@mastra/factory 0.15.1-alpha.0 → 0.16.0-alpha.11

package/dist/routes/intake.js.map

@@ -1 +1 @@
-{"version":3,"file":"intake.js","names":["#resolveTenant"],"sources":["../../src/routes/intake.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\n\nimport type { BoardRegistry } from '../boards/index.js';\nimport { cardLabels, moveCardToBoard } from '../boards/relocate.js';\nimport type { Intake, IntakeItem } from '../capabilities/intake.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport { normalizeIntakeLabel, resolveIntakeLabelRoute } from '../storage/domains/intake/base.js';\nimport type { IntakeConfig, IntakeLabelRoute, IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface IntakeIntegration {\n  id: string;\n  intake: Pick<Intake, 'listSources' | 'listItems'>;\n}\n\ninterface AggregatedIntakeItem extends Omit<IntakeItem, 'source'> {\n  integrationId: string;\n  externalSource: {\n    integrationId: string;\n    type: string;\n    externalId: string;\n    url?: string;\n  };\n}\n\nexport interface IntakeRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Intake selection domain handle. */\n  intake: IntakeStorage;\n  /** Factory project domain handle, used to validate binding targets. */\n  projects?: { get(input: { orgId: string; id: string }): Promise<unknown | null> };\n  integrations?: IntakeIntegration[];\n  /** Installed boards, used to validate binding targets. Absent means only legacy routing is accepted. */\n  boardRegistry?: BoardRegistry;\n  /** Work items domain handle; when present, rebinding a source to another board moves its resting cards. */\n  workItems?: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n}\n\n/** Upper bound on source pages read while relocating cards, so a huge source cannot stall the request. */\nconst REBIND_MAX_PAGES = 20;\n/**\n * One deadline for the whole rebind read, not one per page: the binding is already saved when we\n * get here, so the caller is only waiting on relocation and a slow provider must not hold the\n * response for pages × timeout.\n */\nconst REBIND_READ_BUDGET_MS = 30_000;\n\n/**\n * Keys under which an intake item may be persisted as a work item. Providers key items by their\n * own id, while materialization uses the human identifier (`linear:MAS-44`), so both are accepted.\n */\nfunction intakeItemSourceKeys(integrationId: string, item: IntakeItem): string[] {\n  const identifier = item.metadata?.identifier;\n  return typeof identifier === 'string' && identifier.length > 0\n    ? [item.source.externalId, `${integrationId}:${identifier}`]\n    : [item.source.externalId];\n}\n\n/**\n * Move the cards that came from a rebound source onto its new board's initial phase. Terminal cards\n * stay put (they are history that belongs where it finished), as do cards with a session attached to\n * a current stage (a run owns them). Everything else moves, including cards parked in a working\n * phase that never started a run — auto-ingested issues sit in Work › Triage that way.\n */\nasync function relocateSourceCards({\n  workItems,\n  integration,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  sourceId,\n  targetBoard,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  integration: IntakeIntegration;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  sourceId: string;\n  targetBoard: string;\n}): Promise<{ moved: number; skipped: number }> {\n  if (!boardRegistry.has(targetBoard)) return { moved: 0, skipped: 0 };\n\n  const sourceKeys = new Set<string>();\n  let cursor: string | undefined;\n  const deadline = Date.now() + REBIND_READ_BUDGET_MS;\n  for (let page = 0; page < REBIND_MAX_PAGES; page += 1) {\n    const result = await withTimeout(\n      integration.id,\n      () => integration.intake.listItems({ orgId, userId, sourceIds: [sourceId], cursor }),\n      deadline - Date.now(),\n    );\n    for (const item of result.items) {\n      for (const key of intakeItemSourceKeys(integration.id, item)) sourceKeys.add(key);\n    }\n    if (!result.nextCursor) break;\n    cursor = result.nextCursor;\n  }\n  if (sourceKeys.size === 0) return { moved: 0, skipped: 0 };\n\n  let moved = 0;\n  let skipped = 0;\n  const items = await workItems.list({ orgId, factoryProjectId });\n  for (const item of items) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integration.id || !sourceKeys.has(source.externalId)) continue;\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/**\n * After a label route changes, every issue card in the project that carries `label` is re-routed\n * under the project's current routes: to the board its labels now select, or back to Work when none\n * of them is routed any more.\n */\nasync function relocateLabeledCards({\n  workItems,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  integrationId,\n  label,\n  routes,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  integrationId: string;\n  label: string;\n  routes: readonly IntakeLabelRoute[];\n}): Promise<{ moved: number; skipped: number }> {\n  const changed = normalizeIntakeLabel(label);\n  let moved = 0;\n  let skipped = 0;\n  for (const item of await workItems.list({ orgId, factoryProjectId })) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integrationId || source.type !== 'issue') continue;\n    const labels = cardLabels(item);\n    if (!labels.some(candidate => normalizeIntakeLabel(candidate) === changed)) continue;\n    const targetBoard = resolveIntakeLabelRoute(routes, labels)?.board ?? 'work';\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/** One integration that failed while the rest of the aggregation succeeded. */\nexport interface IntakeIntegrationFailure {\n  integrationId: string;\n  message: string;\n}\n\ntype SettledIntegration<T> = { integrationId: string; value: T } | IntakeIntegrationFailure;\n\nconst PROVIDER_READ_TIMEOUT_MS = 15_000;\n\n/** The Intake contract takes no abort signal, so a slow read is abandoned, not cancelled. */\nfunction withTimeout<T>(\n  integrationId: string,\n  read: () => Promise<T>,\n  timeoutMs: number = PROVIDER_READ_TIMEOUT_MS,\n): Promise<T> {\n  return new Promise((resolve, reject) => {\n    const budget = Math.max(0, timeoutMs);\n    const timer = setTimeout(\n      () => reject(new Error(`${integrationId} did not answer within ${Math.round(budget / 1000)}s`)),\n      budget,\n    );\n    read()\n      .then(resolve, reject)\n      .finally(() => clearTimeout(timer));\n  });\n}\n\n/**\n * Read every integration concurrently and isolate the ones that throw or hang, so a single\n * unreachable provider degrades to a per-source error instead of failing the listing.\n */\nasync function settleByIntegration<T>(\n  requests: Array<{ integrationId: string; read: () => Promise<T> }>,\n): Promise<{ pages: Array<{ integrationId: string; value: T }>; failures: IntakeIntegrationFailure[] }> {\n  const settled = await Promise.all(\n    requests.map(async ({ integrationId, read }): Promise<SettledIntegration<T>> => {\n      try {\n        return { integrationId, value: await withTimeout(integrationId, read) };\n      } catch (error) {\n        console.error(`[factory] intake integration ${integrationId} is unavailable:`, error);\n        return { integrationId, message: error instanceof Error ? error.message : String(error) };\n      }\n    }),\n  );\n  const pages: Array<{ integrationId: string; value: T }> = [];\n  const failures: IntakeIntegrationFailure[] = [];\n  for (const entry of settled) {\n    if ('value' in entry) pages.push(entry);\n    else failures.push(entry);\n  }\n  return { pages, failures };\n}\n\ninterface ParsedBinding {\n  integrationId: string;\n  sourceId: string;\n  factoryProjectId: string | null;\n  /** Installed board target; `null`/omitted keeps legacy source-type routing. */\n  board: string | null;\n}\n\n/** Validate a binding request body, rejecting unknown shapes. */\nexport function parseIntakeBinding(body: unknown): ParsedBinding | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const { integrationId, sourceId, factoryProjectId, board } = body as Record<string, unknown>;\n  const isId = (value: unknown) => typeof value === 'string' && value.length > 0 && value.length <= 256;\n  if (!isId(integrationId) || !isId(sourceId)) return null;\n  if (factoryProjectId !== null && !isId(factoryProjectId)) return null;\n  if (board !== undefined && board !== null && !isId(board)) return null;\n  return {\n    integrationId: integrationId as string,\n    sourceId: sourceId as string,\n    factoryProjectId: factoryProjectId as string | null,\n    board: (board as string | null | undefined) ?? null,\n  };\n}\n\nconst identifier = z.string().min(1).max(256);\nconst labelRouteBodySchema = z.object({\n  factoryProjectId: identifier,\n  integrationId: identifier,\n  label: z\n    .string()\n    .max(256)\n    .transform(normalizeIntakeLabel)\n    .refine(label => label.length > 0, 'label must not be blank'),\n  /** Installed board target; `null` removes the route so the label falls back to Work. */\n  board: identifier.nullish().transform(board => board ?? null),\n});\ntype ParsedLabelRoute = z.output<typeof labelRouteBodySchema>;\n\n/** Validate a label-route request body, rejecting unknown shapes. */\nexport function parseIntakeLabelRoute(body: unknown): ParsedLabelRoute | null {\n  const parsed = labelRouteBodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction sanitizeIdList(value: unknown): string[] | null | undefined {\n  if (value === null) return null;\n  if (!Array.isArray(value) || value.length > 200) return undefined;\n  const ids = value.filter((item): item is string => typeof item === 'string' && item.length > 0 && item.length <= 256);\n  return ids.length === value.length && new Set(ids).size === ids.length ? ids : undefined;\n}\n\n/** Validate a request body into an intake config, rejecting unknown shapes. */\nexport function parseIntakeConfig(body: unknown): IntakeConfig | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const entries = Object.entries(body);\n  if (entries.length > 50) return null;\n\n  // Null-prototype so an `__proto__` key lands as a real entry instead of silently\n  // reassigning the prototype and disappearing from the validation below.\n  const config: IntakeConfig = Object.create(null);\n  for (const [integrationId, value] of entries) {\n    if (\n      !integrationId ||\n      integrationId.length > 128 ||\n      typeof value !== 'object' ||\n      value === null ||\n      Array.isArray(value)\n    ) {\n      return null;\n    }\n    const selection = value as { enabled?: unknown; sourceIds?: unknown };\n    if (typeof selection.enabled !== 'boolean') return null;\n    const sourceIds = sanitizeIdList(selection.sourceIds ?? null);\n    if (sourceIds === undefined) return null;\n    config[integrationId] = { enabled: selection.enabled, sourceIds };\n  }\n  return config;\n}\n\nfunction encodeCursor(cursors: Record<string, string>): string | null {\n  return Object.keys(cursors).length > 0 ? Buffer.from(JSON.stringify(cursors)).toString('base64url') : null;\n}\n\nfunction decodeCursor(value: string | undefined): Record<string, string> | null {\n  if (!value) return {};\n  try {\n    const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return null;\n    const entries = Object.entries(parsed);\n    if (entries.some(([key, cursor]) => !key || typeof cursor !== 'string')) return null;\n    return Object.fromEntries(entries) as Record<string, string>;\n  } catch {\n    return null;\n  }\n}\n\nexport class IntakeRoutes extends Route<IntakeRoutesDeps> {\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'Intake configuration requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    const { audit, intake, projects, integrations = [], boardRegistry, workItems } = this.deps;\n    const integrationIds = integrations.map(integration => integration.id);\n\n    return [\n      registerApiRoute('/web/intake/config', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          const config = await intake.getConfig({ orgId: tenant.orgId, integrationIds });\n          return c.json({ config });\n        },\n      }),\n      registerApiRoute('/web/intake/config', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const config = parseIntakeConfig(body);\n          if (!config) {\n            return c.json({ error: 'invalid_config' }, 400);\n          }\n\n          const registeredConfig: IntakeConfig = Object.create(null);\n          for (const [integrationId, selection] of Object.entries(config)) {\n            if (integrationIds.includes(integrationId)) {\n              registeredConfig[integrationId] = selection;\n              continue;\n            }\n            if (selection.enabled || selection.sourceIds?.length) {\n              return c.json({ error: 'invalid_config' }, 400);\n            }\n          }\n\n          await intake.ensureReady();\n          await intake.saveConfig({ orgId: tenant.orgId, config: registeredConfig });\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.config_updated',\n              targets: [{ type: 'intake_config', id: tenant.orgId }],\n              metadata: Object.fromEntries(\n                Object.entries(registeredConfig).map(([integrationId, selection]) => [\n                  integrationId,\n                  { enabled: selection.enabled, sources: selection.sourceIds?.length ?? null },\n                ]),\n              ),\n            },\n          });\n          return c.json({ config: registeredConfig });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          return c.json({ bindings: await intake.listBindings({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const binding = parseIntakeBinding(body);\n          if (!binding || !integrationIds.includes(binding.integrationId)) {\n            return c.json({ error: 'invalid_binding' }, 400);\n          }\n          if (binding.factoryProjectId && projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: binding.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (binding.board !== null && !boardRegistry?.has(binding.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${binding.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          let auditFactoryProjectId = binding.factoryProjectId;\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (binding.factoryProjectId === null) {\n            const previousBinding = await intake.clearBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            auditFactoryProjectId = previousBinding?.factoryProjectId ?? null;\n          } else {\n            const previousBinding = await intake.getBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            await intake.setBinding({\n              orgId: tenant.orgId,\n              userId: tenant.userId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n              factoryProjectId: binding.factoryProjectId,\n              board: binding.board,\n            });\n            // A source that stays in the same project but is pointed at a different board\n            // takes its resting cards along. Bindings that predate persisted boards have a\n            // null board yet still fed Work/Review, so relocation compares each card's\n            // effective board rather than trusting the previous binding value.\n            const nextBoard = binding.board;\n            const integration = integrations.find(candidate => candidate.id === binding.integrationId);\n            if (\n              workItems &&\n              boardRegistry &&\n              integration &&\n              previousBinding?.factoryProjectId === binding.factoryProjectId &&\n              nextBoard !== null &&\n              previousBinding.board !== nextBoard\n            ) {\n              try {\n                relocated = await relocateSourceCards({\n                  workItems,\n                  integration,\n                  boardRegistry,\n                  orgId: tenant.orgId,\n                  userId: tenant.userId,\n                  factoryProjectId: binding.factoryProjectId,\n                  sourceId: binding.sourceId,\n                  targetBoard: nextBoard,\n                });\n              } catch (error) {\n                // The binding is saved; the cards can be moved by hand if the provider was unreachable.\n                console.error(`[factory] intake rebind could not relocate ${binding.integrationId} cards:`, error);\n              }\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.binding_updated',\n              ...(auditFactoryProjectId ? { factoryProjectId: auditFactoryProjectId } : {}),\n              targets: [{ type: 'intake_source', id: `${binding.integrationId}:${binding.sourceId}` }],\n              metadata: {\n                factoryProjectId: binding.factoryProjectId,\n                board: binding.board,\n                ...(relocated ? { relocated } : {}),\n              },\n            },\n          });\n          return c.json({\n            bindings: await intake.listBindings({ orgId: tenant.orgId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const factoryProjectId = c.req.query('factoryProjectId');\n          await intake.ensureReady();\n          return c.json({\n            routes: await intake.listLabelRoutes({\n              orgId: tenant.orgId,\n              ...(factoryProjectId ? { factoryProjectId } : {}),\n            }),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const route = parseIntakeLabelRoute(body);\n          if (!route || !integrationIds.includes(route.integrationId)) {\n            return c.json({ error: 'invalid_label_route' }, 400);\n          }\n          if (projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: route.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (route.board !== null && !boardRegistry?.has(route.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${route.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          const scope = {\n            orgId: tenant.orgId,\n            factoryProjectId: route.factoryProjectId,\n            integrationId: route.integrationId,\n          };\n          const previous = (await intake.listLabelRoutes(scope)).find(existing => existing.label === route.label);\n          if (route.board === null) {\n            await intake.clearLabelRoute({ ...scope, label: route.label });\n          } else {\n            await intake.setLabelRoute({ ...scope, label: route.label, board: route.board, userId: tenant.userId });\n          }\n\n          // Cards already carrying the label follow the route: onto the new board, or back to\n          // Work when the label is no longer routed anywhere.\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (workItems && boardRegistry && (previous?.board ?? null) !== route.board) {\n            try {\n              relocated = await relocateLabeledCards({\n                workItems,\n                boardRegistry,\n                orgId: tenant.orgId,\n                userId: tenant.userId,\n                factoryProjectId: route.factoryProjectId,\n                integrationId: route.integrationId,\n                label: route.label,\n                routes: await intake.listLabelRoutes(scope),\n              });\n            } catch (error) {\n              // The route is saved; the cards can be moved by hand.\n              console.error(`[factory] intake label route could not relocate ${route.integrationId} cards:`, error);\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.label_route_updated',\n              factoryProjectId: route.factoryProjectId,\n              targets: [{ type: 'intake_label_route', id: `${route.integrationId}:${route.label}` }],\n              metadata: { board: route.board, ...(relocated ? { relocated } : {}) },\n            },\n          });\n          return c.json({\n            routes: await intake.listLabelRoutes({ orgId: tenant.orgId, factoryProjectId: route.factoryProjectId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/sources', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const { pages, failures } = await settleByIntegration(\n            integrations.map(integration => ({\n              integrationId: integration.id,\n              read: () => integration.intake.listSources(tenant),\n            })),\n          );\n          return c.json({\n            sources: pages.flatMap(({ integrationId, value }) => value.map(source => ({ integrationId, ...source }))),\n            failures,\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/items', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const cursors = decodeCursor(c.req.query('cursor'));\n          if (!cursors) return c.json({ error: 'invalid_cursor' }, 400);\n\n          await intake.ensureReady();\n          const config = await intake.getConfig({ orgId: tenant.orgId, integrationIds });\n          const { pages, failures } = await settleByIntegration(\n            integrations.flatMap(integration => {\n              const selection = config[integration.id];\n              if (!selection?.enabled || !selection.sourceIds?.length) return [];\n              const sourceIds = selection.sourceIds;\n              const cursor = cursors[integration.id];\n              return [\n                {\n                  integrationId: integration.id,\n                  read: () => integration.intake.listItems({ ...tenant, sourceIds, ...(cursor ? { cursor } : {}) }),\n                },\n              ];\n            }),\n          );\n\n          const items: AggregatedIntakeItem[] = [];\n          const nextCursors: Record<string, string> = {};\n          for (const { integrationId, value } of pages) {\n            items.push(\n              ...value.items.map(item => {\n                const { source, ...candidate } = item;\n                return { ...candidate, integrationId, externalSource: { integrationId, ...source } };\n              }),\n            );\n            if (value.nextCursor) nextCursors[integrationId] = value.nextCursor;\n          }\n          // Keep the cursor an unavailable integration came in with, so the next page resumes there instead of replaying it.\n          for (const { integrationId } of failures) {\n            const cursor = cursors[integrationId];\n            if (cursor) nextCursors[integrationId] = cursor;\n          }\n          return c.json({ items, nextCursor: encodeCursor(nextCursors), failures });\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;AA4CA,MAAM,mBAAmB;;;;;;AAMzB,MAAM,wBAAwB;;;;;AAM9B,SAAS,qBAAqB,eAAuB,MAA4B;CAC/E,MAAM,aAAa,KAAK,UAAU;CAClC,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,CAAC,KAAK,OAAO,YAAY,GAAG,cAAc,GAAG,YAAY,IACzD,CAAC,KAAK,OAAO,UAAU;AAC7B;;;;;;;AAQA,eAAe,oBAAoB,EACjC,WACA,aACA,eACA,OACA,QACA,kBACA,UACA,eAU8C;CAC9C,IAAI,CAAC,cAAc,IAAI,WAAW,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEnE,MAAM,6BAAa,IAAI,IAAY;CACnC,IAAI;CACJ,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,KAAK,IAAI,OAAO,GAAG,OAAO,kBAAkB,QAAQ,GAAG;EACrD,MAAM,SAAS,MAAM,YACnB,YAAY,UACN,YAAY,OAAO,UAAU;GAAE;GAAO;GAAQ,WAAW,CAAC,QAAQ;GAAG;EAAO,CAAC,GACnF,WAAW,KAAK,IAAI,CACtB;EACA,KAAK,MAAM,QAAQ,OAAO,OACxB,KAAK,MAAM,OAAO,qBAAqB,YAAY,IAAI,IAAI,GAAG,WAAW,IAAI,GAAG;EAElF,IAAI,CAAC,OAAO,YAAY;EACxB,SAAS,OAAO;CAClB;CACA,IAAI,WAAW,SAAS,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEzD,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC;CAC9D,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,YAAY,MAAM,CAAC,WAAW,IAAI,OAAO,UAAU,GAAG;EAC9F,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM;EAAY,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;;;;;;AAOA,eAAe,qBAAqB,EAClC,WACA,eACA,OACA,QACA,kBACA,eACA,OACA,UAU8C;CAC9C,MAAM,UAAU,qBAAqB,KAAK;CAC1C,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC,GAAG;EACpE,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,iBAAiB,OAAO,SAAS,SAAS;EAClF,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,CAAC,OAAO,MAAK,cAAa,qBAAqB,SAAS,MAAM,OAAO,GAAG;EAE5E,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM,aAD5D,wBAAwB,QAAQ,MAAM,CAAC,EAAE,SAAS;EACsB,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAUA,MAAM,2BAA2B;;AAGjC,SAAS,YACP,eACA,MACA,YAAoB,0BACR;CACZ,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAS,KAAK,IAAI,GAAG,SAAS;EACpC,MAAM,QAAQ,iBACN,uBAAO,IAAI,MAAM,GAAG,cAAc,yBAAyB,KAAK,MAAM,SAAS,GAAI,EAAE,EAAE,CAAC,GAC9F,MACF;EACA,KAAK,CAAC,CACH,KAAK,SAAS,MAAM,CAAC,CACrB,cAAc,aAAa,KAAK,CAAC;CACtC,CAAC;AACH;;;;;AAMA,eAAe,oBACb,UACsG;CACtG,MAAM,UAAU,MAAM,QAAQ,IAC5B,SAAS,IAAI,OAAO,EAAE,eAAe,WAA2C;EAC9E,IAAI;GACF,OAAO;IAAE;IAAe,OAAO,MAAM,YAAY,eAAe,IAAI;GAAE;EACxE,SAAS,OAAO;GACd,QAAQ,MAAM,gCAAgC,cAAc,mBAAmB,KAAK;GACpF,OAAO;IAAE;IAAe,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC1F;CACF,CAAC,CACH;CACA,MAAM,QAAoD,CAAC;CAC3D,MAAM,WAAuC,CAAC;CAC9C,KAAK,MAAM,SAAS,SAClB,IAAI,WAAW,OAAO,MAAM,KAAK,KAAK;MACjC,SAAS,KAAK,KAAK;CAE1B,OAAO;EAAE;EAAO;CAAS;AAC3B;;AAWA,SAAgB,mBAAmB,MAAqC;CACtE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,EAAE,eAAe,UAAU,kBAAkB,UAAU;CAC7D,MAAM,QAAQ,UAAmB,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;CAClG,IAAI,CAAC,KAAK,aAAa,KAAK,CAAC,KAAK,QAAQ,GAAG,OAAO;CACpD,IAAI,qBAAqB,QAAQ,CAAC,KAAK,gBAAgB,GAAG,OAAO;CACjE,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO;CAClE,OAAO;EACU;EACL;EACQ;EAClB,OAAQ,SAAuC;CACjD;AACF;AAEA,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAC5C,MAAM,uBAAuB,EAAE,OAAO;CACpC,kBAAkB;CAClB,eAAe;CACf,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,UAAU,oBAAoB,CAAC,CAC/B,QAAO,UAAS,MAAM,SAAS,GAAG,yBAAyB;;CAE9D,OAAO,WAAW,QAAQ,CAAC,CAAC,WAAU,UAAS,SAAS,IAAI;AAC9D,CAAC;;AAID,SAAgB,sBAAsB,MAAwC;CAC5E,MAAM,SAAS,qBAAqB,UAAU,IAAI;CAClD,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,eAAe,OAA6C;CACnE,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,KAAK,OAAO,KAAA;CACxD,MAAM,MAAM,MAAM,QAAQ,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,KAAK,UAAU,GAAG;CACpH,OAAO,IAAI,WAAW,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,MAAM,KAAA;AACjF;;AAGA,SAAgB,kBAAkB,MAAoC;CACpE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,UAAU,OAAO,QAAQ,IAAI;CACnC,IAAI,QAAQ,SAAS,IAAI,OAAO;CAIhC,MAAM,SAAuB,OAAO,OAAO,IAAI;CAC/C,KAAK,MAAM,CAAC,eAAe,UAAU,SAAS;EAC5C,IACE,CAAC,iBACD,cAAc,SAAS,OACvB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GAEnB,OAAO;EAET,MAAM,YAAY;EAClB,IAAI,OAAO,UAAU,YAAY,WAAW,OAAO;EACnD,MAAM,YAAY,eAAe,UAAU,aAAa,IAAI;EAC5D,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,OAAO,iBAAiB;GAAE,SAAS,UAAU;GAAS;EAAU;CAClE;CACA,OAAO;AACT;AAEA,SAAS,aAAa,SAAgD;CACpE,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW,IAAI;AACxG;AAEA,SAAS,aAAa,OAA0D;CAC9E,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAC1E,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO;EACnF,MAAM,UAAU,OAAO,QAAQ,MAAM;EACrC,IAAI,QAAQ,MAAM,CAAC,KAAK,YAAY,CAAC,OAAO,OAAO,WAAW,QAAQ,GAAG,OAAO;EAChF,OAAO,OAAO,YAAY,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,eAAb,cAAkC,MAAwB;CACxD,MAAMA,eAAe,GAAiF;EACpG,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;EACjC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;EACtC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAAiD,GAC5F,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;CAEA,SAAqB;EACnB,MAAM,EAAE,OAAO,QAAQ,UAAU,eAAe,CAAC,GAAG,eAAe,cAAc,KAAK;EACtF,MAAM,iBAAiB,aAAa,KAAI,gBAAe,YAAY,EAAE;EAErE,OAAO;GACL,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,OAAO,OAAO;MAAO;KAAe,CAAC;KAC7E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;IAC1B;GACF,CAAC;GACD,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,SAAS,kBAAkB,IAAI;KACrC,IAAI,CAAC,QACH,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAGhD,MAAM,mBAAiC,OAAO,OAAO,IAAI;KACzD,KAAK,MAAM,CAAC,eAAe,cAAc,OAAO,QAAQ,MAAM,GAAG;MAC/D,IAAI,eAAe,SAAS,aAAa,GAAG;OAC1C,iBAAiB,iBAAiB;OAClC;MACF;MACA,IAAI,UAAU,WAAW,UAAU,WAAW,QAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAElD;KAEA,MAAM,OAAO,YAAY;KACzB,MAAM,OAAO,WAAW;MAAE,OAAO,OAAO;MAAO,QAAQ;KAAiB,CAAC;KACzE,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,OAAO;OAAM,CAAC;OACrD,UAAU,OAAO,YACf,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KAAK,CAAC,eAAe,eAAe,CACnE,eACA;QAAE,SAAS,UAAU;QAAS,SAAS,UAAU,WAAW,UAAU;OAAK,CAC7E,CAAC,CACH;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,QAAQ,iBAAiB,CAAC;IAC5C;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;IAChF;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,UAAU,mBAAmB,IAAI;KACvC,IAAI,CAAC,WAAW,CAAC,eAAe,SAAS,QAAQ,aAAa,GAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KAEjD,IAAI,QAAQ,oBAAoB,UAE1B;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,QAAQ;MAAiB,CAAC,GAC1E,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,QAAQ,UAAU,QAAQ,CAAC,eAAe,IAAI,QAAQ,KAAK,GAC7D,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,QAAQ,MAAM;KAAqB,GAAG,GAAG;KAGtG,MAAM,OAAO,YAAY;KACzB,IAAI,wBAAwB,QAAQ;KACpC,IAAI,YAAuD;KAC3D,IAAI,QAAQ,qBAAqB,MAM/B,yBAAwB,MALM,OAAO,aAAa;MAChD,OAAO,OAAO;MACd,eAAe,QAAQ;MACvB,UAAU,QAAQ;KACpB,CAAC,EAAA,EACwC,oBAAoB;UACxD;MACL,MAAM,kBAAkB,MAAM,OAAO,WAAW;OAC9C,OAAO,OAAO;OACd,eAAe,QAAQ;OACvB,UAAU,QAAQ;MACpB,CAAC;MACD,MAAM,OAAO,WAAW;OACtB,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,eAAe,QAAQ;OACvB,UAAU,QAAQ;OAClB,kBAAkB,QAAQ;OAC1B,OAAO,QAAQ;MACjB,CAAC;MAKD,MAAM,YAAY,QAAQ;MAC1B,MAAM,cAAc,aAAa,MAAK,cAAa,UAAU,OAAO,QAAQ,aAAa;MACzF,IACE,aACA,iBACA,eACA,iBAAiB,qBAAqB,QAAQ,oBAC9C,cAAc,QACd,gBAAgB,UAAU,WAE1B,IAAI;OACF,YAAY,MAAM,oBAAoB;QACpC;QACA;QACA;QACA,OAAO,OAAO;QACd,QAAQ,OAAO;QACf,kBAAkB,QAAQ;QAC1B,UAAU,QAAQ;QAClB,aAAa;OACf,CAAC;MACH,SAAS,OAAO;OAEd,QAAQ,MAAM,8CAA8C,QAAQ,cAAc,UAAU,KAAK;MACnG;KAEJ;KACA,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,GAAI,wBAAwB,EAAE,kBAAkB,sBAAsB,IAAI,CAAC;OAC3E,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,GAAG,QAAQ,cAAc,GAAG,QAAQ;OAAW,CAAC;OACvF,UAAU;QACR,kBAAkB,QAAQ;QAC1B,OAAO,QAAQ;QACf,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OACnC;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC;MAC3D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;KACvD,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EACZ,QAAQ,MAAM,OAAO,gBAAgB;MACnC,OAAO,OAAO;MACd,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;KACjD,CAAC,EACH,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,QAAQ,sBAAsB,IAAI;KACxC,IAAI,CAAC,SAAS,CAAC,eAAe,SAAS,MAAM,aAAa,GACxD,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAErD,IAAI,UAEE;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,MAAM;MAAiB,CAAC,GACxE,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,MAAM,UAAU,QAAQ,CAAC,eAAe,IAAI,MAAM,KAAK,GACzD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,MAAM,MAAM;KAAqB,GAAG,GAAG;KAGpG,MAAM,OAAO,YAAY;KACzB,MAAM,QAAQ;MACZ,OAAO,OAAO;MACd,kBAAkB,MAAM;MACxB,eAAe,MAAM;KACvB;KACA,MAAM,YAAY,MAAM,OAAO,gBAAgB,KAAK,EAAA,CAAG,MAAK,aAAY,SAAS,UAAU,MAAM,KAAK;KACtG,IAAI,MAAM,UAAU,MAClB,MAAM,OAAO,gBAAgB;MAAE,GAAG;MAAO,OAAO,MAAM;KAAM,CAAC;UAE7D,MAAM,OAAO,cAAc;MAAE,GAAG;MAAO,OAAO,MAAM;MAAO,OAAO,MAAM;MAAO,QAAQ,OAAO;KAAO,CAAC;KAKxG,IAAI,YAAuD;KAC3D,IAAI,aAAa,kBAAkB,UAAU,SAAS,UAAU,MAAM,OACpE,IAAI;MACF,YAAY,MAAM,qBAAqB;OACrC;OACA;OACA,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,kBAAkB,MAAM;OACxB,eAAe,MAAM;OACrB,OAAO,MAAM;OACb,QAAQ,MAAM,OAAO,gBAAgB,KAAK;MAC5C,CAAC;KACH,SAAS,OAAO;MAEd,QAAQ,MAAM,mDAAmD,MAAM,cAAc,UAAU,KAAK;KACtG;KAEF,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,kBAAkB,MAAM;OACxB,SAAS,CAAC;QAAE,MAAM;QAAsB,IAAI,GAAG,MAAM,cAAc,GAAG,MAAM;OAAQ,CAAC;OACrF,UAAU;QAAE,OAAO,MAAM;QAAO,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OAAG;MACtE;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,QAAQ,MAAM,OAAO,gBAAgB;OAAE,OAAO,OAAO;OAAO,kBAAkB,MAAM;MAAiB,CAAC;MACtG,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,KAAI,iBAAgB;MAC/B,eAAe,YAAY;MAC3B,YAAY,YAAY,OAAO,YAAY,MAAM;KACnD,EAAE,CACJ;KACA,OAAO,EAAE,KAAK;MACZ,SAAS,MAAM,SAAS,EAAE,eAAe,YAAY,MAAM,KAAI,YAAW;OAAE;OAAe,GAAG;MAAO,EAAE,CAAC;MACxG;KACF,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,qBAAqB;IACpC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,UAAU,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;KAClD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAE5D,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,OAAO,OAAO;MAAO;KAAe,CAAC;KAC7E,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,SAAQ,gBAAe;MAClC,MAAM,YAAY,OAAO,YAAY;MACrC,IAAI,CAAC,WAAW,WAAW,CAAC,UAAU,WAAW,QAAQ,OAAO,CAAC;MACjE,MAAM,YAAY,UAAU;MAC5B,MAAM,SAAS,QAAQ,YAAY;MACnC,OAAO,CACL;OACE,eAAe,YAAY;OAC3B,YAAY,YAAY,OAAO,UAAU;QAAE,GAAG;QAAQ;QAAW,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;OAAG,CAAC;MAClG,CACF;KACF,CAAC,CACH;KAEA,MAAM,QAAgC,CAAC;KACvC,MAAM,cAAsC,CAAC;KAC7C,KAAK,MAAM,EAAE,eAAe,WAAW,OAAO;MAC5C,MAAM,KACJ,GAAG,MAAM,MAAM,KAAI,SAAQ;OACzB,MAAM,EAAE,QAAQ,GAAG,cAAc;OACjC,OAAO;QAAE,GAAG;QAAW;QAAe,gBAAgB;SAAE;SAAe,GAAG;QAAO;OAAE;MACrF,CAAC,CACH;MACA,IAAI,MAAM,YAAY,YAAY,iBAAiB,MAAM;KAC3D;KAEA,KAAK,MAAM,EAAE,mBAAmB,UAAU;MACxC,MAAM,SAAS,QAAQ;MACvB,IAAI,QAAQ,YAAY,iBAAiB;KAC3C;KACA,OAAO,EAAE,KAAK;MAAE;MAAO,YAAY,aAAa,WAAW;MAAG;KAAS,CAAC;IAC1E;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"intake.js","names":["#resolveTenant"],"sources":["../../src/routes/intake.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\n\nimport type { BoardRegistry } from '../boards/index.js';\nimport { cardLabels, moveCardToBoard } from '../boards/relocate.js';\nimport type { Intake, IntakeItem } from '../capabilities/intake.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport { normalizeIntakeLabel, resolveIntakeLabelRoute } from '../storage/domains/intake/base.js';\nimport type { IntakeConfig, IntakeLabelRoute, IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface IntakeIntegration {\n  id: string;\n  intake: Pick<Intake, 'listSources' | 'listItems'>;\n}\n\ninterface AggregatedIntakeItem extends Omit<IntakeItem, 'source'> {\n  integrationId: string;\n  externalSource: {\n    integrationId: string;\n    type: string;\n    externalId: string;\n    url?: string;\n  };\n}\n\nexport interface IntakeRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Intake selection domain handle. */\n  intake: IntakeStorage;\n  /** Factory project domain handle, used to validate binding targets. */\n  projects?: { get(input: { orgId: string; id: string }): Promise<unknown | null> };\n  integrations?: IntakeIntegration[];\n  /** Installed boards, used to validate binding targets. Absent means only legacy routing is accepted. */\n  boardRegistry?: BoardRegistry;\n  /** Work items domain handle; when present, rebinding a source to another board moves its resting cards. */\n  workItems?: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n}\n\n/** Upper bound on source pages read while relocating cards, so a huge source cannot stall the request. */\nconst REBIND_MAX_PAGES = 20;\n/**\n * One deadline for the whole rebind read, not one per page: the binding is already saved when we\n * get here, so the caller is only waiting on relocation and a slow provider must not hold the\n * response for pages × timeout.\n */\nconst REBIND_READ_BUDGET_MS = 30_000;\n\n/**\n * Keys under which an intake item may be persisted as a work item. Providers key items by their\n * own id, while materialization uses the human identifier (`linear:MAS-44`), so both are accepted.\n */\nfunction intakeItemSourceKeys(integrationId: string, item: IntakeItem): string[] {\n  const identifier = item.metadata?.identifier;\n  return typeof identifier === 'string' && identifier.length > 0\n    ? [item.source.externalId, `${integrationId}:${identifier}`]\n    : [item.source.externalId];\n}\n\n/**\n * Move the cards that came from a rebound source onto its new board's initial phase. Terminal cards\n * stay put (they are history that belongs where it finished), as do cards with a session attached to\n * a current stage (a run owns them). Everything else moves, including cards parked in a working\n * phase that never started a run — auto-ingested issues sit in Work › Triage that way.\n */\nasync function relocateSourceCards({\n  workItems,\n  integration,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  sourceId,\n  targetBoard,\n  attributionSourceIds,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  integration: IntakeIntegration;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  sourceId: string;\n  targetBoard: string;\n  attributionSourceIds: string[];\n}): Promise<{ moved: number; skipped: number }> {\n  if (!boardRegistry.has(targetBoard)) return { moved: 0, skipped: 0 };\n\n  const sourceKeys = new Set<string>();\n  let cursor: string | undefined;\n  const deadline = Date.now() + REBIND_READ_BUDGET_MS;\n  for (let page = 0; page < REBIND_MAX_PAGES; page += 1) {\n    const result = await withTimeout(\n      integration.id,\n      () =>\n        integration.intake.listItems({\n          orgId,\n          userId,\n          sourceIds: [sourceId],\n          attributionSourceIds,\n          cursor,\n        }),\n      deadline - Date.now(),\n    );\n    for (const item of result.items) {\n      if (item.sourceId !== sourceId) continue;\n      for (const key of intakeItemSourceKeys(integration.id, item)) sourceKeys.add(key);\n    }\n    if (!result.nextCursor) break;\n    cursor = result.nextCursor;\n  }\n  if (sourceKeys.size === 0) return { moved: 0, skipped: 0 };\n\n  let moved = 0;\n  let skipped = 0;\n  const items = await workItems.list({ orgId, factoryProjectId });\n  for (const item of items) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integration.id || !sourceKeys.has(source.externalId)) continue;\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/**\n * After a label route changes, every issue card in the project that carries `label` is re-routed\n * under the project's current routes: to the board its labels now select, or back to Work when none\n * of them is routed any more.\n */\nasync function relocateLabeledCards({\n  workItems,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  integrationId,\n  label,\n  routes,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  integrationId: string;\n  label: string;\n  routes: readonly IntakeLabelRoute[];\n}): Promise<{ moved: number; skipped: number }> {\n  const changed = normalizeIntakeLabel(label);\n  let moved = 0;\n  let skipped = 0;\n  for (const item of await workItems.list({ orgId, factoryProjectId })) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integrationId || source.type !== 'issue') continue;\n    const labels = cardLabels(item);\n    if (!labels.some(candidate => normalizeIntakeLabel(candidate) === changed)) continue;\n    const targetBoard = resolveIntakeLabelRoute(routes, labels)?.board ?? 'work';\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/** One integration that failed while the rest of the aggregation succeeded. */\nexport interface IntakeIntegrationFailure {\n  integrationId: string;\n  message: string;\n}\n\ntype SettledIntegration<T> = { integrationId: string; value: T } | IntakeIntegrationFailure;\n\nconst PROVIDER_READ_TIMEOUT_MS = 15_000;\n\n/** The Intake contract takes no abort signal, so a slow read is abandoned, not cancelled. */\nfunction withTimeout<T>(\n  integrationId: string,\n  read: () => Promise<T>,\n  timeoutMs: number = PROVIDER_READ_TIMEOUT_MS,\n): Promise<T> {\n  return new Promise((resolve, reject) => {\n    const budget = Math.max(0, timeoutMs);\n    const timer = setTimeout(\n      () => reject(new Error(`${integrationId} did not answer within ${Math.round(budget / 1000)}s`)),\n      budget,\n    );\n    read()\n      .then(resolve, reject)\n      .finally(() => clearTimeout(timer));\n  });\n}\n\n/**\n * Read every integration concurrently and isolate the ones that throw or hang, so a single\n * unreachable provider degrades to a per-source error instead of failing the listing.\n */\nasync function settleByIntegration<T>(\n  requests: Array<{ integrationId: string; read: () => Promise<T> }>,\n): Promise<{ pages: Array<{ integrationId: string; value: T }>; failures: IntakeIntegrationFailure[] }> {\n  const settled = await Promise.all(\n    requests.map(async ({ integrationId, read }): Promise<SettledIntegration<T>> => {\n      try {\n        return { integrationId, value: await withTimeout(integrationId, read) };\n      } catch (error) {\n        console.error(`[factory] intake integration ${integrationId} is unavailable:`, error);\n        return { integrationId, message: error instanceof Error ? error.message : String(error) };\n      }\n    }),\n  );\n  const pages: Array<{ integrationId: string; value: T }> = [];\n  const failures: IntakeIntegrationFailure[] = [];\n  for (const entry of settled) {\n    if ('value' in entry) pages.push(entry);\n    else failures.push(entry);\n  }\n  return { pages, failures };\n}\n\nconst MAX_INTAKE_SOURCE_ID_LENGTH = 1024;\n\ninterface ParsedBinding {\n  integrationId: string;\n  sourceId: string;\n  factoryProjectId: string | null;\n  /** Installed board target; `null`/omitted keeps legacy source-type routing. */\n  board: string | null;\n}\n\n/** Validate a binding request body, rejecting unknown shapes. */\nexport function parseIntakeBinding(body: unknown): ParsedBinding | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const { integrationId, sourceId, factoryProjectId, board } = body as Record<string, unknown>;\n  const isId = (value: unknown) => typeof value === 'string' && value.length > 0 && value.length <= 256;\n  const isSourceId = (value: unknown) =>\n    typeof value === 'string' && value.length > 0 && value.length <= MAX_INTAKE_SOURCE_ID_LENGTH;\n  if (!isId(integrationId) || !isSourceId(sourceId)) return null;\n  if (factoryProjectId !== null && !isId(factoryProjectId)) return null;\n  if (board !== undefined && board !== null && !isId(board)) return null;\n  return {\n    integrationId: integrationId as string,\n    sourceId: sourceId as string,\n    factoryProjectId: factoryProjectId as string | null,\n    board: (board as string | null | undefined) ?? null,\n  };\n}\n\nconst identifier = z.string().min(1).max(256);\nconst labelRouteBodySchema = z.object({\n  factoryProjectId: identifier,\n  integrationId: identifier,\n  label: z\n    .string()\n    .max(256)\n    .transform(normalizeIntakeLabel)\n    .refine(label => label.length > 0, 'label must not be blank'),\n  /** Installed board target; `null` removes the route so the label falls back to Work. */\n  board: identifier.nullish().transform(board => board ?? null),\n});\ntype ParsedLabelRoute = z.output<typeof labelRouteBodySchema>;\n\n/** Validate a label-route request body, rejecting unknown shapes. */\nexport function parseIntakeLabelRoute(body: unknown): ParsedLabelRoute | null {\n  const parsed = labelRouteBodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction sanitizeIdList(value: unknown): string[] | null | undefined {\n  if (value === null) return null;\n  if (!Array.isArray(value) || value.length > 200) return undefined;\n  const ids = value.filter(\n    (item): item is string => typeof item === 'string' && item.length > 0 && item.length <= MAX_INTAKE_SOURCE_ID_LENGTH,\n  );\n  return ids.length === value.length && new Set(ids).size === ids.length ? ids : undefined;\n}\n\n/** Validate a request body into an intake config, rejecting unknown shapes. */\nexport function parseIntakeConfig(body: unknown): IntakeConfig | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const entries = Object.entries(body);\n  if (entries.length > 50) return null;\n\n  // Null-prototype so an `__proto__` key lands as a real entry instead of silently\n  // reassigning the prototype and disappearing from the validation below.\n  const config: IntakeConfig = Object.create(null);\n  for (const [integrationId, value] of entries) {\n    if (\n      !integrationId ||\n      integrationId.length > 128 ||\n      typeof value !== 'object' ||\n      value === null ||\n      Array.isArray(value)\n    ) {\n      return null;\n    }\n    const selection = value as { enabled?: unknown; sourceIds?: unknown };\n    if (typeof selection.enabled !== 'boolean') return null;\n    const sourceIds = sanitizeIdList(selection.sourceIds ?? null);\n    if (sourceIds === undefined) return null;\n    config[integrationId] = { enabled: selection.enabled, sourceIds };\n  }\n  return config;\n}\n\nfunction encodeCursor(cursors: Record<string, string>): string | null {\n  return Object.keys(cursors).length > 0 ? Buffer.from(JSON.stringify(cursors)).toString('base64url') : null;\n}\n\nfunction decodeCursor(value: string | undefined): Record<string, string> | null {\n  if (!value) return {};\n  try {\n    const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return null;\n    const entries = Object.entries(parsed);\n    if (entries.some(([key, cursor]) => !key || typeof cursor !== 'string')) return null;\n    return Object.fromEntries(entries) as Record<string, string>;\n  } catch {\n    return null;\n  }\n}\n\nexport class IntakeRoutes extends Route<IntakeRoutesDeps> {\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'Intake configuration requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    const { audit, intake, projects, integrations = [], boardRegistry, workItems } = this.deps;\n    const integrationIds = integrations.map(integration => integration.id);\n\n    return [\n      registerApiRoute('/web/intake/config', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          const config = await intake.getConfig({ orgId: tenant.orgId, integrationIds });\n          return c.json({ config });\n        },\n      }),\n      registerApiRoute('/web/intake/config', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const config = parseIntakeConfig(body);\n          if (!config) {\n            return c.json({ error: 'invalid_config' }, 400);\n          }\n\n          const registeredConfig: IntakeConfig = Object.create(null);\n          for (const [integrationId, selection] of Object.entries(config)) {\n            if (integrationIds.includes(integrationId)) {\n              registeredConfig[integrationId] = selection;\n              continue;\n            }\n            if (selection.enabled || selection.sourceIds?.length) {\n              return c.json({ error: 'invalid_config' }, 400);\n            }\n          }\n\n          await intake.ensureReady();\n          await intake.saveConfig({ orgId: tenant.orgId, config: registeredConfig });\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.config_updated',\n              targets: [{ type: 'intake_config', id: tenant.orgId }],\n              metadata: Object.fromEntries(\n                Object.entries(registeredConfig).map(([integrationId, selection]) => [\n                  integrationId,\n                  { enabled: selection.enabled, sources: selection.sourceIds?.length ?? null },\n                ]),\n              ),\n            },\n          });\n          return c.json({ config: registeredConfig });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          return c.json({ bindings: await intake.listBindings({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const binding = parseIntakeBinding(body);\n          if (!binding || !integrationIds.includes(binding.integrationId)) {\n            return c.json({ error: 'invalid_binding' }, 400);\n          }\n          if (binding.factoryProjectId && projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: binding.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (binding.board !== null && !boardRegistry?.has(binding.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${binding.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          let auditFactoryProjectId = binding.factoryProjectId;\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (binding.factoryProjectId === null) {\n            const previousBinding = await intake.clearBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            auditFactoryProjectId = previousBinding?.factoryProjectId ?? null;\n          } else {\n            const previousBinding = await intake.getBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            await intake.setBinding({\n              orgId: tenant.orgId,\n              userId: tenant.userId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n              factoryProjectId: binding.factoryProjectId,\n              board: binding.board,\n            });\n            // A source that stays in the same project but is pointed at a different board\n            // takes its resting cards along. Bindings that predate persisted boards have a\n            // null board yet still fed Work/Review, so relocation compares each card's\n            // effective board rather than trusting the previous binding value.\n            const nextBoard = binding.board;\n            const integration = integrations.find(candidate => candidate.id === binding.integrationId);\n            if (\n              workItems &&\n              boardRegistry &&\n              integration &&\n              previousBinding?.factoryProjectId === binding.factoryProjectId &&\n              nextBoard !== null &&\n              previousBinding.board !== nextBoard\n            ) {\n              try {\n                const config = await intake.getConfig({\n                  orgId: tenant.orgId,\n                  integrationIds: [binding.integrationId],\n                });\n                const configuredSourceIds = config[binding.integrationId]?.sourceIds ?? [];\n                const attributionSourceIds = configuredSourceIds.includes(binding.sourceId)\n                  ? configuredSourceIds\n                  : [...configuredSourceIds, binding.sourceId];\n                relocated = await relocateSourceCards({\n                  workItems,\n                  integration,\n                  boardRegistry,\n                  orgId: tenant.orgId,\n                  userId: tenant.userId,\n                  factoryProjectId: binding.factoryProjectId,\n                  sourceId: binding.sourceId,\n                  attributionSourceIds,\n                  targetBoard: nextBoard,\n                });\n              } catch (error) {\n                // The binding is saved; the cards can be moved by hand if the provider was unreachable.\n                console.error(`[factory] intake rebind could not relocate ${binding.integrationId} cards:`, error);\n              }\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.binding_updated',\n              ...(auditFactoryProjectId ? { factoryProjectId: auditFactoryProjectId } : {}),\n              targets: [{ type: 'intake_source', id: `${binding.integrationId}:${binding.sourceId}` }],\n              metadata: {\n                factoryProjectId: binding.factoryProjectId,\n                board: binding.board,\n                ...(relocated ? { relocated } : {}),\n              },\n            },\n          });\n          return c.json({\n            bindings: await intake.listBindings({ orgId: tenant.orgId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const factoryProjectId = c.req.query('factoryProjectId');\n          await intake.ensureReady();\n          return c.json({\n            routes: await intake.listLabelRoutes({\n              orgId: tenant.orgId,\n              ...(factoryProjectId ? { factoryProjectId } : {}),\n            }),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const route = parseIntakeLabelRoute(body);\n          if (!route || !integrationIds.includes(route.integrationId)) {\n            return c.json({ error: 'invalid_label_route' }, 400);\n          }\n          if (projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: route.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (route.board !== null && !boardRegistry?.has(route.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${route.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          const scope = {\n            orgId: tenant.orgId,\n            factoryProjectId: route.factoryProjectId,\n            integrationId: route.integrationId,\n          };\n          const previous = (await intake.listLabelRoutes(scope)).find(existing => existing.label === route.label);\n          if (route.board === null) {\n            await intake.clearLabelRoute({ ...scope, label: route.label });\n          } else {\n            await intake.setLabelRoute({ ...scope, label: route.label, board: route.board, userId: tenant.userId });\n          }\n\n          // Cards already carrying the label follow the route: onto the new board, or back to\n          // Work when the label is no longer routed anywhere.\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (workItems && boardRegistry && (previous?.board ?? null) !== route.board) {\n            try {\n              relocated = await relocateLabeledCards({\n                workItems,\n                boardRegistry,\n                orgId: tenant.orgId,\n                userId: tenant.userId,\n                factoryProjectId: route.factoryProjectId,\n                integrationId: route.integrationId,\n                label: route.label,\n                routes: await intake.listLabelRoutes(scope),\n              });\n            } catch (error) {\n              // The route is saved; the cards can be moved by hand.\n              console.error(`[factory] intake label route could not relocate ${route.integrationId} cards:`, error);\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.label_route_updated',\n              factoryProjectId: route.factoryProjectId,\n              targets: [{ type: 'intake_label_route', id: `${route.integrationId}:${route.label}` }],\n              metadata: { board: route.board, ...(relocated ? { relocated } : {}) },\n            },\n          });\n          return c.json({\n            routes: await intake.listLabelRoutes({ orgId: tenant.orgId, factoryProjectId: route.factoryProjectId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/sources', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const { pages, failures } = await settleByIntegration(\n            integrations.map(integration => ({\n              integrationId: integration.id,\n              read: () => integration.intake.listSources(tenant),\n            })),\n          );\n          return c.json({\n            sources: pages.flatMap(({ integrationId, value }) => value.map(source => ({ integrationId, ...source }))),\n            failures,\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/items', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const cursors = decodeCursor(c.req.query('cursor'));\n          if (!cursors) return c.json({ error: 'invalid_cursor' }, 400);\n\n          await intake.ensureReady();\n          const config = await intake.getConfig({ orgId: tenant.orgId, integrationIds });\n          const { pages, failures } = await settleByIntegration(\n            integrations.flatMap(integration => {\n              const selection = config[integration.id];\n              if (!selection?.enabled || !selection.sourceIds?.length) return [];\n              const sourceIds = selection.sourceIds;\n              const cursor = cursors[integration.id];\n              return [\n                {\n                  integrationId: integration.id,\n                  read: () => integration.intake.listItems({ ...tenant, sourceIds, ...(cursor ? { cursor } : {}) }),\n                },\n              ];\n            }),\n          );\n\n          const items: AggregatedIntakeItem[] = [];\n          const nextCursors: Record<string, string> = {};\n          for (const { integrationId, value } of pages) {\n            items.push(\n              ...value.items.map(item => {\n                const { source, ...candidate } = item;\n                return { ...candidate, integrationId, externalSource: { integrationId, ...source } };\n              }),\n            );\n            if (value.nextCursor) nextCursors[integrationId] = value.nextCursor;\n          }\n          // Keep the cursor an unavailable integration came in with, so the next page resumes there instead of replaying it.\n          for (const { integrationId } of failures) {\n            const cursor = cursors[integrationId];\n            if (cursor) nextCursors[integrationId] = cursor;\n          }\n          return c.json({ items, nextCursor: encodeCursor(nextCursors), failures });\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;AA4CA,MAAM,mBAAmB;;;;;;AAMzB,MAAM,wBAAwB;;;;;AAM9B,SAAS,qBAAqB,eAAuB,MAA4B;CAC/E,MAAM,aAAa,KAAK,UAAU;CAClC,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,CAAC,KAAK,OAAO,YAAY,GAAG,cAAc,GAAG,YAAY,IACzD,CAAC,KAAK,OAAO,UAAU;AAC7B;;;;;;;AAQA,eAAe,oBAAoB,EACjC,WACA,aACA,eACA,OACA,QACA,kBACA,UACA,aACA,wBAW8C;CAC9C,IAAI,CAAC,cAAc,IAAI,WAAW,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEnE,MAAM,6BAAa,IAAI,IAAY;CACnC,IAAI;CACJ,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,KAAK,IAAI,OAAO,GAAG,OAAO,kBAAkB,QAAQ,GAAG;EACrD,MAAM,SAAS,MAAM,YACnB,YAAY,UAEV,YAAY,OAAO,UAAU;GAC3B;GACA;GACA,WAAW,CAAC,QAAQ;GACpB;GACA;EACF,CAAC,GACH,WAAW,KAAK,IAAI,CACtB;EACA,KAAK,MAAM,QAAQ,OAAO,OAAO;GAC/B,IAAI,KAAK,aAAa,UAAU;GAChC,KAAK,MAAM,OAAO,qBAAqB,YAAY,IAAI,IAAI,GAAG,WAAW,IAAI,GAAG;EAClF;EACA,IAAI,CAAC,OAAO,YAAY;EACxB,SAAS,OAAO;CAClB;CACA,IAAI,WAAW,SAAS,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEzD,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC;CAC9D,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,YAAY,MAAM,CAAC,WAAW,IAAI,OAAO,UAAU,GAAG;EAC9F,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM;EAAY,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;;;;;;AAOA,eAAe,qBAAqB,EAClC,WACA,eACA,OACA,QACA,kBACA,eACA,OACA,UAU8C;CAC9C,MAAM,UAAU,qBAAqB,KAAK;CAC1C,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC,GAAG;EACpE,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,iBAAiB,OAAO,SAAS,SAAS;EAClF,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,CAAC,OAAO,MAAK,cAAa,qBAAqB,SAAS,MAAM,OAAO,GAAG;EAE5E,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM,aAD5D,wBAAwB,QAAQ,MAAM,CAAC,EAAE,SAAS;EACsB,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAUA,MAAM,2BAA2B;;AAGjC,SAAS,YACP,eACA,MACA,YAAoB,0BACR;CACZ,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAS,KAAK,IAAI,GAAG,SAAS;EACpC,MAAM,QAAQ,iBACN,uBAAO,IAAI,MAAM,GAAG,cAAc,yBAAyB,KAAK,MAAM,SAAS,GAAI,EAAE,EAAE,CAAC,GAC9F,MACF;EACA,KAAK,CAAC,CACH,KAAK,SAAS,MAAM,CAAC,CACrB,cAAc,aAAa,KAAK,CAAC;CACtC,CAAC;AACH;;;;;AAMA,eAAe,oBACb,UACsG;CACtG,MAAM,UAAU,MAAM,QAAQ,IAC5B,SAAS,IAAI,OAAO,EAAE,eAAe,WAA2C;EAC9E,IAAI;GACF,OAAO;IAAE;IAAe,OAAO,MAAM,YAAY,eAAe,IAAI;GAAE;EACxE,SAAS,OAAO;GACd,QAAQ,MAAM,gCAAgC,cAAc,mBAAmB,KAAK;GACpF,OAAO;IAAE;IAAe,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC1F;CACF,CAAC,CACH;CACA,MAAM,QAAoD,CAAC;CAC3D,MAAM,WAAuC,CAAC;CAC9C,KAAK,MAAM,SAAS,SAClB,IAAI,WAAW,OAAO,MAAM,KAAK,KAAK;MACjC,SAAS,KAAK,KAAK;CAE1B,OAAO;EAAE;EAAO;CAAS;AAC3B;AAEA,MAAM,8BAA8B;;AAWpC,SAAgB,mBAAmB,MAAqC;CACtE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,EAAE,eAAe,UAAU,kBAAkB,UAAU;CAC7D,MAAM,QAAQ,UAAmB,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;CAClG,MAAM,cAAc,UAClB,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;CACnE,IAAI,CAAC,KAAK,aAAa,KAAK,CAAC,WAAW,QAAQ,GAAG,OAAO;CAC1D,IAAI,qBAAqB,QAAQ,CAAC,KAAK,gBAAgB,GAAG,OAAO;CACjE,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO;CAClE,OAAO;EACU;EACL;EACQ;EAClB,OAAQ,SAAuC;CACjD;AACF;AAEA,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAC5C,MAAM,uBAAuB,EAAE,OAAO;CACpC,kBAAkB;CAClB,eAAe;CACf,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,UAAU,oBAAoB,CAAC,CAC/B,QAAO,UAAS,MAAM,SAAS,GAAG,yBAAyB;;CAE9D,OAAO,WAAW,QAAQ,CAAC,CAAC,WAAU,UAAS,SAAS,IAAI;AAC9D,CAAC;;AAID,SAAgB,sBAAsB,MAAwC;CAC5E,MAAM,SAAS,qBAAqB,UAAU,IAAI;CAClD,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,eAAe,OAA6C;CACnE,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,KAAK,OAAO,KAAA;CACxD,MAAM,MAAM,MAAM,QACf,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,KAAK,UAAU,2BAC1F;CACA,OAAO,IAAI,WAAW,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,MAAM,KAAA;AACjF;;AAGA,SAAgB,kBAAkB,MAAoC;CACpE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,UAAU,OAAO,QAAQ,IAAI;CACnC,IAAI,QAAQ,SAAS,IAAI,OAAO;CAIhC,MAAM,SAAuB,OAAO,OAAO,IAAI;CAC/C,KAAK,MAAM,CAAC,eAAe,UAAU,SAAS;EAC5C,IACE,CAAC,iBACD,cAAc,SAAS,OACvB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GAEnB,OAAO;EAET,MAAM,YAAY;EAClB,IAAI,OAAO,UAAU,YAAY,WAAW,OAAO;EACnD,MAAM,YAAY,eAAe,UAAU,aAAa,IAAI;EAC5D,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,OAAO,iBAAiB;GAAE,SAAS,UAAU;GAAS;EAAU;CAClE;CACA,OAAO;AACT;AAEA,SAAS,aAAa,SAAgD;CACpE,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW,IAAI;AACxG;AAEA,SAAS,aAAa,OAA0D;CAC9E,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAC1E,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO;EACnF,MAAM,UAAU,OAAO,QAAQ,MAAM;EACrC,IAAI,QAAQ,MAAM,CAAC,KAAK,YAAY,CAAC,OAAO,OAAO,WAAW,QAAQ,GAAG,OAAO;EAChF,OAAO,OAAO,YAAY,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,eAAb,cAAkC,MAAwB;CACxD,MAAMA,eAAe,GAAiF;EACpG,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;EACjC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;EACtC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAAiD,GAC5F,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;CAEA,SAAqB;EACnB,MAAM,EAAE,OAAO,QAAQ,UAAU,eAAe,CAAC,GAAG,eAAe,cAAc,KAAK;EACtF,MAAM,iBAAiB,aAAa,KAAI,gBAAe,YAAY,EAAE;EAErE,OAAO;GACL,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,OAAO,OAAO;MAAO;KAAe,CAAC;KAC7E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;IAC1B;GACF,CAAC;GACD,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,SAAS,kBAAkB,IAAI;KACrC,IAAI,CAAC,QACH,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAGhD,MAAM,mBAAiC,OAAO,OAAO,IAAI;KACzD,KAAK,MAAM,CAAC,eAAe,cAAc,OAAO,QAAQ,MAAM,GAAG;MAC/D,IAAI,eAAe,SAAS,aAAa,GAAG;OAC1C,iBAAiB,iBAAiB;OAClC;MACF;MACA,IAAI,UAAU,WAAW,UAAU,WAAW,QAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAElD;KAEA,MAAM,OAAO,YAAY;KACzB,MAAM,OAAO,WAAW;MAAE,OAAO,OAAO;MAAO,QAAQ;KAAiB,CAAC;KACzE,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,OAAO;OAAM,CAAC;OACrD,UAAU,OAAO,YACf,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KAAK,CAAC,eAAe,eAAe,CACnE,eACA;QAAE,SAAS,UAAU;QAAS,SAAS,UAAU,WAAW,UAAU;OAAK,CAC7E,CAAC,CACH;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,QAAQ,iBAAiB,CAAC;IAC5C;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;IAChF;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,UAAU,mBAAmB,IAAI;KACvC,IAAI,CAAC,WAAW,CAAC,eAAe,SAAS,QAAQ,aAAa,GAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KAEjD,IAAI,QAAQ,oBAAoB,UAE1B;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,QAAQ;MAAiB,CAAC,GAC1E,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,QAAQ,UAAU,QAAQ,CAAC,eAAe,IAAI,QAAQ,KAAK,GAC7D,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,QAAQ,MAAM;KAAqB,GAAG,GAAG;KAGtG,MAAM,OAAO,YAAY;KACzB,IAAI,wBAAwB,QAAQ;KACpC,IAAI,YAAuD;KAC3D,IAAI,QAAQ,qBAAqB,MAM/B,yBAAwB,MALM,OAAO,aAAa;MAChD,OAAO,OAAO;MACd,eAAe,QAAQ;MACvB,UAAU,QAAQ;KACpB,CAAC,EAAA,EACwC,oBAAoB;UACxD;MACL,MAAM,kBAAkB,MAAM,OAAO,WAAW;OAC9C,OAAO,OAAO;OACd,eAAe,QAAQ;OACvB,UAAU,QAAQ;MACpB,CAAC;MACD,MAAM,OAAO,WAAW;OACtB,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,eAAe,QAAQ;OACvB,UAAU,QAAQ;OAClB,kBAAkB,QAAQ;OAC1B,OAAO,QAAQ;MACjB,CAAC;MAKD,MAAM,YAAY,QAAQ;MAC1B,MAAM,cAAc,aAAa,MAAK,cAAa,UAAU,OAAO,QAAQ,aAAa;MACzF,IACE,aACA,iBACA,eACA,iBAAiB,qBAAqB,QAAQ,oBAC9C,cAAc,QACd,gBAAgB,UAAU,WAE1B,IAAI;OAKF,MAAM,uBAAsB,MAJP,OAAO,UAAU;QACpC,OAAO,OAAO;QACd,gBAAgB,CAAC,QAAQ,aAAa;OACxC,CAAC,EAAA,CACkC,QAAQ,cAAc,EAAE,aAAa,CAAC;OACzE,MAAM,uBAAuB,oBAAoB,SAAS,QAAQ,QAAQ,IACtE,sBACA,CAAC,GAAG,qBAAqB,QAAQ,QAAQ;OAC7C,YAAY,MAAM,oBAAoB;QACpC;QACA;QACA;QACA,OAAO,OAAO;QACd,QAAQ,OAAO;QACf,kBAAkB,QAAQ;QAC1B,UAAU,QAAQ;QAClB;QACA,aAAa;OACf,CAAC;MACH,SAAS,OAAO;OAEd,QAAQ,MAAM,8CAA8C,QAAQ,cAAc,UAAU,KAAK;MACnG;KAEJ;KACA,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,GAAI,wBAAwB,EAAE,kBAAkB,sBAAsB,IAAI,CAAC;OAC3E,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,GAAG,QAAQ,cAAc,GAAG,QAAQ;OAAW,CAAC;OACvF,UAAU;QACR,kBAAkB,QAAQ;QAC1B,OAAO,QAAQ;QACf,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OACnC;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC;MAC3D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;KACvD,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EACZ,QAAQ,MAAM,OAAO,gBAAgB;MACnC,OAAO,OAAO;MACd,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;KACjD,CAAC,EACH,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,QAAQ,sBAAsB,IAAI;KACxC,IAAI,CAAC,SAAS,CAAC,eAAe,SAAS,MAAM,aAAa,GACxD,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAErD,IAAI,UAEE;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,MAAM;MAAiB,CAAC,GACxE,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,MAAM,UAAU,QAAQ,CAAC,eAAe,IAAI,MAAM,KAAK,GACzD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,MAAM,MAAM;KAAqB,GAAG,GAAG;KAGpG,MAAM,OAAO,YAAY;KACzB,MAAM,QAAQ;MACZ,OAAO,OAAO;MACd,kBAAkB,MAAM;MACxB,eAAe,MAAM;KACvB;KACA,MAAM,YAAY,MAAM,OAAO,gBAAgB,KAAK,EAAA,CAAG,MAAK,aAAY,SAAS,UAAU,MAAM,KAAK;KACtG,IAAI,MAAM,UAAU,MAClB,MAAM,OAAO,gBAAgB;MAAE,GAAG;MAAO,OAAO,MAAM;KAAM,CAAC;UAE7D,MAAM,OAAO,cAAc;MAAE,GAAG;MAAO,OAAO,MAAM;MAAO,OAAO,MAAM;MAAO,QAAQ,OAAO;KAAO,CAAC;KAKxG,IAAI,YAAuD;KAC3D,IAAI,aAAa,kBAAkB,UAAU,SAAS,UAAU,MAAM,OACpE,IAAI;MACF,YAAY,MAAM,qBAAqB;OACrC;OACA;OACA,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,kBAAkB,MAAM;OACxB,eAAe,MAAM;OACrB,OAAO,MAAM;OACb,QAAQ,MAAM,OAAO,gBAAgB,KAAK;MAC5C,CAAC;KACH,SAAS,OAAO;MAEd,QAAQ,MAAM,mDAAmD,MAAM,cAAc,UAAU,KAAK;KACtG;KAEF,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,kBAAkB,MAAM;OACxB,SAAS,CAAC;QAAE,MAAM;QAAsB,IAAI,GAAG,MAAM,cAAc,GAAG,MAAM;OAAQ,CAAC;OACrF,UAAU;QAAE,OAAO,MAAM;QAAO,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OAAG;MACtE;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,QAAQ,MAAM,OAAO,gBAAgB;OAAE,OAAO,OAAO;OAAO,kBAAkB,MAAM;MAAiB,CAAC;MACtG,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,KAAI,iBAAgB;MAC/B,eAAe,YAAY;MAC3B,YAAY,YAAY,OAAO,YAAY,MAAM;KACnD,EAAE,CACJ;KACA,OAAO,EAAE,KAAK;MACZ,SAAS,MAAM,SAAS,EAAE,eAAe,YAAY,MAAM,KAAI,YAAW;OAAE;OAAe,GAAG;MAAO,EAAE,CAAC;MACxG;KACF,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,qBAAqB;IACpC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,UAAU,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;KAClD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAE5D,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,OAAO,OAAO;MAAO;KAAe,CAAC;KAC7E,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,SAAQ,gBAAe;MAClC,MAAM,YAAY,OAAO,YAAY;MACrC,IAAI,CAAC,WAAW,WAAW,CAAC,UAAU,WAAW,QAAQ,OAAO,CAAC;MACjE,MAAM,YAAY,UAAU;MAC5B,MAAM,SAAS,QAAQ,YAAY;MACnC,OAAO,CACL;OACE,eAAe,YAAY;OAC3B,YAAY,YAAY,OAAO,UAAU;QAAE,GAAG;QAAQ;QAAW,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;OAAG,CAAC;MAClG,CACF;KACF,CAAC,CACH;KAEA,MAAM,QAAgC,CAAC;KACvC,MAAM,cAAsC,CAAC;KAC7C,KAAK,MAAM,EAAE,eAAe,WAAW,OAAO;MAC5C,MAAM,KACJ,GAAG,MAAM,MAAM,KAAI,SAAQ;OACzB,MAAM,EAAE,QAAQ,GAAG,cAAc;OACjC,OAAO;QAAE,GAAG;QAAW;QAAe,gBAAgB;SAAE;SAAe,GAAG;QAAO;OAAE;MACrF,CAAC,CACH;MACA,IAAI,MAAM,YAAY,YAAY,iBAAiB,MAAM;KAC3D;KAEA,KAAK,MAAM,EAAE,mBAAmB,UAAU;MACxC,MAAM,SAAS,QAAQ;MACvB,IAAI,QAAQ,YAAY,iBAAiB;KAC3C;KACA,OAAO,EAAE,KAAK;MAAE;MAAO,YAAY,aAAa,WAAW;MAAG;KAAS,CAAC;IAC1E;GACF,CAAC;EACH;CACF;AACF"}

package/dist/routes/oauth.js

@@ -1,7 +1,7 @@
+import { ModelCredentialsStorage } from "../storage/domains/credentials/base.js";
 import { getAuthProviderId, resolveCredentialContext } from "./provider-credentials.js";
 import { Route } from "./route.js";
 import { seedPersonalOmDefaults } from "./om-seed.js";
-import { ModelCredentialsStorage } from "../storage/domains/credentials/base.js";
 import { registerApiRoute } from "@mastra/core/server";
 import { randomUUID } from "crypto";
 import { nextPollDelayMs } from "@mastra/code-sdk/auth/device-code";
@@ -202,10 +202,7 @@ async function persistOAuthCredential({ ctx, provider, scope, credentials, authS
 		return;
 	}
 	if (!authStorage) throw new Error("Credential storage is not available");
-	authStorage.set(authProviderId, {
-		type: "oauth",
-		...credentials
-	});
+	await authStorage.addAccount(authProviderId, credentials);
 }
 async function readJsonBody(c) {
 	try {
@@ -471,7 +468,7 @@ var OAuthRoutes = class extends Route {
 							onCredentialsChanged(tenant);
 						} else {
 							if (!authStorage) return c.json({ error: "Credential storage is not available" }, 503);
-							authStorage.remove(authProviderId);
+							authStorage.logout(authProviderId);
 						}
 						return c.json({ ok: true });
 					} catch (error) {

package/dist/routes/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../src/routes/oauth.ts"],"sourcesContent":["/**\n * Web OAuth sign-in routes for model providers (Settings › Providers).\n *\n * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's\n * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in\n * HTTP routes. Flow state lives in login sessions — the `model-credentials`\n * domain's `oauth_login_sessions` table in tenant mode (any replica can\n * complete/poll), an in-memory store in local mode — so a flow can span\n * requests. Completed credentials are **user-scoped by default**; org admins\n * can start a flow with `{ scope: 'org' }` to share the credential with the\n * whole org. Local mode writes to the file-backed `AuthStorage`.\n *\n * Tokens never leave the server; responses only carry flow metadata (URLs,\n * user codes, poll delays).\n */\n\nimport { randomUUID } from 'node:crypto';\n\nimport { nextPollDelayMs } from '@mastra/code-sdk/auth/device-code';\nimport { completeAnthropicLogin, startAnthropicLogin } from '@mastra/code-sdk/auth/providers/anthropic';\nimport {\n  copilotNextPollDelayMs,\n  pollGitHubCopilotDeviceLogin,\n  startGitHubCopilotDeviceLogin,\n} from '@mastra/code-sdk/auth/providers/github-copilot';\nimport type { CopilotDeviceLoginPending } from '@mastra/code-sdk/auth/providers/github-copilot';\nimport { pollCodexDeviceLogin, startCodexDeviceLogin } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport type { CodexDeviceLoginPending } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport { pollXAIDeviceLogin, startXAIDeviceLogin } from '@mastra/code-sdk/auth/providers/xai';\nimport type { XAIDeviceLoginPending } from '@mastra/code-sdk/auth/providers/xai';\nimport type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { OAuthCredentials } from '@mastra/code-sdk/auth/types';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { LoginCredentialScope, LoginSessionKind, LoginSessionRow } from '../storage/domains/credentials/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport { seedPersonalOmDefaults } from './om-seed.js';\nimport { getAuthProviderId, resolveCredentialContext } from './provider-credentials.js';\nimport type { CredentialContext } from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\n/** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */\nconst PASTE_CODE_TTL_MS = 10 * 60 * 1000;\n\ninterface OAuthFlowStart {\n  url: string;\n  userCode?: string;\n  instructions: string;\n  /** ms epoch after which the flow expires. */\n  expiresAt: number;\n  /** Delay before the first upstream poll (device-code flows only). */\n  nextPollMs?: number;\n  /** Serializable flow state persisted in the login session. */\n  pending: Record<string, unknown>;\n}\n\ntype OAuthFlowPoll =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending?: Record<string, unknown> }\n  | { status: 'failed'; error: string };\n\ninterface OAuthFlow {\n  kind: LoginSessionKind;\n  start(): Promise<OAuthFlowStart>;\n  /** Paste-code flows: exchange the pasted code for credentials. Throws on bad input. */\n  complete?(pending: Record<string, unknown>, code: string): Promise<OAuthCredentials>;\n  /** Device-code flows: perform exactly one upstream poll. */\n  poll?(pending: Record<string, unknown>): Promise<OAuthFlowPoll>;\n}\n\n/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_FLOW_KINDS}). */\nconst OAUTH_FLOWS: Record<string, OAuthFlow> = {\n  anthropic: {\n    kind: 'paste-code',\n    start: async () => {\n      const { url, verifier } = await startAnthropicLogin();\n      return {\n        url,\n        instructions: 'Open the link, authorize, then paste the code shown on the final page.',\n        expiresAt: Date.now() + PASTE_CODE_TTL_MS,\n        pending: { verifier },\n      };\n    },\n    complete: (pending, code) => completeAnthropicLogin(code, String(pending.verifier ?? '')),\n  },\n  openai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startCodexDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: p.intervalMs,\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollCodexDeviceLogin(pending as unknown as CodexDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  'github-copilot': {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startGitHubCopilotDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: copilotNextPollDelayMs(p),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const p = pending as unknown as CopilotDeviceLoginPending;\n      // Web flows are always started against github.com (no Enterprise input).\n      // Never let deserialized session state redirect server-side polling to\n      // an arbitrary hostname.\n      if (p.domain !== 'github.com' || p.enterpriseDomain !== undefined) {\n        return { status: 'failed', error: 'Unsupported GitHub host' };\n      }\n      const r = await pollGitHubCopilotDeviceLogin(p);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  xai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startXAIDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.state.deadlineAt,\n        nextPollMs: nextPollDelayMs(p.state),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollXAIDeviceLogin(pending as unknown as XAIDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n};\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Local-mode login sessions. Flows in local mode are single-process, so a\n * process-local libsql `:memory:` database (which already handles TTL\n * cleanup) is sufficient.\n */\nlet localSessionsPromise: Promise<ModelCredentialsStorage> | undefined;\nfunction localSessions(): Promise<ModelCredentialsStorage> {\n  localSessionsPromise ??= (async () => {\n    const { LibSQLFactoryStorage } = await import('@mastra/libsql');\n    const storage = new LibSQLFactoryStorage({ id: 'local-oauth-sessions', url: ':memory:' });\n    const store = storage.registerDomain(new ModelCredentialsStorage());\n    await storage.init();\n    return store;\n  })();\n  return localSessionsPromise;\n}\nconst LOCAL_TENANT = { orgId: 'local', userId: 'local' } as const;\n\nasync function sessionStore(ctx: CredentialContext): Promise<ModelCredentialsStorage> {\n  return ctx.mode === 'tenant' ? ctx.storage : localSessions();\n}\n\nfunction sessionTenant(ctx: CredentialContext): { orgId: string; userId: string } {\n  return ctx.mode === 'tenant' ? { orgId: ctx.orgId, userId: ctx.userId } : LOCAL_TENANT;\n}\n\n/** Load a session and verify it belongs to the caller + provider (else undefined). */\nasync function loadOwnedSession({\n  ctx,\n  provider,\n  sessionId,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  sessionId: string;\n}): Promise<LoginSessionRow | undefined> {\n  const session = await (await sessionStore(ctx)).getLoginSession(sessionId);\n  if (!session) return undefined;\n  const tenant = sessionTenant(ctx);\n  if (session.orgId !== tenant.orgId || session.userId !== tenant.userId) return undefined;\n  if (session.provider !== provider) return undefined;\n  return session;\n}\n\n/** Persist completed OAuth credentials — user-scoped unless the flow was started org-wide. */\nasync function persistOAuthCredential({\n  ctx,\n  provider,\n  scope,\n  credentials,\n  authStorage,\n  memorySettings,\n  onCredentialsChanged,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  scope: LoginCredentialScope | undefined;\n  credentials: OAuthCredentials;\n  authStorage: AuthStorage | undefined;\n  memorySettings: MemorySettingsStorage | undefined;\n  onCredentialsChanged: (tenant: { orgId: string; userId?: string }) => void;\n}): Promise<void> {\n  const authProviderId = getAuthProviderId(provider);\n  if (ctx.mode === 'tenant') {\n    const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n    await ctx.storage.setCredential(tenant, authProviderId, {\n      type: 'oauth',\n      ...credentials,\n    });\n    onCredentialsChanged(tenant);\n    await seedPersonalOmDefaults({ memorySettings, tenant, provider });\n    return;\n  }\n  if (!authStorage) throw new Error('Credential storage is not available');\n  authStorage.set(authProviderId, { type: 'oauth', ...credentials });\n}\n\nasync function readJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = (await c.req.json()) as unknown;\n    return body && typeof body === 'object' ? (body as Record<string, unknown>) : {};\n  } catch {\n    return {};\n  }\n}\n\nexport interface OAuthRoutesDeps extends RouteDependencies {\n  /** File-backed credential store; used in local (no-auth) mode. */\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Personal OM settings; seeded from the login provider after a user-scoped sign-in. */\n  memorySettings?: MemorySettingsStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n}\n\n/**\n * Provider OAuth sign-in routes as Mastra `apiRoutes`:\n *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow\n *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange\n *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll\n *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow\n *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)\n */\nexport class OAuthRoutes extends Route<OAuthRoutesDeps> {\n  routes(): ApiRoute[] {\n    const { auth, authStorage, modelCredentials, memorySettings } = this.deps;\n    const onCredentialsChanged = this.deps.onCredentialsChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers/:provider/oauth/start', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow) {\n            return c.json({ error: 'oauth_not_supported', message: `Provider does not support web sign-in` }, 404);\n          }\n          // Body may carry `{ mode }` for future multi-mode providers; each web\n          // flow currently has exactly one mode, so an unknown mode is rejected.\n          const body = await readJsonBody(loose(c));\n          if (typeof body.mode === 'string' && body.mode !== flow.kind) {\n            return c.json({ error: 'invalid_mode', message: `Unsupported mode for ${provider}: ${body.mode}` }, 400);\n          }\n\n          // Optional `{ scope: 'org' }` shares the completed credential with\n          // the whole org (admin-only, tenant mode). Anything else is personal.\n          const scope: LoginCredentialScope = body.scope === 'org' ? 'org' : 'user';\n          if (scope === 'org' && ctx.mode === 'tenant' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          let started: OAuthFlowStart;\n          try {\n            started = await flow.start();\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 502);\n          }\n\n          const sessionId = randomUUID();\n          const tenant = sessionTenant(ctx);\n          await (\n            await sessionStore(ctx)\n          ).createLoginSession({\n            sessionId,\n            orgId: tenant.orgId,\n            userId: tenant.userId,\n            provider,\n            kind: flow.kind,\n            ...(scope === 'org' && ctx.mode === 'tenant' ? { credentialScope: scope } : {}),\n            pending: started.pending,\n            expiresAt: new Date(started.expiresAt),\n            nextPollAt: started.nextPollMs != null ? new Date(Date.now() + started.nextPollMs) : null,\n          });\n\n          return c.json({\n            sessionId,\n            kind: flow.kind,\n            url: started.url,\n            ...(started.userCode ? { userCode: started.userCode } : {}),\n            instructions: started.instructions,\n            expiresAt: started.expiresAt,\n            ...(started.nextPollMs != null ? { nextPollMs: started.nextPollMs } : {}),\n          });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/complete', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.complete) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          const code = typeof body.code === 'string' ? body.code.trim() : '';\n          if (!sessionId || !code) return c.json({ error: 'Missing required fields: sessionId, code' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'paste-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access at completion time — the\n          // caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'paste-code',\n          });\n          if (!claimed) return c.json({ error: 'oauth_in_progress' }, 409);\n\n          let credentials: OAuthCredentials;\n          try {\n            credentials = await flow.complete(claimed.pending, code);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);\n          }\n\n          await persistOAuthCredential({\n            ctx,\n            provider,\n            scope: session.credentialScope,\n            credentials,\n            authStorage,\n            memorySettings,\n            onCredentialsChanged,\n          });\n          await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ status: 'complete', ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/poll', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.poll) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          if (!sessionId) return c.json({ error: 'Missing required field: sessionId' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'device-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access before the credential write —\n          // the caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          // Server-side rate limit: at most one upstream poll per interval,\n          // regardless of how eagerly the client calls this route.\n          const now = Date.now();\n          const nextPollAt = session.nextPollAt?.getTime();\n          if (nextPollAt != null && now < nextPollAt) {\n            return c.json({ status: 'pending', nextPollMs: nextPollAt - now });\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'device-code',\n          });\n          if (!claimed) return c.json({ status: 'pending', nextPollMs: 250 });\n\n          let result: OAuthFlowPoll;\n          try {\n            result = await flow.poll(claimed.pending);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            throw error;\n          }\n\n          if (result.status === 'complete') {\n            await persistOAuthCredential({\n              ctx,\n              provider,\n              scope: session.credentialScope,\n              credentials: result.credentials,\n              authStorage,\n              memorySettings,\n              onCredentialsChanged,\n            });\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'complete', ok: true });\n          }\n\n          if (result.status === 'failed') {\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'failed', error: result.error });\n          }\n\n          await (\n            await sessionStore(ctx)\n          ).touchLoginSession(sessionId, {\n            ...(result.pending ? { pending: result.pending } : {}),\n            nextPollAt: new Date(now + result.nextPollMs),\n          });\n          return c.json({ status: 'pending', nextPollMs: result.nextPollMs });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/session/:sessionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const sessionId = c.req.param('sessionId');\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (session) await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const authProviderId = getAuthProviderId(provider);\n          // `?scope=org` removes the shared org credential (admin-only);\n          // default removes the caller's personal credential only.\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'forbidden', message: 'Only org admins can remove an org-wide sign-in' }, 403);\n              }\n              const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n              await ctx.storage.removeCredential(tenant, authProviderId);\n              onCredentialsChanged(tenant);\n            } else {\n              if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n              authStorage.remove(authProviderId);\n            }\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAM,oBAAoB,MAAU;;AA6BpC,MAAM,cAAyC;CAC7C,WAAW;EACT,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;GACpD,OAAO;IACL;IACA,cAAc;IACd,WAAW,KAAK,IAAI,IAAI;IACxB,SAAS,EAAE,SAAS;GACtB;EACF;EACA,WAAW,SAAS,SAAS,uBAAuB,MAAM,OAAO,QAAQ,YAAY,EAAE,CAAC;CAC1F;CACA,QAAQ;EACN,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,sBAAsB;GACtC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,EAAE;IACd,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,qBAAqB,OAA6C;GAClF,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;GAAW;GACjF,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,kBAAkB;EAChB,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,8BAA8B;GAC9C,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,uBAAuB,CAAC;IACpC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI;GAIV,IAAI,EAAE,WAAW,gBAAgB,EAAE,qBAAqB,KAAA,GACtD,OAAO;IAAE,QAAQ;IAAU,OAAO;GAA0B;GAE9D,MAAM,IAAI,MAAM,6BAA6B,CAAC;GAC9C,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,KAAK;EACH,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,oBAAoB;GACpC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE,MAAM;IACnB,YAAY,gBAAgB,EAAE,KAAK;IACnC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,mBAAmB,OAA2C;GAC9E,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;AACF;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;AAOA,IAAI;AACJ,SAAS,gBAAkD;CACzD,0BAA0B,YAAY;EACpC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,UAAU,IAAI,qBAAqB;GAAE,IAAI;GAAwB,KAAK;EAAW,CAAC;EACxF,MAAM,QAAQ,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAClE,MAAM,QAAQ,KAAK;EACnB,OAAO;CACT,EAAA,CAAG;CACH,OAAO;AACT;AACA,MAAM,eAAe;CAAE,OAAO;CAAS,QAAQ;AAAQ;AAEvD,eAAe,aAAa,KAA0D;CACpF,OAAO,IAAI,SAAS,WAAW,IAAI,UAAU,cAAc;AAC7D;AAEA,SAAS,cAAc,KAA2D;CAChF,OAAO,IAAI,SAAS,WAAW;EAAE,OAAO,IAAI;EAAO,QAAQ,IAAI;CAAO,IAAI;AAC5E;;AAGA,eAAe,iBAAiB,EAC9B,KACA,UACA,aAKuC;CACvC,MAAM,UAAU,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,gBAAgB,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,SAAS,cAAc,GAAG;CAChC,IAAI,QAAQ,UAAU,OAAO,SAAS,QAAQ,WAAW,OAAO,QAAQ,OAAO,KAAA;CAC/E,IAAI,QAAQ,aAAa,UAAU,OAAO,KAAA;CAC1C,OAAO;AACT;;AAGA,eAAe,uBAAuB,EACpC,KACA,UACA,OACA,aACA,aACA,gBACA,wBASgB;CAChB,MAAM,iBAAiB,kBAAkB,QAAQ;CACjD,IAAI,IAAI,SAAS,UAAU;EACzB,MAAM,SAAS;GAAE,OAAO,IAAI;GAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;EAAG;EACtF,MAAM,IAAI,QAAQ,cAAc,QAAQ,gBAAgB;GACtD,MAAM;GACN,GAAG;EACL,CAAC;EACD,qBAAqB,MAAM;EAC3B,MAAM,uBAAuB;GAAE;GAAgB;GAAQ;EAAS,CAAC;EACjE;CACF;CACA,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qCAAqC;CACvE,YAAY,IAAI,gBAAgB;EAAE,MAAM;EAAS,GAAG;CAAY,CAAC;AACnE;AAEA,eAAe,aAAa,GAA8C;CACxE,IAAI;EACF,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK;EAC/B,OAAO,QAAQ,OAAO,SAAS,WAAY,OAAmC,CAAC;CACjF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;;;AAqBA,IAAa,cAAb,cAAiC,MAAuB;CACtD,SAAqB;EACnB,MAAM,EAAE,MAAM,aAAa,kBAAkB,mBAAmB,KAAK;EACrE,MAAM,uBAAuB,KAAK,KAAK,+BAA+B,CAAC;EAEvE,OAAO;GACL,iBAAiB,+CAA+C;IAC9D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;MAAE,OAAO;MAAuB,SAAS;KAAwC,GAAG,GAAG;KAIvG,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,IAAI,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,KAAK,MACtD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAgB,SAAS,wBAAwB,SAAS,IAAI,KAAK;KAAO,GAAG,GAAG;KAKzG,MAAM,QAA8B,KAAK,UAAU,QAAQ,QAAQ;KACnE,IAAI,UAAU,SAAS,IAAI,SAAS,YAAY,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAClG,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,IAAI;KACJ,IAAI;MACF,UAAU,MAAM,KAAK,MAAM;KAC7B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,YAAY,WAAW;KAC7B,MAAM,SAAS,cAAc,GAAG;KAChC,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,mBAAmB;MACnB;MACA,OAAO,OAAO;MACd,QAAQ,OAAO;MACf;MACA,MAAM,KAAK;MACX,GAAI,UAAU,SAAS,IAAI,SAAS,WAAW,EAAE,iBAAiB,MAAM,IAAI,CAAC;MAC7E,SAAS,QAAQ;MACjB,WAAW,IAAI,KAAK,QAAQ,SAAS;MACrC,YAAY,QAAQ,cAAc,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,UAAU,IAAI;KACvF,CAAC;KAED,OAAO,EAAE,KAAK;MACZ;MACA,MAAM,KAAK;MACX,KAAK,QAAQ;MACb,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;MACzD,cAAc,QAAQ;MACtB,WAAW,QAAQ;MACnB,GAAI,QAAQ,cAAc,OAAO,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;KACzE,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,kDAAkD;IACjE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAExE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;KAChE,IAAI,CAAC,aAAa,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;KAEjG,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGrF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAE/D,IAAI;KACJ,IAAI;MACF,cAAc,MAAM,KAAK,SAAS,QAAQ,SAAS,IAAI;KACzD,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,uBAAuB;MAC3B;MACA;MACA,OAAO,QAAQ;MACf;MACA;MACA;MACA;KACF,CAAC;KACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KAC5D,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAY,IAAI;KAAK,CAAC;IAChD;GACF,CAAC;GAED,iBAAiB,8CAA8C;IAC7D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAEpE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,IAAI,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KAEjF,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGtF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAKrG,MAAM,MAAM,KAAK,IAAI;KACrB,MAAM,aAAa,QAAQ,YAAY,QAAQ;KAC/C,IAAI,cAAc,QAAQ,MAAM,YAC9B,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,aAAa;KAAI,CAAC;KAGnE,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY;KAAI,CAAC;KAElE,IAAI;KACJ,IAAI;MACF,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO;KAC1C,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,MAAM;KACR;KAEA,IAAI,OAAO,WAAW,YAAY;MAChC,MAAM,uBAAuB;OAC3B;OACA;OACA,OAAO,QAAQ;OACf,aAAa,OAAO;OACpB;OACA;OACA;MACF,CAAC;MACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAY,IAAI;MAAK,CAAC;KAChD;KAEA,IAAI,OAAO,WAAW,UAAU;MAC9B,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAU,OAAO,OAAO;MAAM,CAAC;KACzD;KAEA,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;MACpD,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU;KAC9C,CAAC;KACD,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,OAAO;KAAW,CAAC;IACpE;GACF,CAAC;GAED,iBAAiB,4DAA4D;IAC3E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;KAEzC,IAAI,MADkB,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC,GACtD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KACzE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;GAED,iBAAiB,yCAAyC;IACxD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAGlC,MAAM,iBAAiB,kBADN,EAAE,IAAI,MAAM,UACmB,CAAC;KAGjD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;KACvD,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK;QAAE,OAAO;QAAa,SAAS;OAAiD,GAAG,GAAG;OAEtG,MAAM,SAAS;QAAE,OAAO,IAAI;QAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;OAAG;OACtF,MAAM,IAAI,QAAQ,iBAAiB,QAAQ,cAAc;OACzD,qBAAqB,MAAM;MAC7B,OAAO;OACL,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;OACrF,YAAY,OAAO,cAAc;MACnC;MACA,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;KAC5B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../src/routes/oauth.ts"],"sourcesContent":["/**\n * Web OAuth sign-in routes for model providers (Settings › Providers).\n *\n * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's\n * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in\n * HTTP routes. Flow state lives in login sessions — the `model-credentials`\n * domain's `oauth_login_sessions` table in tenant mode (any replica can\n * complete/poll), an in-memory store in local mode — so a flow can span\n * requests. Completed credentials are **user-scoped by default**; org admins\n * can start a flow with `{ scope: 'org' }` to share the credential with the\n * whole org. Local mode writes to the file-backed `AuthStorage`.\n *\n * Tokens never leave the server; responses only carry flow metadata (URLs,\n * user codes, poll delays).\n */\n\nimport { randomUUID } from 'node:crypto';\n\nimport { nextPollDelayMs } from '@mastra/code-sdk/auth/device-code';\nimport { completeAnthropicLogin, startAnthropicLogin } from '@mastra/code-sdk/auth/providers/anthropic';\nimport {\n  copilotNextPollDelayMs,\n  pollGitHubCopilotDeviceLogin,\n  startGitHubCopilotDeviceLogin,\n} from '@mastra/code-sdk/auth/providers/github-copilot';\nimport type { CopilotDeviceLoginPending } from '@mastra/code-sdk/auth/providers/github-copilot';\nimport { pollCodexDeviceLogin, startCodexDeviceLogin } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport type { CodexDeviceLoginPending } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport { pollXAIDeviceLogin, startXAIDeviceLogin } from '@mastra/code-sdk/auth/providers/xai';\nimport type { XAIDeviceLoginPending } from '@mastra/code-sdk/auth/providers/xai';\nimport type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { OAuthCredentials } from '@mastra/code-sdk/auth/types';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { LoginCredentialScope, LoginSessionKind, LoginSessionRow } from '../storage/domains/credentials/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport { seedPersonalOmDefaults } from './om-seed.js';\nimport { getAuthProviderId, resolveCredentialContext } from './provider-credentials.js';\nimport type { CredentialContext } from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\n/** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */\nconst PASTE_CODE_TTL_MS = 10 * 60 * 1000;\n\ninterface OAuthFlowStart {\n  url: string;\n  userCode?: string;\n  instructions: string;\n  /** ms epoch after which the flow expires. */\n  expiresAt: number;\n  /** Delay before the first upstream poll (device-code flows only). */\n  nextPollMs?: number;\n  /** Serializable flow state persisted in the login session. */\n  pending: Record<string, unknown>;\n}\n\ntype OAuthFlowPoll =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending?: Record<string, unknown> }\n  | { status: 'failed'; error: string };\n\ninterface OAuthFlow {\n  kind: LoginSessionKind;\n  start(): Promise<OAuthFlowStart>;\n  /** Paste-code flows: exchange the pasted code for credentials. Throws on bad input. */\n  complete?(pending: Record<string, unknown>, code: string): Promise<OAuthCredentials>;\n  /** Device-code flows: perform exactly one upstream poll. */\n  poll?(pending: Record<string, unknown>): Promise<OAuthFlowPoll>;\n}\n\n/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_FLOW_KINDS}). */\nconst OAUTH_FLOWS: Record<string, OAuthFlow> = {\n  anthropic: {\n    kind: 'paste-code',\n    start: async () => {\n      const { url, verifier } = await startAnthropicLogin();\n      return {\n        url,\n        instructions: 'Open the link, authorize, then paste the code shown on the final page.',\n        expiresAt: Date.now() + PASTE_CODE_TTL_MS,\n        pending: { verifier },\n      };\n    },\n    complete: (pending, code) => completeAnthropicLogin(code, String(pending.verifier ?? '')),\n  },\n  openai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startCodexDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: p.intervalMs,\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollCodexDeviceLogin(pending as unknown as CodexDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  'github-copilot': {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startGitHubCopilotDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: copilotNextPollDelayMs(p),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const p = pending as unknown as CopilotDeviceLoginPending;\n      // Web flows are always started against github.com (no Enterprise input).\n      // Never let deserialized session state redirect server-side polling to\n      // an arbitrary hostname.\n      if (p.domain !== 'github.com' || p.enterpriseDomain !== undefined) {\n        return { status: 'failed', error: 'Unsupported GitHub host' };\n      }\n      const r = await pollGitHubCopilotDeviceLogin(p);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  xai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startXAIDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.state.deadlineAt,\n        nextPollMs: nextPollDelayMs(p.state),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollXAIDeviceLogin(pending as unknown as XAIDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n};\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Local-mode login sessions. Flows in local mode are single-process, so a\n * process-local libsql `:memory:` database (which already handles TTL\n * cleanup) is sufficient.\n */\nlet localSessionsPromise: Promise<ModelCredentialsStorage> | undefined;\nfunction localSessions(): Promise<ModelCredentialsStorage> {\n  localSessionsPromise ??= (async () => {\n    const { LibSQLFactoryStorage } = await import('@mastra/libsql');\n    const storage = new LibSQLFactoryStorage({ id: 'local-oauth-sessions', url: ':memory:' });\n    const store = storage.registerDomain(new ModelCredentialsStorage());\n    await storage.init();\n    return store;\n  })();\n  return localSessionsPromise;\n}\nconst LOCAL_TENANT = { orgId: 'local', userId: 'local' } as const;\n\nasync function sessionStore(ctx: CredentialContext): Promise<ModelCredentialsStorage> {\n  return ctx.mode === 'tenant' ? ctx.storage : localSessions();\n}\n\nfunction sessionTenant(ctx: CredentialContext): { orgId: string; userId: string } {\n  return ctx.mode === 'tenant' ? { orgId: ctx.orgId, userId: ctx.userId } : LOCAL_TENANT;\n}\n\n/** Load a session and verify it belongs to the caller + provider (else undefined). */\nasync function loadOwnedSession({\n  ctx,\n  provider,\n  sessionId,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  sessionId: string;\n}): Promise<LoginSessionRow | undefined> {\n  const session = await (await sessionStore(ctx)).getLoginSession(sessionId);\n  if (!session) return undefined;\n  const tenant = sessionTenant(ctx);\n  if (session.orgId !== tenant.orgId || session.userId !== tenant.userId) return undefined;\n  if (session.provider !== provider) return undefined;\n  return session;\n}\n\n/** Persist completed OAuth credentials — user-scoped unless the flow was started org-wide. */\nasync function persistOAuthCredential({\n  ctx,\n  provider,\n  scope,\n  credentials,\n  authStorage,\n  memorySettings,\n  onCredentialsChanged,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  scope: LoginCredentialScope | undefined;\n  credentials: OAuthCredentials;\n  authStorage: AuthStorage | undefined;\n  memorySettings: MemorySettingsStorage | undefined;\n  onCredentialsChanged: (tenant: { orgId: string; userId?: string }) => void;\n}): Promise<void> {\n  const authProviderId = getAuthProviderId(provider);\n  if (ctx.mode === 'tenant') {\n    const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n    await ctx.storage.setCredential(tenant, authProviderId, {\n      type: 'oauth',\n      ...credentials,\n    });\n    onCredentialsChanged(tenant);\n    await seedPersonalOmDefaults({ memorySettings, tenant, provider });\n    return;\n  }\n  if (!authStorage) throw new Error('Credential storage is not available');\n  await authStorage.addAccount(authProviderId, credentials);\n}\n\nasync function readJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = (await c.req.json()) as unknown;\n    return body && typeof body === 'object' ? (body as Record<string, unknown>) : {};\n  } catch {\n    return {};\n  }\n}\n\nexport interface OAuthRoutesDeps extends RouteDependencies {\n  /** File-backed credential store; used in local (no-auth) mode. */\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Personal OM settings; seeded from the login provider after a user-scoped sign-in. */\n  memorySettings?: MemorySettingsStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n}\n\n/**\n * Provider OAuth sign-in routes as Mastra `apiRoutes`:\n *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow\n *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange\n *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll\n *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow\n *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)\n */\nexport class OAuthRoutes extends Route<OAuthRoutesDeps> {\n  routes(): ApiRoute[] {\n    const { auth, authStorage, modelCredentials, memorySettings } = this.deps;\n    const onCredentialsChanged = this.deps.onCredentialsChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers/:provider/oauth/start', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow) {\n            return c.json({ error: 'oauth_not_supported', message: `Provider does not support web sign-in` }, 404);\n          }\n          // Body may carry `{ mode }` for future multi-mode providers; each web\n          // flow currently has exactly one mode, so an unknown mode is rejected.\n          const body = await readJsonBody(loose(c));\n          if (typeof body.mode === 'string' && body.mode !== flow.kind) {\n            return c.json({ error: 'invalid_mode', message: `Unsupported mode for ${provider}: ${body.mode}` }, 400);\n          }\n\n          // Optional `{ scope: 'org' }` shares the completed credential with\n          // the whole org (admin-only, tenant mode). Anything else is personal.\n          const scope: LoginCredentialScope = body.scope === 'org' ? 'org' : 'user';\n          if (scope === 'org' && ctx.mode === 'tenant' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          let started: OAuthFlowStart;\n          try {\n            started = await flow.start();\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 502);\n          }\n\n          const sessionId = randomUUID();\n          const tenant = sessionTenant(ctx);\n          await (\n            await sessionStore(ctx)\n          ).createLoginSession({\n            sessionId,\n            orgId: tenant.orgId,\n            userId: tenant.userId,\n            provider,\n            kind: flow.kind,\n            ...(scope === 'org' && ctx.mode === 'tenant' ? { credentialScope: scope } : {}),\n            pending: started.pending,\n            expiresAt: new Date(started.expiresAt),\n            nextPollAt: started.nextPollMs != null ? new Date(Date.now() + started.nextPollMs) : null,\n          });\n\n          return c.json({\n            sessionId,\n            kind: flow.kind,\n            url: started.url,\n            ...(started.userCode ? { userCode: started.userCode } : {}),\n            instructions: started.instructions,\n            expiresAt: started.expiresAt,\n            ...(started.nextPollMs != null ? { nextPollMs: started.nextPollMs } : {}),\n          });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/complete', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.complete) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          const code = typeof body.code === 'string' ? body.code.trim() : '';\n          if (!sessionId || !code) return c.json({ error: 'Missing required fields: sessionId, code' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'paste-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access at completion time — the\n          // caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'paste-code',\n          });\n          if (!claimed) return c.json({ error: 'oauth_in_progress' }, 409);\n\n          let credentials: OAuthCredentials;\n          try {\n            credentials = await flow.complete(claimed.pending, code);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);\n          }\n\n          await persistOAuthCredential({\n            ctx,\n            provider,\n            scope: session.credentialScope,\n            credentials,\n            authStorage,\n            memorySettings,\n            onCredentialsChanged,\n          });\n          await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ status: 'complete', ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/poll', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.poll) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          if (!sessionId) return c.json({ error: 'Missing required field: sessionId' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'device-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access before the credential write —\n          // the caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          // Server-side rate limit: at most one upstream poll per interval,\n          // regardless of how eagerly the client calls this route.\n          const now = Date.now();\n          const nextPollAt = session.nextPollAt?.getTime();\n          if (nextPollAt != null && now < nextPollAt) {\n            return c.json({ status: 'pending', nextPollMs: nextPollAt - now });\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'device-code',\n          });\n          if (!claimed) return c.json({ status: 'pending', nextPollMs: 250 });\n\n          let result: OAuthFlowPoll;\n          try {\n            result = await flow.poll(claimed.pending);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            throw error;\n          }\n\n          if (result.status === 'complete') {\n            await persistOAuthCredential({\n              ctx,\n              provider,\n              scope: session.credentialScope,\n              credentials: result.credentials,\n              authStorage,\n              memorySettings,\n              onCredentialsChanged,\n            });\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'complete', ok: true });\n          }\n\n          if (result.status === 'failed') {\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'failed', error: result.error });\n          }\n\n          await (\n            await sessionStore(ctx)\n          ).touchLoginSession(sessionId, {\n            ...(result.pending ? { pending: result.pending } : {}),\n            nextPollAt: new Date(now + result.nextPollMs),\n          });\n          return c.json({ status: 'pending', nextPollMs: result.nextPollMs });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/session/:sessionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const sessionId = c.req.param('sessionId');\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (session) await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const authProviderId = getAuthProviderId(provider);\n          // `?scope=org` removes the shared org credential (admin-only);\n          // default removes the caller's personal credential only.\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'forbidden', message: 'Only org admins can remove an org-wide sign-in' }, 403);\n              }\n              const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n              await ctx.storage.removeCredential(tenant, authProviderId);\n              onCredentialsChanged(tenant);\n            } else {\n              if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n              authStorage.logout(authProviderId);\n            }\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAM,oBAAoB,MAAU;;AA6BpC,MAAM,cAAyC;CAC7C,WAAW;EACT,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;GACpD,OAAO;IACL;IACA,cAAc;IACd,WAAW,KAAK,IAAI,IAAI;IACxB,SAAS,EAAE,SAAS;GACtB;EACF;EACA,WAAW,SAAS,SAAS,uBAAuB,MAAM,OAAO,QAAQ,YAAY,EAAE,CAAC;CAC1F;CACA,QAAQ;EACN,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,sBAAsB;GACtC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,EAAE;IACd,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,qBAAqB,OAA6C;GAClF,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;GAAW;GACjF,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,kBAAkB;EAChB,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,8BAA8B;GAC9C,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,uBAAuB,CAAC;IACpC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI;GAIV,IAAI,EAAE,WAAW,gBAAgB,EAAE,qBAAqB,KAAA,GACtD,OAAO;IAAE,QAAQ;IAAU,OAAO;GAA0B;GAE9D,MAAM,IAAI,MAAM,6BAA6B,CAAC;GAC9C,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,KAAK;EACH,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,oBAAoB;GACpC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE,MAAM;IACnB,YAAY,gBAAgB,EAAE,KAAK;IACnC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,mBAAmB,OAA2C;GAC9E,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;AACF;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;AAOA,IAAI;AACJ,SAAS,gBAAkD;CACzD,0BAA0B,YAAY;EACpC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,UAAU,IAAI,qBAAqB;GAAE,IAAI;GAAwB,KAAK;EAAW,CAAC;EACxF,MAAM,QAAQ,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAClE,MAAM,QAAQ,KAAK;EACnB,OAAO;CACT,EAAA,CAAG;CACH,OAAO;AACT;AACA,MAAM,eAAe;CAAE,OAAO;CAAS,QAAQ;AAAQ;AAEvD,eAAe,aAAa,KAA0D;CACpF,OAAO,IAAI,SAAS,WAAW,IAAI,UAAU,cAAc;AAC7D;AAEA,SAAS,cAAc,KAA2D;CAChF,OAAO,IAAI,SAAS,WAAW;EAAE,OAAO,IAAI;EAAO,QAAQ,IAAI;CAAO,IAAI;AAC5E;;AAGA,eAAe,iBAAiB,EAC9B,KACA,UACA,aAKuC;CACvC,MAAM,UAAU,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,gBAAgB,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,SAAS,cAAc,GAAG;CAChC,IAAI,QAAQ,UAAU,OAAO,SAAS,QAAQ,WAAW,OAAO,QAAQ,OAAO,KAAA;CAC/E,IAAI,QAAQ,aAAa,UAAU,OAAO,KAAA;CAC1C,OAAO;AACT;;AAGA,eAAe,uBAAuB,EACpC,KACA,UACA,OACA,aACA,aACA,gBACA,wBASgB;CAChB,MAAM,iBAAiB,kBAAkB,QAAQ;CACjD,IAAI,IAAI,SAAS,UAAU;EACzB,MAAM,SAAS;GAAE,OAAO,IAAI;GAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;EAAG;EACtF,MAAM,IAAI,QAAQ,cAAc,QAAQ,gBAAgB;GACtD,MAAM;GACN,GAAG;EACL,CAAC;EACD,qBAAqB,MAAM;EAC3B,MAAM,uBAAuB;GAAE;GAAgB;GAAQ;EAAS,CAAC;EACjE;CACF;CACA,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qCAAqC;CACvE,MAAM,YAAY,WAAW,gBAAgB,WAAW;AAC1D;AAEA,eAAe,aAAa,GAA8C;CACxE,IAAI;EACF,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK;EAC/B,OAAO,QAAQ,OAAO,SAAS,WAAY,OAAmC,CAAC;CACjF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;;;AAqBA,IAAa,cAAb,cAAiC,MAAuB;CACtD,SAAqB;EACnB,MAAM,EAAE,MAAM,aAAa,kBAAkB,mBAAmB,KAAK;EACrE,MAAM,uBAAuB,KAAK,KAAK,+BAA+B,CAAC;EAEvE,OAAO;GACL,iBAAiB,+CAA+C;IAC9D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;MAAE,OAAO;MAAuB,SAAS;KAAwC,GAAG,GAAG;KAIvG,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,IAAI,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,KAAK,MACtD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAgB,SAAS,wBAAwB,SAAS,IAAI,KAAK;KAAO,GAAG,GAAG;KAKzG,MAAM,QAA8B,KAAK,UAAU,QAAQ,QAAQ;KACnE,IAAI,UAAU,SAAS,IAAI,SAAS,YAAY,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAClG,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,IAAI;KACJ,IAAI;MACF,UAAU,MAAM,KAAK,MAAM;KAC7B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,YAAY,WAAW;KAC7B,MAAM,SAAS,cAAc,GAAG;KAChC,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,mBAAmB;MACnB;MACA,OAAO,OAAO;MACd,QAAQ,OAAO;MACf;MACA,MAAM,KAAK;MACX,GAAI,UAAU,SAAS,IAAI,SAAS,WAAW,EAAE,iBAAiB,MAAM,IAAI,CAAC;MAC7E,SAAS,QAAQ;MACjB,WAAW,IAAI,KAAK,QAAQ,SAAS;MACrC,YAAY,QAAQ,cAAc,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,UAAU,IAAI;KACvF,CAAC;KAED,OAAO,EAAE,KAAK;MACZ;MACA,MAAM,KAAK;MACX,KAAK,QAAQ;MACb,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;MACzD,cAAc,QAAQ;MACtB,WAAW,QAAQ;MACnB,GAAI,QAAQ,cAAc,OAAO,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;KACzE,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,kDAAkD;IACjE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAExE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;KAChE,IAAI,CAAC,aAAa,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;KAEjG,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGrF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAE/D,IAAI;KACJ,IAAI;MACF,cAAc,MAAM,KAAK,SAAS,QAAQ,SAAS,IAAI;KACzD,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,uBAAuB;MAC3B;MACA;MACA,OAAO,QAAQ;MACf;MACA;MACA;MACA;KACF,CAAC;KACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KAC5D,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAY,IAAI;KAAK,CAAC;IAChD;GACF,CAAC;GAED,iBAAiB,8CAA8C;IAC7D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAEpE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,IAAI,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KAEjF,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGtF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAKrG,MAAM,MAAM,KAAK,IAAI;KACrB,MAAM,aAAa,QAAQ,YAAY,QAAQ;KAC/C,IAAI,cAAc,QAAQ,MAAM,YAC9B,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,aAAa;KAAI,CAAC;KAGnE,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY;KAAI,CAAC;KAElE,IAAI;KACJ,IAAI;MACF,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO;KAC1C,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,MAAM;KACR;KAEA,IAAI,OAAO,WAAW,YAAY;MAChC,MAAM,uBAAuB;OAC3B;OACA;OACA,OAAO,QAAQ;OACf,aAAa,OAAO;OACpB;OACA;OACA;MACF,CAAC;MACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAY,IAAI;MAAK,CAAC;KAChD;KAEA,IAAI,OAAO,WAAW,UAAU;MAC9B,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAU,OAAO,OAAO;MAAM,CAAC;KACzD;KAEA,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;MACpD,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU;KAC9C,CAAC;KACD,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,OAAO;KAAW,CAAC;IACpE;GACF,CAAC;GAED,iBAAiB,4DAA4D;IAC3E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;KAEzC,IAAI,MADkB,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC,GACtD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KACzE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;GAED,iBAAiB,yCAAyC;IACxD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAGlC,MAAM,iBAAiB,kBADN,EAAE,IAAI,MAAM,UACmB,CAAC;KAGjD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;KACvD,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK;QAAE,OAAO;QAAa,SAAS;OAAiD,GAAG,GAAG;OAEtG,MAAM,SAAS;QAAE,OAAO,IAAI;QAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;OAAG;OACtF,MAAM,IAAI,QAAQ,iBAAiB,QAAQ,cAAc;OACzD,qBAAqB,MAAM;MAC7B,OAAO;OACL,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;OACrF,YAAY,OAAO,cAAc;MACnC;MACA,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;KAC5B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;EACH;CACF;AACF"}

package/dist/routes/projects.d.ts

@@ -16,6 +16,7 @@ export interface ProjectRoutesDeps extends RouteDependencies {
     resolveRepository?: (input: {
         integrationId: string;
         orgId: string;
+        userId: string;
         installationId: string;
         externalId: string;
         slug: string;

package/dist/routes/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAiInC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,wDAAwD;IACxD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,2EAA2E;IAC3E,aAAa,EAAE,oBAAoB,CAAC;IACpC,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,iBAAiB,CAAA;KAAE,KAAK,IAAI,CAAC;IACpG,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,kFAAkF;IAClF,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AAED,qBAAa,aAAc,SAAQ,KAAK,CAAC,iBAAiB,CAAC;;gBAG7C,IAAI,EAAE,iBAAiB;IA+EnC,MAAM,IAAI,QAAQ,EAAE;CAiRrB"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/routes/projects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EAGrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAiInC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,wDAAwD;IACxD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,2EAA2E;IAC3E,aAAa,EAAE,oBAAoB,CAAC;IACpC,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,iBAAiB,CAAA;KAAE,KAAK,IAAI,CAAC;IACpG,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,kFAAkF;IAClF,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AAED,qBAAa,aAAc,SAAQ,KAAK,CAAC,iBAAiB,CAAC;;gBAG7C,IAAI,EAAE,iBAAiB;IA+EnC,MAAM,IAAI,QAAQ,EAAE;CAkRrB"}

package/dist/routes/projects.js

@@ -398,6 +398,7 @@ var ProjectRoutes = class extends Route {
 					}) : input.repository && this.deps.resolveRepository ? await this.deps.resolveRepository({
 						integrationId: found.connection.integrationId,
 						orgId: tenant.orgId,
+						userId: tenant.userId,
 						installationId: found.connection.installationId,
 						...input.repository
 					}) : null;