@mastra/factory 0.11.1 → 0.12.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @mastra/factory
 
+## 0.12.0-alpha.0
+
+### Minor Changes
+
+- **BREAKING: `sandbox` is now a callback that constructs the session's sandbox** ([#22065](https://github.com/mastra-ai/mastra/pull/22065))
+
+  ```ts
+  // Before — no longer accepted
+  sandbox: { machine: new RailwaySandbox({ apiToken }), workdir: '/workspace', maxSandboxes: 4 }
+
+  // After
+  sandbox: ctx => new E2BSandbox({ id: ctx.sessionId })
+  ```
+
+  A factory still configured with the old options object fails at `prepare()` with a message showing the replacement: `machine` becomes the provider instance you construct inside the callback, `workdir` is gone (remote providers clone into the VM's home directory, local providers use their own `workingDirectory`), and `maxSandboxes` is gone with the fleet. Omit `sandbox` entirely to run without sandboxes. `ctx.getRepositoryAccess` resolves the session repository's clone URL plus a fresh short-lived credential (`undefined` when the session has no repository), so providers can authenticate work such as private-repo template builds.
+
+  Session sandboxes now boot lazily at the first real command instead of being provisioned up front. The sandbox fleet (pooling, budgets, reattach/revival, base checkpoints) is deleted, and the `/ensure` endpoint and the session UI's "preparing sandbox" step go with it — opening a thread provisions nothing. To check whether a sandbox is configured, read `sandboxEnabled` from `GET /web/github/status`.
+
+  A failing setup command no longer wedges the session. The first failure surfaces loudly in the tool result that triggered it, then later starts skip the known-bad command — the clone and branch checkout still run, so the agent can repair or rerun setup itself. Infrastructure failures (clone, checkout, transport) keep failing hard and retry in full.
+
+  Existing databases keep the fleet-era tables and columns as untouched orphans; dropping them is a manual operation.
+
+### Patch Changes
+
+- Hosted sessions no longer leak the host process's environment into the system prompt. The dynamic instructions builder drops its `process.cwd()` fallback: a session without a `projectPath` gets no working directory, no host git-branch probe, and loads no instruction files at all (project locations would resolve against the server's cwd and global locations against the server's homedir). Factory additionally blanks the SDK's default project identity seed (`projectPath`/`projectName`/`gitBranch` from the host's own checkout) so chat-only sessions show "(no workspace attached)" instead of the server's repo and branch; repo-backed sessions keep getting their real session workdir pinned by workspace resolution. ([#22065](https://github.com/mastra-ai/mastra/pull/22065))
+
+- Updated dependencies [[`3910c77`](https://github.com/mastra-ai/mastra/commit/3910c77413a3058ab270c6dbc74a59bc3cdf67ea), [`c80547a`](https://github.com/mastra-ai/mastra/commit/c80547aa7ef33adbb08435ff847e77fa404bafbf), [`c80547a`](https://github.com/mastra-ai/mastra/commit/c80547aa7ef33adbb08435ff847e77fa404bafbf), [`c80547a`](https://github.com/mastra-ai/mastra/commit/c80547aa7ef33adbb08435ff847e77fa404bafbf)]:
+  - @mastra/core@1.63.3-alpha.0
+  - @mastra/code-sdk@1.6.0-alpha.0
+
 ## 0.11.1
 
 ### Patch Changes

package/dist/factory.d.ts

@@ -22,9 +22,9 @@ import type { Mastra } from '@mastra/core/mastra';
 import type { IMastraAuthProvider } from '@mastra/core/server';
 import type { FactoryStorage } from '@mastra/core/storage';
 import type { MastraVector } from '@mastra/core/vector';
-import type { WorkspaceSandbox } from '@mastra/core/workspace';
 import type { FactoryIntegration } from './integrations/base.js';
 import type { FactoryRules } from './rules/types.js';
+import type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';
 import type { FactorySecretEncryption } from './secret-encryption.js';
 /** Constructor args for the `new Mastra(...)` literal in the deploy entry. */
 export type MastraArgs = NonNullable<ConstructorParameters<typeof Mastra>[0]>;
@@ -121,27 +121,7 @@ export interface MastraFactoryConfig {
         githubAppSlug?: string;
     };
 }
-export interface MastraFactorySandboxConfig {
-    /**
-     * Template machine — `RailwaySandbox` (`@mastra/railway`), core
-     * `LocalSandbox` (`@mastra/core/workspace`), or any `WorkspaceSandbox` that
-     * implements `clone()`. Each project-repository execution environment gets
-     * its own sandbox cloned from this machine; the machine itself is never
-     * started. `prepare()` fails fast when the instance lacks `clone()`.
-     */
-    machine: WorkspaceSandbox;
-    /**
-     * In-sandbox base directory repos check out under (nested `owner/name` per
-     * repo). Default: the machine's own `workingDirectory` when it exposes one
-     * (core `LocalSandbox` does), else `/workspace`.
-     */
-    workdir?: string;
-    /**
-     * Per-replica cap on concurrently provisioned sandboxes. `0`/omitted means
-     * unlimited. A lightweight per-process budget, not a cross-replica scheduler.
-     */
-    maxSandboxes?: number;
-}
+export type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';
 /**
  * Per-process cap on concurrent background Factory dispatches. Omitted means
  * the dispatcher default; this is a local replica budget, not a global queue

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAS/D,OAAO,KAAK,EAAE,kBAAkB,EAAgD,MAAM,wBAAwB,CAAC;AAwB/G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AASrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAkCtE,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC;;;;;;;OAOG;IACH,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,mDAAmD;IACnD,UAAU,CAAC,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IAErB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2FD,qBAAa,aAAa;;gBAOZ,MAAM,EAAE,mBAAmB;IAWvC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;IAqsBpC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/B,iFAAiF;IAC3E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAUxD,OAAO,KAAK,EAAE,kBAAkB,EAAgD,MAAM,wBAAwB,CAAC;AAwB/G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAkCtE,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC;;;;;;;OAOG;IACH,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,mDAAmD;IACnD,UAAU,CAAC,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IAErB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE/E;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAyED,qBAAa,aAAa;;gBAOZ,MAAM,EAAE,mBAAmB;IAWvC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;IA8qBpC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/B,iFAAiF;IAC3E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}

package/dist/factory.js

@@ -1,9 +1,6 @@
 import { timedPhase } from "./timing.js";
 import { buildAuthRoutes, createFactoryAuthGate, createFactoryRouteAuth, getFactoryAuthOrgId, getFactoryAuthUserFromContext, getFactoryAuthUserId } from "./auth.js";
 import { recordFactoryPullRequestProvenance, resolveFactoryPullRequestParentWorkItemId } from "./integrations/github/provenance.js";
-import { SandboxFleet } from "./sandbox/fleet.js";
-import { BaseCheckpointBuilder } from "./sandbox/base-checkpoint.js";
-import { createBaseCheckpointTriggers } from "./sandbox/base-checkpoint-triggers.js";
 import { assertFactoryRules } from "./rules/validation.js";
 import { WorkItemsStorage } from "./storage/domains/work-items/base.js";
 import { PlatformGithubIntegration } from "./integrations/platform/github/integration.js";
@@ -16,6 +13,7 @@ import { FactoryFeedReader } from "./storage/domains/comments/feed-context.js";
 import { FactoryTransitionService } from "./rules/transition-service.js";
 import { SourceControlStorage } from "./storage/domains/source-control/base.js";
 import { hydrateSessionModelPack } from "./session/model-pack-hydration.js";
+import { observeSessionFirstExec } from "./session/first-exec-capture.js";
 import { observeSessionFilesystem } from "./session/filesystem-capture.js";
 import { createPlaintextFactorySecretEncryption } from "./secret-encryption.js";
 import { ModelCredentialsStorage } from "./storage/domains/credentials/base.js";
@@ -28,11 +26,9 @@ import { FactoryDecisionDispatcher } from "./rules/dispatcher.js";
 import { FactoryPhaseStateProcessor } from "./rules/processor.js";
 import { createTerminalStageCleanup } from "./rules/terminal-cleanup.js";
 import { createFactoryTransitionTools } from "./rules/tools.js";
-import { registerSandboxReattach } from "./sandbox/reattach.js";
 import { SessionRetirementCoordinator } from "./sandbox/session-retirement.js";
 import { handleServerError } from "./server-error.js";
 import { observeSessionCheckpoint } from "./session/checkpoint-capture.js";
-import { observeSessionFirstExec } from "./session/first-exec-capture.js";
 import { observeSessionFirstMessage } from "./session/first-message-capture.js";
 import { observeSessionThreadTitle } from "./session/thread-title-mirror.js";
 import { createSpaStaticMiddleware, resolveUiDistDir } from "./spa-static.js";
@@ -78,20 +74,6 @@ function hasPlatformCredentials() {
 	return Boolean(process.env.MASTRA_PLATFORM_ACCESS_TOKEN?.trim() || process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());
 }
 /**
-* The template sandbox's own working directory, when it exposes one as a
-* string (core `LocalSandbox` does; remote providers generally don't).
-* Used as the default checkout base so a local template rooted at a host
-* directory checks repos out under that same root.
-*/
-function templateWorkingDirectory(sandbox) {
-	const wd = sandbox.workingDirectory;
-	return typeof wd === "string" && wd.length > 0 ? wd : void 0;
-}
-function resolveSandboxWorkdirBase(machine, configuredWorkdir) {
-	const machineWorkdir = templateWorkingDirectory(machine);
-	return ((configuredWorkdir === "/workspace" && machineWorkdir ? machineWorkdir : configuredWorkdir ?? machineWorkdir) ?? "/workspace").replace(/\/+$/, "");
-}
-/**
 * Default auth provider — `MastraAuthStudio`, which proxies identity to the
 * shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,
 * `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —
@@ -208,7 +190,6 @@ var MastraFactory = class {
 			channelIdentity: channelIdentityStorage,
 			comments: workItemCommentsStorage
 		};
-		let baseCheckpoints;
 		const auditDomain = new AuditDomain({
 			auth: routeAuth,
 			audit: auditStorage,
@@ -232,14 +213,10 @@ var MastraFactory = class {
 			audit: auditDomain
 		});
 		const sandboxConfig = this.#config.sandbox;
-		const machine = sandboxConfig?.machine;
-		if (machine && typeof machine.clone !== "function") throw new Error(`MastraFactory: the configured sandbox machine (provider '${machine.provider}') does not implement clone(). Project repositories each get their own sandbox cloned from the configured machine. Pass a machine that implements clone() — e.g. RailwaySandbox (@mastra/railway) or LocalSandbox (@mastra/core/workspace) — or omit 'sandbox' to disable sandboxes.`);
-		const fleet = new SandboxFleet(machine ? {
-			machine,
-			workdirBase: resolveSandboxWorkdirBase(machine, sandboxConfig?.workdir),
-			maxSandboxes: sandboxConfig?.maxSandboxes
-		} : void 0);
-		registerSandboxReattach(fleet);
+		if (sandboxConfig !== void 0 && typeof sandboxConfig !== "function") {
+			if (typeof sandboxConfig === "object" && sandboxConfig !== null) throw new Error("MastraFactory: 'sandbox' is now a callback, not an options object. It receives a FactorySandboxContext and returns a MastraSandbox, so the host chooses the provider per session:\n  sandbox: ctx => new E2BSandbox({ id: ctx.sessionId })\nThe old options map three ways: 'machine' becomes the provider instance you construct inside the callback (one per session instead of one cloned template); 'workdir' is gone — remote providers clone into the VM's home directory and local providers check out under their own workingDirectory; 'maxSandboxes' is gone with the sandbox fleet — there is one sandbox per session and no pool to cap. Omit 'sandbox' entirely to disable sandboxes.");
+			throw new Error(`MastraFactory: 'sandbox' must be a function constructing a MastraSandbox from a FactorySandboxContext.`);
+		}
 		const workspaceRegistry = new FactoryWorkspaceRegistry();
 		const stateSigner = createStateSigner(this.#config.stateSecret);
 		if (auth && hasAuthInit(auth)) await timedPhase("prepare.auth.init", () => auth.init({
@@ -279,26 +256,8 @@ var MastraFactory = class {
 		const factoryReady = storage.isDomainReady("projects") && storage.isDomainReady("work-items");
 		const knowledgeEnabled = process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === "1";
 		const githubIntegration = integrations.find((integration) => integration.id === "github");
-		if (githubIntegration && fleet.enabled && storage.isDomainReady("source-control")) {
-			const checkpointLogger = { warn: (message) => console.warn(`[factory] ${message}`) };
-			baseCheckpoints = createBaseCheckpointTriggers({
-				builder: new BaseCheckpointBuilder({
-					fleet,
-					logger: checkpointLogger
-				}),
-				fleet,
-				github: {
-					sourceControlStorage: sourceControlStorage.forIntegration("github"),
-					...githubIntegration.versionControl ? { versionControl: githubIntegration.versionControl } : {}
-				},
-				logger: checkpointLogger
-			});
-		}
 		const workItemsReady = storage.isDomainReady("work-items");
-		const sessionRetirement = machine && storage.isDomainReady("source-control") ? new SessionRetirementCoordinator({
-			fleet,
-			invalidateSession: (sessionId) => workspaceRegistry.invalidateSession(sessionId)
-		}) : void 0;
+		const sessionRetirement = sandboxConfig && storage.isDomainReady("source-control") ? new SessionRetirementCoordinator({ invalidateSession: (sessionId) => workspaceRegistry.invalidateSession(sessionId) }) : void 0;
 		const retireTerminalSessions = sessionRetirement && githubIntegration && workItemsReady ? async ({ orgId, workItemId }) => sessionRetirement.retireWorkItemSessions({
 			workItems: workItemsStorage,
 			sourceControl: sourceControlStorage.forIntegration(githubIntegration.id),
@@ -323,8 +282,7 @@ var MastraFactory = class {
 			sourceControl: sourceControlStorage,
 			versionControlIntegrationIds: integrations.filter((integration) => integration.versionControl).map((integration) => integration.id),
 			...sessionRetirement ? { sessionRetirement } : {},
-			...workItemsReady ? { workItems: workItemsStorage } : {},
-			onProjectRepositoryLinked: (args) => baseCheckpoints?.onProjectRepositoryLinked(args)
+			...workItemsReady ? { workItems: workItemsStorage } : {}
 		});
 		const factoryProcessor = workItemsReady ? new FactoryPhaseStateProcessor({
 			rules,
@@ -350,17 +308,19 @@ var MastraFactory = class {
 		const prepared = await timedPhase("prepare.controllerMount", () => prepareAgentControllerMount({
 			controllerId: CONTROLLER_ID,
 			workspace: createWorkspaceFactory({
-				...this.#config.sandbox ? { sandbox: this.#config.sandbox } : {},
+				...sandboxConfig ? { sandbox: sandboxConfig } : {},
 				...githubIntegration ? { github: githubIntegration } : {},
 				...workItemsStorage ? { workItems: workItemsStorage } : {},
-				fleet,
 				workspaceRegistry
 			}),
 			disableGithubSignals: true,
 			disableSettingsOmSeed: true,
 			initialState: {
 				skipGlobalInstructions: true,
-				factoryOrgUnresolved: true
+				factoryOrgUnresolved: true,
+				projectPath: "",
+				projectName: "",
+				gitBranch: ""
 			},
 			storage: storage.getMastraStorage(),
 			...mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {},
@@ -430,8 +390,7 @@ var MastraFactory = class {
 					audit: auditDomain,
 					publicOrigin,
 					stateSigner,
-					fleet,
-					...baseCheckpoints ? { baseCheckpoints } : {},
+					sandbox: sandboxConfig,
 					sessionRetirement,
 					factoryStorage: storage,
 					integrationStorage,
@@ -546,8 +505,7 @@ var MastraFactory = class {
 			publicOrigin,
 			auth: routeAuth,
 			stateSigner,
-			fleet,
-			...baseCheckpoints ? { baseCheckpoints } : {},
+			sandbox: sandboxConfig,
 			factoryStorage: storage,
 			integrationStorage,
 			sourceControlStorage,
@@ -561,8 +519,7 @@ var MastraFactory = class {
 			publicOrigin,
 			auth: routeAuth,
 			stateSigner,
-			fleet,
-			...baseCheckpoints ? { baseCheckpoints } : {},
+			sandbox: sandboxConfig,
 			factoryStorage: storage,
 			integrationStorage,
 			sourceControlStorage,

package/dist/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","names":["#config","#preparing","#dispatcher","#prepared","#factoryProcessor"],"sources":["../src/factory.ts"],"sourcesContent":["/**\n * `MastraFactory` — the single entry point to the whole Mastra Software Factory.\n *\n * The consumer's deploy entry constructs deployment-specific config instances\n * (auth adapter, pubsub) and passes them here explicitly. The only provider\n * defaults constructed here are Platform GitHub and Linear integrations when\n * Platform credentials exist and the caller did not provide those integrations.\n *\n * `prepare()` resolves feature readiness, threads every dependency explicitly,\n * assembles the web routes/middleware, and returns the constructor args for\n * `new Mastra(...)`. The literal `export const mastra = new Mastra(...)` must\n * stay in the entry file — the deployer's `checkConfigExport` Babel plugin\n * only marks the config valid when it finds that literal in the entry AST —\n * so the factory produces args instead of the instance. `finalize()` runs the\n * post-construct boot (controller init + workers).\n *\n * Integration readiness is derived from each instance's declared capabilities\n * and the storage domains those capabilities require.\n */\n\nimport { MastraAuthStudio } from '@mastra/auth-studio';\nimport { prepareAgentControllerMount } from '@mastra/code-sdk';\nimport { AgentControllerChannels } from '@mastra/core/channels';\nimport type { PubSub } from '@mastra/core/events';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { hasAuthInit, isUserProvider } from '@mastra/core/server';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport {\n  buildAuthRoutes,\n  createFactoryAuthGate,\n  createFactoryRouteAuth,\n  getFactoryAuthOrgId,\n  getFactoryAuthUserFromContext,\n  getFactoryAuthUserId,\n} from './auth.js';\nimport type { FactoryIntegration, IntegrationPostToolContext, IntegrationTools } from './integrations/base.js';\nimport type { GithubIntegration } from './integrations/github/integration.js';\nimport {\n  recordFactoryPullRequestProvenance,\n  resolveFactoryPullRequestParentWorkItemId,\n} from './integrations/github/provenance.js';\nimport type { FactoryPullRequestProvenanceData } from './integrations/github/provenance.js';\nimport { PlatformGithubIntegration } from './integrations/platform/github/integration.js';\nimport { PlatformLinearIntegration } from './integrations/platform/linear/integration.js';\nimport { createCustomProvidersPrimer, registerCustomProvidersSource } from './routes/custom-provider-source.js';\nimport { ProjectRoutes } from './routes/projects.js';\nimport { assembleFactoryApiRoutes, buildIntegrationContext } from './routes/surface.js';\nimport type { FactoryApiRoutesDeps } from './routes/surface.js';\nimport {\n  createTenantCredentialPrimer,\n  primeTenantCredentials,\n  registerTenantCredentialResolver,\n} from './routes/tenant-credentials.js';\nimport { builtInFactoryRules } from './rules/defaults.js';\nimport { FactoryDecisionDispatcher } from './rules/dispatcher.js';\nimport { FactoryPhaseStateProcessor } from './rules/processor.js';\nimport { createTerminalStageCleanup } from './rules/terminal-cleanup.js';\nimport { createFactoryTransitionTools } from './rules/tools.js';\nimport { FactoryTransitionService } from './rules/transition-service.js';\nimport type { FactoryRules } from './rules/types.js';\nimport { assertFactoryRules } from './rules/validation.js';\nimport type { BaseCheckpointTriggers } from './sandbox/base-checkpoint-triggers.js';\nimport { createBaseCheckpointTriggers } from './sandbox/base-checkpoint-triggers.js';\nimport { BaseCheckpointBuilder } from './sandbox/base-checkpoint.js';\nimport { SandboxFleet } from './sandbox/fleet.js';\nimport { registerSandboxReattach } from './sandbox/reattach.js';\nimport { SessionRetirementCoordinator } from './sandbox/session-retirement.js';\nimport { createPlaintextFactorySecretEncryption } from './secret-encryption.js';\nimport type { FactorySecretEncryption } from './secret-encryption.js';\nimport { handleServerError } from './server-error.js';\nimport { observeSessionCheckpoint } from './session/checkpoint-capture.js';\nimport { observeSessionFilesystem } from './session/filesystem-capture.js';\nimport { observeSessionFirstExec } from './session/first-exec-capture.js';\nimport { observeSessionFirstMessage } from './session/first-message-capture.js';\nimport { hydrateSessionMemorySettings } from './session/memory-settings-hydration.js';\nimport { hydrateSessionModelPack } from './session/model-pack-hydration.js';\nimport { observeSessionThreadTitle } from './session/thread-title-mirror.js';\nimport { createSpaStaticMiddleware, resolveUiDistDir } from './spa-static.js';\nimport { createStateSigner } from './state-signing.js';\nimport { observeAgentGitAction } from './storage/domains/audit/agent-audit.js';\nimport { AuditStorage } from './storage/domains/audit/base.js';\nimport { AuditDomain } from './storage/domains/audit/domain.js';\nimport { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';\nimport { WorkItemCommentsStorage } from './storage/domains/comments/base.js';\nimport { CommentsDomain } from './storage/domains/comments/domain.js';\nimport { FactoryFeedReader } from './storage/domains/comments/feed-context.js';\nimport { ModelCredentialsStorage } from './storage/domains/credentials/base.js';\nimport { CustomProvidersStorage } from './storage/domains/custom-providers/base.js';\nimport { FilesystemStorage } from './storage/domains/filesystem/base.js';\nimport { IntakeStorage } from './storage/domains/intake/base.js';\nimport { IntegrationStorage } from './storage/domains/integrations/base.js';\nimport { MemorySettingsStorage } from './storage/domains/memory-settings/base.js';\nimport { ModelPacksStorage } from './storage/domains/model-packs/base.js';\nimport { FactoryProjectsStorage } from './storage/domains/projects/base.js';\nimport { QueueHealthStorage } from './storage/domains/queue-health/base.js';\nimport { SourceControlStorage } from './storage/domains/source-control/base.js';\nimport { WorkItemsStorage } from './storage/domains/work-items/base.js';\nimport { timedPhase } from './timing.js';\nimport { createWorkspaceFactory, FactoryWorkspaceRegistry } from './workspace.js';\n\ntype BuildApiRoutesDeps = Pick<FactoryApiRoutesDeps, 'controller' | 'authStorage'>;\n\n/** Constructor args for the `new Mastra(...)` literal in the deploy entry. */\nexport type MastraArgs = NonNullable<ConstructorParameters<typeof Mastra>[0]>;\n\nexport interface MastraFactoryConfig {\n  /**\n   * Auth provider instance — `MastraAuthStudio` (`@mastra/auth-studio`),\n   * `MastraAuthWorkos` (`@mastra/auth-workos`), `MastraAuthBetterAuth`\n   * (`@mastra/auth-better-auth`), or any custom `MastraAuthProvider`. Whatever\n   * instance is passed is the active provider; a passed instance is always\n   * honored as-is.\n   *\n   * Omitted → the factory defaults to `MastraAuthStudio`, proxying auth\n   * through the shared Mastra platform API. `MastraAuthStudio` resolves its\n   * own env (`MASTRA_SHARED_API_URL`, `MASTRA_ORGANIZATION_ID`,\n   * `MASTRA_COOKIE_DOMAIN`).\n   *\n   * Pass `null` to disable auth entirely (open server, local-dev behavior)\n   * without falling back to the default.\n   */\n  auth?: IMastraAuthProvider | null;\n  /**\n   * REQUIRED. Factory storage backend powering BOTH agent storage (threads,\n   * messages, memory, OM — via `getMastraStorage()`) and the app tables\n   * (projects/source-control/audit/intake — via the generic ops surface). Pass a\n   * `PgFactoryStorage` (`@mastra/pg`) for deployments or a\n   * `LibSQLFactoryStorage` (`@mastra/libsql`) for local dev — one backend,\n   * one connection, every feature on.\n   */\n  storage: FactoryStorage;\n  /**\n   * Vector store instance for recall search — `PgVector` (`@mastra/pg`) on\n   * the same database as `storage`. Omitted → the SDK mount's default vector\n   * store resolution applies.\n   */\n  vector?: MastraVector;\n  /**\n   * Distributed event bus instance (e.g. `new RedisStreamsPubSub({ url })`).\n   * When set, streams/workflows/signals ride it across processes and the\n   * controller drops file-based thread locks in favor of pubsub-coordinated\n   * leases. Omitted → in-process default.\n   */\n  pubsub?: PubSub;\n  /**\n   * Browser-facing origin used to build integration OAuth/install callback\n   * URLs and to derive the auth redirect URI. On the platform the SPA is\n   * hosted separately, so this MUST be the public API origin.\n   * Default: `http://localhost:4111` (the local Factory server, which also\n   * serves the UI).\n   */\n  publicUrl?: string;\n  /**\n   * Allowed cross-origin SPA origins. The SPA may be served from a separate\n   * static host, so credentialed requests must be explicitly allowed.\n   */\n  allowedOrigins?: string[];\n  /** Sandbox configuration. Omitted → repository sandboxes are disabled. */\n  sandbox?: MastraFactorySandboxConfig;\n  /** Background Factory dispatcher configuration. */\n  dispatcher?: MastraFactoryDispatcherConfig;\n  /**\n   * Deployment-stable secret for signing integration OAuth `state` values.\n   * Omitted → a per-process random secret, which is fine for single-process\n   * local development but rejected for integrations that declare\n   * `requiresStableStateSigner`.\n   */\n  stateSecret?: string;\n  /**\n   * Encryption boundary for persisted model credentials, custom-provider API\n   * keys, integration connections, and integration settings. Strongly\n   * recommended whenever auth is enabled — omitting it falls back to explicit\n   * plaintext compatibility with a boot-time warning.\n   */\n  secretEncryption?: FactorySecretEncryption;\n  /**\n   * Registered capability providers. The factory registers the pieces each\n   * `FactoryIntegration` instance provides — HTTP routes, storage domains,\n   * agent/session tools, intake, source control, and diagnostics — into the\n   * system. When Platform credentials are configured, missing `github` and\n   * `linear` integrations default to their Platform-backed implementations.\n   */\n  integrations?: FactoryIntegration[];\n  /**\n   * Authoritative Factory board, tool-result, and GitHub-event rules. Construct\n   * with `defaultFactoryRules({ version, overrides })` so deployment policy has\n   * an explicit version and exact handler leaves replace rather than compose.\n   * Omitted → conservative built-in rules for the current deployment.\n   */\n  rules?: FactoryRules;\n\n  /**\n   * Platform-specific overrides. `githubAppSlug` identifies Factory's own\n   * GitHub App writes so their webhook deliveries do not retrigger triage.\n   */\n  platform?: {\n    githubAppSlug?: string;\n  };\n}\n\nexport interface MastraFactorySandboxConfig {\n  /**\n   * Template machine — `RailwaySandbox` (`@mastra/railway`), core\n   * `LocalSandbox` (`@mastra/core/workspace`), or any `WorkspaceSandbox` that\n   * implements `clone()`. Each project-repository execution environment gets\n   * its own sandbox cloned from this machine; the machine itself is never\n   * started. `prepare()` fails fast when the instance lacks `clone()`.\n   */\n  machine: WorkspaceSandbox;\n  /**\n   * In-sandbox base directory repos check out under (nested `owner/name` per\n   * repo). Default: the machine's own `workingDirectory` when it exposes one\n   * (core `LocalSandbox` does), else `/workspace`.\n   */\n  workdir?: string;\n  /**\n   * Per-replica cap on concurrently provisioned sandboxes. `0`/omitted means\n   * unlimited. A lightweight per-process budget, not a cross-replica scheduler.\n   */\n  maxSandboxes?: number;\n}\n\n/**\n * Per-process cap on concurrent background Factory dispatches. Omitted means\n * the dispatcher default; this is a local replica budget, not a global queue\n * limit shared across deployments.\n */\nexport interface MastraFactoryDispatcherConfig {\n  maxInFlight?: number;\n}\n\nconst CONTROLLER_ID = 'code';\n\nfunction hasPlatformCredentials(): boolean {\n  // MASTRA_PLATFORM_ACCESS_TOKEN is the credential Mastra Platform injects\n  // into deployed projects; MASTRA_PLATFORM_SECRET_KEY is the org secret key\n  // written by project scaffolding. Either enables the platform integrations.\n  return Boolean(process.env.MASTRA_PLATFORM_ACCESS_TOKEN?.trim() || process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());\n}\n\n/**\n * The template sandbox's own working directory, when it exposes one as a\n * string (core `LocalSandbox` does; remote providers generally don't).\n * Used as the default checkout base so a local template rooted at a host\n * directory checks repos out under that same root.\n */\nfunction templateWorkingDirectory(sandbox: WorkspaceSandbox): string | undefined {\n  const wd = (sandbox as { workingDirectory?: unknown }).workingDirectory;\n  return typeof wd === 'string' && wd.length > 0 ? wd : undefined;\n}\n\nfunction resolveSandboxWorkdirBase(machine: WorkspaceSandbox, configuredWorkdir?: string): string {\n  const machineWorkdir = templateWorkingDirectory(machine);\n  const workdir =\n    configuredWorkdir === '/workspace' && machineWorkdir ? machineWorkdir : (configuredWorkdir ?? machineWorkdir);\n  return (workdir ?? '/workspace').replace(/\\/+$/, '');\n}\n\n/**\n * Default auth provider — `MastraAuthStudio`, which proxies identity to the\n * shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,\n * `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —\n * this helper only derives a cookie-domain fallback from the factory's\n * `publicUrl`.\n *\n * Cookie-domain resolution (Studio picks the first that wins):\n *   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;\n *   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;\n *   3. this parent-domain fallback derived from `publicUrl` — so a deploy on\n *      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`\n *      without the caller wiring the env var by hand.\n *   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.\n */\nfunction buildDefaultStudioAuth(publicUrl: string): IMastraAuthProvider {\n  return new MastraAuthStudio({\n    cookieDomain: parentDomainFromPublicUrl(publicUrl),\n  });\n}\n\n/**\n * Derive a parent cookie domain from `publicUrl` by stripping the leftmost\n * label — the same shape platform-API's env injection uses (see\n * `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\\./, '')}`).\n *\n * Rather than a generic `strip-left-label` heuristic — which either emits\n * cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`\n * requires PSL data to be safe) or misclassifies numeric hostnames like\n * `3scale.example.com` as IPv4 — we only derive a parent domain when the\n * host sits under one of the platform's known registrable domains. Anything\n * else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)\n * falls through to host-only cookies. Callers that need a different scope\n * pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).\n */\nconst KNOWN_PLATFORM_COOKIE_PARENTS = ['mastra.cloud', 'mastra.ai'] as const;\n\nfunction isIpLiteral(hostname: string): boolean {\n  // IPv6 addresses in URLs are bracketed; `URL.hostname` strips the brackets\n  // but the address itself still contains `:`. IPv4 is four dot-separated\n  // numeric octets — trust the parser to have already validated shape.\n  if (hostname.includes(':')) return true;\n  return /^\\d+(?:\\.\\d+){3}$/.test(hostname);\n}\n\nfunction parentDomainFromPublicUrl(publicUrl: string): string | undefined {\n  let hostname: string;\n  try {\n    hostname = new URL(publicUrl).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (hostname === 'localhost' || isIpLiteral(hostname)) return undefined;\n  for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {\n    // Exact match → we're already on the parent, host-only is correct.\n    // Subdomain match → mint the parent-scoped cookie.\n    if (hostname === parent) return undefined;\n    if (hostname.endsWith(`.${parent}`)) return `.${parent}`;\n  }\n  return undefined;\n}\n\nexport class MastraFactory {\n  readonly #config: MastraFactoryConfig;\n  #prepared: Awaited<ReturnType<typeof prepareAgentControllerMount>> | undefined;\n  #dispatcher: FactoryDecisionDispatcher | undefined;\n  #factoryProcessor: FactoryPhaseStateProcessor | undefined;\n  #preparing = false;\n\n  constructor(config: MastraFactoryConfig) {\n    if (!config?.storage) {\n      throw new Error(\n        \"MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. \" +\n          \"new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or \" +\n          \"new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.\",\n      );\n    }\n    this.#config = config;\n  }\n\n  /**\n   * Resolve feature readiness, wire every dependency explicitly, and assemble\n   * everything needed to construct the server-owned Mastra. Returns the args\n   * for the `new Mastra(...)` literal that must live in the entry file.\n   */\n  async prepare(): Promise<MastraArgs> {\n    // Guard set synchronously (before the first await) so overlapping calls —\n    // not just strictly sequential ones — can't double-seed the runtime\n    // registry or double-run one-time adapter init.\n    if (this.#preparing) throw new Error('MastraFactory.prepare() called twice');\n    this.#preparing = true;\n\n    const publicOrigin = (this.#config.publicUrl ?? 'http://localhost:4111').replace(/\\/+$/, '');\n    const allowedOrigins = (this.#config.allowedOrigins ?? []).map(o => o.replace(/\\/+$/, '')).filter(Boolean);\n    const storage = this.#config.storage;\n    const vector = this.#config.vector;\n    const pubsub = this.#config.pubsub;\n    // Default auth: honor an explicitly-passed provider (including `null` to\n    // disable auth) as-is; otherwise fall back to `MastraAuthStudio`\n    // (platform-proxied identity). The default derives its cookie domain\n    // from `publicUrl` — deploys on `<sub>.mastra.cloud` mint parent-domain\n    // cookies without the caller wiring `MASTRA_COOKIE_DOMAIN` explicitly.\n    const configuredAuth = this.#config.auth;\n    const auth: IMastraAuthProvider | undefined =\n      configuredAuth === null ? undefined : (configuredAuth ?? buildDefaultStudioAuth(publicOrigin));\n    if (auth && !this.#config.secretEncryption) {\n      console.warn(\n        \"[factory] auth is enabled but 'secretEncryption' is not configured. Persisted model credentials, \" +\n          'custom-provider API keys, and integration secrets will be stored as plaintext. Provide ' +\n          \"'secretEncryption' (e.g. via FACTORY_CREDENTIAL_ENCRYPTION_KEY) to encrypt them at rest.\",\n      );\n    }\n    const secretEncryption = this.#config.secretEncryption ?? createPlaintextFactorySecretEncryption();\n    // One RouteAuth seam per boot, closed over the resolved provider. Every\n    // factory route module receives this handle — no service locator.\n    const routeAuth = createFactoryRouteAuth(auth);\n\n    // Explicit integrations win. Platform credentials fill only missing GitHub\n    // and Linear slots so callers can override either provider independently.\n    const integrations = [...(this.#config.integrations ?? [])];\n    if (hasPlatformCredentials()) {\n      if (!integrations.some(integration => integration.id === 'github')) {\n        integrations.push(new PlatformGithubIntegration({ slug: this.#config.platform?.githubAppSlug }));\n      }\n      if (!integrations.some(integration => integration.id === 'linear')) {\n        integrations.push(new PlatformLinearIntegration());\n      }\n    }\n\n    // Validate ids up front so a copy-paste duplicate fails loud instead of one\n    // instance silently shadowing the other.\n    const integrationIds = new Set<string>();\n    for (const integration of integrations) {\n      if (integrationIds.has(integration.id)) {\n        throw new Error(`MastraFactory: duplicate integration id '${integration.id}' in 'integrations'.`);\n      }\n      integrationIds.add(integration.id);\n    }\n    const rules = this.#config.rules ?? builtInFactoryRules();\n    assertFactoryRules(rules);\n\n    // FactoryStorage owns every app-table domain and initializes them through\n    // the same lifecycle as the backend connection.\n    const intakeStorage = storage.registerDomain(new IntakeStorage());\n    const auditStorage = storage.registerDomain(new AuditStorage());\n    const workItemsStorage = storage.registerDomain(new WorkItemsStorage());\n    const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage(secretEncryption));\n    const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());\n    const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());\n    const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage(secretEncryption));\n    const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());\n    // Generic integration storage (connections/subscriptions/settings) — the\n    // default persistence surface for integrations without a bespoke domain.\n    const integrationStorage = storage.registerDomain(new IntegrationStorage(secretEncryption));\n    const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());\n    const filesystemStorage = storage.registerDomain(new FilesystemStorage());\n    const sourceControlStorage = storage.registerDomain(new SourceControlStorage());\n    // Reverse index from a platform sender (Slack/Discord/...) to a Mastra\n    // tenant, so inbound channel events can resolve the sender's model creds.\n    const channelIdentityStorage = storage.registerDomain(new ChannelIdentityStorage());\n    const workItemCommentsStorage = storage.registerDomain(new WorkItemCommentsStorage());\n    // Every app-table domain handle the route builders and integrations need,\n    // threaded explicitly (no service locator).\n    const domains = {\n      intake: intakeStorage,\n      modelCredentials: modelCredentialsStorage,\n      modelPacks: modelPacksStorage,\n      memorySettings: memorySettingsStorage,\n      customProviders: customProvidersStorage,\n      filesystem: filesystemStorage,\n      projects: factoryProjectsStorage,\n      queueHealth: queueHealthStorage,\n      workItems: workItemsStorage,\n      channelIdentity: channelIdentityStorage,\n      comments: workItemCommentsStorage,\n    };\n    // Assigned once the fleet and integrations exist below; the routes only\n    // dereference it at request time, so the late assignment is safe.\n    let baseCheckpoints: BaseCheckpointTriggers | undefined;\n    const auditDomain = new AuditDomain({\n      auth: routeAuth,\n      audit: auditStorage,\n      projects: factoryProjectsStorage,\n      users: auth && isUserProvider(auth) ? auth : undefined,\n      sinks: integrations,\n      agentTenant: requestContext => {\n        const user = getFactoryAuthUserFromContext(requestContext);\n        return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n      },\n    });\n    const commentsDomain = new CommentsDomain({\n      auth: routeAuth,\n      comments: workItemCommentsStorage,\n      workItems: workItemsStorage,\n      projects: factoryProjectsStorage,\n      channelIdentity: channelIdentityStorage,\n      audit: auditDomain,\n    });\n\n    // Repository execution needs one sandbox per project-repository link,\n    // cloned from the configured machine. A machine without `clone()` would\n    // only fail on first use, so fail fast at boot instead.\n    const sandboxConfig = this.#config.sandbox;\n    const machine = sandboxConfig?.machine;\n    if (machine && typeof machine.clone !== 'function') {\n      throw new Error(\n        `MastraFactory: the configured sandbox machine (provider '${machine.provider}') does not implement clone(). ` +\n          `Project repositories each get their own sandbox cloned from the configured machine. ` +\n          `Pass a machine that implements clone() — e.g. RailwaySandbox (@mastra/railway) or ` +\n          `LocalSandbox (@mastra/core/workspace) — or omit 'sandbox' to disable sandboxes.`,\n      );\n    }\n\n    // One sandbox fleet per boot: constructed with the machine config when\n    // sandboxes are configured, disabled otherwise. Handed to integrations\n    // through the IntegrationContext — no global registry.\n    const fleet = new SandboxFleet(\n      machine\n        ? {\n            machine,\n            workdirBase: resolveSandboxWorkdirBase(machine, sandboxConfig?.workdir),\n            maxSandboxes: sandboxConfig?.maxSandboxes,\n          }\n        : undefined,\n    );\n    // Core's `getDynamicWorkspace` reattaches project sandboxes through the\n    // SDK seam; only this factory owns the fleet, so register it here.\n    registerSandboxReattach(fleet);\n    const workspaceRegistry = new FactoryWorkspaceRegistry();\n\n    // One shared OAuth state signer per boot. The deploy entry supplies a\n    // replica-stable secret when needed; otherwise local development gets a\n    // per-process random signer (`stable: false`).\n    const stateSigner = createStateSigner(this.#config.stateSecret);\n\n    // One-time provider initialization with factory-level context (e.g.\n    // better-auth builds its default instance on the backend's auth\n    // database, WorkOS derives its redirect URI from the public URL).\n    // Failures surface here, at prepare() — a misconfigured provider must\n    // not boot.\n    if (auth && hasAuthInit(auth)) {\n      await timedPhase('prepare.auth.init', () =>\n        auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins }),\n      );\n    }\n\n    // Single init path: backend connection failure is a hard boot error;\n    // registered app domains initialize fail-soft inside FactoryStorage.\n    await timedPhase('prepare.storage.init', () => storage.init());\n\n    // Per-tenant model credentials: once the credentials domain is up, model\n    // resolution goes through the caller's own store and the SDK stops\n    // mirroring stored API keys into process.env.\n    //\n    // Only register when a real auth adapter gates callers. In local /\n    // auth-disabled mode there is no authenticated tenant, so registering would\n    // force every model call through an empty tenant store (fail-closed, no env\n    // fallback) and break chat with \"Not logged in\". Leaving it unregistered\n    // lets the SDK fall back to the file-backed AuthStorage (auth.json) — the\n    // same store the local /login and Settings pages read and write.\n    if (auth) {\n      registerTenantCredentialResolver(modelCredentialsStorage);\n    }\n\n    // Custom providers: DB-backed in both modes (org rows in tenant mode, the\n    // sentinel `local` org in no-auth mode). Once registered, model resolution\n    // and the gateway catalog never read settings.json custom providers.\n    registerCustomProvidersSource({ storage: customProvidersStorage, authEnabled: Boolean(auth) });\n\n    for (const integration of integrations) {\n      integration.initialize?.({\n        storage: integrationStorage.forIntegration(integration.id),\n        projects: factoryProjectsStorage,\n        auth: routeAuth,\n      });\n      if (integration.versionControl) {\n        integration.versionControl.initialize({\n          storage: sourceControlStorage.forIntegration(integration.id),\n        });\n      }\n    }\n\n    // Every integration uses generic integration storage. Version-control\n    // providers additionally require the source-control storage domain. Readiness\n    // is derived solely from capability presence, never from provider ids.\n    const integrationRegistrations = integrations.map(integration => {\n      const requiredDomains = [\n        'integrations',\n        ...(integration.versionControl ? ['source-control'] : []),\n        // Channels resolve an inbound sender to a tenant through the reverse\n        // index; without it every message would dispatch tenant-less.\n        ...(integration.channels ? ['channel-identity'] : []),\n      ];\n      return {\n        integration,\n        ready: requiredDomains.every(domain => storage.isDomainReady(domain)),\n        ensureReady: async () => {\n          for (const domain of requiredDomains) await storage.ensureDomainReady(domain);\n        },\n      };\n    });\n    const intakeReady =\n      integrations.some(integration => integration.intake !== undefined) && storage.isDomainReady('intake');\n    const factoryReady = storage.isDomainReady('projects') && storage.isDomainReady('work-items');\n    const knowledgeEnabled = process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === '1';\n    const githubIntegration = integrations.find(integration => integration.id === 'github') as\n      | GithubIntegration\n      | undefined;\n    // Base-checkpoint triggers: keep a warm per-repo checkpoint refreshed on\n    // repo connect, default-branch merges/pushes, and the reconcile sweep.\n    // Constructed only when a sandbox fleet and GitHub source control exist;\n    // otherwise sessions simply keep the cold clone+setup path.\n    if (githubIntegration && fleet.enabled && storage.isDomainReady('source-control')) {\n      const checkpointLogger = {\n        warn: (message: string) => console.warn(`[factory] ${message}`),\n      } as ConstructorParameters<typeof BaseCheckpointBuilder>[0]['logger'];\n      baseCheckpoints = createBaseCheckpointTriggers({\n        builder: new BaseCheckpointBuilder({ fleet, logger: checkpointLogger }),\n        fleet,\n        github: {\n          sourceControlStorage: sourceControlStorage.forIntegration('github'),\n          ...(githubIntegration.versionControl ? { versionControl: githubIntegration.versionControl } : {}),\n        },\n        logger: checkpointLogger,\n      });\n    }\n    const workItemsReady = storage.isDomainReady('work-items');\n    const sessionRetirement =\n      machine && storage.isDomainReady('source-control')\n        ? new SessionRetirementCoordinator({\n            fleet,\n            invalidateSession: sessionId => workspaceRegistry.invalidateSession(sessionId),\n          })\n        : undefined;\n    const retireTerminalSessions =\n      sessionRetirement && githubIntegration && workItemsReady\n        ? async ({ orgId, workItemId }: { orgId: string; workItemId: string }) =>\n            sessionRetirement.retireWorkItemSessions({\n              workItems: workItemsStorage,\n              sourceControl: sourceControlStorage.forIntegration(githubIntegration.id),\n              orgId,\n              workItemId,\n            })\n        : undefined;\n    // Terminal-stage cleanup: ingest any trailing tool results from the item's\n    // bound threads, then revoke the bindings so completed items leave the\n    // reconcile walk (the active-binding set otherwise grows forever), and\n    // finally release the item's sandboxes. Each step is best-effort — a\n    // committed transition never fails on cleanup.\n    const onTerminalStage = workItemsReady\n      ? createTerminalStageCleanup({\n          workItems: workItemsStorage,\n          // `factoryProcessor` is assigned below in this scope; the cleanup\n          // only runs on transitions long after bootstrap completes.\n          reconcileBinding: async (binding): Promise<void> => {\n            await factoryProcessor?.reconcileBinding(binding);\n          },\n          // Session retirement supersedes the older direct sandbox release: it\n          // invalidates the session and hands its sandbox back to the pool.\n          ...(retireTerminalSessions ? { releaseSandboxes: retireTerminalSessions } : {}),\n        })\n      : retireTerminalSessions;\n    const transitionService = workItemsReady\n      ? new FactoryTransitionService({\n          rules,\n          storage: workItemsStorage,\n          ...(onTerminalStage ? { onTerminalStage } : {}),\n        })\n      : undefined;\n    const projectRoutes = new ProjectRoutes({\n      auth: routeAuth,\n      projects: factoryProjectsStorage,\n      sourceControl: sourceControlStorage,\n      versionControlIntegrationIds: integrations\n        .filter(integration => integration.versionControl)\n        .map(integration => integration.id),\n      ...(sessionRetirement ? { sessionRetirement } : {}),\n      ...(workItemsReady ? { workItems: workItemsStorage } : {}),\n      onProjectRepositoryLinked: args => baseCheckpoints?.onProjectRepositoryLinked(args),\n    });\n    const factoryProcessor = workItemsReady\n      ? new FactoryPhaseStateProcessor({\n          rules,\n          storage: workItemsStorage,\n          ...(transitionService ? { transitionService } : {}),\n          ...(githubIntegration\n            ? {\n                recordPullRequestProvenance: (input: Parameters<typeof recordFactoryPullRequestProvenance>[4]) =>\n                  recordFactoryPullRequestProvenance(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration('github'),\n                    integrationStorage.forIntegration('github'),\n                    workItemsStorage,\n                    input,\n                  ),\n              }\n            : {}),\n          messageReader: {\n            listMessages: async input => {\n              const memory = await storage.getMastraStorage().getStore('memory');\n              return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n            },\n          },\n        })\n      : undefined;\n\n    // Boot assertion: an active integration that signs OAuth `state` needs a\n    // replica-stable signer — a per-process random secret silently breaks the\n    // OAuth callback on any replica that didn't sign the state. Fail loud now\n    // instead. (The built-ins also assert this inside their readiness gates.)\n    for (const { integration } of integrationRegistrations) {\n      if (integration.requiresStableStateSigner && !stateSigner.stable) {\n        throw new Error(\n          `MastraFactory: integration '${integration.id}' signs OAuth state and requires a ` +\n            `replica-stable state secret, but none is configured. Set 'stateSecret' on the factory config.`,\n        );\n      }\n    }\n\n    // The SDK needs to know which backend the injected Mastra store uses\n    // (its own `instanceof` detection breaks when the dependency graph holds\n    // duplicate package copies). Resolve it by walking the FactoryStorage\n    // prototype chain by class name — the factory can't import the concrete\n    // classes since '@mastra/pg' / '@mastra/libsql' are the user's choice.\n    const mastraStorageBackend = (() => {\n      for (let proto = Object.getPrototypeOf(storage); proto; proto = Object.getPrototypeOf(proto)) {\n        if (proto.constructor?.name === 'PgFactoryStorage') return 'pg' as const;\n        if (proto.constructor?.name === 'LibSQLFactoryStorage') return 'libsql' as const;\n      }\n      return undefined;\n    })();\n\n    // Integrations contributing tools to agent sessions: org-scoped\n    // `agentTools` (resolved per request) + session-scoped `sessionTools`.\n    const toolIntegrations = integrationRegistrations.filter(\n      ({ integration }) => integration.agentTools || integration.sessionTools,\n    );\n\n    // Build the real production controller (agents, modes, tools, memory, OM,\n    // MCP, providers) — identical to the terminal app. Agent state lives in\n    // the storage backend's Mastra store alongside the Factory app tables —\n    // one shared database for all users, separated by `resourceId` scoping.\n    const prepared = await timedPhase('prepare.controllerMount', () =>\n      prepareAgentControllerMount({\n        controllerId: CONTROLLER_ID,\n        workspace: createWorkspaceFactory({\n          ...(this.#config.sandbox ? { sandbox: this.#config.sandbox } : {}),\n          ...(githubIntegration ? { github: githubIntegration } : {}),\n          ...(workItemsStorage ? { workItems: workItemsStorage } : {}),\n          fleet,\n          workspaceRegistry,\n        }),\n        disableGithubSignals: true,\n        // Memory settings live in the factory's `memory-settings` app table (per\n        // org/user), so the host machine's TUI settings.json must not seed them.\n        disableSettingsOmSeed: true,\n        // A factory reads the repository it works on and its skill, never the\n        // ~/.claude instructions of whoever hosts the process. On the controller\n        // rather than per session, so webhook-recreated sessions keep it too.\n        // Factory sessions start fail-closed on org classification: the\n        // unresolved marker is set at birth, a successful org seed clears it,\n        // and a resolved `factoryOrgId` always takes precedence — so a failed\n        // (best-effort) seed can never leave a session classified as local.\n        initialState: { skipGlobalInstructions: true, factoryOrgUnresolved: true },\n        storage: storage.getMastraStorage(),\n        ...(mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {}),\n        ...(factoryProcessor ? { inputProcessors: [factoryProcessor] } : {}),\n        ...(vector ? { vector } : {}),\n        ...(toolIntegrations.length > 0 || (workItemsStorage && transitionService)\n          ? {\n              extraTools: async ({ requestContext }: { requestContext: RequestContext }) => {\n                const tools: IntegrationTools = {};\n                const toolOwners = new Map<string, string>();\n                const mergeTools = (ownerId: string, contributed: IntegrationTools) => {\n                  for (const [name, tool] of Object.entries(contributed)) {\n                    const owner = toolOwners.get(name);\n                    if (owner) {\n                      throw new Error(\n                        `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`,\n                      );\n                    }\n                    toolOwners.set(name, ownerId);\n                    tools[name] = tool;\n                  }\n                };\n                if (workItemsStorage && transitionService) {\n                  mergeTools(\n                    'factory',\n                    await createFactoryTransitionTools({\n                      requestContext,\n                      storage: workItemsStorage,\n                      transitionService,\n                      // Heals crash-resumed sessions: recovered addresses re-seed\n                      // projectRepositoryId/baseRef from the source session record.\n                      // Only offered while the source-control domain is ready — a\n                      // throwing lookup would abort recovery's catch block and also\n                      // skip the metadata baseRef fallback.\n                      ...(storage.isDomainReady('source-control')\n                        ? { sessions: sourceControlStorage.forIntegration('github').sessions }\n                        : {}),\n                    }),\n                  );\n                }\n                for (const { integration, ready, ensureReady } of toolIntegrations) {\n                  if (!ready && ensureReady) {\n                    try {\n                      await ensureReady();\n                    } catch {\n                      continue;\n                    }\n                  }\n                  if (integration.agentTools) {\n                    mergeTools(integration.id, await integration.agentTools({ requestContext }));\n                  }\n                  if (integration.sessionTools) {\n                    mergeTools(integration.id, integration.sessionTools({ requestContext }));\n                  }\n                }\n                return tools;\n              },\n            }\n          : {}),\n        postToolObserver: async (toolContext: IntegrationPostToolContext) => {\n          const requestContext = (toolContext.context as { requestContext?: RequestContext } | undefined)\n            ?.requestContext;\n          if (requestContext) {\n            await observeAgentGitAction({\n              audit: auditDomain,\n              toolContext: { ...toolContext, context: requestContext },\n            });\n          }\n          await Promise.all(\n            integrations.map(async integration => {\n              if (!integration.postToolObserver) return;\n              try {\n                await integration.postToolObserver({ toolContext, requestContext });\n              } catch (error) {\n                console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);\n              }\n            }),\n          );\n        },\n        ...(pubsub ? { pubsub, crossProcessPubSub: true } : {}),\n        buildApiRoutes: ({ controller, authStorage }: BuildApiRoutesDeps) => [\n          // Public `/auth/*` routes (login/callback/logout/me). Folded in as\n          // `apiRoutes` (not plain Hono routes) because the entry can't touch the\n          // Hono app the deployer generates. `requiresAuth: false`; the gate\n          // skips `/auth/*`.\n          ...(auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : []),\n          // Custom `/web/*` routes (fs / config / integrations / factory / audit).\n          ...assembleFactoryApiRoutes({\n            controllerId: CONTROLLER_ID,\n            controller,\n            auth: routeAuth,\n            ...(auth && isUserProvider(auth) ? { users: auth } : {}),\n            authStorage,\n            audit: auditDomain,\n            publicOrigin,\n            stateSigner,\n            fleet,\n            ...(baseCheckpoints ? { baseCheckpoints } : {}),\n            sessionRetirement,\n            factoryStorage: storage,\n            integrationStorage,\n            sourceControlStorage,\n            domains,\n            integrations: integrationRegistrations,\n            intakeReady,\n            factoryReady,\n            knowledgeEnabled,\n            rules,\n            factoryTransitionService: transitionService,\n            onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {\n              this.#dispatcher ??= new FactoryDecisionDispatcher({\n                controller,\n                transitionService: runtimeTransitionService,\n                storage: storage.getDomain<WorkItemsStorage>('work-items'),\n                maxInFlight: this.#config.dispatcher?.maxInFlight,\n                isAutoRunEnabled: async ({ orgId, factoryProjectId }) => {\n                  await factoryProjectsStorage.ensureReady();\n                  const project = await factoryProjectsStorage.get({ orgId, id: factoryProjectId });\n                  return project?.autoRunEnabled ?? false;\n                },\n                reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n                prepareBinding,\n                feedReader: new FactoryFeedReader(workItemCommentsStorage),\n                primeCredentials: tenant => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage }),\n                resolveLinkedWorkItemParentId: async ({ orgId, decision }) => {\n                  if (decision.source !== 'github-pr') return null;\n                  const repositoryId = decision.metadata?.githubRepositoryId;\n                  const pullRequestNumber = decision.metadata?.githubPullRequestNumber;\n                  if (typeof repositoryId !== 'number' || typeof pullRequestNumber !== 'number') return null;\n                  return resolveFactoryPullRequestParentWorkItemId(\n                    integrationStorage.forIntegration<\n                      Record<string, unknown>,\n                      Record<string, unknown>,\n                      FactoryPullRequestProvenanceData\n                    >('github'),\n                    { orgId, repositoryId, pullRequestNumber },\n                  );\n                },\n              });\n            },\n          }),\n          ...projectRoutes.routes(),\n          ...auditDomain.routes(),\n          ...commentsDomain.routes(),\n        ],\n        buildServerConfig: () => {\n          const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};\n          // Log route errors with method/path/stack and answer with structured\n          // JSON instead of an opaque `Internal Server Error`. Applied by the\n          // deployer to both the top-level app and the custom-route sub-app.\n          const onError = { onError: handleServerError };\n          // Same-origin SPA: when a vite build is present (see resolveUiDistDir),\n          // serve it at `/` from this server. Mounted last so the auth gate (when\n          // enabled) covers it; it always passes `/api`, `/web`, `/auth` through.\n          const uiDist = resolveUiDistDir();\n          const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];\n          if (!auth) {\n            // Auth disabled: no gate. Still prime the sentinel-local custom\n            // provider snapshot so model calls see DB rows, then SPA + CORS.\n            return {\n              middleware: [\n                createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),\n                ...spa,\n              ],\n              ...cors,\n              ...onError,\n            };\n          }\n\n          // Ordered middleware. The deployer applies these AFTER its context\n          // middleware sets `c.set('mastra', mastra)` and BEFORE routes, so:\n          //   1. gate   — validates the auth session, stashes the user, and 401s /\n          //               redirects unauthenticated requests. Skips public `/auth/*`.\n          //   2. primers — hydrate the caller's model-credential and custom\n          //               provider snapshots so the request's first model call\n          //               resolves tenant credentials and custom providers.\n          //   3. spa    — serves the built UI for everything the server doesn't own.\n          // `auth` also lands on `server.auth` so the core auth middleware (and\n          // Studio's dual-auth routing — see `studio.auth` on the returned args)\n          // authenticates core `/api/*` routes with the same provider.\n          return {\n            auth,\n            middleware: [\n              createFactoryAuthGate(auth),\n              createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),\n              createCustomProvidersPrimer({\n                auth: routeAuth,\n                storage: customProvidersStorage,\n                authEnabled: Boolean(auth),\n              }),\n              ...spa,\n            ],\n            ...cors,\n            ...onError,\n          };\n        },\n      }),\n    );\n\n    prepared.base.controller.onSessionCreated(session => {\n      observeSessionFilesystem(session, {\n        filesystem: filesystemStorage,\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionCheckpoint(session);\n      observeSessionFirstMessage(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionFirstExec(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionThreadTitle(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n    });\n\n    // Blocking: `createSession` awaits this seed, so when hydration succeeds\n    // a session's first run starts with the owner's stored OM settings.\n    // Best-effort — failures are logged inside the helper, never thrown, and\n    // the session then falls back to its persisted/default OM configuration.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionMemorySettings(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          memorySettings: memorySettingsStorage,\n        }),\n      { blocking: true },\n    );\n\n    // Personal model packs seed interactive user sessions only. Active Factory\n    // run bindings are excluded and continue to use the project default model.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionModelPack(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          workItems: workItemsStorage,\n          modelPacks: modelPacksStorage,\n        }),\n      { blocking: true },\n    );\n\n    this.#prepared = prepared;\n    this.#factoryProcessor = factoryProcessor;\n\n    // Chat-platform channels (Slack, Discord, …) contributed by integrations,\n    // attached to the mounted controller so inbound platform messages reach\n    // the same agents the web UI drives. READY integrations only — readiness\n    // means the `channel-identity` domain's `init()` succeeded, so its link\n    // table is queryable. Without it a sender can't be resolved to a tenant,\n    // and attaching anyway would dispatch runs on default credentials.\n    const channelRegistrations = integrationRegistrations.filter(\n      ({ integration, ready }) => ready && integration.channels,\n    );\n    // `setChannels` replaces rather than merges, so a second provider would\n    // silently never receive a message. Fail loud instead.\n    if (channelRegistrations.length > 1) {\n      throw new Error(\n        `MastraFactory: integrations [${channelRegistrations\n          .map(({ integration }) => integration.id)\n          .join(', ')}] all provide channels, but only one may. Remove all but one.`,\n      );\n    }\n    for (const { integration } of channelRegistrations) {\n      // Integrations return a channels CONFIG; the factory owns construction.\n      prepared.base.controller.setChannels(\n        new AgentControllerChannels(\n          integration.channels!(\n            buildIntegrationContext(\n              {\n                controller: prepared.base.controller,\n                publicOrigin,\n                auth: routeAuth,\n                stateSigner,\n                fleet,\n                ...(baseCheckpoints ? { baseCheckpoints } : {}),\n                factoryStorage: storage,\n                integrationStorage,\n                sourceControlStorage,\n                rules,\n                factoryReady,\n                domains,\n                ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n              },\n              integration.id,\n            ),\n          ),\n        ),\n      );\n    }\n\n    // Integration lifecycle workers (e.g. polling an upstream without\n    // webhooks): collected from READY integrations only, folded into the\n    // constructor args so `new Mastra(...)` merges them with the default\n    // workers and `finalize()`'s `startWorkers()` starts them alongside the\n    // built-ins. Never passed for the disabled/not-ready case — a worker for\n    // an unavailable integration must not run.\n    const integrationWorkers = integrationRegistrations\n      .filter(({ integration, ready }) => ready && integration.workers)\n      .flatMap(({ integration }) =>\n        integration.workers!(\n          buildIntegrationContext(\n            {\n              controller: prepared.base.controller,\n              publicOrigin,\n              auth: routeAuth,\n              stateSigner,\n              fleet,\n              ...(baseCheckpoints ? { baseCheckpoints } : {}),\n              factoryStorage: storage,\n              integrationStorage,\n              sourceControlStorage,\n              rules,\n              factoryReady,\n              domains,\n              ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n            },\n            integration.id,\n          ),\n        ),\n      );\n\n    return {\n      ...prepared.mastraArgs,\n      // Same provider on `studio.auth` as on `server.auth` (buildServerConfig):\n      // deployed factories must authenticate BOTH plain API callers and Studio\n      // requests (`x-mastra-client-type: studio` routes to `studio.auth`).\n      ...(auth ? { studio: { auth } } : {}),\n      ...(integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}),\n    };\n  }\n\n  /**\n   * Post-construct boot: initialize the controller (which inherits the\n   * constructed Mastra's storage) and start its workers. Call AFTER the entry\n   * has run `new Mastra(prepare()'s args)`.\n   */\n  async finalize(): Promise<void> {\n    if (!this.#prepared) {\n      throw new Error('MastraFactory.finalize() called before prepare()');\n    }\n    await timedPhase('finalize.controller', () => this.#prepared!.finalize());\n    await timedPhase(\n      'finalize.reconcileBoundThreads',\n      () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n    );\n    this.#dispatcher?.start();\n  }\n\n  /** Stop Factory-owned background dispatch before the host process shuts down. */\n  async shutdown(): Promise<void> {\n    await this.#dispatcher?.stop();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2OA,MAAM,gBAAgB;AAEtB,SAAS,yBAAkC;CAIzC,OAAO,QAAQ,QAAQ,IAAI,8BAA8B,KAAK,KAAK,QAAQ,IAAI,4BAA4B,KAAK,CAAC;AACnH;;;;;;;AAQA,SAAS,yBAAyB,SAA+C;CAC/E,MAAM,KAAM,QAA2C;CACvD,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,IAAI,KAAK,KAAA;AACxD;AAEA,SAAS,0BAA0B,SAA2B,mBAAoC;CAChG,MAAM,iBAAiB,yBAAyB,OAAO;CAGvD,SADE,sBAAsB,gBAAgB,iBAAiB,iBAAkB,qBAAqB,mBAC7E,aAAA,CAAc,QAAQ,QAAQ,EAAE;AACrD;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,WAAwC;CACtE,OAAO,IAAI,iBAAiB,EAC1B,cAAc,0BAA0B,SAAS,EACnD,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,MAAM,gCAAgC,CAAC,gBAAgB,WAAW;AAElE,SAAS,YAAY,UAA2B;CAI9C,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO;CACnC,OAAO,oBAAoB,KAAK,QAAQ;AAC1C;AAEA,SAAS,0BAA0B,WAAuC;CACxE,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,SAAS,CAAC,CAAC,SAAS,YAAY;CACrD,QAAQ;EACN;CACF;CACA,IAAI,aAAa,eAAe,YAAY,QAAQ,GAAG,OAAO,KAAA;CAC9D,KAAK,MAAM,UAAU,+BAA+B;EAGlD,IAAI,aAAa,QAAQ,OAAO,KAAA;EAChC,IAAI,SAAS,SAAS,IAAI,QAAQ,GAAG,OAAO,IAAI;CAClD;AAEF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CACA;CACA;CACA;CACA,aAAa;CAEb,YAAY,QAA6B;EACvC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,oOAGF;EAEF,KAAKA,UAAU;CACjB;;;;;;CAOA,MAAM,UAA+B;EAInC,IAAI,KAAKC,YAAY,MAAM,IAAI,MAAM,sCAAsC;EAC3E,KAAKA,aAAa;EAElB,MAAM,gBAAgB,KAAKD,QAAQ,aAAa,wBAAA,CAAyB,QAAQ,QAAQ,EAAE;EAC3F,MAAM,kBAAkB,KAAKA,QAAQ,kBAAkB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO;EACzG,MAAM,UAAU,KAAKA,QAAQ;EAC7B,MAAM,SAAS,KAAKA,QAAQ;EAC5B,MAAM,SAAS,KAAKA,QAAQ;EAM5B,MAAM,iBAAiB,KAAKA,QAAQ;EACpC,MAAM,OACJ,mBAAmB,OAAO,KAAA,IAAa,kBAAkB,uBAAuB,YAAY;EAC9F,IAAI,QAAQ,CAAC,KAAKA,QAAQ,kBACxB,QAAQ,KACN,kRAGF;EAEF,MAAM,mBAAmB,KAAKA,QAAQ,oBAAoB,uCAAuC;EAGjG,MAAM,YAAY,uBAAuB,IAAI;EAI7C,MAAM,eAAe,CAAC,GAAI,KAAKA,QAAQ,gBAAgB,CAAC,CAAE;EAC1D,IAAI,uBAAuB,GAAG;GAC5B,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,EAAE,MAAM,KAAKA,QAAQ,UAAU,cAAc,CAAC,CAAC;GAEjG,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,CAAC;EAErD;EAIA,MAAM,iCAAiB,IAAI,IAAY;EACvC,KAAK,MAAM,eAAe,cAAc;GACtC,IAAI,eAAe,IAAI,YAAY,EAAE,GACnC,MAAM,IAAI,MAAM,4CAA4C,YAAY,GAAG,qBAAqB;GAElG,eAAe,IAAI,YAAY,EAAE;EACnC;EACA,MAAM,QAAQ,KAAKA,QAAQ,SAAS,oBAAoB;EACxD,mBAAmB,KAAK;EAIxB,MAAM,gBAAgB,QAAQ,eAAe,IAAI,cAAc,CAAC;EAChE,MAAM,eAAe,QAAQ,eAAe,IAAI,aAAa,CAAC;EAC9D,MAAM,mBAAmB,QAAQ,eAAe,IAAI,iBAAiB,CAAC;EACtE,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,gBAAgB,CAAC;EACpG,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,wBAAwB,QAAQ,eAAe,IAAI,sBAAsB,CAAC;EAChF,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,gBAAgB,CAAC;EAClG,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,CAAC;EAG1E,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,gBAAgB,CAAC;EAC1F,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,uBAAuB,QAAQ,eAAe,IAAI,qBAAqB,CAAC;EAG9E,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAGpF,MAAM,UAAU;GACd,QAAQ;GACR,kBAAkB;GAClB,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;GACjB,YAAY;GACZ,UAAU;GACV,aAAa;GACb,WAAW;GACX,iBAAiB;GACjB,UAAU;EACZ;EAGA,IAAI;EACJ,MAAM,cAAc,IAAI,YAAY;GAClC,MAAM;GACN,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,eAAe,IAAI,IAAI,OAAO,KAAA;GAC7C,OAAO;GACP,cAAa,mBAAkB;IAC7B,MAAM,OAAO,8BAA8B,cAAc;IACzD,OAAO;KAAE,OAAO,oBAAoB,IAAI;KAAG,QAAQ,qBAAqB,IAAI;IAAE;GAChF;EACF,CAAC;EACD,MAAM,iBAAiB,IAAI,eAAe;GACxC,MAAM;GACN,UAAU;GACV,WAAW;GACX,UAAU;GACV,iBAAiB;GACjB,OAAO;EACT,CAAC;EAKD,MAAM,gBAAgB,KAAKA,QAAQ;EACnC,MAAM,UAAU,eAAe;EAC/B,IAAI,WAAW,OAAO,QAAQ,UAAU,YACtC,MAAM,IAAI,MACR,4DAA4D,QAAQ,SAAS,qRAI/E;EAMF,MAAM,QAAQ,IAAI,aAChB,UACI;GACE;GACA,aAAa,0BAA0B,SAAS,eAAe,OAAO;GACtE,cAAc,eAAe;EAC/B,IACA,KAAA,CACN;EAGA,wBAAwB,KAAK;EAC7B,MAAM,oBAAoB,IAAI,yBAAyB;EAKvD,MAAM,cAAc,kBAAkB,KAAKA,QAAQ,WAAW;EAO9D,IAAI,QAAQ,YAAY,IAAI,GAC1B,MAAM,WAAW,2BACf,KAAK,KAAK;GAAE,UAAU,QAAQ,eAAe;GAAG,WAAW;GAAc;EAAe,CAAC,CAC3F;EAKF,MAAM,WAAW,8BAA8B,QAAQ,KAAK,CAAC;EAY7D,IAAI,MACF,iCAAiC,uBAAuB;EAM1D,8BAA8B;GAAE,SAAS;GAAwB,aAAa,QAAQ,IAAI;EAAE,CAAC;EAE7F,KAAK,MAAM,eAAe,cAAc;GACtC,YAAY,aAAa;IACvB,SAAS,mBAAmB,eAAe,YAAY,EAAE;IACzD,UAAU;IACV,MAAM;GACR,CAAC;GACD,IAAI,YAAY,gBACd,YAAY,eAAe,WAAW,EACpC,SAAS,qBAAqB,eAAe,YAAY,EAAE,EAC7D,CAAC;EAEL;EAKA,MAAM,2BAA2B,aAAa,KAAI,gBAAe;GAC/D,MAAM,kBAAkB;IACtB;IACA,GAAI,YAAY,iBAAiB,CAAC,gBAAgB,IAAI,CAAC;IAGvD,GAAI,YAAY,WAAW,CAAC,kBAAkB,IAAI,CAAC;GACrD;GACA,OAAO;IACL;IACA,OAAO,gBAAgB,OAAM,WAAU,QAAQ,cAAc,MAAM,CAAC;IACpE,aAAa,YAAY;KACvB,KAAK,MAAM,UAAU,iBAAiB,MAAM,QAAQ,kBAAkB,MAAM;IAC9E;GACF;EACF,CAAC;EACD,MAAM,cACJ,aAAa,MAAK,gBAAe,YAAY,WAAW,KAAA,CAAS,KAAK,QAAQ,cAAc,QAAQ;EACtG,MAAM,eAAe,QAAQ,cAAc,UAAU,KAAK,QAAQ,cAAc,YAAY;EAC5F,MAAM,mBAAmB,QAAQ,IAAI,yCAAyC;EAC9E,MAAM,oBAAoB,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ;EAOtF,IAAI,qBAAqB,MAAM,WAAW,QAAQ,cAAc,gBAAgB,GAAG;GACjF,MAAM,mBAAmB,EACvB,OAAO,YAAoB,QAAQ,KAAK,aAAa,SAAS,EAChE;GACA,kBAAkB,6BAA6B;IAC7C,SAAS,IAAI,sBAAsB;KAAE;KAAO,QAAQ;IAAiB,CAAC;IACtE;IACA,QAAQ;KACN,sBAAsB,qBAAqB,eAAe,QAAQ;KAClE,GAAI,kBAAkB,iBAAiB,EAAE,gBAAgB,kBAAkB,eAAe,IAAI,CAAC;IACjG;IACA,QAAQ;GACV,CAAC;EACH;EACA,MAAM,iBAAiB,QAAQ,cAAc,YAAY;EACzD,MAAM,oBACJ,WAAW,QAAQ,cAAc,gBAAgB,IAC7C,IAAI,6BAA6B;GAC/B;GACA,oBAAmB,cAAa,kBAAkB,kBAAkB,SAAS;EAC/E,CAAC,IACD,KAAA;EACN,MAAM,yBACJ,qBAAqB,qBAAqB,iBACtC,OAAO,EAAE,OAAO,iBACd,kBAAkB,uBAAuB;GACvC,WAAW;GACX,eAAe,qBAAqB,eAAe,kBAAkB,EAAE;GACvE;GACA;EACF,CAAC,IACH,KAAA;EAMN,MAAM,kBAAkB,iBACpB,2BAA2B;GACzB,WAAW;GAGX,kBAAkB,OAAO,YAA2B;IAClD,MAAM,kBAAkB,iBAAiB,OAAO;GAClD;GAGA,GAAI,yBAAyB,EAAE,kBAAkB,uBAAuB,IAAI,CAAC;EAC/E,CAAC,IACD;EACJ,MAAM,oBAAoB,iBACtB,IAAI,yBAAyB;GAC3B;GACA,SAAS;GACT,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC/C,CAAC,IACD,KAAA;EACJ,MAAM,gBAAgB,IAAI,cAAc;GACtC,MAAM;GACN,UAAU;GACV,eAAe;GACf,8BAA8B,aAC3B,QAAO,gBAAe,YAAY,cAAc,CAAC,CACjD,KAAI,gBAAe,YAAY,EAAE;GACpC,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,iBAAiB,EAAE,WAAW,iBAAiB,IAAI,CAAC;GACxD,4BAA2B,SAAQ,iBAAiB,0BAA0B,IAAI;EACpF,CAAC;EACD,MAAM,mBAAmB,iBACrB,IAAI,2BAA2B;GAC7B;GACA,SAAS;GACT,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,oBACA,EACE,8BAA8B,UAC5B,mCACE,mBACA,qBAAqB,eAAe,QAAQ,GAC5C,mBAAmB,eAAe,QAAQ,GAC1C,kBACA,KACF,EACJ,IACA,CAAC;GACL,eAAe,EACb,cAAc,OAAM,UAAS;IAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;KAAE,UAAU,CAAC;KAAG,SAAS;IAAM;GAC9E,EACF;EACF,CAAC,IACD,KAAA;EAMJ,KAAK,MAAM,EAAE,iBAAiB,0BAC5B,IAAI,YAAY,6BAA6B,CAAC,YAAY,QACxD,MAAM,IAAI,MACR,+BAA+B,YAAY,GAAG,iIAEhD;EASJ,MAAM,8BAA8B;GAClC,KAAK,IAAI,QAAQ,OAAO,eAAe,OAAO,GAAG,OAAO,QAAQ,OAAO,eAAe,KAAK,GAAG;IAC5F,IAAI,MAAM,aAAa,SAAS,oBAAoB,OAAO;IAC3D,IAAI,MAAM,aAAa,SAAS,wBAAwB,OAAO;GACjE;EAEF,EAAA,CAAG;EAIH,MAAM,mBAAmB,yBAAyB,QAC/C,EAAE,kBAAkB,YAAY,cAAc,YAAY,YAC7D;EAMA,MAAM,WAAW,MAAM,WAAW,iCAChC,4BAA4B;GAC1B,cAAc;GACd,WAAW,uBAAuB;IAChC,GAAI,KAAKA,QAAQ,UAAU,EAAE,SAAS,KAAKA,QAAQ,QAAQ,IAAI,CAAC;IAChE,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;IACzD,GAAI,mBAAmB,EAAE,WAAW,iBAAiB,IAAI,CAAC;IAC1D;IACA;GACF,CAAC;GACD,sBAAsB;GAGtB,uBAAuB;GAQvB,cAAc;IAAE,wBAAwB;IAAM,sBAAsB;GAAK;GACzE,SAAS,QAAQ,iBAAiB;GAClC,GAAI,uBAAuB,EAAE,gBAAgB,qBAAqB,IAAI,CAAC;GACvE,GAAI,mBAAmB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC;GAClE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,GAAI,iBAAiB,SAAS,KAAM,oBAAoB,oBACpD,EACE,YAAY,OAAO,EAAE,qBAAyD;IAC5E,MAAM,QAA0B,CAAC;IACjC,MAAM,6BAAa,IAAI,IAAoB;IAC3C,MAAM,cAAc,SAAiB,gBAAkC;KACrE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GAAG;MACtD,MAAM,QAAQ,WAAW,IAAI,IAAI;MACjC,IAAI,OACF,MAAM,IAAI,MACR,oCAAoC,KAAK,UAAU,QAAQ,oBAAoB,MAAM,GACvF;MAEF,WAAW,IAAI,MAAM,OAAO;MAC5B,MAAM,QAAQ;KAChB;IACF;IACA,IAAI,oBAAoB,mBACtB,WACE,WACA,MAAM,6BAA6B;KACjC;KACA,SAAS;KACT;KAMA,GAAI,QAAQ,cAAc,gBAAgB,IACtC,EAAE,UAAU,qBAAqB,eAAe,QAAQ,CAAC,CAAC,SAAS,IACnE,CAAC;IACP,CAAC,CACH;IAEF,KAAK,MAAM,EAAE,aAAa,OAAO,iBAAiB,kBAAkB;KAClE,IAAI,CAAC,SAAS,aACZ,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN;KACF;KAEF,IAAI,YAAY,YACd,WAAW,YAAY,IAAI,MAAM,YAAY,WAAW,EAAE,eAAe,CAAC,CAAC;KAE7E,IAAI,YAAY,cACd,WAAW,YAAY,IAAI,YAAY,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3E;IACA,OAAO;GACT,EACF,IACA,CAAC;GACL,kBAAkB,OAAO,gBAA4C;IACnE,MAAM,iBAAkB,YAAY,SAChC;IACJ,IAAI,gBACF,MAAM,sBAAsB;KAC1B,OAAO;KACP,aAAa;MAAE,GAAG;MAAa,SAAS;KAAe;IACzD,CAAC;IAEH,MAAM,QAAQ,IACZ,aAAa,IAAI,OAAM,gBAAe;KACpC,IAAI,CAAC,YAAY,kBAAkB;KACnC,IAAI;MACF,MAAM,YAAY,iBAAiB;OAAE;OAAa;MAAe,CAAC;KACpE,SAAS,OAAO;MACd,QAAQ,KAAK,0BAA0B,YAAY,GAAG,+BAA+B,KAAK;KAC5F;IACF,CAAC,CACH;GACF;GACA,GAAI,SAAS;IAAE;IAAQ,oBAAoB;GAAK,IAAI,CAAC;GACrD,iBAAiB,EAAE,YAAY,kBAAsC;IAKnE,GAAI,OAAO,gBAAgB,MAAM,EAAE,WAAW,aAAa,CAAC,IAAI,CAAC;IAEjE,GAAG,yBAAyB;KAC1B,cAAc;KACd;KACA,MAAM;KACN,GAAI,QAAQ,eAAe,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KACtD;KACA,OAAO;KACP;KACA;KACA;KACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;KAC7C;KACA,gBAAgB;KAChB;KACA;KACA;KACA,cAAc;KACd;KACA;KACA;KACA;KACA,0BAA0B;KAC1B,mBAAmB,EAAE,mBAAmB,0BAA0B,qBAAqB;MACrF,KAAKE,gBAAgB,IAAI,0BAA0B;OACjD;OACA,mBAAmB;OACnB,SAAS,QAAQ,UAA4B,YAAY;OACzD,aAAa,KAAKF,QAAQ,YAAY;OACtC,kBAAkB,OAAO,EAAE,OAAO,uBAAuB;QACvD,MAAM,uBAAuB,YAAY;QAEzC,QAAO,MADe,uBAAuB,IAAI;SAAE;SAAO,IAAI;QAAiB,CAAC,EAAA,EAChE,kBAAkB;OACpC;OACA,4BAA4B,kBAAkB,yBAAyB,KAAK,QAAQ,QAAQ;OAC5F;OACA,YAAY,IAAI,kBAAkB,uBAAuB;OACzD,mBAAkB,WAAU,uBAAuB;QAAE;QAAQ,aAAa;OAAwB,CAAC;OACnG,+BAA+B,OAAO,EAAE,OAAO,eAAe;QAC5D,IAAI,SAAS,WAAW,aAAa,OAAO;QAC5C,MAAM,eAAe,SAAS,UAAU;QACxC,MAAM,oBAAoB,SAAS,UAAU;QAC7C,IAAI,OAAO,iBAAiB,YAAY,OAAO,sBAAsB,UAAU,OAAO;QACtF,OAAO,0CACL,mBAAmB,eAIjB,QAAQ,GACV;SAAE;SAAO;SAAc;QAAkB,CAC3C;OACF;MACF,CAAC;KACH;IACF,CAAC;IACD,GAAG,cAAc,OAAO;IACxB,GAAG,YAAY,OAAO;IACtB,GAAG,eAAe,OAAO;GAC3B;GACA,yBAAyB;IACvB,MAAM,OAAO,eAAe,SAAS,EAAE,MAAM;KAAE,QAAQ;KAAgB,aAAa;IAAK,EAAE,IAAI,CAAC;IAIhG,MAAM,UAAU,EAAE,SAAS,kBAAkB;IAI7C,MAAM,SAAS,iBAAiB;IAChC,MAAM,MAAM,SAAS,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAGH,OAAO;KACL,YAAY,CACV,4BAA4B;MAAE,MAAM;MAAW,SAAS;MAAwB,aAAa;KAAM,CAAC,GACpG,GAAG,GACL;KACA,GAAG;KACH,GAAG;IACL;IAcF,OAAO;KACL;KACA,YAAY;MACV,sBAAsB,IAAI;MAC1B,6BAA6B;OAAE,MAAM;OAAW,aAAa;MAAwB,CAAC;MACtF,4BAA4B;OAC1B,MAAM;OACN,SAAS;OACT,aAAa,QAAQ,IAAI;MAC3B,CAAC;MACD,GAAG;KACL;KACA,GAAG;KACH,GAAG;IACL;GACF;EACF,CAAC,CACH;EAEA,SAAS,KAAK,WAAW,kBAAiB,YAAW;GACnD,yBAAyB,SAAS;IAChC,YAAY;IACZ,eAAe,qBAAqB,eAAe,QAAQ;GAC7D,CAAC;GACD,yBAAyB,OAAO;GAChC,2BAA2B,SAAS,EAClC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,wBAAwB,SAAS,EAC/B,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,0BAA0B,SAAS,EACjC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;EACH,CAAC;EAMD,SAAS,KAAK,WAAW,kBACvB,YACE,6BAA6B,SAAS;GACpC,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,gBAAgB;EAClB,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAIA,SAAS,KAAK,WAAW,kBACvB,YACE,wBAAwB,SAAS;GAC/B,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,WAAW;GACX,YAAY;EACd,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAEA,KAAKG,YAAY;EACjB,KAAKC,oBAAoB;EAQzB,MAAM,uBAAuB,yBAAyB,QACnD,EAAE,aAAa,YAAY,SAAS,YAAY,QACnD;EAGA,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,gCAAgC,qBAC7B,KAAK,EAAE,kBAAkB,YAAY,EAAE,CAAC,CACxC,KAAK,IAAI,EAAE,8DAChB;EAEF,KAAK,MAAM,EAAE,iBAAiB,sBAE5B,SAAS,KAAK,WAAW,YACvB,IAAI,wBACF,YAAY,SACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA;GACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;GAC7C,gBAAgB;GAChB;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EAChE,GACA,YAAY,EACd,CACF,CACF,CACF;EASF,MAAM,qBAAqB,yBACxB,QAAQ,EAAE,aAAa,YAAY,SAAS,YAAY,OAAO,CAAC,CAChE,SAAS,EAAE,kBACV,YAAY,QACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA;GACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;GAC7C,gBAAgB;GAChB;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EAChE,GACA,YAAY,EACd,CACF,CACF;EAEF,OAAO;GACL,GAAG,SAAS;GAIZ,GAAI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;GACnC,GAAI,mBAAmB,SAAS,IAAI,EAAE,SAAS,mBAAmB,IAAI,CAAC;EACzE;CACF;;;;;;CAOA,MAAM,WAA0B;EAC9B,IAAI,CAAC,KAAKD,WACR,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,WAAW,6BAA6B,KAAKA,UAAW,SAAS,CAAC;EACxE,MAAM,WACJ,wCACM,KAAKC,mBAAmB,yBAAyB,KAAK,QAAQ,QAAQ,CAC9E;EACA,KAAKF,aAAa,MAAM;CAC1B;;CAGA,MAAM,WAA0B;EAC9B,MAAM,KAAKA,aAAa,KAAK;CAC/B;AACF"}
+{"version":3,"file":"factory.js","names":["#config","#preparing","#dispatcher","#prepared","#factoryProcessor"],"sources":["../src/factory.ts"],"sourcesContent":["/**\n * `MastraFactory` — the single entry point to the whole Mastra Software Factory.\n *\n * The consumer's deploy entry constructs deployment-specific config instances\n * (auth adapter, pubsub) and passes them here explicitly. The only provider\n * defaults constructed here are Platform GitHub and Linear integrations when\n * Platform credentials exist and the caller did not provide those integrations.\n *\n * `prepare()` resolves feature readiness, threads every dependency explicitly,\n * assembles the web routes/middleware, and returns the constructor args for\n * `new Mastra(...)`. The literal `export const mastra = new Mastra(...)` must\n * stay in the entry file — the deployer's `checkConfigExport` Babel plugin\n * only marks the config valid when it finds that literal in the entry AST —\n * so the factory produces args instead of the instance. `finalize()` runs the\n * post-construct boot (controller init + workers).\n *\n * Integration readiness is derived from each instance's declared capabilities\n * and the storage domains those capabilities require.\n */\n\nimport { MastraAuthStudio } from '@mastra/auth-studio';\nimport { prepareAgentControllerMount } from '@mastra/code-sdk';\nimport { AgentControllerChannels } from '@mastra/core/channels';\nimport type { PubSub } from '@mastra/core/events';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { hasAuthInit, isUserProvider } from '@mastra/core/server';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport {\n  buildAuthRoutes,\n  createFactoryAuthGate,\n  createFactoryRouteAuth,\n  getFactoryAuthOrgId,\n  getFactoryAuthUserFromContext,\n  getFactoryAuthUserId,\n} from './auth.js';\nimport type { FactoryIntegration, IntegrationPostToolContext, IntegrationTools } from './integrations/base.js';\nimport type { GithubIntegration } from './integrations/github/integration.js';\nimport {\n  recordFactoryPullRequestProvenance,\n  resolveFactoryPullRequestParentWorkItemId,\n} from './integrations/github/provenance.js';\nimport type { FactoryPullRequestProvenanceData } from './integrations/github/provenance.js';\nimport { PlatformGithubIntegration } from './integrations/platform/github/integration.js';\nimport { PlatformLinearIntegration } from './integrations/platform/linear/integration.js';\nimport { createCustomProvidersPrimer, registerCustomProvidersSource } from './routes/custom-provider-source.js';\nimport { ProjectRoutes } from './routes/projects.js';\nimport { assembleFactoryApiRoutes, buildIntegrationContext } from './routes/surface.js';\nimport type { FactoryApiRoutesDeps } from './routes/surface.js';\nimport {\n  createTenantCredentialPrimer,\n  primeTenantCredentials,\n  registerTenantCredentialResolver,\n} from './routes/tenant-credentials.js';\nimport { builtInFactoryRules } from './rules/defaults.js';\nimport { FactoryDecisionDispatcher } from './rules/dispatcher.js';\nimport { FactoryPhaseStateProcessor } from './rules/processor.js';\nimport { createTerminalStageCleanup } from './rules/terminal-cleanup.js';\nimport { createFactoryTransitionTools } from './rules/tools.js';\nimport { FactoryTransitionService } from './rules/transition-service.js';\nimport type { FactoryRules } from './rules/types.js';\nimport { assertFactoryRules } from './rules/validation.js';\nimport { SessionRetirementCoordinator } from './sandbox/session-retirement.js';\nimport type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';\nimport { createPlaintextFactorySecretEncryption } from './secret-encryption.js';\nimport type { FactorySecretEncryption } from './secret-encryption.js';\nimport { handleServerError } from './server-error.js';\nimport { observeSessionCheckpoint } from './session/checkpoint-capture.js';\nimport { observeSessionFilesystem } from './session/filesystem-capture.js';\nimport { observeSessionFirstExec } from './session/first-exec-capture.js';\nimport { observeSessionFirstMessage } from './session/first-message-capture.js';\nimport { hydrateSessionMemorySettings } from './session/memory-settings-hydration.js';\nimport { hydrateSessionModelPack } from './session/model-pack-hydration.js';\nimport { observeSessionThreadTitle } from './session/thread-title-mirror.js';\nimport { createSpaStaticMiddleware, resolveUiDistDir } from './spa-static.js';\nimport { createStateSigner } from './state-signing.js';\nimport { observeAgentGitAction } from './storage/domains/audit/agent-audit.js';\nimport { AuditStorage } from './storage/domains/audit/base.js';\nimport { AuditDomain } from './storage/domains/audit/domain.js';\nimport { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';\nimport { WorkItemCommentsStorage } from './storage/domains/comments/base.js';\nimport { CommentsDomain } from './storage/domains/comments/domain.js';\nimport { FactoryFeedReader } from './storage/domains/comments/feed-context.js';\nimport { ModelCredentialsStorage } from './storage/domains/credentials/base.js';\nimport { CustomProvidersStorage } from './storage/domains/custom-providers/base.js';\nimport { FilesystemStorage } from './storage/domains/filesystem/base.js';\nimport { IntakeStorage } from './storage/domains/intake/base.js';\nimport { IntegrationStorage } from './storage/domains/integrations/base.js';\nimport { MemorySettingsStorage } from './storage/domains/memory-settings/base.js';\nimport { ModelPacksStorage } from './storage/domains/model-packs/base.js';\nimport { FactoryProjectsStorage } from './storage/domains/projects/base.js';\nimport { QueueHealthStorage } from './storage/domains/queue-health/base.js';\nimport { SourceControlStorage } from './storage/domains/source-control/base.js';\nimport { WorkItemsStorage } from './storage/domains/work-items/base.js';\nimport { timedPhase } from './timing.js';\nimport { createWorkspaceFactory, FactoryWorkspaceRegistry } from './workspace.js';\n\ntype BuildApiRoutesDeps = Pick<FactoryApiRoutesDeps, 'controller' | 'authStorage'>;\n\n/** Constructor args for the `new Mastra(...)` literal in the deploy entry. */\nexport type MastraArgs = NonNullable<ConstructorParameters<typeof Mastra>[0]>;\n\nexport interface MastraFactoryConfig {\n  /**\n   * Auth provider instance — `MastraAuthStudio` (`@mastra/auth-studio`),\n   * `MastraAuthWorkos` (`@mastra/auth-workos`), `MastraAuthBetterAuth`\n   * (`@mastra/auth-better-auth`), or any custom `MastraAuthProvider`. Whatever\n   * instance is passed is the active provider; a passed instance is always\n   * honored as-is.\n   *\n   * Omitted → the factory defaults to `MastraAuthStudio`, proxying auth\n   * through the shared Mastra platform API. `MastraAuthStudio` resolves its\n   * own env (`MASTRA_SHARED_API_URL`, `MASTRA_ORGANIZATION_ID`,\n   * `MASTRA_COOKIE_DOMAIN`).\n   *\n   * Pass `null` to disable auth entirely (open server, local-dev behavior)\n   * without falling back to the default.\n   */\n  auth?: IMastraAuthProvider | null;\n  /**\n   * REQUIRED. Factory storage backend powering BOTH agent storage (threads,\n   * messages, memory, OM — via `getMastraStorage()`) and the app tables\n   * (projects/source-control/audit/intake — via the generic ops surface). Pass a\n   * `PgFactoryStorage` (`@mastra/pg`) for deployments or a\n   * `LibSQLFactoryStorage` (`@mastra/libsql`) for local dev — one backend,\n   * one connection, every feature on.\n   */\n  storage: FactoryStorage;\n  /**\n   * Vector store instance for recall search — `PgVector` (`@mastra/pg`) on\n   * the same database as `storage`. Omitted → the SDK mount's default vector\n   * store resolution applies.\n   */\n  vector?: MastraVector;\n  /**\n   * Distributed event bus instance (e.g. `new RedisStreamsPubSub({ url })`).\n   * When set, streams/workflows/signals ride it across processes and the\n   * controller drops file-based thread locks in favor of pubsub-coordinated\n   * leases. Omitted → in-process default.\n   */\n  pubsub?: PubSub;\n  /**\n   * Browser-facing origin used to build integration OAuth/install callback\n   * URLs and to derive the auth redirect URI. On the platform the SPA is\n   * hosted separately, so this MUST be the public API origin.\n   * Default: `http://localhost:4111` (the local Factory server, which also\n   * serves the UI).\n   */\n  publicUrl?: string;\n  /**\n   * Allowed cross-origin SPA origins. The SPA may be served from a separate\n   * static host, so credentialed requests must be explicitly allowed.\n   */\n  allowedOrigins?: string[];\n  /** Sandbox configuration. Omitted → repository sandboxes are disabled. */\n  sandbox?: MastraFactorySandboxConfig;\n  /** Background Factory dispatcher configuration. */\n  dispatcher?: MastraFactoryDispatcherConfig;\n  /**\n   * Deployment-stable secret for signing integration OAuth `state` values.\n   * Omitted → a per-process random secret, which is fine for single-process\n   * local development but rejected for integrations that declare\n   * `requiresStableStateSigner`.\n   */\n  stateSecret?: string;\n  /**\n   * Encryption boundary for persisted model credentials, custom-provider API\n   * keys, integration connections, and integration settings. Strongly\n   * recommended whenever auth is enabled — omitting it falls back to explicit\n   * plaintext compatibility with a boot-time warning.\n   */\n  secretEncryption?: FactorySecretEncryption;\n  /**\n   * Registered capability providers. The factory registers the pieces each\n   * `FactoryIntegration` instance provides — HTTP routes, storage domains,\n   * agent/session tools, intake, source control, and diagnostics — into the\n   * system. When Platform credentials are configured, missing `github` and\n   * `linear` integrations default to their Platform-backed implementations.\n   */\n  integrations?: FactoryIntegration[];\n  /**\n   * Authoritative Factory board, tool-result, and GitHub-event rules. Construct\n   * with `defaultFactoryRules({ version, overrides })` so deployment policy has\n   * an explicit version and exact handler leaves replace rather than compose.\n   * Omitted → conservative built-in rules for the current deployment.\n   */\n  rules?: FactoryRules;\n\n  /**\n   * Platform-specific overrides. `githubAppSlug` identifies Factory's own\n   * GitHub App writes so their webhook deliveries do not retrigger triage.\n   */\n  platform?: {\n    githubAppSlug?: string;\n  };\n}\n\nexport type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';\n\n/**\n * Per-process cap on concurrent background Factory dispatches. Omitted means\n * the dispatcher default; this is a local replica budget, not a global queue\n * limit shared across deployments.\n */\nexport interface MastraFactoryDispatcherConfig {\n  maxInFlight?: number;\n}\n\nconst CONTROLLER_ID = 'code';\n\nfunction hasPlatformCredentials(): boolean {\n  // MASTRA_PLATFORM_ACCESS_TOKEN is the credential Mastra Platform injects\n  // into deployed projects; MASTRA_PLATFORM_SECRET_KEY is the org secret key\n  // written by project scaffolding. Either enables the platform integrations.\n  return Boolean(process.env.MASTRA_PLATFORM_ACCESS_TOKEN?.trim() || process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());\n}\n\n/**\n * Default auth provider — `MastraAuthStudio`, which proxies identity to the\n * shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,\n * `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —\n * this helper only derives a cookie-domain fallback from the factory's\n * `publicUrl`.\n *\n * Cookie-domain resolution (Studio picks the first that wins):\n *   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;\n *   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;\n *   3. this parent-domain fallback derived from `publicUrl` — so a deploy on\n *      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`\n *      without the caller wiring the env var by hand.\n *   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.\n */\nfunction buildDefaultStudioAuth(publicUrl: string): IMastraAuthProvider {\n  return new MastraAuthStudio({\n    cookieDomain: parentDomainFromPublicUrl(publicUrl),\n  });\n}\n\n/**\n * Derive a parent cookie domain from `publicUrl` by stripping the leftmost\n * label — the same shape platform-API's env injection uses (see\n * `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\\./, '')}`).\n *\n * Rather than a generic `strip-left-label` heuristic — which either emits\n * cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`\n * requires PSL data to be safe) or misclassifies numeric hostnames like\n * `3scale.example.com` as IPv4 — we only derive a parent domain when the\n * host sits under one of the platform's known registrable domains. Anything\n * else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)\n * falls through to host-only cookies. Callers that need a different scope\n * pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).\n */\nconst KNOWN_PLATFORM_COOKIE_PARENTS = ['mastra.cloud', 'mastra.ai'] as const;\n\nfunction isIpLiteral(hostname: string): boolean {\n  // IPv6 addresses in URLs are bracketed; `URL.hostname` strips the brackets\n  // but the address itself still contains `:`. IPv4 is four dot-separated\n  // numeric octets — trust the parser to have already validated shape.\n  if (hostname.includes(':')) return true;\n  return /^\\d+(?:\\.\\d+){3}$/.test(hostname);\n}\n\nfunction parentDomainFromPublicUrl(publicUrl: string): string | undefined {\n  let hostname: string;\n  try {\n    hostname = new URL(publicUrl).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (hostname === 'localhost' || isIpLiteral(hostname)) return undefined;\n  for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {\n    // Exact match → we're already on the parent, host-only is correct.\n    // Subdomain match → mint the parent-scoped cookie.\n    if (hostname === parent) return undefined;\n    if (hostname.endsWith(`.${parent}`)) return `.${parent}`;\n  }\n  return undefined;\n}\n\nexport class MastraFactory {\n  readonly #config: MastraFactoryConfig;\n  #prepared: Awaited<ReturnType<typeof prepareAgentControllerMount>> | undefined;\n  #dispatcher: FactoryDecisionDispatcher | undefined;\n  #factoryProcessor: FactoryPhaseStateProcessor | undefined;\n  #preparing = false;\n\n  constructor(config: MastraFactoryConfig) {\n    if (!config?.storage) {\n      throw new Error(\n        \"MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. \" +\n          \"new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or \" +\n          \"new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.\",\n      );\n    }\n    this.#config = config;\n  }\n\n  /**\n   * Resolve feature readiness, wire every dependency explicitly, and assemble\n   * everything needed to construct the server-owned Mastra. Returns the args\n   * for the `new Mastra(...)` literal that must live in the entry file.\n   */\n  async prepare(): Promise<MastraArgs> {\n    // Guard set synchronously (before the first await) so overlapping calls —\n    // not just strictly sequential ones — can't double-seed the runtime\n    // registry or double-run one-time adapter init.\n    if (this.#preparing) throw new Error('MastraFactory.prepare() called twice');\n    this.#preparing = true;\n\n    const publicOrigin = (this.#config.publicUrl ?? 'http://localhost:4111').replace(/\\/+$/, '');\n    const allowedOrigins = (this.#config.allowedOrigins ?? []).map(o => o.replace(/\\/+$/, '')).filter(Boolean);\n    const storage = this.#config.storage;\n    const vector = this.#config.vector;\n    const pubsub = this.#config.pubsub;\n    // Default auth: honor an explicitly-passed provider (including `null` to\n    // disable auth) as-is; otherwise fall back to `MastraAuthStudio`\n    // (platform-proxied identity). The default derives its cookie domain\n    // from `publicUrl` — deploys on `<sub>.mastra.cloud` mint parent-domain\n    // cookies without the caller wiring `MASTRA_COOKIE_DOMAIN` explicitly.\n    const configuredAuth = this.#config.auth;\n    const auth: IMastraAuthProvider | undefined =\n      configuredAuth === null ? undefined : (configuredAuth ?? buildDefaultStudioAuth(publicOrigin));\n    if (auth && !this.#config.secretEncryption) {\n      console.warn(\n        \"[factory] auth is enabled but 'secretEncryption' is not configured. Persisted model credentials, \" +\n          'custom-provider API keys, and integration secrets will be stored as plaintext. Provide ' +\n          \"'secretEncryption' (e.g. via FACTORY_CREDENTIAL_ENCRYPTION_KEY) to encrypt them at rest.\",\n      );\n    }\n    const secretEncryption = this.#config.secretEncryption ?? createPlaintextFactorySecretEncryption();\n    // One RouteAuth seam per boot, closed over the resolved provider. Every\n    // factory route module receives this handle — no service locator.\n    const routeAuth = createFactoryRouteAuth(auth);\n\n    // Explicit integrations win. Platform credentials fill only missing GitHub\n    // and Linear slots so callers can override either provider independently.\n    const integrations = [...(this.#config.integrations ?? [])];\n    if (hasPlatformCredentials()) {\n      if (!integrations.some(integration => integration.id === 'github')) {\n        integrations.push(new PlatformGithubIntegration({ slug: this.#config.platform?.githubAppSlug }));\n      }\n      if (!integrations.some(integration => integration.id === 'linear')) {\n        integrations.push(new PlatformLinearIntegration());\n      }\n    }\n\n    // Validate ids up front so a copy-paste duplicate fails loud instead of one\n    // instance silently shadowing the other.\n    const integrationIds = new Set<string>();\n    for (const integration of integrations) {\n      if (integrationIds.has(integration.id)) {\n        throw new Error(`MastraFactory: duplicate integration id '${integration.id}' in 'integrations'.`);\n      }\n      integrationIds.add(integration.id);\n    }\n    const rules = this.#config.rules ?? builtInFactoryRules();\n    assertFactoryRules(rules);\n\n    // FactoryStorage owns every app-table domain and initializes them through\n    // the same lifecycle as the backend connection.\n    const intakeStorage = storage.registerDomain(new IntakeStorage());\n    const auditStorage = storage.registerDomain(new AuditStorage());\n    const workItemsStorage = storage.registerDomain(new WorkItemsStorage());\n    const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage(secretEncryption));\n    const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());\n    const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());\n    const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage(secretEncryption));\n    const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());\n    // Generic integration storage (connections/subscriptions/settings) — the\n    // default persistence surface for integrations without a bespoke domain.\n    const integrationStorage = storage.registerDomain(new IntegrationStorage(secretEncryption));\n    const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());\n    const filesystemStorage = storage.registerDomain(new FilesystemStorage());\n    const sourceControlStorage = storage.registerDomain(new SourceControlStorage());\n    // Reverse index from a platform sender (Slack/Discord/...) to a Mastra\n    // tenant, so inbound channel events can resolve the sender's model creds.\n    const channelIdentityStorage = storage.registerDomain(new ChannelIdentityStorage());\n    const workItemCommentsStorage = storage.registerDomain(new WorkItemCommentsStorage());\n    // Every app-table domain handle the route builders and integrations need,\n    // threaded explicitly (no service locator).\n    const domains = {\n      intake: intakeStorage,\n      modelCredentials: modelCredentialsStorage,\n      modelPacks: modelPacksStorage,\n      memorySettings: memorySettingsStorage,\n      customProviders: customProvidersStorage,\n      filesystem: filesystemStorage,\n      projects: factoryProjectsStorage,\n      queueHealth: queueHealthStorage,\n      workItems: workItemsStorage,\n      channelIdentity: channelIdentityStorage,\n      comments: workItemCommentsStorage,\n    };\n    const auditDomain = new AuditDomain({\n      auth: routeAuth,\n      audit: auditStorage,\n      projects: factoryProjectsStorage,\n      users: auth && isUserProvider(auth) ? auth : undefined,\n      sinks: integrations,\n      agentTenant: requestContext => {\n        const user = getFactoryAuthUserFromContext(requestContext);\n        return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n      },\n    });\n    const commentsDomain = new CommentsDomain({\n      auth: routeAuth,\n      comments: workItemCommentsStorage,\n      workItems: workItemsStorage,\n      projects: factoryProjectsStorage,\n      channelIdentity: channelIdentityStorage,\n      audit: auditDomain,\n    });\n\n    // The sandbox config is a bare callback constructing a session's sandbox\n    // from intent. Shape-only validation: probing it with a synthetic ctx at\n    // boot would construct against a fake session, so only the type is\n    // checked.\n    const sandboxConfig = this.#config.sandbox;\n    if (sandboxConfig !== undefined && typeof sandboxConfig !== 'function') {\n      // An object here is almost certainly the pre-callback config, which\n      // described a fleet the factory managed itself. That fleet is gone:\n      // sandboxes are per session and the host constructs them, so say what to\n      // write instead rather than only naming the expected type.\n      if (typeof sandboxConfig === 'object' && sandboxConfig !== null) {\n        throw new Error(\n          `MastraFactory: 'sandbox' is now a callback, not an options object. It receives a FactorySandboxContext and returns a MastraSandbox, so the host chooses the provider per session:\\n` +\n            `  sandbox: ctx => new E2BSandbox({ id: ctx.sessionId })\\n` +\n            `The old options map three ways: 'machine' becomes the provider instance you construct inside the callback (one per session instead of one cloned template); 'workdir' is gone — remote providers clone into the VM's home directory and local providers check out under their own workingDirectory; 'maxSandboxes' is gone with the sandbox fleet — there is one sandbox per session and no pool to cap. Omit 'sandbox' entirely to disable sandboxes.`,\n        );\n      }\n      throw new Error(\n        `MastraFactory: 'sandbox' must be a function constructing a MastraSandbox from a FactorySandboxContext.`,\n      );\n    }\n\n    const workspaceRegistry = new FactoryWorkspaceRegistry();\n\n    // One shared OAuth state signer per boot. The deploy entry supplies a\n    // replica-stable secret when needed; otherwise local development gets a\n    // per-process random signer (`stable: false`).\n    const stateSigner = createStateSigner(this.#config.stateSecret);\n\n    // One-time provider initialization with factory-level context (e.g.\n    // better-auth builds its default instance on the backend's auth\n    // database, WorkOS derives its redirect URI from the public URL).\n    // Failures surface here, at prepare() — a misconfigured provider must\n    // not boot.\n    if (auth && hasAuthInit(auth)) {\n      await timedPhase('prepare.auth.init', () =>\n        auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins }),\n      );\n    }\n\n    // Single init path: backend connection failure is a hard boot error;\n    // registered app domains initialize fail-soft inside FactoryStorage.\n    await timedPhase('prepare.storage.init', () => storage.init());\n\n    // Per-tenant model credentials: once the credentials domain is up, model\n    // resolution goes through the caller's own store and the SDK stops\n    // mirroring stored API keys into process.env.\n    //\n    // Only register when a real auth adapter gates callers. In local /\n    // auth-disabled mode there is no authenticated tenant, so registering would\n    // force every model call through an empty tenant store (fail-closed, no env\n    // fallback) and break chat with \"Not logged in\". Leaving it unregistered\n    // lets the SDK fall back to the file-backed AuthStorage (auth.json) — the\n    // same store the local /login and Settings pages read and write.\n    if (auth) {\n      registerTenantCredentialResolver(modelCredentialsStorage);\n    }\n\n    // Custom providers: DB-backed in both modes (org rows in tenant mode, the\n    // sentinel `local` org in no-auth mode). Once registered, model resolution\n    // and the gateway catalog never read settings.json custom providers.\n    registerCustomProvidersSource({ storage: customProvidersStorage, authEnabled: Boolean(auth) });\n\n    for (const integration of integrations) {\n      integration.initialize?.({\n        storage: integrationStorage.forIntegration(integration.id),\n        projects: factoryProjectsStorage,\n        auth: routeAuth,\n      });\n      if (integration.versionControl) {\n        integration.versionControl.initialize({\n          storage: sourceControlStorage.forIntegration(integration.id),\n        });\n      }\n    }\n\n    // Every integration uses generic integration storage. Version-control\n    // providers additionally require the source-control storage domain. Readiness\n    // is derived solely from capability presence, never from provider ids.\n    const integrationRegistrations = integrations.map(integration => {\n      const requiredDomains = [\n        'integrations',\n        ...(integration.versionControl ? ['source-control'] : []),\n        // Channels resolve an inbound sender to a tenant through the reverse\n        // index; without it every message would dispatch tenant-less.\n        ...(integration.channels ? ['channel-identity'] : []),\n      ];\n      return {\n        integration,\n        ready: requiredDomains.every(domain => storage.isDomainReady(domain)),\n        ensureReady: async () => {\n          for (const domain of requiredDomains) await storage.ensureDomainReady(domain);\n        },\n      };\n    });\n    const intakeReady =\n      integrations.some(integration => integration.intake !== undefined) && storage.isDomainReady('intake');\n    const factoryReady = storage.isDomainReady('projects') && storage.isDomainReady('work-items');\n    const knowledgeEnabled = process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === '1';\n    const githubIntegration = integrations.find(integration => integration.id === 'github') as\n      | GithubIntegration\n      | undefined;\n    const workItemsReady = storage.isDomainReady('work-items');\n    const sessionRetirement =\n      sandboxConfig && storage.isDomainReady('source-control')\n        ? new SessionRetirementCoordinator({\n            invalidateSession: sessionId => workspaceRegistry.invalidateSession(sessionId),\n          })\n        : undefined;\n    const retireTerminalSessions =\n      sessionRetirement && githubIntegration && workItemsReady\n        ? async ({ orgId, workItemId }: { orgId: string; workItemId: string }) =>\n            sessionRetirement.retireWorkItemSessions({\n              workItems: workItemsStorage,\n              sourceControl: sourceControlStorage.forIntegration(githubIntegration.id),\n              orgId,\n              workItemId,\n            })\n        : undefined;\n    // Terminal-stage cleanup: ingest any trailing tool results from the item's\n    // bound threads, then revoke the bindings so completed items leave the\n    // reconcile walk (the active-binding set otherwise grows forever), and\n    // finally release the item's sandboxes. Each step is best-effort — a\n    // committed transition never fails on cleanup.\n    const onTerminalStage = workItemsReady\n      ? createTerminalStageCleanup({\n          workItems: workItemsStorage,\n          // `factoryProcessor` is assigned below in this scope; the cleanup\n          // only runs on transitions long after bootstrap completes.\n          reconcileBinding: async (binding): Promise<void> => {\n            await factoryProcessor?.reconcileBinding(binding);\n          },\n          // Session retirement supersedes the older direct sandbox release: it\n          // invalidates the session and stops/destroys its sandbox.\n          ...(retireTerminalSessions ? { releaseSandboxes: retireTerminalSessions } : {}),\n        })\n      : retireTerminalSessions;\n    const transitionService = workItemsReady\n      ? new FactoryTransitionService({\n          rules,\n          storage: workItemsStorage,\n          ...(onTerminalStage ? { onTerminalStage } : {}),\n        })\n      : undefined;\n    const projectRoutes = new ProjectRoutes({\n      auth: routeAuth,\n      projects: factoryProjectsStorage,\n      sourceControl: sourceControlStorage,\n      versionControlIntegrationIds: integrations\n        .filter(integration => integration.versionControl)\n        .map(integration => integration.id),\n      ...(sessionRetirement ? { sessionRetirement } : {}),\n      ...(workItemsReady ? { workItems: workItemsStorage } : {}),\n    });\n    const factoryProcessor = workItemsReady\n      ? new FactoryPhaseStateProcessor({\n          rules,\n          storage: workItemsStorage,\n          ...(transitionService ? { transitionService } : {}),\n          ...(githubIntegration\n            ? {\n                recordPullRequestProvenance: (input: Parameters<typeof recordFactoryPullRequestProvenance>[4]) =>\n                  recordFactoryPullRequestProvenance(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration('github'),\n                    integrationStorage.forIntegration('github'),\n                    workItemsStorage,\n                    input,\n                  ),\n              }\n            : {}),\n          messageReader: {\n            listMessages: async input => {\n              const memory = await storage.getMastraStorage().getStore('memory');\n              return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n            },\n          },\n        })\n      : undefined;\n\n    // Boot assertion: an active integration that signs OAuth `state` needs a\n    // replica-stable signer — a per-process random secret silently breaks the\n    // OAuth callback on any replica that didn't sign the state. Fail loud now\n    // instead. (The built-ins also assert this inside their readiness gates.)\n    for (const { integration } of integrationRegistrations) {\n      if (integration.requiresStableStateSigner && !stateSigner.stable) {\n        throw new Error(\n          `MastraFactory: integration '${integration.id}' signs OAuth state and requires a ` +\n            `replica-stable state secret, but none is configured. Set 'stateSecret' on the factory config.`,\n        );\n      }\n    }\n\n    // The SDK needs to know which backend the injected Mastra store uses\n    // (its own `instanceof` detection breaks when the dependency graph holds\n    // duplicate package copies). Resolve it by walking the FactoryStorage\n    // prototype chain by class name — the factory can't import the concrete\n    // classes since '@mastra/pg' / '@mastra/libsql' are the user's choice.\n    const mastraStorageBackend = (() => {\n      for (let proto = Object.getPrototypeOf(storage); proto; proto = Object.getPrototypeOf(proto)) {\n        if (proto.constructor?.name === 'PgFactoryStorage') return 'pg' as const;\n        if (proto.constructor?.name === 'LibSQLFactoryStorage') return 'libsql' as const;\n      }\n      return undefined;\n    })();\n\n    // Integrations contributing tools to agent sessions: org-scoped\n    // `agentTools` (resolved per request) + session-scoped `sessionTools`.\n    const toolIntegrations = integrationRegistrations.filter(\n      ({ integration }) => integration.agentTools || integration.sessionTools,\n    );\n\n    // Build the real production controller (agents, modes, tools, memory, OM,\n    // MCP, providers) — identical to the terminal app. Agent state lives in\n    // the storage backend's Mastra store alongside the Factory app tables —\n    // one shared database for all users, separated by `resourceId` scoping.\n    const prepared = await timedPhase('prepare.controllerMount', () =>\n      prepareAgentControllerMount({\n        controllerId: CONTROLLER_ID,\n        workspace: createWorkspaceFactory({\n          ...(sandboxConfig ? { sandbox: sandboxConfig } : {}),\n          ...(githubIntegration ? { github: githubIntegration } : {}),\n          ...(workItemsStorage ? { workItems: workItemsStorage } : {}),\n          workspaceRegistry,\n        }),\n        disableGithubSignals: true,\n        // Memory settings live in the factory's `memory-settings` app table (per\n        // org/user), so the host machine's TUI settings.json must not seed them.\n        disableSettingsOmSeed: true,\n        // A factory reads the repository it works on and its skill, never the\n        // ~/.claude instructions of whoever hosts the process. On the controller\n        // rather than per session, so webhook-recreated sessions keep it too.\n        // Blank project identity for the same reason: the SDK's defaults seed\n        // sessions with the HOST process's own project root / name / branch,\n        // which must never reach a hosted session's prompt. Repo-backed\n        // sessions get their real workdir pinned by workspace resolution;\n        // chat-only sessions legitimately have no project.\n        // Factory sessions also start fail-closed on org classification: the\n        // unresolved marker is set at birth, a successful org seed clears it,\n        // and a resolved `factoryOrgId` always takes precedence — so a failed\n        // (best-effort) seed can never leave a session classified as local.\n        initialState: {\n          skipGlobalInstructions: true,\n          factoryOrgUnresolved: true,\n          projectPath: '',\n          projectName: '',\n          gitBranch: '',\n        },\n        storage: storage.getMastraStorage(),\n        ...(mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {}),\n        ...(factoryProcessor ? { inputProcessors: [factoryProcessor] } : {}),\n        ...(vector ? { vector } : {}),\n        ...(toolIntegrations.length > 0 || (workItemsStorage && transitionService)\n          ? {\n              extraTools: async ({ requestContext }: { requestContext: RequestContext }) => {\n                const tools: IntegrationTools = {};\n                const toolOwners = new Map<string, string>();\n                const mergeTools = (ownerId: string, contributed: IntegrationTools) => {\n                  for (const [name, tool] of Object.entries(contributed)) {\n                    const owner = toolOwners.get(name);\n                    if (owner) {\n                      throw new Error(\n                        `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`,\n                      );\n                    }\n                    toolOwners.set(name, ownerId);\n                    tools[name] = tool;\n                  }\n                };\n                if (workItemsStorage && transitionService) {\n                  mergeTools(\n                    'factory',\n                    await createFactoryTransitionTools({\n                      requestContext,\n                      storage: workItemsStorage,\n                      transitionService,\n                      // Heals crash-resumed sessions: recovered addresses re-seed\n                      // projectRepositoryId/baseRef from the source session record.\n                      // Only offered while the source-control domain is ready — a\n                      // throwing lookup would abort recovery's catch block and also\n                      // skip the metadata baseRef fallback.\n                      ...(storage.isDomainReady('source-control')\n                        ? { sessions: sourceControlStorage.forIntegration('github').sessions }\n                        : {}),\n                    }),\n                  );\n                }\n                for (const { integration, ready, ensureReady } of toolIntegrations) {\n                  if (!ready && ensureReady) {\n                    try {\n                      await ensureReady();\n                    } catch {\n                      continue;\n                    }\n                  }\n                  if (integration.agentTools) {\n                    mergeTools(integration.id, await integration.agentTools({ requestContext }));\n                  }\n                  if (integration.sessionTools) {\n                    mergeTools(integration.id, integration.sessionTools({ requestContext }));\n                  }\n                }\n                return tools;\n              },\n            }\n          : {}),\n        postToolObserver: async (toolContext: IntegrationPostToolContext) => {\n          const requestContext = (toolContext.context as { requestContext?: RequestContext } | undefined)\n            ?.requestContext;\n          if (requestContext) {\n            await observeAgentGitAction({\n              audit: auditDomain,\n              toolContext: { ...toolContext, context: requestContext },\n            });\n          }\n          await Promise.all(\n            integrations.map(async integration => {\n              if (!integration.postToolObserver) return;\n              try {\n                await integration.postToolObserver({ toolContext, requestContext });\n              } catch (error) {\n                console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);\n              }\n            }),\n          );\n        },\n        ...(pubsub ? { pubsub, crossProcessPubSub: true } : {}),\n        buildApiRoutes: ({ controller, authStorage }: BuildApiRoutesDeps) => [\n          // Public `/auth/*` routes (login/callback/logout/me). Folded in as\n          // `apiRoutes` (not plain Hono routes) because the entry can't touch the\n          // Hono app the deployer generates. `requiresAuth: false`; the gate\n          // skips `/auth/*`.\n          ...(auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : []),\n          // Custom `/web/*` routes (fs / config / integrations / factory / audit).\n          ...assembleFactoryApiRoutes({\n            controllerId: CONTROLLER_ID,\n            controller,\n            auth: routeAuth,\n            ...(auth && isUserProvider(auth) ? { users: auth } : {}),\n            authStorage,\n            audit: auditDomain,\n            publicOrigin,\n            stateSigner,\n            sandbox: sandboxConfig,\n            sessionRetirement,\n            factoryStorage: storage,\n            integrationStorage,\n            sourceControlStorage,\n            domains,\n            integrations: integrationRegistrations,\n            intakeReady,\n            factoryReady,\n            knowledgeEnabled,\n            rules,\n            factoryTransitionService: transitionService,\n            onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {\n              this.#dispatcher ??= new FactoryDecisionDispatcher({\n                controller,\n                transitionService: runtimeTransitionService,\n                storage: storage.getDomain<WorkItemsStorage>('work-items'),\n                maxInFlight: this.#config.dispatcher?.maxInFlight,\n                isAutoRunEnabled: async ({ orgId, factoryProjectId }) => {\n                  await factoryProjectsStorage.ensureReady();\n                  const project = await factoryProjectsStorage.get({ orgId, id: factoryProjectId });\n                  return project?.autoRunEnabled ?? false;\n                },\n                reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n                prepareBinding,\n                feedReader: new FactoryFeedReader(workItemCommentsStorage),\n                primeCredentials: tenant => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage }),\n                resolveLinkedWorkItemParentId: async ({ orgId, decision }) => {\n                  if (decision.source !== 'github-pr') return null;\n                  const repositoryId = decision.metadata?.githubRepositoryId;\n                  const pullRequestNumber = decision.metadata?.githubPullRequestNumber;\n                  if (typeof repositoryId !== 'number' || typeof pullRequestNumber !== 'number') return null;\n                  return resolveFactoryPullRequestParentWorkItemId(\n                    integrationStorage.forIntegration<\n                      Record<string, unknown>,\n                      Record<string, unknown>,\n                      FactoryPullRequestProvenanceData\n                    >('github'),\n                    { orgId, repositoryId, pullRequestNumber },\n                  );\n                },\n              });\n            },\n          }),\n          ...projectRoutes.routes(),\n          ...auditDomain.routes(),\n          ...commentsDomain.routes(),\n        ],\n        buildServerConfig: () => {\n          const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};\n          // Log route errors with method/path/stack and answer with structured\n          // JSON instead of an opaque `Internal Server Error`. Applied by the\n          // deployer to both the top-level app and the custom-route sub-app.\n          const onError = { onError: handleServerError };\n          // Same-origin SPA: when a vite build is present (see resolveUiDistDir),\n          // serve it at `/` from this server. Mounted last so the auth gate (when\n          // enabled) covers it; it always passes `/api`, `/web`, `/auth` through.\n          const uiDist = resolveUiDistDir();\n          const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];\n          if (!auth) {\n            // Auth disabled: no gate. Still prime the sentinel-local custom\n            // provider snapshot so model calls see DB rows, then SPA + CORS.\n            return {\n              middleware: [\n                createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),\n                ...spa,\n              ],\n              ...cors,\n              ...onError,\n            };\n          }\n\n          // Ordered middleware. The deployer applies these AFTER its context\n          // middleware sets `c.set('mastra', mastra)` and BEFORE routes, so:\n          //   1. gate   — validates the auth session, stashes the user, and 401s /\n          //               redirects unauthenticated requests. Skips public `/auth/*`.\n          //   2. primers — hydrate the caller's model-credential and custom\n          //               provider snapshots so the request's first model call\n          //               resolves tenant credentials and custom providers.\n          //   3. spa    — serves the built UI for everything the server doesn't own.\n          // `auth` also lands on `server.auth` so the core auth middleware (and\n          // Studio's dual-auth routing — see `studio.auth` on the returned args)\n          // authenticates core `/api/*` routes with the same provider.\n          return {\n            auth,\n            middleware: [\n              createFactoryAuthGate(auth),\n              createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),\n              createCustomProvidersPrimer({\n                auth: routeAuth,\n                storage: customProvidersStorage,\n                authEnabled: Boolean(auth),\n              }),\n              ...spa,\n            ],\n            ...cors,\n            ...onError,\n          };\n        },\n      }),\n    );\n\n    prepared.base.controller.onSessionCreated(session => {\n      observeSessionFilesystem(session, {\n        filesystem: filesystemStorage,\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionCheckpoint(session);\n      observeSessionFirstMessage(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionFirstExec(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionThreadTitle(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n    });\n\n    // Blocking: `createSession` awaits this seed, so when hydration succeeds\n    // a session's first run starts with the owner's stored OM settings.\n    // Best-effort — failures are logged inside the helper, never thrown, and\n    // the session then falls back to its persisted/default OM configuration.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionMemorySettings(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          memorySettings: memorySettingsStorage,\n        }),\n      { blocking: true },\n    );\n\n    // Personal model packs seed interactive user sessions only. Active Factory\n    // run bindings are excluded and continue to use the project default model.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionModelPack(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          workItems: workItemsStorage,\n          modelPacks: modelPacksStorage,\n        }),\n      { blocking: true },\n    );\n\n    this.#prepared = prepared;\n    this.#factoryProcessor = factoryProcessor;\n\n    // Chat-platform channels (Slack, Discord, …) contributed by integrations,\n    // attached to the mounted controller so inbound platform messages reach\n    // the same agents the web UI drives. READY integrations only — readiness\n    // means the `channel-identity` domain's `init()` succeeded, so its link\n    // table is queryable. Without it a sender can't be resolved to a tenant,\n    // and attaching anyway would dispatch runs on default credentials.\n    const channelRegistrations = integrationRegistrations.filter(\n      ({ integration, ready }) => ready && integration.channels,\n    );\n    // `setChannels` replaces rather than merges, so a second provider would\n    // silently never receive a message. Fail loud instead.\n    if (channelRegistrations.length > 1) {\n      throw new Error(\n        `MastraFactory: integrations [${channelRegistrations\n          .map(({ integration }) => integration.id)\n          .join(', ')}] all provide channels, but only one may. Remove all but one.`,\n      );\n    }\n    for (const { integration } of channelRegistrations) {\n      // Integrations return a channels CONFIG; the factory owns construction.\n      prepared.base.controller.setChannels(\n        new AgentControllerChannels(\n          integration.channels!(\n            buildIntegrationContext(\n              {\n                controller: prepared.base.controller,\n                publicOrigin,\n                auth: routeAuth,\n                stateSigner,\n                sandbox: sandboxConfig,\n                factoryStorage: storage,\n                integrationStorage,\n                sourceControlStorage,\n                rules,\n                factoryReady,\n                domains,\n                ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n              },\n              integration.id,\n            ),\n          ),\n        ),\n      );\n    }\n\n    // Integration lifecycle workers (e.g. polling an upstream without\n    // webhooks): collected from READY integrations only, folded into the\n    // constructor args so `new Mastra(...)` merges them with the default\n    // workers and `finalize()`'s `startWorkers()` starts them alongside the\n    // built-ins. Never passed for the disabled/not-ready case — a worker for\n    // an unavailable integration must not run.\n    const integrationWorkers = integrationRegistrations\n      .filter(({ integration, ready }) => ready && integration.workers)\n      .flatMap(({ integration }) =>\n        integration.workers!(\n          buildIntegrationContext(\n            {\n              controller: prepared.base.controller,\n              publicOrigin,\n              auth: routeAuth,\n              stateSigner,\n              sandbox: sandboxConfig,\n              factoryStorage: storage,\n              integrationStorage,\n              sourceControlStorage,\n              rules,\n              factoryReady,\n              domains,\n              ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n            },\n            integration.id,\n          ),\n        ),\n      );\n\n    return {\n      ...prepared.mastraArgs,\n      // Same provider on `studio.auth` as on `server.auth` (buildServerConfig):\n      // deployed factories must authenticate BOTH plain API callers and Studio\n      // requests (`x-mastra-client-type: studio` routes to `studio.auth`).\n      ...(auth ? { studio: { auth } } : {}),\n      ...(integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}),\n    };\n  }\n\n  /**\n   * Post-construct boot: initialize the controller (which inherits the\n   * constructed Mastra's storage) and start its workers. Call AFTER the entry\n   * has run `new Mastra(prepare()'s args)`.\n   */\n  async finalize(): Promise<void> {\n    if (!this.#prepared) {\n      throw new Error('MastraFactory.finalize() called before prepare()');\n    }\n    await timedPhase('finalize.controller', () => this.#prepared!.finalize());\n    await timedPhase(\n      'finalize.reconcileBoundThreads',\n      () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n    );\n    this.#dispatcher?.start();\n  }\n\n  /** Stop Factory-owned background dispatch before the host process shuts down. */\n  async shutdown(): Promise<void> {\n    await this.#dispatcher?.stop();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmNA,MAAM,gBAAgB;AAEtB,SAAS,yBAAkC;CAIzC,OAAO,QAAQ,QAAQ,IAAI,8BAA8B,KAAK,KAAK,QAAQ,IAAI,4BAA4B,KAAK,CAAC;AACnH;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,WAAwC;CACtE,OAAO,IAAI,iBAAiB,EAC1B,cAAc,0BAA0B,SAAS,EACnD,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,MAAM,gCAAgC,CAAC,gBAAgB,WAAW;AAElE,SAAS,YAAY,UAA2B;CAI9C,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO;CACnC,OAAO,oBAAoB,KAAK,QAAQ;AAC1C;AAEA,SAAS,0BAA0B,WAAuC;CACxE,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,SAAS,CAAC,CAAC,SAAS,YAAY;CACrD,QAAQ;EACN;CACF;CACA,IAAI,aAAa,eAAe,YAAY,QAAQ,GAAG,OAAO,KAAA;CAC9D,KAAK,MAAM,UAAU,+BAA+B;EAGlD,IAAI,aAAa,QAAQ,OAAO,KAAA;EAChC,IAAI,SAAS,SAAS,IAAI,QAAQ,GAAG,OAAO,IAAI;CAClD;AAEF;AAEA,IAAa,gBAAb,MAA2B;CACzB;CACA;CACA;CACA;CACA,aAAa;CAEb,YAAY,QAA6B;EACvC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,oOAGF;EAEF,KAAKA,UAAU;CACjB;;;;;;CAOA,MAAM,UAA+B;EAInC,IAAI,KAAKC,YAAY,MAAM,IAAI,MAAM,sCAAsC;EAC3E,KAAKA,aAAa;EAElB,MAAM,gBAAgB,KAAKD,QAAQ,aAAa,wBAAA,CAAyB,QAAQ,QAAQ,EAAE;EAC3F,MAAM,kBAAkB,KAAKA,QAAQ,kBAAkB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO;EACzG,MAAM,UAAU,KAAKA,QAAQ;EAC7B,MAAM,SAAS,KAAKA,QAAQ;EAC5B,MAAM,SAAS,KAAKA,QAAQ;EAM5B,MAAM,iBAAiB,KAAKA,QAAQ;EACpC,MAAM,OACJ,mBAAmB,OAAO,KAAA,IAAa,kBAAkB,uBAAuB,YAAY;EAC9F,IAAI,QAAQ,CAAC,KAAKA,QAAQ,kBACxB,QAAQ,KACN,kRAGF;EAEF,MAAM,mBAAmB,KAAKA,QAAQ,oBAAoB,uCAAuC;EAGjG,MAAM,YAAY,uBAAuB,IAAI;EAI7C,MAAM,eAAe,CAAC,GAAI,KAAKA,QAAQ,gBAAgB,CAAC,CAAE;EAC1D,IAAI,uBAAuB,GAAG;GAC5B,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,EAAE,MAAM,KAAKA,QAAQ,UAAU,cAAc,CAAC,CAAC;GAEjG,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,CAAC;EAErD;EAIA,MAAM,iCAAiB,IAAI,IAAY;EACvC,KAAK,MAAM,eAAe,cAAc;GACtC,IAAI,eAAe,IAAI,YAAY,EAAE,GACnC,MAAM,IAAI,MAAM,4CAA4C,YAAY,GAAG,qBAAqB;GAElG,eAAe,IAAI,YAAY,EAAE;EACnC;EACA,MAAM,QAAQ,KAAKA,QAAQ,SAAS,oBAAoB;EACxD,mBAAmB,KAAK;EAIxB,MAAM,gBAAgB,QAAQ,eAAe,IAAI,cAAc,CAAC;EAChE,MAAM,eAAe,QAAQ,eAAe,IAAI,aAAa,CAAC;EAC9D,MAAM,mBAAmB,QAAQ,eAAe,IAAI,iBAAiB,CAAC;EACtE,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,gBAAgB,CAAC;EACpG,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,wBAAwB,QAAQ,eAAe,IAAI,sBAAsB,CAAC;EAChF,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,gBAAgB,CAAC;EAClG,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,CAAC;EAG1E,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,gBAAgB,CAAC;EAC1F,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,uBAAuB,QAAQ,eAAe,IAAI,qBAAqB,CAAC;EAG9E,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAGpF,MAAM,UAAU;GACd,QAAQ;GACR,kBAAkB;GAClB,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;GACjB,YAAY;GACZ,UAAU;GACV,aAAa;GACb,WAAW;GACX,iBAAiB;GACjB,UAAU;EACZ;EACA,MAAM,cAAc,IAAI,YAAY;GAClC,MAAM;GACN,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,eAAe,IAAI,IAAI,OAAO,KAAA;GAC7C,OAAO;GACP,cAAa,mBAAkB;IAC7B,MAAM,OAAO,8BAA8B,cAAc;IACzD,OAAO;KAAE,OAAO,oBAAoB,IAAI;KAAG,QAAQ,qBAAqB,IAAI;IAAE;GAChF;EACF,CAAC;EACD,MAAM,iBAAiB,IAAI,eAAe;GACxC,MAAM;GACN,UAAU;GACV,WAAW;GACX,UAAU;GACV,iBAAiB;GACjB,OAAO;EACT,CAAC;EAMD,MAAM,gBAAgB,KAAKA,QAAQ;EACnC,IAAI,kBAAkB,KAAA,KAAa,OAAO,kBAAkB,YAAY;GAKtE,IAAI,OAAO,kBAAkB,YAAY,kBAAkB,MACzD,MAAM,IAAI,MACR,oqBAGF;GAEF,MAAM,IAAI,MACR,wGACF;EACF;EAEA,MAAM,oBAAoB,IAAI,yBAAyB;EAKvD,MAAM,cAAc,kBAAkB,KAAKA,QAAQ,WAAW;EAO9D,IAAI,QAAQ,YAAY,IAAI,GAC1B,MAAM,WAAW,2BACf,KAAK,KAAK;GAAE,UAAU,QAAQ,eAAe;GAAG,WAAW;GAAc;EAAe,CAAC,CAC3F;EAKF,MAAM,WAAW,8BAA8B,QAAQ,KAAK,CAAC;EAY7D,IAAI,MACF,iCAAiC,uBAAuB;EAM1D,8BAA8B;GAAE,SAAS;GAAwB,aAAa,QAAQ,IAAI;EAAE,CAAC;EAE7F,KAAK,MAAM,eAAe,cAAc;GACtC,YAAY,aAAa;IACvB,SAAS,mBAAmB,eAAe,YAAY,EAAE;IACzD,UAAU;IACV,MAAM;GACR,CAAC;GACD,IAAI,YAAY,gBACd,YAAY,eAAe,WAAW,EACpC,SAAS,qBAAqB,eAAe,YAAY,EAAE,EAC7D,CAAC;EAEL;EAKA,MAAM,2BAA2B,aAAa,KAAI,gBAAe;GAC/D,MAAM,kBAAkB;IACtB;IACA,GAAI,YAAY,iBAAiB,CAAC,gBAAgB,IAAI,CAAC;IAGvD,GAAI,YAAY,WAAW,CAAC,kBAAkB,IAAI,CAAC;GACrD;GACA,OAAO;IACL;IACA,OAAO,gBAAgB,OAAM,WAAU,QAAQ,cAAc,MAAM,CAAC;IACpE,aAAa,YAAY;KACvB,KAAK,MAAM,UAAU,iBAAiB,MAAM,QAAQ,kBAAkB,MAAM;IAC9E;GACF;EACF,CAAC;EACD,MAAM,cACJ,aAAa,MAAK,gBAAe,YAAY,WAAW,KAAA,CAAS,KAAK,QAAQ,cAAc,QAAQ;EACtG,MAAM,eAAe,QAAQ,cAAc,UAAU,KAAK,QAAQ,cAAc,YAAY;EAC5F,MAAM,mBAAmB,QAAQ,IAAI,yCAAyC;EAC9E,MAAM,oBAAoB,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ;EAGtF,MAAM,iBAAiB,QAAQ,cAAc,YAAY;EACzD,MAAM,oBACJ,iBAAiB,QAAQ,cAAc,gBAAgB,IACnD,IAAI,6BAA6B,EAC/B,oBAAmB,cAAa,kBAAkB,kBAAkB,SAAS,EAC/E,CAAC,IACD,KAAA;EACN,MAAM,yBACJ,qBAAqB,qBAAqB,iBACtC,OAAO,EAAE,OAAO,iBACd,kBAAkB,uBAAuB;GACvC,WAAW;GACX,eAAe,qBAAqB,eAAe,kBAAkB,EAAE;GACvE;GACA;EACF,CAAC,IACH,KAAA;EAMN,MAAM,kBAAkB,iBACpB,2BAA2B;GACzB,WAAW;GAGX,kBAAkB,OAAO,YAA2B;IAClD,MAAM,kBAAkB,iBAAiB,OAAO;GAClD;GAGA,GAAI,yBAAyB,EAAE,kBAAkB,uBAAuB,IAAI,CAAC;EAC/E,CAAC,IACD;EACJ,MAAM,oBAAoB,iBACtB,IAAI,yBAAyB;GAC3B;GACA,SAAS;GACT,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC/C,CAAC,IACD,KAAA;EACJ,MAAM,gBAAgB,IAAI,cAAc;GACtC,MAAM;GACN,UAAU;GACV,eAAe;GACf,8BAA8B,aAC3B,QAAO,gBAAe,YAAY,cAAc,CAAC,CACjD,KAAI,gBAAe,YAAY,EAAE;GACpC,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,iBAAiB,EAAE,WAAW,iBAAiB,IAAI,CAAC;EAC1D,CAAC;EACD,MAAM,mBAAmB,iBACrB,IAAI,2BAA2B;GAC7B;GACA,SAAS;GACT,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,oBACA,EACE,8BAA8B,UAC5B,mCACE,mBACA,qBAAqB,eAAe,QAAQ,GAC5C,mBAAmB,eAAe,QAAQ,GAC1C,kBACA,KACF,EACJ,IACA,CAAC;GACL,eAAe,EACb,cAAc,OAAM,UAAS;IAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;KAAE,UAAU,CAAC;KAAG,SAAS;IAAM;GAC9E,EACF;EACF,CAAC,IACD,KAAA;EAMJ,KAAK,MAAM,EAAE,iBAAiB,0BAC5B,IAAI,YAAY,6BAA6B,CAAC,YAAY,QACxD,MAAM,IAAI,MACR,+BAA+B,YAAY,GAAG,iIAEhD;EASJ,MAAM,8BAA8B;GAClC,KAAK,IAAI,QAAQ,OAAO,eAAe,OAAO,GAAG,OAAO,QAAQ,OAAO,eAAe,KAAK,GAAG;IAC5F,IAAI,MAAM,aAAa,SAAS,oBAAoB,OAAO;IAC3D,IAAI,MAAM,aAAa,SAAS,wBAAwB,OAAO;GACjE;EAEF,EAAA,CAAG;EAIH,MAAM,mBAAmB,yBAAyB,QAC/C,EAAE,kBAAkB,YAAY,cAAc,YAAY,YAC7D;EAMA,MAAM,WAAW,MAAM,WAAW,iCAChC,4BAA4B;GAC1B,cAAc;GACd,WAAW,uBAAuB;IAChC,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;IAClD,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;IACzD,GAAI,mBAAmB,EAAE,WAAW,iBAAiB,IAAI,CAAC;IAC1D;GACF,CAAC;GACD,sBAAsB;GAGtB,uBAAuB;GAavB,cAAc;IACZ,wBAAwB;IACxB,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,WAAW;GACb;GACA,SAAS,QAAQ,iBAAiB;GAClC,GAAI,uBAAuB,EAAE,gBAAgB,qBAAqB,IAAI,CAAC;GACvE,GAAI,mBAAmB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC;GAClE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,GAAI,iBAAiB,SAAS,KAAM,oBAAoB,oBACpD,EACE,YAAY,OAAO,EAAE,qBAAyD;IAC5E,MAAM,QAA0B,CAAC;IACjC,MAAM,6BAAa,IAAI,IAAoB;IAC3C,MAAM,cAAc,SAAiB,gBAAkC;KACrE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GAAG;MACtD,MAAM,QAAQ,WAAW,IAAI,IAAI;MACjC,IAAI,OACF,MAAM,IAAI,MACR,oCAAoC,KAAK,UAAU,QAAQ,oBAAoB,MAAM,GACvF;MAEF,WAAW,IAAI,MAAM,OAAO;MAC5B,MAAM,QAAQ;KAChB;IACF;IACA,IAAI,oBAAoB,mBACtB,WACE,WACA,MAAM,6BAA6B;KACjC;KACA,SAAS;KACT;KAMA,GAAI,QAAQ,cAAc,gBAAgB,IACtC,EAAE,UAAU,qBAAqB,eAAe,QAAQ,CAAC,CAAC,SAAS,IACnE,CAAC;IACP,CAAC,CACH;IAEF,KAAK,MAAM,EAAE,aAAa,OAAO,iBAAiB,kBAAkB;KAClE,IAAI,CAAC,SAAS,aACZ,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN;KACF;KAEF,IAAI,YAAY,YACd,WAAW,YAAY,IAAI,MAAM,YAAY,WAAW,EAAE,eAAe,CAAC,CAAC;KAE7E,IAAI,YAAY,cACd,WAAW,YAAY,IAAI,YAAY,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3E;IACA,OAAO;GACT,EACF,IACA,CAAC;GACL,kBAAkB,OAAO,gBAA4C;IACnE,MAAM,iBAAkB,YAAY,SAChC;IACJ,IAAI,gBACF,MAAM,sBAAsB;KAC1B,OAAO;KACP,aAAa;MAAE,GAAG;MAAa,SAAS;KAAe;IACzD,CAAC;IAEH,MAAM,QAAQ,IACZ,aAAa,IAAI,OAAM,gBAAe;KACpC,IAAI,CAAC,YAAY,kBAAkB;KACnC,IAAI;MACF,MAAM,YAAY,iBAAiB;OAAE;OAAa;MAAe,CAAC;KACpE,SAAS,OAAO;MACd,QAAQ,KAAK,0BAA0B,YAAY,GAAG,+BAA+B,KAAK;KAC5F;IACF,CAAC,CACH;GACF;GACA,GAAI,SAAS;IAAE;IAAQ,oBAAoB;GAAK,IAAI,CAAC;GACrD,iBAAiB,EAAE,YAAY,kBAAsC;IAKnE,GAAI,OAAO,gBAAgB,MAAM,EAAE,WAAW,aAAa,CAAC,IAAI,CAAC;IAEjE,GAAG,yBAAyB;KAC1B,cAAc;KACd;KACA,MAAM;KACN,GAAI,QAAQ,eAAe,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KACtD;KACA,OAAO;KACP;KACA;KACA,SAAS;KACT;KACA,gBAAgB;KAChB;KACA;KACA;KACA,cAAc;KACd;KACA;KACA;KACA;KACA,0BAA0B;KAC1B,mBAAmB,EAAE,mBAAmB,0BAA0B,qBAAqB;MACrF,KAAKE,gBAAgB,IAAI,0BAA0B;OACjD;OACA,mBAAmB;OACnB,SAAS,QAAQ,UAA4B,YAAY;OACzD,aAAa,KAAKF,QAAQ,YAAY;OACtC,kBAAkB,OAAO,EAAE,OAAO,uBAAuB;QACvD,MAAM,uBAAuB,YAAY;QAEzC,QAAO,MADe,uBAAuB,IAAI;SAAE;SAAO,IAAI;QAAiB,CAAC,EAAA,EAChE,kBAAkB;OACpC;OACA,4BAA4B,kBAAkB,yBAAyB,KAAK,QAAQ,QAAQ;OAC5F;OACA,YAAY,IAAI,kBAAkB,uBAAuB;OACzD,mBAAkB,WAAU,uBAAuB;QAAE;QAAQ,aAAa;OAAwB,CAAC;OACnG,+BAA+B,OAAO,EAAE,OAAO,eAAe;QAC5D,IAAI,SAAS,WAAW,aAAa,OAAO;QAC5C,MAAM,eAAe,SAAS,UAAU;QACxC,MAAM,oBAAoB,SAAS,UAAU;QAC7C,IAAI,OAAO,iBAAiB,YAAY,OAAO,sBAAsB,UAAU,OAAO;QACtF,OAAO,0CACL,mBAAmB,eAIjB,QAAQ,GACV;SAAE;SAAO;SAAc;QAAkB,CAC3C;OACF;MACF,CAAC;KACH;IACF,CAAC;IACD,GAAG,cAAc,OAAO;IACxB,GAAG,YAAY,OAAO;IACtB,GAAG,eAAe,OAAO;GAC3B;GACA,yBAAyB;IACvB,MAAM,OAAO,eAAe,SAAS,EAAE,MAAM;KAAE,QAAQ;KAAgB,aAAa;IAAK,EAAE,IAAI,CAAC;IAIhG,MAAM,UAAU,EAAE,SAAS,kBAAkB;IAI7C,MAAM,SAAS,iBAAiB;IAChC,MAAM,MAAM,SAAS,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAGH,OAAO;KACL,YAAY,CACV,4BAA4B;MAAE,MAAM;MAAW,SAAS;MAAwB,aAAa;KAAM,CAAC,GACpG,GAAG,GACL;KACA,GAAG;KACH,GAAG;IACL;IAcF,OAAO;KACL;KACA,YAAY;MACV,sBAAsB,IAAI;MAC1B,6BAA6B;OAAE,MAAM;OAAW,aAAa;MAAwB,CAAC;MACtF,4BAA4B;OAC1B,MAAM;OACN,SAAS;OACT,aAAa,QAAQ,IAAI;MAC3B,CAAC;MACD,GAAG;KACL;KACA,GAAG;KACH,GAAG;IACL;GACF;EACF,CAAC,CACH;EAEA,SAAS,KAAK,WAAW,kBAAiB,YAAW;GACnD,yBAAyB,SAAS;IAChC,YAAY;IACZ,eAAe,qBAAqB,eAAe,QAAQ;GAC7D,CAAC;GACD,yBAAyB,OAAO;GAChC,2BAA2B,SAAS,EAClC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,wBAAwB,SAAS,EAC/B,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,0BAA0B,SAAS,EACjC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;EACH,CAAC;EAMD,SAAS,KAAK,WAAW,kBACvB,YACE,6BAA6B,SAAS;GACpC,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,gBAAgB;EAClB,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAIA,SAAS,KAAK,WAAW,kBACvB,YACE,wBAAwB,SAAS;GAC/B,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,WAAW;GACX,YAAY;EACd,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAEA,KAAKG,YAAY;EACjB,KAAKC,oBAAoB;EAQzB,MAAM,uBAAuB,yBAAyB,QACnD,EAAE,aAAa,YAAY,SAAS,YAAY,QACnD;EAGA,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,gCAAgC,qBAC7B,KAAK,EAAE,kBAAkB,YAAY,EAAE,CAAC,CACxC,KAAK,IAAI,EAAE,8DAChB;EAEF,KAAK,MAAM,EAAE,iBAAiB,sBAE5B,SAAS,KAAK,WAAW,YACvB,IAAI,wBACF,YAAY,SACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA,SAAS;GACT,gBAAgB;GAChB;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EAChE,GACA,YAAY,EACd,CACF,CACF,CACF;EASF,MAAM,qBAAqB,yBACxB,QAAQ,EAAE,aAAa,YAAY,SAAS,YAAY,OAAO,CAAC,CAChE,SAAS,EAAE,kBACV,YAAY,QACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA,SAAS;GACT,gBAAgB;GAChB;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EAChE,GACA,YAAY,EACd,CACF,CACF;EAEF,OAAO;GACL,GAAG,SAAS;GAIZ,GAAI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;GACnC,GAAI,mBAAmB,SAAS,IAAI,EAAE,SAAS,mBAAmB,IAAI,CAAC;EACzE;CACF;;;;;;CAOA,MAAM,WAA0B;EAC9B,IAAI,CAAC,KAAKD,WACR,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,WAAW,6BAA6B,KAAKA,UAAW,SAAS,CAAC;EACxE,MAAM,WACJ,wCACM,KAAKC,mBAAmB,yBAAyB,KAAK,QAAQ,QAAQ,CAC9E;EACA,KAAKF,aAAa,MAAM;CAC1B;;CAGA,MAAM,WAA0B;EAC9B,MAAM,KAAKA,aAAa,KAAK;CAC/B;AACF"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { MastraFactory } from './factory.js';
-export type { MastraArgs, MastraFactoryConfig } from './factory.js';
+export type { MastraArgs, MastraFactoryConfig, MastraFactorySandboxConfig } from './factory.js';
+export type { FactorySandboxContext, SessionSetupRun } from './sandbox/session-sandbox.js';
 export { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';
 export type { ChannelAccountLink, ChannelAccountLinkEntry, ChannelAccountLinkKey, ChannelAccountLinkNames, } from './storage/domains/channel-identity/base.js';
 export { FactoryProjectsStorage } from './storage/domains/projects/base.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAC/G,YAAY,EACV,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAChG,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpF,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAC/G,YAAY,EACV,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC"}