@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/projects.js

@@ -0,0 +1,919 @@
+import { redactCredentials } from "../environment/build.js";
+import { ensureSchedule, invalidCronMessage, readSchedule, scheduleIdFor } from "../environment/build-schedule.js";
+import { ACTIVE_RUN_BINDING_STAGES } from "../storage/domains/work-items/base.js";
+import { FACTORY_ROUTE_CONTRACTS } from "./contracts.js";
+import { Route } from "./route.js";
+import { registerApiRoute } from "@mastra/core/server";
+import { describeFactorySandbox, normalizeFactorySandboxSettings } from "@mastra/core/workspace";
+import { MastraError } from "@mastra/core/error";
+//#region src/routes/projects.ts
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_NAME_LENGTH = 200;
+const MAX_REPOSITORY_COMMAND_LENGTH = 2e3;
+const MAX_BRANCH_LENGTH = 255;
+const MAX_SANDBOX_PROVIDER_LENGTH = 100;
+const MAX_SANDBOX_WORKDIR_LENGTH = 1e3;
+const CONTROL_CHAR_RE = /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/;
+function loose(context) {
+	return context;
+}
+async function readJson(context) {
+	try {
+		return await context.req.json();
+	} catch {
+		return;
+	}
+}
+function parseConnectionInput(value) {
+	if (!value || typeof value !== "object") return null;
+	const input = value;
+	if (typeof input.integrationId !== "string" || !input.integrationId.trim()) return null;
+	if (typeof input.installationId !== "string" || !UUID_RE.test(input.installationId)) return null;
+	return {
+		integrationId: input.integrationId.trim(),
+		installationId: input.installationId
+	};
+}
+function parseOptionalString(value, { maxLength, nullable = false }) {
+	if (value === void 0) return void 0;
+	if (value === null) return nullable ? null : false;
+	if (typeof value !== "string") return false;
+	const normalized = value.trim();
+	if (!normalized) return nullable ? null : false;
+	if (normalized.length > maxLength || CONTROL_CHAR_RE.test(normalized)) return false;
+	return normalized;
+}
+function parseRepositoryLinkInput(value) {
+	if (!value || typeof value !== "object") return null;
+	const input = value;
+	const repositoryId = typeof input.repositoryId === "string" && UUID_RE.test(input.repositoryId) ? input.repositoryId : void 0;
+	const repositoryInput = input.repository;
+	let repository;
+	if (repositoryInput && typeof repositoryInput === "object") {
+		const candidate = repositoryInput;
+		const externalId = parseOptionalString(candidate.externalId, { maxLength: MAX_NAME_LENGTH });
+		const slug = parseOptionalString(candidate.slug, { maxLength: MAX_NAME_LENGTH });
+		if (typeof externalId !== "string" || typeof slug !== "string") return null;
+		repository = {
+			externalId,
+			slug
+		};
+	}
+	if (!repositoryId && !repository) return null;
+	const branch = parseOptionalString(input.branch, {
+		maxLength: MAX_BRANCH_LENGTH,
+		nullable: true
+	});
+	const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });
+	const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });
+	const setupCommand = parseOptionalString(input.setupCommand, {
+		maxLength: MAX_REPOSITORY_COMMAND_LENGTH,
+		nullable: true
+	});
+	const teardownCommand = parseOptionalString(input.teardownCommand, {
+		maxLength: MAX_REPOSITORY_COMMAND_LENGTH,
+		nullable: true
+	});
+	if (branch === false || typeof sandboxProvider !== "string" || typeof sandboxWorkdir !== "string" || setupCommand === false || teardownCommand === false) return null;
+	return {
+		...repositoryId ? { repositoryId } : {},
+		...repository ? { repository } : {},
+		branch: branch ?? null,
+		sandboxProvider,
+		sandboxWorkdir,
+		setupCommand: setupCommand ?? null,
+		teardownCommand: teardownCommand ?? null
+	};
+}
+function parseRepositoryUpdateInput(value) {
+	if (!value || typeof value !== "object") return null;
+	const input = value;
+	const patch = {};
+	const branch = parseOptionalString(input.branch, {
+		maxLength: MAX_BRANCH_LENGTH,
+		nullable: true
+	});
+	const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });
+	const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });
+	const setupCommand = parseOptionalString(input.setupCommand, {
+		maxLength: MAX_REPOSITORY_COMMAND_LENGTH,
+		nullable: true
+	});
+	const teardownCommand = parseOptionalString(input.teardownCommand, {
+		maxLength: MAX_REPOSITORY_COMMAND_LENGTH,
+		nullable: true
+	});
+	if (branch === false || sandboxProvider === false || sandboxProvider === null || sandboxWorkdir === false || sandboxWorkdir === null || setupCommand === false || teardownCommand === false) return null;
+	if (branch !== void 0) patch.branch = branch;
+	if (sandboxProvider !== void 0) patch.sandboxProvider = sandboxProvider;
+	if (sandboxWorkdir !== void 0) patch.sandboxWorkdir = sandboxWorkdir;
+	if (setupCommand !== void 0) patch.setupCommand = setupCommand;
+	if (teardownCommand !== void 0) patch.teardownCommand = teardownCommand;
+	return Object.keys(patch).length > 0 ? patch : null;
+}
+/** Provider output is shown to the user; strip any clone credential from it first. */
+function redactBuild(build) {
+	return {
+		...build,
+		...build.error !== void 0 ? { error: redactCredentials(build.error) } : {},
+		...build.logs ? { logs: build.logs.map(redactCredentials) } : {}
+	};
+}
+/** What the environment reports when the factory has no sandbox configured. */
+const NO_SANDBOX = {
+	provider: "none",
+	settingsSchema: {
+		type: "object",
+		properties: {},
+		additionalProperties: false
+	},
+	capabilities: {
+		template: false,
+		builds: {
+			available: false,
+			history: false
+		}
+	}
+};
+var ProjectRoutes = class extends Route {
+	#versionControlIntegrationIds;
+	#sandboxDescription;
+	#settingsSchema;
+	constructor(deps) {
+		super(deps);
+		this.#versionControlIntegrationIds = new Set(deps.versionControlIntegrationIds ?? []);
+	}
+	#describeSandbox() {
+		if (!this.deps.sandbox) return NO_SANDBOX;
+		this.#sandboxDescription ??= describeFactorySandbox(this.deps.sandbox);
+		return this.#sandboxDescription;
+	}
+	/**
+	* Merge a settings patch onto the stored document (null removes a key) and
+	* validate the result through the sandbox's schema. Returns the issues when
+	* the merged document is rejected.
+	*
+	* A stored key the current schema does not declare, or whose stored value it
+	* now rejects (a tightened range or choice list), is left over from another
+	* provider or an older schema. When the merged document fails validation, the
+	* merge retries without those keys so one stale value cannot lock every later
+	* update; keys the patch itself sets are never pruned.
+	*/
+	async #mergeSettings(stored, patch) {
+		const merged = { ...stored };
+		for (const [key, value] of Object.entries(patch)) if (value === null) delete merged[key];
+		else merged[key] = value;
+		this.#settingsSchema ??= normalizeFactorySandboxSettings(this.deps.sandbox);
+		const result = await this.#settingsSchema["~standard"].validate(merged);
+		if (!result.issues) return { merged: Object.keys(merged).length > 0 ? merged : null };
+		const declared = this.#describeSandbox().settingsSchema.properties ?? {};
+		const rejected = new Set(result.issues.map((issue) => {
+			const segment = issue.path?.[0];
+			return typeof segment === "object" && segment !== null ? segment.key : segment;
+		}));
+		const pruned = Object.fromEntries(Object.entries(merged).filter(([key]) => key in patch || Object.hasOwn(declared, key) && !rejected.has(key)));
+		if (Object.keys(pruned).length === Object.keys(merged).length) return { issues: result.issues };
+		if ((await this.#settingsSchema["~standard"].validate(pruned)).issues) return { issues: result.issues };
+		return { merged: Object.keys(pruned).length > 0 ? pruned : null };
+	}
+	async #projects() {
+		await this.deps.projects.ensureReady();
+		return this.deps.projects;
+	}
+	async #sourceControl() {
+		await this.deps.sourceControl.ensureReady();
+		return this.deps.sourceControl;
+	}
+	async #handles() {
+		const storage = await this.#sourceControl();
+		return [...this.#versionControlIntegrationIds].map((integrationId) => storage.forIntegration(integrationId));
+	}
+	async #project(orgId, id) {
+		return (await this.#projects()).get({
+			orgId,
+			id
+		});
+	}
+	async #findConnection({ orgId, projectId, id }) {
+		for (const handle of await this.#handles()) {
+			const connection = await handle.connections.get({
+				orgId,
+				id
+			});
+			if (connection?.factoryProjectId === projectId) return {
+				handle,
+				connection
+			};
+		}
+		return null;
+	}
+	async #findProjectRepository({ orgId, projectId, id }) {
+		for (const handle of await this.#handles()) {
+			const projectRepository = await handle.projectRepositories.get({
+				orgId,
+				id
+			});
+			if (!projectRepository) continue;
+			const connection = await handle.connections.get({
+				orgId,
+				id: projectRepository.connectionId
+			});
+			if (connection?.factoryProjectId === projectId) return {
+				handle,
+				connection,
+				projectRepository
+			};
+		}
+		return null;
+	}
+	async #repositoryPayload(handle, orgId, projectRepository) {
+		const repository = await handle.repositories.get({
+			orgId,
+			id: projectRepository.repositoryId
+		});
+		return {
+			...projectRepository,
+			repository
+		};
+	}
+	/** Every link of the project across every handle, with the handle that owns it, in position order. */
+	async #environmentLinks(orgId, projectId) {
+		const links = [];
+		for (const handle of await this.#handles()) for (const projectRepository of await handle.projectRepositories.listByProject({
+			orgId,
+			factoryProjectId: projectId
+		})) links.push({
+			handle,
+			projectRepository
+		});
+		return links.sort((a, b) => a.projectRepository.position - b.projectRepository.position || a.projectRepository.createdAt.getTime() - b.projectRepository.createdAt.getTime());
+	}
+	async #environmentPayload(orgId, project) {
+		const repositories = [];
+		for (const { handle, projectRepository } of await this.#environmentLinks(orgId, project.id)) {
+			const repository = await handle.repositories.get({
+				orgId,
+				id: projectRepository.repositoryId
+			});
+			repositories.push({
+				projectRepositoryId: projectRepository.id,
+				connectionId: projectRepository.connectionId,
+				repositoryId: projectRepository.repositoryId,
+				slug: repository?.slug ?? null,
+				defaultBranch: repository?.defaultBranch ?? null,
+				position: projectRepository.position,
+				inEnvironment: projectRepository.inEnvironment,
+				setupCommand: projectRepository.setupCommand,
+				teardownCommand: projectRepository.teardownCommand,
+				lastBuildStatus: projectRepository.lastBuildStatus,
+				lastBuildError: projectRepository.lastBuildError,
+				lastBuiltAt: projectRepository.lastBuiltAt
+			});
+		}
+		return { environment: {
+			sandbox: this.#describeSandbox(),
+			settings: project.sandboxSettings ?? {},
+			sandboxWorkingDirectory: project.sandboxWorkingDirectory,
+			workspaceSetupCommand: project.workspaceSetupCommand,
+			activeTemplateId: project.activeTemplateId,
+			activeTemplateHeads: project.activeTemplateHeads,
+			repositories,
+			...await this.#buildPayload(project)
+		} };
+	}
+	/**
+	* The build keys of the environment payload, present only when the
+	* sandbox can build. Reads the project row and the schedule row; never
+	* the provider (live status is the builds routes' job).
+	*/
+	async #buildPayload(project) {
+		const builds = this.deps.environmentBuilds;
+		if (!builds) return {};
+		const schedules = builds.scheduleAvailable ? builds.schedules() : void 0;
+		return {
+			buildTriggers: {
+				schedule: {
+					...schedules ? await readSchedule(schedules, project.id) : {
+						enabled: false,
+						cron: null,
+						timezone: null
+					},
+					scheduleAvailable: builds.scheduleAvailable
+				},
+				push: {
+					enabled: project.buildOnPushEnabled,
+					debounceMinutes: project.buildPushDebounceMinutes
+				}
+			},
+			build: project.lastBuildId ? {
+				buildId: project.lastBuildId,
+				attemptedAt: project.lastBuildAttemptedAt?.toISOString() ?? null
+			} : null
+		};
+	}
+	/** The builds capability behind the routes, or the 404 to answer with. */
+	#builds(context) {
+		const builds = this.deps.sandbox?.builds;
+		const runner = this.deps.environmentBuilds;
+		if (!builds || !runner) return { response: context.json({ error: "no_builds" }, 404) };
+		return {
+			builds,
+			runner
+		};
+	}
+	#buildRoutes() {
+		return [
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectEnvironmentBuild.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectEnvironmentBuild.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId)) return context.json({ error: "Project not found" }, 404);
+					const project = await this.#project(tenant.orgId, projectId);
+					if (!project) return context.json({ error: "Project not found" }, 404);
+					const capability = this.#builds(context);
+					if ("response" in capability) return capability.response;
+					const { heads: _heads, ...outcome } = await capability.runner.start(project.id, "manual");
+					return context.json(outcome);
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectEnvironmentBuilds.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectEnvironmentBuilds.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId)) return context.json({ error: "Project not found" }, 404);
+					const project = await this.#project(tenant.orgId, projectId);
+					if (!project) return context.json({ error: "Project not found" }, 404);
+					const capability = this.#builds(context);
+					if ("response" in capability) return capability.response;
+					if (!capability.builds.list) return context.json({ error: "no_history" }, 404);
+					const read = await capability.runner.readContext(project.id);
+					if (!read) return context.json({ error: "no_environment" }, 404);
+					const builds = await capability.builds.list(read.ctx, read.settings);
+					return context.json({ builds: builds.map(redactBuild) });
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectEnvironmentBuildGet.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectEnvironmentBuildGet.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId)) return context.json({ error: "Project not found" }, 404);
+					const project = await this.#project(tenant.orgId, projectId);
+					if (!project) return context.json({ error: "Project not found" }, 404);
+					const capability = this.#builds(context);
+					if ("response" in capability) return capability.response;
+					const buildId = context.req.param("buildId") ?? "";
+					if (!buildId) return context.json({ error: "Build not found" }, 404);
+					const read = await capability.runner.readContext(project.id);
+					if (!read) return context.json({ error: "no_environment" }, 404);
+					if (buildId !== project.lastBuildId) {
+						if (!(capability.builds.list ? await capability.builds.list(read.ctx, read.settings) : []).some((build) => build.buildId === buildId)) return context.json({ error: "Build not found" }, 404);
+					}
+					return context.json({ build: redactBuild(await capability.builds.get(read.ctx, read.settings, buildId)) });
+				}
+			})
+		];
+	}
+	/** Best effort: a deleted project's cron schedule must not keep firing. */
+	async #dropSchedule(projectId) {
+		const runner = this.deps.environmentBuilds;
+		if (!runner?.scheduleAvailable) return;
+		try {
+			await runner.schedules().delete(scheduleIdFor(projectId));
+		} catch (error) {
+			if (error instanceof MastraError && error.id === "SCHEDULES_NOT_FOUND") return;
+			console.warn("[factory] could not delete the environment build schedule of a deleted project:", error);
+		}
+	}
+	async #retireProjectRepositorySessions(handle, orgId, projectRepositoryId) {
+		if ((await handle.sessions.listByProjectRepository({ projectRepositoryId })).length === 0) return true;
+		if (!this.deps.sessionRetirement) return false;
+		await this.deps.sessionRetirement.retireProjectRepositorySessions({
+			sourceControl: handle,
+			...this.deps.workItems ? { workItems: this.deps.workItems } : {},
+			orgId,
+			projectRepositoryId
+		});
+		return true;
+	}
+	async #resolveTenant(context) {
+		await this.deps.auth.ensureUser(context);
+		const tenant = this.deps.auth.tenant(context);
+		if (!tenant) return { response: context.json({ error: "unauthorized" }, 401) };
+		if (!tenant.orgId) return { response: context.json({
+			error: "organization_required",
+			message: "Factory projects require an organization."
+		}, 403) };
+		return {
+			orgId: tenant.orgId,
+			userId: tenant.userId
+		};
+	}
+	routes() {
+		return [
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectList.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectList.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					return context.json({ projects: await (await this.#projects()).list({ orgId: tenant.orgId }) });
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectCreate.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectCreate.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const parsed = FACTORY_ROUTE_CONTRACTS.projectCreate.bodySchema.safeParse(await readJson(context));
+					if (!parsed.success) return context.json({ error: "invalid_project" }, 400);
+					const project = await (await this.#projects()).create({
+						orgId: tenant.orgId,
+						userId: tenant.userId,
+						input: parsed.data
+					});
+					return context.json({ project }, 201);
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectGet.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectGet.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const parsedPath = FACTORY_ROUTE_CONTRACTS.projectGet.pathSchema.safeParse({ id: context.req.param("id") });
+					if (!parsedPath.success) return context.json({ error: "Project not found" }, 404);
+					const { id } = parsedPath.data;
+					const project = await this.#project(tenant.orgId, id);
+					return project ? context.json({ project }) : context.json({ error: "Project not found" }, 404);
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectUpdate.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectUpdate.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const parsedPath = FACTORY_ROUTE_CONTRACTS.projectUpdate.pathSchema.safeParse({ id: context.req.param("id") });
+					if (!parsedPath.success) return context.json({ error: "Project not found" }, 404);
+					const parsedBody = FACTORY_ROUTE_CONTRACTS.projectUpdate.bodySchema.safeParse(await readJson(context));
+					if (!parsedBody.success) return context.json({ error: "invalid_project" }, 400);
+					if (parsedBody.data.modelScope !== void 0 && this.deps.auth.enabled() && !await this.deps.auth.isOrganizationAdmin(context, tenant.orgId)) return context.json({
+						error: "forbidden",
+						message: "Organization administrator access is required to change the model scope."
+					}, 403);
+					const project = await (await this.#projects()).update({
+						orgId: tenant.orgId,
+						id: parsedPath.data.id,
+						input: parsedBody.data
+					});
+					return project ? context.json({ project }) : context.json({ error: "Project not found" }, 404);
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectApplyDefaultModel.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectApplyDefaultModel.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					if (!await this.deps.auth.isOrganizationAdmin(context, tenant.orgId)) return context.json({
+						error: "forbidden",
+						message: "Organization administrator access is required to update running sessions."
+					}, 403);
+					const parsedPath = FACTORY_ROUTE_CONTRACTS.projectApplyDefaultModel.pathSchema.safeParse({ id: context.req.param("id") });
+					if (!parsedPath.success) return context.json({ error: "Project not found" }, 404);
+					const project = await this.#project(tenant.orgId, parsedPath.data.id);
+					if (!project) return context.json({ error: "Project not found" }, 404);
+					const modelId = project.defaultModelId;
+					if (!modelId) return context.json({
+						error: "default_model_not_set",
+						message: "Set a default model on the project first."
+					}, 400);
+					const { workItems, controller } = this.deps;
+					if (!workItems || !controller) return context.json({ error: "model_apply_unavailable" }, 503);
+					const bindings = (await workItems.listRunBindings(tenant.orgId, project.id)).filter((binding) => binding.status === "active");
+					const seen = /* @__PURE__ */ new Set();
+					const applied = [];
+					const skipped = [];
+					for (const binding of bindings) {
+						const key = `${binding.sessionId}:${binding.threadId}`;
+						if (seen.has(key)) continue;
+						seen.add(key);
+						const item = await workItems.get({
+							orgId: tenant.orgId,
+							id: binding.workItemId
+						});
+						if (!item || item.factoryProjectId !== project.id) {
+							skipped.push({
+								threadId: binding.threadId,
+								reason: "work-item-missing"
+							});
+							continue;
+						}
+						if (!ACTIVE_RUN_BINDING_STAGES.has(item.stages[0] ?? "")) {
+							skipped.push({
+								threadId: binding.threadId,
+								reason: "stage-inactive"
+							});
+							continue;
+						}
+						const session = await controller.getSessionByResource(binding.resourceId);
+						if (!session) {
+							skipped.push({
+								threadId: binding.threadId,
+								reason: "not-running"
+							});
+							continue;
+						}
+						if (!await session.thread.getById({ threadId: binding.threadId })) {
+							skipped.push({
+								threadId: binding.threadId,
+								reason: "thread-missing"
+							});
+							continue;
+						}
+						try {
+							await session.thread.setSettingOn({
+								threadId: binding.threadId,
+								key: "currentModelId",
+								value: modelId
+							});
+							applied.push(binding.threadId);
+						} catch (error) {
+							console.warn("[factory] apply-default-model failed for thread", binding.threadId, error);
+							skipped.push({
+								threadId: binding.threadId,
+								reason: "apply-failed"
+							});
+						}
+					}
+					return context.json({
+						modelId,
+						applied,
+						skipped
+					});
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectDelete.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectDelete.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const parsedPath = FACTORY_ROUTE_CONTRACTS.projectDelete.pathSchema.safeParse({ id: context.req.param("id") });
+					if (!parsedPath.success) return context.json({ error: "Project not found" }, 404);
+					const { id } = parsedPath.data;
+					if (!await this.#project(tenant.orgId, id)) return context.json({ error: "Project not found" }, 404);
+					for (const handle of await this.#handles()) for (const connection of await handle.connections.list({
+						orgId: tenant.orgId,
+						factoryProjectId: id
+					})) {
+						for (const projectRepository of await handle.projectRepositories.list({
+							orgId: tenant.orgId,
+							connectionId: connection.id
+						})) if (!await this.#retireProjectRepositorySessions(handle, tenant.orgId, projectRepository.id)) return context.json({ error: "session_retirement_unavailable" }, 409);
+						await handle.connections.delete({
+							orgId: tenant.orgId,
+							id: connection.id
+						});
+					}
+					await (await this.#projects()).delete({
+						orgId: tenant.orgId,
+						id
+					});
+					await this.#dropSchedule(id);
+					return context.body(null, 204);
+				}
+			}),
+			registerApiRoute("/web/factory/projects/:id/source-control-connections", {
+				method: "GET",
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId) || !await this.#project(tenant.orgId, projectId)) return context.json({ error: "Project not found" }, 404);
+					const connections = [];
+					for (const handle of await this.#handles()) for (const connection of await handle.connections.list({
+						orgId: tenant.orgId,
+						factoryProjectId: projectId
+					})) {
+						const installation = await handle.installations.get({
+							orgId: tenant.orgId,
+							id: connection.installationId
+						});
+						if (!installation) continue;
+						const links = await handle.projectRepositories.list({
+							orgId: tenant.orgId,
+							connectionId: connection.id
+						});
+						connections.push({
+							...connection,
+							installation,
+							repositories: await Promise.all(links.map((link) => this.#repositoryPayload(handle, tenant.orgId, link)))
+						});
+					}
+					return context.json({ connections });
+				}
+			}),
+			registerApiRoute("/web/factory/projects/:id/source-control-connections", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId) || !await this.#project(tenant.orgId, projectId)) return context.json({ error: "Project not found" }, 404);
+					const input = parseConnectionInput(await readJson(context));
+					if (!input) return context.json({ error: "invalid_source_control_connection" }, 400);
+					if (!this.#versionControlIntegrationIds.has(input.integrationId)) return context.json({ error: "Source-control integration not found" }, 404);
+					const handle = (await this.#sourceControl()).forIntegration(input.integrationId);
+					if (!await handle.installations.get({
+						orgId: tenant.orgId,
+						id: input.installationId
+					})) return context.json({ error: "Source-control installation not found" }, 404);
+					const connection = await handle.connections.create({
+						orgId: tenant.orgId,
+						factoryProjectId: projectId,
+						installationId: input.installationId,
+						createdByUserId: tenant.userId
+					});
+					return context.json({ connection }, 201);
+				}
+			}),
+			registerApiRoute("/web/factory/projects/:id/source-control-connections/:connectionId", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					const connectionId = context.req.param("connectionId");
+					if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId)) return context.json({ error: "Source-control connection not found" }, 404);
+					const found = await this.#findConnection({
+						orgId: tenant.orgId,
+						projectId,
+						id: connectionId
+					});
+					if (!found) return context.json({ error: "Source-control connection not found" }, 404);
+					for (const projectRepository of await found.handle.projectRepositories.list({
+						orgId: tenant.orgId,
+						connectionId
+					})) if (!await this.#retireProjectRepositorySessions(found.handle, tenant.orgId, projectRepository.id)) return context.json({ error: "session_retirement_unavailable" }, 409);
+					await found.handle.connections.delete({
+						orgId: tenant.orgId,
+						id: connectionId
+					});
+					return context.body(null, 204);
+				}
+			}),
+			registerApiRoute("/web/factory/projects/:id/source-control-connections/:connectionId/repositories", {
+				method: "POST",
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					const connectionId = context.req.param("connectionId");
+					if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId)) return context.json({ error: "Source-control connection not found" }, 404);
+					const found = await this.#findConnection({
+						orgId: tenant.orgId,
+						projectId,
+						id: connectionId
+					});
+					if (!found) return context.json({ error: "Source-control connection not found" }, 404);
+					const input = parseRepositoryLinkInput(await readJson(context));
+					if (!input) return context.json({ error: "invalid_project_repository" }, 400);
+					const repository = input.repositoryId ? await found.handle.repositories.get({
+						orgId: tenant.orgId,
+						id: input.repositoryId
+					}) : input.repository && this.deps.resolveRepository ? await this.deps.resolveRepository({
+						integrationId: found.connection.integrationId,
+						orgId: tenant.orgId,
+						userId: tenant.userId,
+						installationId: found.connection.installationId,
+						...input.repository
+					}) : null;
+					if (!repository || repository.installationId !== found.connection.installationId) return context.json({ error: "Source-control repository not found" }, 404);
+					const { repositoryId: _repositoryId, repository: _repository, ...linkInput } = input;
+					const projectRepository = await found.handle.projectRepositories.link({
+						orgId: tenant.orgId,
+						connectionId,
+						createdByUserId: tenant.userId,
+						repositoryId: repository.id,
+						...linkInput
+					});
+					try {
+						this.deps.onProjectRepositoryLinked?.({
+							orgId: tenant.orgId,
+							projectRepository
+						});
+					} catch (error) {
+						console.warn("[factory] onProjectRepositoryLinked failed after a successful repository link:", error);
+					}
+					return context.json({ projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository) }, 201);
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectEnvironmentGet.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectEnvironmentGet.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId)) return context.json({ error: "Project not found" }, 404);
+					const project = await this.#project(tenant.orgId, projectId);
+					if (!project) return context.json({ error: "Project not found" }, 404);
+					return context.json(await this.#environmentPayload(tenant.orgId, project));
+				}
+			}),
+			registerApiRoute(FACTORY_ROUTE_CONTRACTS.projectEnvironmentUpdate.path, {
+				method: FACTORY_ROUTE_CONTRACTS.projectEnvironmentUpdate.method,
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					if (!projectId || !UUID_RE.test(projectId)) return context.json({ error: "Project not found" }, 404);
+					const project = await this.#project(tenant.orgId, projectId);
+					if (!project) return context.json({ error: "Project not found" }, 404);
+					const parsed = FACTORY_ROUTE_CONTRACTS.projectEnvironmentUpdate.bodySchema.safeParse(await readJson(context));
+					if (!parsed.success) return context.json({ error: "invalid_environment" }, 400);
+					const { repositories: repositoryPatches, settings: settingsPatch, buildTriggers, ...projectInput } = parsed.data;
+					const input = projectInput;
+					const runner = this.deps.environmentBuilds;
+					if (buildTriggers !== void 0) {
+						if (!runner) return context.json({ error: "no_builds" }, 400);
+						if (buildTriggers.push?.enabled !== void 0) input.buildOnPushEnabled = buildTriggers.push.enabled;
+						if (buildTriggers.push?.debounceMinutes !== void 0) input.buildPushDebounceMinutes = buildTriggers.push.debounceMinutes;
+						if (buildTriggers.schedule) if (!runner.scheduleAvailable) {
+							if (buildTriggers.schedule.enabled) return context.json({ error: "schedules_unavailable" }, 400);
+						} else {
+							const { cron, timezone } = buildTriggers.schedule;
+							const stored = await readSchedule(runner.schedules(), project.id);
+							const nextCron = cron ?? stored.cron;
+							if (!nextCron && buildTriggers.schedule.enabled) return context.json({
+								error: "invalid_environment",
+								issues: [{
+									message: "cron is required",
+									path: [
+										"buildTriggers",
+										"schedule",
+										"cron"
+									]
+								}]
+							}, 400);
+							const nextTimezone = timezone ?? stored.timezone ?? void 0;
+							const message = nextCron ? invalidCronMessage(nextCron, nextTimezone) : void 0;
+							if (message) return context.json({
+								error: "invalid_environment",
+								issues: [{
+									message,
+									path: [
+										"buildTriggers",
+										"schedule",
+										"cron"
+									]
+								}]
+							}, 400);
+						}
+					}
+					if (settingsPatch !== void 0 && !this.deps.sandbox) return context.json({ error: "no_sandbox" }, 400);
+					let updated = project;
+					if (Object.keys(input).length > 0 || settingsPatch !== void 0 || repositoryPatches !== void 0) {
+						let issues;
+						let repositoryOutcome;
+						const sourceControl = await this.#sourceControl();
+						const result = await (await this.#projects()).update({
+							orgId: tenant.orgId,
+							id: projectId,
+							input: async (current, ops) => {
+								let sandboxSettings;
+								if (settingsPatch !== void 0) {
+									const settings = await this.#mergeSettings(current.sandboxSettings ?? {}, settingsPatch);
+									if ("issues" in settings) {
+										issues = settings.issues;
+										return null;
+									}
+									sandboxSettings = settings.merged;
+								}
+								if (repositoryPatches !== void 0) {
+									repositoryOutcome = await sourceControl.updateEnvironmentRepositories(ops, {
+										factoryProjectId: current.id,
+										integrationIds: [...this.#versionControlIntegrationIds],
+										patches: repositoryPatches
+									});
+									if (repositoryOutcome !== "updated") return null;
+								}
+								return {
+									...input,
+									...sandboxSettings !== void 0 ? { sandboxSettings } : {}
+								};
+							}
+						});
+						if (repositoryOutcome === "not_found") return context.json({ error: "Project repository not found" }, 404);
+						if (repositoryOutcome === "incomplete_reorder") return context.json({ error: "invalid_environment" }, 400);
+						if (issues) return context.json({
+							error: "invalid_environment",
+							issues: issues.map((issue) => ({
+								message: issue.message,
+								path: Array.isArray(issue.path) ? issue.path.map((segment) => typeof segment === "object" && segment !== null && "key" in segment ? segment.key : segment) : []
+							}))
+						}, 400);
+						if (!result) return context.json({ error: "Project not found" }, 404);
+						updated = result;
+					}
+					if (buildTriggers?.schedule && runner?.scheduleAvailable) {
+						const stored = await readSchedule(runner.schedules(), project.id);
+						const cron = buildTriggers.schedule.cron ?? stored.cron;
+						if (cron) await ensureSchedule(runner.schedules(), project.id, {
+							enabled: buildTriggers.schedule.enabled,
+							cron,
+							...buildTriggers.schedule.timezone ?? stored.timezone ? { timezone: buildTriggers.schedule.timezone ?? stored.timezone } : {}
+						});
+					}
+					return context.json(await this.#environmentPayload(tenant.orgId, updated));
+				}
+			}),
+			registerApiRoute("/web/factory/projects/:id/repositories/:projectRepositoryId", {
+				method: "PATCH",
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					const projectRepositoryId = context.req.param("projectRepositoryId");
+					if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId)) return context.json({ error: "Project repository not found" }, 404);
+					const found = await this.#findProjectRepository({
+						orgId: tenant.orgId,
+						projectId,
+						id: projectRepositoryId
+					});
+					if (!found) return context.json({ error: "Project repository not found" }, 404);
+					const input = parseRepositoryUpdateInput(await readJson(context));
+					if (!input) return context.json({ error: "invalid_project_repository" }, 400);
+					const projectRepository = await found.handle.projectRepositories.update({
+						orgId: tenant.orgId,
+						id: projectRepositoryId,
+						input
+					});
+					return context.json({ projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository) });
+				}
+			}),
+			registerApiRoute("/web/factory/projects/:id/repositories/:projectRepositoryId", {
+				method: "DELETE",
+				requiresAuth: false,
+				handler: async (routeContext) => {
+					const context = loose(routeContext);
+					const tenant = await this.#resolveTenant(context);
+					if ("response" in tenant) return tenant.response;
+					const projectId = context.req.param("id");
+					const projectRepositoryId = context.req.param("projectRepositoryId");
+					if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId)) return context.json({ error: "Project repository not found" }, 404);
+					const found = await this.#findProjectRepository({
+						orgId: tenant.orgId,
+						projectId,
+						id: projectRepositoryId
+					});
+					if (!found) return context.json({ error: "Project repository not found" }, 404);
+					if (!await this.#retireProjectRepositorySessions(found.handle, tenant.orgId, projectRepositoryId)) return context.json({ error: "session_retirement_unavailable" }, 409);
+					await found.handle.projectRepositories.unlink({
+						orgId: tenant.orgId,
+						id: projectRepositoryId
+					});
+					return context.body(null, 204);
+				}
+			}),
+			...this.#buildRoutes()
+		];
+	}
+};
+//#endregion
+export { ProjectRoutes };
+
+//# sourceMappingURL=projects.js.map