing required field: name' }, 400);\n          const m = (body.models ?? {}) as Record<string, unknown>;\n          const build = typeof m.build === 'string' ? m.build.trim() : '';\n          const plan = typeof m.plan === 'string' ? m.plan.trim() : '';\n          const fast = typeof m.fast === 'string' ? m.fast.trim() : '';\n          if (!build || !plan || !fast) {\n            return c.json({ error: 'models.build, models.plan and models.fast are required' }, 400);\n          }\n          try {\n            if (packContext.mode === 'tenant') {\n              const record = await packContext.storage.upsert({\n                orgId: packContext.orgId,\n                userId: packContext.userId,\n                input: { name, models: { build, plan, fast } },\n              });\n              return c.json({ ok: true, pack: recordToModePack(record) });\n            }\n            const settings = loadSettings();\n            const entry = { name, models: { build, plan, fast }, createdAt: new Date().toISOString() };\n            const idx = settings.customModelPacks.findIndex(p => p.name === name);\n            if (idx >= 0) settings.customModelPacks[idx] = entry;\n            else settings.customModelPacks.push(entry);\n            saveSettings(settings);\n            return c.json({ ok: true, pack: { id: `custom:${name}`, name, models: { build, plan, fast } } });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          try {\n            if (packContext.mode === 'tenant') {\n              const recordId = id.startsWith('custom:') ? id.slice('custom:'.length) : id;\n              const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });\n              return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack \"${id}\"` }, 404);\n            }\n            const settings = loadSettings();\n            removeCustomPackFromSettings(settings, id);\n            saveSettings(settings);\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id/activate', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          let body: { resourceId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const packs = await listModelPacks({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n              packContext,\n            });\n            const pack = packs.find(p => p.id === id);\n            if (!pack) return c.json({ error: `Unknown pack \"${id}\"` }, 404);\n            await applyPackToSession({ controller, session, pack });\n            return c.json({ ok: true, activePackId: pack.id });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Observational memory ──────────────────────────────────────────────────\n      // Mirrors the TUI's /om command. All five knobs are session-scoped (resolved\n      // from the session, persisted to its state + thread setting) plus written to\n      // GlobalSettings so the choice survives restarts and stays in sync with the TUI.\n\n      registerApiRoute('/web/config/om', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          if (!resourceId) return c.json({ error: 'Missing required query param: resourceId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            return c.json({ config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/:role/model', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const role = c.req.param('role');\n          if (role !== 'observer' && role !== 'reflector') {\n            return c.json({ error: `Unknown OM role \"${role}\"` }, 400);\n          }\n          let body: { resourceId?: unknown; modelId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const modelId = typeof body.modelId === 'string' ? body.modelId.trim() : '';\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          if (!modelId) return c.json({ error: 'Missing required field: modelId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const otherRole = role === 'observer' ? session.om.reflector : session.om.observer;\n            const otherRoleCurrentModelId = otherRole.modelId() ?? null;\n            await session.om[role].switchModel({ modelId });\n            persistOmRoleOverride({ role, modelId, otherRoleCurrentModelId });\n            return c.json({ ok: true, config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/thresholds', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: {\n            resourceId?: unknown;\n            observationThreshold?: unknown;\n            reflectionThreshold?: unknown;\n            scope?: unknown;\n          };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          const observation =\n            typeof body.observationThreshold === 'number' && body.observationThreshold > 0\n              ? Math.round(body.observationThreshold)\n              : undefined;\n          const reflection =\n            typeof body.reflectionThreshold === 'number' && body.reflectionThreshold > 0\n              ? Math.round(body.reflectionThreshold)\n              : undefined;\n          if (observation === undefined && reflection === undefined) {\n            return c.json({ error: 'Provide observationThreshold and/or reflectionThreshold (positive numbers)' }, 400);\n          }\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            if (observation !== undefined) {\n              await session.state.set({ observationThreshold: observation });\n              await session.thread.setSetting({ key: 'observationThreshold', value: observation });\n              persistOmThreshold({ role: 'observation', value: observation });\n            }\n            if (reflection !== undefined) {\n              await session.state.set({ reflectionThreshold: reflection });\n              await session.thread.setSetting({ key: 'reflectionThreshold', value: reflection });\n              persistOmThreshold({ role: 'reflection', value: reflection });\n            }\n            return c.json({ ok: true, config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/observe-attachments', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { resourceId?: unknown; value?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          const raw = body.value;\n          const value: 'auto' | boolean = raw === 'auto' || raw === true || raw === false ? raw : 'auto';\n          if (raw !== 'auto' && raw !== true && raw !== false) {\n            return c.json({ error: \"value must be 'auto', true, or false\" }, 400);\n          }\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            await session.state.set({ observeAttachments: value });\n            await session.thread.setSetting({ key: 'observeAttachments', value });\n            persistOmObserveAttachments(value);\n            return c.json({ ok: true, config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n","/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  { mode: 'local' } | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AACA,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,mCAAmC;AACjE,SAAS,6BAA6B;AAEtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,wBAAwB;;;ACa1B,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,aAAa,WAAW,iBAAiB;AAClD;AAQO,IAAM,uBAAmE;AAAA,EAC9E,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,KAAK;AACP;AAUA,eAAsB,4BACpB,aAC8C;AAC9C,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,YAAY,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;AAOA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF,GAKwD;AACtD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,QAAQ;AAIX,QAAI,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC9E,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,QACV;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO;AACtF;AASA,eAAsB,gCAAgC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACF,GAK4C;AAC1C,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,OAAQ,QAAO,KAAK,QAAQ,IAAI,CAAC,IAAI;AAC1C,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,SAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE;;;AChGO,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;AFdA,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AA2FA,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,OAAO,oBAAI,IAA0B;AAE3C,aAAW,SAAS,QAAQ;AAC1B,QAAI,KAAK,IAAI,MAAM,QAAQ,EAAG;AAE9B,UAAM,iBAAiB,kBAAkB,MAAM,QAAQ;AACvD,QAAI,SAAiC;AACrC,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,UAAI,SAAS,WAAW,SAAS,SAAS;AACxC,iBAAS;AAAA,MACX,WAAW,SAAS,WAAW,SAAS,WAAW;AACjD,iBAAS;AAAA,MACX,WAAW,QAAQ,WAAW,SAAS,WAAW;AAChD,iBAAS;AAAA,MACX;AAAA,IACF,WAAW,aAAa,WAAW,cAAc,GAAG;AAClD,eAAS;AAAA,IACX,WAAW,aAAa,gBAAgB,MAAM,QAAQ,GAAG;AACvD,eAAS;AAAA,IACX,WAAW,MAAM,gBAAgB,QAAQ,IAAI,MAAM,YAAY,GAAG;AAChE,eAAS;AAAA,IACX,WAAW,MAAM,WAAW;AAC1B,eAAS;AAAA,IACX;AAEA,UAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,SAAK,IAAI,MAAM,UAAU;AAAA,MACvB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,GAAI,WAAW,EAAE,OAAO,EAAE,WAAW,MAAe,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtF;AAYO,SAAS,sBAA4C;AAC1D,QAAM,WAAW,aAAa;AAC9B,SAAO,SAAS,gBAAgB,IAAI,QAAM;AAAA,IACxC,IAAI,oBAAoB,EAAE,IAAI;AAAA,IAC9B,MAAM,EAAE;AAAA,IACR,KAAK,EAAE;AAAA,IACP,WAAW,QAAQ,EAAE,MAAM;AAAA,IAC3B,QAAQ,EAAE;AAAA,EACZ,EAAE;AACJ;AAGA,SAAS,wBAAwB,MAA0D;AACzF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,OAAO,oBAAoB;AAC3E,QAAM,IAAI;AACV,QAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,+BAA+B;AAC1D,QAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,IAAI,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,EAAE,OAAO,8BAA8B;AACxD,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,aAAO,EAAE,OAAO,6BAA6B;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,0BAA0B;AAAA,EAC5C;AACA,QAAM,SAAS,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,KAAK,IAAI;AACnF,QAAM,SAAS,MAAM,QAAQ,EAAE,MAAM,IACjC,EAAE,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,IACnG,CAAC;AACL,SAAO,EAAE,MAAM,KAAK,QAAQ,OAAO;AACrC;AAeA,eAAsB,oBAAoB;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,cAAc,CAAC,aAAqB,OAAO,KAAK,OAAK,EAAE,aAAa,YAAY,EAAE,SAAS;AACjG,QAAM,cAAc,CAAC,aAA0C;AAC7D,UAAM,iBAAiB,kBAAkB,QAAQ;AACjD,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,YAAM,aAAa,SAAS,cAAc,QAAQ;AAClD,UAAI,YAAY,SAAS,QAAS,QAAO;AACzC,UAAI,YAAY,SAAS,aAAa,WAAW,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC/E,aAAO;AAAA,IACT;AAEA,UAAM,kBAAkB,aAAa,IAAI,cAAc;AACvD,QAAI,iBAAiB,SAAS,QAAS,QAAO;AAC9C,QAAI,aAAa,gBAAgB,QAAQ,EAAG,QAAO;AACnD,UAAM,mBAAmB,aAAa,IAAI,QAAQ;AAClD,QAAI,kBAAkB,SAAS,aAAa,iBAAiB,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC3F,WAAO,YAAY,QAAQ,IAAI,WAAW;AAAA,EAC5C;AACA,QAAM,SAAyB;AAAA,IAC7B,WAAW,YAAY,WAAW;AAAA,IAClC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,kBAAkB,YAAY,gBAAgB;AAAA,EAChD;AACA,QAAM,OAAO,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AACxC,aAAW,KAAK,QAAQ;AACtB,QAAI,CAAC,KAAK,IAAI,EAAE,QAAQ,GAAG;AACzB,aAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,QAAQ;AAC3C,WAAK,IAAI,EAAE,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAwB,UAA2B;AAC9E,SAAO,QAAQ,OAAO,QAAQ,CAAC;AACjC;AAYA,eAAe,2BACb,YACwC;AACxC,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI;AACF,UAAM,WAAW,YAAY;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkD;AAChD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,QAAQ;AACX,QAAI,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC9E,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,2BAA2B,UAAU;AAC3D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,QACV;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO;AACtF;AAGA,SAAS,iBAAiB,QAAmC;AAC3D,SAAO,EAAE,IAAI,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,MAAM,aAAa,qBAAqB,QAAQ,OAAO,OAAO;AACjH;AAQA,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAM6B;AAC3B,QAAM,SAAS,MAAM,oBAAoB,EAAE,YAAY,aAAa,kBAAkB,CAAC;AACvF,QAAM,QACJ,YAAY,SAAS,UACjB,sBAAsB,QAAQ,aAAa,EAAE,gBAAgB,IAC7D;AAAA,IACE,GAAG,sBAAsB,MAAM;AAAA,IAC/B,IAAI,MAAM,YAAY,QAAQ,KAAK,EAAE,OAAO,YAAY,MAAM,CAAC,GAAG,IAAI,gBAAgB;AAAA,EACxF;AACN,SAAO,MACJ,OAAO,OAAK,EAAE,OAAO,QAAQ,EAC7B,IAAI,QAAM;AAAA,IACT,GAAG;AAAA,IACH,QAAQ,EAAE,GAAG,WAAW,SAAS;AAAA,IACjC,QAAQ,gBAAgB,QAAQ,EAAE,OAAO;AAAA,EAC3C,EAAE;AACN;AAGA,eAAe,oBAAoB,SAA0D;AAC3F,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,WAAW,QAAQ,OAAO,MAAM;AACtC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,UAAU,MAAM,QAAQ,OAAO,KAAK,GAAG,KAAK,OAAK,EAAE,OAAO,QAAQ;AACxE,QAAM,QAAQ,QAAQ,WAAW,+BAA+B;AAChE,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAOA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkB;AAChB,QAAM,QAAQ,WAAW,YAAY,KAAK,CAAC;AAC3C,QAAM,aAAa,KAAK;AAExB,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,WAAW,KAAK,EAAE;AAClC,QAAI,SAAS;AACX,WAAK,iBAAiB;AACtB,YAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,eAAe,KAAK,EAAE,IAAI,OAAO,QAAQ,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,mBAAmB,WAAW,QAAQ,KAAK,IAAI,CAAC;AACtD,MAAI,kBAAkB;AACpB,UAAM,QAAQ,MAAM,OAAO,EAAE,SAAS,iBAAiB,CAAC;AAAA,EAC1D;AAEA,QAAM,kBAA0C,EAAE,SAAS,QAAQ,MAAM,QAAQ,SAAS,QAAQ;AAClG,aAAW,CAAC,WAAW,MAAM,KAAK,OAAO,QAAQ,eAAe,GAAG;AACjE,UAAM,YAAY,WAAW,MAAM;AACnC,QAAI,WAAW;AACb,YAAM,QAAQ,UAAU,MAAM,IAAI,EAAE,SAAS,WAAW,UAAU,CAAC;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,iCAAiC,OAAO,KAAK,GAAG,CAAC;AAC1F;AAUA,IAAM,gCAAgC;AACtC,IAAM,+BAA+B;AAW9B,SAAS,aAAa,SAAkC;AAC7D,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,qBAAqB,MAAM;AACjC,SAAO;AAAA,IACL,iBAAiB,QAAQ,GAAG,SAAS,QAAQ,KAAK;AAAA,IAClD,kBAAkB,QAAQ,GAAG,UAAU,QAAQ,KAAK;AAAA,IACpD,sBAAsB,QAAQ,GAAG,SAAS,UAAU,KAAK;AAAA,IACzD,qBAAqB,QAAQ,GAAG,UAAU,UAAU,KAAK;AAAA,IACzD,oBAAoB,uBAAuB,QAAQ,uBAAuB,QAAQ,qBAAqB;AAAA,EACzG;AACF;AAGA,SAAS,mBAAmB,EAAE,MAAM,MAAM,GAAgE;AACxG,QAAM,WAAW,aAAa;AAC9B,MAAI,SAAS,cAAe,UAAS,OAAO,yBAAyB;AAAA,MAChE,UAAS,OAAO,wBAAwB;AAC7C,eAAa,QAAQ;AACvB;AAGA,SAAS,sBAAsB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF,GAIS;AACP,QAAM,WAAW,aAAa;AAC9B,sBAAoB,UAAU,MAAM,SAAS,uBAAuB;AACpE,eAAa,QAAQ;AACvB;AA4BO,IAAM,eAAN,cAA2B,MAAwB;AAAA,EACxD,SAAqB;AACnB,UAAM,UAAU,KAAK;AACrB,UAAM,EAAE,YAAY,aAAa,KAAK,IAAI;AAC1C,UAAM,uBAAuB,QAAQ,yBAAyB,MAAM;AAAA,IAAC;AAErE,WAAO;AAAA,MACL,iBAAiB,yBAAyB;AAAA,QACxC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAGF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,WAAW,MAAM,cAAc;AAAA,gBAC7B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,IAAI,KAAK,IAAI;AAC7D,cAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AACrE,gBAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,gBAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;AAC7C,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAG/F,oBAAM,IAAI,QAAQ,cAAc,QAAQ,kBAAkB,QAAQ,GAAG,EAAE,MAAM,WAAW,IAAI,CAAC;AAC7F,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAErF,wBAAY,gBAAgB,UAAU,KAAK,MAAM;AACjD,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACvD,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAC/F,oBAAM,IAAI,QAAQ,iBAAiB,QAAQ,kBAAkB,QAAQ,CAAC;AACtE,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AACrF,wBAAY,OAAO,UAAU,QAAQ,EAAE;AACvC,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA,MAMD,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAK;AACZ,cAAI;AACF,mBAAO,EAAE,KAAK,EAAE,WAAW,oBAAoB,EAAE,CAAC;AAAA,UACpD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,SAAS,wBAAwB,IAAI;AAC3C,cAAI,WAAW,OAAQ,QAAO,EAAE,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,GAAG;AAEjE,gBAAM,aACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,eAAe,WACtF,KAAiC,aACnC;AACN,cAAI;AACF,kBAAM,WAAW,aAAa;AAC9B,2CAA+B,UAAU,QAAQ,UAAU;AAC3D,yBAAa,QAAQ;AACrB,kBAAM,KAAK,oBAAoB,OAAO,IAAI;AAC1C,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,oBAAoB,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,oCAAoC;AAAA,QACnD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAK;AACZ,gBAAM,KAAK,EAAE,IAAI,MAAM,IAAI;AAC3B,cAAI;AACF,kBAAM,WAAW,aAAa;AAC9B,6CAAiC,UAAU,EAAE;AAC7C,yBAAa,QAAQ;AACrB,mBAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,UAC5B,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,sBAAsB;AAAA,QACrC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,cACzC,WAAW,oBAAoB;AAAA,cAC/B,oBAAoB;AAAA,gBAClB;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,QAAQ,OACL,OAAO,OAAK,oBAAoB,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,OAAO,QAAQ,EAC/E,IAAI,QAAM,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,UAAU,WAAW,EAAE,WAAW,WAAW,KAAK,EAAE,EACtF;AAAA,gBAAK,CAAC,GAAG,MACR,EAAE,aAAa,EAAE,WAAW,EAAE,GAAI,cAAc,EAAE,EAAG,IAAI,EAAE,SAAS,cAAc,EAAE,QAAQ;AAAA,cAC9F;AAAA,YACJ,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQD,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,kBAAM,eAAe,MAAM,oBAAoB,OAAO;AACtD,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,OAAO,MAAM,eAAe;AAAA,gBAC1B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,gBACA;AAAA,gBACA;AAAA,cACF,CAAC;AAAA,cACD;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AAChE,cAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AACvE,gBAAM,IAAK,KAAK,UAAU,CAAC;AAC3B,gBAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,KAAK,IAAI;AAC7D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,cAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;AAC5B,mBAAO,EAAE,KAAK,EAAE,OAAO,yDAAyD,GAAG,GAAG;AAAA,UACxF;AACA,cAAI;AACF,gBAAI,YAAY,SAAS,UAAU;AACjC,oBAAM,SAAS,MAAM,YAAY,QAAQ,OAAO;AAAA,gBAC9C,OAAO,YAAY;AAAA,gBACnB,QAAQ,YAAY;AAAA,gBACpB,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE;AAAA,cAC/C,CAAC;AACD,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,MAAM,iBAAiB,MAAM,EAAE,CAAC;AAAA,YAC5D;AACA,kBAAM,WAAW,aAAa;AAC9B,kBAAM,QAAQ,EAAE,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AACzF,kBAAM,MAAM,SAAS,iBAAiB,UAAU,OAAK,EAAE,SAAS,IAAI;AACpE,gBAAI,OAAO,EAAG,UAAS,iBAAiB,GAAG,IAAI;AAAA,gBAC1C,UAAS,iBAAiB,KAAK,KAAK;AACzC,yBAAa,QAAQ;AACrB,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,IAAI,UAAU,IAAI,IAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE,EAAE,CAAC;AAAA,UACjG,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,+BAA+B;AAAA,QAC9C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACF,gBAAI,YAAY,SAAS,UAAU;AACjC,oBAAM,WAAW,GAAG,WAAW,SAAS,IAAI,GAAG,MAAM,UAAU,MAAM,IAAI;AACzE,oBAAM,UAAU,MAAM,YAAY,QAAQ,OAAO,EAAE,OAAO,YAAY,OAAO,IAAI,SAAS,CAAC;AAC3F,qBAAO,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAAA,YACvF;AACA,kBAAM,WAAW,aAAa;AAC9B,yCAA6B,UAAU,EAAE;AACzC,yBAAa,QAAQ;AACrB,mBAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,UAC5B,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,wCAAwC;AAAA,QACvD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,QAAQ,MAAM,eAAe;AAAA,cACjC;AAAA,cACA,aAAa,oBAAoB,SAAY;AAAA,cAC7C;AAAA,cACA;AAAA,YACF,CAAC;AACD,kBAAM,OAAO,MAAM,KAAK,OAAK,EAAE,OAAO,EAAE;AACxC,gBAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAC/D,kBAAM,mBAAmB,EAAE,YAAY,SAAS,KAAK,CAAC;AACtD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,cAAc,KAAK,GAAG,CAAC;AAAA,UACnD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,kBAAkB;AAAA,QACjC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;AACzF,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,mBAAO,EAAE,KAAK,EAAE,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UACjD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,8BAA8B;AAAA,QAC7C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,cAAI,SAAS,cAAc,SAAS,aAAa;AAC/C,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,UAC3D;AACA,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,KAAK,IAAI;AACzE,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,cAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,kCAAkC,GAAG,GAAG;AAC7E,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,YAAY,SAAS,aAAa,QAAQ,GAAG,YAAY,QAAQ,GAAG;AAC1E,kBAAM,0BAA0B,UAAU,QAAQ,KAAK;AACvD,kBAAM,QAAQ,GAAG,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAC9C,kCAAsB,EAAE,MAAM,SAAS,wBAAwB,CAAC;AAChE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UAC3D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAMJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,gBAAM,cACJ,OAAO,KAAK,yBAAyB,YAAY,KAAK,uBAAuB,IACzE,KAAK,MAAM,KAAK,oBAAoB,IACpC;AACN,gBAAM,aACJ,OAAO,KAAK,wBAAwB,YAAY,KAAK,sBAAsB,IACvE,KAAK,MAAM,KAAK,mBAAmB,IACnC;AACN,cAAI,gBAAgB,UAAa,eAAe,QAAW;AACzD,mBAAO,EAAE,KAAK,EAAE,OAAO,6EAA6E,GAAG,GAAG;AAAA,UAC5G;AACA,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,gBAAI,gBAAgB,QAAW;AAC7B,oBAAM,QAAQ,MAAM,IAAI,EAAE,sBAAsB,YAAY,CAAC;AAC7D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,wBAAwB,OAAO,YAAY,CAAC;AACnF,iCAAmB,EAAE,MAAM,eAAe,OAAO,YAAY,CAAC;AAAA,YAChE;AACA,gBAAI,eAAe,QAAW;AAC5B,oBAAM,QAAQ,MAAM,IAAI,EAAE,qBAAqB,WAAW,CAAC;AAC3D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,uBAAuB,OAAO,WAAW,CAAC;AACjF,iCAAmB,EAAE,MAAM,cAAc,OAAO,WAAW,CAAC;AAAA,YAC9D;AACA,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UAC3D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,sCAAsC;AAAA,QACrD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,gBAAM,MAAM,KAAK;AACjB,gBAAM,QAA0B,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AACxF,cAAI,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,OAAO;AACnD,mBAAO,EAAE,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;AAAA,UACtE;AACA,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,QAAQ,MAAM,IAAI,EAAE,oBAAoB,MAAM,CAAC;AACrD,kBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,sBAAsB,MAAM,CAAC;AACpE,wCAA4B,KAAK;AACjC,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UAC3D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["providers"]}
+{"version":3,"sources":["../../src/routes/config.ts","../../src/routes/provider-credentials.ts","../../src/routes/route.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport { DEFAULT_OM_MODEL_ID } from '@mastra/code-sdk/constants';\nimport { getAvailableModePacks } from '@mastra/code-sdk/onboarding/packs';\nimport type { ModePack, ProviderAccess, ProviderAccessLevel } from '@mastra/code-sdk/onboarding/packs';\nimport { getCustomProviderId, THREAD_ACTIVE_MODEL_PACK_ID_KEY } from '@mastra/code-sdk/onboarding/settings';\nimport type { CustomProviderSetting } from '@mastra/code-sdk/onboarding/settings';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { Context } from 'hono';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { CustomProviderRecord, CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type {\n  MemorySettingsFillIfUnset,\n  MemorySettingsPatch,\n  MemorySettingsRecord,\n  MemorySettingsStorage,\n} from '../storage/domains/memory-settings/base.js';\nimport type { ModelPackRecord, ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport {\n  getAuthProviderId,\n  listTenantCredentialsForRequest,\n  resolveCredentialContext,\n  tenantOrgId,\n  WEB_OAUTH_FLOW_KINDS,\n} from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteAuth, RouteDependencies } from './route.js';\n\n/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Server-side configuration routes for the web app.\n *\n * The browser has no access to the credential store or the model catalog, so\n * the web settings panel asks the server — which owns both — to list providers\n * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the\n * same `AuthStorage`-backed key management over HTTP.\n *\n * Keys are never returned to the client; only their presence and source.\n */\n\n/**\n * Where a provider's active credential comes from, as seen by the caller.\n * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode\n * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).\n */\nexport type ProviderCredentialSource =\n  'oauth' | 'stored' | 'env' | 'none' | 'oauth-user' | 'stored-user' | 'stored-org';\n\n/** A model provider with the current source of its credentials. */\nexport interface ProviderInfo {\n  provider: string;\n  /** Env var the provider's key is read from, if any. */\n  envVar?: string;\n  /** Where the active credential comes from. */\n  source: ProviderCredentialSource;\n  /** Web OAuth sign-in capability, when the provider supports it. */\n  oauth?: { supported: true; modes: LoginSessionKind[] };\n}\n\n/** Minimal session surface a pack activation touches. */\ninterface PackSession {\n  mode: { get: () => string };\n  model: { switch: (args: { modelId: string }) => Promise<void> };\n  subagents: { model: { set: (args: { modelId: string; agentType: string }) => Promise<void> } };\n  thread: {\n    getId: () => string | null;\n    setSetting: (args: { key: string; value: unknown }) => Promise<void>;\n    list: () => Promise<Array<{ id: string; metadata?: Record<string, unknown> }>>;\n  };\n}\n\n/** One observational-memory role's read/switch surface. */\ninterface OMRole {\n  modelId: () => string | undefined;\n  threshold: () => number | undefined;\n  switchModel: (args: { modelId: string }) => Promise<void>;\n}\n\n/**\n * Session-state fields the OM config routes write. The index signatures mirror\n * `MastraCodeState` so the concrete `Session.state.set(Partial<MastraCodeState>)`\n * stays assignable to this minimal surface (contravariant parameter check).\n */\ninterface OMStateWrites {\n  [key: string]: unknown;\n  [key: `subagentModelId_${string}`]: string | undefined;\n  observationThreshold?: number;\n  reflectionThreshold?: number;\n  observeAttachments?: 'auto' | boolean;\n}\n\n/** Minimal session surface the OM config routes touch. */\nexport interface OMSession extends PackSession {\n  state: {\n    get: () => Record<string, unknown> | undefined;\n    set: (updates: OMStateWrites) => Promise<void> | void;\n  };\n  om: { observer: OMRole; reflector: OMRole };\n}\n\n/** Minimal controller surface this module needs (model catalog + modes + sessions). */\ninterface ModelCatalog {\n  listAvailableModels: () => Promise<\n    Array<{ id?: string; modelName?: string; provider: string; hasApiKey: boolean; apiKeyEnvVar?: string }>\n  >;\n  listModes?: () => Array<{ id: string; defaultModelId?: string }>;\n  getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;\n}\n\n/**\n * Build a deduplicated, sorted list of providers from the model catalog,\n * annotated with where each provider's credential currently comes from.\n * Mirrors the TUI's `/api-keys` provider list.\n *\n * When `tenantCredentials` is given (deployed mode), sources reflect the\n * *caller's* tenant rows with user > org precedence and the server-global\n * `authStorage` is ignored; otherwise the local `auth.json` view is reported.\n */\nexport async function listProviders({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderInfo[]> {\n  const models = await controller.listAvailableModels();\n  const seen = new Map<string, ProviderInfo>();\n\n  for (const model of models) {\n    if (seen.has(model.provider)) continue;\n\n    const authProviderId = getAuthProviderId(model.provider);\n    let source: ProviderInfo['source'] = 'none';\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      if (userRec?.credential.type === 'oauth') {\n        source = 'oauth-user';\n      } else if (userRec?.credential.type === 'api_key') {\n        source = 'stored-user';\n      } else if (orgRec?.credential.type === 'api_key') {\n        source = 'stored-org';\n      }\n    } else if (authStorage?.isLoggedIn(authProviderId)) {\n      source = 'oauth';\n    } else if (authStorage?.hasStoredApiKey(model.provider)) {\n      source = 'stored';\n    } else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) {\n      source = 'env';\n    } else if (model.hasApiKey) {\n      source = 'env';\n    }\n\n    const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];\n    seen.set(model.provider, {\n      provider: model.provider,\n      envVar: model.apiKeyEnvVar,\n      source,\n      ...(flowKind ? { oauth: { supported: true as const, modes: [flowKind] } } : {}),\n    });\n  }\n\n  return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));\n}\n\n/** A user-defined OpenAI-compatible provider, with key presence (never the key). */\nexport interface CustomProviderInfo {\n  id: string;\n  name: string;\n  url: string;\n  hasApiKey: boolean;\n  models: string[];\n}\n\n/** Redact a stored custom-provider row for the client (key presence only). */\nfunction toCustomProviderInfo(record: CustomProviderRecord): CustomProviderInfo {\n  return {\n    id: record.providerId,\n    name: record.name,\n    url: record.url,\n    hasApiKey: Boolean(record.apiKey),\n    models: record.models,\n  };\n}\n\n/** The resolved custom-providers storage scope for a request. */\ninterface CustomProvidersContext {\n  storage: CustomProvidersStorage;\n  orgId: string;\n  userId: string;\n}\n\n/**\n * Resolve the custom-providers context for a request, or a ready-to-return\n * error response. Same posture as memory settings: tenant rows in deployed\n * mode, a sentinel `local` org in no-auth mode — never settings.json.\n */\nasync function resolveCustomProvidersContext({\n  c,\n  auth,\n  customProviders,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  customProviders?: CustomProvidersStorage;\n}): Promise<CustomProvidersContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (customProviders) {\n    try {\n      await customProviders.ensureReady();\n      return tenant\n        ? { storage: customProviders, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: customProviders, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'custom_providers_unavailable',\n        message: 'Custom provider storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Validate + coerce a request body into a CustomProviderSetting. */\nfunction parseCustomProviderBody(body: unknown): CustomProviderSetting | { error: string } {\n  if (!body || typeof body !== 'object') return { error: 'Invalid JSON body' };\n  const b = body as Record<string, unknown>;\n  const name = typeof b.name === 'string' ? b.name.trim() : '';\n  if (!name) return { error: 'Missing required field: name' };\n  const url = typeof b.url === 'string' ? b.url.trim() : '';\n  if (!url) return { error: 'Missing required field: url' };\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n      return { error: 'url must be an http(s) URL' };\n    }\n  } catch {\n    return { error: 'url must be a valid URL' };\n  }\n  const apiKey = typeof b.apiKey === 'string' && b.apiKey.trim() ? b.apiKey.trim() : undefined;\n  const models = Array.isArray(b.models)\n    ? b.models.filter((m): m is string => typeof m === 'string' && m.trim().length > 0).map(m => m.trim())\n    : [];\n  return { name, url, apiKey, models };\n}\n\n// ── Model packs ──────────────────────────────────────────────────────────\n\n/** A model pack as surfaced to the web client, with an `active` flag. */\nexport interface ModelPackInfo extends ModePack {\n  custom: boolean;\n  active: boolean;\n}\n\n/**\n * Compute which providers the user can reach, mirroring the TUI's\n * `/models-pack` access derivation: OAuth/api-key from the credential store for\n * the named providers, plus any other provider that has a usable key.\n */\nexport async function buildProviderAccess({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderAccess> {\n  const models = await controller.listAvailableModels();\n  const hasModelKey = (provider: string) => models.some(m => m.provider === provider && m.hasApiKey);\n  const accessLevel = (provider: string): ProviderAccessLevel => {\n    const authProviderId = getAuthProviderId(provider);\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      const credential = userRec?.credential ?? orgRec?.credential;\n      if (credential?.type === 'oauth') return 'oauth';\n      if (credential?.type === 'api_key' && credential.key.trim().length > 0) return 'apikey';\n      return false;\n    }\n\n    const oauthCredential = authStorage?.get(authProviderId);\n    if (oauthCredential?.type === 'oauth') return 'oauth';\n    if (authStorage?.hasStoredApiKey(provider)) return 'apikey';\n    const directCredential = authStorage?.get(provider);\n    if (directCredential?.type === 'api_key' && directCredential.key.trim().length > 0) return 'apikey';\n    return hasModelKey(provider) ? 'apikey' : false;\n  };\n  const access: ProviderAccess = {\n    anthropic: accessLevel('anthropic'),\n    openai: accessLevel('openai'),\n    cerebras: accessLevel('cerebras'),\n    google: accessLevel('google'),\n    deepseek: accessLevel('deepseek'),\n    'github-copilot': accessLevel('github-copilot'),\n  };\n  const seen = new Set(Object.keys(access));\n  for (const m of models) {\n    if (!seen.has(m.provider)) {\n      access[m.provider] = accessLevel(m.provider);\n      seen.add(m.provider);\n    }\n  }\n  return access;\n}\n\nfunction canUseModelProvider(access: ProviderAccess, provider: string): boolean {\n  return Boolean(access[provider]);\n}\n\n/**\n * Where a request's custom model packs live. Same posture as memory settings\n * and custom providers: the `model-packs` factory storage domain, scoped per\n * org in deployed mode and to a sentinel `local` org in no-auth mode — never\n * settings.json.\n */\nexport interface PackContext {\n  storage: ModelPacksStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the pack context for a request, or a ready-to-return error response. */\nasync function resolvePackContext({\n  c,\n  auth,\n  modelPacks,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  modelPacks?: ModelPacksStorage;\n}): Promise<PackContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (modelPacks) {\n    try {\n      await modelPacks.ensureReady();\n      return tenant\n        ? { storage: modelPacks, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: modelPacks, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'model_packs_unavailable',\n        message: 'Model pack storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** DB row → the `ModePack` shape the packs list and activation flow consume. */\nfunction recordToModePack(record: ModelPackRecord): ModePack {\n  return { id: `custom:${record.id}`, name: record.name, description: 'Saved custom pack', models: record.models };\n}\n\n/**\n * List available model packs (built-in, gated by provider access, plus saved\n * custom packs from the request's pack context). Drops the synthetic\n * \"New Custom\" placeholder — the web client has its own create flow. `active`\n * is set from the given session's thread when a resourceId is supplied.\n */\nexport async function listModelPacks({\n  controller,\n  authStorage,\n  tenantCredentials,\n  packContext,\n  activePackId,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n  packContext: PackContext;\n  activePackId?: string | null;\n}): Promise<ModelPackInfo[]> {\n  const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });\n  const packs = [\n    ...getAvailableModePacks(access),\n    ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack),\n  ];\n  return packs\n    .filter(p => p.id !== 'custom') // synthetic \"choose each model\" placeholder\n    .map(p => ({\n      ...p,\n      custom: p.id.startsWith('custom:'),\n      active: activePackId != null && p.id === activePackId,\n    }));\n}\n\n/** Resolve the active pack id for a session by reading its current thread. */\nasync function resolveActivePackId(session: PackSession | undefined): Promise<string | null> {\n  if (!session) return null;\n  const threadId = session.thread.getId();\n  if (!threadId) return null;\n  const thread = (await session.thread.list()).find(t => t.id === threadId);\n  const value = thread?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];\n  return typeof value === 'string' ? value : null;\n}\n\n/**\n * Apply a pack to a session: seed each mode's default model, switch the current\n * mode's model, set per-subagent models, and tag the thread with the active\n * pack id. Mirrors the TUI `applyPack` orchestration.\n */\nasync function applyPackToSession({\n  controller,\n  session,\n  pack,\n}: {\n  controller: ModelCatalog;\n  session: PackSession;\n  pack: ModePack;\n}): Promise<void> {\n  const modes = controller.listModes?.() ?? [];\n  const packModels = pack.models as Record<string, string>;\n\n  for (const mode of modes) {\n    const modelId = packModels[mode.id];\n    if (modelId) {\n      mode.defaultModelId = modelId;\n      await session.thread.setSetting({ key: `modeModelId_${mode.id}`, value: modelId });\n    }\n  }\n\n  const currentModeModel = packModels[session.mode.get()];\n  if (currentModeModel) {\n    await session.model.switch({ modelId: currentModeModel });\n  }\n\n  const subagentModeMap: Record<string, string> = { explore: 'fast', plan: 'plan', execute: 'build' };\n  for (const [agentType, modeId] of Object.entries(subagentModeMap)) {\n    const saModelId = packModels[modeId];\n    if (saModelId) {\n      await session.subagents.model.set({ modelId: saModelId, agentType });\n    }\n  }\n\n  await session.thread.setSetting({ key: THREAD_ACTIVE_MODEL_PACK_ID_KEY, value: pack.id });\n}\n\n// ── Observational memory ────────────────────────────────────────────────────\n// Mirrors the TUI `/om` command. Observer/reflector model + threshold reads come\n// from the session (state, falling back to omConfig defaults); writes go to both\n// the session (state + thread setting, via the same session methods the TUI uses)\n// and GlobalSettings (settings.json), so the choice survives restarts and stays\n// in sync with the terminal.\n\n/** Default thresholds mirror the TUI `/om` fallbacks. */\nconst DEFAULT_OBSERVATION_THRESHOLD = 30_000;\nconst DEFAULT_REFLECTION_THRESHOLD = 40_000;\n\n/** Read the current OM config from a session. */\nexport interface OMConfigInfo {\n  observerModelId: string;\n  reflectorModelId: string;\n  observationThreshold: number;\n  reflectionThreshold: number;\n  observeAttachments: 'auto' | boolean;\n}\n\nexport function readOMConfig(session: OMSession): OMConfigInfo {\n  const state = session.state.get() ?? {};\n  const observeAttachments = state.observeAttachments;\n  return {\n    observerModelId: session.om.observer.modelId() ?? '',\n    reflectorModelId: session.om.reflector.modelId() ?? '',\n    observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : 'auto',\n  };\n}\n\n/**\n * Where a request's OM settings live: the `memory-settings` factory storage\n * domain, one row per (org, user). Without a tenant (auth disabled), settings\n * land on a sentinel `(local, local)` row in the same table — the web surface\n * never reads or writes `settings.json` for memory settings.\n */\ninterface MemorySettingsContext {\n  storage: MemorySettingsStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the memory-settings context for a request, or a ready-to-return error response. */\nasync function resolveMemorySettingsContext({\n  c,\n  auth,\n  memorySettings,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  memorySettings?: MemorySettingsStorage;\n}): Promise<MemorySettingsContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (memorySettings) {\n    try {\n      await memorySettings.ensureReady();\n      return tenant\n        ? { storage: memorySettings, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: memorySettings, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'memory_settings_unavailable',\n        message: 'Memory settings storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Persist an OM knob change to the caller's memory-settings row. */\nasync function persistMemorySettings(\n  context: MemorySettingsContext,\n  patch: MemorySettingsPatch,\n  fillIfUnset?: MemorySettingsFillIfUnset,\n): Promise<void> {\n  await context.storage.patch({ orgId: context.orgId, userId: context.userId, patch, fillIfUnset });\n}\n\n/**\n * Apply the stored memory-settings row onto the session, so the DB — not\n * whatever happens to sit in persisted session state (e.g. a stale boot-time\n * seed from before memory settings moved to the DB) — is what the web surface\n * reads and what the session's OM actually runs with. The row is authoritative:\n * knobs without a stored value reset to the built-in defaults.\n */\nasync function hydrateSessionMemorySettings(session: OMSession, record: MemorySettingsRecord | null): Promise<void> {\n  for (const role of ['observer', 'reflector'] as const) {\n    const stored = role === 'observer' ? record?.observerModelId : record?.reflectorModelId;\n    const target = stored ?? DEFAULT_OM_MODEL_ID;\n    if (session.om[role].modelId() !== target) {\n      await session.om[role].switchModel({ modelId: target });\n    }\n  }\n  const state = session.state.get() ?? {};\n  const updates: OMStateWrites = {};\n  const observationThreshold = record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD;\n  if (state.observationThreshold !== observationThreshold) {\n    updates.observationThreshold = observationThreshold;\n  }\n  const reflectionThreshold = record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD;\n  if (state.reflectionThreshold !== reflectionThreshold) {\n    updates.reflectionThreshold = reflectionThreshold;\n  }\n  const observeAttachments = record?.observeAttachments ?? 'auto';\n  if ((state.observeAttachments ?? 'auto') !== observeAttachments) {\n    updates.observeAttachments = observeAttachments;\n  }\n  if (Object.keys(updates).length > 0) await session.state.set(updates);\n}\n\n/** Dependencies injected into {@link ConfigRoutes}. */\nexport interface ConfigRoutesDeps extends RouteDependencies {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Tenant model-packs domain handle; absent in local (no-DB) mode. */\n  modelPacks?: ModelPacksStorage;\n  /** Tenant memory-settings domain handle; absent in local (no-DB) mode. */\n  memorySettings?: MemorySettingsStorage;\n  /** Custom-providers domain handle; absent when the app database is missing. */\n  customProviders?: CustomProvidersStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n  /** Notifies the host after custom providers change so model-router caches can be dropped. */\n  onCustomProvidersChanged?: (tenant: { orgId: string }) => void;\n}\n\n/**\n * The web config routes as Mastra `apiRoutes`:\n *   - `GET    /web/config/providers`              — list providers + key source\n *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key\n *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key\n *   - `GET    /web/config/models`                  — list available models (credentialed providers)\n *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers\n *   - `POST   /web/config/custom-providers`        — create/update a custom provider\n *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider\n *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments\n *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model\n *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds\n *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)\n */\nexport class ConfigRoutes extends Route<ConfigRoutesDeps> {\n  routes(): ApiRoute[] {\n    const options = this.deps;\n    const { controller, authStorage, auth } = options;\n    const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});\n    const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            // Tenant mode lists the caller's rows and never exposes the\n            // server-global auth.json; local mode is unchanged.\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              providers: await listProviders({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          let body: { key?: unknown; envVar?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const key = typeof body.key === 'string' ? body.key.trim() : '';\n          if (!key) return c.json({ error: 'Missing required field: key' }, 400);\n          const envVar = typeof body.envVar === 'string' ? body.envVar : undefined;\n          const scope = body.scope === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              // envVar is intentionally ignored: tenant credentials are resolved\n              // per-request, never written into process.env.\n              await ctx.storage.setCredential(tenant, getAuthProviderId(provider), { type: 'api_key', key });\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            // Local mode is single-user: scope is meaningless and ignored.\n            authStorage.setStoredApiKey(provider, key, envVar);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            authStorage.remove(`apikey:${provider}`);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────\n      // Mirrors the TUI's /custom-providers command, but backed by the\n      // `custom-providers` domain (org rows in tenant mode, a sentinel `local`\n      // org in no-auth mode) — the server never reads settings.json for these.\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          try {\n            const records = await ctx.storage.list({ orgId: ctx.orgId });\n            return c.json({ providers: records.map(toCustomProviderInfo) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const parsed = parseCustomProviderBody(body);\n          if ('error' in parsed) return c.json({ error: parsed.error }, 400);\n          // `previousId` lets a rename remove the old entry as well as any name clash.\n          const previousId =\n            body && typeof body === 'object' && typeof (body as Record<string, unknown>).previousId === 'string'\n              ? ((body as Record<string, unknown>).previousId as string)\n              : undefined;\n          try {\n            const record = await ctx.storage.upsert({\n              orgId: ctx.orgId,\n              userId: ctx.userId,\n              input: {\n                providerId: getCustomProviderId(parsed.name),\n                name: parsed.name,\n                url: parsed.url,\n                apiKey: parsed.apiKey,\n                models: parsed.models,\n              },\n              previousProviderId: previousId,\n            });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true, provider: toCustomProviderInfo(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          const id = c.req.param('id');\n          try {\n            await ctx.storage.delete({ orgId: ctx.orgId, providerId: id });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Available models ────────────────────────────────────────────────────\n      // Session-independent model catalog for settings pickers (Factory default\n      // model, pack editors). Only models whose provider has a credential are\n      // returned — the same filter the session-scoped hook applies client-side.\n\n      registerApiRoute('/web/config/models', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const [models, access] = await Promise.all([\n              controller.listAvailableModels(),\n              buildProviderAccess({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            ]);\n            const catalog = models\n              .filter(m => canUseModelProvider(access, m.provider) && typeof m.id === 'string')\n              .map(m => ({ id: m.id!, provider: m.provider, modelName: m.modelName, hasApiKey: true }));\n            // Append the caller's custom provider models (DB-backed, org rows in\n            // tenant mode / sentinel `local` org in no-auth mode). The boot-time\n            // gateway catalog only carries the local list, so tenant callers get\n            // theirs here. Dedupe against ids already present.\n            if (options.customProviders) {\n              try {\n                const ctx = await resolveCustomProvidersContext({\n                  c: loose(c),\n                  auth,\n                  customProviders: options.customProviders,\n                });\n                if (!('response' in ctx)) {\n                  const known = new Set(catalog.map(m => m.id));\n                  for (const record of await ctx.storage.list({ orgId: ctx.orgId })) {\n                    for (const model of record.models) {\n                      const id = `${record.providerId}/${model}`;\n                      if (known.has(id)) continue;\n                      known.add(id);\n                      catalog.push({ id, provider: record.providerId, modelName: model, hasApiKey: true });\n                    }\n                  }\n                }\n              } catch {\n                // Fail soft: the catalog still serves the built-in models.\n              }\n            }\n            return c.json({\n              models: catalog.sort((a, b) =>\n                a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider),\n              ),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Model packs ─────────────────────────────────────────────────────────\n      // Mirrors the TUI's /models-pack command. Custom-pack CRUD lives in the\n      // model-packs storage domain (org-scoped, sentinel `local` org in no-auth\n      // mode — never settings.json); activation is session-scoped and resolves\n      // the session from the controller registry by resourceId.\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const activePackId = await resolveActivePackId(session);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              packs: await listModelPacks({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n                packContext,\n                activePackId,\n              }),\n              activePackId,\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          let body: { name?: unknown; models?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const name = typeof body.name === 'string' ? body.name.trim() : '';\n          if (!name) return c.json({ error: 'Missing required field: name' }, 400);\n          const m = (body.models ?? {}) as Record<string, unknown>;\n          const build = typeof m.build === 'string' ? m.build.trim() : '';\n          const plan = typeof m.plan === 'string' ? m.plan.trim() : '';\n          const fast = typeof m.fast === 'string' ? m.fast.trim() : '';\n          if (!build || !plan || !fast) {\n            return c.json({ error: 'models.build, models.plan and models.fast are required' }, 400);\n          }\n          try {\n            const record = await packContext.storage.upsert({\n              orgId: packContext.orgId,\n              userId: packContext.userId,\n              input: { name, models: { build, plan, fast } },\n            });\n            return c.json({ ok: true, pack: recordToModePack(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          try {\n            const recordId = id.startsWith('custom:') ? id.slice('custom:'.length) : id;\n            const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });\n            return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack \"${id}\"` }, 404);\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id/activate', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          let body: { resourceId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const packs = await listModelPacks({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n              packContext,\n            });\n            const pack = packs.find(p => p.id === id);\n            if (!pack) return c.json({ error: `Unknown pack \"${id}\"` }, 404);\n            await applyPackToSession({ controller, session, pack });\n            return c.json({ ok: true, activePackId: pack.id });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Observational memory ──────────────────────────────────────────────────\n      // Mirrors the TUI's /om command. All five knobs are session-scoped (resolved\n      // from the session, persisted to its state + thread setting) and durably\n      // stored in the per-(org, user) `memory-settings` app table — never\n      // settings.json. GET hydrates the session from the stored row first so the\n      // DB, not the SDK's boot-time seed, is the source of truth.\n\n      registerApiRoute('/web/config/om', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          if (!resourceId) return c.json({ error: 'Missing required query param: resourceId' }, 400);\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });\n            await hydrateSessionMemorySettings(session, record);\n            return c.json({ config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/:role/model', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const role = c.req.param('role');\n          if (role !== 'observer' && role !== 'reflector') {\n            return c.json({ error: `Unknown OM role \"${role}\"` }, 400);\n          }\n          let body: { resourceId?: unknown; modelId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const modelId = typeof body.modelId === 'string' ? body.modelId.trim() : '';\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          if (!modelId) return c.json({ error: 'Missing required field: modelId' }, 400);\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const otherRole = role === 'observer' ? session.om.reflector : session.om.observer;\n            const otherRoleCurrentModelId = otherRole.modelId() ?? null;\n            await session.om[role].switchModel({ modelId });\n            // Pin the other role's current model too, so a later restart\n            // doesn't drift it once this role is explicitly overridden. The\n            // \"only if still unset\" check runs inside the storage layer's\n            // atomic update, so a concurrent explicit switch of the other\n            // role is never clobbered by this fill.\n            const otherKey = role === 'observer' ? 'reflectorModelId' : 'observerModelId';\n            await persistMemorySettings(\n              context,\n              { [role === 'observer' ? 'observerModelId' : 'reflectorModelId']: modelId },\n              otherRoleCurrentModelId ? { [otherKey]: otherRoleCurrentModelId } : undefined,\n            );\n            return c.json({ ok: true, config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/thresholds', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: {\n            resourceId?: unknown;\n            observationThreshold?: unknown;\n            reflectionThreshold?: unknown;\n            scope?: unknown;\n          };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          const observation =\n            typeof body.observationThreshold === 'number' && body.observationThreshold > 0\n              ? Math.round(body.observationThreshold)\n              : undefined;\n          const reflection =\n            typeof body.reflectionThreshold === 'number' && body.reflectionThreshold > 0\n              ? Math.round(body.reflectionThreshold)\n              : undefined;\n          if (observation === undefined && reflection === undefined) {\n            return c.json({ error: 'Provide observationThreshold and/or reflectionThreshold (positive numbers)' }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            if (observation !== undefined) {\n              await session.state.set({ observationThreshold: observation });\n              await session.thread.setSetting({ key: 'observationThreshold', value: observation });\n            }\n            if (reflection !== undefined) {\n              await session.state.set({ reflectionThreshold: reflection });\n              await session.thread.setSetting({ key: 'reflectionThreshold', value: reflection });\n            }\n            await persistMemorySettings(context, {\n              ...(observation !== undefined ? { observationThreshold: observation } : {}),\n              ...(reflection !== undefined ? { reflectionThreshold: reflection } : {}),\n            });\n            return c.json({ ok: true, config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/observe-attachments', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { resourceId?: unknown; value?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          const raw = body.value;\n          const value: 'auto' | boolean = raw === 'auto' || raw === true || raw === false ? raw : 'auto';\n          if (raw !== 'auto' && raw !== true && raw !== false) {\n            return c.json({ error: \"value must be 'auto', true, or false\" }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            await session.state.set({ observeAttachments: value });\n            await session.thread.setSetting({ key: 'observeAttachments', value });\n            await persistMemorySettings(context, { observeAttachments: value });\n            return c.json({ ok: true, config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n","/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  { mode: 'local' } | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AACA,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,qBAAqB,uCAAuC;AAGrE,SAAS,wBAAwB;;;ACuB1B,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,aAAa,WAAW,iBAAiB;AAClD;AAQO,IAAM,uBAAmE;AAAA,EAC9E,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,KAAK;AACP;AAUA,eAAsB,4BACpB,aAC8C;AAC9C,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,YAAY,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;AAOA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF,GAKwD;AACtD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,QAAQ;AAIX,QAAI,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC9E,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,QACV;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO;AACtF;AASA,eAAsB,gCAAgC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACF,GAK4C;AAC1C,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,OAAQ,QAAO,KAAK,QAAQ,IAAI,CAAC,IAAI;AAC1C,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,SAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE;;;AChGO,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;AFjBA,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AA2FA,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,OAAO,oBAAI,IAA0B;AAE3C,aAAW,SAAS,QAAQ;AAC1B,QAAI,KAAK,IAAI,MAAM,QAAQ,EAAG;AAE9B,UAAM,iBAAiB,kBAAkB,MAAM,QAAQ;AACvD,QAAI,SAAiC;AACrC,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,UAAI,SAAS,WAAW,SAAS,SAAS;AACxC,iBAAS;AAAA,MACX,WAAW,SAAS,WAAW,SAAS,WAAW;AACjD,iBAAS;AAAA,MACX,WAAW,QAAQ,WAAW,SAAS,WAAW;AAChD,iBAAS;AAAA,MACX;AAAA,IACF,WAAW,aAAa,WAAW,cAAc,GAAG;AAClD,eAAS;AAAA,IACX,WAAW,aAAa,gBAAgB,MAAM,QAAQ,GAAG;AACvD,eAAS;AAAA,IACX,WAAW,MAAM,gBAAgB,QAAQ,IAAI,MAAM,YAAY,GAAG;AAChE,eAAS;AAAA,IACX,WAAW,MAAM,WAAW;AAC1B,eAAS;AAAA,IACX;AAEA,UAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,SAAK,IAAI,MAAM,UAAU;AAAA,MACvB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,GAAI,WAAW,EAAE,OAAO,EAAE,WAAW,MAAe,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtF;AAYA,SAAS,qBAAqB,QAAkD;AAC9E,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,WAAW,QAAQ,OAAO,MAAM;AAAA,IAChC,QAAQ,OAAO;AAAA,EACjB;AACF;AAcA,eAAe,8BAA8B;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AACF,GAI6D;AAC3D,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,gBAAgB,YAAY;AAClC,aAAO,SACH,EAAE,SAAS,iBAAiB,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IAC9E,EAAE,SAAS,iBAAiB,OAAO,SAAS,QAAQ,QAAQ;AAAA,IAClE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,wBAAwB,MAA0D;AACzF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,OAAO,oBAAoB;AAC3E,QAAM,IAAI;AACV,QAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,+BAA+B;AAC1D,QAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,IAAI,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,EAAE,OAAO,8BAA8B;AACxD,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,aAAO,EAAE,OAAO,6BAA6B;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,0BAA0B;AAAA,EAC5C;AACA,QAAM,SAAS,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,KAAK,IAAI;AACnF,QAAM,SAAS,MAAM,QAAQ,EAAE,MAAM,IACjC,EAAE,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,IACnG,CAAC;AACL,SAAO,EAAE,MAAM,KAAK,QAAQ,OAAO;AACrC;AAeA,eAAsB,oBAAoB;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,cAAc,CAAC,aAAqB,OAAO,KAAK,OAAK,EAAE,aAAa,YAAY,EAAE,SAAS;AACjG,QAAM,cAAc,CAAC,aAA0C;AAC7D,UAAM,iBAAiB,kBAAkB,QAAQ;AACjD,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,YAAM,aAAa,SAAS,cAAc,QAAQ;AAClD,UAAI,YAAY,SAAS,QAAS,QAAO;AACzC,UAAI,YAAY,SAAS,aAAa,WAAW,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC/E,aAAO;AAAA,IACT;AAEA,UAAM,kBAAkB,aAAa,IAAI,cAAc;AACvD,QAAI,iBAAiB,SAAS,QAAS,QAAO;AAC9C,QAAI,aAAa,gBAAgB,QAAQ,EAAG,QAAO;AACnD,UAAM,mBAAmB,aAAa,IAAI,QAAQ;AAClD,QAAI,kBAAkB,SAAS,aAAa,iBAAiB,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC3F,WAAO,YAAY,QAAQ,IAAI,WAAW;AAAA,EAC5C;AACA,QAAM,SAAyB;AAAA,IAC7B,WAAW,YAAY,WAAW;AAAA,IAClC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,kBAAkB,YAAY,gBAAgB;AAAA,EAChD;AACA,QAAM,OAAO,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AACxC,aAAW,KAAK,QAAQ;AACtB,QAAI,CAAC,KAAK,IAAI,EAAE,QAAQ,GAAG;AACzB,aAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,QAAQ;AAC3C,WAAK,IAAI,EAAE,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAwB,UAA2B;AAC9E,SAAO,QAAQ,OAAO,QAAQ,CAAC;AACjC;AAeA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkD;AAChD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,YAAY;AACd,QAAI;AACF,YAAM,WAAW,YAAY;AAC7B,aAAO,SACH,EAAE,SAAS,YAAY,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IACzE,EAAE,SAAS,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,IAC7D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,QAAmC;AAC3D,SAAO,EAAE,IAAI,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,MAAM,aAAa,qBAAqB,QAAQ,OAAO,OAAO;AACjH;AAQA,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAM6B;AAC3B,QAAM,SAAS,MAAM,oBAAoB,EAAE,YAAY,aAAa,kBAAkB,CAAC;AACvF,QAAM,QAAQ;AAAA,IACZ,GAAG,sBAAsB,MAAM;AAAA,IAC/B,IAAI,MAAM,YAAY,QAAQ,KAAK,EAAE,OAAO,YAAY,MAAM,CAAC,GAAG,IAAI,gBAAgB;AAAA,EACxF;AACA,SAAO,MACJ,OAAO,OAAK,EAAE,OAAO,QAAQ,EAC7B,IAAI,QAAM;AAAA,IACT,GAAG;AAAA,IACH,QAAQ,EAAE,GAAG,WAAW,SAAS;AAAA,IACjC,QAAQ,gBAAgB,QAAQ,EAAE,OAAO;AAAA,EAC3C,EAAE;AACN;AAGA,eAAe,oBAAoB,SAA0D;AAC3F,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,WAAW,QAAQ,OAAO,MAAM;AACtC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,UAAU,MAAM,QAAQ,OAAO,KAAK,GAAG,KAAK,OAAK,EAAE,OAAO,QAAQ;AACxE,QAAM,QAAQ,QAAQ,WAAW,+BAA+B;AAChE,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAOA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkB;AAChB,QAAM,QAAQ,WAAW,YAAY,KAAK,CAAC;AAC3C,QAAM,aAAa,KAAK;AAExB,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,WAAW,KAAK,EAAE;AAClC,QAAI,SAAS;AACX,WAAK,iBAAiB;AACtB,YAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,eAAe,KAAK,EAAE,IAAI,OAAO,QAAQ,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,mBAAmB,WAAW,QAAQ,KAAK,IAAI,CAAC;AACtD,MAAI,kBAAkB;AACpB,UAAM,QAAQ,MAAM,OAAO,EAAE,SAAS,iBAAiB,CAAC;AAAA,EAC1D;AAEA,QAAM,kBAA0C,EAAE,SAAS,QAAQ,MAAM,QAAQ,SAAS,QAAQ;AAClG,aAAW,CAAC,WAAW,MAAM,KAAK,OAAO,QAAQ,eAAe,GAAG;AACjE,UAAM,YAAY,WAAW,MAAM;AACnC,QAAI,WAAW;AACb,YAAM,QAAQ,UAAU,MAAM,IAAI,EAAE,SAAS,WAAW,UAAU,CAAC;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,iCAAiC,OAAO,KAAK,GAAG,CAAC;AAC1F;AAUA,IAAM,gCAAgC;AACtC,IAAM,+BAA+B;AAW9B,SAAS,aAAa,SAAkC;AAC7D,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,qBAAqB,MAAM;AACjC,SAAO;AAAA,IACL,iBAAiB,QAAQ,GAAG,SAAS,QAAQ,KAAK;AAAA,IAClD,kBAAkB,QAAQ,GAAG,UAAU,QAAQ,KAAK;AAAA,IACpD,sBAAsB,QAAQ,GAAG,SAAS,UAAU,KAAK;AAAA,IACzD,qBAAqB,QAAQ,GAAG,UAAU,UAAU,KAAK;AAAA,IACzD,oBAAoB,uBAAuB,QAAQ,uBAAuB,QAAQ,qBAAqB;AAAA,EACzG;AACF;AAeA,eAAe,6BAA6B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AACF,GAI4D;AAC1D,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,YAAY;AACjC,aAAO,SACH,EAAE,SAAS,gBAAgB,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IAC7E,EAAE,SAAS,gBAAgB,OAAO,SAAS,QAAQ,QAAQ;AAAA,IACjE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAe,sBACb,SACA,OACA,aACe;AACf,QAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,OAAO,YAAY,CAAC;AAClG;AASA,eAAe,6BAA6B,SAAoB,QAAoD;AAClH,aAAW,QAAQ,CAAC,YAAY,WAAW,GAAY;AACrD,UAAM,SAAS,SAAS,aAAa,QAAQ,kBAAkB,QAAQ;AACvE,UAAM,SAAS,UAAU;AACzB,QAAI,QAAQ,GAAG,IAAI,EAAE,QAAQ,MAAM,QAAQ;AACzC,YAAM,QAAQ,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,OAAO,CAAC;AAAA,IACxD;AAAA,EACF;AACA,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,UAAyB,CAAC;AAChC,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,MAAI,MAAM,yBAAyB,sBAAsB;AACvD,YAAQ,uBAAuB;AAAA,EACjC;AACA,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,MAAI,MAAM,wBAAwB,qBAAqB;AACrD,YAAQ,sBAAsB;AAAA,EAChC;AACA,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,OAAK,MAAM,sBAAsB,YAAY,oBAAoB;AAC/D,YAAQ,qBAAqB;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,OAAO,EAAE,SAAS,EAAG,OAAM,QAAQ,MAAM,IAAI,OAAO;AACtE;AAkCO,IAAM,eAAN,cAA2B,MAAwB;AAAA,EACxD,SAAqB;AACnB,UAAM,UAAU,KAAK;AACrB,UAAM,EAAE,YAAY,aAAa,KAAK,IAAI;AAC1C,UAAM,uBAAuB,QAAQ,yBAAyB,MAAM;AAAA,IAAC;AACrE,UAAM,2BAA2B,QAAQ,6BAA6B,MAAM;AAAA,IAAC;AAE7E,WAAO;AAAA,MACL,iBAAiB,yBAAyB;AAAA,QACxC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAGF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,WAAW,MAAM,cAAc;AAAA,gBAC7B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,IAAI,KAAK,IAAI;AAC7D,cAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AACrE,gBAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,gBAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;AAC7C,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAG/F,oBAAM,IAAI,QAAQ,cAAc,QAAQ,kBAAkB,QAAQ,GAAG,EAAE,MAAM,WAAW,IAAI,CAAC;AAC7F,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAErF,wBAAY,gBAAgB,UAAU,KAAK,MAAM;AACjD,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACvD,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAC/F,oBAAM,IAAI,QAAQ,iBAAiB,QAAQ,kBAAkB,QAAQ,CAAC;AACtE,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AACrF,wBAAY,OAAO,UAAU,QAAQ,EAAE;AACvC,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,cAAI;AACF,kBAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC;AAC3D,mBAAO,EAAE,KAAK,EAAE,WAAW,QAAQ,IAAI,oBAAoB,EAAE,CAAC;AAAA,UAChE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,SAAS,wBAAwB,IAAI;AAC3C,cAAI,WAAW,OAAQ,QAAO,EAAE,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,GAAG;AAEjE,gBAAM,aACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,eAAe,WACtF,KAAiC,aACnC;AACN,cAAI;AACF,kBAAM,SAAS,MAAM,IAAI,QAAQ,OAAO;AAAA,cACtC,OAAO,IAAI;AAAA,cACX,QAAQ,IAAI;AAAA,cACZ,OAAO;AAAA,gBACL,YAAY,oBAAoB,OAAO,IAAI;AAAA,gBAC3C,MAAM,OAAO;AAAA,gBACb,KAAK,OAAO;AAAA,gBACZ,QAAQ,OAAO;AAAA,gBACf,QAAQ,OAAO;AAAA,cACjB;AAAA,cACA,oBAAoB;AAAA,YACtB,CAAC;AACD,qCAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;AAC7C,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,qBAAqB,MAAM,EAAE,CAAC;AAAA,UACpE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,oCAAoC;AAAA,QACnD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,gBAAM,KAAK,EAAE,IAAI,MAAM,IAAI;AAC3B,cAAI;AACF,kBAAM,IAAI,QAAQ,OAAO,EAAE,OAAO,IAAI,OAAO,YAAY,GAAG,CAAC;AAC7D,qCAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;AAC7C,mBAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,UAC5B,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,sBAAsB;AAAA,QACrC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,cACzC,WAAW,oBAAoB;AAAA,cAC/B,oBAAoB;AAAA,gBAClB;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AACD,kBAAM,UAAU,OACb,OAAO,OAAK,oBAAoB,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,OAAO,QAAQ,EAC/E,IAAI,QAAM,EAAE,IAAI,EAAE,IAAK,UAAU,EAAE,UAAU,WAAW,EAAE,WAAW,WAAW,KAAK,EAAE;AAK1F,gBAAI,QAAQ,iBAAiB;AAC3B,kBAAI;AACF,sBAAM,MAAM,MAAM,8BAA8B;AAAA,kBAC9C,GAAG,MAAM,CAAC;AAAA,kBACV;AAAA,kBACA,iBAAiB,QAAQ;AAAA,gBAC3B,CAAC;AACD,oBAAI,EAAE,cAAc,MAAM;AACxB,wBAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,OAAK,EAAE,EAAE,CAAC;AAC5C,6BAAW,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG;AACjE,+BAAW,SAAS,OAAO,QAAQ;AACjC,4BAAM,KAAK,GAAG,OAAO,UAAU,IAAI,KAAK;AACxC,0BAAI,MAAM,IAAI,EAAE,EAAG;AACnB,4BAAM,IAAI,EAAE;AACZ,8BAAQ,KAAK,EAAE,IAAI,UAAU,OAAO,YAAY,WAAW,OAAO,WAAW,KAAK,CAAC;AAAA,oBACrF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF,QAAQ;AAAA,cAER;AAAA,YACF;AACA,mBAAO,EAAE,KAAK;AAAA,cACZ,QAAQ,QAAQ;AAAA,gBAAK,CAAC,GAAG,MACvB,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,cAAc,EAAE,QAAQ;AAAA,cAC5F;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQD,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,kBAAM,eAAe,MAAM,oBAAoB,OAAO;AACtD,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,OAAO,MAAM,eAAe;AAAA,gBAC1B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,gBACA;AAAA,gBACA;AAAA,cACF,CAAC;AAAA,cACD;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AAChE,cAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AACvE,gBAAM,IAAK,KAAK,UAAU,CAAC;AAC3B,gBAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,KAAK,IAAI;AAC7D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,cAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;AAC5B,mBAAO,EAAE,KAAK,EAAE,OAAO,yDAAyD,GAAG,GAAG;AAAA,UACxF;AACA,cAAI;AACF,kBAAM,SAAS,MAAM,YAAY,QAAQ,OAAO;AAAA,cAC9C,OAAO,YAAY;AAAA,cACnB,QAAQ,YAAY;AAAA,cACpB,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE;AAAA,YAC/C,CAAC;AACD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,MAAM,iBAAiB,MAAM,EAAE,CAAC;AAAA,UAC5D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,+BAA+B;AAAA,QAC9C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACF,kBAAM,WAAW,GAAG,WAAW,SAAS,IAAI,GAAG,MAAM,UAAU,MAAM,IAAI;AACzE,kBAAM,UAAU,MAAM,YAAY,QAAQ,OAAO,EAAE,OAAO,YAAY,OAAO,IAAI,SAAS,CAAC;AAC3F,mBAAO,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAAA,UACvF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,wCAAwC;AAAA,QACvD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,QAAQ,MAAM,eAAe;AAAA,cACjC;AAAA,cACA,aAAa,oBAAoB,SAAY;AAAA,cAC7C;AAAA,cACA;AAAA,YACF,CAAC;AACD,kBAAM,OAAO,MAAM,KAAK,OAAK,EAAE,OAAO,EAAE;AACxC,gBAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAC/D,kBAAM,mBAAmB,EAAE,YAAY,SAAS,KAAK,CAAC;AACtD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,cAAc,KAAK,GAAG,CAAC;AAAA,UACnD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASD,iBAAiB,kBAAkB;AAAA,QACjC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;AACzF,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACzF,kBAAM,6BAA6B,SAAS,MAAM;AAClD,mBAAO,EAAE,KAAK,EAAE,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UACjD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,8BAA8B;AAAA,QAC7C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,cAAI,SAAS,cAAc,SAAS,aAAa;AAC/C,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,UAC3D;AACA,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,KAAK,IAAI;AACzE,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,cAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,kCAAkC,GAAG,GAAG;AAC7E,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,YAAY,SAAS,aAAa,QAAQ,GAAG,YAAY,QAAQ,GAAG;AAC1E,kBAAM,0BAA0B,UAAU,QAAQ,KAAK;AACvD,kBAAM,QAAQ,GAAG,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAM9C,kBAAM,WAAW,SAAS,aAAa,qBAAqB;AAC5D,kBAAM;AAAA,cACJ;AAAA,cACA,EAAE,CAAC,SAAS,aAAa,oBAAoB,kBAAkB,GAAG,QAAQ;AAAA,cAC1E,0BAA0B,EAAE,CAAC,QAAQ,GAAG,wBAAwB,IAAI;AAAA,YACtE;AACA,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UAC3D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAMJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,gBAAM,cACJ,OAAO,KAAK,yBAAyB,YAAY,KAAK,uBAAuB,IACzE,KAAK,MAAM,KAAK,oBAAoB,IACpC;AACN,gBAAM,aACJ,OAAO,KAAK,wBAAwB,YAAY,KAAK,sBAAsB,IACvE,KAAK,MAAM,KAAK,mBAAmB,IACnC;AACN,cAAI,gBAAgB,UAAa,eAAe,QAAW;AACzD,mBAAO,EAAE,KAAK,EAAE,OAAO,6EAA6E,GAAG,GAAG;AAAA,UAC5G;AACA,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,gBAAI,gBAAgB,QAAW;AAC7B,oBAAM,QAAQ,MAAM,IAAI,EAAE,sBAAsB,YAAY,CAAC;AAC7D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,wBAAwB,OAAO,YAAY,CAAC;AAAA,YACrF;AACA,gBAAI,eAAe,QAAW;AAC5B,oBAAM,QAAQ,MAAM,IAAI,EAAE,qBAAqB,WAAW,CAAC;AAC3D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,uBAAuB,OAAO,WAAW,CAAC;AAAA,YACnF;AACA,kBAAM,sBAAsB,SAAS;AAAA,cACnC,GAAI,gBAAgB,SAAY,EAAE,sBAAsB,YAAY,IAAI,CAAC;AAAA,cACzE,GAAI,eAAe,SAAY,EAAE,qBAAqB,WAAW,IAAI,CAAC;AAAA,YACxE,CAAC;AACD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UAC3D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,sCAAsC;AAAA,QACrD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,gBAAM,MAAM,KAAK;AACjB,gBAAM,QAA0B,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AACxF,cAAI,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,OAAO;AACnD,mBAAO,EAAE,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;AAAA,UACtE;AACA,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,QAAQ,MAAM,IAAI,EAAE,oBAAoB,MAAM,CAAC;AACrD,kBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,sBAAsB,MAAM,CAAC;AACpE,kBAAM,sBAAsB,SAAS,EAAE,oBAAoB,MAAM,CAAC;AAClE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UAC3D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["providers"]}

package/dist/routes/custom-provider-source.d.ts

@@ -0,0 +1,52 @@
+/**
+ * DB-backed custom providers source for model resolution (factory mode).
+ *
+ * The SDK's `resolveModel` and gateway catalog ask the registered
+ * `CustomProvidersSource` synchronously, so this module keeps a small per-org
+ * **snapshot** of custom provider rows hydrated from the `custom-providers`
+ * domain. Once registered the source is authoritative — the factory never
+ * reads `settings.json` custom providers, in either auth mode:
+ *
+ * - tenant mode: rows are scoped per org (`tenantOrgId`); calls without an
+ *   authenticated tenant (boot-time catalog) resolve to an empty list.
+ * - no-auth/local mode: rows live under the sentinel `local` org, matching the
+ *   custom provider routes.
+ *
+ * Snapshots are primed per request by `createCustomProvidersPrimer` (mounted
+ * after the web auth gate) and invalidated on writes via
+ * `invalidateCustomProvidersSnapshots` so changes are visible immediately.
+ */
+import type { MiddlewareHandler } from 'hono';
+import type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';
+import type { RouteAuth } from './route.js';
+/**
+ * Register the DB-backed custom providers source with the SDK. Called by the
+ * factory after storage init with the `custom-providers` domain handle; from
+ * then on model resolution and the gateway catalog never read settings.json
+ * custom providers.
+ */
+export declare function registerCustomProvidersSource({ storage, authEnabled, }: {
+    storage: CustomProvidersStorage;
+    authEnabled: boolean;
+}): void;
+/**
+ * Drop the org's cached snapshot after a custom provider write so the change
+ * is visible to the next model call immediately instead of after the TTL.
+ */
+export declare function invalidateCustomProvidersSnapshots(tenant: {
+    orgId: string;
+}): void;
+/** Test hook: clear registration and cached org snapshots. */
+export declare function resetCustomProvidersSourceForTests(): void;
+/**
+ * Middleware mounted after the web auth gate: primes the caller's org snapshot
+ * so the request's first model call sees their custom providers without an
+ * async seam in model resolution. Cheap when fresh (TTL check), best-effort
+ * when not — a failed hydrate serves the last snapshot, never blocks a request.
+ */
+export declare function createCustomProvidersPrimer({ auth, storage, authEnabled, }: {
+    auth: RouteAuth;
+    storage: CustomProvidersStorage;
+    authEnabled: boolean;
+}): MiddlewareHandler;
+//# sourceMappingURL=custom-provider-source.d.ts.map

package/dist/routes/custom-provider-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-source.d.ts","sourceRoot":"","sources":["../../src/routes/custom-provider-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAE1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA6E5C;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACP,WAAW,GACZ,EAAE;IACD,OAAO,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,IAAI,CAMP;AAED;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAElF;AAED,8DAA8D;AAC9D,wBAAgB,kCAAkC,IAAI,IAAI,CAGzD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,IAAI,EACJ,OAAO,EACP,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,iBAAiB,CAYpB"}

package/dist/routes/custom-provider-source.js

@@ -0,0 +1,107 @@
+// src/routes/custom-provider-source.ts
+import { setCustomProvidersSource } from "@mastra/code-sdk/agents/custom-provider-source";
+
+// src/routes/provider-credentials.ts
+function tenantOrgId(tenant) {
+  return tenant.orgId ?? `user:${tenant.userId}`;
+}
+
+// src/routes/custom-provider-source.ts
+var SNAPSHOT_TTL_MS = 15e3;
+var MAX_CACHED_ORGS = 1e3;
+var LOCAL_ORG = "local";
+var OrgCustomProvidersSnapshot = class {
+  #orgId;
+  #storage;
+  #snapshot = [];
+  #fetchedAt = 0;
+  #hydrating;
+  constructor(orgId, storage) {
+    this.#orgId = orgId;
+    this.#storage = storage;
+  }
+  /** Hydrate the snapshot when stale; coalesces concurrent callers. */
+  async ensureFresh(now = Date.now()) {
+    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+    this.#hydrating ??= this.#hydrate().finally(() => {
+      this.#hydrating = void 0;
+    });
+    await this.#hydrating;
+  }
+  async #hydrate() {
+    await this.#storage.ensureReady();
+    const records = await this.#storage.list({ orgId: this.#orgId });
+    this.#snapshot = records.map((record) => ({
+      name: record.name,
+      url: record.url,
+      apiKey: record.apiKey ?? void 0,
+      models: record.models
+    }));
+    this.#fetchedAt = Date.now();
+  }
+  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+  get() {
+    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {
+      void this.ensureFresh().catch(() => {
+      });
+    }
+    return this.#snapshot;
+  }
+};
+var orgSnapshots = /* @__PURE__ */ new Map();
+function snapshotFor(orgId, storage) {
+  let snapshot = orgSnapshots.get(orgId);
+  if (!snapshot) {
+    if (orgSnapshots.size >= MAX_CACHED_ORGS) {
+      const oldest = orgSnapshots.keys().next().value;
+      if (oldest !== void 0) orgSnapshots.delete(oldest);
+    }
+    snapshot = new OrgCustomProvidersSnapshot(orgId, storage);
+    orgSnapshots.set(orgId, snapshot);
+  }
+  return snapshot;
+}
+function orgForTenant(tenant, authEnabled) {
+  if (!authEnabled) return LOCAL_ORG;
+  return tenant ? tenantOrgId(tenant) : void 0;
+}
+function registerCustomProvidersSource({
+  storage,
+  authEnabled
+}) {
+  setCustomProvidersSource((tenant) => {
+    const orgId = orgForTenant(tenant, authEnabled);
+    if (!orgId) return [];
+    return snapshotFor(orgId, storage).get();
+  });
+}
+function invalidateCustomProvidersSnapshots(tenant) {
+  orgSnapshots.delete(tenant.orgId);
+}
+function resetCustomProvidersSourceForTests() {
+  setCustomProvidersSource(void 0);
+  orgSnapshots.clear();
+}
+function createCustomProvidersPrimer({
+  auth,
+  storage,
+  authEnabled
+}) {
+  return async (c, next) => {
+    const orgId = orgForTenant(auth.tenant(c), authEnabled);
+    if (orgId) {
+      try {
+        await snapshotFor(orgId, storage).ensureFresh();
+      } catch {
+      }
+    }
+    await next();
+  };
+}
+export {
+  createCustomProvidersPrimer,
+  invalidateCustomProvidersSnapshots,
+  registerCustomProvidersSource,
+  resetCustomProvidersSourceForTests
+};
+//# sourceMappingURL=custom-provider-source.js.map

package/dist/routes/custom-provider-source.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/custom-provider-source.ts","../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * DB-backed custom providers source for model resolution (factory mode).\n *\n * The SDK's `resolveModel` and gateway catalog ask the registered\n * `CustomProvidersSource` synchronously, so this module keeps a small per-org\n * **snapshot** of custom provider rows hydrated from the `custom-providers`\n * domain. Once registered the source is authoritative — the factory never\n * reads `settings.json` custom providers, in either auth mode:\n *\n * - tenant mode: rows are scoped per org (`tenantOrgId`); calls without an\n *   authenticated tenant (boot-time catalog) resolve to an empty list.\n * - no-auth/local mode: rows live under the sentinel `local` org, matching the\n *   custom provider routes.\n *\n * Snapshots are primed per request by `createCustomProvidersPrimer` (mounted\n * after the web auth gate) and invalidated on writes via\n * `invalidateCustomProvidersSnapshots` so changes are visible immediately.\n */\n\nimport { setCustomProvidersSource } from '@mastra/code-sdk/agents/custom-provider-source';\nimport type { MastraCodeCustomProvider } from '@mastra/code-sdk/agents/mastracode-gateway';\nimport type { MiddlewareHandler } from 'hono';\n\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport { tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached org snapshots; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_ORGS = 1000;\n\n/** Sentinel org for no-auth mode — must match the custom provider routes. */\nconst LOCAL_ORG = 'local';\n\nclass OrgCustomProvidersSnapshot {\n  readonly #orgId: string;\n  readonly #storage: CustomProvidersStorage;\n  #snapshot: MastraCodeCustomProvider[] = [];\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(orgId: string, storage: CustomProvidersStorage) {\n    this.#orgId = orgId;\n    this.#storage = storage;\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    await this.#storage.ensureReady();\n    const records = await this.#storage.list({ orgId: this.#orgId });\n    this.#snapshot = records.map(record => ({\n      name: record.name,\n      url: record.url,\n      apiKey: record.apiKey ?? undefined,\n      models: record.models,\n    }));\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  get(): MastraCodeCustomProvider[] {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n    return this.#snapshot;\n  }\n}\n\nconst orgSnapshots = new Map<string, OrgCustomProvidersSnapshot>();\n\nfunction snapshotFor(orgId: string, storage: CustomProvidersStorage): OrgCustomProvidersSnapshot {\n  let snapshot = orgSnapshots.get(orgId);\n  if (!snapshot) {\n    if (orgSnapshots.size >= MAX_CACHED_ORGS) {\n      const oldest = orgSnapshots.keys().next().value;\n      if (oldest !== undefined) orgSnapshots.delete(oldest);\n    }\n    snapshot = new OrgCustomProvidersSnapshot(orgId, storage);\n    orgSnapshots.set(orgId, snapshot);\n  }\n  return snapshot;\n}\n\n/** The org a call resolves to, or `undefined` to fail closed (tenant mode without identity). */\nfunction orgForTenant(\n  tenant: { orgId?: string; userId: string } | undefined,\n  authEnabled: boolean,\n): string | undefined {\n  if (!authEnabled) return LOCAL_ORG;\n  return tenant ? tenantOrgId(tenant) : undefined;\n}\n\n/**\n * Register the DB-backed custom providers source with the SDK. Called by the\n * factory after storage init with the `custom-providers` domain handle; from\n * then on model resolution and the gateway catalog never read settings.json\n * custom providers.\n */\nexport function registerCustomProvidersSource({\n  storage,\n  authEnabled,\n}: {\n  storage: CustomProvidersStorage;\n  authEnabled: boolean;\n}): void {\n  setCustomProvidersSource(tenant => {\n    const orgId = orgForTenant(tenant, authEnabled);\n    if (!orgId) return [];\n    return snapshotFor(orgId, storage).get();\n  });\n}\n\n/**\n * Drop the org's cached snapshot after a custom provider write so the change\n * is visible to the next model call immediately instead of after the TTL.\n */\nexport function invalidateCustomProvidersSnapshots(tenant: { orgId: string }): void {\n  orgSnapshots.delete(tenant.orgId);\n}\n\n/** Test hook: clear registration and cached org snapshots. */\nexport function resetCustomProvidersSourceForTests(): void {\n  setCustomProvidersSource(undefined);\n  orgSnapshots.clear();\n}\n\n/**\n * Middleware mounted after the web auth gate: primes the caller's org snapshot\n * so the request's first model call sees their custom providers without an\n * async seam in model resolution. Cheap when fresh (TTL check), best-effort\n * when not — a failed hydrate serves the last snapshot, never blocks a request.\n */\nexport function createCustomProvidersPrimer({\n  auth,\n  storage,\n  authEnabled,\n}: {\n  auth: RouteAuth;\n  storage: CustomProvidersStorage;\n  authEnabled: boolean;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const orgId = orgForTenant(auth.tenant(c), authEnabled);\n    if (orgId) {\n      try {\n        await snapshotFor(orgId, storage).ensureFresh();\n      } catch {\n        // Fail open: model calls serve the last snapshot (or none).\n      }\n    }\n    await next();\n  };\n}\n","/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  { mode: 'local' } | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";AAmBA,SAAS,gCAAgC;;;ACqDlC,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;;;AD9CA,IAAM,kBAAkB;AAGxB,IAAM,kBAAkB;AAGxB,IAAM,YAAY;AAElB,IAAM,6BAAN,MAAiC;AAAA,EACtB;AAAA,EACA;AAAA,EACT,YAAwC,CAAC;AAAA,EACzC,aAAa;AAAA,EACb;AAAA,EAEA,YAAY,OAAe,SAAiC;AAC1D,SAAK,SAAS;AACd,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA,EAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;AACjD,QAAI,MAAM,KAAK,aAAa,gBAAiB;AAC7C,SAAK,eAAe,KAAK,SAAS,EAAE,QAAQ,MAAM;AAChD,WAAK,aAAa;AAAA,IACpB,CAAC;AACD,UAAM,KAAK;AAAA,EACb;AAAA,EAEA,MAAM,WAA0B;AAC9B,UAAM,KAAK,SAAS,YAAY;AAChC,UAAM,UAAU,MAAM,KAAK,SAAS,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;AAC/D,SAAK,YAAY,QAAQ,IAAI,aAAW;AAAA,MACtC,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,QAAQ,OAAO,UAAU;AAAA,MACzB,QAAQ,OAAO;AAAA,IACjB,EAAE;AACF,SAAK,aAAa,KAAK,IAAI;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAkC;AAChC,QAAI,KAAK,IAAI,IAAI,KAAK,cAAc,iBAAiB;AACnD,WAAK,KAAK,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACxC;AACA,WAAO,KAAK;AAAA,EACd;AACF;AAEA,IAAM,eAAe,oBAAI,IAAwC;AAEjE,SAAS,YAAY,OAAe,SAA6D;AAC/F,MAAI,WAAW,aAAa,IAAI,KAAK;AACrC,MAAI,CAAC,UAAU;AACb,QAAI,aAAa,QAAQ,iBAAiB;AACxC,YAAM,SAAS,aAAa,KAAK,EAAE,KAAK,EAAE;AAC1C,UAAI,WAAW,OAAW,cAAa,OAAO,MAAM;AAAA,IACtD;AACA,eAAW,IAAI,2BAA2B,OAAO,OAAO;AACxD,iBAAa,IAAI,OAAO,QAAQ;AAAA,EAClC;AACA,SAAO;AACT;AAGA,SAAS,aACP,QACA,aACoB;AACpB,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,SAAS,YAAY,MAAM,IAAI;AACxC;AAQO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;AACP,2BAAyB,YAAU;AACjC,UAAM,QAAQ,aAAa,QAAQ,WAAW;AAC9C,QAAI,CAAC,MAAO,QAAO,CAAC;AACpB,WAAO,YAAY,OAAO,OAAO,EAAE,IAAI;AAAA,EACzC,CAAC;AACH;AAMO,SAAS,mCAAmC,QAAiC;AAClF,eAAa,OAAO,OAAO,KAAK;AAClC;AAGO,SAAS,qCAA2C;AACzD,2BAAyB,MAAS;AAClC,eAAa,MAAM;AACrB;AAQO,SAAS,4BAA4B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AACF,GAIsB;AACpB,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,QAAQ,aAAa,KAAK,OAAO,CAAC,GAAG,WAAW;AACtD,QAAI,OAAO;AACT,UAAI;AACF,cAAM,YAAY,OAAO,OAAO,EAAE,YAAY;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}