@mastra/factory 0.12.0-alpha.4 → 0.12.0-alpha.6

package/dist/routes/projects.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.js","names":["#versionControlIntegrationIds","#projects","#sourceControl","#handles","#project","#findConnection","#findProjectRepository","#repositoryPayload","#retireProjectRepositorySessions","#resolveTenant"],"sources":["../../src/routes/projects.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';\nimport type {\n  CreateFactoryProjectInput,\n  FactoryProjectsStorage,\n  UpdateFactoryProjectInput,\n} from '../storage/domains/projects/base.js';\nimport type {\n  ProjectRepository,\n  SourceControlStorage,\n  SourceControlStorageHandle,\n  UpdateProjectRepositoryInput,\n} from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_NAME_LENGTH = 200;\nconst MAX_DESCRIPTION_LENGTH = 2_000;\nconst MAX_REPOSITORY_COMMAND_LENGTH = 2_000;\nconst MAX_BRANCH_LENGTH = 255;\nconst MAX_SANDBOX_PROVIDER_LENGTH = 100;\nconst MAX_SANDBOX_WORKDIR_LENGTH = 1_000;\nconst CONTROL_CHAR_RE = /[\\0-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]/;\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nasync function readJson(context: Context): Promise<unknown | undefined> {\n  try {\n    return await context.req.json();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseCreateInput(value: unknown): CreateFactoryProjectInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.name !== 'string') return null;\n  const name = input.name.trim();\n  if (!name || name.length > MAX_NAME_LENGTH) return null;\n  if (input.description !== undefined && input.description !== null && typeof input.description !== 'string')\n    return null;\n  const description = typeof input.description === 'string' ? input.description.trim() || null : null;\n  if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;\n  return { name, description };\n}\n\nfunction parseUpdateInput(value: unknown): UpdateFactoryProjectInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  const patch: UpdateFactoryProjectInput = {};\n  if (input.name !== undefined) {\n    if (typeof input.name !== 'string') return null;\n    const name = input.name.trim();\n    if (!name || name.length > MAX_NAME_LENGTH) return null;\n    patch.name = name;\n  }\n  if (input.description !== undefined) {\n    if (input.description !== null && typeof input.description !== 'string') return null;\n    const description = typeof input.description === 'string' ? input.description.trim() || null : null;\n    if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;\n    patch.description = description;\n  }\n  if (input.defaultModelId !== undefined) {\n    const defaultModelId = parseOptionalString(input.defaultModelId, { maxLength: MAX_NAME_LENGTH, nullable: true });\n    if (defaultModelId === false) return null;\n    patch.defaultModelId = defaultModelId ?? null;\n  }\n  if (input.slackWorkItemsEnabled !== undefined) {\n    if (typeof input.slackWorkItemsEnabled !== 'boolean') return null;\n    patch.slackWorkItemsEnabled = input.slackWorkItemsEnabled;\n  }\n  if (input.autoRunEnabled !== undefined) {\n    if (typeof input.autoRunEnabled !== 'boolean') return null;\n    patch.autoRunEnabled = input.autoRunEnabled;\n  }\n  return Object.keys(patch).length > 0 ? patch : null;\n}\n\nfunction parseConnectionInput(value: unknown): { integrationId: string; installationId: string } | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.integrationId !== 'string' || !input.integrationId.trim()) return null;\n  if (typeof input.installationId !== 'string' || !UUID_RE.test(input.installationId)) return null;\n  return { integrationId: input.integrationId.trim(), installationId: input.installationId };\n}\n\nfunction parseOptionalString(\n  value: unknown,\n  { maxLength, nullable = false }: { maxLength: number; nullable?: boolean },\n): string | null | undefined | false {\n  if (value === undefined) return undefined;\n  if (value === null) return nullable ? null : false;\n  if (typeof value !== 'string') return false;\n  const normalized = value.trim();\n  if (!normalized) return nullable ? null : false;\n  if (normalized.length > maxLength || CONTROL_CHAR_RE.test(normalized)) return false;\n  return normalized;\n}\n\nfunction parseRepositoryLinkInput(value: unknown): {\n  repositoryId: string;\n  branch: string | null;\n  sandboxProvider: string;\n  sandboxWorkdir: string;\n  setupCommand: string | null;\n  teardownCommand: string | null;\n} | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.repositoryId !== 'string' || !UUID_RE.test(input.repositoryId)) return null;\n  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });\n  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });\n  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });\n  const setupCommand = parseOptionalString(input.setupCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  const teardownCommand = parseOptionalString(input.teardownCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  if (\n    branch === false ||\n    typeof sandboxProvider !== 'string' ||\n    typeof sandboxWorkdir !== 'string' ||\n    setupCommand === false ||\n    teardownCommand === false\n  )\n    return null;\n  return {\n    repositoryId: input.repositoryId,\n    branch: branch ?? null,\n    sandboxProvider,\n    sandboxWorkdir,\n    setupCommand: setupCommand ?? null,\n    teardownCommand: teardownCommand ?? null,\n  };\n}\n\nfunction parseRepositoryUpdateInput(value: unknown): UpdateProjectRepositoryInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  const patch: UpdateProjectRepositoryInput = {};\n  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });\n  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });\n  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });\n  const setupCommand = parseOptionalString(input.setupCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  const teardownCommand = parseOptionalString(input.teardownCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  if (\n    branch === false ||\n    sandboxProvider === false ||\n    sandboxProvider === null ||\n    sandboxWorkdir === false ||\n    sandboxWorkdir === null ||\n    setupCommand === false ||\n    teardownCommand === false\n  )\n    return null;\n  if (branch !== undefined) patch.branch = branch;\n  if (sandboxProvider !== undefined) patch.sandboxProvider = sandboxProvider;\n  if (sandboxWorkdir !== undefined) patch.sandboxWorkdir = sandboxWorkdir;\n  if (setupCommand !== undefined) patch.setupCommand = setupCommand;\n  if (teardownCommand !== undefined) patch.teardownCommand = teardownCommand;\n  return Object.keys(patch).length > 0 ? patch : null;\n}\n\nexport interface ProjectRoutesDeps extends RouteDependencies {\n  /** Factory projects domain backing the CRUD surface. */\n  projects: FactoryProjectsStorage;\n  /** Source-control domain the connection/repository routes fan out over. */\n  sourceControl: SourceControlStorage;\n  /** Integration ids allowed as source-control connection targets. */\n  versionControlIntegrationIds?: string[];\n  /**\n   * Fire-and-forget hook invoked after a repository is linked to a project —\n   * kicks the initial base-checkpoint build. Must never throw.\n   */\n  onProjectRepositoryLinked?: (args: { orgId: string; projectRepository: ProjectRepository }) => void;\n  /** Shared lifecycle for retiring sessions before their owning records are deleted. */\n  sessionRetirement?: SessionRetirementCoordinator;\n  /** Work-items domain — retired sessions drop the refs work items hold on them. */\n  workItems?: Pick<WorkItemsStorage, 'clearSessionReferences'>;\n}\n\nexport class ProjectRoutes extends Route<ProjectRoutesDeps> {\n  readonly #versionControlIntegrationIds: Set<string>;\n\n  constructor(deps: ProjectRoutesDeps) {\n    super(deps);\n    this.#versionControlIntegrationIds = new Set(deps.versionControlIntegrationIds ?? []);\n  }\n\n  async #projects(): Promise<FactoryProjectsStorage> {\n    await this.deps.projects.ensureReady();\n    return this.deps.projects;\n  }\n\n  async #sourceControl(): Promise<SourceControlStorage> {\n    await this.deps.sourceControl.ensureReady();\n    return this.deps.sourceControl;\n  }\n\n  async #handles(): Promise<SourceControlStorageHandle[]> {\n    const storage = await this.#sourceControl();\n    return [...this.#versionControlIntegrationIds].map(integrationId => storage.forIntegration(integrationId));\n  }\n\n  async #project(orgId: string, id: string) {\n    return (await this.#projects()).get({ orgId, id });\n  }\n\n  async #findConnection({ orgId, projectId, id }: { orgId: string; projectId: string; id: string }) {\n    for (const handle of await this.#handles()) {\n      const connection = await handle.connections.get({ orgId, id });\n      if (connection?.factoryProjectId === projectId) return { handle, connection };\n    }\n    return null;\n  }\n\n  async #findProjectRepository({ orgId, projectId, id }: { orgId: string; projectId: string; id: string }) {\n    for (const handle of await this.#handles()) {\n      const projectRepository = await handle.projectRepositories.get({ orgId, id });\n      if (!projectRepository) continue;\n      const connection = await handle.connections.get({ orgId, id: projectRepository.connectionId });\n      if (connection?.factoryProjectId === projectId) return { handle, connection, projectRepository };\n    }\n    return null;\n  }\n\n  async #repositoryPayload(handle: SourceControlStorageHandle, orgId: string, projectRepository: ProjectRepository) {\n    const repository = await handle.repositories.get({ orgId, id: projectRepository.repositoryId });\n    return { ...projectRepository, repository };\n  }\n\n  async #retireProjectRepositorySessions(\n    handle: SourceControlStorageHandle,\n    orgId: string,\n    projectRepositoryId: string,\n  ): Promise<boolean> {\n    const sessions = await handle.sessions.listByProjectRepository({ projectRepositoryId });\n    if (sessions.length === 0) return true;\n    if (!this.deps.sessionRetirement) return false;\n    await this.deps.sessionRetirement.retireProjectRepositorySessions({\n      sourceControl: handle,\n      ...(this.deps.workItems ? { workItems: this.deps.workItems } : {}),\n      orgId,\n      projectRepositoryId,\n    });\n    return true;\n  }\n\n  async #resolveTenant(context: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(context);\n    const tenant = this.deps.auth.tenant(context);\n    if (!tenant) return { response: context.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: context.json(\n          { error: 'organization_required', message: 'Factory projects require an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          return context.json({ projects: await (await this.#projects()).list({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/factory/projects', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const input = parseCreateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project' }, 400);\n          const project = await (await this.#projects()).create({ orgId: tenant.orgId, userId: tenant.userId, input });\n          return context.json({ project }, 201);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          const project = await this.#project(tenant.orgId, id);\n          return project ? context.json({ project }) : context.json({ error: 'Project not found' }, 404);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'PATCH',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          const input = parseUpdateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project' }, 400);\n          const project = await (await this.#projects()).update({ orgId: tenant.orgId, id, input });\n          return project ? context.json({ project }) : context.json({ error: 'Project not found' }, 404);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          if (!(await this.#project(tenant.orgId, id))) return context.json({ error: 'Project not found' }, 404);\n          for (const handle of await this.#handles()) {\n            for (const connection of await handle.connections.list({ orgId: tenant.orgId, factoryProjectId: id })) {\n              for (const projectRepository of await handle.projectRepositories.list({\n                orgId: tenant.orgId,\n                connectionId: connection.id,\n              })) {\n                if (!(await this.#retireProjectRepositorySessions(handle, tenant.orgId, projectRepository.id))) {\n                  return context.json({ error: 'session_retirement_unavailable' }, 409);\n                }\n              }\n              await handle.connections.delete({ orgId: tenant.orgId, id: connection.id });\n            }\n          }\n          await (await this.#projects()).delete({ orgId: tenant.orgId, id });\n          return context.body(null, 204);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId) || !(await this.#project(tenant.orgId, projectId)))\n            return context.json({ error: 'Project not found' }, 404);\n          const connections = [];\n          for (const handle of await this.#handles()) {\n            for (const connection of await handle.connections.list({\n              orgId: tenant.orgId,\n              factoryProjectId: projectId,\n            })) {\n              const installation = await handle.installations.get({\n                orgId: tenant.orgId,\n                id: connection.installationId,\n              });\n              // Skip orphaned connections whose installation was pruned (e.g.\n              // the user uninstalled the GitHub App). Otherwise\n              // `projectRepositories.list` throws `requireConnection` and the\n              // whole endpoint 500s, which hangs the web UI on the page\n              // loader for every project. New code cascade-deletes these on\n              // installation removal, but this defensive skip lets already-\n              // orphaned rows in existing databases self-heal on read.\n              if (!installation) continue;\n              const links = await handle.projectRepositories.list({ orgId: tenant.orgId, connectionId: connection.id });\n              connections.push({\n                ...connection,\n                installation,\n                repositories: await Promise.all(links.map(link => this.#repositoryPayload(handle, tenant.orgId, link))),\n              });\n            }\n          }\n          return context.json({ connections });\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId) || !(await this.#project(tenant.orgId, projectId)))\n            return context.json({ error: 'Project not found' }, 404);\n          const input = parseConnectionInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_source_control_connection' }, 400);\n          if (!this.#versionControlIntegrationIds.has(input.integrationId))\n            return context.json({ error: 'Source-control integration not found' }, 404);\n          const handle = (await this.#sourceControl()).forIntegration(input.integrationId);\n          if (!(await handle.installations.get({ orgId: tenant.orgId, id: input.installationId })))\n            return context.json({ error: 'Source-control installation not found' }, 404);\n          const connection = await handle.connections.create({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            installationId: input.installationId,\n            createdByUserId: tenant.userId,\n          });\n          return context.json({ connection }, 201);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections/:connectionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const connectionId = context.req.param('connectionId');\n          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))\n            return context.json({ error: 'Source-control connection not found' }, 404);\n          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });\n          if (!found) return context.json({ error: 'Source-control connection not found' }, 404);\n          for (const projectRepository of await found.handle.projectRepositories.list({\n            orgId: tenant.orgId,\n            connectionId,\n          })) {\n            if (!(await this.#retireProjectRepositorySessions(found.handle, tenant.orgId, projectRepository.id))) {\n              return context.json({ error: 'session_retirement_unavailable' }, 409);\n            }\n          }\n          await found.handle.connections.delete({ orgId: tenant.orgId, id: connectionId });\n          return context.body(null, 204);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections/:connectionId/repositories', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const connectionId = context.req.param('connectionId');\n          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))\n            return context.json({ error: 'Source-control connection not found' }, 404);\n          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });\n          if (!found) return context.json({ error: 'Source-control connection not found' }, 404);\n          const input = parseRepositoryLinkInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project_repository' }, 400);\n          const repository = await found.handle.repositories.get({ orgId: tenant.orgId, id: input.repositoryId });\n          if (!repository || repository.installationId !== found.connection.installationId)\n            return context.json({ error: 'Source-control repository not found' }, 404);\n          const projectRepository = await found.handle.projectRepositories.link({\n            orgId: tenant.orgId,\n            connectionId,\n            createdByUserId: tenant.userId,\n            ...input,\n          });\n          try {\n            this.deps.onProjectRepositoryLinked?.({ orgId: tenant.orgId, projectRepository });\n          } catch (error) {\n            console.warn('[factory] onProjectRepositoryLinked failed after a successful repository link:', error);\n          }\n          return context.json(\n            { projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository) },\n            201,\n          );\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/repositories/:projectRepositoryId', {\n        method: 'PATCH',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const projectRepositoryId = context.req.param('projectRepositoryId');\n          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))\n            return context.json({ error: 'Project repository not found' }, 404);\n          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });\n          if (!found) return context.json({ error: 'Project repository not found' }, 404);\n          const input = parseRepositoryUpdateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project_repository' }, 400);\n          const projectRepository = await found.handle.projectRepositories.update({\n            orgId: tenant.orgId,\n            id: projectRepositoryId,\n            input,\n          });\n          return context.json({\n            projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository!),\n          });\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/repositories/:projectRepositoryId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const projectRepositoryId = context.req.param('projectRepositoryId');\n          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))\n            return context.json({ error: 'Project repository not found' }, 404);\n          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });\n          if (!found) return context.json({ error: 'Project repository not found' }, 404);\n          if (!(await this.#retireProjectRepositorySessions(found.handle, tenant.orgId, projectRepositoryId))) {\n            return context.json({ error: 'session_retirement_unavailable' }, 409);\n          }\n          await found.handle.projectRepositories.unlink({ orgId: tenant.orgId, id: projectRepositoryId });\n          return context.body(null, 204);\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;AAoBA,MAAM,UAAU;AAChB,MAAM,kBAAkB;AACxB,MAAM,yBAAyB;AAC/B,MAAM,gCAAgC;AACtC,MAAM,oBAAoB;AAC1B,MAAM,8BAA8B;AACpC,MAAM,6BAA6B;AACnC,MAAM,kBAAkB;AAExB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,eAAe,SAAS,SAAgD;CACtE,IAAI;EACF,OAAO,MAAM,QAAQ,IAAI,KAAK;CAChC,QAAQ;EACN;CACF;AACF;AAEA,SAAS,iBAAiB,OAAkD;CAC1E,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,SAAS,UAAU,OAAO;CAC3C,MAAM,OAAO,MAAM,KAAK,KAAK;CAC7B,IAAI,CAAC,QAAQ,KAAK,SAAS,iBAAiB,OAAO;CACnD,IAAI,MAAM,gBAAgB,KAAA,KAAa,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,UAChG,OAAO;CACT,MAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO;CAC/F,IAAI,eAAe,YAAY,SAAS,wBAAwB,OAAO;CACvE,OAAO;EAAE;EAAM;CAAY;AAC7B;AAEA,SAAS,iBAAiB,OAAkD;CAC1E,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,MAAM,QAAmC,CAAC;CAC1C,IAAI,MAAM,SAAS,KAAA,GAAW;EAC5B,IAAI,OAAO,MAAM,SAAS,UAAU,OAAO;EAC3C,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,IAAI,CAAC,QAAQ,KAAK,SAAS,iBAAiB,OAAO;EACnD,MAAM,OAAO;CACf;CACA,IAAI,MAAM,gBAAgB,KAAA,GAAW;EACnC,IAAI,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,UAAU,OAAO;EAChF,MAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO;EAC/F,IAAI,eAAe,YAAY,SAAS,wBAAwB,OAAO;EACvE,MAAM,cAAc;CACtB;CACA,IAAI,MAAM,mBAAmB,KAAA,GAAW;EACtC,MAAM,iBAAiB,oBAAoB,MAAM,gBAAgB;GAAE,WAAW;GAAiB,UAAU;EAAK,CAAC;EAC/G,IAAI,mBAAmB,OAAO,OAAO;EACrC,MAAM,iBAAiB,kBAAkB;CAC3C;CACA,IAAI,MAAM,0BAA0B,KAAA,GAAW;EAC7C,IAAI,OAAO,MAAM,0BAA0B,WAAW,OAAO;EAC7D,MAAM,wBAAwB,MAAM;CACtC;CACA,IAAI,MAAM,mBAAmB,KAAA,GAAW;EACtC,IAAI,OAAO,MAAM,mBAAmB,WAAW,OAAO;EACtD,MAAM,iBAAiB,MAAM;CAC/B;CACA,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ;AACjD;AAEA,SAAS,qBAAqB,OAA0E;CACtG,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,kBAAkB,YAAY,CAAC,MAAM,cAAc,KAAK,GAAG,OAAO;CACnF,IAAI,OAAO,MAAM,mBAAmB,YAAY,CAAC,QAAQ,KAAK,MAAM,cAAc,GAAG,OAAO;CAC5F,OAAO;EAAE,eAAe,MAAM,cAAc,KAAK;EAAG,gBAAgB,MAAM;CAAe;AAC3F;AAEA,SAAS,oBACP,OACA,EAAE,WAAW,WAAW,SACW;CACnC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,UAAU,MAAM,OAAO,WAAW,OAAO;CAC7C,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,aAAa,MAAM,KAAK;CAC9B,IAAI,CAAC,YAAY,OAAO,WAAW,OAAO;CAC1C,IAAI,WAAW,SAAS,aAAa,gBAAgB,KAAK,UAAU,GAAG,OAAO;CAC9E,OAAO;AACT;AAEA,SAAS,yBAAyB,OAOzB;CACP,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,iBAAiB,YAAY,CAAC,QAAQ,KAAK,MAAM,YAAY,GAAG,OAAO;CACxF,MAAM,SAAS,oBAAoB,MAAM,QAAQ;EAAE,WAAW;EAAmB,UAAU;CAAK,CAAC;CACjG,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB,EAAE,WAAW,4BAA4B,CAAC;CAC7G,MAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,2BAA2B,CAAC;CAC1G,MAAM,eAAe,oBAAoB,MAAM,cAAc;EAC3D,WAAW;EACX,UAAU;CACZ,CAAC;CACD,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB;EACjE,WAAW;EACX,UAAU;CACZ,CAAC;CACD,IACE,WAAW,SACX,OAAO,oBAAoB,YAC3B,OAAO,mBAAmB,YAC1B,iBAAiB,SACjB,oBAAoB,OAEpB,OAAO;CACT,OAAO;EACL,cAAc,MAAM;EACpB,QAAQ,UAAU;EAClB;EACA;EACA,cAAc,gBAAgB;EAC9B,iBAAiB,mBAAmB;CACtC;AACF;AAEA,SAAS,2BAA2B,OAAqD;CACvF,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,MAAM,QAAsC,CAAC;CAC7C,MAAM,SAAS,oBAAoB,MAAM,QAAQ;EAAE,WAAW;EAAmB,UAAU;CAAK,CAAC;CACjG,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB,EAAE,WAAW,4BAA4B,CAAC;CAC7G,MAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,2BAA2B,CAAC;CAC1G,MAAM,eAAe,oBAAoB,MAAM,cAAc;EAC3D,WAAW;EACX,UAAU;CACZ,CAAC;CACD,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB;EACjE,WAAW;EACX,UAAU;CACZ,CAAC;CACD,IACE,WAAW,SACX,oBAAoB,SACpB,oBAAoB,QACpB,mBAAmB,SACnB,mBAAmB,QACnB,iBAAiB,SACjB,oBAAoB,OAEpB,OAAO;CACT,IAAI,WAAW,KAAA,GAAW,MAAM,SAAS;CACzC,IAAI,oBAAoB,KAAA,GAAW,MAAM,kBAAkB;CAC3D,IAAI,mBAAmB,KAAA,GAAW,MAAM,iBAAiB;CACzD,IAAI,iBAAiB,KAAA,GAAW,MAAM,eAAe;CACrD,IAAI,oBAAoB,KAAA,GAAW,MAAM,kBAAkB;CAC3D,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ;AACjD;AAoBA,IAAa,gBAAb,cAAmC,MAAyB;CAC1D;CAEA,YAAY,MAAyB;EACnC,MAAM,IAAI;EACV,KAAKA,gCAAgC,IAAI,IAAI,KAAK,gCAAgC,CAAC,CAAC;CACtF;CAEA,MAAMC,YAA6C;EACjD,MAAM,KAAK,KAAK,SAAS,YAAY;EACrC,OAAO,KAAK,KAAK;CACnB;CAEA,MAAMC,iBAAgD;EACpD,MAAM,KAAK,KAAK,cAAc,YAAY;EAC1C,OAAO,KAAK,KAAK;CACnB;CAEA,MAAMC,WAAkD;EACtD,MAAM,UAAU,MAAM,KAAKD,eAAe;EAC1C,OAAO,CAAC,GAAG,KAAKF,6BAA6B,CAAC,CAAC,KAAI,kBAAiB,QAAQ,eAAe,aAAa,CAAC;CAC3G;CAEA,MAAMI,SAAS,OAAe,IAAY;EACxC,QAAQ,MAAM,KAAKH,UAAU,EAAA,CAAG,IAAI;GAAE;GAAO;EAAG,CAAC;CACnD;CAEA,MAAMI,gBAAgB,EAAE,OAAO,WAAW,MAAwD;EAChG,KAAK,MAAM,UAAU,MAAM,KAAKF,SAAS,GAAG;GAC1C,MAAM,aAAa,MAAM,OAAO,YAAY,IAAI;IAAE;IAAO;GAAG,CAAC;GAC7D,IAAI,YAAY,qBAAqB,WAAW,OAAO;IAAE;IAAQ;GAAW;EAC9E;EACA,OAAO;CACT;CAEA,MAAMG,uBAAuB,EAAE,OAAO,WAAW,MAAwD;EACvG,KAAK,MAAM,UAAU,MAAM,KAAKH,SAAS,GAAG;GAC1C,MAAM,oBAAoB,MAAM,OAAO,oBAAoB,IAAI;IAAE;IAAO;GAAG,CAAC;GAC5E,IAAI,CAAC,mBAAmB;GACxB,MAAM,aAAa,MAAM,OAAO,YAAY,IAAI;IAAE;IAAO,IAAI,kBAAkB;GAAa,CAAC;GAC7F,IAAI,YAAY,qBAAqB,WAAW,OAAO;IAAE;IAAQ;IAAY;GAAkB;EACjG;EACA,OAAO;CACT;CAEA,MAAMI,mBAAmB,QAAoC,OAAe,mBAAsC;EAChH,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI;GAAE;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC9F,OAAO;GAAE,GAAG;GAAmB;EAAW;CAC5C;CAEA,MAAMC,iCACJ,QACA,OACA,qBACkB;EAElB,KAAI,MADmB,OAAO,SAAS,wBAAwB,EAAE,oBAAoB,CAAC,EAAA,CACzE,WAAW,GAAG,OAAO;EAClC,IAAI,CAAC,KAAK,KAAK,mBAAmB,OAAO;EACzC,MAAM,KAAK,KAAK,kBAAkB,gCAAgC;GAChE,eAAe;GACf,GAAI,KAAK,KAAK,YAAY,EAAE,WAAW,KAAK,KAAK,UAAU,IAAI,CAAC;GAChE;GACA;EACF,CAAC;EACD,OAAO;CACT;CAEA,MAAMC,eAAe,SAAuF;EAC1G,MAAM,KAAK,KAAK,KAAK,WAAW,OAAO;EACvC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,OAAO;EAC5C,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,QAAQ,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EAC7E,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,QAAQ,KAChB;GAAE,OAAO;GAAyB,SAAS;EAA4C,GACvF,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;CAEA,SAAqB;EACnB,OAAO;GACL,iBAAiB,yBAAyB;IACxC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKA,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,OAAO,QAAQ,KAAK,EAAE,UAAU,OAAO,MAAM,KAAKR,UAAU,EAAA,CAAG,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;IAChG;GACF,CAAC;GACD,iBAAiB,yBAAyB;IACxC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,QAAQ,iBAAiB,MAAM,SAAS,OAAO,CAAC;KACtD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KACjE,MAAM,UAAU,OAAO,MAAM,KAAKR,UAAU,EAAA,CAAG,OAAO;MAAE,OAAO,OAAO;MAAO,QAAQ,OAAO;MAAQ;KAAM,CAAC;KAC3G,OAAO,QAAQ,KAAK,EAAE,QAAQ,GAAG,GAAG;IACtC;GACF,CAAC;GACD,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;KACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrF,MAAM,UAAU,MAAM,KAAKL,SAAS,OAAO,OAAO,EAAE;KACpD,OAAO,UAAU,QAAQ,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC/F;GACF,CAAC;GACD,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKK,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;KACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrF,MAAM,QAAQ,iBAAiB,MAAM,SAAS,OAAO,CAAC;KACtD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KACjE,MAAM,UAAU,OAAO,MAAM,KAAKR,UAAU,EAAA,CAAG,OAAO;MAAE,OAAO,OAAO;MAAO;MAAI;KAAM,CAAC;KACxF,OAAO,UAAU,QAAQ,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC/F;GACF,CAAC;GACD,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;KACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrF,IAAI,CAAE,MAAM,KAAKL,SAAS,OAAO,OAAO,EAAE,GAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrG,KAAK,MAAM,UAAU,MAAM,KAAKD,SAAS,GACvC,KAAK,MAAM,cAAc,MAAM,OAAO,YAAY,KAAK;MAAE,OAAO,OAAO;MAAO,kBAAkB;KAAG,CAAC,GAAG;MACrG,KAAK,MAAM,qBAAqB,MAAM,OAAO,oBAAoB,KAAK;OACpE,OAAO,OAAO;OACd,cAAc,WAAW;MAC3B,CAAC,GACC,IAAI,CAAE,MAAM,KAAKK,iCAAiC,QAAQ,OAAO,OAAO,kBAAkB,EAAE,GAC1F,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;MAGxE,MAAM,OAAO,YAAY,OAAO;OAAE,OAAO,OAAO;OAAO,IAAI,WAAW;MAAG,CAAC;KAC5E;KAEF,OAAO,MAAM,KAAKP,UAAU,EAAA,CAAG,OAAO;MAAE,OAAO,OAAO;MAAO;KAAG,CAAC;KACjE,OAAO,QAAQ,KAAK,MAAM,GAAG;IAC/B;GACF,CAAC;GACD,iBAAiB,wDAAwD;IACvE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAE,MAAM,KAAKL,SAAS,OAAO,OAAO,SAAS,GACzF,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzD,MAAM,cAAc,CAAC;KACrB,KAAK,MAAM,UAAU,MAAM,KAAKD,SAAS,GACvC,KAAK,MAAM,cAAc,MAAM,OAAO,YAAY,KAAK;MACrD,OAAO,OAAO;MACd,kBAAkB;KACpB,CAAC,GAAG;MACF,MAAM,eAAe,MAAM,OAAO,cAAc,IAAI;OAClD,OAAO,OAAO;OACd,IAAI,WAAW;MACjB,CAAC;MAQD,IAAI,CAAC,cAAc;MACnB,MAAM,QAAQ,MAAM,OAAO,oBAAoB,KAAK;OAAE,OAAO,OAAO;OAAO,cAAc,WAAW;MAAG,CAAC;MACxG,YAAY,KAAK;OACf,GAAG;OACH;OACA,cAAc,MAAM,QAAQ,IAAI,MAAM,KAAI,SAAQ,KAAKI,mBAAmB,QAAQ,OAAO,OAAO,IAAI,CAAC,CAAC;MACxG,CAAC;KACH;KAEF,OAAO,QAAQ,KAAK,EAAE,YAAY,CAAC;IACrC;GACF,CAAC;GACD,iBAAiB,wDAAwD;IACvE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKE,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAE,MAAM,KAAKL,SAAS,OAAO,OAAO,SAAS,GACzF,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzD,MAAM,QAAQ,qBAAqB,MAAM,SAAS,OAAO,CAAC;KAC1D,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KACnF,IAAI,CAAC,KAAKJ,8BAA8B,IAAI,MAAM,aAAa,GAC7D,OAAO,QAAQ,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;KAC5E,MAAM,UAAU,MAAM,KAAKE,eAAe,EAAA,CAAG,eAAe,MAAM,aAAa;KAC/E,IAAI,CAAE,MAAM,OAAO,cAAc,IAAI;MAAE,OAAO,OAAO;MAAO,IAAI,MAAM;KAAe,CAAC,GACpF,OAAO,QAAQ,KAAK,EAAE,OAAO,wCAAwC,GAAG,GAAG;KAC7E,MAAM,aAAa,MAAM,OAAO,YAAY,OAAO;MACjD,OAAO,OAAO;MACd,kBAAkB;MAClB,gBAAgB,MAAM;MACtB,iBAAiB,OAAO;KAC1B,CAAC;KACD,OAAO,QAAQ,KAAK,EAAE,WAAW,GAAG,GAAG;IACzC;GACF,CAAC;GACD,iBAAiB,sEAAsE;IACrF,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKO,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,eAAe,QAAQ,IAAI,MAAM,cAAc;KACrD,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY,GACvF,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KAC3E,MAAM,QAAQ,MAAM,KAAKJ,gBAAgB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAa,CAAC;KAC7F,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KACrF,KAAK,MAAM,qBAAqB,MAAM,MAAM,OAAO,oBAAoB,KAAK;MAC1E,OAAO,OAAO;MACd;KACF,CAAC,GACC,IAAI,CAAE,MAAM,KAAKG,iCAAiC,MAAM,QAAQ,OAAO,OAAO,kBAAkB,EAAE,GAChG,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;KAGxE,MAAM,MAAM,OAAO,YAAY,OAAO;MAAE,OAAO,OAAO;MAAO,IAAI;KAAa,CAAC;KAC/E,OAAO,QAAQ,KAAK,MAAM,GAAG;IAC/B;GACF,CAAC;GACD,iBAAiB,mFAAmF;IAClG,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKC,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,eAAe,QAAQ,IAAI,MAAM,cAAc;KACrD,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY,GACvF,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KAC3E,MAAM,QAAQ,MAAM,KAAKJ,gBAAgB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAa,CAAC;KAC7F,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KACrF,MAAM,QAAQ,yBAAyB,MAAM,SAAS,OAAO,CAAC;KAC9D,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;KAC5E,MAAM,aAAa,MAAM,MAAM,OAAO,aAAa,IAAI;MAAE,OAAO,OAAO;MAAO,IAAI,MAAM;KAAa,CAAC;KACtG,IAAI,CAAC,cAAc,WAAW,mBAAmB,MAAM,WAAW,gBAChE,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KAC3E,MAAM,oBAAoB,MAAM,MAAM,OAAO,oBAAoB,KAAK;MACpE,OAAO,OAAO;MACd;MACA,iBAAiB,OAAO;MACxB,GAAG;KACL,CAAC;KACD,IAAI;MACF,KAAK,KAAK,4BAA4B;OAAE,OAAO,OAAO;OAAO;MAAkB,CAAC;KAClF,SAAS,OAAO;MACd,QAAQ,KAAK,kFAAkF,KAAK;KACtG;KACA,OAAO,QAAQ,KACb,EAAE,mBAAmB,MAAM,KAAKE,mBAAmB,MAAM,QAAQ,OAAO,OAAO,iBAAiB,EAAE,GAClG,GACF;IACF;GACF,CAAC;GACD,iBAAiB,+DAA+D;IAC9E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKE,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,sBAAsB,QAAQ,IAAI,MAAM,qBAAqB;KACnE,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,uBAAuB,CAAC,QAAQ,KAAK,mBAAmB,GACrG,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KACpE,MAAM,QAAQ,MAAM,KAAKH,uBAAuB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAoB,CAAC;KAC3G,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KAC9E,MAAM,QAAQ,2BAA2B,MAAM,SAAS,OAAO,CAAC;KAChE,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;KAC5E,MAAM,oBAAoB,MAAM,MAAM,OAAO,oBAAoB,OAAO;MACtE,OAAO,OAAO;MACd,IAAI;MACJ;KACF,CAAC;KACD,OAAO,QAAQ,KAAK,EAClB,mBAAmB,MAAM,KAAKC,mBAAmB,MAAM,QAAQ,OAAO,OAAO,iBAAkB,EACjG,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,+DAA+D;IAC9E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKE,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,sBAAsB,QAAQ,IAAI,MAAM,qBAAqB;KACnE,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,uBAAuB,CAAC,QAAQ,KAAK,mBAAmB,GACrG,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KACpE,MAAM,QAAQ,MAAM,KAAKH,uBAAuB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAoB,CAAC;KAC3G,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KAC9E,IAAI,CAAE,MAAM,KAAKE,iCAAiC,MAAM,QAAQ,OAAO,OAAO,mBAAmB,GAC/F,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;KAEtE,MAAM,MAAM,OAAO,oBAAoB,OAAO;MAAE,OAAO,OAAO;MAAO,IAAI;KAAoB,CAAC;KAC9F,OAAO,QAAQ,KAAK,MAAM,GAAG;IAC/B;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"projects.js","names":["#versionControlIntegrationIds","#projects","#sourceControl","#handles","#project","#findConnection","#findProjectRepository","#repositoryPayload","#retireProjectRepositorySessions","#resolveTenant"],"sources":["../../src/routes/projects.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';\nimport type {\n  CreateFactoryProjectInput,\n  FactoryProjectsStorage,\n  UpdateFactoryProjectInput,\n} from '../storage/domains/projects/base.js';\nimport type {\n  ProjectRepository,\n  SourceControlStorage,\n  SourceControlStorageHandle,\n  UpdateProjectRepositoryInput,\n} from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_NAME_LENGTH = 200;\nconst MAX_DESCRIPTION_LENGTH = 2_000;\nconst MAX_REPOSITORY_COMMAND_LENGTH = 2_000;\nconst MAX_BRANCH_LENGTH = 255;\nconst MAX_SANDBOX_PROVIDER_LENGTH = 100;\nconst MAX_SANDBOX_WORKDIR_LENGTH = 1_000;\nconst CONTROL_CHAR_RE = /[\\0-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]/;\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nasync function readJson(context: Context): Promise<unknown | undefined> {\n  try {\n    return await context.req.json();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction parseCreateInput(value: unknown): CreateFactoryProjectInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.name !== 'string') return null;\n  const name = input.name.trim();\n  if (!name || name.length > MAX_NAME_LENGTH) return null;\n  if (input.description !== undefined && input.description !== null && typeof input.description !== 'string')\n    return null;\n  const description = typeof input.description === 'string' ? input.description.trim() || null : null;\n  if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;\n  return { name, description };\n}\n\nfunction parseUpdateInput(value: unknown): UpdateFactoryProjectInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  const patch: UpdateFactoryProjectInput = {};\n  if (input.name !== undefined) {\n    if (typeof input.name !== 'string') return null;\n    const name = input.name.trim();\n    if (!name || name.length > MAX_NAME_LENGTH) return null;\n    patch.name = name;\n  }\n  if (input.description !== undefined) {\n    if (input.description !== null && typeof input.description !== 'string') return null;\n    const description = typeof input.description === 'string' ? input.description.trim() || null : null;\n    if (description && description.length > MAX_DESCRIPTION_LENGTH) return null;\n    patch.description = description;\n  }\n  if (input.defaultModelId !== undefined) {\n    const defaultModelId = parseOptionalString(input.defaultModelId, { maxLength: MAX_NAME_LENGTH, nullable: true });\n    if (defaultModelId === false) return null;\n    patch.defaultModelId = defaultModelId ?? null;\n  }\n  if (input.slackWorkItemsEnabled !== undefined) {\n    if (typeof input.slackWorkItemsEnabled !== 'boolean') return null;\n    patch.slackWorkItemsEnabled = input.slackWorkItemsEnabled;\n  }\n  if (input.autoRunEnabled !== undefined) {\n    if (typeof input.autoRunEnabled !== 'boolean') return null;\n    patch.autoRunEnabled = input.autoRunEnabled;\n  }\n  if (input.autoApprovePlans !== undefined) {\n    if (typeof input.autoApprovePlans !== 'boolean') return null;\n    patch.autoApprovePlans = input.autoApprovePlans;\n  }\n  return Object.keys(patch).length > 0 ? patch : null;\n}\n\nfunction parseConnectionInput(value: unknown): { integrationId: string; installationId: string } | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.integrationId !== 'string' || !input.integrationId.trim()) return null;\n  if (typeof input.installationId !== 'string' || !UUID_RE.test(input.installationId)) return null;\n  return { integrationId: input.integrationId.trim(), installationId: input.installationId };\n}\n\nfunction parseOptionalString(\n  value: unknown,\n  { maxLength, nullable = false }: { maxLength: number; nullable?: boolean },\n): string | null | undefined | false {\n  if (value === undefined) return undefined;\n  if (value === null) return nullable ? null : false;\n  if (typeof value !== 'string') return false;\n  const normalized = value.trim();\n  if (!normalized) return nullable ? null : false;\n  if (normalized.length > maxLength || CONTROL_CHAR_RE.test(normalized)) return false;\n  return normalized;\n}\n\nfunction parseRepositoryLinkInput(value: unknown): {\n  repositoryId: string;\n  branch: string | null;\n  sandboxProvider: string;\n  sandboxWorkdir: string;\n  setupCommand: string | null;\n  teardownCommand: string | null;\n} | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  if (typeof input.repositoryId !== 'string' || !UUID_RE.test(input.repositoryId)) return null;\n  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });\n  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });\n  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });\n  const setupCommand = parseOptionalString(input.setupCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  const teardownCommand = parseOptionalString(input.teardownCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  if (\n    branch === false ||\n    typeof sandboxProvider !== 'string' ||\n    typeof sandboxWorkdir !== 'string' ||\n    setupCommand === false ||\n    teardownCommand === false\n  )\n    return null;\n  return {\n    repositoryId: input.repositoryId,\n    branch: branch ?? null,\n    sandboxProvider,\n    sandboxWorkdir,\n    setupCommand: setupCommand ?? null,\n    teardownCommand: teardownCommand ?? null,\n  };\n}\n\nfunction parseRepositoryUpdateInput(value: unknown): UpdateProjectRepositoryInput | null {\n  if (!value || typeof value !== 'object') return null;\n  const input = value as Record<string, unknown>;\n  const patch: UpdateProjectRepositoryInput = {};\n  const branch = parseOptionalString(input.branch, { maxLength: MAX_BRANCH_LENGTH, nullable: true });\n  const sandboxProvider = parseOptionalString(input.sandboxProvider, { maxLength: MAX_SANDBOX_PROVIDER_LENGTH });\n  const sandboxWorkdir = parseOptionalString(input.sandboxWorkdir, { maxLength: MAX_SANDBOX_WORKDIR_LENGTH });\n  const setupCommand = parseOptionalString(input.setupCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  const teardownCommand = parseOptionalString(input.teardownCommand, {\n    maxLength: MAX_REPOSITORY_COMMAND_LENGTH,\n    nullable: true,\n  });\n  if (\n    branch === false ||\n    sandboxProvider === false ||\n    sandboxProvider === null ||\n    sandboxWorkdir === false ||\n    sandboxWorkdir === null ||\n    setupCommand === false ||\n    teardownCommand === false\n  )\n    return null;\n  if (branch !== undefined) patch.branch = branch;\n  if (sandboxProvider !== undefined) patch.sandboxProvider = sandboxProvider;\n  if (sandboxWorkdir !== undefined) patch.sandboxWorkdir = sandboxWorkdir;\n  if (setupCommand !== undefined) patch.setupCommand = setupCommand;\n  if (teardownCommand !== undefined) patch.teardownCommand = teardownCommand;\n  return Object.keys(patch).length > 0 ? patch : null;\n}\n\nexport interface ProjectRoutesDeps extends RouteDependencies {\n  /** Factory projects domain backing the CRUD surface. */\n  projects: FactoryProjectsStorage;\n  /** Source-control domain the connection/repository routes fan out over. */\n  sourceControl: SourceControlStorage;\n  /** Integration ids allowed as source-control connection targets. */\n  versionControlIntegrationIds?: string[];\n  /**\n   * Fire-and-forget hook invoked after a repository is linked to a project —\n   * kicks the initial base-checkpoint build. Must never throw.\n   */\n  onProjectRepositoryLinked?: (args: { orgId: string; projectRepository: ProjectRepository }) => void;\n  /** Shared lifecycle for retiring sessions before their owning records are deleted. */\n  sessionRetirement?: SessionRetirementCoordinator;\n  /** Work-items domain — retired sessions drop the refs work items hold on them. */\n  workItems?: Pick<WorkItemsStorage, 'clearSessionReferences'>;\n}\n\nexport class ProjectRoutes extends Route<ProjectRoutesDeps> {\n  readonly #versionControlIntegrationIds: Set<string>;\n\n  constructor(deps: ProjectRoutesDeps) {\n    super(deps);\n    this.#versionControlIntegrationIds = new Set(deps.versionControlIntegrationIds ?? []);\n  }\n\n  async #projects(): Promise<FactoryProjectsStorage> {\n    await this.deps.projects.ensureReady();\n    return this.deps.projects;\n  }\n\n  async #sourceControl(): Promise<SourceControlStorage> {\n    await this.deps.sourceControl.ensureReady();\n    return this.deps.sourceControl;\n  }\n\n  async #handles(): Promise<SourceControlStorageHandle[]> {\n    const storage = await this.#sourceControl();\n    return [...this.#versionControlIntegrationIds].map(integrationId => storage.forIntegration(integrationId));\n  }\n\n  async #project(orgId: string, id: string) {\n    return (await this.#projects()).get({ orgId, id });\n  }\n\n  async #findConnection({ orgId, projectId, id }: { orgId: string; projectId: string; id: string }) {\n    for (const handle of await this.#handles()) {\n      const connection = await handle.connections.get({ orgId, id });\n      if (connection?.factoryProjectId === projectId) return { handle, connection };\n    }\n    return null;\n  }\n\n  async #findProjectRepository({ orgId, projectId, id }: { orgId: string; projectId: string; id: string }) {\n    for (const handle of await this.#handles()) {\n      const projectRepository = await handle.projectRepositories.get({ orgId, id });\n      if (!projectRepository) continue;\n      const connection = await handle.connections.get({ orgId, id: projectRepository.connectionId });\n      if (connection?.factoryProjectId === projectId) return { handle, connection, projectRepository };\n    }\n    return null;\n  }\n\n  async #repositoryPayload(handle: SourceControlStorageHandle, orgId: string, projectRepository: ProjectRepository) {\n    const repository = await handle.repositories.get({ orgId, id: projectRepository.repositoryId });\n    return { ...projectRepository, repository };\n  }\n\n  async #retireProjectRepositorySessions(\n    handle: SourceControlStorageHandle,\n    orgId: string,\n    projectRepositoryId: string,\n  ): Promise<boolean> {\n    const sessions = await handle.sessions.listByProjectRepository({ projectRepositoryId });\n    if (sessions.length === 0) return true;\n    if (!this.deps.sessionRetirement) return false;\n    await this.deps.sessionRetirement.retireProjectRepositorySessions({\n      sourceControl: handle,\n      ...(this.deps.workItems ? { workItems: this.deps.workItems } : {}),\n      orgId,\n      projectRepositoryId,\n    });\n    return true;\n  }\n\n  async #resolveTenant(context: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(context);\n    const tenant = this.deps.auth.tenant(context);\n    if (!tenant) return { response: context.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: context.json(\n          { error: 'organization_required', message: 'Factory projects require an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          return context.json({ projects: await (await this.#projects()).list({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/factory/projects', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const input = parseCreateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project' }, 400);\n          const project = await (await this.#projects()).create({ orgId: tenant.orgId, userId: tenant.userId, input });\n          return context.json({ project }, 201);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          const project = await this.#project(tenant.orgId, id);\n          return project ? context.json({ project }) : context.json({ error: 'Project not found' }, 404);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'PATCH',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          const input = parseUpdateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project' }, 400);\n          const project = await (await this.#projects()).update({ orgId: tenant.orgId, id, input });\n          return project ? context.json({ project }) : context.json({ error: 'Project not found' }, 404);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const id = context.req.param('id');\n          if (!id || !UUID_RE.test(id)) return context.json({ error: 'Project not found' }, 404);\n          if (!(await this.#project(tenant.orgId, id))) return context.json({ error: 'Project not found' }, 404);\n          for (const handle of await this.#handles()) {\n            for (const connection of await handle.connections.list({ orgId: tenant.orgId, factoryProjectId: id })) {\n              for (const projectRepository of await handle.projectRepositories.list({\n                orgId: tenant.orgId,\n                connectionId: connection.id,\n              })) {\n                if (!(await this.#retireProjectRepositorySessions(handle, tenant.orgId, projectRepository.id))) {\n                  return context.json({ error: 'session_retirement_unavailable' }, 409);\n                }\n              }\n              await handle.connections.delete({ orgId: tenant.orgId, id: connection.id });\n            }\n          }\n          await (await this.#projects()).delete({ orgId: tenant.orgId, id });\n          return context.body(null, 204);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId) || !(await this.#project(tenant.orgId, projectId)))\n            return context.json({ error: 'Project not found' }, 404);\n          const connections = [];\n          for (const handle of await this.#handles()) {\n            for (const connection of await handle.connections.list({\n              orgId: tenant.orgId,\n              factoryProjectId: projectId,\n            })) {\n              const installation = await handle.installations.get({\n                orgId: tenant.orgId,\n                id: connection.installationId,\n              });\n              // Skip orphaned connections whose installation was pruned (e.g.\n              // the user uninstalled the GitHub App). Otherwise\n              // `projectRepositories.list` throws `requireConnection` and the\n              // whole endpoint 500s, which hangs the web UI on the page\n              // loader for every project. New code cascade-deletes these on\n              // installation removal, but this defensive skip lets already-\n              // orphaned rows in existing databases self-heal on read.\n              if (!installation) continue;\n              const links = await handle.projectRepositories.list({ orgId: tenant.orgId, connectionId: connection.id });\n              connections.push({\n                ...connection,\n                installation,\n                repositories: await Promise.all(links.map(link => this.#repositoryPayload(handle, tenant.orgId, link))),\n              });\n            }\n          }\n          return context.json({ connections });\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId) || !(await this.#project(tenant.orgId, projectId)))\n            return context.json({ error: 'Project not found' }, 404);\n          const input = parseConnectionInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_source_control_connection' }, 400);\n          if (!this.#versionControlIntegrationIds.has(input.integrationId))\n            return context.json({ error: 'Source-control integration not found' }, 404);\n          const handle = (await this.#sourceControl()).forIntegration(input.integrationId);\n          if (!(await handle.installations.get({ orgId: tenant.orgId, id: input.installationId })))\n            return context.json({ error: 'Source-control installation not found' }, 404);\n          const connection = await handle.connections.create({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            installationId: input.installationId,\n            createdByUserId: tenant.userId,\n          });\n          return context.json({ connection }, 201);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections/:connectionId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const connectionId = context.req.param('connectionId');\n          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))\n            return context.json({ error: 'Source-control connection not found' }, 404);\n          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });\n          if (!found) return context.json({ error: 'Source-control connection not found' }, 404);\n          for (const projectRepository of await found.handle.projectRepositories.list({\n            orgId: tenant.orgId,\n            connectionId,\n          })) {\n            if (!(await this.#retireProjectRepositorySessions(found.handle, tenant.orgId, projectRepository.id))) {\n              return context.json({ error: 'session_retirement_unavailable' }, 409);\n            }\n          }\n          await found.handle.connections.delete({ orgId: tenant.orgId, id: connectionId });\n          return context.body(null, 204);\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/source-control-connections/:connectionId/repositories', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const connectionId = context.req.param('connectionId');\n          if (!projectId || !UUID_RE.test(projectId) || !connectionId || !UUID_RE.test(connectionId))\n            return context.json({ error: 'Source-control connection not found' }, 404);\n          const found = await this.#findConnection({ orgId: tenant.orgId, projectId, id: connectionId });\n          if (!found) return context.json({ error: 'Source-control connection not found' }, 404);\n          const input = parseRepositoryLinkInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project_repository' }, 400);\n          const repository = await found.handle.repositories.get({ orgId: tenant.orgId, id: input.repositoryId });\n          if (!repository || repository.installationId !== found.connection.installationId)\n            return context.json({ error: 'Source-control repository not found' }, 404);\n          const projectRepository = await found.handle.projectRepositories.link({\n            orgId: tenant.orgId,\n            connectionId,\n            createdByUserId: tenant.userId,\n            ...input,\n          });\n          try {\n            this.deps.onProjectRepositoryLinked?.({ orgId: tenant.orgId, projectRepository });\n          } catch (error) {\n            console.warn('[factory] onProjectRepositoryLinked failed after a successful repository link:', error);\n          }\n          return context.json(\n            { projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository) },\n            201,\n          );\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/repositories/:projectRepositoryId', {\n        method: 'PATCH',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const projectRepositoryId = context.req.param('projectRepositoryId');\n          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))\n            return context.json({ error: 'Project repository not found' }, 404);\n          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });\n          if (!found) return context.json({ error: 'Project repository not found' }, 404);\n          const input = parseRepositoryUpdateInput(await readJson(context));\n          if (!input) return context.json({ error: 'invalid_project_repository' }, 400);\n          const projectRepository = await found.handle.projectRepositories.update({\n            orgId: tenant.orgId,\n            id: projectRepositoryId,\n            input,\n          });\n          return context.json({\n            projectRepository: await this.#repositoryPayload(found.handle, tenant.orgId, projectRepository!),\n          });\n        },\n      }),\n      registerApiRoute('/web/factory/projects/:id/repositories/:projectRepositoryId', {\n        method: 'DELETE',\n        requiresAuth: false,\n        handler: async routeContext => {\n          const context = loose(routeContext);\n          const tenant = await this.#resolveTenant(context);\n          if ('response' in tenant) return tenant.response;\n          const projectId = context.req.param('id');\n          const projectRepositoryId = context.req.param('projectRepositoryId');\n          if (!projectId || !UUID_RE.test(projectId) || !projectRepositoryId || !UUID_RE.test(projectRepositoryId))\n            return context.json({ error: 'Project repository not found' }, 404);\n          const found = await this.#findProjectRepository({ orgId: tenant.orgId, projectId, id: projectRepositoryId });\n          if (!found) return context.json({ error: 'Project repository not found' }, 404);\n          if (!(await this.#retireProjectRepositorySessions(found.handle, tenant.orgId, projectRepositoryId))) {\n            return context.json({ error: 'session_retirement_unavailable' }, 409);\n          }\n          await found.handle.projectRepositories.unlink({ orgId: tenant.orgId, id: projectRepositoryId });\n          return context.body(null, 204);\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;AAoBA,MAAM,UAAU;AAChB,MAAM,kBAAkB;AACxB,MAAM,yBAAyB;AAC/B,MAAM,gCAAgC;AACtC,MAAM,oBAAoB;AAC1B,MAAM,8BAA8B;AACpC,MAAM,6BAA6B;AACnC,MAAM,kBAAkB;AAExB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,eAAe,SAAS,SAAgD;CACtE,IAAI;EACF,OAAO,MAAM,QAAQ,IAAI,KAAK;CAChC,QAAQ;EACN;CACF;AACF;AAEA,SAAS,iBAAiB,OAAkD;CAC1E,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,SAAS,UAAU,OAAO;CAC3C,MAAM,OAAO,MAAM,KAAK,KAAK;CAC7B,IAAI,CAAC,QAAQ,KAAK,SAAS,iBAAiB,OAAO;CACnD,IAAI,MAAM,gBAAgB,KAAA,KAAa,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,UAChG,OAAO;CACT,MAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO;CAC/F,IAAI,eAAe,YAAY,SAAS,wBAAwB,OAAO;CACvE,OAAO;EAAE;EAAM;CAAY;AAC7B;AAEA,SAAS,iBAAiB,OAAkD;CAC1E,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,MAAM,QAAmC,CAAC;CAC1C,IAAI,MAAM,SAAS,KAAA,GAAW;EAC5B,IAAI,OAAO,MAAM,SAAS,UAAU,OAAO;EAC3C,MAAM,OAAO,MAAM,KAAK,KAAK;EAC7B,IAAI,CAAC,QAAQ,KAAK,SAAS,iBAAiB,OAAO;EACnD,MAAM,OAAO;CACf;CACA,IAAI,MAAM,gBAAgB,KAAA,GAAW;EACnC,IAAI,MAAM,gBAAgB,QAAQ,OAAO,MAAM,gBAAgB,UAAU,OAAO;EAChF,MAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,KAAK,OAAO;EAC/F,IAAI,eAAe,YAAY,SAAS,wBAAwB,OAAO;EACvE,MAAM,cAAc;CACtB;CACA,IAAI,MAAM,mBAAmB,KAAA,GAAW;EACtC,MAAM,iBAAiB,oBAAoB,MAAM,gBAAgB;GAAE,WAAW;GAAiB,UAAU;EAAK,CAAC;EAC/G,IAAI,mBAAmB,OAAO,OAAO;EACrC,MAAM,iBAAiB,kBAAkB;CAC3C;CACA,IAAI,MAAM,0BAA0B,KAAA,GAAW;EAC7C,IAAI,OAAO,MAAM,0BAA0B,WAAW,OAAO;EAC7D,MAAM,wBAAwB,MAAM;CACtC;CACA,IAAI,MAAM,mBAAmB,KAAA,GAAW;EACtC,IAAI,OAAO,MAAM,mBAAmB,WAAW,OAAO;EACtD,MAAM,iBAAiB,MAAM;CAC/B;CACA,IAAI,MAAM,qBAAqB,KAAA,GAAW;EACxC,IAAI,OAAO,MAAM,qBAAqB,WAAW,OAAO;EACxD,MAAM,mBAAmB,MAAM;CACjC;CACA,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ;AACjD;AAEA,SAAS,qBAAqB,OAA0E;CACtG,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,kBAAkB,YAAY,CAAC,MAAM,cAAc,KAAK,GAAG,OAAO;CACnF,IAAI,OAAO,MAAM,mBAAmB,YAAY,CAAC,QAAQ,KAAK,MAAM,cAAc,GAAG,OAAO;CAC5F,OAAO;EAAE,eAAe,MAAM,cAAc,KAAK;EAAG,gBAAgB,MAAM;CAAe;AAC3F;AAEA,SAAS,oBACP,OACA,EAAE,WAAW,WAAW,SACW;CACnC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,UAAU,MAAM,OAAO,WAAW,OAAO;CAC7C,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,aAAa,MAAM,KAAK;CAC9B,IAAI,CAAC,YAAY,OAAO,WAAW,OAAO;CAC1C,IAAI,WAAW,SAAS,aAAa,gBAAgB,KAAK,UAAU,GAAG,OAAO;CAC9E,OAAO;AACT;AAEA,SAAS,yBAAyB,OAOzB;CACP,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,iBAAiB,YAAY,CAAC,QAAQ,KAAK,MAAM,YAAY,GAAG,OAAO;CACxF,MAAM,SAAS,oBAAoB,MAAM,QAAQ;EAAE,WAAW;EAAmB,UAAU;CAAK,CAAC;CACjG,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB,EAAE,WAAW,4BAA4B,CAAC;CAC7G,MAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,2BAA2B,CAAC;CAC1G,MAAM,eAAe,oBAAoB,MAAM,cAAc;EAC3D,WAAW;EACX,UAAU;CACZ,CAAC;CACD,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB;EACjE,WAAW;EACX,UAAU;CACZ,CAAC;CACD,IACE,WAAW,SACX,OAAO,oBAAoB,YAC3B,OAAO,mBAAmB,YAC1B,iBAAiB,SACjB,oBAAoB,OAEpB,OAAO;CACT,OAAO;EACL,cAAc,MAAM;EACpB,QAAQ,UAAU;EAClB;EACA;EACA,cAAc,gBAAgB;EAC9B,iBAAiB,mBAAmB;CACtC;AACF;AAEA,SAAS,2BAA2B,OAAqD;CACvF,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,MAAM,QAAsC,CAAC;CAC7C,MAAM,SAAS,oBAAoB,MAAM,QAAQ;EAAE,WAAW;EAAmB,UAAU;CAAK,CAAC;CACjG,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB,EAAE,WAAW,4BAA4B,CAAC;CAC7G,MAAM,iBAAiB,oBAAoB,MAAM,gBAAgB,EAAE,WAAW,2BAA2B,CAAC;CAC1G,MAAM,eAAe,oBAAoB,MAAM,cAAc;EAC3D,WAAW;EACX,UAAU;CACZ,CAAC;CACD,MAAM,kBAAkB,oBAAoB,MAAM,iBAAiB;EACjE,WAAW;EACX,UAAU;CACZ,CAAC;CACD,IACE,WAAW,SACX,oBAAoB,SACpB,oBAAoB,QACpB,mBAAmB,SACnB,mBAAmB,QACnB,iBAAiB,SACjB,oBAAoB,OAEpB,OAAO;CACT,IAAI,WAAW,KAAA,GAAW,MAAM,SAAS;CACzC,IAAI,oBAAoB,KAAA,GAAW,MAAM,kBAAkB;CAC3D,IAAI,mBAAmB,KAAA,GAAW,MAAM,iBAAiB;CACzD,IAAI,iBAAiB,KAAA,GAAW,MAAM,eAAe;CACrD,IAAI,oBAAoB,KAAA,GAAW,MAAM,kBAAkB;CAC3D,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ;AACjD;AAoBA,IAAa,gBAAb,cAAmC,MAAyB;CAC1D;CAEA,YAAY,MAAyB;EACnC,MAAM,IAAI;EACV,KAAKA,gCAAgC,IAAI,IAAI,KAAK,gCAAgC,CAAC,CAAC;CACtF;CAEA,MAAMC,YAA6C;EACjD,MAAM,KAAK,KAAK,SAAS,YAAY;EACrC,OAAO,KAAK,KAAK;CACnB;CAEA,MAAMC,iBAAgD;EACpD,MAAM,KAAK,KAAK,cAAc,YAAY;EAC1C,OAAO,KAAK,KAAK;CACnB;CAEA,MAAMC,WAAkD;EACtD,MAAM,UAAU,MAAM,KAAKD,eAAe;EAC1C,OAAO,CAAC,GAAG,KAAKF,6BAA6B,CAAC,CAAC,KAAI,kBAAiB,QAAQ,eAAe,aAAa,CAAC;CAC3G;CAEA,MAAMI,SAAS,OAAe,IAAY;EACxC,QAAQ,MAAM,KAAKH,UAAU,EAAA,CAAG,IAAI;GAAE;GAAO;EAAG,CAAC;CACnD;CAEA,MAAMI,gBAAgB,EAAE,OAAO,WAAW,MAAwD;EAChG,KAAK,MAAM,UAAU,MAAM,KAAKF,SAAS,GAAG;GAC1C,MAAM,aAAa,MAAM,OAAO,YAAY,IAAI;IAAE;IAAO;GAAG,CAAC;GAC7D,IAAI,YAAY,qBAAqB,WAAW,OAAO;IAAE;IAAQ;GAAW;EAC9E;EACA,OAAO;CACT;CAEA,MAAMG,uBAAuB,EAAE,OAAO,WAAW,MAAwD;EACvG,KAAK,MAAM,UAAU,MAAM,KAAKH,SAAS,GAAG;GAC1C,MAAM,oBAAoB,MAAM,OAAO,oBAAoB,IAAI;IAAE;IAAO;GAAG,CAAC;GAC5E,IAAI,CAAC,mBAAmB;GACxB,MAAM,aAAa,MAAM,OAAO,YAAY,IAAI;IAAE;IAAO,IAAI,kBAAkB;GAAa,CAAC;GAC7F,IAAI,YAAY,qBAAqB,WAAW,OAAO;IAAE;IAAQ;IAAY;GAAkB;EACjG;EACA,OAAO;CACT;CAEA,MAAMI,mBAAmB,QAAoC,OAAe,mBAAsC;EAChH,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI;GAAE;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC9F,OAAO;GAAE,GAAG;GAAmB;EAAW;CAC5C;CAEA,MAAMC,iCACJ,QACA,OACA,qBACkB;EAElB,KAAI,MADmB,OAAO,SAAS,wBAAwB,EAAE,oBAAoB,CAAC,EAAA,CACzE,WAAW,GAAG,OAAO;EAClC,IAAI,CAAC,KAAK,KAAK,mBAAmB,OAAO;EACzC,MAAM,KAAK,KAAK,kBAAkB,gCAAgC;GAChE,eAAe;GACf,GAAI,KAAK,KAAK,YAAY,EAAE,WAAW,KAAK,KAAK,UAAU,IAAI,CAAC;GAChE;GACA;EACF,CAAC;EACD,OAAO;CACT;CAEA,MAAMC,eAAe,SAAuF;EAC1G,MAAM,KAAK,KAAK,KAAK,WAAW,OAAO;EACvC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,OAAO;EAC5C,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,QAAQ,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EAC7E,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,QAAQ,KAChB;GAAE,OAAO;GAAyB,SAAS;EAA4C,GACvF,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;CAEA,SAAqB;EACnB,OAAO;GACL,iBAAiB,yBAAyB;IACxC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKA,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,OAAO,QAAQ,KAAK,EAAE,UAAU,OAAO,MAAM,KAAKR,UAAU,EAAA,CAAG,KAAK,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;IAChG;GACF,CAAC;GACD,iBAAiB,yBAAyB;IACxC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,QAAQ,iBAAiB,MAAM,SAAS,OAAO,CAAC;KACtD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KACjE,MAAM,UAAU,OAAO,MAAM,KAAKR,UAAU,EAAA,CAAG,OAAO;MAAE,OAAO,OAAO;MAAO,QAAQ,OAAO;MAAQ;KAAM,CAAC;KAC3G,OAAO,QAAQ,KAAK,EAAE,QAAQ,GAAG,GAAG;IACtC;GACF,CAAC;GACD,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;KACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrF,MAAM,UAAU,MAAM,KAAKL,SAAS,OAAO,OAAO,EAAE;KACpD,OAAO,UAAU,QAAQ,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC/F;GACF,CAAC;GACD,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKK,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;KACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrF,MAAM,QAAQ,iBAAiB,MAAM,SAAS,OAAO,CAAC;KACtD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KACjE,MAAM,UAAU,OAAO,MAAM,KAAKR,UAAU,EAAA,CAAG,OAAO;MAAE,OAAO,OAAO;MAAO;MAAI;KAAM,CAAC;KACxF,OAAO,UAAU,QAAQ,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC/F;GACF,CAAC;GACD,iBAAiB,6BAA6B;IAC5C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI;KACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrF,IAAI,CAAE,MAAM,KAAKL,SAAS,OAAO,OAAO,EAAE,GAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACrG,KAAK,MAAM,UAAU,MAAM,KAAKD,SAAS,GACvC,KAAK,MAAM,cAAc,MAAM,OAAO,YAAY,KAAK;MAAE,OAAO,OAAO;MAAO,kBAAkB;KAAG,CAAC,GAAG;MACrG,KAAK,MAAM,qBAAqB,MAAM,OAAO,oBAAoB,KAAK;OACpE,OAAO,OAAO;OACd,cAAc,WAAW;MAC3B,CAAC,GACC,IAAI,CAAE,MAAM,KAAKK,iCAAiC,QAAQ,OAAO,OAAO,kBAAkB,EAAE,GAC1F,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;MAGxE,MAAM,OAAO,YAAY,OAAO;OAAE,OAAO,OAAO;OAAO,IAAI,WAAW;MAAG,CAAC;KAC5E;KAEF,OAAO,MAAM,KAAKP,UAAU,EAAA,CAAG,OAAO;MAAE,OAAO,OAAO;MAAO;KAAG,CAAC;KACjE,OAAO,QAAQ,KAAK,MAAM,GAAG;IAC/B;GACF,CAAC;GACD,iBAAiB,wDAAwD;IACvE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKQ,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAE,MAAM,KAAKL,SAAS,OAAO,OAAO,SAAS,GACzF,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzD,MAAM,cAAc,CAAC;KACrB,KAAK,MAAM,UAAU,MAAM,KAAKD,SAAS,GACvC,KAAK,MAAM,cAAc,MAAM,OAAO,YAAY,KAAK;MACrD,OAAO,OAAO;MACd,kBAAkB;KACpB,CAAC,GAAG;MACF,MAAM,eAAe,MAAM,OAAO,cAAc,IAAI;OAClD,OAAO,OAAO;OACd,IAAI,WAAW;MACjB,CAAC;MAQD,IAAI,CAAC,cAAc;MACnB,MAAM,QAAQ,MAAM,OAAO,oBAAoB,KAAK;OAAE,OAAO,OAAO;OAAO,cAAc,WAAW;MAAG,CAAC;MACxG,YAAY,KAAK;OACf,GAAG;OACH;OACA,cAAc,MAAM,QAAQ,IAAI,MAAM,KAAI,SAAQ,KAAKI,mBAAmB,QAAQ,OAAO,OAAO,IAAI,CAAC,CAAC;MACxG,CAAC;KACH;KAEF,OAAO,QAAQ,KAAK,EAAE,YAAY,CAAC;IACrC;GACF,CAAC;GACD,iBAAiB,wDAAwD;IACvE,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKE,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAE,MAAM,KAAKL,SAAS,OAAO,OAAO,SAAS,GACzF,OAAO,QAAQ,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzD,MAAM,QAAQ,qBAAqB,MAAM,SAAS,OAAO,CAAC;KAC1D,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KACnF,IAAI,CAAC,KAAKJ,8BAA8B,IAAI,MAAM,aAAa,GAC7D,OAAO,QAAQ,KAAK,EAAE,OAAO,uCAAuC,GAAG,GAAG;KAC5E,MAAM,UAAU,MAAM,KAAKE,eAAe,EAAA,CAAG,eAAe,MAAM,aAAa;KAC/E,IAAI,CAAE,MAAM,OAAO,cAAc,IAAI;MAAE,OAAO,OAAO;MAAO,IAAI,MAAM;KAAe,CAAC,GACpF,OAAO,QAAQ,KAAK,EAAE,OAAO,wCAAwC,GAAG,GAAG;KAC7E,MAAM,aAAa,MAAM,OAAO,YAAY,OAAO;MACjD,OAAO,OAAO;MACd,kBAAkB;MAClB,gBAAgB,MAAM;MACtB,iBAAiB,OAAO;KAC1B,CAAC;KACD,OAAO,QAAQ,KAAK,EAAE,WAAW,GAAG,GAAG;IACzC;GACF,CAAC;GACD,iBAAiB,sEAAsE;IACrF,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKO,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,eAAe,QAAQ,IAAI,MAAM,cAAc;KACrD,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY,GACvF,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KAC3E,MAAM,QAAQ,MAAM,KAAKJ,gBAAgB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAa,CAAC;KAC7F,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KACrF,KAAK,MAAM,qBAAqB,MAAM,MAAM,OAAO,oBAAoB,KAAK;MAC1E,OAAO,OAAO;MACd;KACF,CAAC,GACC,IAAI,CAAE,MAAM,KAAKG,iCAAiC,MAAM,QAAQ,OAAO,OAAO,kBAAkB,EAAE,GAChG,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;KAGxE,MAAM,MAAM,OAAO,YAAY,OAAO;MAAE,OAAO,OAAO;MAAO,IAAI;KAAa,CAAC;KAC/E,OAAO,QAAQ,KAAK,MAAM,GAAG;IAC/B;GACF,CAAC;GACD,iBAAiB,mFAAmF;IAClG,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKC,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,eAAe,QAAQ,IAAI,MAAM,cAAc;KACrD,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,gBAAgB,CAAC,QAAQ,KAAK,YAAY,GACvF,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KAC3E,MAAM,QAAQ,MAAM,KAAKJ,gBAAgB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAa,CAAC;KAC7F,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KACrF,MAAM,QAAQ,yBAAyB,MAAM,SAAS,OAAO,CAAC;KAC9D,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;KAC5E,MAAM,aAAa,MAAM,MAAM,OAAO,aAAa,IAAI;MAAE,OAAO,OAAO;MAAO,IAAI,MAAM;KAAa,CAAC;KACtG,IAAI,CAAC,cAAc,WAAW,mBAAmB,MAAM,WAAW,gBAChE,OAAO,QAAQ,KAAK,EAAE,OAAO,sCAAsC,GAAG,GAAG;KAC3E,MAAM,oBAAoB,MAAM,MAAM,OAAO,oBAAoB,KAAK;MACpE,OAAO,OAAO;MACd;MACA,iBAAiB,OAAO;MACxB,GAAG;KACL,CAAC;KACD,IAAI;MACF,KAAK,KAAK,4BAA4B;OAAE,OAAO,OAAO;OAAO;MAAkB,CAAC;KAClF,SAAS,OAAO;MACd,QAAQ,KAAK,kFAAkF,KAAK;KACtG;KACA,OAAO,QAAQ,KACb,EAAE,mBAAmB,MAAM,KAAKE,mBAAmB,MAAM,QAAQ,OAAO,OAAO,iBAAiB,EAAE,GAClG,GACF;IACF;GACF,CAAC;GACD,iBAAiB,+DAA+D;IAC9E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKE,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,sBAAsB,QAAQ,IAAI,MAAM,qBAAqB;KACnE,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,uBAAuB,CAAC,QAAQ,KAAK,mBAAmB,GACrG,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KACpE,MAAM,QAAQ,MAAM,KAAKH,uBAAuB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAoB,CAAC;KAC3G,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KAC9E,MAAM,QAAQ,2BAA2B,MAAM,SAAS,OAAO,CAAC;KAChE,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;KAC5E,MAAM,oBAAoB,MAAM,MAAM,OAAO,oBAAoB,OAAO;MACtE,OAAO,OAAO;MACd,IAAI;MACJ;KACF,CAAC;KACD,OAAO,QAAQ,KAAK,EAClB,mBAAmB,MAAM,KAAKC,mBAAmB,MAAM,QAAQ,OAAO,OAAO,iBAAkB,EACjG,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,+DAA+D;IAC9E,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,iBAAgB;KAC7B,MAAM,UAAU,MAAM,YAAY;KAClC,MAAM,SAAS,MAAM,KAAKE,eAAe,OAAO;KAChD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,YAAY,QAAQ,IAAI,MAAM,IAAI;KACxC,MAAM,sBAAsB,QAAQ,IAAI,MAAM,qBAAqB;KACnE,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,uBAAuB,CAAC,QAAQ,KAAK,mBAAmB,GACrG,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KACpE,MAAM,QAAQ,MAAM,KAAKH,uBAAuB;MAAE,OAAO,OAAO;MAAO;MAAW,IAAI;KAAoB,CAAC;KAC3G,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;KAC9E,IAAI,CAAE,MAAM,KAAKE,iCAAiC,MAAM,QAAQ,OAAO,OAAO,mBAAmB,GAC/F,OAAO,QAAQ,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;KAEtE,MAAM,MAAM,OAAO,oBAAoB,OAAO;MAAE,OAAO,OAAO;MAAO,IAAI;KAAoB,CAAC;KAC9F,OAAO,QAAQ,KAAK,MAAM,GAAG;IAC/B;GACF,CAAC;EACH;CACF;AACF"}

package/dist/routes/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAKpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAgBnC,UAAU,0BAA0B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3E,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAC1E,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C;AAiCD,qBAAa,WAAY,SAAQ,KAAK,CAAC,eAAe,CAAC;;IAoErD,MAAM,IAAI,QAAQ,EAAE;CA8ErB"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAKpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAgBnC,UAAU,0BAA0B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3E,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAC1E,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C;AAiCD,qBAAa,WAAY,SAAQ,KAAK,CAAC,eAAe,CAAC;;IAoErD,MAAM,IAAI,QAAQ,EAAE;CAiFrB"}

package/dist/routes/skills.js

@@ -139,9 +139,15 @@ var SkillRoutes = class extends Route {
 			}, authorization.status ?? 403);
 			try {
 				const resolved = await resolveSkillInvocation(controller, body);
-				if (dispatch) resolved.session.sendMessage({ content: resolved.message }).catch((error) => {
-					console.error("Workspace skill dispatch failed after acceptance", error);
-				});
+				if (dispatch) {
+					const requestContext = c.get("requestContext");
+					resolved.session.sendMessage({
+						content: resolved.message,
+						...requestContext ? { requestContext } : {}
+					}).catch((error) => {
+						console.error("Workspace skill dispatch failed after acceptance", error);
+					});
+				}
 				return c.json({
 					ok: true,
 					skill: resolved.skillName,

package/dist/routes/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","names":["#authorizeSessionAddress"],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { peekSessionSandbox } from '../sandbox/session-sandbox.js';\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_RESOURCE_ID_LENGTH = 512;\nconst MAX_SCOPE_LENGTH = 2048;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  resourceId: string;\n  projectRepositoryId?: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.resourceId !== 'string' || input.resourceId.length === 0) return undefined;\n  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return undefined;\n  if (\n    input.projectRepositoryId !== undefined &&\n    (typeof input.projectRepositoryId !== 'string' || !UUID_RE.test(input.projectRepositoryId))\n  ) {\n    return undefined;\n  }\n  if (input.scope !== undefined && (typeof input.scope !== 'string' || input.scope.length > MAX_SCOPE_LENGTH)) {\n    return undefined;\n  }\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    resourceId: input.resourceId,\n    ...(input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions are keyed by the authenticated WorkOS user id. Their\n    // scope is a client-managed local/user-session worktree and needs no app DB.\n    if (address.resourceId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are keyed by factoryProjectId and explicitly identify the\n    // linked repository whose user-owned worktree supplies the session scope.\n    if (\n      !UUID_RE.test(address.resourceId) ||\n      !address.projectRepositoryId ||\n      !UUID_RE.test(address.projectRepositoryId)\n    ) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !address.scope) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (!storage) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n      }\n    }\n    const projectRepository = await storage.projectRepositories.get({\n      orgId: tenant.orgId,\n      id: address.projectRepositoryId,\n    });\n    if (!projectRepository) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });\n    if (!connection || connection.factoryProjectId !== address.resourceId) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    // The scope must be the live workdir of a session the viewer can see under\n    // this repository. The live memoized sandbox entry is the only truth for\n    // workdirs (persisted columns are observability); no running/memoized\n    // sandbox at that path means no grant (fail closed).\n    const sessions = await storage.sessions.list({\n      projectRepositoryId: address.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    const scopeIsLiveSessionWorkdir = sessions.some(row => {\n      const liveWorkdir = peekSessionSandbox(row.id)?.workdir;\n      return liveWorkdir !== undefined && liveWorkdir === address.scope;\n    });\n    return scopeIsLiveSessionWorkdir\n      ? { allowed: true }\n      : { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { resourceId: string; projectRepositoryId?: string; scope?: string }) =>\n        this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, {\n        resourceId: body.resourceId,\n        projectRepositoryId: body.projectRepositoryId,\n        scope: body.scope,\n      });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          void resolved.session.sendMessage({ content: resolved.message }).catch((error: unknown) => {\n            console.error('Workspace skill dispatch failed after acceptance', error);\n          });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;AAaA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AA4BhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,WAAW,GAAG,OAAO,KAAA;CAClF,IAAI,MAAM,WAAW,SAAS,wBAAwB,OAAO,KAAA;CAC7D,IACE,MAAM,wBAAwB,KAAA,MAC7B,OAAO,MAAM,wBAAwB,YAAY,CAAC,QAAQ,KAAK,MAAM,mBAAmB,IAEzF;CAEF,IAAI,MAAM,UAAU,KAAA,MAAc,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,mBACxF;CAEF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,YAAY,MAAM;EAClB,GAAI,MAAM,sBAAsB,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;EACtF,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAMA,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,eAAe,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAIjE,IACE,CAAC,QAAQ,KAAK,QAAQ,UAAU,KAChC,CAAC,QAAQ,uBACT,CAAC,QAAQ,KAAK,QAAQ,mBAAmB,GAEzC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,OAC5B,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,CAAC,SACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;IAAE,SAAS;IAAO,QAAQ;IAAK,MAAM;IAAqB,SAAS;GAAyB;EACrG;EAEF,MAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;GAC9D,OAAO,OAAO;GACd,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,MAAM,aAAa,MAAM,QAAQ,YAAY,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC5G,IAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,YACzD,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAcrG,QAJkC,MAJX,QAAQ,SAAS,KAAK;GAC3C,qBAAqB,QAAQ;GAC7B,cAAc,OAAO;EACvB,CAAC,EAAA,CAC0C,MAAK,QAAO;GACrD,MAAM,cAAc,mBAAmB,IAAI,EAAE,CAAC,EAAE;GAChD,OAAO,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ;EAC9D,CAC+B,IAC3B,EAAE,SAAS,KAAK,IAChB;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;CAClG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAClB,KAAKA,yBAAyB,SAAS,OAAO;EAClD,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG;IACvC,YAAY,KAAK;IACjB,qBAAqB,KAAK;IAC1B,OAAO,KAAK;GACd,CAAC;GACD,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UACF,SAAc,QAAQ,YAAY,EAAE,SAAS,SAAS,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;KACzF,QAAQ,MAAM,oDAAoD,KAAK;IACzE,CAAC;IAEH,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"skills.js","names":["#authorizeSessionAddress"],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { peekSessionSandbox } from '../sandbox/session-sandbox.js';\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_RESOURCE_ID_LENGTH = 512;\nconst MAX_SCOPE_LENGTH = 2048;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  resourceId: string;\n  projectRepositoryId?: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.resourceId !== 'string' || input.resourceId.length === 0) return undefined;\n  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return undefined;\n  if (\n    input.projectRepositoryId !== undefined &&\n    (typeof input.projectRepositoryId !== 'string' || !UUID_RE.test(input.projectRepositoryId))\n  ) {\n    return undefined;\n  }\n  if (input.scope !== undefined && (typeof input.scope !== 'string' || input.scope.length > MAX_SCOPE_LENGTH)) {\n    return undefined;\n  }\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    resourceId: input.resourceId,\n    ...(input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions are keyed by the authenticated WorkOS user id. Their\n    // scope is a client-managed local/user-session worktree and needs no app DB.\n    if (address.resourceId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are keyed by factoryProjectId and explicitly identify the\n    // linked repository whose user-owned worktree supplies the session scope.\n    if (\n      !UUID_RE.test(address.resourceId) ||\n      !address.projectRepositoryId ||\n      !UUID_RE.test(address.projectRepositoryId)\n    ) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !address.scope) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (!storage) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n      }\n    }\n    const projectRepository = await storage.projectRepositories.get({\n      orgId: tenant.orgId,\n      id: address.projectRepositoryId,\n    });\n    if (!projectRepository) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });\n    if (!connection || connection.factoryProjectId !== address.resourceId) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    // The scope must be the live workdir of a session the viewer can see under\n    // this repository. The live memoized sandbox entry is the only truth for\n    // workdirs (persisted columns are observability); no running/memoized\n    // sandbox at that path means no grant (fail closed).\n    const sessions = await storage.sessions.list({\n      projectRepositoryId: address.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    const scopeIsLiveSessionWorkdir = sessions.some(row => {\n      const liveWorkdir = peekSessionSandbox(row.id)?.workdir;\n      return liveWorkdir !== undefined && liveWorkdir === address.scope;\n    });\n    return scopeIsLiveSessionWorkdir\n      ? { allowed: true }\n      : { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { resourceId: string; projectRepositoryId?: string; scope?: string }) =>\n        this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, {\n        resourceId: body.resourceId,\n        projectRepositoryId: body.projectRepositoryId,\n        scope: body.scope,\n      });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          const requestContext = c.get('requestContext' as never) as RequestContext | undefined;\n          void resolved.session\n            .sendMessage({ content: resolved.message, ...(requestContext ? { requestContext } : {}) })\n            .catch((error: unknown) => {\n              console.error('Workspace skill dispatch failed after acceptance', error);\n            });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AA4BhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,WAAW,GAAG,OAAO,KAAA;CAClF,IAAI,MAAM,WAAW,SAAS,wBAAwB,OAAO,KAAA;CAC7D,IACE,MAAM,wBAAwB,KAAA,MAC7B,OAAO,MAAM,wBAAwB,YAAY,CAAC,QAAQ,KAAK,MAAM,mBAAmB,IAEzF;CAEF,IAAI,MAAM,UAAU,KAAA,MAAc,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,mBACxF;CAEF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,YAAY,MAAM;EAClB,GAAI,MAAM,sBAAsB,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;EACtF,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAMA,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,eAAe,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAIjE,IACE,CAAC,QAAQ,KAAK,QAAQ,UAAU,KAChC,CAAC,QAAQ,uBACT,CAAC,QAAQ,KAAK,QAAQ,mBAAmB,GAEzC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,OAC5B,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,CAAC,SACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;IAAE,SAAS;IAAO,QAAQ;IAAK,MAAM;IAAqB,SAAS;GAAyB;EACrG;EAEF,MAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;GAC9D,OAAO,OAAO;GACd,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,MAAM,aAAa,MAAM,QAAQ,YAAY,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC5G,IAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,YACzD,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAcrG,QAJkC,MAJX,QAAQ,SAAS,KAAK;GAC3C,qBAAqB,QAAQ;GAC7B,cAAc,OAAO;EACvB,CAAC,EAAA,CAC0C,MAAK,QAAO;GACrD,MAAM,cAAc,mBAAmB,IAAI,EAAE,CAAC,EAAE;GAChD,OAAO,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ;EAC9D,CAC+B,IAC3B,EAAE,SAAS,KAAK,IAChB;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;CAClG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAClB,KAAKA,yBAAyB,SAAS,OAAO;EAClD,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG;IACvC,YAAY,KAAK;IACjB,qBAAqB,KAAK;IAC1B,OAAO,KAAK;GACd,CAAC;GACD,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UAAU;KACZ,MAAM,iBAAiB,EAAE,IAAI,gBAAyB;KACtD,SAAc,QACX,YAAY;MAAE,SAAS,SAAS;MAAS,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAAG,CAAC,CAAC,CACzF,OAAO,UAAmB;MACzB,QAAQ,MAAM,oDAAoD,KAAK;KACzE,CAAC;IACL;IACA,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}

package/dist/routes/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAOhF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAA8B,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAQ1G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,cAAc,EAAE,qBAAqB,CAAC;QACtC,eAAe,EAAE,sBAAsB,CAAC;QACxC,UAAU,EAAE,iBAAiB,CAAC;QAC9B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;QAC5B,eAAe,EAAE,sBAAsB,CAAC;QACxC,QAAQ,EAAE,uBAAuB,CAAC;KACnC,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,KAAK,EAAE,YAAY,CAAC;IACpB,oFAAoF;IACpF,IAAI,EAAE,cAAc,CAAC;IACrB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,iBAAiB,CAAC,EAAE,OAAO,kCAAkC,EAAE,4BAA4B,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAiDD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EACrD,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,IAAI,CAAC,CAkEf;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EAClB,YAAY,GACZ,cAAc,GACd,MAAM,GACN,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,oBAAoB,GACpB,sBAAsB,CACzB,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,IAAI,CACX,oBAAoB,CAAC,SAAS,CAAC,EAC/B,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAC3E,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CAwBpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAgI/E"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAShF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAA8B,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAQ1G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,cAAc,EAAE,qBAAqB,CAAC;QACtC,eAAe,EAAE,sBAAsB,CAAC;QACxC,UAAU,EAAE,iBAAiB,CAAC;QAC9B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;QAC5B,eAAe,EAAE,sBAAsB,CAAC;QACxC,QAAQ,EAAE,uBAAuB,CAAC;KACnC,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,KAAK,EAAE,YAAY,CAAC;IACpB,oFAAoF;IACpF,IAAI,EAAE,cAAc,CAAC;IACrB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,iBAAiB,CAAC,EAAE,OAAO,kCAAkC,EAAE,4BAA4B,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAkFD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EACrD,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,IAAI,CAAC,CAwEf;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EAClB,YAAY,GACZ,cAAc,GACd,MAAM,GACN,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,oBAAoB,GACpB,sBAAsB,CACzB,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,IAAI,CACX,oBAAoB,CAAC,SAAS,CAAC,EAC/B,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAC3E,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CAwBpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAgI/E"}

package/dist/routes/surface.js

@@ -3,7 +3,7 @@ import { getGithubFeatureDiagnostics } from "../integrations/github/config.js";
 import { MaterializeError } from "../integrations/github/sandbox.js";
 import { invalidateCustomProvidersSnapshots } from "./custom-provider-source.js";
 import { FactoryDispatchError } from "../rules/dispatch-errors.js";
-import { FactorySourceSessionResolutionError, ensureFactorySourceSession, resolveFactoryDefaultModelId } from "../session/factory-session.js";
+import { FactorySourceSessionResolutionError, ensureFactorySourceSession, resolveFactoryDefaultModelId, resolveFactoryProjectForSession } from "../session/factory-session.js";
 import { FactoryFeedReader } from "../storage/domains/comments/feed-context.js";
 import { FactoryStartCoordinator } from "../rules/start-coordinator.js";
 import { FactoryTransitionService } from "../rules/transition-service.js";
@@ -71,6 +71,30 @@ function guardIntegrationRoutes({ integration, ready, ensureReady, routes }) {
 	});
 }
 /**
+* Resolve the source-control session the work item already holds for this role,
+* when it still resolves to the item's org and factory project. Returns
+* `undefined` when there is no ref or the ref no longer resolves, so the caller
+* falls back to minting one.
+*/
+async function reuseBoundSession(sourceControl, input) {
+	const ref = input.item.sessions[input.role];
+	if (!ref) return void 0;
+	const resolved = await resolveFactoryProjectForSession({
+		sourceControl,
+		sessionId: ref.sessionId
+	});
+	if (!resolved || resolved.orgId !== input.record.orgId || resolved.factoryProjectId !== input.record.factoryProjectId) return;
+	const session = await sourceControl.sessions.getBySessionId(ref.sessionId);
+	if (!session) return void 0;
+	return {
+		sessionId: session.sessionId,
+		userId: session.userId,
+		projectRepositoryId: session.projectRepositoryId,
+		branch: session.branch,
+		baseBranch: session.baseBranch
+	};
+}
+/**
 * Start a factory run for a rule binding: ensure the source-control session the
 * coordinator requires, then hand it to `prepare` along with the factory's
 * default model. Exported for tests — this is the autonomous entry point with no
@@ -88,7 +112,7 @@ async function prepareFactoryRuleBinding(github, coordinator, projects, input) {
 		const destinationStage = currentStage === "intake" ? factoryLaneForRole(input.role) : currentStage;
 		if (!destinationStage) throw new FactoryDispatchError("unsupported_provider_item", `Factory skill invocation has no destination lane (role "${input.role}", stages [${input.item.stages.join(", ")}]).`);
 		const repositorySlug = typeof input.item.metadata?.repository === "string" ? input.item.metadata.repository : void 0;
-		const preparedSession = await ensureFactorySourceSession({
+		const preparedSession = await reuseBoundSession(github.sourceControlStorage, input) ?? await ensureFactorySourceSession({
 			sourceControl: github.sourceControlStorage,
 			orgId: input.record.orgId,
 			factoryProjectId: input.record.factoryProjectId,

package/dist/routes/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport { MaterializeError } from '../integrations/github/sandbox.js';\nimport { FactoryDispatchError } from '../rules/dispatch-errors.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport { factoryLaneForRole, factoryRuleStage } from '../rules/types.js';\nimport type { MastraFactorySandboxConfig } from '../sandbox/session-sandbox.js';\nimport {\n  ensureFactorySourceSession,\n  FactorySourceSessionResolutionError,\n  resolveFactoryDefaultModelId,\n} from '../session/factory-session.js';\nimport { LiveSessions } from '../session/live-sessions.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport type { CommentsDomain } from '../storage/domains/comments/domain.js';\nimport { FactoryFeedReader } from '../storage/domains/comments/feed-context.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport {\n  SourceControlConnectionNotFoundError,\n  type SourceControlStorage,\n} from '../storage/domains/source-control/base.js';\nimport type { FactoryDispatchFailureCode, WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { workItemBranch, workItemBranchSource } from '../work-item-branch.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { KnowledgeRoutes } from './knowledge.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nconst MATERIALIZE_FAILURE_CODE = {\n  'git-missing': 'repository_git_missing',\n  'egress-blocked': 'repository_egress_blocked',\n  'clone-failed': 'repository_clone_failed',\n  'pull-failed': 'repository_pull_failed',\n  'push-failed': 'repository_push_failed',\n  'commit-failed': 'repository_commit_failed',\n  'gh-missing': 'repository_cli_missing',\n  'pr-failed': 'repository_pr_failed',\n} satisfies Record<MaterializeError['code'], FactoryDispatchFailureCode>;\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  /** Optional user directory for resolving persisted owners to display profiles. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox surface (enablement, provider label, create callback). */\n  sandbox?: MastraFactorySandboxConfig;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n    comments: WorkItemCommentsStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  knowledgeEnabled: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  /** Work-item feed service, handed to integrations that ingest platform messages. */\n  feed: CommentsDomain;\n  factoryTransitionService?: FactoryTransitionService;\n  sessionRetirement?: import('../sandbox/session-retirement.js').SessionRetirementCoordinator;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: Pick<FactoryStartCoordinator, 'prepare'>,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  try {\n    const branch = workItemBranch({\n      id: input.item.id,\n      source: workItemBranchSource(input.item.externalSource),\n      metadata: input.item.metadata,\n    });\n    // Only the Intake exit derives a lane from the role: roles don't own lanes,\n    // and the Done close-out running in the triage seat must not drag the card back.\n    const currentStage = factoryRuleStage(input.item.stages);\n    const destinationStage = currentStage === 'intake' ? factoryLaneForRole(input.role) : currentStage;\n    if (!destinationStage) {\n      throw new FactoryDispatchError(\n        'unsupported_provider_item',\n        `Factory skill invocation has no destination lane (role \"${input.role}\", stages [${input.item.stages.join(', ')}]).`,\n      );\n    }\n    const repositorySlug =\n      typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n    const preparedSession = await ensureFactorySourceSession({\n      sourceControl: github.sourceControlStorage,\n      orgId: input.record.orgId,\n      factoryProjectId: input.record.factoryProjectId,\n      repositorySlug,\n      branch,\n      // A human-approved proposal has an interactive user: attribute the run to\n      // the approver, not the repo connector.\n      attributeToUserId: input.record.approvedBy ?? undefined,\n    });\n\n    await coordinator.prepare({\n      orgId: input.record.orgId,\n      userId: preparedSession.userId,\n      factoryProjectId: input.record.factoryProjectId,\n      sessionId: preparedSession.sessionId,\n      defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n      threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n      kickoffKey: input.record.id,\n      destinationStage,\n      workItem: {\n        id: input.item.id,\n        role: input.role,\n        input: {\n          externalSource: input.item.externalSource,\n          parentWorkItemId: input.item.parentWorkItemId,\n          title: input.item.title,\n          stages: ['intake'],\n          sessions: input.item.sessions,\n          metadata: input.item.metadata,\n        },\n      },\n    });\n  } catch (error) {\n    if (error instanceof FactoryDispatchError) throw error;\n    if (error instanceof FactorySourceSessionResolutionError) {\n      const code = error.reason === 'connection' ? 'source_control_missing' : 'source_repository_missing';\n      throw new FactoryDispatchError(code, error.message, { cause: error });\n    }\n    if (error instanceof SourceControlConnectionNotFoundError) {\n      throw new FactoryDispatchError('source_control_missing', error.message, { cause: error });\n    }\n    if (error instanceof MaterializeError) {\n      throw new FactoryDispatchError(MATERIALIZE_FAILURE_CODE[error.code], error.message, { cause: error });\n    }\n    throw error;\n  }\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    | 'controller'\n    | 'publicOrigin'\n    | 'auth'\n    | 'sandbox'\n    | 'users'\n    | 'factoryStorage'\n    | 'integrationStorage'\n    | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    /** Work-item feed service, so a channel integration can ingest platform messages. */\n    feed: CommentsDomain;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    sandbox: deps.sandbox,\n    ...(deps.users ? { users: deps.users } : {}),\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { workItems: deps.domains.workItems, feed: deps.feed } : {}),\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              sandbox: deps.sandbox,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n        new FactoryFeedReader(deps.domains.comments),\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      sourceControlSessions: deps.sourceControlStorage.forIntegration('github').sessions,\n      memorySettings: deps.domains.memorySettings,\n      factoryProjects: deps.domains.projects,\n      customProviders: deps.domains.customProviders,\n      features: { knowledge: deps.knowledgeEnabled },\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          projects: deps.domains.projects,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady && deps.knowledgeEnabled\n      ? new KnowledgeRoutes({\n          auth: deps.auth,\n          projects: deps.domains.projects,\n          knowledge: async () => deps.factoryStorage?.getMastraStorage().getStore('knowledge'),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          comments: deps.domains.comments,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n          liveSessions: new LiveSessions(deps.controller),\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,2BAA2B;CAC/B,eAAe;CACf,kBAAkB;CAClB,gBAAgB;CAChB,eAAe;CACf,eAAe;CACf,iBAAiB;CACjB,cAAc;CACd,aAAa;AACf;AAuDA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,IAAI;EACF,MAAM,SAAS,eAAe;GAC5B,IAAI,MAAM,KAAK;GACf,QAAQ,qBAAqB,MAAM,KAAK,cAAc;GACtD,UAAU,MAAM,KAAK;EACvB,CAAC;EAGD,MAAM,eAAe,iBAAiB,MAAM,KAAK,MAAM;EACvD,MAAM,mBAAmB,iBAAiB,WAAW,mBAAmB,MAAM,IAAI,IAAI;EACtF,IAAI,CAAC,kBACH,MAAM,IAAI,qBACR,6BACA,2DAA2D,MAAM,KAAK,aAAa,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,IAClH;EAEF,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;EACzF,MAAM,kBAAkB,MAAM,2BAA2B;GACvD,eAAe,OAAO;GACtB,OAAO,MAAM,OAAO;GACpB,kBAAkB,MAAM,OAAO;GAC/B;GACA;GAGA,mBAAmB,MAAM,OAAO,cAAc,KAAA;EAChD,CAAC;EAED,MAAM,YAAY,QAAQ;GACxB,OAAO,MAAM,OAAO;GACpB,QAAQ,gBAAgB;GACxB,kBAAkB,MAAM,OAAO;GAC/B,WAAW,gBAAgB;GAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;GAC1F,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;GACxE,YAAY,MAAM,OAAO;GACzB;GACA,UAAU;IACR,IAAI,MAAM,KAAK;IACf,MAAM,MAAM;IACZ,OAAO;KACL,gBAAgB,MAAM,KAAK;KAC3B,kBAAkB,MAAM,KAAK;KAC7B,OAAO,MAAM,KAAK;KAClB,QAAQ,CAAC,QAAQ;KACjB,UAAU,MAAM,KAAK;KACrB,UAAU,MAAM,KAAK;IACvB;GACF;EACF,CAAC;CACH,SAAS,OAAO;EACd,IAAI,iBAAiB,sBAAsB,MAAM;EACjD,IAAI,iBAAiB,qCAEnB,MAAM,IAAI,qBADG,MAAM,WAAW,eAAe,2BAA2B,6BACnC,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtE,IAAI,iBAAiB,sCACnB,MAAM,IAAI,qBAAqB,0BAA0B,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE1F,IAAI,iBAAiB,kBACnB,MAAM,IAAI,qBAAqB,yBAAyB,MAAM,OAAO,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtG,MAAM;CACR;AACF;;;;;;;AAQA,SAAgB,wBACd,MA4BA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,SAAS,KAAK;EACd,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;EAC1C,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe;GAAE,WAAW,KAAK,QAAQ;GAAW,MAAM,KAAK;EAAK,IAAI,CAAC;EAClF,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,SAAS,KAAK;GAChB,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,gBACb,IAAI,kBAAkB,KAAK,QAAQ,QAAQ,CAC7C,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,uBAAuB,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;GAC1E,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,iBAAiB,KAAK,QAAQ;GAC9B,UAAU,EAAE,WAAW,KAAK,iBAAiB;GAC7C,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;GACvB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,gBAAgB,KAAK,mBAC1B,IAAI,gBAAgB;GAClB,MAAM,KAAK;GACX,UAAU,KAAK,QAAQ;GACvB,WAAW,YAAY,KAAK,gBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW;EACrF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,UAAU,KAAK,QAAQ;GACvB,aAAa,KAAK,QAAQ;GAC1B;GACA;GACA,cAAc,IAAI,aAAa,KAAK,UAAU;EAChD,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}
+{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport { MaterializeError } from '../integrations/github/sandbox.js';\nimport { FactoryDispatchError } from '../rules/dispatch-errors.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport { factoryLaneForRole, factoryRuleStage } from '../rules/types.js';\nimport type { MastraFactorySandboxConfig } from '../sandbox/session-sandbox.js';\nimport {\n  ensureFactorySourceSession,\n  FactorySourceSessionResolutionError,\n  resolveFactoryDefaultModelId,\n  resolveFactoryProjectForSession,\n} from '../session/factory-session.js';\nimport type { EnsuredFactorySourceSession } from '../session/factory-session.js';\nimport { LiveSessions } from '../session/live-sessions.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport type { CommentsDomain } from '../storage/domains/comments/domain.js';\nimport { FactoryFeedReader } from '../storage/domains/comments/feed-context.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport {\n  SourceControlConnectionNotFoundError,\n  type SourceControlStorage,\n} from '../storage/domains/source-control/base.js';\nimport type { FactoryDispatchFailureCode, WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { workItemBranch, workItemBranchSource } from '../work-item-branch.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { KnowledgeRoutes } from './knowledge.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nconst MATERIALIZE_FAILURE_CODE = {\n  'git-missing': 'repository_git_missing',\n  'egress-blocked': 'repository_egress_blocked',\n  'clone-failed': 'repository_clone_failed',\n  'pull-failed': 'repository_pull_failed',\n  'push-failed': 'repository_push_failed',\n  'commit-failed': 'repository_commit_failed',\n  'gh-missing': 'repository_cli_missing',\n  'pr-failed': 'repository_pr_failed',\n} satisfies Record<MaterializeError['code'], FactoryDispatchFailureCode>;\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  /** Optional user directory for resolving persisted owners to display profiles. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox surface (enablement, provider label, create callback). */\n  sandbox?: MastraFactorySandboxConfig;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n    comments: WorkItemCommentsStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  knowledgeEnabled: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  /** Work-item feed service, handed to integrations that ingest platform messages. */\n  feed: CommentsDomain;\n  factoryTransitionService?: FactoryTransitionService;\n  sessionRetirement?: import('../sandbox/session-retirement.js').SessionRetirementCoordinator;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\n/**\n * Resolve the source-control session the work item already holds for this role,\n * when it still resolves to the item's org and factory project. Returns\n * `undefined` when there is no ref or the ref no longer resolves, so the caller\n * falls back to minting one.\n */\nasync function reuseBoundSession(\n  sourceControl: GithubIntegration['sourceControlStorage'],\n  input: FactoryBindingPreparationInput,\n): Promise<EnsuredFactorySourceSession | undefined> {\n  const ref = input.item.sessions[input.role];\n  if (!ref) return undefined;\n  // At least as strict as the coordinator's resolveSourceSession: a ref it\n  // would reject must fall through to minting, not hard-fail the run.\n  const resolved = await resolveFactoryProjectForSession({ sourceControl, sessionId: ref.sessionId });\n  if (\n    !resolved ||\n    resolved.orgId !== input.record.orgId ||\n    resolved.factoryProjectId !== input.record.factoryProjectId\n  ) {\n    return undefined;\n  }\n  const session = await sourceControl.sessions.getBySessionId(ref.sessionId);\n  if (!session) return undefined;\n  return {\n    sessionId: session.sessionId,\n    userId: session.userId,\n    projectRepositoryId: session.projectRepositoryId,\n    branch: session.branch,\n    baseBranch: session.baseBranch,\n  };\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: Pick<FactoryStartCoordinator, 'prepare'>,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  try {\n    const branch = workItemBranch({\n      id: input.item.id,\n      source: workItemBranchSource(input.item.externalSource),\n      metadata: input.item.metadata,\n    });\n    // Only the Intake exit derives a lane from the role: roles don't own lanes,\n    // and the Done close-out running in the triage seat must not drag the card back.\n    const currentStage = factoryRuleStage(input.item.stages);\n    const destinationStage = currentStage === 'intake' ? factoryLaneForRole(input.role) : currentStage;\n    if (!destinationStage) {\n      throw new FactoryDispatchError(\n        'unsupported_provider_item',\n        `Factory skill invocation has no destination lane (role \"${input.role}\", stages [${input.item.stages.join(', ')}]).`,\n      );\n    }\n    const repositorySlug =\n      typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n    // Re-preparing a binding (server restart, retired controller session) must\n    // land in the role's existing session: minting a replacement would repoint\n    // the work item, flip the session's owner to the approver, and orphan the\n    // previous sandbox.\n    const preparedSession =\n      (await reuseBoundSession(github.sourceControlStorage, input)) ??\n      (await ensureFactorySourceSession({\n        sourceControl: github.sourceControlStorage,\n        orgId: input.record.orgId,\n        factoryProjectId: input.record.factoryProjectId,\n        repositorySlug,\n        branch,\n        // A human-approved proposal has an interactive user: attribute the run to\n        // the approver, not the repo connector.\n        attributeToUserId: input.record.approvedBy ?? undefined,\n      }));\n\n    await coordinator.prepare({\n      orgId: input.record.orgId,\n      userId: preparedSession.userId,\n      factoryProjectId: input.record.factoryProjectId,\n      sessionId: preparedSession.sessionId,\n      defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n      threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n      kickoffKey: input.record.id,\n      destinationStage,\n      workItem: {\n        id: input.item.id,\n        role: input.role,\n        input: {\n          externalSource: input.item.externalSource,\n          parentWorkItemId: input.item.parentWorkItemId,\n          title: input.item.title,\n          stages: ['intake'],\n          sessions: input.item.sessions,\n          metadata: input.item.metadata,\n        },\n      },\n    });\n  } catch (error) {\n    if (error instanceof FactoryDispatchError) throw error;\n    if (error instanceof FactorySourceSessionResolutionError) {\n      const code = error.reason === 'connection' ? 'source_control_missing' : 'source_repository_missing';\n      throw new FactoryDispatchError(code, error.message, { cause: error });\n    }\n    if (error instanceof SourceControlConnectionNotFoundError) {\n      throw new FactoryDispatchError('source_control_missing', error.message, { cause: error });\n    }\n    if (error instanceof MaterializeError) {\n      throw new FactoryDispatchError(MATERIALIZE_FAILURE_CODE[error.code], error.message, { cause: error });\n    }\n    throw error;\n  }\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    | 'controller'\n    | 'publicOrigin'\n    | 'auth'\n    | 'sandbox'\n    | 'users'\n    | 'factoryStorage'\n    | 'integrationStorage'\n    | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    /** Work-item feed service, so a channel integration can ingest platform messages. */\n    feed: CommentsDomain;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    sandbox: deps.sandbox,\n    ...(deps.users ? { users: deps.users } : {}),\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { workItems: deps.domains.workItems, feed: deps.feed } : {}),\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              sandbox: deps.sandbox,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n        new FactoryFeedReader(deps.domains.comments),\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      sourceControlSessions: deps.sourceControlStorage.forIntegration('github').sessions,\n      memorySettings: deps.domains.memorySettings,\n      factoryProjects: deps.domains.projects,\n      customProviders: deps.domains.customProviders,\n      features: { knowledge: deps.knowledgeEnabled },\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          projects: deps.domains.projects,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady && deps.knowledgeEnabled\n      ? new KnowledgeRoutes({\n          auth: deps.auth,\n          projects: deps.domains.projects,\n          knowledge: async () => deps.factoryStorage?.getMastraStorage().getStore('knowledge'),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          comments: deps.domains.comments,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n          liveSessions: new LiveSessions(deps.controller),\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAM,2BAA2B;CAC/B,eAAe;CACf,kBAAkB;CAClB,gBAAgB;CAChB,eAAe;CACf,eAAe;CACf,iBAAiB;CACjB,cAAc;CACd,aAAa;AACf;AAuDA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;;;;;;;AAQA,eAAe,kBACb,eACA,OACkD;CAClD,MAAM,MAAM,MAAM,KAAK,SAAS,MAAM;CACtC,IAAI,CAAC,KAAK,OAAO,KAAA;CAGjB,MAAM,WAAW,MAAM,gCAAgC;EAAE;EAAe,WAAW,IAAI;CAAU,CAAC;CAClG,IACE,CAAC,YACD,SAAS,UAAU,MAAM,OAAO,SAChC,SAAS,qBAAqB,MAAM,OAAO,kBAE3C;CAEF,MAAM,UAAU,MAAM,cAAc,SAAS,eAAe,IAAI,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO;EACL,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,qBAAqB,QAAQ;EAC7B,QAAQ,QAAQ;EAChB,YAAY,QAAQ;CACtB;AACF;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,IAAI;EACF,MAAM,SAAS,eAAe;GAC5B,IAAI,MAAM,KAAK;GACf,QAAQ,qBAAqB,MAAM,KAAK,cAAc;GACtD,UAAU,MAAM,KAAK;EACvB,CAAC;EAGD,MAAM,eAAe,iBAAiB,MAAM,KAAK,MAAM;EACvD,MAAM,mBAAmB,iBAAiB,WAAW,mBAAmB,MAAM,IAAI,IAAI;EACtF,IAAI,CAAC,kBACH,MAAM,IAAI,qBACR,6BACA,2DAA2D,MAAM,KAAK,aAAa,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,IAClH;EAEF,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;EAKzF,MAAM,kBACH,MAAM,kBAAkB,OAAO,sBAAsB,KAAK,KAC1D,MAAM,2BAA2B;GAChC,eAAe,OAAO;GACtB,OAAO,MAAM,OAAO;GACpB,kBAAkB,MAAM,OAAO;GAC/B;GACA;GAGA,mBAAmB,MAAM,OAAO,cAAc,KAAA;EAChD,CAAC;EAEH,MAAM,YAAY,QAAQ;GACxB,OAAO,MAAM,OAAO;GACpB,QAAQ,gBAAgB;GACxB,kBAAkB,MAAM,OAAO;GAC/B,WAAW,gBAAgB;GAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;GAC1F,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;GACxE,YAAY,MAAM,OAAO;GACzB;GACA,UAAU;IACR,IAAI,MAAM,KAAK;IACf,MAAM,MAAM;IACZ,OAAO;KACL,gBAAgB,MAAM,KAAK;KAC3B,kBAAkB,MAAM,KAAK;KAC7B,OAAO,MAAM,KAAK;KAClB,QAAQ,CAAC,QAAQ;KACjB,UAAU,MAAM,KAAK;KACrB,UAAU,MAAM,KAAK;IACvB;GACF;EACF,CAAC;CACH,SAAS,OAAO;EACd,IAAI,iBAAiB,sBAAsB,MAAM;EACjD,IAAI,iBAAiB,qCAEnB,MAAM,IAAI,qBADG,MAAM,WAAW,eAAe,2BAA2B,6BACnC,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtE,IAAI,iBAAiB,sCACnB,MAAM,IAAI,qBAAqB,0BAA0B,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE1F,IAAI,iBAAiB,kBACnB,MAAM,IAAI,qBAAqB,yBAAyB,MAAM,OAAO,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtG,MAAM;CACR;AACF;;;;;;;AAQA,SAAgB,wBACd,MA4BA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,SAAS,KAAK;EACd,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;EAC1C,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe;GAAE,WAAW,KAAK,QAAQ;GAAW,MAAM,KAAK;EAAK,IAAI,CAAC;EAClF,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,SAAS,KAAK;GAChB,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,gBACb,IAAI,kBAAkB,KAAK,QAAQ,QAAQ,CAC7C,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,uBAAuB,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;GAC1E,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,iBAAiB,KAAK,QAAQ;GAC9B,UAAU,EAAE,WAAW,KAAK,iBAAiB;GAC7C,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;GACvB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,gBAAgB,KAAK,mBAC1B,IAAI,gBAAgB;GAClB,MAAM,KAAK;GACX,UAAU,KAAK,QAAQ;GACvB,WAAW,YAAY,KAAK,gBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW;EACrF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,UAAU,KAAK,QAAQ;GACvB,aAAa,KAAK,QAAQ;GAC1B;GACA;GACA,cAAc,IAAI,aAAa,KAAK,UAAU;EAChD,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}

package/dist/routes/tenant-credentials.d.ts

@@ -58,10 +58,10 @@ export declare function invalidateTenantCredentialSnapshots(tenant: {
     userId?: string;
 }): void;
 /**
- * Middleware mounted after the web auth gate: primes the caller's credential
- * snapshot so the request's first model call sees their credentials without an
- * async seam in model resolution. Cheap when fresh (TTL check), best-effort
- * when not — a failed hydrate falls back to env vars, never blocks a request.
+ * Middleware mounted after the web auth gate: primes both credential precedence
+ * modes so the request's first model call can resolve user → organization when
+ * `orgFirst` is false or organization → user when `orgFirst` is true. Cheap when
+ * fresh because each store has a TTL.
  */
 export declare function primeTenantCredentials({ tenant, credentials, }: {
     tenant: SdkCredentialTenant;

package/dist/routes/tenant-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/tenant-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,IAAI,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAG3G,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,qBAAa,qBAAsB,YAAW,eAAe;;IAC3D,QAAQ,CAAC,wBAAwB,SAAS;gBAS9B,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,uBAAuB,GAAG,SAAS,EAAE,QAAQ,UAAQ;IAO7G,qEAAqE;IAC/D,WAAW,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BlD,kFAAkF;IAClF,MAAM,IAAI,IAAI;IAMd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAoD/D;AAoBD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAE3F;AAED,iEAAiE;AACjE,wBAAgB,qCAAqC,IAAI,IAAI,CAG5D;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASpG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,MAAM,EACN,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,iBAAiB,CAYpB"}
+{"version":3,"file":"tenant-credentials.d.ts","sourceRoot":"","sources":["../../src/routes/tenant-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,IAAI,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAG3G,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,qBAAa,qBAAsB,YAAW,eAAe;;IAC3D,QAAQ,CAAC,wBAAwB,SAAS;gBAS9B,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,uBAAuB,GAAG,SAAS,EAAE,QAAQ,UAAQ;IAO7G,qEAAqE;IAC/D,WAAW,CAAC,GAAG,SAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BlD,kFAAkF;IAClF,MAAM,IAAI,IAAI;IAMd,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAoD/D;AAoBD;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAE3F;AAED,iEAAiE;AACjE,wBAAgB,qCAAqC,IAAI,IAAI,CAG5D;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASpG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,MAAM,EACN,WAAW,GACZ,EAAE;IACD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,IAAI,EACJ,WAAW,GACZ,EAAE;IACD,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,uBAAuB,CAAC;CACtC,GAAG,iBAAiB,CAgBpB"}

package/dist/routes/tenant-credentials.js

@@ -138,20 +138,35 @@ function invalidateTenantCredentialSnapshots(tenant) {
 	for (const key of tenantStores.keys()) if (key.startsWith(`${tenant.orgId}\u0000`)) tenantStores.delete(key);
 }
 /**
-* Middleware mounted after the web auth gate: primes the caller's credential
-* snapshot so the request's first model call sees their credentials without an
-* async seam in model resolution. Cheap when fresh (TTL check), best-effort
-* when not — a failed hydrate falls back to env vars, never blocks a request.
+* Middleware mounted after the web auth gate: primes both credential precedence
+* modes so the request's first model call can resolve user → organization when
+* `orgFirst` is false or organization → user when `orgFirst` is true. Cheap when
+* fresh because each store has a TTL.
 */
 async function primeTenantCredentials({ tenant, credentials }) {
-	await storeFor(tenant, credentials).ensureFresh();
+	await Promise.all([storeFor({
+		...tenant,
+		orgFirst: false
+	}, credentials).ensureFresh(), storeFor({
+		...tenant,
+		orgFirst: true
+	}, credentials).ensureFresh()]);
 }
 function createTenantCredentialPrimer({ auth, credentials }) {
 	return async (c, next) => {
 		const tenant = auth.tenant(c);
 		if (tenant) try {
-			await storeFor(tenant, credentials).ensureFresh();
-		} catch {}
+			await primeTenantCredentials({
+				tenant,
+				credentials
+			});
+		} catch (error) {
+			console.warn("[factory] Failed to prime tenant model credentials", {
+				orgId: tenant.orgId,
+				userId: tenant.userId,
+				error
+			});
+		}
 		await next();
 	};
 }