@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.2

package/dist/storage/domains/credentials/base.js

@@ -1,257 +1,273 @@
-// src/storage/domains/credentials/base.ts
 import { FactoryStorageDomain, UniqueViolationError } from "@mastra/core/storage";
+//#region src/storage/domains/credentials/base.ts
+/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */
 function isOAuthCredentialExpired(credential, now = Date.now()) {
-  return now >= credential.expires;
+	return now >= credential.expires;
 }
+/** OAuth plan credentials are personal and must always have an owning user. */
 function assertCredentialScope(tenant, credential) {
-  if (credential.type === "oauth" && !tenant.userId) {
-    throw new Error("OAuth credentials must be user-scoped");
-  }
+	if (credential.type === "oauth" && !tenant.userId) throw new Error("OAuth credentials must be user-scoped");
 }
-var MODEL_CREDENTIALS_SCHEMA = {
-  name: "model_provider_credentials",
-  columns: {
-    id: { type: "uuid-pk" },
-    org_id: { type: "text" },
-    user_id: { type: "text", nullable: true },
-    provider: { type: "text" },
-    type: { type: "text" },
-    data: { type: "json" },
-    created_at: { type: "timestamp" },
-    updated_at: { type: "timestamp" }
-  },
-  uniqueIndexes: [
-    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared
-    // row), enforced by two partial unique indexes.
-    {
-      name: "model_provider_credentials_user_unique",
-      columns: ["org_id", "user_id", "provider"],
-      whereNotNull: "user_id"
-    },
-    { name: "model_provider_credentials_org_unique", columns: ["org_id", "provider"], whereNull: "user_id" }
-  ]
+const MODEL_CREDENTIALS_SCHEMA = {
+	name: "model_provider_credentials",
+	columns: {
+		id: { type: "uuid-pk" },
+		org_id: { type: "text" },
+		user_id: {
+			type: "text",
+			nullable: true
+		},
+		provider: { type: "text" },
+		type: { type: "text" },
+		data: { type: "json" },
+		created_at: { type: "timestamp" },
+		updated_at: { type: "timestamp" }
+	},
+	uniqueIndexes: [{
+		name: "model_provider_credentials_user_unique",
+		columns: [
+			"org_id",
+			"user_id",
+			"provider"
+		],
+		whereNotNull: "user_id"
+	}, {
+		name: "model_provider_credentials_org_unique",
+		columns: ["org_id", "provider"],
+		whereNull: "user_id"
+	}]
 };
-var OAUTH_LOGIN_SESSIONS_SCHEMA = {
-  name: "oauth_login_sessions",
-  columns: {
-    session_id: { type: "text", primaryKey: true },
-    org_id: { type: "text" },
-    user_id: { type: "text" },
-    provider: { type: "text" },
-    kind: { type: "text" },
-    pending: { type: "json" },
-    expires_at: { type: "timestamp" },
-    next_poll_at: { type: "timestamp", nullable: true },
-    created_at: { type: "timestamp" }
-  }
+const OAUTH_LOGIN_SESSIONS_SCHEMA = {
+	name: "oauth_login_sessions",
+	columns: {
+		session_id: {
+			type: "text",
+			primaryKey: true
+		},
+		org_id: { type: "text" },
+		user_id: { type: "text" },
+		provider: { type: "text" },
+		kind: { type: "text" },
+		pending: { type: "json" },
+		expires_at: { type: "timestamp" },
+		next_poll_at: {
+			type: "timestamp",
+			nullable: true
+		},
+		created_at: { type: "timestamp" }
+	}
 };
 function toSessionRow(db) {
-  return {
-    sessionId: db.session_id,
-    orgId: db.org_id,
-    userId: db.user_id,
-    provider: db.provider,
-    kind: db.kind,
-    pending: db.pending,
-    expiresAt: db.expires_at,
-    nextPollAt: db.next_poll_at,
-    createdAt: db.created_at
-  };
+	return {
+		sessionId: db.session_id,
+		orgId: db.org_id,
+		userId: db.user_id,
+		provider: db.provider,
+		kind: db.kind,
+		pending: db.pending,
+		expiresAt: db.expires_at,
+		nextPollAt: db.next_poll_at,
+		createdAt: db.created_at
+	};
 }
+/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */
 function tenantWhere(tenant, provider) {
-  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };
+	return {
+		org_id: tenant.orgId,
+		provider,
+		user_id: tenant.userId ?? null
+	};
 }
+/**
+* Model-credentials storage, written once against the generic
+* `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`
+* ride `updateAtomic` so concurrent replicas serialize instead of
+* invalidating each other's rotating tokens / double-claiming a flow.
+*/
 var ModelCredentialsStorage = class extends FactoryStorageDomain {
-  constructor() {
-    super("model-credentials");
-  }
-  async init() {
-    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);
-  }
-  async dangerouslyClearAll() {
-    await this.ops.deleteMany("oauth_login_sessions", {});
-    await this.ops.deleteMany("model_provider_credentials", {});
-  }
-  get #db() {
-    return this.ops;
-  }
-  /** Read the tenant's credential for a provider at exactly that scope. */
-  async getCredential(tenant, provider) {
-    const row = await this.#db.findOne("model_provider_credentials", tenantWhere(tenant, provider));
-    return row?.data;
-  }
-  /** Upsert the tenant's credential (`created_at` is preserved on update). */
-  async setCredential(tenant, provider, credential) {
-    assertCredentialScope(tenant, credential);
-    const where = tenantWhere(tenant, provider);
-    const update = async () => this.#db.updateMany("model_provider_credentials", where, {
-      type: credential.type,
-      data: credential,
-      updated_at: /* @__PURE__ */ new Date()
-    });
-    let lastError;
-    for (let attempt = 0; attempt < 2; attempt++) {
-      if (await update() > 0) return;
-      const now = /* @__PURE__ */ new Date();
-      try {
-        await this.#db.insertOne("model_provider_credentials", {
-          org_id: tenant.orgId,
-          user_id: tenant.userId ?? null,
-          provider,
-          type: credential.type,
-          data: credential,
-          created_at: now,
-          updated_at: now
-        });
-        return;
-      } catch (error) {
-        if (!(error instanceof UniqueViolationError)) throw error;
-        lastError = error;
-      }
-    }
-    throw lastError;
-  }
-  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */
-  async removeCredential(tenant, provider) {
-    const deleted = await this.#db.deleteMany("model_provider_credentials", tenantWhere(tenant, provider));
-    return deleted > 0;
-  }
-  /** All credentials visible to a user: their own rows plus the org's shared rows. */
-  async listCredentials(orgId, userId) {
-    const [userRows, orgRows] = await Promise.all([
-      this.#db.findMany("model_provider_credentials", { org_id: orgId, user_id: userId }),
-      this.#db.findMany("model_provider_credentials", { org_id: orgId, user_id: null })
-    ]);
-    return [
-      ...userRows.map((row) => ({
-        provider: row.provider,
-        scope: "user",
-        credential: row.data,
-        updatedAt: row.updated_at
-      })),
-      ...orgRows.map((row) => ({
-        provider: row.provider,
-        scope: "org",
-        credential: row.data,
-        updatedAt: row.updated_at
-      }))
-    ];
-  }
-  /**
-   * Resolve the credential a caller should use for a provider: the user's own
-   * row wins over the org's shared row.
-   */
-  async resolveCredential(orgId, userId, provider) {
-    const userRow = await this.#db.findOne("model_provider_credentials", {
-      org_id: orgId,
-      provider,
-      user_id: userId
-    });
-    if (userRow) return { provider: userRow.provider, scope: "user", credential: userRow.data };
-    const orgRow = await this.#db.findOne("model_provider_credentials", {
-      org_id: orgId,
-      provider,
-      user_id: null
-    });
-    if (orgRow) return { provider: orgRow.provider, scope: "org", credential: orgRow.data };
-    return void 0;
-  }
-  /**
-   * Refresh the tenant's OAuth credential under the backend's atomic
-   * read-modify-write so concurrent replicas don't invalidate each other's
-   * rotating refresh tokens. The expiry is re-checked under the lock —
-   * another replica may have refreshed already, in which case `refreshFn` is
-   * skipped and the fresh credential is returned. Returns `undefined` when no
-   * OAuth row exists for the tenant.
-   */
-  async refreshOAuth(tenant, provider, refreshFn) {
-    let result;
-    await this.#db.updateAtomic(
-      "model_provider_credentials",
-      tenantWhere(tenant, provider),
-      async (row) => {
-        if (row.data.type !== "oauth") return null;
-        const current = row.data;
-        if (!isOAuthCredentialExpired(current)) {
-          result = current;
-          return null;
-        }
-        const next = await refreshFn(current);
-        result = next;
-        return { data: next, updated_at: /* @__PURE__ */ new Date() };
-      }
-    );
-    return result;
-  }
-  /** Persist a pending login flow started by a web route. */
-  async createLoginSession(input) {
-    const inserted = await this.#db.insertOne("oauth_login_sessions", {
-      session_id: input.sessionId,
-      org_id: input.orgId,
-      user_id: input.userId,
-      provider: input.provider,
-      kind: input.kind,
-      pending: input.pending,
-      expires_at: input.expiresAt,
-      next_poll_at: input.nextPollAt ?? null,
-      created_at: /* @__PURE__ */ new Date()
-    });
-    return toSessionRow(inserted);
-  }
-  /**
-   * Read a pending login flow. An expired session is deleted on read (TTL
-   * cleanup) and reported as absent.
-   */
-  async getLoginSession(sessionId) {
-    const row = await this.#db.findOne("oauth_login_sessions", { session_id: sessionId });
-    if (!row) return void 0;
-    if (row.expires_at.getTime() <= Date.now()) {
-      await this.#db.deleteMany("oauth_login_sessions", { session_id: sessionId });
-      return void 0;
-    }
-    return toSessionRow(row);
-  }
-  /**
-   * Atomically claim a due login session for one upstream completion/poll attempt.
-   * Returns undefined when the session is missing, expired, owned by another
-   * tenant/provider, or already claimed by a concurrent request.
-   */
-  async claimLoginSession(sessionId, owner) {
-    const now = Date.now();
-    let claimed = false;
-    const updated = await this.#db.updateAtomic(
-      "oauth_login_sessions",
-      { session_id: sessionId },
-      (row) => {
-        if (row.org_id !== owner.orgId || row.user_id !== owner.userId || row.provider !== owner.provider || row.kind !== owner.kind) {
-          return null;
-        }
-        if (row.expires_at.getTime() <= now) return null;
-        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;
-        claimed = true;
-        return { next_poll_at: row.expires_at };
-      }
-    );
-    return claimed && updated ? toSessionRow(updated) : void 0;
-  }
-  /** Update a pending flow's serialized state and/or next allowed poll time. */
-  async touchLoginSession(sessionId, updates) {
-    const set = {};
-    if (updates.pending !== void 0) set.pending = updates.pending;
-    if (updates.nextPollAt !== void 0) set.next_poll_at = updates.nextPollAt;
-    if (Object.keys(set).length === 0) return;
-    await this.#db.updateMany("oauth_login_sessions", { session_id: sessionId }, set);
-  }
-  /** Remove a pending login flow (completed, cancelled, or failed). */
-  async deleteLoginSession(sessionId) {
-    await this.#db.deleteMany("oauth_login_sessions", { session_id: sessionId });
-  }
-};
-export {
-  MODEL_CREDENTIALS_SCHEMA,
-  ModelCredentialsStorage,
-  OAUTH_LOGIN_SESSIONS_SCHEMA,
-  assertCredentialScope,
-  isOAuthCredentialExpired
+	constructor() {
+		super("model-credentials");
+	}
+	async init() {
+		await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);
+	}
+	async dangerouslyClearAll() {
+		await this.ops.deleteMany("oauth_login_sessions", {});
+		await this.ops.deleteMany("model_provider_credentials", {});
+	}
+	get #db() {
+		return this.ops;
+	}
+	/** Read the tenant's credential for a provider at exactly that scope. */
+	async getCredential(tenant, provider) {
+		return (await this.#db.findOne("model_provider_credentials", tenantWhere(tenant, provider)))?.data;
+	}
+	/** Upsert the tenant's credential (`created_at` is preserved on update). */
+	async setCredential(tenant, provider, credential) {
+		assertCredentialScope(tenant, credential);
+		const where = tenantWhere(tenant, provider);
+		const update = async () => this.#db.updateMany("model_provider_credentials", where, {
+			type: credential.type,
+			data: credential,
+			updated_at: /* @__PURE__ */ new Date()
+		});
+		let lastError;
+		for (let attempt = 0; attempt < 2; attempt++) {
+			if (await update() > 0) return;
+			const now = /* @__PURE__ */ new Date();
+			try {
+				await this.#db.insertOne("model_provider_credentials", {
+					org_id: tenant.orgId,
+					user_id: tenant.userId ?? null,
+					provider,
+					type: credential.type,
+					data: credential,
+					created_at: now,
+					updated_at: now
+				});
+				return;
+			} catch (error) {
+				if (!(error instanceof UniqueViolationError)) throw error;
+				lastError = error;
+			}
+		}
+		throw lastError;
+	}
+	/** Delete the tenant's credential at exactly that scope. True when a row was removed. */
+	async removeCredential(tenant, provider) {
+		return await this.#db.deleteMany("model_provider_credentials", tenantWhere(tenant, provider)) > 0;
+	}
+	/** All credentials visible to a user: their own rows plus the org's shared rows. */
+	async listCredentials(orgId, userId) {
+		const [userRows, orgRows] = await Promise.all([this.#db.findMany("model_provider_credentials", {
+			org_id: orgId,
+			user_id: userId
+		}), this.#db.findMany("model_provider_credentials", {
+			org_id: orgId,
+			user_id: null
+		})]);
+		return [...userRows.map((row) => ({
+			provider: row.provider,
+			scope: "user",
+			credential: row.data,
+			updatedAt: row.updated_at
+		})), ...orgRows.map((row) => ({
+			provider: row.provider,
+			scope: "org",
+			credential: row.data,
+			updatedAt: row.updated_at
+		}))];
+	}
+	/**
+	* Resolve the credential a caller should use for a provider: the user's own
+	* row wins over the org's shared row.
+	*/
+	async resolveCredential(orgId, userId, provider) {
+		const userRow = await this.#db.findOne("model_provider_credentials", {
+			org_id: orgId,
+			provider,
+			user_id: userId
+		});
+		if (userRow) return {
+			provider: userRow.provider,
+			scope: "user",
+			credential: userRow.data
+		};
+		const orgRow = await this.#db.findOne("model_provider_credentials", {
+			org_id: orgId,
+			provider,
+			user_id: null
+		});
+		if (orgRow) return {
+			provider: orgRow.provider,
+			scope: "org",
+			credential: orgRow.data
+		};
+	}
+	/**
+	* Refresh the tenant's OAuth credential under the backend's atomic
+	* read-modify-write so concurrent replicas don't invalidate each other's
+	* rotating refresh tokens. The expiry is re-checked under the lock —
+	* another replica may have refreshed already, in which case `refreshFn` is
+	* skipped and the fresh credential is returned. Returns `undefined` when no
+	* OAuth row exists for the tenant.
+	*/
+	async refreshOAuth(tenant, provider, refreshFn) {
+		let result;
+		await this.#db.updateAtomic("model_provider_credentials", tenantWhere(tenant, provider), async (row) => {
+			if (row.data.type !== "oauth") return null;
+			const current = row.data;
+			if (!isOAuthCredentialExpired(current)) {
+				result = current;
+				return null;
+			}
+			const next = await refreshFn(current);
+			result = next;
+			return {
+				data: next,
+				updated_at: /* @__PURE__ */ new Date()
+			};
+		});
+		return result;
+	}
+	/** Persist a pending login flow started by a web route. */
+	async createLoginSession(input) {
+		return toSessionRow(await this.#db.insertOne("oauth_login_sessions", {
+			session_id: input.sessionId,
+			org_id: input.orgId,
+			user_id: input.userId,
+			provider: input.provider,
+			kind: input.kind,
+			pending: input.pending,
+			expires_at: input.expiresAt,
+			next_poll_at: input.nextPollAt ?? null,
+			created_at: /* @__PURE__ */ new Date()
+		}));
+	}
+	/**
+	* Read a pending login flow. An expired session is deleted on read (TTL
+	* cleanup) and reported as absent.
+	*/
+	async getLoginSession(sessionId) {
+		const row = await this.#db.findOne("oauth_login_sessions", { session_id: sessionId });
+		if (!row) return void 0;
+		if (row.expires_at.getTime() <= Date.now()) {
+			await this.#db.deleteMany("oauth_login_sessions", { session_id: sessionId });
+			return;
+		}
+		return toSessionRow(row);
+	}
+	/**
+	* Atomically claim a due login session for one upstream completion/poll attempt.
+	* Returns undefined when the session is missing, expired, owned by another
+	* tenant/provider, or already claimed by a concurrent request.
+	*/
+	async claimLoginSession(sessionId, owner) {
+		const now = Date.now();
+		let claimed = false;
+		const updated = await this.#db.updateAtomic("oauth_login_sessions", { session_id: sessionId }, (row) => {
+			if (row.org_id !== owner.orgId || row.user_id !== owner.userId || row.provider !== owner.provider || row.kind !== owner.kind) return null;
+			if (row.expires_at.getTime() <= now) return null;
+			if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;
+			claimed = true;
+			return { next_poll_at: row.expires_at };
+		});
+		return claimed && updated ? toSessionRow(updated) : void 0;
+	}
+	/** Update a pending flow's serialized state and/or next allowed poll time. */
+	async touchLoginSession(sessionId, updates) {
+		const set = {};
+		if (updates.pending !== void 0) set.pending = updates.pending;
+		if (updates.nextPollAt !== void 0) set.next_poll_at = updates.nextPollAt;
+		if (Object.keys(set).length === 0) return;
+		await this.#db.updateMany("oauth_login_sessions", { session_id: sessionId }, set);
+	}
+	/** Remove a pending login flow (completed, cancelled, or failed). */
+	async deleteLoginSession(sessionId) {
+		await this.#db.deleteMany("oauth_login_sessions", { session_id: sessionId });
+	}
 };
+//#endregion
+export { MODEL_CREDENTIALS_SCHEMA, ModelCredentialsStorage, OAUTH_LOGIN_SESSIONS_SCHEMA, assertCredentialScope, isOAuthCredentialExpired };
+
 //# sourceMappingURL=base.js.map

package/dist/storage/domains/credentials/base.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/storage/domains/credentials/base.ts"],"sourcesContent":["/**\n * Model provider credentials domain — tenant-scoped OAuth tokens and API keys\n * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,\n * xAI, plus plain API-key providers).\n *\n * Tenancy is two-level:\n * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and\n *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are\n *   personal subscriptions, and sharing one would bill/rate-limit a single\n *   account for the whole org.\n * - **org-scoped** rows (`userId` absent): shared API keys set by an org\n *   admin, inherited by every member.\n *\n * Resolution order at model-call time is user > org (the caller layers server\n * env vars underneath as a final fallback).\n *\n * Secrets posture: credentials are stored server-side only and never returned\n * to the client (same as `linear_connections.access_token`). Encryption at\n * rest is out of scope, matching the existing posture.\n *\n * The domain also owns `oauth_login_sessions`: pending web login flows\n * (paste-code PKCE verifiers, device-code poll state) persisted server-side so\n * any replica can complete or poll a flow started on another.\n */\n\nimport type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\n/** Owning tenant of a credential row. `userId` absent = org-scoped row. */\nexport interface CredentialTenant {\n  orgId: string;\n  userId?: string;\n}\n\n/** Which tenancy level a credential row lives at. */\nexport type CredentialScope = 'user' | 'org';\n\n/** One stored credential, annotated with its scope. */\nexport interface CredentialRecord {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n  updatedAt: Date;\n}\n\n/** Result of per-caller resolution: the winning credential and its scope. */\nexport interface ResolvedCredential {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n}\n\n/** Kind of pending web login flow a session row tracks. */\nexport type LoginSessionKind = 'paste-code' | 'device-code';\n\n/** One pending OAuth login flow, persisted so any replica can continue it. */\nexport interface LoginSessionRow {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  /** Serialized flow state (PKCE verifier, device-code pending state, ...). */\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  /** Earliest time the next upstream poll is allowed (device-code flows). */\n  nextPollAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateLoginSessionInput {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  nextPollAt?: Date | null;\n}\n\n/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */\nexport function isOAuthCredentialExpired(credential: OAuthCredential, now = Date.now()): boolean {\n  return now >= credential.expires;\n}\n\n/** OAuth plan credentials are personal and must always have an owning user. */\nexport function assertCredentialScope(tenant: CredentialTenant, credential: AuthCredential): void {\n  if (credential.type === 'oauth' && !tenant.userId) {\n    throw new Error('OAuth credentials must be user-scoped');\n  }\n}\n\nexport const MODEL_CREDENTIALS_SCHEMA: CollectionSchema = {\n  name: 'model_provider_credentials',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    user_id: { type: 'text', nullable: true },\n    provider: { type: 'text' },\n    type: { type: 'text' },\n    data: { type: 'json' },\n    created_at: { type: 'timestamp' },\n    updated_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared\n    // row), enforced by two partial unique indexes.\n    {\n      name: 'model_provider_credentials_user_unique',\n      columns: ['org_id', 'user_id', 'provider'],\n      whereNotNull: 'user_id',\n    },\n    { name: 'model_provider_credentials_org_unique', columns: ['org_id', 'provider'], whereNull: 'user_id' },\n  ],\n};\n\nexport const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema = {\n  name: 'oauth_login_sessions',\n  columns: {\n    session_id: { type: 'text', primaryKey: true },\n    org_id: { type: 'text' },\n    user_id: { type: 'text' },\n    provider: { type: 'text' },\n    kind: { type: 'text' },\n    pending: { type: 'json' },\n    expires_at: { type: 'timestamp' },\n    next_poll_at: { type: 'timestamp', nullable: true },\n    created_at: { type: 'timestamp' },\n  },\n};\n\n/** Column shape of one `model_provider_credentials` row as returned by ops. */\ninterface CredentialDbRow extends Record<string, unknown> {\n  id: string;\n  provider: string;\n  user_id: string | null;\n  data: AuthCredential;\n  updated_at: Date;\n}\n\n/** Column shape of one `oauth_login_sessions` row as returned by ops. */\ninterface LoginSessionDbRow extends Record<string, unknown> {\n  session_id: string;\n  org_id: string;\n  user_id: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expires_at: Date;\n  next_poll_at: Date | null;\n  created_at: Date;\n}\n\nfunction toSessionRow(db: LoginSessionDbRow): LoginSessionRow {\n  return {\n    sessionId: db.session_id,\n    orgId: db.org_id,\n    userId: db.user_id,\n    provider: db.provider,\n    kind: db.kind,\n    pending: db.pending,\n    expiresAt: db.expires_at,\n    nextPollAt: db.next_poll_at,\n    createdAt: db.created_at,\n  };\n}\n\n/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */\nfunction tenantWhere(tenant: CredentialTenant, provider: string): CollectionWhere {\n  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };\n}\n\n/**\n * Model-credentials storage, written once against the generic\n * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`\n * ride `updateAtomic` so concurrent replicas serialize instead of\n * invalidating each other's rotating tokens / double-claiming a flow.\n */\nexport class ModelCredentialsStorage extends FactoryStorageDomain {\n  constructor() {\n    super('model-credentials');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('oauth_login_sessions', {});\n    await this.ops.deleteMany('model_provider_credentials', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Read the tenant's credential for a provider at exactly that scope. */\n  async getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined> {\n    const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', tenantWhere(tenant, provider));\n    return row?.data;\n  }\n\n  /** Upsert the tenant's credential (`created_at` is preserved on update). */\n  async setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void> {\n    assertCredentialScope(tenant, credential);\n    const where = tenantWhere(tenant, provider);\n    const update = async () =>\n      this.#db.updateMany('model_provider_credentials', where, {\n        type: credential.type,\n        data: credential,\n        updated_at: new Date(),\n      });\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 2; attempt++) {\n      if ((await update()) > 0) return;\n\n      const now = new Date();\n      try {\n        await this.#db.insertOne<CredentialDbRow>('model_provider_credentials', {\n          org_id: tenant.orgId,\n          user_id: tenant.userId ?? null,\n          provider,\n          type: credential.type,\n          data: credential,\n          created_at: now,\n          updated_at: now,\n        });\n        return;\n      } catch (error) {\n        if (!(error instanceof UniqueViolationError)) throw error;\n        lastError = error;\n      }\n    }\n    throw lastError;\n  }\n\n  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */\n  async removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('model_provider_credentials', tenantWhere(tenant, provider));\n    return deleted > 0;\n  }\n\n  /** All credentials visible to a user: their own rows plus the org's shared rows. */\n  async listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]> {\n    // SQL `IN` never matches NULL, so the org rows need their own query.\n    const [userRows, orgRows] = await Promise.all([\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: userId }),\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: null }),\n    ]);\n    return [\n      ...userRows.map(row => ({\n        provider: row.provider,\n        scope: 'user' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n      ...orgRows.map(row => ({\n        provider: row.provider,\n        scope: 'org' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n    ];\n  }\n\n  /**\n   * Resolve the credential a caller should use for a provider: the user's own\n   * row wins over the org's shared row.\n   */\n  async resolveCredential(orgId: string, userId: string, provider: string): Promise<ResolvedCredential | undefined> {\n    const userRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: userId,\n    });\n    if (userRow) return { provider: userRow.provider, scope: 'user', credential: userRow.data };\n    const orgRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: null,\n    });\n    if (orgRow) return { provider: orgRow.provider, scope: 'org', credential: orgRow.data };\n    return undefined;\n  }\n\n  /**\n   * Refresh the tenant's OAuth credential under the backend's atomic\n   * read-modify-write so concurrent replicas don't invalidate each other's\n   * rotating refresh tokens. The expiry is re-checked under the lock —\n   * another replica may have refreshed already, in which case `refreshFn` is\n   * skipped and the fresh credential is returned. Returns `undefined` when no\n   * OAuth row exists for the tenant.\n   */\n  async refreshOAuth(\n    tenant: CredentialTenant,\n    provider: string,\n    refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>,\n  ): Promise<OAuthCredential | undefined> {\n    let result: OAuthCredential | undefined;\n    await this.#db.updateAtomic<CredentialDbRow>(\n      'model_provider_credentials',\n      tenantWhere(tenant, provider),\n      async row => {\n        if (row.data.type !== 'oauth') return null;\n        const current = row.data;\n        // Re-check under the lock: another replica may have refreshed while we waited.\n        if (!isOAuthCredentialExpired(current)) {\n          result = current;\n          return null;\n        }\n        const next = await refreshFn(current);\n        result = next;\n        return { data: next, updated_at: new Date() };\n      },\n    );\n    return result;\n  }\n\n  /** Persist a pending login flow started by a web route. */\n  async createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow> {\n    const inserted = await this.#db.insertOne<LoginSessionDbRow>('oauth_login_sessions', {\n      session_id: input.sessionId,\n      org_id: input.orgId,\n      user_id: input.userId,\n      provider: input.provider,\n      kind: input.kind,\n      pending: input.pending,\n      expires_at: input.expiresAt,\n      next_poll_at: input.nextPollAt ?? null,\n      created_at: new Date(),\n    });\n    return toSessionRow(inserted);\n  }\n\n  /**\n   * Read a pending login flow. An expired session is deleted on read (TTL\n   * cleanup) and reported as absent.\n   */\n  async getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined> {\n    const row = await this.#db.findOne<LoginSessionDbRow>('oauth_login_sessions', { session_id: sessionId });\n    if (!row) return undefined;\n    if (row.expires_at.getTime() <= Date.now()) {\n      await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n      return undefined;\n    }\n    return toSessionRow(row);\n  }\n\n  /**\n   * Atomically claim a due login session for one upstream completion/poll attempt.\n   * Returns undefined when the session is missing, expired, owned by another\n   * tenant/provider, or already claimed by a concurrent request.\n   */\n  async claimLoginSession(\n    sessionId: string,\n    owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>,\n  ): Promise<LoginSessionRow | undefined> {\n    const now = Date.now();\n    let claimed = false;\n    const updated = await this.#db.updateAtomic<LoginSessionDbRow>(\n      'oauth_login_sessions',\n      { session_id: sessionId },\n      row => {\n        if (\n          row.org_id !== owner.orgId ||\n          row.user_id !== owner.userId ||\n          row.provider !== owner.provider ||\n          row.kind !== owner.kind\n        ) {\n          return null;\n        }\n        if (row.expires_at.getTime() <= now) return null;\n        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;\n        claimed = true;\n        // Park the next poll at expiry so a concurrent claim loses until the\n        // claimer either touches the session forward or deletes it.\n        return { next_poll_at: row.expires_at };\n      },\n    );\n    return claimed && updated ? toSessionRow(updated) : undefined;\n  }\n\n  /** Update a pending flow's serialized state and/or next allowed poll time. */\n  async touchLoginSession(\n    sessionId: string,\n    updates: { pending?: Record<string, unknown>; nextPollAt?: Date | null },\n  ): Promise<void> {\n    const set: Record<string, unknown> = {};\n    if (updates.pending !== undefined) set.pending = updates.pending;\n    if (updates.nextPollAt !== undefined) set.next_poll_at = updates.nextPollAt;\n    if (Object.keys(set).length === 0) return;\n    await this.#db.updateMany('oauth_login_sessions', { session_id: sessionId }, set);\n  }\n\n  /** Remove a pending login flow (completed, cancelled, or failed). */\n  async deleteLoginSession(sessionId: string): Promise<void> {\n    await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n  }\n}\n"],"mappings":";AA0BA,SAAS,sBAAsB,4BAA4B;AAyDpD,SAAS,yBAAyB,YAA6B,MAAM,KAAK,IAAI,GAAY;AAC/F,SAAO,OAAO,WAAW;AAC3B;AAGO,SAAS,sBAAsB,QAA0B,YAAkC;AAChG,MAAI,WAAW,SAAS,WAAW,CAAC,OAAO,QAAQ;AACjD,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACF;AAEO,IAAM,2BAA6C;AAAA,EACxD,MAAM;AAAA,EACN,SAAS;AAAA,IACP,IAAI,EAAE,MAAM,UAAU;AAAA,IACtB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,UAAU,EAAE,MAAM,OAAO;AAAA,IACzB,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,YAAY,EAAE,MAAM,YAAY;AAAA,EAClC;AAAA,EACA,eAAe;AAAA;AAAA;AAAA,IAGb;AAAA,MACE,MAAM;AAAA,MACN,SAAS,CAAC,UAAU,WAAW,UAAU;AAAA,MACzC,cAAc;AAAA,IAChB;AAAA,IACA,EAAE,MAAM,yCAAyC,SAAS,CAAC,UAAU,UAAU,GAAG,WAAW,UAAU;AAAA,EACzG;AACF;AAEO,IAAM,8BAAgD;AAAA,EAC3D,MAAM;AAAA,EACN,SAAS;AAAA,IACP,YAAY,EAAE,MAAM,QAAQ,YAAY,KAAK;AAAA,IAC7C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,SAAS,EAAE,MAAM,OAAO;AAAA,IACxB,UAAU,EAAE,MAAM,OAAO;AAAA,IACzB,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,SAAS,EAAE,MAAM,OAAO;AAAA,IACxB,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,cAAc,EAAE,MAAM,aAAa,UAAU,KAAK;AAAA,IAClD,YAAY,EAAE,MAAM,YAAY;AAAA,EAClC;AACF;AAwBA,SAAS,aAAa,IAAwC;AAC5D,SAAO;AAAA,IACL,WAAW,GAAG;AAAA,IACd,OAAO,GAAG;AAAA,IACV,QAAQ,GAAG;AAAA,IACX,UAAU,GAAG;AAAA,IACb,MAAM,GAAG;AAAA,IACT,SAAS,GAAG;AAAA,IACZ,WAAW,GAAG;AAAA,IACd,YAAY,GAAG;AAAA,IACf,WAAW,GAAG;AAAA,EAChB;AACF;AAGA,SAAS,YAAY,QAA0B,UAAmC;AAChF,SAAO,EAAE,QAAQ,OAAO,OAAO,UAAU,SAAS,OAAO,UAAU,KAAK;AAC1E;AAQO,IAAM,0BAAN,cAAsC,qBAAqB;AAAA,EAChE,cAAc;AACZ,UAAM,mBAAmB;AAAA,EAC3B;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,KAAK,kBAAkB,CAAC,0BAA0B,2BAA2B,CAAC;AAAA,EACtF;AAAA,EAEA,MAAM,sBAAqC;AACzC,UAAM,KAAK,IAAI,WAAW,wBAAwB,CAAC,CAAC;AACpD,UAAM,KAAK,IAAI,WAAW,8BAA8B,CAAC,CAAC;AAAA,EAC5D;AAAA,EAEA,IAAI,MAAyB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,cAAc,QAA0B,UAAuD;AACnG,UAAM,MAAM,MAAM,KAAK,IAAI,QAAyB,8BAA8B,YAAY,QAAQ,QAAQ,CAAC;AAC/G,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,MAAM,cAAc,QAA0B,UAAkB,YAA2C;AACzG,0BAAsB,QAAQ,UAAU;AACxC,UAAM,QAAQ,YAAY,QAAQ,QAAQ;AAC1C,UAAM,SAAS,YACb,KAAK,IAAI,WAAW,8BAA8B,OAAO;AAAA,MACvD,MAAM,WAAW;AAAA,MACjB,MAAM;AAAA,MACN,YAAY,oBAAI,KAAK;AAAA,IACvB,CAAC;AAEH,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAK,MAAM,OAAO,IAAK,EAAG;AAE1B,YAAM,MAAM,oBAAI,KAAK;AACrB,UAAI;AACF,cAAM,KAAK,IAAI,UAA2B,8BAA8B;AAAA,UACtE,QAAQ,OAAO;AAAA,UACf,SAAS,OAAO,UAAU;AAAA,UAC1B;AAAA,UACA,MAAM,WAAW;AAAA,UACjB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,YAAY;AAAA,QACd,CAAC;AACD;AAAA,MACF,SAAS,OAAO;AACd,YAAI,EAAE,iBAAiB,sBAAuB,OAAM;AACpD,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,iBAAiB,QAA0B,UAAoC;AACnF,UAAM,UAAU,MAAM,KAAK,IAAI,WAAW,8BAA8B,YAAY,QAAQ,QAAQ,CAAC;AACrG,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,gBAAgB,OAAe,QAA6C;AAEhF,UAAM,CAAC,UAAU,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC5C,KAAK,IAAI,SAA0B,8BAA8B,EAAE,QAAQ,OAAO,SAAS,OAAO,CAAC;AAAA,MACnG,KAAK,IAAI,SAA0B,8BAA8B,EAAE,QAAQ,OAAO,SAAS,KAAK,CAAC;AAAA,IACnG,CAAC;AACD,WAAO;AAAA,MACL,GAAG,SAAS,IAAI,UAAQ;AAAA,QACtB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,MACjB,EAAE;AAAA,MACF,GAAG,QAAQ,IAAI,UAAQ;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,OAAe,QAAgB,UAA2D;AAChH,UAAM,UAAU,MAAM,KAAK,IAAI,QAAyB,8BAA8B;AAAA,MACpF,QAAQ;AAAA,MACR;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,QAAS,QAAO,EAAE,UAAU,QAAQ,UAAU,OAAO,QAAQ,YAAY,QAAQ,KAAK;AAC1F,UAAM,SAAS,MAAM,KAAK,IAAI,QAAyB,8BAA8B;AAAA,MACnF,QAAQ;AAAA,MACR;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,OAAQ,QAAO,EAAE,UAAU,OAAO,UAAU,OAAO,OAAO,YAAY,OAAO,KAAK;AACtF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,aACJ,QACA,UACA,WACsC;AACtC,QAAI;AACJ,UAAM,KAAK,IAAI;AAAA,MACb;AAAA,MACA,YAAY,QAAQ,QAAQ;AAAA,MAC5B,OAAM,QAAO;AACX,YAAI,IAAI,KAAK,SAAS,QAAS,QAAO;AACtC,cAAM,UAAU,IAAI;AAEpB,YAAI,CAAC,yBAAyB,OAAO,GAAG;AACtC,mBAAS;AACT,iBAAO;AAAA,QACT;AACA,cAAM,OAAO,MAAM,UAAU,OAAO;AACpC,iBAAS;AACT,eAAO,EAAE,MAAM,MAAM,YAAY,oBAAI,KAAK,EAAE;AAAA,MAC9C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,mBAAmB,OAA0D;AACjF,UAAM,WAAW,MAAM,KAAK,IAAI,UAA6B,wBAAwB;AAAA,MACnF,YAAY,MAAM;AAAA,MAClB,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,cAAc,MAAM,cAAc;AAAA,MAClC,YAAY,oBAAI,KAAK;AAAA,IACvB,CAAC;AACD,WAAO,aAAa,QAAQ;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,WAAyD;AAC7E,UAAM,MAAM,MAAM,KAAK,IAAI,QAA2B,wBAAwB,EAAE,YAAY,UAAU,CAAC;AACvG,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC1C,YAAM,KAAK,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;AAC3E,aAAO;AAAA,IACT;AACA,WAAO,aAAa,GAAG;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,WACA,OACsC;AACtC,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,UAAU;AACd,UAAM,UAAU,MAAM,KAAK,IAAI;AAAA,MAC7B;AAAA,MACA,EAAE,YAAY,UAAU;AAAA,MACxB,SAAO;AACL,YACE,IAAI,WAAW,MAAM,SACrB,IAAI,YAAY,MAAM,UACtB,IAAI,aAAa,MAAM,YACvB,IAAI,SAAS,MAAM,MACnB;AACA,iBAAO;AAAA,QACT;AACA,YAAI,IAAI,WAAW,QAAQ,KAAK,IAAK,QAAO;AAC5C,YAAI,IAAI,gBAAgB,IAAI,aAAa,QAAQ,IAAI,IAAK,QAAO;AACjE,kBAAU;AAGV,eAAO,EAAE,cAAc,IAAI,WAAW;AAAA,MACxC;AAAA,IACF;AACA,WAAO,WAAW,UAAU,aAAa,OAAO,IAAI;AAAA,EACtD;AAAA;AAAA,EAGA,MAAM,kBACJ,WACA,SACe;AACf,UAAM,MAA+B,CAAC;AACtC,QAAI,QAAQ,YAAY,OAAW,KAAI,UAAU,QAAQ;AACzD,QAAI,QAAQ,eAAe,OAAW,KAAI,eAAe,QAAQ;AACjE,QAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG;AACnC,UAAM,KAAK,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,GAAG,GAAG;AAAA,EAClF;AAAA;AAAA,EAGA,MAAM,mBAAmB,WAAkC;AACzD,UAAM,KAAK,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;AAAA,EAC7E;AACF;","names":[]}
+{"version":3,"file":"base.js","names":["#db"],"sources":["../../../../src/storage/domains/credentials/base.ts"],"sourcesContent":["/**\n * Model provider credentials domain — tenant-scoped OAuth tokens and API keys\n * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,\n * xAI, plus plain API-key providers).\n *\n * Tenancy is two-level:\n * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and\n *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are\n *   personal subscriptions, and sharing one would bill/rate-limit a single\n *   account for the whole org.\n * - **org-scoped** rows (`userId` absent): shared API keys set by an org\n *   admin, inherited by every member.\n *\n * Resolution order at model-call time is user > org (the caller layers server\n * env vars underneath as a final fallback).\n *\n * Secrets posture: credentials are stored server-side only and never returned\n * to the client (same as `linear_connections.access_token`). Encryption at\n * rest is out of scope, matching the existing posture.\n *\n * The domain also owns `oauth_login_sessions`: pending web login flows\n * (paste-code PKCE verifiers, device-code poll state) persisted server-side so\n * any replica can complete or poll a flow started on another.\n */\n\nimport type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\n/** Owning tenant of a credential row. `userId` absent = org-scoped row. */\nexport interface CredentialTenant {\n  orgId: string;\n  userId?: string;\n}\n\n/** Which tenancy level a credential row lives at. */\nexport type CredentialScope = 'user' | 'org';\n\n/** One stored credential, annotated with its scope. */\nexport interface CredentialRecord {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n  updatedAt: Date;\n}\n\n/** Result of per-caller resolution: the winning credential and its scope. */\nexport interface ResolvedCredential {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n}\n\n/** Kind of pending web login flow a session row tracks. */\nexport type LoginSessionKind = 'paste-code' | 'device-code';\n\n/** One pending OAuth login flow, persisted so any replica can continue it. */\nexport interface LoginSessionRow {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  /** Serialized flow state (PKCE verifier, device-code pending state, ...). */\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  /** Earliest time the next upstream poll is allowed (device-code flows). */\n  nextPollAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateLoginSessionInput {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  nextPollAt?: Date | null;\n}\n\n/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */\nexport function isOAuthCredentialExpired(credential: OAuthCredential, now = Date.now()): boolean {\n  return now >= credential.expires;\n}\n\n/** OAuth plan credentials are personal and must always have an owning user. */\nexport function assertCredentialScope(tenant: CredentialTenant, credential: AuthCredential): void {\n  if (credential.type === 'oauth' && !tenant.userId) {\n    throw new Error('OAuth credentials must be user-scoped');\n  }\n}\n\nexport const MODEL_CREDENTIALS_SCHEMA: CollectionSchema = {\n  name: 'model_provider_credentials',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    user_id: { type: 'text', nullable: true },\n    provider: { type: 'text' },\n    type: { type: 'text' },\n    data: { type: 'json' },\n    created_at: { type: 'timestamp' },\n    updated_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared\n    // row), enforced by two partial unique indexes.\n    {\n      name: 'model_provider_credentials_user_unique',\n      columns: ['org_id', 'user_id', 'provider'],\n      whereNotNull: 'user_id',\n    },\n    { name: 'model_provider_credentials_org_unique', columns: ['org_id', 'provider'], whereNull: 'user_id' },\n  ],\n};\n\nexport const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema = {\n  name: 'oauth_login_sessions',\n  columns: {\n    session_id: { type: 'text', primaryKey: true },\n    org_id: { type: 'text' },\n    user_id: { type: 'text' },\n    provider: { type: 'text' },\n    kind: { type: 'text' },\n    pending: { type: 'json' },\n    expires_at: { type: 'timestamp' },\n    next_poll_at: { type: 'timestamp', nullable: true },\n    created_at: { type: 'timestamp' },\n  },\n};\n\n/** Column shape of one `model_provider_credentials` row as returned by ops. */\ninterface CredentialDbRow extends Record<string, unknown> {\n  id: string;\n  provider: string;\n  user_id: string | null;\n  data: AuthCredential;\n  updated_at: Date;\n}\n\n/** Column shape of one `oauth_login_sessions` row as returned by ops. */\ninterface LoginSessionDbRow extends Record<string, unknown> {\n  session_id: string;\n  org_id: string;\n  user_id: string;\n  provider: string;\n  kind: LoginSessionKind;\n  pending: Record<string, unknown>;\n  expires_at: Date;\n  next_poll_at: Date | null;\n  created_at: Date;\n}\n\nfunction toSessionRow(db: LoginSessionDbRow): LoginSessionRow {\n  return {\n    sessionId: db.session_id,\n    orgId: db.org_id,\n    userId: db.user_id,\n    provider: db.provider,\n    kind: db.kind,\n    pending: db.pending,\n    expiresAt: db.expires_at,\n    nextPollAt: db.next_poll_at,\n    createdAt: db.created_at,\n  };\n}\n\n/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */\nfunction tenantWhere(tenant: CredentialTenant, provider: string): CollectionWhere {\n  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };\n}\n\n/**\n * Model-credentials storage, written once against the generic\n * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`\n * ride `updateAtomic` so concurrent replicas serialize instead of\n * invalidating each other's rotating tokens / double-claiming a flow.\n */\nexport class ModelCredentialsStorage extends FactoryStorageDomain {\n  constructor() {\n    super('model-credentials');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('oauth_login_sessions', {});\n    await this.ops.deleteMany('model_provider_credentials', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Read the tenant's credential for a provider at exactly that scope. */\n  async getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined> {\n    const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', tenantWhere(tenant, provider));\n    return row?.data;\n  }\n\n  /** Upsert the tenant's credential (`created_at` is preserved on update). */\n  async setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void> {\n    assertCredentialScope(tenant, credential);\n    const where = tenantWhere(tenant, provider);\n    const update = async () =>\n      this.#db.updateMany('model_provider_credentials', where, {\n        type: credential.type,\n        data: credential,\n        updated_at: new Date(),\n      });\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 2; attempt++) {\n      if ((await update()) > 0) return;\n\n      const now = new Date();\n      try {\n        await this.#db.insertOne<CredentialDbRow>('model_provider_credentials', {\n          org_id: tenant.orgId,\n          user_id: tenant.userId ?? null,\n          provider,\n          type: credential.type,\n          data: credential,\n          created_at: now,\n          updated_at: now,\n        });\n        return;\n      } catch (error) {\n        if (!(error instanceof UniqueViolationError)) throw error;\n        lastError = error;\n      }\n    }\n    throw lastError;\n  }\n\n  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */\n  async removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('model_provider_credentials', tenantWhere(tenant, provider));\n    return deleted > 0;\n  }\n\n  /** All credentials visible to a user: their own rows plus the org's shared rows. */\n  async listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]> {\n    // SQL `IN` never matches NULL, so the org rows need their own query.\n    const [userRows, orgRows] = await Promise.all([\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: userId }),\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: null }),\n    ]);\n    return [\n      ...userRows.map(row => ({\n        provider: row.provider,\n        scope: 'user' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n      ...orgRows.map(row => ({\n        provider: row.provider,\n        scope: 'org' as const,\n        credential: row.data,\n        updatedAt: row.updated_at,\n      })),\n    ];\n  }\n\n  /**\n   * Resolve the credential a caller should use for a provider: the user's own\n   * row wins over the org's shared row.\n   */\n  async resolveCredential(orgId: string, userId: string, provider: string): Promise<ResolvedCredential | undefined> {\n    const userRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: userId,\n    });\n    if (userRow) return { provider: userRow.provider, scope: 'user', credential: userRow.data };\n    const orgRow = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n      org_id: orgId,\n      provider,\n      user_id: null,\n    });\n    if (orgRow) return { provider: orgRow.provider, scope: 'org', credential: orgRow.data };\n    return undefined;\n  }\n\n  /**\n   * Refresh the tenant's OAuth credential under the backend's atomic\n   * read-modify-write so concurrent replicas don't invalidate each other's\n   * rotating refresh tokens. The expiry is re-checked under the lock —\n   * another replica may have refreshed already, in which case `refreshFn` is\n   * skipped and the fresh credential is returned. Returns `undefined` when no\n   * OAuth row exists for the tenant.\n   */\n  async refreshOAuth(\n    tenant: CredentialTenant,\n    provider: string,\n    refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>,\n  ): Promise<OAuthCredential | undefined> {\n    let result: OAuthCredential | undefined;\n    await this.#db.updateAtomic<CredentialDbRow>(\n      'model_provider_credentials',\n      tenantWhere(tenant, provider),\n      async row => {\n        if (row.data.type !== 'oauth') return null;\n        const current = row.data;\n        // Re-check under the lock: another replica may have refreshed while we waited.\n        if (!isOAuthCredentialExpired(current)) {\n          result = current;\n          return null;\n        }\n        const next = await refreshFn(current);\n        result = next;\n        return { data: next, updated_at: new Date() };\n      },\n    );\n    return result;\n  }\n\n  /** Persist a pending login flow started by a web route. */\n  async createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow> {\n    const inserted = await this.#db.insertOne<LoginSessionDbRow>('oauth_login_sessions', {\n      session_id: input.sessionId,\n      org_id: input.orgId,\n      user_id: input.userId,\n      provider: input.provider,\n      kind: input.kind,\n      pending: input.pending,\n      expires_at: input.expiresAt,\n      next_poll_at: input.nextPollAt ?? null,\n      created_at: new Date(),\n    });\n    return toSessionRow(inserted);\n  }\n\n  /**\n   * Read a pending login flow. An expired session is deleted on read (TTL\n   * cleanup) and reported as absent.\n   */\n  async getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined> {\n    const row = await this.#db.findOne<LoginSessionDbRow>('oauth_login_sessions', { session_id: sessionId });\n    if (!row) return undefined;\n    if (row.expires_at.getTime() <= Date.now()) {\n      await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n      return undefined;\n    }\n    return toSessionRow(row);\n  }\n\n  /**\n   * Atomically claim a due login session for one upstream completion/poll attempt.\n   * Returns undefined when the session is missing, expired, owned by another\n   * tenant/provider, or already claimed by a concurrent request.\n   */\n  async claimLoginSession(\n    sessionId: string,\n    owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>,\n  ): Promise<LoginSessionRow | undefined> {\n    const now = Date.now();\n    let claimed = false;\n    const updated = await this.#db.updateAtomic<LoginSessionDbRow>(\n      'oauth_login_sessions',\n      { session_id: sessionId },\n      row => {\n        if (\n          row.org_id !== owner.orgId ||\n          row.user_id !== owner.userId ||\n          row.provider !== owner.provider ||\n          row.kind !== owner.kind\n        ) {\n          return null;\n        }\n        if (row.expires_at.getTime() <= now) return null;\n        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;\n        claimed = true;\n        // Park the next poll at expiry so a concurrent claim loses until the\n        // claimer either touches the session forward or deletes it.\n        return { next_poll_at: row.expires_at };\n      },\n    );\n    return claimed && updated ? toSessionRow(updated) : undefined;\n  }\n\n  /** Update a pending flow's serialized state and/or next allowed poll time. */\n  async touchLoginSession(\n    sessionId: string,\n    updates: { pending?: Record<string, unknown>; nextPollAt?: Date | null },\n  ): Promise<void> {\n    const set: Record<string, unknown> = {};\n    if (updates.pending !== undefined) set.pending = updates.pending;\n    if (updates.nextPollAt !== undefined) set.next_poll_at = updates.nextPollAt;\n    if (Object.keys(set).length === 0) return;\n    await this.#db.updateMany('oauth_login_sessions', { session_id: sessionId }, set);\n  }\n\n  /** Remove a pending login flow (completed, cancelled, or failed). */\n  async deleteLoginSession(sessionId: string): Promise<void> {\n    await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n  }\n}\n"],"mappings":";;;AAmFA,SAAgB,yBAAyB,YAA6B,MAAM,KAAK,IAAI,GAAY;CAC/F,OAAO,OAAO,WAAW;AAC3B;;AAGA,SAAgB,sBAAsB,QAA0B,YAAkC;CAChG,IAAI,WAAW,SAAS,WAAW,CAAC,OAAO,QACzC,MAAM,IAAI,MAAM,uCAAuC;AAE3D;AAEA,MAAa,2BAA6C;CACxD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS;GAAE,MAAM;GAAQ,UAAU;EAAK;EACxC,UAAU,EAAE,MAAM,OAAO;EACzB,MAAM,EAAE,MAAM,OAAO;EACrB,MAAM,EAAE,MAAM,OAAO;EACrB,YAAY,EAAE,MAAM,YAAY;EAChC,YAAY,EAAE,MAAM,YAAY;CAClC;CACA,eAAe,CAGb;EACE,MAAM;EACN,SAAS;GAAC;GAAU;GAAW;EAAU;EACzC,cAAc;CAChB,GACA;EAAE,MAAM;EAAyC,SAAS,CAAC,UAAU,UAAU;EAAG,WAAW;CAAU,CACzG;AACF;AAEA,MAAa,8BAAgD;CAC3D,MAAM;CACN,SAAS;EACP,YAAY;GAAE,MAAM;GAAQ,YAAY;EAAK;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,MAAM,EAAE,MAAM,OAAO;EACrB,SAAS,EAAE,MAAM,OAAO;EACxB,YAAY,EAAE,MAAM,YAAY;EAChC,cAAc;GAAE,MAAM;GAAa,UAAU;EAAK;EAClD,YAAY,EAAE,MAAM,YAAY;CAClC;AACF;AAwBA,SAAS,aAAa,IAAwC;CAC5D,OAAO;EACL,WAAW,GAAG;EACd,OAAO,GAAG;EACV,QAAQ,GAAG;EACX,UAAU,GAAG;EACb,MAAM,GAAG;EACT,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,YAAY,GAAG;EACf,WAAW,GAAG;CAChB;AACF;;AAGA,SAAS,YAAY,QAA0B,UAAmC;CAChF,OAAO;EAAE,QAAQ,OAAO;EAAO;EAAU,SAAS,OAAO,UAAU;CAAK;AAC1E;;;;;;;AAQA,IAAa,0BAAb,cAA6C,qBAAqB;CAChE,cAAc;EACZ,MAAM,mBAAmB;CAC3B;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,0BAA0B,2BAA2B,CAAC;CACtF;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,wBAAwB,CAAC,CAAC;EACpD,MAAM,KAAK,IAAI,WAAW,8BAA8B,CAAC,CAAC;CAC5D;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,cAAc,QAA0B,UAAuD;EAEnG,QAAO,MADW,KAAKA,IAAI,QAAyB,8BAA8B,YAAY,QAAQ,QAAQ,CAAC,EAAA,EACnG;CACd;;CAGA,MAAM,cAAc,QAA0B,UAAkB,YAA2C;EACzG,sBAAsB,QAAQ,UAAU;EACxC,MAAM,QAAQ,YAAY,QAAQ,QAAQ;EAC1C,MAAM,SAAS,YACb,KAAKA,IAAI,WAAW,8BAA8B,OAAO;GACvD,MAAM,WAAW;GACjB,MAAM;GACN,4BAAY,IAAI,KAAK;EACvB,CAAC;EAEH,IAAI;EACJ,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;GAC5C,IAAK,MAAM,OAAO,IAAK,GAAG;GAE1B,MAAM,sBAAM,IAAI,KAAK;GACrB,IAAI;IACF,MAAM,KAAKA,IAAI,UAA2B,8BAA8B;KACtE,QAAQ,OAAO;KACf,SAAS,OAAO,UAAU;KAC1B;KACA,MAAM,WAAW;KACjB,MAAM;KACN,YAAY;KACZ,YAAY;IACd,CAAC;IACD;GACF,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;IACpD,YAAY;GACd;EACF;EACA,MAAM;CACR;;CAGA,MAAM,iBAAiB,QAA0B,UAAoC;EAEnF,OAAO,MADe,KAAKA,IAAI,WAAW,8BAA8B,YAAY,QAAQ,QAAQ,CAAC,IACpF;CACnB;;CAGA,MAAM,gBAAgB,OAAe,QAA6C;EAEhF,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,KAAKA,IAAI,SAA0B,8BAA8B;GAAE,QAAQ;GAAO,SAAS;EAAO,CAAC,GACnG,KAAKA,IAAI,SAA0B,8BAA8B;GAAE,QAAQ;GAAO,SAAS;EAAK,CAAC,CACnG,CAAC;EACD,OAAO,CACL,GAAG,SAAS,KAAI,SAAQ;GACtB,UAAU,IAAI;GACd,OAAO;GACP,YAAY,IAAI;GAChB,WAAW,IAAI;EACjB,EAAE,GACF,GAAG,QAAQ,KAAI,SAAQ;GACrB,UAAU,IAAI;GACd,OAAO;GACP,YAAY,IAAI;GAChB,WAAW,IAAI;EACjB,EAAE,CACJ;CACF;;;;;CAMA,MAAM,kBAAkB,OAAe,QAAgB,UAA2D;EAChH,MAAM,UAAU,MAAM,KAAKA,IAAI,QAAyB,8BAA8B;GACpF,QAAQ;GACR;GACA,SAAS;EACX,CAAC;EACD,IAAI,SAAS,OAAO;GAAE,UAAU,QAAQ;GAAU,OAAO;GAAQ,YAAY,QAAQ;EAAK;EAC1F,MAAM,SAAS,MAAM,KAAKA,IAAI,QAAyB,8BAA8B;GACnF,QAAQ;GACR;GACA,SAAS;EACX,CAAC;EACD,IAAI,QAAQ,OAAO;GAAE,UAAU,OAAO;GAAU,OAAO;GAAO,YAAY,OAAO;EAAK;CAExF;;;;;;;;;CAUA,MAAM,aACJ,QACA,UACA,WACsC;EACtC,IAAI;EACJ,MAAM,KAAKA,IAAI,aACb,8BACA,YAAY,QAAQ,QAAQ,GAC5B,OAAM,QAAO;GACX,IAAI,IAAI,KAAK,SAAS,SAAS,OAAO;GACtC,MAAM,UAAU,IAAI;GAEpB,IAAI,CAAC,yBAAyB,OAAO,GAAG;IACtC,SAAS;IACT,OAAO;GACT;GACA,MAAM,OAAO,MAAM,UAAU,OAAO;GACpC,SAAS;GACT,OAAO;IAAE,MAAM;IAAM,4BAAY,IAAI,KAAK;GAAE;EAC9C,CACF;EACA,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAA0D;EAYjF,OAAO,aAAa,MAXG,KAAKA,IAAI,UAA6B,wBAAwB;GACnF,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,cAAc,MAAM,cAAc;GAClC,4BAAY,IAAI,KAAK;EACvB,CAAC,CAC2B;CAC9B;;;;;CAMA,MAAM,gBAAgB,WAAyD;EAC7E,MAAM,MAAM,MAAM,KAAKA,IAAI,QAA2B,wBAAwB,EAAE,YAAY,UAAU,CAAC;EACvG,IAAI,CAAC,KAAK,OAAO,KAAA;EACjB,IAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,IAAI,GAAG;GAC1C,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;GAC3E;EACF;EACA,OAAO,aAAa,GAAG;CACzB;;;;;;CAOA,MAAM,kBACJ,WACA,OACsC;EACtC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,UAAU;EACd,MAAM,UAAU,MAAM,KAAKA,IAAI,aAC7B,wBACA,EAAE,YAAY,UAAU,IACxB,QAAO;GACL,IACE,IAAI,WAAW,MAAM,SACrB,IAAI,YAAY,MAAM,UACtB,IAAI,aAAa,MAAM,YACvB,IAAI,SAAS,MAAM,MAEnB,OAAO;GAET,IAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,OAAO;GAC5C,IAAI,IAAI,gBAAgB,IAAI,aAAa,QAAQ,IAAI,KAAK,OAAO;GACjE,UAAU;GAGV,OAAO,EAAE,cAAc,IAAI,WAAW;EACxC,CACF;EACA,OAAO,WAAW,UAAU,aAAa,OAAO,IAAI,KAAA;CACtD;;CAGA,MAAM,kBACJ,WACA,SACe;EACf,MAAM,MAA+B,CAAC;EACtC,IAAI,QAAQ,YAAY,KAAA,GAAW,IAAI,UAAU,QAAQ;EACzD,IAAI,QAAQ,eAAe,KAAA,GAAW,IAAI,eAAe,QAAQ;EACjE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG;EACnC,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,GAAG,GAAG;CAClF;;CAGA,MAAM,mBAAmB,WAAkC;EACzD,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;CAC7E;AACF"}