@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/routes/surface.js

@@ -0,0 +1,260 @@
+import { getGithubFeatureDiagnostics } from "../integrations/github/config.js";
+import { invalidateCustomProvidersSnapshots } from "./custom-provider-source.js";
+import { ensureFactoryRuleSession } from "../integrations/github/factory-session.js";
+import { FactoryStartCoordinator } from "../rules/start-coordinator.js";
+import { FactoryTransitionService } from "../rules/transition-service.js";
+import { ConfigRoutes } from "./config.js";
+import { buildFsRoutes } from "./fs.js";
+import { IntakeRoutes } from "./intake.js";
+import { OAuthRoutes } from "./oauth.js";
+import { SkillRoutes } from "./skills.js";
+import { invalidateTenantCredentialSnapshots } from "./tenant-credentials.js";
+import { WorkItemRoutes } from "./work-items.js";
+import { registerApiRoute } from "@mastra/core/server";
+//#region src/routes/surface.ts
+function guardIntegrationRoutes({ integration, ready, ensureReady, routes }) {
+	if (ready) return routes;
+	return routes.map((route) => {
+		if ("handler" in route) {
+			const handler = route.handler;
+			return {
+				...route,
+				handler: async (context) => {
+					try {
+						await ensureReady();
+					} catch {
+						return context.json({
+							error: "integration_unavailable",
+							message: `${integration.id} integration is unavailable.`
+						}, 503);
+					}
+					return handler(context, async () => {});
+				}
+			};
+		}
+		const createHandler = route.createHandler;
+		return {
+			...route,
+			createHandler: async (args) => {
+				const handler = await createHandler(args);
+				return async (context) => {
+					try {
+						await ensureReady();
+					} catch {
+						return context.json({
+							error: "integration_unavailable",
+							message: `${integration.id} integration is unavailable.`
+						}, 503);
+					}
+					return handler(context);
+				};
+			}
+		};
+	});
+}
+function factoryRuleBranch(item) {
+	const metadata = item.metadata ?? {};
+	const issueNumber = metadata.githubIssueNumber ?? metadata.number;
+	if (item.externalSource?.integrationId === "github" && item.externalSource.type === "issue" && typeof issueNumber === "number") return `factory/issue-${issueNumber}`;
+	const pullRequestNumber = metadata.githubPullRequestNumber ?? metadata.number;
+	if (item.externalSource?.integrationId === "github" && item.externalSource.type === "pull-request" && typeof pullRequestNumber === "number") return `factory/pr-${pullRequestNumber}`;
+	throw new Error("Factory skill invocation requires a GitHub issue or pull request number.");
+}
+async function prepareFactoryRuleBinding(github, coordinator, input) {
+	const branch = factoryRuleBranch(input.item);
+	const repositorySlug = typeof input.item.metadata?.repository === "string" ? input.item.metadata.repository : void 0;
+	const preparedSession = await ensureFactoryRuleSession({
+		github,
+		orgId: input.record.orgId,
+		factoryProjectId: input.record.factoryProjectId,
+		repositorySlug,
+		branch
+	});
+	const destinationStage = input.item.stages.length === 1 ? input.item.stages[0] : void 0;
+	if (!destinationStage) throw new Error("Factory skill invocation requires one exclusive board stage.");
+	await coordinator.prepare({
+		orgId: input.record.orgId,
+		userId: preparedSession.userId,
+		factoryProjectId: input.record.factoryProjectId,
+		sessionId: preparedSession.sessionId,
+		threadTitle: `${input.role === "review" ? "PR" : "Issue"}: ${input.item.title}`,
+		kickoffKey: input.record.id,
+		destinationStage,
+		workItem: {
+			id: input.item.id,
+			role: input.role,
+			input: {
+				externalSource: input.item.externalSource,
+				parentWorkItemId: input.item.parentWorkItemId,
+				title: input.item.title,
+				stages: ["intake"],
+				sessions: input.item.sessions,
+				metadata: input.item.metadata
+			}
+		}
+	});
+}
+/**
+* Build the {@link IntegrationContext} handed to an integration when the
+* factory collects its capabilities (routes, workers). One shape everywhere:
+* `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it
+* when collecting integration workers at finalize.
+*/
+function buildIntegrationContext(deps, integrationId) {
+	return {
+		auth: deps.auth,
+		fleet: deps.fleet,
+		factoryStorage: deps.factoryStorage,
+		baseUrl: deps.publicOrigin,
+		controller: deps.controller,
+		stateSigner: deps.stateSigner,
+		storage: {
+			generic: deps.integrationStorage.forIntegration(integrationId),
+			sourceControl: deps.sourceControlStorage.forIntegration(integrationId),
+			projects: deps.domains.projects,
+			intake: deps.domains.intake,
+			channelIdentity: deps.domains.channelIdentity
+		},
+		...deps.factoryReady ? { rules: {
+			config: deps.rules,
+			workItems: deps.domains.workItems
+		} } : {},
+		...deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}
+	};
+}
+/**
+* Disabled-status stub for the well-known integration ids. The SPA polls
+* `/web/github/status` and `/web/linear/status` unconditionally, so when an
+* integration is absent (or not ready) the status contract must still hold.
+* Unknown custom ids get no stub — the SPA doesn't poll them.
+*/
+function disabledIntegrationStatusRoutes(deps, id, configured = false) {
+	if (id === "github") return [registerApiRoute("/web/github/status", {
+		method: "GET",
+		requiresAuth: false,
+		handler: (c) => c.json({
+			enabled: false,
+			connected: false,
+			installations: [],
+			reason: "missing_config",
+			diagnostics: getGithubFeatureDiagnostics({
+				github: void 0,
+				auth: deps.auth,
+				appDbConfigured: deps.factoryStorage !== void 0,
+				stateSigner: deps.stateSigner,
+				fleet: deps.fleet
+			})
+		})
+	})];
+	if (id === "linear") return [registerApiRoute("/web/linear/status", {
+		method: "GET",
+		requiresAuth: false,
+		handler: (c) => c.json({
+			enabled: false,
+			connected: false,
+			workspace: null,
+			reason: "missing_config",
+			diagnostics: {
+				linearAppConfigured: configured,
+				factoryAuthEnabled: deps.auth.enabled(),
+				appDbConfigured: true
+			}
+		})
+	})];
+	return [];
+}
+/**
+* Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:
+*   - fs browser routes (project picker), confined to `fsRoot`
+*   - config routes (provider/API-key/model-pack/OM management)
+*   - every registered integration's `routes()` surface (full set when ready,
+*     disabled-status stub otherwise), plus stubs for absent known ids
+*/
+function assembleFactoryApiRoutes(deps) {
+	const emitAudit = (args) => deps.audit.emit(args);
+	const registrations = deps.integrations ?? [];
+	const githubRegistration = registrations.find(({ integration }) => integration.id === "github");
+	const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration("github") : void 0;
+	const githubIntegration = githubRegistration?.integration;
+	const integrationRoutes = registrations.flatMap((registration) => {
+		const { integration } = registration;
+		if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);
+		const context = buildIntegrationContext({
+			...deps,
+			stateSigner: deps.stateSigner,
+			emitAudit
+		}, integration.id);
+		return guardIntegrationRoutes({
+			...registration,
+			routes: integration.routes(context)
+		});
+	});
+	const absentStubs = ["github", "linear"].filter((id) => !registrations.some(({ integration }) => integration.id === id)).flatMap((id) => disabledIntegrationStatusRoutes(deps, id));
+	const transitionService = deps.factoryReady ? deps.factoryTransitionService ?? new FactoryTransitionService({
+		rules: deps.rules,
+		storage: deps.domains.workItems
+	}) : void 0;
+	const startCoordinator = transitionService ? new FactoryStartCoordinator(deps.controller, deps.domains.workItems, transitionService, githubIntegration?.sourceControlStorage, deps.domains.memorySettings) : void 0;
+	if (transitionService && startCoordinator) deps.onFactoryRuntime?.({
+		transitionService,
+		...githubIntegration ? { prepareBinding: (input) => prepareFactoryRuleBinding(githubIntegration, startCoordinator, input) } : {}
+	});
+	return [
+		...buildFsRoutes({
+			root: deps.fsRoot,
+			sessionFs: {
+				auth: deps.auth,
+				fleet: deps.fleet,
+				sessions: deps.sourceControlStorage.forIntegration("github").sessions
+			}
+		}),
+		...new ConfigRoutes({
+			auth: deps.auth,
+			controller: deps.controller,
+			authStorage: deps.authStorage,
+			modelCredentials: deps.domains.modelCredentials,
+			modelPacks: deps.domains.modelPacks,
+			memorySettings: deps.domains.memorySettings,
+			customProviders: deps.domains.customProviders,
+			onCredentialsChanged: invalidateTenantCredentialSnapshots,
+			onCustomProvidersChanged: invalidateCustomProvidersSnapshots
+		}).routes(),
+		...new OAuthRoutes({
+			auth: deps.auth,
+			authStorage: deps.authStorage,
+			modelCredentials: deps.domains.modelCredentials,
+			onCredentialsChanged: invalidateTenantCredentialSnapshots
+		}).routes(),
+		...new SkillRoutes({
+			auth: deps.auth,
+			controllerId: deps.controllerId,
+			controller: deps.controller,
+			sourceControlStorage: githubStorage,
+			ensureSourceControlReady: githubRegistration?.ensureReady
+		}).routes(),
+		...integrationRoutes,
+		...absentStubs,
+		...deps.intakeReady ? new IntakeRoutes({
+			auth: deps.auth,
+			audit: deps.audit,
+			intake: deps.domains.intake,
+			integrations: (deps.integrations ?? []).flatMap(({ integration }) => integration.intake ? [{
+				id: integration.id,
+				intake: integration.intake
+			}] : [])
+		}).routes() : [],
+		...deps.factoryReady ? new WorkItemRoutes({
+			auth: deps.auth,
+			audit: deps.audit,
+			projects: deps.domains.projects,
+			workItems: deps.domains.workItems,
+			queueHealth: deps.domains.queueHealth,
+			transitionService,
+			startCoordinator
+		}).routes() : []
+	];
+}
+//#endregion
+export { assembleFactoryApiRoutes, buildIntegrationContext, factoryRuleBranch };
+
+//# sourceMappingURL=surface.js.map

package/dist/routes/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport { ensureFactoryRuleSession } from '../integrations/github/factory-session.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport type { SandboxFleet } from '../sandbox/fleet.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport type { SourceControlStorage } from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox fleet constructed by the factory (disabled when no machine). */\n  fleet: SandboxFleet;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  factoryTransitionService?: FactoryTransitionService;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\nexport function factoryRuleBranch(item: FactoryBindingPreparationInput['item']): string {\n  const metadata = item.metadata ?? {};\n  const issueNumber = metadata.githubIssueNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'issue' &&\n    typeof issueNumber === 'number'\n  ) {\n    return `factory/issue-${issueNumber}`;\n  }\n  const pullRequestNumber = metadata.githubPullRequestNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'pull-request' &&\n    typeof pullRequestNumber === 'number'\n  ) {\n    return `factory/pr-${pullRequestNumber}`;\n  }\n  throw new Error('Factory skill invocation requires a GitHub issue or pull request number.');\n}\n\nasync function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: FactoryStartCoordinator,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  const branch = factoryRuleBranch(input.item);\n  const repositorySlug =\n    typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n  const preparedSession = await ensureFactoryRuleSession({\n    github,\n    orgId: input.record.orgId,\n    factoryProjectId: input.record.factoryProjectId,\n    repositorySlug,\n    branch,\n  });\n  const destinationStage = input.item.stages.length === 1 ? input.item.stages[0] : undefined;\n  if (!destinationStage) throw new Error('Factory skill invocation requires one exclusive board stage.');\n\n  await coordinator.prepare({\n    orgId: input.record.orgId,\n    userId: preparedSession.userId,\n    factoryProjectId: input.record.factoryProjectId,\n    sessionId: preparedSession.sessionId,\n    threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n    kickoffKey: input.record.id,\n    destinationStage: destinationStage as 'intake' | 'triage' | 'planning' | 'execute' | 'review' | 'done',\n    workItem: {\n      id: input.item.id,\n      role: input.role,\n      input: {\n        externalSource: input.item.externalSource,\n        parentWorkItemId: input.item.parentWorkItemId,\n        title: input.item.title,\n        stages: ['intake'],\n        sessions: input.item.sessions,\n        metadata: input.item.metadata,\n      },\n    },\n  });\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    'controller' | 'publicOrigin' | 'auth' | 'fleet' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    domains: Pick<FactoryApiRoutesDeps['domains'], 'projects' | 'intake' | 'workItems' | 'channelIdentity'>;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    fleet: deps.fleet,\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n    },\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              fleet: deps.fleet,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext({ ...deps, stateSigner: deps.stateSigner, emitAudit }, integration.id);\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        fleet: deps.fleet,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      memorySettings: deps.domains.memorySettings,\n      customProviders: deps.domains.customProviders,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;AAqFA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAsD;CACtF,MAAM,WAAW,KAAK,YAAY,CAAC;CACnC,MAAM,cAAc,SAAS,qBAAqB,SAAS;CAC3D,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,WAC7B,OAAO,gBAAgB,UAEvB,OAAO,iBAAiB;CAE1B,MAAM,oBAAoB,SAAS,2BAA2B,SAAS;CACvE,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,kBAC7B,OAAO,sBAAsB,UAE7B,OAAO,cAAc;CAEvB,MAAM,IAAI,MAAM,0EAA0E;AAC5F;AAEA,eAAe,0BACb,QACA,aACA,OACe;CACf,MAAM,SAAS,kBAAkB,MAAM,IAAI;CAC3C,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;CACzF,MAAM,kBAAkB,MAAM,yBAAyB;EACrD;EACA,OAAO,MAAM,OAAO;EACpB,kBAAkB,MAAM,OAAO;EAC/B;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK,KAAA;CACjF,IAAI,CAAC,kBAAkB,MAAM,IAAI,MAAM,8DAA8D;CAErG,MAAM,YAAY,QAAQ;EACxB,OAAO,MAAM,OAAO;EACpB,QAAQ,gBAAgB;EACxB,kBAAkB,MAAM,OAAO;EAC/B,WAAW,gBAAgB;EAC3B,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;EACxE,YAAY,MAAM,OAAO;EACP;EAClB,UAAU;GACR,IAAI,MAAM,KAAK;GACf,MAAM,MAAM;GACZ,OAAO;IACL,gBAAgB,MAAM,KAAK;IAC3B,kBAAkB,MAAM,KAAK;IAC7B,OAAO,MAAM,KAAK;IAClB,QAAQ,CAAC,QAAQ;IACjB,UAAU,MAAM,KAAK;IACrB,UAAU,MAAM,KAAK;GACvB;EACF;CACF,CAAC;AACH;;;;;;;AAQA,SAAgB,wBACd,MAUA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;EAChC;EACA,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,OAAO,KAAK;GACd,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBAAwB;GAAE,GAAG;GAAM,aAAa,KAAK;GAAa;EAAU,GAAG,YAAY,EAAE;EAC7G,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAE1D,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,EACxE,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;GAC/D;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,aAAa,KAAK,QAAQ;GAC1B;GACA;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}

package/dist/routes/tenant-credentials.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Per-tenant credential store for model resolution (deployed mode).
+ *
+ * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a
+ * store synchronously, so this module keeps a small per-tenant **snapshot** of
+ * resolved credentials (user rows over org rows) hydrated from the
+ * `model-credentials` domain. The snapshot serves the gateway's synchronous
+ * path-selection reads (`get` / `getStoredApiKey`); the fetch-time
+ * `getApiKey` is authoritative — it re-resolves against the domain and
+ * refreshes expired OAuth tokens under the domain's row lock, so a slightly
+ * stale snapshot can never send an expired token upstream.
+ *
+ * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted
+ * after the web auth gate) so the first model call of a request already sees
+ * the caller's credentials. This store explicitly disables the SDK's
+ * environment fallback so server-shell credentials never leak into tenants.
+ */
+import type { CredentialTenant as SdkCredentialTenant } from '@mastra/code-sdk/agents/credential-resolver';
+import type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';
+import type { MiddlewareHandler } from 'hono';
+import type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import type { RouteAuth } from './route.js';
+export declare class TenantCredentialStore implements CredentialStore {
+    #private;
+    readonly allowEnvironmentFallback = false;
+    constructor(orgId: string, userId: string, credentials: ModelCredentialsStorage | undefined);
+    /** Hydrate the snapshot when stale; coalesces concurrent callers. */
+    ensureFresh(now?: number): Promise<void>;
+    /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+    reload(): void;
+    get(provider: string): AuthCredential | undefined;
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Authoritative fetch-time resolution: re-reads the domain (user > org) and
+     * refreshes expired OAuth tokens under the domain's row lock. Mirrors
+     * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or
+     * failed refresh (caller surfaces a re-login error).
+     */
+    getApiKey(provider: string): Promise<string | undefined>;
+}
+/**
+ * Register the web tenant credential store provider with the SDK. Called by
+ * the factory after storage init with the `model-credentials` domain handle;
+ * from then on `resolveModel` uses per-tenant credentials and the SDK skips
+ * the `loadStoredApiKeysIntoEnv` env side-channel.
+ */
+export declare function registerTenantCredentialResolver(credentials: ModelCredentialsStorage): void;
+/** Test hook: clear registration and cached tenant snapshots. */
+export declare function resetTenantCredentialResolverForTests(): void;
+/**
+ * Drop cached snapshots after a credential write so the change is visible to
+ * the next model call immediately instead of after the snapshot TTL. An org
+ * write affects every member's resolved view, so all stores under the org are
+ * invalidated; a user write only drops that user's store.
+ */
+export declare function invalidateTenantCredentialSnapshots(tenant: {
+    orgId: string;
+    userId?: string;
+}): void;
+/**
+ * Middleware mounted after the web auth gate: primes the caller's credential
+ * snapshot so the request's first model call sees their credentials without an
+ * async seam in model resolution. Cheap when fresh (TTL check), best-effort
+ * when not — a failed hydrate falls back to env vars, never blocks a request.
+ */
+export declare function primeTenantCredentials({ tenant, credentials, }: {
+    tenant: SdkCredentialTenant;
+    credentials: ModelCredentialsStorage;
+}): Promise<void>;
+export declare function createTenantCredentialPrimer({ auth, credentials, }: {
+    auth: RouteAuth;
+    credentials: ModelCredentialsStorage;
+}): MiddlewareHandler;
+//# sourceMappingURL=tenant-credentials.d.ts.map

package/dist/routes/tenant-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/tenant-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,IAAI,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAG3G,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,qBAAa,qBAAsB,YAAW,eAAe;;IAC3D,QAAQ,CAAC,wBAAwB,SAAS;gBAQ9B,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,uBAAuB,GAAG,SAAS;IAM3F,qEAAqE;IAC/D,WAAW,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBlD,kFAAkF;IAClF,MAAM,IAAI,IAAI;IAMd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA+C/D;AAmBD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAE3F;AAED,iEAAiE;AACjE,wBAAgB,qCAAqC,IAAI,IAAI,CAG5D;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQpG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,MAAM,EACN,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,iBAAiB,CAYpB"}

package/dist/routes/tenant-credentials.js

@@ -0,0 +1,156 @@
+import { getTenantCredentialsStorage, tenantOrgId } from "./provider-credentials.js";
+import { isOAuthCredentialExpired } from "../storage/domains/credentials/base.js";
+import { setCredentialStoreProvider } from "@mastra/code-sdk/agents/credential-resolver";
+import { getOAuthProvider } from "@mastra/code-sdk/auth/storage";
+//#region src/routes/tenant-credentials.ts
+/** How long a hydrated snapshot is considered fresh. */
+const SNAPSHOT_TTL_MS = 15e3;
+/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */
+const MAX_CACHED_TENANTS = 1e3;
+var TenantCredentialStore = class {
+	allowEnvironmentFallback = false;
+	#orgId;
+	#userId;
+	#credentials;
+	#snapshot = /* @__PURE__ */ new Map();
+	#fetchedAt = 0;
+	#hydrating;
+	constructor(orgId, userId, credentials) {
+		this.#orgId = orgId;
+		this.#userId = userId;
+		this.#credentials = credentials;
+	}
+	/** Hydrate the snapshot when stale; coalesces concurrent callers. */
+	async ensureFresh(now = Date.now()) {
+		if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;
+		this.#hydrating ??= this.#hydrate().finally(() => {
+			this.#hydrating = void 0;
+		});
+		await this.#hydrating;
+	}
+	async #hydrate() {
+		const storage = await getTenantCredentialsStorage(this.#credentials);
+		if (!storage) return;
+		const records = await storage.listCredentials(this.#orgId, this.#userId);
+		const next = /* @__PURE__ */ new Map();
+		for (const record of records.filter((r) => r.scope === "org")) next.set(record.provider, record.credential);
+		for (const record of records.filter((r) => r.scope === "user")) next.set(record.provider, record.credential);
+		this.#snapshot = next;
+		this.#fetchedAt = Date.now();
+	}
+	/** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */
+	reload() {
+		if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) this.ensureFresh().catch(() => {});
+	}
+	get(provider) {
+		return this.#snapshot.get(provider);
+	}
+	getStoredApiKey(provider) {
+		const cred = this.#snapshot.get(provider);
+		return cred?.type === "api_key" ? cred.key : void 0;
+	}
+	/**
+	* Authoritative fetch-time resolution: re-reads the domain (user > org) and
+	* refreshes expired OAuth tokens under the domain's row lock. Mirrors
+	* `AuthStorage.getApiKey` semantics: `undefined` on missing credential or
+	* failed refresh (caller surfaces a re-login error).
+	*/
+	async getApiKey(provider) {
+		const storage = await getTenantCredentialsStorage(this.#credentials);
+		if (!storage) {
+			const cred = this.#snapshot.get(provider);
+			if (cred?.type === "api_key") return cred.key;
+			if (cred?.type === "oauth" && !isOAuthCredentialExpired(cred)) return getOAuthProvider(provider)?.getApiKey(cred);
+			return;
+		}
+		const resolved = await storage.resolveCredential(this.#orgId, this.#userId, provider);
+		if (!resolved) {
+			this.#snapshot.delete(provider);
+			return;
+		}
+		this.#snapshot.set(provider, resolved.credential);
+		if (resolved.credential.type === "api_key") return resolved.credential.key;
+		const oauthProvider = getOAuthProvider(provider);
+		if (!oauthProvider) return void 0;
+		if (!isOAuthCredentialExpired(resolved.credential)) return oauthProvider.getApiKey(resolved.credential);
+		const rowTenant = resolved.scope === "user" ? {
+			orgId: this.#orgId,
+			userId: this.#userId
+		} : { orgId: this.#orgId };
+		try {
+			const refreshed = await storage.refreshOAuth(rowTenant, provider, async (current) => ({
+				type: "oauth",
+				...await oauthProvider.refreshToken(current)
+			}));
+			if (!refreshed) return void 0;
+			this.#snapshot.set(provider, refreshed);
+			return oauthProvider.getApiKey(refreshed);
+		} catch {
+			return;
+		}
+	}
+};
+const tenantStores = /* @__PURE__ */ new Map();
+function storeFor(tenant, credentials) {
+	const orgId = tenantOrgId(tenant);
+	const key = `${orgId}\u0000${tenant.userId}`;
+	let store = tenantStores.get(key);
+	if (!store) {
+		if (tenantStores.size >= MAX_CACHED_TENANTS) {
+			const oldest = tenantStores.keys().next().value;
+			if (oldest !== void 0) tenantStores.delete(oldest);
+		}
+		store = new TenantCredentialStore(orgId, tenant.userId, credentials);
+		tenantStores.set(key, store);
+	}
+	return store;
+}
+/**
+* Register the web tenant credential store provider with the SDK. Called by
+* the factory after storage init with the `model-credentials` domain handle;
+* from then on `resolveModel` uses per-tenant credentials and the SDK skips
+* the `loadStoredApiKeysIntoEnv` env side-channel.
+*/
+function registerTenantCredentialResolver(credentials) {
+	setCredentialStoreProvider((tenant) => storeFor(tenant, credentials));
+}
+/** Test hook: clear registration and cached tenant snapshots. */
+function resetTenantCredentialResolverForTests() {
+	setCredentialStoreProvider(void 0);
+	tenantStores.clear();
+}
+/**
+* Drop cached snapshots after a credential write so the change is visible to
+* the next model call immediately instead of after the snapshot TTL. An org
+* write affects every member's resolved view, so all stores under the org are
+* invalidated; a user write only drops that user's store.
+*/
+function invalidateTenantCredentialSnapshots(tenant) {
+	if (tenant.userId) {
+		tenantStores.delete(`${tenant.orgId}\u0000${tenant.userId}`);
+		return;
+	}
+	for (const key of tenantStores.keys()) if (key.startsWith(`${tenant.orgId}\u0000`)) tenantStores.delete(key);
+}
+/**
+* Middleware mounted after the web auth gate: primes the caller's credential
+* snapshot so the request's first model call sees their credentials without an
+* async seam in model resolution. Cheap when fresh (TTL check), best-effort
+* when not — a failed hydrate falls back to env vars, never blocks a request.
+*/
+async function primeTenantCredentials({ tenant, credentials }) {
+	await storeFor(tenant, credentials).ensureFresh();
+}
+function createTenantCredentialPrimer({ auth, credentials }) {
+	return async (c, next) => {
+		const tenant = auth.tenant(c);
+		if (tenant) try {
+			await storeFor(tenant, credentials).ensureFresh();
+		} catch {}
+		await next();
+	};
+}
+//#endregion
+export { TenantCredentialStore, createTenantCredentialPrimer, invalidateTenantCredentialSnapshots, primeTenantCredentials, registerTenantCredentialResolver, resetTenantCredentialResolverForTests };
+
+//# sourceMappingURL=tenant-credentials.js.map

package/dist/routes/tenant-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-credentials.js","names":["#orgId","#userId","#credentials","#fetchedAt","#hydrating","#hydrate","#snapshot"],"sources":["../../src/routes/tenant-credentials.ts"],"sourcesContent":["/**\n * Per-tenant credential store for model resolution (deployed mode).\n *\n * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a\n * store synchronously, so this module keeps a small per-tenant **snapshot** of\n * resolved credentials (user rows over org rows) hydrated from the\n * `model-credentials` domain. The snapshot serves the gateway's synchronous\n * path-selection reads (`get` / `getStoredApiKey`); the fetch-time\n * `getApiKey` is authoritative — it re-resolves against the domain and\n * refreshes expired OAuth tokens under the domain's row lock, so a slightly\n * stale snapshot can never send an expired token upstream.\n *\n * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted\n * after the web auth gate) so the first model call of a request already sees\n * the caller's credentials. This store explicitly disables the SDK's\n * environment fallback so server-shell credentials never leak into tenants.\n */\n\nimport type { CredentialTenant as SdkCredentialTenant } from '@mastra/code-sdk/agents/credential-resolver';\nimport { setCredentialStoreProvider } from '@mastra/code-sdk/agents/credential-resolver';\nimport { getOAuthProvider } from '@mastra/code-sdk/auth/storage';\nimport type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';\nimport type { MiddlewareHandler } from 'hono';\n\nimport { isOAuthCredentialExpired } from '../storage/domains/credentials/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport { getTenantCredentialsStorage, tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_TENANTS = 1000;\n\nexport class TenantCredentialStore implements CredentialStore {\n  readonly allowEnvironmentFallback = false;\n  readonly #orgId: string;\n  readonly #userId: string;\n  readonly #credentials: ModelCredentialsStorage | undefined;\n  #snapshot = new Map<string, AuthCredential>();\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(orgId: string, userId: string, credentials: ModelCredentialsStorage | undefined) {\n    this.#orgId = orgId;\n    this.#userId = userId;\n    this.#credentials = credentials;\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) return; // Keep the last tenant-scoped snapshot.\n    const records = await storage.listCredentials(this.#orgId, this.#userId);\n    const next = new Map<string, AuthCredential>();\n    // Org rows first so user rows overwrite them (user > org precedence).\n    for (const record of records.filter(r => r.scope === 'org')) {\n      next.set(record.provider, record.credential);\n    }\n    for (const record of records.filter(r => r.scope === 'user')) {\n      next.set(record.provider, record.credential);\n    }\n    this.#snapshot = next;\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  reload(): void {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n  }\n\n  get(provider: string): AuthCredential | undefined {\n    return this.#snapshot.get(provider);\n  }\n\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.#snapshot.get(provider);\n    return cred?.type === 'api_key' ? cred.key : undefined;\n  }\n\n  /**\n   * Authoritative fetch-time resolution: re-reads the domain (user > org) and\n   * refreshes expired OAuth tokens under the domain's row lock. Mirrors\n   * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or\n   * failed refresh (caller surfaces a re-login error).\n   */\n  async getApiKey(provider: string): Promise<string | undefined> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) {\n      // Domain unavailable: best effort from the snapshot; expired OAuth\n      // tokens cannot be refreshed without the domain's lock.\n      const cred = this.#snapshot.get(provider);\n      if (cred?.type === 'api_key') return cred.key;\n      if (cred?.type === 'oauth' && !isOAuthCredentialExpired(cred)) {\n        return getOAuthProvider(provider)?.getApiKey(cred);\n      }\n      return undefined;\n    }\n\n    const resolved = await storage.resolveCredential(this.#orgId, this.#userId, provider);\n    if (!resolved) {\n      this.#snapshot.delete(provider);\n      return undefined;\n    }\n    this.#snapshot.set(provider, resolved.credential);\n\n    if (resolved.credential.type === 'api_key') {\n      return resolved.credential.key;\n    }\n\n    const oauthProvider = getOAuthProvider(provider);\n    if (!oauthProvider) return undefined;\n\n    if (!isOAuthCredentialExpired(resolved.credential)) {\n      return oauthProvider.getApiKey(resolved.credential);\n    }\n\n    // Refresh at the scope the credential actually lives at (OAuth rows are\n    // user-scoped by policy, but resolve defensively from the record).\n    const rowTenant = resolved.scope === 'user' ? { orgId: this.#orgId, userId: this.#userId } : { orgId: this.#orgId };\n    try {\n      const refreshed = await storage.refreshOAuth(rowTenant, provider, async current => ({\n        type: 'oauth' as const,\n        ...(await oauthProvider.refreshToken(current)),\n      }));\n      if (!refreshed) return undefined;\n      this.#snapshot.set(provider, refreshed);\n      return oauthProvider.getApiKey(refreshed);\n    } catch {\n      // Refresh failed — user needs to re-login (same posture as AuthStorage).\n      return undefined;\n    }\n  }\n}\n\nconst tenantStores = new Map<string, TenantCredentialStore>();\n\nfunction storeFor(tenant: SdkCredentialTenant, credentials: ModelCredentialsStorage): TenantCredentialStore {\n  const orgId = tenantOrgId(tenant);\n  const key = `${orgId}\\u0000${tenant.userId}`;\n  let store = tenantStores.get(key);\n  if (!store) {\n    if (tenantStores.size >= MAX_CACHED_TENANTS) {\n      const oldest = tenantStores.keys().next().value;\n      if (oldest !== undefined) tenantStores.delete(oldest);\n    }\n    store = new TenantCredentialStore(orgId, tenant.userId, credentials);\n    tenantStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Register the web tenant credential store provider with the SDK. Called by\n * the factory after storage init with the `model-credentials` domain handle;\n * from then on `resolveModel` uses per-tenant credentials and the SDK skips\n * the `loadStoredApiKeysIntoEnv` env side-channel.\n */\nexport function registerTenantCredentialResolver(credentials: ModelCredentialsStorage): void {\n  setCredentialStoreProvider(tenant => storeFor(tenant, credentials));\n}\n\n/** Test hook: clear registration and cached tenant snapshots. */\nexport function resetTenantCredentialResolverForTests(): void {\n  setCredentialStoreProvider(undefined);\n  tenantStores.clear();\n}\n\n/**\n * Drop cached snapshots after a credential write so the change is visible to\n * the next model call immediately instead of after the snapshot TTL. An org\n * write affects every member's resolved view, so all stores under the org are\n * invalidated; a user write only drops that user's store.\n */\nexport function invalidateTenantCredentialSnapshots(tenant: { orgId: string; userId?: string }): void {\n  if (tenant.userId) {\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}`);\n    return;\n  }\n  for (const key of tenantStores.keys()) {\n    if (key.startsWith(`${tenant.orgId}\\u0000`)) tenantStores.delete(key);\n  }\n}\n\n/**\n * Middleware mounted after the web auth gate: primes the caller's credential\n * snapshot so the request's first model call sees their credentials without an\n * async seam in model resolution. Cheap when fresh (TTL check), best-effort\n * when not — a failed hydrate falls back to env vars, never blocks a request.\n */\nexport async function primeTenantCredentials({\n  tenant,\n  credentials,\n}: {\n  tenant: SdkCredentialTenant;\n  credentials: ModelCredentialsStorage;\n}): Promise<void> {\n  await storeFor(tenant, credentials).ensureFresh();\n}\n\nexport function createTenantCredentialPrimer({\n  auth,\n  credentials,\n}: {\n  auth: RouteAuth;\n  credentials: ModelCredentialsStorage;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const tenant = auth.tenant(c);\n    if (tenant) {\n      try {\n        await storeFor(tenant, credentials).ensureFresh();\n      } catch {\n        // Fail open: model calls fall back to env credentials.\n      }\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AA8BA,MAAM,kBAAkB;;AAGxB,MAAM,qBAAqB;AAE3B,IAAa,wBAAb,MAA8D;CAC5D,2BAAoC;CACpC;CACA;CACA;CACA,4BAAY,IAAI,IAA4B;CAC5C,aAAa;CACb;CAEA,YAAY,OAAe,QAAgB,aAAkD;EAC3F,KAAKA,SAAS;EACd,KAAKC,UAAU;EACf,KAAKC,eAAe;CACtB;;CAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;EACjD,IAAI,MAAM,KAAKC,aAAa,iBAAiB;EAC7C,KAAKC,eAAe,KAAKC,SAAS,CAAC,CAAC,cAAc;GAChD,KAAKD,aAAa,KAAA;EACpB,CAAC;EACD,MAAM,KAAKA;CACb;CAEA,MAAMC,WAA0B;EAC9B,MAAM,UAAU,MAAM,4BAA4B,KAAKH,YAAY;EACnE,IAAI,CAAC,SAAS;EACd,MAAM,UAAU,MAAM,QAAQ,gBAAgB,KAAKF,QAAQ,KAAKC,OAAO;EACvE,MAAM,uBAAO,IAAI,IAA4B;EAE7C,KAAK,MAAM,UAAU,QAAQ,QAAO,MAAK,EAAE,UAAU,KAAK,GACxD,KAAK,IAAI,OAAO,UAAU,OAAO,UAAU;EAE7C,KAAK,MAAM,UAAU,QAAQ,QAAO,MAAK,EAAE,UAAU,MAAM,GACzD,KAAK,IAAI,OAAO,UAAU,OAAO,UAAU;EAE7C,KAAKK,YAAY;EACjB,KAAKH,aAAa,KAAK,IAAI;CAC7B;;CAGA,SAAe;EACb,IAAI,KAAK,IAAI,IAAI,KAAKA,cAAc,iBAClC,KAAU,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;CAE1C;CAEA,IAAI,UAA8C;EAChD,OAAO,KAAKG,UAAU,IAAI,QAAQ;CACpC;CAEA,gBAAgB,UAAsC;EACpD,MAAM,OAAO,KAAKA,UAAU,IAAI,QAAQ;EACxC,OAAO,MAAM,SAAS,YAAY,KAAK,MAAM,KAAA;CAC/C;;;;;;;CAQA,MAAM,UAAU,UAA+C;EAC7D,MAAM,UAAU,MAAM,4BAA4B,KAAKJ,YAAY;EACnE,IAAI,CAAC,SAAS;GAGZ,MAAM,OAAO,KAAKI,UAAU,IAAI,QAAQ;GACxC,IAAI,MAAM,SAAS,WAAW,OAAO,KAAK;GAC1C,IAAI,MAAM,SAAS,WAAW,CAAC,yBAAyB,IAAI,GAC1D,OAAO,iBAAiB,QAAQ,CAAC,EAAE,UAAU,IAAI;GAEnD;EACF;EAEA,MAAM,WAAW,MAAM,QAAQ,kBAAkB,KAAKN,QAAQ,KAAKC,SAAS,QAAQ;EACpF,IAAI,CAAC,UAAU;GACb,KAAKK,UAAU,OAAO,QAAQ;GAC9B;EACF;EACA,KAAKA,UAAU,IAAI,UAAU,SAAS,UAAU;EAEhD,IAAI,SAAS,WAAW,SAAS,WAC/B,OAAO,SAAS,WAAW;EAG7B,MAAM,gBAAgB,iBAAiB,QAAQ;EAC/C,IAAI,CAAC,eAAe,OAAO,KAAA;EAE3B,IAAI,CAAC,yBAAyB,SAAS,UAAU,GAC/C,OAAO,cAAc,UAAU,SAAS,UAAU;EAKpD,MAAM,YAAY,SAAS,UAAU,SAAS;GAAE,OAAO,KAAKN;GAAQ,QAAQ,KAAKC;EAAQ,IAAI,EAAE,OAAO,KAAKD,OAAO;EAClH,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,aAAa,WAAW,UAAU,OAAM,aAAY;IAClF,MAAM;IACN,GAAI,MAAM,cAAc,aAAa,OAAO;GAC9C,EAAE;GACF,IAAI,CAAC,WAAW,OAAO,KAAA;GACvB,KAAKM,UAAU,IAAI,UAAU,SAAS;GACtC,OAAO,cAAc,UAAU,SAAS;EAC1C,QAAQ;GAEN;EACF;CACF;AACF;AAEA,MAAM,+BAAe,IAAI,IAAmC;AAE5D,SAAS,SAAS,QAA6B,aAA6D;CAC1G,MAAM,QAAQ,YAAY,MAAM;CAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,OAAO;CACpC,IAAI,QAAQ,aAAa,IAAI,GAAG;CAChC,IAAI,CAAC,OAAO;EACV,IAAI,aAAa,QAAQ,oBAAoB;GAC3C,MAAM,SAAS,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,IAAI,WAAW,KAAA,GAAW,aAAa,OAAO,MAAM;EACtD;EACA,QAAQ,IAAI,sBAAsB,OAAO,OAAO,QAAQ,WAAW;EACnE,aAAa,IAAI,KAAK,KAAK;CAC7B;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,iCAAiC,aAA4C;CAC3F,4BAA2B,WAAU,SAAS,QAAQ,WAAW,CAAC;AACpE;;AAGA,SAAgB,wCAA8C;CAC5D,2BAA2B,KAAA,CAAS;CACpC,aAAa,MAAM;AACrB;;;;;;;AAQA,SAAgB,oCAAoC,QAAkD;CACpG,IAAI,OAAO,QAAQ;EACjB,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,QAAQ;EAC3D;CACF;CACA,KAAK,MAAM,OAAO,aAAa,KAAK,GAClC,IAAI,IAAI,WAAW,GAAG,OAAO,MAAM,OAAO,GAAG,aAAa,OAAO,GAAG;AAExE;;;;;;;AAQA,eAAsB,uBAAuB,EAC3C,QACA,eAIgB;CAChB,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,YAAY;AAClD;AAEA,SAAgB,6BAA6B,EAC3C,MACA,eAIoB;CACpB,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,SAAS,KAAK,OAAO,CAAC;EAC5B,IAAI,QACF,IAAI;GACF,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,YAAY;EAClD,QAAQ,CAER;EAEF,MAAM,KAAK;CACb;AACF"}

package/dist/routes/work-items.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Mastra `apiRoutes` for Factory work items (the kanban board).
+ *
+ * Registered alongside the other `/web/*` routes behind the host auth gate.
+ * The board is org-wide: every route re-resolves the caller's `(orgId, userId)`
+ * tenant and scopes reads/writes by `orgId`, so any org member sees and moves
+ * the same cards while `created_by` / stage history record who acted.
+ */
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryStartCoordinator } from '../rules/start-coordinator.js';
+import type { FactoryTransitionService } from '../rules/transition-service.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';
+import type { CreateWorkItemInput, UpdateWorkItemInput, WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+export interface WorkItemRoutesDeps extends RouteDependencies {
+    audit: AuditEmitter;
+    /** Factory projects domain — validates the `:id` project belongs to the caller's org. */
+    projects: FactoryProjectsStorage;
+    /** Work-items domain backing the kanban board. */
+    workItems: WorkItemsStorage;
+    /** Per-project queue-health threshold config. */
+    queueHealth: QueueHealthStorage;
+    /** Governed stage-transition service. Stage moves 503 when absent. */
+    transitionService?: Pick<FactoryTransitionService, 'transition' | 'ruleSetVersion'>;
+    /** Coordinator that binds a Factory run before dispatching its kickoff. */
+    startCoordinator?: Pick<FactoryStartCoordinator, 'prepare'>;
+}
+/** Validate an untrusted create body. Unknown keys are dropped. */
+export declare function parseCreateWorkItem(body: unknown): CreateWorkItemInput | null;
+/** Validate an untrusted patch body. Unknown keys are dropped. */
+export declare function parseUpdateWorkItem(body: unknown): UpdateWorkItemInput | null;
+export declare class WorkItemRoutes extends Route<WorkItemRoutesDeps> {
+    #private;
+    /** Build the Factory work-item routes as Mastra `apiRoutes`. */
+    routes(): ApiRoute[];
+}
+//# sourceMappingURL=work-items.d.ts.map

package/dist/routes/work-items.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-items.d.ts","sourceRoot":"","sources":["../../src/routes/work-items.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EACV,uBAAuB,EAGxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAA4B,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAGzG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,KAAK,EACV,mBAAmB,EAInB,mBAAmB,EAKnB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,KAAK,EAAE,YAAY,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,sBAAsB,CAAC;IACjC,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,iDAAiD;IACjD,WAAW,EAAE,kBAAkB,CAAC;IAChC,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,gBAAgB,CAAC,CAAC;IACpF,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;CAC7D;AAqED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAuB7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA4B7E;AAmLD,qBAAa,cAAe,SAAQ,KAAK,CAAC,kBAAkB,CAAC;;IA0G3D,gEAAgE;IAChE,MAAM,IAAI,QAAQ,EAAE;CAuWrB"}