@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/attention.js

@@ -0,0 +1,219 @@
+import { factoryAttentionKey } from "../storage/domains/work-items/base.js";
+import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { DecisionAttentionProvider, MentionAttentionProvider, SupervisorFindingAttentionProvider, factoryDecisionType, failedDecisionAttentionSpec } from "./attention-providers.js";
+import { ActivityAttentionProvider } from "./attention-activity.js";
+import { ParkedRunAttentionProvider } from "./attention-parked.js";
+import { proposedDecisionAttentionSpec } from "./attention-proposed.js";
+import { registerApiRoute } from "@mastra/core/server";
+//#region src/routes/attention.ts
+function encodeAttentionCursor(cursors) {
+	const wire = {};
+	for (const [kind, position] of cursors) wire[kind] = position ? [position.occurredAt.toISOString(), position.id] : null;
+	return Buffer.from(JSON.stringify(wire), "utf8").toString("base64url");
+}
+/**
+* Take the newest `limit` entries across provider pages. Each kind's next
+* cursor is the resume position of its last consumed entry; a kind consumed to
+* the end inherits the provider's own continuation.
+*/
+function mergeAttentionPages(pages, limit) {
+	const consumed = new Map(pages.map((page) => [page.kind, 0]));
+	const items = [];
+	while (items.length < limit) {
+		let best;
+		for (const page of pages) {
+			const next = page.result.entries[consumed.get(page.kind) ?? 0];
+			if (!next) continue;
+			const at = next.occurredAt.getTime();
+			if (!best || at > best.at) best = {
+				kind: page.kind,
+				at
+			};
+		}
+		if (!best) break;
+		const index = consumed.get(best.kind) ?? 0;
+		const entry = pages.find((page) => page.kind === best.kind)?.result.entries[index];
+		if (!entry) break;
+		items.push(entry.item);
+		consumed.set(best.kind, index + 1);
+	}
+	const nextCursors = /* @__PURE__ */ new Map();
+	let hasMore = false;
+	for (const page of pages) {
+		const used = consumed.get(page.kind) ?? 0;
+		const entries = page.result.entries;
+		if (used < entries.length) {
+			hasMore = true;
+			const lastConsumed = used > 0 ? entries[used - 1] : void 0;
+			nextCursors.set(page.kind, lastConsumed ? lastConsumed.resumeCursor : page.incoming);
+			continue;
+		}
+		if (page.result.hasMore) {
+			hasMore = true;
+			nextCursors.set(page.kind, page.result.continuation ?? entries.at(-1)?.resumeCursor ?? page.incoming);
+		}
+	}
+	return {
+		items,
+		hasMore,
+		...hasMore && nextCursors.size > 0 ? { nextCursor: encodeAttentionCursor(nextCursors) } : {}
+	};
+}
+function receiptRoute(dependencies, verb, action) {
+	const contract = verb === "read" ? FACTORY_ROUTE_CONTRACTS.attentionRead : verb === "archive" ? FACTORY_ROUTE_CONTRACTS.attentionArchive : FACTORY_ROUTE_CONTRACTS.attentionRestore;
+	return registerApiRoute(contract.path, {
+		method: contract.method,
+		requiresAuth: false,
+		handler: async (context) => {
+			const resolved = await dependencies.resolveProject(context);
+			if ("response" in resolved) return resolved.response;
+			const parsedPath = contract.pathSchema.safeParse({
+				id: resolved.factoryProjectId,
+				kind: context.req.param("kind"),
+				sourceId: context.req.param("sourceId"),
+				occurrence: context.req.param("occurrence")
+			});
+			if (!parsedPath.success) return context.json({ error: "invalid_attention_item" }, 422);
+			const { kind, sourceId, occurrence } = parsedPath.data;
+			if (!(kind !== "agent-waiting" || dependencies.liveSessions.parked(sourceId)?.suspendedAt === occurrence)) return context.json({ error: "attention_item_not_current" }, 409);
+			await dependencies.workItems.ensureReady();
+			const receipt = await dependencies.workItems.setAttentionReceipt({
+				orgId: resolved.orgId,
+				factoryProjectId: resolved.factoryProjectId,
+				userId: resolved.userId,
+				identity: {
+					kind,
+					sourceId,
+					occurrence
+				},
+				action,
+				now: /* @__PURE__ */ new Date()
+			});
+			if (!receipt) return context.json({ error: "attention_item_not_current" }, 409);
+			return context.json({ receipt: {
+				key: factoryAttentionKey(resolved.factoryProjectId, receipt),
+				state: receipt.state,
+				readAt: receipt.readAt.toISOString(),
+				archivedAt: receipt.archivedAt?.toISOString() ?? null
+			} });
+		}
+	});
+}
+function buildAttentionRoutes(dependencies) {
+	const { workItems, boards, comments, liveSessions } = dependencies;
+	const providers = [
+		new DecisionAttentionProvider({
+			workItems,
+			boards
+		}, failedDecisionAttentionSpec),
+		new DecisionAttentionProvider({
+			workItems,
+			boards
+		}, proposedDecisionAttentionSpec),
+		new SupervisorFindingAttentionProvider({ workItems }),
+		new MentionAttentionProvider({
+			workItems,
+			comments
+		}),
+		new ActivityAttentionProvider({
+			workItems,
+			comments
+		}),
+		new ParkedRunAttentionProvider({
+			workItems,
+			liveSessions
+		})
+	];
+	return [
+		registerApiRoute(FACTORY_ROUTE_CONTRACTS.attentionList.path, {
+			method: FACTORY_ROUTE_CONTRACTS.attentionList.method,
+			requiresAuth: false,
+			handler: async (context) => {
+				const resolved = await dependencies.resolveProject(context);
+				if ("response" in resolved) return resolved.response;
+				const query = FACTORY_ROUTE_CONTRACTS.attentionList.querySchema.safeParse({
+					view: context.req.query("view"),
+					kind: context.req.queries("kind"),
+					before: context.req.query("before"),
+					limit: context.req.query("limit"),
+					search: context.req.query("search")
+				});
+				if (!query.success) {
+					const field = query.error.issues[0]?.path[0];
+					return context.json({ error: field === "kind" ? "invalid_attention_kind" : field === "before" ? "invalid_cursor" : "invalid_attention_view" }, 400);
+				}
+				const { view, before, search, limit } = query.data;
+				const kinds = query.data.kind ?? providers.map((provider) => provider.kind);
+				await workItems.ensureReady();
+				await comments.ensureReady();
+				const active = providers.filter((provider) => kinds.includes(provider.kind) && (!before || before.has(provider.kind)));
+				const [summaries, pages] = await Promise.all([Promise.all(providers.map(async (provider) => ({
+					kind: provider.kind,
+					counts: await provider.counts(resolved),
+					latest: await provider.latest(resolved)
+				}))), Promise.all(active.map(async (provider) => ({
+					kind: provider.kind,
+					incoming: before?.get(provider.kind),
+					result: await provider.page(resolved, {
+						view,
+						...search ? { search } : {},
+						before: before?.get(provider.kind),
+						limit
+					})
+				})))]);
+				const merged = mergeAttentionPages(pages, limit);
+				return context.json({
+					items: merged.items,
+					kinds: Object.fromEntries(summaries.map((summary) => [summary.kind, {
+						...summary.counts,
+						latest: summary.latest ? {
+							...summary.latest,
+							at: summary.latest.at.toISOString()
+						} : null
+					}])),
+					hasMore: merged.hasMore,
+					...merged.nextCursor ? { nextCursor: merged.nextCursor } : {}
+				});
+			}
+		}),
+		registerApiRoute(FACTORY_ROUTE_CONTRACTS.attentionReadAll.path, {
+			method: FACTORY_ROUTE_CONTRACTS.attentionReadAll.method,
+			requiresAuth: false,
+			handler: async (context) => {
+				const resolved = await dependencies.resolveProject(context);
+				if ("response" in resolved) return resolved.response;
+				const query = FACTORY_ROUTE_CONTRACTS.attentionReadAll.querySchema.safeParse({ before: context.req.query("before") });
+				if (!query.success) return context.json({ error: "invalid_cursor" }, 400);
+				const { before } = query.data;
+				await workItems.ensureReady();
+				await comments.ensureReady();
+				const now = /* @__PURE__ */ new Date();
+				const active = providers.filter((provider) => !before || before.has(provider.kind));
+				const nextCursors = /* @__PURE__ */ new Map();
+				let hasMore = false;
+				for (const provider of active) {
+					const result = await provider.markAllRead(resolved, {
+						before: before?.get(provider.kind),
+						now
+					});
+					if (result.hasMore) {
+						hasMore = true;
+						if (result.continuation) nextCursors.set(provider.kind, result.continuation);
+					}
+				}
+				return context.json({
+					ok: true,
+					hasMore,
+					...hasMore && nextCursors.size > 0 ? { nextCursor: encodeAttentionCursor(nextCursors) } : {}
+				});
+			}
+		}),
+		receiptRoute(dependencies, "read", "read"),
+		receiptRoute(dependencies, "archive", "archive"),
+		receiptRoute(dependencies, "restore", "restore")
+	];
+}
+//#endregion
+export { buildAttentionRoutes, factoryDecisionType };
+
+//# sourceMappingURL=attention.js.map

package/dist/routes/attention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attention.js","names":[],"sources":["../../src/routes/attention.ts"],"sourcesContent":["/**\n * Attention routes: k-way merge of the per-kind providers on `occurredAt desc`.\n * The wire cursor is a per-kind map — each kind's stream resumes independently,\n * `null` meaning \"not started yet\", an absent kind meaning \"exhausted\".\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { BoardRegistry } from '../boards/index.js';\n\nimport type { LiveSessions } from '../session/live-sessions.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport type {\n  FactoryAttentionKind,\n  FactoryAttentionReceiptAction,\n  WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\nimport { factoryAttentionKey } from '../storage/domains/work-items/base.js';\nimport { ActivityAttentionProvider } from './attention-activity.js';\nimport { ParkedRunAttentionProvider } from './attention-parked.js';\nimport { proposedDecisionAttentionSpec } from './attention-proposed.js';\nimport type {\n  AttentionPageResult,\n  AttentionProvider,\n  AttentionScope,\n  AttentionStreamPosition,\n} from './attention-providers.js';\nimport {\n  DecisionAttentionProvider,\n  failedDecisionAttentionSpec,\n  MentionAttentionProvider,\n  SupervisorFindingAttentionProvider,\n} from './attention-providers.js';\nimport { FACTORY_ROUTE_CONTRACTS } from './contracts.js';\n\nexport { factoryDecisionType } from './attention-providers.js';\n\ninterface AttentionRouteDependencies {\n  workItems: WorkItemsStorage;\n  boards: BoardRegistry;\n  comments: WorkItemCommentsStorage;\n  liveSessions: Pick<LiveSessions, 'parked' | 'parkedIn'>;\n  resolveProject(context: unknown): Promise<AttentionScope | { response: Response }>;\n}\n\ntype AttentionCursorMap = Map<FactoryAttentionKind, AttentionStreamPosition | undefined>;\n\nfunction encodeAttentionCursor(cursors: AttentionCursorMap): string {\n  const wire: Record<string, [string, string] | null> = {};\n  for (const [kind, position] of cursors) {\n    wire[kind] = position ? [position.occurredAt.toISOString(), position.id] : null;\n  }\n  return Buffer.from(JSON.stringify(wire), 'utf8').toString('base64url');\n}\n\ninterface MergedAttentionPage {\n  items: Array<Record<string, unknown>>;\n  hasMore: boolean;\n  nextCursor?: string;\n}\n\n/**\n * Take the newest `limit` entries across provider pages. Each kind's next\n * cursor is the resume position of its last consumed entry; a kind consumed to\n * the end inherits the provider's own continuation.\n */\nfunction mergeAttentionPages(\n  pages: Array<{\n    kind: FactoryAttentionKind;\n    incoming: AttentionStreamPosition | undefined;\n    result: AttentionPageResult;\n  }>,\n  limit: number,\n): MergedAttentionPage {\n  const consumed = new Map(pages.map(page => [page.kind, 0]));\n  const items: Array<Record<string, unknown>> = [];\n  while (items.length < limit) {\n    let best: { kind: FactoryAttentionKind; at: number } | undefined;\n    for (const page of pages) {\n      const next = page.result.entries[consumed.get(page.kind) ?? 0];\n      if (!next) continue;\n      const at = next.occurredAt.getTime();\n      if (!best || at > best.at) best = { kind: page.kind, at };\n    }\n    if (!best) break;\n    const index = consumed.get(best.kind) ?? 0;\n    const entry = pages.find(page => page.kind === best.kind)?.result.entries[index];\n    if (!entry) break;\n    items.push(entry.item);\n    consumed.set(best.kind, index + 1);\n  }\n\n  const nextCursors: AttentionCursorMap = new Map();\n  let hasMore = false;\n  for (const page of pages) {\n    const used = consumed.get(page.kind) ?? 0;\n    const entries = page.result.entries;\n    if (used < entries.length) {\n      hasMore = true;\n      const lastConsumed = used > 0 ? entries[used - 1] : undefined;\n      nextCursors.set(page.kind, lastConsumed ? lastConsumed.resumeCursor : page.incoming);\n      continue;\n    }\n    if (page.result.hasMore) {\n      hasMore = true;\n      nextCursors.set(page.kind, page.result.continuation ?? entries.at(-1)?.resumeCursor ?? page.incoming);\n    }\n  }\n  return {\n    items,\n    hasMore,\n    ...(hasMore && nextCursors.size > 0 ? { nextCursor: encodeAttentionCursor(nextCursors) } : {}),\n  };\n}\n\nfunction receiptRoute(\n  dependencies: AttentionRouteDependencies,\n  verb: 'read' | 'archive' | 'restore',\n  action: FactoryAttentionReceiptAction,\n): ApiRoute {\n  const contract =\n    verb === 'read'\n      ? FACTORY_ROUTE_CONTRACTS.attentionRead\n      : verb === 'archive'\n        ? FACTORY_ROUTE_CONTRACTS.attentionArchive\n        : FACTORY_ROUTE_CONTRACTS.attentionRestore;\n  return registerApiRoute(contract.path, {\n    method: contract.method,\n    requiresAuth: false,\n    handler: async context => {\n      const resolved = await dependencies.resolveProject(context);\n      if ('response' in resolved) return resolved.response;\n      const parsedPath = contract.pathSchema.safeParse({\n        id: resolved.factoryProjectId,\n        kind: context.req.param('kind'),\n        sourceId: context.req.param('sourceId'),\n        occurrence: context.req.param('occurrence'),\n      });\n      if (!parsedPath.success) return context.json({ error: 'invalid_attention_item' }, 422);\n      const { kind, sourceId, occurrence } = parsedPath.data;\n      const stillParked =\n        kind !== 'agent-waiting' || dependencies.liveSessions.parked(sourceId)?.suspendedAt === occurrence;\n      if (!stillParked) return context.json({ error: 'attention_item_not_current' }, 409);\n      await dependencies.workItems.ensureReady();\n      const receipt = await dependencies.workItems.setAttentionReceipt({\n        orgId: resolved.orgId,\n        factoryProjectId: resolved.factoryProjectId,\n        userId: resolved.userId,\n        identity: { kind, sourceId, occurrence },\n        action,\n        now: new Date(),\n      });\n      if (!receipt) return context.json({ error: 'attention_item_not_current' }, 409);\n      return context.json({\n        receipt: {\n          key: factoryAttentionKey(resolved.factoryProjectId, receipt),\n          state: receipt.state,\n          readAt: receipt.readAt.toISOString(),\n          archivedAt: receipt.archivedAt?.toISOString() ?? null,\n        },\n      });\n    },\n  });\n}\n\nexport function buildAttentionRoutes(dependencies: AttentionRouteDependencies): ApiRoute[] {\n  const { workItems, boards, comments, liveSessions } = dependencies;\n  const providers: AttentionProvider[] = [\n    new DecisionAttentionProvider({ workItems, boards }, failedDecisionAttentionSpec),\n    new DecisionAttentionProvider({ workItems, boards }, proposedDecisionAttentionSpec),\n    new SupervisorFindingAttentionProvider({ workItems }),\n    new MentionAttentionProvider({ workItems, comments }),\n    new ActivityAttentionProvider({ workItems, comments }),\n    new ParkedRunAttentionProvider({ workItems, liveSessions }),\n  ];\n\n  return [\n    registerApiRoute(FACTORY_ROUTE_CONTRACTS.attentionList.path, {\n      method: FACTORY_ROUTE_CONTRACTS.attentionList.method,\n      requiresAuth: false,\n      handler: async context => {\n        const resolved = await dependencies.resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        const query = FACTORY_ROUTE_CONTRACTS.attentionList.querySchema.safeParse({\n          view: context.req.query('view'),\n          kind: context.req.queries('kind'),\n          before: context.req.query('before'),\n          limit: context.req.query('limit'),\n          search: context.req.query('search'),\n        });\n        if (!query.success) {\n          const field = query.error.issues[0]?.path[0];\n          return context.json(\n            {\n              error:\n                field === 'kind'\n                  ? 'invalid_attention_kind'\n                  : field === 'before'\n                    ? 'invalid_cursor'\n                    : 'invalid_attention_view',\n            },\n            400,\n          );\n        }\n        const { view, before, search, limit } = query.data;\n        const kinds = query.data.kind ?? providers.map(provider => provider.kind);\n        await workItems.ensureReady();\n        await comments.ensureReady();\n\n        const active = providers.filter(\n          provider => kinds.includes(provider.kind) && (!before || before.has(provider.kind)),\n        );\n\n        const [summaries, pages] = await Promise.all([\n          Promise.all(\n            providers.map(async provider => ({\n              kind: provider.kind,\n              counts: await provider.counts(resolved),\n              latest: await provider.latest(resolved),\n            })),\n          ),\n          Promise.all(\n            active.map(async provider => ({\n              kind: provider.kind,\n              incoming: before?.get(provider.kind),\n              result: await provider.page(resolved, {\n                view,\n                ...(search ? { search } : {}),\n                before: before?.get(provider.kind),\n                limit,\n              }),\n            })),\n          ),\n        ]);\n\n        const merged = mergeAttentionPages(pages, limit);\n\n        return context.json({\n          items: merged.items,\n          kinds: Object.fromEntries(\n            summaries.map(summary => [\n              summary.kind,\n              {\n                ...summary.counts,\n                latest: summary.latest ? { ...summary.latest, at: summary.latest.at.toISOString() } : null,\n              },\n            ]),\n          ),\n          hasMore: merged.hasMore,\n          ...(merged.nextCursor ? { nextCursor: merged.nextCursor } : {}),\n        });\n      },\n    }),\n    registerApiRoute(FACTORY_ROUTE_CONTRACTS.attentionReadAll.path, {\n      method: FACTORY_ROUTE_CONTRACTS.attentionReadAll.method,\n      requiresAuth: false,\n      handler: async context => {\n        const resolved = await dependencies.resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        const query = FACTORY_ROUTE_CONTRACTS.attentionReadAll.querySchema.safeParse({\n          before: context.req.query('before'),\n        });\n        if (!query.success) return context.json({ error: 'invalid_cursor' }, 400);\n        const { before } = query.data;\n        await workItems.ensureReady();\n        await comments.ensureReady();\n\n        const now = new Date();\n        const active = providers.filter(provider => !before || before.has(provider.kind));\n        const nextCursors: AttentionCursorMap = new Map();\n        let hasMore = false;\n        for (const provider of active) {\n          const result = await provider.markAllRead(resolved, { before: before?.get(provider.kind), now });\n          if (result.hasMore) {\n            hasMore = true;\n            if (result.continuation) nextCursors.set(provider.kind, result.continuation);\n          }\n        }\n        return context.json({\n          ok: true,\n          hasMore,\n          ...(hasMore && nextCursors.size > 0 ? { nextCursor: encodeAttentionCursor(nextCursors) } : {}),\n        });\n      },\n    }),\n    receiptRoute(dependencies, 'read', 'read'),\n    receiptRoute(dependencies, 'archive', 'archive'),\n    receiptRoute(dependencies, 'restore', 'restore'),\n  ];\n}\n"],"mappings":";;;;;;;;AA+CA,SAAS,sBAAsB,SAAqC;CAClE,MAAM,OAAgD,CAAC;CACvD,KAAK,MAAM,CAAC,MAAM,aAAa,SAC7B,KAAK,QAAQ,WAAW,CAAC,SAAS,WAAW,YAAY,GAAG,SAAS,EAAE,IAAI;CAE7E,OAAO,OAAO,KAAK,KAAK,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;AACvE;;;;;;AAaA,SAAS,oBACP,OAKA,OACqB;CACrB,MAAM,WAAW,IAAI,IAAI,MAAM,KAAI,SAAQ,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;CAC1D,MAAM,QAAwC,CAAC;CAC/C,OAAO,MAAM,SAAS,OAAO;EAC3B,IAAI;EACJ,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,OAAO,KAAK,OAAO,QAAQ,SAAS,IAAI,KAAK,IAAI,KAAK;GAC5D,IAAI,CAAC,MAAM;GACX,MAAM,KAAK,KAAK,WAAW,QAAQ;GACnC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO;IAAE,MAAM,KAAK;IAAM;GAAG;EAC1D;EACA,IAAI,CAAC,MAAM;EACX,MAAM,QAAQ,SAAS,IAAI,KAAK,IAAI,KAAK;EACzC,MAAM,QAAQ,MAAM,MAAK,SAAQ,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE,OAAO,QAAQ;EAC1E,IAAI,CAAC,OAAO;EACZ,MAAM,KAAK,MAAM,IAAI;EACrB,SAAS,IAAI,KAAK,MAAM,QAAQ,CAAC;CACnC;CAEA,MAAM,8BAAkC,IAAI,IAAI;CAChD,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,SAAS,IAAI,KAAK,IAAI,KAAK;EACxC,MAAM,UAAU,KAAK,OAAO;EAC5B,IAAI,OAAO,QAAQ,QAAQ;GACzB,UAAU;GACV,MAAM,eAAe,OAAO,IAAI,QAAQ,OAAO,KAAK,KAAA;GACpD,YAAY,IAAI,KAAK,MAAM,eAAe,aAAa,eAAe,KAAK,QAAQ;GACnF;EACF;EACA,IAAI,KAAK,OAAO,SAAS;GACvB,UAAU;GACV,YAAY,IAAI,KAAK,MAAM,KAAK,OAAO,gBAAgB,QAAQ,GAAG,EAAE,CAAC,EAAE,gBAAgB,KAAK,QAAQ;EACtG;CACF;CACA,OAAO;EACL;EACA;EACA,GAAI,WAAW,YAAY,OAAO,IAAI,EAAE,YAAY,sBAAsB,WAAW,EAAE,IAAI,CAAC;CAC9F;AACF;AAEA,SAAS,aACP,cACA,MACA,QACU;CACV,MAAM,WACJ,SAAS,SACL,wBAAwB,gBACxB,SAAS,YACP,wBAAwB,mBACxB,wBAAwB;CAChC,OAAO,iBAAiB,SAAS,MAAM;EACrC,QAAQ,SAAS;EACjB,cAAc;EACd,SAAS,OAAM,YAAW;GACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;GAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,aAAa,SAAS,WAAW,UAAU;IAC/C,IAAI,SAAS;IACb,MAAM,QAAQ,IAAI,MAAM,MAAM;IAC9B,UAAU,QAAQ,IAAI,MAAM,UAAU;IACtC,YAAY,QAAQ,IAAI,MAAM,YAAY;GAC5C,CAAC;GACD,IAAI,CAAC,WAAW,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;GACrF,MAAM,EAAE,MAAM,UAAU,eAAe,WAAW;GAGlD,IAAI,EADF,SAAS,mBAAmB,aAAa,aAAa,OAAO,QAAQ,CAAC,EAAE,gBAAgB,aACxE,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAClF,MAAM,aAAa,UAAU,YAAY;GACzC,MAAM,UAAU,MAAM,aAAa,UAAU,oBAAoB;IAC/D,OAAO,SAAS;IAChB,kBAAkB,SAAS;IAC3B,QAAQ,SAAS;IACjB,UAAU;KAAE;KAAM;KAAU;IAAW;IACvC;IACA,qBAAK,IAAI,KAAK;GAChB,CAAC;GACD,IAAI,CAAC,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAC9E,OAAO,QAAQ,KAAK,EAClB,SAAS;IACP,KAAK,oBAAoB,SAAS,kBAAkB,OAAO;IAC3D,OAAO,QAAQ;IACf,QAAQ,QAAQ,OAAO,YAAY;IACnC,YAAY,QAAQ,YAAY,YAAY,KAAK;GACnD,EACF,CAAC;EACH;CACF,CAAC;AACH;AAEA,SAAgB,qBAAqB,cAAsD;CACzF,MAAM,EAAE,WAAW,QAAQ,UAAU,iBAAiB;CACtD,MAAM,YAAiC;EACrC,IAAI,0BAA0B;GAAE;GAAW;EAAO,GAAG,2BAA2B;EAChF,IAAI,0BAA0B;GAAE;GAAW;EAAO,GAAG,6BAA6B;EAClF,IAAI,mCAAmC,EAAE,UAAU,CAAC;EACpD,IAAI,yBAAyB;GAAE;GAAW;EAAS,CAAC;EACpD,IAAI,0BAA0B;GAAE;GAAW;EAAS,CAAC;EACrD,IAAI,2BAA2B;GAAE;GAAW;EAAa,CAAC;CAC5D;CAEA,OAAO;EACL,iBAAiB,wBAAwB,cAAc,MAAM;GAC3D,QAAQ,wBAAwB,cAAc;GAC9C,cAAc;GACd,SAAS,OAAM,YAAW;IACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;IAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,QAAQ,wBAAwB,cAAc,YAAY,UAAU;KACxE,MAAM,QAAQ,IAAI,MAAM,MAAM;KAC9B,MAAM,QAAQ,IAAI,QAAQ,MAAM;KAChC,QAAQ,QAAQ,IAAI,MAAM,QAAQ;KAClC,OAAO,QAAQ,IAAI,MAAM,OAAO;KAChC,QAAQ,QAAQ,IAAI,MAAM,QAAQ;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,SAAS;KAClB,MAAM,QAAQ,MAAM,MAAM,OAAO,EAAE,EAAE,KAAK;KAC1C,OAAO,QAAQ,KACb,EACE,OACE,UAAU,SACN,2BACA,UAAU,WACR,mBACA,yBACV,GACA,GACF;IACF;IACA,MAAM,EAAE,MAAM,QAAQ,QAAQ,UAAU,MAAM;IAC9C,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,KAAI,aAAY,SAAS,IAAI;IACxE,MAAM,UAAU,YAAY;IAC5B,MAAM,SAAS,YAAY;IAE3B,MAAM,SAAS,UAAU,QACvB,aAAY,MAAM,SAAS,SAAS,IAAI,MAAM,CAAC,UAAU,OAAO,IAAI,SAAS,IAAI,EACnF;IAEA,MAAM,CAAC,WAAW,SAAS,MAAM,QAAQ,IAAI,CAC3C,QAAQ,IACN,UAAU,IAAI,OAAM,cAAa;KAC/B,MAAM,SAAS;KACf,QAAQ,MAAM,SAAS,OAAO,QAAQ;KACtC,QAAQ,MAAM,SAAS,OAAO,QAAQ;IACxC,EAAE,CACJ,GACA,QAAQ,IACN,OAAO,IAAI,OAAM,cAAa;KAC5B,MAAM,SAAS;KACf,UAAU,QAAQ,IAAI,SAAS,IAAI;KACnC,QAAQ,MAAM,SAAS,KAAK,UAAU;MACpC;MACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;MAC3B,QAAQ,QAAQ,IAAI,SAAS,IAAI;MACjC;KACF,CAAC;IACH,EAAE,CACJ,CACF,CAAC;IAED,MAAM,SAAS,oBAAoB,OAAO,KAAK;IAE/C,OAAO,QAAQ,KAAK;KAClB,OAAO,OAAO;KACd,OAAO,OAAO,YACZ,UAAU,KAAI,YAAW,CACvB,QAAQ,MACR;MACE,GAAG,QAAQ;MACX,QAAQ,QAAQ,SAAS;OAAE,GAAG,QAAQ;OAAQ,IAAI,QAAQ,OAAO,GAAG,YAAY;MAAE,IAAI;KACxF,CACF,CAAC,CACH;KACA,SAAS,OAAO;KAChB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,iBAAiB,wBAAwB,iBAAiB,MAAM;GAC9D,QAAQ,wBAAwB,iBAAiB;GACjD,cAAc;GACd,SAAS,OAAM,YAAW;IACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;IAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,QAAQ,wBAAwB,iBAAiB,YAAY,UAAU,EAC3E,QAAQ,QAAQ,IAAI,MAAM,QAAQ,EACpC,CAAC;IACD,IAAI,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;IACxE,MAAM,EAAE,WAAW,MAAM;IACzB,MAAM,UAAU,YAAY;IAC5B,MAAM,SAAS,YAAY;IAE3B,MAAM,sBAAM,IAAI,KAAK;IACrB,MAAM,SAAS,UAAU,QAAO,aAAY,CAAC,UAAU,OAAO,IAAI,SAAS,IAAI,CAAC;IAChF,MAAM,8BAAkC,IAAI,IAAI;IAChD,IAAI,UAAU;IACd,KAAK,MAAM,YAAY,QAAQ;KAC7B,MAAM,SAAS,MAAM,SAAS,YAAY,UAAU;MAAE,QAAQ,QAAQ,IAAI,SAAS,IAAI;MAAG;KAAI,CAAC;KAC/F,IAAI,OAAO,SAAS;MAClB,UAAU;MACV,IAAI,OAAO,cAAc,YAAY,IAAI,SAAS,MAAM,OAAO,YAAY;KAC7E;IACF;IACA,OAAO,QAAQ,KAAK;KAClB,IAAI;KACJ;KACA,GAAI,WAAW,YAAY,OAAO,IAAI,EAAE,YAAY,sBAAsB,WAAW,EAAE,IAAI,CAAC;IAC9F,CAAC;GACH;EACF,CAAC;EACD,aAAa,cAAc,QAAQ,MAAM;EACzC,aAAa,cAAc,WAAW,SAAS;EAC/C,aAAa,cAAc,WAAW,SAAS;CACjD;AACF"}

package/dist/routes/automation-runs.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Mastra `apiRoutes` for trusted external orchestrators to enqueue an
+ * idempotent, deferred skill dispatch against a Factory work item.
+ *
+ * The endpoint is a constrained ingress in front of
+ * `WorkItemsStorage.commitRuleEvaluation()`: it commits exactly one
+ * `invokeSkill` decision, stamps a non-human system actor, and leaves
+ * execution (session creation, auto-run/approval policy, retry, restart
+ * recovery) to the `FactoryDecisionDispatcher`.
+ *
+ * Idempotency: the `requestId` becomes the ingress identity, so replaying the
+ * same request returns the prior result without inserting a second decision.
+ * Tenant-mode callers must administer the organization; local (no-auth)
+ * deployments run under the shared `local` storage scope without inventing a
+ * tenant user.
+ */
+import type { ApiRoute } from '@mastra/core/server';
+import type { AuditEmitter, AuditRecorder } from '../storage/domains/audit/domain.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import { Route } from './route.js';
+import type { RouteDependencies } from './route.js';
+export interface AutomationRunRoutesDeps extends RouteDependencies {
+    audit: AuditEmitter & AuditRecorder;
+    /** Factory projects domain — validates the `:id` project belongs to the caller's org. */
+    projects: FactoryProjectsStorage;
+    /** Work-items domain backing `commitRuleEvaluation`. */
+    workItems: WorkItemsStorage;
+    /** Config version stamped on the committed rule evaluation. */
+    configVersion: string;
+}
+export declare class AutomationRunRoutes extends Route<AutomationRunRoutesDeps> {
+    #private;
+    routes(): ApiRoute[];
+}
+export declare function buildAutomationRunRoutes(deps: AutomationRunRoutesDeps): ApiRoute[];
+//# sourceMappingURL=automation-runs.d.ts.map

package/dist/routes/automation-runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-runs.d.ts","sourceRoot":"","sources":["../../src/routes/automation-runs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAMpD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6CpD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,KAAK,EAAE,YAAY,GAAG,aAAa,CAAC;IACpC,yFAAyF;IACzF,QAAQ,EAAE,sBAAsB,CAAC;IACjC,wDAAwD;IACxD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;CACvB;AASD,qBAAa,mBAAoB,SAAQ,KAAK,CAAC,uBAAuB,CAAC;;IAmFrE,MAAM,IAAI,QAAQ,EAAE;CA0HrB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,uBAAuB,GAAG,QAAQ,EAAE,CAElF"}

package/dist/routes/automation-runs.js

@@ -0,0 +1,196 @@
+import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { Route } from "./route.js";
+import { auditRequestContext } from "../storage/domains/audit/domain.js";
+import { registerApiRoute } from "@mastra/core/server";
+//#region src/routes/automation-runs.ts
+function loose(c) {
+	return c;
+}
+/**
+* Whether a replayed rule-evaluation record describes the SAME operation as the
+* current request. `commitRuleEvaluation` keys idempotency on `(org, project,
+* ingress identity)` alone, so a reused `requestId` replays regardless of the
+* work item or decision payload. We reconstruct the prior `invokeSkill`
+* decision from the stored result and compare the item id, role, skill, and
+* arguments; any divergence is a collision, not a legitimate retry.
+*/
+function replayMatchesRequest(result, itemId, request) {
+	if (result.itemId != null && result.itemId !== itemId) return false;
+	const prior = (Array.isArray(result.decisions) ? result.decisions : []).find((candidate) => typeof candidate === "object" && candidate !== null && candidate.type === "invokeSkill" && candidate.idempotencyKey === request.idempotencyKey);
+	if (!prior) return false;
+	return prior.role === request.role && prior.skillName === request.skillName && (prior.arguments ?? void 0) === (request.arguments ?? void 0);
+}
+var AutomationRunRoutes = class extends Route {
+	/**
+	* Resolve the `(orgId, userId)` ingress scope. Tenant mode requires a
+	* signed-in organization administrator; local (no-auth) mode runs under the
+	* shared `local` scope without inventing a user.
+	*/
+	async #resolveScope(c) {
+		const { auth } = this.deps;
+		if (!auth.enabled()) return {
+			orgId: "local",
+			userId: "local"
+		};
+		await auth.ensureUser(c);
+		const tenant = auth.tenant(c);
+		if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+		if (!tenant.orgId) return { response: c.json({
+			error: "organization_required",
+			message: "The Factory board requires an organization."
+		}, 403) };
+		if (!await auth.isOrganizationAdmin(c, tenant.orgId)) return { response: c.json({
+			error: "forbidden",
+			message: "Organization administrator access is required for automation ingress."
+		}, 403) };
+		return {
+			orgId: tenant.orgId,
+			userId: tenant.userId
+		};
+	}
+	/** Resolve the ingress scope AND the org-owned project from the `:id` param. */
+	async #resolveProject(c) {
+		const scope = await this.#resolveScope(c);
+		if ("response" in scope) return scope;
+		const parsedPath = FACTORY_ROUTE_CONTRACTS.projectGet.pathSchema.safeParse({ id: c.req.param("id") });
+		if (!parsedPath.success) return { response: c.json({ error: "Project not found" }, 404) };
+		const { projects } = this.deps;
+		await projects.ensureReady();
+		if (!await projects.get({
+			orgId: scope.orgId,
+			id: parsedPath.data.id
+		})) return { response: c.json({ error: "Project not found" }, 404) };
+		return {
+			...scope,
+			factoryProjectId: parsedPath.data.id
+		};
+	}
+	/**
+	* Persist an audit event under the ingress-resolved scope. This route can run
+	* under the synthetic `local` no-auth scope, where the tenant-gated
+	* `audit.emit()` derives no org from the request and drops the event; writing
+	* through `record()` with the explicit org + system actor keeps traceability
+	* in every deployment mode.
+	*
+	* The `idempotencyKey` (`<action>:<requestId>`) makes the audit write itself
+	* idempotent: replaying the same request re-enters this path, but the trail
+	* keeps a single event per requestId instead of one duplicate per retry.
+	*/
+	async #writeAudit(c, scope, action, requestId, targets, metadata) {
+		await this.deps.audit.record({
+			idempotencyKey: `${action}:${requestId}`,
+			orgId: scope.orgId,
+			actorId: "factory-external-orchestrator",
+			actorType: "system",
+			action,
+			targets,
+			metadata,
+			factoryProjectId: scope.factoryProjectId,
+			context: auditRequestContext(c)
+		});
+	}
+	routes() {
+		const { workItems, configVersion } = this.deps;
+		const contract = FACTORY_ROUTE_CONTRACTS.workItemAutomationRun;
+		return [registerApiRoute(contract.path, {
+			method: contract.method,
+			handler: async (c) => {
+				const context = loose(c);
+				const resolved = await this.#resolveProject(context);
+				if ("response" in resolved) return resolved.response;
+				const parsedPath = contract.pathSchema.safeParse({
+					id: c.req.param("id"),
+					workItemId: c.req.param("workItemId")
+				});
+				if (!parsedPath.success) return c.json({ error: "Work item not found" }, 404);
+				const body = await c.req.json().catch(() => void 0);
+				if (body === void 0) return c.json({ error: "Invalid JSON body" }, 400);
+				const parsed = contract.bodySchema.safeParse(body);
+				if (!parsed.success) return c.json({ error: "invalid_automation_run_request" }, 400);
+				const request = parsed.data;
+				const item = await workItems.getForProject(resolved.orgId, resolved.factoryProjectId, parsedPath.data.workItemId);
+				if (!item) return c.json({ error: "Work item not found" }, 404);
+				const idempotencyKey = `external-orchestrator:${request.requestId}`;
+				const decision = {
+					type: "invokeSkill",
+					idempotencyKey,
+					role: request.role,
+					skillName: request.skillName,
+					...request.arguments !== void 0 ? { arguments: request.arguments } : {}
+				};
+				const now = /* @__PURE__ */ new Date();
+				const commit = await workItems.commitRuleEvaluation({
+					orgId: resolved.orgId,
+					factoryProjectId: resolved.factoryProjectId,
+					workItemId: item.id,
+					ingress: {
+						identity: idempotencyKey,
+						triggerType: "external-orchestrator.invoke-skill"
+					},
+					configVersion,
+					expectedRevision: request.expectedRevision,
+					actor: {
+						type: "system",
+						id: "factory-external-orchestrator"
+					},
+					outcome: { status: "accepted" },
+					decisions: [decision],
+					causalChain: [],
+					now
+				});
+				if (commit.status === "missing") return c.json({ error: "Work item not found" }, 404);
+				const result = commit.status === "stale" ? {
+					status: "rejected",
+					code: "stale"
+				} : commit.result;
+				const resultStatus = result.status ?? "accepted";
+				const code = typeof result.code === "string" ? result.code : void 0;
+				const targets = [{
+					type: "work_item",
+					id: item.id,
+					name: item.title
+				}];
+				const auditMetadata = {
+					requestId: request.requestId,
+					role: request.role,
+					skillName: request.skillName,
+					commitStatus: commit.status,
+					resultStatus,
+					...code ? { code } : {}
+				};
+				if (commit.status === "replayed" && !replayMatchesRequest(result, item.id, decision)) {
+					await this.#writeAudit(context, resolved, "factory.run.rejected", request.requestId, targets, {
+						...auditMetadata,
+						resultStatus: "rejected",
+						code: "request_id_conflict"
+					});
+					return c.json({
+						status: "rejected",
+						code: "request_id_conflict",
+						requestId: request.requestId
+					}, 409);
+				}
+				if (resultStatus === "accepted") {
+					await this.#writeAudit(context, resolved, "factory.run.queued", request.requestId, targets, auditMetadata);
+					return c.json({
+						status: commit.status === "replayed" ? "replayed" : "committed",
+						requestId: request.requestId
+					}, commit.status === "replayed" ? 200 : 202);
+				}
+				await this.#writeAudit(context, resolved, "factory.run.rejected", request.requestId, targets, auditMetadata);
+				return c.json({
+					status: "rejected",
+					...code ? { code } : {},
+					requestId: request.requestId
+				}, code === "stale" ? 409 : 422);
+			}
+		})];
+	}
+};
+function buildAutomationRunRoutes(deps) {
+	return new AutomationRunRoutes(deps).routes();
+}
+//#endregion
+export { AutomationRunRoutes, buildAutomationRunRoutes };
+
+//# sourceMappingURL=automation-runs.js.map

package/dist/routes/automation-runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-runs.js","names":["#resolveScope","#resolveProject","#writeAudit"],"sources":["../../src/routes/automation-runs.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for trusted external orchestrators to enqueue an\n * idempotent, deferred skill dispatch against a Factory work item.\n *\n * The endpoint is a constrained ingress in front of\n * `WorkItemsStorage.commitRuleEvaluation()`: it commits exactly one\n * `invokeSkill` decision, stamps a non-human system actor, and leaves\n * execution (session creation, auto-run/approval policy, retry, restart\n * recovery) to the `FactoryDecisionDispatcher`.\n *\n * Idempotency: the `requestId` becomes the ingress identity, so replaying the\n * same request returns the prior result without inserting a second decision.\n * Tenant-mode callers must administer the organization; local (no-auth)\n * deployments run under the shared `local` storage scope without inventing a\n * tenant user.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { AuditAction } from '../storage/domains/audit/actions.js';\nimport type { AuditTarget } from '../storage/domains/audit/base.js';\nimport type { AuditEmitter, AuditRecorder } from '../storage/domains/audit/domain.js';\nimport { auditRequestContext } from '../storage/domains/audit/domain.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { FACTORY_ROUTE_CONTRACTS } from './contracts.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/** The invokeSkill payload this route commits, matched against a prior replay. */\ninterface AutomationInvokeSkillDecision {\n  type: 'invokeSkill';\n  idempotencyKey: string;\n  role: string;\n  skillName: string;\n  arguments?: string;\n}\n\n/**\n * Whether a replayed rule-evaluation record describes the SAME operation as the\n * current request. `commitRuleEvaluation` keys idempotency on `(org, project,\n * ingress identity)` alone, so a reused `requestId` replays regardless of the\n * work item or decision payload. We reconstruct the prior `invokeSkill`\n * decision from the stored result and compare the item id, role, skill, and\n * arguments; any divergence is a collision, not a legitimate retry.\n */\nfunction replayMatchesRequest(\n  result: { itemId?: string | null; decisions?: unknown[] },\n  itemId: string,\n  request: AutomationInvokeSkillDecision,\n): boolean {\n  if (result.itemId != null && result.itemId !== itemId) return false;\n  const decisions = Array.isArray(result.decisions) ? result.decisions : [];\n  const prior = decisions.find(\n    (candidate): candidate is Record<string, unknown> =>\n      typeof candidate === 'object' &&\n      candidate !== null &&\n      (candidate as Record<string, unknown>).type === 'invokeSkill' &&\n      (candidate as Record<string, unknown>).idempotencyKey === request.idempotencyKey,\n  );\n  if (!prior) return false;\n  return (\n    prior.role === request.role &&\n    prior.skillName === request.skillName &&\n    (prior.arguments ?? undefined) === (request.arguments ?? undefined)\n  );\n}\n\nexport interface AutomationRunRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter & AuditRecorder;\n  /** Factory projects domain — validates the `:id` project belongs to the caller's org. */\n  projects: FactoryProjectsStorage;\n  /** Work-items domain backing `commitRuleEvaluation`. */\n  workItems: WorkItemsStorage;\n  /** Config version stamped on the committed rule evaluation. */\n  configVersion: string;\n}\n\n/** Resolved ingress scope for an automation-run request. */\ninterface AutomationRunScope {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n}\n\nexport class AutomationRunRoutes extends Route<AutomationRunRoutesDeps> {\n  /**\n   * Resolve the `(orgId, userId)` ingress scope. Tenant mode requires a\n   * signed-in organization administrator; local (no-auth) mode runs under the\n   * shared `local` scope without inventing a user.\n   */\n  async #resolveScope(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    const { auth } = this.deps;\n    if (!auth.enabled()) {\n      return { orgId: 'local', userId: 'local' };\n    }\n    await auth.ensureUser(c);\n    const tenant = auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'The Factory board requires an organization.' },\n          403,\n        ),\n      };\n    }\n    if (!(await auth.isOrganizationAdmin(c, tenant.orgId))) {\n      return {\n        response: c.json(\n          { error: 'forbidden', message: 'Organization administrator access is required for automation ingress.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  /** Resolve the ingress scope AND the org-owned project from the `:id` param. */\n  async #resolveProject(c: Context): Promise<AutomationRunScope | { response: Response }> {\n    const scope = await this.#resolveScope(c);\n    if ('response' in scope) return scope;\n\n    const parsedPath = FACTORY_ROUTE_CONTRACTS.projectGet.pathSchema.safeParse({ id: c.req.param('id') });\n    if (!parsedPath.success) {\n      return { response: c.json({ error: 'Project not found' }, 404) };\n    }\n    const { projects } = this.deps;\n    await projects.ensureReady();\n    const project = await projects.get({ orgId: scope.orgId, id: parsedPath.data.id });\n    if (!project) {\n      return { response: c.json({ error: 'Project not found' }, 404) };\n    }\n    return { ...scope, factoryProjectId: parsedPath.data.id };\n  }\n\n  /**\n   * Persist an audit event under the ingress-resolved scope. This route can run\n   * under the synthetic `local` no-auth scope, where the tenant-gated\n   * `audit.emit()` derives no org from the request and drops the event; writing\n   * through `record()` with the explicit org + system actor keeps traceability\n   * in every deployment mode.\n   *\n   * The `idempotencyKey` (`<action>:<requestId>`) makes the audit write itself\n   * idempotent: replaying the same request re-enters this path, but the trail\n   * keeps a single event per requestId instead of one duplicate per retry.\n   */\n  async #writeAudit(\n    c: Context,\n    scope: AutomationRunScope,\n    action: AuditAction,\n    requestId: string,\n    targets: AuditTarget[],\n    metadata: Record<string, unknown>,\n  ): Promise<void> {\n    await this.deps.audit.record({\n      idempotencyKey: `${action}:${requestId}`,\n      orgId: scope.orgId,\n      actorId: 'factory-external-orchestrator',\n      actorType: 'system',\n      action,\n      targets,\n      metadata,\n      factoryProjectId: scope.factoryProjectId,\n      context: auditRequestContext(c),\n    });\n  }\n\n  routes(): ApiRoute[] {\n    const { workItems, configVersion } = this.deps;\n    const contract = FACTORY_ROUTE_CONTRACTS.workItemAutomationRun;\n\n    return [\n      registerApiRoute(contract.path, {\n        method: contract.method,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n\n          const parsedPath = contract.pathSchema.safeParse({\n            id: c.req.param('id'),\n            workItemId: c.req.param('workItemId'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n\n          const body = await c.req.json().catch(() => undefined);\n          if (body === undefined) return c.json({ error: 'Invalid JSON body' }, 400);\n          const parsed = contract.bodySchema.safeParse(body);\n          if (!parsed.success) return c.json({ error: 'invalid_automation_run_request' }, 400);\n          const request = parsed.data as {\n            requestId: string;\n            expectedRevision: number;\n            role: string;\n            skillName: string;\n            arguments?: string;\n          };\n\n          const item = await workItems.getForProject(\n            resolved.orgId,\n            resolved.factoryProjectId,\n            (parsedPath.data as { workItemId: string }).workItemId,\n          );\n          if (!item) return c.json({ error: 'Work item not found' }, 404);\n\n          const idempotencyKey = `external-orchestrator:${request.requestId}`;\n          const decision = {\n            type: 'invokeSkill' as const,\n            idempotencyKey,\n            role: request.role,\n            skillName: request.skillName,\n            ...(request.arguments !== undefined ? { arguments: request.arguments } : {}),\n          };\n\n          const now = new Date();\n          const commit = await workItems.commitRuleEvaluation({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            workItemId: item.id,\n            ingress: { identity: idempotencyKey, triggerType: 'external-orchestrator.invoke-skill' },\n            configVersion,\n            expectedRevision: request.expectedRevision,\n            actor: { type: 'system', id: 'factory-external-orchestrator' },\n            outcome: { status: 'accepted' },\n            decisions: [decision],\n            causalChain: [],\n            now,\n          });\n\n          if (commit.status === 'missing') return c.json({ error: 'Work item not found' }, 404);\n\n          // A stale commit persists nothing, so the caller can retry the same\n          // requestId once it has re-read the work item's revision.\n          const result = (commit.status === 'stale' ? { status: 'rejected', code: 'stale' } : commit.result) as {\n            status?: string;\n            code?: string;\n            itemId?: string | null;\n            decisions?: unknown[];\n          };\n          const resultStatus = result.status ?? 'accepted';\n          const code = typeof result.code === 'string' ? result.code : undefined;\n          const targets = [{ type: 'work_item' as const, id: item.id, name: item.title }];\n\n          const auditMetadata = {\n            requestId: request.requestId,\n            role: request.role,\n            skillName: request.skillName,\n            commitStatus: commit.status,\n            resultStatus,\n            ...(code ? { code } : {}),\n          };\n\n          // A replay only means \"this request was already committed\" — it must\n          // be the SAME operation. If the caller reused a requestId against a\n          // different work item, role, skill, or arguments, returning\n          // `replayed` would report durable success for work that was never\n          // enqueued. Reject the collision instead of silently swallowing it.\n          if (commit.status === 'replayed' && !replayMatchesRequest(result, item.id, decision)) {\n            await this.#writeAudit(context, resolved, 'factory.run.rejected', request.requestId, targets, {\n              ...auditMetadata,\n              resultStatus: 'rejected',\n              code: 'request_id_conflict',\n            });\n            return c.json(\n              {\n                status: 'rejected',\n                code: 'request_id_conflict',\n                requestId: request.requestId,\n              },\n              409,\n            );\n          }\n\n          if (resultStatus === 'accepted') {\n            await this.#writeAudit(context, resolved, 'factory.run.queued', request.requestId, targets, auditMetadata);\n            return c.json(\n              { status: commit.status === 'replayed' ? 'replayed' : 'committed', requestId: request.requestId },\n              commit.status === 'replayed' ? 200 : 202,\n            );\n          }\n\n          await this.#writeAudit(context, resolved, 'factory.run.rejected', request.requestId, targets, auditMetadata);\n          return c.json(\n            { status: 'rejected', ...(code ? { code } : {}), requestId: request.requestId },\n            code === 'stale' ? 409 : 422,\n          );\n        },\n      }),\n    ];\n  }\n}\n\nexport function buildAutomationRunRoutes(deps: AutomationRunRoutesDeps): ApiRoute[] {\n  return new AutomationRunRoutes(deps).routes();\n}\n"],"mappings":";;;;;AA+BA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;;;;;;;;AAmBA,SAAS,qBACP,QACA,QACA,SACS;CACT,IAAI,OAAO,UAAU,QAAQ,OAAO,WAAW,QAAQ,OAAO;CAE9D,MAAM,SADY,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,YAAY,CAAC,EAAA,CAChD,MACrB,cACC,OAAO,cAAc,YACrB,cAAc,QACb,UAAsC,SAAS,iBAC/C,UAAsC,mBAAmB,QAAQ,cACtE;CACA,IAAI,CAAC,OAAO,OAAO;CACnB,OACE,MAAM,SAAS,QAAQ,QACvB,MAAM,cAAc,QAAQ,cAC3B,MAAM,aAAa,KAAA,QAAgB,QAAQ,aAAa,KAAA;AAE7D;AAmBA,IAAa,sBAAb,cAAyC,MAA+B;;;;;;CAMtE,MAAMA,cAAc,GAAiF;EACnG,MAAM,EAAE,SAAS,KAAK;EACtB,IAAI,CAAC,KAAK,QAAQ,GAChB,OAAO;GAAE,OAAO;GAAS,QAAQ;EAAQ;EAE3C,MAAM,KAAK,WAAW,CAAC;EACvB,MAAM,SAAS,KAAK,OAAO,CAAC;EAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAA8C,GACzF,GACF,EACF;EAEF,IAAI,CAAE,MAAM,KAAK,oBAAoB,GAAG,OAAO,KAAK,GAClD,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAa,SAAS;EAAwE,GACvG,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;;CAGA,MAAMC,gBAAgB,GAAkE;EACtF,MAAM,QAAQ,MAAM,KAAKD,cAAc,CAAC;EACxC,IAAI,cAAc,OAAO,OAAO;EAEhC,MAAM,aAAa,wBAAwB,WAAW,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;EACpG,IAAI,CAAC,WAAW,SACd,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG,EAAE;EAEjE,MAAM,EAAE,aAAa,KAAK;EAC1B,MAAM,SAAS,YAAY;EAE3B,IAAI,CAAC,MADiB,SAAS,IAAI;GAAE,OAAO,MAAM;GAAO,IAAI,WAAW,KAAK;EAAG,CAAC,GAE/E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG,EAAE;EAEjE,OAAO;GAAE,GAAG;GAAO,kBAAkB,WAAW,KAAK;EAAG;CAC1D;;;;;;;;;;;;CAaA,MAAME,YACJ,GACA,OACA,QACA,WACA,SACA,UACe;EACf,MAAM,KAAK,KAAK,MAAM,OAAO;GAC3B,gBAAgB,GAAG,OAAO,GAAG;GAC7B,OAAO,MAAM;GACb,SAAS;GACT,WAAW;GACX;GACA;GACA;GACA,kBAAkB,MAAM;GACxB,SAAS,oBAAoB,CAAC;EAChC,CAAC;CACH;CAEA,SAAqB;EACnB,MAAM,EAAE,WAAW,kBAAkB,KAAK;EAC1C,MAAM,WAAW,wBAAwB;EAEzC,OAAO,CACL,iBAAiB,SAAS,MAAM;GAC9B,QAAQ,SAAS;GACjB,SAAS,OAAM,MAAK;IAClB,MAAM,UAAU,MAAM,CAAC;IACvB,MAAM,WAAW,MAAM,KAAKD,gBAAgB,OAAO;IACnD,IAAI,cAAc,UAAU,OAAO,SAAS;IAE5C,MAAM,aAAa,SAAS,WAAW,UAAU;KAC/C,IAAI,EAAE,IAAI,MAAM,IAAI;KACpB,YAAY,EAAE,IAAI,MAAM,YAAY;IACtC,CAAC;IACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;IAE5E,MAAM,OAAO,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;IACrD,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IACzE,MAAM,SAAS,SAAS,WAAW,UAAU,IAAI;IACjD,IAAI,CAAC,OAAO,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;IACnF,MAAM,UAAU,OAAO;IAQvB,MAAM,OAAO,MAAM,UAAU,cAC3B,SAAS,OACT,SAAS,kBACR,WAAW,KAAgC,UAC9C;IACA,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;IAE9D,MAAM,iBAAiB,yBAAyB,QAAQ;IACxD,MAAM,WAAW;KACf,MAAM;KACN;KACA,MAAM,QAAQ;KACd,WAAW,QAAQ;KACnB,GAAI,QAAQ,cAAc,KAAA,IAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;IAC5E;IAEA,MAAM,sBAAM,IAAI,KAAK;IACrB,MAAM,SAAS,MAAM,UAAU,qBAAqB;KAClD,OAAO,SAAS;KAChB,kBAAkB,SAAS;KAC3B,YAAY,KAAK;KACjB,SAAS;MAAE,UAAU;MAAgB,aAAa;KAAqC;KACvF;KACA,kBAAkB,QAAQ;KAC1B,OAAO;MAAE,MAAM;MAAU,IAAI;KAAgC;KAC7D,SAAS,EAAE,QAAQ,WAAW;KAC9B,WAAW,CAAC,QAAQ;KACpB,aAAa,CAAC;KACd;IACF,CAAC;IAED,IAAI,OAAO,WAAW,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;IAIpF,MAAM,SAAU,OAAO,WAAW,UAAU;KAAE,QAAQ;KAAY,MAAM;IAAQ,IAAI,OAAO;IAM3F,MAAM,eAAe,OAAO,UAAU;IACtC,MAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO,KAAA;IAC7D,MAAM,UAAU,CAAC;KAAE,MAAM;KAAsB,IAAI,KAAK;KAAI,MAAM,KAAK;IAAM,CAAC;IAE9E,MAAM,gBAAgB;KACpB,WAAW,QAAQ;KACnB,MAAM,QAAQ;KACd,WAAW,QAAQ;KACnB,cAAc,OAAO;KACrB;KACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;IACzB;IAOA,IAAI,OAAO,WAAW,cAAc,CAAC,qBAAqB,QAAQ,KAAK,IAAI,QAAQ,GAAG;KACpF,MAAM,KAAKC,YAAY,SAAS,UAAU,wBAAwB,QAAQ,WAAW,SAAS;MAC5F,GAAG;MACH,cAAc;MACd,MAAM;KACR,CAAC;KACD,OAAO,EAAE,KACP;MACE,QAAQ;MACR,MAAM;MACN,WAAW,QAAQ;KACrB,GACA,GACF;IACF;IAEA,IAAI,iBAAiB,YAAY;KAC/B,MAAM,KAAKA,YAAY,SAAS,UAAU,sBAAsB,QAAQ,WAAW,SAAS,aAAa;KACzG,OAAO,EAAE,KACP;MAAE,QAAQ,OAAO,WAAW,aAAa,aAAa;MAAa,WAAW,QAAQ;KAAU,GAChG,OAAO,WAAW,aAAa,MAAM,GACvC;IACF;IAEA,MAAM,KAAKA,YAAY,SAAS,UAAU,wBAAwB,QAAQ,WAAW,SAAS,aAAa;IAC3G,OAAO,EAAE,KACP;KAAE,QAAQ;KAAY,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;KAAI,WAAW,QAAQ;IAAU,GAC9E,SAAS,UAAU,MAAM,GAC3B;GACF;EACF,CAAC,CACH;CACF;AACF;AAEA,SAAgB,yBAAyB,MAA2C;CAClF,OAAO,IAAI,oBAAoB,IAAI,CAAC,CAAC,OAAO;AAC9C"}