@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/routes/telemetry.js

@@ -0,0 +1,60 @@
+import { captureFactoryWebActivity, isFactoryTelemetryEnabled } from "../telemetry.js";
+import { Route } from "./route.js";
+import { FACTORY_WEB_PAGES } from "../telemetry-types.js";
+import { registerApiRoute } from "@mastra/core/server";
+import { z } from "zod";
+import { bodyLimit } from "hono/body-limit";
+//#region src/routes/telemetry.ts
+const activitySchema = z.object({
+	activity: z.enum(["page_view", "interaction"]),
+	page: z.enum(FACTORY_WEB_PAGES)
+}).strict();
+function localContext(context) {
+	return context;
+}
+var TelemetryRoutes = class extends Route {
+	budgets = /* @__PURE__ */ new Map();
+	routes() {
+		const limitBody = bodyLimit({ maxSize: 512 });
+		const origins = /* @__PURE__ */ new Set([this.deps.publicOrigin, ...this.deps.allowedOrigins]);
+		return [registerApiRoute("/web/telemetry/activity", {
+			method: "POST",
+			middleware: (context, next) => limitBody(localContext(context), next),
+			handler: async (context) => {
+				const c = localContext(context);
+				if (!this.deps.auth.enabled()) return c.body(null, 401);
+				await this.deps.auth.ensureUser(c);
+				const actor = this.deps.auth.tenant(c);
+				if (!actor?.userId) return c.body(null, 401);
+				const origin = c.req.header("Origin");
+				if (origin && !origins.has(origin)) return c.body(null, 403);
+				if (c.req.header("Content-Type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") return c.body(null, 415);
+				const parsed = activitySchema.safeParse(await c.req.json().catch(() => void 0));
+				if (!parsed.success) return c.body(null, 400);
+				if (!isFactoryTelemetryEnabled(this.deps.providerName)) return c.body(null, 204);
+				const key = JSON.stringify([actor.orgId, actor.userId]);
+				const now = Date.now();
+				const previous = this.budgets.get(key);
+				if (previous && previous.until > now) {
+					if (previous.count >= 60) return c.body(null, 204);
+					previous.count += 1;
+				} else {
+					if (this.budgets.size >= 1e4) {
+						for (const [id, budget] of this.budgets) if (budget.until <= now) this.budgets.delete(id);
+						if (this.budgets.size >= 1e4) return c.body(null, 204);
+					}
+					this.budgets.set(key, {
+						until: now + 6e4,
+						count: 1
+					});
+				}
+				captureFactoryWebActivity(parsed.data, actor);
+				return c.body(null, 204);
+			}
+		})];
+	}
+};
+//#endregion
+export { TelemetryRoutes };
+
+//# sourceMappingURL=telemetry.js.map

package/dist/routes/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","names":[],"sources":["../../src/routes/telemetry.ts"],"sourcesContent":["import { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\nimport { bodyLimit } from 'hono/body-limit';\nimport { z } from 'zod';\n\nimport { FACTORY_WEB_PAGES } from '../telemetry-types.js';\nimport { captureFactoryWebActivity, isFactoryTelemetryEnabled } from '../telemetry.js';\nimport { Route } from './route.js';\nimport type { RouteDependencies } from './route.js';\n\nconst activitySchema = z\n  .object({\n    activity: z.enum(['page_view', 'interaction']),\n    page: z.enum(FACTORY_WEB_PAGES),\n  })\n  .strict();\n\n// Core bundles Hono declarations, so the same runtime Context has distinct\n// nominal request types across the package boundary (as in other route modules).\nfunction localContext(context: unknown): Context {\n  return context as Context;\n}\n\ninterface TelemetryRoutesDeps extends RouteDependencies {\n  providerName?: string;\n  publicOrigin: string;\n  allowedOrigins: string[];\n}\n\nexport class TelemetryRoutes extends Route<TelemetryRoutesDeps> {\n  private readonly budgets = new Map<string, { until: number; count: number }>();\n\n  routes() {\n    const limitBody = bodyLimit({ maxSize: 512 });\n    const origins = new Set([this.deps.publicOrigin, ...this.deps.allowedOrigins]);\n    return [\n      registerApiRoute('/web/telemetry/activity', {\n        method: 'POST',\n        middleware: (context, next) => limitBody(localContext(context), next),\n        handler: async context => {\n          const c = localContext(context);\n          if (!this.deps.auth.enabled()) return c.body(null, 401);\n          await this.deps.auth.ensureUser(c);\n          const actor = this.deps.auth.tenant(c);\n          if (!actor?.userId) return c.body(null, 401);\n          const origin = c.req.header('Origin');\n          if (origin && !origins.has(origin)) return c.body(null, 403);\n          if (c.req.header('Content-Type')?.split(';')[0]?.trim().toLowerCase() !== 'application/json') {\n            return c.body(null, 415);\n          }\n          const parsed = activitySchema.safeParse(await c.req.json().catch(() => undefined));\n          if (!parsed.success) return c.body(null, 400);\n          if (!isFactoryTelemetryEnabled(this.deps.providerName)) return c.body(null, 204);\n\n          // Bound capture rate and memory per process; this is not a distributed\n          // quota or a promise of exactly-once delivery.\n          const key = JSON.stringify([actor.orgId, actor.userId]);\n          const now = Date.now();\n          const previous = this.budgets.get(key);\n          if (previous && previous.until > now) {\n            if (previous.count >= 60) return c.body(null, 204);\n            previous.count += 1;\n          } else {\n            if (this.budgets.size >= 10_000) {\n              for (const [id, budget] of this.budgets) {\n                if (budget.until <= now) this.budgets.delete(id);\n              }\n              if (this.budgets.size >= 10_000) return c.body(null, 204);\n            }\n            this.budgets.set(key, { until: now + 60_000, count: 1 });\n          }\n          captureFactoryWebActivity(parsed.data, actor);\n          return c.body(null, 204);\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;AAUA,MAAM,iBAAiB,EACpB,OAAO;CACN,UAAU,EAAE,KAAK,CAAC,aAAa,aAAa,CAAC;CAC7C,MAAM,EAAE,KAAK,iBAAiB;AAChC,CAAC,CAAC,CACD,OAAO;AAIV,SAAS,aAAa,SAA2B;CAC/C,OAAO;AACT;AAQA,IAAa,kBAAb,cAAqC,MAA2B;CAC9D,0BAA2B,IAAI,IAA8C;CAE7E,SAAS;EACP,MAAM,YAAY,UAAU,EAAE,SAAS,IAAI,CAAC;EAC5C,MAAM,0BAAU,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,GAAG,KAAK,KAAK,cAAc,CAAC;EAC7E,OAAO,CACL,iBAAiB,2BAA2B;GAC1C,QAAQ;GACR,aAAa,SAAS,SAAS,UAAU,aAAa,OAAO,GAAG,IAAI;GACpE,SAAS,OAAM,YAAW;IACxB,MAAM,IAAI,aAAa,OAAO;IAC9B,IAAI,CAAC,KAAK,KAAK,KAAK,QAAQ,GAAG,OAAO,EAAE,KAAK,MAAM,GAAG;IACtD,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;IACjC,MAAM,QAAQ,KAAK,KAAK,KAAK,OAAO,CAAC;IACrC,IAAI,CAAC,OAAO,QAAQ,OAAO,EAAE,KAAK,MAAM,GAAG;IAC3C,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ;IACpC,IAAI,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG,OAAO,EAAE,KAAK,MAAM,GAAG;IAC3D,IAAI,EAAE,IAAI,OAAO,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM,oBACxE,OAAO,EAAE,KAAK,MAAM,GAAG;IAEzB,MAAM,SAAS,eAAe,UAAU,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC;IACjF,IAAI,CAAC,OAAO,SAAS,OAAO,EAAE,KAAK,MAAM,GAAG;IAC5C,IAAI,CAAC,0BAA0B,KAAK,KAAK,YAAY,GAAG,OAAO,EAAE,KAAK,MAAM,GAAG;IAI/E,MAAM,MAAM,KAAK,UAAU,CAAC,MAAM,OAAO,MAAM,MAAM,CAAC;IACtD,MAAM,MAAM,KAAK,IAAI;IACrB,MAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;IACrC,IAAI,YAAY,SAAS,QAAQ,KAAK;KACpC,IAAI,SAAS,SAAS,IAAI,OAAO,EAAE,KAAK,MAAM,GAAG;KACjD,SAAS,SAAS;IACpB,OAAO;KACL,IAAI,KAAK,QAAQ,QAAQ,KAAQ;MAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,KAAK,SAC9B,IAAI,OAAO,SAAS,KAAK,KAAK,QAAQ,OAAO,EAAE;MAEjD,IAAI,KAAK,QAAQ,QAAQ,KAAQ,OAAO,EAAE,KAAK,MAAM,GAAG;KAC1D;KACA,KAAK,QAAQ,IAAI,KAAK;MAAE,OAAO,MAAM;MAAQ,OAAO;KAAE,CAAC;IACzD;IACA,0BAA0B,OAAO,MAAM,KAAK;IAC5C,OAAO,EAAE,KAAK,MAAM,GAAG;GACzB;EACF,CAAC,CACH;CACF;AACF"}

package/dist/routes/tenant-credentials.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Per-tenant credential store for model resolution (deployed mode).
+ *
+ * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a
+ * store synchronously, so this module keeps a small per-tenant **snapshot** of
+ * credentials from one exclusive scope hydrated from the `model-credentials`
+ * domain. The snapshot serves the gateway's synchronous
+ * path-selection reads (`get` / `getStoredApiKey`); the fetch-time
+ * `getApiKey` is authoritative — it re-resolves against the domain and
+ * refreshes expired OAuth tokens under the domain's row lock, so a slightly
+ * stale snapshot can never send an expired token upstream.
+ *
+ * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted
+ * after the web auth gate) so the first model call of a request already sees
+ * the caller's credentials. This store explicitly disables the SDK's
+ * environment fallback so server-shell credentials never leak into tenants.
+ */
+import type { CredentialTenant as SdkCredentialTenant, CredentialTenantResolver } from '@mastra/code-sdk/agents/credential-resolver';
+import type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';
+import type { RequestContext } from '@mastra/core/request-context';
+import type { MiddlewareHandler } from 'hono';
+import type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import type { RouteAuth } from './route.js';
+export declare class TenantCredentialStore implements CredentialStore {
+    #private;
+    readonly allowEnvironmentFallback = false;
+    constructor(orgId: string, userId: string, credentials: ModelCredentialsStorage | undefined, scope: SdkCredentialTenant['credentialScope'], deploymentProviders?: ReadonlySet<string>);
+    /** Providers the operator opted in to run on the server process's own credentials. */
+    allowsDeploymentCredentials(provider: string): boolean;
+    /** Hydrate the snapshot when stale; coalesces concurrent callers. */
+    ensureFresh(now?: number): Promise<void>;
+    /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+    reload(): void;
+    get(provider: string): AuthCredential | undefined;
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Authoritative fetch-time resolution: re-reads only the selected scope and
+     * refreshes expired OAuth tokens under the domain's row lock. Mirrors
+     * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or
+     * failed refresh (caller surfaces a re-login error).
+     */
+    getApiKey(provider: string): Promise<string | undefined>;
+}
+/**
+ * Register the web tenant credential store provider with the SDK. Called by
+ * the factory after storage init with the `model-credentials` domain handle;
+ * from then on `resolveModel` uses per-tenant credentials and the SDK skips
+ * the `loadStoredApiKeysIntoEnv` env side-channel. `deploymentProviders` are
+ * the providers the operator opted in to authenticate with the server
+ * process's own credentials (see `MastraFactoryConfig.deploymentModelProviders`).
+ */
+export declare function registerTenantCredentialResolver(credentials: ModelCredentialsStorage, deploymentProviders?: ReadonlySet<string>, resolveTenant?: CredentialTenantResolver): void;
+/**
+ * Prime the tenant stores for a request context built outside the web layer,
+ * such as a webhook-triggered session run. The auth middleware does this for
+ * HTTP requests; a run that starts without one would otherwise resolve its
+ * model against an empty snapshot and fail closed. No-op before registration.
+ */
+export declare function primeTenantCredentialsForRequestContext(requestContext: RequestContext): Promise<void>;
+/** Prime one already-resolved Factory session tenant before entering the agent run. */
+export declare function primeTenantCredentialsForTenant(tenant: SdkCredentialTenant): Promise<void>;
+/** Test hook: clear registration and cached tenant snapshots. */
+export declare function resetTenantCredentialResolverForTests(): void;
+/**
+ * Drop cached snapshots after a credential write so the change is visible to
+ * the next model call immediately instead of after the snapshot TTL. An org
+ * write affects every member's resolved view, so all stores under the org are
+ * invalidated; a user write only drops that user's store.
+ */
+export declare function invalidateTenantCredentialSnapshots(tenant: {
+    orgId: string;
+    userId?: string;
+}): void;
+/**
+ * Middleware mounted after the web auth gate: primes both exclusive credential
+ * scopes because the HTTP principal is known before the controller session is.
+ * Cheap when fresh because each store has a TTL.
+ */
+export declare function primeTenantCredentials({ tenant, credentials, }: {
+    tenant: Pick<SdkCredentialTenant, 'orgId' | 'userId'> & Partial<Pick<SdkCredentialTenant, 'credentialScope'>>;
+    credentials: ModelCredentialsStorage;
+}): Promise<void>;
+export declare function createTenantCredentialPrimer({ auth, credentials, }: {
+    auth: RouteAuth;
+    credentials: ModelCredentialsStorage;
+}): MiddlewareHandler;
+//# sourceMappingURL=tenant-credentials.d.ts.map

package/dist/routes/tenant-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/tenant-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,gBAAgB,IAAI,mBAAmB,EACvC,wBAAwB,EACzB,MAAM,6CAA6C,CAAC;AAOrD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,qBAAa,qBAAsB,YAAW,eAAe;;IAC3D,QAAQ,CAAC,wBAAwB,SAAS;gBAWxC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,uBAAuB,GAAG,SAAS,EAChD,KAAK,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,EAC7C,mBAAmB,GAAE,WAAW,CAAC,MAAM,CAAa;IAStD,sFAAsF;IACtF,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAItD,qEAAqE;IAC/D,WAAW,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBlD,kFAAkF;IAClF,MAAM,IAAI,IAAI;IAMd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAoD/D;AA2BD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,uBAAuB,EACpC,mBAAmB,GAAE,WAAW,CAAC,MAAM,CAAa,EACpD,aAAa,CAAC,EAAE,wBAAwB,GACvC,IAAI,CAcN;AAED;;;;;GAKG;AACH,wBAAsB,uCAAuC,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3G;AAED,uFAAuF;AACvF,wBAAsB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhG;AAED,iEAAiE;AACjE,wBAAgB,qCAAqC,IAAI,IAAI,CAK5D;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASpG;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,MAAM,EACN,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9G,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,iBAAiB,CAgBpB"}

package/dist/routes/tenant-credentials.js

@@ -0,0 +1,219 @@
+import { isOAuthCredentialExpired } from "../storage/domains/credentials/base.js";
+import { getTenantCredentialsStorage, tenantOrgId } from "./provider-credentials.js";
+import { prepareCredentialTenant, resolveTenantFromRequestContext, setCredentialStoreProvider } from "@mastra/code-sdk/agents/credential-resolver";
+import { getOAuthProvider } from "@mastra/code-sdk/auth/storage";
+//#region src/routes/tenant-credentials.ts
+/** How long a hydrated snapshot is considered fresh. */
+const SNAPSHOT_TTL_MS = 15e3;
+/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */
+const MAX_CACHED_TENANTS = 1e3;
+var TenantCredentialStore = class {
+	allowEnvironmentFallback = false;
+	#orgId;
+	#userId;
+	#scope;
+	#credentials;
+	#deploymentProviders;
+	#snapshot = /* @__PURE__ */ new Map();
+	#fetchedAt = 0;
+	#hydrating;
+	constructor(orgId, userId, credentials, scope, deploymentProviders = /* @__PURE__ */ new Set()) {
+		this.#orgId = orgId;
+		this.#userId = userId;
+		this.#credentials = credentials;
+		this.#scope = scope;
+		this.#deploymentProviders = deploymentProviders;
+	}
+	/** Providers the operator opted in to run on the server process's own credentials. */
+	allowsDeploymentCredentials(provider) {
+		return this.#deploymentProviders.has(provider);
+	}
+	/** Hydrate the snapshot when stale; coalesces concurrent callers. */
+	async ensureFresh(now = Date.now()) {
+		if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+		this.#hydrating ??= this.#hydrate().finally(() => {
+			this.#hydrating = void 0;
+		});
+		await this.#hydrating;
+	}
+	async #hydrate() {
+		const storage = await getTenantCredentialsStorage(this.#credentials);
+		if (!storage) return;
+		const records = await storage.listCredentials(this.#orgId, this.#userId);
+		const next = /* @__PURE__ */ new Map();
+		const storageScope = this.#scope === "factory" ? "org" : "user";
+		for (const record of records.filter((r) => r.scope === storageScope)) next.set(record.provider, record.credential);
+		this.#snapshot = next;
+		this.#fetchedAt = Date.now();
+	}
+	/** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+	reload() {
+		if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) this.ensureFresh().catch(() => {});
+	}
+	get(provider) {
+		return this.#snapshot.get(provider);
+	}
+	getStoredApiKey(provider) {
+		const cred = this.#snapshot.get(provider);
+		return cred?.type === "api_key" ? cred.key : void 0;
+	}
+	/**
+	* Authoritative fetch-time resolution: re-reads only the selected scope and
+	* refreshes expired OAuth tokens under the domain's row lock. Mirrors
+	* `AuthStorage.getApiKey` semantics: `undefined` on missing credential or
+	* failed refresh (caller surfaces a re-login error).
+	*/
+	async getApiKey(provider) {
+		const storage = await getTenantCredentialsStorage(this.#credentials);
+		if (!storage) {
+			const cred = this.#snapshot.get(provider);
+			if (cred?.type === "api_key") return cred.key;
+			if (cred?.type === "oauth" && !isOAuthCredentialExpired(cred)) return getOAuthProvider(provider)?.getApiKey(cred);
+			return;
+		}
+		const resolved = await storage.resolveCredential(this.#orgId, this.#userId, provider, this.#scope === "factory" ? "org" : "user");
+		if (!resolved) {
+			this.#snapshot.delete(provider);
+			return;
+		}
+		this.#snapshot.set(provider, resolved.credential);
+		if (resolved.credential.type === "api_key") return resolved.credential.key;
+		const oauthProvider = getOAuthProvider(provider);
+		if (!oauthProvider) return void 0;
+		if (!isOAuthCredentialExpired(resolved.credential)) return oauthProvider.getApiKey(resolved.credential);
+		const rowTenant = resolved.scope === "user" ? {
+			orgId: this.#orgId,
+			userId: this.#userId
+		} : { orgId: this.#orgId };
+		try {
+			const refreshed = await storage.refreshOAuth(rowTenant, provider, async (current) => ({
+				type: "oauth",
+				...await oauthProvider.refreshToken(current)
+			}));
+			if (!refreshed) return void 0;
+			this.#snapshot.set(provider, refreshed);
+			return oauthProvider.getApiKey(refreshed);
+		} catch {
+			return;
+		}
+	}
+};
+const tenantStores = /* @__PURE__ */ new Map();
+let registeredCredentials;
+let registeredDeploymentProviders = /* @__PURE__ */ new Set();
+function storeFor(tenant, credentials) {
+	const orgId = tenantOrgId(tenant);
+	const key = `${orgId}\u0000${tenant.userId}\u0000${tenant.credentialScope}`;
+	let store = tenantStores.get(key);
+	if (!store) {
+		if (tenantStores.size >= MAX_CACHED_TENANTS) {
+			const oldest = tenantStores.keys().next().value;
+			if (oldest !== void 0) tenantStores.delete(oldest);
+		}
+		store = new TenantCredentialStore(orgId, tenant.userId, credentials, tenant.credentialScope, registeredDeploymentProviders);
+		tenantStores.set(key, store);
+	}
+	return store;
+}
+/**
+* Register the web tenant credential store provider with the SDK. Called by
+* the factory after storage init with the `model-credentials` domain handle;
+* from then on `resolveModel` uses per-tenant credentials and the SDK skips
+* the `loadStoredApiKeysIntoEnv` env side-channel. `deploymentProviders` are
+* the providers the operator opted in to authenticate with the server
+* process's own credentials (see `MastraFactoryConfig.deploymentModelProviders`).
+*/
+function registerTenantCredentialResolver(credentials, deploymentProviders = /* @__PURE__ */ new Set(), resolveTenant) {
+	registeredCredentials = credentials;
+	registeredDeploymentProviders = deploymentProviders;
+	tenantStores.clear();
+	setCredentialStoreProvider((tenant) => storeFor(tenant, credentials), resolveTenant ? async (requestContext) => {
+		const tenant = await resolveTenant(requestContext);
+		if (tenant) await storeFor(tenant, credentials).ensureFresh();
+		return tenant;
+	} : void 0);
+}
+/**
+* Prime the tenant stores for a request context built outside the web layer,
+* such as a webhook-triggered session run. The auth middleware does this for
+* HTTP requests; a run that starts without one would otherwise resolve its
+* model against an empty snapshot and fail closed. No-op before registration.
+*/
+async function primeTenantCredentialsForRequestContext(requestContext) {
+	if (!registeredCredentials) return;
+	await prepareCredentialTenant(requestContext);
+	const tenant = resolveTenantFromRequestContext(requestContext);
+	if (!tenant) return;
+	await storeFor(tenant, registeredCredentials).ensureFresh();
+}
+/** Prime one already-resolved Factory session tenant before entering the agent run. */
+async function primeTenantCredentialsForTenant(tenant) {
+	if (!registeredCredentials) return;
+	try {
+		await storeFor(tenant, registeredCredentials).ensureFresh();
+	} catch (error) {
+		console.warn("[factory] Failed to prime scoped tenant model credentials", {
+			orgId: tenant.orgId,
+			userId: tenant.userId,
+			credentialScope: tenant.credentialScope,
+			error
+		});
+	}
+}
+/** Test hook: clear registration and cached tenant snapshots. */
+function resetTenantCredentialResolverForTests() {
+	setCredentialStoreProvider(void 0);
+	registeredCredentials = void 0;
+	registeredDeploymentProviders = /* @__PURE__ */ new Set();
+	tenantStores.clear();
+}
+/**
+* Drop cached snapshots after a credential write so the change is visible to
+* the next model call immediately instead of after the snapshot TTL. An org
+* write affects every member's resolved view, so all stores under the org are
+* invalidated; a user write only drops that user's store.
+*/
+function invalidateTenantCredentialSnapshots(tenant) {
+	if (tenant.userId) {
+		tenantStores.delete(`${tenant.orgId}\u0000${tenant.userId}\u0000user`);
+		tenantStores.delete(`${tenant.orgId}\u0000${tenant.userId}\u0000factory`);
+		return;
+	}
+	for (const key of tenantStores.keys()) if (key.startsWith(`${tenant.orgId}\u0000`)) tenantStores.delete(key);
+}
+/**
+* Middleware mounted after the web auth gate: primes both exclusive credential
+* scopes because the HTTP principal is known before the controller session is.
+* Cheap when fresh because each store has a TTL.
+*/
+async function primeTenantCredentials({ tenant, credentials }) {
+	await Promise.all([storeFor({
+		...tenant,
+		credentialScope: "user"
+	}, credentials).ensureFresh(), storeFor({
+		...tenant,
+		credentialScope: "factory"
+	}, credentials).ensureFresh()]);
+}
+function createTenantCredentialPrimer({ auth, credentials }) {
+	return async (c, next) => {
+		const tenant = auth.tenant(c);
+		if (tenant) try {
+			await primeTenantCredentials({
+				tenant,
+				credentials
+			});
+		} catch (error) {
+			console.warn("[factory] Failed to prime tenant model credentials", {
+				orgId: tenant.orgId,
+				userId: tenant.userId,
+				error
+			});
+		}
+		await next();
+	};
+}
+//#endregion
+export { TenantCredentialStore, createTenantCredentialPrimer, invalidateTenantCredentialSnapshots, primeTenantCredentials, primeTenantCredentialsForRequestContext, primeTenantCredentialsForTenant, registerTenantCredentialResolver, resetTenantCredentialResolverForTests };
+
+//# sourceMappingURL=tenant-credentials.js.map

package/dist/routes/tenant-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-credentials.js","names":["#orgId","#userId","#scope","#credentials","#deploymentProviders","#fetchedAt","#hydrating","#hydrate","#snapshot"],"sources":["../../src/routes/tenant-credentials.ts"],"sourcesContent":["/**\n * Per-tenant credential store for model resolution (deployed mode).\n *\n * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a\n * store synchronously, so this module keeps a small per-tenant **snapshot** of\n * credentials from one exclusive scope hydrated from the `model-credentials`\n * domain. The snapshot serves the gateway's synchronous\n * path-selection reads (`get` / `getStoredApiKey`); the fetch-time\n * `getApiKey` is authoritative — it re-resolves against the domain and\n * refreshes expired OAuth tokens under the domain's row lock, so a slightly\n * stale snapshot can never send an expired token upstream.\n *\n * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted\n * after the web auth gate) so the first model call of a request already sees\n * the caller's credentials. This store explicitly disables the SDK's\n * environment fallback so server-shell credentials never leak into tenants.\n */\n\nimport type {\n  CredentialTenant as SdkCredentialTenant,\n  CredentialTenantResolver,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport {\n  prepareCredentialTenant,\n  resolveTenantFromRequestContext,\n  setCredentialStoreProvider,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport { getOAuthProvider } from '@mastra/code-sdk/auth/storage';\nimport type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MiddlewareHandler } from 'hono';\n\nimport { isOAuthCredentialExpired } from '../storage/domains/credentials/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport { getTenantCredentialsStorage, tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_TENANTS = 1000;\n\nexport class TenantCredentialStore implements CredentialStore {\n  readonly allowEnvironmentFallback = false;\n  readonly #orgId: string;\n  readonly #userId: string;\n  readonly #scope: SdkCredentialTenant['credentialScope'];\n  readonly #credentials: ModelCredentialsStorage | undefined;\n  readonly #deploymentProviders: ReadonlySet<string>;\n  #snapshot = new Map<string, AuthCredential>();\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(\n    orgId: string,\n    userId: string,\n    credentials: ModelCredentialsStorage | undefined,\n    scope: SdkCredentialTenant['credentialScope'],\n    deploymentProviders: ReadonlySet<string> = new Set(),\n  ) {\n    this.#orgId = orgId;\n    this.#userId = userId;\n    this.#credentials = credentials;\n    this.#scope = scope;\n    this.#deploymentProviders = deploymentProviders;\n  }\n\n  /** Providers the operator opted in to run on the server process's own credentials. */\n  allowsDeploymentCredentials(provider: string): boolean {\n    return this.#deploymentProviders.has(provider);\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) return; // Keep the last tenant-scoped snapshot.\n    const records = await storage.listCredentials(this.#orgId, this.#userId);\n    const next = new Map<string, AuthCredential>();\n    const storageScope = this.#scope === 'factory' ? 'org' : 'user';\n    for (const record of records.filter(r => r.scope === storageScope)) {\n      next.set(record.provider, record.credential);\n    }\n    this.#snapshot = next;\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  reload(): void {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n  }\n\n  get(provider: string): AuthCredential | undefined {\n    return this.#snapshot.get(provider);\n  }\n\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.#snapshot.get(provider);\n    return cred?.type === 'api_key' ? cred.key : undefined;\n  }\n\n  /**\n   * Authoritative fetch-time resolution: re-reads only the selected scope and\n   * refreshes expired OAuth tokens under the domain's row lock. Mirrors\n   * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or\n   * failed refresh (caller surfaces a re-login error).\n   */\n  async getApiKey(provider: string): Promise<string | undefined> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) {\n      // Domain unavailable: best effort from the snapshot; expired OAuth\n      // tokens cannot be refreshed without the domain's lock.\n      const cred = this.#snapshot.get(provider);\n      if (cred?.type === 'api_key') return cred.key;\n      if (cred?.type === 'oauth' && !isOAuthCredentialExpired(cred)) {\n        return getOAuthProvider(provider)?.getApiKey(cred);\n      }\n      return undefined;\n    }\n\n    const resolved = await storage.resolveCredential(\n      this.#orgId,\n      this.#userId,\n      provider,\n      this.#scope === 'factory' ? 'org' : 'user',\n    );\n    if (!resolved) {\n      this.#snapshot.delete(provider);\n      return undefined;\n    }\n    this.#snapshot.set(provider, resolved.credential);\n\n    if (resolved.credential.type === 'api_key') {\n      return resolved.credential.key;\n    }\n\n    const oauthProvider = getOAuthProvider(provider);\n    if (!oauthProvider) return undefined;\n\n    if (!isOAuthCredentialExpired(resolved.credential)) {\n      return oauthProvider.getApiKey(resolved.credential);\n    }\n\n    // Refresh at the scope the credential actually lives at (OAuth rows are\n    // user-scoped by policy, but resolve defensively from the record).\n    const rowTenant = resolved.scope === 'user' ? { orgId: this.#orgId, userId: this.#userId } : { orgId: this.#orgId };\n    try {\n      const refreshed = await storage.refreshOAuth(rowTenant, provider, async current => ({\n        type: 'oauth' as const,\n        ...(await oauthProvider.refreshToken(current)),\n      }));\n      if (!refreshed) return undefined;\n      this.#snapshot.set(provider, refreshed);\n      return oauthProvider.getApiKey(refreshed);\n    } catch {\n      // Refresh failed — user needs to re-login (same posture as AuthStorage).\n      return undefined;\n    }\n  }\n}\n\nconst tenantStores = new Map<string, TenantCredentialStore>();\nlet registeredCredentials: ModelCredentialsStorage | undefined;\nlet registeredDeploymentProviders: ReadonlySet<string> = new Set();\n\nfunction storeFor(tenant: SdkCredentialTenant, credentials: ModelCredentialsStorage): TenantCredentialStore {\n  const orgId = tenantOrgId(tenant);\n  const key = `${orgId}\\u0000${tenant.userId}\\u0000${tenant.credentialScope}`;\n  let store = tenantStores.get(key);\n  if (!store) {\n    if (tenantStores.size >= MAX_CACHED_TENANTS) {\n      const oldest = tenantStores.keys().next().value;\n      if (oldest !== undefined) tenantStores.delete(oldest);\n    }\n    store = new TenantCredentialStore(\n      orgId,\n      tenant.userId,\n      credentials,\n      tenant.credentialScope,\n      registeredDeploymentProviders,\n    );\n    tenantStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Register the web tenant credential store provider with the SDK. Called by\n * the factory after storage init with the `model-credentials` domain handle;\n * from then on `resolveModel` uses per-tenant credentials and the SDK skips\n * the `loadStoredApiKeysIntoEnv` env side-channel. `deploymentProviders` are\n * the providers the operator opted in to authenticate with the server\n * process's own credentials (see `MastraFactoryConfig.deploymentModelProviders`).\n */\nexport function registerTenantCredentialResolver(\n  credentials: ModelCredentialsStorage,\n  deploymentProviders: ReadonlySet<string> = new Set(),\n  resolveTenant?: CredentialTenantResolver,\n): void {\n  registeredCredentials = credentials;\n  registeredDeploymentProviders = deploymentProviders;\n  tenantStores.clear();\n  setCredentialStoreProvider(\n    tenant => storeFor(tenant, credentials),\n    resolveTenant\n      ? async requestContext => {\n          const tenant = await resolveTenant(requestContext);\n          if (tenant) await storeFor(tenant, credentials).ensureFresh();\n          return tenant;\n        }\n      : undefined,\n  );\n}\n\n/**\n * Prime the tenant stores for a request context built outside the web layer,\n * such as a webhook-triggered session run. The auth middleware does this for\n * HTTP requests; a run that starts without one would otherwise resolve its\n * model against an empty snapshot and fail closed. No-op before registration.\n */\nexport async function primeTenantCredentialsForRequestContext(requestContext: RequestContext): Promise<void> {\n  if (!registeredCredentials) return;\n  await prepareCredentialTenant(requestContext);\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) return;\n  await storeFor(tenant, registeredCredentials).ensureFresh();\n}\n\n/** Prime one already-resolved Factory session tenant before entering the agent run. */\nexport async function primeTenantCredentialsForTenant(tenant: SdkCredentialTenant): Promise<void> {\n  if (!registeredCredentials) return;\n  try {\n    await storeFor(tenant, registeredCredentials).ensureFresh();\n  } catch (error) {\n    console.warn('[factory] Failed to prime scoped tenant model credentials', {\n      orgId: tenant.orgId,\n      userId: tenant.userId,\n      credentialScope: tenant.credentialScope,\n      error,\n    });\n  }\n}\n\n/** Test hook: clear registration and cached tenant snapshots. */\nexport function resetTenantCredentialResolverForTests(): void {\n  setCredentialStoreProvider(undefined);\n  registeredCredentials = undefined;\n  registeredDeploymentProviders = new Set();\n  tenantStores.clear();\n}\n\n/**\n * Drop cached snapshots after a credential write so the change is visible to\n * the next model call immediately instead of after the snapshot TTL. An org\n * write affects every member's resolved view, so all stores under the org are\n * invalidated; a user write only drops that user's store.\n */\nexport function invalidateTenantCredentialSnapshots(tenant: { orgId: string; userId?: string }): void {\n  if (tenant.userId) {\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}\\u0000user`);\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}\\u0000factory`);\n    return;\n  }\n  for (const key of tenantStores.keys()) {\n    if (key.startsWith(`${tenant.orgId}\\u0000`)) tenantStores.delete(key);\n  }\n}\n\n/**\n * Middleware mounted after the web auth gate: primes both exclusive credential\n * scopes because the HTTP principal is known before the controller session is.\n * Cheap when fresh because each store has a TTL.\n */\nexport async function primeTenantCredentials({\n  tenant,\n  credentials,\n}: {\n  tenant: Pick<SdkCredentialTenant, 'orgId' | 'userId'> & Partial<Pick<SdkCredentialTenant, 'credentialScope'>>;\n  credentials: ModelCredentialsStorage;\n}): Promise<void> {\n  await Promise.all([\n    storeFor({ ...tenant, credentialScope: 'user' }, credentials).ensureFresh(),\n    storeFor({ ...tenant, credentialScope: 'factory' }, credentials).ensureFresh(),\n  ]);\n}\n\nexport function createTenantCredentialPrimer({\n  auth,\n  credentials,\n}: {\n  auth: RouteAuth;\n  credentials: ModelCredentialsStorage;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const tenant = auth.tenant(c);\n    if (tenant) {\n      try {\n        await primeTenantCredentials({ tenant, credentials });\n      } catch (error) {\n        console.warn('[factory] Failed to prime tenant model credentials', {\n          orgId: tenant.orgId,\n          userId: tenant.userId,\n          error,\n        });\n      }\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAsCA,MAAM,kBAAkB;;AAGxB,MAAM,qBAAqB;AAE3B,IAAa,wBAAb,MAA8D;CAC5D,2BAAoC;CACpC;CACA;CACA;CACA;CACA;CACA,4BAAY,IAAI,IAA4B;CAC5C,aAAa;CACb;CAEA,YACE,OACA,QACA,aACA,OACA,sCAA2C,IAAI,IAAI,GACnD;EACA,KAAKA,SAAS;EACd,KAAKC,UAAU;EACf,KAAKE,eAAe;EACpB,KAAKD,SAAS;EACd,KAAKE,uBAAuB;CAC9B;;CAGA,4BAA4B,UAA2B;EACrD,OAAO,KAAKA,qBAAqB,IAAI,QAAQ;CAC/C;;CAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;EACjD,IAAI,MAAM,KAAKC,aAAa,iBAAiB;EAC7C,KAAKC,eAAe,KAAKC,SAAS,CAAC,CAAC,cAAc;GAChD,KAAKD,aAAa,KAAA;EACpB,CAAC;EACD,MAAM,KAAKA;CACb;CAEA,MAAMC,WAA0B;EAC9B,MAAM,UAAU,MAAM,4BAA4B,KAAKJ,YAAY;EACnE,IAAI,CAAC,SAAS;EACd,MAAM,UAAU,MAAM,QAAQ,gBAAgB,KAAKH,QAAQ,KAAKC,OAAO;EACvE,MAAM,uBAAO,IAAI,IAA4B;EAC7C,MAAM,eAAe,KAAKC,WAAW,YAAY,QAAQ;EACzD,KAAK,MAAM,UAAU,QAAQ,QAAO,MAAK,EAAE,UAAU,YAAY,GAC/D,KAAK,IAAI,OAAO,UAAU,OAAO,UAAU;EAE7C,KAAKM,YAAY;EACjB,KAAKH,aAAa,KAAK,IAAI;CAC7B;;CAGA,SAAe;EACb,IAAI,KAAK,IAAI,IAAI,KAAKA,cAAc,iBAClC,KAAU,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;CAE1C;CAEA,IAAI,UAA8C;EAChD,OAAO,KAAKG,UAAU,IAAI,QAAQ;CACpC;CAEA,gBAAgB,UAAsC;EACpD,MAAM,OAAO,KAAKA,UAAU,IAAI,QAAQ;EACxC,OAAO,MAAM,SAAS,YAAY,KAAK,MAAM,KAAA;CAC/C;;;;;;;CAQA,MAAM,UAAU,UAA+C;EAC7D,MAAM,UAAU,MAAM,4BAA4B,KAAKL,YAAY;EACnE,IAAI,CAAC,SAAS;GAGZ,MAAM,OAAO,KAAKK,UAAU,IAAI,QAAQ;GACxC,IAAI,MAAM,SAAS,WAAW,OAAO,KAAK;GAC1C,IAAI,MAAM,SAAS,WAAW,CAAC,yBAAyB,IAAI,GAC1D,OAAO,iBAAiB,QAAQ,CAAC,EAAE,UAAU,IAAI;GAEnD;EACF;EAEA,MAAM,WAAW,MAAM,QAAQ,kBAC7B,KAAKR,QACL,KAAKC,SACL,UACA,KAAKC,WAAW,YAAY,QAAQ,MACtC;EACA,IAAI,CAAC,UAAU;GACb,KAAKM,UAAU,OAAO,QAAQ;GAC9B;EACF;EACA,KAAKA,UAAU,IAAI,UAAU,SAAS,UAAU;EAEhD,IAAI,SAAS,WAAW,SAAS,WAC/B,OAAO,SAAS,WAAW;EAG7B,MAAM,gBAAgB,iBAAiB,QAAQ;EAC/C,IAAI,CAAC,eAAe,OAAO,KAAA;EAE3B,IAAI,CAAC,yBAAyB,SAAS,UAAU,GAC/C,OAAO,cAAc,UAAU,SAAS,UAAU;EAKpD,MAAM,YAAY,SAAS,UAAU,SAAS;GAAE,OAAO,KAAKR;GAAQ,QAAQ,KAAKC;EAAQ,IAAI,EAAE,OAAO,KAAKD,OAAO;EAClH,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,aAAa,WAAW,UAAU,OAAM,aAAY;IAClF,MAAM;IACN,GAAI,MAAM,cAAc,aAAa,OAAO;GAC9C,EAAE;GACF,IAAI,CAAC,WAAW,OAAO,KAAA;GACvB,KAAKQ,UAAU,IAAI,UAAU,SAAS;GACtC,OAAO,cAAc,UAAU,SAAS;EAC1C,QAAQ;GAEN;EACF;CACF;AACF;AAEA,MAAM,+BAAe,IAAI,IAAmC;AAC5D,IAAI;AACJ,IAAI,gDAAqD,IAAI,IAAI;AAEjE,SAAS,SAAS,QAA6B,aAA6D;CAC1G,MAAM,QAAQ,YAAY,MAAM;CAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,OAAO,OAAO,QAAQ,OAAO;CAC1D,IAAI,QAAQ,aAAa,IAAI,GAAG;CAChC,IAAI,CAAC,OAAO;EACV,IAAI,aAAa,QAAQ,oBAAoB;GAC3C,MAAM,SAAS,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,IAAI,WAAW,KAAA,GAAW,aAAa,OAAO,MAAM;EACtD;EACA,QAAQ,IAAI,sBACV,OACA,OAAO,QACP,aACA,OAAO,iBACP,6BACF;EACA,aAAa,IAAI,KAAK,KAAK;CAC7B;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,iCACd,aACA,sCAA2C,IAAI,IAAI,GACnD,eACM;CACN,wBAAwB;CACxB,gCAAgC;CAChC,aAAa,MAAM;CACnB,4BACE,WAAU,SAAS,QAAQ,WAAW,GACtC,gBACI,OAAM,mBAAkB;EACtB,MAAM,SAAS,MAAM,cAAc,cAAc;EACjD,IAAI,QAAQ,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,YAAY;EAC5D,OAAO;CACT,IACA,KAAA,CACN;AACF;;;;;;;AAQA,eAAsB,wCAAwC,gBAA+C;CAC3G,IAAI,CAAC,uBAAuB;CAC5B,MAAM,wBAAwB,cAAc;CAC5C,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;CACb,MAAM,SAAS,QAAQ,qBAAqB,CAAC,CAAC,YAAY;AAC5D;;AAGA,eAAsB,gCAAgC,QAA4C;CAChG,IAAI,CAAC,uBAAuB;CAC5B,IAAI;EACF,MAAM,SAAS,QAAQ,qBAAqB,CAAC,CAAC,YAAY;CAC5D,SAAS,OAAO;EACd,QAAQ,KAAK,6DAA6D;GACxE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,iBAAiB,OAAO;GACxB;EACF,CAAC;CACH;AACF;;AAGA,SAAgB,wCAA8C;CAC5D,2BAA2B,KAAA,CAAS;CACpC,wBAAwB,KAAA;CACxB,gDAAgC,IAAI,IAAI;CACxC,aAAa,MAAM;AACrB;;;;;;;AAQA,SAAgB,oCAAoC,QAAkD;CACpG,IAAI,OAAO,QAAQ;EACjB,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrE,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,cAAc;EACxE;CACF;CACA,KAAK,MAAM,OAAO,aAAa,KAAK,GAClC,IAAI,IAAI,WAAW,GAAG,OAAO,MAAM,OAAO,GAAG,aAAa,OAAO,GAAG;AAExE;;;;;;AAOA,eAAsB,uBAAuB,EAC3C,QACA,eAIgB;CAChB,MAAM,QAAQ,IAAI,CAChB,SAAS;EAAE,GAAG;EAAQ,iBAAiB;CAAO,GAAG,WAAW,CAAC,CAAC,YAAY,GAC1E,SAAS;EAAE,GAAG;EAAQ,iBAAiB;CAAU,GAAG,WAAW,CAAC,CAAC,YAAY,CAC/E,CAAC;AACH;AAEA,SAAgB,6BAA6B,EAC3C,MACA,eAIoB;CACpB,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,SAAS,KAAK,OAAO,CAAC;EAC5B,IAAI,QACF,IAAI;GACF,MAAM,uBAAuB;IAAE;IAAQ;GAAY,CAAC;EACtD,SAAS,OAAO;GACd,QAAQ,KAAK,sDAAsD;IACjE,OAAO,OAAO;IACd,QAAQ,OAAO;IACf;GACF,CAAC;EACH;EAEF,MAAM,KAAK;CACb;AACF"}

package/dist/routes/work-items.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Mastra `apiRoutes` for Factory work items (the kanban board).
+ *
+ * Registered alongside the other `/web/*` routes behind the host auth gate.
+ * The board is org-wide: every route re-resolves the caller's `(orgId, userId)`
+ * tenant and scopes reads/writes by `orgId`, so any org member sees and moves
+ * the same cards while `created_by` / stage history record who acted.
+ */
+import type { ApiRoute } from '@mastra/core/server';
+import type { BoardRegistry } from '../boards/index.js';
+import type { FactoryStartCoordinator } from '../rules/start-coordinator.js';
+import type { FactoryTransitionService } from '../rules/transition-service.js';
+import type { LiveSessions } from '../session/live-sessions.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';
+import type { CreateWorkItemInput, UpdateWorkItemInput, WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+export interface WorkItemRoutesDeps extends RouteDependencies {
+    audit: AuditEmitter;
+    /** Factory projects domain — validates the `:id` project belongs to the caller's org. */
+    projects: FactoryProjectsStorage;
+    /** Work-items domain backing the kanban board. */
+    workItems: WorkItemsStorage;
+    /** Boards installed for this Factory instance. */
+    boardRegistry?: BoardRegistry;
+    /** Comments domain — backs the mention attention provider. */
+    comments: WorkItemCommentsStorage;
+    /** Per-project queue-health threshold config. */
+    queueHealth: QueueHealthStorage;
+    /** Governed stage-transition service. Stage moves 503 when absent. */
+    transitionService?: Pick<FactoryTransitionService, 'transition' | 'configVersion'>;
+    /** Coordinator that binds a Factory run before dispatching its kickoff. */
+    startCoordinator?: Pick<FactoryStartCoordinator, 'prepare'>;
+    /** Materialized sessions, read to report which of the listed cards are being worked or wait on someone. */
+    liveSessions: Pick<LiveSessions, 'isRunning' | 'parked' | 'parkedIn'>;
+}
+/** Validate an untrusted create body. Unknown keys are dropped. */
+export declare function parseCreateWorkItem(body: unknown): CreateWorkItemInput | null;
+/** Validate an untrusted patch body. Unknown keys are dropped. */
+export declare function parseUpdateWorkItem(body: unknown): UpdateWorkItemInput | null;
+export declare class WorkItemRoutes extends Route<WorkItemRoutesDeps> {
+    #private;
+    /** Build the Factory work-item routes as Mastra `apiRoutes`. */
+    routes(): ApiRoute[];
+}
+//# sourceMappingURL=work-items.d.ts.map

package/dist/routes/work-items.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-items.d.ts","sourceRoot":"","sources":["../../src/routes/work-items.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,KAAK,EACV,uBAAuB,EAGxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAA4B,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAEzG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,KAAK,EAAuB,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,KAAK,EACV,mBAAmB,EAEnB,mBAAmB,EAEnB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAU/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGnC,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,KAAK,EAAE,YAAY,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,sBAAsB,CAAC;IACjC,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,kDAAkD;IAClD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,EAAE,uBAAuB,CAAC;IAClC,iDAAiD;IACjD,WAAW,EAAE,kBAAkB,CAAC;IAChC,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,eAAe,CAAC,CAAC;IACnF,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;IAC5D,2GAA2G;IAC3G,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC;CACvE;AA2CD,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAG7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAG7E;AA+ED,qBAAa,cAAe,SAAQ,KAAK,CAAC,kBAAkB,CAAC;;IAuI3D,gEAAgE;IAChE,MAAM,IAAI,QAAQ,EAAE;CAqbrB"}