@mastra/factory 0.0.0 → 0.1.0-alpha.2

package/dist/integrations/base.d.ts

@@ -0,0 +1,197 @@
+/**
+ * `FactoryIntegration` — the common contract for pluggable web integrations
+ * (GitHub, Linear, third-party).
+ *
+ * Each integration is a self-contained class: the deploy entry
+ * (`src/mastra/index.ts`) reads that integration's env vars ONCE, constructs
+ * an instance with explicit credentials, and passes it to `MastraFactory`
+ * via `integrations: [...]`. The factory registers the pieces each instance
+ * provides — HTTP routes, agent/session tools, diagnostics — into the system.
+ * No system code reads integration env vars or imports integration free
+ * functions; everything downstream talks to instances through this interface.
+ *
+ * An absent integration means: its routes never mount, its tools never
+ * register, diagnostics report "not configured", and the server boots fine.
+ * Third parties add capabilities by implementing this same interface — no
+ * factory changes required (the same capability-based philosophy as the
+ * sandbox machine's `derive()` gate).
+ */
+import type { MastraCodeConfig, MountedMastraCode } from '@mastra/code-sdk';
+import type { RequestContext } from '@mastra/core/request-context';
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryStorage } from '@mastra/core/storage';
+import type { MastraWorker } from '@mastra/core/worker';
+import type { Intake } from '../capabilities/intake.js';
+import type { VersionControl } from '../capabilities/version-control.js';
+import type { RouteAuth } from '../routes/route.js';
+import type { SandboxFleet } from '../sandbox/fleet.js';
+import type { StateSigner } from '../state-signing.js';
+import type { AuditEventRow } from '../storage/domains/audit/base.js';
+import type { AuditEmitter } from '../storage/domains/audit/domain.js';
+import type { IntakeStorage } from '../storage/domains/intake/base.js';
+import type { IntegrationStorageHandle } from '../storage/domains/integrations/base.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { ParsedGithubWebhook } from './github/webhook.js';
+export interface LinearIssueIngress {
+    id: string;
+    identifier: string;
+    title: string;
+    url: string;
+    state: string;
+    stateType: string;
+    priorityLabel: string;
+    assignee: string | null;
+    team: string | null;
+    labels: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+/** Factory-owned hooks integrations may invoke. */
+export interface IntegrationHooks {
+    emitAudit?: AuditEmitter['emit'];
+    ingestGithubEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;
+    ingestLinearIssues?: (input: {
+        orgId: string;
+        userId: string;
+        factoryProjectId: string;
+        issues: LinearIssueIngress[];
+    }) => Promise<unknown>;
+}
+/**
+ * Tool records integrations contribute — the same static-record shape the
+ * SDK's `extraTools` accepts, so the factory can merge every integration's
+ * tools into one dynamic tool set.
+ */
+export type IntegrationTools = Extract<NonNullable<MastraCodeConfig['extraTools']>, Record<string, unknown>>;
+export interface IntegrationPostToolContext {
+    toolName: string;
+    input: unknown;
+    output?: unknown;
+    error?: unknown;
+    context: unknown;
+}
+/**
+ * Everything the factory hands an integration when collecting its routes.
+ * Built once per boot in `MastraFactory.prepare()`.
+ */
+export interface IntegrationContext {
+    /** Host auth seam — integration routes resolve callers through this. */
+    auth: RouteAuth;
+    /**
+     * Sandbox fleet for per-project sandboxes. Always constructed at boot; a
+     * fleet built without a machine config reports `enabled: false` and
+     * sandbox-backed routes respond 503.
+     */
+    fleet: SandboxFleet;
+    /**
+     * Root factory storage backend. Supplies the cross-replica
+     * `withDistributedLock` capability and the `appDbConfigured` diagnostic.
+     * Absent when the host runs without an application database.
+     */
+    factoryStorage?: FactoryStorage;
+    /** Browser-facing origin (OAuth redirect base), no trailing slash. */
+    baseUrl?: string;
+    /** Mounted agent controller for webhook → session signal delivery. */
+    controller?: MountedMastraCode['controller'];
+    /**
+     * Shared OAuth state signer created by the factory. One signer per boot, so
+     * every integration's OAuth flow signs and verifies with the same secret.
+     */
+    stateSigner?: StateSigner;
+    /** Persistence handles pre-scoped to this integration's stable id. */
+    storage: {
+        generic: IntegrationStorageHandle;
+        sourceControl: SourceControlStorageHandle;
+        /** Factory projects domain — e.g. resolving a project's default model. */
+        projects: FactoryProjectsStorage;
+        /** Cross-integration intake selection (which sources are synced). */
+        intake: IntakeStorage;
+    };
+    /** System hooks integrations may invoke. */
+    hooks?: IntegrationHooks;
+}
+/**
+ * A pluggable web integration. Implementations own their credentials
+ * (validated at construction), their API surface, and their HTTP routes.
+ */
+export interface FactoryIntegration {
+    /** Stable identifier: `'github'`, `'linear'`, custom ids for third parties. */
+    readonly id: string;
+    /** Issue-oriented capability consumed by Intake. */
+    readonly intake?: Intake;
+    /** Repository, installation, and pull-request capability. */
+    readonly versionControl?: VersionControl;
+    /**
+     * Bind the integration's generic persistence handle. Called once by the
+     * factory during `prepare()` (before routes/tools/workers are collected),
+     * so instance methods that run outside an `IntegrationContext` — per-request
+     * agent tools, intake capability calls — reach storage without a service
+     * locator. Mirrors `sourceControl.initialize`.
+     */
+    initialize?(args: {
+        storage: IntegrationStorageHandle;
+        projects: FactoryProjectsStorage;
+        auth: RouteAuth;
+    }): void;
+    /**
+     * The integration's full HTTP surface (status, OAuth, webhooks, feature
+     * routes), as Mastra `apiRoutes`. Called once at boot; the factory folds
+     * the result into the server's route table.
+     */
+    routes(ctx: IntegrationContext): ApiRoute[];
+    /**
+     * Org-scoped agent tools resolved per request (e.g. Linear's issue tools).
+     * Optional capability; the factory merges results into the SDK's async
+     * `extraTools` provider.
+     */
+    agentTools?(args: {
+        requestContext: RequestContext;
+    }): Promise<IntegrationTools>;
+    /**
+     * Session-scoped tools (e.g. GitHub's PR subscribe/unsubscribe). Optional
+     * capability, resolved synchronously per request.
+     */
+    sessionTools?(args: {
+        requestContext: RequestContext;
+    }): IntegrationTools;
+    /**
+     * Optional provider-owned observer for successful or failed tool calls.
+     * The factory invokes every configured observer independently so one
+     * integration cannot prevent another from observing the same tool result.
+     */
+    postToolObserver?(args: {
+        toolContext: IntegrationPostToolContext;
+        requestContext?: RequestContext;
+    }): Promise<void>;
+    /**
+     * Background workers the integration needs running for its lifecycle
+     * (e.g. polling an upstream that doesn't support webhooks). Optional
+     * capability: called once at boot for READY integrations only; the factory
+     * folds the returned workers into the server Mastra's `workers` option, so
+     * they are merged with the built-in workers and started with them
+     * (`startWorkers()`). Worker names must be unique across integrations —
+     * duplicates fail the `new Mastra(...)` construction loudly.
+     */
+    workers?(ctx: IntegrationContext): MastraWorker[];
+    /**
+     * Non-secret config snapshot (booleans + names only, never values). The
+     * factory merges it into system diagnostics/startup logs.
+     */
+    diagnostics(): Record<string, unknown>;
+    /**
+     * Optional best-effort destination for locally persisted audit events.
+     * Audit export remains independent of the configured web auth adapter.
+     */
+    audit?(args: {
+        event: AuditEventRow;
+    }): Promise<void>;
+    /**
+     * True when the integration signs OAuth `state` and therefore needs a
+     * replica-stable signer. The factory fails loud at boot when a registered
+     * integration requires stability but only a per-process random secret is
+     * available (see `./state-signing.ts`).
+     */
+    readonly requiresStableStateSigner?: boolean;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/integrations/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/integrations/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,kBAAkB,EAAE,CAAC;KAC9B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7G,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,IAAI,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,OAAO,EAAE;QACP,OAAO,EAAE,wBAAwB,CAAC;QAClC,aAAa,EAAE,0BAA0B,CAAC;QAC1C,0EAA0E;QAC1E,QAAQ,EAAE,sBAAsB,CAAC;QACjC,qEAAqE;QACrE,MAAM,EAAE,aAAa,CAAC;KACvB,CAAC;IACF,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,wBAAwB,CAAC;QAAC,QAAQ,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IAClH;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF;;;OAGG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB,CAAC;IAC1E;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,0BAA0B,CAAC;QAAC,cAAc,CAAC,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrH;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,EAAE,CAAC;IAClD;;;OAGG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CAC9C"}

package/dist/integrations/base.js

@@ -0,0 +1 @@
+//# sourceMappingURL=base.js.map

package/dist/integrations/base.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/integrations/github/config.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Composite feature gate + diagnostics for the GitHub App project feature.
+ *
+ * The GitHub feature is enabled only when *all three* hold:
+ *  - a `GithubIntegration` instance is registered with the factory
+ *    (constructed by the deploy entry from the `GITHUB_APP_*` env vars),
+ *  - web auth is enabled (a per-user installation requires a logged-in user),
+ *  - the application database is configured.
+ *
+ * OAuth/install `state` signing lives in `../../state-signing.ts` — the factory
+ * creates one shared signer at boot and hands it to every integration.
+ *
+ * Everything here is pure: callers pass the handles they already own (the
+ * integration, auth seam, state signer, sandbox fleet) — there is no global
+ * registry lookup.
+ */
+import type { RouteAuth } from '../../routes/route.js';
+import type { SandboxFleet } from '../../sandbox/fleet.js';
+import type { StateSigner } from '../../state-signing.js';
+import type { GithubIntegration } from './integration.js';
+/** Handles the GitHub feature gate + diagnostics are computed from. */
+export interface GithubFeatureGateOptions {
+    /** The registered GitHub integration, when configured. */
+    github: GithubIntegration | undefined;
+    /** Web auth seam — the feature requires a logged-in user. */
+    auth: RouteAuth;
+    /** True when the application database is configured. */
+    appDbConfigured: boolean;
+    /** Shared OAuth/install `state` signer, when configured. */
+    stateSigner?: StateSigner;
+    /** Sandbox fleet, when sandboxes are configured. */
+    fleet?: SandboxFleet;
+}
+/**
+ * True when the GitHub App project feature should be active.
+ */
+export declare function isGithubFeatureEnabled(options: Pick<GithubFeatureGateOptions, 'github' | 'auth'>): boolean;
+/**
+ * Non-secret diagnostic snapshot of every GitHub feature gate. Used by startup
+ * logs, `/web/github/status`, and the SPA so all three explain the same state.
+ *
+ * Only env var *names* and booleans are exposed — never secret values.
+ */
+export interface GithubFeatureDiagnostics {
+    githubAppConfigured: boolean;
+    factoryAuthEnabled: boolean;
+    appDbConfigured: boolean;
+    stateSecretConfigured: boolean;
+    sandboxEnabled: boolean;
+    sandboxProvider: string;
+    /** Names of the GitHub App env vars still needed (empty when configured). */
+    missingGithubAppEnvVars: string[];
+}
+/**
+ * Collect a non-secret diagnostic snapshot of every GitHub feature gate. Centralizes
+ * the feature-gate reasoning so startup logs, the status API, and the SPA explain
+ * the same state. Does not change `isGithubFeatureEnabled()` behavior.
+ */
+export declare function getGithubFeatureDiagnostics(options: GithubFeatureGateOptions): GithubFeatureDiagnostics;
+//# sourceMappingURL=config.d.ts.map

package/dist/integrations/github/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAiB1D,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC,6DAA6D;IAC7D,IAAI,EAAE,SAAS,CAAC;IAChB,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oDAAoD;IACpD,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAE1G;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,uBAAuB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,wBAAwB,CAWvG"}

package/dist/integrations/github/config.js

@@ -0,0 +1,28 @@
+// src/integrations/github/config.ts
+var GITHUB_APP_ENV_VARS = [
+  "GITHUB_APP_ID",
+  "GITHUB_APP_PRIVATE_KEY",
+  "GITHUB_APP_CLIENT_ID",
+  "GITHUB_APP_CLIENT_SECRET",
+  "GITHUB_APP_SLUG"
+];
+function isGithubFeatureEnabled(options) {
+  return options.github !== void 0 && options.auth.enabled();
+}
+function getGithubFeatureDiagnostics(options) {
+  const { github, auth, appDbConfigured, stateSigner, fleet } = options;
+  return {
+    githubAppConfigured: github !== void 0,
+    factoryAuthEnabled: auth.enabled(),
+    appDbConfigured,
+    stateSecretConfigured: stateSigner?.stable ?? false,
+    sandboxEnabled: fleet?.enabled ?? false,
+    sandboxProvider: fleet?.provider ?? "none",
+    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS]
+  };
+}
+export {
+  getGithubFeatureDiagnostics,
+  isGithubFeatureEnabled
+};
+//# sourceMappingURL=config.js.map

package/dist/integrations/github/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/integrations/github/config.ts"],"sourcesContent":["/**\n * Composite feature gate + diagnostics for the GitHub App project feature.\n *\n * The GitHub feature is enabled only when *all three* hold:\n *  - a `GithubIntegration` instance is registered with the factory\n *    (constructed by the deploy entry from the `GITHUB_APP_*` env vars),\n *  - web auth is enabled (a per-user installation requires a logged-in user),\n *  - the application database is configured.\n *\n * OAuth/install `state` signing lives in `../../state-signing.ts` — the factory\n * creates one shared signer at boot and hands it to every integration.\n *\n * Everything here is pure: callers pass the handles they already own (the\n * integration, auth seam, state signer, sandbox fleet) — there is no global\n * registry lookup.\n */\n\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { SandboxFleet } from '../../sandbox/fleet.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { GithubIntegration } from './integration.js';\n\n/**\n * Env vars the deploy entry reads to construct a `GithubIntegration`. Names\n * only — used by diagnostics to tell an operator what to set when the\n * integration is absent. The entry enforces all-or-nothing: partial config\n * fails the boot, so at runtime the integration is either fully configured or\n * not configured at all.\n */\nconst GITHUB_APP_ENV_VARS = [\n  'GITHUB_APP_ID',\n  'GITHUB_APP_PRIVATE_KEY',\n  'GITHUB_APP_CLIENT_ID',\n  'GITHUB_APP_CLIENT_SECRET',\n  'GITHUB_APP_SLUG',\n] as const;\n\n/** Handles the GitHub feature gate + diagnostics are computed from. */\nexport interface GithubFeatureGateOptions {\n  /** The registered GitHub integration, when configured. */\n  github: GithubIntegration | undefined;\n  /** Web auth seam — the feature requires a logged-in user. */\n  auth: RouteAuth;\n  /** True when the application database is configured. */\n  appDbConfigured: boolean;\n  /** Shared OAuth/install `state` signer, when configured. */\n  stateSigner?: StateSigner;\n  /** Sandbox fleet, when sandboxes are configured. */\n  fleet?: SandboxFleet;\n}\n\n/**\n * True when the GitHub App project feature should be active.\n */\nexport function isGithubFeatureEnabled(options: Pick<GithubFeatureGateOptions, 'github' | 'auth'>): boolean {\n  return options.github !== undefined && options.auth.enabled();\n}\n\n/**\n * Non-secret diagnostic snapshot of every GitHub feature gate. Used by startup\n * logs, `/web/github/status`, and the SPA so all three explain the same state.\n *\n * Only env var *names* and booleans are exposed — never secret values.\n */\nexport interface GithubFeatureDiagnostics {\n  githubAppConfigured: boolean;\n  factoryAuthEnabled: boolean;\n  appDbConfigured: boolean;\n  stateSecretConfigured: boolean;\n  sandboxEnabled: boolean;\n  sandboxProvider: string;\n  /** Names of the GitHub App env vars still needed (empty when configured). */\n  missingGithubAppEnvVars: string[];\n}\n\n/**\n * Collect a non-secret diagnostic snapshot of every GitHub feature gate. Centralizes\n * the feature-gate reasoning so startup logs, the status API, and the SPA explain\n * the same state. Does not change `isGithubFeatureEnabled()` behavior.\n */\nexport function getGithubFeatureDiagnostics(options: GithubFeatureGateOptions): GithubFeatureDiagnostics {\n  const { github, auth, appDbConfigured, stateSigner, fleet } = options;\n  return {\n    githubAppConfigured: github !== undefined,\n    factoryAuthEnabled: auth.enabled(),\n    appDbConfigured,\n    stateSecretConfigured: stateSigner?.stable ?? false,\n    sandboxEnabled: fleet?.enabled ?? false,\n    sandboxProvider: fleet?.provider ?? 'none',\n    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS],\n  };\n}\n"],"mappings":";AA6BA,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAmBO,SAAS,uBAAuB,SAAqE;AAC1G,SAAO,QAAQ,WAAW,UAAa,QAAQ,KAAK,QAAQ;AAC9D;AAwBO,SAAS,4BAA4B,SAA6D;AACvG,QAAM,EAAE,QAAQ,MAAM,iBAAiB,aAAa,MAAM,IAAI;AAC9D,SAAO;AAAA,IACL,qBAAqB,WAAW;AAAA,IAChC,oBAAoB,KAAK,QAAQ;AAAA,IACjC;AAAA,IACA,uBAAuB,aAAa,UAAU;AAAA,IAC9C,gBAAgB,OAAO,WAAW;AAAA,IAClC,iBAAiB,OAAO,YAAY;AAAA,IACpC,yBAAyB,SAAS,CAAC,IAAI,CAAC,GAAG,mBAAmB;AAAA,EAChE;AACF;","names":[]}

package/dist/integrations/github/factory-session.d.ts

@@ -0,0 +1,12 @@
+import type { GithubIntegration } from './integration.js';
+export declare function ensureFactoryRuleSession(args: {
+    github: GithubIntegration;
+    orgId: string;
+    factoryProjectId: string;
+    repositorySlug?: string;
+    branch: string;
+}): Promise<{
+    sessionId: string;
+    userId: string;
+}>;
+//# sourceMappingURL=factory-session.d.ts.map

package/dist/integrations/github/factory-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory-session.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/factory-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoCjD"}

package/dist/integrations/github/factory-session.js

@@ -0,0 +1,41 @@
+// src/integrations/github/factory-session.ts
+import { randomUUID } from "crypto";
+async function ensureFactoryRuleSession(args) {
+  const connections = await args.github.sourceControlStorage.connections.list({
+    orgId: args.orgId,
+    factoryProjectId: args.factoryProjectId
+  });
+  const connection = connections.find((candidate) => candidate.integrationId === args.github.id);
+  if (!connection) throw new Error("Factory GitHub connection not found.");
+  const projectRepositories = await args.github.sourceControlStorage.projectRepositories.list({
+    orgId: args.orgId,
+    connectionId: connection.id
+  });
+  const resolvedRepositories = await Promise.all(
+    projectRepositories.map(async (projectRepository) => ({
+      projectRepository,
+      repository: await args.github.sourceControlStorage.repositories.get({
+        orgId: args.orgId,
+        id: projectRepository.repositoryId
+      })
+    }))
+  );
+  const resolved = resolvedRepositories.find(
+    (candidate) => candidate.repository && (!args.repositorySlug || candidate.repository.slug === args.repositorySlug)
+  );
+  if (!resolved?.repository) throw new Error("Factory GitHub repository not found.");
+  const userId = connection.createdByUserId;
+  const session = await args.github.sourceControlStorage.sessions.create({
+    sessionId: randomUUID(),
+    projectRepositoryId: resolved.projectRepository.id,
+    orgId: args.orgId,
+    userId,
+    branch: args.branch,
+    baseBranch: resolved.projectRepository.branch ?? resolved.repository.defaultBranch
+  });
+  return { sessionId: session.sessionId, userId };
+}
+export {
+  ensureFactoryRuleSession
+};
+//# sourceMappingURL=factory-session.js.map

package/dist/integrations/github/factory-session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/integrations/github/factory-session.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { GithubIntegration } from './integration.js';\n\nexport async function ensureFactoryRuleSession(args: {\n  github: GithubIntegration;\n  orgId: string;\n  factoryProjectId: string;\n  repositorySlug?: string;\n  branch: string;\n}): Promise<{ sessionId: string; userId: string }> {\n  const connections = await args.github.sourceControlStorage.connections.list({\n    orgId: args.orgId,\n    factoryProjectId: args.factoryProjectId,\n  });\n  const connection = connections.find(candidate => candidate.integrationId === args.github.id);\n  if (!connection) throw new Error('Factory GitHub connection not found.');\n\n  const projectRepositories = await args.github.sourceControlStorage.projectRepositories.list({\n    orgId: args.orgId,\n    connectionId: connection.id,\n  });\n  const resolvedRepositories = await Promise.all(\n    projectRepositories.map(async projectRepository => ({\n      projectRepository,\n      repository: await args.github.sourceControlStorage.repositories.get({\n        orgId: args.orgId,\n        id: projectRepository.repositoryId,\n      }),\n    })),\n  );\n  const resolved = resolvedRepositories.find(\n    candidate => candidate.repository && (!args.repositorySlug || candidate.repository.slug === args.repositorySlug),\n  );\n  if (!resolved?.repository) throw new Error('Factory GitHub repository not found.');\n\n  const userId = connection.createdByUserId;\n  const session = await args.github.sourceControlStorage.sessions.create({\n    sessionId: randomUUID(),\n    projectRepositoryId: resolved.projectRepository.id,\n    orgId: args.orgId,\n    userId,\n    branch: args.branch,\n    baseBranch: resolved.projectRepository.branch ?? resolved.repository.defaultBranch,\n  });\n  return { sessionId: session.sessionId, userId };\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAI3B,eAAsB,yBAAyB,MAMI;AACjD,QAAM,cAAc,MAAM,KAAK,OAAO,qBAAqB,YAAY,KAAK;AAAA,IAC1E,OAAO,KAAK;AAAA,IACZ,kBAAkB,KAAK;AAAA,EACzB,CAAC;AACD,QAAM,aAAa,YAAY,KAAK,eAAa,UAAU,kBAAkB,KAAK,OAAO,EAAE;AAC3F,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,sCAAsC;AAEvE,QAAM,sBAAsB,MAAM,KAAK,OAAO,qBAAqB,oBAAoB,KAAK;AAAA,IAC1F,OAAO,KAAK;AAAA,IACZ,cAAc,WAAW;AAAA,EAC3B,CAAC;AACD,QAAM,uBAAuB,MAAM,QAAQ;AAAA,IACzC,oBAAoB,IAAI,OAAM,uBAAsB;AAAA,MAClD;AAAA,MACA,YAAY,MAAM,KAAK,OAAO,qBAAqB,aAAa,IAAI;AAAA,QAClE,OAAO,KAAK;AAAA,QACZ,IAAI,kBAAkB;AAAA,MACxB,CAAC;AAAA,IACH,EAAE;AAAA,EACJ;AACA,QAAM,WAAW,qBAAqB;AAAA,IACpC,eAAa,UAAU,eAAe,CAAC,KAAK,kBAAkB,UAAU,WAAW,SAAS,KAAK;AAAA,EACnG;AACA,MAAI,CAAC,UAAU,WAAY,OAAM,IAAI,MAAM,sCAAsC;AAEjF,QAAM,SAAS,WAAW;AAC1B,QAAM,UAAU,MAAM,KAAK,OAAO,qBAAqB,SAAS,OAAO;AAAA,IACrE,WAAW,WAAW;AAAA,IACtB,qBAAqB,SAAS,kBAAkB;AAAA,IAChD,OAAO,KAAK;AAAA,IACZ;AAAA,IACA,QAAQ,KAAK;AAAA,IACb,YAAY,SAAS,kBAAkB,UAAU,SAAS,WAAW;AAAA,EACvE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,OAAO;AAChD;","names":[]}

package/dist/integrations/github/integration.d.ts

@@ -0,0 +1,191 @@
+/**
+ * `GithubIntegration` — the injectable GitHub App integration for the web
+ * factory.
+ *
+ * The deploy entry (`src/mastra/index.ts`) reads the `GITHUB_APP_*` env vars
+ * once, constructs an instance, and passes it to `MastraFactory` (the same
+ * dependency-injection pattern as the auth adapter and the sandbox machine).
+ * The factory seeds it into the runtime-config registry for the feature gate
+ * (`./config.ts`) and hands the instance to every consumer explicitly — route
+ * handlers receive it through `routes()`, the webhook fan-out and session
+ * subscription tools through their deps.
+ *
+ * The class owns:
+ *   - the GitHub App credentials (validated + PEM-normalized at construction),
+ *   - every GitHub API operation the web surface performs (Octokit factories,
+ *     token minting, installation/repo/issue/PR listings, OAuth exchange),
+ *   - the webhook secret used to verify GitHub webhook deliveries,
+ *   - its own HTTP surface: `routes()` returns the `/web/github/*` +
+ *     `/auth/github/*` Mastra `apiRoutes`.
+ *
+ * A custom integration (different app per tenant, custom Octokit config) can
+ * subclass this and override individual methods — everything downstream only
+ * talks to the instance.
+ */
+import type { RequestContext } from '@mastra/core/request-context';
+import type { ApiRoute } from '@mastra/core/server';
+import { Octokit } from '@octokit/rest';
+import type { Intake } from '../../capabilities/intake.js';
+import type { VersionControl } from '../../capabilities/version-control.js';
+import type { FactoryIntegration, IntegrationContext, IntegrationTools } from '../base.js';
+import type { GithubSubscriptionStorage } from './subscriptions.js';
+/**
+ * Normalize a PEM private key supplied via env. Env tooling tends to mangle
+ * multi-line PEMs, so two single-line forms are supported:
+ *   - `\n`-escaped: literal `\n` sequences become real newlines
+ *   - fully flattened: newlines stripped entirely — the PEM is rebuilt by
+ *     re-wrapping the base64 body (Node's decoder rejects header/body/footer
+ *     on one line with `error:1E08010C:DECODER routines::unsupported`)
+ */
+export declare function normalizePrivateKey(raw: string): string;
+export interface UserInstallation {
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+}
+export interface RepoSummary {
+    id: number;
+    fullName: string;
+    name: string;
+    owner: string;
+    defaultBranch: string;
+    private: boolean;
+    installationId: number;
+}
+export type GithubRepositoryPermission = 'admin' | 'maintain' | 'write' | 'triage' | 'read' | 'none';
+export interface IssueSummary {
+    number: number;
+    title: string;
+    url: string;
+    author: string | null;
+    labels: string[];
+    comments: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Page size for issue/PR listings; one GitHub API call per page. */
+export declare const LIST_PAGE_SIZE = 30;
+export interface IssuePage {
+    issues: IssueSummary[];
+    /** Next page number to request, or `null` when this was the last page. */
+    nextPage: number | null;
+}
+export interface ListRepoOpenIssuesOptions {
+    label?: string;
+}
+export interface GithubIntegrationConfig {
+    /** GitHub App id (the numeric id, as a string). */
+    appId: string;
+    /**
+     * App private key (PEM). Multi-line, `\n`-escaped, and fully flattened
+     * single-line forms are all accepted (normalized at construction).
+     */
+    privateKey: string;
+    /** OAuth client id of the GitHub App. */
+    clientId: string;
+    /** OAuth client secret of the GitHub App. */
+    clientSecret: string;
+    /** App slug — the URL name used to build the install URL. */
+    slug: string;
+    /**
+     * Secret GitHub uses to sign webhook deliveries. Omitted → webhook
+     * signature verification rejects all deliveries. Also serves as the default
+     * replica-stable OAuth/install `state` secret (see `./config.ts`).
+     */
+    webhookSecret?: string;
+}
+export declare class GithubIntegration implements FactoryIntegration {
+    #private;
+    /** Stable integration identifier (see `../factory-integration.ts`). */
+    readonly id = "github";
+    readonly intake: Intake;
+    readonly versionControl: VersionControl;
+    /**
+     * The OAuth/install flow round-trips a signed `state` through GitHub, so a
+     * multi-replica deploy needs a deployment-stable state secret.
+     */
+    readonly requiresStableStateSigner = true;
+    constructor(config: GithubIntegrationConfig);
+    /** App slug — the URL name used to build the install URL. */
+    get slug(): string;
+    get genericStorage(): IntegrationContext['storage']['generic'];
+    get sourceControlStorage(): IntegrationContext['storage']['sourceControl'];
+    get integrationStorage(): GithubSubscriptionStorage;
+    /** Secret GitHub uses to sign webhook deliveries, when configured. */
+    get webhookSecret(): string | undefined;
+    /**
+     * Octokit authenticated as the GitHub App itself (app JWT). Used for
+     * app-level operations and to mint installation tokens.
+     */
+    getAppOctokit(): Octokit;
+    /**
+     * Octokit authenticated as a specific installation (installation access
+     * token). Used to list repos and to operate on a repo on the user's behalf.
+     */
+    getInstallationOctokit(installationId: number): Octokit;
+    /** Octokit authenticated as a user via their OAuth token (the identify step). */
+    getUserOctokit(userToken: string): Octokit;
+    /**
+     * Mint a short-lived installation access token. Returned token is used only
+     * server-side / inside the sandbox clone URL and never sent to the browser.
+     */
+    mintInstallationToken(installationId: number): Promise<string>;
+    /**
+     * List the installations the authenticated user can access, via their OAuth
+     * token (`GET /user/installations`).
+     */
+    listUserInstallations(userToken: string): Promise<UserInstallation[]>;
+    /** List repos accessible to an installation (paginated). */
+    listInstallationRepos(installationId: number): Promise<RepoSummary[]>;
+    /**
+     * The authenticated user's permission level on a repo, through the
+     * installation. `undefined` when the repo/user is not accessible.
+     */
+    getRepositoryCollaboratorPermission(installationId: number, repoFullName: string, username: string, signal?: AbortSignal): Promise<GithubRepositoryPermission | undefined>;
+    /**
+     * Fetch a single repo's metadata through an installation token and confirm
+     * the installation actually has access to it. Returns `null` when the repo
+     * is not accessible to the installation (so a client can't create a project
+     * for an arbitrary repo under an installation id it merely owns).
+     */
+    getInstallationRepo(installationId: number, repoFullName: string): Promise<RepoSummary | null>;
+    /** Add labels to an issue (deduplicated; no-op on empty/malformed input). */
+    addIssueLabels(installationId: number, repoFullName: string, issueNumber: number, labels: string[]): Promise<void>;
+    /**
+     * List one page of a repo's open issues through an installation token. The
+     * issues API also returns pull requests, so those are filtered out (the
+     * filter can make a non-final page shorter than the page size — `nextPage`
+     * is derived from the raw response length, not the filtered one).
+     */
+    listRepoOpenIssues(installationId: number, repoFullName: string, page: number, options?: ListRepoOpenIssuesOptions): Promise<IssuePage>;
+    /**
+     * Build the GitHub App install URL. `state` is carried through the install
+     * flow and validated on callback.
+     */
+    buildInstallUrl(state: string): string;
+    /**
+     * Build the OAuth identify URL (authorize) used to confirm the user's
+     * identity and obtain a user token for listing their installations.
+     */
+    buildOAuthIdentifyUrl(state: string, redirectUri: string): string;
+    /** Exchange an OAuth `code` for a user access token. */
+    exchangeOAuthCode(code: string, redirectUri: string): Promise<string>;
+    /**
+     * The integration's HTTP surface: the `/web/github/*` + `/auth/github/*`
+     * Mastra `apiRoutes` (webhook handler, install/OAuth flow, project +
+     * worktree + session operations). The factory folds these into the server's
+     * `apiRoutes` when the feature is ready. Handlers operate on this instance.
+     */
+    routes(ctx: IntegrationContext): ApiRoute[];
+    /**
+     * Session-scoped agent tools: PR subscribe/unsubscribe for sessions bound
+     * to a GitHub-backed project. Empty for sessions outside a GitHub project.
+     */
+    sessionTools({ requestContext }: {
+        requestContext: RequestContext;
+    }): IntegrationTools;
+    postToolObserver({ toolContext, requestContext, }: Parameters<NonNullable<FactoryIntegration['postToolObserver']>>[0]): Promise<void>;
+    /** Non-secret config snapshot for system diagnostics/startup logs. */
+    diagnostics(): Record<string, unknown>;
+}
+//# sourceMappingURL=integration.d.ts.map

package/dist/integrations/github/integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAGV,MAAM,EAIP,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAKV,cAAc,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQ3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAMpE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qEAAqE;AACrE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,qBAAa,iBAAkB,YAAW,kBAAkB;;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,EAAE,YAAY;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAkFrB;IACF,QAAQ,CAAC,cAAc,EAAE,cAAc,CAmErC;IACF;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,QAAQ;gBAW9B,MAAM,EAAE,uBAAuB;IAiB3C,6DAA6D;IAC7D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,cAAc,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAG7D;IAED,IAAI,oBAAoB,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAIzE;IAED,IAAI,kBAAkB,IAAI,yBAAyB,CAGlD;IAED,sEAAsE;IACtE,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAWD;;;OAGG;IACH,aAAa,IAAI,OAAO;IAIxB;;;OAGG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAIvD,iFAAiF;IACjF,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI1C;;;OAGG;IACG,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMpE;;;OAGG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAY3E,4DAA4D;IACtD,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgB3E;;;OAGG;IACG,mCAAmC,CACvC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAelD;;;;;OAKG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgapG,6EAA6E;IACvE,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,IAAI,CAAC;IAchB;;;;;OAKG;IACG,kBAAkB,CACtB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,CAAC;IA2BrB;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAMtC;;;OAGG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAQjE,wDAAwD;IAClD,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwB3E;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE;IAmB3C;;;OAGG;IACH,YAAY,CAAC,EAAE,cAAc,EAAE,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB;IAIhF,gBAAgB,CAAC,EACrB,WAAW,EACX,cAAc,GACf,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrF,sEAAsE;IACtE,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMvC"}