@mastra/factory 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/integrations/base.d.ts

@@ -0,0 +1,254 @@
+/**
+ * `FactoryIntegration` — the common contract for pluggable web integrations
+ * (GitHub, Linear, third-party).
+ *
+ * Each integration is a self-contained class: the deploy entry
+ * (`src/mastra/index.ts`) reads that integration's env vars ONCE, constructs
+ * an instance with explicit credentials, and passes it to `MastraFactory`
+ * via `integrations: [...]`. The factory registers the pieces each instance
+ * provides — HTTP routes, agent/session tools, diagnostics — into the system.
+ * No system code reads integration env vars or imports integration free
+ * functions; everything downstream talks to instances through this interface.
+ *
+ * An absent integration means: its routes never mount, its tools never
+ * register, diagnostics report "not configured", and the server boots fine.
+ * Third parties add capabilities by implementing this same interface — no
+ * factory changes required (the same capability-based philosophy as the
+ * sandbox machine's `derive()` gate).
+ */
+import type { MastraCodeConfig, MountedMastraCode } from '@mastra/code-sdk';
+import type { AgentControllerChannelsConfig, ChannelAdapterConfig } from '@mastra/core/channels';
+import type { RequestContext } from '@mastra/core/request-context';
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryStorage } from '@mastra/core/storage';
+import type { MastraWorker } from '@mastra/core/worker';
+import type { Intake } from '../capabilities/intake.js';
+import type { VersionControl } from '../capabilities/version-control.js';
+import type { RouteAuth } from '../routes/route.js';
+import type { FactoryRules } from '../rules/types.js';
+import type { SandboxFleet } from '../sandbox/fleet.js';
+import type { StateSigner } from '../state-signing.js';
+import type { AuditEventRow } from '../storage/domains/audit/base.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';
+import type { IntakeStorage } from '../storage/domains/intake/base.js';
+import type { IntegrationStorageHandle } from '../storage/domains/integrations/base.js';
+import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+/** Factory-owned hooks integrations may invoke. */
+export interface IntegrationHooks {
+    emitAudit?: AuditEmitter['emit'];
+}
+/**
+ * Tool records integrations contribute — the same static-record shape the
+ * SDK's `extraTools` accepts, so the factory can merge every integration's
+ * tools into one dynamic tool set.
+ */
+export type IntegrationTools = Extract<NonNullable<MastraCodeConfig['extraTools']>, Record<string, unknown>>;
+export interface IntegrationPostToolContext {
+    toolName: string;
+    input: unknown;
+    output?: unknown;
+    error?: unknown;
+    context: unknown;
+}
+/**
+ * Everything the factory hands an integration when collecting its routes.
+ * Built once per boot in `MastraFactory.prepare()`.
+ */
+export interface IntegrationContext {
+    /** Host auth seam — integration routes resolve callers through this. */
+    auth: RouteAuth;
+    /**
+     * Sandbox fleet for per-project sandboxes. Always constructed at boot; a
+     * fleet built without a machine config reports `enabled: false` and
+     * sandbox-backed routes respond 503.
+     */
+    fleet: SandboxFleet;
+    /**
+     * Root factory storage backend and source of the `appDbConfigured`
+     * diagnostic. Absent when the host runs without an application database.
+     */
+    factoryStorage?: FactoryStorage;
+    /** Browser-facing origin (OAuth redirect base), no trailing slash. */
+    baseUrl?: string;
+    /** Mounted agent controller for webhook → session signal delivery. */
+    controller?: MountedMastraCode['controller'];
+    /**
+     * Shared OAuth state signer created by the factory. One signer per boot, so
+     * every integration's OAuth flow signs and verifies with the same secret.
+     */
+    stateSigner?: StateSigner;
+    /** Persistence handles pre-scoped to this integration's stable id. */
+    storage: {
+        generic: IntegrationStorageHandle;
+        sourceControl: SourceControlStorageHandle;
+        /**
+         * The factory's source-control-owning integration's storage handle
+         * (today: GitHub when registered; the handle carries its own
+         * `integrationId`). Channel integrations use it to make sessions
+         * repo-backed without the entry hand-wiring a source-control slice.
+         * Absent when no source-control owner is registered.
+         */
+        sourceControlOwner?: SourceControlStorageHandle;
+        /** Factory projects domain — e.g. resolving a project's default model. */
+        projects: FactoryProjectsStorage;
+        /**
+         * Observational-memory settings domain, so a session an integration starts
+         * adopts the same memory configuration the web kickoff applies.
+         */
+        memorySettings: MemorySettingsStorage;
+        /** Cross-integration intake selection (which sources are synced). */
+        intake: IntakeStorage;
+        /**
+         * Reverse index from a chat-platform sender to a Mastra tenant. Channel
+         * integrations resolve an inbound sender through this to run under the
+         * right user's credentials.
+         */
+        channelIdentity: ChannelIdentityStorage;
+    };
+    /**
+     * Factory rule runtime available when the work-item domain is ready.
+     * Integrations attach their own provider event rules to their ingress
+     * surfaces instead of relying on provider-specific services in the host.
+     */
+    rules?: {
+        config: FactoryRules;
+        workItems: WorkItemsStorage;
+    };
+    /** System hooks integrations may invoke. */
+    hooks?: IntegrationHooks;
+}
+/**
+ * One adapter entry in a {@link FactoryChannelsConfig} adapter map.
+ *
+ * Core's adapter-map entry is `ChannelAdapterConfig | Adapter<any, any>`, and
+ * `ChannelAdapterConfig` is itself a union — so this MUST be a type alias, not
+ * an interface extends (illegal on unions). Factory's contract deliberately
+ * EXCLUDES the bare-`Adapter` shorthand core accepts: entries use the config
+ * form so future per-platform extras (e.g. a `resolveWorkspaceId`, connect
+ * handlers) have a home. Today the alias adds no fields; it is the stable
+ * extension point.
+ */
+export type FactoryChannelAdapterEntry = ChannelAdapterConfig;
+/**
+ * The channels contribution a {@link FactoryIntegration} returns from
+ * `channels()`. A config object, not a built instance — the factory constructs
+ * the `AgentControllerChannels` at the attach site.
+ *
+ * The adapter-map key is the platform identity (`'slack'`, `'discord'`, …).
+ * One integration = one platform = one entry is the norm: the map shape is
+ * inherited from core (one `AgentControllerChannels` instance drives multiple
+ * adapters) and is where cross-integration merging will happen later — it is
+ * NOT an invitation for a single integration to bundle multiple platforms.
+ * Note the top-level `handlers` and resolvers are shared across all adapters
+ * in the map. Entries use the config form; the bare-`Adapter` shorthand core
+ * accepts is deliberately excluded (see {@link FactoryChannelAdapterEntry}).
+ */
+export interface FactoryChannelsConfig extends Omit<AgentControllerChannelsConfig, 'adapters'> {
+    adapters: Record<string, FactoryChannelAdapterEntry>;
+}
+/**
+ * A pluggable web integration. Implementations own their credentials
+ * (validated at construction), their API surface, and their HTTP routes.
+ */
+export interface FactoryIntegration {
+    /** Stable identifier: `'github'`, `'linear'`, custom ids for third parties. */
+    readonly id: string;
+    /** Issue-oriented capability consumed by Intake. */
+    readonly intake?: Intake;
+    /** Repository, installation, and pull-request capability. */
+    readonly versionControl?: VersionControl;
+    /**
+     * Bind the integration's generic persistence handle. Called once by the
+     * factory during `prepare()` (before routes/tools/workers are collected),
+     * so instance methods that run outside an `IntegrationContext` — per-request
+     * agent tools, intake capability calls — reach storage without a service
+     * locator. Mirrors `sourceControl.initialize`.
+     */
+    initialize?(args: {
+        storage: IntegrationStorageHandle;
+        projects: FactoryProjectsStorage;
+        auth: RouteAuth;
+    }): void;
+    /**
+     * The integration's full HTTP surface (status, OAuth, webhooks, feature
+     * routes), as Mastra `apiRoutes`. Called once at boot; the factory folds
+     * the result into the server's route table.
+     */
+    routes(ctx: IntegrationContext): ApiRoute[];
+    /**
+     * Org-scoped agent tools resolved per request (e.g. Linear's issue tools).
+     * Optional capability; the factory merges results into the SDK's async
+     * `extraTools` provider.
+     */
+    agentTools?(args: {
+        requestContext: RequestContext;
+    }): Promise<IntegrationTools>;
+    /**
+     * Session-scoped tools (e.g. GitHub's PR subscribe/unsubscribe). Optional
+     * capability, resolved synchronously per request.
+     */
+    sessionTools?(args: {
+        requestContext: RequestContext;
+    }): IntegrationTools;
+    /**
+     * Optional provider-owned observer for successful or failed tool calls.
+     * The factory invokes every configured observer independently so one
+     * integration cannot prevent another from observing the same tool result.
+     */
+    postToolObserver?(args: {
+        toolContext: IntegrationPostToolContext;
+        requestContext?: RequestContext;
+    }): Promise<void>;
+    /**
+     * Background workers the integration needs running for its lifecycle
+     * (e.g. polling an upstream that doesn't support webhooks). Optional
+     * capability: called once at boot for READY integrations only; the factory
+     * folds the returned workers into the server Mastra's `workers` option, so
+     * they are merged with the built-in workers and started with them
+     * (`startWorkers()`). Worker names must be unique across integrations —
+     * duplicates fail the `new Mastra(...)` construction loudly.
+     */
+    workers?(ctx: IntegrationContext): MastraWorker[];
+    /**
+     * Chat-platform channels this integration contributes (Slack, Discord, …).
+     * Called once at boot for READY integrations only; the factory constructs an
+     * `AgentControllerChannels` from the returned config and attaches it to the
+     * mounted agent controller via `setChannels`, so inbound platform messages
+     * reach the same agents the web UI drives.
+     *
+     * An integration providing this slot also declares a dependency on the
+     * `channel-identity` domain, which the factory folds into its readiness
+     * gate — so an integration whose reverse index isn't migrated yet reports
+     * not-ready and its channels never attach, rather than dispatching runs it
+     * can't resolve a tenant for.
+     *
+     * Only one integration may provide channels; the factory fails loud at boot
+     * on a second, because `setChannels` replaces rather than merges and the
+     * loser would silently never receive a message.
+     */
+    channels?(ctx: IntegrationContext): FactoryChannelsConfig;
+    /**
+     * Non-secret config snapshot (booleans + names only, never values). The
+     * factory merges it into system diagnostics/startup logs.
+     */
+    diagnostics(): Record<string, unknown>;
+    /**
+     * Optional best-effort destination for locally persisted audit events.
+     * Audit export remains independent of the configured web auth adapter.
+     */
+    audit?(args: {
+        event: AuditEventRow;
+    }): Promise<void>;
+    /**
+     * True when the integration signs OAuth `state` and therefore needs a
+     * replica-stable signer. The factory fails loud at boot when a registered
+     * integration requires stability but only a per-process random secret is
+     * available (see `./state-signing.ts`).
+     */
+    readonly requiresStableStateSigner?: boolean;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/integrations/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/integrations/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7G,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,IAAI,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,OAAO,EAAE;QACP,OAAO,EAAE,wBAAwB,CAAC;QAClC,aAAa,EAAE,0BAA0B,CAAC;QAC1C;;;;;;WAMG;QACH,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;QAChD,0EAA0E;QAC1E,QAAQ,EAAE,sBAAsB,CAAC;QACjC;;;WAGG;QACH,cAAc,EAAE,qBAAqB,CAAC;QACtC,qEAAqE;QACrE,MAAM,EAAE,aAAa,CAAC;QACtB;;;;WAIG;QACH,eAAe,EAAE,sBAAsB,CAAC;KACzC,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,YAAY,CAAC;QACrB,SAAS,EAAE,gBAAgB,CAAC;KAC7B,CAAC;IACF,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,6BAA6B,EAAE,UAAU,CAAC;IAC5F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,wBAAwB,CAAC;QAAC,QAAQ,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IAClH;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF;;;OAGG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB,CAAC;IAC1E;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,0BAA0B,CAAC;QAAC,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrH;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,CAAC,GAAG,EAAE,kBAAkB,GAAG,qBAAqB,CAAC;IAC1D;;;OAGG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CAC9C"}

package/dist/integrations/base.js

@@ -0,0 +1 @@
+export {};

package/dist/integrations/github/config.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Composite feature gate + diagnostics for the GitHub App project feature.
+ *
+ * The GitHub feature is enabled only when *all three* hold:
+ *  - a `GithubIntegration` instance is registered with the factory
+ *    (constructed by the deploy entry from the `GITHUB_APP_*` env vars),
+ *  - web auth is enabled (a per-user installation requires a logged-in user),
+ *  - the application database is configured.
+ *
+ * OAuth/install `state` signing lives in `../../state-signing.ts` — the factory
+ * creates one shared signer at boot and hands it to every integration.
+ *
+ * Everything here is pure: callers pass the handles they already own (the
+ * integration, auth seam, state signer, sandbox fleet) — there is no global
+ * registry lookup.
+ */
+import type { RouteAuth } from '../../routes/route.js';
+import type { SandboxFleet } from '../../sandbox/fleet.js';
+import type { StateSigner } from '../../state-signing.js';
+import type { GithubIntegration } from './integration.js';
+/** Handles the GitHub feature gate + diagnostics are computed from. */
+export interface GithubFeatureGateOptions {
+    /** The registered GitHub integration, when configured. */
+    github: GithubIntegration | undefined;
+    /** Web auth seam — the feature requires a logged-in user. */
+    auth: RouteAuth;
+    /** True when the application database is configured. */
+    appDbConfigured: boolean;
+    /** Shared OAuth/install `state` signer, when configured. */
+    stateSigner?: StateSigner;
+    /** Sandbox fleet, when sandboxes are configured. */
+    fleet?: SandboxFleet;
+}
+/**
+ * True when the GitHub App project feature should be active.
+ */
+export declare function isGithubFeatureEnabled(options: Pick<GithubFeatureGateOptions, 'github' | 'auth'>): boolean;
+/**
+ * Non-secret diagnostic snapshot of every GitHub feature gate. Used by startup
+ * logs, `/web/github/status`, and the SPA so all three explain the same state.
+ *
+ * Only env var *names* and booleans are exposed — never secret values.
+ */
+export interface GithubFeatureDiagnostics {
+    githubAppConfigured: boolean;
+    factoryAuthEnabled: boolean;
+    appDbConfigured: boolean;
+    stateSecretConfigured: boolean;
+    sandboxEnabled: boolean;
+    sandboxProvider: string;
+    /** Names of the GitHub App env vars still needed (empty when configured). */
+    missingGithubAppEnvVars: string[];
+}
+/**
+ * Collect a non-secret diagnostic snapshot of every GitHub feature gate. Centralizes
+ * the feature-gate reasoning so startup logs, the status API, and the SPA explain
+ * the same state. Does not change `isGithubFeatureEnabled()` behavior.
+ */
+export declare function getGithubFeatureDiagnostics(options: GithubFeatureGateOptions): GithubFeatureDiagnostics;
+//# sourceMappingURL=config.d.ts.map

package/dist/integrations/github/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAiB1D,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC,6DAA6D;IAC7D,IAAI,EAAE,SAAS,CAAC;IAChB,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oDAAoD;IACpD,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAE1G;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,uBAAuB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,wBAAwB,CAWvG"}

package/dist/integrations/github/config.js

@@ -0,0 +1,42 @@
+//#region src/integrations/github/config.ts
+/**
+* Env vars the deploy entry reads to construct a `GithubIntegration`. Names
+* only — used by diagnostics to tell an operator what to set when the
+* integration is absent. The entry enforces all-or-nothing: partial config
+* fails the boot, so at runtime the integration is either fully configured or
+* not configured at all.
+*/
+const GITHUB_APP_ENV_VARS = [
+	"GITHUB_APP_ID",
+	"GITHUB_APP_PRIVATE_KEY",
+	"GITHUB_APP_CLIENT_ID",
+	"GITHUB_APP_CLIENT_SECRET",
+	"GITHUB_APP_SLUG"
+];
+/**
+* True when the GitHub App project feature should be active.
+*/
+function isGithubFeatureEnabled(options) {
+	return options.github !== void 0 && options.auth.enabled();
+}
+/**
+* Collect a non-secret diagnostic snapshot of every GitHub feature gate. Centralizes
+* the feature-gate reasoning so startup logs, the status API, and the SPA explain
+* the same state. Does not change `isGithubFeatureEnabled()` behavior.
+*/
+function getGithubFeatureDiagnostics(options) {
+	const { github, auth, appDbConfigured, stateSigner, fleet } = options;
+	return {
+		githubAppConfigured: github !== void 0,
+		factoryAuthEnabled: auth.enabled(),
+		appDbConfigured,
+		stateSecretConfigured: stateSigner?.stable ?? false,
+		sandboxEnabled: fleet?.enabled ?? false,
+		sandboxProvider: fleet?.provider ?? "none",
+		missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS]
+	};
+}
+//#endregion
+export { getGithubFeatureDiagnostics, isGithubFeatureEnabled };
+
+//# sourceMappingURL=config.js.map

package/dist/integrations/github/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","names":[],"sources":["../../../src/integrations/github/config.ts"],"sourcesContent":["/**\n * Composite feature gate + diagnostics for the GitHub App project feature.\n *\n * The GitHub feature is enabled only when *all three* hold:\n *  - a `GithubIntegration` instance is registered with the factory\n *    (constructed by the deploy entry from the `GITHUB_APP_*` env vars),\n *  - web auth is enabled (a per-user installation requires a logged-in user),\n *  - the application database is configured.\n *\n * OAuth/install `state` signing lives in `../../state-signing.ts` — the factory\n * creates one shared signer at boot and hands it to every integration.\n *\n * Everything here is pure: callers pass the handles they already own (the\n * integration, auth seam, state signer, sandbox fleet) — there is no global\n * registry lookup.\n */\n\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { SandboxFleet } from '../../sandbox/fleet.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { GithubIntegration } from './integration.js';\n\n/**\n * Env vars the deploy entry reads to construct a `GithubIntegration`. Names\n * only — used by diagnostics to tell an operator what to set when the\n * integration is absent. The entry enforces all-or-nothing: partial config\n * fails the boot, so at runtime the integration is either fully configured or\n * not configured at all.\n */\nconst GITHUB_APP_ENV_VARS = [\n  'GITHUB_APP_ID',\n  'GITHUB_APP_PRIVATE_KEY',\n  'GITHUB_APP_CLIENT_ID',\n  'GITHUB_APP_CLIENT_SECRET',\n  'GITHUB_APP_SLUG',\n] as const;\n\n/** Handles the GitHub feature gate + diagnostics are computed from. */\nexport interface GithubFeatureGateOptions {\n  /** The registered GitHub integration, when configured. */\n  github: GithubIntegration | undefined;\n  /** Web auth seam — the feature requires a logged-in user. */\n  auth: RouteAuth;\n  /** True when the application database is configured. */\n  appDbConfigured: boolean;\n  /** Shared OAuth/install `state` signer, when configured. */\n  stateSigner?: StateSigner;\n  /** Sandbox fleet, when sandboxes are configured. */\n  fleet?: SandboxFleet;\n}\n\n/**\n * True when the GitHub App project feature should be active.\n */\nexport function isGithubFeatureEnabled(options: Pick<GithubFeatureGateOptions, 'github' | 'auth'>): boolean {\n  return options.github !== undefined && options.auth.enabled();\n}\n\n/**\n * Non-secret diagnostic snapshot of every GitHub feature gate. Used by startup\n * logs, `/web/github/status`, and the SPA so all three explain the same state.\n *\n * Only env var *names* and booleans are exposed — never secret values.\n */\nexport interface GithubFeatureDiagnostics {\n  githubAppConfigured: boolean;\n  factoryAuthEnabled: boolean;\n  appDbConfigured: boolean;\n  stateSecretConfigured: boolean;\n  sandboxEnabled: boolean;\n  sandboxProvider: string;\n  /** Names of the GitHub App env vars still needed (empty when configured). */\n  missingGithubAppEnvVars: string[];\n}\n\n/**\n * Collect a non-secret diagnostic snapshot of every GitHub feature gate. Centralizes\n * the feature-gate reasoning so startup logs, the status API, and the SPA explain\n * the same state. Does not change `isGithubFeatureEnabled()` behavior.\n */\nexport function getGithubFeatureDiagnostics(options: GithubFeatureGateOptions): GithubFeatureDiagnostics {\n  const { github, auth, appDbConfigured, stateSigner, fleet } = options;\n  return {\n    githubAppConfigured: github !== undefined,\n    factoryAuthEnabled: auth.enabled(),\n    appDbConfigured,\n    stateSecretConfigured: stateSigner?.stable ?? false,\n    sandboxEnabled: fleet?.enabled ?? false,\n    sandboxProvider: fleet?.provider ?? 'none',\n    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS],\n  };\n}\n"],"mappings":";;;;;;;;AA6BA,MAAM,sBAAsB;CAC1B;CACA;CACA;CACA;CACA;AACF;;;;AAmBA,SAAgB,uBAAuB,SAAqE;CAC1G,OAAO,QAAQ,WAAW,KAAA,KAAa,QAAQ,KAAK,QAAQ;AAC9D;;;;;;AAwBA,SAAgB,4BAA4B,SAA6D;CACvG,MAAM,EAAE,QAAQ,MAAM,iBAAiB,aAAa,UAAU;CAC9D,OAAO;EACL,qBAAqB,WAAW,KAAA;EAChC,oBAAoB,KAAK,QAAQ;EACjC;EACA,uBAAuB,aAAa,UAAU;EAC9C,gBAAgB,OAAO,WAAW;EAClC,iBAAiB,OAAO,YAAY;EACpC,yBAAyB,SAAS,CAAC,IAAI,CAAC,GAAG,mBAAmB;CAChE;AACF"}

package/dist/integrations/github/integration.d.ts

@@ -0,0 +1,220 @@
+/**
+ * `GithubIntegration` — the injectable GitHub App integration for the web
+ * factory.
+ *
+ * The deploy entry (`src/mastra/index.ts`) reads the `GITHUB_APP_*` env vars
+ * once, constructs an instance, and passes it to `MastraFactory` (the same
+ * dependency-injection pattern as the auth adapter and the sandbox machine).
+ * The factory seeds it into the runtime-config registry for the feature gate
+ * (`./config.ts`) and hands the instance to every consumer explicitly — route
+ * handlers receive it through `routes()`, the webhook fan-out and session
+ * subscription tools through their deps.
+ *
+ * The class owns:
+ *   - the GitHub App credentials (validated + PEM-normalized at construction),
+ *   - every GitHub API operation the web surface performs (Octokit factories,
+ *     token minting, installation/repo/issue/PR listings, OAuth exchange),
+ *   - the webhook secret used to verify GitHub webhook deliveries,
+ *   - its own HTTP surface: `routes()` returns the `/web/github/*` +
+ *     `/auth/github/*` Mastra `apiRoutes`.
+ *
+ * A custom integration (different app per tenant, custom Octokit config) can
+ * subclass this and override individual methods — everything downstream only
+ * talks to the instance.
+ */
+import type { RequestContext } from '@mastra/core/request-context';
+import type { ApiRoute } from '@mastra/core/server';
+import type { MastraWorker } from '@mastra/core/worker';
+import { Octokit } from '@octokit/rest';
+import type { Intake } from '../../capabilities/intake.js';
+import type { VersionControl } from '../../capabilities/version-control.js';
+import type { FactoryIntegration, IntegrationContext, IntegrationTools } from '../base.js';
+import type { ReconcileIssueState, ReconcilePullRequestState } from './rules.js';
+import type { GithubSubscriptionStorage } from './subscriptions.js';
+/**
+ * Normalize a PEM private key supplied via env. Env tooling tends to mangle
+ * multi-line PEMs, so two single-line forms are supported:
+ *   - `\n`-escaped: literal `\n` sequences become real newlines
+ *   - fully flattened: newlines stripped entirely — the PEM is rebuilt by
+ *     re-wrapping the base64 body (Node's decoder rejects header/body/footer
+ *     on one line with `error:1E08010C:DECODER routines::unsupported`)
+ */
+export declare function normalizePrivateKey(raw: string): string;
+export interface UserInstallation {
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+}
+export interface RepoSummary {
+    id: number;
+    fullName: string;
+    name: string;
+    owner: string;
+    defaultBranch: string;
+    private: boolean;
+    installationId: number;
+}
+export type GithubRepositoryPermission = 'admin' | 'maintain' | 'write' | 'triage' | 'read' | 'none';
+export interface IssueSummary {
+    number: number;
+    title: string;
+    url: string;
+    author: string | null;
+    assignees: string[];
+    labels: string[];
+    comments: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Page size for issue/PR listings; one GitHub API call per page. */
+export declare const LIST_PAGE_SIZE = 30;
+export interface IssuePage {
+    issues: IssueSummary[];
+    /** Next page number to request, or `null` when this was the last page. */
+    nextPage: number | null;
+}
+export interface ListRepoOpenIssuesOptions {
+    label?: string;
+}
+export interface GithubIntegrationConfig {
+    /** GitHub App id (the numeric id, as a string). */
+    appId: string;
+    /**
+     * App private key (PEM). Multi-line, `\n`-escaped, and fully flattened
+     * single-line forms are all accepted (normalized at construction).
+     */
+    privateKey: string;
+    /** OAuth client id of the GitHub App. */
+    clientId: string;
+    /** OAuth client secret of the GitHub App. */
+    clientSecret: string;
+    /** App slug — the URL name used to build the install URL. */
+    slug: string;
+    /**
+     * Secret GitHub uses to sign webhook deliveries. Omitted → webhook
+     * signature verification rejects all deliveries. Also serves as the default
+     * replica-stable OAuth/install `state` secret (see `./config.ts`).
+     */
+    webhookSecret?: string;
+}
+export declare class GithubIntegration implements FactoryIntegration {
+    #private;
+    /** Stable integration identifier (see `../factory-integration.ts`). */
+    readonly id = "github";
+    readonly intake: Intake;
+    readonly versionControl: VersionControl;
+    /**
+     * The OAuth/install flow round-trips a signed `state` through GitHub, so a
+     * multi-replica deploy needs a deployment-stable state secret.
+     */
+    readonly requiresStableStateSigner = true;
+    constructor(config: GithubIntegrationConfig);
+    /** App slug — the URL name used to build the install URL. */
+    get slug(): string;
+    get genericStorage(): IntegrationContext['storage']['generic'];
+    get sourceControlStorage(): IntegrationContext['storage']['sourceControl'];
+    get integrationStorage(): GithubSubscriptionStorage;
+    /** Secret GitHub uses to sign webhook deliveries, when configured. */
+    get webhookSecret(): string | undefined;
+    /**
+     * Octokit authenticated as the GitHub App itself (app JWT). Used for
+     * app-level operations and to mint installation tokens.
+     */
+    getAppOctokit(): Octokit;
+    /**
+     * Octokit authenticated as a specific installation (installation access
+     * token). Used to list repos and to operate on a repo on the user's behalf.
+     */
+    getInstallationOctokit(installationId: number): Octokit;
+    /** Octokit authenticated as a user via their OAuth token (the identify step). */
+    getUserOctokit(userToken: string): Octokit;
+    /**
+     * Mint a short-lived installation access token. Returned token is used only
+     * server-side / inside the sandbox clone URL and never sent to the browser.
+     */
+    mintInstallationToken(installationId: number): Promise<string>;
+    /**
+     * List the installations the authenticated user can access, via their OAuth
+     * token (`GET /user/installations`).
+     */
+    listUserInstallations(userToken: string): Promise<UserInstallation[]>;
+    /** List repos accessible to an installation (paginated). */
+    listInstallationRepos(installationId: number): Promise<RepoSummary[]>;
+    /**
+     * The authenticated user's permission level on a repo, through the
+     * installation. `undefined` when the repo/user is not accessible.
+     */
+    getRepositoryCollaboratorPermission(installationId: number, repoFullName: string, username: string, signal?: AbortSignal): Promise<GithubRepositoryPermission | undefined>;
+    /**
+     * Fetch a single repo's metadata through an installation token and confirm
+     * the installation actually has access to it. Returns `null` when the repo
+     * is not accessible to the installation (so a client can't create a project
+     * for an arbitrary repo under an installation id it merely owns).
+     */
+    getInstallationRepo(installationId: number, repoFullName: string): Promise<RepoSummary | null>;
+    /** Add labels to an issue (deduplicated; no-op on empty/malformed input). */
+    addIssueLabels(installationId: number, repoFullName: string, issueNumber: number, labels: string[]): Promise<void>;
+    /**
+     * List one page of a repo's open issues through an installation token. The
+     * issues API also returns pull requests, so those are filtered out (the
+     * filter can make a non-final page shorter than the page size — `nextPage`
+     * is derived from the raw response length, not the filtered one).
+     */
+    listRepoOpenIssues(installationId: number, repoFullName: string, page: number, options?: ListRepoOpenIssuesOptions): Promise<IssuePage>;
+    /**
+     * Build the GitHub App install URL. `state` is carried through the install
+     * flow and validated on callback.
+     */
+    buildInstallUrl(state: string): string;
+    /**
+     * Build the OAuth identify URL (authorize) used to confirm the user's
+     * identity and obtain a user token for listing their installations.
+     */
+    buildOAuthIdentifyUrl(state: string, redirectUri: string): string;
+    /** Exchange an OAuth `code` for a user access token. */
+    exchangeOAuthCode(code: string, redirectUri: string): Promise<string>;
+    /**
+     * The integration's HTTP surface: the `/web/github/*` + `/auth/github/*`
+     * Mastra `apiRoutes` (webhook handler, install/OAuth flow, project +
+     * worktree + session operations). The factory folds these into the server's
+     * `apiRoutes` when the feature is ready. Handlers operate on this instance.
+     */
+    routes(ctx: IntegrationContext): ApiRoute[];
+    /**
+     * Merge-state safety net. Webhooks are the only other writer of merge state,
+     * and a self-hosted deployment GitHub cannot reach (private network, local
+     * dev) never receives one — without this sweep its PR cards stay open
+     * forever. Disable with `MASTRACODE_GITHUB_RECONCILE_ENABLED=false`.
+     */
+    workers(ctx: IntegrationContext): MastraWorker[];
+    /**
+     * Reads live PR state for the merge reconciler. Returns undefined when the PR
+     * cannot be resolved so a sweep never fabricates a merge.
+     */
+    fetchPullRequestState(input: {
+        installationId: number;
+        repository: string;
+        number: number;
+    }): Promise<ReconcilePullRequestState | undefined>;
+    /**
+     * Reads live issue state for the reconciler. Returns undefined when the
+     * issue cannot be resolved (missing, is actually a PR, API error) so a
+     * sweep never fabricates a close.
+     */
+    fetchIssueState(input: {
+        installationId: number;
+        repository: string;
+        number: number;
+    }): Promise<ReconcileIssueState | undefined>;
+    /**
+     * Session-scoped agent tools for token refresh and PR subscriptions in
+     * sessions bound to a GitHub-backed project. Empty elsewhere.
+     */
+    sessionTools({ requestContext }: {
+        requestContext: RequestContext;
+    }): IntegrationTools;
+    postToolObserver({ toolContext, requestContext, }: Parameters<NonNullable<FactoryIntegration['postToolObserver']>>[0]): Promise<void>;
+    /** Non-secret config snapshot for system diagnostics/startup logs. */
+    diagnostics(): Record<string, unknown>;
+}
+//# sourceMappingURL=integration.d.ts.map

package/dist/integrations/github/integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAGV,MAAM,EAKP,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAKV,cAAc,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAMjF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAMpE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qEAAqE;AACrE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,qBAAa,iBAAkB,YAAW,kBAAkB;;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,EAAE,YAAY;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAoFrB;IACF,QAAQ,CAAC,cAAc,EAAE,cAAc,CAmErC;IACF;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,QAAQ;gBAW9B,MAAM,EAAE,uBAAuB;IAiB3C,6DAA6D;IAC7D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,cAAc,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAG7D;IAED,IAAI,oBAAoB,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAIzE;IAED,IAAI,kBAAkB,IAAI,yBAAyB,CAGlD;IA4BD,sEAAsE;IACtE,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAWD;;;OAGG;IACH,aAAa,IAAI,OAAO;IAIxB;;;OAGG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAIvD,iFAAiF;IACjF,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI1C;;;OAGG;IACG,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMpE;;;OAGG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAY3E,4DAA4D;IACtD,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgB3E;;;OAGG;IACG,mCAAmC,CACvC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAelD;;;;;OAKG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA+dpG,6EAA6E;IACvE,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,IAAI,CAAC;IAchB;;;;;OAKG;IACG,kBAAkB,CACtB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,CAAC;IA4BrB;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAMtC;;;OAGG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAQjE,wDAAwD;IAClD,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwB3E;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE;IAoB3C;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,EAAE;IAmBhD;;;OAGG;IACG,qBAAqB,CAAC,KAAK,EAAE;QACjC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IA0BlD;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA4B5C;;;OAGG;IACH,YAAY,CAAC,EAAE,cAAc,EAAE,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB;IAIhF,gBAAgB,CAAC,EACrB,WAAW,EACX,cAAc,GACf,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrF,sEAAsE;IACtE,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMvC"}