@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.1

package/dist/routes/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAuB,MAAM,mCAAmC,CAAC;AAGvG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAwB,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAChH,OAAO,KAAK,EAIV,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQjG,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/D;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,QAAQ,GACR,KAAK,GACL,MAAM,GACN,YAAY,GACZ,aAAa,GACb,YAAY,CAAC;AAEjB,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC,mEAAmE;IACnE,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;CACxD;AAED,yDAAyD;AACzD,UAAU,WAAW;IACnB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;IAC5B,KAAK,EAAE;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAChE,SAAS,EAAE;QAAE,KAAK,EAAE;YAAE,GAAG,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;QAC3B,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC,CAAC;KAChF,CAAC;CACH;AAED,2DAA2D;AAC3D,UAAU,MAAM;IACd,OAAO,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,UAAU,aAAa;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,CAAC,GAAG,EAAE,mBAAmB,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;QAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KACvD,CAAC;IACF,EAAE,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,uFAAuF;AACvF,UAAU,YAAY;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAChC,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CACxG,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAuC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAmFD,yEAAyE;AACzE,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,cAAc,CAAC,CAqC1B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAa3B;AA8DD,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;CACtB;AAaD,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,YAAY,CAU7D;AAmGD,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,sEAAsE;IACtE,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5E,6FAA6F;IAC7F,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAChE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAa,SAAQ,KAAK,CAAC,gBAAgB,CAAC;IACvD,MAAM,IAAI,QAAQ,EAAE;CA0mBrB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAuB,MAAM,mCAAmC,CAAC;AAGvG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAwB,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAChH,OAAO,KAAK,EAIV,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQjG,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/D;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,OAAO,GACP,QAAQ,GACR,KAAK,GACL,MAAM,GACN,YAAY,GACZ,aAAa,GACb,YAAY,CAAC;AAEjB,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,wBAAwB,CAAC;IACjC,mEAAmE;IACnE,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;CACxD;AAED,yDAAyD;AACzD,UAAU,WAAW;IACnB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;IAC5B,KAAK,EAAE;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAChE,SAAS,EAAE;QAAE,KAAK,EAAE;YAAE,GAAG,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;QAC3B,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC,CAAC;KAChF,CAAC;CACH;AAED,2DAA2D;AAC3D,UAAU,MAAM;IACd,OAAO,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,UAAU,aAAa;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,CAAC,GAAG,EAAE,mBAAmB,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;QAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KACvD,CAAC;IACF,EAAE,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,uFAAuF;AACvF,UAAU,YAAY;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAChC,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CACxG,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAuC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAmFD,yEAAyE;AACzE,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,cAAc,CAAC,CAqC1B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,EAAE;IACD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAa3B;AA8DD,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,YAAY,CAAC;CACtB;AAaD,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,YAAY,CAU7D;AAmGD,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,UAAU,EAAE,YAAY,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,sEAAsE;IACtE,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5E,6FAA6F;IAC7F,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAChE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAa,SAAQ,KAAK,CAAC,gBAAgB,CAAC;IACvD,MAAM,IAAI,QAAQ,EAAE;CAinBrB"}

package/dist/routes/config.js

@@ -799,7 +799,7 @@ var ConfigRoutes = class extends Route {
             const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });
             if (!resourceId) return c.json({ config: readStoredOMConfig(record) });
             const session = await controller.getSessionByResource?.(resourceId, scope);
-            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            if (!session) return c.json({ config: readStoredOMConfig(record) });
             await hydrateSessionMemorySettings(session, record);
             return c.json({ config: readOMConfig(session) });
           } catch (error) {
@@ -833,7 +833,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             const otherRole = session ? role === "observer" ? session.om.reflector : session.om.observer : void 0;
             const otherRoleCurrentModelId = otherRole?.modelId() ?? null;
             await session?.om[role].switchModel({ modelId });
@@ -875,7 +874,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (observation !== void 0 && session) {
               await session.state.set({ observationThreshold: observation });
               await session.thread.setSetting({ key: "observationThreshold", value: observation });
@@ -920,7 +918,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (session) {
               await session.state.set({ observeAttachments: value });
               await session.thread.setSetting({ key: "observeAttachments", value });

package/dist/routes/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/routes/config.ts","../../src/routes/provider-credentials.ts","../../src/routes/route.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport { DEFAULT_OM_MODEL_ID } from '@mastra/code-sdk/constants';\nimport { getAvailableModePacks } from '@mastra/code-sdk/onboarding/packs';\nimport type { ModePack, ProviderAccess, ProviderAccessLevel } from '@mastra/code-sdk/onboarding/packs';\nimport { getCustomProviderId, THREAD_ACTIVE_MODEL_PACK_ID_KEY } from '@mastra/code-sdk/onboarding/settings';\nimport type { CustomProviderSetting } from '@mastra/code-sdk/onboarding/settings';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { Context } from 'hono';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { CustomProviderRecord, CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type {\n  MemorySettingsFillIfUnset,\n  MemorySettingsPatch,\n  MemorySettingsRecord,\n  MemorySettingsStorage,\n} from '../storage/domains/memory-settings/base.js';\nimport type { ModelPackRecord, ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport {\n  getAuthProviderId,\n  listTenantCredentialsForRequest,\n  resolveCredentialContext,\n  tenantOrgId,\n  WEB_OAUTH_FLOW_KINDS,\n} from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteAuth, RouteDependencies } from './route.js';\n\n/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Server-side configuration routes for the web app.\n *\n * The browser has no access to the credential store or the model catalog, so\n * the web settings panel asks the server — which owns both — to list providers\n * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the\n * same `AuthStorage`-backed key management over HTTP.\n *\n * Keys are never returned to the client; only their presence and source.\n */\n\n/**\n * Where a provider's active credential comes from, as seen by the caller.\n * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode\n * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).\n */\nexport type ProviderCredentialSource =\n  | 'oauth'\n  | 'stored'\n  | 'env'\n  | 'none'\n  | 'oauth-user'\n  | 'stored-user'\n  | 'stored-org';\n\n/** A model provider with the current source of its credentials. */\nexport interface ProviderInfo {\n  provider: string;\n  /** Env var the provider's key is read from, if any. */\n  envVar?: string;\n  /** Where the active credential comes from. */\n  source: ProviderCredentialSource;\n  /** Web OAuth sign-in capability, when the provider supports it. */\n  oauth?: { supported: true; modes: LoginSessionKind[] };\n}\n\n/** Minimal session surface a pack activation touches. */\ninterface PackSession {\n  mode: { get: () => string };\n  model: { switch: (args: { modelId: string }) => Promise<void> };\n  subagents: { model: { set: (args: { modelId: string; agentType: string }) => Promise<void> } };\n  thread: {\n    getId: () => string | null;\n    setSetting: (args: { key: string; value: unknown }) => Promise<void>;\n    list: () => Promise<Array<{ id: string; metadata?: Record<string, unknown> }>>;\n  };\n}\n\n/** One observational-memory role's read/switch surface. */\ninterface OMRole {\n  modelId: () => string | undefined;\n  threshold: () => number | undefined;\n  switchModel: (args: { modelId: string }) => Promise<void>;\n}\n\n/**\n * Session-state fields the OM config routes write. The index signatures mirror\n * `MastraCodeState` so the concrete `Session.state.set(Partial<MastraCodeState>)`\n * stays assignable to this minimal surface (contravariant parameter check).\n */\ninterface OMStateWrites {\n  [key: string]: unknown;\n  [key: `subagentModelId_${string}`]: string | undefined;\n  observationThreshold?: number;\n  reflectionThreshold?: number;\n  observeAttachments?: 'auto' | boolean;\n}\n\n/** Minimal session surface the OM config routes touch. */\nexport interface OMSession extends PackSession {\n  state: {\n    get: () => Record<string, unknown> | undefined;\n    set: (updates: OMStateWrites) => Promise<void> | void;\n  };\n  om: { observer: OMRole; reflector: OMRole };\n}\n\n/** Minimal controller surface this module needs (model catalog + modes + sessions). */\ninterface ModelCatalog {\n  listAvailableModels: () => Promise<\n    Array<{ id?: string; modelName?: string; provider: string; hasApiKey: boolean; apiKeyEnvVar?: string }>\n  >;\n  listModes?: () => Array<{ id: string; defaultModelId?: string }>;\n  getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;\n}\n\n/**\n * Build a deduplicated, sorted list of providers from the model catalog,\n * annotated with where each provider's credential currently comes from.\n * Mirrors the TUI's `/api-keys` provider list.\n *\n * When `tenantCredentials` is given (deployed mode), sources reflect the\n * *caller's* tenant rows with user > org precedence and the server-global\n * `authStorage` is ignored; otherwise the local `auth.json` view is reported.\n */\nexport async function listProviders({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderInfo[]> {\n  const models = await controller.listAvailableModels();\n  const seen = new Map<string, ProviderInfo>();\n\n  for (const model of models) {\n    if (seen.has(model.provider)) continue;\n\n    const authProviderId = getAuthProviderId(model.provider);\n    let source: ProviderInfo['source'] = 'none';\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      if (userRec?.credential.type === 'oauth') {\n        source = 'oauth-user';\n      } else if (userRec?.credential.type === 'api_key') {\n        source = 'stored-user';\n      } else if (orgRec?.credential.type === 'api_key') {\n        source = 'stored-org';\n      }\n    } else if (authStorage?.isLoggedIn(authProviderId)) {\n      source = 'oauth';\n    } else if (authStorage?.hasStoredApiKey(model.provider)) {\n      source = 'stored';\n    } else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) {\n      source = 'env';\n    } else if (model.hasApiKey) {\n      source = 'env';\n    }\n\n    const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];\n    seen.set(model.provider, {\n      provider: model.provider,\n      envVar: model.apiKeyEnvVar,\n      source,\n      ...(flowKind ? { oauth: { supported: true as const, modes: [flowKind] } } : {}),\n    });\n  }\n\n  return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));\n}\n\n/** A user-defined OpenAI-compatible provider, with key presence (never the key). */\nexport interface CustomProviderInfo {\n  id: string;\n  name: string;\n  url: string;\n  hasApiKey: boolean;\n  models: string[];\n}\n\n/** Redact a stored custom-provider row for the client (key presence only). */\nfunction toCustomProviderInfo(record: CustomProviderRecord): CustomProviderInfo {\n  return {\n    id: record.providerId,\n    name: record.name,\n    url: record.url,\n    hasApiKey: Boolean(record.apiKey),\n    models: record.models,\n  };\n}\n\n/** The resolved custom-providers storage scope for a request. */\ninterface CustomProvidersContext {\n  storage: CustomProvidersStorage;\n  orgId: string;\n  userId: string;\n}\n\n/**\n * Resolve the custom-providers context for a request, or a ready-to-return\n * error response. Same posture as memory settings: tenant rows in deployed\n * mode, a sentinel `local` org in no-auth mode — never settings.json.\n */\nasync function resolveCustomProvidersContext({\n  c,\n  auth,\n  customProviders,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  customProviders?: CustomProvidersStorage;\n}): Promise<CustomProvidersContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (customProviders) {\n    try {\n      await customProviders.ensureReady();\n      return tenant\n        ? { storage: customProviders, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: customProviders, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'custom_providers_unavailable',\n        message: 'Custom provider storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Validate + coerce a request body into a CustomProviderSetting. */\nfunction parseCustomProviderBody(body: unknown): CustomProviderSetting | { error: string } {\n  if (!body || typeof body !== 'object') return { error: 'Invalid JSON body' };\n  const b = body as Record<string, unknown>;\n  const name = typeof b.name === 'string' ? b.name.trim() : '';\n  if (!name) return { error: 'Missing required field: name' };\n  const url = typeof b.url === 'string' ? b.url.trim() : '';\n  if (!url) return { error: 'Missing required field: url' };\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n      return { error: 'url must be an http(s) URL' };\n    }\n  } catch {\n    return { error: 'url must be a valid URL' };\n  }\n  const apiKey = typeof b.apiKey === 'string' && b.apiKey.trim() ? b.apiKey.trim() : undefined;\n  const models = Array.isArray(b.models)\n    ? b.models.filter((m): m is string => typeof m === 'string' && m.trim().length > 0).map(m => m.trim())\n    : [];\n  return { name, url, apiKey, models };\n}\n\n// ── Model packs ──────────────────────────────────────────────────────────\n\n/** A model pack as surfaced to the web client, with an `active` flag. */\nexport interface ModelPackInfo extends ModePack {\n  custom: boolean;\n  active: boolean;\n}\n\n/**\n * Compute which providers the user can reach, mirroring the TUI's\n * `/models-pack` access derivation: OAuth/api-key from the credential store for\n * the named providers, plus any other provider that has a usable key.\n */\nexport async function buildProviderAccess({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderAccess> {\n  const models = await controller.listAvailableModels();\n  const hasModelKey = (provider: string) => models.some(m => m.provider === provider && m.hasApiKey);\n  const accessLevel = (provider: string): ProviderAccessLevel => {\n    const authProviderId = getAuthProviderId(provider);\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      const credential = userRec?.credential ?? orgRec?.credential;\n      if (credential?.type === 'oauth') return 'oauth';\n      if (credential?.type === 'api_key' && credential.key.trim().length > 0) return 'apikey';\n      return false;\n    }\n\n    const oauthCredential = authStorage?.get(authProviderId);\n    if (oauthCredential?.type === 'oauth') return 'oauth';\n    if (authStorage?.hasStoredApiKey(provider)) return 'apikey';\n    const directCredential = authStorage?.get(provider);\n    if (directCredential?.type === 'api_key' && directCredential.key.trim().length > 0) return 'apikey';\n    return hasModelKey(provider) ? 'apikey' : false;\n  };\n  const access: ProviderAccess = {\n    anthropic: accessLevel('anthropic'),\n    openai: accessLevel('openai'),\n    cerebras: accessLevel('cerebras'),\n    google: accessLevel('google'),\n    deepseek: accessLevel('deepseek'),\n    'github-copilot': accessLevel('github-copilot'),\n  };\n  const seen = new Set(Object.keys(access));\n  for (const m of models) {\n    if (!seen.has(m.provider)) {\n      access[m.provider] = accessLevel(m.provider);\n      seen.add(m.provider);\n    }\n  }\n  return access;\n}\n\nfunction canUseModelProvider(access: ProviderAccess, provider: string): boolean {\n  return Boolean(access[provider]);\n}\n\n/**\n * Where a request's custom model packs live. Same posture as memory settings\n * and custom providers: the `model-packs` factory storage domain, scoped per\n * org in deployed mode and to a sentinel `local` org in no-auth mode — never\n * settings.json.\n */\nexport interface PackContext {\n  storage: ModelPacksStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the pack context for a request, or a ready-to-return error response. */\nasync function resolvePackContext({\n  c,\n  auth,\n  modelPacks,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  modelPacks?: ModelPacksStorage;\n}): Promise<PackContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (modelPacks) {\n    try {\n      await modelPacks.ensureReady();\n      return tenant\n        ? { storage: modelPacks, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: modelPacks, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'model_packs_unavailable',\n        message: 'Model pack storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** DB row → the `ModePack` shape the packs list and activation flow consume. */\nfunction recordToModePack(record: ModelPackRecord): ModePack {\n  return { id: `custom:${record.id}`, name: record.name, description: 'Saved custom pack', models: record.models };\n}\n\n/**\n * List available model packs (built-in, gated by provider access, plus saved\n * custom packs from the request's pack context). Drops the synthetic\n * \"New Custom\" placeholder — the web client has its own create flow. `active`\n * is set from the given session's thread when a resourceId is supplied.\n */\nexport async function listModelPacks({\n  controller,\n  authStorage,\n  tenantCredentials,\n  packContext,\n  activePackId,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n  packContext: PackContext;\n  activePackId?: string | null;\n}): Promise<ModelPackInfo[]> {\n  const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });\n  const packs = [\n    ...getAvailableModePacks(access),\n    ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack),\n  ];\n  return packs\n    .filter(p => p.id !== 'custom') // synthetic \"choose each model\" placeholder\n    .map(p => ({\n      ...p,\n      custom: p.id.startsWith('custom:'),\n      active: activePackId != null && p.id === activePackId,\n    }));\n}\n\n/** Resolve the active pack id for a session by reading its current thread. */\nasync function resolveActivePackId(session: PackSession | undefined): Promise<string | null> {\n  if (!session) return null;\n  const threadId = session.thread.getId();\n  if (!threadId) return null;\n  const thread = (await session.thread.list()).find(t => t.id === threadId);\n  const value = thread?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];\n  return typeof value === 'string' ? value : null;\n}\n\n/**\n * Apply a pack to a session: seed each mode's default model, switch the current\n * mode's model, set per-subagent models, and tag the thread with the active\n * pack id. Mirrors the TUI `applyPack` orchestration.\n */\nasync function applyPackToSession({\n  controller,\n  session,\n  pack,\n}: {\n  controller: ModelCatalog;\n  session: PackSession;\n  pack: ModePack;\n}): Promise<void> {\n  const modes = controller.listModes?.() ?? [];\n  const packModels = pack.models as Record<string, string>;\n\n  for (const mode of modes) {\n    const modelId = packModels[mode.id];\n    if (modelId) {\n      mode.defaultModelId = modelId;\n      await session.thread.setSetting({ key: `modeModelId_${mode.id}`, value: modelId });\n    }\n  }\n\n  const currentModeModel = packModels[session.mode.get()];\n  if (currentModeModel) {\n    await session.model.switch({ modelId: currentModeModel });\n  }\n\n  const subagentModeMap: Record<string, string> = { explore: 'fast', plan: 'plan', execute: 'build' };\n  for (const [agentType, modeId] of Object.entries(subagentModeMap)) {\n    const saModelId = packModels[modeId];\n    if (saModelId) {\n      await session.subagents.model.set({ modelId: saModelId, agentType });\n    }\n  }\n\n  await session.thread.setSetting({ key: THREAD_ACTIVE_MODEL_PACK_ID_KEY, value: pack.id });\n}\n\n// ── Observational memory ────────────────────────────────────────────────────\n// Mirrors the TUI `/om` command. Settings are persisted per organization and\n// user in the Factory app database. Requests with an active session also apply\n// changes immediately to that session's state and thread settings.\n\n/** Default thresholds mirror the TUI `/om` fallbacks. */\nconst DEFAULT_OBSERVATION_THRESHOLD = 30_000;\nconst DEFAULT_REFLECTION_THRESHOLD = 40_000;\n\n/** Read the current OM config from a session. */\nexport interface OMConfigInfo {\n  observerModelId: string;\n  reflectorModelId: string;\n  observationThreshold: number;\n  reflectionThreshold: number;\n  observeAttachments: 'auto' | boolean;\n}\n\nexport interface ProviderOMDefaultsResponse {\n  ok: true;\n  config: OMConfigInfo;\n}\n\nfunction providerOMModelId(providerId: string, factoryModelId: string): string {\n  switch (providerId) {\n    case 'anthropic':\n      return 'anthropic/claude-haiku-4-5';\n    case 'openai':\n      return 'openai/gpt-5.4-mini';\n    default:\n      return factoryModelId || DEFAULT_OM_MODEL_ID;\n  }\n}\n\nexport function readOMConfig(session: OMSession): OMConfigInfo {\n  const state = session.state.get() ?? {};\n  const observeAttachments = state.observeAttachments;\n  return {\n    observerModelId: session.om.observer.modelId() ?? '',\n    reflectorModelId: session.om.reflector.modelId() ?? '',\n    observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : 'auto',\n  };\n}\n\nfunction readStoredOMConfig(record: MemorySettingsRecord | null): OMConfigInfo {\n  return {\n    observerModelId: record?.observerModelId ?? DEFAULT_OM_MODEL_ID,\n    reflectorModelId: record?.reflectorModelId ?? DEFAULT_OM_MODEL_ID,\n    observationThreshold: record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: record?.observeAttachments ?? 'auto',\n  };\n}\n\n/**\n * Where a request's OM settings live: the `memory-settings` factory storage\n * domain, one row per (org, user). Without a tenant (auth disabled), settings\n * land on a sentinel `(local, local)` row in the same table — the web surface\n * never reads or writes `settings.json` for memory settings.\n */\ninterface MemorySettingsContext {\n  storage: MemorySettingsStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the memory-settings context for a request, or a ready-to-return error response. */\nasync function resolveMemorySettingsContext({\n  c,\n  auth,\n  memorySettings,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  memorySettings?: MemorySettingsStorage;\n}): Promise<MemorySettingsContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (memorySettings) {\n    try {\n      await memorySettings.ensureReady();\n      return tenant\n        ? { storage: memorySettings, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: memorySettings, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'memory_settings_unavailable',\n        message: 'Memory settings storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Persist an OM knob change to the caller's memory-settings row. */\nasync function persistMemorySettings(\n  context: MemorySettingsContext,\n  patch: MemorySettingsPatch,\n  fillIfUnset?: MemorySettingsFillIfUnset,\n): Promise<void> {\n  await context.storage.patch({ orgId: context.orgId, userId: context.userId, patch, fillIfUnset });\n}\n\n/**\n * Apply the stored memory-settings row onto the session, so the DB — not\n * whatever happens to sit in persisted session state (e.g. a stale boot-time\n * seed from before memory settings moved to the DB) — is what the web surface\n * reads and what the session's OM actually runs with. The row is authoritative:\n * knobs without a stored value reset to the built-in defaults.\n */\nasync function hydrateSessionMemorySettings(session: OMSession, record: MemorySettingsRecord | null): Promise<void> {\n  for (const role of ['observer', 'reflector'] as const) {\n    const stored = role === 'observer' ? record?.observerModelId : record?.reflectorModelId;\n    const target = stored ?? DEFAULT_OM_MODEL_ID;\n    if (session.om[role].modelId() !== target) {\n      await session.om[role].switchModel({ modelId: target });\n    }\n  }\n  const state = session.state.get() ?? {};\n  const updates: OMStateWrites = {};\n  const observationThreshold = record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD;\n  if (state.observationThreshold !== observationThreshold) {\n    updates.observationThreshold = observationThreshold;\n  }\n  const reflectionThreshold = record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD;\n  if (state.reflectionThreshold !== reflectionThreshold) {\n    updates.reflectionThreshold = reflectionThreshold;\n  }\n  const observeAttachments = record?.observeAttachments ?? 'auto';\n  if ((state.observeAttachments ?? 'auto') !== observeAttachments) {\n    updates.observeAttachments = observeAttachments;\n  }\n  if (Object.keys(updates).length > 0) await session.state.set(updates);\n}\n\n/** Dependencies injected into {@link ConfigRoutes}. */\nexport interface ConfigRoutesDeps extends RouteDependencies {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Tenant model-packs domain handle; absent in local (no-DB) mode. */\n  modelPacks?: ModelPacksStorage;\n  /** Tenant memory-settings domain handle; absent in local (no-DB) mode. */\n  memorySettings?: MemorySettingsStorage;\n  /** Custom-providers domain handle; absent when the app database is missing. */\n  customProviders?: CustomProvidersStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n  /** Notifies the host after custom providers change so model-router caches can be dropped. */\n  onCustomProvidersChanged?: (tenant: { orgId: string }) => void;\n}\n\n/**\n * The web config routes as Mastra `apiRoutes`:\n *   - `GET    /web/config/providers`              — list providers + key source\n *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key\n *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key\n *   - `GET    /web/config/models`                  — list available models (credentialed providers)\n *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers\n *   - `POST   /web/config/custom-providers`        — create/update a custom provider\n *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider\n *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments\n *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model\n *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds\n *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)\n */\nexport class ConfigRoutes extends Route<ConfigRoutesDeps> {\n  routes(): ApiRoute[] {\n    const options = this.deps;\n    const { controller, authStorage, auth } = options;\n    const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});\n    const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            // Tenant mode lists the caller's rows and never exposes the\n            // server-global auth.json; local mode is unchanged.\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              providers: await listProviders({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          let body: { key?: unknown; envVar?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const key = typeof body.key === 'string' ? body.key.trim() : '';\n          if (!key) return c.json({ error: 'Missing required field: key' }, 400);\n          const envVar = typeof body.envVar === 'string' ? body.envVar : undefined;\n          const scope = body.scope === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              // envVar is intentionally ignored: tenant credentials are resolved\n              // per-request, never written into process.env.\n              await ctx.storage.setCredential(tenant, getAuthProviderId(provider), { type: 'api_key', key });\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            // Local mode is single-user: scope is meaningless and ignored.\n            authStorage.setStoredApiKey(provider, key, envVar);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            authStorage.remove(`apikey:${provider}`);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────\n      // Mirrors the TUI's /custom-providers command, but backed by the\n      // `custom-providers` domain (org rows in tenant mode, a sentinel `local`\n      // org in no-auth mode) — the server never reads settings.json for these.\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          try {\n            const records = await ctx.storage.list({ orgId: ctx.orgId });\n            return c.json({ providers: records.map(toCustomProviderInfo) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const parsed = parseCustomProviderBody(body);\n          if ('error' in parsed) return c.json({ error: parsed.error }, 400);\n          // `previousId` lets a rename remove the old entry as well as any name clash.\n          const previousId =\n            body && typeof body === 'object' && typeof (body as Record<string, unknown>).previousId === 'string'\n              ? ((body as Record<string, unknown>).previousId as string)\n              : undefined;\n          try {\n            const record = await ctx.storage.upsert({\n              orgId: ctx.orgId,\n              userId: ctx.userId,\n              input: {\n                providerId: getCustomProviderId(parsed.name),\n                name: parsed.name,\n                url: parsed.url,\n                apiKey: parsed.apiKey,\n                models: parsed.models,\n              },\n              previousProviderId: previousId,\n            });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true, provider: toCustomProviderInfo(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          const id = c.req.param('id');\n          try {\n            await ctx.storage.delete({ orgId: ctx.orgId, providerId: id });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Available models ────────────────────────────────────────────────────\n      // Session-independent model catalog for settings pickers (Factory default\n      // model, pack editors). Only models whose provider has a credential are\n      // returned — the same filter the session-scoped hook applies client-side.\n\n      registerApiRoute('/web/config/models', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const [models, access] = await Promise.all([\n              controller.listAvailableModels(),\n              buildProviderAccess({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            ]);\n            const catalog = models\n              .filter(m => canUseModelProvider(access, m.provider) && typeof m.id === 'string')\n              .map(m => ({ id: m.id!, provider: m.provider, modelName: m.modelName, hasApiKey: true }));\n            // Append the caller's custom provider models (DB-backed, org rows in\n            // tenant mode / sentinel `local` org in no-auth mode). The boot-time\n            // gateway catalog only carries the local list, so tenant callers get\n            // theirs here. Dedupe against ids already present.\n            if (options.customProviders) {\n              try {\n                const ctx = await resolveCustomProvidersContext({\n                  c: loose(c),\n                  auth,\n                  customProviders: options.customProviders,\n                });\n                if (!('response' in ctx)) {\n                  const known = new Set(catalog.map(m => m.id));\n                  for (const record of await ctx.storage.list({ orgId: ctx.orgId })) {\n                    for (const model of record.models) {\n                      const id = `${record.providerId}/${model}`;\n                      if (known.has(id)) continue;\n                      known.add(id);\n                      catalog.push({ id, provider: record.providerId, modelName: model, hasApiKey: true });\n                    }\n                  }\n                }\n              } catch {\n                // Fail soft: the catalog still serves the built-in models.\n              }\n            }\n            return c.json({\n              models: catalog.sort((a, b) =>\n                a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider),\n              ),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Model packs ─────────────────────────────────────────────────────────\n      // Mirrors the TUI's /models-pack command. Custom-pack CRUD lives in the\n      // model-packs storage domain (org-scoped, sentinel `local` org in no-auth\n      // mode — never settings.json); activation is session-scoped and resolves\n      // the session from the controller registry by resourceId.\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const activePackId = await resolveActivePackId(session);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              packs: await listModelPacks({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n                packContext,\n                activePackId,\n              }),\n              activePackId,\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          let body: { name?: unknown; models?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const name = typeof body.name === 'string' ? body.name.trim() : '';\n          if (!name) return c.json({ error: 'Missing required field: name' }, 400);\n          const m = (body.models ?? {}) as Record<string, unknown>;\n          const build = typeof m.build === 'string' ? m.build.trim() : '';\n          const plan = typeof m.plan === 'string' ? m.plan.trim() : '';\n          const fast = typeof m.fast === 'string' ? m.fast.trim() : '';\n          if (!build || !plan || !fast) {\n            return c.json({ error: 'models.build, models.plan and models.fast are required' }, 400);\n          }\n          try {\n            const record = await packContext.storage.upsert({\n              orgId: packContext.orgId,\n              userId: packContext.userId,\n              input: { name, models: { build, plan, fast } },\n            });\n            return c.json({ ok: true, pack: recordToModePack(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          try {\n            const recordId = id.startsWith('custom:') ? id.slice('custom:'.length) : id;\n            const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });\n            return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack \"${id}\"` }, 404);\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id/activate', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          let body: { resourceId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const packs = await listModelPacks({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n              packContext,\n            });\n            const pack = packs.find(p => p.id === id);\n            if (!pack) return c.json({ error: `Unknown pack \"${id}\"` }, 404);\n            await applyPackToSession({ controller, session, pack });\n            return c.json({ ok: true, activePackId: pack.id });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/provider-defaults', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { providerId?: unknown; factoryModelId?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const providerId = typeof body.providerId === 'string' ? body.providerId.trim() : '';\n          const factoryModelId = typeof body.factoryModelId === 'string' ? body.factoryModelId.trim() : '';\n          if (!providerId) return c.json({ error: 'Missing required field: providerId' }, 400);\n\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const access = await buildProviderAccess({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n            });\n            if (!access[providerId]) return c.json({ error: `Provider \"${providerId}\" is not configured` }, 400);\n\n            const modelId = providerOMModelId(providerId, factoryModelId);\n            const record = await context.storage.patch({\n              orgId: context.orgId,\n              userId: context.userId,\n              patch: {},\n              fillIfUnset: { observerModelId: modelId, reflectorModelId: modelId },\n            });\n            return c.json({ ok: true, config: readStoredOMConfig(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Observational memory ──────────────────────────────────────────────────\n      // Mirrors the TUI's /om command. All five knobs are durably stored in the\n      // per-(org, user) `memory-settings` app table — never settings.json. When a\n      // session is supplied, changes are also applied to its state and thread.\n\n      registerApiRoute('/web/config/om', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });\n            if (!resourceId) return c.json({ config: readStoredOMConfig(record) });\n\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            await hydrateSessionMemorySettings(session, record);\n            return c.json({ config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/:role/model', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const role = c.req.param('role');\n          if (role !== 'observer' && role !== 'reflector') {\n            return c.json({ error: `Unknown OM role \"${role}\"` }, 400);\n          }\n          let body: { resourceId?: unknown; modelId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const modelId = typeof body.modelId === 'string' ? body.modelId.trim() : '';\n          if (!modelId) return c.json({ error: 'Missing required field: modelId' }, 400);\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (resourceId && !session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const otherRole = session ? (role === 'observer' ? session.om.reflector : session.om.observer) : undefined;\n            const otherRoleCurrentModelId = otherRole?.modelId() ?? null;\n            await session?.om[role].switchModel({ modelId });\n            // Pin the other role's current model too, so a later restart\n            // doesn't drift it once this role is explicitly overridden. The\n            // \"only if still unset\" check runs inside the storage layer's\n            // atomic update, so a concurrent explicit switch of the other\n            // role is never clobbered by this fill.\n            const otherKey = role === 'observer' ? 'reflectorModelId' : 'observerModelId';\n            await persistMemorySettings(\n              context,\n              { [role === 'observer' ? 'observerModelId' : 'reflectorModelId']: modelId },\n              otherRoleCurrentModelId ? { [otherKey]: otherRoleCurrentModelId } : undefined,\n            );\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/thresholds', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: {\n            resourceId?: unknown;\n            observationThreshold?: unknown;\n            reflectionThreshold?: unknown;\n            scope?: unknown;\n          };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const observation =\n            typeof body.observationThreshold === 'number' && body.observationThreshold > 0\n              ? Math.round(body.observationThreshold)\n              : undefined;\n          const reflection =\n            typeof body.reflectionThreshold === 'number' && body.reflectionThreshold > 0\n              ? Math.round(body.reflectionThreshold)\n              : undefined;\n          if (observation === undefined && reflection === undefined) {\n            return c.json({ error: 'Provide observationThreshold and/or reflectionThreshold (positive numbers)' }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (resourceId && !session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            if (observation !== undefined && session) {\n              await session.state.set({ observationThreshold: observation });\n              await session.thread.setSetting({ key: 'observationThreshold', value: observation });\n            }\n            if (reflection !== undefined && session) {\n              await session.state.set({ reflectionThreshold: reflection });\n              await session.thread.setSetting({ key: 'reflectionThreshold', value: reflection });\n            }\n            await persistMemorySettings(context, {\n              ...(observation !== undefined ? { observationThreshold: observation } : {}),\n              ...(reflection !== undefined ? { reflectionThreshold: reflection } : {}),\n            });\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/observe-attachments', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { resourceId?: unknown; value?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const raw = body.value;\n          const value: 'auto' | boolean = raw === 'auto' || raw === true || raw === false ? raw : 'auto';\n          if (raw !== 'auto' && raw !== true && raw !== false) {\n            return c.json({ error: \"value must be 'auto', true, or false\" }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (resourceId && !session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            if (session) {\n              await session.state.set({ observeAttachments: value });\n              await session.thread.setSetting({ key: 'observeAttachments', value });\n            }\n            await persistMemorySettings(context, { observeAttachments: value });\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n","/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  | { mode: 'local' }\n  | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AACA,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,qBAAqB,uCAAuC;AAGrE,SAAS,wBAAwB;;;ACuB1B,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,aAAa,WAAW,iBAAiB;AAClD;AAQO,IAAM,uBAAmE;AAAA,EAC9E,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,KAAK;AACP;AAWA,eAAsB,4BACpB,aAC8C;AAC9C,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,YAAY,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;AAOA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF,GAKwD;AACtD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,QAAQ;AAIX,QAAI,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC9E,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,QACV;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO;AACtF;AASA,eAAsB,gCAAgC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACF,GAK4C;AAC1C,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,OAAQ,QAAO,KAAK,QAAQ,IAAI,CAAC,IAAI;AAC1C,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,SAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE;;;ACjGO,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;AFjBA,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AAiGA,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,OAAO,oBAAI,IAA0B;AAE3C,aAAW,SAAS,QAAQ;AAC1B,QAAI,KAAK,IAAI,MAAM,QAAQ,EAAG;AAE9B,UAAM,iBAAiB,kBAAkB,MAAM,QAAQ;AACvD,QAAI,SAAiC;AACrC,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,UAAI,SAAS,WAAW,SAAS,SAAS;AACxC,iBAAS;AAAA,MACX,WAAW,SAAS,WAAW,SAAS,WAAW;AACjD,iBAAS;AAAA,MACX,WAAW,QAAQ,WAAW,SAAS,WAAW;AAChD,iBAAS;AAAA,MACX;AAAA,IACF,WAAW,aAAa,WAAW,cAAc,GAAG;AAClD,eAAS;AAAA,IACX,WAAW,aAAa,gBAAgB,MAAM,QAAQ,GAAG;AACvD,eAAS;AAAA,IACX,WAAW,MAAM,gBAAgB,QAAQ,IAAI,MAAM,YAAY,GAAG;AAChE,eAAS;AAAA,IACX,WAAW,MAAM,WAAW;AAC1B,eAAS;AAAA,IACX;AAEA,UAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,SAAK,IAAI,MAAM,UAAU;AAAA,MACvB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,GAAI,WAAW,EAAE,OAAO,EAAE,WAAW,MAAe,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtF;AAYA,SAAS,qBAAqB,QAAkD;AAC9E,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,WAAW,QAAQ,OAAO,MAAM;AAAA,IAChC,QAAQ,OAAO;AAAA,EACjB;AACF;AAcA,eAAe,8BAA8B;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AACF,GAI6D;AAC3D,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,gBAAgB,YAAY;AAClC,aAAO,SACH,EAAE,SAAS,iBAAiB,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IAC9E,EAAE,SAAS,iBAAiB,OAAO,SAAS,QAAQ,QAAQ;AAAA,IAClE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,wBAAwB,MAA0D;AACzF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,OAAO,oBAAoB;AAC3E,QAAM,IAAI;AACV,QAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,+BAA+B;AAC1D,QAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,IAAI,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,EAAE,OAAO,8BAA8B;AACxD,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,aAAO,EAAE,OAAO,6BAA6B;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,0BAA0B;AAAA,EAC5C;AACA,QAAM,SAAS,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,KAAK,IAAI;AACnF,QAAM,SAAS,MAAM,QAAQ,EAAE,MAAM,IACjC,EAAE,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,IACnG,CAAC;AACL,SAAO,EAAE,MAAM,KAAK,QAAQ,OAAO;AACrC;AAeA,eAAsB,oBAAoB;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,cAAc,CAAC,aAAqB,OAAO,KAAK,OAAK,EAAE,aAAa,YAAY,EAAE,SAAS;AACjG,QAAM,cAAc,CAAC,aAA0C;AAC7D,UAAM,iBAAiB,kBAAkB,QAAQ;AACjD,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,YAAM,aAAa,SAAS,cAAc,QAAQ;AAClD,UAAI,YAAY,SAAS,QAAS,QAAO;AACzC,UAAI,YAAY,SAAS,aAAa,WAAW,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC/E,aAAO;AAAA,IACT;AAEA,UAAM,kBAAkB,aAAa,IAAI,cAAc;AACvD,QAAI,iBAAiB,SAAS,QAAS,QAAO;AAC9C,QAAI,aAAa,gBAAgB,QAAQ,EAAG,QAAO;AACnD,UAAM,mBAAmB,aAAa,IAAI,QAAQ;AAClD,QAAI,kBAAkB,SAAS,aAAa,iBAAiB,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC3F,WAAO,YAAY,QAAQ,IAAI,WAAW;AAAA,EAC5C;AACA,QAAM,SAAyB;AAAA,IAC7B,WAAW,YAAY,WAAW;AAAA,IAClC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,kBAAkB,YAAY,gBAAgB;AAAA,EAChD;AACA,QAAM,OAAO,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AACxC,aAAW,KAAK,QAAQ;AACtB,QAAI,CAAC,KAAK,IAAI,EAAE,QAAQ,GAAG;AACzB,aAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,QAAQ;AAC3C,WAAK,IAAI,EAAE,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAwB,UAA2B;AAC9E,SAAO,QAAQ,OAAO,QAAQ,CAAC;AACjC;AAeA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkD;AAChD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,YAAY;AACd,QAAI;AACF,YAAM,WAAW,YAAY;AAC7B,aAAO,SACH,EAAE,SAAS,YAAY,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IACzE,EAAE,SAAS,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,IAC7D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,QAAmC;AAC3D,SAAO,EAAE,IAAI,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,MAAM,aAAa,qBAAqB,QAAQ,OAAO,OAAO;AACjH;AAQA,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAM6B;AAC3B,QAAM,SAAS,MAAM,oBAAoB,EAAE,YAAY,aAAa,kBAAkB,CAAC;AACvF,QAAM,QAAQ;AAAA,IACZ,GAAG,sBAAsB,MAAM;AAAA,IAC/B,IAAI,MAAM,YAAY,QAAQ,KAAK,EAAE,OAAO,YAAY,MAAM,CAAC,GAAG,IAAI,gBAAgB;AAAA,EACxF;AACA,SAAO,MACJ,OAAO,OAAK,EAAE,OAAO,QAAQ,EAC7B,IAAI,QAAM;AAAA,IACT,GAAG;AAAA,IACH,QAAQ,EAAE,GAAG,WAAW,SAAS;AAAA,IACjC,QAAQ,gBAAgB,QAAQ,EAAE,OAAO;AAAA,EAC3C,EAAE;AACN;AAGA,eAAe,oBAAoB,SAA0D;AAC3F,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,WAAW,QAAQ,OAAO,MAAM;AACtC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,UAAU,MAAM,QAAQ,OAAO,KAAK,GAAG,KAAK,OAAK,EAAE,OAAO,QAAQ;AACxE,QAAM,QAAQ,QAAQ,WAAW,+BAA+B;AAChE,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAOA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkB;AAChB,QAAM,QAAQ,WAAW,YAAY,KAAK,CAAC;AAC3C,QAAM,aAAa,KAAK;AAExB,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,WAAW,KAAK,EAAE;AAClC,QAAI,SAAS;AACX,WAAK,iBAAiB;AACtB,YAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,eAAe,KAAK,EAAE,IAAI,OAAO,QAAQ,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,mBAAmB,WAAW,QAAQ,KAAK,IAAI,CAAC;AACtD,MAAI,kBAAkB;AACpB,UAAM,QAAQ,MAAM,OAAO,EAAE,SAAS,iBAAiB,CAAC;AAAA,EAC1D;AAEA,QAAM,kBAA0C,EAAE,SAAS,QAAQ,MAAM,QAAQ,SAAS,QAAQ;AAClG,aAAW,CAAC,WAAW,MAAM,KAAK,OAAO,QAAQ,eAAe,GAAG;AACjE,UAAM,YAAY,WAAW,MAAM;AACnC,QAAI,WAAW;AACb,YAAM,QAAQ,UAAU,MAAM,IAAI,EAAE,SAAS,WAAW,UAAU,CAAC;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,iCAAiC,OAAO,KAAK,GAAG,CAAC;AAC1F;AAQA,IAAM,gCAAgC;AACtC,IAAM,+BAA+B;AAgBrC,SAAS,kBAAkB,YAAoB,gBAAgC;AAC7E,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,kBAAkB;AAAA,EAC7B;AACF;AAEO,SAAS,aAAa,SAAkC;AAC7D,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,qBAAqB,MAAM;AACjC,SAAO;AAAA,IACL,iBAAiB,QAAQ,GAAG,SAAS,QAAQ,KAAK;AAAA,IAClD,kBAAkB,QAAQ,GAAG,UAAU,QAAQ,KAAK;AAAA,IACpD,sBAAsB,QAAQ,GAAG,SAAS,UAAU,KAAK;AAAA,IACzD,qBAAqB,QAAQ,GAAG,UAAU,UAAU,KAAK;AAAA,IACzD,oBAAoB,uBAAuB,QAAQ,uBAAuB,QAAQ,qBAAqB;AAAA,EACzG;AACF;AAEA,SAAS,mBAAmB,QAAmD;AAC7E,SAAO;AAAA,IACL,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,sBAAsB,QAAQ,wBAAwB;AAAA,IACtD,qBAAqB,QAAQ,uBAAuB;AAAA,IACpD,oBAAoB,QAAQ,sBAAsB;AAAA,EACpD;AACF;AAeA,eAAe,6BAA6B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AACF,GAI4D;AAC1D,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,YAAY;AACjC,aAAO,SACH,EAAE,SAAS,gBAAgB,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IAC7E,EAAE,SAAS,gBAAgB,OAAO,SAAS,QAAQ,QAAQ;AAAA,IACjE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAe,sBACb,SACA,OACA,aACe;AACf,QAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,OAAO,YAAY,CAAC;AAClG;AASA,eAAe,6BAA6B,SAAoB,QAAoD;AAClH,aAAW,QAAQ,CAAC,YAAY,WAAW,GAAY;AACrD,UAAM,SAAS,SAAS,aAAa,QAAQ,kBAAkB,QAAQ;AACvE,UAAM,SAAS,UAAU;AACzB,QAAI,QAAQ,GAAG,IAAI,EAAE,QAAQ,MAAM,QAAQ;AACzC,YAAM,QAAQ,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,OAAO,CAAC;AAAA,IACxD;AAAA,EACF;AACA,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,UAAyB,CAAC;AAChC,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,MAAI,MAAM,yBAAyB,sBAAsB;AACvD,YAAQ,uBAAuB;AAAA,EACjC;AACA,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,MAAI,MAAM,wBAAwB,qBAAqB;AACrD,YAAQ,sBAAsB;AAAA,EAChC;AACA,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,OAAK,MAAM,sBAAsB,YAAY,oBAAoB;AAC/D,YAAQ,qBAAqB;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,OAAO,EAAE,SAAS,EAAG,OAAM,QAAQ,MAAM,IAAI,OAAO;AACtE;AAkCO,IAAM,eAAN,cAA2B,MAAwB;AAAA,EACxD,SAAqB;AACnB,UAAM,UAAU,KAAK;AACrB,UAAM,EAAE,YAAY,aAAa,KAAK,IAAI;AAC1C,UAAM,uBAAuB,QAAQ,yBAAyB,MAAM;AAAA,IAAC;AACrE,UAAM,2BAA2B,QAAQ,6BAA6B,MAAM;AAAA,IAAC;AAE7E,WAAO;AAAA,MACL,iBAAiB,yBAAyB;AAAA,QACxC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAGF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,WAAW,MAAM,cAAc;AAAA,gBAC7B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,IAAI,KAAK,IAAI;AAC7D,cAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AACrE,gBAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,gBAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;AAC7C,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAG/F,oBAAM,IAAI,QAAQ,cAAc,QAAQ,kBAAkB,QAAQ,GAAG,EAAE,MAAM,WAAW,IAAI,CAAC;AAC7F,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAErF,wBAAY,gBAAgB,UAAU,KAAK,MAAM;AACjD,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACvD,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAC/F,oBAAM,IAAI,QAAQ,iBAAiB,QAAQ,kBAAkB,QAAQ,CAAC;AACtE,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AACrF,wBAAY,OAAO,UAAU,QAAQ,EAAE;AACvC,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,cAAI;AACF,kBAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC;AAC3D,mBAAO,EAAE,KAAK,EAAE,WAAW,QAAQ,IAAI,oBAAoB,EAAE,CAAC;AAAA,UAChE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,SAAS,wBAAwB,IAAI;AAC3C,cAAI,WAAW,OAAQ,QAAO,EAAE,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,GAAG;AAEjE,gBAAM,aACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,eAAe,WACtF,KAAiC,aACnC;AACN,cAAI;AACF,kBAAM,SAAS,MAAM,IAAI,QAAQ,OAAO;AAAA,cACtC,OAAO,IAAI;AAAA,cACX,QAAQ,IAAI;AAAA,cACZ,OAAO;AAAA,gBACL,YAAY,oBAAoB,OAAO,IAAI;AAAA,gBAC3C,MAAM,OAAO;AAAA,gBACb,KAAK,OAAO;AAAA,gBACZ,QAAQ,OAAO;AAAA,gBACf,QAAQ,OAAO;AAAA,cACjB;AAAA,cACA,oBAAoB;AAAA,YACtB,CAAC;AACD,qCAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;AAC7C,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,qBAAqB,MAAM,EAAE,CAAC;AAAA,UACpE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,oCAAoC;AAAA,QACnD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,gBAAM,KAAK,EAAE,IAAI,MAAM,IAAI;AAC3B,cAAI;AACF,kBAAM,IAAI,QAAQ,OAAO,EAAE,OAAO,IAAI,OAAO,YAAY,GAAG,CAAC;AAC7D,qCAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;AAC7C,mBAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,UAC5B,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,sBAAsB;AAAA,QACrC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,cACzC,WAAW,oBAAoB;AAAA,cAC/B,oBAAoB;AAAA,gBAClB;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AACD,kBAAM,UAAU,OACb,OAAO,OAAK,oBAAoB,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,OAAO,QAAQ,EAC/E,IAAI,QAAM,EAAE,IAAI,EAAE,IAAK,UAAU,EAAE,UAAU,WAAW,EAAE,WAAW,WAAW,KAAK,EAAE;AAK1F,gBAAI,QAAQ,iBAAiB;AAC3B,kBAAI;AACF,sBAAM,MAAM,MAAM,8BAA8B;AAAA,kBAC9C,GAAG,MAAM,CAAC;AAAA,kBACV;AAAA,kBACA,iBAAiB,QAAQ;AAAA,gBAC3B,CAAC;AACD,oBAAI,EAAE,cAAc,MAAM;AACxB,wBAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,OAAK,EAAE,EAAE,CAAC;AAC5C,6BAAW,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG;AACjE,+BAAW,SAAS,OAAO,QAAQ;AACjC,4BAAM,KAAK,GAAG,OAAO,UAAU,IAAI,KAAK;AACxC,0BAAI,MAAM,IAAI,EAAE,EAAG;AACnB,4BAAM,IAAI,EAAE;AACZ,8BAAQ,KAAK,EAAE,IAAI,UAAU,OAAO,YAAY,WAAW,OAAO,WAAW,KAAK,CAAC;AAAA,oBACrF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF,QAAQ;AAAA,cAER;AAAA,YACF;AACA,mBAAO,EAAE,KAAK;AAAA,cACZ,QAAQ,QAAQ;AAAA,gBAAK,CAAC,GAAG,MACvB,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,cAAc,EAAE,QAAQ;AAAA,cAC5F;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQD,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,kBAAM,eAAe,MAAM,oBAAoB,OAAO;AACtD,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,OAAO,MAAM,eAAe;AAAA,gBAC1B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,gBACA;AAAA,gBACA;AAAA,cACF,CAAC;AAAA,cACD;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AAChE,cAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AACvE,gBAAM,IAAK,KAAK,UAAU,CAAC;AAC3B,gBAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,KAAK,IAAI;AAC7D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,cAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;AAC5B,mBAAO,EAAE,KAAK,EAAE,OAAO,yDAAyD,GAAG,GAAG;AAAA,UACxF;AACA,cAAI;AACF,kBAAM,SAAS,MAAM,YAAY,QAAQ,OAAO;AAAA,cAC9C,OAAO,YAAY;AAAA,cACnB,QAAQ,YAAY;AAAA,cACpB,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE;AAAA,YAC/C,CAAC;AACD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,MAAM,iBAAiB,MAAM,EAAE,CAAC;AAAA,UAC5D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,+BAA+B;AAAA,QAC9C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACF,kBAAM,WAAW,GAAG,WAAW,SAAS,IAAI,GAAG,MAAM,UAAU,MAAM,IAAI;AACzE,kBAAM,UAAU,MAAM,YAAY,QAAQ,OAAO,EAAE,OAAO,YAAY,OAAO,IAAI,SAAS,CAAC;AAC3F,mBAAO,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAAA,UACvF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,wCAAwC;AAAA,QACvD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,QAAQ,MAAM,eAAe;AAAA,cACjC;AAAA,cACA,aAAa,oBAAoB,SAAY;AAAA,cAC7C;AAAA,cACA;AAAA,YACF,CAAC;AACD,kBAAM,OAAO,MAAM,KAAK,OAAK,EAAE,OAAO,EAAE;AACxC,gBAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAC/D,kBAAM,mBAAmB,EAAE,YAAY,SAAS,KAAK,CAAC;AACtD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,cAAc,KAAK,GAAG,CAAC;AAAA,UACnD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,oCAAoC;AAAA,QACnD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,KAAK,IAAI;AAClF,gBAAM,iBAAiB,OAAO,KAAK,mBAAmB,WAAW,KAAK,eAAe,KAAK,IAAI;AAC9F,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAEnF,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAE1C,cAAI;AACF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,SAAS,MAAM,oBAAoB;AAAA,cACvC;AAAA,cACA,aAAa,oBAAoB,SAAY;AAAA,cAC7C;AAAA,YACF,CAAC;AACD,gBAAI,CAAC,OAAO,UAAU,EAAG,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,UAAU,sBAAsB,GAAG,GAAG;AAEnG,kBAAM,UAAU,kBAAkB,YAAY,cAAc;AAC5D,kBAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM;AAAA,cACzC,OAAO,QAAQ;AAAA,cACf,QAAQ,QAAQ;AAAA,cAChB,OAAO,CAAC;AAAA,cACR,aAAa,EAAE,iBAAiB,SAAS,kBAAkB,QAAQ;AAAA,YACrE,CAAC;AACD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,mBAAmB,MAAM,EAAE,CAAC;AAAA,UAChE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,kBAAkB;AAAA,QACjC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACzF,gBAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,QAAQ,mBAAmB,MAAM,EAAE,CAAC;AAErE,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,6BAA6B,SAAS,MAAM;AAClD,mBAAO,EAAE,KAAK,EAAE,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UACjD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,8BAA8B;AAAA,QAC7C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,cAAI,SAAS,cAAc,SAAS,aAAa;AAC/C,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,UAC3D;AACA,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,KAAK,IAAI;AACzE,cAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,kCAAkC,GAAG,GAAG;AAC7E,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,gBAAI,cAAc,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACrG,kBAAM,YAAY,UAAW,SAAS,aAAa,QAAQ,GAAG,YAAY,QAAQ,GAAG,WAAY;AACjG,kBAAM,0BAA0B,WAAW,QAAQ,KAAK;AACxD,kBAAM,SAAS,GAAG,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAM/C,kBAAM,WAAW,SAAS,aAAa,qBAAqB;AAC5D,kBAAM;AAAA,cACJ;AAAA,cACA,EAAE,CAAC,SAAS,aAAa,oBAAoB,kBAAkB,GAAG,QAAQ;AAAA,cAC1E,0BAA0B,EAAE,CAAC,QAAQ,GAAG,wBAAwB,IAAI;AAAA,YACtE;AACA,kBAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC;AAClG,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UACpC,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAMJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,cACJ,OAAO,KAAK,yBAAyB,YAAY,KAAK,uBAAuB,IACzE,KAAK,MAAM,KAAK,oBAAoB,IACpC;AACN,gBAAM,aACJ,OAAO,KAAK,wBAAwB,YAAY,KAAK,sBAAsB,IACvE,KAAK,MAAM,KAAK,mBAAmB,IACnC;AACN,cAAI,gBAAgB,UAAa,eAAe,QAAW;AACzD,mBAAO,EAAE,KAAK,EAAE,OAAO,6EAA6E,GAAG,GAAG;AAAA,UAC5G;AACA,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,gBAAI,cAAc,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACrG,gBAAI,gBAAgB,UAAa,SAAS;AACxC,oBAAM,QAAQ,MAAM,IAAI,EAAE,sBAAsB,YAAY,CAAC;AAC7D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,wBAAwB,OAAO,YAAY,CAAC;AAAA,YACrF;AACA,gBAAI,eAAe,UAAa,SAAS;AACvC,oBAAM,QAAQ,MAAM,IAAI,EAAE,qBAAqB,WAAW,CAAC;AAC3D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,uBAAuB,OAAO,WAAW,CAAC;AAAA,YACnF;AACA,kBAAM,sBAAsB,SAAS;AAAA,cACnC,GAAI,gBAAgB,SAAY,EAAE,sBAAsB,YAAY,IAAI,CAAC;AAAA,cACzE,GAAI,eAAe,SAAY,EAAE,qBAAqB,WAAW,IAAI,CAAC;AAAA,YACxE,CAAC;AACD,kBAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC;AAClG,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UACpC,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,sCAAsC;AAAA,QACrD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,MAAM,KAAK;AACjB,gBAAM,QAA0B,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AACxF,cAAI,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,OAAO;AACnD,mBAAO,EAAE,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;AAAA,UACtE;AACA,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,gBAAI,cAAc,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACrG,gBAAI,SAAS;AACX,oBAAM,QAAQ,MAAM,IAAI,EAAE,oBAAoB,MAAM,CAAC;AACrD,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,sBAAsB,MAAM,CAAC;AAAA,YACtE;AACA,kBAAM,sBAAsB,SAAS,EAAE,oBAAoB,MAAM,CAAC;AAClE,kBAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC;AAClG,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UACpC,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["providers"]}
+{"version":3,"sources":["../../src/routes/config.ts","../../src/routes/provider-credentials.ts","../../src/routes/route.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport { DEFAULT_OM_MODEL_ID } from '@mastra/code-sdk/constants';\nimport { getAvailableModePacks } from '@mastra/code-sdk/onboarding/packs';\nimport type { ModePack, ProviderAccess, ProviderAccessLevel } from '@mastra/code-sdk/onboarding/packs';\nimport { getCustomProviderId, THREAD_ACTIVE_MODEL_PACK_ID_KEY } from '@mastra/code-sdk/onboarding/settings';\nimport type { CustomProviderSetting } from '@mastra/code-sdk/onboarding/settings';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { Context } from 'hono';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { CustomProviderRecord, CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type {\n  MemorySettingsFillIfUnset,\n  MemorySettingsPatch,\n  MemorySettingsRecord,\n  MemorySettingsStorage,\n} from '../storage/domains/memory-settings/base.js';\nimport type { ModelPackRecord, ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport {\n  getAuthProviderId,\n  listTenantCredentialsForRequest,\n  resolveCredentialContext,\n  tenantOrgId,\n  WEB_OAUTH_FLOW_KINDS,\n} from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteAuth, RouteDependencies } from './route.js';\n\n/** Widen a route-local Hono context to the plain `Context` the auth helpers take. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Server-side configuration routes for the web app.\n *\n * The browser has no access to the credential store or the model catalog, so\n * the web settings panel asks the server — which owns both — to list providers\n * and manage API keys. This mirrors the TUI's `/api-keys` command, exposing the\n * same `AuthStorage`-backed key management over HTTP.\n *\n * Keys are never returned to the client; only their presence and source.\n */\n\n/**\n * Where a provider's active credential comes from, as seen by the caller.\n * Local mode reports `oauth`/`stored` (server-global `auth.json`); tenant mode\n * reports the scoped variants (`oauth-user`/`stored-user`/`stored-org`).\n */\nexport type ProviderCredentialSource =\n  | 'oauth'\n  | 'stored'\n  | 'env'\n  | 'none'\n  | 'oauth-user'\n  | 'stored-user'\n  | 'stored-org';\n\n/** A model provider with the current source of its credentials. */\nexport interface ProviderInfo {\n  provider: string;\n  /** Env var the provider's key is read from, if any. */\n  envVar?: string;\n  /** Where the active credential comes from. */\n  source: ProviderCredentialSource;\n  /** Web OAuth sign-in capability, when the provider supports it. */\n  oauth?: { supported: true; modes: LoginSessionKind[] };\n}\n\n/** Minimal session surface a pack activation touches. */\ninterface PackSession {\n  mode: { get: () => string };\n  model: { switch: (args: { modelId: string }) => Promise<void> };\n  subagents: { model: { set: (args: { modelId: string; agentType: string }) => Promise<void> } };\n  thread: {\n    getId: () => string | null;\n    setSetting: (args: { key: string; value: unknown }) => Promise<void>;\n    list: () => Promise<Array<{ id: string; metadata?: Record<string, unknown> }>>;\n  };\n}\n\n/** One observational-memory role's read/switch surface. */\ninterface OMRole {\n  modelId: () => string | undefined;\n  threshold: () => number | undefined;\n  switchModel: (args: { modelId: string }) => Promise<void>;\n}\n\n/**\n * Session-state fields the OM config routes write. The index signatures mirror\n * `MastraCodeState` so the concrete `Session.state.set(Partial<MastraCodeState>)`\n * stays assignable to this minimal surface (contravariant parameter check).\n */\ninterface OMStateWrites {\n  [key: string]: unknown;\n  [key: `subagentModelId_${string}`]: string | undefined;\n  observationThreshold?: number;\n  reflectionThreshold?: number;\n  observeAttachments?: 'auto' | boolean;\n}\n\n/** Minimal session surface the OM config routes touch. */\nexport interface OMSession extends PackSession {\n  state: {\n    get: () => Record<string, unknown> | undefined;\n    set: (updates: OMStateWrites) => Promise<void> | void;\n  };\n  om: { observer: OMRole; reflector: OMRole };\n}\n\n/** Minimal controller surface this module needs (model catalog + modes + sessions). */\ninterface ModelCatalog {\n  listAvailableModels: () => Promise<\n    Array<{ id?: string; modelName?: string; provider: string; hasApiKey: boolean; apiKeyEnvVar?: string }>\n  >;\n  listModes?: () => Array<{ id: string; defaultModelId?: string }>;\n  getSessionByResource?: (resourceId: string, scope?: string) => Promise<OMSession | undefined>;\n}\n\n/**\n * Build a deduplicated, sorted list of providers from the model catalog,\n * annotated with where each provider's credential currently comes from.\n * Mirrors the TUI's `/api-keys` provider list.\n *\n * When `tenantCredentials` is given (deployed mode), sources reflect the\n * *caller's* tenant rows with user > org precedence and the server-global\n * `authStorage` is ignored; otherwise the local `auth.json` view is reported.\n */\nexport async function listProviders({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderInfo[]> {\n  const models = await controller.listAvailableModels();\n  const seen = new Map<string, ProviderInfo>();\n\n  for (const model of models) {\n    if (seen.has(model.provider)) continue;\n\n    const authProviderId = getAuthProviderId(model.provider);\n    let source: ProviderInfo['source'] = 'none';\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      if (userRec?.credential.type === 'oauth') {\n        source = 'oauth-user';\n      } else if (userRec?.credential.type === 'api_key') {\n        source = 'stored-user';\n      } else if (orgRec?.credential.type === 'api_key') {\n        source = 'stored-org';\n      }\n    } else if (authStorage?.isLoggedIn(authProviderId)) {\n      source = 'oauth';\n    } else if (authStorage?.hasStoredApiKey(model.provider)) {\n      source = 'stored';\n    } else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) {\n      source = 'env';\n    } else if (model.hasApiKey) {\n      source = 'env';\n    }\n\n    const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];\n    seen.set(model.provider, {\n      provider: model.provider,\n      envVar: model.apiKeyEnvVar,\n      source,\n      ...(flowKind ? { oauth: { supported: true as const, modes: [flowKind] } } : {}),\n    });\n  }\n\n  return Array.from(seen.values()).sort((a, b) => a.provider.localeCompare(b.provider));\n}\n\n/** A user-defined OpenAI-compatible provider, with key presence (never the key). */\nexport interface CustomProviderInfo {\n  id: string;\n  name: string;\n  url: string;\n  hasApiKey: boolean;\n  models: string[];\n}\n\n/** Redact a stored custom-provider row for the client (key presence only). */\nfunction toCustomProviderInfo(record: CustomProviderRecord): CustomProviderInfo {\n  return {\n    id: record.providerId,\n    name: record.name,\n    url: record.url,\n    hasApiKey: Boolean(record.apiKey),\n    models: record.models,\n  };\n}\n\n/** The resolved custom-providers storage scope for a request. */\ninterface CustomProvidersContext {\n  storage: CustomProvidersStorage;\n  orgId: string;\n  userId: string;\n}\n\n/**\n * Resolve the custom-providers context for a request, or a ready-to-return\n * error response. Same posture as memory settings: tenant rows in deployed\n * mode, a sentinel `local` org in no-auth mode — never settings.json.\n */\nasync function resolveCustomProvidersContext({\n  c,\n  auth,\n  customProviders,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  customProviders?: CustomProvidersStorage;\n}): Promise<CustomProvidersContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (customProviders) {\n    try {\n      await customProviders.ensureReady();\n      return tenant\n        ? { storage: customProviders, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: customProviders, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'custom_providers_unavailable',\n        message: 'Custom provider storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Validate + coerce a request body into a CustomProviderSetting. */\nfunction parseCustomProviderBody(body: unknown): CustomProviderSetting | { error: string } {\n  if (!body || typeof body !== 'object') return { error: 'Invalid JSON body' };\n  const b = body as Record<string, unknown>;\n  const name = typeof b.name === 'string' ? b.name.trim() : '';\n  if (!name) return { error: 'Missing required field: name' };\n  const url = typeof b.url === 'string' ? b.url.trim() : '';\n  if (!url) return { error: 'Missing required field: url' };\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n      return { error: 'url must be an http(s) URL' };\n    }\n  } catch {\n    return { error: 'url must be a valid URL' };\n  }\n  const apiKey = typeof b.apiKey === 'string' && b.apiKey.trim() ? b.apiKey.trim() : undefined;\n  const models = Array.isArray(b.models)\n    ? b.models.filter((m): m is string => typeof m === 'string' && m.trim().length > 0).map(m => m.trim())\n    : [];\n  return { name, url, apiKey, models };\n}\n\n// ── Model packs ──────────────────────────────────────────────────────────\n\n/** A model pack as surfaced to the web client, with an `active` flag. */\nexport interface ModelPackInfo extends ModePack {\n  custom: boolean;\n  active: boolean;\n}\n\n/**\n * Compute which providers the user can reach, mirroring the TUI's\n * `/models-pack` access derivation: OAuth/api-key from the credential store for\n * the named providers, plus any other provider that has a usable key.\n */\nexport async function buildProviderAccess({\n  controller,\n  authStorage,\n  tenantCredentials,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n}): Promise<ProviderAccess> {\n  const models = await controller.listAvailableModels();\n  const hasModelKey = (provider: string) => models.some(m => m.provider === provider && m.hasApiKey);\n  const accessLevel = (provider: string): ProviderAccessLevel => {\n    const authProviderId = getAuthProviderId(provider);\n    if (tenantCredentials) {\n      const userRec = tenantCredentials.find(r => r.scope === 'user' && r.provider === authProviderId);\n      const orgRec = tenantCredentials.find(r => r.scope === 'org' && r.provider === authProviderId);\n      const credential = userRec?.credential ?? orgRec?.credential;\n      if (credential?.type === 'oauth') return 'oauth';\n      if (credential?.type === 'api_key' && credential.key.trim().length > 0) return 'apikey';\n      return false;\n    }\n\n    const oauthCredential = authStorage?.get(authProviderId);\n    if (oauthCredential?.type === 'oauth') return 'oauth';\n    if (authStorage?.hasStoredApiKey(provider)) return 'apikey';\n    const directCredential = authStorage?.get(provider);\n    if (directCredential?.type === 'api_key' && directCredential.key.trim().length > 0) return 'apikey';\n    return hasModelKey(provider) ? 'apikey' : false;\n  };\n  const access: ProviderAccess = {\n    anthropic: accessLevel('anthropic'),\n    openai: accessLevel('openai'),\n    cerebras: accessLevel('cerebras'),\n    google: accessLevel('google'),\n    deepseek: accessLevel('deepseek'),\n    'github-copilot': accessLevel('github-copilot'),\n  };\n  const seen = new Set(Object.keys(access));\n  for (const m of models) {\n    if (!seen.has(m.provider)) {\n      access[m.provider] = accessLevel(m.provider);\n      seen.add(m.provider);\n    }\n  }\n  return access;\n}\n\nfunction canUseModelProvider(access: ProviderAccess, provider: string): boolean {\n  return Boolean(access[provider]);\n}\n\n/**\n * Where a request's custom model packs live. Same posture as memory settings\n * and custom providers: the `model-packs` factory storage domain, scoped per\n * org in deployed mode and to a sentinel `local` org in no-auth mode — never\n * settings.json.\n */\nexport interface PackContext {\n  storage: ModelPacksStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the pack context for a request, or a ready-to-return error response. */\nasync function resolvePackContext({\n  c,\n  auth,\n  modelPacks,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  modelPacks?: ModelPacksStorage;\n}): Promise<PackContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (modelPacks) {\n    try {\n      await modelPacks.ensureReady();\n      return tenant\n        ? { storage: modelPacks, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: modelPacks, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'model_packs_unavailable',\n        message: 'Model pack storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** DB row → the `ModePack` shape the packs list and activation flow consume. */\nfunction recordToModePack(record: ModelPackRecord): ModePack {\n  return { id: `custom:${record.id}`, name: record.name, description: 'Saved custom pack', models: record.models };\n}\n\n/**\n * List available model packs (built-in, gated by provider access, plus saved\n * custom packs from the request's pack context). Drops the synthetic\n * \"New Custom\" placeholder — the web client has its own create flow. `active`\n * is set from the given session's thread when a resourceId is supplied.\n */\nexport async function listModelPacks({\n  controller,\n  authStorage,\n  tenantCredentials,\n  packContext,\n  activePackId,\n}: {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  tenantCredentials?: CredentialRecord[];\n  packContext: PackContext;\n  activePackId?: string | null;\n}): Promise<ModelPackInfo[]> {\n  const access = await buildProviderAccess({ controller, authStorage, tenantCredentials });\n  const packs = [\n    ...getAvailableModePacks(access),\n    ...(await packContext.storage.list({ orgId: packContext.orgId })).map(recordToModePack),\n  ];\n  return packs\n    .filter(p => p.id !== 'custom') // synthetic \"choose each model\" placeholder\n    .map(p => ({\n      ...p,\n      custom: p.id.startsWith('custom:'),\n      active: activePackId != null && p.id === activePackId,\n    }));\n}\n\n/** Resolve the active pack id for a session by reading its current thread. */\nasync function resolveActivePackId(session: PackSession | undefined): Promise<string | null> {\n  if (!session) return null;\n  const threadId = session.thread.getId();\n  if (!threadId) return null;\n  const thread = (await session.thread.list()).find(t => t.id === threadId);\n  const value = thread?.metadata?.[THREAD_ACTIVE_MODEL_PACK_ID_KEY];\n  return typeof value === 'string' ? value : null;\n}\n\n/**\n * Apply a pack to a session: seed each mode's default model, switch the current\n * mode's model, set per-subagent models, and tag the thread with the active\n * pack id. Mirrors the TUI `applyPack` orchestration.\n */\nasync function applyPackToSession({\n  controller,\n  session,\n  pack,\n}: {\n  controller: ModelCatalog;\n  session: PackSession;\n  pack: ModePack;\n}): Promise<void> {\n  const modes = controller.listModes?.() ?? [];\n  const packModels = pack.models as Record<string, string>;\n\n  for (const mode of modes) {\n    const modelId = packModels[mode.id];\n    if (modelId) {\n      mode.defaultModelId = modelId;\n      await session.thread.setSetting({ key: `modeModelId_${mode.id}`, value: modelId });\n    }\n  }\n\n  const currentModeModel = packModels[session.mode.get()];\n  if (currentModeModel) {\n    await session.model.switch({ modelId: currentModeModel });\n  }\n\n  const subagentModeMap: Record<string, string> = { explore: 'fast', plan: 'plan', execute: 'build' };\n  for (const [agentType, modeId] of Object.entries(subagentModeMap)) {\n    const saModelId = packModels[modeId];\n    if (saModelId) {\n      await session.subagents.model.set({ modelId: saModelId, agentType });\n    }\n  }\n\n  await session.thread.setSetting({ key: THREAD_ACTIVE_MODEL_PACK_ID_KEY, value: pack.id });\n}\n\n// ── Observational memory ────────────────────────────────────────────────────\n// Mirrors the TUI `/om` command. Settings are persisted per organization and\n// user in the Factory app database. Requests with an active session also apply\n// changes immediately to that session's state and thread settings.\n\n/** Default thresholds mirror the TUI `/om` fallbacks. */\nconst DEFAULT_OBSERVATION_THRESHOLD = 30_000;\nconst DEFAULT_REFLECTION_THRESHOLD = 40_000;\n\n/** Read the current OM config from a session. */\nexport interface OMConfigInfo {\n  observerModelId: string;\n  reflectorModelId: string;\n  observationThreshold: number;\n  reflectionThreshold: number;\n  observeAttachments: 'auto' | boolean;\n}\n\nexport interface ProviderOMDefaultsResponse {\n  ok: true;\n  config: OMConfigInfo;\n}\n\nfunction providerOMModelId(providerId: string, factoryModelId: string): string {\n  switch (providerId) {\n    case 'anthropic':\n      return 'anthropic/claude-haiku-4-5';\n    case 'openai':\n      return 'openai/gpt-5.4-mini';\n    default:\n      return factoryModelId || DEFAULT_OM_MODEL_ID;\n  }\n}\n\nexport function readOMConfig(session: OMSession): OMConfigInfo {\n  const state = session.state.get() ?? {};\n  const observeAttachments = state.observeAttachments;\n  return {\n    observerModelId: session.om.observer.modelId() ?? '',\n    reflectorModelId: session.om.reflector.modelId() ?? '',\n    observationThreshold: session.om.observer.threshold() ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: session.om.reflector.threshold() ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: observeAttachments === true || observeAttachments === false ? observeAttachments : 'auto',\n  };\n}\n\nfunction readStoredOMConfig(record: MemorySettingsRecord | null): OMConfigInfo {\n  return {\n    observerModelId: record?.observerModelId ?? DEFAULT_OM_MODEL_ID,\n    reflectorModelId: record?.reflectorModelId ?? DEFAULT_OM_MODEL_ID,\n    observationThreshold: record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD,\n    reflectionThreshold: record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD,\n    observeAttachments: record?.observeAttachments ?? 'auto',\n  };\n}\n\n/**\n * Where a request's OM settings live: the `memory-settings` factory storage\n * domain, one row per (org, user). Without a tenant (auth disabled), settings\n * land on a sentinel `(local, local)` row in the same table — the web surface\n * never reads or writes `settings.json` for memory settings.\n */\ninterface MemorySettingsContext {\n  storage: MemorySettingsStorage;\n  orgId: string;\n  userId: string;\n}\n\n/** Resolve the memory-settings context for a request, or a ready-to-return error response. */\nasync function resolveMemorySettingsContext({\n  c,\n  auth,\n  memorySettings,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  memorySettings?: MemorySettingsStorage;\n}): Promise<MemorySettingsContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant && auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (memorySettings) {\n    try {\n      await memorySettings.ensureReady();\n      return tenant\n        ? { storage: memorySettings, orgId: tenantOrgId(tenant), userId: tenant.userId }\n        : { storage: memorySettings, orgId: 'local', userId: 'local' };\n    } catch {\n      // fall through to the unavailable response\n    }\n  }\n  return {\n    response: c.json(\n      {\n        error: 'memory_settings_unavailable',\n        message: 'Memory settings storage is unavailable — the app database is not configured or failed to start.',\n      },\n      503,\n    ),\n  };\n}\n\n/** Persist an OM knob change to the caller's memory-settings row. */\nasync function persistMemorySettings(\n  context: MemorySettingsContext,\n  patch: MemorySettingsPatch,\n  fillIfUnset?: MemorySettingsFillIfUnset,\n): Promise<void> {\n  await context.storage.patch({ orgId: context.orgId, userId: context.userId, patch, fillIfUnset });\n}\n\n/**\n * Apply the stored memory-settings row onto the session, so the DB — not\n * whatever happens to sit in persisted session state (e.g. a stale boot-time\n * seed from before memory settings moved to the DB) — is what the web surface\n * reads and what the session's OM actually runs with. The row is authoritative:\n * knobs without a stored value reset to the built-in defaults.\n */\nasync function hydrateSessionMemorySettings(session: OMSession, record: MemorySettingsRecord | null): Promise<void> {\n  for (const role of ['observer', 'reflector'] as const) {\n    const stored = role === 'observer' ? record?.observerModelId : record?.reflectorModelId;\n    const target = stored ?? DEFAULT_OM_MODEL_ID;\n    if (session.om[role].modelId() !== target) {\n      await session.om[role].switchModel({ modelId: target });\n    }\n  }\n  const state = session.state.get() ?? {};\n  const updates: OMStateWrites = {};\n  const observationThreshold = record?.observationThreshold ?? DEFAULT_OBSERVATION_THRESHOLD;\n  if (state.observationThreshold !== observationThreshold) {\n    updates.observationThreshold = observationThreshold;\n  }\n  const reflectionThreshold = record?.reflectionThreshold ?? DEFAULT_REFLECTION_THRESHOLD;\n  if (state.reflectionThreshold !== reflectionThreshold) {\n    updates.reflectionThreshold = reflectionThreshold;\n  }\n  const observeAttachments = record?.observeAttachments ?? 'auto';\n  if ((state.observeAttachments ?? 'auto') !== observeAttachments) {\n    updates.observeAttachments = observeAttachments;\n  }\n  if (Object.keys(updates).length > 0) await session.state.set(updates);\n}\n\n/** Dependencies injected into {@link ConfigRoutes}. */\nexport interface ConfigRoutesDeps extends RouteDependencies {\n  controller: ModelCatalog;\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Tenant model-packs domain handle; absent in local (no-DB) mode. */\n  modelPacks?: ModelPacksStorage;\n  /** Tenant memory-settings domain handle; absent in local (no-DB) mode. */\n  memorySettings?: MemorySettingsStorage;\n  /** Custom-providers domain handle; absent when the app database is missing. */\n  customProviders?: CustomProvidersStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n  /** Notifies the host after custom providers change so model-router caches can be dropped. */\n  onCustomProvidersChanged?: (tenant: { orgId: string }) => void;\n}\n\n/**\n * The web config routes as Mastra `apiRoutes`:\n *   - `GET    /web/config/providers`              — list providers + key source\n *   - `PUT    /web/config/providers/:provider/key` — set/update a provider's API key\n *   - `DELETE /web/config/providers/:provider/key` — remove a stored API key\n *   - `GET    /web/config/models`                  — list available models (credentialed providers)\n *   - `GET    /web/config/custom-providers`        — list custom OpenAI-compatible providers\n *   - `POST   /web/config/custom-providers`        — create/update a custom provider\n *   - `DELETE /web/config/custom-providers/:id`    — remove a custom provider\n *   - `GET    /web/config/om`                      — read OM models/thresholds/observe-attachments\n *   - `PUT    /web/config/om/:role/model`          — switch observer/reflector model\n *   - `PUT    /web/config/om/thresholds`           — set observation/reflection thresholds\n *   - `PUT    /web/config/om/observe-attachments`  — set observe-attachments (auto/on/off)\n */\nexport class ConfigRoutes extends Route<ConfigRoutesDeps> {\n  routes(): ApiRoute[] {\n    const options = this.deps;\n    const { controller, authStorage, auth } = options;\n    const onCredentialsChanged = options.onCredentialsChanged ?? (() => {});\n    const onCustomProvidersChanged = options.onCustomProvidersChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            // Tenant mode lists the caller's rows and never exposes the\n            // server-global auth.json; local mode is unchanged.\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              providers: await listProviders({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          let body: { key?: unknown; envVar?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const key = typeof body.key === 'string' ? body.key.trim() : '';\n          if (!key) return c.json({ error: 'Missing required field: key' }, 400);\n          const envVar = typeof body.envVar === 'string' ? body.envVar : undefined;\n          const scope = body.scope === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              // envVar is intentionally ignored: tenant credentials are resolved\n              // per-request, never written into process.env.\n              await ctx.storage.setCredential(tenant, getAuthProviderId(provider), { type: 'api_key', key });\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            // Local mode is single-user: scope is meaningless and ignored.\n            authStorage.setStoredApiKey(provider, key, envVar);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/key', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: options.modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'organization_admin_required' }, 403);\n              }\n              const tenant = scope === 'org' ? { orgId: ctx.orgId } : { orgId: ctx.orgId, userId: ctx.userId };\n              await ctx.storage.removeCredential(tenant, getAuthProviderId(provider));\n              onCredentialsChanged(tenant);\n              const records = await ctx.storage.listCredentials(ctx.orgId, ctx.userId);\n              const providers = await listProviders({ controller, tenantCredentials: records });\n              return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n            }\n            if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n            authStorage.remove(`apikey:${provider}`);\n            const providers = await listProviders({ controller, authStorage });\n            return c.json({ ok: true, provider: providers.find(p => p.provider === provider) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Custom providers (OpenAI-compatible endpoints) ──────────────────────\n      // Mirrors the TUI's /custom-providers command, but backed by the\n      // `custom-providers` domain (org rows in tenant mode, a sentinel `local`\n      // org in no-auth mode) — the server never reads settings.json for these.\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          try {\n            const records = await ctx.storage.list({ orgId: ctx.orgId });\n            return c.json({ providers: records.map(toCustomProviderInfo) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const parsed = parseCustomProviderBody(body);\n          if ('error' in parsed) return c.json({ error: parsed.error }, 400);\n          // `previousId` lets a rename remove the old entry as well as any name clash.\n          const previousId =\n            body && typeof body === 'object' && typeof (body as Record<string, unknown>).previousId === 'string'\n              ? ((body as Record<string, unknown>).previousId as string)\n              : undefined;\n          try {\n            const record = await ctx.storage.upsert({\n              orgId: ctx.orgId,\n              userId: ctx.userId,\n              input: {\n                providerId: getCustomProviderId(parsed.name),\n                name: parsed.name,\n                url: parsed.url,\n                apiKey: parsed.apiKey,\n                models: parsed.models,\n              },\n              previousProviderId: previousId,\n            });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true, provider: toCustomProviderInfo(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/custom-providers/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCustomProvidersContext({\n            c: loose(c),\n            auth,\n            customProviders: options.customProviders,\n          });\n          if ('response' in ctx) return ctx.response;\n          const id = c.req.param('id');\n          try {\n            await ctx.storage.delete({ orgId: ctx.orgId, providerId: id });\n            onCustomProvidersChanged({ orgId: ctx.orgId });\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Available models ────────────────────────────────────────────────────\n      // Session-independent model catalog for settings pickers (Factory default\n      // model, pack editors). Only models whose provider has a credential are\n      // returned — the same filter the session-scoped hook applies client-side.\n\n      registerApiRoute('/web/config/models', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const [models, access] = await Promise.all([\n              controller.listAvailableModels(),\n              buildProviderAccess({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n              }),\n            ]);\n            const catalog = models\n              .filter(m => canUseModelProvider(access, m.provider) && typeof m.id === 'string')\n              .map(m => ({ id: m.id!, provider: m.provider, modelName: m.modelName, hasApiKey: true }));\n            // Append the caller's custom provider models (DB-backed, org rows in\n            // tenant mode / sentinel `local` org in no-auth mode). The boot-time\n            // gateway catalog only carries the local list, so tenant callers get\n            // theirs here. Dedupe against ids already present.\n            if (options.customProviders) {\n              try {\n                const ctx = await resolveCustomProvidersContext({\n                  c: loose(c),\n                  auth,\n                  customProviders: options.customProviders,\n                });\n                if (!('response' in ctx)) {\n                  const known = new Set(catalog.map(m => m.id));\n                  for (const record of await ctx.storage.list({ orgId: ctx.orgId })) {\n                    for (const model of record.models) {\n                      const id = `${record.providerId}/${model}`;\n                      if (known.has(id)) continue;\n                      known.add(id);\n                      catalog.push({ id, provider: record.providerId, modelName: model, hasApiKey: true });\n                    }\n                  }\n                }\n              } catch {\n                // Fail soft: the catalog still serves the built-in models.\n              }\n            }\n            return c.json({\n              models: catalog.sort((a, b) =>\n                a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider),\n              ),\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Model packs ─────────────────────────────────────────────────────────\n      // Mirrors the TUI's /models-pack command. Custom-pack CRUD lives in the\n      // model-packs storage domain (org-scoped, sentinel `local` org in no-auth\n      // mode — never settings.json); activation is session-scoped and resolves\n      // the session from the controller registry by resourceId.\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          try {\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const activePackId = await resolveActivePackId(session);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            return c.json({\n              packs: await listModelPacks({\n                controller,\n                authStorage: tenantCredentials ? undefined : authStorage,\n                tenantCredentials,\n                packContext,\n                activePackId,\n              }),\n              activePackId,\n            });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          let body: { name?: unknown; models?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const name = typeof body.name === 'string' ? body.name.trim() : '';\n          if (!name) return c.json({ error: 'Missing required field: name' }, 400);\n          const m = (body.models ?? {}) as Record<string, unknown>;\n          const build = typeof m.build === 'string' ? m.build.trim() : '';\n          const plan = typeof m.plan === 'string' ? m.plan.trim() : '';\n          const fast = typeof m.fast === 'string' ? m.fast.trim() : '';\n          if (!build || !plan || !fast) {\n            return c.json({ error: 'models.build, models.plan and models.fast are required' }, 400);\n          }\n          try {\n            const record = await packContext.storage.upsert({\n              orgId: packContext.orgId,\n              userId: packContext.userId,\n              input: { name, models: { build, plan, fast } },\n            });\n            return c.json({ ok: true, pack: recordToModePack(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          try {\n            const recordId = id.startsWith('custom:') ? id.slice('custom:'.length) : id;\n            const deleted = await packContext.storage.delete({ orgId: packContext.orgId, id: recordId });\n            return deleted ? c.json({ ok: true }) : c.json({ error: `Unknown pack \"${id}\"` }, 404);\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/model-packs/:id/activate', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const packContext = await resolvePackContext({ c: loose(c), auth, modelPacks: options.modelPacks });\n          if ('response' in packContext) return packContext.response;\n          const id = decodeURIComponent(c.req.param('id'));\n          let body: { resourceId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          if (!resourceId) return c.json({ error: 'Missing required field: resourceId' }, 400);\n          try {\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ error: `No session for resourceId \"${resourceId}\"` }, 404);\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const packs = await listModelPacks({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n              packContext,\n            });\n            const pack = packs.find(p => p.id === id);\n            if (!pack) return c.json({ error: `Unknown pack \"${id}\"` }, 404);\n            await applyPackToSession({ controller, session, pack });\n            return c.json({ ok: true, activePackId: pack.id });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/provider-defaults', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { providerId?: unknown; factoryModelId?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const providerId = typeof body.providerId === 'string' ? body.providerId.trim() : '';\n          const factoryModelId = typeof body.factoryModelId === 'string' ? body.factoryModelId.trim() : '';\n          if (!providerId) return c.json({ error: 'Missing required field: providerId' }, 400);\n\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n\n          try {\n            const tenantCredentials = await listTenantCredentialsForRequest({\n              c: loose(c),\n              auth,\n              credentials: options.modelCredentials,\n            });\n            const access = await buildProviderAccess({\n              controller,\n              authStorage: tenantCredentials ? undefined : authStorage,\n              tenantCredentials,\n            });\n            if (!access[providerId]) return c.json({ error: `Provider \"${providerId}\" is not configured` }, 400);\n\n            const modelId = providerOMModelId(providerId, factoryModelId);\n            const record = await context.storage.patch({\n              orgId: context.orgId,\n              userId: context.userId,\n              patch: {},\n              fillIfUnset: { observerModelId: modelId, reflectorModelId: modelId },\n            });\n            return c.json({ ok: true, config: readStoredOMConfig(record) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      // ── Observational memory ──────────────────────────────────────────────────\n      // Mirrors the TUI's /om command. All five knobs are durably stored in the\n      // per-(org, user) `memory-settings` app table — never settings.json. When a\n      // session is supplied, changes are also applied to its state and thread.\n\n      registerApiRoute('/web/config/om', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const resourceId = c.req.query('resourceId');\n          const scope = c.req.query('scope') || undefined;\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });\n            if (!resourceId) return c.json({ config: readStoredOMConfig(record) });\n\n            // Session sync is best-effort: the stored row is authoritative and\n            // new sessions hydrate from it, so a resourceId without a live\n            // session (e.g. settings page after a restart) still reads the\n            // stored config instead of failing.\n            const session = await controller.getSessionByResource?.(resourceId, scope);\n            if (!session) return c.json({ config: readStoredOMConfig(record) });\n            await hydrateSessionMemorySettings(session, record);\n            return c.json({ config: readOMConfig(session) });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/:role/model', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const role = c.req.param('role');\n          if (role !== 'observer' && role !== 'reflector') {\n            return c.json({ error: `Unknown OM role \"${role}\"` }, 400);\n          }\n          let body: { resourceId?: unknown; modelId?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const modelId = typeof body.modelId === 'string' ? body.modelId.trim() : '';\n          if (!modelId) return c.json({ error: 'Missing required field: modelId' }, 400);\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            // Best-effort session sync: persist regardless, apply to the live\n            // session only when one exists for the resourceId.\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            const otherRole = session ? (role === 'observer' ? session.om.reflector : session.om.observer) : undefined;\n            const otherRoleCurrentModelId = otherRole?.modelId() ?? null;\n            await session?.om[role].switchModel({ modelId });\n            // Pin the other role's current model too, so a later restart\n            // doesn't drift it once this role is explicitly overridden. The\n            // \"only if still unset\" check runs inside the storage layer's\n            // atomic update, so a concurrent explicit switch of the other\n            // role is never clobbered by this fill.\n            const otherKey = role === 'observer' ? 'reflectorModelId' : 'observerModelId';\n            await persistMemorySettings(\n              context,\n              { [role === 'observer' ? 'observerModelId' : 'reflectorModelId']: modelId },\n              otherRoleCurrentModelId ? { [otherKey]: otherRoleCurrentModelId } : undefined,\n            );\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/thresholds', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: {\n            resourceId?: unknown;\n            observationThreshold?: unknown;\n            reflectionThreshold?: unknown;\n            scope?: unknown;\n          };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const observation =\n            typeof body.observationThreshold === 'number' && body.observationThreshold > 0\n              ? Math.round(body.observationThreshold)\n              : undefined;\n          const reflection =\n            typeof body.reflectionThreshold === 'number' && body.reflectionThreshold > 0\n              ? Math.round(body.reflectionThreshold)\n              : undefined;\n          if (observation === undefined && reflection === undefined) {\n            return c.json({ error: 'Provide observationThreshold and/or reflectionThreshold (positive numbers)' }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            // Best-effort session sync: persist regardless, apply to the live\n            // session only when one exists for the resourceId.\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (observation !== undefined && session) {\n              await session.state.set({ observationThreshold: observation });\n              await session.thread.setSetting({ key: 'observationThreshold', value: observation });\n            }\n            if (reflection !== undefined && session) {\n              await session.state.set({ reflectionThreshold: reflection });\n              await session.thread.setSetting({ key: 'reflectionThreshold', value: reflection });\n            }\n            await persistMemorySettings(context, {\n              ...(observation !== undefined ? { observationThreshold: observation } : {}),\n              ...(reflection !== undefined ? { reflectionThreshold: reflection } : {}),\n            });\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n\n      registerApiRoute('/web/config/om/observe-attachments', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          let body: { resourceId?: unknown; value?: unknown; scope?: unknown };\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const resourceId = typeof body.resourceId === 'string' ? body.resourceId : '';\n          const scope = typeof body.scope === 'string' && body.scope ? body.scope : undefined;\n          const raw = body.value;\n          const value: 'auto' | boolean = raw === 'auto' || raw === true || raw === false ? raw : 'auto';\n          if (raw !== 'auto' && raw !== true && raw !== false) {\n            return c.json({ error: \"value must be 'auto', true, or false\" }, 400);\n          }\n          const context = await resolveMemorySettingsContext({\n            c: loose(c),\n            auth,\n            memorySettings: options.memorySettings,\n          });\n          if ('response' in context) return context.response;\n          try {\n            // Best-effort session sync: persist regardless, apply to the live\n            // session only when one exists for the resourceId.\n            const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : undefined;\n            if (session) {\n              await session.state.set({ observeAttachments: value });\n              await session.thread.setSetting({ key: 'observeAttachments', value });\n            }\n            await persistMemorySettings(context, { observeAttachments: value });\n            const config = session\n              ? readOMConfig(session)\n              : readStoredOMConfig(await context.storage.get({ orgId: context.orgId, userId: context.userId }));\n            return c.json({ ok: true, config });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n","/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  | { mode: 'local' }\n  | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AACA,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,qBAAqB,uCAAuC;AAGrE,SAAS,wBAAwB;;;ACuB1B,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,aAAa,WAAW,iBAAiB;AAClD;AAQO,IAAM,uBAAmE;AAAA,EAC9E,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,KAAK;AACP;AAWA,eAAsB,4BACpB,aAC8C;AAC9C,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,YAAY,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;AAOA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF,GAKwD;AACtD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,QAAQ;AAIX,QAAI,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC9E,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,QACV;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO;AACtF;AASA,eAAsB,gCAAgC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACF,GAK4C;AAC1C,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,OAAQ,QAAO,KAAK,QAAQ,IAAI,CAAC,IAAI;AAC1C,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,SAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE;;;ACjGO,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;AFjBA,SAAS,MAAM,GAAqB;AAClC,SAAO;AACT;AAiGA,eAAsB,cAAc;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,OAAO,oBAAI,IAA0B;AAE3C,aAAW,SAAS,QAAQ;AAC1B,QAAI,KAAK,IAAI,MAAM,QAAQ,EAAG;AAE9B,UAAM,iBAAiB,kBAAkB,MAAM,QAAQ;AACvD,QAAI,SAAiC;AACrC,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,UAAI,SAAS,WAAW,SAAS,SAAS;AACxC,iBAAS;AAAA,MACX,WAAW,SAAS,WAAW,SAAS,WAAW;AACjD,iBAAS;AAAA,MACX,WAAW,QAAQ,WAAW,SAAS,WAAW;AAChD,iBAAS;AAAA,MACX;AAAA,IACF,WAAW,aAAa,WAAW,cAAc,GAAG;AAClD,eAAS;AAAA,IACX,WAAW,aAAa,gBAAgB,MAAM,QAAQ,GAAG;AACvD,eAAS;AAAA,IACX,WAAW,MAAM,gBAAgB,QAAQ,IAAI,MAAM,YAAY,GAAG;AAChE,eAAS;AAAA,IACX,WAAW,MAAM,WAAW;AAC1B,eAAS;AAAA,IACX;AAEA,UAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,SAAK,IAAI,MAAM,UAAU;AAAA,MACvB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,GAAI,WAAW,EAAE,OAAO,EAAE,WAAW,MAAe,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AACtF;AAYA,SAAS,qBAAqB,QAAkD;AAC9E,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,WAAW,QAAQ,OAAO,MAAM;AAAA,IAChC,QAAQ,OAAO;AAAA,EACjB;AACF;AAcA,eAAe,8BAA8B;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AACF,GAI6D;AAC3D,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,iBAAiB;AACnB,QAAI;AACF,YAAM,gBAAgB,YAAY;AAClC,aAAO,SACH,EAAE,SAAS,iBAAiB,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IAC9E,EAAE,SAAS,iBAAiB,OAAO,SAAS,QAAQ,QAAQ;AAAA,IAClE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,wBAAwB,MAA0D;AACzF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,OAAO,oBAAoB;AAC3E,QAAM,IAAI;AACV,QAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,+BAA+B;AAC1D,QAAM,MAAM,OAAO,EAAE,QAAQ,WAAW,EAAE,IAAI,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,EAAE,OAAO,8BAA8B;AACxD,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,aAAO,EAAE,OAAO,6BAA6B;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,0BAA0B;AAAA,EAC5C;AACA,QAAM,SAAS,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,KAAK,IAAI;AACnF,QAAM,SAAS,MAAM,QAAQ,EAAE,MAAM,IACjC,EAAE,OAAO,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,IACnG,CAAC;AACL,SAAO,EAAE,MAAM,KAAK,QAAQ,OAAO;AACrC;AAeA,eAAsB,oBAAoB;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AACF,GAI4B;AAC1B,QAAM,SAAS,MAAM,WAAW,oBAAoB;AACpD,QAAM,cAAc,CAAC,aAAqB,OAAO,KAAK,OAAK,EAAE,aAAa,YAAY,EAAE,SAAS;AACjG,QAAM,cAAc,CAAC,aAA0C;AAC7D,UAAM,iBAAiB,kBAAkB,QAAQ;AACjD,QAAI,mBAAmB;AACrB,YAAM,UAAU,kBAAkB,KAAK,OAAK,EAAE,UAAU,UAAU,EAAE,aAAa,cAAc;AAC/F,YAAM,SAAS,kBAAkB,KAAK,OAAK,EAAE,UAAU,SAAS,EAAE,aAAa,cAAc;AAC7F,YAAM,aAAa,SAAS,cAAc,QAAQ;AAClD,UAAI,YAAY,SAAS,QAAS,QAAO;AACzC,UAAI,YAAY,SAAS,aAAa,WAAW,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC/E,aAAO;AAAA,IACT;AAEA,UAAM,kBAAkB,aAAa,IAAI,cAAc;AACvD,QAAI,iBAAiB,SAAS,QAAS,QAAO;AAC9C,QAAI,aAAa,gBAAgB,QAAQ,EAAG,QAAO;AACnD,UAAM,mBAAmB,aAAa,IAAI,QAAQ;AAClD,QAAI,kBAAkB,SAAS,aAAa,iBAAiB,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAC3F,WAAO,YAAY,QAAQ,IAAI,WAAW;AAAA,EAC5C;AACA,QAAM,SAAyB;AAAA,IAC7B,WAAW,YAAY,WAAW;AAAA,IAClC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,UAAU,YAAY,UAAU;AAAA,IAChC,kBAAkB,YAAY,gBAAgB;AAAA,EAChD;AACA,QAAM,OAAO,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AACxC,aAAW,KAAK,QAAQ;AACtB,QAAI,CAAC,KAAK,IAAI,EAAE,QAAQ,GAAG;AACzB,aAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,QAAQ;AAC3C,WAAK,IAAI,EAAE,QAAQ;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,QAAwB,UAA2B;AAC9E,SAAO,QAAQ,OAAO,QAAQ,CAAC;AACjC;AAeA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkD;AAChD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,YAAY;AACd,QAAI;AACF,YAAM,WAAW,YAAY;AAC7B,aAAO,SACH,EAAE,SAAS,YAAY,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IACzE,EAAE,SAAS,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,IAC7D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,iBAAiB,QAAmC;AAC3D,SAAO,EAAE,IAAI,UAAU,OAAO,EAAE,IAAI,MAAM,OAAO,MAAM,aAAa,qBAAqB,QAAQ,OAAO,OAAO;AACjH;AAQA,eAAsB,eAAe;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAM6B;AAC3B,QAAM,SAAS,MAAM,oBAAoB,EAAE,YAAY,aAAa,kBAAkB,CAAC;AACvF,QAAM,QAAQ;AAAA,IACZ,GAAG,sBAAsB,MAAM;AAAA,IAC/B,IAAI,MAAM,YAAY,QAAQ,KAAK,EAAE,OAAO,YAAY,MAAM,CAAC,GAAG,IAAI,gBAAgB;AAAA,EACxF;AACA,SAAO,MACJ,OAAO,OAAK,EAAE,OAAO,QAAQ,EAC7B,IAAI,QAAM;AAAA,IACT,GAAG;AAAA,IACH,QAAQ,EAAE,GAAG,WAAW,SAAS;AAAA,IACjC,QAAQ,gBAAgB,QAAQ,EAAE,OAAO;AAAA,EAC3C,EAAE;AACN;AAGA,eAAe,oBAAoB,SAA0D;AAC3F,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,WAAW,QAAQ,OAAO,MAAM;AACtC,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,UAAU,MAAM,QAAQ,OAAO,KAAK,GAAG,KAAK,OAAK,EAAE,OAAO,QAAQ;AACxE,QAAM,QAAQ,QAAQ,WAAW,+BAA+B;AAChE,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAOA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIkB;AAChB,QAAM,QAAQ,WAAW,YAAY,KAAK,CAAC;AAC3C,QAAM,aAAa,KAAK;AAExB,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,WAAW,KAAK,EAAE;AAClC,QAAI,SAAS;AACX,WAAK,iBAAiB;AACtB,YAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,eAAe,KAAK,EAAE,IAAI,OAAO,QAAQ,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,mBAAmB,WAAW,QAAQ,KAAK,IAAI,CAAC;AACtD,MAAI,kBAAkB;AACpB,UAAM,QAAQ,MAAM,OAAO,EAAE,SAAS,iBAAiB,CAAC;AAAA,EAC1D;AAEA,QAAM,kBAA0C,EAAE,SAAS,QAAQ,MAAM,QAAQ,SAAS,QAAQ;AAClG,aAAW,CAAC,WAAW,MAAM,KAAK,OAAO,QAAQ,eAAe,GAAG;AACjE,UAAM,YAAY,WAAW,MAAM;AACnC,QAAI,WAAW;AACb,YAAM,QAAQ,UAAU,MAAM,IAAI,EAAE,SAAS,WAAW,UAAU,CAAC;AAAA,IACrE;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,iCAAiC,OAAO,KAAK,GAAG,CAAC;AAC1F;AAQA,IAAM,gCAAgC;AACtC,IAAM,+BAA+B;AAgBrC,SAAS,kBAAkB,YAAoB,gBAAgC;AAC7E,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,kBAAkB;AAAA,EAC7B;AACF;AAEO,SAAS,aAAa,SAAkC;AAC7D,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,qBAAqB,MAAM;AACjC,SAAO;AAAA,IACL,iBAAiB,QAAQ,GAAG,SAAS,QAAQ,KAAK;AAAA,IAClD,kBAAkB,QAAQ,GAAG,UAAU,QAAQ,KAAK;AAAA,IACpD,sBAAsB,QAAQ,GAAG,SAAS,UAAU,KAAK;AAAA,IACzD,qBAAqB,QAAQ,GAAG,UAAU,UAAU,KAAK;AAAA,IACzD,oBAAoB,uBAAuB,QAAQ,uBAAuB,QAAQ,qBAAqB;AAAA,EACzG;AACF;AAEA,SAAS,mBAAmB,QAAmD;AAC7E,SAAO;AAAA,IACL,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,sBAAsB,QAAQ,wBAAwB;AAAA,IACtD,qBAAqB,QAAQ,uBAAuB;AAAA,IACpD,oBAAoB,QAAQ,sBAAsB;AAAA,EACpD;AACF;AAeA,eAAe,6BAA6B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AACF,GAI4D;AAC1D,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,UAAU,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AACzF,MAAI,gBAAgB;AAClB,QAAI;AACF,YAAM,eAAe,YAAY;AACjC,aAAO,SACH,EAAE,SAAS,gBAAgB,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO,IAC7E,EAAE,SAAS,gBAAgB,OAAO,SAAS,QAAQ,QAAQ;AAAA,IACjE,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,eAAe,sBACb,SACA,OACA,aACe;AACf,QAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,OAAO,YAAY,CAAC;AAClG;AASA,eAAe,6BAA6B,SAAoB,QAAoD;AAClH,aAAW,QAAQ,CAAC,YAAY,WAAW,GAAY;AACrD,UAAM,SAAS,SAAS,aAAa,QAAQ,kBAAkB,QAAQ;AACvE,UAAM,SAAS,UAAU;AACzB,QAAI,QAAQ,GAAG,IAAI,EAAE,QAAQ,MAAM,QAAQ;AACzC,YAAM,QAAQ,GAAG,IAAI,EAAE,YAAY,EAAE,SAAS,OAAO,CAAC;AAAA,IACxD;AAAA,EACF;AACA,QAAM,QAAQ,QAAQ,MAAM,IAAI,KAAK,CAAC;AACtC,QAAM,UAAyB,CAAC;AAChC,QAAM,uBAAuB,QAAQ,wBAAwB;AAC7D,MAAI,MAAM,yBAAyB,sBAAsB;AACvD,YAAQ,uBAAuB;AAAA,EACjC;AACA,QAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,MAAI,MAAM,wBAAwB,qBAAqB;AACrD,YAAQ,sBAAsB;AAAA,EAChC;AACA,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,OAAK,MAAM,sBAAsB,YAAY,oBAAoB;AAC/D,YAAQ,qBAAqB;AAAA,EAC/B;AACA,MAAI,OAAO,KAAK,OAAO,EAAE,SAAS,EAAG,OAAM,QAAQ,MAAM,IAAI,OAAO;AACtE;AAkCO,IAAM,eAAN,cAA2B,MAAwB;AAAA,EACxD,SAAqB;AACnB,UAAM,UAAU,KAAK;AACrB,UAAM,EAAE,YAAY,aAAa,KAAK,IAAI;AAC1C,UAAM,uBAAuB,QAAQ,yBAAyB,MAAM;AAAA,IAAC;AACrE,UAAM,2BAA2B,QAAQ,6BAA6B,MAAM;AAAA,IAAC;AAE7E,WAAO;AAAA,MACL,iBAAiB,yBAAyB;AAAA,QACxC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAGF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,WAAW,MAAM,cAAc;AAAA,gBAC7B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,IAAI,KAAK,IAAI;AAC7D,cAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AACrE,gBAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAC/D,gBAAM,QAAQ,KAAK,UAAU,QAAQ,QAAQ;AAC7C,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAG/F,oBAAM,IAAI,QAAQ,cAAc,QAAQ,kBAAkB,QAAQ,GAAG,EAAE,MAAM,WAAW,IAAI,CAAC;AAC7F,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AAErF,wBAAY,gBAAgB,UAAU,KAAK,MAAM;AACjD,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,uCAAuC;AAAA,QACtD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,yBAAyB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,QAAQ,iBAAiB,CAAC;AACvG,cAAI,cAAc,IAAK,QAAO,IAAI;AAElC,gBAAM,WAAW,EAAE,IAAI,MAAM,UAAU;AACvC,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;AACvD,cAAI;AACF,gBAAI,IAAI,SAAS,UAAU;AACzB,kBAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAAI;AAC7E,uBAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,GAAG,GAAG;AAAA,cAC7D;AACA,oBAAM,SAAS,UAAU,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO;AAC/F,oBAAM,IAAI,QAAQ,iBAAiB,QAAQ,kBAAkB,QAAQ,CAAC;AACtE,mCAAqB,MAAM;AAC3B,oBAAM,UAAU,MAAM,IAAI,QAAQ,gBAAgB,IAAI,OAAO,IAAI,MAAM;AACvE,oBAAMA,aAAY,MAAM,cAAc,EAAE,YAAY,mBAAmB,QAAQ,CAAC;AAChF,qBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAUA,WAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,YACpF;AACA,gBAAI,CAAC,YAAa,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;AACrF,wBAAY,OAAO,UAAU,QAAQ,EAAE;AACvC,kBAAM,YAAY,MAAM,cAAc,EAAE,YAAY,YAAY,CAAC;AACjE,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,UAAU,KAAK,OAAK,EAAE,aAAa,QAAQ,EAAE,CAAC;AAAA,UACpF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,cAAI;AACF,kBAAM,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC;AAC3D,mBAAO,EAAE,KAAK,EAAE,WAAW,QAAQ,IAAI,oBAAoB,EAAE,CAAC;AAAA,UAChE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,gCAAgC;AAAA,QAC/C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,SAAS,wBAAwB,IAAI;AAC3C,cAAI,WAAW,OAAQ,QAAO,EAAE,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,GAAG;AAEjE,gBAAM,aACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,eAAe,WACtF,KAAiC,aACnC;AACN,cAAI;AACF,kBAAM,SAAS,MAAM,IAAI,QAAQ,OAAO;AAAA,cACtC,OAAO,IAAI;AAAA,cACX,QAAQ,IAAI;AAAA,cACZ,OAAO;AAAA,gBACL,YAAY,oBAAoB,OAAO,IAAI;AAAA,gBAC3C,MAAM,OAAO;AAAA,gBACb,KAAK,OAAO;AAAA,gBACZ,QAAQ,OAAO;AAAA,gBACf,QAAQ,OAAO;AAAA,cACjB;AAAA,cACA,oBAAoB;AAAA,YACtB,CAAC;AACD,qCAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;AAC7C,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,UAAU,qBAAqB,MAAM,EAAE,CAAC;AAAA,UACpE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,oCAAoC;AAAA,QACnD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,MAAM,MAAM,8BAA8B;AAAA,YAC9C,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,iBAAiB,QAAQ;AAAA,UAC3B,CAAC;AACD,cAAI,cAAc,IAAK,QAAO,IAAI;AAClC,gBAAM,KAAK,EAAE,IAAI,MAAM,IAAI;AAC3B,cAAI;AACF,kBAAM,IAAI,QAAQ,OAAO,EAAE,OAAO,IAAI,OAAO,YAAY,GAAG,CAAC;AAC7D,qCAAyB,EAAE,OAAO,IAAI,MAAM,CAAC;AAC7C,mBAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,UAC5B,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,sBAAsB;AAAA,QACrC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,cACzC,WAAW,oBAAoB;AAAA,cAC/B,oBAAoB;AAAA,gBAClB;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,cACF,CAAC;AAAA,YACH,CAAC;AACD,kBAAM,UAAU,OACb,OAAO,OAAK,oBAAoB,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,OAAO,QAAQ,EAC/E,IAAI,QAAM,EAAE,IAAI,EAAE,IAAK,UAAU,EAAE,UAAU,WAAW,EAAE,WAAW,WAAW,KAAK,EAAE;AAK1F,gBAAI,QAAQ,iBAAiB;AAC3B,kBAAI;AACF,sBAAM,MAAM,MAAM,8BAA8B;AAAA,kBAC9C,GAAG,MAAM,CAAC;AAAA,kBACV;AAAA,kBACA,iBAAiB,QAAQ;AAAA,gBAC3B,CAAC;AACD,oBAAI,EAAE,cAAc,MAAM;AACxB,wBAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,OAAK,EAAE,EAAE,CAAC;AAC5C,6BAAW,UAAU,MAAM,IAAI,QAAQ,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG;AACjE,+BAAW,SAAS,OAAO,QAAQ;AACjC,4BAAM,KAAK,GAAG,OAAO,UAAU,IAAI,KAAK;AACxC,0BAAI,MAAM,IAAI,EAAE,EAAG;AACnB,4BAAM,IAAI,EAAE;AACZ,8BAAQ,KAAK,EAAE,IAAI,UAAU,OAAO,YAAY,WAAW,OAAO,WAAW,KAAK,CAAC;AAAA,oBACrF;AAAA,kBACF;AAAA,gBACF;AAAA,cACF,QAAQ;AAAA,cAER;AAAA,YACF;AACA,mBAAO,EAAE,KAAK;AAAA,cACZ,QAAQ,QAAQ;AAAA,gBAAK,CAAC,GAAG,MACvB,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,cAAc,EAAE,QAAQ;AAAA,cAC5F;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQD,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,cAAI;AACF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,kBAAM,eAAe,MAAM,oBAAoB,OAAO;AACtD,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,mBAAO,EAAE,KAAK;AAAA,cACZ,OAAO,MAAM,eAAe;AAAA,gBAC1B;AAAA,gBACA,aAAa,oBAAoB,SAAY;AAAA,gBAC7C;AAAA,gBACA;AAAA,gBACA;AAAA,cACF,CAAC;AAAA,cACD;AAAA,YACF,CAAC;AAAA,UACH,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,2BAA2B;AAAA,QAC1C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AAChE,cAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AACvE,gBAAM,IAAK,KAAK,UAAU,CAAC;AAC3B,gBAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,KAAK,IAAI;AAC7D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAC1D,cAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;AAC5B,mBAAO,EAAE,KAAK,EAAE,OAAO,yDAAyD,GAAG,GAAG;AAAA,UACxF;AACA,cAAI;AACF,kBAAM,SAAS,MAAM,YAAY,QAAQ,OAAO;AAAA,cAC9C,OAAO,YAAY;AAAA,cACnB,QAAQ,YAAY;AAAA,cACpB,OAAO,EAAE,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,EAAE;AAAA,YAC/C,CAAC;AACD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,MAAM,iBAAiB,MAAM,EAAE,CAAC;AAAA,UAC5D,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,+BAA+B;AAAA,QAC9C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACF,kBAAM,WAAW,GAAG,WAAW,SAAS,IAAI,GAAG,MAAM,UAAU,MAAM,IAAI;AACzE,kBAAM,UAAU,MAAM,YAAY,QAAQ,OAAO,EAAE,OAAO,YAAY,OAAO,IAAI,SAAS,CAAC;AAC3F,mBAAO,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAAA,UACvF,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,wCAAwC;AAAA,QACvD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,cAAc,MAAM,mBAAmB,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,YAAY,QAAQ,WAAW,CAAC;AAClG,cAAI,cAAc,YAAa,QAAO,YAAY;AAClD,gBAAM,KAAK,mBAAmB,EAAE,IAAI,MAAM,IAAI,CAAC;AAC/C,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AACnF,cAAI;AACF,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,UAAU,IAAI,GAAG,GAAG;AACvF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,QAAQ,MAAM,eAAe;AAAA,cACjC;AAAA,cACA,aAAa,oBAAoB,SAAY;AAAA,cAC7C;AAAA,cACA;AAAA,YACF,CAAC;AACD,kBAAM,OAAO,MAAM,KAAK,OAAK,EAAE,OAAO,EAAE;AACxC,gBAAI,CAAC,KAAM,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI,GAAG,GAAG;AAC/D,kBAAM,mBAAmB,EAAE,YAAY,SAAS,KAAK,CAAC;AACtD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,cAAc,KAAK,GAAG,CAAC;AAAA,UACnD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,oCAAoC;AAAA,QACnD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,KAAK,IAAI;AAClF,gBAAM,iBAAiB,OAAO,KAAK,mBAAmB,WAAW,KAAK,eAAe,KAAK,IAAI;AAC9F,cAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;AAEnF,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAE1C,cAAI;AACF,kBAAM,oBAAoB,MAAM,gCAAgC;AAAA,cAC9D,GAAG,MAAM,CAAC;AAAA,cACV;AAAA,cACA,aAAa,QAAQ;AAAA,YACvB,CAAC;AACD,kBAAM,SAAS,MAAM,oBAAoB;AAAA,cACvC;AAAA,cACA,aAAa,oBAAoB,SAAY;AAAA,cAC7C;AAAA,YACF,CAAC;AACD,gBAAI,CAAC,OAAO,UAAU,EAAG,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,UAAU,sBAAsB,GAAG,GAAG;AAEnG,kBAAM,UAAU,kBAAkB,YAAY,cAAc;AAC5D,kBAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM;AAAA,cACzC,OAAO,QAAQ;AAAA,cACf,QAAQ,QAAQ;AAAA,cAChB,OAAO,CAAC;AAAA,cACR,aAAa,EAAE,iBAAiB,SAAS,kBAAkB,QAAQ;AAAA,YACrE,CAAC;AACD,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,QAAQ,mBAAmB,MAAM,EAAE,CAAC;AAAA,UAChE,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAOD,iBAAiB,kBAAkB;AAAA,QACjC,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,aAAa,EAAE,IAAI,MAAM,YAAY;AAC3C,gBAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AACF,kBAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACzF,gBAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,QAAQ,mBAAmB,MAAM,EAAE,CAAC;AAMrE,kBAAM,UAAU,MAAM,WAAW,uBAAuB,YAAY,KAAK;AACzE,gBAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,QAAQ,mBAAmB,MAAM,EAAE,CAAC;AAClE,kBAAM,6BAA6B,SAAS,MAAM;AAClD,mBAAO,EAAE,KAAK,EAAE,QAAQ,aAAa,OAAO,EAAE,CAAC;AAAA,UACjD,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,8BAA8B;AAAA,QAC7C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,gBAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,cAAI,SAAS,cAAc,SAAS,aAAa;AAC/C,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,UAC3D;AACA,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,KAAK,IAAI;AACzE,cAAI,CAAC,QAAS,QAAO,EAAE,KAAK,EAAE,OAAO,kCAAkC,GAAG,GAAG;AAC7E,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AAGF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,kBAAM,YAAY,UAAW,SAAS,aAAa,QAAQ,GAAG,YAAY,QAAQ,GAAG,WAAY;AACjG,kBAAM,0BAA0B,WAAW,QAAQ,KAAK;AACxD,kBAAM,SAAS,GAAG,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAM/C,kBAAM,WAAW,SAAS,aAAa,qBAAqB;AAC5D,kBAAM;AAAA,cACJ;AAAA,cACA,EAAE,CAAC,SAAS,aAAa,oBAAoB,kBAAkB,GAAG,QAAQ;AAAA,cAC1E,0BAA0B,EAAE,CAAC,QAAQ,GAAG,wBAAwB,IAAI;AAAA,YACtE;AACA,kBAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC;AAClG,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UACpC,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,6BAA6B;AAAA,QAC5C,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AAMJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,cACJ,OAAO,KAAK,yBAAyB,YAAY,KAAK,uBAAuB,IACzE,KAAK,MAAM,KAAK,oBAAoB,IACpC;AACN,gBAAM,aACJ,OAAO,KAAK,wBAAwB,YAAY,KAAK,sBAAsB,IACvE,KAAK,MAAM,KAAK,mBAAmB,IACnC;AACN,cAAI,gBAAgB,UAAa,eAAe,QAAW;AACzD,mBAAO,EAAE,KAAK,EAAE,OAAO,6EAA6E,GAAG,GAAG;AAAA,UAC5G;AACA,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AAGF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,gBAAI,gBAAgB,UAAa,SAAS;AACxC,oBAAM,QAAQ,MAAM,IAAI,EAAE,sBAAsB,YAAY,CAAC;AAC7D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,wBAAwB,OAAO,YAAY,CAAC;AAAA,YACrF;AACA,gBAAI,eAAe,UAAa,SAAS;AACvC,oBAAM,QAAQ,MAAM,IAAI,EAAE,qBAAqB,WAAW,CAAC;AAC3D,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,uBAAuB,OAAO,WAAW,CAAC;AAAA,YACnF;AACA,kBAAM,sBAAsB,SAAS;AAAA,cACnC,GAAI,gBAAgB,SAAY,EAAE,sBAAsB,YAAY,IAAI,CAAC;AAAA,cACzE,GAAI,eAAe,SAAY,EAAE,qBAAqB,WAAW,IAAI,CAAC;AAAA,YACxE,CAAC;AACD,kBAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC;AAClG,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UACpC,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MAED,iBAAiB,sCAAsC;AAAA,QACrD,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,OAAM,MAAK;AAClB,cAAI;AACJ,cAAI;AACF,mBAAO,MAAM,EAAE,IAAI,KAAK;AAAA,UAC1B,QAAQ;AACN,mBAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;AAAA,UACnD;AACA,gBAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;AAC3E,gBAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC1E,gBAAM,MAAM,KAAK;AACjB,gBAAM,QAA0B,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AACxF,cAAI,QAAQ,UAAU,QAAQ,QAAQ,QAAQ,OAAO;AACnD,mBAAO,EAAE,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;AAAA,UACtE;AACA,gBAAM,UAAU,MAAM,6BAA6B;AAAA,YACjD,GAAG,MAAM,CAAC;AAAA,YACV;AAAA,YACA,gBAAgB,QAAQ;AAAA,UAC1B,CAAC;AACD,cAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,cAAI;AAGF,kBAAM,UAAU,aAAa,MAAM,WAAW,uBAAuB,YAAY,KAAK,IAAI;AAC1F,gBAAI,SAAS;AACX,oBAAM,QAAQ,MAAM,IAAI,EAAE,oBAAoB,MAAM,CAAC;AACrD,oBAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,sBAAsB,MAAM,CAAC;AAAA,YACtE;AACA,kBAAM,sBAAsB,SAAS,EAAE,oBAAoB,MAAM,CAAC;AAClE,kBAAM,SAAS,UACX,aAAa,OAAO,IACpB,mBAAmB,MAAM,QAAQ,QAAQ,IAAI,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC,CAAC;AAClG,mBAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,UACpC,SAAS,OAAO;AACd,mBAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;AAAA,UACtF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["providers"]}

package/dist/routes/surface.js

@@ -26047,7 +26047,7 @@ var ConfigRoutes = class extends Route {
             const record = await context.storage.get({ orgId: context.orgId, userId: context.userId });
             if (!resourceId) return c.json({ config: readStoredOMConfig(record) });
             const session = await controller.getSessionByResource?.(resourceId, scope);
-            if (!session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
+            if (!session) return c.json({ config: readStoredOMConfig(record) });
             await hydrateSessionMemorySettings(session, record);
             return c.json({ config: readOMConfig(session) });
           } catch (error) {
@@ -26081,7 +26081,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             const otherRole = session ? role === "observer" ? session.om.reflector : session.om.observer : void 0;
             const otherRoleCurrentModelId = otherRole?.modelId() ?? null;
             await session?.om[role].switchModel({ modelId });
@@ -26123,7 +26122,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (observation !== void 0 && session) {
               await session.state.set({ observationThreshold: observation });
               await session.thread.setSetting({ key: "observationThreshold", value: observation });
@@ -26168,7 +26166,6 @@ var ConfigRoutes = class extends Route {
           if ("response" in context) return context.response;
           try {
             const session = resourceId ? await controller.getSessionByResource?.(resourceId, scope) : void 0;
-            if (resourceId && !session) return c.json({ error: `No session for resourceId "${resourceId}"` }, 404);
             if (session) {
               await session.state.set({ observeAttachments: value });
               await session.thread.setSetting({ key: "observeAttachments", value });