@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/factory.js

@@ -0,0 +1,483 @@
+import { timedPhase } from "./timing.js";
+import { buildAuthRoutes, createFactoryAuthGate, createFactoryRouteAuth, getFactoryAuthOrgId, getFactoryAuthUserId } from "./auth.js";
+import { recordFactoryPullRequestProvenance } from "./integrations/github/provenance.js";
+import { SandboxFleet } from "./sandbox/fleet.js";
+import { releaseWorkItemSandboxes } from "./integrations/github/sandbox-release.js";
+import { assertFactoryRules } from "./rules/validation.js";
+import { PlatformGithubIntegration } from "./integrations/platform/github/integration.js";
+import { PlatformLinearIntegration } from "./integrations/platform/linear/integration.js";
+import { createCustomProvidersPrimer, registerCustomProvidersSource } from "./routes/custom-provider-source.js";
+import { ProjectRoutes } from "./routes/projects.js";
+import { FactoryTransitionService } from "./rules/transition-service.js";
+import { ModelCredentialsStorage } from "./storage/domains/credentials/base.js";
+import { createTenantCredentialPrimer, primeTenantCredentials, registerTenantCredentialResolver } from "./routes/tenant-credentials.js";
+import { QueueHealthStorage } from "./storage/domains/queue-health/base.js";
+import { WorkItemsStorage } from "./storage/domains/work-items/base.js";
+import { assembleFactoryApiRoutes, buildIntegrationContext } from "./routes/surface.js";
+import { builtInFactoryRules } from "./rules/defaults.js";
+import { FactoryDecisionDispatcher } from "./rules/dispatcher.js";
+import { FactoryPhaseStateProcessor } from "./rules/processor.js";
+import { createFactoryTransitionTools } from "./rules/tools.js";
+import { registerSandboxReattach } from "./sandbox/reattach.js";
+import { handleServerError } from "./server-error.js";
+import { createSpaStaticMiddleware, resolveUiDistDir } from "./spa-static.js";
+import { createStateSigner } from "./state-signing.js";
+import { observeAgentGitAction } from "./storage/domains/audit/agent-audit.js";
+import { AuditStorage } from "./storage/domains/audit/base.js";
+import { AuditDomain } from "./storage/domains/audit/domain.js";
+import { ChannelIdentityStorage } from "./storage/domains/channel-identity/base.js";
+import { CustomProvidersStorage } from "./storage/domains/custom-providers/base.js";
+import { IntakeStorage } from "./storage/domains/intake/base.js";
+import { IntegrationStorage } from "./storage/domains/integrations/base.js";
+import { MemorySettingsStorage } from "./storage/domains/memory-settings/base.js";
+import { ModelPacksStorage } from "./storage/domains/model-packs/base.js";
+import { FactoryProjectsStorage } from "./storage/domains/projects/base.js";
+import { SourceControlStorage } from "./storage/domains/source-control/base.js";
+import { createWorkspaceFactory } from "./workspace.js";
+import { hasAuthInit } from "@mastra/core/server";
+import { MastraAuthStudio } from "@mastra/auth-studio";
+import { prepareAgentControllerMount } from "@mastra/code-sdk";
+import { LocalSandbox } from "@mastra/core/workspace";
+//#region src/factory.ts
+/**
+* `MastraFactory` — the single entry point to the whole Mastra Software Factory.
+*
+* The consumer's deploy entry constructs deployment-specific config instances
+* (auth adapter, pubsub) and passes them here explicitly. The only provider
+* defaults constructed here are Platform GitHub and Linear integrations when
+* Platform credentials exist and the caller did not provide those integrations.
+*
+* `prepare()` resolves feature readiness, threads every dependency explicitly,
+* assembles the web routes/middleware, and returns the constructor args for
+* `new Mastra(...)`. The literal `export const mastra = new Mastra(...)` must
+* stay in the entry file — the deployer's `checkConfigExport` Babel plugin
+* only marks the config valid when it finds that literal in the entry AST —
+* so the factory produces args instead of the instance. `finalize()` runs the
+* post-construct boot (controller init + workers).
+*
+* Integration readiness is derived from each instance's declared capabilities
+* and the storage domains those capabilities require.
+*/
+const CONTROLLER_ID = "code";
+function hasPlatformSecretKey() {
+	return Boolean(process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());
+}
+/**
+* The template sandbox's own working directory, when it exposes one as a
+* string (core `LocalSandbox` does; remote providers generally don't).
+* Used as the default checkout base so a local template rooted at a host
+* directory checks repos out under that same root.
+*/
+function templateWorkingDirectory(sandbox) {
+	const wd = sandbox.workingDirectory;
+	return typeof wd === "string" && wd.length > 0 ? wd : void 0;
+}
+function resolveSandboxWorkdirBase(machine, configuredWorkdir) {
+	const machineWorkdir = templateWorkingDirectory(machine);
+	return ((configuredWorkdir === "/workspace" && machineWorkdir ? machineWorkdir : configuredWorkdir ?? machineWorkdir) ?? "/workspace").replace(/\/+$/, "");
+}
+/**
+* Default auth provider — `MastraAuthStudio`, which proxies identity to the
+* shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,
+* `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —
+* this helper only derives a cookie-domain fallback from the factory's
+* `publicUrl`.
+*
+* Cookie-domain resolution (Studio picks the first that wins):
+*   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;
+*   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;
+*   3. this parent-domain fallback derived from `publicUrl` — so a deploy on
+*      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`
+*      without the caller wiring the env var by hand.
+*   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.
+*/
+function buildDefaultStudioAuth(publicUrl) {
+	return new MastraAuthStudio({ cookieDomain: parentDomainFromPublicUrl(publicUrl) });
+}
+/**
+* Derive a parent cookie domain from `publicUrl` by stripping the leftmost
+* label — the same shape platform-API's env injection uses (see
+* `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\./, '')}`).
+*
+* Rather than a generic `strip-left-label` heuristic — which either emits
+* cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`
+* requires PSL data to be safe) or misclassifies numeric hostnames like
+* `3scale.example.com` as IPv4 — we only derive a parent domain when the
+* host sits under one of the platform's known registrable domains. Anything
+* else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)
+* falls through to host-only cookies. Callers that need a different scope
+* pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).
+*/
+const KNOWN_PLATFORM_COOKIE_PARENTS = ["mastra.cloud", "mastra.ai"];
+function isIpLiteral(hostname) {
+	if (hostname.includes(":")) return true;
+	return /^\d+(?:\.\d+){3}$/.test(hostname);
+}
+function parentDomainFromPublicUrl(publicUrl) {
+	let hostname;
+	try {
+		hostname = new URL(publicUrl).hostname.toLowerCase();
+	} catch {
+		return;
+	}
+	if (hostname === "localhost" || isIpLiteral(hostname)) return void 0;
+	for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {
+		if (hostname === parent) return void 0;
+		if (hostname.endsWith(`.${parent}`)) return `.${parent}`;
+	}
+}
+var MastraFactory = class {
+	#config;
+	#prepared;
+	#dispatcher;
+	#factoryProcessor;
+	#preparing = false;
+	constructor(config) {
+		if (!config?.storage) throw new Error("MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.");
+		this.#config = config;
+	}
+	/**
+	* Resolve feature readiness, wire every dependency explicitly, and assemble
+	* everything needed to construct the server-owned Mastra. Returns the args
+	* for the `new Mastra(...)` literal that must live in the entry file.
+	*/
+	async prepare() {
+		if (this.#preparing) throw new Error("MastraFactory.prepare() called twice");
+		this.#preparing = true;
+		const publicOrigin = (this.#config.publicUrl ?? "http://localhost:4111").replace(/\/+$/, "");
+		const allowedOrigins = (this.#config.allowedOrigins ?? []).map((o) => o.replace(/\/+$/, "")).filter(Boolean);
+		const storage = this.#config.storage;
+		const vector = this.#config.vector;
+		const pubsub = this.#config.pubsub;
+		const configuredAuth = this.#config.auth;
+		const auth = configuredAuth === null ? void 0 : configuredAuth ?? buildDefaultStudioAuth(publicOrigin);
+		const routeAuth = createFactoryRouteAuth(auth);
+		const integrations = [...this.#config.integrations ?? []];
+		if (hasPlatformSecretKey()) {
+			if (!integrations.some((integration) => integration.id === "github")) integrations.push(new PlatformGithubIntegration({ runIssueTriage: this.#config.platform?.runIssueTriage }));
+			if (!integrations.some((integration) => integration.id === "linear")) integrations.push(new PlatformLinearIntegration());
+		}
+		const integrationIds = /* @__PURE__ */ new Set();
+		for (const integration of integrations) {
+			if (integrationIds.has(integration.id)) throw new Error(`MastraFactory: duplicate integration id '${integration.id}' in 'integrations'.`);
+			integrationIds.add(integration.id);
+		}
+		const rules = this.#config.rules ?? builtInFactoryRules();
+		assertFactoryRules(rules);
+		const intakeStorage = storage.registerDomain(new IntakeStorage());
+		const auditStorage = storage.registerDomain(new AuditStorage());
+		const workItemsStorage = storage.registerDomain(new WorkItemsStorage());
+		const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage());
+		const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());
+		const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());
+		const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage());
+		const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());
+		const integrationStorage = storage.registerDomain(new IntegrationStorage());
+		const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());
+		const sourceControlStorage = storage.registerDomain(new SourceControlStorage());
+		const domains = {
+			intake: intakeStorage,
+			modelCredentials: modelCredentialsStorage,
+			modelPacks: modelPacksStorage,
+			memorySettings: memorySettingsStorage,
+			customProviders: customProvidersStorage,
+			projects: factoryProjectsStorage,
+			queueHealth: queueHealthStorage,
+			workItems: workItemsStorage,
+			channelIdentity: storage.registerDomain(new ChannelIdentityStorage())
+		};
+		const projectRoutes = new ProjectRoutes({
+			auth: routeAuth,
+			projects: factoryProjectsStorage,
+			sourceControl: sourceControlStorage,
+			versionControlIntegrationIds: integrations.filter((integration) => integration.versionControl).map((integration) => integration.id)
+		});
+		const auditDomain = new AuditDomain({
+			auth: routeAuth,
+			audit: auditStorage,
+			projects: factoryProjectsStorage,
+			sinks: integrations,
+			agentTenant: (requestContext) => {
+				const user = requestContext.get("user");
+				return {
+					orgId: getFactoryAuthOrgId(user),
+					userId: getFactoryAuthUserId(user)
+				};
+			}
+		});
+		const sandboxConfig = this.#config.sandbox;
+		const machine = sandboxConfig?.machine;
+		if (machine && typeof machine.clone !== "function") throw new Error(`MastraFactory: the configured sandbox machine (provider '${machine.provider}') does not implement clone(). Project repositories each get their own sandbox cloned from the configured machine. Pass a machine that implements clone() — e.g. RailwaySandbox (@mastra/railway) or LocalSandbox (@mastra/core/workspace) — or omit 'sandbox' to disable sandboxes.`);
+		const fleet = new SandboxFleet(machine ? {
+			machine,
+			workdirBase: resolveSandboxWorkdirBase(machine, sandboxConfig?.workdir),
+			maxSandboxes: sandboxConfig?.maxSandboxes
+		} : void 0);
+		registerSandboxReattach(fleet);
+		const stateSigner = createStateSigner(this.#config.stateSecret);
+		if (auth && hasAuthInit(auth)) await timedPhase("prepare.auth.init", () => auth.init({
+			database: storage.authDatabase?.(),
+			publicUrl: publicOrigin,
+			allowedOrigins
+		}));
+		await timedPhase("prepare.storage.init", () => storage.init());
+		if (auth) registerTenantCredentialResolver(modelCredentialsStorage);
+		registerCustomProvidersSource({
+			storage: customProvidersStorage,
+			authEnabled: Boolean(auth)
+		});
+		for (const integration of integrations) {
+			integration.initialize?.({
+				storage: integrationStorage.forIntegration(integration.id),
+				projects: factoryProjectsStorage,
+				auth: routeAuth
+			});
+			if (integration.versionControl) integration.versionControl.initialize({ storage: sourceControlStorage.forIntegration(integration.id) });
+		}
+		const integrationRegistrations = integrations.map((integration) => {
+			const requiredDomains = [
+				"integrations",
+				...integration.versionControl ? ["source-control"] : [],
+				...integration.channels ? ["channel-identity"] : []
+			];
+			return {
+				integration,
+				ready: requiredDomains.every((domain) => storage.isDomainReady(domain)),
+				ensureReady: async () => {
+					for (const domain of requiredDomains) await storage.ensureDomainReady(domain);
+				}
+			};
+		});
+		const intakeReady = integrations.some((integration) => integration.intake !== void 0) && storage.isDomainReady("intake");
+		const factoryReady = storage.isDomainReady("projects") && storage.isDomainReady("work-items");
+		const githubIntegration = integrations.find((integration) => integration.id === "github");
+		const workItemsReady = storage.isDomainReady("work-items");
+		const releaseTerminalSandboxes = machine && !(machine instanceof LocalSandbox) && workItemsReady && storage.isDomainReady("source-control") ? async ({ orgId, workItemId }) => releaseWorkItemSandboxes({
+			workItems: workItemsStorage,
+			sourceControl: sourceControlStorage.forIntegration("github"),
+			fleet,
+			orgId,
+			workItemId
+		}) : void 0;
+		const transitionService = workItemsReady ? new FactoryTransitionService({
+			rules,
+			storage: workItemsStorage,
+			...releaseTerminalSandboxes ? { onTerminalStage: releaseTerminalSandboxes } : {}
+		}) : void 0;
+		const factoryProcessor = workItemsReady ? new FactoryPhaseStateProcessor({
+			rules,
+			storage: workItemsStorage,
+			...transitionService ? { transitionService } : {},
+			...githubIntegration ? { recordPullRequestProvenance: (input) => recordFactoryPullRequestProvenance(githubIntegration, sourceControlStorage.forIntegration("github"), integrationStorage.forIntegration("github"), input) } : {},
+			messageReader: { listMessages: async (input) => {
+				const memory = await storage.getMastraStorage().getStore("memory");
+				return memory ? memory.listMessages(input) : {
+					messages: [],
+					hasMore: false
+				};
+			} }
+		}) : void 0;
+		for (const { integration } of integrationRegistrations) if (integration.requiresStableStateSigner && !stateSigner.stable) throw new Error(`MastraFactory: integration '${integration.id}' signs OAuth state and requires a replica-stable state secret, but none is configured. Set 'stateSecret' on the factory config.`);
+		const mastraStorageBackend = (() => {
+			for (let proto = Object.getPrototypeOf(storage); proto; proto = Object.getPrototypeOf(proto)) {
+				if (proto.constructor?.name === "PgFactoryStorage") return "pg";
+				if (proto.constructor?.name === "LibSQLFactoryStorage") return "libsql";
+			}
+		})();
+		const toolIntegrations = integrationRegistrations.filter(({ integration }) => integration.agentTools || integration.sessionTools);
+		const prepared = await timedPhase("prepare.controllerMount", () => prepareAgentControllerMount({
+			controllerId: CONTROLLER_ID,
+			workspace: createWorkspaceFactory({
+				...this.#config.sandbox ? { sandbox: this.#config.sandbox } : {},
+				...githubIntegration ? { github: githubIntegration } : {},
+				...workItemsStorage ? { workItems: workItemsStorage } : {},
+				fleet
+			}),
+			disableGithubSignals: true,
+			disableSettingsOmSeed: true,
+			storage: storage.getMastraStorage(),
+			...mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {},
+			...factoryProcessor ? { inputProcessors: [factoryProcessor] } : {},
+			...vector ? { vector } : {},
+			...toolIntegrations.length > 0 || workItemsStorage && transitionService ? { extraTools: async ({ requestContext }) => {
+				const tools = {};
+				const toolOwners = /* @__PURE__ */ new Map();
+				const mergeTools = (ownerId, contributed) => {
+					for (const [name, tool] of Object.entries(contributed)) {
+						const owner = toolOwners.get(name);
+						if (owner) throw new Error(`MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`);
+						toolOwners.set(name, ownerId);
+						tools[name] = tool;
+					}
+				};
+				if (workItemsStorage && transitionService) mergeTools("factory", await createFactoryTransitionTools({
+					requestContext,
+					storage: workItemsStorage,
+					transitionService
+				}));
+				for (const { integration, ready, ensureReady } of toolIntegrations) {
+					if (!ready && ensureReady) try {
+						await ensureReady();
+					} catch {
+						continue;
+					}
+					if (integration.agentTools) mergeTools(integration.id, await integration.agentTools({ requestContext }));
+					if (integration.sessionTools) mergeTools(integration.id, integration.sessionTools({ requestContext }));
+				}
+				return tools;
+			} } : {},
+			postToolObserver: async (toolContext) => {
+				const requestContext = toolContext.context?.requestContext;
+				if (requestContext) await observeAgentGitAction({
+					audit: auditDomain,
+					toolContext: {
+						...toolContext,
+						context: requestContext
+					}
+				});
+				await Promise.all(integrations.map(async (integration) => {
+					if (!integration.postToolObserver) return;
+					try {
+						await integration.postToolObserver({
+							toolContext,
+							requestContext
+						});
+					} catch (error) {
+						console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);
+					}
+				}));
+			},
+			...pubsub ? {
+				pubsub,
+				crossProcessPubSub: true
+			} : {},
+			buildApiRoutes: ({ controller, authStorage }) => [
+				...auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : [],
+				...assembleFactoryApiRoutes({
+					controllerId: CONTROLLER_ID,
+					controller,
+					auth: routeAuth,
+					authStorage,
+					audit: auditDomain,
+					publicOrigin,
+					stateSigner,
+					fleet,
+					factoryStorage: storage,
+					integrationStorage,
+					sourceControlStorage,
+					domains,
+					integrations: integrationRegistrations,
+					intakeReady,
+					factoryReady,
+					rules,
+					factoryTransitionService: transitionService,
+					onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {
+						this.#dispatcher ??= new FactoryDecisionDispatcher({
+							controller,
+							transitionService: runtimeTransitionService,
+							storage: storage.getDomain("work-items"),
+							reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),
+							prepareBinding,
+							primeCredentials: (tenant) => primeTenantCredentials({
+								tenant,
+								credentials: modelCredentialsStorage
+							})
+						});
+					}
+				}),
+				...projectRoutes.routes(),
+				...auditDomain.routes()
+			],
+			buildServerConfig: () => {
+				const cors = allowedOrigins.length ? { cors: {
+					origin: allowedOrigins,
+					credentials: true
+				} } : {};
+				const onError = { onError: handleServerError };
+				const uiDist = resolveUiDistDir();
+				const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];
+				if (!auth) return {
+					middleware: [createCustomProvidersPrimer({
+						auth: routeAuth,
+						storage: customProvidersStorage,
+						authEnabled: false
+					}), ...spa],
+					...cors,
+					...onError
+				};
+				return {
+					auth,
+					middleware: [
+						createFactoryAuthGate(auth),
+						createTenantCredentialPrimer({
+							auth: routeAuth,
+							credentials: modelCredentialsStorage
+						}),
+						createCustomProvidersPrimer({
+							auth: routeAuth,
+							storage: customProvidersStorage,
+							authEnabled: Boolean(auth)
+						}),
+						...spa
+					],
+					...cors,
+					...onError
+				};
+			}
+		}));
+		this.#prepared = prepared;
+		this.#factoryProcessor = factoryProcessor;
+		const channelRegistrations = integrationRegistrations.filter(({ integration, ready }) => ready && integration.channels);
+		if (channelRegistrations.length > 1) throw new Error(`MastraFactory: integrations [${channelRegistrations.map(({ integration }) => integration.id).join(", ")}] all provide channels, but only one may. Remove all but one.`);
+		for (const { integration } of channelRegistrations) prepared.base.controller.setChannels(integration.channels(buildIntegrationContext({
+			controller: prepared.base.controller,
+			publicOrigin,
+			auth: routeAuth,
+			stateSigner,
+			fleet,
+			factoryStorage: storage,
+			integrationStorage,
+			sourceControlStorage,
+			rules,
+			factoryReady,
+			domains
+		}, integration.id)));
+		const integrationWorkers = integrationRegistrations.filter(({ integration, ready }) => ready && integration.workers).flatMap(({ integration }) => integration.workers(buildIntegrationContext({
+			controller: prepared.base.controller,
+			publicOrigin,
+			auth: routeAuth,
+			stateSigner,
+			fleet,
+			factoryStorage: storage,
+			integrationStorage,
+			sourceControlStorage,
+			rules,
+			factoryReady,
+			domains
+		}, integration.id)));
+		return {
+			...prepared.mastraArgs,
+			...auth ? { studio: { auth } } : {},
+			...integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}
+		};
+	}
+	/**
+	* Post-construct boot: initialize the controller (which inherits the
+	* constructed Mastra's storage) and start its workers. Call AFTER the entry
+	* has run `new Mastra(prepare()'s args)`.
+	*/
+	async finalize() {
+		if (!this.#prepared) throw new Error("MastraFactory.finalize() called before prepare()");
+		await timedPhase("finalize.controller", () => this.#prepared.finalize());
+		await timedPhase("finalize.reconcileBoundThreads", () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve());
+		this.#dispatcher?.start();
+	}
+	/** Stop Factory-owned background dispatch before the host process shuts down. */
+	async shutdown() {
+		await this.#dispatcher?.stop();
+	}
+};
+//#endregion
+export { MastraFactory };
+
+//# sourceMappingURL=factory.js.map

package/dist/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","names":["#config","#preparing","#dispatcher","#prepared","#factoryProcessor"],"sources":["../src/factory.ts"],"sourcesContent":["/**\n * `MastraFactory` — the single entry point to the whole Mastra Software Factory.\n *\n * The consumer's deploy entry constructs deployment-specific config instances\n * (auth adapter, pubsub) and passes them here explicitly. The only provider\n * defaults constructed here are Platform GitHub and Linear integrations when\n * Platform credentials exist and the caller did not provide those integrations.\n *\n * `prepare()` resolves feature readiness, threads every dependency explicitly,\n * assembles the web routes/middleware, and returns the constructor args for\n * `new Mastra(...)`. The literal `export const mastra = new Mastra(...)` must\n * stay in the entry file — the deployer's `checkConfigExport` Babel plugin\n * only marks the config valid when it finds that literal in the entry AST —\n * so the factory produces args instead of the instance. `finalize()` runs the\n * post-construct boot (controller init + workers).\n *\n * Integration readiness is derived from each instance's declared capabilities\n * and the storage domains those capabilities require.\n */\n\nimport { MastraAuthStudio } from '@mastra/auth-studio';\nimport { prepareAgentControllerMount } from '@mastra/code-sdk';\nimport type { PubSub } from '@mastra/core/events';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { hasAuthInit } from '@mastra/core/server';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport { LocalSandbox } from '@mastra/core/workspace';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport type { FactoryAuthUser } from './auth.js';\nimport {\n  buildAuthRoutes,\n  createFactoryAuthGate,\n  createFactoryRouteAuth,\n  getFactoryAuthOrgId,\n  getFactoryAuthUserId,\n} from './auth.js';\nimport type { FactoryIntegration, IntegrationPostToolContext, IntegrationTools } from './integrations/base.js';\nimport type { GithubIntegration } from './integrations/github/integration.js';\nimport type { GithubIssueTriageInput, GithubIssueTriageResult } from './integrations/github/issue-triage.js';\nimport { recordFactoryPullRequestProvenance } from './integrations/github/provenance.js';\nimport { releaseWorkItemSandboxes } from './integrations/github/sandbox-release.js';\nimport { PlatformGithubIntegration } from './integrations/platform/github/integration.js';\nimport { PlatformLinearIntegration } from './integrations/platform/linear/integration.js';\nimport { createCustomProvidersPrimer, registerCustomProvidersSource } from './routes/custom-provider-source.js';\nimport { ProjectRoutes } from './routes/projects.js';\nimport { assembleFactoryApiRoutes, buildIntegrationContext } from './routes/surface.js';\nimport type { FactoryApiRoutesDeps } from './routes/surface.js';\nimport {\n  createTenantCredentialPrimer,\n  primeTenantCredentials,\n  registerTenantCredentialResolver,\n} from './routes/tenant-credentials.js';\nimport { builtInFactoryRules } from './rules/defaults.js';\nimport { FactoryDecisionDispatcher } from './rules/dispatcher.js';\nimport { FactoryPhaseStateProcessor } from './rules/processor.js';\nimport { createFactoryTransitionTools } from './rules/tools.js';\nimport { FactoryTransitionService } from './rules/transition-service.js';\nimport type { FactoryRules } from './rules/types.js';\nimport { assertFactoryRules } from './rules/validation.js';\nimport { SandboxFleet } from './sandbox/fleet.js';\nimport { registerSandboxReattach } from './sandbox/reattach.js';\nimport { handleServerError } from './server-error.js';\nimport { createSpaStaticMiddleware, resolveUiDistDir } from './spa-static.js';\nimport { createStateSigner } from './state-signing.js';\nimport { observeAgentGitAction } from './storage/domains/audit/agent-audit.js';\nimport { AuditStorage } from './storage/domains/audit/base.js';\nimport { AuditDomain } from './storage/domains/audit/domain.js';\nimport { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';\nimport { ModelCredentialsStorage } from './storage/domains/credentials/base.js';\nimport { CustomProvidersStorage } from './storage/domains/custom-providers/base.js';\nimport { IntakeStorage } from './storage/domains/intake/base.js';\nimport { IntegrationStorage } from './storage/domains/integrations/base.js';\nimport { MemorySettingsStorage } from './storage/domains/memory-settings/base.js';\nimport { ModelPacksStorage } from './storage/domains/model-packs/base.js';\nimport { FactoryProjectsStorage } from './storage/domains/projects/base.js';\nimport { QueueHealthStorage } from './storage/domains/queue-health/base.js';\nimport { SourceControlStorage } from './storage/domains/source-control/base.js';\nimport { WorkItemsStorage } from './storage/domains/work-items/base.js';\nimport { timedPhase } from './timing.js';\nimport { createWorkspaceFactory } from './workspace.js';\n\ntype BuildApiRoutesDeps = Pick<FactoryApiRoutesDeps, 'controller' | 'authStorage'>;\n\n/** Constructor args for the `new Mastra(...)` literal in the deploy entry. */\nexport type MastraArgs = NonNullable<ConstructorParameters<typeof Mastra>[0]>;\n\nexport interface MastraFactoryConfig {\n  /**\n   * Auth provider instance — `MastraAuthStudio` (`@mastra/auth-studio`),\n   * `MastraAuthWorkos` (`@mastra/auth-workos`), `MastraAuthBetterAuth`\n   * (`@mastra/auth-better-auth`), or any custom `MastraAuthProvider`. Whatever\n   * instance is passed is the active provider; a passed instance is always\n   * honored as-is.\n   *\n   * Omitted → the factory defaults to `MastraAuthStudio`, proxying auth\n   * through the shared Mastra platform API. `MastraAuthStudio` resolves its\n   * own env (`MASTRA_SHARED_API_URL`, `MASTRA_ORGANIZATION_ID`,\n   * `MASTRA_COOKIE_DOMAIN`).\n   *\n   * Pass `null` to disable auth entirely (open server, local-dev behavior)\n   * without falling back to the default.\n   */\n  auth?: IMastraAuthProvider | null;\n  /**\n   * REQUIRED. Factory storage backend powering BOTH agent storage (threads,\n   * messages, memory, OM — via `getMastraStorage()`) and the app tables\n   * (projects/source-control/audit/intake — via the generic ops surface). Pass a\n   * `PgFactoryStorage` (`@mastra/pg`) for deployments or a\n   * `LibSQLFactoryStorage` (`@mastra/libsql`) for local dev — one backend,\n   * one connection, every feature on.\n   */\n  storage: FactoryStorage;\n  /**\n   * Vector store instance for recall search — `PgVector` (`@mastra/pg`) on\n   * the same database as `storage`. Omitted → the SDK mount's default vector\n   * store resolution applies.\n   */\n  vector?: MastraVector;\n  /**\n   * Distributed event bus instance (e.g. `new RedisStreamsPubSub({ url })`).\n   * When set, streams/workflows/signals ride it across processes and the\n   * controller drops file-based thread locks in favor of pubsub-coordinated\n   * leases. Omitted → in-process default.\n   */\n  pubsub?: PubSub;\n  /**\n   * Browser-facing origin used to build integration OAuth/install callback\n   * URLs and to derive the auth redirect URI. On the platform the SPA is\n   * hosted separately, so this MUST be the public API origin.\n   * Default: `http://localhost:4111` (the local Factory server, which also\n   * serves the UI).\n   */\n  publicUrl?: string;\n  /**\n   * Allowed cross-origin SPA origins. The SPA may be served from a separate\n   * static host, so credentialed requests must be explicitly allowed.\n   */\n  allowedOrigins?: string[];\n  /** Sandbox configuration. Omitted → repository sandboxes are disabled. */\n  sandbox?: MastraFactorySandboxConfig;\n  /**\n   * Deployment-stable secret for signing integration OAuth `state` values.\n   * Omitted → a per-process random secret, which is fine for single-process\n   * local development but rejected for integrations that declare\n   * `requiresStableStateSigner`.\n   */\n  stateSecret?: string;\n  /**\n   * Registered capability providers. The factory registers the pieces each\n   * `FactoryIntegration` instance provides — HTTP routes, storage domains,\n   * agent/session tools, intake, source control, and diagnostics — into the\n   * system. When Platform credentials are configured, missing `github` and\n   * `linear` integrations default to their Platform-backed implementations.\n   */\n  integrations?: FactoryIntegration[];\n  /**\n   * Authoritative Factory board, tool-result, and GitHub-event rules. Construct\n   * with `defaultFactoryRules({ version, overrides })` so deployment policy has\n   * an explicit version and exact handler leaves replace rather than compose.\n   * Omitted → conservative built-in rules for the current deployment.\n   */\n  rules?: FactoryRules;\n\n  /**\n   * Platform-specific overrides. When the Platform-backed GitHub integration\n   * is active, it derives a `runIssueTriage` runner from the mounted\n   * controller automatically. An explicit `runIssueTriage` here takes\n   * precedence over the controller-derived default.\n   */\n  platform?: {\n    runIssueTriage?: (input: GithubIssueTriageInput) => Promise<GithubIssueTriageResult>;\n  };\n}\n\nexport interface MastraFactorySandboxConfig {\n  /**\n   * Template machine — `RailwaySandbox` (`@mastra/railway`), core\n   * `LocalSandbox` (`@mastra/core/workspace`), or any `WorkspaceSandbox` that\n   * implements `clone()`. Each project-repository execution environment gets\n   * its own sandbox cloned from this machine; the machine itself is never\n   * started. `prepare()` fails fast when the instance lacks `clone()`.\n   */\n  machine: WorkspaceSandbox;\n  /**\n   * In-sandbox base directory repos check out under (nested `owner/name` per\n   * repo). Default: the machine's own `workingDirectory` when it exposes one\n   * (core `LocalSandbox` does), else `/workspace`.\n   */\n  workdir?: string;\n  /**\n   * Per-replica cap on concurrently provisioned sandboxes. `0`/omitted means\n   * unlimited. A lightweight per-process budget, not a cross-replica scheduler.\n   */\n  maxSandboxes?: number;\n}\n\nconst CONTROLLER_ID = 'code';\n\nfunction hasPlatformSecretKey(): boolean {\n  return Boolean(process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());\n}\n\n/**\n * The template sandbox's own working directory, when it exposes one as a\n * string (core `LocalSandbox` does; remote providers generally don't).\n * Used as the default checkout base so a local template rooted at a host\n * directory checks repos out under that same root.\n */\nfunction templateWorkingDirectory(sandbox: WorkspaceSandbox): string | undefined {\n  const wd = (sandbox as { workingDirectory?: unknown }).workingDirectory;\n  return typeof wd === 'string' && wd.length > 0 ? wd : undefined;\n}\n\nfunction resolveSandboxWorkdirBase(machine: WorkspaceSandbox, configuredWorkdir?: string): string {\n  const machineWorkdir = templateWorkingDirectory(machine);\n  const workdir =\n    configuredWorkdir === '/workspace' && machineWorkdir ? machineWorkdir : (configuredWorkdir ?? machineWorkdir);\n  return (workdir ?? '/workspace').replace(/\\/+$/, '');\n}\n\n/**\n * Default auth provider — `MastraAuthStudio`, which proxies identity to the\n * shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,\n * `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —\n * this helper only derives a cookie-domain fallback from the factory's\n * `publicUrl`.\n *\n * Cookie-domain resolution (Studio picks the first that wins):\n *   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;\n *   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;\n *   3. this parent-domain fallback derived from `publicUrl` — so a deploy on\n *      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`\n *      without the caller wiring the env var by hand.\n *   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.\n */\nfunction buildDefaultStudioAuth(publicUrl: string): IMastraAuthProvider {\n  return new MastraAuthStudio({\n    cookieDomain: parentDomainFromPublicUrl(publicUrl),\n  });\n}\n\n/**\n * Derive a parent cookie domain from `publicUrl` by stripping the leftmost\n * label — the same shape platform-API's env injection uses (see\n * `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\\./, '')}`).\n *\n * Rather than a generic `strip-left-label` heuristic — which either emits\n * cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`\n * requires PSL data to be safe) or misclassifies numeric hostnames like\n * `3scale.example.com` as IPv4 — we only derive a parent domain when the\n * host sits under one of the platform's known registrable domains. Anything\n * else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)\n * falls through to host-only cookies. Callers that need a different scope\n * pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).\n */\nconst KNOWN_PLATFORM_COOKIE_PARENTS = ['mastra.cloud', 'mastra.ai'] as const;\n\nfunction isIpLiteral(hostname: string): boolean {\n  // IPv6 addresses in URLs are bracketed; `URL.hostname` strips the brackets\n  // but the address itself still contains `:`. IPv4 is four dot-separated\n  // numeric octets — trust the parser to have already validated shape.\n  if (hostname.includes(':')) return true;\n  return /^\\d+(?:\\.\\d+){3}$/.test(hostname);\n}\n\nfunction parentDomainFromPublicUrl(publicUrl: string): string | undefined {\n  let hostname: string;\n  try {\n    hostname = new URL(publicUrl).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (hostname === 'localhost' || isIpLiteral(hostname)) return undefined;\n  for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {\n    // Exact match → we're already on the parent, host-only is correct.\n    // Subdomain match → mint the parent-scoped cookie.\n    if (hostname === parent) return undefined;\n    if (hostname.endsWith(`.${parent}`)) return `.${parent}`;\n  }\n  return undefined;\n}\n\nexport class MastraFactory {\n  readonly #config: MastraFactoryConfig;\n  #prepared: Awaited<ReturnType<typeof prepareAgentControllerMount>> | undefined;\n  #dispatcher: FactoryDecisionDispatcher | undefined;\n  #factoryProcessor: FactoryPhaseStateProcessor | undefined;\n  #preparing = false;\n\n  constructor(config: MastraFactoryConfig) {\n    if (!config?.storage) {\n      throw new Error(\n        \"MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. \" +\n          \"new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or \" +\n          \"new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.\",\n      );\n    }\n    this.#config = config;\n  }\n\n  /**\n   * Resolve feature readiness, wire every dependency explicitly, and assemble\n   * everything needed to construct the server-owned Mastra. Returns the args\n   * for the `new Mastra(...)` literal that must live in the entry file.\n   */\n  async prepare(): Promise<MastraArgs> {\n    // Guard set synchronously (before the first await) so overlapping calls —\n    // not just strictly sequential ones — can't double-seed the runtime\n    // registry or double-run one-time adapter init.\n    if (this.#preparing) throw new Error('MastraFactory.prepare() called twice');\n    this.#preparing = true;\n\n    const publicOrigin = (this.#config.publicUrl ?? 'http://localhost:4111').replace(/\\/+$/, '');\n    const allowedOrigins = (this.#config.allowedOrigins ?? []).map(o => o.replace(/\\/+$/, '')).filter(Boolean);\n    const storage = this.#config.storage;\n    const vector = this.#config.vector;\n    const pubsub = this.#config.pubsub;\n    // Default auth: honor an explicitly-passed provider (including `null` to\n    // disable auth) as-is; otherwise fall back to `MastraAuthStudio`\n    // (platform-proxied identity). The default derives its cookie domain\n    // from `publicUrl` — deploys on `<sub>.mastra.cloud` mint parent-domain\n    // cookies without the caller wiring `MASTRA_COOKIE_DOMAIN` explicitly.\n    const configuredAuth = this.#config.auth;\n    const auth: IMastraAuthProvider | undefined =\n      configuredAuth === null ? undefined : (configuredAuth ?? buildDefaultStudioAuth(publicOrigin));\n    // One RouteAuth seam per boot, closed over the resolved provider. Every\n    // factory route module receives this handle — no service locator.\n    const routeAuth = createFactoryRouteAuth(auth);\n\n    // Explicit integrations win. Platform credentials fill only missing GitHub\n    // and Linear slots so callers can override either provider independently.\n    const integrations = [...(this.#config.integrations ?? [])];\n    if (hasPlatformSecretKey()) {\n      if (!integrations.some(integration => integration.id === 'github')) {\n        integrations.push(\n          new PlatformGithubIntegration({\n            runIssueTriage: this.#config.platform?.runIssueTriage,\n          }),\n        );\n      }\n      if (!integrations.some(integration => integration.id === 'linear')) {\n        integrations.push(new PlatformLinearIntegration());\n      }\n    }\n\n    // Validate ids up front so a copy-paste duplicate fails loud instead of one\n    // instance silently shadowing the other.\n    const integrationIds = new Set<string>();\n    for (const integration of integrations) {\n      if (integrationIds.has(integration.id)) {\n        throw new Error(`MastraFactory: duplicate integration id '${integration.id}' in 'integrations'.`);\n      }\n      integrationIds.add(integration.id);\n    }\n    const rules = this.#config.rules ?? builtInFactoryRules();\n    assertFactoryRules(rules);\n\n    // FactoryStorage owns every app-table domain and initializes them through\n    // the same lifecycle as the backend connection.\n    const intakeStorage = storage.registerDomain(new IntakeStorage());\n    const auditStorage = storage.registerDomain(new AuditStorage());\n    const workItemsStorage = storage.registerDomain(new WorkItemsStorage());\n    const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage());\n    const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());\n    const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());\n    const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage());\n    const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());\n    // Generic integration storage (connections/subscriptions/settings) — the\n    // default persistence surface for integrations without a bespoke domain.\n    const integrationStorage = storage.registerDomain(new IntegrationStorage());\n    const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());\n    const sourceControlStorage = storage.registerDomain(new SourceControlStorage());\n    // Reverse index from a platform sender (Slack/Discord/...) to a Mastra\n    // tenant, so inbound channel events can resolve the sender's model creds.\n    const channelIdentityStorage = storage.registerDomain(new ChannelIdentityStorage());\n    // Every app-table domain handle the route builders and integrations need,\n    // threaded explicitly (no service locator).\n    const domains = {\n      intake: intakeStorage,\n      modelCredentials: modelCredentialsStorage,\n      modelPacks: modelPacksStorage,\n      memorySettings: memorySettingsStorage,\n      customProviders: customProvidersStorage,\n      projects: factoryProjectsStorage,\n      queueHealth: queueHealthStorage,\n      workItems: workItemsStorage,\n      channelIdentity: channelIdentityStorage,\n    };\n    const projectRoutes = new ProjectRoutes({\n      auth: routeAuth,\n      projects: factoryProjectsStorage,\n      sourceControl: sourceControlStorage,\n      versionControlIntegrationIds: integrations\n        .filter(integration => integration.versionControl)\n        .map(integration => integration.id),\n    });\n    const auditDomain = new AuditDomain({\n      auth: routeAuth,\n      audit: auditStorage,\n      projects: factoryProjectsStorage,\n      sinks: integrations,\n      agentTenant: requestContext => {\n        const user = requestContext.get('user') as FactoryAuthUser | undefined;\n        return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n      },\n    });\n\n    // Repository execution needs one sandbox per project-repository link,\n    // cloned from the configured machine. A machine without `clone()` would\n    // only fail on first use, so fail fast at boot instead.\n    const sandboxConfig = this.#config.sandbox;\n    const machine = sandboxConfig?.machine;\n    if (machine && typeof machine.clone !== 'function') {\n      throw new Error(\n        `MastraFactory: the configured sandbox machine (provider '${machine.provider}') does not implement clone(). ` +\n          `Project repositories each get their own sandbox cloned from the configured machine. ` +\n          `Pass a machine that implements clone() — e.g. RailwaySandbox (@mastra/railway) or ` +\n          `LocalSandbox (@mastra/core/workspace) — or omit 'sandbox' to disable sandboxes.`,\n      );\n    }\n\n    // One sandbox fleet per boot: constructed with the machine config when\n    // sandboxes are configured, disabled otherwise. Handed to integrations\n    // through the IntegrationContext — no global registry.\n    const fleet = new SandboxFleet(\n      machine\n        ? {\n            machine,\n            workdirBase: resolveSandboxWorkdirBase(machine, sandboxConfig?.workdir),\n            maxSandboxes: sandboxConfig?.maxSandboxes,\n          }\n        : undefined,\n    );\n    // Core's `getDynamicWorkspace` reattaches project sandboxes through the\n    // SDK seam; only this factory owns the fleet, so register it here.\n    registerSandboxReattach(fleet);\n\n    // One shared OAuth state signer per boot. The deploy entry supplies a\n    // replica-stable secret when needed; otherwise local development gets a\n    // per-process random signer (`stable: false`).\n    const stateSigner = createStateSigner(this.#config.stateSecret);\n\n    // One-time provider initialization with factory-level context (e.g.\n    // better-auth builds its default instance on the backend's auth\n    // database, WorkOS derives its redirect URI from the public URL).\n    // Failures surface here, at prepare() — a misconfigured provider must\n    // not boot.\n    if (auth && hasAuthInit(auth)) {\n      await timedPhase('prepare.auth.init', () =>\n        auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins }),\n      );\n    }\n\n    // Single init path: backend connection failure is a hard boot error;\n    // registered app domains initialize fail-soft inside FactoryStorage.\n    await timedPhase('prepare.storage.init', () => storage.init());\n\n    // Per-tenant model credentials: once the credentials domain is up, model\n    // resolution goes through the caller's own store and the SDK stops\n    // mirroring stored API keys into process.env.\n    //\n    // Only register when a real auth adapter gates callers. In local /\n    // auth-disabled mode there is no authenticated tenant, so registering would\n    // force every model call through an empty tenant store (fail-closed, no env\n    // fallback) and break chat with \"Not logged in\". Leaving it unregistered\n    // lets the SDK fall back to the file-backed AuthStorage (auth.json) — the\n    // same store the local /login and Settings pages read and write.\n    if (auth) {\n      registerTenantCredentialResolver(modelCredentialsStorage);\n    }\n\n    // Custom providers: DB-backed in both modes (org rows in tenant mode, the\n    // sentinel `local` org in no-auth mode). Once registered, model resolution\n    // and the gateway catalog never read settings.json custom providers.\n    registerCustomProvidersSource({ storage: customProvidersStorage, authEnabled: Boolean(auth) });\n\n    for (const integration of integrations) {\n      integration.initialize?.({\n        storage: integrationStorage.forIntegration(integration.id),\n        projects: factoryProjectsStorage,\n        auth: routeAuth,\n      });\n      if (integration.versionControl) {\n        integration.versionControl.initialize({\n          storage: sourceControlStorage.forIntegration(integration.id),\n        });\n      }\n    }\n\n    // Every integration uses generic integration storage. Version-control\n    // providers additionally require the source-control storage domain. Readiness\n    // is derived solely from capability presence, never from provider ids.\n    const integrationRegistrations = integrations.map(integration => {\n      const requiredDomains = [\n        'integrations',\n        ...(integration.versionControl ? ['source-control'] : []),\n        // Channels resolve an inbound sender to a tenant through the reverse\n        // index; without it every message would dispatch tenant-less.\n        ...(integration.channels ? ['channel-identity'] : []),\n      ];\n      return {\n        integration,\n        ready: requiredDomains.every(domain => storage.isDomainReady(domain)),\n        ensureReady: async () => {\n          for (const domain of requiredDomains) await storage.ensureDomainReady(domain);\n        },\n      };\n    });\n    const intakeReady =\n      integrations.some(integration => integration.intake !== undefined) && storage.isDomainReady('intake');\n    const factoryReady = storage.isDomainReady('projects') && storage.isDomainReady('work-items');\n    const githubIntegration = integrations.find(integration => integration.id === 'github') as\n      | GithubIntegration\n      | undefined;\n    const workItemsReady = storage.isDomainReady('work-items');\n    // Terminal work items release their session sandboxes back to the reuse\n    // pool so the next session for the same repository/user claims a warm VM\n    // instead of provisioning fresh. Remote providers only: local \"sandboxes\"\n    // are the host machine with per-session workdirs — nothing to pool.\n    const releaseTerminalSandboxes =\n      machine && !(machine instanceof LocalSandbox) && workItemsReady && storage.isDomainReady('source-control')\n        ? async ({ orgId, workItemId }: { orgId: string; workItemId: string }) =>\n            releaseWorkItemSandboxes({\n              workItems: workItemsStorage,\n              sourceControl: sourceControlStorage.forIntegration('github'),\n              fleet,\n              orgId,\n              workItemId,\n            })\n        : undefined;\n    const transitionService = workItemsReady\n      ? new FactoryTransitionService({\n          rules,\n          storage: workItemsStorage,\n          ...(releaseTerminalSandboxes ? { onTerminalStage: releaseTerminalSandboxes } : {}),\n        })\n      : undefined;\n    const factoryProcessor = workItemsReady\n      ? new FactoryPhaseStateProcessor({\n          rules,\n          storage: workItemsStorage,\n          ...(transitionService ? { transitionService } : {}),\n          ...(githubIntegration\n            ? {\n                recordPullRequestProvenance: (input: Parameters<typeof recordFactoryPullRequestProvenance>[3]) =>\n                  recordFactoryPullRequestProvenance(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration('github'),\n                    integrationStorage.forIntegration('github'),\n                    input,\n                  ),\n              }\n            : {}),\n          messageReader: {\n            listMessages: async input => {\n              const memory = await storage.getMastraStorage().getStore('memory');\n              return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n            },\n          },\n        })\n      : undefined;\n\n    // Boot assertion: an active integration that signs OAuth `state` needs a\n    // replica-stable signer — a per-process random secret silently breaks the\n    // OAuth callback on any replica that didn't sign the state. Fail loud now\n    // instead. (The built-ins also assert this inside their readiness gates.)\n    for (const { integration } of integrationRegistrations) {\n      if (integration.requiresStableStateSigner && !stateSigner.stable) {\n        throw new Error(\n          `MastraFactory: integration '${integration.id}' signs OAuth state and requires a ` +\n            `replica-stable state secret, but none is configured. Set 'stateSecret' on the factory config.`,\n        );\n      }\n    }\n\n    // The SDK needs to know which backend the injected Mastra store uses\n    // (its own `instanceof` detection breaks when the dependency graph holds\n    // duplicate package copies). Resolve it by walking the FactoryStorage\n    // prototype chain by class name — the factory can't import the concrete\n    // classes since '@mastra/pg' / '@mastra/libsql' are the user's choice.\n    const mastraStorageBackend = (() => {\n      for (let proto = Object.getPrototypeOf(storage); proto; proto = Object.getPrototypeOf(proto)) {\n        if (proto.constructor?.name === 'PgFactoryStorage') return 'pg' as const;\n        if (proto.constructor?.name === 'LibSQLFactoryStorage') return 'libsql' as const;\n      }\n      return undefined;\n    })();\n\n    // Integrations contributing tools to agent sessions: org-scoped\n    // `agentTools` (resolved per request) + session-scoped `sessionTools`.\n    const toolIntegrations = integrationRegistrations.filter(\n      ({ integration }) => integration.agentTools || integration.sessionTools,\n    );\n\n    // Build the real production controller (agents, modes, tools, memory, OM,\n    // MCP, providers) — identical to the terminal app. Agent state lives in\n    // the storage backend's Mastra store alongside the Factory app tables —\n    // one shared database for all users, separated by `resourceId` scoping.\n    const prepared = await timedPhase('prepare.controllerMount', () =>\n      prepareAgentControllerMount({\n        controllerId: CONTROLLER_ID,\n        workspace: createWorkspaceFactory({\n          ...(this.#config.sandbox ? { sandbox: this.#config.sandbox } : {}),\n          ...(githubIntegration ? { github: githubIntegration } : {}),\n          ...(workItemsStorage ? { workItems: workItemsStorage } : {}),\n          fleet,\n        }),\n        disableGithubSignals: true,\n        // Memory settings live in the factory's `memory-settings` app table (per\n        // org/user), so the host machine's TUI settings.json must not seed them.\n        disableSettingsOmSeed: true,\n        storage: storage.getMastraStorage(),\n        ...(mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {}),\n        ...(factoryProcessor ? { inputProcessors: [factoryProcessor] } : {}),\n        ...(vector ? { vector } : {}),\n        ...(toolIntegrations.length > 0 || (workItemsStorage && transitionService)\n          ? {\n              extraTools: async ({ requestContext }: { requestContext: RequestContext }) => {\n                const tools: IntegrationTools = {};\n                const toolOwners = new Map<string, string>();\n                const mergeTools = (ownerId: string, contributed: IntegrationTools) => {\n                  for (const [name, tool] of Object.entries(contributed)) {\n                    const owner = toolOwners.get(name);\n                    if (owner) {\n                      throw new Error(\n                        `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`,\n                      );\n                    }\n                    toolOwners.set(name, ownerId);\n                    tools[name] = tool;\n                  }\n                };\n                if (workItemsStorage && transitionService) {\n                  mergeTools(\n                    'factory',\n                    await createFactoryTransitionTools({\n                      requestContext,\n                      storage: workItemsStorage,\n                      transitionService,\n                    }),\n                  );\n                }\n                for (const { integration, ready, ensureReady } of toolIntegrations) {\n                  if (!ready && ensureReady) {\n                    try {\n                      await ensureReady();\n                    } catch {\n                      continue;\n                    }\n                  }\n                  if (integration.agentTools) {\n                    mergeTools(integration.id, await integration.agentTools({ requestContext }));\n                  }\n                  if (integration.sessionTools) {\n                    mergeTools(integration.id, integration.sessionTools({ requestContext }));\n                  }\n                }\n                return tools;\n              },\n            }\n          : {}),\n        postToolObserver: async (toolContext: IntegrationPostToolContext) => {\n          const requestContext = (toolContext.context as { requestContext?: RequestContext } | undefined)\n            ?.requestContext;\n          if (requestContext) {\n            await observeAgentGitAction({\n              audit: auditDomain,\n              toolContext: { ...toolContext, context: requestContext },\n            });\n          }\n          await Promise.all(\n            integrations.map(async integration => {\n              if (!integration.postToolObserver) return;\n              try {\n                await integration.postToolObserver({ toolContext, requestContext });\n              } catch (error) {\n                console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);\n              }\n            }),\n          );\n        },\n        ...(pubsub ? { pubsub, crossProcessPubSub: true } : {}),\n        buildApiRoutes: ({ controller, authStorage }: BuildApiRoutesDeps) => [\n          // Public `/auth/*` routes (login/callback/logout/me). Folded in as\n          // `apiRoutes` (not plain Hono routes) because the entry can't touch the\n          // Hono app the deployer generates. `requiresAuth: false`; the gate\n          // skips `/auth/*`.\n          ...(auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : []),\n          // Custom `/web/*` routes (fs / config / integrations / factory / audit).\n          ...assembleFactoryApiRoutes({\n            controllerId: CONTROLLER_ID,\n            controller,\n            auth: routeAuth,\n            authStorage,\n            audit: auditDomain,\n            publicOrigin,\n            stateSigner,\n            fleet,\n            factoryStorage: storage,\n            integrationStorage,\n            sourceControlStorage,\n            domains,\n            integrations: integrationRegistrations,\n            intakeReady,\n            factoryReady,\n            rules,\n            factoryTransitionService: transitionService,\n            onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {\n              this.#dispatcher ??= new FactoryDecisionDispatcher({\n                controller,\n                transitionService: runtimeTransitionService,\n                storage: storage.getDomain<WorkItemsStorage>('work-items'),\n                reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n                prepareBinding,\n                primeCredentials: tenant => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage }),\n              });\n            },\n          }),\n          ...projectRoutes.routes(),\n          ...auditDomain.routes(),\n        ],\n        buildServerConfig: () => {\n          const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};\n          // Log route errors with method/path/stack and answer with structured\n          // JSON instead of an opaque `Internal Server Error`. Applied by the\n          // deployer to both the top-level app and the custom-route sub-app.\n          const onError = { onError: handleServerError };\n          // Same-origin SPA: when a vite build is present (see resolveUiDistDir),\n          // serve it at `/` from this server. Mounted last so the auth gate (when\n          // enabled) covers it; it always passes `/api`, `/web`, `/auth` through.\n          const uiDist = resolveUiDistDir();\n          const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];\n          if (!auth) {\n            // Auth disabled: no gate. Still prime the sentinel-local custom\n            // provider snapshot so model calls see DB rows, then SPA + CORS.\n            return {\n              middleware: [\n                createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),\n                ...spa,\n              ],\n              ...cors,\n              ...onError,\n            };\n          }\n\n          // Ordered middleware. The deployer applies these AFTER its context\n          // middleware sets `c.set('mastra', mastra)` and BEFORE routes, so:\n          //   1. gate   — validates the auth session, stashes the user, and 401s /\n          //               redirects unauthenticated requests. Skips public `/auth/*`.\n          //   2. primers — hydrate the caller's model-credential and custom\n          //               provider snapshots so the request's first model call\n          //               resolves tenant credentials and custom providers.\n          //   3. spa    — serves the built UI for everything the server doesn't own.\n          // `auth` also lands on `server.auth` so the core auth middleware (and\n          // Studio's dual-auth routing — see `studio.auth` on the returned args)\n          // authenticates core `/api/*` routes with the same provider.\n          return {\n            auth,\n            middleware: [\n              createFactoryAuthGate(auth),\n              createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),\n              createCustomProvidersPrimer({\n                auth: routeAuth,\n                storage: customProvidersStorage,\n                authEnabled: Boolean(auth),\n              }),\n              ...spa,\n            ],\n            ...cors,\n            ...onError,\n          };\n        },\n      }),\n    );\n\n    this.#prepared = prepared;\n    this.#factoryProcessor = factoryProcessor;\n\n    // Chat-platform channels (Slack, Discord, …) contributed by integrations,\n    // attached to the mounted controller so inbound platform messages reach\n    // the same agents the web UI drives. READY integrations only — readiness\n    // means the `channel-identity` domain's `init()` succeeded, so its link\n    // table is queryable. Without it a sender can't be resolved to a tenant,\n    // and attaching anyway would dispatch runs on default credentials.\n    const channelRegistrations = integrationRegistrations.filter(\n      ({ integration, ready }) => ready && integration.channels,\n    );\n    // `setChannels` replaces rather than merges, so a second provider would\n    // silently never receive a message. Fail loud instead.\n    if (channelRegistrations.length > 1) {\n      throw new Error(\n        `MastraFactory: integrations [${channelRegistrations\n          .map(({ integration }) => integration.id)\n          .join(', ')}] all provide channels, but only one may. Remove all but one.`,\n      );\n    }\n    for (const { integration } of channelRegistrations) {\n      prepared.base.controller.setChannels(\n        integration.channels!(\n          buildIntegrationContext(\n            {\n              controller: prepared.base.controller,\n              publicOrigin,\n              auth: routeAuth,\n              stateSigner,\n              fleet,\n              factoryStorage: storage,\n              integrationStorage,\n              sourceControlStorage,\n              rules,\n              factoryReady,\n              domains,\n            },\n            integration.id,\n          ),\n        ),\n      );\n    }\n\n    // Integration lifecycle workers (e.g. polling an upstream without\n    // webhooks): collected from READY integrations only, folded into the\n    // constructor args so `new Mastra(...)` merges them with the default\n    // workers and `finalize()`'s `startWorkers()` starts them alongside the\n    // built-ins. Never passed for the disabled/not-ready case — a worker for\n    // an unavailable integration must not run.\n    const integrationWorkers = integrationRegistrations\n      .filter(({ integration, ready }) => ready && integration.workers)\n      .flatMap(({ integration }) =>\n        integration.workers!(\n          buildIntegrationContext(\n            {\n              controller: prepared.base.controller,\n              publicOrigin,\n              auth: routeAuth,\n              stateSigner,\n              fleet,\n              factoryStorage: storage,\n              integrationStorage,\n              sourceControlStorage,\n              rules,\n              factoryReady,\n              domains,\n            },\n            integration.id,\n          ),\n        ),\n      );\n\n    return {\n      ...prepared.mastraArgs,\n      // Same provider on `studio.auth` as on `server.auth` (buildServerConfig):\n      // deployed factories must authenticate BOTH plain API callers and Studio\n      // requests (`x-mastra-client-type: studio` routes to `studio.auth`).\n      ...(auth ? { studio: { auth } } : {}),\n      ...(integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}),\n    };\n  }\n\n  /**\n   * Post-construct boot: initialize the controller (which inherits the\n   * constructed Mastra's storage) and start its workers. Call AFTER the entry\n   * has run `new Mastra(prepare()'s args)`.\n   */\n  async finalize(): Promise<void> {\n    if (!this.#prepared) {\n      throw new Error('MastraFactory.finalize() called before prepare()');\n    }\n    await timedPhase('finalize.controller', () => this.#prepared!.finalize());\n    await timedPhase(\n      'finalize.reconcileBoundThreads',\n      () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n    );\n    this.#dispatcher?.start();\n  }\n\n  /** Stop Factory-owned background dispatch before the host process shuts down. */\n  async shutdown(): Promise<void> {\n    await this.#dispatcher?.stop();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuMA,MAAM,gBAAgB;AAEtB,SAAS,uBAAgC;CACvC,OAAO,QAAQ,QAAQ,IAAI,4BAA4B,KAAK,CAAC;AAC/D;;;;;;;AAQA,SAAS,yBAAyB,SAA+C;CAC/E,MAAM,KAAM,QAA2C;CACvD,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,IAAI,KAAK,KAAA;AACxD;AAEA,SAAS,0BAA0B,SAA2B,mBAAoC;CAChG,MAAM,iBAAiB,yBAAyB,OAAO;CAGvD,SADE,sBAAsB,gBAAgB,iBAAiB,iBAAkB,qBAAqB,mBAC7E,aAAA,CAAc,QAAQ,QAAQ,EAAE;AACrD;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,WAAwC;CACtE,OAAO,IAAI,iBAAiB,EAC1B,cAAc,0BAA0B,SAAS,EACnD,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,MAAM,gCAAgC,CAAC,gBAAgB,WAAW;AAElE,SAAS,YAAY,UAA2B;CAI9C,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO;CACnC,OAAO,oBAAoB,KAAK,QAAQ;AAC1C;AAEA,SAAS,0BAA0B,WAAuC;CACxE,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,SAAS,CAAC,CAAC,SAAS,YAAY;CACrD,QAAQ;EACN;CACF;CACA,IAAI,aAAa,eAAe,YAAY,QAAQ,GAAG,OAAO,KAAA;CAC9D,KAAK,MAAM,UAAU,+BAA+B;EAGlD,IAAI,aAAa,QAAQ,OAAO,KAAA;EAChC,IAAI,SAAS,SAAS,IAAI,QAAQ,GAAG,OAAO,IAAI;CAClD;AAEF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CACA;CACA;CACA;CACA,aAAa;CAEb,YAAY,QAA6B;EACvC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,oOAGF;EAEF,KAAKA,UAAU;CACjB;;;;;;CAOA,MAAM,UAA+B;EAInC,IAAI,KAAKC,YAAY,MAAM,IAAI,MAAM,sCAAsC;EAC3E,KAAKA,aAAa;EAElB,MAAM,gBAAgB,KAAKD,QAAQ,aAAa,wBAAA,CAAyB,QAAQ,QAAQ,EAAE;EAC3F,MAAM,kBAAkB,KAAKA,QAAQ,kBAAkB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO;EACzG,MAAM,UAAU,KAAKA,QAAQ;EAC7B,MAAM,SAAS,KAAKA,QAAQ;EAC5B,MAAM,SAAS,KAAKA,QAAQ;EAM5B,MAAM,iBAAiB,KAAKA,QAAQ;EACpC,MAAM,OACJ,mBAAmB,OAAO,KAAA,IAAa,kBAAkB,uBAAuB,YAAY;EAG9F,MAAM,YAAY,uBAAuB,IAAI;EAI7C,MAAM,eAAe,CAAC,GAAI,KAAKA,QAAQ,gBAAgB,CAAC,CAAE;EAC1D,IAAI,qBAAqB,GAAG;GAC1B,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KACX,IAAI,0BAA0B,EAC5B,gBAAgB,KAAKA,QAAQ,UAAU,eACzC,CAAC,CACH;GAEF,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,CAAC;EAErD;EAIA,MAAM,iCAAiB,IAAI,IAAY;EACvC,KAAK,MAAM,eAAe,cAAc;GACtC,IAAI,eAAe,IAAI,YAAY,EAAE,GACnC,MAAM,IAAI,MAAM,4CAA4C,YAAY,GAAG,qBAAqB;GAElG,eAAe,IAAI,YAAY,EAAE;EACnC;EACA,MAAM,QAAQ,KAAKA,QAAQ,SAAS,oBAAoB;EACxD,mBAAmB,KAAK;EAIxB,MAAM,gBAAgB,QAAQ,eAAe,IAAI,cAAc,CAAC;EAChE,MAAM,eAAe,QAAQ,eAAe,IAAI,aAAa,CAAC;EAC9D,MAAM,mBAAmB,QAAQ,eAAe,IAAI,iBAAiB,CAAC;EACtE,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EACpF,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,wBAAwB,QAAQ,eAAe,IAAI,sBAAsB,CAAC;EAChF,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,CAAC;EAG1E,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,CAAC;EAC1E,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,uBAAuB,QAAQ,eAAe,IAAI,qBAAqB,CAAC;EAM9E,MAAM,UAAU;GACd,QAAQ;GACR,kBAAkB;GAClB,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;GACjB,UAAU;GACV,aAAa;GACb,WAAW;GACX,iBAZ6B,QAAQ,eAAe,IAAI,uBAAuB,CAYzC;EACxC;EACA,MAAM,gBAAgB,IAAI,cAAc;GACtC,MAAM;GACN,UAAU;GACV,eAAe;GACf,8BAA8B,aAC3B,QAAO,gBAAe,YAAY,cAAc,CAAC,CACjD,KAAI,gBAAe,YAAY,EAAE;EACtC,CAAC;EACD,MAAM,cAAc,IAAI,YAAY;GAClC,MAAM;GACN,OAAO;GACP,UAAU;GACV,OAAO;GACP,cAAa,mBAAkB;IAC7B,MAAM,OAAO,eAAe,IAAI,MAAM;IACtC,OAAO;KAAE,OAAO,oBAAoB,IAAI;KAAG,QAAQ,qBAAqB,IAAI;IAAE;GAChF;EACF,CAAC;EAKD,MAAM,gBAAgB,KAAKA,QAAQ;EACnC,MAAM,UAAU,eAAe;EAC/B,IAAI,WAAW,OAAO,QAAQ,UAAU,YACtC,MAAM,IAAI,MACR,4DAA4D,QAAQ,SAAS,qRAI/E;EAMF,MAAM,QAAQ,IAAI,aAChB,UACI;GACE;GACA,aAAa,0BAA0B,SAAS,eAAe,OAAO;GACtE,cAAc,eAAe;EAC/B,IACA,KAAA,CACN;EAGA,wBAAwB,KAAK;EAK7B,MAAM,cAAc,kBAAkB,KAAKA,QAAQ,WAAW;EAO9D,IAAI,QAAQ,YAAY,IAAI,GAC1B,MAAM,WAAW,2BACf,KAAK,KAAK;GAAE,UAAU,QAAQ,eAAe;GAAG,WAAW;GAAc;EAAe,CAAC,CAC3F;EAKF,MAAM,WAAW,8BAA8B,QAAQ,KAAK,CAAC;EAY7D,IAAI,MACF,iCAAiC,uBAAuB;EAM1D,8BAA8B;GAAE,SAAS;GAAwB,aAAa,QAAQ,IAAI;EAAE,CAAC;EAE7F,KAAK,MAAM,eAAe,cAAc;GACtC,YAAY,aAAa;IACvB,SAAS,mBAAmB,eAAe,YAAY,EAAE;IACzD,UAAU;IACV,MAAM;GACR,CAAC;GACD,IAAI,YAAY,gBACd,YAAY,eAAe,WAAW,EACpC,SAAS,qBAAqB,eAAe,YAAY,EAAE,EAC7D,CAAC;EAEL;EAKA,MAAM,2BAA2B,aAAa,KAAI,gBAAe;GAC/D,MAAM,kBAAkB;IACtB;IACA,GAAI,YAAY,iBAAiB,CAAC,gBAAgB,IAAI,CAAC;IAGvD,GAAI,YAAY,WAAW,CAAC,kBAAkB,IAAI,CAAC;GACrD;GACA,OAAO;IACL;IACA,OAAO,gBAAgB,OAAM,WAAU,QAAQ,cAAc,MAAM,CAAC;IACpE,aAAa,YAAY;KACvB,KAAK,MAAM,UAAU,iBAAiB,MAAM,QAAQ,kBAAkB,MAAM;IAC9E;GACF;EACF,CAAC;EACD,MAAM,cACJ,aAAa,MAAK,gBAAe,YAAY,WAAW,KAAA,CAAS,KAAK,QAAQ,cAAc,QAAQ;EACtG,MAAM,eAAe,QAAQ,cAAc,UAAU,KAAK,QAAQ,cAAc,YAAY;EAC5F,MAAM,oBAAoB,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ;EAGtF,MAAM,iBAAiB,QAAQ,cAAc,YAAY;EAKzD,MAAM,2BACJ,WAAW,EAAE,mBAAmB,iBAAiB,kBAAkB,QAAQ,cAAc,gBAAgB,IACrG,OAAO,EAAE,OAAO,iBACd,yBAAyB;GACvB,WAAW;GACX,eAAe,qBAAqB,eAAe,QAAQ;GAC3D;GACA;GACA;EACF,CAAC,IACH,KAAA;EACN,MAAM,oBAAoB,iBACtB,IAAI,yBAAyB;GAC3B;GACA,SAAS;GACT,GAAI,2BAA2B,EAAE,iBAAiB,yBAAyB,IAAI,CAAC;EAClF,CAAC,IACD,KAAA;EACJ,MAAM,mBAAmB,iBACrB,IAAI,2BAA2B;GAC7B;GACA,SAAS;GACT,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,oBACA,EACE,8BAA8B,UAC5B,mCACE,mBACA,qBAAqB,eAAe,QAAQ,GAC5C,mBAAmB,eAAe,QAAQ,GAC1C,KACF,EACJ,IACA,CAAC;GACL,eAAe,EACb,cAAc,OAAM,UAAS;IAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;KAAE,UAAU,CAAC;KAAG,SAAS;IAAM;GAC9E,EACF;EACF,CAAC,IACD,KAAA;EAMJ,KAAK,MAAM,EAAE,iBAAiB,0BAC5B,IAAI,YAAY,6BAA6B,CAAC,YAAY,QACxD,MAAM,IAAI,MACR,+BAA+B,YAAY,GAAG,iIAEhD;EASJ,MAAM,8BAA8B;GAClC,KAAK,IAAI,QAAQ,OAAO,eAAe,OAAO,GAAG,OAAO,QAAQ,OAAO,eAAe,KAAK,GAAG;IAC5F,IAAI,MAAM,aAAa,SAAS,oBAAoB,OAAO;IAC3D,IAAI,MAAM,aAAa,SAAS,wBAAwB,OAAO;GACjE;EAEF,EAAA,CAAG;EAIH,MAAM,mBAAmB,yBAAyB,QAC/C,EAAE,kBAAkB,YAAY,cAAc,YAAY,YAC7D;EAMA,MAAM,WAAW,MAAM,WAAW,iCAChC,4BAA4B;GAC1B,cAAc;GACd,WAAW,uBAAuB;IAChC,GAAI,KAAKA,QAAQ,UAAU,EAAE,SAAS,KAAKA,QAAQ,QAAQ,IAAI,CAAC;IAChE,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;IACzD,GAAI,mBAAmB,EAAE,WAAW,iBAAiB,IAAI,CAAC;IAC1D;GACF,CAAC;GACD,sBAAsB;GAGtB,uBAAuB;GACvB,SAAS,QAAQ,iBAAiB;GAClC,GAAI,uBAAuB,EAAE,gBAAgB,qBAAqB,IAAI,CAAC;GACvE,GAAI,mBAAmB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC;GAClE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,GAAI,iBAAiB,SAAS,KAAM,oBAAoB,oBACpD,EACE,YAAY,OAAO,EAAE,qBAAyD;IAC5E,MAAM,QAA0B,CAAC;IACjC,MAAM,6BAAa,IAAI,IAAoB;IAC3C,MAAM,cAAc,SAAiB,gBAAkC;KACrE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GAAG;MACtD,MAAM,QAAQ,WAAW,IAAI,IAAI;MACjC,IAAI,OACF,MAAM,IAAI,MACR,oCAAoC,KAAK,UAAU,QAAQ,oBAAoB,MAAM,GACvF;MAEF,WAAW,IAAI,MAAM,OAAO;MAC5B,MAAM,QAAQ;KAChB;IACF;IACA,IAAI,oBAAoB,mBACtB,WACE,WACA,MAAM,6BAA6B;KACjC;KACA,SAAS;KACT;IACF,CAAC,CACH;IAEF,KAAK,MAAM,EAAE,aAAa,OAAO,iBAAiB,kBAAkB;KAClE,IAAI,CAAC,SAAS,aACZ,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN;KACF;KAEF,IAAI,YAAY,YACd,WAAW,YAAY,IAAI,MAAM,YAAY,WAAW,EAAE,eAAe,CAAC,CAAC;KAE7E,IAAI,YAAY,cACd,WAAW,YAAY,IAAI,YAAY,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3E;IACA,OAAO;GACT,EACF,IACA,CAAC;GACL,kBAAkB,OAAO,gBAA4C;IACnE,MAAM,iBAAkB,YAAY,SAChC;IACJ,IAAI,gBACF,MAAM,sBAAsB;KAC1B,OAAO;KACP,aAAa;MAAE,GAAG;MAAa,SAAS;KAAe;IACzD,CAAC;IAEH,MAAM,QAAQ,IACZ,aAAa,IAAI,OAAM,gBAAe;KACpC,IAAI,CAAC,YAAY,kBAAkB;KACnC,IAAI;MACF,MAAM,YAAY,iBAAiB;OAAE;OAAa;MAAe,CAAC;KACpE,SAAS,OAAO;MACd,QAAQ,KAAK,0BAA0B,YAAY,GAAG,+BAA+B,KAAK;KAC5F;IACF,CAAC,CACH;GACF;GACA,GAAI,SAAS;IAAE;IAAQ,oBAAoB;GAAK,IAAI,CAAC;GACrD,iBAAiB,EAAE,YAAY,kBAAsC;IAKnE,GAAI,OAAO,gBAAgB,MAAM,EAAE,WAAW,aAAa,CAAC,IAAI,CAAC;IAEjE,GAAG,yBAAyB;KAC1B,cAAc;KACd;KACA,MAAM;KACN;KACA,OAAO;KACP;KACA;KACA;KACA,gBAAgB;KAChB;KACA;KACA;KACA,cAAc;KACd;KACA;KACA;KACA,0BAA0B;KAC1B,mBAAmB,EAAE,mBAAmB,0BAA0B,qBAAqB;MACrF,KAAKE,gBAAgB,IAAI,0BAA0B;OACjD;OACA,mBAAmB;OACnB,SAAS,QAAQ,UAA4B,YAAY;OACzD,4BAA4B,kBAAkB,yBAAyB,KAAK,QAAQ,QAAQ;OAC5F;OACA,mBAAkB,WAAU,uBAAuB;QAAE;QAAQ,aAAa;OAAwB,CAAC;MACrG,CAAC;KACH;IACF,CAAC;IACD,GAAG,cAAc,OAAO;IACxB,GAAG,YAAY,OAAO;GACxB;GACA,yBAAyB;IACvB,MAAM,OAAO,eAAe,SAAS,EAAE,MAAM;KAAE,QAAQ;KAAgB,aAAa;IAAK,EAAE,IAAI,CAAC;IAIhG,MAAM,UAAU,EAAE,SAAS,kBAAkB;IAI7C,MAAM,SAAS,iBAAiB;IAChC,MAAM,MAAM,SAAS,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAGH,OAAO;KACL,YAAY,CACV,4BAA4B;MAAE,MAAM;MAAW,SAAS;MAAwB,aAAa;KAAM,CAAC,GACpG,GAAG,GACL;KACA,GAAG;KACH,GAAG;IACL;IAcF,OAAO;KACL;KACA,YAAY;MACV,sBAAsB,IAAI;MAC1B,6BAA6B;OAAE,MAAM;OAAW,aAAa;MAAwB,CAAC;MACtF,4BAA4B;OAC1B,MAAM;OACN,SAAS;OACT,aAAa,QAAQ,IAAI;MAC3B,CAAC;MACD,GAAG;KACL;KACA,GAAG;KACH,GAAG;IACL;GACF;EACF,CAAC,CACH;EAEA,KAAKC,YAAY;EACjB,KAAKC,oBAAoB;EAQzB,MAAM,uBAAuB,yBAAyB,QACnD,EAAE,aAAa,YAAY,SAAS,YAAY,QACnD;EAGA,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,gCAAgC,qBAC7B,KAAK,EAAE,kBAAkB,YAAY,EAAE,CAAC,CACxC,KAAK,IAAI,EAAE,8DAChB;EAEF,KAAK,MAAM,EAAE,iBAAiB,sBAC5B,SAAS,KAAK,WAAW,YACvB,YAAY,SACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA;GACA,gBAAgB;GAChB;GACA;GACA;GACA;GACA;EACF,GACA,YAAY,EACd,CACF,CACF;EASF,MAAM,qBAAqB,yBACxB,QAAQ,EAAE,aAAa,YAAY,SAAS,YAAY,OAAO,CAAC,CAChE,SAAS,EAAE,kBACV,YAAY,QACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA;GACA,gBAAgB;GAChB;GACA;GACA;GACA;GACA;EACF,GACA,YAAY,EACd,CACF,CACF;EAEF,OAAO;GACL,GAAG,SAAS;GAIZ,GAAI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;GACnC,GAAI,mBAAmB,SAAS,IAAI,EAAE,SAAS,mBAAmB,IAAI,CAAC;EACzE;CACF;;;;;;CAOA,MAAM,WAA0B;EAC9B,IAAI,CAAC,KAAKD,WACR,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,WAAW,6BAA6B,KAAKA,UAAW,SAAS,CAAC;EACxE,MAAM,WACJ,wCACM,KAAKC,mBAAmB,yBAAyB,KAAK,QAAQ,QAAQ,CAC9E;EACA,KAAKF,aAAa,MAAM;CAC1B;;CAGA,MAAM,WAA0B;EAC9B,MAAM,KAAKA,aAAa,KAAK;CAC/B;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { MastraFactory } from './factory.js';
+export type { MastraArgs, MastraFactoryConfig } from './factory.js';
+export { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';
+export type { ChannelAccountLink, ChannelAccountLinkEntry, ChannelAccountLinkKey, ChannelAccountLinkNames, } from './storage/domains/channel-identity/base.js';
+export { FactoryProjectsStorage } from './storage/domains/projects/base.js';
+export type { FactoryProject } from './storage/domains/projects/base.js';
+export { WorkItemsStorage } from './storage/domains/work-items/base.js';
+export type { CreateWorkItemInput, WorkItemRow } from './storage/domains/work-items/base.js';
+export { createStateSigner } from './state-signing.js';
+export type { StateSigner, StateTenant } from './state-signing.js';
+export { createFactoryRouteAuth } from './auth.js';
+export type { RouteAuth } from './routes/route.js';
+export type { FactoryIntegration, IntegrationContext, IntegrationHooks, IntegrationTools, } from './integrations/base.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+import { createFactoryRouteAuth } from "./auth.js";
+import { WorkItemsStorage } from "./storage/domains/work-items/base.js";
+import { createStateSigner } from "./state-signing.js";
+import { ChannelIdentityStorage } from "./storage/domains/channel-identity/base.js";
+import { FactoryProjectsStorage } from "./storage/domains/projects/base.js";
+import { MastraFactory } from "./factory.js";
+export { ChannelIdentityStorage, FactoryProjectsStorage, MastraFactory, WorkItemsStorage, createFactoryRouteAuth, createStateSigner };