@mastra/factory 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/rules/validation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/rules/types.ts","../../src/rules/validation.ts"],"sourcesContent":["export type WorkItemSource = 'github-issue' | 'github-pr' | 'linear-issue' | 'manual';\n\nexport const FACTORY_RULE_STAGES = ['intake', 'triage', 'planning', 'execute', 'review', 'done', 'canceled'] as const;\nexport type FactoryRuleStage = (typeof FACTORY_RULE_STAGES)[number];\n\nexport const FACTORY_RULE_BOARDS = ['work', 'review'] as const;\nexport type FactoryRuleBoard = (typeof FACTORY_RULE_BOARDS)[number];\n\nexport const FACTORY_RULE_SOURCES = ['issue', 'pullRequest', 'linearIssue', 'manual'] as const;\nexport type FactoryRuleSource = (typeof FACTORY_RULE_SOURCES)[number];\n\nexport const FACTORY_GITHUB_EVENTS = [\n  'issueOpened',\n  'pullRequestOpened',\n  'pullRequestUpdated',\n  'pullRequestReviewRequested',\n  'pullRequestMerged',\n] as const;\nexport type FactoryGithubEventName = (typeof FACTORY_GITHUB_EVENTS)[number];\n\nexport const FACTORY_LINEAR_EVENTS = ['issueObserved'] as const;\nexport type FactoryLinearEventName = (typeof FACTORY_LINEAR_EVENTS)[number];\n\nexport type FactoryRuleJsonValue =\n  null | boolean | number | string | FactoryRuleJsonValue[] | { [key: string]: FactoryRuleJsonValue };\n\nexport interface FactoryRuleItemContext {\n  id: string;\n  source: WorkItemSource;\n  sourceKey: string | null;\n  parentWorkItemId: string | null;\n  title: string;\n  url: string | null;\n  stages: readonly string[];\n}\n\nexport type FactoryRuleActor =\n  | { type: 'human'; id: string }\n  | { type: 'agent'; bindingId: string; role: string }\n  | { type: 'github'; login: string; trusted: boolean; factoryAuthored: boolean }\n  | { type: 'system'; id: string };\n\nexport interface FactoryRuleIngressIdentity {\n  type: 'human' | 'agent' | 'toolResult' | 'github' | 'linear' | 'rule';\n  id: string;\n}\n\nexport interface FactoryRuleCausalEntry {\n  ingressId: string;\n  decisionType: FactoryCommitDecision['type'];\n}\n\nexport interface FactoryRuleContextBase {\n  tenant: { orgId: string; projectId: string };\n  actor: FactoryRuleActor;\n  ingress: FactoryRuleIngressIdentity;\n  cause: string;\n  causalChain: readonly FactoryRuleCausalEntry[];\n  ruleSetVersion: string;\n}\n\nexport interface FactoryBoundRuleContext extends FactoryRuleContextBase {\n  item: FactoryRuleItemContext;\n  board: FactoryRuleBoard;\n  itemRevision: number;\n}\n\nexport interface FactoryStageRuleContext extends FactoryBoundRuleContext {\n  source: FactoryRuleSource;\n  stage: FactoryRuleStage;\n  fromStage: FactoryRuleStage;\n  toStage: FactoryRuleStage;\n}\n\nexport interface FactoryToolResultRuleContext extends FactoryBoundRuleContext {\n  toolName: string;\n  threadId: string;\n  assistantMessageId: string;\n  toolCallId: string;\n  result: {\n    status: 'success' | 'error';\n    value: FactoryRuleJsonValue;\n  };\n}\n\nexport interface FactoryGithubRuleContext extends FactoryRuleContextBase {\n  item?: FactoryRuleItemContext;\n  board?: FactoryRuleBoard;\n  itemRevision?: number;\n  event: FactoryGithubEventName;\n  deliveryId: string;\n  repository: { id: number; fullName: string };\n  issue?: { number: number; title: string; url: string };\n  pullRequest?: {\n    number: number;\n    title: string;\n    url: string;\n    state: 'open' | 'closed';\n    merged: boolean;\n    headBranch: string;\n    baseBranch: string;\n  };\n}\n\nexport interface FactoryLinearRuleContext extends FactoryRuleContextBase {\n  item?: FactoryRuleItemContext;\n  board?: FactoryRuleBoard;\n  itemRevision?: number;\n  event: FactoryLinearEventName;\n  issue: {\n    id: string;\n    identifier: string;\n    title: string;\n    url: string;\n    state: string;\n    stateType: string;\n    priorityLabel: string;\n    assignee: string | null;\n    team: string | null;\n    labels: readonly string[];\n    createdAt: string;\n    updatedAt: string;\n  };\n}\n\nexport type FactoryRuleHandler<TContext> = (\n  context: Readonly<TContext>,\n) => FactoryRuleDecision | void | Promise<FactoryRuleDecision | void>;\n\nexport interface FactoryBoardRuleLeaf {\n  onEnter?: FactoryRuleHandler<FactoryStageRuleContext>;\n  onExit?: FactoryRuleHandler<FactoryStageRuleContext>;\n}\n\nexport interface FactoryToolRuleLeaf {\n  onResult?: FactoryRuleHandler<FactoryToolResultRuleContext>;\n}\n\nexport interface FactoryGithubRuleLeaf {\n  onEvent?: FactoryRuleHandler<FactoryGithubRuleContext>;\n}\n\nexport interface FactoryLinearRuleLeaf {\n  onEvent?: FactoryRuleHandler<FactoryLinearRuleContext>;\n}\n\nexport type FactoryBoardRules = Partial<\n  Record<FactoryRuleStage, Partial<Record<FactoryRuleSource, FactoryBoardRuleLeaf>>>\n>;\n\nexport interface FactoryRules {\n  version: string;\n  work: FactoryBoardRules;\n  review: FactoryBoardRules;\n  tools: Record<string, FactoryToolRuleLeaf>;\n  github: Partial<Record<FactoryGithubEventName, FactoryGithubRuleLeaf>>;\n  linear: Partial<Record<FactoryLinearEventName, FactoryLinearRuleLeaf>>;\n}\n\nexport interface FactoryRulesOverrides {\n  work?: FactoryBoardRules;\n  review?: FactoryBoardRules;\n  tools?: Record<string, FactoryToolRuleLeaf>;\n  github?: Partial<Record<FactoryGithubEventName, FactoryGithubRuleLeaf>>;\n  linear?: Partial<Record<FactoryLinearEventName, FactoryLinearRuleLeaf>>;\n}\n\nexport type FactoryRuleRejectionCode =\n  | 'forbidden'\n  | 'invalid_transition'\n  | 'missing_binding'\n  | 'stale'\n  | 'timeout'\n  | 'rule_error'\n  | 'causal_depth_exceeded'\n  | 'repeated_transition';\n\nexport interface FactoryRuleRejectDecision {\n  type: 'reject';\n  code: FactoryRuleRejectionCode;\n  reason: string;\n}\n\ninterface FactoryCommitDecisionBase {\n  idempotencyKey: string;\n}\n\nexport interface FactoryTransitionDecision extends FactoryCommitDecisionBase {\n  type: 'transition';\n  board: FactoryRuleBoard;\n  stage: FactoryRuleStage;\n}\n\nexport interface FactoryUpsertLinkedWorkItemDecision extends FactoryCommitDecisionBase {\n  type: 'upsertLinkedWorkItem';\n  board: FactoryRuleBoard;\n  source: WorkItemSource;\n  sourceKey: string;\n  title: string;\n  url: string | null;\n  stage: FactoryRuleStage;\n  metadata?: Record<string, FactoryRuleJsonValue>;\n}\n\nexport interface FactoryInvokeSkillDecision extends FactoryCommitDecisionBase {\n  type: 'invokeSkill';\n  role: string;\n  skillName: string;\n  arguments?: string;\n  precedingMessage?: string;\n}\n\nexport interface FactorySendMessageDecision extends FactoryCommitDecisionBase {\n  type: 'sendMessage';\n  role: string;\n  message: string;\n  priority?: 'medium' | 'high' | 'urgent';\n  idleBehavior?: 'persist' | 'wake';\n  prepareBinding?: boolean;\n}\n\nexport interface FactoryNotifyDecision extends FactoryCommitDecisionBase {\n  type: 'notify';\n  title: string;\n  body?: string;\n  level?: 'info' | 'warning' | 'error';\n}\n\nexport type FactoryCommitDecision =\n  | FactoryTransitionDecision\n  | FactoryUpsertLinkedWorkItemDecision\n  | FactoryInvokeSkillDecision\n  | FactorySendMessageDecision\n  | FactoryNotifyDecision;\n\nexport type FactoryRuleDecision = FactoryRuleRejectDecision | FactoryCommitDecision;\n\nexport interface FactoryTransitionResultAccepted {\n  status: 'accepted';\n  transitionId: string;\n  itemId: string;\n  revision: number;\n  stage: FactoryRuleStage;\n  decisions: FactoryCommitDecision[];\n}\n\nexport interface FactoryTransitionResultRejected {\n  status: 'rejected';\n  transitionId: string;\n  itemId: string;\n  code: FactoryRuleRejectionCode;\n  reason: string;\n}\n\nexport type FactoryTransitionResult = FactoryTransitionResultAccepted | FactoryTransitionResultRejected;\n\nexport function factoryRuleSourceForWorkItem(source: WorkItemSource): FactoryRuleSource {\n  switch (source) {\n    case 'github-issue':\n      return 'issue';\n    case 'github-pr':\n      return 'pullRequest';\n    case 'linear-issue':\n      return 'linearIssue';\n    case 'manual':\n      return 'manual';\n  }\n}\n","import {\n  FACTORY_GITHUB_EVENTS,\n  FACTORY_LINEAR_EVENTS,\n  FACTORY_RULE_BOARDS,\n  FACTORY_RULE_SOURCES,\n  FACTORY_RULE_STAGES,\n} from './types.js';\nimport type {\n  FactoryBoardRules,\n  FactoryCommitDecision,\n  FactoryRuleDecision,\n  FactoryRuleJsonValue,\n  FactoryRules,\n  FactoryRuleRejectionCode,\n  WorkItemSource,\n} from './types.js';\n\nexport const MAX_FACTORY_RULE_CAUSAL_DEPTH = 8;\n\nconst MAX_VERSION_LENGTH = 128;\nconst MAX_IDEMPOTENCY_KEY_LENGTH = 256;\nconst MAX_REASON_LENGTH = 512;\nconst MAX_TITLE_LENGTH = 512;\nconst MAX_MESSAGE_LENGTH = 8_192;\nconst MAX_ARGUMENTS_LENGTH = 4_096;\nconst MAX_ROLE_LENGTH = 32;\nconst MAX_SKILL_NAME_LENGTH = 128;\nconst MAX_SOURCE_KEY_LENGTH = 256;\nconst MAX_URL_LENGTH = 2_048;\nconst MAX_METADATA_JSON_LENGTH = 16_384;\nconst MAX_JSON_DEPTH = 8;\nconst MAX_JSON_COLLECTION_SIZE = 100;\n\nconst IDENTIFIER_RE = /^[a-z0-9][a-z0-9_-]*$/i;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst SENSITIVE_KEY_RE = /(?:authorization|cookie|credential|password|secret|token)/i;\nconst WORK_ITEM_SOURCES: readonly WorkItemSource[] = ['github-issue', 'github-pr', 'linear-issue', 'manual'];\nconst REJECTION_CODES: readonly FactoryRuleRejectionCode[] = [\n  'forbidden',\n  'invalid_transition',\n  'missing_binding',\n  'stale',\n  'timeout',\n  'rule_error',\n  'causal_depth_exceeded',\n  'repeated_transition',\n];\n\nexport class FactoryRuleValidationError extends Error {\n  readonly code = 'invalid_factory_rule';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'FactoryRuleValidationError';\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction assertExactKeys(value: Record<string, unknown>, keys: readonly string[], label: string): void {\n  const allowed = new Set(keys);\n  if (Object.keys(value).some(key => !allowed.has(key))) {\n    throw new FactoryRuleValidationError(`${label} contains an unsupported field.`);\n  }\n}\n\nfunction boundedString(value: unknown, label: string, max: number, pattern?: RegExp): string {\n  if (typeof value !== 'string') throw new FactoryRuleValidationError(`${label} must be a string.`);\n  const normalized = value.trim();\n  if (normalized.length === 0 || normalized.length > max || (pattern && !pattern.test(normalized))) {\n    throw new FactoryRuleValidationError(`${label} is invalid.`);\n  }\n  return normalized;\n}\n\nfunction optionalBoundedString(value: unknown, label: string, max: number): string | undefined {\n  if (value === undefined) return undefined;\n  return boundedString(value, label, max);\n}\n\nfunction enumValue<T extends string>(value: unknown, allowed: readonly T[], label: string): T {\n  if (typeof value !== 'string' || !allowed.includes(value as T)) {\n    throw new FactoryRuleValidationError(`${label} is invalid.`);\n  }\n  return value as T;\n}\n\nexport function normalizeFactoryRuleJsonValue(\n  value: unknown,\n  depth = 0,\n  seen = new Set<object>(),\n): FactoryRuleJsonValue {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new FactoryRuleValidationError('Rule metadata must contain finite numbers.');\n    return value;\n  }\n  if (depth >= MAX_JSON_DEPTH || (typeof value !== 'object' && !Array.isArray(value))) {\n    throw new FactoryRuleValidationError('Rule metadata is not bounded JSON.');\n  }\n  if (seen.has(value as object)) throw new FactoryRuleValidationError('Rule metadata must not contain cycles.');\n  seen.add(value as object);\n  try {\n    if (Array.isArray(value)) {\n      if (value.length > MAX_JSON_COLLECTION_SIZE) {\n        throw new FactoryRuleValidationError('Rule metadata contains too many entries.');\n      }\n      return value.map(entry => normalizeFactoryRuleJsonValue(entry, depth + 1, seen));\n    }\n    if (!isPlainObject(value)) throw new FactoryRuleValidationError('Rule metadata must use plain objects.');\n    const entries = Object.entries(value);\n    if (entries.length > MAX_JSON_COLLECTION_SIZE) {\n      throw new FactoryRuleValidationError('Rule metadata contains too many fields.');\n    }\n    const sanitized: Record<string, FactoryRuleJsonValue> = {};\n    for (const [key, entry] of entries) {\n      const normalizedKey = boundedString(key, 'Rule metadata key', 128, IDENTIFIER_RE);\n      sanitized[normalizedKey] = SENSITIVE_KEY_RE.test(normalizedKey)\n        ? '[REDACTED]'\n        : normalizeFactoryRuleJsonValue(entry, depth + 1, seen);\n    }\n    return sanitized;\n  } finally {\n    seen.delete(value as object);\n  }\n}\n\nfunction sanitizeMetadata(value: unknown): Record<string, FactoryRuleJsonValue> | undefined {\n  if (value === undefined) return undefined;\n  const sanitized = normalizeFactoryRuleJsonValue(value);\n  if (!isPlainObject(sanitized)) throw new FactoryRuleValidationError('Rule metadata must be an object.');\n  if (JSON.stringify(sanitized).length > MAX_METADATA_JSON_LENGTH) {\n    throw new FactoryRuleValidationError('Rule metadata is too large.');\n  }\n  return sanitized;\n}\n\nfunction validateBoardRules(rules: unknown, label: string): asserts rules is FactoryBoardRules {\n  if (!isPlainObject(rules)) throw new FactoryRuleValidationError(`${label} must be an object.`);\n  for (const [stage, sources] of Object.entries(rules)) {\n    enumValue(stage, FACTORY_RULE_STAGES, `${label} stage`);\n    if (!isPlainObject(sources)) throw new FactoryRuleValidationError(`${label}.${stage} must be an object.`);\n    for (const [source, leaf] of Object.entries(sources)) {\n      enumValue(source, FACTORY_RULE_SOURCES, `${label}.${stage} source`);\n      if (!isPlainObject(leaf)) throw new FactoryRuleValidationError(`${label}.${stage}.${source} must be an object.`);\n      assertExactKeys(leaf, ['onEnter', 'onExit'], `${label}.${stage}.${source}`);\n      for (const handler of Object.values(leaf)) {\n        if (handler !== undefined && typeof handler !== 'function') {\n          throw new FactoryRuleValidationError(`${label}.${stage}.${source} handlers must be functions.`);\n        }\n      }\n    }\n  }\n}\n\nexport function assertFactoryRules(rules: unknown): asserts rules is FactoryRules {\n  if (!isPlainObject(rules)) throw new FactoryRuleValidationError('Factory rules must be an object.');\n  assertExactKeys(rules, ['version', 'work', 'review', 'tools', 'github', 'linear'], 'Factory rules');\n  boundedString(rules.version, 'Factory rule version', MAX_VERSION_LENGTH);\n  validateBoardRules(rules.work, 'Factory rules.work');\n  validateBoardRules(rules.review, 'Factory rules.review');\n\n  if (!isPlainObject(rules.tools)) throw new FactoryRuleValidationError('Factory rules.tools must be an object.');\n  for (const [toolName, leaf] of Object.entries(rules.tools)) {\n    boundedString(toolName, 'Factory tool name', 128, IDENTIFIER_RE);\n    if (!isPlainObject(leaf))\n      throw new FactoryRuleValidationError(`Factory rules.tools.${toolName} must be an object.`);\n    assertExactKeys(leaf, ['onResult'], `Factory rules.tools.${toolName}`);\n    if (leaf.onResult !== undefined && typeof leaf.onResult !== 'function') {\n      throw new FactoryRuleValidationError(`Factory rules.tools.${toolName}.onResult must be a function.`);\n    }\n  }\n\n  if (!isPlainObject(rules.github)) throw new FactoryRuleValidationError('Factory rules.github must be an object.');\n  for (const [event, leaf] of Object.entries(rules.github)) {\n    enumValue(event, FACTORY_GITHUB_EVENTS, 'Factory GitHub event');\n    if (!isPlainObject(leaf)) throw new FactoryRuleValidationError(`Factory rules.github.${event} must be an object.`);\n    assertExactKeys(leaf, ['onEvent'], `Factory rules.github.${event}`);\n    if (leaf.onEvent !== undefined && typeof leaf.onEvent !== 'function') {\n      throw new FactoryRuleValidationError(`Factory rules.github.${event}.onEvent must be a function.`);\n    }\n  }\n\n  if (!isPlainObject(rules.linear)) throw new FactoryRuleValidationError('Factory rules.linear must be an object.');\n  for (const [event, leaf] of Object.entries(rules.linear)) {\n    enumValue(event, FACTORY_LINEAR_EVENTS, 'Factory Linear event');\n    if (!isPlainObject(leaf)) throw new FactoryRuleValidationError(`Factory rules.linear.${event} must be an object.`);\n    assertExactKeys(leaf, ['onEvent'], `Factory rules.linear.${event}`);\n    if (leaf.onEvent !== undefined && typeof leaf.onEvent !== 'function') {\n      throw new FactoryRuleValidationError(`Factory rules.linear.${event}.onEvent must be a function.`);\n    }\n  }\n}\n\nfunction commonCommitFields(value: Record<string, unknown>): { idempotencyKey: string } {\n  return {\n    idempotencyKey: boundedString(value.idempotencyKey, 'Factory decision idempotencyKey', MAX_IDEMPOTENCY_KEY_LENGTH),\n  };\n}\n\nexport function validateFactoryRuleDecision(value: unknown, causalDepth = 0): FactoryRuleDecision {\n  if (causalDepth > MAX_FACTORY_RULE_CAUSAL_DEPTH) {\n    throw new FactoryRuleValidationError('Factory rule causal depth exceeded.');\n  }\n  if (!isPlainObject(value)) throw new FactoryRuleValidationError('Factory rule decision must be an object.');\n  const type = value.type;\n  if (typeof type !== 'string') throw new FactoryRuleValidationError('Factory rule decision type is required.');\n\n  switch (type) {\n    case 'reject': {\n      assertExactKeys(value, ['type', 'code', 'reason'], 'Factory reject decision');\n      return {\n        type,\n        code: enumValue(value.code, REJECTION_CODES, 'Factory rejection code'),\n        reason: boundedString(value.reason, 'Factory rejection reason', MAX_REASON_LENGTH),\n      };\n    }\n    case 'transition': {\n      assertExactKeys(value, ['type', 'idempotencyKey', 'board', 'stage'], 'Factory transition decision');\n      return {\n        type,\n        ...commonCommitFields(value),\n        board: enumValue(value.board, FACTORY_RULE_BOARDS, 'Factory transition board'),\n        stage: enumValue(value.stage, FACTORY_RULE_STAGES, 'Factory transition stage'),\n      };\n    }\n    case 'upsertLinkedWorkItem': {\n      assertExactKeys(\n        value,\n        ['type', 'idempotencyKey', 'board', 'source', 'sourceKey', 'title', 'url', 'stage', 'metadata'],\n        'Factory linked work item decision',\n      );\n      const url = value.url;\n      if (url !== null && (typeof url !== 'string' || url.length > MAX_URL_LENGTH || !/^https?:\\/\\//.test(url))) {\n        throw new FactoryRuleValidationError('Factory linked work item URL is invalid.');\n      }\n      const metadata = sanitizeMetadata(value.metadata);\n      return {\n        type,\n        ...commonCommitFields(value),\n        board: enumValue(value.board, FACTORY_RULE_BOARDS, 'Factory linked work item board'),\n        source: enumValue(value.source, WORK_ITEM_SOURCES, 'Factory linked work item source'),\n        sourceKey: boundedString(value.sourceKey, 'Factory linked work item sourceKey', MAX_SOURCE_KEY_LENGTH),\n        title: boundedString(value.title, 'Factory linked work item title', MAX_TITLE_LENGTH),\n        url,\n        stage: enumValue(value.stage, FACTORY_RULE_STAGES, 'Factory linked work item stage'),\n        ...(metadata ? { metadata } : {}),\n      };\n    }\n    case 'invokeSkill': {\n      assertExactKeys(\n        value,\n        ['type', 'idempotencyKey', 'role', 'skillName', 'arguments', 'precedingMessage'],\n        'Factory invoke skill decision',\n      );\n      const args = optionalBoundedString(value.arguments, 'Factory skill arguments', MAX_ARGUMENTS_LENGTH);\n      const precedingMessage = optionalBoundedString(\n        value.precedingMessage,\n        'Factory skill preceding message',\n        MAX_MESSAGE_LENGTH,\n      );\n      return {\n        type,\n        ...commonCommitFields(value),\n        role: boundedString(value.role, 'Factory skill role', MAX_ROLE_LENGTH, IDENTIFIER_RE),\n        skillName: boundedString(value.skillName, 'Factory skill name', MAX_SKILL_NAME_LENGTH, SKILL_NAME_RE),\n        ...(args ? { arguments: args } : {}),\n        ...(precedingMessage ? { precedingMessage } : {}),\n      };\n    }\n    case 'sendMessage': {\n      assertExactKeys(\n        value,\n        ['type', 'idempotencyKey', 'role', 'message', 'priority', 'idleBehavior', 'prepareBinding'],\n        'Factory send message decision',\n      );\n      const priority =\n        value.priority === undefined\n          ? undefined\n          : enumValue(value.priority, ['medium', 'high', 'urgent'] as const, 'Factory message priority');\n      const idleBehavior =\n        value.idleBehavior === undefined\n          ? undefined\n          : enumValue(value.idleBehavior, ['persist', 'wake'] as const, 'Factory message idle behavior');\n      if (value.prepareBinding !== undefined && typeof value.prepareBinding !== 'boolean') {\n        throw new FactoryRuleValidationError('Factory message prepareBinding must be a boolean.');\n      }\n      return {\n        type,\n        ...commonCommitFields(value),\n        role: boundedString(value.role, 'Factory message role', MAX_ROLE_LENGTH, IDENTIFIER_RE),\n        message: boundedString(value.message, 'Factory message', MAX_MESSAGE_LENGTH),\n        ...(priority ? { priority } : {}),\n        ...(idleBehavior ? { idleBehavior } : {}),\n        ...(value.prepareBinding === true ? { prepareBinding: true } : {}),\n      };\n    }\n    case 'notify': {\n      assertExactKeys(value, ['type', 'idempotencyKey', 'title', 'body', 'level'], 'Factory notify decision');\n      const body = optionalBoundedString(value.body, 'Factory notification body', MAX_MESSAGE_LENGTH);\n      const level =\n        value.level === undefined\n          ? undefined\n          : enumValue(value.level, ['info', 'warning', 'error'] as const, 'Factory notification level');\n      return {\n        type,\n        ...commonCommitFields(value),\n        title: boundedString(value.title, 'Factory notification title', MAX_TITLE_LENGTH),\n        ...(body ? { body } : {}),\n        ...(level ? { level } : {}),\n      };\n    }\n    default:\n      throw new FactoryRuleValidationError('Factory rule decision type is unsupported.');\n  }\n}\n\nexport function validateFactoryRuleDecisions(values: readonly unknown[], causalDepth = 0): FactoryCommitDecision[] {\n  if (values.length > MAX_JSON_COLLECTION_SIZE) {\n    throw new FactoryRuleValidationError('Factory rule produced too many decisions.');\n  }\n  const decisions: FactoryCommitDecision[] = [];\n  for (const value of values) {\n    const decision = validateFactoryRuleDecision(value, causalDepth);\n    if (decision.type === 'reject') {\n      throw new FactoryRuleValidationError('A rejection cannot be persisted with commit decisions.');\n    }\n    decisions.push(decision);\n  }\n  const keys = decisions.map(decision => decision.idempotencyKey);\n  if (new Set(keys).size !== keys.length) {\n    throw new FactoryRuleValidationError('Factory decisions require unique idempotency keys.');\n  }\n  return decisions;\n}\n"],"mappings":";AAEO,IAAM,sBAAsB,CAAC,UAAU,UAAU,YAAY,WAAW,UAAU,QAAQ,UAAU;AAGpG,IAAM,sBAAsB,CAAC,QAAQ,QAAQ;AAG7C,IAAM,uBAAuB,CAAC,SAAS,eAAe,eAAe,QAAQ;AAG7E,IAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,wBAAwB,CAAC,eAAe;;;ACH9C,IAAM,gCAAgC;AAE7C,IAAM,qBAAqB;AAC3B,IAAM,6BAA6B;AACnC,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAC7B,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB;AACvB,IAAM,2BAA2B;AACjC,IAAM,iBAAiB;AACvB,IAAM,2BAA2B;AAEjC,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,oBAA+C,CAAC,gBAAgB,aAAa,gBAAgB,QAAQ;AAC3G,IAAM,kBAAuD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C,OAAO;AAAA,EAEhB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,gBAAgB,OAAgC,MAAyB,OAAqB;AACrG,QAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,SAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG;AACrD,UAAM,IAAI,2BAA2B,GAAG,KAAK,iCAAiC;AAAA,EAChF;AACF;AAEA,SAAS,cAAc,OAAgB,OAAe,KAAa,SAA0B;AAC3F,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,2BAA2B,GAAG,KAAK,oBAAoB;AAChG,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,WAAW,WAAW,KAAK,WAAW,SAAS,OAAQ,WAAW,CAAC,QAAQ,KAAK,UAAU,GAAI;AAChG,UAAM,IAAI,2BAA2B,GAAG,KAAK,cAAc;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAe,KAAiC;AAC7F,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,cAAc,OAAO,OAAO,GAAG;AACxC;AAEA,SAAS,UAA4B,OAAgB,SAAuB,OAAkB;AAC5F,MAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,SAAS,KAAU,GAAG;AAC9D,UAAM,IAAI,2BAA2B,GAAG,KAAK,cAAc;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,8BACd,OACA,QAAQ,GACR,OAAO,oBAAI,IAAY,GACD;AACtB,MAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,SAAU,QAAO;AACtF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,2BAA2B,4CAA4C;AAC9G,WAAO;AAAA,EACT;AACA,MAAI,SAAS,kBAAmB,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAI;AACnF,UAAM,IAAI,2BAA2B,oCAAoC;AAAA,EAC3E;AACA,MAAI,KAAK,IAAI,KAAe,EAAG,OAAM,IAAI,2BAA2B,wCAAwC;AAC5G,OAAK,IAAI,KAAe;AACxB,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,MAAM,SAAS,0BAA0B;AAC3C,cAAM,IAAI,2BAA2B,0CAA0C;AAAA,MACjF;AACA,aAAO,MAAM,IAAI,WAAS,8BAA8B,OAAO,QAAQ,GAAG,IAAI,CAAC;AAAA,IACjF;AACA,QAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,uCAAuC;AACvG,UAAM,UAAU,OAAO,QAAQ,KAAK;AACpC,QAAI,QAAQ,SAAS,0BAA0B;AAC7C,YAAM,IAAI,2BAA2B,yCAAyC;AAAA,IAChF;AACA,UAAM,YAAkD,CAAC;AACzD,eAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,YAAM,gBAAgB,cAAc,KAAK,qBAAqB,KAAK,aAAa;AAChF,gBAAU,aAAa,IAAI,iBAAiB,KAAK,aAAa,IAC1D,eACA,8BAA8B,OAAO,QAAQ,GAAG,IAAI;AAAA,IAC1D;AACA,WAAO;AAAA,EACT,UAAE;AACA,SAAK,OAAO,KAAe;AAAA,EAC7B;AACF;AAEA,SAAS,iBAAiB,OAAkE;AAC1F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,YAAY,8BAA8B,KAAK;AACrD,MAAI,CAAC,cAAc,SAAS,EAAG,OAAM,IAAI,2BAA2B,kCAAkC;AACtG,MAAI,KAAK,UAAU,SAAS,EAAE,SAAS,0BAA0B;AAC/D,UAAM,IAAI,2BAA2B,6BAA6B;AAAA,EACpE;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,OAAmD;AAC7F,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,GAAG,KAAK,qBAAqB;AAC7F,aAAW,CAAC,OAAO,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,cAAU,OAAO,qBAAqB,GAAG,KAAK,QAAQ;AACtD,QAAI,CAAC,cAAc,OAAO,EAAG,OAAM,IAAI,2BAA2B,GAAG,KAAK,IAAI,KAAK,qBAAqB;AACxG,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,gBAAU,QAAQ,sBAAsB,GAAG,KAAK,IAAI,KAAK,SAAS;AAClE,UAAI,CAAC,cAAc,IAAI,EAAG,OAAM,IAAI,2BAA2B,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,qBAAqB;AAC/G,sBAAgB,MAAM,CAAC,WAAW,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,EAAE;AAC1E,iBAAW,WAAW,OAAO,OAAO,IAAI,GAAG;AACzC,YAAI,YAAY,UAAa,OAAO,YAAY,YAAY;AAC1D,gBAAM,IAAI,2BAA2B,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,8BAA8B;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,OAA+C;AAChF,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,kCAAkC;AAClG,kBAAgB,OAAO,CAAC,WAAW,QAAQ,UAAU,SAAS,UAAU,QAAQ,GAAG,eAAe;AAClG,gBAAc,MAAM,SAAS,wBAAwB,kBAAkB;AACvE,qBAAmB,MAAM,MAAM,oBAAoB;AACnD,qBAAmB,MAAM,QAAQ,sBAAsB;AAEvD,MAAI,CAAC,cAAc,MAAM,KAAK,EAAG,OAAM,IAAI,2BAA2B,wCAAwC;AAC9G,aAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK,GAAG;AAC1D,kBAAc,UAAU,qBAAqB,KAAK,aAAa;AAC/D,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,IAAI,2BAA2B,uBAAuB,QAAQ,qBAAqB;AAC3F,oBAAgB,MAAM,CAAC,UAAU,GAAG,uBAAuB,QAAQ,EAAE;AACrE,QAAI,KAAK,aAAa,UAAa,OAAO,KAAK,aAAa,YAAY;AACtE,YAAM,IAAI,2BAA2B,uBAAuB,QAAQ,+BAA+B;AAAA,IACrG;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,MAAM,MAAM,EAAG,OAAM,IAAI,2BAA2B,yCAAyC;AAChH,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,MAAM,GAAG;AACxD,cAAU,OAAO,uBAAuB,sBAAsB;AAC9D,QAAI,CAAC,cAAc,IAAI,EAAG,OAAM,IAAI,2BAA2B,wBAAwB,KAAK,qBAAqB;AACjH,oBAAgB,MAAM,CAAC,SAAS,GAAG,wBAAwB,KAAK,EAAE;AAClE,QAAI,KAAK,YAAY,UAAa,OAAO,KAAK,YAAY,YAAY;AACpE,YAAM,IAAI,2BAA2B,wBAAwB,KAAK,8BAA8B;AAAA,IAClG;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,MAAM,MAAM,EAAG,OAAM,IAAI,2BAA2B,yCAAyC;AAChH,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,MAAM,GAAG;AACxD,cAAU,OAAO,uBAAuB,sBAAsB;AAC9D,QAAI,CAAC,cAAc,IAAI,EAAG,OAAM,IAAI,2BAA2B,wBAAwB,KAAK,qBAAqB;AACjH,oBAAgB,MAAM,CAAC,SAAS,GAAG,wBAAwB,KAAK,EAAE;AAClE,QAAI,KAAK,YAAY,UAAa,OAAO,KAAK,YAAY,YAAY;AACpE,YAAM,IAAI,2BAA2B,wBAAwB,KAAK,8BAA8B;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA4D;AACtF,SAAO;AAAA,IACL,gBAAgB,cAAc,MAAM,gBAAgB,mCAAmC,0BAA0B;AAAA,EACnH;AACF;AAEO,SAAS,4BAA4B,OAAgB,cAAc,GAAwB;AAChG,MAAI,cAAc,+BAA+B;AAC/C,UAAM,IAAI,2BAA2B,qCAAqC;AAAA,EAC5E;AACA,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,0CAA0C;AAC1G,QAAM,OAAO,MAAM;AACnB,MAAI,OAAO,SAAS,SAAU,OAAM,IAAI,2BAA2B,yCAAyC;AAE5G,UAAQ,MAAM;AAAA,IACZ,KAAK,UAAU;AACb,sBAAgB,OAAO,CAAC,QAAQ,QAAQ,QAAQ,GAAG,yBAAyB;AAC5E,aAAO;AAAA,QACL;AAAA,QACA,MAAM,UAAU,MAAM,MAAM,iBAAiB,wBAAwB;AAAA,QACrE,QAAQ,cAAc,MAAM,QAAQ,4BAA4B,iBAAiB;AAAA,MACnF;AAAA,IACF;AAAA,IACA,KAAK,cAAc;AACjB,sBAAgB,OAAO,CAAC,QAAQ,kBAAkB,SAAS,OAAO,GAAG,6BAA6B;AAClG,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,OAAO,UAAU,MAAM,OAAO,qBAAqB,0BAA0B;AAAA,QAC7E,OAAO,UAAU,MAAM,OAAO,qBAAqB,0BAA0B;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,KAAK,wBAAwB;AAC3B;AAAA,QACE;AAAA,QACA,CAAC,QAAQ,kBAAkB,SAAS,UAAU,aAAa,SAAS,OAAO,SAAS,UAAU;AAAA,QAC9F;AAAA,MACF;AACA,YAAM,MAAM,MAAM;AAClB,UAAI,QAAQ,SAAS,OAAO,QAAQ,YAAY,IAAI,SAAS,kBAAkB,CAAC,eAAe,KAAK,GAAG,IAAI;AACzG,cAAM,IAAI,2BAA2B,0CAA0C;AAAA,MACjF;AACA,YAAM,WAAW,iBAAiB,MAAM,QAAQ;AAChD,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,OAAO,UAAU,MAAM,OAAO,qBAAqB,gCAAgC;AAAA,QACnF,QAAQ,UAAU,MAAM,QAAQ,mBAAmB,iCAAiC;AAAA,QACpF,WAAW,cAAc,MAAM,WAAW,sCAAsC,qBAAqB;AAAA,QACrG,OAAO,cAAc,MAAM,OAAO,kCAAkC,gBAAgB;AAAA,QACpF;AAAA,QACA,OAAO,UAAU,MAAM,OAAO,qBAAqB,gCAAgC;AAAA,QACnF,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,IACA,KAAK,eAAe;AAClB;AAAA,QACE;AAAA,QACA,CAAC,QAAQ,kBAAkB,QAAQ,aAAa,aAAa,kBAAkB;AAAA,QAC/E;AAAA,MACF;AACA,YAAM,OAAO,sBAAsB,MAAM,WAAW,2BAA2B,oBAAoB;AACnG,YAAM,mBAAmB;AAAA,QACvB,MAAM;AAAA,QACN;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,MAAM,cAAc,MAAM,MAAM,sBAAsB,iBAAiB,aAAa;AAAA,QACpF,WAAW,cAAc,MAAM,WAAW,sBAAsB,uBAAuB,aAAa;AAAA,QACpG,GAAI,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QAClC,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,IACA,KAAK,eAAe;AAClB;AAAA,QACE;AAAA,QACA,CAAC,QAAQ,kBAAkB,QAAQ,WAAW,YAAY,gBAAgB,gBAAgB;AAAA,QAC1F;AAAA,MACF;AACA,YAAM,WACJ,MAAM,aAAa,SACf,SACA,UAAU,MAAM,UAAU,CAAC,UAAU,QAAQ,QAAQ,GAAY,0BAA0B;AACjG,YAAM,eACJ,MAAM,iBAAiB,SACnB,SACA,UAAU,MAAM,cAAc,CAAC,WAAW,MAAM,GAAY,+BAA+B;AACjG,UAAI,MAAM,mBAAmB,UAAa,OAAO,MAAM,mBAAmB,WAAW;AACnF,cAAM,IAAI,2BAA2B,mDAAmD;AAAA,MAC1F;AACA,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,MAAM,cAAc,MAAM,MAAM,wBAAwB,iBAAiB,aAAa;AAAA,QACtF,SAAS,cAAc,MAAM,SAAS,mBAAmB,kBAAkB;AAAA,QAC3E,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,QAC/B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,QACvC,GAAI,MAAM,mBAAmB,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,sBAAgB,OAAO,CAAC,QAAQ,kBAAkB,SAAS,QAAQ,OAAO,GAAG,yBAAyB;AACtG,YAAM,OAAO,sBAAsB,MAAM,MAAM,6BAA6B,kBAAkB;AAC9F,YAAM,QACJ,MAAM,UAAU,SACZ,SACA,UAAU,MAAM,OAAO,CAAC,QAAQ,WAAW,OAAO,GAAY,4BAA4B;AAChG,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,OAAO,cAAc,MAAM,OAAO,8BAA8B,gBAAgB;AAAA,QAChF,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AACE,YAAM,IAAI,2BAA2B,4CAA4C;AAAA,EACrF;AACF;AAEO,SAAS,6BAA6B,QAA4B,cAAc,GAA4B;AACjH,MAAI,OAAO,SAAS,0BAA0B;AAC5C,UAAM,IAAI,2BAA2B,2CAA2C;AAAA,EAClF;AACA,QAAM,YAAqC,CAAC;AAC5C,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,4BAA4B,OAAO,WAAW;AAC/D,QAAI,SAAS,SAAS,UAAU;AAC9B,YAAM,IAAI,2BAA2B,wDAAwD;AAAA,IAC/F;AACA,cAAU,KAAK,QAAQ;AAAA,EACzB;AACA,QAAM,OAAO,UAAU,IAAI,cAAY,SAAS,cAAc;AAC9D,MAAI,IAAI,IAAI,IAAI,EAAE,SAAS,KAAK,QAAQ;AACtC,UAAM,IAAI,2BAA2B,oDAAoD;AAAA,EAC3F;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/rules/types.ts","../../src/rules/validation.ts"],"sourcesContent":["export type WorkItemSource = 'github-issue' | 'github-pr' | 'linear-issue' | 'manual';\n\nexport const FACTORY_RULE_STAGES = ['intake', 'triage', 'planning', 'execute', 'review', 'done', 'canceled'] as const;\nexport type FactoryRuleStage = (typeof FACTORY_RULE_STAGES)[number];\n\nexport const FACTORY_RULE_BOARDS = ['work', 'review'] as const;\nexport type FactoryRuleBoard = (typeof FACTORY_RULE_BOARDS)[number];\n\nexport const FACTORY_RULE_SOURCES = ['issue', 'pullRequest', 'linearIssue', 'manual'] as const;\nexport type FactoryRuleSource = (typeof FACTORY_RULE_SOURCES)[number];\n\nexport const FACTORY_GITHUB_EVENTS = [\n  'issueOpened',\n  'pullRequestOpened',\n  'pullRequestUpdated',\n  'pullRequestReviewRequested',\n  'pullRequestMerged',\n] as const;\nexport type FactoryGithubEventName = (typeof FACTORY_GITHUB_EVENTS)[number];\n\nexport const FACTORY_LINEAR_EVENTS = ['issueObserved'] as const;\nexport type FactoryLinearEventName = (typeof FACTORY_LINEAR_EVENTS)[number];\n\nexport type FactoryRuleJsonValue =\n  null | boolean | number | string | FactoryRuleJsonValue[] | { [key: string]: FactoryRuleJsonValue };\n\nexport interface FactoryRuleItemContext {\n  id: string;\n  source: WorkItemSource;\n  sourceKey: string | null;\n  parentWorkItemId: string | null;\n  title: string;\n  url: string | null;\n  stages: readonly string[];\n}\n\nexport type FactoryRuleActor =\n  | { type: 'human'; id: string }\n  | { type: 'agent'; bindingId: string; role: string }\n  | { type: 'github'; login: string; trusted: boolean; factoryAuthored: boolean }\n  | { type: 'system'; id: string };\n\nexport interface FactoryRuleIngressIdentity {\n  type: 'human' | 'agent' | 'toolResult' | 'github' | 'linear' | 'rule';\n  id: string;\n}\n\nexport interface FactoryRuleCausalEntry {\n  ingressId: string;\n  decisionType: FactoryCommitDecision['type'];\n}\n\nexport interface FactoryRuleContextBase {\n  tenant: { orgId: string; projectId: string };\n  actor: FactoryRuleActor;\n  ingress: FactoryRuleIngressIdentity;\n  cause: string;\n  causalChain: readonly FactoryRuleCausalEntry[];\n  ruleSetVersion: string;\n}\n\nexport interface FactoryBoundRuleContext extends FactoryRuleContextBase {\n  item: FactoryRuleItemContext;\n  board: FactoryRuleBoard;\n  itemRevision: number;\n}\n\nexport interface FactoryStageRuleContext extends FactoryBoundRuleContext {\n  source: FactoryRuleSource;\n  stage: FactoryRuleStage;\n  fromStage: FactoryRuleStage;\n  toStage: FactoryRuleStage;\n}\n\nexport interface FactoryToolResultRuleContext extends FactoryBoundRuleContext {\n  toolName: string;\n  threadId: string;\n  assistantMessageId: string;\n  toolCallId: string;\n  result: {\n    status: 'success' | 'error';\n    value: FactoryRuleJsonValue;\n  };\n}\n\nexport interface FactoryGithubRuleContext extends FactoryRuleContextBase {\n  item?: FactoryRuleItemContext;\n  board?: FactoryRuleBoard;\n  itemRevision?: number;\n  event: FactoryGithubEventName;\n  deliveryId: string;\n  factory: { createdAt: string };\n  repository: { id: number; fullName: string };\n  issue?: { number: number; title: string; url: string; createdAt?: string };\n  pullRequest?: {\n    number: number;\n    title: string;\n    url: string;\n    createdAt?: string;\n    state: 'open' | 'closed';\n    merged: boolean;\n    headBranch: string;\n    baseBranch: string;\n  };\n}\n\nexport interface FactoryLinearRuleContext extends FactoryRuleContextBase {\n  item?: FactoryRuleItemContext;\n  board?: FactoryRuleBoard;\n  itemRevision?: number;\n  event: FactoryLinearEventName;\n  issue: {\n    id: string;\n    identifier: string;\n    title: string;\n    url: string;\n    state: string;\n    stateType: string;\n    priorityLabel: string;\n    assignee: string | null;\n    team: string | null;\n    labels: readonly string[];\n    createdAt: string;\n    updatedAt: string;\n  };\n}\n\nexport type FactoryRuleHandler<TContext> = (\n  context: Readonly<TContext>,\n) => FactoryRuleDecision | void | Promise<FactoryRuleDecision | void>;\n\nexport interface FactoryBoardRuleLeaf {\n  onEnter?: FactoryRuleHandler<FactoryStageRuleContext>;\n  onExit?: FactoryRuleHandler<FactoryStageRuleContext>;\n}\n\nexport interface FactoryToolRuleLeaf {\n  onResult?: FactoryRuleHandler<FactoryToolResultRuleContext>;\n}\n\nexport interface FactoryGithubRuleLeaf {\n  onEvent?: FactoryRuleHandler<FactoryGithubRuleContext>;\n}\n\nexport interface FactoryLinearRuleLeaf {\n  onEvent?: FactoryRuleHandler<FactoryLinearRuleContext>;\n}\n\nexport type FactoryBoardRules = Partial<\n  Record<FactoryRuleStage, Partial<Record<FactoryRuleSource, FactoryBoardRuleLeaf>>>\n>;\n\nexport interface FactoryRules {\n  version: string;\n  work: FactoryBoardRules;\n  review: FactoryBoardRules;\n  tools: Record<string, FactoryToolRuleLeaf>;\n  github: Partial<Record<FactoryGithubEventName, FactoryGithubRuleLeaf>>;\n  linear: Partial<Record<FactoryLinearEventName, FactoryLinearRuleLeaf>>;\n}\n\nexport interface FactoryRulesOverrides {\n  work?: FactoryBoardRules;\n  review?: FactoryBoardRules;\n  tools?: Record<string, FactoryToolRuleLeaf>;\n  github?: Partial<Record<FactoryGithubEventName, FactoryGithubRuleLeaf>>;\n  linear?: Partial<Record<FactoryLinearEventName, FactoryLinearRuleLeaf>>;\n}\n\nexport type FactoryRuleRejectionCode =\n  | 'forbidden'\n  | 'invalid_transition'\n  | 'missing_binding'\n  | 'stale'\n  | 'timeout'\n  | 'rule_error'\n  | 'causal_depth_exceeded'\n  | 'repeated_transition';\n\nexport interface FactoryRuleRejectDecision {\n  type: 'reject';\n  code: FactoryRuleRejectionCode;\n  reason: string;\n}\n\ninterface FactoryCommitDecisionBase {\n  idempotencyKey: string;\n}\n\nexport interface FactoryTransitionDecision extends FactoryCommitDecisionBase {\n  type: 'transition';\n  board: FactoryRuleBoard;\n  stage: FactoryRuleStage;\n}\n\nexport interface FactoryUpsertLinkedWorkItemDecision extends FactoryCommitDecisionBase {\n  type: 'upsertLinkedWorkItem';\n  board: FactoryRuleBoard;\n  source: WorkItemSource;\n  sourceKey: string;\n  title: string;\n  url: string | null;\n  stage: FactoryRuleStage;\n  metadata?: Record<string, FactoryRuleJsonValue>;\n}\n\nexport interface FactoryInvokeSkillDecision extends FactoryCommitDecisionBase {\n  type: 'invokeSkill';\n  role: string;\n  skillName: string;\n  arguments?: string;\n  precedingMessage?: string;\n}\n\nexport interface FactorySendMessageDecision extends FactoryCommitDecisionBase {\n  type: 'sendMessage';\n  role: string;\n  message: string;\n  priority?: 'medium' | 'high' | 'urgent';\n  idleBehavior?: 'persist' | 'wake';\n  prepareBinding?: boolean;\n}\n\nexport interface FactoryNotifyDecision extends FactoryCommitDecisionBase {\n  type: 'notify';\n  title: string;\n  body?: string;\n  level?: 'info' | 'warning' | 'error';\n}\n\nexport type FactoryCommitDecision =\n  | FactoryTransitionDecision\n  | FactoryUpsertLinkedWorkItemDecision\n  | FactoryInvokeSkillDecision\n  | FactorySendMessageDecision\n  | FactoryNotifyDecision;\n\nexport type FactoryRuleDecision = FactoryRuleRejectDecision | FactoryCommitDecision;\n\nexport interface FactoryTransitionResultAccepted {\n  status: 'accepted';\n  transitionId: string;\n  itemId: string;\n  revision: number;\n  stage: FactoryRuleStage;\n  decisions: FactoryCommitDecision[];\n}\n\nexport interface FactoryTransitionResultRejected {\n  status: 'rejected';\n  transitionId: string;\n  itemId: string;\n  code: FactoryRuleRejectionCode;\n  reason: string;\n}\n\nexport type FactoryTransitionResult = FactoryTransitionResultAccepted | FactoryTransitionResultRejected;\n\nexport function factoryRuleSourceForWorkItem(source: WorkItemSource): FactoryRuleSource {\n  switch (source) {\n    case 'github-issue':\n      return 'issue';\n    case 'github-pr':\n      return 'pullRequest';\n    case 'linear-issue':\n      return 'linearIssue';\n    case 'manual':\n      return 'manual';\n  }\n}\n","import {\n  FACTORY_GITHUB_EVENTS,\n  FACTORY_LINEAR_EVENTS,\n  FACTORY_RULE_BOARDS,\n  FACTORY_RULE_SOURCES,\n  FACTORY_RULE_STAGES,\n} from './types.js';\nimport type {\n  FactoryBoardRules,\n  FactoryCommitDecision,\n  FactoryRuleDecision,\n  FactoryRuleJsonValue,\n  FactoryRules,\n  FactoryRuleRejectionCode,\n  WorkItemSource,\n} from './types.js';\n\nexport const MAX_FACTORY_RULE_CAUSAL_DEPTH = 8;\n\nconst MAX_VERSION_LENGTH = 128;\nconst MAX_IDEMPOTENCY_KEY_LENGTH = 256;\nconst MAX_REASON_LENGTH = 512;\nconst MAX_TITLE_LENGTH = 512;\nconst MAX_MESSAGE_LENGTH = 8_192;\nconst MAX_ARGUMENTS_LENGTH = 4_096;\nconst MAX_ROLE_LENGTH = 32;\nconst MAX_SKILL_NAME_LENGTH = 128;\nconst MAX_SOURCE_KEY_LENGTH = 256;\nconst MAX_URL_LENGTH = 2_048;\nconst MAX_METADATA_JSON_LENGTH = 16_384;\nconst MAX_JSON_DEPTH = 8;\nconst MAX_JSON_COLLECTION_SIZE = 100;\n\nconst IDENTIFIER_RE = /^[a-z0-9][a-z0-9_-]*$/i;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst SENSITIVE_KEY_RE = /(?:authorization|cookie|credential|password|secret|token)/i;\nconst WORK_ITEM_SOURCES: readonly WorkItemSource[] = ['github-issue', 'github-pr', 'linear-issue', 'manual'];\nconst REJECTION_CODES: readonly FactoryRuleRejectionCode[] = [\n  'forbidden',\n  'invalid_transition',\n  'missing_binding',\n  'stale',\n  'timeout',\n  'rule_error',\n  'causal_depth_exceeded',\n  'repeated_transition',\n];\n\nexport class FactoryRuleValidationError extends Error {\n  readonly code = 'invalid_factory_rule';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'FactoryRuleValidationError';\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction assertExactKeys(value: Record<string, unknown>, keys: readonly string[], label: string): void {\n  const allowed = new Set(keys);\n  if (Object.keys(value).some(key => !allowed.has(key))) {\n    throw new FactoryRuleValidationError(`${label} contains an unsupported field.`);\n  }\n}\n\nfunction boundedString(value: unknown, label: string, max: number, pattern?: RegExp): string {\n  if (typeof value !== 'string') throw new FactoryRuleValidationError(`${label} must be a string.`);\n  const normalized = value.trim();\n  if (normalized.length === 0 || normalized.length > max || (pattern && !pattern.test(normalized))) {\n    throw new FactoryRuleValidationError(`${label} is invalid.`);\n  }\n  return normalized;\n}\n\nfunction optionalBoundedString(value: unknown, label: string, max: number): string | undefined {\n  if (value === undefined) return undefined;\n  return boundedString(value, label, max);\n}\n\nfunction enumValue<T extends string>(value: unknown, allowed: readonly T[], label: string): T {\n  if (typeof value !== 'string' || !allowed.includes(value as T)) {\n    throw new FactoryRuleValidationError(`${label} is invalid.`);\n  }\n  return value as T;\n}\n\nexport function normalizeFactoryRuleJsonValue(\n  value: unknown,\n  depth = 0,\n  seen = new Set<object>(),\n): FactoryRuleJsonValue {\n  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new FactoryRuleValidationError('Rule metadata must contain finite numbers.');\n    return value;\n  }\n  if (depth >= MAX_JSON_DEPTH || (typeof value !== 'object' && !Array.isArray(value))) {\n    throw new FactoryRuleValidationError('Rule metadata is not bounded JSON.');\n  }\n  if (seen.has(value as object)) throw new FactoryRuleValidationError('Rule metadata must not contain cycles.');\n  seen.add(value as object);\n  try {\n    if (Array.isArray(value)) {\n      if (value.length > MAX_JSON_COLLECTION_SIZE) {\n        throw new FactoryRuleValidationError('Rule metadata contains too many entries.');\n      }\n      return value.map(entry => normalizeFactoryRuleJsonValue(entry, depth + 1, seen));\n    }\n    if (!isPlainObject(value)) throw new FactoryRuleValidationError('Rule metadata must use plain objects.');\n    const entries = Object.entries(value);\n    if (entries.length > MAX_JSON_COLLECTION_SIZE) {\n      throw new FactoryRuleValidationError('Rule metadata contains too many fields.');\n    }\n    const sanitized: Record<string, FactoryRuleJsonValue> = {};\n    for (const [key, entry] of entries) {\n      const normalizedKey = boundedString(key, 'Rule metadata key', 128, IDENTIFIER_RE);\n      sanitized[normalizedKey] = SENSITIVE_KEY_RE.test(normalizedKey)\n        ? '[REDACTED]'\n        : normalizeFactoryRuleJsonValue(entry, depth + 1, seen);\n    }\n    return sanitized;\n  } finally {\n    seen.delete(value as object);\n  }\n}\n\nfunction sanitizeMetadata(value: unknown): Record<string, FactoryRuleJsonValue> | undefined {\n  if (value === undefined) return undefined;\n  const sanitized = normalizeFactoryRuleJsonValue(value);\n  if (!isPlainObject(sanitized)) throw new FactoryRuleValidationError('Rule metadata must be an object.');\n  if (JSON.stringify(sanitized).length > MAX_METADATA_JSON_LENGTH) {\n    throw new FactoryRuleValidationError('Rule metadata is too large.');\n  }\n  return sanitized;\n}\n\nfunction validateBoardRules(rules: unknown, label: string): asserts rules is FactoryBoardRules {\n  if (!isPlainObject(rules)) throw new FactoryRuleValidationError(`${label} must be an object.`);\n  for (const [stage, sources] of Object.entries(rules)) {\n    enumValue(stage, FACTORY_RULE_STAGES, `${label} stage`);\n    if (!isPlainObject(sources)) throw new FactoryRuleValidationError(`${label}.${stage} must be an object.`);\n    for (const [source, leaf] of Object.entries(sources)) {\n      enumValue(source, FACTORY_RULE_SOURCES, `${label}.${stage} source`);\n      if (!isPlainObject(leaf)) throw new FactoryRuleValidationError(`${label}.${stage}.${source} must be an object.`);\n      assertExactKeys(leaf, ['onEnter', 'onExit'], `${label}.${stage}.${source}`);\n      for (const handler of Object.values(leaf)) {\n        if (handler !== undefined && typeof handler !== 'function') {\n          throw new FactoryRuleValidationError(`${label}.${stage}.${source} handlers must be functions.`);\n        }\n      }\n    }\n  }\n}\n\nexport function assertFactoryRules(rules: unknown): asserts rules is FactoryRules {\n  if (!isPlainObject(rules)) throw new FactoryRuleValidationError('Factory rules must be an object.');\n  assertExactKeys(rules, ['version', 'work', 'review', 'tools', 'github', 'linear'], 'Factory rules');\n  boundedString(rules.version, 'Factory rule version', MAX_VERSION_LENGTH);\n  validateBoardRules(rules.work, 'Factory rules.work');\n  validateBoardRules(rules.review, 'Factory rules.review');\n\n  if (!isPlainObject(rules.tools)) throw new FactoryRuleValidationError('Factory rules.tools must be an object.');\n  for (const [toolName, leaf] of Object.entries(rules.tools)) {\n    boundedString(toolName, 'Factory tool name', 128, IDENTIFIER_RE);\n    if (!isPlainObject(leaf))\n      throw new FactoryRuleValidationError(`Factory rules.tools.${toolName} must be an object.`);\n    assertExactKeys(leaf, ['onResult'], `Factory rules.tools.${toolName}`);\n    if (leaf.onResult !== undefined && typeof leaf.onResult !== 'function') {\n      throw new FactoryRuleValidationError(`Factory rules.tools.${toolName}.onResult must be a function.`);\n    }\n  }\n\n  if (!isPlainObject(rules.github)) throw new FactoryRuleValidationError('Factory rules.github must be an object.');\n  for (const [event, leaf] of Object.entries(rules.github)) {\n    enumValue(event, FACTORY_GITHUB_EVENTS, 'Factory GitHub event');\n    if (!isPlainObject(leaf)) throw new FactoryRuleValidationError(`Factory rules.github.${event} must be an object.`);\n    assertExactKeys(leaf, ['onEvent'], `Factory rules.github.${event}`);\n    if (leaf.onEvent !== undefined && typeof leaf.onEvent !== 'function') {\n      throw new FactoryRuleValidationError(`Factory rules.github.${event}.onEvent must be a function.`);\n    }\n  }\n\n  if (!isPlainObject(rules.linear)) throw new FactoryRuleValidationError('Factory rules.linear must be an object.');\n  for (const [event, leaf] of Object.entries(rules.linear)) {\n    enumValue(event, FACTORY_LINEAR_EVENTS, 'Factory Linear event');\n    if (!isPlainObject(leaf)) throw new FactoryRuleValidationError(`Factory rules.linear.${event} must be an object.`);\n    assertExactKeys(leaf, ['onEvent'], `Factory rules.linear.${event}`);\n    if (leaf.onEvent !== undefined && typeof leaf.onEvent !== 'function') {\n      throw new FactoryRuleValidationError(`Factory rules.linear.${event}.onEvent must be a function.`);\n    }\n  }\n}\n\nfunction commonCommitFields(value: Record<string, unknown>): { idempotencyKey: string } {\n  return {\n    idempotencyKey: boundedString(value.idempotencyKey, 'Factory decision idempotencyKey', MAX_IDEMPOTENCY_KEY_LENGTH),\n  };\n}\n\nexport function validateFactoryRuleDecision(value: unknown, causalDepth = 0): FactoryRuleDecision {\n  if (causalDepth > MAX_FACTORY_RULE_CAUSAL_DEPTH) {\n    throw new FactoryRuleValidationError('Factory rule causal depth exceeded.');\n  }\n  if (!isPlainObject(value)) throw new FactoryRuleValidationError('Factory rule decision must be an object.');\n  const type = value.type;\n  if (typeof type !== 'string') throw new FactoryRuleValidationError('Factory rule decision type is required.');\n\n  switch (type) {\n    case 'reject': {\n      assertExactKeys(value, ['type', 'code', 'reason'], 'Factory reject decision');\n      return {\n        type,\n        code: enumValue(value.code, REJECTION_CODES, 'Factory rejection code'),\n        reason: boundedString(value.reason, 'Factory rejection reason', MAX_REASON_LENGTH),\n      };\n    }\n    case 'transition': {\n      assertExactKeys(value, ['type', 'idempotencyKey', 'board', 'stage'], 'Factory transition decision');\n      return {\n        type,\n        ...commonCommitFields(value),\n        board: enumValue(value.board, FACTORY_RULE_BOARDS, 'Factory transition board'),\n        stage: enumValue(value.stage, FACTORY_RULE_STAGES, 'Factory transition stage'),\n      };\n    }\n    case 'upsertLinkedWorkItem': {\n      assertExactKeys(\n        value,\n        ['type', 'idempotencyKey', 'board', 'source', 'sourceKey', 'title', 'url', 'stage', 'metadata'],\n        'Factory linked work item decision',\n      );\n      const url = value.url;\n      if (url !== null && (typeof url !== 'string' || url.length > MAX_URL_LENGTH || !/^https?:\\/\\//.test(url))) {\n        throw new FactoryRuleValidationError('Factory linked work item URL is invalid.');\n      }\n      const metadata = sanitizeMetadata(value.metadata);\n      return {\n        type,\n        ...commonCommitFields(value),\n        board: enumValue(value.board, FACTORY_RULE_BOARDS, 'Factory linked work item board'),\n        source: enumValue(value.source, WORK_ITEM_SOURCES, 'Factory linked work item source'),\n        sourceKey: boundedString(value.sourceKey, 'Factory linked work item sourceKey', MAX_SOURCE_KEY_LENGTH),\n        title: boundedString(value.title, 'Factory linked work item title', MAX_TITLE_LENGTH),\n        url,\n        stage: enumValue(value.stage, FACTORY_RULE_STAGES, 'Factory linked work item stage'),\n        ...(metadata ? { metadata } : {}),\n      };\n    }\n    case 'invokeSkill': {\n      assertExactKeys(\n        value,\n        ['type', 'idempotencyKey', 'role', 'skillName', 'arguments', 'precedingMessage'],\n        'Factory invoke skill decision',\n      );\n      const args = optionalBoundedString(value.arguments, 'Factory skill arguments', MAX_ARGUMENTS_LENGTH);\n      const precedingMessage = optionalBoundedString(\n        value.precedingMessage,\n        'Factory skill preceding message',\n        MAX_MESSAGE_LENGTH,\n      );\n      return {\n        type,\n        ...commonCommitFields(value),\n        role: boundedString(value.role, 'Factory skill role', MAX_ROLE_LENGTH, IDENTIFIER_RE),\n        skillName: boundedString(value.skillName, 'Factory skill name', MAX_SKILL_NAME_LENGTH, SKILL_NAME_RE),\n        ...(args ? { arguments: args } : {}),\n        ...(precedingMessage ? { precedingMessage } : {}),\n      };\n    }\n    case 'sendMessage': {\n      assertExactKeys(\n        value,\n        ['type', 'idempotencyKey', 'role', 'message', 'priority', 'idleBehavior', 'prepareBinding'],\n        'Factory send message decision',\n      );\n      const priority =\n        value.priority === undefined\n          ? undefined\n          : enumValue(value.priority, ['medium', 'high', 'urgent'] as const, 'Factory message priority');\n      const idleBehavior =\n        value.idleBehavior === undefined\n          ? undefined\n          : enumValue(value.idleBehavior, ['persist', 'wake'] as const, 'Factory message idle behavior');\n      if (value.prepareBinding !== undefined && typeof value.prepareBinding !== 'boolean') {\n        throw new FactoryRuleValidationError('Factory message prepareBinding must be a boolean.');\n      }\n      return {\n        type,\n        ...commonCommitFields(value),\n        role: boundedString(value.role, 'Factory message role', MAX_ROLE_LENGTH, IDENTIFIER_RE),\n        message: boundedString(value.message, 'Factory message', MAX_MESSAGE_LENGTH),\n        ...(priority ? { priority } : {}),\n        ...(idleBehavior ? { idleBehavior } : {}),\n        ...(value.prepareBinding === true ? { prepareBinding: true } : {}),\n      };\n    }\n    case 'notify': {\n      assertExactKeys(value, ['type', 'idempotencyKey', 'title', 'body', 'level'], 'Factory notify decision');\n      const body = optionalBoundedString(value.body, 'Factory notification body', MAX_MESSAGE_LENGTH);\n      const level =\n        value.level === undefined\n          ? undefined\n          : enumValue(value.level, ['info', 'warning', 'error'] as const, 'Factory notification level');\n      return {\n        type,\n        ...commonCommitFields(value),\n        title: boundedString(value.title, 'Factory notification title', MAX_TITLE_LENGTH),\n        ...(body ? { body } : {}),\n        ...(level ? { level } : {}),\n      };\n    }\n    default:\n      throw new FactoryRuleValidationError('Factory rule decision type is unsupported.');\n  }\n}\n\nexport function validateFactoryRuleDecisions(values: readonly unknown[], causalDepth = 0): FactoryCommitDecision[] {\n  if (values.length > MAX_JSON_COLLECTION_SIZE) {\n    throw new FactoryRuleValidationError('Factory rule produced too many decisions.');\n  }\n  const decisions: FactoryCommitDecision[] = [];\n  for (const value of values) {\n    const decision = validateFactoryRuleDecision(value, causalDepth);\n    if (decision.type === 'reject') {\n      throw new FactoryRuleValidationError('A rejection cannot be persisted with commit decisions.');\n    }\n    decisions.push(decision);\n  }\n  const keys = decisions.map(decision => decision.idempotencyKey);\n  if (new Set(keys).size !== keys.length) {\n    throw new FactoryRuleValidationError('Factory decisions require unique idempotency keys.');\n  }\n  return decisions;\n}\n"],"mappings":";AAEO,IAAM,sBAAsB,CAAC,UAAU,UAAU,YAAY,WAAW,UAAU,QAAQ,UAAU;AAGpG,IAAM,sBAAsB,CAAC,QAAQ,QAAQ;AAG7C,IAAM,uBAAuB,CAAC,SAAS,eAAe,eAAe,QAAQ;AAG7E,IAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,wBAAwB,CAAC,eAAe;;;ACH9C,IAAM,gCAAgC;AAE7C,IAAM,qBAAqB;AAC3B,IAAM,6BAA6B;AACnC,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAC7B,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB;AACvB,IAAM,2BAA2B;AACjC,IAAM,iBAAiB;AACvB,IAAM,2BAA2B;AAEjC,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,oBAA+C,CAAC,gBAAgB,aAAa,gBAAgB,QAAQ;AAC3G,IAAM,kBAAuD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C,OAAO;AAAA,EAEhB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,SAAO,cAAc,OAAO,aAAa,cAAc;AACzD;AAEA,SAAS,gBAAgB,OAAgC,MAAyB,OAAqB;AACrG,QAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,SAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG;AACrD,UAAM,IAAI,2BAA2B,GAAG,KAAK,iCAAiC;AAAA,EAChF;AACF;AAEA,SAAS,cAAc,OAAgB,OAAe,KAAa,SAA0B;AAC3F,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,2BAA2B,GAAG,KAAK,oBAAoB;AAChG,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,WAAW,WAAW,KAAK,WAAW,SAAS,OAAQ,WAAW,CAAC,QAAQ,KAAK,UAAU,GAAI;AAChG,UAAM,IAAI,2BAA2B,GAAG,KAAK,cAAc;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAe,KAAiC;AAC7F,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,cAAc,OAAO,OAAO,GAAG;AACxC;AAEA,SAAS,UAA4B,OAAgB,SAAuB,OAAkB;AAC5F,MAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,SAAS,KAAU,GAAG;AAC9D,UAAM,IAAI,2BAA2B,GAAG,KAAK,cAAc;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,8BACd,OACA,QAAQ,GACR,OAAO,oBAAI,IAAY,GACD;AACtB,MAAI,UAAU,QAAQ,OAAO,UAAU,aAAa,OAAO,UAAU,SAAU,QAAO;AACtF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,2BAA2B,4CAA4C;AAC9G,WAAO;AAAA,EACT;AACA,MAAI,SAAS,kBAAmB,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAI;AACnF,UAAM,IAAI,2BAA2B,oCAAoC;AAAA,EAC3E;AACA,MAAI,KAAK,IAAI,KAAe,EAAG,OAAM,IAAI,2BAA2B,wCAAwC;AAC5G,OAAK,IAAI,KAAe;AACxB,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,MAAM,SAAS,0BAA0B;AAC3C,cAAM,IAAI,2BAA2B,0CAA0C;AAAA,MACjF;AACA,aAAO,MAAM,IAAI,WAAS,8BAA8B,OAAO,QAAQ,GAAG,IAAI,CAAC;AAAA,IACjF;AACA,QAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,uCAAuC;AACvG,UAAM,UAAU,OAAO,QAAQ,KAAK;AACpC,QAAI,QAAQ,SAAS,0BAA0B;AAC7C,YAAM,IAAI,2BAA2B,yCAAyC;AAAA,IAChF;AACA,UAAM,YAAkD,CAAC;AACzD,eAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,YAAM,gBAAgB,cAAc,KAAK,qBAAqB,KAAK,aAAa;AAChF,gBAAU,aAAa,IAAI,iBAAiB,KAAK,aAAa,IAC1D,eACA,8BAA8B,OAAO,QAAQ,GAAG,IAAI;AAAA,IAC1D;AACA,WAAO;AAAA,EACT,UAAE;AACA,SAAK,OAAO,KAAe;AAAA,EAC7B;AACF;AAEA,SAAS,iBAAiB,OAAkE;AAC1F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,YAAY,8BAA8B,KAAK;AACrD,MAAI,CAAC,cAAc,SAAS,EAAG,OAAM,IAAI,2BAA2B,kCAAkC;AACtG,MAAI,KAAK,UAAU,SAAS,EAAE,SAAS,0BAA0B;AAC/D,UAAM,IAAI,2BAA2B,6BAA6B;AAAA,EACpE;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,OAAmD;AAC7F,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,GAAG,KAAK,qBAAqB;AAC7F,aAAW,CAAC,OAAO,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,cAAU,OAAO,qBAAqB,GAAG,KAAK,QAAQ;AACtD,QAAI,CAAC,cAAc,OAAO,EAAG,OAAM,IAAI,2BAA2B,GAAG,KAAK,IAAI,KAAK,qBAAqB;AACxG,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,gBAAU,QAAQ,sBAAsB,GAAG,KAAK,IAAI,KAAK,SAAS;AAClE,UAAI,CAAC,cAAc,IAAI,EAAG,OAAM,IAAI,2BAA2B,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,qBAAqB;AAC/G,sBAAgB,MAAM,CAAC,WAAW,QAAQ,GAAG,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,EAAE;AAC1E,iBAAW,WAAW,OAAO,OAAO,IAAI,GAAG;AACzC,YAAI,YAAY,UAAa,OAAO,YAAY,YAAY;AAC1D,gBAAM,IAAI,2BAA2B,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,8BAA8B;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,OAA+C;AAChF,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,kCAAkC;AAClG,kBAAgB,OAAO,CAAC,WAAW,QAAQ,UAAU,SAAS,UAAU,QAAQ,GAAG,eAAe;AAClG,gBAAc,MAAM,SAAS,wBAAwB,kBAAkB;AACvE,qBAAmB,MAAM,MAAM,oBAAoB;AACnD,qBAAmB,MAAM,QAAQ,sBAAsB;AAEvD,MAAI,CAAC,cAAc,MAAM,KAAK,EAAG,OAAM,IAAI,2BAA2B,wCAAwC;AAC9G,aAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK,GAAG;AAC1D,kBAAc,UAAU,qBAAqB,KAAK,aAAa;AAC/D,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,IAAI,2BAA2B,uBAAuB,QAAQ,qBAAqB;AAC3F,oBAAgB,MAAM,CAAC,UAAU,GAAG,uBAAuB,QAAQ,EAAE;AACrE,QAAI,KAAK,aAAa,UAAa,OAAO,KAAK,aAAa,YAAY;AACtE,YAAM,IAAI,2BAA2B,uBAAuB,QAAQ,+BAA+B;AAAA,IACrG;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,MAAM,MAAM,EAAG,OAAM,IAAI,2BAA2B,yCAAyC;AAChH,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,MAAM,GAAG;AACxD,cAAU,OAAO,uBAAuB,sBAAsB;AAC9D,QAAI,CAAC,cAAc,IAAI,EAAG,OAAM,IAAI,2BAA2B,wBAAwB,KAAK,qBAAqB;AACjH,oBAAgB,MAAM,CAAC,SAAS,GAAG,wBAAwB,KAAK,EAAE;AAClE,QAAI,KAAK,YAAY,UAAa,OAAO,KAAK,YAAY,YAAY;AACpE,YAAM,IAAI,2BAA2B,wBAAwB,KAAK,8BAA8B;AAAA,IAClG;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,MAAM,MAAM,EAAG,OAAM,IAAI,2BAA2B,yCAAyC;AAChH,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,MAAM,GAAG;AACxD,cAAU,OAAO,uBAAuB,sBAAsB;AAC9D,QAAI,CAAC,cAAc,IAAI,EAAG,OAAM,IAAI,2BAA2B,wBAAwB,KAAK,qBAAqB;AACjH,oBAAgB,MAAM,CAAC,SAAS,GAAG,wBAAwB,KAAK,EAAE;AAClE,QAAI,KAAK,YAAY,UAAa,OAAO,KAAK,YAAY,YAAY;AACpE,YAAM,IAAI,2BAA2B,wBAAwB,KAAK,8BAA8B;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,OAA4D;AACtF,SAAO;AAAA,IACL,gBAAgB,cAAc,MAAM,gBAAgB,mCAAmC,0BAA0B;AAAA,EACnH;AACF;AAEO,SAAS,4BAA4B,OAAgB,cAAc,GAAwB;AAChG,MAAI,cAAc,+BAA+B;AAC/C,UAAM,IAAI,2BAA2B,qCAAqC;AAAA,EAC5E;AACA,MAAI,CAAC,cAAc,KAAK,EAAG,OAAM,IAAI,2BAA2B,0CAA0C;AAC1G,QAAM,OAAO,MAAM;AACnB,MAAI,OAAO,SAAS,SAAU,OAAM,IAAI,2BAA2B,yCAAyC;AAE5G,UAAQ,MAAM;AAAA,IACZ,KAAK,UAAU;AACb,sBAAgB,OAAO,CAAC,QAAQ,QAAQ,QAAQ,GAAG,yBAAyB;AAC5E,aAAO;AAAA,QACL;AAAA,QACA,MAAM,UAAU,MAAM,MAAM,iBAAiB,wBAAwB;AAAA,QACrE,QAAQ,cAAc,MAAM,QAAQ,4BAA4B,iBAAiB;AAAA,MACnF;AAAA,IACF;AAAA,IACA,KAAK,cAAc;AACjB,sBAAgB,OAAO,CAAC,QAAQ,kBAAkB,SAAS,OAAO,GAAG,6BAA6B;AAClG,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,OAAO,UAAU,MAAM,OAAO,qBAAqB,0BAA0B;AAAA,QAC7E,OAAO,UAAU,MAAM,OAAO,qBAAqB,0BAA0B;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,KAAK,wBAAwB;AAC3B;AAAA,QACE;AAAA,QACA,CAAC,QAAQ,kBAAkB,SAAS,UAAU,aAAa,SAAS,OAAO,SAAS,UAAU;AAAA,QAC9F;AAAA,MACF;AACA,YAAM,MAAM,MAAM;AAClB,UAAI,QAAQ,SAAS,OAAO,QAAQ,YAAY,IAAI,SAAS,kBAAkB,CAAC,eAAe,KAAK,GAAG,IAAI;AACzG,cAAM,IAAI,2BAA2B,0CAA0C;AAAA,MACjF;AACA,YAAM,WAAW,iBAAiB,MAAM,QAAQ;AAChD,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,OAAO,UAAU,MAAM,OAAO,qBAAqB,gCAAgC;AAAA,QACnF,QAAQ,UAAU,MAAM,QAAQ,mBAAmB,iCAAiC;AAAA,QACpF,WAAW,cAAc,MAAM,WAAW,sCAAsC,qBAAqB;AAAA,QACrG,OAAO,cAAc,MAAM,OAAO,kCAAkC,gBAAgB;AAAA,QACpF;AAAA,QACA,OAAO,UAAU,MAAM,OAAO,qBAAqB,gCAAgC;AAAA,QACnF,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,IACA,KAAK,eAAe;AAClB;AAAA,QACE;AAAA,QACA,CAAC,QAAQ,kBAAkB,QAAQ,aAAa,aAAa,kBAAkB;AAAA,QAC/E;AAAA,MACF;AACA,YAAM,OAAO,sBAAsB,MAAM,WAAW,2BAA2B,oBAAoB;AACnG,YAAM,mBAAmB;AAAA,QACvB,MAAM;AAAA,QACN;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,MAAM,cAAc,MAAM,MAAM,sBAAsB,iBAAiB,aAAa;AAAA,QACpF,WAAW,cAAc,MAAM,WAAW,sBAAsB,uBAAuB,aAAa;AAAA,QACpG,GAAI,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QAClC,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;AAAA,MACjD;AAAA,IACF;AAAA,IACA,KAAK,eAAe;AAClB;AAAA,QACE;AAAA,QACA,CAAC,QAAQ,kBAAkB,QAAQ,WAAW,YAAY,gBAAgB,gBAAgB;AAAA,QAC1F;AAAA,MACF;AACA,YAAM,WACJ,MAAM,aAAa,SACf,SACA,UAAU,MAAM,UAAU,CAAC,UAAU,QAAQ,QAAQ,GAAY,0BAA0B;AACjG,YAAM,eACJ,MAAM,iBAAiB,SACnB,SACA,UAAU,MAAM,cAAc,CAAC,WAAW,MAAM,GAAY,+BAA+B;AACjG,UAAI,MAAM,mBAAmB,UAAa,OAAO,MAAM,mBAAmB,WAAW;AACnF,cAAM,IAAI,2BAA2B,mDAAmD;AAAA,MAC1F;AACA,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,MAAM,cAAc,MAAM,MAAM,wBAAwB,iBAAiB,aAAa;AAAA,QACtF,SAAS,cAAc,MAAM,SAAS,mBAAmB,kBAAkB;AAAA,QAC3E,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,QAC/B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,QACvC,GAAI,MAAM,mBAAmB,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,sBAAgB,OAAO,CAAC,QAAQ,kBAAkB,SAAS,QAAQ,OAAO,GAAG,yBAAyB;AACtG,YAAM,OAAO,sBAAsB,MAAM,MAAM,6BAA6B,kBAAkB;AAC9F,YAAM,QACJ,MAAM,UAAU,SACZ,SACA,UAAU,MAAM,OAAO,CAAC,QAAQ,WAAW,OAAO,GAAY,4BAA4B;AAChG,aAAO;AAAA,QACL;AAAA,QACA,GAAG,mBAAmB,KAAK;AAAA,QAC3B,OAAO,cAAc,MAAM,OAAO,8BAA8B,gBAAgB;AAAA,QAChF,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AACE,YAAM,IAAI,2BAA2B,4CAA4C;AAAA,EACrF;AACF;AAEO,SAAS,6BAA6B,QAA4B,cAAc,GAA4B;AACjH,MAAI,OAAO,SAAS,0BAA0B;AAC5C,UAAM,IAAI,2BAA2B,2CAA2C;AAAA,EAClF;AACA,QAAM,YAAqC,CAAC;AAC5C,aAAW,SAAS,QAAQ;AAC1B,UAAM,WAAW,4BAA4B,OAAO,WAAW;AAC/D,QAAI,SAAS,SAAS,UAAU;AAC9B,YAAM,IAAI,2BAA2B,wDAAwD;AAAA,IAC/F;AACA,cAAU,KAAK,QAAQ;AAAA,EACzB;AACA,QAAM,OAAO,UAAU,IAAI,cAAY,SAAS,cAAc;AAC9D,MAAI,IAAI,IAAI,IAAI,EAAE,SAAS,KAAK,QAAQ;AACtC,UAAM,IAAI,2BAA2B,oDAAoD;AAAA,EAC3F;AACA,SAAO;AACT;","names":[]}

package/dist/sandbox/fleet.d.ts

@@ -35,7 +35,10 @@ export interface MaterializationSandbox {
     }>;
     executeCommand(command: string, args?: string[], options?: {
         timeout?: number;
+        env?: Record<string, string | undefined>;
     }): Promise<SandboxCommandResult>;
+    /** Update an environment variable for future commands in this sandbox. */
+    setEnvironmentVariable?(name: string, value: string): void;
     /** Tear down the underlying VM. Optional: providers without it are no-ops. */
     stop?(): Promise<void>;
 }

package/dist/sandbox/fleet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/sandbox/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3D,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChH,8EAA8E;IAC9E,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,GAAG,cAAc,GAAG,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC;IAC9G,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAE1D,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAO/F;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,oBAAoB,KAAK,sBAAsB,CAAC;AAEpF,4EAA4E;AAC5E,qBAAa,kBAAmB,SAAQ,KAAK;IAE/B,QAAQ,CAAC,GAAG,EAAE,MAAM;IADhC,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBAC9B,GAAG,EAAE,MAAM;CAOjC;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mFAAmF;IACnF,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uFAAuF;IACvF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA8CD,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAKxF;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,YAAY;;gBAKX,MAAM,CAAC,EAAE,kBAAkB;IAIvC;;;;OAIG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;OAOG;IACH,IAAI,WAAW,IAAI,MAAM,CAIxB;IAED;;;;;OAKG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,kEAAkE;IAClE,gBAAgB,CAAC,KAAK,SAAI,GAAG,IAAI;IAIjC,4CAA4C;IAC5C,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIzC,oDAAoD;IACpD,YAAY,IAAI,IAAI;IAIpB;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAM5C;;;;OAIG;IACH,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAyC3E;;;OAGG;IACG,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IACnG,aAAa,CACjB,KAAK,EAAE,mBAAmB,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IA+DlC;;;;;;;OAOG;IACG,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAclG;;;;;OAKG;IACG,eAAe,CACnB,iBAAiB,EAAE,MAAM,EACzB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,sBAAsB,CAAC;CASnC"}
+{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/sandbox/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3D,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EAAE,EACf,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;KAAE,GACvE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,0EAA0E;IAC1E,sBAAsB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,8EAA8E;IAC9E,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,GAAG,cAAc,GAAG,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC;IAC9G,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAE1D,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAO/F;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,oBAAoB,KAAK,sBAAsB,CAAC;AAEpF,4EAA4E;AAC5E,qBAAa,kBAAmB,SAAQ,KAAK;IAE/B,QAAQ,CAAC,GAAG,EAAE,MAAM;IADhC,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBAC9B,GAAG,EAAE,MAAM;CAOjC;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mFAAmF;IACnF,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uFAAuF;IACvF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAyDD,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAKxF;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,YAAY;;gBAKX,MAAM,CAAC,EAAE,kBAAkB;IAIvC;;;;OAIG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;OAOG;IACH,IAAI,WAAW,IAAI,MAAM,CAIxB;IAED;;;;;OAKG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,kEAAkE;IAClE,gBAAgB,CAAC,KAAK,SAAI,GAAG,IAAI;IAIjC,4CAA4C;IAC5C,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIzC,oDAAoD;IACpD,YAAY,IAAI,IAAI;IAIpB;;;;;;;OAOG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAM5C;;;;OAIG;IACH,0BAA0B,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAyC3E;;;OAGG;IACG,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IACnG,aAAa,CACjB,KAAK,EAAE,mBAAmB,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,CAAC,EAAE,UAAU,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IA+DlC;;;;;;;OAOG;IACG,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAclG;;;;;OAKG;IACG,eAAe,CACnB,iBAAiB,EAAE,MAAM,EACzB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,sBAAsB,CAAC;CASnC"}

package/dist/sandbox/fleet.js

@@ -18,20 +18,27 @@ var SandboxBudgetError = class extends Error {
   max;
   code = "sandbox-budget-exceeded";
 };
-function toMaterializationSandbox(sandbox) {
+function toMaterializationSandbox(sandbox, initialEnvironment = {}) {
   if (typeof sandbox.executeCommand !== "function") {
     throw new Error(
       `Sandbox provider '${sandbox.provider}' does not implement executeCommand() \u2014 cannot materialize repos.`
     );
   }
   const lifecycle = sandbox;
+  const environment = { ...initialEnvironment };
   return {
     id: sandbox.id,
     start: async () => {
       await (lifecycle._start ?? sandbox.start)?.call(sandbox);
     },
     getInfo: async () => await sandbox.getInfo?.() ?? {},
-    executeCommand: (command, args, options) => sandbox.executeCommand(command, args, options),
+    executeCommand: (command, args, options) => sandbox.executeCommand(command, args, {
+      ...options,
+      env: { ...environment, ...options?.env }
+    }),
+    setEnvironmentVariable: (name, value) => {
+      environment[name] = value;
+    },
     stop: async () => {
       await (lifecycle._stop ?? sandbox.stop)?.call(sandbox);
     }
@@ -171,7 +178,7 @@ var SandboxFleet = class {
       ...opts.idleTimeoutMinutes !== void 0 ? { idleTimeoutMinutes: opts.idleTimeoutMinutes } : {},
       ...opts.checkpointName ? { checkpointName: opts.checkpointName } : {}
     });
-    return toMaterializationSandbox(clone);
+    return toMaterializationSandbox(clone, opts.env);
   }
   async ensureSandbox(store, envOrProgress, progressOrOptions, maybeOptions = {}) {
     const env = typeof envOrProgress === "function" ? void 0 : envOrProgress;

package/dist/sandbox/fleet.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/sandbox/fleet.ts"],"sourcesContent":["/**\n * Project sandbox fleet: provisioning, reattach, teardown, and budgeting.\n *\n * Server-hosted projects never run on the web host itself. Each project gets\n * its own isolated sandbox (a `WorkspaceSandbox`, e.g. a Railway VM) `clone()`d\n * from the machine the factory was configured with. This module owns everything\n * about that fleet — which provider is active, where checkouts live inside a\n * sandbox, the idle window, the per-replica budget, and the\n * provision/reattach/teardown lifecycle — but knows nothing about what runs\n * inside a sandbox (git materialization lives with its feature, e.g. the\n * GitHub integration's `sandbox.ts`).\n *\n * The fleet is constructed once at boot with the machine config (or none, when\n * sandboxes are disabled) and handed to consumers — no global registry.\n * Persistence of the provider's reattach id is delegated to the caller via\n * {@link SandboxBindingStore}, so the fleet stays storage-agnostic. Tests can\n * swap the low-level construction via {@link SandboxFleet.setFactory}.\n */\n\nimport path from 'node:path';\n\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\n\n/** Minimal command result shape sandbox consumers depend on. */\nexport interface SandboxCommandResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Minimal live-sandbox surface fleet consumers need: an id, a way to start it,\n * a way to learn the provider's reattach id, and command execution.\n */\nexport interface MaterializationSandbox {\n  readonly id: string;\n  start(): Promise<void>;\n  getInfo(): Promise<{ metadata?: Record<string, unknown> }>;\n  executeCommand(command: string, args?: string[], options?: { timeout?: number }): Promise<SandboxCommandResult>;\n  /** Tear down the underlying VM. Optional: providers without it are no-ops. */\n  stop?(): Promise<void>;\n}\n\n/** Options for building (or reattaching) one sandbox. */\nexport interface SandboxCreateOptions {\n  /** Reattach to this existing provider VM instead of provisioning a new one. */\n  providerSandboxId?: string;\n  /** Environment variables baked into the sandbox. */\n  env?: Record<string, string>;\n  /** Provider working directory for this sandbox. */\n  workingDirectory?: string;\n  /** Idle teardown window (minutes). The provider stops the VM after this idle period. */\n  idleTimeoutMinutes?: number;\n  /** Provider checkpoint used to seed and preserve this sandbox's filesystem. */\n  checkpointName?: string;\n}\n\n/**\n * A coarse-grained step of the sandbox-preparation flow, reported as it happens\n * so the UI can show the user what the server is doing instead of a static\n * \"Preparing…\" toast. `phase` is a stable machine token; `message` is\n * user-facing copy.\n */\nexport interface PrepareProgress {\n  phase: 'reattaching' | 'provisioning' | 'preparing-workspace' | 'cloning' | 'pulling' | 'finalizing' | 'done';\n  message: string;\n}\n\n/** Callback invoked with each preparation step. Best-effort; never throws. */\nexport type ProgressFn = (event: PrepareProgress) => void;\n\n/** Invoke a progress callback without letting it break the actual work. */\nexport function reportProgress(onProgress: ProgressFn | undefined, event: PrepareProgress): void {\n  if (!onProgress) return;\n  try {\n    onProgress(event);\n  } catch {\n    // Progress reporting must never break the actual work.\n  }\n}\n\n/**\n * Factory that builds a (not-yet-started) sandbox. When `providerSandboxId` is\n * provided the sandbox should reattach to that existing VM instead of\n * provisioning a new one.\n */\nexport type SandboxFactory = (opts: SandboxCreateOptions) => MaterializationSandbox;\n\n/** Raised when provisioning would exceed the per-replica sandbox budget. */\nexport class SandboxBudgetError extends Error {\n  readonly code = 'sandbox-budget-exceeded' as const;\n  constructor(readonly max: number) {\n    super(\n      `Sandbox budget exceeded: this server already has ${max} active sandbox(es), ` +\n        `the configured per-replica maximum. Close an existing repository's sandbox and try again.`,\n    );\n    this.name = 'SandboxBudgetError';\n  }\n}\n\n/** Optional knobs for provisioning/reattaching one sandbox. */\nexport interface EnsureSandboxOptions {\n  /** Provider working directory for this sandbox. */\n  workingDirectory?: string;\n}\n\n/**\n * Where a feature persists its sandbox binding. The fleet reads the stored\n * reattach id and writes updates through this seam so it stays agnostic of\n * the owning table (GitHub projects today, anything else tomorrow).\n */\nexport interface SandboxBindingStore {\n  /** Stored provider reattach id from a previous provisioning, if any. */\n  readonly sandboxId: string | null;\n  /** Provider checkpoint used to seed and preserve this sandbox's filesystem. */\n  readonly checkpointName?: string;\n  /** Persist a freshly provisioned provider id, or clear a stale one with `null`. */\n  setSandboxId(id: string | null): Promise<void>;\n  /** Clear all stored sandbox state (reattach id + materialization mark) on teardown. */\n  clear(): Promise<void>;\n}\n\n/**\n * Adapt a cloned `WorkspaceSandbox` to the minimal surface this module needs.\n * Lifecycle goes through the `_`-prefixed wrappers when present (they add\n * status tracking and concurrency safety on `MastraSandbox` subclasses),\n * falling back to the plain methods for interface-only implementations.\n */\nfunction toMaterializationSandbox(sandbox: WorkspaceSandbox): MaterializationSandbox {\n  if (typeof sandbox.executeCommand !== 'function') {\n    throw new Error(\n      `Sandbox provider '${sandbox.provider}' does not implement executeCommand() — cannot materialize repos.`,\n    );\n  }\n  const lifecycle = sandbox as { _start?(): Promise<void>; _stop?(): Promise<void> };\n  return {\n    id: sandbox.id,\n    start: async () => {\n      await (lifecycle._start ?? sandbox.start)?.call(sandbox);\n    },\n    getInfo: async () => (await sandbox.getInfo?.()) ?? {},\n    executeCommand: (command, args, options) => sandbox.executeCommand!(command, args, options),\n    stop: async () => {\n      await (lifecycle._stop ?? sandbox.stop)?.call(sandbox);\n    },\n  };\n}\n\n/**\n * The provider's reattach id for a started sandbox. For Railway this is the\n * underlying `railwaySandboxId` in `getInfo().metadata`. Providers without a\n * provider-native id (e.g. local) reattach by construction id, so fall back\n * to the sandbox's own logical id.\n */\nasync function readProviderSandboxId(sandbox: MaterializationSandbox): Promise<string | undefined> {\n  const info = await sandbox.getInfo();\n  const id = info.metadata?.railwaySandboxId ?? info.metadata?.sandboxId;\n  return typeof id === 'string' ? id : sandbox.id;\n}\n\n/** Keep each path piece a single safe segment (no separators or traversal). */\nfunction sanitizeSegment(segment: string): string {\n  const cleaned = segment.replace(/[^A-Za-z0-9._-]/g, '-').replace(/^\\.+/, '');\n  return cleaned || 'repo';\n}\n\n/** Resolve a workdir under `root`, refusing any path that escapes the configured root. */\nexport function resolveContainedLocalWorkdir(root: string, ...segments: string[]): string {\n  const resolvedRoot = path.resolve(root);\n  const resolved = path.resolve(resolvedRoot, ...segments);\n  if (resolved !== resolvedRoot && resolved.startsWith(`${resolvedRoot}${path.sep}`)) return resolved;\n  throw new Error(`Refusing to use local sandbox path outside configured root: ${resolved}`);\n}\n\n/**\n * Factory-resolved sandbox runtime the fleet is constructed with: the machine\n * projects clone their per-project sandboxes from, plus the knobs the factory\n * resolved around it.\n */\nexport interface SandboxFleetConfig {\n  /**\n   * Template machine (validated by the factory to implement `clone()`).\n   * Never started — acts purely as the credential/default holder that\n   * per-project sandboxes are cloned from.\n   */\n  machine: WorkspaceSandbox;\n  /** In-sandbox base directory repos check out under (no trailing slash). */\n  workdirBase: string;\n  /** Per-replica cap on concurrently provisioned sandboxes. 0 = unlimited. */\n  maxSandboxes?: number;\n}\n\n/**\n * The sandbox fleet for one deployment. Constructed once at boot — with a\n * config when a sandbox machine was configured, or without one when sandboxes\n * are disabled (every provisioning entry point then throws and\n * {@link enabled} reports `false` so features stay off).\n */\nexport class SandboxFleet {\n  readonly #config: SandboxFleetConfig | undefined;\n  #factory: SandboxFactory | undefined;\n  #liveCount = 0;\n\n  constructor(config?: SandboxFleetConfig) {\n    this.#config = config;\n  }\n\n  /**\n   * True when a sandbox machine was configured. The factory validates the\n   * machine implements `clone()` at boot, so a configured fleet is usable —\n   * sandbox-backed projects stay off only when the slot was omitted.\n   */\n  get enabled(): boolean {\n    return this.#config !== undefined;\n  }\n\n  /**\n   * Name of the active sandbox provider — the configured machine's `provider`\n   * discriminator (`'railway'`, `'local'`, …), or `'none'` when the fleet was\n   * constructed without a config. Diagnostic only; feature gating goes\n   * through {@link enabled}.\n   */\n  get provider(): string {\n    return this.#config?.machine.provider ?? 'none';\n  }\n\n  /**\n   * Idle teardown window for provisioned sandboxes, in minutes; defaults to 30.\n   * Read back from the machine's own config when it exposes one\n   * (Railway's `idleTimeoutMinutes`) — the knob lives on the sandbox, the\n   * fleet only needs it to schedule GC and stamp sandbox clones. Advisory:\n   * providers without idle GC ignore it, and a re-open detects a torn-down VM\n   * and re-provisions cleanly.\n   */\n  get idleMinutes(): number {\n    const machine = this.#config?.machine as { idleTimeoutMinutes?: unknown } | undefined;\n    const minutes = machine?.idleTimeoutMinutes;\n    return typeof minutes === 'number' && Number.isFinite(minutes) && minutes > 0 ? minutes : 30;\n  }\n\n  /**\n   * Per-replica cap on concurrently *provisioned* sandboxes. 0 means unlimited.\n   * This is a lightweight per-process budget to keep a single replica from\n   * exhausting provider quota — it is not a global, cross-replica scheduler\n   * (that is a deferred follow-up).\n   */\n  get maxSandboxes(): number {\n    return this.#config?.maxSandboxes ?? 0;\n  }\n\n  /**\n   * Count of sandboxes this fleet has freshly provisioned and not yet torn\n   * down. Reattaches to existing VMs do not count (they reuse an already-billed\n   * sandbox). Used to enforce {@link maxSandboxes}.\n   */\n  get liveCount(): number {\n    return this.#liveCount;\n  }\n\n  /** For tests: reset the live-sandbox counter to a known state. */\n  __resetLiveCount(value = 0): void {\n    this.#liveCount = value;\n  }\n\n  /** Override the sandbox factory (tests). */\n  setFactory(factory: SandboxFactory): void {\n    this.#factory = factory;\n  }\n\n  /** Reset to the default machine-cloning factory. */\n  resetFactory(): void {\n    this.#factory = undefined;\n  }\n\n  /**\n   * Compute the in-sandbox working directory for a repo: a nested\n   * `<base>/<owner>/<name>` layout under the factory-resolved checkout base.\n   * Nesting keeps same-name repos apart (`acme/api` vs `other/api`) — cloud\n   * sandboxes are one-per-project so it's merely tidy there, but local\n   * checkouts share one host root where it prevents collisions. Server-side\n   * only; never derived from client input.\n   */\n  computeWorkdir(repoFullName: string): string {\n    if (!this.#config) throw new Error('No sandbox configured');\n    const [owner, name] = repoFullName.split('/', 2);\n    return `${this.#config.workdirBase}/${sanitizeSegment(owner || 'unknown')}/${sanitizeSegment(name || 'repo')}`;\n  }\n\n  /**\n   * Compute the host working directory for a local GitHub session checkout.\n   * This is server-derived only: repo pieces are sanitized and the trusted\n   * session id is kept as a single path segment under the configured local root.\n   */\n  computeLocalSessionWorkdir(repoFullName: string, sessionId: string): string {\n    if (!this.#config) throw new Error('No sandbox configured');\n    if (this.#config.machine.provider !== 'local') {\n      throw new Error('Local session workdirs require the local sandbox provider');\n    }\n\n    const localRoot = (this.#config.machine as { workingDirectory?: unknown }).workingDirectory;\n    if (typeof localRoot !== 'string' || localRoot.length === 0) {\n      throw new Error('Local sandbox working directory is not configured');\n    }\n\n    const [owner, name] = repoFullName.split('/', 2);\n    return resolveContainedLocalWorkdir(\n      localRoot,\n      'github-sessions',\n      sanitizeSegment(owner || 'unknown'),\n      sanitizeSegment(name || 'repo'),\n      sanitizeSegment(sessionId),\n    );\n  }\n\n  /**\n   * Build a (not-yet-started) sandbox: the test-provided factory when set,\n   * otherwise a per-project clone of the configured machine. The stored id is\n   * passed both as the logical `id` (providers that reattach by construction\n   * id, e.g. local) and as the provider-native `sandboxId` hint (Railway) so\n   * reattach works across the provider matrix.\n   */\n  #build(opts: SandboxCreateOptions): MaterializationSandbox {\n    if (this.#factory) return this.#factory(opts);\n    if (!this.#config) throw new Error('No sandbox configured');\n    const clone = this.#config.machine.clone!({\n      ...(opts.providerSandboxId ? { id: opts.providerSandboxId, sandboxId: opts.providerSandboxId } : {}),\n      ...(opts.env ? { env: opts.env } : {}),\n      ...(opts.workingDirectory ? { workingDirectory: opts.workingDirectory } : {}),\n      ...(opts.idleTimeoutMinutes !== undefined ? { idleTimeoutMinutes: opts.idleTimeoutMinutes } : {}),\n      ...(opts.checkpointName ? { checkpointName: opts.checkpointName } : {}),\n    });\n    return toMaterializationSandbox(clone);\n  }\n\n  /**\n   * Provision a new sandbox (persisting its provider id on first open) or\n   * reattach to the stored one. Returns a started, live sandbox.\n   */\n  async ensureSandbox(store: SandboxBindingStore, onProgress?: ProgressFn): Promise<MaterializationSandbox>;\n  async ensureSandbox(\n    store: SandboxBindingStore,\n    env?: Record<string, string>,\n    onProgress?: ProgressFn,\n    options?: EnsureSandboxOptions,\n  ): Promise<MaterializationSandbox>;\n  async ensureSandbox(\n    store: SandboxBindingStore,\n    envOrProgress?: Record<string, string> | ProgressFn,\n    progressOrOptions?: ProgressFn | EnsureSandboxOptions,\n    maybeOptions: EnsureSandboxOptions = {},\n  ): Promise<MaterializationSandbox> {\n    const env = typeof envOrProgress === 'function' ? undefined : envOrProgress;\n    const onProgress =\n      typeof envOrProgress === 'function' ? envOrProgress : (progressOrOptions as ProgressFn | undefined);\n    const options =\n      typeof envOrProgress === 'function'\n        ? ((progressOrOptions as EnsureSandboxOptions | undefined) ?? {})\n        : maybeOptions;\n    const idleTimeoutMinutes = this.idleMinutes;\n    const checkpointName = store.checkpointName;\n\n    // Reattach path: if we have a stored sandbox id, try to reattach. The VM may\n    // have been torn down by the provider's idle GC (or otherwise died), in which\n    // case `start()` fails. Recover by clearing the stale id and provisioning a\n    // fresh sandbox so the next open succeeds instead of being permanently wedged.\n    if (store.sandboxId) {\n      reportProgress(onProgress, { phase: 'reattaching', message: 'Reconnecting to your sandbox…' });\n      const reattached = this.#build({\n        providerSandboxId: store.sandboxId,\n        idleTimeoutMinutes,\n        ...(checkpointName ? { checkpointName } : {}),\n        ...(env ? { env } : {}),\n        ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),\n      });\n      try {\n        await reattached.start();\n        return reattached;\n      } catch {\n        await store.setSandboxId(null);\n        // fall through to fresh provision below\n      }\n    }\n\n    // Fresh provision: enforce the per-replica budget before spending quota.\n    const max = this.maxSandboxes;\n    if (max > 0 && this.#liveCount >= max) {\n      throw new SandboxBudgetError(max);\n    }\n\n    reportProgress(onProgress, { phase: 'provisioning', message: 'Provisioning a new sandbox…' });\n    const sandbox = this.#build({\n      idleTimeoutMinutes,\n      ...(checkpointName ? { checkpointName } : {}),\n      ...(env ? { env } : {}),\n      ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),\n    });\n    await sandbox.start();\n    this.#liveCount += 1;\n\n    const providerSandboxId = await readProviderSandboxId(sandbox);\n    if (providerSandboxId) {\n      await store.setSandboxId(providerSandboxId);\n    }\n\n    return sandbox;\n  }\n\n  /**\n   * Tear down a sandbox binding: stop the live VM (best-effort) and clear the\n   * persisted state through the binding store so the next open re-provisions\n   * cleanly. Decrements the per-replica live-sandbox counter.\n   *\n   * @param store   the binding to tear down\n   * @param sandbox an already-reattached live sandbox to stop, when available\n   */\n  async teardownSandbox(store: SandboxBindingStore, sandbox?: MaterializationSandbox): Promise<void> {\n    if (sandbox?.stop) {\n      try {\n        await sandbox.stop();\n      } catch {\n        // Best-effort: the VM may already be gone (idle GC). Still clear the binding.\n      }\n    }\n    if (store.sandboxId) {\n      if (this.#liveCount > 0) this.#liveCount -= 1;\n      await store.clear();\n    }\n  }\n\n  /**\n   * Reattach to an already-provisioned sandbox by its provider id and start it.\n   * Used by the workspace seam when opening a project that was already\n   * materialized (sandbox id + workdir carried on controller state), so no DB\n   * round-trip is needed.\n   */\n  async reattachSandbox(\n    providerSandboxId: string,\n    options: EnsureSandboxOptions = {},\n  ): Promise<MaterializationSandbox> {\n    const sandbox = this.#build({\n      providerSandboxId,\n      idleTimeoutMinutes: this.idleMinutes,\n      ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),\n    });\n    await sandbox.start();\n    return sandbox;\n  }\n}\n"],"mappings":";AAmBA,OAAO,UAAU;AAqDV,SAAS,eAAe,YAAoC,OAA8B;AAC/F,MAAI,CAAC,WAAY;AACjB,MAAI;AACF,eAAW,KAAK;AAAA,EAClB,QAAQ;AAAA,EAER;AACF;AAUO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YAAqB,KAAa;AAChC;AAAA,MACE,oDAAoD,GAAG;AAAA,IAEzD;AAJmB;AAKnB,SAAK,OAAO;AAAA,EACd;AAAA,EANqB;AAAA,EADZ,OAAO;AAQlB;AA8BA,SAAS,yBAAyB,SAAmD;AACnF,MAAI,OAAO,QAAQ,mBAAmB,YAAY;AAChD,UAAM,IAAI;AAAA,MACR,qBAAqB,QAAQ,QAAQ;AAAA,IACvC;AAAA,EACF;AACA,QAAM,YAAY;AAClB,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,OAAO,YAAY;AACjB,aAAO,UAAU,UAAU,QAAQ,QAAQ,KAAK,OAAO;AAAA,IACzD;AAAA,IACA,SAAS,YAAa,MAAM,QAAQ,UAAU,KAAM,CAAC;AAAA,IACrD,gBAAgB,CAAC,SAAS,MAAM,YAAY,QAAQ,eAAgB,SAAS,MAAM,OAAO;AAAA,IAC1F,MAAM,YAAY;AAChB,aAAO,UAAU,SAAS,QAAQ,OAAO,KAAK,OAAO;AAAA,IACvD;AAAA,EACF;AACF;AAQA,eAAe,sBAAsB,SAA8D;AACjG,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,KAAK,KAAK,UAAU,oBAAoB,KAAK,UAAU;AAC7D,SAAO,OAAO,OAAO,WAAW,KAAK,QAAQ;AAC/C;AAGA,SAAS,gBAAgB,SAAyB;AAChD,QAAM,UAAU,QAAQ,QAAQ,oBAAoB,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E,SAAO,WAAW;AACpB;AAGO,SAAS,6BAA6B,SAAiB,UAA4B;AACxF,QAAM,eAAe,KAAK,QAAQ,IAAI;AACtC,QAAM,WAAW,KAAK,QAAQ,cAAc,GAAG,QAAQ;AACvD,MAAI,aAAa,gBAAgB,SAAS,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,EAAE,EAAG,QAAO;AAC3F,QAAM,IAAI,MAAM,+DAA+D,QAAQ,EAAE;AAC3F;AA0BO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACT;AAAA,EACA,aAAa;AAAA,EAEb,YAAY,QAA6B;AACvC,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,UAAmB;AACrB,WAAO,KAAK,YAAY;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,WAAmB;AACrB,WAAO,KAAK,SAAS,QAAQ,YAAY;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,IAAI,cAAsB;AACxB,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,SAAS;AACzB,WAAO,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,KAAK,UAAU,IAAI,UAAU;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,eAAuB;AACzB,WAAO,KAAK,SAAS,gBAAgB;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,YAAoB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,iBAAiB,QAAQ,GAAS;AAChC,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGA,WAAW,SAA+B;AACxC,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA,EAGA,eAAqB;AACnB,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,eAAe,cAA8B;AAC3C,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,uBAAuB;AAC1D,UAAM,CAAC,OAAO,IAAI,IAAI,aAAa,MAAM,KAAK,CAAC;AAC/C,WAAO,GAAG,KAAK,QAAQ,WAAW,IAAI,gBAAgB,SAAS,SAAS,CAAC,IAAI,gBAAgB,QAAQ,MAAM,CAAC;AAAA,EAC9G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAA2B,cAAsB,WAA2B;AAC1E,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,uBAAuB;AAC1D,QAAI,KAAK,QAAQ,QAAQ,aAAa,SAAS;AAC7C,YAAM,IAAI,MAAM,2DAA2D;AAAA,IAC7E;AAEA,UAAM,YAAa,KAAK,QAAQ,QAA2C;AAC3E,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAEA,UAAM,CAAC,OAAO,IAAI,IAAI,aAAa,MAAM,KAAK,CAAC;AAC/C,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,gBAAgB,SAAS,SAAS;AAAA,MAClC,gBAAgB,QAAQ,MAAM;AAAA,MAC9B,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,MAAoD;AACzD,QAAI,KAAK,SAAU,QAAO,KAAK,SAAS,IAAI;AAC5C,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,uBAAuB;AAC1D,UAAM,QAAQ,KAAK,QAAQ,QAAQ,MAAO;AAAA,MACxC,GAAI,KAAK,oBAAoB,EAAE,IAAI,KAAK,mBAAmB,WAAW,KAAK,kBAAkB,IAAI,CAAC;AAAA,MAClG,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;AAAA,MACpC,GAAI,KAAK,mBAAmB,EAAE,kBAAkB,KAAK,iBAAiB,IAAI,CAAC;AAAA,MAC3E,GAAI,KAAK,uBAAuB,SAAY,EAAE,oBAAoB,KAAK,mBAAmB,IAAI,CAAC;AAAA,MAC/F,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,yBAAyB,KAAK;AAAA,EACvC;AAAA,EAaA,MAAM,cACJ,OACA,eACA,mBACA,eAAqC,CAAC,GACL;AACjC,UAAM,MAAM,OAAO,kBAAkB,aAAa,SAAY;AAC9D,UAAM,aACJ,OAAO,kBAAkB,aAAa,gBAAiB;AACzD,UAAM,UACJ,OAAO,kBAAkB,aACnB,qBAA0D,CAAC,IAC7D;AACN,UAAM,qBAAqB,KAAK;AAChC,UAAM,iBAAiB,MAAM;AAM7B,QAAI,MAAM,WAAW;AACnB,qBAAe,YAAY,EAAE,OAAO,eAAe,SAAS,qCAAgC,CAAC;AAC7F,YAAM,aAAa,KAAK,OAAO;AAAA,QAC7B,mBAAmB,MAAM;AAAA,QACzB;AAAA,QACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,QAC3C,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,QACrB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,MACnF,CAAC;AACD,UAAI;AACF,cAAM,WAAW,MAAM;AACvB,eAAO;AAAA,MACT,QAAQ;AACN,cAAM,MAAM,aAAa,IAAI;AAAA,MAE/B;AAAA,IACF;AAGA,UAAM,MAAM,KAAK;AACjB,QAAI,MAAM,KAAK,KAAK,cAAc,KAAK;AACrC,YAAM,IAAI,mBAAmB,GAAG;AAAA,IAClC;AAEA,mBAAe,YAAY,EAAE,OAAO,gBAAgB,SAAS,mCAA8B,CAAC;AAC5F,UAAM,UAAU,KAAK,OAAO;AAAA,MAC1B;AAAA,MACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC3C,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,MACrB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,IACnF,CAAC;AACD,UAAM,QAAQ,MAAM;AACpB,SAAK,cAAc;AAEnB,UAAM,oBAAoB,MAAM,sBAAsB,OAAO;AAC7D,QAAI,mBAAmB;AACrB,YAAM,MAAM,aAAa,iBAAiB;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBAAgB,OAA4B,SAAiD;AACjG,QAAI,SAAS,MAAM;AACjB,UAAI;AACF,cAAM,QAAQ,KAAK;AAAA,MACrB,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,MAAM,WAAW;AACnB,UAAI,KAAK,aAAa,EAAG,MAAK,cAAc;AAC5C,YAAM,MAAM,MAAM;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,gBACJ,mBACA,UAAgC,CAAC,GACA;AACjC,UAAM,UAAU,KAAK,OAAO;AAAA,MAC1B;AAAA,MACA,oBAAoB,KAAK;AAAA,MACzB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,IACnF,CAAC;AACD,UAAM,QAAQ,MAAM;AACpB,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../src/sandbox/fleet.ts"],"sourcesContent":["/**\n * Project sandbox fleet: provisioning, reattach, teardown, and budgeting.\n *\n * Server-hosted projects never run on the web host itself. Each project gets\n * its own isolated sandbox (a `WorkspaceSandbox`, e.g. a Railway VM) `clone()`d\n * from the machine the factory was configured with. This module owns everything\n * about that fleet — which provider is active, where checkouts live inside a\n * sandbox, the idle window, the per-replica budget, and the\n * provision/reattach/teardown lifecycle — but knows nothing about what runs\n * inside a sandbox (git materialization lives with its feature, e.g. the\n * GitHub integration's `sandbox.ts`).\n *\n * The fleet is constructed once at boot with the machine config (or none, when\n * sandboxes are disabled) and handed to consumers — no global registry.\n * Persistence of the provider's reattach id is delegated to the caller via\n * {@link SandboxBindingStore}, so the fleet stays storage-agnostic. Tests can\n * swap the low-level construction via {@link SandboxFleet.setFactory}.\n */\n\nimport path from 'node:path';\n\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\n\n/** Minimal command result shape sandbox consumers depend on. */\nexport interface SandboxCommandResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Minimal live-sandbox surface fleet consumers need: an id, a way to start it,\n * a way to learn the provider's reattach id, and command execution.\n */\nexport interface MaterializationSandbox {\n  readonly id: string;\n  start(): Promise<void>;\n  getInfo(): Promise<{ metadata?: Record<string, unknown> }>;\n  executeCommand(\n    command: string,\n    args?: string[],\n    options?: { timeout?: number; env?: Record<string, string | undefined> },\n  ): Promise<SandboxCommandResult>;\n  /** Update an environment variable for future commands in this sandbox. */\n  setEnvironmentVariable?(name: string, value: string): void;\n  /** Tear down the underlying VM. Optional: providers without it are no-ops. */\n  stop?(): Promise<void>;\n}\n\n/** Options for building (or reattaching) one sandbox. */\nexport interface SandboxCreateOptions {\n  /** Reattach to this existing provider VM instead of provisioning a new one. */\n  providerSandboxId?: string;\n  /** Environment variables baked into the sandbox. */\n  env?: Record<string, string>;\n  /** Provider working directory for this sandbox. */\n  workingDirectory?: string;\n  /** Idle teardown window (minutes). The provider stops the VM after this idle period. */\n  idleTimeoutMinutes?: number;\n  /** Provider checkpoint used to seed and preserve this sandbox's filesystem. */\n  checkpointName?: string;\n}\n\n/**\n * A coarse-grained step of the sandbox-preparation flow, reported as it happens\n * so the UI can show the user what the server is doing instead of a static\n * \"Preparing…\" toast. `phase` is a stable machine token; `message` is\n * user-facing copy.\n */\nexport interface PrepareProgress {\n  phase: 'reattaching' | 'provisioning' | 'preparing-workspace' | 'cloning' | 'pulling' | 'finalizing' | 'done';\n  message: string;\n}\n\n/** Callback invoked with each preparation step. Best-effort; never throws. */\nexport type ProgressFn = (event: PrepareProgress) => void;\n\n/** Invoke a progress callback without letting it break the actual work. */\nexport function reportProgress(onProgress: ProgressFn | undefined, event: PrepareProgress): void {\n  if (!onProgress) return;\n  try {\n    onProgress(event);\n  } catch {\n    // Progress reporting must never break the actual work.\n  }\n}\n\n/**\n * Factory that builds a (not-yet-started) sandbox. When `providerSandboxId` is\n * provided the sandbox should reattach to that existing VM instead of\n * provisioning a new one.\n */\nexport type SandboxFactory = (opts: SandboxCreateOptions) => MaterializationSandbox;\n\n/** Raised when provisioning would exceed the per-replica sandbox budget. */\nexport class SandboxBudgetError extends Error {\n  readonly code = 'sandbox-budget-exceeded' as const;\n  constructor(readonly max: number) {\n    super(\n      `Sandbox budget exceeded: this server already has ${max} active sandbox(es), ` +\n        `the configured per-replica maximum. Close an existing repository's sandbox and try again.`,\n    );\n    this.name = 'SandboxBudgetError';\n  }\n}\n\n/** Optional knobs for provisioning/reattaching one sandbox. */\nexport interface EnsureSandboxOptions {\n  /** Provider working directory for this sandbox. */\n  workingDirectory?: string;\n}\n\n/**\n * Where a feature persists its sandbox binding. The fleet reads the stored\n * reattach id and writes updates through this seam so it stays agnostic of\n * the owning table (GitHub projects today, anything else tomorrow).\n */\nexport interface SandboxBindingStore {\n  /** Stored provider reattach id from a previous provisioning, if any. */\n  readonly sandboxId: string | null;\n  /** Provider checkpoint used to seed and preserve this sandbox's filesystem. */\n  readonly checkpointName?: string;\n  /** Persist a freshly provisioned provider id, or clear a stale one with `null`. */\n  setSandboxId(id: string | null): Promise<void>;\n  /** Clear all stored sandbox state (reattach id + materialization mark) on teardown. */\n  clear(): Promise<void>;\n}\n\n/**\n * Adapt a cloned `WorkspaceSandbox` to the minimal surface this module needs.\n * Lifecycle goes through the `_`-prefixed wrappers when present (they add\n * status tracking and concurrency safety on `MastraSandbox` subclasses),\n * falling back to the plain methods for interface-only implementations.\n */\nfunction toMaterializationSandbox(\n  sandbox: WorkspaceSandbox,\n  initialEnvironment: Record<string, string> = {},\n): MaterializationSandbox {\n  if (typeof sandbox.executeCommand !== 'function') {\n    throw new Error(\n      `Sandbox provider '${sandbox.provider}' does not implement executeCommand() — cannot materialize repos.`,\n    );\n  }\n  const lifecycle = sandbox as { _start?(): Promise<void>; _stop?(): Promise<void> };\n  const environment = { ...initialEnvironment };\n  return {\n    id: sandbox.id,\n    start: async () => {\n      await (lifecycle._start ?? sandbox.start)?.call(sandbox);\n    },\n    getInfo: async () => (await sandbox.getInfo?.()) ?? {},\n    executeCommand: (command, args, options) =>\n      sandbox.executeCommand!(command, args, {\n        ...options,\n        env: { ...environment, ...options?.env },\n      }),\n    setEnvironmentVariable: (name, value) => {\n      environment[name] = value;\n    },\n    stop: async () => {\n      await (lifecycle._stop ?? sandbox.stop)?.call(sandbox);\n    },\n  };\n}\n\n/**\n * The provider's reattach id for a started sandbox. For Railway this is the\n * underlying `railwaySandboxId` in `getInfo().metadata`. Providers without a\n * provider-native id (e.g. local) reattach by construction id, so fall back\n * to the sandbox's own logical id.\n */\nasync function readProviderSandboxId(sandbox: MaterializationSandbox): Promise<string | undefined> {\n  const info = await sandbox.getInfo();\n  const id = info.metadata?.railwaySandboxId ?? info.metadata?.sandboxId;\n  return typeof id === 'string' ? id : sandbox.id;\n}\n\n/** Keep each path piece a single safe segment (no separators or traversal). */\nfunction sanitizeSegment(segment: string): string {\n  const cleaned = segment.replace(/[^A-Za-z0-9._-]/g, '-').replace(/^\\.+/, '');\n  return cleaned || 'repo';\n}\n\n/** Resolve a workdir under `root`, refusing any path that escapes the configured root. */\nexport function resolveContainedLocalWorkdir(root: string, ...segments: string[]): string {\n  const resolvedRoot = path.resolve(root);\n  const resolved = path.resolve(resolvedRoot, ...segments);\n  if (resolved !== resolvedRoot && resolved.startsWith(`${resolvedRoot}${path.sep}`)) return resolved;\n  throw new Error(`Refusing to use local sandbox path outside configured root: ${resolved}`);\n}\n\n/**\n * Factory-resolved sandbox runtime the fleet is constructed with: the machine\n * projects clone their per-project sandboxes from, plus the knobs the factory\n * resolved around it.\n */\nexport interface SandboxFleetConfig {\n  /**\n   * Template machine (validated by the factory to implement `clone()`).\n   * Never started — acts purely as the credential/default holder that\n   * per-project sandboxes are cloned from.\n   */\n  machine: WorkspaceSandbox;\n  /** In-sandbox base directory repos check out under (no trailing slash). */\n  workdirBase: string;\n  /** Per-replica cap on concurrently provisioned sandboxes. 0 = unlimited. */\n  maxSandboxes?: number;\n}\n\n/**\n * The sandbox fleet for one deployment. Constructed once at boot — with a\n * config when a sandbox machine was configured, or without one when sandboxes\n * are disabled (every provisioning entry point then throws and\n * {@link enabled} reports `false` so features stay off).\n */\nexport class SandboxFleet {\n  readonly #config: SandboxFleetConfig | undefined;\n  #factory: SandboxFactory | undefined;\n  #liveCount = 0;\n\n  constructor(config?: SandboxFleetConfig) {\n    this.#config = config;\n  }\n\n  /**\n   * True when a sandbox machine was configured. The factory validates the\n   * machine implements `clone()` at boot, so a configured fleet is usable —\n   * sandbox-backed projects stay off only when the slot was omitted.\n   */\n  get enabled(): boolean {\n    return this.#config !== undefined;\n  }\n\n  /**\n   * Name of the active sandbox provider — the configured machine's `provider`\n   * discriminator (`'railway'`, `'local'`, …), or `'none'` when the fleet was\n   * constructed without a config. Diagnostic only; feature gating goes\n   * through {@link enabled}.\n   */\n  get provider(): string {\n    return this.#config?.machine.provider ?? 'none';\n  }\n\n  /**\n   * Idle teardown window for provisioned sandboxes, in minutes; defaults to 30.\n   * Read back from the machine's own config when it exposes one\n   * (Railway's `idleTimeoutMinutes`) — the knob lives on the sandbox, the\n   * fleet only needs it to schedule GC and stamp sandbox clones. Advisory:\n   * providers without idle GC ignore it, and a re-open detects a torn-down VM\n   * and re-provisions cleanly.\n   */\n  get idleMinutes(): number {\n    const machine = this.#config?.machine as { idleTimeoutMinutes?: unknown } | undefined;\n    const minutes = machine?.idleTimeoutMinutes;\n    return typeof minutes === 'number' && Number.isFinite(minutes) && minutes > 0 ? minutes : 30;\n  }\n\n  /**\n   * Per-replica cap on concurrently *provisioned* sandboxes. 0 means unlimited.\n   * This is a lightweight per-process budget to keep a single replica from\n   * exhausting provider quota — it is not a global, cross-replica scheduler\n   * (that is a deferred follow-up).\n   */\n  get maxSandboxes(): number {\n    return this.#config?.maxSandboxes ?? 0;\n  }\n\n  /**\n   * Count of sandboxes this fleet has freshly provisioned and not yet torn\n   * down. Reattaches to existing VMs do not count (they reuse an already-billed\n   * sandbox). Used to enforce {@link maxSandboxes}.\n   */\n  get liveCount(): number {\n    return this.#liveCount;\n  }\n\n  /** For tests: reset the live-sandbox counter to a known state. */\n  __resetLiveCount(value = 0): void {\n    this.#liveCount = value;\n  }\n\n  /** Override the sandbox factory (tests). */\n  setFactory(factory: SandboxFactory): void {\n    this.#factory = factory;\n  }\n\n  /** Reset to the default machine-cloning factory. */\n  resetFactory(): void {\n    this.#factory = undefined;\n  }\n\n  /**\n   * Compute the in-sandbox working directory for a repo: a nested\n   * `<base>/<owner>/<name>` layout under the factory-resolved checkout base.\n   * Nesting keeps same-name repos apart (`acme/api` vs `other/api`) — cloud\n   * sandboxes are one-per-project so it's merely tidy there, but local\n   * checkouts share one host root where it prevents collisions. Server-side\n   * only; never derived from client input.\n   */\n  computeWorkdir(repoFullName: string): string {\n    if (!this.#config) throw new Error('No sandbox configured');\n    const [owner, name] = repoFullName.split('/', 2);\n    return `${this.#config.workdirBase}/${sanitizeSegment(owner || 'unknown')}/${sanitizeSegment(name || 'repo')}`;\n  }\n\n  /**\n   * Compute the host working directory for a local GitHub session checkout.\n   * This is server-derived only: repo pieces are sanitized and the trusted\n   * session id is kept as a single path segment under the configured local root.\n   */\n  computeLocalSessionWorkdir(repoFullName: string, sessionId: string): string {\n    if (!this.#config) throw new Error('No sandbox configured');\n    if (this.#config.machine.provider !== 'local') {\n      throw new Error('Local session workdirs require the local sandbox provider');\n    }\n\n    const localRoot = (this.#config.machine as { workingDirectory?: unknown }).workingDirectory;\n    if (typeof localRoot !== 'string' || localRoot.length === 0) {\n      throw new Error('Local sandbox working directory is not configured');\n    }\n\n    const [owner, name] = repoFullName.split('/', 2);\n    return resolveContainedLocalWorkdir(\n      localRoot,\n      'github-sessions',\n      sanitizeSegment(owner || 'unknown'),\n      sanitizeSegment(name || 'repo'),\n      sanitizeSegment(sessionId),\n    );\n  }\n\n  /**\n   * Build a (not-yet-started) sandbox: the test-provided factory when set,\n   * otherwise a per-project clone of the configured machine. The stored id is\n   * passed both as the logical `id` (providers that reattach by construction\n   * id, e.g. local) and as the provider-native `sandboxId` hint (Railway) so\n   * reattach works across the provider matrix.\n   */\n  #build(opts: SandboxCreateOptions): MaterializationSandbox {\n    if (this.#factory) return this.#factory(opts);\n    if (!this.#config) throw new Error('No sandbox configured');\n    const clone = this.#config.machine.clone!({\n      ...(opts.providerSandboxId ? { id: opts.providerSandboxId, sandboxId: opts.providerSandboxId } : {}),\n      ...(opts.env ? { env: opts.env } : {}),\n      ...(opts.workingDirectory ? { workingDirectory: opts.workingDirectory } : {}),\n      ...(opts.idleTimeoutMinutes !== undefined ? { idleTimeoutMinutes: opts.idleTimeoutMinutes } : {}),\n      ...(opts.checkpointName ? { checkpointName: opts.checkpointName } : {}),\n    });\n    return toMaterializationSandbox(clone, opts.env);\n  }\n\n  /**\n   * Provision a new sandbox (persisting its provider id on first open) or\n   * reattach to the stored one. Returns a started, live sandbox.\n   */\n  async ensureSandbox(store: SandboxBindingStore, onProgress?: ProgressFn): Promise<MaterializationSandbox>;\n  async ensureSandbox(\n    store: SandboxBindingStore,\n    env?: Record<string, string>,\n    onProgress?: ProgressFn,\n    options?: EnsureSandboxOptions,\n  ): Promise<MaterializationSandbox>;\n  async ensureSandbox(\n    store: SandboxBindingStore,\n    envOrProgress?: Record<string, string> | ProgressFn,\n    progressOrOptions?: ProgressFn | EnsureSandboxOptions,\n    maybeOptions: EnsureSandboxOptions = {},\n  ): Promise<MaterializationSandbox> {\n    const env = typeof envOrProgress === 'function' ? undefined : envOrProgress;\n    const onProgress =\n      typeof envOrProgress === 'function' ? envOrProgress : (progressOrOptions as ProgressFn | undefined);\n    const options =\n      typeof envOrProgress === 'function'\n        ? ((progressOrOptions as EnsureSandboxOptions | undefined) ?? {})\n        : maybeOptions;\n    const idleTimeoutMinutes = this.idleMinutes;\n    const checkpointName = store.checkpointName;\n\n    // Reattach path: if we have a stored sandbox id, try to reattach. The VM may\n    // have been torn down by the provider's idle GC (or otherwise died), in which\n    // case `start()` fails. Recover by clearing the stale id and provisioning a\n    // fresh sandbox so the next open succeeds instead of being permanently wedged.\n    if (store.sandboxId) {\n      reportProgress(onProgress, { phase: 'reattaching', message: 'Reconnecting to your sandbox…' });\n      const reattached = this.#build({\n        providerSandboxId: store.sandboxId,\n        idleTimeoutMinutes,\n        ...(checkpointName ? { checkpointName } : {}),\n        ...(env ? { env } : {}),\n        ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),\n      });\n      try {\n        await reattached.start();\n        return reattached;\n      } catch {\n        await store.setSandboxId(null);\n        // fall through to fresh provision below\n      }\n    }\n\n    // Fresh provision: enforce the per-replica budget before spending quota.\n    const max = this.maxSandboxes;\n    if (max > 0 && this.#liveCount >= max) {\n      throw new SandboxBudgetError(max);\n    }\n\n    reportProgress(onProgress, { phase: 'provisioning', message: 'Provisioning a new sandbox…' });\n    const sandbox = this.#build({\n      idleTimeoutMinutes,\n      ...(checkpointName ? { checkpointName } : {}),\n      ...(env ? { env } : {}),\n      ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),\n    });\n    await sandbox.start();\n    this.#liveCount += 1;\n\n    const providerSandboxId = await readProviderSandboxId(sandbox);\n    if (providerSandboxId) {\n      await store.setSandboxId(providerSandboxId);\n    }\n\n    return sandbox;\n  }\n\n  /**\n   * Tear down a sandbox binding: stop the live VM (best-effort) and clear the\n   * persisted state through the binding store so the next open re-provisions\n   * cleanly. Decrements the per-replica live-sandbox counter.\n   *\n   * @param store   the binding to tear down\n   * @param sandbox an already-reattached live sandbox to stop, when available\n   */\n  async teardownSandbox(store: SandboxBindingStore, sandbox?: MaterializationSandbox): Promise<void> {\n    if (sandbox?.stop) {\n      try {\n        await sandbox.stop();\n      } catch {\n        // Best-effort: the VM may already be gone (idle GC). Still clear the binding.\n      }\n    }\n    if (store.sandboxId) {\n      if (this.#liveCount > 0) this.#liveCount -= 1;\n      await store.clear();\n    }\n  }\n\n  /**\n   * Reattach to an already-provisioned sandbox by its provider id and start it.\n   * Used by the workspace seam when opening a project that was already\n   * materialized (sandbox id + workdir carried on controller state), so no DB\n   * round-trip is needed.\n   */\n  async reattachSandbox(\n    providerSandboxId: string,\n    options: EnsureSandboxOptions = {},\n  ): Promise<MaterializationSandbox> {\n    const sandbox = this.#build({\n      providerSandboxId,\n      idleTimeoutMinutes: this.idleMinutes,\n      ...(options.workingDirectory ? { workingDirectory: options.workingDirectory } : {}),\n    });\n    await sandbox.start();\n    return sandbox;\n  }\n}\n"],"mappings":";AAmBA,OAAO,UAAU;AA2DV,SAAS,eAAe,YAAoC,OAA8B;AAC/F,MAAI,CAAC,WAAY;AACjB,MAAI;AACF,eAAW,KAAK;AAAA,EAClB,QAAQ;AAAA,EAER;AACF;AAUO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YAAqB,KAAa;AAChC;AAAA,MACE,oDAAoD,GAAG;AAAA,IAEzD;AAJmB;AAKnB,SAAK,OAAO;AAAA,EACd;AAAA,EANqB;AAAA,EADZ,OAAO;AAQlB;AA8BA,SAAS,yBACP,SACA,qBAA6C,CAAC,GACtB;AACxB,MAAI,OAAO,QAAQ,mBAAmB,YAAY;AAChD,UAAM,IAAI;AAAA,MACR,qBAAqB,QAAQ,QAAQ;AAAA,IACvC;AAAA,EACF;AACA,QAAM,YAAY;AAClB,QAAM,cAAc,EAAE,GAAG,mBAAmB;AAC5C,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,OAAO,YAAY;AACjB,aAAO,UAAU,UAAU,QAAQ,QAAQ,KAAK,OAAO;AAAA,IACzD;AAAA,IACA,SAAS,YAAa,MAAM,QAAQ,UAAU,KAAM,CAAC;AAAA,IACrD,gBAAgB,CAAC,SAAS,MAAM,YAC9B,QAAQ,eAAgB,SAAS,MAAM;AAAA,MACrC,GAAG;AAAA,MACH,KAAK,EAAE,GAAG,aAAa,GAAG,SAAS,IAAI;AAAA,IACzC,CAAC;AAAA,IACH,wBAAwB,CAAC,MAAM,UAAU;AACvC,kBAAY,IAAI,IAAI;AAAA,IACtB;AAAA,IACA,MAAM,YAAY;AAChB,aAAO,UAAU,SAAS,QAAQ,OAAO,KAAK,OAAO;AAAA,IACvD;AAAA,EACF;AACF;AAQA,eAAe,sBAAsB,SAA8D;AACjG,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,KAAK,KAAK,UAAU,oBAAoB,KAAK,UAAU;AAC7D,SAAO,OAAO,OAAO,WAAW,KAAK,QAAQ;AAC/C;AAGA,SAAS,gBAAgB,SAAyB;AAChD,QAAM,UAAU,QAAQ,QAAQ,oBAAoB,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAC3E,SAAO,WAAW;AACpB;AAGO,SAAS,6BAA6B,SAAiB,UAA4B;AACxF,QAAM,eAAe,KAAK,QAAQ,IAAI;AACtC,QAAM,WAAW,KAAK,QAAQ,cAAc,GAAG,QAAQ;AACvD,MAAI,aAAa,gBAAgB,SAAS,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,EAAE,EAAG,QAAO;AAC3F,QAAM,IAAI,MAAM,+DAA+D,QAAQ,EAAE;AAC3F;AA0BO,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACT;AAAA,EACA,aAAa;AAAA,EAEb,YAAY,QAA6B;AACvC,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,UAAmB;AACrB,WAAO,KAAK,YAAY;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,WAAmB;AACrB,WAAO,KAAK,SAAS,QAAQ,YAAY;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,IAAI,cAAsB;AACxB,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,SAAS;AACzB,WAAO,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,KAAK,UAAU,IAAI,UAAU;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,eAAuB;AACzB,WAAO,KAAK,SAAS,gBAAgB;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,YAAoB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,iBAAiB,QAAQ,GAAS;AAChC,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGA,WAAW,SAA+B;AACxC,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA,EAGA,eAAqB;AACnB,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,eAAe,cAA8B;AAC3C,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,uBAAuB;AAC1D,UAAM,CAAC,OAAO,IAAI,IAAI,aAAa,MAAM,KAAK,CAAC;AAC/C,WAAO,GAAG,KAAK,QAAQ,WAAW,IAAI,gBAAgB,SAAS,SAAS,CAAC,IAAI,gBAAgB,QAAQ,MAAM,CAAC;AAAA,EAC9G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAA2B,cAAsB,WAA2B;AAC1E,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,uBAAuB;AAC1D,QAAI,KAAK,QAAQ,QAAQ,aAAa,SAAS;AAC7C,YAAM,IAAI,MAAM,2DAA2D;AAAA,IAC7E;AAEA,UAAM,YAAa,KAAK,QAAQ,QAA2C;AAC3E,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAEA,UAAM,CAAC,OAAO,IAAI,IAAI,aAAa,MAAM,KAAK,CAAC;AAC/C,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,gBAAgB,SAAS,SAAS;AAAA,MAClC,gBAAgB,QAAQ,MAAM;AAAA,MAC9B,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,MAAoD;AACzD,QAAI,KAAK,SAAU,QAAO,KAAK,SAAS,IAAI;AAC5C,QAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,uBAAuB;AAC1D,UAAM,QAAQ,KAAK,QAAQ,QAAQ,MAAO;AAAA,MACxC,GAAI,KAAK,oBAAoB,EAAE,IAAI,KAAK,mBAAmB,WAAW,KAAK,kBAAkB,IAAI,CAAC;AAAA,MAClG,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;AAAA,MACpC,GAAI,KAAK,mBAAmB,EAAE,kBAAkB,KAAK,iBAAiB,IAAI,CAAC;AAAA,MAC3E,GAAI,KAAK,uBAAuB,SAAY,EAAE,oBAAoB,KAAK,mBAAmB,IAAI,CAAC;AAAA,MAC/F,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,yBAAyB,OAAO,KAAK,GAAG;AAAA,EACjD;AAAA,EAaA,MAAM,cACJ,OACA,eACA,mBACA,eAAqC,CAAC,GACL;AACjC,UAAM,MAAM,OAAO,kBAAkB,aAAa,SAAY;AAC9D,UAAM,aACJ,OAAO,kBAAkB,aAAa,gBAAiB;AACzD,UAAM,UACJ,OAAO,kBAAkB,aACnB,qBAA0D,CAAC,IAC7D;AACN,UAAM,qBAAqB,KAAK;AAChC,UAAM,iBAAiB,MAAM;AAM7B,QAAI,MAAM,WAAW;AACnB,qBAAe,YAAY,EAAE,OAAO,eAAe,SAAS,qCAAgC,CAAC;AAC7F,YAAM,aAAa,KAAK,OAAO;AAAA,QAC7B,mBAAmB,MAAM;AAAA,QACzB;AAAA,QACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,QAC3C,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,QACrB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,MACnF,CAAC;AACD,UAAI;AACF,cAAM,WAAW,MAAM;AACvB,eAAO;AAAA,MACT,QAAQ;AACN,cAAM,MAAM,aAAa,IAAI;AAAA,MAE/B;AAAA,IACF;AAGA,UAAM,MAAM,KAAK;AACjB,QAAI,MAAM,KAAK,KAAK,cAAc,KAAK;AACrC,YAAM,IAAI,mBAAmB,GAAG;AAAA,IAClC;AAEA,mBAAe,YAAY,EAAE,OAAO,gBAAgB,SAAS,mCAA8B,CAAC;AAC5F,UAAM,UAAU,KAAK,OAAO;AAAA,MAC1B;AAAA,MACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC3C,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,MACrB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,IACnF,CAAC;AACD,UAAM,QAAQ,MAAM;AACpB,SAAK,cAAc;AAEnB,UAAM,oBAAoB,MAAM,sBAAsB,OAAO;AAC7D,QAAI,mBAAmB;AACrB,YAAM,MAAM,aAAa,iBAAiB;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBAAgB,OAA4B,SAAiD;AACjG,QAAI,SAAS,MAAM;AACjB,UAAI;AACF,cAAM,QAAQ,KAAK;AAAA,MACrB,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,MAAM,WAAW;AACnB,UAAI,KAAK,aAAa,EAAG,MAAK,cAAc;AAC5C,YAAM,MAAM,MAAM;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,gBACJ,mBACA,UAAgC,CAAC,GACA;AACjC,UAAM,UAAU,KAAK,OAAO;AAAA,MAC1B;AAAA,MACA,oBAAoB,KAAK;AAAA,MACzB,GAAI,QAAQ,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;AAAA,IACnF,CAAC;AACD,UAAM,QAAQ,MAAM;AACpB,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/spa-static.d.ts

@@ -14,11 +14,10 @@ import type { Context } from 'hono';
 /**
  * Locate the built SPA (a dir containing `index.html`). Checked in order:
  *   1. `MASTRACODE_UI_DIST` — explicit override for custom layouts.
- *   2. `ui/` next to the bundled server module — vite builds into
- *      `src/mastra/public/ui` and `mastra build` copies `public/` into
- *      `.mastra/output/`, so the build output is self-contained.
- *   3. `src/mastra/public/ui` under cwd — the vite outDir when running from
- *      the package root before `mastra build`.
+ *   2. `factory/` under cwd — both `mastra dev` (cwd is the Mastra public dir)
+ *      and `mastra start` (cwd is `.mastra/output`) expose assets this way.
+ *   3. `factory/` next to the bundled server module.
+ *   4. Source-layout fallbacks under `MASTRA_PROJECT_ROOT` or cwd.
  * Returns `undefined` when no build is found (e.g. plain `mastra dev` without
  * a prior vite build), in which case the middleware is simply not mounted.
  */

package/dist/spa-static.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spa-static.d.ts","sourceRoot":"","sources":["../src/spa-static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA0BpC;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAUrD;AAmBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,IACxC,GAAG,OAAO,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuB/E"}
+{"version":3,"file":"spa-static.d.ts","sourceRoot":"","sources":["../src/spa-static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AA0BpC;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAarD;AAmBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,IACxC,GAAG,OAAO,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuB/E"}

package/dist/spa-static.js

@@ -25,10 +25,13 @@ var MIME = {
 };
 var SERVER_PREFIXES = ["/api", "/web", "/auth"];
 function resolveUiDistDir() {
+  const projectRoot = process.env.MASTRA_PROJECT_ROOT?.trim();
   const candidates = [
     process.env.MASTRACODE_UI_DIST,
-    join(dirname(fileURLToPath(import.meta.url)), "ui"),
-    resolve(process.cwd(), "src/mastra/public/ui")
+    resolve(process.cwd(), "factory"),
+    join(dirname(fileURLToPath(import.meta.url)), "factory"),
+    projectRoot && resolve(projectRoot, "src/mastra/public/factory"),
+    resolve(process.cwd(), "src/mastra/public/factory")
   ];
   for (const candidate of candidates) {
     if (candidate && existsSync(join(candidate, "index.html"))) return resolve(candidate);

package/dist/spa-static.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/spa-static.ts"],"sourcesContent":["/**\n * Same-origin SPA serving for production.\n *\n * In dev the SPA is served by Vite (:5173) which proxies API paths to the\n * server (:4111) — this module is effectively idle there. In production the\n * built SPA (vite output) is served by the API server itself at `/`, so the\n * app is a single origin and no CORS / separate static host is required.\n *\n * The middleware is mounted via the Mastra entry's `server.middleware`, which\n * the deployer applies before routes: real file hits and SPA navigations are\n * answered here, everything else falls through to the API routes.\n */\n\nimport { existsSync } from 'node:fs';\nimport { readFile, stat } from 'node:fs/promises';\nimport { dirname, extname, join, normalize, resolve, sep } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nimport type { Context } from 'hono';\n\nconst MIME: Record<string, string> = {\n  '.html': 'text/html; charset=utf-8',\n  '.js': 'text/javascript; charset=utf-8',\n  '.mjs': 'text/javascript; charset=utf-8',\n  '.css': 'text/css; charset=utf-8',\n  '.json': 'application/json',\n  '.map': 'application/json',\n  '.svg': 'image/svg+xml',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.webp': 'image/webp',\n  '.ico': 'image/x-icon',\n  '.txt': 'text/plain; charset=utf-8',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.wasm': 'application/wasm',\n};\n\n/** Server-owned path prefixes the SPA middleware must never answer for. */\nconst SERVER_PREFIXES = ['/api', '/web', '/auth'];\n\n/**\n * Locate the built SPA (a dir containing `index.html`). Checked in order:\n *   1. `MASTRACODE_UI_DIST` — explicit override for custom layouts.\n *   2. `ui/` next to the bundled server module — vite builds into\n *      `src/mastra/public/ui` and `mastra build` copies `public/` into\n *      `.mastra/output/`, so the build output is self-contained.\n *   3. `src/mastra/public/ui` under cwd — the vite outDir when running from\n *      the package root before `mastra build`.\n * Returns `undefined` when no build is found (e.g. plain `mastra dev` without\n * a prior vite build), in which case the middleware is simply not mounted.\n */\nexport function resolveUiDistDir(): string | undefined {\n  const candidates = [\n    process.env.MASTRACODE_UI_DIST,\n    join(dirname(fileURLToPath(import.meta.url)), 'ui'),\n    resolve(process.cwd(), 'src/mastra/public/ui'),\n  ];\n  for (const candidate of candidates) {\n    if (candidate && existsSync(join(candidate, 'index.html'))) return resolve(candidate);\n  }\n  return undefined;\n}\n\nasync function isFile(path: string): Promise<boolean> {\n  try {\n    return (await stat(path)).isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function serveFile(c: Context, filePath: string, immutable: boolean): Promise<Response> {\n  const data = await readFile(filePath);\n  c.header('Content-Type', MIME[extname(filePath).toLowerCase()] ?? 'application/octet-stream');\n  // Vite emits content-hashed filenames under assets/ — cache those forever;\n  // index.html (and anything unhashed) must revalidate so deploys roll out.\n  c.header('Cache-Control', immutable ? 'public, max-age=31536000, immutable' : 'no-cache');\n  return c.body(new Uint8Array(data));\n}\n\n/**\n * Hono middleware serving the built SPA from `uiDist`:\n *   - exact file hits (js/css/assets) are served directly,\n *   - GET navigations to non-server paths fall back to `index.html` (SPA\n *     client-side routing),\n *   - `/api`, `/web`, `/auth` and non-GET requests always pass through.\n */\nexport function createSpaStaticMiddleware(uiDist: string) {\n  return async (c: Context, next: () => Promise<void>): Promise<Response | void> => {\n    if (c.req.method !== 'GET' && c.req.method !== 'HEAD') return next();\n    const path = c.req.path;\n    if (SERVER_PREFIXES.some(prefix => path === prefix || path.startsWith(`${prefix}/`))) return next();\n\n    // Resolve the request path inside uiDist, rejecting traversal escapes.\n    const relative = normalize(decodeURIComponent(path)).replace(/^[/\\\\]+/, '');\n    const filePath = resolve(uiDist, relative);\n    // Use a trailing separator so a sibling like \"ui.key\" can't slip past the\n    // prefix check (same pattern as fs-routes.ts isWithinRoot).\n    const uiDistPrefix = uiDist.endsWith(sep) ? uiDist : uiDist + sep;\n    if (filePath.startsWith(uiDistPrefix) && relative !== '' && (await isFile(filePath))) {\n      return serveFile(c, filePath, relative.startsWith('assets/'));\n    }\n\n    // SPA fallback: serve index.html for root and html navigations.\n    const accept = c.req.header('Accept') ?? '';\n    if (path === '/' || accept.includes('text/html')) {\n      return serveFile(c, join(uiDist, 'index.html'), false);\n    }\n\n    return next();\n  };\n}\n"],"mappings":";AAaA,SAAS,kBAAkB;AAC3B,SAAS,UAAU,YAAY;AAC/B,SAAS,SAAS,SAAS,MAAM,WAAW,SAAS,WAAW;AAChE,SAAS,qBAAqB;AAI9B,IAAM,OAA+B;AAAA,EACnC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AACX;AAGA,IAAM,kBAAkB,CAAC,QAAQ,QAAQ,OAAO;AAazC,SAAS,mBAAuC;AACrD,QAAM,aAAa;AAAA,IACjB,QAAQ,IAAI;AAAA,IACZ,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI;AAAA,IAClD,QAAQ,QAAQ,IAAI,GAAG,sBAAsB;AAAA,EAC/C;AACA,aAAW,aAAa,YAAY;AAClC,QAAI,aAAa,WAAW,KAAK,WAAW,YAAY,CAAC,EAAG,QAAO,QAAQ,SAAS;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,YAAQ,MAAM,KAAK,IAAI,GAAG,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,UAAU,GAAY,UAAkB,WAAuC;AAC5F,QAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,IAAE,OAAO,gBAAgB,KAAK,QAAQ,QAAQ,EAAE,YAAY,CAAC,KAAK,0BAA0B;AAG5F,IAAE,OAAO,iBAAiB,YAAY,wCAAwC,UAAU;AACxF,SAAO,EAAE,KAAK,IAAI,WAAW,IAAI,CAAC;AACpC;AASO,SAAS,0BAA0B,QAAgB;AACxD,SAAO,OAAO,GAAY,SAAwD;AAChF,QAAI,EAAE,IAAI,WAAW,SAAS,EAAE,IAAI,WAAW,OAAQ,QAAO,KAAK;AACnE,UAAM,OAAO,EAAE,IAAI;AACnB,QAAI,gBAAgB,KAAK,YAAU,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC,EAAG,QAAO,KAAK;AAGlG,UAAM,WAAW,UAAU,mBAAmB,IAAI,CAAC,EAAE,QAAQ,WAAW,EAAE;AAC1E,UAAM,WAAW,QAAQ,QAAQ,QAAQ;AAGzC,UAAM,eAAe,OAAO,SAAS,GAAG,IAAI,SAAS,SAAS;AAC9D,QAAI,SAAS,WAAW,YAAY,KAAK,aAAa,MAAO,MAAM,OAAO,QAAQ,GAAI;AACpF,aAAO,UAAU,GAAG,UAAU,SAAS,WAAW,SAAS,CAAC;AAAA,IAC9D;AAGA,UAAM,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK;AACzC,QAAI,SAAS,OAAO,OAAO,SAAS,WAAW,GAAG;AAChD,aAAO,UAAU,GAAG,KAAK,QAAQ,YAAY,GAAG,KAAK;AAAA,IACvD;AAEA,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}
+{"version":3,"sources":["../src/spa-static.ts"],"sourcesContent":["/**\n * Same-origin SPA serving for production.\n *\n * In dev the SPA is served by Vite (:5173) which proxies API paths to the\n * server (:4111) — this module is effectively idle there. In production the\n * built SPA (vite output) is served by the API server itself at `/`, so the\n * app is a single origin and no CORS / separate static host is required.\n *\n * The middleware is mounted via the Mastra entry's `server.middleware`, which\n * the deployer applies before routes: real file hits and SPA navigations are\n * answered here, everything else falls through to the API routes.\n */\n\nimport { existsSync } from 'node:fs';\nimport { readFile, stat } from 'node:fs/promises';\nimport { dirname, extname, join, normalize, resolve, sep } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nimport type { Context } from 'hono';\n\nconst MIME: Record<string, string> = {\n  '.html': 'text/html; charset=utf-8',\n  '.js': 'text/javascript; charset=utf-8',\n  '.mjs': 'text/javascript; charset=utf-8',\n  '.css': 'text/css; charset=utf-8',\n  '.json': 'application/json',\n  '.map': 'application/json',\n  '.svg': 'image/svg+xml',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.webp': 'image/webp',\n  '.ico': 'image/x-icon',\n  '.txt': 'text/plain; charset=utf-8',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.wasm': 'application/wasm',\n};\n\n/** Server-owned path prefixes the SPA middleware must never answer for. */\nconst SERVER_PREFIXES = ['/api', '/web', '/auth'];\n\n/**\n * Locate the built SPA (a dir containing `index.html`). Checked in order:\n *   1. `MASTRACODE_UI_DIST` — explicit override for custom layouts.\n *   2. `factory/` under cwd — both `mastra dev` (cwd is the Mastra public dir)\n *      and `mastra start` (cwd is `.mastra/output`) expose assets this way.\n *   3. `factory/` next to the bundled server module.\n *   4. Source-layout fallbacks under `MASTRA_PROJECT_ROOT` or cwd.\n * Returns `undefined` when no build is found (e.g. plain `mastra dev` without\n * a prior vite build), in which case the middleware is simply not mounted.\n */\nexport function resolveUiDistDir(): string | undefined {\n  const projectRoot = process.env.MASTRA_PROJECT_ROOT?.trim();\n  const candidates = [\n    process.env.MASTRACODE_UI_DIST,\n    resolve(process.cwd(), 'factory'),\n    join(dirname(fileURLToPath(import.meta.url)), 'factory'),\n    projectRoot && resolve(projectRoot, 'src/mastra/public/factory'),\n    resolve(process.cwd(), 'src/mastra/public/factory'),\n  ];\n  for (const candidate of candidates) {\n    if (candidate && existsSync(join(candidate, 'index.html'))) return resolve(candidate);\n  }\n  return undefined;\n}\n\nasync function isFile(path: string): Promise<boolean> {\n  try {\n    return (await stat(path)).isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function serveFile(c: Context, filePath: string, immutable: boolean): Promise<Response> {\n  const data = await readFile(filePath);\n  c.header('Content-Type', MIME[extname(filePath).toLowerCase()] ?? 'application/octet-stream');\n  // Vite emits content-hashed filenames under assets/ — cache those forever;\n  // index.html (and anything unhashed) must revalidate so deploys roll out.\n  c.header('Cache-Control', immutable ? 'public, max-age=31536000, immutable' : 'no-cache');\n  return c.body(new Uint8Array(data));\n}\n\n/**\n * Hono middleware serving the built SPA from `uiDist`:\n *   - exact file hits (js/css/assets) are served directly,\n *   - GET navigations to non-server paths fall back to `index.html` (SPA\n *     client-side routing),\n *   - `/api`, `/web`, `/auth` and non-GET requests always pass through.\n */\nexport function createSpaStaticMiddleware(uiDist: string) {\n  return async (c: Context, next: () => Promise<void>): Promise<Response | void> => {\n    if (c.req.method !== 'GET' && c.req.method !== 'HEAD') return next();\n    const path = c.req.path;\n    if (SERVER_PREFIXES.some(prefix => path === prefix || path.startsWith(`${prefix}/`))) return next();\n\n    // Resolve the request path inside uiDist, rejecting traversal escapes.\n    const relative = normalize(decodeURIComponent(path)).replace(/^[/\\\\]+/, '');\n    const filePath = resolve(uiDist, relative);\n    // Use a trailing separator so a sibling like \"ui.key\" can't slip past the\n    // prefix check (same pattern as fs-routes.ts isWithinRoot).\n    const uiDistPrefix = uiDist.endsWith(sep) ? uiDist : uiDist + sep;\n    if (filePath.startsWith(uiDistPrefix) && relative !== '' && (await isFile(filePath))) {\n      return serveFile(c, filePath, relative.startsWith('assets/'));\n    }\n\n    // SPA fallback: serve index.html for root and html navigations.\n    const accept = c.req.header('Accept') ?? '';\n    if (path === '/' || accept.includes('text/html')) {\n      return serveFile(c, join(uiDist, 'index.html'), false);\n    }\n\n    return next();\n  };\n}\n"],"mappings":";AAaA,SAAS,kBAAkB;AAC3B,SAAS,UAAU,YAAY;AAC/B,SAAS,SAAS,SAAS,MAAM,WAAW,SAAS,WAAW;AAChE,SAAS,qBAAqB;AAI9B,IAAM,OAA+B;AAAA,EACnC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,SAAS;AACX;AAGA,IAAM,kBAAkB,CAAC,QAAQ,QAAQ,OAAO;AAYzC,SAAS,mBAAuC;AACrD,QAAM,cAAc,QAAQ,IAAI,qBAAqB,KAAK;AAC1D,QAAM,aAAa;AAAA,IACjB,QAAQ,IAAI;AAAA,IACZ,QAAQ,QAAQ,IAAI,GAAG,SAAS;AAAA,IAChC,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,SAAS;AAAA,IACvD,eAAe,QAAQ,aAAa,2BAA2B;AAAA,IAC/D,QAAQ,QAAQ,IAAI,GAAG,2BAA2B;AAAA,EACpD;AACA,aAAW,aAAa,YAAY;AAClC,QAAI,aAAa,WAAW,KAAK,WAAW,YAAY,CAAC,EAAG,QAAO,QAAQ,SAAS;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAe,OAAO,MAAgC;AACpD,MAAI;AACF,YAAQ,MAAM,KAAK,IAAI,GAAG,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,UAAU,GAAY,UAAkB,WAAuC;AAC5F,QAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,IAAE,OAAO,gBAAgB,KAAK,QAAQ,QAAQ,EAAE,YAAY,CAAC,KAAK,0BAA0B;AAG5F,IAAE,OAAO,iBAAiB,YAAY,wCAAwC,UAAU;AACxF,SAAO,EAAE,KAAK,IAAI,WAAW,IAAI,CAAC;AACpC;AASO,SAAS,0BAA0B,QAAgB;AACxD,SAAO,OAAO,GAAY,SAAwD;AAChF,QAAI,EAAE,IAAI,WAAW,SAAS,EAAE,IAAI,WAAW,OAAQ,QAAO,KAAK;AACnE,UAAM,OAAO,EAAE,IAAI;AACnB,QAAI,gBAAgB,KAAK,YAAU,SAAS,UAAU,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC,EAAG,QAAO,KAAK;AAGlG,UAAM,WAAW,UAAU,mBAAmB,IAAI,CAAC,EAAE,QAAQ,WAAW,EAAE;AAC1E,UAAM,WAAW,QAAQ,QAAQ,QAAQ;AAGzC,UAAM,eAAe,OAAO,SAAS,GAAG,IAAI,SAAS,SAAS;AAC9D,QAAI,SAAS,WAAW,YAAY,KAAK,aAAa,MAAO,MAAM,OAAO,QAAQ,GAAI;AACpF,aAAO,UAAU,GAAG,UAAU,SAAS,WAAW,SAAS,CAAC;AAAA,IAC9D;AAGA,UAAM,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK;AACzC,QAAI,SAAS,OAAO,OAAO,SAAS,WAAW,GAAG;AAChD,aAAO,UAAU,GAAG,KAAK,QAAQ,YAAY,GAAG,KAAK;AAAA,IACvD;AAEA,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}

package/dist/storage/domains/custom-providers/base.d.ts

@@ -0,0 +1,57 @@
+import { FactoryStorageDomain } from '@mastra/core/storage';
+import type { CollectionSchema } from '@mastra/core/storage';
+/**
+ * A user-defined OpenAI-compatible provider. The DB-backed counterpart of the
+ * local `settings.json` `customProviders` entries: org-scoped rows keyed by the
+ * derived provider id (name slug), API key stored alongside so a deployed
+ * server never reads the shared settings file.
+ */
+export interface CustomProviderRecord {
+    id: string;
+    orgId: string;
+    createdBy: string;
+    /** Stable slug derived from the name (`getCustomProviderId`). */
+    providerId: string;
+    name: string;
+    url: string;
+    apiKey: string | null;
+    models: string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface UpsertCustomProviderInput {
+    providerId: string;
+    name: string;
+    url: string;
+    apiKey?: string;
+    models: string[];
+}
+export declare const CUSTOM_PROVIDERS_SCHEMA: CollectionSchema;
+export declare class CustomProvidersStorage extends FactoryStorageDomain {
+    #private;
+    constructor();
+    init(): Promise<void>;
+    dangerouslyClearAll(): Promise<void>;
+    /**
+     * Create or wholesale-replace a provider by `(orgId, providerId)` — mirrors
+     * the settings.json upsert semantics (no key retention: an absent `apiKey`
+     * clears the stored key). `previousProviderId` renames the provider: the
+     * common path is a single atomic in-place update of the old row; renaming
+     * onto an id that already exists overwrites the target first and removes the
+     * old row last, so no interleaving or failure can lose the provider.
+     */
+    upsert({ orgId, userId, input, previousProviderId, }: {
+        orgId: string;
+        userId: string;
+        input: UpsertCustomProviderInput;
+        previousProviderId?: string;
+    }): Promise<CustomProviderRecord>;
+    list({ orgId }: {
+        orgId: string;
+    }): Promise<CustomProviderRecord[]>;
+    delete({ orgId, providerId }: {
+        orgId: string;
+        providerId: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/custom-providers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/custom-providers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,uBAAuB,EAAE,gBAerC,CAAC;AA8BF,qBAAa,sBAAuB,SAAQ,oBAAoB;;;IAKxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C;;;;;;;OAOG;IACG,MAAM,CAAC,EACX,KAAK,EACL,MAAM,EACN,KAAK,EACL,kBAAkB,GACnB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,yBAAyB,CAAC;QACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAkG3B,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IASnE,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG7F"}