@mastra/factory 0.0.0 → 0.1.0-alpha.2

package/dist/routes/provider-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/provider-credentials.ts"],"sourcesContent":["/**\n * Per-request model-provider credential context.\n *\n * The provider config/OAuth routes serve two deployment shapes:\n *\n * - **Local** (no web auth adapter): credentials live in the server-global\n *   file-backed `AuthStorage` (`auth.json`) — unchanged TUI behavior.\n * - **Tenant** (auth adapter active): credentials live in the\n *   `model-credentials` factory storage domain, scoped per `(orgId, userId)`\n *   with optional org-wide rows (`userId` absent).\n *\n * `resolveCredentialContext` decides which shape a request is in: an\n * authenticated user always gets the tenant path; an unauthenticated request\n * is rejected when auth is enabled and falls back to local otherwise.\n */\n\nimport type { Context } from 'hono';\n\nimport type {\n  CredentialRecord,\n  LoginSessionKind,\n  ModelCredentialsStorage,\n} from '../storage/domains/credentials/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * OAuth credentials are stored under the auth provider id, which differs from\n * the catalog provider id for OpenAI (stored as `openai-codex`). Tenant rows\n * use the same keying so one lookup serves both OAuth tokens and API keys.\n */\nexport function getAuthProviderId(provider: string): string {\n  return provider === 'openai' ? 'openai-codex' : provider;\n}\n\n/**\n * Providers that support a browser-driven OAuth sign-in flow, keyed by\n * *catalog* provider id (what the routes and settings UI use). All flows need\n * no inbound connection to the server: Anthropic uses paste-code PKCE, the\n * rest use RFC 8628-style device codes.\n */\nexport const WEB_OAUTH_FLOW_KINDS: Readonly<Record<string, LoginSessionKind>> = {\n  anthropic: 'paste-code',\n  openai: 'device-code',\n  'github-copilot': 'device-code',\n  xai: 'device-code',\n};\n\nexport type CredentialContext =\n  { mode: 'local' } | { mode: 'tenant'; storage: ModelCredentialsStorage; orgId: string; userId: string };\n\n/**\n * The tenant credentials domain, when registered and ready. `undefined` means\n * the factory never ran (no handle threaded in) or the domain's init failed\n * (fail-soft — callers report the feature unavailable instead of crashing).\n */\nexport async function getTenantCredentialsStorage(\n  credentials: ModelCredentialsStorage | undefined,\n): Promise<ModelCredentialsStorage | undefined> {\n  if (!credentials) return undefined;\n  try {\n    await credentials.ensureReady();\n  } catch {\n    return undefined;\n  }\n  return credentials;\n}\n\n/**\n * Org key for tenant rows. Personal accounts get an org bootstrapped by the\n * auth adapter (`ensureOrg`); if one still isn't present, scope rows under a\n * per-user synthetic org so credentials never become server-global.\n */\nexport function tenantOrgId(tenant: { orgId?: string; userId: string }): string {\n  return tenant.orgId ?? `user:${tenant.userId}`;\n}\n\n/**\n * Resolve the credential context for a request, or a ready-to-return error\n * response. Mutating credential routes call this and hard-fail (401/503)\n * when the tenant path is required but unavailable.\n */\nexport async function resolveCredentialContext({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialContext | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) {\n    // When an auth provider is active, credential operations always require a\n    // signed-in caller — otherwise one anonymous request could write keys for\n    // everyone. Without a provider this is a single-user local server.\n    if (auth.enabled()) return { response: c.json({ error: 'unauthorized' }, 401) };\n    return { mode: 'local' };\n  }\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) {\n    return {\n      response: c.json(\n        {\n          error: 'credentials_unavailable',\n          message: 'Tenant credential storage is unavailable — the app database is not configured or failed to start.',\n        },\n        503,\n      ),\n    };\n  }\n  return { mode: 'tenant', storage, orgId: tenantOrgId(tenant), userId: tenant.userId };\n}\n\n/**\n * List the caller's tenant credential records for provider listing, or\n * `undefined` in local mode (caller should fall back to `AuthStorage`).\n * Read-only and degradation-friendly: an authenticated caller with the domain\n * unavailable gets an empty list (sources show `env`/`none`) instead of a 503\n * so the settings page still renders.\n */\nexport async function listTenantCredentialsForRequest({\n  c,\n  auth,\n  credentials,\n}: {\n  c: Context;\n  auth: RouteAuth;\n  /** Tenant credential domain handle; absent in local (no-DB) mode. */\n  credentials?: ModelCredentialsStorage;\n}): Promise<CredentialRecord[] | undefined> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return auth.enabled() ? [] : undefined;\n  const storage = await getTenantCredentialsStorage(credentials);\n  if (!storage) return [];\n  return storage.listCredentials(tenantOrgId(tenant), tenant.userId);\n}\n"],"mappings":";AA8BO,SAAS,kBAAkB,UAA0B;AAC1D,SAAO,aAAa,WAAW,iBAAiB;AAClD;AAQO,IAAM,uBAAmE;AAAA,EAC9E,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,KAAK;AACP;AAUA,eAAsB,4BACpB,aAC8C;AAC9C,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,YAAY,YAAY;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,YAAY,QAAoD;AAC9E,SAAO,OAAO,SAAS,QAAQ,OAAO,MAAM;AAC9C;AAOA,eAAsB,yBAAyB;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF,GAKwD;AACtD,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,QAAQ;AAIX,QAAI,KAAK,QAAQ,EAAG,QAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;AAC9E,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AACA,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,UAAU,EAAE;AAAA,QACV;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,UAAU,SAAS,OAAO,YAAY,MAAM,GAAG,QAAQ,OAAO,OAAO;AACtF;AASA,eAAsB,gCAAgC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACF,GAK4C;AAC1C,QAAM,KAAK,WAAW,CAAC;AACvB,QAAM,SAAS,KAAK,OAAO,CAAC;AAC5B,MAAI,CAAC,OAAQ,QAAO,KAAK,QAAQ,IAAI,CAAC,IAAI;AAC1C,QAAM,UAAU,MAAM,4BAA4B,WAAW;AAC7D,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,SAAO,QAAQ,gBAAgB,YAAY,MAAM,GAAG,OAAO,MAAM;AACnE;","names":[]}

package/dist/routes/route.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Base class for factory route modules.
+ *
+ * Route modules build Mastra `apiRoutes` from injected dependencies instead of
+ * reaching into host globals. The host server (e.g. `mastracode/web`) supplies
+ * the auth seam and storage domain handles at construction time, so the routes
+ * stay portable and testable with fakes.
+ */
+import type { ApiRoute } from '@mastra/core/server';
+import type { Context } from 'hono';
+/**
+ * The auth surface factory routes need, implemented by the host server.
+ *
+ * Local (no-auth) deployments implement this with a stub where `enabled()`
+ * returns `false` and `tenant()` returns `undefined` — routes then take their
+ * single-user local paths.
+ */
+export interface RouteAuth {
+    /** Whether an auth provider is active (tenant mode). */
+    enabled(): boolean;
+    /**
+     * Resolve (and cache) the signed-in user for the request, if any. Must be
+     * called before `tenant()` so the request context is populated.
+     */
+    ensureUser(c: Context): Promise<unknown>;
+    /** Tenant identity for the request, when signed in. */
+    tenant(c: Context): {
+        orgId?: string;
+        userId: string;
+    } | undefined;
+    /** Fail-closed check that the caller administers the given organization. */
+    isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;
+}
+/** Dependencies shared by every factory route module. */
+export interface RouteDependencies {
+    auth: RouteAuth;
+}
+/**
+ * A route module: constructed once at boot with its dependencies, then asked
+ * for the `ApiRoute[]` it serves.
+ */
+export declare abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {
+    protected readonly deps: TDeps;
+    constructor(deps: TDeps);
+    /** Build the Mastra `apiRoutes` served by this module. */
+    abstract routes(): ApiRoute[];
+}
+//# sourceMappingURL=route.d.ts.map

package/dist/routes/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/routes/route.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,OAAO,IAAI,OAAO,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,uDAAuD;IACvD,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACnE,4EAA4E;IAC5E,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAC;CACjB;AAED;;;GAGG;AACH,8BAAsB,KAAK,CAAC,KAAK,SAAS,iBAAiB,GAAG,iBAAiB;IAC7E,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;gBAEnB,IAAI,EAAE,KAAK;IAIvB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,IAAI,QAAQ,EAAE;CAC9B"}

package/dist/routes/route.js

@@ -0,0 +1,11 @@
+// src/routes/route.ts
+var Route = class {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+};
+export {
+  Route
+};
+//# sourceMappingURL=route.js.map

package/dist/routes/route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/route.ts"],"sourcesContent":["/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AA0CO,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;","names":[]}

package/dist/routes/skills.d.ts

@@ -0,0 +1,30 @@
+import type { MastraCodeState } from '@mastra/code-sdk/schema';
+import type { AgentController } from '@mastra/core/agent-controller';
+import type { ApiRoute } from '@mastra/core/server';
+import type { Context } from 'hono';
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { RouteDependencies } from './route.js';
+import { Route } from './route.js';
+interface SessionAuthorizationResult {
+    allowed: boolean;
+    status?: 400 | 401 | 403;
+    code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';
+    message?: string;
+}
+export interface SkillRoutesDeps extends RouteDependencies {
+    controllerId: string;
+    controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;
+    sourceControlStorage?: SourceControlStorageHandle;
+    ensureSourceControlReady?: () => Promise<void>;
+    authorizeSessionAddress?: (context: Context, address: {
+        resourceId: string;
+        projectRepositoryId?: string;
+        scope?: string;
+    }) => Promise<SessionAuthorizationResult>;
+}
+export declare class SkillRoutes extends Route<SkillRoutesDeps> {
+    #private;
+    routes(): ApiRoute[];
+}
+export {};
+//# sourceMappingURL=skills.d.ts.map

package/dist/routes/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAgBnC,UAAU,0BAA0B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3E,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAC1E,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C;AAiCD,qBAAa,WAAY,SAAQ,KAAK,CAAC,eAAe,CAAC;;IA6DrD,MAAM,IAAI,QAAQ,EAAE;CA6DrB"}

package/dist/routes/skills.js

@@ -0,0 +1,181 @@
+// src/routes/skills.ts
+import { registerApiRoute } from "@mastra/core/server";
+
+// src/skills/service.ts
+import { formatSkillActivation } from "@mastra/core/workspace";
+var SkillInvocationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "SkillInvocationError";
+    this.code = code;
+  }
+};
+function escapeSkillBoundary(value) {
+  return value.replaceAll("</skill>", "&lt;/skill&gt;");
+}
+async function resolveSkillInvocation(controller, input) {
+  const session = await controller.getSessionByResource(input.resourceId, input.scope);
+  if (!session) throw new SkillInvocationError("session_not_found", "Agent controller session not found.");
+  const skills = session.getWorkspace().skills;
+  await skills?.maybeRefresh();
+  const skill = await skills?.get(input.name);
+  if (!skill || skill["user-invocable"] === false) {
+    throw new SkillInvocationError("skill_not_found", `Skill not found: ${input.name}.`);
+  }
+  const args = input.arguments?.trim();
+  const content = `${formatSkillActivation(skill)}${args ? `
+
+ARGUMENTS: ${args}` : ""}`.trim();
+  return {
+    session,
+    skillName: skill.name,
+    message: `<skill name="${skill.name}">
+${escapeSkillBoundary(content)}
+</skill>`
+  };
+}
+
+// src/routes/route.ts
+var Route = class {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+};
+
+// src/routes/skills.ts
+var MAX_RESOURCE_ID_LENGTH = 512;
+var MAX_SCOPE_LENGTH = 2048;
+var MAX_ARGUMENTS_LENGTH = 16384;
+var SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function loose(context) {
+  return context;
+}
+function parseBody(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const input = value;
+  if (typeof input.resourceId !== "string" || input.resourceId.length === 0) return void 0;
+  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return void 0;
+  if (input.projectRepositoryId !== void 0 && (typeof input.projectRepositoryId !== "string" || !UUID_RE.test(input.projectRepositoryId))) {
+    return void 0;
+  }
+  if (input.scope !== void 0 && (typeof input.scope !== "string" || input.scope.length > MAX_SCOPE_LENGTH)) {
+    return void 0;
+  }
+  if (typeof input.name !== "string" || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return void 0;
+  if (input.arguments !== void 0) {
+    if (typeof input.arguments !== "string" || input.arguments.length > MAX_ARGUMENTS_LENGTH) return void 0;
+  }
+  return {
+    resourceId: input.resourceId,
+    ...input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {},
+    ...input.scope ? { scope: input.scope } : {},
+    name: input.name,
+    ...input.arguments !== void 0 ? { arguments: input.arguments } : {}
+  };
+}
+var SkillRoutes = class extends Route {
+  async #authorizeSessionAddress(context, address) {
+    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;
+    if (!auth.enabled()) return { allowed: true };
+    await auth.ensureUser(context);
+    const tenant = auth.tenant(context);
+    if (!tenant) {
+      return { allowed: false, status: 401, code: "unauthorized", message: "Authentication required." };
+    }
+    if (address.resourceId === tenant.userId) return { allowed: true };
+    if (!UUID_RE.test(address.resourceId) || !address.projectRepositoryId || !UUID_RE.test(address.projectRepositoryId)) {
+      return { allowed: false, status: 400, code: "invalid_request", message: "Invalid skill invocation request." };
+    }
+    if (!tenant.orgId || !address.scope) {
+      return { allowed: false, status: 403, code: "session_forbidden", message: "Session access denied." };
+    }
+    if (!storage) {
+      return { allowed: false, status: 403, code: "session_forbidden", message: "Session access denied." };
+    }
+    if (ensureSourceControlReady) {
+      try {
+        await ensureSourceControlReady();
+      } catch {
+        return { allowed: false, status: 403, code: "session_forbidden", message: "Session access denied." };
+      }
+    }
+    const projectRepository = await storage.projectRepositories.get({
+      orgId: tenant.orgId,
+      id: address.projectRepositoryId
+    });
+    if (!projectRepository) {
+      return { allowed: false, status: 403, code: "session_forbidden", message: "Session access denied." };
+    }
+    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });
+    if (!connection || connection.factoryProjectId !== address.resourceId) {
+      return { allowed: false, status: 403, code: "session_forbidden", message: "Session access denied." };
+    }
+    const worktree = await storage.worktrees.findByPath({
+      projectRepositoryId: address.projectRepositoryId,
+      userId: tenant.userId,
+      worktreePath: address.scope
+    });
+    return worktree ? { allowed: true } : { allowed: false, status: 403, code: "session_forbidden", message: "Session access denied." };
+  }
+  routes() {
+    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;
+    const authorize = customAuthorize ?? ((context, address) => this.#authorizeSessionAddress(context, address));
+    const handleSkillRequest = async (context, dispatch) => {
+      const c = loose(context);
+      if (c.req.param("controllerId") !== controllerId) {
+        return c.json({ error: "controller_not_found", message: "Agent controller not found." }, 404);
+      }
+      let rawBody;
+      try {
+        rawBody = await c.req.json();
+      } catch {
+        return c.json({ error: "invalid_request", message: "Invalid JSON body." }, 400);
+      }
+      const body = parseBody(rawBody);
+      if (!body) {
+        return c.json({ error: "invalid_request", message: "Invalid skill invocation request." }, 400);
+      }
+      const authorization = await authorize(c, {
+        resourceId: body.resourceId,
+        projectRepositoryId: body.projectRepositoryId,
+        scope: body.scope
+      });
+      if (!authorization.allowed) {
+        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);
+      }
+      try {
+        const resolved = await resolveSkillInvocation(controller, body);
+        if (dispatch) {
+          void resolved.session.sendMessage({ content: resolved.message }).catch((error) => {
+            console.error("Workspace skill dispatch failed after acceptance", error);
+          });
+        }
+        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });
+      } catch (error) {
+        if (error instanceof SkillInvocationError) {
+          return c.json({ error: error.code, message: error.message }, 404);
+        }
+        throw error;
+      }
+    };
+    return [
+      registerApiRoute("/web/agent-controller/:controllerId/skills/prepare", {
+        method: "POST",
+        requiresAuth: false,
+        handler: (context) => handleSkillRequest(context, false)
+      }),
+      registerApiRoute("/web/agent-controller/:controllerId/skills/invoke", {
+        method: "POST",
+        requiresAuth: false,
+        handler: (context) => handleSkillRequest(context, true)
+      })
+    ];
+  }
+};
+export {
+  SkillRoutes
+};
+//# sourceMappingURL=skills.js.map

package/dist/routes/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/routes/skills.ts","../../src/skills/service.ts","../../src/routes/route.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_RESOURCE_ID_LENGTH = 512;\nconst MAX_SCOPE_LENGTH = 2048;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  resourceId: string;\n  projectRepositoryId?: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.resourceId !== 'string' || input.resourceId.length === 0) return undefined;\n  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return undefined;\n  if (\n    input.projectRepositoryId !== undefined &&\n    (typeof input.projectRepositoryId !== 'string' || !UUID_RE.test(input.projectRepositoryId))\n  ) {\n    return undefined;\n  }\n  if (input.scope !== undefined && (typeof input.scope !== 'string' || input.scope.length > MAX_SCOPE_LENGTH)) {\n    return undefined;\n  }\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    resourceId: input.resourceId,\n    ...(input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions are keyed by the authenticated WorkOS user id. Their\n    // scope is a client-managed local/user-session worktree and needs no app DB.\n    if (address.resourceId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are keyed by factoryProjectId and explicitly identify the\n    // linked repository whose user-owned worktree supplies the session scope.\n    if (\n      !UUID_RE.test(address.resourceId) ||\n      !address.projectRepositoryId ||\n      !UUID_RE.test(address.projectRepositoryId)\n    ) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !address.scope) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (!storage) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n      }\n    }\n    const projectRepository = await storage.projectRepositories.get({\n      orgId: tenant.orgId,\n      id: address.projectRepositoryId,\n    });\n    if (!projectRepository) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });\n    if (!connection || connection.factoryProjectId !== address.resourceId) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const worktree = await storage.worktrees.findByPath({\n      projectRepositoryId: address.projectRepositoryId,\n      userId: tenant.userId,\n      worktreePath: address.scope,\n    });\n    return worktree\n      ? { allowed: true }\n      : { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { resourceId: string; projectRepositoryId?: string; scope?: string }) =>\n        this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, {\n        resourceId: body.resourceId,\n        projectRepositoryId: body.projectRepositoryId,\n        scope: body.scope,\n      });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          void resolved.session.sendMessage({ content: resolved.message }).catch((error: unknown) => {\n            console.error('Workspace skill dispatch failed after acceptance', error);\n          });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    return [\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n","import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { SendAgentSignalResult } from '@mastra/core/agent';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { formatSkillActivation } from '@mastra/core/workspace';\nimport type { Workspace } from '@mastra/core/workspace';\n\nexport interface SkillInvocationInput {\n  resourceId: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\nexport interface SkillSession {\n  getWorkspace(): Workspace;\n  sendMessage(input: { content: string }): Promise<unknown>;\n  sendNotificationSignal(\n    input: {\n      source: string;\n      kind: string;\n      summary: string;\n      priority?: 'low' | 'medium' | 'high' | 'urgent';\n      payload?: unknown;\n      dedupeKey?: string;\n      sourceId?: string;\n    },\n    options?: {\n      ifActive?: { behavior?: 'deliver' | 'persist' };\n      ifIdle?: { behavior?: 'persist' | 'wake' };\n      requestContext?: RequestContext;\n    },\n  ): Promise<Pick<SendAgentSignalResult, 'persisted' | 'accepted'>>;\n}\n\nexport class SkillInvocationError extends Error {\n  readonly code: 'session_not_found' | 'skill_not_found';\n\n  constructor(code: SkillInvocationError['code'], message: string) {\n    super(message);\n    this.name = 'SkillInvocationError';\n    this.code = code;\n  }\n}\n\nfunction escapeSkillBoundary(value: string): string {\n  return value.replaceAll('</skill>', '&lt;/skill&gt;');\n}\n\nexport async function resolveSkillInvocation(\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>,\n  input: SkillInvocationInput,\n): Promise<{ session: SkillSession; skillName: string; message: string }> {\n  const session = (await controller.getSessionByResource(input.resourceId, input.scope)) as SkillSession | undefined;\n  if (!session) throw new SkillInvocationError('session_not_found', 'Agent controller session not found.');\n\n  const skills = session.getWorkspace().skills;\n  await skills?.maybeRefresh();\n  const skill = await skills?.get(input.name);\n  if (!skill || skill['user-invocable'] === false) {\n    throw new SkillInvocationError('skill_not_found', `Skill not found: ${input.name}.`);\n  }\n\n  const args = input.arguments?.trim();\n  const content = `${formatSkillActivation(skill)}${args ? `\\n\\nARGUMENTS: ${args}` : ''}`.trim();\n  return {\n    session,\n    skillName: skill.name,\n    message: `<skill name=\"${skill.name}\">\\n${escapeSkillBoundary(content)}\\n</skill>`,\n  };\n}\n\nexport async function dispatchSkillInvocation(\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>,\n  input: SkillInvocationInput,\n): Promise<{ skillName: string; message: string }> {\n  const resolved = await resolveSkillInvocation(controller, input);\n  await resolved.session.sendMessage({ content: resolved.message });\n  return { skillName: resolved.skillName, message: resolved.message };\n}\n","/**\n * Base class for factory route modules.\n *\n * Route modules build Mastra `apiRoutes` from injected dependencies instead of\n * reaching into host globals. The host server (e.g. `mastracode/web`) supplies\n * the auth seam and storage domain handles at construction time, so the routes\n * stay portable and testable with fakes.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\n/**\n * The auth surface factory routes need, implemented by the host server.\n *\n * Local (no-auth) deployments implement this with a stub where `enabled()`\n * returns `false` and `tenant()` returns `undefined` — routes then take their\n * single-user local paths.\n */\nexport interface RouteAuth {\n  /** Whether an auth provider is active (tenant mode). */\n  enabled(): boolean;\n  /**\n   * Resolve (and cache) the signed-in user for the request, if any. Must be\n   * called before `tenant()` so the request context is populated.\n   */\n  ensureUser(c: Context): Promise<unknown>;\n  /** Tenant identity for the request, when signed in. */\n  tenant(c: Context): { orgId?: string; userId: string } | undefined;\n  /** Fail-closed check that the caller administers the given organization. */\n  isOrganizationAdmin(c: Context, organizationId: string): Promise<boolean>;\n}\n\n/** Dependencies shared by every factory route module. */\nexport interface RouteDependencies {\n  auth: RouteAuth;\n}\n\n/**\n * A route module: constructed once at boot with its dependencies, then asked\n * for the `ApiRoute[]` it serves.\n */\nexport abstract class Route<TDeps extends RouteDependencies = RouteDependencies> {\n  protected readonly deps: TDeps;\n\n  constructor(deps: TDeps) {\n    this.deps = deps;\n  }\n\n  /** Build the Mastra `apiRoutes` served by this module. */\n  abstract routes(): ApiRoute[];\n}\n"],"mappings":";AAGA,SAAS,wBAAwB;;;ACCjC,SAAS,6BAA6B;AA+B/B,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC;AAAA,EAET,YAAY,MAAoC,SAAiB;AAC/D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,oBAAoB,OAAuB;AAClD,SAAO,MAAM,WAAW,YAAY,gBAAgB;AACtD;AAEA,eAAsB,uBACpB,YACA,OACwE;AACxE,QAAM,UAAW,MAAM,WAAW,qBAAqB,MAAM,YAAY,MAAM,KAAK;AACpF,MAAI,CAAC,QAAS,OAAM,IAAI,qBAAqB,qBAAqB,qCAAqC;AAEvG,QAAM,SAAS,QAAQ,aAAa,EAAE;AACtC,QAAM,QAAQ,aAAa;AAC3B,QAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,IAAI;AAC1C,MAAI,CAAC,SAAS,MAAM,gBAAgB,MAAM,OAAO;AAC/C,UAAM,IAAI,qBAAqB,mBAAmB,oBAAoB,MAAM,IAAI,GAAG;AAAA,EACrF;AAEA,QAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAM,UAAU,GAAG,sBAAsB,KAAK,CAAC,GAAG,OAAO;AAAA;AAAA,aAAkB,IAAI,KAAK,EAAE,GAAG,KAAK;AAC9F,SAAO;AAAA,IACL;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,SAAS,gBAAgB,MAAM,IAAI;AAAA,EAAO,oBAAoB,OAAO,CAAC;AAAA;AAAA,EACxE;AACF;;;AC5BO,IAAe,QAAf,MAA0E;AAAA,EAC5D;AAAA,EAEnB,YAAY,MAAa;AACvB,SAAK,OAAO;AAAA,EACd;AAIF;;;AFxCA,IAAM,yBAAyB;AAC/B,IAAM,mBAAmB;AACzB,IAAM,uBAAuB;AAC7B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AA4BhB,SAAS,MAAM,SAA2B;AACxC,SAAO;AACT;AAEA,SAAS,UAAU,OAAiD;AAClE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,WAAW,EAAG,QAAO;AAClF,MAAI,MAAM,WAAW,SAAS,uBAAwB,QAAO;AAC7D,MACE,MAAM,wBAAwB,WAC7B,OAAO,MAAM,wBAAwB,YAAY,CAAC,QAAQ,KAAK,MAAM,mBAAmB,IACzF;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,UAAU,WAAc,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,mBAAmB;AAC3G,WAAO;AAAA,EACT;AACA,MAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,EAAG,QAAO;AACxG,MAAI,MAAM,cAAc,QAAW;AACjC,QAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,qBAAsB,QAAO;AAAA,EACnG;AACA,SAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,GAAI,MAAM,sBAAsB,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;AAAA,IACtF,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC5C,MAAM,MAAM;AAAA,IACZ,GAAI,MAAM,cAAc,SAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,EACxE;AACF;AAEO,IAAM,cAAN,cAA0B,MAAuB;AAAA,EACtD,MAAM,yBACJ,SACA,SACqC;AACrC,UAAM,EAAE,MAAM,sBAAsB,SAAS,yBAAyB,IAAI,KAAK;AAC/E,QAAI,CAAC,KAAK,QAAQ,EAAG,QAAO,EAAE,SAAS,KAAK;AAE5C,UAAM,KAAK,WAAW,OAAO;AAC7B,UAAM,SAAS,KAAK,OAAO,OAAO;AAClC,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,gBAAgB,SAAS,2BAA2B;AAAA,IAClG;AAIA,QAAI,QAAQ,eAAe,OAAO,OAAQ,QAAO,EAAE,SAAS,KAAK;AAIjE,QACE,CAAC,QAAQ,KAAK,QAAQ,UAAU,KAChC,CAAC,QAAQ,uBACT,CAAC,QAAQ,KAAK,QAAQ,mBAAmB,GACzC;AACA,aAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,mBAAmB,SAAS,oCAAoC;AAAA,IAC9G;AACA,QAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,OAAO;AACnC,aAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,qBAAqB,SAAS,yBAAyB;AAAA,IACrG;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,qBAAqB,SAAS,yBAAyB;AAAA,IACrG;AACA,QAAI,0BAA0B;AAC5B,UAAI;AACF,cAAM,yBAAyB;AAAA,MACjC,QAAQ;AACN,eAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,qBAAqB,SAAS,yBAAyB;AAAA,MACrG;AAAA,IACF;AACA,UAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;AAAA,MAC9D,OAAO,OAAO;AAAA,MACd,IAAI,QAAQ;AAAA,IACd,CAAC;AACD,QAAI,CAAC,mBAAmB;AACtB,aAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,qBAAqB,SAAS,yBAAyB;AAAA,IACrG;AACA,UAAM,aAAa,MAAM,QAAQ,YAAY,IAAI,EAAE,OAAO,OAAO,OAAO,IAAI,kBAAkB,aAAa,CAAC;AAC5G,QAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,YAAY;AACrE,aAAO,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,qBAAqB,SAAS,yBAAyB;AAAA,IACrG;AACA,UAAM,WAAW,MAAM,QAAQ,UAAU,WAAW;AAAA,MAClD,qBAAqB,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,cAAc,QAAQ;AAAA,IACxB,CAAC;AACD,WAAO,WACH,EAAE,SAAS,KAAK,IAChB,EAAE,SAAS,OAAO,QAAQ,KAAK,MAAM,qBAAqB,SAAS,yBAAyB;AAAA,EAClG;AAAA,EAEA,SAAqB;AACnB,UAAM,EAAE,cAAc,YAAY,yBAAyB,gBAAgB,IAAI,KAAK;AACpF,UAAM,YACJ,oBACC,CAAC,SAAkB,YAClB,KAAK,yBAAyB,SAAS,OAAO;AAClD,UAAM,qBAAqB,OAAO,SAAkB,aAAsB;AACxE,YAAM,IAAI,MAAM,OAAO;AACvB,UAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAAc;AAChD,eAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,SAAS,8BAA8B,GAAG,GAAG;AAAA,MAC9F;AAEA,UAAI;AACJ,UAAI;AACF,kBAAU,MAAM,EAAE,IAAI,KAAK;AAAA,MAC7B,QAAQ;AACN,eAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,SAAS,qBAAqB,GAAG,GAAG;AAAA,MAChF;AACA,YAAM,OAAO,UAAU,OAAO;AAC9B,UAAI,CAAC,MAAM;AACT,eAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,SAAS,oCAAoC,GAAG,GAAG;AAAA,MAC/F;AAEA,YAAM,gBAAgB,MAAM,UAAU,GAAG;AAAA,QACvC,YAAY,KAAK;AAAA,QACjB,qBAAqB,KAAK;AAAA,QAC1B,OAAO,KAAK;AAAA,MACd,CAAC;AACD,UAAI,CAAC,cAAc,SAAS;AAC1B,eAAO,EAAE,KAAK,EAAE,OAAO,cAAc,MAAM,SAAS,cAAc,QAAQ,GAAG,cAAc,UAAU,GAAG;AAAA,MAC1G;AAEA,UAAI;AACF,cAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;AAC9D,YAAI,UAAU;AACZ,eAAK,SAAS,QAAQ,YAAY,EAAE,SAAS,SAAS,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAmB;AACzF,oBAAQ,MAAM,oDAAoD,KAAK;AAAA,UACzE,CAAC;AAAA,QACH;AACA,eAAO,EAAE,KAAK,EAAE,IAAI,MAAM,OAAO,SAAS,WAAW,SAAS,SAAS,QAAQ,CAAC;AAAA,MAClF,SAAS,OAAO;AACd,YAAI,iBAAiB,sBAAsB;AACzC,iBAAO,EAAE,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,GAAG,GAAG;AAAA,QAClE;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAEA,WAAO;AAAA,MACL,iBAAiB,sDAAsD;AAAA,QACrE,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,aAAW,mBAAmB,SAAS,KAAK;AAAA,MACvD,CAAC;AAAA,MACD,iBAAiB,qDAAqD;AAAA,QACpE,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,SAAS,aAAW,mBAAmB,SAAS,IAAI;AAAA,MACtD,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/routes/surface.d.ts

@@ -0,0 +1,83 @@
+import type { AuthStorage } from '@mastra/code-sdk/auth/storage';
+import type { MastraCodeState } from '@mastra/code-sdk/schema';
+import type { AgentController } from '@mastra/core/agent-controller';
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryStorage } from '@mastra/core/storage';
+import type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';
+import type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';
+import { FactoryTransitionService } from '../rules/transition-service.js';
+import type { FactoryRules } from '../rules/types.js';
+import type { SandboxFleet } from '../sandbox/fleet.js';
+import type { StateSigner } from '../state-signing.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
+import type { IntakeStorage } from '../storage/domains/intake/base.js';
+import type { IntegrationStorage } from '../storage/domains/integrations/base.js';
+import type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';
+import type { SourceControlStorage } from '../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { RouteAuth } from './route.js';
+export interface IntegrationRegistration {
+    integration: FactoryIntegration;
+    ready: boolean;
+    ensureReady: () => Promise<void>;
+}
+export interface FactoryApiRoutesDeps {
+    controllerId: string;
+    controller: AgentController<MastraCodeState>;
+    /** Request-auth seam threaded from the host (no service locator). */
+    auth: RouteAuth;
+    authStorage: AuthStorage;
+    audit: AuditEmitter;
+    fsRoot?: string;
+    publicOrigin: string;
+    stateSigner?: StateSigner;
+    /** Sandbox fleet constructed by the factory (disabled when no machine). */
+    fleet: SandboxFleet;
+    /** Root factory storage backend (distributed locks, app-db diagnostics). */
+    factoryStorage?: FactoryStorage;
+    integrationStorage: IntegrationStorage;
+    sourceControlStorage: SourceControlStorage;
+    /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */
+    domains: {
+        intake: IntakeStorage;
+        modelCredentials: ModelCredentialsStorage;
+        modelPacks: ModelPacksStorage;
+        projects: FactoryProjectsStorage;
+        queueHealth: QueueHealthStorage;
+        workItems: WorkItemsStorage;
+    };
+    integrations?: IntegrationRegistration[];
+    intakeReady: boolean;
+    factoryReady: boolean;
+    /** Resolved Factory rule set, threaded from the host (no service locator). */
+    rules: FactoryRules;
+    factoryTransitionService?: FactoryTransitionService;
+    onFactoryRuntime?: (runtime: {
+        transitionService: FactoryTransitionService;
+        prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;
+    }) => void;
+}
+export declare function factoryRuleBranch(item: FactoryBindingPreparationInput['item']): string;
+/**
+ * Build the {@link IntegrationContext} handed to an integration when the
+ * factory collects its capabilities (routes, workers). One shape everywhere:
+ * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it
+ * when collecting integration workers at finalize.
+ */
+export declare function buildIntegrationContext(deps: Pick<FactoryApiRoutesDeps, 'controller' | 'publicOrigin' | 'auth' | 'fleet' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'> & {
+    stateSigner: StateSigner;
+    emitAudit?: AuditEmitter['emit'];
+    domains: Pick<FactoryApiRoutesDeps['domains'], 'projects' | 'intake'>;
+}, integrationId: string): IntegrationContext;
+/**
+ * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:
+ *   - fs browser routes (project picker), confined to `fsRoot`
+ *   - config routes (provider/API-key/model-pack/OM management)
+ *   - every registered integration's `routes()` surface (full set when ready,
+ *     disabled-status stub otherwise), plus stubs for absent known ids
+ */
+export declare function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[];
+//# sourceMappingURL=surface.d.ts.map

package/dist/routes/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAItF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAI7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAK9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,EAAE,YAAY,CAAC;IACpB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;KAC7B,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,KAAK,EAAE,YAAY,CAAC;IACpB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAiDD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,MAAM,CAmBtF;AA2CD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EACpB,YAAY,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,sBAAsB,CACpH,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;CACvE,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CAgBpB;AAsDD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAsH/E"}