@mastra/factory 0.24.0-alpha.1 → 0.24.0-alpha.2

package/dist/routes/contracts.js

@@ -39,7 +39,9 @@ const updateProjectBodySchema = z.object({
 	modelScope: z.enum(FACTORY_MODEL_SCOPES).optional(),
 	defaultThinkingLevel: z.enum(THINKING_LEVELS).optional(),
 	autoRunEnabled: z.boolean().optional(),
-	autoApprovePlans: z.boolean().optional()
+	autoApprovePlans: z.boolean().optional(),
+	reviewTestChecksEnabled: z.boolean().optional(),
+	selfReviewEnabled: z.boolean().optional()
 }).refine((input) => Object.keys(input).length > 0, { message: "At least one project field is required" });
 const environmentRepositorySchema = z.object({
 	projectRepositoryId: z.string(),

package/dist/routes/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","names":[],"sources":["../../src/routes/contracts.ts"],"sourcesContent":["import { THINKING_LEVEL_VALUES } from '@mastra/code-sdk/thinking';\nimport type { ThinkingLevelSetting } from '@mastra/code-sdk/thinking';\nimport { z } from 'zod';\n\nimport { FACTORY_ROLE_STAGES } from '../rules/types.js';\nimport { BOARD_IDENTIFIER_RE, MAX_BOARD_IDENTIFIER_LENGTH } from '../rules/validation.js';\nimport { FACTORY_MODEL_SCOPES } from '../storage/domains/projects/base.js';\n\nconst FACTORY_ROLE_VALUES = Object.keys(FACTORY_ROLE_STAGES) as [string, ...string[]];\nconst THINKING_LEVELS = THINKING_LEVEL_VALUES as [ThinkingLevelSetting, ...ThinkingLevelSetting[]];\n\nexport type FactoryRouteContract = {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE';\n  path: string;\n  description: string;\n  pathSchema?: z.ZodType;\n  querySchema?: z.ZodType;\n  bodySchema?: z.ZodType;\n  responseSchema: z.ZodType;\n};\n\nexport const UUID_PATTERN = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$';\nconst uuidSchema = z.string().regex(new RegExp(UUID_PATTERN));\nconst entitySchema = z.record(z.string(), z.unknown());\nconst nonEmptyTrimmed = (max: number) => z.string().trim().min(1).max(max);\nconst rawBoundedTrimmed = (max: number) =>\n  z\n    .string()\n    .max(max)\n    .transform(value => value.trim())\n    .pipe(z.string().min(1));\nconst trimmedUuidSchema = z.string().trim().regex(new RegExp(UUID_PATTERN));\nconst nullableTrimmed = (max: number) =>\n  z.union([\n    z\n      .string()\n      .trim()\n      .max(max)\n      .transform(value => value || null),\n    z.null(),\n  ]);\nconst projectPathSchema = z.object({ id: uuidSchema });\nconst projectDecisionPathSchema = z.object({ id: uuidSchema, decisionId: uuidSchema });\nconst workItemPathSchema = z.object({ id: uuidSchema });\nconst transitionPathSchema = z.object({ id: uuidSchema, workItemId: uuidSchema });\n\nconst projectSchema = entitySchema;\nconst projectResponseSchema = z.object({ project: projectSchema });\nconst workItemResponseSchema = z.object({ workItem: entitySchema });\nconst decisionResponseSchema = z.object({ decision: entitySchema });\n\nexport const createProjectBodySchema = z.object({\n  name: nonEmptyTrimmed(200),\n  description: nullableTrimmed(2_000).optional().default(null),\n  modelScope: z.enum(FACTORY_MODEL_SCOPES).optional(),\n});\n\nexport const updateProjectBodySchema = z\n  .object({\n    name: nonEmptyTrimmed(200).optional(),\n    description: nullableTrimmed(2_000).optional(),\n    defaultModelId: nullableTrimmed(200).optional(),\n    modelScope: z.enum(FACTORY_MODEL_SCOPES).optional(),\n    defaultThinkingLevel: z.enum(THINKING_LEVELS).optional(),\n    autoRunEnabled: z.boolean().optional(),\n    autoApprovePlans: z.boolean().optional(),\n  })\n  .refine(input => Object.keys(input).length > 0, { message: 'At least one project field is required' });\n\nconst environmentRepositorySchema = z.object({\n  projectRepositoryId: z.string(),\n  connectionId: z.string(),\n  repositoryId: z.string(),\n  // Null when the repository row behind the link is missing.\n  slug: z.string().nullable(),\n  defaultBranch: z.string().nullable(),\n  position: z.number().int(),\n  inEnvironment: z.boolean(),\n  setupCommand: z.string().nullable(),\n  teardownCommand: z.string().nullable(),\n  lastBuildStatus: z.enum(['unbuilt', 'configured', 'failed']),\n  lastBuildError: z.string().nullable(),\n  lastBuiltAt: z.string().nullable(),\n});\n\n/** The configured FactorySandbox as factory describes it: provider id, JSON Schema of its settings, capabilities. */\nexport const environmentSandboxSchema = z.object({\n  provider: z.string(),\n  settingsSchema: z.record(z.string(), z.unknown()),\n  capabilities: z.object({\n    template: z.boolean(),\n    builds: z.object({ available: z.boolean(), history: z.boolean() }),\n  }),\n});\n\n/** When the environment builds on its own; present only when the sandbox can build. */\nexport const environmentBuildTriggersSchema = z.object({\n  schedule: z.object({\n    enabled: z.boolean(),\n    cron: z.string().nullable(),\n    timezone: z.string().nullable(),\n    /** False when the host's storage has no schedules domain; the cron trigger cannot be enabled then. */\n    scheduleAvailable: z.boolean(),\n  }),\n  push: z.object({ enabled: z.boolean(), debounceMinutes: z.number().int() }),\n});\n\n/** The last build factory asked the provider for, from the project row only; status is read live. */\nexport const environmentLastBuildSchema = z.object({ buildId: z.string(), attemptedAt: z.string().nullable() });\n\nexport const projectEnvironmentResponseSchema = z.object({\n  environment: z.object({\n    sandbox: environmentSandboxSchema,\n    /** The stored settings document; only keys the user set. */\n    settings: z.record(z.string(), z.unknown()),\n    sandboxWorkingDirectory: z.string().nullable(),\n    workspaceSetupCommand: z.string().nullable(),\n    activeTemplateId: z.string().nullable(),\n    activeTemplateHeads: z.record(z.string(), z.string()).nullable(),\n    repositories: z.array(environmentRepositorySchema),\n    buildTriggers: environmentBuildTriggersSchema.optional(),\n    build: environmentLastBuildSchema.nullable().optional(),\n  }),\n});\n\nconst environmentBuildStatusSchema = z.enum(['pending', 'building', 'ready', 'failed', 'unknown']);\n\nexport const environmentBuildStartResponseSchema = z.object({\n  outcome: z.enum(['started', 'skipped', 'unavailable', 'failed']),\n  buildId: z.string().optional(),\n  templateId: z.string().optional(),\n  reason: z.string().optional(),\n});\n\nexport const environmentBuildSchema = z.object({\n  buildId: z.string(),\n  status: environmentBuildStatusSchema,\n  templateId: z.string().optional(),\n  startedAt: z.string().optional(),\n  finishedAt: z.string().optional(),\n  error: z.string().optional(),\n  logs: z.array(z.string()).optional(),\n});\n\nexport const environmentBuildsResponseSchema = z.object({ builds: z.array(environmentBuildSchema) });\nexport const environmentBuildResponseSchema = z.object({ build: environmentBuildSchema });\n\nconst buildPathSchema = projectPathSchema.extend({ buildId: z.string().min(1) });\n\nconst environmentRepositoryPatchSchema = z.object({\n  projectRepositoryId: uuidSchema,\n  position: z.number().int().min(1).optional(),\n  inEnvironment: z.boolean().optional(),\n  setupCommand: nullableTrimmed(2_000).optional(),\n  teardownCommand: nullableTrimmed(2_000).optional(),\n});\n\nexport const updateProjectEnvironmentBodySchema = z\n  .object({\n    sandboxWorkingDirectory: nullableTrimmed(1_000)\n      .refine(value => value === null || value.startsWith('/'), {\n        message: 'sandboxWorkingDirectory must be absolute',\n      })\n      .optional(),\n    /** Partial settings merged onto the stored document; null removes a key. Validated by the FactorySandbox. */\n    settings: z.record(z.string(), z.unknown().nullable()).optional(),\n    workspaceSetupCommand: nullableTrimmed(2_000).optional(),\n    /** Build triggers; only accepted when the sandbox can build. */\n    buildTriggers: z\n      .object({\n        schedule: z\n          .object({\n            enabled: z.boolean(),\n            cron: z.string().trim().min(1).max(100).optional(),\n            timezone: z.string().trim().min(1).max(100).optional(),\n          })\n          .optional(),\n        push: z\n          .object({\n            enabled: z.boolean().optional(),\n            debounceMinutes: z.number().int().min(0).max(1_440).optional(),\n          })\n          .optional(),\n      })\n      .optional(),\n    repositories: z\n      .array(environmentRepositoryPatchSchema)\n      .max(100)\n      .superRefine((entries, ctx) => {\n        const ids = new Set(entries.map(entry => entry.projectRepositoryId));\n        if (ids.size !== entries.length) {\n          ctx.addIssue({ code: 'custom', message: 'Each repository may be listed once' });\n        }\n        const positions = entries.flatMap(entry => (entry.position === undefined ? [] : [entry.position]));\n        if (positions.length === 0) return;\n        const expected = Array.from({ length: entries.length }, (_, index) => index + 1);\n        if (\n          positions.length !== entries.length ||\n          [...positions].sort((a, b) => a - b).some((p, i) => p !== expected[i])\n        ) {\n          ctx.addIssue({\n            code: 'custom',\n            message: 'Positions must be a permutation of 1..n over the listed repositories',\n          });\n        }\n      })\n      .optional(),\n  })\n  .refine(input => Object.keys(input).length > 0, { message: 'At least one environment field is required' });\n\nconst stagesSchema = z\n  .array(\n    z\n      .string()\n      .max(64)\n      .regex(/^[a-z0-9][a-z0-9_-]*$/i),\n  )\n  .min(1)\n  .max(16)\n  .refine(stages => new Set(stages).size === stages.length, { message: 'Stages must be unique' });\n\nconst externalSourceSchema = z\n  .object({\n    integrationId: z.string().min(1).max(128),\n    type: z.string().min(1).max(128),\n    externalId: z.string().min(1).max(512),\n    url: z.string().max(2_048).optional(),\n  })\n  .nullable();\n\nconst sessionSchema = z.object({\n  sessionId: z.string().min(1).max(512),\n  branch: z.string().min(1).max(512),\n  threadId: z.string().min(1).max(512),\n});\n\nconst sessionsSchema = z.record(z.string().min(1).max(64), sessionSchema);\nconst metadataSchema = z\n  .union([z.record(z.string(), z.unknown()), z.null()])\n  .refine(value => {\n    try {\n      return JSON.stringify(value).length <= 16 * 1024;\n    } catch {\n      return false;\n    }\n  }, 'Metadata exceeds 16 KiB')\n  .transform(value => {\n    if (value === null) return null;\n    const {\n      factoryRuleMaterializationKey: _materialization,\n      factoryPullRequestReconciliation: _reconciliation,\n      externalSourceMissingAt: _externalSourceMissingAt,\n      ...metadata\n    } = value;\n    return metadata;\n  });\n\nexport const createWorkItemBodySchema = z.object({\n  title: rawBoundedTrimmed(500),\n  board: z.string().min(1).max(128).optional(),\n  externalSource: externalSourceSchema.optional(),\n  parentWorkItemId: uuidSchema.nullable().optional(),\n  stages: stagesSchema.optional(),\n  sessions: sessionsSchema.optional(),\n  metadata: metadataSchema.optional(),\n});\n\nexport const updateWorkItemBodySchema = z\n  .object({\n    title: rawBoundedTrimmed(500).optional(),\n    board: z.string().min(1).max(128).optional(),\n    parentWorkItemId: uuidSchema.nullable().optional(),\n    stages: stagesSchema.optional(),\n    sessions: sessionsSchema.optional(),\n    metadata: metadataSchema.optional(),\n    plansPreapproved: z.literal(true).optional(),\n  })\n  .refine(input => Object.keys(input).length > 0, { message: 'At least one work-item field is required' });\n\nexport const transitionBodySchema = z\n  .object({\n    board: z.string().max(MAX_BOARD_IDENTIFIER_LENGTH).regex(BOARD_IDENTIFIER_RE),\n    stage: z.string().max(MAX_BOARD_IDENTIFIER_LENGTH).regex(BOARD_IDENTIFIER_RE),\n    expectedRevision: z.number().int().min(1),\n    requestId: trimmedUuidSchema,\n    cause: nonEmptyTrimmed(256),\n    reenter: z.unknown().optional(),\n  })\n  .transform(input => ({\n    board: input.board,\n    stage: input.stage,\n    expectedRevision: input.expectedRevision,\n    ingress: { type: 'human' as const, identity: input.requestId },\n    cause: input.cause,\n    ...(input.reenter === true ? { reenter: true } : {}),\n  }));\n\nexport const startWorkItemBodySchema = z.object({\n  sessionId: trimmedUuidSchema,\n  threadTitle: nonEmptyTrimmed(512),\n  kickoffKey: trimmedUuidSchema,\n  workItem: z.object({\n    id: trimmedUuidSchema,\n    role: nonEmptyTrimmed(32),\n    input: createWorkItemBodySchema,\n  }),\n});\n\nexport const automationRunStartBodySchema = z\n  .object({\n    requestId: trimmedUuidSchema,\n    expectedRevision: z.number().int().min(1),\n    role: z.enum(FACTORY_ROLE_VALUES),\n    skillName: nonEmptyTrimmed(128),\n    arguments: nonEmptyTrimmed(4_096).optional(),\n  })\n  .strict();\n\nexport const metricsQuerySchema = z.object({\n  from: z.string().optional(),\n  to: z.string().optional(),\n});\n\nconst decisionStatusSchema = z.enum([\n  'pending',\n  'proposed',\n  'dismissed',\n  'superseded',\n  'leased',\n  'retry',\n  'succeeded',\n  'failed',\n]);\nconst boundedLimitSchema = (defaultValue: number, max: number) =>\n  z\n    .string()\n    .optional()\n    .transform(value => {\n      const parsed = value ? Number.parseInt(value, 10) : defaultValue;\n      return Number.isFinite(parsed) ? Math.max(1, Math.min(max, parsed)) : defaultValue;\n    });\nconst decisionCursorSchema = z\n  .string()\n  .optional()\n  .transform((value, context) => {\n    if (!value) return undefined;\n    try {\n      const decoded = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n      if (\n        !Array.isArray(decoded) ||\n        decoded.length !== 2 ||\n        typeof decoded[0] !== 'string' ||\n        typeof decoded[1] !== 'string'\n      ) {\n        throw new Error('invalid cursor');\n      }\n      const createdAt = new Date(decoded[0]);\n      if (Number.isNaN(createdAt.getTime()) || !new RegExp(UUID_PATTERN).test(decoded[1])) {\n        throw new Error('invalid cursor');\n      }\n      return { createdAt, id: decoded[1] };\n    } catch {\n      context.addIssue({ code: 'custom', message: 'Invalid cursor' });\n      return z.NEVER;\n    }\n  });\n\nexport const decisionQuerySchema = z.object({\n  statuses: z\n    .string()\n    .optional()\n    .transform(value => {\n      if (!value) return undefined;\n      const statuses = [...new Set(value.split(',').map(status => status.trim()))].filter(\n        status => decisionStatusSchema.safeParse(status).success,\n      ) as Array<z.infer<typeof decisionStatusSchema>>;\n      return statuses.length > 0 ? statuses : undefined;\n    }),\n  before: decisionCursorSchema,\n  limit: boundedLimitSchema(25, 50),\n});\n\nconst attentionKindSchema = z.enum([\n  'automation-failed',\n  'automation-proposed',\n  'mention',\n  'activity',\n  'agent-waiting',\n]);\ntype AttentionKind = z.infer<typeof attentionKindSchema>;\ntype AttentionStreamPosition = { occurredAt: Date; id: string };\ntype AttentionCursorMap = Map<AttentionKind, AttentionStreamPosition | undefined>;\n\nfunction parseAttentionStreamPosition(value: unknown): AttentionStreamPosition | undefined {\n  if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== 'string' || typeof value[1] !== 'string') {\n    return undefined;\n  }\n  const occurredAt = new Date(value[0]);\n  if (Number.isNaN(occurredAt.getTime()) || !new RegExp(UUID_PATTERN).test(value[1])) return undefined;\n  return { occurredAt, id: value[1] };\n}\n\nconst attentionCursorSchema = z\n  .string()\n  .optional()\n  .transform((value, context) => {\n    if (!value) return undefined;\n    try {\n      const decoded: unknown = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));\n      if (Array.isArray(decoded)) {\n        const legacy = parseAttentionStreamPosition(decoded);\n        if (!legacy) throw new Error('invalid cursor');\n        return new Map<AttentionKind, AttentionStreamPosition | undefined>([['automation-failed', legacy]]);\n      }\n      if (!decoded || typeof decoded !== 'object') throw new Error('invalid cursor');\n      const cursors: AttentionCursorMap = new Map();\n      for (const [kind, positionValue] of Object.entries(decoded)) {\n        const parsedKind = attentionKindSchema.safeParse(kind);\n        if (!parsedKind.success) throw new Error('invalid cursor');\n        if (positionValue === null) {\n          cursors.set(parsedKind.data, undefined);\n          continue;\n        }\n        const position = parseAttentionStreamPosition(positionValue);\n        if (!position) throw new Error('invalid cursor');\n        cursors.set(parsedKind.data, position);\n      }\n      if (cursors.size === 0) throw new Error('invalid cursor');\n      return cursors;\n    } catch {\n      context.addIssue({ code: 'custom', message: 'Invalid cursor' });\n      return z.NEVER;\n    }\n  });\n\nexport const attentionQuerySchema = z.object({\n  view: z.enum(['open', 'unread', 'archived']).optional().default('open'),\n  kind: z.array(attentionKindSchema).optional(),\n  before: attentionCursorSchema,\n  limit: boundedLimitSchema(25, 50),\n  search: z\n    .string()\n    .optional()\n    .transform(value => value?.trim().toLowerCase().slice(0, 200) || undefined),\n});\n\nconst attentionActionPathSchema = z\n  .object({\n    id: uuidSchema,\n    kind: attentionKindSchema,\n    sourceId: z.string().min(1).max(256),\n    occurrence: z\n      .string()\n      .regex(/^(0|[1-9]\\d*)$/)\n      .transform((value, context) => {\n        const occurrence = Number(value);\n        if (Number.isSafeInteger(occurrence)) return occurrence;\n        context.addIssue({ code: 'custom', message: 'Invalid occurrence' });\n        return z.NEVER;\n      }),\n  })\n  .refine(input => new RegExp(UUID_PATTERN).test(input.sourceId), {\n    message: 'Invalid attention source id',\n    path: ['sourceId'],\n  });\n\nexport const FACTORY_ROUTE_CONTRACTS = {\n  projectList: {\n    method: 'GET',\n    path: '/web/factory/projects',\n    description: 'List Factory projects for the current organization',\n    responseSchema: z.object({ projects: z.array(projectSchema) }),\n  },\n  projectCreate: {\n    method: 'POST',\n    path: '/web/factory/projects',\n    description: 'Create a Factory project',\n    bodySchema: createProjectBodySchema,\n    responseSchema: projectResponseSchema,\n  },\n  projectGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id',\n    description: 'Get a Factory project',\n    pathSchema: projectPathSchema,\n    responseSchema: projectResponseSchema,\n  },\n  projectUpdate: {\n    method: 'PATCH',\n    path: '/web/factory/projects/:id',\n    description: 'Update a Factory project',\n    pathSchema: projectPathSchema,\n    bodySchema: updateProjectBodySchema,\n    responseSchema: projectResponseSchema,\n  },\n  projectEnvironmentGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/environment',\n    description: 'Get the sandbox environment of a Factory project: provider settings and its repositories in order',\n    pathSchema: projectPathSchema,\n    responseSchema: projectEnvironmentResponseSchema,\n  },\n  projectEnvironmentUpdate: {\n    method: 'PATCH',\n    path: '/web/factory/projects/:id/environment',\n    description: 'Update the sandbox environment of a Factory project: provider settings, repository order and setup',\n    pathSchema: projectPathSchema,\n    bodySchema: updateProjectEnvironmentBodySchema,\n    responseSchema: projectEnvironmentResponseSchema,\n  },\n  projectEnvironmentBuild: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/environment/build',\n    description: 'Build the sandbox environment template of a Factory project now',\n    pathSchema: projectPathSchema,\n    responseSchema: environmentBuildStartResponseSchema,\n  },\n  projectEnvironmentBuilds: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/environment/builds',\n    description:\n      'List the environment template builds of a Factory project, newest first, when the provider keeps history',\n    pathSchema: projectPathSchema,\n    responseSchema: environmentBuildsResponseSchema,\n  },\n  projectEnvironmentBuildGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/environment/builds/:buildId',\n    description: 'Get the live status of one environment template build of a Factory project',\n    pathSchema: buildPathSchema,\n    responseSchema: environmentBuildResponseSchema,\n  },\n  projectApplyDefaultModel: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/apply-default-model',\n    description: 'Apply the Factory default model to running work and review threads',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({\n      modelId: z.string(),\n      applied: z.array(z.string()),\n      skipped: z.array(\n        z.object({\n          threadId: z.string(),\n          reason: z.enum([\n            'not-running',\n            'work-item-missing',\n            'stage-inactive',\n            'thread-missing',\n            'mode-unknown',\n            'apply-failed',\n          ]),\n        }),\n      ),\n    }),\n  },\n  projectDelete: {\n    method: 'DELETE',\n    path: '/web/factory/projects/:id',\n    description: 'Delete a Factory project',\n    pathSchema: projectPathSchema,\n    responseSchema: z.null(),\n  },\n  metricsGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/metrics',\n    description: 'Get Factory project metrics',\n    pathSchema: projectPathSchema,\n    querySchema: metricsQuerySchema,\n    responseSchema: z.object({ metrics: entitySchema }),\n  },\n  healthThresholdsGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/health/thresholds',\n    description: 'Get queue-health thresholds',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({ thresholds: z.array(z.number().finite()) }),\n  },\n  boardCatalog: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/boards',\n    description: 'List installed Factory boards',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({\n      boards: z.array(\n        z.object({\n          id: z.string(),\n          title: z.string(),\n          initialPhase: z.string(),\n          phases: z.array(\n            z.object({\n              id: z.string(),\n              title: z.string(),\n              kind: z.enum(['resting', 'working', 'terminal']),\n              role: z.string().optional(),\n              transitions: z.array(z.object({ outcome: z.string().nullable(), to: z.string() })),\n            }),\n          ),\n        }),\n      ),\n    }),\n  },\n  workItemList: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/work-items',\n    description: 'List Factory work items and running sessions',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({\n      workItems: z.array(entitySchema),\n      runningSessionIds: z.array(z.string()),\n      parkedSessionIds: z.array(z.string()),\n    }),\n  },\n  workItemCreate: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/work-items',\n    description: 'Create a work item in Intake',\n    pathSchema: projectPathSchema,\n    bodySchema: createWorkItemBodySchema,\n    responseSchema: workItemResponseSchema,\n  },\n  workItemUpdate: {\n    method: 'PATCH',\n    path: '/web/factory/work-items/:id',\n    description: 'Update non-stage work-item fields',\n    pathSchema: workItemPathSchema,\n    bodySchema: updateWorkItemBodySchema,\n    responseSchema: workItemResponseSchema,\n  },\n  workItemDelete: {\n    method: 'DELETE',\n    path: '/web/factory/work-items/:id',\n    description: 'Delete a Factory work item',\n    pathSchema: workItemPathSchema,\n    responseSchema: z.object({ ok: z.literal(true) }),\n  },\n  workItemTransition: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/work-items/:workItemId/transition',\n    description: 'Transition a work item with its expected revision',\n    pathSchema: transitionPathSchema,\n    bodySchema: transitionBodySchema,\n    responseSchema: entitySchema,\n  },\n  workItemStart: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/runs/start',\n    description: 'Explicitly start a Factory work-item run',\n    pathSchema: projectPathSchema,\n    bodySchema: startWorkItemBodySchema,\n    responseSchema: entitySchema,\n  },\n  workItemAutomationRun: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/work-items/:workItemId/automation-runs',\n    description: 'Enqueue an idempotent deferred skill dispatch for a trusted external orchestrator',\n    pathSchema: transitionPathSchema,\n    bodySchema: automationRunStartBodySchema,\n    responseSchema: entitySchema,\n  },\n  decisionList: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/decisions',\n    description: 'List Factory decisions',\n    pathSchema: projectPathSchema,\n    querySchema: decisionQuerySchema,\n    responseSchema: z.object({ decisions: z.array(entitySchema), nextCursor: z.string().optional() }),\n  },\n  decisionApprove: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/decisions/:decisionId/approve',\n    description: 'Approve a proposed Factory decision',\n    pathSchema: projectDecisionPathSchema,\n    responseSchema: decisionResponseSchema,\n  },\n  decisionDismiss: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/decisions/:decisionId/dismiss',\n    description: 'Dismiss a proposed Factory decision',\n    pathSchema: projectDecisionPathSchema,\n    responseSchema: decisionResponseSchema,\n  },\n  decisionRetry: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/decisions/:decisionId/retry',\n    description: 'Retry a failed retryable Factory decision',\n    pathSchema: projectDecisionPathSchema,\n    responseSchema: decisionResponseSchema,\n  },\n  attentionList: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/attention',\n    description: 'List the Factory attention inbox',\n    pathSchema: projectPathSchema,\n    querySchema: attentionQuerySchema,\n    responseSchema: z.object({\n      items: z.array(entitySchema),\n      kinds: z.record(\n        attentionKindSchema,\n        z.object({\n          open: z.number(),\n          unread: z.number(),\n          latest: z.object({ key: z.string(), at: z.string(), unread: z.boolean() }).nullable(),\n        }),\n      ),\n      hasMore: z.boolean(),\n      nextCursor: z.string().optional(),\n    }),\n  },\n  attentionReadAll: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/read-all',\n    description: 'Mark all Factory attention as read',\n    pathSchema: projectPathSchema,\n    querySchema: z.object({ before: attentionCursorSchema }),\n    responseSchema: z.object({ ok: z.literal(true), hasMore: z.boolean(), nextCursor: z.string().optional() }),\n  },\n  attentionRead: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/:kind/:sourceId/:occurrence/read',\n    description: 'Mark a Factory attention receipt as read',\n    pathSchema: attentionActionPathSchema,\n    responseSchema: z.object({ receipt: entitySchema }),\n  },\n  attentionArchive: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/:kind/:sourceId/:occurrence/archive',\n    description: 'Archive a Factory attention receipt',\n    pathSchema: attentionActionPathSchema,\n    responseSchema: z.object({ receipt: entitySchema }),\n  },\n  attentionRestore: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/:kind/:sourceId/:occurrence/restore',\n    description: 'Restore an archived Factory attention receipt',\n    pathSchema: attentionActionPathSchema,\n    responseSchema: z.object({ receipt: entitySchema }),\n  },\n} as const satisfies Record<string, FactoryRouteContract>;\n\nexport type FactoryRouteContractKey = keyof typeof FACTORY_ROUTE_CONTRACTS;\n"],"mappings":";;;;;;AAQA,MAAM,sBAAsB,OAAO,KAAK,mBAAmB;AAC3D,MAAM,kBAAkB;AAYxB,MAAa,eAAe;AAC5B,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,YAAY,CAAC;AAC5D,MAAM,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACrD,MAAM,mBAAmB,QAAgB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACzE,MAAM,qBAAqB,QACzB,EACG,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,WAAU,UAAS,MAAM,KAAK,CAAC,CAAC,CAChC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3B,MAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,YAAY,CAAC;AAC1E,MAAM,mBAAmB,QACvB,EAAE,MAAM,CACN,EACG,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,GAAG,CAAC,CACR,WAAU,UAAS,SAAS,IAAI,GACnC,EAAE,KAAK,CACT,CAAC;AACH,MAAM,oBAAoB,EAAE,OAAO,EAAE,IAAI,WAAW,CAAC;AACrD,MAAM,4BAA4B,EAAE,OAAO;CAAE,IAAI;CAAY,YAAY;AAAW,CAAC;AACrF,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,WAAW,CAAC;AACtD,MAAM,uBAAuB,EAAE,OAAO;CAAE,IAAI;CAAY,YAAY;AAAW,CAAC;AAEhF,MAAM,gBAAgB;AACtB,MAAM,wBAAwB,EAAE,OAAO,EAAE,SAAS,cAAc,CAAC;AACjE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,aAAa,CAAC;AAClE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,aAAa,CAAC;AAElE,MAAa,0BAA0B,EAAE,OAAO;CAC9C,MAAM,gBAAgB,GAAG;CACzB,aAAa,gBAAgB,GAAK,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI;CAC3D,YAAY,EAAE,KAAK,oBAAoB,CAAC,CAAC,SAAS;AACpD,CAAC;AAED,MAAa,0BAA0B,EACpC,OAAO;CACN,MAAM,gBAAgB,GAAG,CAAC,CAAC,SAAS;CACpC,aAAa,gBAAgB,GAAK,CAAC,CAAC,SAAS;CAC7C,gBAAgB,gBAAgB,GAAG,CAAC,CAAC,SAAS;CAC9C,YAAY,EAAE,KAAK,oBAAoB,CAAC,CAAC,SAAS;CAClD,sBAAsB,EAAE,KAAK,eAAe,CAAC,CAAC,SAAS;CACvD,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;AACzC,CAAC,CAAC,CACD,QAAO,UAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,yCAAyC,CAAC;AAEvG,MAAM,8BAA8B,EAAE,OAAO;CAC3C,qBAAqB,EAAE,OAAO;CAC9B,cAAc,EAAE,OAAO;CACvB,cAAc,EAAE,OAAO;CAEvB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,eAAe,EAAE,QAAQ;CACzB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,iBAAiB,EAAE,KAAK;EAAC;EAAW;EAAc;CAAQ,CAAC;CAC3D,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC;;AAGD,MAAa,2BAA2B,EAAE,OAAO;CAC/C,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAChD,cAAc,EAAE,OAAO;EACrB,UAAU,EAAE,QAAQ;EACpB,QAAQ,EAAE,OAAO;GAAE,WAAW,EAAE,QAAQ;GAAG,SAAS,EAAE,QAAQ;EAAE,CAAC;CACnE,CAAC;AACH,CAAC;;AAGD,MAAa,iCAAiC,EAAE,OAAO;CACrD,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,QAAQ;EACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;EAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;;EAE9B,mBAAmB,EAAE,QAAQ;CAC/B,CAAC;CACD,MAAM,EAAE,OAAO;EAAE,SAAS,EAAE,QAAQ;EAAG,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI;CAAE,CAAC;AAC5E,CAAC;;AAGD,MAAa,6BAA6B,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE9G,MAAa,mCAAmC,EAAE,OAAO,EACvD,aAAa,EAAE,OAAO;CACpB,SAAS;;CAET,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAC1C,yBAAyB,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7C,uBAAuB,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3C,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,qBAAqB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAC/D,cAAc,EAAE,MAAM,2BAA2B;CACjD,eAAe,+BAA+B,SAAS;CACvD,OAAO,2BAA2B,SAAS,CAAC,CAAC,SAAS;AACxD,CAAC,EACH,CAAC;AAED,MAAM,+BAA+B,EAAE,KAAK;CAAC;CAAW;CAAY;CAAS;CAAU;AAAS,CAAC;AAEjG,MAAa,sCAAsC,EAAE,OAAO;CAC1D,SAAS,EAAE,KAAK;EAAC;EAAW;EAAW;EAAe;CAAQ,CAAC;CAC/D,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;AAC9B,CAAC;AAED,MAAa,yBAAyB,EAAE,OAAO;CAC7C,SAAS,EAAE,OAAO;CAClB,QAAQ;CACR,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AACrC,CAAC;AAED,MAAa,kCAAkC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,EAAE,CAAC;AACnG,MAAa,iCAAiC,EAAE,OAAO,EAAE,OAAO,uBAAuB,CAAC;AAExF,MAAM,kBAAkB,kBAAkB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAE/E,MAAM,mCAAmC,EAAE,OAAO;CAChD,qBAAqB;CACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC3C,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS;CACpC,cAAc,gBAAgB,GAAK,CAAC,CAAC,SAAS;CAC9C,iBAAiB,gBAAgB,GAAK,CAAC,CAAC,SAAS;AACnD,CAAC;AAED,MAAa,qCAAqC,EAC/C,OAAO;CACN,yBAAyB,gBAAgB,GAAK,CAAC,CAC5C,QAAO,UAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,GAAG,EACxD,SAAS,2CACX,CAAC,CAAC,CACD,SAAS;;CAEZ,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;CAChE,uBAAuB,gBAAgB,GAAK,CAAC,CAAC,SAAS;;CAEvD,eAAe,EACZ,OAAO;EACN,UAAU,EACP,OAAO;GACN,SAAS,EAAE,QAAQ;GACnB,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;GACjD,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC,CAAC,CACD,SAAS;EACZ,MAAM,EACH,OAAO;GACN,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;GAC9B,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAK,CAAC,CAAC,SAAS;EAC/D,CAAC,CAAC,CACD,SAAS;CACd,CAAC,CAAC,CACD,SAAS;CACZ,cAAc,EACX,MAAM,gCAAgC,CAAC,CACvC,IAAI,GAAG,CAAC,CACR,aAAa,SAAS,QAAQ;EAE7B,IAAI,IADY,IAAI,QAAQ,KAAI,UAAS,MAAM,mBAAmB,CAC5D,CAAC,CAAC,SAAS,QAAQ,QACvB,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS;EAAqC,CAAC;EAEhF,MAAM,YAAY,QAAQ,SAAQ,UAAU,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAE;EACjG,IAAI,UAAU,WAAW,GAAG;EAC5B,MAAM,WAAW,MAAM,KAAK,EAAE,QAAQ,QAAQ,OAAO,IAAI,GAAG,UAAU,QAAQ,CAAC;EAC/E,IACE,UAAU,WAAW,QAAQ,UAC7B,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,MAAM,SAAS,EAAE,GAErE,IAAI,SAAS;GACX,MAAM;GACN,SAAS;EACX,CAAC;CAEL,CAAC,CAAC,CACD,SAAS;AACd,CAAC,CAAC,CACD,QAAO,UAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,6CAA6C,CAAC;AAE3G,MAAM,eAAe,EAClB,MACC,EACG,OAAO,CAAC,CACR,IAAI,EAAE,CAAC,CACP,MAAM,wBAAwB,CACnC,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QAAO,WAAU,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QAAQ,EAAE,SAAS,wBAAwB,CAAC;AAEhG,MAAM,uBAAuB,EAC1B,OAAO;CACN,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACxC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACrC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,IAAK,CAAC,CAAC,SAAS;AACtC,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,gBAAgB,EAAE,OAAO;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACpC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACjC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,aAAa;AACxE,MAAM,iBAAiB,EACpB,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CACpD,QAAO,UAAS;CACf,IAAI;EACF,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,UAAU,KAAK;CAC9C,QAAQ;EACN,OAAO;CACT;AACF,GAAG,yBAAyB,CAAC,CAC5B,WAAU,UAAS;CAClB,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,EACJ,+BAA+B,kBAC/B,kCAAkC,iBAClC,yBAAyB,0BACzB,GAAG,aACD;CACJ,OAAO;AACT,CAAC;AAEH,MAAa,2BAA2B,EAAE,OAAO;CAC/C,OAAO,kBAAkB,GAAG;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CAC3C,gBAAgB,qBAAqB,SAAS;CAC9C,kBAAkB,WAAW,SAAS,CAAC,CAAC,SAAS;CACjD,QAAQ,aAAa,SAAS;CAC9B,UAAU,eAAe,SAAS;CAClC,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,MAAa,2BAA2B,EACrC,OAAO;CACN,OAAO,kBAAkB,GAAG,CAAC,CAAC,SAAS;CACvC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CAC3C,kBAAkB,WAAW,SAAS,CAAC,CAAC,SAAS;CACjD,QAAQ,aAAa,SAAS;CAC9B,UAAU,eAAe,SAAS;CAClC,UAAU,eAAe,SAAS;CAClC,kBAAkB,EAAE,QAAQ,IAAI,CAAC,CAAC,SAAS;AAC7C,CAAC,CAAC,CACD,QAAO,UAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,2CAA2C,CAAC;AAEzG,MAAa,uBAAuB,EACjC,OAAO;CACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAA,GAA+B,CAAC,CAAC,MAAM,mBAAmB;CAC5E,OAAO,EAAE,OAAO,CAAC,CAAC,IAAA,GAA+B,CAAC,CAAC,MAAM,mBAAmB;CAC5E,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACxC,WAAW;CACX,OAAO,gBAAgB,GAAG;CAC1B,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAChC,CAAC,CAAC,CACD,WAAU,WAAU;CACnB,OAAO,MAAM;CACb,OAAO,MAAM;CACb,kBAAkB,MAAM;CACxB,SAAS;EAAE,MAAM;EAAkB,UAAU,MAAM;CAAU;CAC7D,OAAO,MAAM;CACb,GAAI,MAAM,YAAY,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AACpD,EAAE;AAEJ,MAAa,0BAA0B,EAAE,OAAO;CAC9C,WAAW;CACX,aAAa,gBAAgB,GAAG;CAChC,YAAY;CACZ,UAAU,EAAE,OAAO;EACjB,IAAI;EACJ,MAAM,gBAAgB,EAAE;EACxB,OAAO;CACT,CAAC;AACH,CAAC;AAED,MAAa,+BAA+B,EACzC,OAAO;CACN,WAAW;CACX,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACxC,MAAM,EAAE,KAAK,mBAAmB;CAChC,WAAW,gBAAgB,GAAG;CAC9B,WAAW,gBAAgB,IAAK,CAAC,CAAC,SAAS;AAC7C,CAAC,CAAC,CACD,OAAO;AAEV,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;AAC1B,CAAC;AAED,MAAM,uBAAuB,EAAE,KAAK;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,sBAAsB,cAAsB,QAChD,EACG,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAU,UAAS;CAClB,MAAM,SAAS,QAAQ,OAAO,SAAS,OAAO,EAAE,IAAI;CACpD,OAAO,OAAO,SAAS,MAAM,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,MAAM,CAAC,IAAI;AACxE,CAAC;AACL,MAAM,uBAAuB,EAC1B,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAW,OAAO,YAAY;CAC7B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI;EACF,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAC3E,IACE,CAAC,MAAM,QAAQ,OAAO,KACtB,QAAQ,WAAW,KACnB,OAAO,QAAQ,OAAO,YACtB,OAAO,QAAQ,OAAO,UAEtB,MAAM,IAAI,MAAM,gBAAgB;EAElC,MAAM,YAAY,IAAI,KAAK,QAAQ,EAAE;EACrC,IAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,KAAK,kBAAC,IAAI,OAAA,+EAAmB,EAAC,CAAC,KAAK,QAAQ,EAAE,GAChF,MAAM,IAAI,MAAM,gBAAgB;EAElC,OAAO;GAAE;GAAW,IAAI,QAAQ;EAAG;CACrC,QAAQ;EACN,QAAQ,SAAS;GAAE,MAAM;GAAU,SAAS;EAAiB,CAAC;EAC9D,OAAO,EAAE;CACX;AACF,CAAC;AAEH,MAAa,sBAAsB,EAAE,OAAO;CAC1C,UAAU,EACP,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAU,UAAS;EAClB,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC,KAAI,WAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAC3E,WAAU,qBAAqB,UAAU,MAAM,CAAC,CAAC,OACnD;EACA,OAAO,SAAS,SAAS,IAAI,WAAW,KAAA;CAC1C,CAAC;CACH,QAAQ;CACR,OAAO,mBAAmB,IAAI,EAAE;AAClC,CAAC;AAED,MAAM,sBAAsB,EAAE,KAAK;CACjC;CACA;CACA;CACA;CACA;AACF,CAAC;AAKD,SAAS,6BAA6B,OAAqD;CACzF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,OAAO,UACrG;CAEF,MAAM,aAAa,IAAI,KAAK,MAAM,EAAE;CACpC,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,kBAAC,IAAI,OAAA,+EAAmB,EAAC,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,KAAA;CAC3F,OAAO;EAAE;EAAY,IAAI,MAAM;CAAG;AACpC;AAEA,MAAM,wBAAwB,EAC3B,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAW,OAAO,YAAY;CAC7B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI;EACF,MAAM,UAAmB,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACpF,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,MAAM,SAAS,6BAA6B,OAAO;GACnD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,gBAAgB;GAC7C,uBAAO,IAAI,IAAwD,CAAC,CAAC,qBAAqB,MAAM,CAAC,CAAC;EACpG;EACA,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,gBAAgB;EAC7E,MAAM,0BAA8B,IAAI,IAAI;EAC5C,KAAK,MAAM,CAAC,MAAM,kBAAkB,OAAO,QAAQ,OAAO,GAAG;GAC3D,MAAM,aAAa,oBAAoB,UAAU,IAAI;GACrD,IAAI,CAAC,WAAW,SAAS,MAAM,IAAI,MAAM,gBAAgB;GACzD,IAAI,kBAAkB,MAAM;IAC1B,QAAQ,IAAI,WAAW,MAAM,KAAA,CAAS;IACtC;GACF;GACA,MAAM,WAAW,6BAA6B,aAAa;GAC3D,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,gBAAgB;GAC/C,QAAQ,IAAI,WAAW,MAAM,QAAQ;EACvC;EACA,IAAI,QAAQ,SAAS,GAAG,MAAM,IAAI,MAAM,gBAAgB;EACxD,OAAO;CACT,QAAQ;EACN,QAAQ,SAAS;GAAE,MAAM;GAAU,SAAS;EAAiB,CAAC;EAC9D,OAAO,EAAE;CACX;AACF,CAAC;AAEH,MAAa,uBAAuB,EAAE,OAAO;CAC3C,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAU;CAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,MAAM;CACtE,MAAM,EAAE,MAAM,mBAAmB,CAAC,CAAC,SAAS;CAC5C,QAAQ;CACR,OAAO,mBAAmB,IAAI,EAAE;CAChC,QAAQ,EACL,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAU,UAAS,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,GAAG,KAAK,KAAA,CAAS;AAC9E,CAAC;AAED,MAAM,4BAA4B,EAC/B,OAAO;CACN,IAAI;CACJ,MAAM;CACN,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACnC,YAAY,EACT,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,WAAW,OAAO,YAAY;EAC7B,MAAM,aAAa,OAAO,KAAK;EAC/B,IAAI,OAAO,cAAc,UAAU,GAAG,OAAO;EAC7C,QAAQ,SAAS;GAAE,MAAM;GAAU,SAAS;EAAqB,CAAC;EAClE,OAAO,EAAE;CACX,CAAC;AACL,CAAC,CAAC,CACD,QAAO,UAAS,IAAI,OAAO,YAAY,CAAC,CAAC,KAAK,MAAM,QAAQ,GAAG;CAC9D,SAAS;CACT,MAAM,CAAC,UAAU;AACnB,CAAC;AAEH,MAAa,0BAA0B;CACrC,aAAa;EACX,QAAQ;EACR,MAAM;EACN,aAAa;EACb,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,EAAE,CAAC;CAC/D;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,YAAY;EACV,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,uBAAuB;EACrB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,0BAA0B;EACxB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,yBAAyB;EACvB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,0BAA0B;EACxB,QAAQ;EACR,MAAM;EACN,aACE;EACF,YAAY;EACZ,gBAAgB;CAClB;CACA,4BAA4B;EAC1B,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,0BAA0B;EACxB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO;GACvB,SAAS,EAAE,OAAO;GAClB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;GAC3B,SAAS,EAAE,MACT,EAAE,OAAO;IACP,UAAU,EAAE,OAAO;IACnB,QAAQ,EAAE,KAAK;KACb;KACA;KACA;KACA;KACA;KACA;IACF,CAAC;GACH,CAAC,CACH;EACF,CAAC;CACH;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,KAAK;CACzB;CACA,YAAY;EACV,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa;EACb,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;CACA,qBAAqB;EACnB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvE;CACA,cAAc;EACZ,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EACvB,QAAQ,EAAE,MACR,EAAE,OAAO;GACP,IAAI,EAAE,OAAO;GACb,OAAO,EAAE,OAAO;GAChB,cAAc,EAAE,OAAO;GACvB,QAAQ,EAAE,MACR,EAAE,OAAO;IACP,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,KAAK;KAAC;KAAW;KAAW;IAAU,CAAC;IAC/C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,aAAa,EAAE,MAAM,EAAE,OAAO;KAAE,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;KAAG,IAAI,EAAE,OAAO;IAAE,CAAC,CAAC;GACnF,CAAC,CACH;EACF,CAAC,CACH,EACF,CAAC;CACH;CACA,cAAc;EACZ,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO;GACvB,WAAW,EAAE,MAAM,YAAY;GAC/B,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC;GACrC,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;EACtC,CAAC;CACH;CACA,gBAAgB;EACd,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,gBAAgB;EACd,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,gBAAgB;EACd,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;CAClD;CACA,oBAAoB;EAClB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,uBAAuB;EACrB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,cAAc;EACZ,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa;EACb,gBAAgB,EAAE,OAAO;GAAE,WAAW,EAAE,MAAM,YAAY;GAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAAE,CAAC;CAClG;CACA,iBAAiB;EACf,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,iBAAiB;EACf,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa;EACb,gBAAgB,EAAE,OAAO;GACvB,OAAO,EAAE,MAAM,YAAY;GAC3B,OAAO,EAAE,OACP,qBACA,EAAE,OAAO;IACP,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,OAAO;KAAE,KAAK,EAAE,OAAO;KAAG,IAAI,EAAE,OAAO;KAAG,QAAQ,EAAE,QAAQ;IAAE,CAAC,CAAC,CAAC,SAAS;GACtF,CAAC,CACH;GACA,SAAS,EAAE,QAAQ;GACnB,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAClC,CAAC;CACH;CACA,kBAAkB;EAChB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa,EAAE,OAAO,EAAE,QAAQ,sBAAsB,CAAC;EACvD,gBAAgB,EAAE,OAAO;GAAE,IAAI,EAAE,QAAQ,IAAI;GAAG,SAAS,EAAE,QAAQ;GAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAAE,CAAC;CAC3G;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;CACA,kBAAkB;EAChB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;CACA,kBAAkB;EAChB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;AACF"}
+{"version":3,"file":"contracts.js","names":[],"sources":["../../src/routes/contracts.ts"],"sourcesContent":["import { THINKING_LEVEL_VALUES } from '@mastra/code-sdk/thinking';\nimport type { ThinkingLevelSetting } from '@mastra/code-sdk/thinking';\nimport { z } from 'zod';\n\nimport { FACTORY_ROLE_STAGES } from '../rules/types.js';\nimport { BOARD_IDENTIFIER_RE, MAX_BOARD_IDENTIFIER_LENGTH } from '../rules/validation.js';\nimport { FACTORY_MODEL_SCOPES } from '../storage/domains/projects/base.js';\n\nconst FACTORY_ROLE_VALUES = Object.keys(FACTORY_ROLE_STAGES) as [string, ...string[]];\nconst THINKING_LEVELS = THINKING_LEVEL_VALUES as [ThinkingLevelSetting, ...ThinkingLevelSetting[]];\n\nexport type FactoryRouteContract = {\n  method: 'GET' | 'POST' | 'PATCH' | 'DELETE';\n  path: string;\n  description: string;\n  pathSchema?: z.ZodType;\n  querySchema?: z.ZodType;\n  bodySchema?: z.ZodType;\n  responseSchema: z.ZodType;\n};\n\nexport const UUID_PATTERN = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$';\nconst uuidSchema = z.string().regex(new RegExp(UUID_PATTERN));\nconst entitySchema = z.record(z.string(), z.unknown());\nconst nonEmptyTrimmed = (max: number) => z.string().trim().min(1).max(max);\nconst rawBoundedTrimmed = (max: number) =>\n  z\n    .string()\n    .max(max)\n    .transform(value => value.trim())\n    .pipe(z.string().min(1));\nconst trimmedUuidSchema = z.string().trim().regex(new RegExp(UUID_PATTERN));\nconst nullableTrimmed = (max: number) =>\n  z.union([\n    z\n      .string()\n      .trim()\n      .max(max)\n      .transform(value => value || null),\n    z.null(),\n  ]);\nconst projectPathSchema = z.object({ id: uuidSchema });\nconst projectDecisionPathSchema = z.object({ id: uuidSchema, decisionId: uuidSchema });\nconst workItemPathSchema = z.object({ id: uuidSchema });\nconst transitionPathSchema = z.object({ id: uuidSchema, workItemId: uuidSchema });\n\nconst projectSchema = entitySchema;\nconst projectResponseSchema = z.object({ project: projectSchema });\nconst workItemResponseSchema = z.object({ workItem: entitySchema });\nconst decisionResponseSchema = z.object({ decision: entitySchema });\n\nexport const createProjectBodySchema = z.object({\n  name: nonEmptyTrimmed(200),\n  description: nullableTrimmed(2_000).optional().default(null),\n  modelScope: z.enum(FACTORY_MODEL_SCOPES).optional(),\n});\n\nexport const updateProjectBodySchema = z\n  .object({\n    name: nonEmptyTrimmed(200).optional(),\n    description: nullableTrimmed(2_000).optional(),\n    defaultModelId: nullableTrimmed(200).optional(),\n    modelScope: z.enum(FACTORY_MODEL_SCOPES).optional(),\n    defaultThinkingLevel: z.enum(THINKING_LEVELS).optional(),\n    autoRunEnabled: z.boolean().optional(),\n    autoApprovePlans: z.boolean().optional(),\n    reviewTestChecksEnabled: z.boolean().optional(),\n    selfReviewEnabled: z.boolean().optional(),\n  })\n  .refine(input => Object.keys(input).length > 0, { message: 'At least one project field is required' });\n\nconst environmentRepositorySchema = z.object({\n  projectRepositoryId: z.string(),\n  connectionId: z.string(),\n  repositoryId: z.string(),\n  // Null when the repository row behind the link is missing.\n  slug: z.string().nullable(),\n  defaultBranch: z.string().nullable(),\n  position: z.number().int(),\n  inEnvironment: z.boolean(),\n  setupCommand: z.string().nullable(),\n  teardownCommand: z.string().nullable(),\n  lastBuildStatus: z.enum(['unbuilt', 'configured', 'failed']),\n  lastBuildError: z.string().nullable(),\n  lastBuiltAt: z.string().nullable(),\n});\n\n/** The configured FactorySandbox as factory describes it: provider id, JSON Schema of its settings, capabilities. */\nexport const environmentSandboxSchema = z.object({\n  provider: z.string(),\n  settingsSchema: z.record(z.string(), z.unknown()),\n  capabilities: z.object({\n    template: z.boolean(),\n    builds: z.object({ available: z.boolean(), history: z.boolean() }),\n  }),\n});\n\n/** When the environment builds on its own; present only when the sandbox can build. */\nexport const environmentBuildTriggersSchema = z.object({\n  schedule: z.object({\n    enabled: z.boolean(),\n    cron: z.string().nullable(),\n    timezone: z.string().nullable(),\n    /** False when the host's storage has no schedules domain; the cron trigger cannot be enabled then. */\n    scheduleAvailable: z.boolean(),\n  }),\n  push: z.object({ enabled: z.boolean(), debounceMinutes: z.number().int() }),\n});\n\n/** The last build factory asked the provider for, from the project row only; status is read live. */\nexport const environmentLastBuildSchema = z.object({ buildId: z.string(), attemptedAt: z.string().nullable() });\n\nexport const projectEnvironmentResponseSchema = z.object({\n  environment: z.object({\n    sandbox: environmentSandboxSchema,\n    /** The stored settings document; only keys the user set. */\n    settings: z.record(z.string(), z.unknown()),\n    sandboxWorkingDirectory: z.string().nullable(),\n    workspaceSetupCommand: z.string().nullable(),\n    activeTemplateId: z.string().nullable(),\n    activeTemplateHeads: z.record(z.string(), z.string()).nullable(),\n    repositories: z.array(environmentRepositorySchema),\n    buildTriggers: environmentBuildTriggersSchema.optional(),\n    build: environmentLastBuildSchema.nullable().optional(),\n  }),\n});\n\nconst environmentBuildStatusSchema = z.enum(['pending', 'building', 'ready', 'failed', 'unknown']);\n\nexport const environmentBuildStartResponseSchema = z.object({\n  outcome: z.enum(['started', 'skipped', 'unavailable', 'failed']),\n  buildId: z.string().optional(),\n  templateId: z.string().optional(),\n  reason: z.string().optional(),\n});\n\nexport const environmentBuildSchema = z.object({\n  buildId: z.string(),\n  status: environmentBuildStatusSchema,\n  templateId: z.string().optional(),\n  startedAt: z.string().optional(),\n  finishedAt: z.string().optional(),\n  error: z.string().optional(),\n  logs: z.array(z.string()).optional(),\n});\n\nexport const environmentBuildsResponseSchema = z.object({ builds: z.array(environmentBuildSchema) });\nexport const environmentBuildResponseSchema = z.object({ build: environmentBuildSchema });\n\nconst buildPathSchema = projectPathSchema.extend({ buildId: z.string().min(1) });\n\nconst environmentRepositoryPatchSchema = z.object({\n  projectRepositoryId: uuidSchema,\n  position: z.number().int().min(1).optional(),\n  inEnvironment: z.boolean().optional(),\n  setupCommand: nullableTrimmed(2_000).optional(),\n  teardownCommand: nullableTrimmed(2_000).optional(),\n});\n\nexport const updateProjectEnvironmentBodySchema = z\n  .object({\n    sandboxWorkingDirectory: nullableTrimmed(1_000)\n      .refine(value => value === null || value.startsWith('/'), {\n        message: 'sandboxWorkingDirectory must be absolute',\n      })\n      .optional(),\n    /** Partial settings merged onto the stored document; null removes a key. Validated by the FactorySandbox. */\n    settings: z.record(z.string(), z.unknown().nullable()).optional(),\n    workspaceSetupCommand: nullableTrimmed(2_000).optional(),\n    /** Build triggers; only accepted when the sandbox can build. */\n    buildTriggers: z\n      .object({\n        schedule: z\n          .object({\n            enabled: z.boolean(),\n            cron: z.string().trim().min(1).max(100).optional(),\n            timezone: z.string().trim().min(1).max(100).optional(),\n          })\n          .optional(),\n        push: z\n          .object({\n            enabled: z.boolean().optional(),\n            debounceMinutes: z.number().int().min(0).max(1_440).optional(),\n          })\n          .optional(),\n      })\n      .optional(),\n    repositories: z\n      .array(environmentRepositoryPatchSchema)\n      .max(100)\n      .superRefine((entries, ctx) => {\n        const ids = new Set(entries.map(entry => entry.projectRepositoryId));\n        if (ids.size !== entries.length) {\n          ctx.addIssue({ code: 'custom', message: 'Each repository may be listed once' });\n        }\n        const positions = entries.flatMap(entry => (entry.position === undefined ? [] : [entry.position]));\n        if (positions.length === 0) return;\n        const expected = Array.from({ length: entries.length }, (_, index) => index + 1);\n        if (\n          positions.length !== entries.length ||\n          [...positions].sort((a, b) => a - b).some((p, i) => p !== expected[i])\n        ) {\n          ctx.addIssue({\n            code: 'custom',\n            message: 'Positions must be a permutation of 1..n over the listed repositories',\n          });\n        }\n      })\n      .optional(),\n  })\n  .refine(input => Object.keys(input).length > 0, { message: 'At least one environment field is required' });\n\nconst stagesSchema = z\n  .array(\n    z\n      .string()\n      .max(64)\n      .regex(/^[a-z0-9][a-z0-9_-]*$/i),\n  )\n  .min(1)\n  .max(16)\n  .refine(stages => new Set(stages).size === stages.length, { message: 'Stages must be unique' });\n\nconst externalSourceSchema = z\n  .object({\n    integrationId: z.string().min(1).max(128),\n    type: z.string().min(1).max(128),\n    externalId: z.string().min(1).max(512),\n    url: z.string().max(2_048).optional(),\n  })\n  .nullable();\n\nconst sessionSchema = z.object({\n  sessionId: z.string().min(1).max(512),\n  branch: z.string().min(1).max(512),\n  threadId: z.string().min(1).max(512),\n});\n\nconst sessionsSchema = z.record(z.string().min(1).max(64), sessionSchema);\nconst metadataSchema = z\n  .union([z.record(z.string(), z.unknown()), z.null()])\n  .refine(value => {\n    try {\n      return JSON.stringify(value).length <= 16 * 1024;\n    } catch {\n      return false;\n    }\n  }, 'Metadata exceeds 16 KiB')\n  .transform(value => {\n    if (value === null) return null;\n    const {\n      factoryRuleMaterializationKey: _materialization,\n      factoryPullRequestReconciliation: _reconciliation,\n      externalSourceMissingAt: _externalSourceMissingAt,\n      ...metadata\n    } = value;\n    return metadata;\n  });\n\nexport const createWorkItemBodySchema = z.object({\n  title: rawBoundedTrimmed(500),\n  board: z.string().min(1).max(128).optional(),\n  externalSource: externalSourceSchema.optional(),\n  parentWorkItemId: uuidSchema.nullable().optional(),\n  stages: stagesSchema.optional(),\n  sessions: sessionsSchema.optional(),\n  metadata: metadataSchema.optional(),\n});\n\nexport const updateWorkItemBodySchema = z\n  .object({\n    title: rawBoundedTrimmed(500).optional(),\n    board: z.string().min(1).max(128).optional(),\n    parentWorkItemId: uuidSchema.nullable().optional(),\n    stages: stagesSchema.optional(),\n    sessions: sessionsSchema.optional(),\n    metadata: metadataSchema.optional(),\n    plansPreapproved: z.literal(true).optional(),\n  })\n  .refine(input => Object.keys(input).length > 0, { message: 'At least one work-item field is required' });\n\nexport const transitionBodySchema = z\n  .object({\n    board: z.string().max(MAX_BOARD_IDENTIFIER_LENGTH).regex(BOARD_IDENTIFIER_RE),\n    stage: z.string().max(MAX_BOARD_IDENTIFIER_LENGTH).regex(BOARD_IDENTIFIER_RE),\n    expectedRevision: z.number().int().min(1),\n    requestId: trimmedUuidSchema,\n    cause: nonEmptyTrimmed(256),\n    reenter: z.unknown().optional(),\n  })\n  .transform(input => ({\n    board: input.board,\n    stage: input.stage,\n    expectedRevision: input.expectedRevision,\n    ingress: { type: 'human' as const, identity: input.requestId },\n    cause: input.cause,\n    ...(input.reenter === true ? { reenter: true } : {}),\n  }));\n\nexport const startWorkItemBodySchema = z.object({\n  sessionId: trimmedUuidSchema,\n  threadTitle: nonEmptyTrimmed(512),\n  kickoffKey: trimmedUuidSchema,\n  workItem: z.object({\n    id: trimmedUuidSchema,\n    role: nonEmptyTrimmed(32),\n    input: createWorkItemBodySchema,\n  }),\n});\n\nexport const automationRunStartBodySchema = z\n  .object({\n    requestId: trimmedUuidSchema,\n    expectedRevision: z.number().int().min(1),\n    role: z.enum(FACTORY_ROLE_VALUES),\n    skillName: nonEmptyTrimmed(128),\n    arguments: nonEmptyTrimmed(4_096).optional(),\n  })\n  .strict();\n\nexport const metricsQuerySchema = z.object({\n  from: z.string().optional(),\n  to: z.string().optional(),\n});\n\nconst decisionStatusSchema = z.enum([\n  'pending',\n  'proposed',\n  'dismissed',\n  'superseded',\n  'leased',\n  'retry',\n  'succeeded',\n  'failed',\n]);\nconst boundedLimitSchema = (defaultValue: number, max: number) =>\n  z\n    .string()\n    .optional()\n    .transform(value => {\n      const parsed = value ? Number.parseInt(value, 10) : defaultValue;\n      return Number.isFinite(parsed) ? Math.max(1, Math.min(max, parsed)) : defaultValue;\n    });\nconst decisionCursorSchema = z\n  .string()\n  .optional()\n  .transform((value, context) => {\n    if (!value) return undefined;\n    try {\n      const decoded = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n      if (\n        !Array.isArray(decoded) ||\n        decoded.length !== 2 ||\n        typeof decoded[0] !== 'string' ||\n        typeof decoded[1] !== 'string'\n      ) {\n        throw new Error('invalid cursor');\n      }\n      const createdAt = new Date(decoded[0]);\n      if (Number.isNaN(createdAt.getTime()) || !new RegExp(UUID_PATTERN).test(decoded[1])) {\n        throw new Error('invalid cursor');\n      }\n      return { createdAt, id: decoded[1] };\n    } catch {\n      context.addIssue({ code: 'custom', message: 'Invalid cursor' });\n      return z.NEVER;\n    }\n  });\n\nexport const decisionQuerySchema = z.object({\n  statuses: z\n    .string()\n    .optional()\n    .transform(value => {\n      if (!value) return undefined;\n      const statuses = [...new Set(value.split(',').map(status => status.trim()))].filter(\n        status => decisionStatusSchema.safeParse(status).success,\n      ) as Array<z.infer<typeof decisionStatusSchema>>;\n      return statuses.length > 0 ? statuses : undefined;\n    }),\n  before: decisionCursorSchema,\n  limit: boundedLimitSchema(25, 50),\n});\n\nconst attentionKindSchema = z.enum([\n  'automation-failed',\n  'automation-proposed',\n  'mention',\n  'activity',\n  'agent-waiting',\n]);\ntype AttentionKind = z.infer<typeof attentionKindSchema>;\ntype AttentionStreamPosition = { occurredAt: Date; id: string };\ntype AttentionCursorMap = Map<AttentionKind, AttentionStreamPosition | undefined>;\n\nfunction parseAttentionStreamPosition(value: unknown): AttentionStreamPosition | undefined {\n  if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== 'string' || typeof value[1] !== 'string') {\n    return undefined;\n  }\n  const occurredAt = new Date(value[0]);\n  if (Number.isNaN(occurredAt.getTime()) || !new RegExp(UUID_PATTERN).test(value[1])) return undefined;\n  return { occurredAt, id: value[1] };\n}\n\nconst attentionCursorSchema = z\n  .string()\n  .optional()\n  .transform((value, context) => {\n    if (!value) return undefined;\n    try {\n      const decoded: unknown = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));\n      if (Array.isArray(decoded)) {\n        const legacy = parseAttentionStreamPosition(decoded);\n        if (!legacy) throw new Error('invalid cursor');\n        return new Map<AttentionKind, AttentionStreamPosition | undefined>([['automation-failed', legacy]]);\n      }\n      if (!decoded || typeof decoded !== 'object') throw new Error('invalid cursor');\n      const cursors: AttentionCursorMap = new Map();\n      for (const [kind, positionValue] of Object.entries(decoded)) {\n        const parsedKind = attentionKindSchema.safeParse(kind);\n        if (!parsedKind.success) throw new Error('invalid cursor');\n        if (positionValue === null) {\n          cursors.set(parsedKind.data, undefined);\n          continue;\n        }\n        const position = parseAttentionStreamPosition(positionValue);\n        if (!position) throw new Error('invalid cursor');\n        cursors.set(parsedKind.data, position);\n      }\n      if (cursors.size === 0) throw new Error('invalid cursor');\n      return cursors;\n    } catch {\n      context.addIssue({ code: 'custom', message: 'Invalid cursor' });\n      return z.NEVER;\n    }\n  });\n\nexport const attentionQuerySchema = z.object({\n  view: z.enum(['open', 'unread', 'archived']).optional().default('open'),\n  kind: z.array(attentionKindSchema).optional(),\n  before: attentionCursorSchema,\n  limit: boundedLimitSchema(25, 50),\n  search: z\n    .string()\n    .optional()\n    .transform(value => value?.trim().toLowerCase().slice(0, 200) || undefined),\n});\n\nconst attentionActionPathSchema = z\n  .object({\n    id: uuidSchema,\n    kind: attentionKindSchema,\n    sourceId: z.string().min(1).max(256),\n    occurrence: z\n      .string()\n      .regex(/^(0|[1-9]\\d*)$/)\n      .transform((value, context) => {\n        const occurrence = Number(value);\n        if (Number.isSafeInteger(occurrence)) return occurrence;\n        context.addIssue({ code: 'custom', message: 'Invalid occurrence' });\n        return z.NEVER;\n      }),\n  })\n  .refine(input => new RegExp(UUID_PATTERN).test(input.sourceId), {\n    message: 'Invalid attention source id',\n    path: ['sourceId'],\n  });\n\nexport const FACTORY_ROUTE_CONTRACTS = {\n  projectList: {\n    method: 'GET',\n    path: '/web/factory/projects',\n    description: 'List Factory projects for the current organization',\n    responseSchema: z.object({ projects: z.array(projectSchema) }),\n  },\n  projectCreate: {\n    method: 'POST',\n    path: '/web/factory/projects',\n    description: 'Create a Factory project',\n    bodySchema: createProjectBodySchema,\n    responseSchema: projectResponseSchema,\n  },\n  projectGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id',\n    description: 'Get a Factory project',\n    pathSchema: projectPathSchema,\n    responseSchema: projectResponseSchema,\n  },\n  projectUpdate: {\n    method: 'PATCH',\n    path: '/web/factory/projects/:id',\n    description: 'Update a Factory project',\n    pathSchema: projectPathSchema,\n    bodySchema: updateProjectBodySchema,\n    responseSchema: projectResponseSchema,\n  },\n  projectEnvironmentGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/environment',\n    description: 'Get the sandbox environment of a Factory project: provider settings and its repositories in order',\n    pathSchema: projectPathSchema,\n    responseSchema: projectEnvironmentResponseSchema,\n  },\n  projectEnvironmentUpdate: {\n    method: 'PATCH',\n    path: '/web/factory/projects/:id/environment',\n    description: 'Update the sandbox environment of a Factory project: provider settings, repository order and setup',\n    pathSchema: projectPathSchema,\n    bodySchema: updateProjectEnvironmentBodySchema,\n    responseSchema: projectEnvironmentResponseSchema,\n  },\n  projectEnvironmentBuild: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/environment/build',\n    description: 'Build the sandbox environment template of a Factory project now',\n    pathSchema: projectPathSchema,\n    responseSchema: environmentBuildStartResponseSchema,\n  },\n  projectEnvironmentBuilds: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/environment/builds',\n    description:\n      'List the environment template builds of a Factory project, newest first, when the provider keeps history',\n    pathSchema: projectPathSchema,\n    responseSchema: environmentBuildsResponseSchema,\n  },\n  projectEnvironmentBuildGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/environment/builds/:buildId',\n    description: 'Get the live status of one environment template build of a Factory project',\n    pathSchema: buildPathSchema,\n    responseSchema: environmentBuildResponseSchema,\n  },\n  projectApplyDefaultModel: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/apply-default-model',\n    description: 'Apply the Factory default model to running work and review threads',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({\n      modelId: z.string(),\n      applied: z.array(z.string()),\n      skipped: z.array(\n        z.object({\n          threadId: z.string(),\n          reason: z.enum([\n            'not-running',\n            'work-item-missing',\n            'stage-inactive',\n            'thread-missing',\n            'mode-unknown',\n            'apply-failed',\n          ]),\n        }),\n      ),\n    }),\n  },\n  projectDelete: {\n    method: 'DELETE',\n    path: '/web/factory/projects/:id',\n    description: 'Delete a Factory project',\n    pathSchema: projectPathSchema,\n    responseSchema: z.null(),\n  },\n  metricsGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/metrics',\n    description: 'Get Factory project metrics',\n    pathSchema: projectPathSchema,\n    querySchema: metricsQuerySchema,\n    responseSchema: z.object({ metrics: entitySchema }),\n  },\n  healthThresholdsGet: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/health/thresholds',\n    description: 'Get queue-health thresholds',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({ thresholds: z.array(z.number().finite()) }),\n  },\n  boardCatalog: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/boards',\n    description: 'List installed Factory boards',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({\n      boards: z.array(\n        z.object({\n          id: z.string(),\n          title: z.string(),\n          initialPhase: z.string(),\n          phases: z.array(\n            z.object({\n              id: z.string(),\n              title: z.string(),\n              kind: z.enum(['resting', 'working', 'terminal']),\n              role: z.string().optional(),\n              transitions: z.array(z.object({ outcome: z.string().nullable(), to: z.string() })),\n            }),\n          ),\n        }),\n      ),\n    }),\n  },\n  workItemList: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/work-items',\n    description: 'List Factory work items and running sessions',\n    pathSchema: projectPathSchema,\n    responseSchema: z.object({\n      workItems: z.array(entitySchema),\n      runningSessionIds: z.array(z.string()),\n      parkedSessionIds: z.array(z.string()),\n    }),\n  },\n  workItemCreate: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/work-items',\n    description: 'Create a work item in Intake',\n    pathSchema: projectPathSchema,\n    bodySchema: createWorkItemBodySchema,\n    responseSchema: workItemResponseSchema,\n  },\n  workItemUpdate: {\n    method: 'PATCH',\n    path: '/web/factory/work-items/:id',\n    description: 'Update non-stage work-item fields',\n    pathSchema: workItemPathSchema,\n    bodySchema: updateWorkItemBodySchema,\n    responseSchema: workItemResponseSchema,\n  },\n  workItemDelete: {\n    method: 'DELETE',\n    path: '/web/factory/work-items/:id',\n    description: 'Delete a Factory work item',\n    pathSchema: workItemPathSchema,\n    responseSchema: z.object({ ok: z.literal(true) }),\n  },\n  workItemTransition: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/work-items/:workItemId/transition',\n    description: 'Transition a work item with its expected revision',\n    pathSchema: transitionPathSchema,\n    bodySchema: transitionBodySchema,\n    responseSchema: entitySchema,\n  },\n  workItemStart: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/runs/start',\n    description: 'Explicitly start a Factory work-item run',\n    pathSchema: projectPathSchema,\n    bodySchema: startWorkItemBodySchema,\n    responseSchema: entitySchema,\n  },\n  workItemAutomationRun: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/work-items/:workItemId/automation-runs',\n    description: 'Enqueue an idempotent deferred skill dispatch for a trusted external orchestrator',\n    pathSchema: transitionPathSchema,\n    bodySchema: automationRunStartBodySchema,\n    responseSchema: entitySchema,\n  },\n  decisionList: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/decisions',\n    description: 'List Factory decisions',\n    pathSchema: projectPathSchema,\n    querySchema: decisionQuerySchema,\n    responseSchema: z.object({ decisions: z.array(entitySchema), nextCursor: z.string().optional() }),\n  },\n  decisionApprove: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/decisions/:decisionId/approve',\n    description: 'Approve a proposed Factory decision',\n    pathSchema: projectDecisionPathSchema,\n    responseSchema: decisionResponseSchema,\n  },\n  decisionDismiss: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/decisions/:decisionId/dismiss',\n    description: 'Dismiss a proposed Factory decision',\n    pathSchema: projectDecisionPathSchema,\n    responseSchema: decisionResponseSchema,\n  },\n  decisionRetry: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/decisions/:decisionId/retry',\n    description: 'Retry a failed retryable Factory decision',\n    pathSchema: projectDecisionPathSchema,\n    responseSchema: decisionResponseSchema,\n  },\n  attentionList: {\n    method: 'GET',\n    path: '/web/factory/projects/:id/attention',\n    description: 'List the Factory attention inbox',\n    pathSchema: projectPathSchema,\n    querySchema: attentionQuerySchema,\n    responseSchema: z.object({\n      items: z.array(entitySchema),\n      kinds: z.record(\n        attentionKindSchema,\n        z.object({\n          open: z.number(),\n          unread: z.number(),\n          latest: z.object({ key: z.string(), at: z.string(), unread: z.boolean() }).nullable(),\n        }),\n      ),\n      hasMore: z.boolean(),\n      nextCursor: z.string().optional(),\n    }),\n  },\n  attentionReadAll: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/read-all',\n    description: 'Mark all Factory attention as read',\n    pathSchema: projectPathSchema,\n    querySchema: z.object({ before: attentionCursorSchema }),\n    responseSchema: z.object({ ok: z.literal(true), hasMore: z.boolean(), nextCursor: z.string().optional() }),\n  },\n  attentionRead: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/:kind/:sourceId/:occurrence/read',\n    description: 'Mark a Factory attention receipt as read',\n    pathSchema: attentionActionPathSchema,\n    responseSchema: z.object({ receipt: entitySchema }),\n  },\n  attentionArchive: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/:kind/:sourceId/:occurrence/archive',\n    description: 'Archive a Factory attention receipt',\n    pathSchema: attentionActionPathSchema,\n    responseSchema: z.object({ receipt: entitySchema }),\n  },\n  attentionRestore: {\n    method: 'POST',\n    path: '/web/factory/projects/:id/attention/:kind/:sourceId/:occurrence/restore',\n    description: 'Restore an archived Factory attention receipt',\n    pathSchema: attentionActionPathSchema,\n    responseSchema: z.object({ receipt: entitySchema }),\n  },\n} as const satisfies Record<string, FactoryRouteContract>;\n\nexport type FactoryRouteContractKey = keyof typeof FACTORY_ROUTE_CONTRACTS;\n"],"mappings":";;;;;;AAQA,MAAM,sBAAsB,OAAO,KAAK,mBAAmB;AAC3D,MAAM,kBAAkB;AAYxB,MAAa,eAAe;AAC5B,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,YAAY,CAAC;AAC5D,MAAM,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACrD,MAAM,mBAAmB,QAAgB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACzE,MAAM,qBAAqB,QACzB,EACG,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,WAAU,UAAS,MAAM,KAAK,CAAC,CAAC,CAChC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3B,MAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,YAAY,CAAC;AAC1E,MAAM,mBAAmB,QACvB,EAAE,MAAM,CACN,EACG,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,GAAG,CAAC,CACR,WAAU,UAAS,SAAS,IAAI,GACnC,EAAE,KAAK,CACT,CAAC;AACH,MAAM,oBAAoB,EAAE,OAAO,EAAE,IAAI,WAAW,CAAC;AACrD,MAAM,4BAA4B,EAAE,OAAO;CAAE,IAAI;CAAY,YAAY;AAAW,CAAC;AACrF,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,WAAW,CAAC;AACtD,MAAM,uBAAuB,EAAE,OAAO;CAAE,IAAI;CAAY,YAAY;AAAW,CAAC;AAEhF,MAAM,gBAAgB;AACtB,MAAM,wBAAwB,EAAE,OAAO,EAAE,SAAS,cAAc,CAAC;AACjE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,aAAa,CAAC;AAClE,MAAM,yBAAyB,EAAE,OAAO,EAAE,UAAU,aAAa,CAAC;AAElE,MAAa,0BAA0B,EAAE,OAAO;CAC9C,MAAM,gBAAgB,GAAG;CACzB,aAAa,gBAAgB,GAAK,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI;CAC3D,YAAY,EAAE,KAAK,oBAAoB,CAAC,CAAC,SAAS;AACpD,CAAC;AAED,MAAa,0BAA0B,EACpC,OAAO;CACN,MAAM,gBAAgB,GAAG,CAAC,CAAC,SAAS;CACpC,aAAa,gBAAgB,GAAK,CAAC,CAAC,SAAS;CAC7C,gBAAgB,gBAAgB,GAAG,CAAC,CAAC,SAAS;CAC9C,YAAY,EAAE,KAAK,oBAAoB,CAAC,CAAC,SAAS;CAClD,sBAAsB,EAAE,KAAK,eAAe,CAAC,CAAC,SAAS;CACvD,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACvC,yBAAyB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC9C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC1C,CAAC,CAAC,CACD,QAAO,UAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,yCAAyC,CAAC;AAEvG,MAAM,8BAA8B,EAAE,OAAO;CAC3C,qBAAqB,EAAE,OAAO;CAC9B,cAAc,EAAE,OAAO;CACvB,cAAc,EAAE,OAAO;CAEvB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,eAAe,EAAE,QAAQ;CACzB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,iBAAiB,EAAE,KAAK;EAAC;EAAW;EAAc;CAAQ,CAAC;CAC3D,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC;;AAGD,MAAa,2BAA2B,EAAE,OAAO;CAC/C,UAAU,EAAE,OAAO;CACnB,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAChD,cAAc,EAAE,OAAO;EACrB,UAAU,EAAE,QAAQ;EACpB,QAAQ,EAAE,OAAO;GAAE,WAAW,EAAE,QAAQ;GAAG,SAAS,EAAE,QAAQ;EAAE,CAAC;CACnE,CAAC;AACH,CAAC;;AAGD,MAAa,iCAAiC,EAAE,OAAO;CACrD,UAAU,EAAE,OAAO;EACjB,SAAS,EAAE,QAAQ;EACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;EAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;;EAE9B,mBAAmB,EAAE,QAAQ;CAC/B,CAAC;CACD,MAAM,EAAE,OAAO;EAAE,SAAS,EAAE,QAAQ;EAAG,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI;CAAE,CAAC;AAC5E,CAAC;;AAGD,MAAa,6BAA6B,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AAAE,CAAC;AAE9G,MAAa,mCAAmC,EAAE,OAAO,EACvD,aAAa,EAAE,OAAO;CACpB,SAAS;;CAET,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;CAC1C,yBAAyB,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7C,uBAAuB,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3C,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,qBAAqB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAC/D,cAAc,EAAE,MAAM,2BAA2B;CACjD,eAAe,+BAA+B,SAAS;CACvD,OAAO,2BAA2B,SAAS,CAAC,CAAC,SAAS;AACxD,CAAC,EACH,CAAC;AAED,MAAM,+BAA+B,EAAE,KAAK;CAAC;CAAW;CAAY;CAAS;CAAU;AAAS,CAAC;AAEjG,MAAa,sCAAsC,EAAE,OAAO;CAC1D,SAAS,EAAE,KAAK;EAAC;EAAW;EAAW;EAAe;CAAQ,CAAC;CAC/D,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;AAC9B,CAAC;AAED,MAAa,yBAAyB,EAAE,OAAO;CAC7C,SAAS,EAAE,OAAO;CAClB,QAAQ;CACR,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;AACrC,CAAC;AAED,MAAa,kCAAkC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,EAAE,CAAC;AACnG,MAAa,iCAAiC,EAAE,OAAO,EAAE,OAAO,uBAAuB,CAAC;AAExF,MAAM,kBAAkB,kBAAkB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAE/E,MAAM,mCAAmC,EAAE,OAAO;CAChD,qBAAqB;CACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC3C,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS;CACpC,cAAc,gBAAgB,GAAK,CAAC,CAAC,SAAS;CAC9C,iBAAiB,gBAAgB,GAAK,CAAC,CAAC,SAAS;AACnD,CAAC;AAED,MAAa,qCAAqC,EAC/C,OAAO;CACN,yBAAyB,gBAAgB,GAAK,CAAC,CAC5C,QAAO,UAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,GAAG,EACxD,SAAS,2CACX,CAAC,CAAC,CACD,SAAS;;CAEZ,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;CAChE,uBAAuB,gBAAgB,GAAK,CAAC,CAAC,SAAS;;CAEvD,eAAe,EACZ,OAAO;EACN,UAAU,EACP,OAAO;GACN,SAAS,EAAE,QAAQ;GACnB,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;GACjD,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;EACvD,CAAC,CAAC,CACD,SAAS;EACZ,MAAM,EACH,OAAO;GACN,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;GAC9B,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAK,CAAC,CAAC,SAAS;EAC/D,CAAC,CAAC,CACD,SAAS;CACd,CAAC,CAAC,CACD,SAAS;CACZ,cAAc,EACX,MAAM,gCAAgC,CAAC,CACvC,IAAI,GAAG,CAAC,CACR,aAAa,SAAS,QAAQ;EAE7B,IAAI,IADY,IAAI,QAAQ,KAAI,UAAS,MAAM,mBAAmB,CAC5D,CAAC,CAAC,SAAS,QAAQ,QACvB,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS;EAAqC,CAAC;EAEhF,MAAM,YAAY,QAAQ,SAAQ,UAAU,MAAM,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAE;EACjG,IAAI,UAAU,WAAW,GAAG;EAC5B,MAAM,WAAW,MAAM,KAAK,EAAE,QAAQ,QAAQ,OAAO,IAAI,GAAG,UAAU,QAAQ,CAAC;EAC/E,IACE,UAAU,WAAW,QAAQ,UAC7B,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,MAAM,SAAS,EAAE,GAErE,IAAI,SAAS;GACX,MAAM;GACN,SAAS;EACX,CAAC;CAEL,CAAC,CAAC,CACD,SAAS;AACd,CAAC,CAAC,CACD,QAAO,UAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,6CAA6C,CAAC;AAE3G,MAAM,eAAe,EAClB,MACC,EACG,OAAO,CAAC,CACR,IAAI,EAAE,CAAC,CACP,MAAM,wBAAwB,CACnC,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QAAO,WAAU,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QAAQ,EAAE,SAAS,wBAAwB,CAAC;AAEhG,MAAM,uBAAuB,EAC1B,OAAO;CACN,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACxC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACrC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,IAAK,CAAC,CAAC,SAAS;AACtC,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,gBAAgB,EAAE,OAAO;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACpC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACjC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,aAAa;AACxE,MAAM,iBAAiB,EACpB,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CACpD,QAAO,UAAS;CACf,IAAI;EACF,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,UAAU,KAAK;CAC9C,QAAQ;EACN,OAAO;CACT;AACF,GAAG,yBAAyB,CAAC,CAC5B,WAAU,UAAS;CAClB,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,EACJ,+BAA+B,kBAC/B,kCAAkC,iBAClC,yBAAyB,0BACzB,GAAG,aACD;CACJ,OAAO;AACT,CAAC;AAEH,MAAa,2BAA2B,EAAE,OAAO;CAC/C,OAAO,kBAAkB,GAAG;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CAC3C,gBAAgB,qBAAqB,SAAS;CAC9C,kBAAkB,WAAW,SAAS,CAAC,CAAC,SAAS;CACjD,QAAQ,aAAa,SAAS;CAC9B,UAAU,eAAe,SAAS;CAClC,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,MAAa,2BAA2B,EACrC,OAAO;CACN,OAAO,kBAAkB,GAAG,CAAC,CAAC,SAAS;CACvC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CAC3C,kBAAkB,WAAW,SAAS,CAAC,CAAC,SAAS;CACjD,QAAQ,aAAa,SAAS;CAC9B,UAAU,eAAe,SAAS;CAClC,UAAU,eAAe,SAAS;CAClC,kBAAkB,EAAE,QAAQ,IAAI,CAAC,CAAC,SAAS;AAC7C,CAAC,CAAC,CACD,QAAO,UAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,SAAS,2CAA2C,CAAC;AAEzG,MAAa,uBAAuB,EACjC,OAAO;CACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAA,GAA+B,CAAC,CAAC,MAAM,mBAAmB;CAC5E,OAAO,EAAE,OAAO,CAAC,CAAC,IAAA,GAA+B,CAAC,CAAC,MAAM,mBAAmB;CAC5E,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACxC,WAAW;CACX,OAAO,gBAAgB,GAAG;CAC1B,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAChC,CAAC,CAAC,CACD,WAAU,WAAU;CACnB,OAAO,MAAM;CACb,OAAO,MAAM;CACb,kBAAkB,MAAM;CACxB,SAAS;EAAE,MAAM;EAAkB,UAAU,MAAM;CAAU;CAC7D,OAAO,MAAM;CACb,GAAI,MAAM,YAAY,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AACpD,EAAE;AAEJ,MAAa,0BAA0B,EAAE,OAAO;CAC9C,WAAW;CACX,aAAa,gBAAgB,GAAG;CAChC,YAAY;CACZ,UAAU,EAAE,OAAO;EACjB,IAAI;EACJ,MAAM,gBAAgB,EAAE;EACxB,OAAO;CACT,CAAC;AACH,CAAC;AAED,MAAa,+BAA+B,EACzC,OAAO;CACN,WAAW;CACX,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACxC,MAAM,EAAE,KAAK,mBAAmB;CAChC,WAAW,gBAAgB,GAAG;CAC9B,WAAW,gBAAgB,IAAK,CAAC,CAAC,SAAS;AAC7C,CAAC,CAAC,CACD,OAAO;AAEV,MAAa,qBAAqB,EAAE,OAAO;CACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS;AAC1B,CAAC;AAED,MAAM,uBAAuB,EAAE,KAAK;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,sBAAsB,cAAsB,QAChD,EACG,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAU,UAAS;CAClB,MAAM,SAAS,QAAQ,OAAO,SAAS,OAAO,EAAE,IAAI;CACpD,OAAO,OAAO,SAAS,MAAM,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,MAAM,CAAC,IAAI;AACxE,CAAC;AACL,MAAM,uBAAuB,EAC1B,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAW,OAAO,YAAY;CAC7B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI;EACF,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAC3E,IACE,CAAC,MAAM,QAAQ,OAAO,KACtB,QAAQ,WAAW,KACnB,OAAO,QAAQ,OAAO,YACtB,OAAO,QAAQ,OAAO,UAEtB,MAAM,IAAI,MAAM,gBAAgB;EAElC,MAAM,YAAY,IAAI,KAAK,QAAQ,EAAE;EACrC,IAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,KAAK,kBAAC,IAAI,OAAA,+EAAmB,EAAC,CAAC,KAAK,QAAQ,EAAE,GAChF,MAAM,IAAI,MAAM,gBAAgB;EAElC,OAAO;GAAE;GAAW,IAAI,QAAQ;EAAG;CACrC,QAAQ;EACN,QAAQ,SAAS;GAAE,MAAM;GAAU,SAAS;EAAiB,CAAC;EAC9D,OAAO,EAAE;CACX;AACF,CAAC;AAEH,MAAa,sBAAsB,EAAE,OAAO;CAC1C,UAAU,EACP,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAU,UAAS;EAClB,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC,KAAI,WAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAC3E,WAAU,qBAAqB,UAAU,MAAM,CAAC,CAAC,OACnD;EACA,OAAO,SAAS,SAAS,IAAI,WAAW,KAAA;CAC1C,CAAC;CACH,QAAQ;CACR,OAAO,mBAAmB,IAAI,EAAE;AAClC,CAAC;AAED,MAAM,sBAAsB,EAAE,KAAK;CACjC;CACA;CACA;CACA;CACA;AACF,CAAC;AAKD,SAAS,6BAA6B,OAAqD;CACzF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,OAAO,UACrG;CAEF,MAAM,aAAa,IAAI,KAAK,MAAM,EAAE;CACpC,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,kBAAC,IAAI,OAAA,+EAAmB,EAAC,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,KAAA;CAC3F,OAAO;EAAE;EAAY,IAAI,MAAM;CAAG;AACpC;AAEA,MAAM,wBAAwB,EAC3B,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAW,OAAO,YAAY;CAC7B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI;EACF,MAAM,UAAmB,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACpF,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,MAAM,SAAS,6BAA6B,OAAO;GACnD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,gBAAgB;GAC7C,uBAAO,IAAI,IAAwD,CAAC,CAAC,qBAAqB,MAAM,CAAC,CAAC;EACpG;EACA,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,gBAAgB;EAC7E,MAAM,0BAA8B,IAAI,IAAI;EAC5C,KAAK,MAAM,CAAC,MAAM,kBAAkB,OAAO,QAAQ,OAAO,GAAG;GAC3D,MAAM,aAAa,oBAAoB,UAAU,IAAI;GACrD,IAAI,CAAC,WAAW,SAAS,MAAM,IAAI,MAAM,gBAAgB;GACzD,IAAI,kBAAkB,MAAM;IAC1B,QAAQ,IAAI,WAAW,MAAM,KAAA,CAAS;IACtC;GACF;GACA,MAAM,WAAW,6BAA6B,aAAa;GAC3D,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,gBAAgB;GAC/C,QAAQ,IAAI,WAAW,MAAM,QAAQ;EACvC;EACA,IAAI,QAAQ,SAAS,GAAG,MAAM,IAAI,MAAM,gBAAgB;EACxD,OAAO;CACT,QAAQ;EACN,QAAQ,SAAS;GAAE,MAAM;GAAU,SAAS;EAAiB,CAAC;EAC9D,OAAO,EAAE;CACX;AACF,CAAC;AAEH,MAAa,uBAAuB,EAAE,OAAO;CAC3C,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAU;CAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,MAAM;CACtE,MAAM,EAAE,MAAM,mBAAmB,CAAC,CAAC,SAAS;CAC5C,QAAQ;CACR,OAAO,mBAAmB,IAAI,EAAE;CAChC,QAAQ,EACL,OAAO,CAAC,CACR,SAAS,CAAC,CACV,WAAU,UAAS,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,GAAG,KAAK,KAAA,CAAS;AAC9E,CAAC;AAED,MAAM,4BAA4B,EAC/B,OAAO;CACN,IAAI;CACJ,MAAM;CACN,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACnC,YAAY,EACT,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,WAAW,OAAO,YAAY;EAC7B,MAAM,aAAa,OAAO,KAAK;EAC/B,IAAI,OAAO,cAAc,UAAU,GAAG,OAAO;EAC7C,QAAQ,SAAS;GAAE,MAAM;GAAU,SAAS;EAAqB,CAAC;EAClE,OAAO,EAAE;CACX,CAAC;AACL,CAAC,CAAC,CACD,QAAO,UAAS,IAAI,OAAO,YAAY,CAAC,CAAC,KAAK,MAAM,QAAQ,GAAG;CAC9D,SAAS;CACT,MAAM,CAAC,UAAU;AACnB,CAAC;AAEH,MAAa,0BAA0B;CACrC,aAAa;EACX,QAAQ;EACR,MAAM;EACN,aAAa;EACb,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,EAAE,CAAC;CAC/D;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,YAAY;EACV,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,uBAAuB;EACrB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,0BAA0B;EACxB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,yBAAyB;EACvB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,0BAA0B;EACxB,QAAQ;EACR,MAAM;EACN,aACE;EACF,YAAY;EACZ,gBAAgB;CAClB;CACA,4BAA4B;EAC1B,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,0BAA0B;EACxB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO;GACvB,SAAS,EAAE,OAAO;GAClB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;GAC3B,SAAS,EAAE,MACT,EAAE,OAAO;IACP,UAAU,EAAE,OAAO;IACnB,QAAQ,EAAE,KAAK;KACb;KACA;KACA;KACA;KACA;KACA;IACF,CAAC;GACH,CAAC,CACH;EACF,CAAC;CACH;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,KAAK;CACzB;CACA,YAAY;EACV,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa;EACb,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;CACA,qBAAqB;EACnB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvE;CACA,cAAc;EACZ,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EACvB,QAAQ,EAAE,MACR,EAAE,OAAO;GACP,IAAI,EAAE,OAAO;GACb,OAAO,EAAE,OAAO;GAChB,cAAc,EAAE,OAAO;GACvB,QAAQ,EAAE,MACR,EAAE,OAAO;IACP,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE,KAAK;KAAC;KAAW;KAAW;IAAU,CAAC;IAC/C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,aAAa,EAAE,MAAM,EAAE,OAAO;KAAE,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;KAAG,IAAI,EAAE,OAAO;IAAE,CAAC,CAAC;GACnF,CAAC,CACH;EACF,CAAC,CACH,EACF,CAAC;CACH;CACA,cAAc;EACZ,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO;GACvB,WAAW,EAAE,MAAM,YAAY;GAC/B,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC;GACrC,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;EACtC,CAAC;CACH;CACA,gBAAgB;EACd,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,gBAAgB;EACd,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,gBAAgB;EACd,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;CAClD;CACA,oBAAoB;EAClB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,uBAAuB;EACrB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,YAAY;EACZ,gBAAgB;CAClB;CACA,cAAc;EACZ,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa;EACb,gBAAgB,EAAE,OAAO;GAAE,WAAW,EAAE,MAAM,YAAY;GAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAAE,CAAC;CAClG;CACA,iBAAiB;EACf,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,iBAAiB;EACf,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB;CAClB;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa;EACb,gBAAgB,EAAE,OAAO;GACvB,OAAO,EAAE,MAAM,YAAY;GAC3B,OAAO,EAAE,OACP,qBACA,EAAE,OAAO;IACP,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,OAAO;KAAE,KAAK,EAAE,OAAO;KAAG,IAAI,EAAE,OAAO;KAAG,QAAQ,EAAE,QAAQ;IAAE,CAAC,CAAC,CAAC,SAAS;GACtF,CAAC,CACH;GACA,SAAS,EAAE,QAAQ;GACnB,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAClC,CAAC;CACH;CACA,kBAAkB;EAChB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,aAAa,EAAE,OAAO,EAAE,QAAQ,sBAAsB,CAAC;EACvD,gBAAgB,EAAE,OAAO;GAAE,IAAI,EAAE,QAAQ,IAAI;GAAG,SAAS,EAAE,QAAQ;GAAG,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAAE,CAAC;CAC3G;CACA,eAAe;EACb,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;CACA,kBAAkB;EAChB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;CACA,kBAAkB;EAChB,QAAQ;EACR,MAAM;EACN,aAAa;EACb,YAAY;EACZ,gBAAgB,EAAE,OAAO,EAAE,SAAS,aAAa,CAAC;CACpD;AACF"}

package/dist/routes/oauth.js

@@ -25,7 +25,7 @@ import { pollXAIDeviceLogin, startXAIDeviceLogin } from "@mastra/code-sdk/auth/p
 */
 /** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */
 const PASTE_CODE_TTL_MS = 600 * 1e3;
-/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_FLOW_KINDS}). */
+/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_PROVIDERS}). */
 const OAUTH_FLOWS = {
 	anthropic: {
 		kind: "paste-code",

package/dist/routes/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../src/routes/oauth.ts"],"sourcesContent":["/**\n * Web OAuth sign-in routes for model providers (Settings › Providers).\n *\n * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's\n * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in\n * HTTP routes. Flow state lives in login sessions — the `model-credentials`\n * domain's `oauth_login_sessions` table in tenant mode (any replica can\n * complete/poll), an in-memory store in local mode — so a flow can span\n * requests. Completed credentials are **user-scoped by default**; org admins\n * can start a flow with `{ scope: 'org' }` to share the credential with the\n * whole org. Local mode writes to the file-backed `AuthStorage`.\n *\n * Tokens never leave the server; responses only carry flow metadata (URLs,\n * user codes, poll delays).\n */\n\nimport { nextPollDelayMs } from '@mastra/code-sdk/auth/device-code';\nimport { completeAnthropicLogin, startAnthropicLogin } from '@mastra/code-sdk/auth/providers/anthropic';\nimport {\n  copilotNextPollDelayMs,\n  pollGitHubCopilotDeviceLogin,\n  startGitHubCopilotDeviceLogin,\n} from '@mastra/code-sdk/auth/providers/github-copilot';\nimport type { CopilotDeviceLoginPending } from '@mastra/code-sdk/auth/providers/github-copilot';\nimport { pollCodexDeviceLogin, startCodexDeviceLogin } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport type { CodexDeviceLoginPending } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport { pollXAIDeviceLogin, startXAIDeviceLogin } from '@mastra/code-sdk/auth/providers/xai';\nimport type { XAIDeviceLoginPending } from '@mastra/code-sdk/auth/providers/xai';\nimport type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { OAuthCredentials } from '@mastra/code-sdk/auth/types';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { LoginCredentialScope, LoginSessionKind, LoginSessionRow } from '../storage/domains/credentials/base.js';\nimport { getAuthProviderId, resolveCredentialContext } from './provider-credentials.js';\nimport type { CredentialContext } from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\n/** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */\nconst PASTE_CODE_TTL_MS = 10 * 60 * 1000;\n\ninterface OAuthFlowStart {\n  url: string;\n  userCode?: string;\n  instructions: string;\n  /** ms epoch after which the flow expires. */\n  expiresAt: number;\n  /** Delay before the first upstream poll (device-code flows only). */\n  nextPollMs?: number;\n  /** Serializable flow state persisted in the login session. */\n  pending: Record<string, unknown>;\n}\n\ntype OAuthFlowPoll =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending?: Record<string, unknown> }\n  | { status: 'failed'; error: string };\n\ninterface OAuthFlow {\n  kind: LoginSessionKind;\n  start(): Promise<OAuthFlowStart>;\n  /** Paste-code flows: exchange the pasted code for credentials. Throws on bad input. */\n  complete?(pending: Record<string, unknown>, code: string): Promise<OAuthCredentials>;\n  /** Device-code flows: perform exactly one upstream poll. */\n  poll?(pending: Record<string, unknown>): Promise<OAuthFlowPoll>;\n}\n\n/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_FLOW_KINDS}). */\nconst OAUTH_FLOWS: Record<string, OAuthFlow> = {\n  anthropic: {\n    kind: 'paste-code',\n    start: async () => {\n      const { url, verifier } = await startAnthropicLogin();\n      return {\n        url,\n        instructions: 'Open the link, authorize, then paste the code shown on the final page.',\n        expiresAt: Date.now() + PASTE_CODE_TTL_MS,\n        pending: { verifier },\n      };\n    },\n    complete: (pending, code) => completeAnthropicLogin(code, String(pending.verifier ?? '')),\n  },\n  openai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startCodexDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: p.intervalMs,\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollCodexDeviceLogin(pending as unknown as CodexDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  'github-copilot': {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startGitHubCopilotDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: copilotNextPollDelayMs(p),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const p = pending as unknown as CopilotDeviceLoginPending;\n      // Web flows are always started against github.com (no Enterprise input).\n      // Never let deserialized session state redirect server-side polling to\n      // an arbitrary hostname.\n      if (p.domain !== 'github.com' || p.enterpriseDomain !== undefined) {\n        return { status: 'failed', error: 'Unsupported GitHub host' };\n      }\n      const r = await pollGitHubCopilotDeviceLogin(p);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  xai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startXAIDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.state.deadlineAt,\n        nextPollMs: nextPollDelayMs(p.state),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollXAIDeviceLogin(pending as unknown as XAIDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n};\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Local-mode login sessions. Flows in local mode are single-process, so a\n * process-local libsql `:memory:` database (which already handles TTL\n * cleanup) is sufficient.\n */\nlet localSessionsPromise: Promise<ModelCredentialsStorage> | undefined;\nfunction localSessions(): Promise<ModelCredentialsStorage> {\n  localSessionsPromise ??= (async () => {\n    const { LibSQLFactoryStorage } = await import('@mastra/libsql');\n    const storage = new LibSQLFactoryStorage({ id: 'local-oauth-sessions', url: ':memory:' });\n    const store = storage.registerDomain(new ModelCredentialsStorage());\n    await storage.init();\n    return store;\n  })();\n  return localSessionsPromise;\n}\nconst LOCAL_TENANT = { orgId: 'local', userId: 'local' } as const;\n\nasync function sessionStore(ctx: CredentialContext): Promise<ModelCredentialsStorage> {\n  return ctx.mode === 'tenant' ? ctx.storage : localSessions();\n}\n\nfunction sessionTenant(ctx: CredentialContext): { orgId: string; userId: string } {\n  return ctx.mode === 'tenant' ? { orgId: ctx.orgId, userId: ctx.userId } : LOCAL_TENANT;\n}\n\n/** Load a session and verify it belongs to the caller + provider (else undefined). */\nasync function loadOwnedSession({\n  ctx,\n  provider,\n  sessionId,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  sessionId: string;\n}): Promise<LoginSessionRow | undefined> {\n  const session = await (await sessionStore(ctx)).getLoginSession(sessionId);\n  if (!session) return undefined;\n  const tenant = sessionTenant(ctx);\n  if (session.orgId !== tenant.orgId || session.userId !== tenant.userId) return undefined;\n  if (session.provider !== provider) return undefined;\n  return session;\n}\n\n/** Persist completed OAuth credentials — user-scoped unless the flow was started org-wide. */\nasync function persistOAuthCredential({\n  ctx,\n  provider,\n  scope,\n  credentials,\n  authStorage,\n  onCredentialsChanged,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  scope: LoginCredentialScope | undefined;\n  credentials: OAuthCredentials;\n  authStorage: AuthStorage | undefined;\n  onCredentialsChanged: (tenant: { orgId: string; userId?: string }) => void;\n}): Promise<void> {\n  const authProviderId = getAuthProviderId(provider);\n  if (ctx.mode === 'tenant') {\n    const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n    await ctx.storage.setCredential(tenant, authProviderId, {\n      type: 'oauth',\n      ...credentials,\n    });\n    onCredentialsChanged(tenant);\n    return;\n  }\n  if (!authStorage) throw new Error('Credential storage is not available');\n  await authStorage.addAccount(authProviderId, credentials);\n}\n\nasync function readJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = (await c.req.json()) as unknown;\n    return body && typeof body === 'object' ? (body as Record<string, unknown>) : {};\n  } catch {\n    return {};\n  }\n}\n\nexport interface OAuthRoutesDeps extends RouteDependencies {\n  /** File-backed credential store; used in local (no-auth) mode. */\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n}\n\n/**\n * Provider OAuth sign-in routes as Mastra `apiRoutes`:\n *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow\n *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange\n *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll\n *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow\n *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)\n */\nexport class OAuthRoutes extends Route<OAuthRoutesDeps> {\n  routes(): ApiRoute[] {\n    const { auth, authStorage, modelCredentials } = this.deps;\n    const onCredentialsChanged = this.deps.onCredentialsChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers/:provider/oauth/start', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow) {\n            return c.json({ error: 'oauth_not_supported', message: `Provider does not support web sign-in` }, 404);\n          }\n          // Body may carry `{ mode }` for future multi-mode providers; each web\n          // flow currently has exactly one mode, so an unknown mode is rejected.\n          const body = await readJsonBody(loose(c));\n          if (typeof body.mode === 'string' && body.mode !== flow.kind) {\n            return c.json({ error: 'invalid_mode', message: `Unsupported mode for ${provider}: ${body.mode}` }, 400);\n          }\n\n          // Optional `{ scope: 'org' }` shares the completed credential with\n          // the whole org (admin-only, tenant mode). Anything else is personal.\n          const scope: LoginCredentialScope = body.scope === 'org' ? 'org' : 'user';\n          if (scope === 'org' && ctx.mode === 'tenant' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          let started: OAuthFlowStart;\n          try {\n            started = await flow.start();\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 502);\n          }\n\n          const sessionId = globalThis.crypto.randomUUID();\n          const tenant = sessionTenant(ctx);\n          await (\n            await sessionStore(ctx)\n          ).createLoginSession({\n            sessionId,\n            orgId: tenant.orgId,\n            userId: tenant.userId,\n            provider,\n            kind: flow.kind,\n            ...(scope === 'org' && ctx.mode === 'tenant' ? { credentialScope: scope } : {}),\n            pending: started.pending,\n            expiresAt: new Date(started.expiresAt),\n            nextPollAt: started.nextPollMs != null ? new Date(Date.now() + started.nextPollMs) : null,\n          });\n\n          return c.json({\n            sessionId,\n            kind: flow.kind,\n            url: started.url,\n            ...(started.userCode ? { userCode: started.userCode } : {}),\n            instructions: started.instructions,\n            expiresAt: started.expiresAt,\n            ...(started.nextPollMs != null ? { nextPollMs: started.nextPollMs } : {}),\n          });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/complete', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.complete) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          const code = typeof body.code === 'string' ? body.code.trim() : '';\n          if (!sessionId || !code) return c.json({ error: 'Missing required fields: sessionId, code' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'paste-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access at completion time — the\n          // caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'paste-code',\n          });\n          if (!claimed) return c.json({ error: 'oauth_in_progress' }, 409);\n\n          let credentials: OAuthCredentials;\n          try {\n            credentials = await flow.complete(claimed.pending, code);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);\n          }\n\n          await persistOAuthCredential({\n            ctx,\n            provider,\n            scope: session.credentialScope,\n            credentials,\n            authStorage,\n            onCredentialsChanged,\n          });\n          await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ status: 'complete', ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/poll', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.poll) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          if (!sessionId) return c.json({ error: 'Missing required field: sessionId' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'device-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access before the credential write —\n          // the caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          // Server-side rate limit: at most one upstream poll per interval,\n          // regardless of how eagerly the client calls this route.\n          const now = Date.now();\n          const nextPollAt = session.nextPollAt?.getTime();\n          // claimLoginSession parks next_poll_at at expires_at while another\n          // request owns the flow. That is a lock, not a schedule, so fall\n          // through to the claim and take its short retry instead.\n          const parkedByClaim = nextPollAt != null && nextPollAt >= session.expiresAt.getTime();\n          if (nextPollAt != null && now < nextPollAt && !parkedByClaim) {\n            return c.json({ status: 'pending', nextPollMs: nextPollAt - now });\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'device-code',\n          });\n          if (!claimed) return c.json({ status: 'pending', nextPollMs: 250 });\n\n          let result: OAuthFlowPoll;\n          try {\n            result = await flow.poll(claimed.pending);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            throw error;\n          }\n\n          if (result.status === 'complete') {\n            await persistOAuthCredential({\n              ctx,\n              provider,\n              scope: session.credentialScope,\n              credentials: result.credentials,\n              authStorage,\n              onCredentialsChanged,\n            });\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'complete', ok: true });\n          }\n\n          if (result.status === 'failed') {\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'failed', error: result.error });\n          }\n\n          await (\n            await sessionStore(ctx)\n          ).touchLoginSession(sessionId, {\n            ...(result.pending ? { pending: result.pending } : {}),\n            nextPollAt: new Date(now + result.nextPollMs),\n          });\n          return c.json({ status: 'pending', nextPollMs: result.nextPollMs });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/session/:sessionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const sessionId = c.req.param('sessionId');\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (session) await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const authProviderId = getAuthProviderId(provider);\n          // `?scope=org` removes the shared org credential (admin-only);\n          // default removes the caller's personal credential only.\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'forbidden', message: 'Only org admins can remove an org-wide sign-in' }, 403);\n              }\n              const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n              await ctx.storage.removeCredential(tenant, authProviderId);\n              onCredentialsChanged(tenant);\n            } else {\n              if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n              authStorage.logout(authProviderId);\n            }\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAM,oBAAoB,MAAU;;AA6BpC,MAAM,cAAyC;CAC7C,WAAW;EACT,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;GACpD,OAAO;IACL;IACA,cAAc;IACd,WAAW,KAAK,IAAI,IAAI;IACxB,SAAS,EAAE,SAAS;GACtB;EACF;EACA,WAAW,SAAS,SAAS,uBAAuB,MAAM,OAAO,QAAQ,YAAY,EAAE,CAAC;CAC1F;CACA,QAAQ;EACN,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,sBAAsB;GACtC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,EAAE;IACd,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,qBAAqB,OAA6C;GAClF,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;GAAW;GACjF,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,kBAAkB;EAChB,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,8BAA8B;GAC9C,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,uBAAuB,CAAC;IACpC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI;GAIV,IAAI,EAAE,WAAW,gBAAgB,EAAE,qBAAqB,KAAA,GACtD,OAAO;IAAE,QAAQ;IAAU,OAAO;GAA0B;GAE9D,MAAM,IAAI,MAAM,6BAA6B,CAAC;GAC9C,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,KAAK;EACH,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,oBAAoB;GACpC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE,MAAM;IACnB,YAAY,gBAAgB,EAAE,KAAK;IACnC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,mBAAmB,OAA2C;GAC9E,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;AACF;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;AAOA,IAAI;AACJ,SAAS,gBAAkD;CACzD,0BAA0B,YAAY;EACpC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,UAAU,IAAI,qBAAqB;GAAE,IAAI;GAAwB,KAAK;EAAW,CAAC;EACxF,MAAM,QAAQ,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAClE,MAAM,QAAQ,KAAK;EACnB,OAAO;CACT,EAAA,CAAG;CACH,OAAO;AACT;AACA,MAAM,eAAe;CAAE,OAAO;CAAS,QAAQ;AAAQ;AAEvD,eAAe,aAAa,KAA0D;CACpF,OAAO,IAAI,SAAS,WAAW,IAAI,UAAU,cAAc;AAC7D;AAEA,SAAS,cAAc,KAA2D;CAChF,OAAO,IAAI,SAAS,WAAW;EAAE,OAAO,IAAI;EAAO,QAAQ,IAAI;CAAO,IAAI;AAC5E;;AAGA,eAAe,iBAAiB,EAC9B,KACA,UACA,aAKuC;CACvC,MAAM,UAAU,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,gBAAgB,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,SAAS,cAAc,GAAG;CAChC,IAAI,QAAQ,UAAU,OAAO,SAAS,QAAQ,WAAW,OAAO,QAAQ,OAAO,KAAA;CAC/E,IAAI,QAAQ,aAAa,UAAU,OAAO,KAAA;CAC1C,OAAO;AACT;;AAGA,eAAe,uBAAuB,EACpC,KACA,UACA,OACA,aACA,aACA,wBAQgB;CAChB,MAAM,iBAAiB,kBAAkB,QAAQ;CACjD,IAAI,IAAI,SAAS,UAAU;EACzB,MAAM,SAAS;GAAE,OAAO,IAAI;GAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;EAAG;EACtF,MAAM,IAAI,QAAQ,cAAc,QAAQ,gBAAgB;GACtD,MAAM;GACN,GAAG;EACL,CAAC;EACD,qBAAqB,MAAM;EAC3B;CACF;CACA,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qCAAqC;CACvE,MAAM,YAAY,WAAW,gBAAgB,WAAW;AAC1D;AAEA,eAAe,aAAa,GAA8C;CACxE,IAAI;EACF,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK;EAC/B,OAAO,QAAQ,OAAO,SAAS,WAAY,OAAmC,CAAC;CACjF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;;;AAmBA,IAAa,cAAb,cAAiC,MAAuB;CACtD,SAAqB;EACnB,MAAM,EAAE,MAAM,aAAa,qBAAqB,KAAK;EACrD,MAAM,uBAAuB,KAAK,KAAK,+BAA+B,CAAC;EAEvE,OAAO;GACL,iBAAiB,+CAA+C;IAC9D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;MAAE,OAAO;MAAuB,SAAS;KAAwC,GAAG,GAAG;KAIvG,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,IAAI,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,KAAK,MACtD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAgB,SAAS,wBAAwB,SAAS,IAAI,KAAK;KAAO,GAAG,GAAG;KAKzG,MAAM,QAA8B,KAAK,UAAU,QAAQ,QAAQ;KACnE,IAAI,UAAU,SAAS,IAAI,SAAS,YAAY,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAClG,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,IAAI;KACJ,IAAI;MACF,UAAU,MAAM,KAAK,MAAM;KAC7B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,YAAY,WAAW,OAAO,WAAW;KAC/C,MAAM,SAAS,cAAc,GAAG;KAChC,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,mBAAmB;MACnB;MACA,OAAO,OAAO;MACd,QAAQ,OAAO;MACf;MACA,MAAM,KAAK;MACX,GAAI,UAAU,SAAS,IAAI,SAAS,WAAW,EAAE,iBAAiB,MAAM,IAAI,CAAC;MAC7E,SAAS,QAAQ;MACjB,WAAW,IAAI,KAAK,QAAQ,SAAS;MACrC,YAAY,QAAQ,cAAc,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,UAAU,IAAI;KACvF,CAAC;KAED,OAAO,EAAE,KAAK;MACZ;MACA,MAAM,KAAK;MACX,KAAK,QAAQ;MACb,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;MACzD,cAAc,QAAQ;MACtB,WAAW,QAAQ;MACnB,GAAI,QAAQ,cAAc,OAAO,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;KACzE,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,kDAAkD;IACjE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAExE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;KAChE,IAAI,CAAC,aAAa,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;KAEjG,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGrF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAE/D,IAAI;KACJ,IAAI;MACF,cAAc,MAAM,KAAK,SAAS,QAAQ,SAAS,IAAI;KACzD,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,uBAAuB;MAC3B;MACA;MACA,OAAO,QAAQ;MACf;MACA;MACA;KACF,CAAC;KACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KAC5D,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAY,IAAI;KAAK,CAAC;IAChD;GACF,CAAC;GAED,iBAAiB,8CAA8C;IAC7D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAEpE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,IAAI,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KAEjF,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGtF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAKrG,MAAM,MAAM,KAAK,IAAI;KACrB,MAAM,aAAa,QAAQ,YAAY,QAAQ;KAI/C,MAAM,gBAAgB,cAAc,QAAQ,cAAc,QAAQ,UAAU,QAAQ;KACpF,IAAI,cAAc,QAAQ,MAAM,cAAc,CAAC,eAC7C,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,aAAa;KAAI,CAAC;KAGnE,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY;KAAI,CAAC;KAElE,IAAI;KACJ,IAAI;MACF,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO;KAC1C,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,MAAM;KACR;KAEA,IAAI,OAAO,WAAW,YAAY;MAChC,MAAM,uBAAuB;OAC3B;OACA;OACA,OAAO,QAAQ;OACf,aAAa,OAAO;OACpB;OACA;MACF,CAAC;MACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAY,IAAI;MAAK,CAAC;KAChD;KAEA,IAAI,OAAO,WAAW,UAAU;MAC9B,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAU,OAAO,OAAO;MAAM,CAAC;KACzD;KAEA,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;MACpD,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU;KAC9C,CAAC;KACD,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,OAAO;KAAW,CAAC;IACpE;GACF,CAAC;GAED,iBAAiB,4DAA4D;IAC3E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;KAEzC,IAAI,MADkB,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC,GACtD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KACzE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;GAED,iBAAiB,yCAAyC;IACxD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAGlC,MAAM,iBAAiB,kBADN,EAAE,IAAI,MAAM,UACmB,CAAC;KAGjD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;KACvD,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK;QAAE,OAAO;QAAa,SAAS;OAAiD,GAAG,GAAG;OAEtG,MAAM,SAAS;QAAE,OAAO,IAAI;QAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;OAAG;OACtF,MAAM,IAAI,QAAQ,iBAAiB,QAAQ,cAAc;OACzD,qBAAqB,MAAM;MAC7B,OAAO;OACL,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;OACrF,YAAY,OAAO,cAAc;MACnC;MACA,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;KAC5B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../src/routes/oauth.ts"],"sourcesContent":["/**\n * Web OAuth sign-in routes for model providers (Settings › Providers).\n *\n * Wraps the SDK's step-based OAuth primitives (start/complete for Anthropic's\n * paste-code PKCE flow, start/poll for the Codex/Copilot/xAI device flows) in\n * HTTP routes. Flow state lives in login sessions — the `model-credentials`\n * domain's `oauth_login_sessions` table in tenant mode (any replica can\n * complete/poll), an in-memory store in local mode — so a flow can span\n * requests. Completed credentials are **user-scoped by default**; org admins\n * can start a flow with `{ scope: 'org' }` to share the credential with the\n * whole org. Local mode writes to the file-backed `AuthStorage`.\n *\n * Tokens never leave the server; responses only carry flow metadata (URLs,\n * user codes, poll delays).\n */\n\nimport { nextPollDelayMs } from '@mastra/code-sdk/auth/device-code';\nimport { completeAnthropicLogin, startAnthropicLogin } from '@mastra/code-sdk/auth/providers/anthropic';\nimport {\n  copilotNextPollDelayMs,\n  pollGitHubCopilotDeviceLogin,\n  startGitHubCopilotDeviceLogin,\n} from '@mastra/code-sdk/auth/providers/github-copilot';\nimport type { CopilotDeviceLoginPending } from '@mastra/code-sdk/auth/providers/github-copilot';\nimport { pollCodexDeviceLogin, startCodexDeviceLogin } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport type { CodexDeviceLoginPending } from '@mastra/code-sdk/auth/providers/openai-codex';\nimport { pollXAIDeviceLogin, startXAIDeviceLogin } from '@mastra/code-sdk/auth/providers/xai';\nimport type { XAIDeviceLoginPending } from '@mastra/code-sdk/auth/providers/xai';\nimport type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { OAuthCredentials } from '@mastra/code-sdk/auth/types';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { LoginCredentialScope, LoginSessionKind, LoginSessionRow } from '../storage/domains/credentials/base.js';\nimport { getAuthProviderId, resolveCredentialContext } from './provider-credentials.js';\nimport type { CredentialContext } from './provider-credentials.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\n/** Lifetime of a paste-code session (Anthropic gives no explicit expiry). */\nconst PASTE_CODE_TTL_MS = 10 * 60 * 1000;\n\ninterface OAuthFlowStart {\n  url: string;\n  userCode?: string;\n  instructions: string;\n  /** ms epoch after which the flow expires. */\n  expiresAt: number;\n  /** Delay before the first upstream poll (device-code flows only). */\n  nextPollMs?: number;\n  /** Serializable flow state persisted in the login session. */\n  pending: Record<string, unknown>;\n}\n\ntype OAuthFlowPoll =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending?: Record<string, unknown> }\n  | { status: 'failed'; error: string };\n\ninterface OAuthFlow {\n  kind: LoginSessionKind;\n  start(): Promise<OAuthFlowStart>;\n  /** Paste-code flows: exchange the pasted code for credentials. Throws on bad input. */\n  complete?(pending: Record<string, unknown>, code: string): Promise<OAuthCredentials>;\n  /** Device-code flows: perform exactly one upstream poll. */\n  poll?(pending: Record<string, unknown>): Promise<OAuthFlowPoll>;\n}\n\n/** Web OAuth flows keyed by *catalog* provider id (mirrors {@link WEB_OAUTH_PROVIDERS}). */\nconst OAUTH_FLOWS: Record<string, OAuthFlow> = {\n  anthropic: {\n    kind: 'paste-code',\n    start: async () => {\n      const { url, verifier } = await startAnthropicLogin();\n      return {\n        url,\n        instructions: 'Open the link, authorize, then paste the code shown on the final page.',\n        expiresAt: Date.now() + PASTE_CODE_TTL_MS,\n        pending: { verifier },\n      };\n    },\n    complete: (pending, code) => completeAnthropicLogin(code, String(pending.verifier ?? '')),\n  },\n  openai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startCodexDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: p.intervalMs,\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollCodexDeviceLogin(pending as unknown as CodexDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  'github-copilot': {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startGitHubCopilotDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.deadlineAt,\n        nextPollMs: copilotNextPollDelayMs(p),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const p = pending as unknown as CopilotDeviceLoginPending;\n      // Web flows are always started against github.com (no Enterprise input).\n      // Never let deserialized session state redirect server-side polling to\n      // an arbitrary hostname.\n      if (p.domain !== 'github.com' || p.enterpriseDomain !== undefined) {\n        return { status: 'failed', error: 'Unsupported GitHub host' };\n      }\n      const r = await pollGitHubCopilotDeviceLogin(p);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n  xai: {\n    kind: 'device-code',\n    start: async () => {\n      const p = await startXAIDeviceLogin();\n      return {\n        url: p.url,\n        userCode: p.userCode,\n        instructions: p.instructions,\n        expiresAt: p.state.deadlineAt,\n        nextPollMs: nextPollDelayMs(p.state),\n        pending: { ...p },\n      };\n    },\n    poll: async pending => {\n      const r = await pollXAIDeviceLogin(pending as unknown as XAIDeviceLoginPending);\n      if (r.status === 'complete') return { status: 'complete', credentials: r.credentials };\n      if (r.status === 'pending') return { status: 'pending', nextPollMs: r.nextPollMs, pending: { ...r.pending } };\n      return { status: 'failed', error: r.error };\n    },\n  },\n};\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/**\n * Local-mode login sessions. Flows in local mode are single-process, so a\n * process-local libsql `:memory:` database (which already handles TTL\n * cleanup) is sufficient.\n */\nlet localSessionsPromise: Promise<ModelCredentialsStorage> | undefined;\nfunction localSessions(): Promise<ModelCredentialsStorage> {\n  localSessionsPromise ??= (async () => {\n    const { LibSQLFactoryStorage } = await import('@mastra/libsql');\n    const storage = new LibSQLFactoryStorage({ id: 'local-oauth-sessions', url: ':memory:' });\n    const store = storage.registerDomain(new ModelCredentialsStorage());\n    await storage.init();\n    return store;\n  })();\n  return localSessionsPromise;\n}\nconst LOCAL_TENANT = { orgId: 'local', userId: 'local' } as const;\n\nasync function sessionStore(ctx: CredentialContext): Promise<ModelCredentialsStorage> {\n  return ctx.mode === 'tenant' ? ctx.storage : localSessions();\n}\n\nfunction sessionTenant(ctx: CredentialContext): { orgId: string; userId: string } {\n  return ctx.mode === 'tenant' ? { orgId: ctx.orgId, userId: ctx.userId } : LOCAL_TENANT;\n}\n\n/** Load a session and verify it belongs to the caller + provider (else undefined). */\nasync function loadOwnedSession({\n  ctx,\n  provider,\n  sessionId,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  sessionId: string;\n}): Promise<LoginSessionRow | undefined> {\n  const session = await (await sessionStore(ctx)).getLoginSession(sessionId);\n  if (!session) return undefined;\n  const tenant = sessionTenant(ctx);\n  if (session.orgId !== tenant.orgId || session.userId !== tenant.userId) return undefined;\n  if (session.provider !== provider) return undefined;\n  return session;\n}\n\n/** Persist completed OAuth credentials — user-scoped unless the flow was started org-wide. */\nasync function persistOAuthCredential({\n  ctx,\n  provider,\n  scope,\n  credentials,\n  authStorage,\n  onCredentialsChanged,\n}: {\n  ctx: CredentialContext;\n  provider: string;\n  scope: LoginCredentialScope | undefined;\n  credentials: OAuthCredentials;\n  authStorage: AuthStorage | undefined;\n  onCredentialsChanged: (tenant: { orgId: string; userId?: string }) => void;\n}): Promise<void> {\n  const authProviderId = getAuthProviderId(provider);\n  if (ctx.mode === 'tenant') {\n    const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n    await ctx.storage.setCredential(tenant, authProviderId, {\n      type: 'oauth',\n      ...credentials,\n    });\n    onCredentialsChanged(tenant);\n    return;\n  }\n  if (!authStorage) throw new Error('Credential storage is not available');\n  await authStorage.addAccount(authProviderId, credentials);\n}\n\nasync function readJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = (await c.req.json()) as unknown;\n    return body && typeof body === 'object' ? (body as Record<string, unknown>) : {};\n  } catch {\n    return {};\n  }\n}\n\nexport interface OAuthRoutesDeps extends RouteDependencies {\n  /** File-backed credential store; used in local (no-auth) mode. */\n  authStorage?: AuthStorage;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  modelCredentials?: ModelCredentialsStorage;\n  /** Notifies the host after tenant credentials change so caches can be dropped. */\n  onCredentialsChanged?: (tenant: { orgId: string; userId?: string }) => void;\n}\n\n/**\n * Provider OAuth sign-in routes as Mastra `apiRoutes`:\n *   - `POST   /web/config/providers/:provider/oauth/start`              — begin a sign-in flow\n *   - `POST   /web/config/providers/:provider/oauth/complete`           — paste-code exchange\n *   - `POST   /web/config/providers/:provider/oauth/poll`               — one device-code poll\n *   - `DELETE /web/config/providers/:provider/oauth/session/:sessionId` — cancel a flow\n *   - `DELETE /web/config/providers/:provider/oauth`                    — sign out (caller only)\n */\nexport class OAuthRoutes extends Route<OAuthRoutesDeps> {\n  routes(): ApiRoute[] {\n    const { auth, authStorage, modelCredentials } = this.deps;\n    const onCredentialsChanged = this.deps.onCredentialsChanged ?? (() => {});\n\n    return [\n      registerApiRoute('/web/config/providers/:provider/oauth/start', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow) {\n            return c.json({ error: 'oauth_not_supported', message: `Provider does not support web sign-in` }, 404);\n          }\n          // Body may carry `{ mode }` for future multi-mode providers; each web\n          // flow currently has exactly one mode, so an unknown mode is rejected.\n          const body = await readJsonBody(loose(c));\n          if (typeof body.mode === 'string' && body.mode !== flow.kind) {\n            return c.json({ error: 'invalid_mode', message: `Unsupported mode for ${provider}: ${body.mode}` }, 400);\n          }\n\n          // Optional `{ scope: 'org' }` shares the completed credential with\n          // the whole org (admin-only, tenant mode). Anything else is personal.\n          const scope: LoginCredentialScope = body.scope === 'org' ? 'org' : 'user';\n          if (scope === 'org' && ctx.mode === 'tenant' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          let started: OAuthFlowStart;\n          try {\n            started = await flow.start();\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 502);\n          }\n\n          const sessionId = globalThis.crypto.randomUUID();\n          const tenant = sessionTenant(ctx);\n          await (\n            await sessionStore(ctx)\n          ).createLoginSession({\n            sessionId,\n            orgId: tenant.orgId,\n            userId: tenant.userId,\n            provider,\n            kind: flow.kind,\n            ...(scope === 'org' && ctx.mode === 'tenant' ? { credentialScope: scope } : {}),\n            pending: started.pending,\n            expiresAt: new Date(started.expiresAt),\n            nextPollAt: started.nextPollMs != null ? new Date(Date.now() + started.nextPollMs) : null,\n          });\n\n          return c.json({\n            sessionId,\n            kind: flow.kind,\n            url: started.url,\n            ...(started.userCode ? { userCode: started.userCode } : {}),\n            instructions: started.instructions,\n            expiresAt: started.expiresAt,\n            ...(started.nextPollMs != null ? { nextPollMs: started.nextPollMs } : {}),\n          });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/complete', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.complete) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          const code = typeof body.code === 'string' ? body.code.trim() : '';\n          if (!sessionId || !code) return c.json({ error: 'Missing required fields: sessionId, code' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'paste-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access at completion time — the\n          // caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'paste-code',\n          });\n          if (!claimed) return c.json({ error: 'oauth_in_progress' }, 409);\n\n          let credentials: OAuthCredentials;\n          try {\n            credentials = await flow.complete(claimed.pending, code);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);\n          }\n\n          await persistOAuthCredential({\n            ctx,\n            provider,\n            scope: session.credentialScope,\n            credentials,\n            authStorage,\n            onCredentialsChanged,\n          });\n          await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ status: 'complete', ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/poll', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const flow = OAUTH_FLOWS[provider];\n          if (!flow?.poll) return c.json({ error: 'oauth_not_supported' }, 404);\n\n          const body = await readJsonBody(loose(c));\n          const sessionId = typeof body.sessionId === 'string' ? body.sessionId : '';\n          if (!sessionId) return c.json({ error: 'Missing required field: sessionId' }, 400);\n\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (!session) return c.json({ error: 'session_not_found' }, 404);\n          if (session.kind !== 'device-code') return c.json({ error: 'wrong_session_kind' }, 400);\n          // Org-scoped flows recheck admin access before the credential write —\n          // the caller may have lost admin since the flow was started.\n          if (\n            session.credentialScope === 'org' &&\n            ctx.mode === 'tenant' &&\n            !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))\n          ) {\n            return c.json({ error: 'forbidden', message: 'Only org admins can sign in for the whole org' }, 403);\n          }\n\n          // Server-side rate limit: at most one upstream poll per interval,\n          // regardless of how eagerly the client calls this route.\n          const now = Date.now();\n          const nextPollAt = session.nextPollAt?.getTime();\n          // claimLoginSession parks next_poll_at at expires_at while another\n          // request owns the flow. That is a lock, not a schedule, so fall\n          // through to the claim and take its short retry instead.\n          const parkedByClaim = nextPollAt != null && nextPollAt >= session.expiresAt.getTime();\n          if (nextPollAt != null && now < nextPollAt && !parkedByClaim) {\n            return c.json({ status: 'pending', nextPollMs: nextPollAt - now });\n          }\n\n          const claimed = await (\n            await sessionStore(ctx)\n          ).claimLoginSession(sessionId, {\n            orgId: session.orgId,\n            userId: session.userId,\n            provider,\n            kind: 'device-code',\n          });\n          if (!claimed) return c.json({ status: 'pending', nextPollMs: 250 });\n\n          let result: OAuthFlowPoll;\n          try {\n            result = await flow.poll(claimed.pending);\n          } catch (error) {\n            await (await sessionStore(ctx)).touchLoginSession(sessionId, { nextPollAt: null });\n            throw error;\n          }\n\n          if (result.status === 'complete') {\n            await persistOAuthCredential({\n              ctx,\n              provider,\n              scope: session.credentialScope,\n              credentials: result.credentials,\n              authStorage,\n              onCredentialsChanged,\n            });\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'complete', ok: true });\n          }\n\n          if (result.status === 'failed') {\n            await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n            return c.json({ status: 'failed', error: result.error });\n          }\n\n          await (\n            await sessionStore(ctx)\n          ).touchLoginSession(sessionId, {\n            ...(result.pending ? { pending: result.pending } : {}),\n            nextPollAt: new Date(now + result.nextPollMs),\n          });\n          return c.json({ status: 'pending', nextPollMs: result.nextPollMs });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth/session/:sessionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const sessionId = c.req.param('sessionId');\n          const session = await loadOwnedSession({ ctx, provider, sessionId });\n          if (session) await (await sessionStore(ctx)).deleteLoginSession(sessionId);\n          return c.json({ ok: true });\n        },\n      }),\n\n      registerApiRoute('/web/config/providers/:provider/oauth', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async c => {\n          const ctx = await resolveCredentialContext({ c: loose(c), auth, credentials: modelCredentials });\n          if ('response' in ctx) return ctx.response;\n\n          const provider = c.req.param('provider');\n          const authProviderId = getAuthProviderId(provider);\n          // `?scope=org` removes the shared org credential (admin-only);\n          // default removes the caller's personal credential only.\n          const scope = c.req.query('scope') === 'org' ? 'org' : 'user';\n          try {\n            if (ctx.mode === 'tenant') {\n              if (scope === 'org' && !(await auth.isOrganizationAdmin(loose(c), ctx.orgId))) {\n                return c.json({ error: 'forbidden', message: 'Only org admins can remove an org-wide sign-in' }, 403);\n              }\n              const tenant = { orgId: ctx.orgId, ...(scope === 'org' ? {} : { userId: ctx.userId }) };\n              await ctx.storage.removeCredential(tenant, authProviderId);\n              onCredentialsChanged(tenant);\n            } else {\n              if (!authStorage) return c.json({ error: 'Credential storage is not available' }, 503);\n              authStorage.logout(authProviderId);\n            }\n            return c.json({ ok: true });\n          } catch (error) {\n            return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n          }\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAM,oBAAoB,MAAU;;AA6BpC,MAAM,cAAyC;CAC7C,WAAW;EACT,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,EAAE,KAAK,aAAa,MAAM,oBAAoB;GACpD,OAAO;IACL;IACA,cAAc;IACd,WAAW,KAAK,IAAI,IAAI;IACxB,SAAS,EAAE,SAAS;GACtB;EACF;EACA,WAAW,SAAS,SAAS,uBAAuB,MAAM,OAAO,QAAQ,YAAY,EAAE,CAAC;CAC1F;CACA,QAAQ;EACN,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,sBAAsB;GACtC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,EAAE;IACd,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,qBAAqB,OAA6C;GAClF,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;GAAW;GACjF,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,kBAAkB;EAChB,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,8BAA8B;GAC9C,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE;IACb,YAAY,uBAAuB,CAAC;IACpC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI;GAIV,IAAI,EAAE,WAAW,gBAAgB,EAAE,qBAAqB,KAAA,GACtD,OAAO;IAAE,QAAQ;IAAU,OAAO;GAA0B;GAE9D,MAAM,IAAI,MAAM,6BAA6B,CAAC;GAC9C,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;CACA,KAAK;EACH,MAAM;EACN,OAAO,YAAY;GACjB,MAAM,IAAI,MAAM,oBAAoB;GACpC,OAAO;IACL,KAAK,EAAE;IACP,UAAU,EAAE;IACZ,cAAc,EAAE;IAChB,WAAW,EAAE,MAAM;IACnB,YAAY,gBAAgB,EAAE,KAAK;IACnC,SAAS,EAAE,GAAG,EAAE;GAClB;EACF;EACA,MAAM,OAAM,YAAW;GACrB,MAAM,IAAI,MAAM,mBAAmB,OAA2C;GAC9E,IAAI,EAAE,WAAW,YAAY,OAAO;IAAE,QAAQ;IAAY,aAAa,EAAE;GAAY;GACrF,IAAI,EAAE,WAAW,WAAW,OAAO;IAAE,QAAQ;IAAW,YAAY,EAAE;IAAY,SAAS,EAAE,GAAG,EAAE,QAAQ;GAAE;GAC5G,OAAO;IAAE,QAAQ;IAAU,OAAO,EAAE;GAAM;EAC5C;CACF;AACF;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;AAOA,IAAI;AACJ,SAAS,gBAAkD;CACzD,0BAA0B,YAAY;EACpC,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,UAAU,IAAI,qBAAqB;GAAE,IAAI;GAAwB,KAAK;EAAW,CAAC;EACxF,MAAM,QAAQ,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAClE,MAAM,QAAQ,KAAK;EACnB,OAAO;CACT,EAAA,CAAG;CACH,OAAO;AACT;AACA,MAAM,eAAe;CAAE,OAAO;CAAS,QAAQ;AAAQ;AAEvD,eAAe,aAAa,KAA0D;CACpF,OAAO,IAAI,SAAS,WAAW,IAAI,UAAU,cAAc;AAC7D;AAEA,SAAS,cAAc,KAA2D;CAChF,OAAO,IAAI,SAAS,WAAW;EAAE,OAAO,IAAI;EAAO,QAAQ,IAAI;CAAO,IAAI;AAC5E;;AAGA,eAAe,iBAAiB,EAC9B,KACA,UACA,aAKuC;CACvC,MAAM,UAAU,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,gBAAgB,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,SAAS,cAAc,GAAG;CAChC,IAAI,QAAQ,UAAU,OAAO,SAAS,QAAQ,WAAW,OAAO,QAAQ,OAAO,KAAA;CAC/E,IAAI,QAAQ,aAAa,UAAU,OAAO,KAAA;CAC1C,OAAO;AACT;;AAGA,eAAe,uBAAuB,EACpC,KACA,UACA,OACA,aACA,aACA,wBAQgB;CAChB,MAAM,iBAAiB,kBAAkB,QAAQ;CACjD,IAAI,IAAI,SAAS,UAAU;EACzB,MAAM,SAAS;GAAE,OAAO,IAAI;GAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;EAAG;EACtF,MAAM,IAAI,QAAQ,cAAc,QAAQ,gBAAgB;GACtD,MAAM;GACN,GAAG;EACL,CAAC;EACD,qBAAqB,MAAM;EAC3B;CACF;CACA,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,qCAAqC;CACvE,MAAM,YAAY,WAAW,gBAAgB,WAAW;AAC1D;AAEA,eAAe,aAAa,GAA8C;CACxE,IAAI;EACF,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK;EAC/B,OAAO,QAAQ,OAAO,SAAS,WAAY,OAAmC,CAAC;CACjF,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;;;;;;;AAmBA,IAAa,cAAb,cAAiC,MAAuB;CACtD,SAAqB;EACnB,MAAM,EAAE,MAAM,aAAa,qBAAqB,KAAK;EACrD,MAAM,uBAAuB,KAAK,KAAK,+BAA+B,CAAC;EAEvE,OAAO;GACL,iBAAiB,+CAA+C;IAC9D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;MAAE,OAAO;MAAuB,SAAS;KAAwC,GAAG,GAAG;KAIvG,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,IAAI,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,KAAK,MACtD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAgB,SAAS,wBAAwB,SAAS,IAAI,KAAK;KAAO,GAAG,GAAG;KAKzG,MAAM,QAA8B,KAAK,UAAU,QAAQ,QAAQ;KACnE,IAAI,UAAU,SAAS,IAAI,SAAS,YAAY,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAClG,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,IAAI;KACJ,IAAI;MACF,UAAU,MAAM,KAAK,MAAM;KAC7B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,YAAY,WAAW,OAAO,WAAW;KAC/C,MAAM,SAAS,cAAc,GAAG;KAChC,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,mBAAmB;MACnB;MACA,OAAO,OAAO;MACd,QAAQ,OAAO;MACf;MACA,MAAM,KAAK;MACX,GAAI,UAAU,SAAS,IAAI,SAAS,WAAW,EAAE,iBAAiB,MAAM,IAAI,CAAC;MAC7E,SAAS,QAAQ;MACjB,WAAW,IAAI,KAAK,QAAQ,SAAS;MACrC,YAAY,QAAQ,cAAc,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,UAAU,IAAI;KACvF,CAAC;KAED,OAAO,EAAE,KAAK;MACZ;MACA,MAAM,KAAK;MACX,KAAK,QAAQ;MACb,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;MACzD,cAAc,QAAQ;MACtB,WAAW,QAAQ;MACnB,GAAI,QAAQ,cAAc,OAAO,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;KACzE,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,kDAAkD;IACjE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAExE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;KAChE,IAAI,CAAC,aAAa,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,2CAA2C,GAAG,GAAG;KAEjG,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGrF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAGrG,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAE/D,IAAI;KACJ,IAAI;MACF,cAAc,MAAM,KAAK,SAAS,QAAQ,SAAS,IAAI;KACzD,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;KAEA,MAAM,uBAAuB;MAC3B;MACA;MACA,OAAO,QAAQ;MACf;MACA;MACA;KACF,CAAC;KACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KAC5D,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAY,IAAI;KAAK,CAAC;IAChD;GACF,CAAC;GAED,iBAAiB,8CAA8C;IAC7D,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,OAAO,YAAY;KACzB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAEpE,MAAM,OAAO,MAAM,aAAa,MAAM,CAAC,CAAC;KACxC,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;KACxE,IAAI,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KAEjF,MAAM,UAAU,MAAM,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC;KACnE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC/D,IAAI,QAAQ,SAAS,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;KAGtF,IACE,QAAQ,oBAAoB,SAC5B,IAAI,SAAS,YACb,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GAEpD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAa,SAAS;KAAgD,GAAG,GAAG;KAKrG,MAAM,MAAM,KAAK,IAAI;KACrB,MAAM,aAAa,QAAQ,YAAY,QAAQ;KAI/C,MAAM,gBAAgB,cAAc,QAAQ,cAAc,QAAQ,UAAU,QAAQ;KACpF,IAAI,cAAc,QAAQ,MAAM,cAAc,CAAC,eAC7C,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,aAAa;KAAI,CAAC;KAGnE,MAAM,UAAU,OACd,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,OAAO,QAAQ;MACf,QAAQ,QAAQ;MAChB;MACA,MAAM;KACR,CAAC;KACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY;KAAI,CAAC;KAElE,IAAI;KACJ,IAAI;MACF,SAAS,MAAM,KAAK,KAAK,QAAQ,OAAO;KAC1C,SAAS,OAAO;MACd,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,kBAAkB,WAAW,EAAE,YAAY,KAAK,CAAC;MACjF,MAAM;KACR;KAEA,IAAI,OAAO,WAAW,YAAY;MAChC,MAAM,uBAAuB;OAC3B;OACA;OACA,OAAO,QAAQ;OACf,aAAa,OAAO;OACpB;OACA;MACF,CAAC;MACD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAY,IAAI;MAAK,CAAC;KAChD;KAEA,IAAI,OAAO,WAAW,UAAU;MAC9B,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;MAC5D,OAAO,EAAE,KAAK;OAAE,QAAQ;OAAU,OAAO,OAAO;MAAM,CAAC;KACzD;KAEA,OACE,MAAM,aAAa,GAAG,EAAA,CACtB,kBAAkB,WAAW;MAC7B,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;MACpD,YAAY,IAAI,KAAK,MAAM,OAAO,UAAU;KAC9C,CAAC;KACD,OAAO,EAAE,KAAK;MAAE,QAAQ;MAAW,YAAY,OAAO;KAAW,CAAC;IACpE;GACF,CAAC;GAED,iBAAiB,4DAA4D;IAC3E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAElC,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU;KACvC,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;KAEzC,IAAI,MADkB,iBAAiB;MAAE;MAAK;MAAU;KAAU,CAAC,GACtD,OAAO,MAAM,aAAa,GAAG,EAAA,CAAG,mBAAmB,SAAS;KACzE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;GAED,iBAAiB,yCAAyC;IACxD,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,MAAM,MAAM,yBAAyB;MAAE,GAAG,MAAM,CAAC;MAAG;MAAM,aAAa;KAAiB,CAAC;KAC/F,IAAI,cAAc,KAAK,OAAO,IAAI;KAGlC,MAAM,iBAAiB,kBADN,EAAE,IAAI,MAAM,UACmB,CAAC;KAGjD,MAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,MAAM,QAAQ,QAAQ;KACvD,IAAI;MACF,IAAI,IAAI,SAAS,UAAU;OACzB,IAAI,UAAU,SAAS,CAAE,MAAM,KAAK,oBAAoB,MAAM,CAAC,GAAG,IAAI,KAAK,GACzE,OAAO,EAAE,KAAK;QAAE,OAAO;QAAa,SAAS;OAAiD,GAAG,GAAG;OAEtG,MAAM,SAAS;QAAE,OAAO,IAAI;QAAO,GAAI,UAAU,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO;OAAG;OACtF,MAAM,IAAI,QAAQ,iBAAiB,QAAQ,cAAc;OACzD,qBAAqB,MAAM;MAC7B,OAAO;OACL,IAAI,CAAC,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;OACrF,YAAY,OAAO,cAAc;MACnC;MACA,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;KAC5B,SAAS,OAAO;MACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;KACtF;IACF;GACF,CAAC;EACH;CACF;AACF"}

package/dist/routes/provider-credentials.d.ts

@@ -27,9 +27,13 @@ export { getCredentialProviderId as getAuthProviderId } from '@mastra/code-sdk/p
  * Providers that support a browser-driven OAuth sign-in flow, keyed by
  * *catalog* provider id (what the routes and settings UI use). All flows need
  * no inbound connection to the server: Anthropic uses paste-code PKCE, the
- * rest use RFC 8628-style device codes.
+ * rest use RFC 8628-style device codes. `subscription` names the plan the
+ * sign-in bills, as shown under a reply.
  */
-export declare const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>>;
+export declare const WEB_OAUTH_PROVIDERS: Readonly<Record<string, {
+    flow: LoginSessionKind;
+    subscription: string;
+}>>;
 export type CredentialContext = {
     mode: 'local';
 } | {

package/dist/routes/provider-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/provider-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,OAAO,EAAE,uBAAuB,IAAI,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEpG;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAK3E,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,uBAAuB,GAAG,SAAS,GAC/C,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAQ9C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,CAAC,EACD,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,CAAC,EAAE,OAAO,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GAAG,OAAO,CAAC,iBAAiB,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAuBtD;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,CAAC,EACD,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,CAAC,EAAE,OAAO,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAO1C"}
+{"version":3,"file":"provider-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/provider-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,OAAO,EAAE,uBAAuB,IAAI,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEpG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAK1G,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,uBAAuB,GAAG,SAAS,GAC/C,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAQ9C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,CAAC,EACD,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,CAAC,EAAE,OAAO,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GAAG,OAAO,CAAC,iBAAiB,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAuBtD;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,CAAC,EACD,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,CAAC,EAAE,OAAO,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAO1C"}

package/dist/routes/provider-credentials.js

@@ -5,13 +5,26 @@ import { getCredentialProviderId as getAuthProviderId } from "@mastra/code-sdk/p
 * Providers that support a browser-driven OAuth sign-in flow, keyed by
 * *catalog* provider id (what the routes and settings UI use). All flows need
 * no inbound connection to the server: Anthropic uses paste-code PKCE, the
-* rest use RFC 8628-style device codes.
+* rest use RFC 8628-style device codes. `subscription` names the plan the
+* sign-in bills, as shown under a reply.
 */
-const WEB_OAUTH_FLOW_KINDS = {
-	anthropic: "paste-code",
-	openai: "device-code",
-	"github-copilot": "device-code",
-	xai: "device-code"
+const WEB_OAUTH_PROVIDERS = {
+	anthropic: {
+		flow: "paste-code",
+		subscription: "Claude Pro/Max"
+	},
+	openai: {
+		flow: "device-code",
+		subscription: "ChatGPT Plus/Pro"
+	},
+	"github-copilot": {
+		flow: "device-code",
+		subscription: "GitHub Copilot"
+	},
+	xai: {
+		flow: "device-code",
+		subscription: "SuperGrok/X Premium+"
+	}
 };
 /**
 * The tenant credentials domain, when registered and ready. `undefined` means
@@ -75,6 +88,6 @@ async function listTenantCredentialsForRequest({ c, auth, credentials }) {
 	return storage.listCredentials(tenantOrgId(tenant), tenant.userId);
 }
 //#endregion
-export { WEB_OAUTH_FLOW_KINDS, getAuthProviderId, getTenantCredentialsStorage, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId };
+export { WEB_OAUTH_PROVIDERS, getAuthProviderId, getTenantCredentialsStorage, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId };
 
 //# sourceMappingURL=provider-credentials.js.map

package/dist/routes/provider-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-credentials.js","names":[],"sources":["../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport { factoryUserOrgId } from '../auth.js';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the credential id, which differs from the\n * catalog provider id for OpenAI (`openai-codex`) and Kimi (`kimi-for-coding`).\n * Tenant rows use the same keying so one lookup serves both OAuth tokens and\n * API keys, and match what model resolution reads.\n */\nexport { getCredentialProviderId as getAuthProviderId } from '@mastra/code-sdk/providers/model-ids';\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  | { mode: 'local' }\n  | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? factoryUserOrgId({ id: tenant.userId }) ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";;;;;;;;;AAwCA,MAAa,uBAAmE;CAC9E,WAAW;CACX,QAAQ;CACR,kBAAkB;CAClB,KAAK;AACP;;;;;;AAWA,eAAsB,4BACpB,aAC8C;CAC9C,IAAI,CAAC,aAAa,OAAO,KAAA;CACzB,IAAI;EACF,MAAM,YAAY,YAAY;CAChC,QAAQ;EACN;CACF;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,YAAY,QAAoD;CAC9E,OAAO,OAAO,SAAS,iBAAiB,EAAE,IAAI,OAAO,OAAO,CAAC,KAAK,QAAQ,OAAO;AACnF;;;;;;AAOA,eAAsB,yBAAyB,EAC7C,GACA,MACA,eAMsD;CACtD,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ;EAIX,IAAI,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EAC9E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SACH,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO;EAAE,MAAM;EAAU;EAAS,OAAO,YAAY,MAAM;EAAG,QAAQ,OAAO;CAAO;AACtF;;;;;;;;AASA,eAAsB,gCAAgC,EACpD,GACA,MACA,eAM0C;CAC1C,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAA;CAC1C,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE"}
+{"version":3,"file":"provider-credentials.js","names":[],"sources":["../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport { factoryUserOrgId } from '../auth.js';\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the credential id, which differs from the\n * catalog provider id for OpenAI (`openai-codex`) and Kimi (`kimi-for-coding`).\n * Tenant rows use the same keying so one lookup serves both OAuth tokens and\n * API keys, and match what model resolution reads.\n */\nexport { getCredentialProviderId as getAuthProviderId } from '@mastra/code-sdk/providers/model-ids';\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes. `subscription` names the plan the\n * sign-in bills, as shown under a reply.\n */\nexport const WEB_OAUTH_PROVIDERS: Readonly<Record<string, { flow: LoginSessionKind; subscription: string }>> = {\n  anthropic: { flow: 'paste-code', subscription: 'Claude Pro/Max' },\n  openai: { flow: 'device-code', subscription: 'ChatGPT Plus/Pro' },\n  'github-copilot': { flow: 'device-code', subscription: 'GitHub Copilot' },\n  xai: { flow: 'device-code', subscription: 'SuperGrok/X Premium+' },\n};\n\nexport type CredentialContext =\n  | { mode: 'local' }\n  | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? factoryUserOrgId({ id: tenant.userId }) ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";;;;;;;;;;AAyCA,MAAa,sBAAkG;CAC7G,WAAW;EAAE,MAAM;EAAc,cAAc;CAAiB;CAChE,QAAQ;EAAE,MAAM;EAAe,cAAc;CAAmB;CAChE,kBAAkB;EAAE,MAAM;EAAe,cAAc;CAAiB;CACxE,KAAK;EAAE,MAAM;EAAe,cAAc;CAAuB;AACnE;;;;;;AAWA,eAAsB,4BACpB,aAC8C;CAC9C,IAAI,CAAC,aAAa,OAAO,KAAA;CACzB,IAAI;EACF,MAAM,YAAY,YAAY;CAChC,QAAQ;EACN;CACF;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,YAAY,QAAoD;CAC9E,OAAO,OAAO,SAAS,iBAAiB,EAAE,IAAI,OAAO,OAAO,CAAC,KAAK,QAAQ,OAAO;AACnF;;;;;;AAOA,eAAsB,yBAAyB,EAC7C,GACA,MACA,eAMsD;CACtD,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ;EAIX,IAAI,KAAK,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EAC9E,OAAO,EAAE,MAAM,QAAQ;CACzB;CACA,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SACH,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO;EAAE,MAAM;EAAU;EAAS,OAAO,YAAY,MAAM;EAAG,QAAQ,OAAO;CAAO;AACtF;;;;;;;;AASA,eAAsB,gCAAgC,EACpD,GACA,MACA,eAM0C;CAC1C,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAA;CAC1C,MAAM,UAAU,MAAM,4BAA4B,WAAW;CAC7D,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE"}

package/dist/routes/source-control-sessions.d.ts

@@ -6,6 +6,7 @@ import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js
 import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
 import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
 import type { RouteAuth } from './route.js';
+export declare const USER_SESSION_BRANCH_PREFIX = "user/session-";
 type SessionOwnerUserProvider = Pick<IUserProvider, 'getUser'> & Partial<Pick<IUserProvider, 'getUsers'>>;
 export interface SourceControlSessionRoutesOptions {
     auth: RouteAuth;

package/dist/routes/source-control-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAGrF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAoB5C,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AA0RD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CA6ItG"}
+{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAGrF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAY1D,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AA0RD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CA6ItG"}

package/dist/routes/source-control-sessions.js

@@ -351,6 +351,6 @@ function buildSourceControlSessionRoutes(options) {
 	];
 }
 //#endregion
-export { buildSourceControlSessionRoutes };
+export { USER_SESSION_BRANCH_PREFIX, buildSourceControlSessionRoutes };
 
 //# sourceMappingURL=source-control-sessions.js.map