@mastra/factory 0.13.0-alpha.11 → 0.13.0-alpha.13

package/dist/integrations/slack/slack.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack.js","names":[],"sources":["../../../src/integrations/slack/slack.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type {\n  ChannelHandler,\n  ChannelHandlerContext,\n  ChannelHandlers,\n  ChannelSessionResolve,\n  ChannelSessionStart,\n  ResolveResourceId,\n  ResolveThreadId,\n} from '@mastra/core/channels';\nimport type { Mastra } from '@mastra/core/mastra';\nimport { createSlackAdapter } from '@mastra/slack';\nimport type { SlackAdapterChannelConfig } from '@mastra/slack';\nimport { Card, CardText, Actions, LinkButton } from 'chat';\n\nimport {\n  hydrateFactorySession,\n  resolveFactoryDefaultModelId,\n  resolveFactoryProjectForSession,\n  resolveFactorySourceRepository,\n} from '../../session/factory-session.js';\nimport { readRequestContextOrgId, seedSessionOrg } from '../../session/org-seed.js';\nimport type {\n  ChannelAccountLink,\n  ChannelAccountLinkKey,\n  ChannelIdentityStorage,\n} from '../../storage/domains/channel-identity/base.js';\nimport type { FactoryActorExternalIdentity } from '../../storage/domains/comments/actor.js';\nimport { actorFromChannelAuthor } from '../../storage/domains/comments/actor.js';\nimport type { CommentsDomain } from '../../storage/domains/comments/domain.js';\nimport type { MemorySettingsStorage } from '../../storage/domains/memory-settings/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';\nimport type { ExternalWorkItemSource, WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { FactoryChannelsConfig } from '../base.js';\n\nimport { slackCommentSource } from './feed-publisher.js';\n\n// Derive the thread/message types from the core handler signature rather than\n// importing them from `chat` directly: mc-web can resolve a different `chat`\n// version than @mastra/core, and the two `Thread`/`Message` declarations are\n// structurally incompatible (private fields). Using the handler's own types\n// keeps everything on one version.\ntype HandlerThread = Parameters<ChannelHandler>[0];\ntype HandlerMessage = Parameters<ChannelHandler>[1];\n\nconst SLACK_REQUEST_TIMEOUT_MS = 15_000;\n\n/** Dependencies the Slack channel handlers close over, injected from the web entry. */\ninterface SlackChannelDeps {\n  /**\n   * The factory's reverse-index store mapping a Slack sender to a Mastra\n   * tenant. When provided, inbound messages from an unlinked sender are not\n   * dispatched — the run only proceeds (with the sender's tenant stamped on\n   * the request context) once they've linked their account. Unlinked senders\n   * get an ephemeral \"connect your account\" card instead.\n   */\n  accountLinks?: ChannelIdentityStorage;\n  /**\n   * Factory projects domain. When provided (alongside `accountLinks`), a\n   * linked sender's run must also resolve to a Factory project before it\n   * dispatches: their link's default factory, else their tenant's only\n   * factory (stamped back onto the link), else an ephemeral \"pick a default\n   * factory\" card and no run. Unset → no factory routing (runs dispatch as\n   * before).\n   */\n  projects?: FactoryProjectsStorage;\n  /**\n   * Storage handle of the integration that owns source control\n   * (`IntegrationContext.storage.sourceControlOwner`). Used to make new Slack\n   * threads repo-backed: when the sender is linked and their factory has a\n   * repository, the thread's resourceId becomes a Factory user-session id (repo\n   * cloned on a `slack/{threadTs}` branch) instead of the chat-only\n   * `channel:...` id. It also lets a started session read back the project it\n   * belongs to. Nothing here is provider-specific — the connection is matched\n   * by the handle's own `integrationId`. Absent (no source-control integration\n   * registered) → chat-only sessions as before.\n   */\n  sourceControl?: SourceControlStorageHandle;\n  /**\n   * Observational-memory settings domain. When provided, a repo-backed session\n   * adopts its factory project's shared memory settings on start, matching the\n   * web kickoff.\n   */\n  memorySettings?: MemorySettingsStorage;\n  /**\n   * Factory work-items domain. When provided, a dispatched new-session thread\n   * (DM or mention) upserts a Work-board card in Building (`execute`) carrying\n   * the Slack thread as its external source and binding the repo-backed\n   * session. Best-effort — a failure never blocks the run. Unset → no card.\n   */\n  workItems?: WorkItemsStorage;\n  /**\n   * Work-item feed. With it (and `workItems`), an `aside` lands as a comment on\n   * the card the thread created. Unset → asides stay ignored, as before.\n   */\n  feed?: Pick<CommentsDomain, 'createComment'>;\n  /** Overrides applied to the Slack channel adapter entry. */\n  adapterOptions?: SlackAdapterChannelConfig;\n}\n\n/**\n * Read the Slack team id off a raw platform payload (Events API envelope or\n * slash-command body — both carry `team_id`), duck-typed to build the\n * workspace-scoped account-link key.\n */\nfunction rawTeamId(rawPayload: unknown): string | undefined {\n  if (!rawPayload || typeof rawPayload !== 'object') return undefined;\n  const raw = rawPayload as { team_id?: unknown; team?: unknown };\n  if (typeof raw.team_id === 'string' && raw.team_id) return raw.team_id;\n  if (typeof raw.team === 'string' && raw.team) return raw.team;\n  if (raw.team && typeof raw.team === 'object') {\n    const id = (raw.team as { id?: unknown }).id;\n    if (typeof id === 'string' && id) return id;\n  }\n  return undefined;\n}\n\n/**\n * The Slack team id survives onto a normalized chat Message only on\n * `message.raw` (the Slack Events API envelope).\n */\nfunction slackTeamId(message: HandlerMessage): string | undefined {\n  return rawTeamId(message.raw);\n}\n\n/**\n * Resolve the web-UI origin for links humans open in a browser (Connect card,\n * session deep links). Prefers `MASTRACODE_PUBLIC_URL` — the origin auth\n * cookies and OAuth redirect allow-lists are registered against — over the\n * channels tunnel, which only Slack's servers need to reach.\n */\nfunction webPublicUrl(): string | undefined {\n  return process.env.MASTRACODE_PUBLIC_URL ?? process.env.MASTRACODE_CHANNELS_PUBLIC_URL;\n}\n\n/** Outcome of the sender-link gate for one inbound message. */\ntype LinkedSenderResult =\n  /** Gating not configured — dispatch as before account linking existed. */\n  | { status: 'ungated' }\n  /** Sender unlinked — Connect card posted (when possible), do not dispatch. */\n  | { status: 'blocked' }\n  /** Sender linked — their tenant plus the sender key the link lives under. */\n  | { status: 'linked'; link: ChannelAccountLink; key: ChannelAccountLinkKey };\n\n/**\n * Resolve the sender's account link, posting an ephemeral \"connect your\n * account\" card (visible only to the sender) linking into the web UI's\n * Slack-connect flow when they're unlinked.\n */\nexport async function resolveLinkedSender({\n  thread,\n  message,\n  accountLinks,\n}: {\n  thread: HandlerThread;\n  message: HandlerMessage;\n  accountLinks?: ChannelIdentityStorage;\n}): Promise<LinkedSenderResult> {\n  if (!accountLinks) return { status: 'ungated' };\n  const platform = thread.adapter.name;\n  const externalUserId = message.author.userId;\n  const externalTeamId = slackTeamId(message);\n  // Without a team id we can't identify the workspace-scoped link; treat as\n  // unlinked so a run never proceeds tenant-less.\n  const key = externalTeamId ? { platform, externalTeamId, externalUserId } : undefined;\n  const link = key ? await accountLinks.getAccountLink(key) : null;\n  if (link && key) return { status: 'linked', link, key };\n\n  const publicUrl = webPublicUrl();\n  // A public origin is all the card needs. The link carries no identity: the\n  // web app authenticates the visitor, then Slack's OIDC flow proves which\n  // Slack account they control. Without an origin, still block, just no card.\n  if (publicUrl) {\n    await thread.postEphemeral(message.author, buildConnectCard(publicUrl), { fallbackToDM: true });\n  }\n  return { status: 'blocked' };\n}\n\n/**\n * The \"connect your account\" card. The link is deliberately identity-free —\n * `/connect/slack` sends the visitor to Connections, where \"Connect Slack\"\n * runs the OIDC flow and Slack itself asserts the (team, user) pair.\n */\nfunction buildConnectCard(publicUrl: string) {\n  return Card({\n    title: 'Connect your account',\n    children: [\n      CardText('Connect your account to use this agent.'),\n      Actions([\n        LinkButton({\n          url: `${publicUrl}/connect/slack`,\n          label: 'Connect account',\n        }),\n      ]),\n    ],\n  });\n}\n\n/** Outcome of factory routing for one linked sender's inbound message. */\ntype FactoryRouteResult =\n  /** Factory routing not configured — dispatch without a factory. */\n  | { status: 'ungated' }\n  /** No factory resolved — prompt card posted (when possible), do not dispatch. */\n  | { status: 'blocked' }\n  /** The Factory project this sender's runs route to. */\n  | { status: 'resolved'; factoryProjectId: string; slackWorkItemsEnabled: boolean };\n\n/**\n * Decide which Factory project a linked sender's run belongs to:\n *\n * 1. The link's `defaultFactoryProjectId`, when it still exists (a stale id —\n *    deleted factory — falls through as if unset).\n * 2. Else, the tenant's only factory, stamped back onto the link so it shows\n *    up (and stays editable) in Connected Accounts settings.\n * 3. Else — zero or several factories — an ephemeral \"pick a default factory\"\n *    card deep-linking to settings, and the run is blocked.\n */\nexport async function resolveFactoryForLink({\n  thread,\n  message,\n  link,\n  key,\n  accountLinks,\n  projects,\n}: {\n  thread: HandlerThread;\n  message: HandlerMessage;\n  link: ChannelAccountLink;\n  key: ChannelAccountLinkKey;\n  accountLinks: ChannelIdentityStorage;\n  projects?: FactoryProjectsStorage;\n}): Promise<FactoryRouteResult> {\n  if (!projects) return { status: 'ungated' };\n  // Factories are org-scoped; a personal account (no org) has none and lands\n  // on the prompt below.\n  const orgId = link.orgId ?? '';\n\n  if (link.defaultFactoryProjectId) {\n    const existing = await projects.get({ orgId, id: link.defaultFactoryProjectId });\n    if (existing) {\n      return {\n        status: 'resolved',\n        factoryProjectId: existing.id,\n        slackWorkItemsEnabled: existing.slackWorkItemsEnabled,\n      };\n    }\n  }\n\n  const factories = orgId ? await projects.list({ orgId }) : [];\n  if (factories.length === 1) {\n    const only = factories[0]!;\n    await accountLinks.setDefaultFactory({ ...key, userId: link.userId, factoryProjectId: only.id });\n    return {\n      status: 'resolved',\n      factoryProjectId: only.id,\n      slackWorkItemsEnabled: only.slackWorkItemsEnabled,\n    };\n  }\n\n  const publicUrl = webPublicUrl();\n  if (publicUrl) {\n    await thread.postEphemeral(\n      message.author,\n      Card({\n        title: 'Pick a default factory',\n        children: [\n          CardText(\n            factories.length === 0\n              ? 'Your account has no factory yet. Create one in the web app, then message me again.'\n              : 'Your account has several factories. Pick which one Slack sessions should go to, then message me again.',\n          ),\n          Actions([\n            LinkButton({\n              url: `${publicUrl}/settings/connections`,\n              label: 'Open settings',\n            }),\n          ]),\n        ],\n      }),\n      { fallbackToDM: true },\n    );\n  }\n  return { status: 'blocked' };\n}\n\n/**\n * Deterministic per-thread branch name: `slack/{threadTs}` with characters\n * outside the sandbox git-ref allow-list (`[A-Za-z0-9_./-]`, and `.` for\n * readability) mapped to `-`. `thread.id` is `{channelId}:{threadTs}`\n * (platform-prefixed on handler threads) — the trailing segment is the ts.\n *\n * Top-level DM and channel conversations use the empty-threadTs thread form,\n * so the trailing segment can be empty; a bare `slack/` is not a valid git\n * ref. Fall back to the last non-empty segment (the channel id): one\n * deterministic branch per top-level conversation.\n */\nfunction threadBranch(threadId: string): string {\n  const segments = threadId.split(':');\n  const tail = segments.findLast(segment => segment.length > 0) ?? threadId;\n  return `slack/${tail.replace(/[^A-Za-z0-9_/-]/g, '-')}`;\n}\n\n/**\n * Resolve the resourceId for a NEW Slack channel thread. A linked sender whose\n * factory has a repository gets a Factory user-session id — the controller\n * session then materializes the repo sandbox via the factory's dynamic\n * workspace (clone + PAT), the session shows up in the web Sessions list, and\n * View Session deep-links land on the normal workspace route. Everything else\n * (unlinked, unrouted, repo-less, or no source control) keeps the chat-only\n * `defaultResourceId`.\n *\n * Pure lookups only — cards for unlinked/unrouted senders are the dispatch\n * gate's job; this hook must never post.\n */\nexport function createChannelResourceIdResolver(deps: SlackChannelDeps): ResolveResourceId {\n  const { accountLinks, projects, sourceControl } = deps;\n  return async ({ platform, thread, message }) => {\n    // NOT the hook's `defaultResourceId`: configuring a custom resolver\n    // bypasses AgentControllerChannels' own `channel:{thread.id}` derivation\n    // (agent-controller-channels.ts `resolveChannelResourceId`), and the base\n    // default is the per-USER memory key. Chat-only fallbacks must stay\n    // per-thread, so reproduce the controller default here.\n    const chatOnlyResourceId = `channel:${thread.id}`;\n    if (!accountLinks || !projects || !sourceControl) return chatOnlyResourceId;\n    try {\n      const externalTeamId = rawTeamId(message.raw);\n      if (!externalTeamId) return chatOnlyResourceId;\n      const link = await accountLinks.getAccountLink({\n        platform,\n        externalTeamId,\n        externalUserId: message.author.userId,\n      });\n      if (!link) return chatOnlyResourceId;\n\n      // Same chain as `resolveFactoryForLink`, minus prompts/stamping: the\n      // dispatch gate has already run (and stamped a lone factory) by the\n      // time a new thread is created, so this is a read-only re-resolve.\n      const orgId = link.orgId ?? '';\n      let factoryProjectId: string | undefined;\n      if (link.defaultFactoryProjectId && (await projects.get({ orgId, id: link.defaultFactoryProjectId }))) {\n        factoryProjectId = link.defaultFactoryProjectId;\n      } else if (orgId) {\n        const factories = await projects.list({ orgId });\n        if (factories.length === 1) factoryProjectId = factories[0]!.id;\n      }\n      if (!factoryProjectId) return chatOnlyResourceId;\n\n      const repo = await resolveFactorySourceRepository({ sourceControl, orgId, factoryProjectId });\n      if (!repo.found) return chatOnlyResourceId;\n\n      const branch = threadBranch(thread.id);\n      // Attributed to the Slack sender, not to whoever connected the repository:\n      // unlike an autonomous rule run, a Slack thread has a real interactive user.\n      const existing = await sourceControl.sessions.getForBranch({\n        projectRepositoryId: repo.projectRepositoryId,\n        userId: link.userId,\n        branch,\n      });\n      if (existing) return existing.sessionId;\n      const session = await sourceControl.sessions.create({\n        sessionId: randomUUID(),\n        projectRepositoryId: repo.projectRepositoryId,\n        orgId,\n        userId: link.userId,\n        branch,\n        baseBranch: repo.baseBranch,\n        // DMs are the only private origin; channel threads are org-visible.\n        visibility: thread.isDM ? 'private' : 'org',\n      });\n      return session.sessionId;\n    } catch (error) {\n      // Fall back to a chat-only session rather than dropping the message.\n      console.warn('[slack] repo-backed session resolution failed for thread', thread.id, error);\n      return chatOnlyResourceId;\n    }\n  };\n}\n\n/**\n * Thread id for a NEW Slack channel thread. Repo-backed threads take the\n * user-session id AS their thread id, matching the web convention\n * (FactoryStartCoordinator seeds threads with threadId = sessionId) so\n * `/workspaces/{sessionId}/threads/{sessionId}` resolves Slack-created\n * sessions exactly like web-created ones — no `?resourceId=` override needed.\n * Chat-only threads keep the default random id: their `channel:...`\n * resourceId is a memory key, not a unique thread id.\n */\nexport const resolveChannelThreadId: ResolveThreadId = ({ resourceId, defaultThreadId }) =>\n  resourceId.startsWith('channel:') ? defaultThreadId : resourceId;\n\n/** Create channel sessions with their Factory ownership present in initial controller state. */\nexport function createChannelSessionResolver(deps: SlackChannelDeps): ChannelSessionResolve {\n  const { sourceControl } = deps;\n  return async ({ controller, thread, requestContext }) => {\n    const owner =\n      sourceControl && !thread.resourceId.startsWith('channel:')\n        ? await resolveFactoryProjectForSession({ sourceControl, sessionId: thread.resourceId })\n        : null;\n    return controller.createSession({\n      id: thread.resourceId,\n      ownerId: controller.id,\n      resourceId: thread.resourceId,\n      requestContext,\n      ...(owner ? { tags: { factoryProjectId: owner.factoryProjectId } } : {}),\n    });\n  };\n}\n\n/**\n * Apply the factory's configuration to a Slack-created session the first time\n * its thread reaches the controller.\n *\n * Without this a Slack session runs on the SDK's built-in mode default\n * (`openai/gpt-5.5`), so a factory configured for any other provider fails every\n * message with a missing-credentials error. The web kickoff has always applied\n * the factory default; this brings Slack to the same footing.\n *\n * Only repo-backed threads are configured. Their resourceId IS the Factory\n * session id, which the source-control rows turn back into a project — a\n * chat-only `channel:...` id names no project, so there is nothing to read.\n *\n * Skips a session whose mode already has a model persisted on the thread. That\n * is the durable record of a deliberate choice — either an earlier start or a\n * user's own switch — and re-applying the factory default over it would undo\n * the user's selection every time the process restarts.\n */\nexport function createChannelSessionStartHook(deps: SlackChannelDeps): ChannelSessionStart {\n  const { projects, sourceControl, memorySettings } = deps;\n  return async ({ session, thread, requestContext }) => {\n    // Seed the tenant org above every guard below. `gateDispatch` stamps it on\n    // the message's request context before the session exists, so this needs no\n    // storage read — which matters, because the guards below deliberately skip\n    // storage on a restarted session. A channel-only thread and a thread whose\n    // dispatch was ungated both land here with no org and are marked unresolved\n    // rather than being left to look like a local session.\n    await seedSessionOrg(session, readRequestContextOrgId(requestContext));\n\n    if (!projects || !sourceControl) return;\n    if (thread.resourceId.startsWith('channel:')) return;\n\n    const owner = await resolveFactoryProjectForSession({ sourceControl, sessionId: thread.resourceId });\n    if (!owner) return;\n\n    // Repo-backed Slack sessions are factory sessions: stamp the owning\n    // project onto controller state so downstream reads (org-first credential\n    // resolution, authority gates) recognize them, same as board runs.\n    await session.state.set({ factoryProjectId: owner.factoryProjectId });\n    // Route the org through the seed helper rather than stamping it directly:\n    // an ungated dispatch marked this session unresolved above, and owner\n    // recovery is the resolution that has to clear that marker with it.\n    await seedSessionOrg(session, owner.orgId);\n\n    const modeModelKey = `modeModelId_${session.mode.get()}`;\n    if (await session.thread.getSetting({ key: modeModelKey })) return;\n\n    const defaultModelId = await resolveFactoryDefaultModelId(projects, owner.factoryProjectId);\n    await hydrateFactorySession(session, {\n      orgId: owner.orgId,\n      factoryProjectId: owner.factoryProjectId,\n      defaultModelId,\n      memorySettings,\n    });\n  };\n}\n\n/**\n * The internal Mastra thread the framework created for a channel conversation.\n * The handler's `thread.id` is the platform thread id (e.g. `slack:C123:ts`),\n * NOT the internal UUID — the mapping lives in the stored thread's channel\n * metadata.\n */\nasync function findInternalThread(mastra: Mastra | undefined, thread: HandlerThread) {\n  const store = await mastra?.getStorage()?.getStore('memory');\n  const { threads } = (await store?.listThreads({\n    filter: {\n      metadata: {\n        channel_platform: thread.adapter.name,\n        channel_externalThreadId: thread.id,\n        channel_externalChannelId: thread.channelId,\n      },\n    },\n    perPage: 1,\n  })) ?? { threads: [] };\n  return threads[0];\n}\n\n/**\n * Build the \"new session\" handler for mention / direct-message events. A mention or\n * DM on a not-yet-subscribed thread starts a NEW session; once subscribed, later\n * events are follow-ups and don't re-announce.\n */\n/**\n * Run the account-link + factory-routing gates for one inbound message.\n * Returns `null` when the run must not dispatch (a prompt card was posted\n * where possible); otherwise the dispatch context — with `routed` present\n * only when a linked sender resolved to a factory.\n */\nasync function gateDispatch(\n  thread: HandlerThread,\n  message: HandlerMessage,\n  { accountLinks, projects }: SlackChannelDeps,\n  ctx: ChannelHandlerContext,\n): Promise<{\n  routed?: { link: ChannelAccountLink; factoryProjectId: string; slackWorkItemsEnabled: boolean };\n} | null> {\n  const sender = await resolveLinkedSender({ thread, message, accountLinks });\n  if (sender.status === 'blocked') return null;\n  // Linked senders must also route to a Factory project before a run starts.\n  if (sender.status === 'linked' && accountLinks) {\n    // Stamp the tenant on the run's request context — the single seam\n    // `resolveCredentialStore` reads to load this sender's model credentials.\n    // This belongs to the link, not to the routing: a linked sender whose\n    // factory routing comes back `ungated` still exits below and dispatches, so\n    // stamping only in the routed branch would silently run them on default\n    // credentials.\n    ctx.requestContext.set('user', { id: sender.link.userId, organizationId: sender.link.orgId });\n\n    const route = await resolveFactoryForLink({ thread, message, ...sender, accountLinks, projects });\n    if (route.status === 'blocked') return null;\n    if (route.status === 'resolved') {\n      return {\n        routed: {\n          link: sender.link,\n          factoryProjectId: route.factoryProjectId,\n          slackWorkItemsEnabled: route.slackWorkItemsEnabled,\n        },\n      };\n    }\n  }\n  return {};\n}\n\n/**\n * A channel id and a `ts` name a thread only inside the workspace that issued\n * them, so the team scopes the card's key — without it two workspaces could\n * hold one key and an aside would land on another tenant's card.\n */\nexport function slackThreadSource(thread: HandlerThread, teamId?: string): ExternalWorkItemSource {\n  return {\n    integrationId: thread.adapter.name,\n    type: 'slack-thread',\n    ...(teamId ? { workspaceId: teamId } : {}),\n    externalId: thread.id,\n  };\n}\n\n/** Cards written before the key carried a team are still keyed bare. */\nasync function findThreadWorkItem(\n  workItems: WorkItemsStorage,\n  thread: HandlerThread,\n  teamId?: string,\n): Promise<WorkItemRow | null> {\n  const scoped = await workItems.getBySource(slackThreadSource(thread, teamId));\n  if (scoped || !teamId) return scoped;\n  return workItems.getBySource(slackThreadSource(thread));\n}\n\n/**\n * Upsert the Work-board card for a dispatched Slack-thread run. Keyed on the\n * thread via `externalSource` — the work-items domain's unique\n * `(factory_project_id, source_key)` index makes repeat messages reuse the\n * same card, and `reuseMode: 'preserve'` keeps a card a human already dragged\n * across stages untouched. The card lands in Building (`execute`) for every\n * dispatched thread (DM or mention) — there is deliberately no per-origin\n * stage split; smart routing is a follow-up.\n *\n * The session id / branch / threadId and the workspace deep-link are resolved\n * by the caller (which already looked up the internal thread), so this helper\n * just shapes and writes. Best-effort: the run is already dispatched, so a\n * failure logs instead of throwing — work-item creation must never abort a Slack run.\n */\nexport async function upsertThreadWorkItem({\n  workItems,\n  thread,\n  message,\n  link,\n  factoryProjectId,\n  session,\n  url,\n}: {\n  workItems: WorkItemsStorage;\n  thread: HandlerThread;\n  message: HandlerMessage;\n  link: ChannelAccountLink;\n  factoryProjectId: string;\n  /**\n   * The repo-backed Factory session to bind under the `chat` role, or\n   * `undefined` for a chat-only thread (no Factory session to bind).\n   */\n  session?: { sessionId: string; branch: string; threadId: string };\n  /** Workspace deep-link to the running session; omitted when no public URL. */\n  url?: string;\n}): Promise<void> {\n  try {\n    const title = message.text.length > 80 ? `${message.text.slice(0, 79)}…` : message.text;\n\n    await workItems.upsert({\n      orgId: link.orgId ?? '',\n      userId: link.userId,\n      factoryProjectId,\n      reuseMode: 'preserve',\n      input: {\n        title: title || 'Slack thread',\n        externalSource: { ...slackThreadSource(thread, slackTeamId(message)), ...(url ? { url } : {}) },\n        stages: ['execute'],\n        ...(session ? { sessions: { chat: session } } : {}),\n      },\n    });\n  } catch (error) {\n    console.warn('[slack] work-item creation failed for thread', thread.id, error);\n  }\n}\n\nfunction createNewSessionChatHandler(deps: SlackChannelDeps): ChannelHandler {\n  const { workItems } = deps;\n  return async (thread, message, defaultHandler, ctx) => {\n    // Gate on the sender having linked their Slack account to a Mastra tenant.\n    // Unlinked → post the ephemeral Connect card and stop; no session/run is\n    // created (which would otherwise be tenant-less and fail credential\n    // resolution). This handler is the only gate — core dispatches whatever\n    // reaches it — so every slot that can start a run must call it.\n    const gate = await gateDispatch(thread, message, deps, ctx);\n    if (!gate) return;\n\n    // A mention on a not-yet-subscribed thread is a NEW session. The\n    // default handler auto-subscribes, so once subscribed this is a\n    // follow-up mention — don't re-announce.\n    const isNewSession = !(await thread.isSubscribed());\n\n    // Run the framework handler first so the internal Mastra thread and\n    // controller session are created before we build the deep link.\n    await defaultHandler(thread, message);\n\n    if (!isNewSession) return;\n\n    // The internal-thread lookup and deep-link are needed by BOTH the\n    // announcement card AND work-item creation, so they run BEFORE the\n    // card-only `MASTRACODE_PUBLIC_URL` gate — a deployment without a public\n    // origin should still create board cards, just without a clickable link.\n    const internalThread = await findInternalThread(ctx.mastra, thread);\n    if (!internalThread) {\n      console.warn('[onMention] no internal thread found for', thread.id);\n      return;\n    }\n\n    // When the sender routed to a factory we know exactly which workspace the\n    // session belongs to — deep-link straight into it. A repo-backed thread's\n    // resourceId IS the Factory user-session id, so the link lands on the same\n    // route a web-started run navigates to; chat-only threads keep the literal\n    // `channel` segment (the real resource rides the `?resourceId=` override).\n    // Unrouted senders fall back to the factory-agnostic /threads/ redirect.\n    // One predicate drives both the path segment and the query param, so the\n    // two can never disagree about what the URL already carries.\n    const isChatOnly = internalThread.resourceId.startsWith('channel:');\n    const workspaceSegment = isChatOnly ? 'channel' : encodeURIComponent(internalThread.resourceId);\n    const threadPath = gate.routed\n      ? `/factories/${encodeURIComponent(gate.routed.factoryProjectId)}/workspaces/${workspaceSegment}/threads/${encodeURIComponent(internalThread.id)}`\n      : `/threads/${internalThread.id}`;\n\n    // The param is an override for a URL that can't otherwise name its\n    // resource. A routed repo-backed thread already spells the resourceId out\n    // as its workspace segment, so appending it again is duplication the app\n    // ignores. Chat-only threads need it (their segment is the literal string\n    // `channel`), and so does the unrouted fallback, which has no workspace\n    // segment at all — `ChannelThreadRedirect` forwards the search through.\n    //\n    // One shared deep-link: the card's button and the work-item `url` read the\n    // SAME value so they can never drift. Undefined without a public origin —\n    // the card is then skipped, but the work item is still created (url omitted).\n    const needsResourceParam = isChatOnly || !gate.routed;\n    const deepLink = process.env.MASTRACODE_PUBLIC_URL\n      ? needsResourceParam\n        ? `${process.env.MASTRACODE_PUBLIC_URL}${threadPath}?resourceId=${encodeURIComponent(internalThread.resourceId)}`\n        : `${process.env.MASTRACODE_PUBLIC_URL}${threadPath}`\n      : undefined;\n\n    // A dispatched, routed new-session thread becomes a Work-board card in\n    // Building. Only routed senders (linked → factory) have the org/user/factory\n    // a work item needs. Bind the repo-backed Factory session under the `chat`\n    // role; a chat-only `channel:` resourceId is NOT a session id, so bind\n    // nothing rather than a bad id. Best-effort (the helper swallows failures).\n    if (workItems && gate.routed?.slackWorkItemsEnabled) {\n      const session = isChatOnly\n        ? undefined\n        : { sessionId: internalThread.resourceId, branch: threadBranch(thread.id), threadId: internalThread.id };\n      await upsertThreadWorkItem({\n        workItems,\n        thread,\n        message,\n        link: gate.routed.link,\n        factoryProjectId: gate.routed.factoryProjectId,\n        session,\n        url: deepLink,\n      });\n    }\n\n    // The announcement card is only useful with a public origin to deep-link\n    // to — otherwise the link would be `undefined/threads/...`. Without one the\n    // session (and now the work item) still exist; we just skip the broken card.\n    if (!deepLink) return;\n\n    await thread.post(\n      Card({\n        title: 'New session started',\n        children: [Actions([LinkButton({ url: deepLink, label: 'View session' })])],\n      }),\n    );\n  };\n}\n\n/**\n * An `aside` never reaches the agent, but it is still part of the conversation:\n * record it on the card the thread created. The link is resolved here rather\n * than through `gateDispatch`, which posts a Connect card an aside must not\n * trigger. Best-effort — nothing here may surface in the Slack thread.\n */\nasync function ingestAside(\n  thread: HandlerThread,\n  message: HandlerMessage,\n  { feed, workItems, accountLinks }: SlackChannelDeps,\n): Promise<void> {\n  if (!feed || !workItems) return;\n  const body = message.text.replace(/^aside\\b[,:]?\\s*/i, '').trim();\n  if (!body) return;\n  try {\n    const teamId = slackTeamId(message);\n    const workItem = await findThreadWorkItem(workItems, thread, teamId);\n    if (!workItem) return;\n\n    const external: FactoryActorExternalIdentity = {\n      platform: thread.adapter.name,\n      ...(teamId ? { teamId } : {}),\n      messageId: message.id,\n      userId: message.author.userId,\n      userName: message.author.userName,\n      fullName: message.author.fullName,\n      isBot: message.author.isBot,\n    };\n    const link =\n      accountLinks && teamId\n        ? await accountLinks.getAccountLink({\n            platform: external.platform,\n            externalTeamId: teamId,\n            externalUserId: external.userId,\n          })\n        : null;\n\n    const result = await feed.createComment({\n      orgId: workItem.orgId,\n      workItemId: workItem.id,\n      author: actorFromChannelAuthor(external, link),\n      body,\n      occurredAt: message.metadata.dateSent,\n      externalSource: slackCommentSource(thread.id, message.id, teamId),\n    });\n    if (result.status !== 'created') {\n      console.warn('[slack] aside not ingested', { thread: thread.id, messageTs: message.id, status: result.status });\n    }\n  } catch (error) {\n    // Slack was acked before this handler ran, so a lost aside is never redelivered.\n    console.warn('[slack] aside ingest failed', { thread: thread.id, messageTs: message.id, error });\n  }\n}\n\nexport const createHandlers = (deps: SlackChannelDeps): ChannelHandlers => {\n  const newSessionChatHandler = createNewSessionChatHandler(deps);\n\n  return {\n    onSubscribedMessage: async (thread, message, defaultHandler, ctx) => {\n      // `aside` as its own leading word lets humans talk in a subscribed\n      // thread without the bot replying. Word boundary so messages that\n      // merely start with \"aside...\" (e.g. \"asides can wait\") still route.\n      if (/^aside\\b/i.test(message.text)) return ingestAside(thread, message, deps);\n      // A subscribed follow-up from an unlinked sender must not run either\n      // (e.g. the link was removed mid-conversation), and it must still\n      // resolve a factory (e.g. the default was cleared or its factory\n      // deleted mid-conversation).\n      const gate = await gateDispatch(thread, message, deps, ctx);\n      if (!gate) return;\n      await defaultHandler(thread, message);\n    },\n    onMention: newSessionChatHandler,\n    onDirectMessage: newSessionChatHandler,\n  };\n};\n\n/** Slack app credentials, passed in explicitly rather than read from env here. */\ninterface SlackCredentials {\n  clientId?: string;\n  clientSecret?: string;\n  signingSecret: string;\n  botToken?: string;\n}\n\nexport function createSlackChannelsConfig(deps: SlackChannelDeps & { slack: SlackCredentials }): FactoryChannelsConfig {\n  // Per HTTP attempt, not per call: the WebClient's own retry policy still\n  // waits out a 429. Without it a dead socket hangs a post forever.\n  const adapter = createSlackAdapter({ ...deps.slack, webClientOptions: { timeout: SLACK_REQUEST_TIMEOUT_MS } });\n  const slack =\n    deps.adapterOptions?.streaming === false\n      ? { adapter, ...deps.adapterOptions }\n      : { adapter, ...deps.adapterOptions, streaming: deps.adapterOptions?.streaming ?? true };\n\n  return {\n    adapters: { slack },\n    handlers: createHandlers(deps),\n    // New linked+repo-backed threads own a Factory user-session id as their\n    // resourceId, which is what makes the controller session repo-backed.\n    resolveResourceId: createChannelResourceIdResolver(deps),\n    resolveThreadId: resolveChannelThreadId,\n    resolveSession: createChannelSessionResolver(deps),\n    // Those sessions are created by the channel machinery, not the web kickoff,\n    // so this is where they pick up the factory's configuration.\n    onSessionStart: createChannelSessionStartHook(deps),\n  };\n}\n"],"mappings":";;;;;;;;AA+CA,MAAM,2BAA2B;;;;;;AA4DjC,SAAS,UAAU,YAAyC;CAC1D,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO,KAAA;CAC1D,MAAM,MAAM;CACZ,IAAI,OAAO,IAAI,YAAY,YAAY,IAAI,SAAS,OAAO,IAAI;CAC/D,IAAI,OAAO,IAAI,SAAS,YAAY,IAAI,MAAM,OAAO,IAAI;CACzD,IAAI,IAAI,QAAQ,OAAO,IAAI,SAAS,UAAU;EAC5C,MAAM,KAAM,IAAI,KAA0B;EAC1C,IAAI,OAAO,OAAO,YAAY,IAAI,OAAO;CAC3C;AAEF;;;;;AAMA,SAAS,YAAY,SAA6C;CAChE,OAAO,UAAU,QAAQ,GAAG;AAC9B;;;;;;;AAQA,SAAS,eAAmC;CAC1C,OAAO,QAAQ,IAAI,yBAAyB,QAAQ,IAAI;AAC1D;;;;;;AAgBA,eAAsB,oBAAoB,EACxC,QACA,SACA,gBAK8B;CAC9B,IAAI,CAAC,cAAc,OAAO,EAAE,QAAQ,UAAU;CAC9C,MAAM,WAAW,OAAO,QAAQ;CAChC,MAAM,iBAAiB,QAAQ,OAAO;CACtC,MAAM,iBAAiB,YAAY,OAAO;CAG1C,MAAM,MAAM,iBAAiB;EAAE;EAAU;EAAgB;CAAe,IAAI,KAAA;CAC5E,MAAM,OAAO,MAAM,MAAM,aAAa,eAAe,GAAG,IAAI;CAC5D,IAAI,QAAQ,KAAK,OAAO;EAAE,QAAQ;EAAU;EAAM;CAAI;CAEtD,MAAM,YAAY,aAAa;CAI/B,IAAI,WACF,MAAM,OAAO,cAAc,QAAQ,QAAQ,iBAAiB,SAAS,GAAG,EAAE,cAAc,KAAK,CAAC;CAEhG,OAAO,EAAE,QAAQ,UAAU;AAC7B;;;;;;AAOA,SAAS,iBAAiB,WAAmB;CAC3C,OAAO,KAAK;EACV,OAAO;EACP,UAAU,CACR,SAAS,yCAAyC,GAClD,QAAQ,CACN,WAAW;GACT,KAAK,GAAG,UAAU;GAClB,OAAO;EACT,CAAC,CACH,CAAC,CACH;CACF,CAAC;AACH;;;;;;;;;;;AAqBA,eAAsB,sBAAsB,EAC1C,QACA,SACA,MACA,KACA,cACA,YAQ8B;CAC9B,IAAI,CAAC,UAAU,OAAO,EAAE,QAAQ,UAAU;CAG1C,MAAM,QAAQ,KAAK,SAAS;CAE5B,IAAI,KAAK,yBAAyB;EAChC,MAAM,WAAW,MAAM,SAAS,IAAI;GAAE;GAAO,IAAI,KAAK;EAAwB,CAAC;EAC/E,IAAI,UACF,OAAO;GACL,QAAQ;GACR,kBAAkB,SAAS;GAC3B,uBAAuB,SAAS;EAClC;CAEJ;CAEA,MAAM,YAAY,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;CAC5D,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,OAAO,UAAU;EACvB,MAAM,aAAa,kBAAkB;GAAE,GAAG;GAAK,QAAQ,KAAK;GAAQ,kBAAkB,KAAK;EAAG,CAAC;EAC/F,OAAO;GACL,QAAQ;GACR,kBAAkB,KAAK;GACvB,uBAAuB,KAAK;EAC9B;CACF;CAEA,MAAM,YAAY,aAAa;CAC/B,IAAI,WACF,MAAM,OAAO,cACX,QAAQ,QACR,KAAK;EACH,OAAO;EACP,UAAU,CACR,SACE,UAAU,WAAW,IACjB,uFACA,wGACN,GACA,QAAQ,CACN,WAAW;GACT,KAAK,GAAG,UAAU;GAClB,OAAO;EACT,CAAC,CACH,CAAC,CACH;CACF,CAAC,GACD,EAAE,cAAc,KAAK,CACvB;CAEF,OAAO,EAAE,QAAQ,UAAU;AAC7B;;;;;;;;;;;;AAaA,SAAS,aAAa,UAA0B;CAG9C,OAAO,UAFU,SAAS,MAAM,GACZ,CAAC,CAAC,UAAS,YAAW,QAAQ,SAAS,CAAC,KAAK,SAAA,CAC5C,QAAQ,oBAAoB,GAAG;AACtD;;;;;;;;;;;;;AAcA,SAAgB,gCAAgC,MAA2C;CACzF,MAAM,EAAE,cAAc,UAAU,kBAAkB;CAClD,OAAO,OAAO,EAAE,UAAU,QAAQ,cAAc;EAM9C,MAAM,qBAAqB,WAAW,OAAO;EAC7C,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,eAAe,OAAO;EACzD,IAAI;GACF,MAAM,iBAAiB,UAAU,QAAQ,GAAG;GAC5C,IAAI,CAAC,gBAAgB,OAAO;GAC5B,MAAM,OAAO,MAAM,aAAa,eAAe;IAC7C;IACA;IACA,gBAAgB,QAAQ,OAAO;GACjC,CAAC;GACD,IAAI,CAAC,MAAM,OAAO;GAKlB,MAAM,QAAQ,KAAK,SAAS;GAC5B,IAAI;GACJ,IAAI,KAAK,2BAA4B,MAAM,SAAS,IAAI;IAAE;IAAO,IAAI,KAAK;GAAwB,CAAC,GACjG,mBAAmB,KAAK;QACnB,IAAI,OAAO;IAChB,MAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,CAAC;IAC/C,IAAI,UAAU,WAAW,GAAG,mBAAmB,UAAU,EAAE,CAAE;GAC/D;GACA,IAAI,CAAC,kBAAkB,OAAO;GAE9B,MAAM,OAAO,MAAM,+BAA+B;IAAE;IAAe;IAAO;GAAiB,CAAC;GAC5F,IAAI,CAAC,KAAK,OAAO,OAAO;GAExB,MAAM,SAAS,aAAa,OAAO,EAAE;GAGrC,MAAM,WAAW,MAAM,cAAc,SAAS,aAAa;IACzD,qBAAqB,KAAK;IAC1B,QAAQ,KAAK;IACb;GACF,CAAC;GACD,IAAI,UAAU,OAAO,SAAS;GAW9B,QAAO,MAVe,cAAc,SAAS,OAAO;IAClD,WAAW,WAAW;IACtB,qBAAqB,KAAK;IAC1B;IACA,QAAQ,KAAK;IACb;IACA,YAAY,KAAK;IAEjB,YAAY,OAAO,OAAO,YAAY;GACxC,CAAC,EAAA,CACc;EACjB,SAAS,OAAO;GAEd,QAAQ,KAAK,4DAA4D,OAAO,IAAI,KAAK;GACzF,OAAO;EACT;CACF;AACF;;;;;;;;;;AAWA,MAAa,0BAA2C,EAAE,YAAY,sBACpE,WAAW,WAAW,UAAU,IAAI,kBAAkB;;AAGxD,SAAgB,6BAA6B,MAA+C;CAC1F,MAAM,EAAE,kBAAkB;CAC1B,OAAO,OAAO,EAAE,YAAY,QAAQ,qBAAqB;EACvD,MAAM,QACJ,iBAAiB,CAAC,OAAO,WAAW,WAAW,UAAU,IACrD,MAAM,gCAAgC;GAAE;GAAe,WAAW,OAAO;EAAW,CAAC,IACrF;EACN,OAAO,WAAW,cAAc;GAC9B,IAAI,OAAO;GACX,SAAS,WAAW;GACpB,YAAY,OAAO;GACnB;GACA,GAAI,QAAQ,EAAE,MAAM,EAAE,kBAAkB,MAAM,iBAAiB,EAAE,IAAI,CAAC;EACxE,CAAC;CACH;AACF;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,8BAA8B,MAA6C;CACzF,MAAM,EAAE,UAAU,eAAe,mBAAmB;CACpD,OAAO,OAAO,EAAE,SAAS,QAAQ,qBAAqB;EAOpD,MAAM,eAAe,SAAS,wBAAwB,cAAc,CAAC;EAErE,IAAI,CAAC,YAAY,CAAC,eAAe;EACjC,IAAI,OAAO,WAAW,WAAW,UAAU,GAAG;EAE9C,MAAM,QAAQ,MAAM,gCAAgC;GAAE;GAAe,WAAW,OAAO;EAAW,CAAC;EACnG,IAAI,CAAC,OAAO;EAKZ,MAAM,QAAQ,MAAM,IAAI,EAAE,kBAAkB,MAAM,iBAAiB,CAAC;EAIpE,MAAM,eAAe,SAAS,MAAM,KAAK;EAEzC,MAAM,eAAe,eAAe,QAAQ,KAAK,IAAI;EACrD,IAAI,MAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,aAAa,CAAC,GAAG;EAE5D,MAAM,iBAAiB,MAAM,6BAA6B,UAAU,MAAM,gBAAgB;EAC1F,MAAM,sBAAsB,SAAS;GACnC,OAAO,MAAM;GACb,kBAAkB,MAAM;GACxB;GACA;EACF,CAAC;CACH;AACF;;;;;;;AAQA,eAAe,mBAAmB,QAA4B,QAAuB;CAEnF,MAAM,EAAE,YAAa,OAAM,MADP,QAAQ,WAAW,CAAC,EAAE,SAAS,QAAQ,EAAA,EACzB,YAAY;EAC5C,QAAQ,EACN,UAAU;GACR,kBAAkB,OAAO,QAAQ;GACjC,0BAA0B,OAAO;GACjC,2BAA2B,OAAO;EACpC,EACF;EACA,SAAS;CACX,CAAC,KAAM,EAAE,SAAS,CAAC,EAAE;CACrB,OAAO,QAAQ;AACjB;;;;;;;;;;;;AAaA,eAAe,aACb,QACA,SACA,EAAE,cAAc,YAChB,KAGQ;CACR,MAAM,SAAS,MAAM,oBAAoB;EAAE;EAAQ;EAAS;CAAa,CAAC;CAC1E,IAAI,OAAO,WAAW,WAAW,OAAO;CAExC,IAAI,OAAO,WAAW,YAAY,cAAc;EAO9C,IAAI,eAAe,IAAI,QAAQ;GAAE,IAAI,OAAO,KAAK;GAAQ,gBAAgB,OAAO,KAAK;EAAM,CAAC;EAE5F,MAAM,QAAQ,MAAM,sBAAsB;GAAE;GAAQ;GAAS,GAAG;GAAQ;GAAc;EAAS,CAAC;EAChG,IAAI,MAAM,WAAW,WAAW,OAAO;EACvC,IAAI,MAAM,WAAW,YACnB,OAAO,EACL,QAAQ;GACN,MAAM,OAAO;GACb,kBAAkB,MAAM;GACxB,uBAAuB,MAAM;EAC/B,EACF;CAEJ;CACA,OAAO,CAAC;AACV;;;;;;AAOA,SAAgB,kBAAkB,QAAuB,QAAyC;CAChG,OAAO;EACL,eAAe,OAAO,QAAQ;EAC9B,MAAM;EACN,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;EACxC,YAAY,OAAO;CACrB;AACF;;AAGA,eAAe,mBACb,WACA,QACA,QAC6B;CAC7B,MAAM,SAAS,MAAM,UAAU,YAAY,kBAAkB,QAAQ,MAAM,CAAC;CAC5E,IAAI,UAAU,CAAC,QAAQ,OAAO;CAC9B,OAAO,UAAU,YAAY,kBAAkB,MAAM,CAAC;AACxD;;;;;;;;;;;;;;;AAgBA,eAAsB,qBAAqB,EACzC,WACA,QACA,SACA,MACA,kBACA,SACA,OAcgB;CAChB,IAAI;EACF,MAAM,QAAQ,QAAQ,KAAK,SAAS,KAAK,GAAG,QAAQ,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,QAAQ;EAEnF,MAAM,UAAU,OAAO;GACrB,OAAO,KAAK,SAAS;GACrB,QAAQ,KAAK;GACb;GACA,WAAW;GACX,OAAO;IACL,OAAO,SAAS;IAChB,gBAAgB;KAAE,GAAG,kBAAkB,QAAQ,YAAY,OAAO,CAAC;KAAG,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;IAAG;IAC9F,QAAQ,CAAC,SAAS;IAClB,GAAI,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,EAAE,IAAI,CAAC;GACnD;EACF,CAAC;CACH,SAAS,OAAO;EACd,QAAQ,KAAK,gDAAgD,OAAO,IAAI,KAAK;CAC/E;AACF;AAEA,SAAS,4BAA4B,MAAwC;CAC3E,MAAM,EAAE,cAAc;CACtB,OAAO,OAAO,QAAQ,SAAS,gBAAgB,QAAQ;EAMrD,MAAM,OAAO,MAAM,aAAa,QAAQ,SAAS,MAAM,GAAG;EAC1D,IAAI,CAAC,MAAM;EAKX,MAAM,eAAe,CAAE,MAAM,OAAO,aAAa;EAIjD,MAAM,eAAe,QAAQ,OAAO;EAEpC,IAAI,CAAC,cAAc;EAMnB,MAAM,iBAAiB,MAAM,mBAAmB,IAAI,QAAQ,MAAM;EAClE,IAAI,CAAC,gBAAgB;GACnB,QAAQ,KAAK,4CAA4C,OAAO,EAAE;GAClE;EACF;EAUA,MAAM,aAAa,eAAe,WAAW,WAAW,UAAU;EAClE,MAAM,mBAAmB,aAAa,YAAY,mBAAmB,eAAe,UAAU;EAC9F,MAAM,aAAa,KAAK,SACpB,cAAc,mBAAmB,KAAK,OAAO,gBAAgB,EAAE,cAAc,iBAAiB,WAAW,mBAAmB,eAAe,EAAE,MAC7I,YAAY,eAAe;EAY/B,MAAM,qBAAqB,cAAc,CAAC,KAAK;EAC/C,MAAM,WAAW,QAAQ,IAAI,wBACzB,qBACE,GAAG,QAAQ,IAAI,wBAAwB,WAAW,cAAc,mBAAmB,eAAe,UAAU,MAC5G,GAAG,QAAQ,IAAI,wBAAwB,eACzC,KAAA;EAOJ,IAAI,aAAa,KAAK,QAAQ,uBAAuB;GACnD,MAAM,UAAU,aACZ,KAAA,IACA;IAAE,WAAW,eAAe;IAAY,QAAQ,aAAa,OAAO,EAAE;IAAG,UAAU,eAAe;GAAG;GACzG,MAAM,qBAAqB;IACzB;IACA;IACA;IACA,MAAM,KAAK,OAAO;IAClB,kBAAkB,KAAK,OAAO;IAC9B;IACA,KAAK;GACP,CAAC;EACH;EAKA,IAAI,CAAC,UAAU;EAEf,MAAM,OAAO,KACX,KAAK;GACH,OAAO;GACP,UAAU,CAAC,QAAQ,CAAC,WAAW;IAAE,KAAK;IAAU,OAAO;GAAe,CAAC,CAAC,CAAC,CAAC;EAC5E,CAAC,CACH;CACF;AACF;;;;;;;AAQA,eAAe,YACb,QACA,SACA,EAAE,MAAM,WAAW,gBACJ;CACf,IAAI,CAAC,QAAQ,CAAC,WAAW;CACzB,MAAM,OAAO,QAAQ,KAAK,QAAQ,qBAAqB,EAAE,CAAC,CAAC,KAAK;CAChE,IAAI,CAAC,MAAM;CACX,IAAI;EACF,MAAM,SAAS,YAAY,OAAO;EAClC,MAAM,WAAW,MAAM,mBAAmB,WAAW,QAAQ,MAAM;EACnE,IAAI,CAAC,UAAU;EAEf,MAAM,WAAyC;GAC7C,UAAU,OAAO,QAAQ;GACzB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,WAAW,QAAQ;GACnB,QAAQ,QAAQ,OAAO;GACvB,UAAU,QAAQ,OAAO;GACzB,UAAU,QAAQ,OAAO;GACzB,OAAO,QAAQ,OAAO;EACxB;EACA,MAAM,OACJ,gBAAgB,SACZ,MAAM,aAAa,eAAe;GAChC,UAAU,SAAS;GACnB,gBAAgB;GAChB,gBAAgB,SAAS;EAC3B,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,cAAc;GACtC,OAAO,SAAS;GAChB,YAAY,SAAS;GACrB,QAAQ,uBAAuB,UAAU,IAAI;GAC7C;GACA,YAAY,QAAQ,SAAS;GAC7B,gBAAgB,mBAAmB,OAAO,IAAI,QAAQ,IAAI,MAAM;EAClE,CAAC;EACD,IAAI,OAAO,WAAW,WACpB,QAAQ,KAAK,8BAA8B;GAAE,QAAQ,OAAO;GAAI,WAAW,QAAQ;GAAI,QAAQ,OAAO;EAAO,CAAC;CAElH,SAAS,OAAO;EAEd,QAAQ,KAAK,+BAA+B;GAAE,QAAQ,OAAO;GAAI,WAAW,QAAQ;GAAI;EAAM,CAAC;CACjG;AACF;AAEA,MAAa,kBAAkB,SAA4C;CACzE,MAAM,wBAAwB,4BAA4B,IAAI;CAE9D,OAAO;EACL,qBAAqB,OAAO,QAAQ,SAAS,gBAAgB,QAAQ;GAInE,IAAI,YAAY,KAAK,QAAQ,IAAI,GAAG,OAAO,YAAY,QAAQ,SAAS,IAAI;GAM5E,IAAI,CAAC,MADc,aAAa,QAAQ,SAAS,MAAM,GAAG,GAC/C;GACX,MAAM,eAAe,QAAQ,OAAO;EACtC;EACA,WAAW;EACX,iBAAiB;CACnB;AACF;AAUA,SAAgB,0BAA0B,MAA6E;CAGrH,MAAM,UAAU,mBAAmB;EAAE,GAAG,KAAK;EAAO,kBAAkB,EAAE,SAAS,yBAAyB;CAAE,CAAC;CAM7G,OAAO;EACL,UAAU,EAAE,OALZ,KAAK,gBAAgB,cAAc,QAC/B;GAAE;GAAS,GAAG,KAAK;EAAe,IAClC;GAAE;GAAS,GAAG,KAAK;GAAgB,WAAW,KAAK,gBAAgB,aAAa;EAAK,EAGvE;EAClB,UAAU,eAAe,IAAI;EAG7B,mBAAmB,gCAAgC,IAAI;EACvD,iBAAiB;EACjB,gBAAgB,6BAA6B,IAAI;EAGjD,gBAAgB,8BAA8B,IAAI;CACpD;AACF"}
+{"version":3,"file":"slack.js","names":[],"sources":["../../../src/integrations/slack/slack.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type {\n  ChannelHandler,\n  ChannelHandlerContext,\n  ChannelHandlers,\n  ChannelSessionResolve,\n  ChannelSessionStart,\n  ResolveResourceId,\n  ResolveThreadId,\n} from '@mastra/core/channels';\nimport type { Mastra } from '@mastra/core/mastra';\nimport { createSlackAdapter } from '@mastra/slack';\nimport type { SlackAdapterChannelConfig } from '@mastra/slack';\nimport { Card, CardText, Actions, LinkButton } from 'chat';\n\nimport {\n  hydrateFactorySession,\n  resolveFactoryDefaultModelId,\n  resolveFactoryProjectForSession,\n  resolveFactorySourceRepository,\n} from '../../session/factory-session.js';\nimport { readRequestContextOrgId, seedSessionOrg } from '../../session/org-seed.js';\nimport type {\n  ChannelAccountLink,\n  ChannelAccountLinkKey,\n  ChannelIdentityStorage,\n} from '../../storage/domains/channel-identity/base.js';\nimport type { FactoryActorExternalIdentity } from '../../storage/domains/comments/actor.js';\nimport { actorFromChannelAuthor } from '../../storage/domains/comments/actor.js';\nimport type { CommentsDomain } from '../../storage/domains/comments/domain.js';\nimport type { MemorySettingsStorage } from '../../storage/domains/memory-settings/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';\nimport type { ExternalWorkItemSource, WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { FactoryChannelsConfig } from '../base.js';\n\nimport { resolveEmojiShortcodes } from './emoji.js';\nimport { slackCommentSource } from './feed-publisher.js';\n\n// Derive the thread/message types from the core handler signature rather than\n// importing them from `chat` directly: mc-web can resolve a different `chat`\n// version than @mastra/core, and the two `Thread`/`Message` declarations are\n// structurally incompatible (private fields). Using the handler's own types\n// keeps everything on one version.\ntype HandlerThread = Parameters<ChannelHandler>[0];\ntype HandlerMessage = Parameters<ChannelHandler>[1];\n\nconst SLACK_REQUEST_TIMEOUT_MS = 15_000;\nconst MAX_WORK_ITEM_TITLE_CHARS = 80;\nconst graphemes = new Intl.Segmenter(undefined, { granularity: 'grapheme' });\n\n/**\n * A card is titled with what the sender wrote. Cutting counts graphemes, not\n * code points: `👍🏼` is a base plus a skin-tone modifier, and a cut between\n * them leaves the wrong emoji.\n */\nfunction workItemTitleFrom(messageText: string): string {\n  const resolved = resolveEmojiShortcodes(messageText);\n  const characters = [...graphemes.segment(resolved)].map(({ segment }) => segment);\n  if (characters.length <= MAX_WORK_ITEM_TITLE_CHARS) return resolved;\n  return `${characters.slice(0, MAX_WORK_ITEM_TITLE_CHARS - 1).join('')}…`;\n}\n\n/** Dependencies the Slack channel handlers close over, injected from the web entry. */\ninterface SlackChannelDeps {\n  /**\n   * The factory's reverse-index store mapping a Slack sender to a Mastra\n   * tenant. When provided, inbound messages from an unlinked sender are not\n   * dispatched — the run only proceeds (with the sender's tenant stamped on\n   * the request context) once they've linked their account. Unlinked senders\n   * get an ephemeral \"connect your account\" card instead.\n   */\n  accountLinks?: ChannelIdentityStorage;\n  /**\n   * Factory projects domain. When provided (alongside `accountLinks`), a\n   * linked sender's run must also resolve to a Factory project before it\n   * dispatches: their link's default factory, else their tenant's only\n   * factory (stamped back onto the link), else an ephemeral \"pick a default\n   * factory\" card and no run. Unset → no factory routing (runs dispatch as\n   * before).\n   */\n  projects?: FactoryProjectsStorage;\n  /**\n   * Storage handle of the integration that owns source control\n   * (`IntegrationContext.storage.sourceControlOwner`). Used to make new Slack\n   * threads repo-backed: when the sender is linked and their factory has a\n   * repository, the thread's resourceId becomes a Factory user-session id (repo\n   * cloned on a `slack/{threadTs}` branch) instead of the chat-only\n   * `channel:...` id. It also lets a started session read back the project it\n   * belongs to. Nothing here is provider-specific — the connection is matched\n   * by the handle's own `integrationId`. Absent (no source-control integration\n   * registered) → chat-only sessions as before.\n   */\n  sourceControl?: SourceControlStorageHandle;\n  /**\n   * Observational-memory settings domain. When provided, a repo-backed session\n   * adopts its factory project's shared memory settings on start, matching the\n   * web kickoff.\n   */\n  memorySettings?: MemorySettingsStorage;\n  /**\n   * Factory work-items domain. When provided, a dispatched new-session thread\n   * (DM or mention) upserts a Work-board card in Building (`execute`) carrying\n   * the Slack thread as its external source and binding the repo-backed\n   * session. Best-effort — a failure never blocks the run. Unset → no card.\n   */\n  workItems?: WorkItemsStorage;\n  /**\n   * Work-item feed. With it (and `workItems`), an `aside` lands as a comment on\n   * the card the thread created. Unset → asides stay ignored, as before.\n   */\n  feed?: Pick<CommentsDomain, 'createComment'>;\n  /** Overrides applied to the Slack channel adapter entry. */\n  adapterOptions?: SlackAdapterChannelConfig;\n}\n\n/**\n * Read the Slack team id off a raw platform payload (Events API envelope or\n * slash-command body — both carry `team_id`), duck-typed to build the\n * workspace-scoped account-link key.\n */\nfunction rawTeamId(rawPayload: unknown): string | undefined {\n  if (!rawPayload || typeof rawPayload !== 'object') return undefined;\n  const raw = rawPayload as { team_id?: unknown; team?: unknown };\n  if (typeof raw.team_id === 'string' && raw.team_id) return raw.team_id;\n  if (typeof raw.team === 'string' && raw.team) return raw.team;\n  if (raw.team && typeof raw.team === 'object') {\n    const id = (raw.team as { id?: unknown }).id;\n    if (typeof id === 'string' && id) return id;\n  }\n  return undefined;\n}\n\n/**\n * The Slack team id survives onto a normalized chat Message only on\n * `message.raw` (the Slack Events API envelope).\n */\nfunction slackTeamId(message: HandlerMessage): string | undefined {\n  return rawTeamId(message.raw);\n}\n\n/**\n * Resolve the web-UI origin for links humans open in a browser (Connect card,\n * session deep links). Prefers `MASTRACODE_PUBLIC_URL` — the origin auth\n * cookies and OAuth redirect allow-lists are registered against — over the\n * channels tunnel, which only Slack's servers need to reach.\n */\nfunction webPublicUrl(): string | undefined {\n  return process.env.MASTRACODE_PUBLIC_URL ?? process.env.MASTRACODE_CHANNELS_PUBLIC_URL;\n}\n\n/** Outcome of the sender-link gate for one inbound message. */\ntype LinkedSenderResult =\n  /** Gating not configured — dispatch as before account linking existed. */\n  | { status: 'ungated' }\n  /** Sender unlinked — Connect card posted (when possible), do not dispatch. */\n  | { status: 'blocked' }\n  /** Sender linked — their tenant plus the sender key the link lives under. */\n  | { status: 'linked'; link: ChannelAccountLink; key: ChannelAccountLinkKey };\n\n/**\n * Resolve the sender's account link, posting an ephemeral \"connect your\n * account\" card (visible only to the sender) linking into the web UI's\n * Slack-connect flow when they're unlinked.\n */\nexport async function resolveLinkedSender({\n  thread,\n  message,\n  accountLinks,\n}: {\n  thread: HandlerThread;\n  message: HandlerMessage;\n  accountLinks?: ChannelIdentityStorage;\n}): Promise<LinkedSenderResult> {\n  if (!accountLinks) return { status: 'ungated' };\n  const platform = thread.adapter.name;\n  const externalUserId = message.author.userId;\n  const externalTeamId = slackTeamId(message);\n  // Without a team id we can't identify the workspace-scoped link; treat as\n  // unlinked so a run never proceeds tenant-less.\n  const key = externalTeamId ? { platform, externalTeamId, externalUserId } : undefined;\n  const link = key ? await accountLinks.getAccountLink(key) : null;\n  if (link && key) return { status: 'linked', link, key };\n\n  const publicUrl = webPublicUrl();\n  // A public origin is all the card needs. The link carries no identity: the\n  // web app authenticates the visitor, then Slack's OIDC flow proves which\n  // Slack account they control. Without an origin, still block, just no card.\n  if (publicUrl) {\n    await thread.postEphemeral(message.author, buildConnectCard(publicUrl), { fallbackToDM: true });\n  }\n  return { status: 'blocked' };\n}\n\n/**\n * The \"connect your account\" card. The link is deliberately identity-free —\n * `/connect/slack` sends the visitor to Connections, where \"Connect Slack\"\n * runs the OIDC flow and Slack itself asserts the (team, user) pair.\n */\nfunction buildConnectCard(publicUrl: string) {\n  return Card({\n    title: 'Connect your account',\n    children: [\n      CardText('Connect your account to use this agent.'),\n      Actions([\n        LinkButton({\n          url: `${publicUrl}/connect/slack`,\n          label: 'Connect account',\n        }),\n      ]),\n    ],\n  });\n}\n\n/** Outcome of factory routing for one linked sender's inbound message. */\ntype FactoryRouteResult =\n  /** Factory routing not configured — dispatch without a factory. */\n  | { status: 'ungated' }\n  /** No factory resolved — prompt card posted (when possible), do not dispatch. */\n  | { status: 'blocked' }\n  /** The Factory project this sender's runs route to. */\n  | { status: 'resolved'; factoryProjectId: string; slackWorkItemsEnabled: boolean };\n\n/**\n * Decide which Factory project a linked sender's run belongs to:\n *\n * 1. The link's `defaultFactoryProjectId`, when it still exists (a stale id —\n *    deleted factory — falls through as if unset).\n * 2. Else, the tenant's only factory, stamped back onto the link so it shows\n *    up (and stays editable) in Connected Accounts settings.\n * 3. Else — zero or several factories — an ephemeral \"pick a default factory\"\n *    card deep-linking to settings, and the run is blocked.\n */\nexport async function resolveFactoryForLink({\n  thread,\n  message,\n  link,\n  key,\n  accountLinks,\n  projects,\n}: {\n  thread: HandlerThread;\n  message: HandlerMessage;\n  link: ChannelAccountLink;\n  key: ChannelAccountLinkKey;\n  accountLinks: ChannelIdentityStorage;\n  projects?: FactoryProjectsStorage;\n}): Promise<FactoryRouteResult> {\n  if (!projects) return { status: 'ungated' };\n  // Factories are org-scoped; a personal account (no org) has none and lands\n  // on the prompt below.\n  const orgId = link.orgId ?? '';\n\n  if (link.defaultFactoryProjectId) {\n    const existing = await projects.get({ orgId, id: link.defaultFactoryProjectId });\n    if (existing) {\n      return {\n        status: 'resolved',\n        factoryProjectId: existing.id,\n        slackWorkItemsEnabled: existing.slackWorkItemsEnabled,\n      };\n    }\n  }\n\n  const factories = orgId ? await projects.list({ orgId }) : [];\n  if (factories.length === 1) {\n    const only = factories[0]!;\n    await accountLinks.setDefaultFactory({ ...key, userId: link.userId, factoryProjectId: only.id });\n    return {\n      status: 'resolved',\n      factoryProjectId: only.id,\n      slackWorkItemsEnabled: only.slackWorkItemsEnabled,\n    };\n  }\n\n  const publicUrl = webPublicUrl();\n  if (publicUrl) {\n    await thread.postEphemeral(\n      message.author,\n      Card({\n        title: 'Pick a default factory',\n        children: [\n          CardText(\n            factories.length === 0\n              ? 'Your account has no factory yet. Create one in the web app, then message me again.'\n              : 'Your account has several factories. Pick which one Slack sessions should go to, then message me again.',\n          ),\n          Actions([\n            LinkButton({\n              url: `${publicUrl}/settings/connections`,\n              label: 'Open settings',\n            }),\n          ]),\n        ],\n      }),\n      { fallbackToDM: true },\n    );\n  }\n  return { status: 'blocked' };\n}\n\n/**\n * Deterministic per-thread branch name: `slack/{threadTs}` with characters\n * outside the sandbox git-ref allow-list (`[A-Za-z0-9_./-]`, and `.` for\n * readability) mapped to `-`. `thread.id` is `{channelId}:{threadTs}`\n * (platform-prefixed on handler threads) — the trailing segment is the ts.\n *\n * Top-level DM and channel conversations use the empty-threadTs thread form,\n * so the trailing segment can be empty; a bare `slack/` is not a valid git\n * ref. Fall back to the last non-empty segment (the channel id): one\n * deterministic branch per top-level conversation.\n */\nfunction threadBranch(threadId: string): string {\n  const segments = threadId.split(':');\n  const tail = segments.findLast(segment => segment.length > 0) ?? threadId;\n  return `slack/${tail.replace(/[^A-Za-z0-9_/-]/g, '-')}`;\n}\n\n/**\n * Resolve the resourceId for a NEW Slack channel thread. A linked sender whose\n * factory has a repository gets a Factory user-session id — the controller\n * session then materializes the repo sandbox via the factory's dynamic\n * workspace (clone + PAT), the session shows up in the web Sessions list, and\n * View Session deep-links land on the normal workspace route. Everything else\n * (unlinked, unrouted, repo-less, or no source control) keeps the chat-only\n * `defaultResourceId`.\n *\n * Pure lookups only — cards for unlinked/unrouted senders are the dispatch\n * gate's job; this hook must never post.\n */\nexport function createChannelResourceIdResolver(deps: SlackChannelDeps): ResolveResourceId {\n  const { accountLinks, projects, sourceControl } = deps;\n  return async ({ platform, thread, message }) => {\n    // NOT the hook's `defaultResourceId`: configuring a custom resolver\n    // bypasses AgentControllerChannels' own `channel:{thread.id}` derivation\n    // (agent-controller-channels.ts `resolveChannelResourceId`), and the base\n    // default is the per-USER memory key. Chat-only fallbacks must stay\n    // per-thread, so reproduce the controller default here.\n    const chatOnlyResourceId = `channel:${thread.id}`;\n    if (!accountLinks || !projects || !sourceControl) return chatOnlyResourceId;\n    try {\n      const externalTeamId = rawTeamId(message.raw);\n      if (!externalTeamId) return chatOnlyResourceId;\n      const link = await accountLinks.getAccountLink({\n        platform,\n        externalTeamId,\n        externalUserId: message.author.userId,\n      });\n      if (!link) return chatOnlyResourceId;\n\n      // Same chain as `resolveFactoryForLink`, minus prompts/stamping: the\n      // dispatch gate has already run (and stamped a lone factory) by the\n      // time a new thread is created, so this is a read-only re-resolve.\n      const orgId = link.orgId ?? '';\n      let factoryProjectId: string | undefined;\n      if (link.defaultFactoryProjectId && (await projects.get({ orgId, id: link.defaultFactoryProjectId }))) {\n        factoryProjectId = link.defaultFactoryProjectId;\n      } else if (orgId) {\n        const factories = await projects.list({ orgId });\n        if (factories.length === 1) factoryProjectId = factories[0]!.id;\n      }\n      if (!factoryProjectId) return chatOnlyResourceId;\n\n      const repo = await resolveFactorySourceRepository({ sourceControl, orgId, factoryProjectId });\n      if (!repo.found) return chatOnlyResourceId;\n\n      const branch = threadBranch(thread.id);\n      // Attributed to the Slack sender, not to whoever connected the repository:\n      // unlike an autonomous rule run, a Slack thread has a real interactive user.\n      const existing = await sourceControl.sessions.getForBranch({\n        projectRepositoryId: repo.projectRepositoryId,\n        userId: link.userId,\n        branch,\n      });\n      if (existing) return existing.sessionId;\n      const session = await sourceControl.sessions.create({\n        sessionId: randomUUID(),\n        projectRepositoryId: repo.projectRepositoryId,\n        orgId,\n        userId: link.userId,\n        branch,\n        baseBranch: repo.baseBranch,\n        // DMs are the only private origin; channel threads are org-visible.\n        visibility: thread.isDM ? 'private' : 'org',\n      });\n      return session.sessionId;\n    } catch (error) {\n      // Fall back to a chat-only session rather than dropping the message.\n      console.warn('[slack] repo-backed session resolution failed for thread', thread.id, error);\n      return chatOnlyResourceId;\n    }\n  };\n}\n\n/**\n * Thread id for a NEW Slack channel thread. Repo-backed threads take the\n * user-session id AS their thread id, matching the web convention\n * (FactoryStartCoordinator seeds threads with threadId = sessionId) so\n * `/workspaces/{sessionId}/threads/{sessionId}` resolves Slack-created\n * sessions exactly like web-created ones — no `?resourceId=` override needed.\n * Chat-only threads keep the default random id: their `channel:...`\n * resourceId is a memory key, not a unique thread id.\n */\nexport const resolveChannelThreadId: ResolveThreadId = ({ resourceId, defaultThreadId }) =>\n  resourceId.startsWith('channel:') ? defaultThreadId : resourceId;\n\n/** Create channel sessions with their Factory ownership present in initial controller state. */\nexport function createChannelSessionResolver(deps: SlackChannelDeps): ChannelSessionResolve {\n  const { sourceControl } = deps;\n  return async ({ controller, thread, requestContext }) => {\n    const owner =\n      sourceControl && !thread.resourceId.startsWith('channel:')\n        ? await resolveFactoryProjectForSession({ sourceControl, sessionId: thread.resourceId })\n        : null;\n    return controller.createSession({\n      id: thread.resourceId,\n      ownerId: controller.id,\n      resourceId: thread.resourceId,\n      requestContext,\n      ...(owner ? { tags: { factoryProjectId: owner.factoryProjectId } } : {}),\n    });\n  };\n}\n\n/**\n * Apply the factory's configuration to a Slack-created session the first time\n * its thread reaches the controller.\n *\n * Without this a Slack session runs on the SDK's built-in mode default\n * (`openai/gpt-5.5`), so a factory configured for any other provider fails every\n * message with a missing-credentials error. The web kickoff has always applied\n * the factory default; this brings Slack to the same footing.\n *\n * Only repo-backed threads are configured. Their resourceId IS the Factory\n * session id, which the source-control rows turn back into a project — a\n * chat-only `channel:...` id names no project, so there is nothing to read.\n *\n * Skips a session whose mode already has a model persisted on the thread. That\n * is the durable record of a deliberate choice — either an earlier start or a\n * user's own switch — and re-applying the factory default over it would undo\n * the user's selection every time the process restarts.\n */\nexport function createChannelSessionStartHook(deps: SlackChannelDeps): ChannelSessionStart {\n  const { projects, sourceControl, memorySettings } = deps;\n  return async ({ session, thread, requestContext }) => {\n    // Seed the tenant org above every guard below. `gateDispatch` stamps it on\n    // the message's request context before the session exists, so this needs no\n    // storage read — which matters, because the guards below deliberately skip\n    // storage on a restarted session. A channel-only thread and a thread whose\n    // dispatch was ungated both land here with no org and are marked unresolved\n    // rather than being left to look like a local session.\n    await seedSessionOrg(session, readRequestContextOrgId(requestContext));\n\n    if (!projects || !sourceControl) return;\n    if (thread.resourceId.startsWith('channel:')) return;\n\n    const owner = await resolveFactoryProjectForSession({ sourceControl, sessionId: thread.resourceId });\n    if (!owner) return;\n\n    // Repo-backed Slack sessions are factory sessions: stamp the owning\n    // project onto controller state so downstream reads (org-first credential\n    // resolution, authority gates) recognize them, same as board runs.\n    await session.state.set({ factoryProjectId: owner.factoryProjectId });\n    // Route the org through the seed helper rather than stamping it directly:\n    // an ungated dispatch marked this session unresolved above, and owner\n    // recovery is the resolution that has to clear that marker with it.\n    await seedSessionOrg(session, owner.orgId);\n\n    const modeModelKey = `modeModelId_${session.mode.get()}`;\n    if (await session.thread.getSetting({ key: modeModelKey })) return;\n\n    const defaultModelId = await resolveFactoryDefaultModelId(projects, owner.factoryProjectId);\n    await hydrateFactorySession(session, {\n      orgId: owner.orgId,\n      factoryProjectId: owner.factoryProjectId,\n      defaultModelId,\n      memorySettings,\n    });\n  };\n}\n\n/**\n * The internal Mastra thread the framework created for a channel conversation.\n * The handler's `thread.id` is the platform thread id (e.g. `slack:C123:ts`),\n * NOT the internal UUID — the mapping lives in the stored thread's channel\n * metadata.\n */\nasync function findInternalThread(mastra: Mastra | undefined, thread: HandlerThread) {\n  const store = await mastra?.getStorage()?.getStore('memory');\n  const { threads } = (await store?.listThreads({\n    filter: {\n      metadata: {\n        channel_platform: thread.adapter.name,\n        channel_externalThreadId: thread.id,\n        channel_externalChannelId: thread.channelId,\n      },\n    },\n    perPage: 1,\n  })) ?? { threads: [] };\n  return threads[0];\n}\n\n/**\n * Build the \"new session\" handler for mention / direct-message events. A mention or\n * DM on a not-yet-subscribed thread starts a NEW session; once subscribed, later\n * events are follow-ups and don't re-announce.\n */\n/**\n * Run the account-link + factory-routing gates for one inbound message.\n * Returns `null` when the run must not dispatch (a prompt card was posted\n * where possible); otherwise the dispatch context — with `routed` present\n * only when a linked sender resolved to a factory.\n */\nasync function gateDispatch(\n  thread: HandlerThread,\n  message: HandlerMessage,\n  { accountLinks, projects }: SlackChannelDeps,\n  ctx: ChannelHandlerContext,\n): Promise<{\n  routed?: { link: ChannelAccountLink; factoryProjectId: string; slackWorkItemsEnabled: boolean };\n} | null> {\n  const sender = await resolveLinkedSender({ thread, message, accountLinks });\n  if (sender.status === 'blocked') return null;\n  // Linked senders must also route to a Factory project before a run starts.\n  if (sender.status === 'linked' && accountLinks) {\n    // Stamp the tenant on the run's request context — the single seam\n    // `resolveCredentialStore` reads to load this sender's model credentials.\n    // This belongs to the link, not to the routing: a linked sender whose\n    // factory routing comes back `ungated` still exits below and dispatches, so\n    // stamping only in the routed branch would silently run them on default\n    // credentials.\n    ctx.requestContext.set('user', { id: sender.link.userId, organizationId: sender.link.orgId });\n\n    const route = await resolveFactoryForLink({ thread, message, ...sender, accountLinks, projects });\n    if (route.status === 'blocked') return null;\n    if (route.status === 'resolved') {\n      return {\n        routed: {\n          link: sender.link,\n          factoryProjectId: route.factoryProjectId,\n          slackWorkItemsEnabled: route.slackWorkItemsEnabled,\n        },\n      };\n    }\n  }\n  return {};\n}\n\n/**\n * A channel id and a `ts` name a thread only inside the workspace that issued\n * them, so the team scopes the card's key — without it two workspaces could\n * hold one key and an aside would land on another tenant's card.\n */\nexport function slackThreadSource(thread: HandlerThread, teamId?: string): ExternalWorkItemSource {\n  return {\n    integrationId: thread.adapter.name,\n    type: 'slack-thread',\n    ...(teamId ? { workspaceId: teamId } : {}),\n    externalId: thread.id,\n  };\n}\n\n/** Cards written before the key carried a team are still keyed bare. */\nasync function findThreadWorkItem(\n  workItems: WorkItemsStorage,\n  thread: HandlerThread,\n  teamId?: string,\n): Promise<WorkItemRow | null> {\n  const scoped = await workItems.getBySource(slackThreadSource(thread, teamId));\n  if (scoped || !teamId) return scoped;\n  return workItems.getBySource(slackThreadSource(thread));\n}\n\n/**\n * Upsert the Work-board card for a dispatched Slack-thread run. Keyed on the\n * thread via `externalSource` — the work-items domain's unique\n * `(factory_project_id, source_key)` index makes repeat messages reuse the\n * same card, and `reuseMode: 'preserve'` keeps a card a human already dragged\n * across stages untouched. The card lands in Building (`execute`) for every\n * dispatched thread (DM or mention) — there is deliberately no per-origin\n * stage split; smart routing is a follow-up.\n *\n * The session id / branch / threadId and the workspace deep-link are resolved\n * by the caller (which already looked up the internal thread), so this helper\n * just shapes and writes. Best-effort: the run is already dispatched, so a\n * failure logs instead of throwing — work-item creation must never abort a Slack run.\n */\nexport async function upsertThreadWorkItem({\n  workItems,\n  thread,\n  message,\n  link,\n  factoryProjectId,\n  session,\n  url,\n}: {\n  workItems: WorkItemsStorage;\n  thread: HandlerThread;\n  message: HandlerMessage;\n  link: ChannelAccountLink;\n  factoryProjectId: string;\n  /**\n   * The repo-backed Factory session to bind under the `chat` role, or\n   * `undefined` for a chat-only thread (no Factory session to bind).\n   */\n  session?: { sessionId: string; branch: string; threadId: string };\n  /** Workspace deep-link to the running session; omitted when no public URL. */\n  url?: string;\n}): Promise<void> {\n  try {\n    const title = workItemTitleFrom(message.text);\n\n    await workItems.upsert({\n      orgId: link.orgId ?? '',\n      userId: link.userId,\n      factoryProjectId,\n      reuseMode: 'preserve',\n      input: {\n        title: title || 'Slack thread',\n        externalSource: { ...slackThreadSource(thread, slackTeamId(message)), ...(url ? { url } : {}) },\n        stages: ['execute'],\n        ...(session ? { sessions: { chat: session } } : {}),\n      },\n    });\n  } catch (error) {\n    console.warn('[slack] work-item creation failed for thread', thread.id, error);\n  }\n}\n\nfunction createNewSessionChatHandler(deps: SlackChannelDeps): ChannelHandler {\n  const { workItems } = deps;\n  return async (thread, message, defaultHandler, ctx) => {\n    // Gate on the sender having linked their Slack account to a Mastra tenant.\n    // Unlinked → post the ephemeral Connect card and stop; no session/run is\n    // created (which would otherwise be tenant-less and fail credential\n    // resolution). This handler is the only gate — core dispatches whatever\n    // reaches it — so every slot that can start a run must call it.\n    const gate = await gateDispatch(thread, message, deps, ctx);\n    if (!gate) return;\n\n    // A mention on a not-yet-subscribed thread is a NEW session. The\n    // default handler auto-subscribes, so once subscribed this is a\n    // follow-up mention — don't re-announce.\n    const isNewSession = !(await thread.isSubscribed());\n\n    // Run the framework handler first so the internal Mastra thread and\n    // controller session are created before we build the deep link.\n    await defaultHandler(thread, message);\n\n    if (!isNewSession) return;\n\n    // The internal-thread lookup and deep-link are needed by BOTH the\n    // announcement card AND work-item creation, so they run BEFORE the\n    // card-only `MASTRACODE_PUBLIC_URL` gate — a deployment without a public\n    // origin should still create board cards, just without a clickable link.\n    const internalThread = await findInternalThread(ctx.mastra, thread);\n    if (!internalThread) {\n      console.warn('[onMention] no internal thread found for', thread.id);\n      return;\n    }\n\n    // When the sender routed to a factory we know exactly which workspace the\n    // session belongs to — deep-link straight into it. A repo-backed thread's\n    // resourceId IS the Factory user-session id, so the link lands on the same\n    // route a web-started run navigates to; chat-only threads keep the literal\n    // `channel` segment (the real resource rides the `?resourceId=` override).\n    // Unrouted senders fall back to the factory-agnostic /threads/ redirect.\n    // One predicate drives both the path segment and the query param, so the\n    // two can never disagree about what the URL already carries.\n    const isChatOnly = internalThread.resourceId.startsWith('channel:');\n    const workspaceSegment = isChatOnly ? 'channel' : encodeURIComponent(internalThread.resourceId);\n    const threadPath = gate.routed\n      ? `/factories/${encodeURIComponent(gate.routed.factoryProjectId)}/workspaces/${workspaceSegment}/threads/${encodeURIComponent(internalThread.id)}`\n      : `/threads/${internalThread.id}`;\n\n    // The param is an override for a URL that can't otherwise name its\n    // resource. A routed repo-backed thread already spells the resourceId out\n    // as its workspace segment, so appending it again is duplication the app\n    // ignores. Chat-only threads need it (their segment is the literal string\n    // `channel`), and so does the unrouted fallback, which has no workspace\n    // segment at all — `ChannelThreadRedirect` forwards the search through.\n    //\n    // One shared deep-link: the card's button and the work-item `url` read the\n    // SAME value so they can never drift. Undefined without a public origin —\n    // the card is then skipped, but the work item is still created (url omitted).\n    const needsResourceParam = isChatOnly || !gate.routed;\n    const deepLink = process.env.MASTRACODE_PUBLIC_URL\n      ? needsResourceParam\n        ? `${process.env.MASTRACODE_PUBLIC_URL}${threadPath}?resourceId=${encodeURIComponent(internalThread.resourceId)}`\n        : `${process.env.MASTRACODE_PUBLIC_URL}${threadPath}`\n      : undefined;\n\n    // A dispatched, routed new-session thread becomes a Work-board card in\n    // Building. Only routed senders (linked → factory) have the org/user/factory\n    // a work item needs. Bind the repo-backed Factory session under the `chat`\n    // role; a chat-only `channel:` resourceId is NOT a session id, so bind\n    // nothing rather than a bad id. Best-effort (the helper swallows failures).\n    if (workItems && gate.routed?.slackWorkItemsEnabled) {\n      const session = isChatOnly\n        ? undefined\n        : { sessionId: internalThread.resourceId, branch: threadBranch(thread.id), threadId: internalThread.id };\n      await upsertThreadWorkItem({\n        workItems,\n        thread,\n        message,\n        link: gate.routed.link,\n        factoryProjectId: gate.routed.factoryProjectId,\n        session,\n        url: deepLink,\n      });\n    }\n\n    // The announcement card is only useful with a public origin to deep-link\n    // to — otherwise the link would be `undefined/threads/...`. Without one the\n    // session (and now the work item) still exist; we just skip the broken card.\n    if (!deepLink) return;\n\n    await thread.post(\n      Card({\n        title: 'New session started',\n        children: [Actions([LinkButton({ url: deepLink, label: 'View session' })])],\n      }),\n    );\n  };\n}\n\n/**\n * An `aside` never reaches the agent, but it is still part of the conversation:\n * record it on the card the thread created. The link is resolved here rather\n * than through `gateDispatch`, which posts a Connect card an aside must not\n * trigger. Best-effort — nothing here may surface in the Slack thread.\n */\nasync function ingestAside(\n  thread: HandlerThread,\n  message: HandlerMessage,\n  { feed, workItems, accountLinks }: SlackChannelDeps,\n): Promise<void> {\n  if (!feed || !workItems) return;\n  const body = resolveEmojiShortcodes(message.text.replace(/^aside\\b[,:]?\\s*/i, '').trim());\n  if (!body) return;\n  try {\n    const teamId = slackTeamId(message);\n    const workItem = await findThreadWorkItem(workItems, thread, teamId);\n    if (!workItem) return;\n\n    const external: FactoryActorExternalIdentity = {\n      platform: thread.adapter.name,\n      ...(teamId ? { teamId } : {}),\n      messageId: message.id,\n      userId: message.author.userId,\n      userName: message.author.userName,\n      fullName: message.author.fullName,\n      isBot: message.author.isBot,\n    };\n    const link =\n      accountLinks && teamId\n        ? await accountLinks.getAccountLink({\n            platform: external.platform,\n            externalTeamId: teamId,\n            externalUserId: external.userId,\n          })\n        : null;\n\n    const result = await feed.createComment({\n      orgId: workItem.orgId,\n      workItemId: workItem.id,\n      author: actorFromChannelAuthor(external, link),\n      body,\n      occurredAt: message.metadata.dateSent,\n      externalSource: slackCommentSource(thread.id, message.id, teamId),\n    });\n    if (result.status !== 'created') {\n      console.warn('[slack] aside not ingested', { thread: thread.id, messageTs: message.id, status: result.status });\n    }\n  } catch (error) {\n    // Slack was acked before this handler ran, so a lost aside is never redelivered.\n    console.warn('[slack] aside ingest failed', { thread: thread.id, messageTs: message.id, error });\n  }\n}\n\nexport const createHandlers = (deps: SlackChannelDeps): ChannelHandlers => {\n  const newSessionChatHandler = createNewSessionChatHandler(deps);\n\n  return {\n    onSubscribedMessage: async (thread, message, defaultHandler, ctx) => {\n      // `aside` as its own leading word lets humans talk in a subscribed\n      // thread without the bot replying. Word boundary so messages that\n      // merely start with \"aside...\" (e.g. \"asides can wait\") still route.\n      if (/^aside\\b/i.test(message.text)) return ingestAside(thread, message, deps);\n      // A subscribed follow-up from an unlinked sender must not run either\n      // (e.g. the link was removed mid-conversation), and it must still\n      // resolve a factory (e.g. the default was cleared or its factory\n      // deleted mid-conversation).\n      const gate = await gateDispatch(thread, message, deps, ctx);\n      if (!gate) return;\n      await defaultHandler(thread, message);\n    },\n    onMention: newSessionChatHandler,\n    onDirectMessage: newSessionChatHandler,\n  };\n};\n\n/** Slack app credentials, passed in explicitly rather than read from env here. */\ninterface SlackCredentials {\n  clientId?: string;\n  clientSecret?: string;\n  signingSecret: string;\n  botToken?: string;\n}\n\nexport function createSlackChannelsConfig(deps: SlackChannelDeps & { slack: SlackCredentials }): FactoryChannelsConfig {\n  // Per HTTP attempt, not per call: the WebClient's own retry policy still\n  // waits out a 429. Without it a dead socket hangs a post forever.\n  const adapter = createSlackAdapter({ ...deps.slack, webClientOptions: { timeout: SLACK_REQUEST_TIMEOUT_MS } });\n  const slack =\n    deps.adapterOptions?.streaming === false\n      ? { adapter, ...deps.adapterOptions }\n      : { adapter, ...deps.adapterOptions, streaming: deps.adapterOptions?.streaming ?? true };\n\n  return {\n    adapters: { slack },\n    handlers: createHandlers(deps),\n    // New linked+repo-backed threads own a Factory user-session id as their\n    // resourceId, which is what makes the controller session repo-backed.\n    resolveResourceId: createChannelResourceIdResolver(deps),\n    resolveThreadId: resolveChannelThreadId,\n    resolveSession: createChannelSessionResolver(deps),\n    // Those sessions are created by the channel machinery, not the web kickoff,\n    // so this is where they pick up the factory's configuration.\n    onSessionStart: createChannelSessionStartHook(deps),\n  };\n}\n"],"mappings":";;;;;;;;;AAgDA,MAAM,2BAA2B;AACjC,MAAM,4BAA4B;AAClC,MAAM,YAAY,IAAI,KAAK,UAAU,KAAA,GAAW,EAAE,aAAa,WAAW,CAAC;;;;;;AAO3E,SAAS,kBAAkB,aAA6B;CACtD,MAAM,WAAW,uBAAuB,WAAW;CACnD,MAAM,aAAa,CAAC,GAAG,UAAU,QAAQ,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,OAAO;CAChF,IAAI,WAAW,UAAU,2BAA2B,OAAO;CAC3D,OAAO,GAAG,WAAW,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;AACxE;;;;;;AA4DA,SAAS,UAAU,YAAyC;CAC1D,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO,KAAA;CAC1D,MAAM,MAAM;CACZ,IAAI,OAAO,IAAI,YAAY,YAAY,IAAI,SAAS,OAAO,IAAI;CAC/D,IAAI,OAAO,IAAI,SAAS,YAAY,IAAI,MAAM,OAAO,IAAI;CACzD,IAAI,IAAI,QAAQ,OAAO,IAAI,SAAS,UAAU;EAC5C,MAAM,KAAM,IAAI,KAA0B;EAC1C,IAAI,OAAO,OAAO,YAAY,IAAI,OAAO;CAC3C;AAEF;;;;;AAMA,SAAS,YAAY,SAA6C;CAChE,OAAO,UAAU,QAAQ,GAAG;AAC9B;;;;;;;AAQA,SAAS,eAAmC;CAC1C,OAAO,QAAQ,IAAI,yBAAyB,QAAQ,IAAI;AAC1D;;;;;;AAgBA,eAAsB,oBAAoB,EACxC,QACA,SACA,gBAK8B;CAC9B,IAAI,CAAC,cAAc,OAAO,EAAE,QAAQ,UAAU;CAC9C,MAAM,WAAW,OAAO,QAAQ;CAChC,MAAM,iBAAiB,QAAQ,OAAO;CACtC,MAAM,iBAAiB,YAAY,OAAO;CAG1C,MAAM,MAAM,iBAAiB;EAAE;EAAU;EAAgB;CAAe,IAAI,KAAA;CAC5E,MAAM,OAAO,MAAM,MAAM,aAAa,eAAe,GAAG,IAAI;CAC5D,IAAI,QAAQ,KAAK,OAAO;EAAE,QAAQ;EAAU;EAAM;CAAI;CAEtD,MAAM,YAAY,aAAa;CAI/B,IAAI,WACF,MAAM,OAAO,cAAc,QAAQ,QAAQ,iBAAiB,SAAS,GAAG,EAAE,cAAc,KAAK,CAAC;CAEhG,OAAO,EAAE,QAAQ,UAAU;AAC7B;;;;;;AAOA,SAAS,iBAAiB,WAAmB;CAC3C,OAAO,KAAK;EACV,OAAO;EACP,UAAU,CACR,SAAS,yCAAyC,GAClD,QAAQ,CACN,WAAW;GACT,KAAK,GAAG,UAAU;GAClB,OAAO;EACT,CAAC,CACH,CAAC,CACH;CACF,CAAC;AACH;;;;;;;;;;;AAqBA,eAAsB,sBAAsB,EAC1C,QACA,SACA,MACA,KACA,cACA,YAQ8B;CAC9B,IAAI,CAAC,UAAU,OAAO,EAAE,QAAQ,UAAU;CAG1C,MAAM,QAAQ,KAAK,SAAS;CAE5B,IAAI,KAAK,yBAAyB;EAChC,MAAM,WAAW,MAAM,SAAS,IAAI;GAAE;GAAO,IAAI,KAAK;EAAwB,CAAC;EAC/E,IAAI,UACF,OAAO;GACL,QAAQ;GACR,kBAAkB,SAAS;GAC3B,uBAAuB,SAAS;EAClC;CAEJ;CAEA,MAAM,YAAY,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;CAC5D,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,OAAO,UAAU;EACvB,MAAM,aAAa,kBAAkB;GAAE,GAAG;GAAK,QAAQ,KAAK;GAAQ,kBAAkB,KAAK;EAAG,CAAC;EAC/F,OAAO;GACL,QAAQ;GACR,kBAAkB,KAAK;GACvB,uBAAuB,KAAK;EAC9B;CACF;CAEA,MAAM,YAAY,aAAa;CAC/B,IAAI,WACF,MAAM,OAAO,cACX,QAAQ,QACR,KAAK;EACH,OAAO;EACP,UAAU,CACR,SACE,UAAU,WAAW,IACjB,uFACA,wGACN,GACA,QAAQ,CACN,WAAW;GACT,KAAK,GAAG,UAAU;GAClB,OAAO;EACT,CAAC,CACH,CAAC,CACH;CACF,CAAC,GACD,EAAE,cAAc,KAAK,CACvB;CAEF,OAAO,EAAE,QAAQ,UAAU;AAC7B;;;;;;;;;;;;AAaA,SAAS,aAAa,UAA0B;CAG9C,OAAO,UAFU,SAAS,MAAM,GACZ,CAAC,CAAC,UAAS,YAAW,QAAQ,SAAS,CAAC,KAAK,SAAA,CAC5C,QAAQ,oBAAoB,GAAG;AACtD;;;;;;;;;;;;;AAcA,SAAgB,gCAAgC,MAA2C;CACzF,MAAM,EAAE,cAAc,UAAU,kBAAkB;CAClD,OAAO,OAAO,EAAE,UAAU,QAAQ,cAAc;EAM9C,MAAM,qBAAqB,WAAW,OAAO;EAC7C,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,eAAe,OAAO;EACzD,IAAI;GACF,MAAM,iBAAiB,UAAU,QAAQ,GAAG;GAC5C,IAAI,CAAC,gBAAgB,OAAO;GAC5B,MAAM,OAAO,MAAM,aAAa,eAAe;IAC7C;IACA;IACA,gBAAgB,QAAQ,OAAO;GACjC,CAAC;GACD,IAAI,CAAC,MAAM,OAAO;GAKlB,MAAM,QAAQ,KAAK,SAAS;GAC5B,IAAI;GACJ,IAAI,KAAK,2BAA4B,MAAM,SAAS,IAAI;IAAE;IAAO,IAAI,KAAK;GAAwB,CAAC,GACjG,mBAAmB,KAAK;QACnB,IAAI,OAAO;IAChB,MAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,CAAC;IAC/C,IAAI,UAAU,WAAW,GAAG,mBAAmB,UAAU,EAAE,CAAE;GAC/D;GACA,IAAI,CAAC,kBAAkB,OAAO;GAE9B,MAAM,OAAO,MAAM,+BAA+B;IAAE;IAAe;IAAO;GAAiB,CAAC;GAC5F,IAAI,CAAC,KAAK,OAAO,OAAO;GAExB,MAAM,SAAS,aAAa,OAAO,EAAE;GAGrC,MAAM,WAAW,MAAM,cAAc,SAAS,aAAa;IACzD,qBAAqB,KAAK;IAC1B,QAAQ,KAAK;IACb;GACF,CAAC;GACD,IAAI,UAAU,OAAO,SAAS;GAW9B,QAAO,MAVe,cAAc,SAAS,OAAO;IAClD,WAAW,WAAW;IACtB,qBAAqB,KAAK;IAC1B;IACA,QAAQ,KAAK;IACb;IACA,YAAY,KAAK;IAEjB,YAAY,OAAO,OAAO,YAAY;GACxC,CAAC,EAAA,CACc;EACjB,SAAS,OAAO;GAEd,QAAQ,KAAK,4DAA4D,OAAO,IAAI,KAAK;GACzF,OAAO;EACT;CACF;AACF;;;;;;;;;;AAWA,MAAa,0BAA2C,EAAE,YAAY,sBACpE,WAAW,WAAW,UAAU,IAAI,kBAAkB;;AAGxD,SAAgB,6BAA6B,MAA+C;CAC1F,MAAM,EAAE,kBAAkB;CAC1B,OAAO,OAAO,EAAE,YAAY,QAAQ,qBAAqB;EACvD,MAAM,QACJ,iBAAiB,CAAC,OAAO,WAAW,WAAW,UAAU,IACrD,MAAM,gCAAgC;GAAE;GAAe,WAAW,OAAO;EAAW,CAAC,IACrF;EACN,OAAO,WAAW,cAAc;GAC9B,IAAI,OAAO;GACX,SAAS,WAAW;GACpB,YAAY,OAAO;GACnB;GACA,GAAI,QAAQ,EAAE,MAAM,EAAE,kBAAkB,MAAM,iBAAiB,EAAE,IAAI,CAAC;EACxE,CAAC;CACH;AACF;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,8BAA8B,MAA6C;CACzF,MAAM,EAAE,UAAU,eAAe,mBAAmB;CACpD,OAAO,OAAO,EAAE,SAAS,QAAQ,qBAAqB;EAOpD,MAAM,eAAe,SAAS,wBAAwB,cAAc,CAAC;EAErE,IAAI,CAAC,YAAY,CAAC,eAAe;EACjC,IAAI,OAAO,WAAW,WAAW,UAAU,GAAG;EAE9C,MAAM,QAAQ,MAAM,gCAAgC;GAAE;GAAe,WAAW,OAAO;EAAW,CAAC;EACnG,IAAI,CAAC,OAAO;EAKZ,MAAM,QAAQ,MAAM,IAAI,EAAE,kBAAkB,MAAM,iBAAiB,CAAC;EAIpE,MAAM,eAAe,SAAS,MAAM,KAAK;EAEzC,MAAM,eAAe,eAAe,QAAQ,KAAK,IAAI;EACrD,IAAI,MAAM,QAAQ,OAAO,WAAW,EAAE,KAAK,aAAa,CAAC,GAAG;EAE5D,MAAM,iBAAiB,MAAM,6BAA6B,UAAU,MAAM,gBAAgB;EAC1F,MAAM,sBAAsB,SAAS;GACnC,OAAO,MAAM;GACb,kBAAkB,MAAM;GACxB;GACA;EACF,CAAC;CACH;AACF;;;;;;;AAQA,eAAe,mBAAmB,QAA4B,QAAuB;CAEnF,MAAM,EAAE,YAAa,OAAM,MADP,QAAQ,WAAW,CAAC,EAAE,SAAS,QAAQ,EAAA,EACzB,YAAY;EAC5C,QAAQ,EACN,UAAU;GACR,kBAAkB,OAAO,QAAQ;GACjC,0BAA0B,OAAO;GACjC,2BAA2B,OAAO;EACpC,EACF;EACA,SAAS;CACX,CAAC,KAAM,EAAE,SAAS,CAAC,EAAE;CACrB,OAAO,QAAQ;AACjB;;;;;;;;;;;;AAaA,eAAe,aACb,QACA,SACA,EAAE,cAAc,YAChB,KAGQ;CACR,MAAM,SAAS,MAAM,oBAAoB;EAAE;EAAQ;EAAS;CAAa,CAAC;CAC1E,IAAI,OAAO,WAAW,WAAW,OAAO;CAExC,IAAI,OAAO,WAAW,YAAY,cAAc;EAO9C,IAAI,eAAe,IAAI,QAAQ;GAAE,IAAI,OAAO,KAAK;GAAQ,gBAAgB,OAAO,KAAK;EAAM,CAAC;EAE5F,MAAM,QAAQ,MAAM,sBAAsB;GAAE;GAAQ;GAAS,GAAG;GAAQ;GAAc;EAAS,CAAC;EAChG,IAAI,MAAM,WAAW,WAAW,OAAO;EACvC,IAAI,MAAM,WAAW,YACnB,OAAO,EACL,QAAQ;GACN,MAAM,OAAO;GACb,kBAAkB,MAAM;GACxB,uBAAuB,MAAM;EAC/B,EACF;CAEJ;CACA,OAAO,CAAC;AACV;;;;;;AAOA,SAAgB,kBAAkB,QAAuB,QAAyC;CAChG,OAAO;EACL,eAAe,OAAO,QAAQ;EAC9B,MAAM;EACN,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;EACxC,YAAY,OAAO;CACrB;AACF;;AAGA,eAAe,mBACb,WACA,QACA,QAC6B;CAC7B,MAAM,SAAS,MAAM,UAAU,YAAY,kBAAkB,QAAQ,MAAM,CAAC;CAC5E,IAAI,UAAU,CAAC,QAAQ,OAAO;CAC9B,OAAO,UAAU,YAAY,kBAAkB,MAAM,CAAC;AACxD;;;;;;;;;;;;;;;AAgBA,eAAsB,qBAAqB,EACzC,WACA,QACA,SACA,MACA,kBACA,SACA,OAcgB;CAChB,IAAI;EACF,MAAM,QAAQ,kBAAkB,QAAQ,IAAI;EAE5C,MAAM,UAAU,OAAO;GACrB,OAAO,KAAK,SAAS;GACrB,QAAQ,KAAK;GACb;GACA,WAAW;GACX,OAAO;IACL,OAAO,SAAS;IAChB,gBAAgB;KAAE,GAAG,kBAAkB,QAAQ,YAAY,OAAO,CAAC;KAAG,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;IAAG;IAC9F,QAAQ,CAAC,SAAS;IAClB,GAAI,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,EAAE,IAAI,CAAC;GACnD;EACF,CAAC;CACH,SAAS,OAAO;EACd,QAAQ,KAAK,gDAAgD,OAAO,IAAI,KAAK;CAC/E;AACF;AAEA,SAAS,4BAA4B,MAAwC;CAC3E,MAAM,EAAE,cAAc;CACtB,OAAO,OAAO,QAAQ,SAAS,gBAAgB,QAAQ;EAMrD,MAAM,OAAO,MAAM,aAAa,QAAQ,SAAS,MAAM,GAAG;EAC1D,IAAI,CAAC,MAAM;EAKX,MAAM,eAAe,CAAE,MAAM,OAAO,aAAa;EAIjD,MAAM,eAAe,QAAQ,OAAO;EAEpC,IAAI,CAAC,cAAc;EAMnB,MAAM,iBAAiB,MAAM,mBAAmB,IAAI,QAAQ,MAAM;EAClE,IAAI,CAAC,gBAAgB;GACnB,QAAQ,KAAK,4CAA4C,OAAO,EAAE;GAClE;EACF;EAUA,MAAM,aAAa,eAAe,WAAW,WAAW,UAAU;EAClE,MAAM,mBAAmB,aAAa,YAAY,mBAAmB,eAAe,UAAU;EAC9F,MAAM,aAAa,KAAK,SACpB,cAAc,mBAAmB,KAAK,OAAO,gBAAgB,EAAE,cAAc,iBAAiB,WAAW,mBAAmB,eAAe,EAAE,MAC7I,YAAY,eAAe;EAY/B,MAAM,qBAAqB,cAAc,CAAC,KAAK;EAC/C,MAAM,WAAW,QAAQ,IAAI,wBACzB,qBACE,GAAG,QAAQ,IAAI,wBAAwB,WAAW,cAAc,mBAAmB,eAAe,UAAU,MAC5G,GAAG,QAAQ,IAAI,wBAAwB,eACzC,KAAA;EAOJ,IAAI,aAAa,KAAK,QAAQ,uBAAuB;GACnD,MAAM,UAAU,aACZ,KAAA,IACA;IAAE,WAAW,eAAe;IAAY,QAAQ,aAAa,OAAO,EAAE;IAAG,UAAU,eAAe;GAAG;GACzG,MAAM,qBAAqB;IACzB;IACA;IACA;IACA,MAAM,KAAK,OAAO;IAClB,kBAAkB,KAAK,OAAO;IAC9B;IACA,KAAK;GACP,CAAC;EACH;EAKA,IAAI,CAAC,UAAU;EAEf,MAAM,OAAO,KACX,KAAK;GACH,OAAO;GACP,UAAU,CAAC,QAAQ,CAAC,WAAW;IAAE,KAAK;IAAU,OAAO;GAAe,CAAC,CAAC,CAAC,CAAC;EAC5E,CAAC,CACH;CACF;AACF;;;;;;;AAQA,eAAe,YACb,QACA,SACA,EAAE,MAAM,WAAW,gBACJ;CACf,IAAI,CAAC,QAAQ,CAAC,WAAW;CACzB,MAAM,OAAO,uBAAuB,QAAQ,KAAK,QAAQ,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC;CACxF,IAAI,CAAC,MAAM;CACX,IAAI;EACF,MAAM,SAAS,YAAY,OAAO;EAClC,MAAM,WAAW,MAAM,mBAAmB,WAAW,QAAQ,MAAM;EACnE,IAAI,CAAC,UAAU;EAEf,MAAM,WAAyC;GAC7C,UAAU,OAAO,QAAQ;GACzB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,WAAW,QAAQ;GACnB,QAAQ,QAAQ,OAAO;GACvB,UAAU,QAAQ,OAAO;GACzB,UAAU,QAAQ,OAAO;GACzB,OAAO,QAAQ,OAAO;EACxB;EACA,MAAM,OACJ,gBAAgB,SACZ,MAAM,aAAa,eAAe;GAChC,UAAU,SAAS;GACnB,gBAAgB;GAChB,gBAAgB,SAAS;EAC3B,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,cAAc;GACtC,OAAO,SAAS;GAChB,YAAY,SAAS;GACrB,QAAQ,uBAAuB,UAAU,IAAI;GAC7C;GACA,YAAY,QAAQ,SAAS;GAC7B,gBAAgB,mBAAmB,OAAO,IAAI,QAAQ,IAAI,MAAM;EAClE,CAAC;EACD,IAAI,OAAO,WAAW,WACpB,QAAQ,KAAK,8BAA8B;GAAE,QAAQ,OAAO;GAAI,WAAW,QAAQ;GAAI,QAAQ,OAAO;EAAO,CAAC;CAElH,SAAS,OAAO;EAEd,QAAQ,KAAK,+BAA+B;GAAE,QAAQ,OAAO;GAAI,WAAW,QAAQ;GAAI;EAAM,CAAC;CACjG;AACF;AAEA,MAAa,kBAAkB,SAA4C;CACzE,MAAM,wBAAwB,4BAA4B,IAAI;CAE9D,OAAO;EACL,qBAAqB,OAAO,QAAQ,SAAS,gBAAgB,QAAQ;GAInE,IAAI,YAAY,KAAK,QAAQ,IAAI,GAAG,OAAO,YAAY,QAAQ,SAAS,IAAI;GAM5E,IAAI,CAAC,MADc,aAAa,QAAQ,SAAS,MAAM,GAAG,GAC/C;GACX,MAAM,eAAe,QAAQ,OAAO;EACtC;EACA,WAAW;EACX,iBAAiB;CACnB;AACF;AAUA,SAAgB,0BAA0B,MAA6E;CAGrH,MAAM,UAAU,mBAAmB;EAAE,GAAG,KAAK;EAAO,kBAAkB,EAAE,SAAS,yBAAyB;CAAE,CAAC;CAM7G,OAAO;EACL,UAAU,EAAE,OALZ,KAAK,gBAAgB,cAAc,QAC/B;GAAE;GAAS,GAAG,KAAK;EAAe,IAClC;GAAE;GAAS,GAAG,KAAK;GAAgB,WAAW,KAAK,gBAAgB,aAAa;EAAK,EAGvE;EAClB,UAAU,eAAe,IAAI;EAG7B,mBAAmB,gCAAgC,IAAI;EACvD,iBAAiB;EACjB,gBAAgB,6BAA6B,IAAI;EAGjD,gBAAgB,8BAA8B,IAAI;CACpD;AACF"}

package/dist/routes/supervisor.d.ts

@@ -7,9 +7,11 @@
  * owns.
  */
 import type { ApiRoute } from '@mastra/core/server';
+import type { BoardRegistry } from '../boards/index.js';
 import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
 interface SupervisorRouteDependencies {
     workItems: WorkItemsStorage;
+    boards: BoardRegistry;
     resolveProject(context: unknown): Promise<{
         orgId: string;
         userId: string;

package/dist/routes/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/routes/supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAI9E,UAAU,2BAA2B;IACnC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,cAAc,CACZ,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAClG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,QAAQ,EAAE,CA+B3F"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/routes/supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAI9E,UAAU,2BAA2B;IACnC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,cAAc,CACZ,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAClG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,2BAA2B,GAAG,QAAQ,EAAE,CA+B3F"}

package/dist/routes/supervisor.js

@@ -3,7 +3,7 @@ import { runFactoryHealthCheck } from "../supervisor/health.js";
 import { registerApiRoute } from "@mastra/core/server";
 //#region src/routes/supervisor.ts
 function buildSupervisorRoutes(dependencies) {
-	const { workItems } = dependencies;
+	const { workItems, boards } = dependencies;
 	return [registerApiRoute("/web/factory/projects/:id/supervisor/session", {
 		method: "POST",
 		requiresAuth: false,
@@ -23,7 +23,7 @@ function buildSupervisorRoutes(dependencies) {
 			const resolved = await dependencies.resolveProject(context);
 			if ("response" in resolved) return resolved.response;
 			await workItems.ensureReady();
-			const report = await runFactoryHealthCheck(workItems, resolved);
+			const report = await runFactoryHealthCheck(workItems, boards, resolved);
 			return context.json(report);
 		}
 	})];

package/dist/routes/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","names":[],"sources":["../../src/routes/supervisor.ts"],"sourcesContent":["/**\n * Supervisor routes: the per-factory supervisor session address and the\n * deterministic health check the supervisor page pins above its transcript.\n *\n * Mounted from {@link WorkItemRoutes} so they share its tenant + project\n * resolution: a caller can only address a supervisor for a project their org\n * owns.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { runFactoryHealthCheck } from '../supervisor/health.js';\nimport { supervisorResourceId, supervisorThreadId } from '../supervisor/session.js';\n\ninterface SupervisorRouteDependencies {\n  workItems: WorkItemsStorage;\n  resolveProject(\n    context: unknown,\n  ): Promise<{ orgId: string; userId: string; factoryProjectId: string } | { response: Response }>;\n}\n\nexport function buildSupervisorRoutes(dependencies: SupervisorRouteDependencies): ApiRoute[] {\n  const { workItems } = dependencies;\n  return [\n    // The session is addressed deterministically and created lazily by the\n    // agent controller on first reach (see hydrateSupervisorSession), so\n    // \"ensure\" only has to hand back the address once ownership is verified.\n    registerApiRoute('/web/factory/projects/:id/supervisor/session', {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async context => {\n        const resolved = await dependencies.resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        return context.json({\n          sessionId: supervisorResourceId(resolved.factoryProjectId),\n          threadId: supervisorThreadId(resolved.factoryProjectId),\n          factoryProjectId: resolved.factoryProjectId,\n        });\n      },\n    }),\n    registerApiRoute('/web/factory/projects/:id/supervisor/health', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async context => {\n        const resolved = await dependencies.resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        await workItems.ensureReady();\n        const report = await runFactoryHealthCheck(workItems, resolved);\n        return context.json(report);\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;AAuBA,SAAgB,sBAAsB,cAAuD;CAC3F,MAAM,EAAE,cAAc;CACtB,OAAO,CAIL,iBAAiB,gDAAgD;EAC/D,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,YAAW;GACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;GAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,OAAO,QAAQ,KAAK;IAClB,WAAW,qBAAqB,SAAS,gBAAgB;IACzD,UAAU,mBAAmB,SAAS,gBAAgB;IACtD,kBAAkB,SAAS;GAC7B,CAAC;EACH;CACF,CAAC,GACD,iBAAiB,+CAA+C;EAC9D,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,YAAW;GACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;GAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,UAAU,YAAY;GAC5B,MAAM,SAAS,MAAM,sBAAsB,WAAW,QAAQ;GAC9D,OAAO,QAAQ,KAAK,MAAM;EAC5B;CACF,CAAC,CACH;AACF"}
+{"version":3,"file":"supervisor.js","names":[],"sources":["../../src/routes/supervisor.ts"],"sourcesContent":["/**\n * Supervisor routes: the per-factory supervisor session address and the\n * deterministic health check the supervisor page pins above its transcript.\n *\n * Mounted from {@link WorkItemRoutes} so they share its tenant + project\n * resolution: a caller can only address a supervisor for a project their org\n * owns.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\n\nimport type { BoardRegistry } from '../boards/index.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { runFactoryHealthCheck } from '../supervisor/health.js';\nimport { supervisorResourceId, supervisorThreadId } from '../supervisor/session.js';\n\ninterface SupervisorRouteDependencies {\n  workItems: WorkItemsStorage;\n  boards: BoardRegistry;\n  resolveProject(\n    context: unknown,\n  ): Promise<{ orgId: string; userId: string; factoryProjectId: string } | { response: Response }>;\n}\n\nexport function buildSupervisorRoutes(dependencies: SupervisorRouteDependencies): ApiRoute[] {\n  const { workItems, boards } = dependencies;\n  return [\n    // The session is addressed deterministically and created lazily by the\n    // agent controller on first reach (see hydrateSupervisorSession), so\n    // \"ensure\" only has to hand back the address once ownership is verified.\n    registerApiRoute('/web/factory/projects/:id/supervisor/session', {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async context => {\n        const resolved = await dependencies.resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        return context.json({\n          sessionId: supervisorResourceId(resolved.factoryProjectId),\n          threadId: supervisorThreadId(resolved.factoryProjectId),\n          factoryProjectId: resolved.factoryProjectId,\n        });\n      },\n    }),\n    registerApiRoute('/web/factory/projects/:id/supervisor/health', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async context => {\n        const resolved = await dependencies.resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        await workItems.ensureReady();\n        const report = await runFactoryHealthCheck(workItems, boards, resolved);\n        return context.json(report);\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;AAyBA,SAAgB,sBAAsB,cAAuD;CAC3F,MAAM,EAAE,WAAW,WAAW;CAC9B,OAAO,CAIL,iBAAiB,gDAAgD;EAC/D,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,YAAW;GACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;GAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,OAAO,QAAQ,KAAK;IAClB,WAAW,qBAAqB,SAAS,gBAAgB;IACzD,UAAU,mBAAmB,SAAS,gBAAgB;IACtD,kBAAkB,SAAS;GAC7B,CAAC;EACH;CACF,CAAC,GACD,iBAAiB,+CAA+C;EAC9D,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,YAAW;GACxB,MAAM,WAAW,MAAM,aAAa,eAAe,OAAO;GAC1D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,UAAU,YAAY;GAC5B,MAAM,SAAS,MAAM,sBAAsB,WAAW,QAAQ,QAAQ;GACtE,OAAO,QAAQ,KAAK,MAAM;EAC5B;CACF,CAAC,CACH;AACF"}

package/dist/routes/surface.d.ts

@@ -9,7 +9,6 @@ import type { GithubIntegration } from '../integrations/github/integration.js';
 import type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';
 import { FactoryStartCoordinator } from '../rules/start-coordinator.js';
 import { FactoryTransitionService } from '../rules/transition-service.js';
-import type { FactoryRules } from '../rules/types.js';
 import type { MastraFactorySandboxConfig } from '../sandbox/session-sandbox.js';
 import type { StateSigner } from '../state-signing.js';
 import type { AuditEmitter } from '../storage/domains/audit/domain.js';
@@ -70,7 +69,7 @@ export interface FactoryApiRoutesDeps {
     factoryReady: boolean;
     knowledgeEnabled: boolean;
     /** Resolved Factory rule set, threaded from the host (no service locator). */
-    rules: FactoryRules;
+    configVersion: string;
     /** Boards installed for this Factory instance. */
     boardRegistry: BoardRegistry;
     /** Work-item feed service, handed to integrations that ingest platform messages. */
@@ -89,7 +88,7 @@ export interface FactoryApiRoutesDeps {
  * browser and no interactive user, so nothing else would catch a regression in
  * what it forwards.
  */
-export declare function prepareFactoryRuleBinding(github: GithubIntegration, coordinator: Pick<FactoryStartCoordinator, 'prepare'>, projects: FactoryProjectsStorage, input: FactoryBindingPreparationInput): Promise<void>;
+export declare function prepareFactoryRuleBinding(github: GithubIntegration, coordinator: Pick<FactoryStartCoordinator, 'prepare'>, projects: FactoryProjectsStorage, boards: BoardRegistry, input: FactoryBindingPreparationInput): Promise<void>;
 /**
  * Build the {@link IntegrationContext} handed to an integration when the
  * factory collects its capabilities (routes, workers). One shape everywhere:
@@ -99,7 +98,8 @@ export declare function prepareFactoryRuleBinding(github: GithubIntegration, coo
 export declare function buildIntegrationContext(deps: Pick<FactoryApiRoutesDeps, 'controller' | 'publicOrigin' | 'auth' | 'sandbox' | 'users' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'> & {
     stateSigner: StateSigner;
     emitAudit?: AuditEmitter['emit'];
-    rules: FactoryRules;
+    configVersion: string;
+    boardRegistry: BoardRegistry;
     factoryReady: boolean;
     /** Work-item feed service, so a channel integration can ingest platform messages. */
     feed: CommentsDomain;

package/dist/routes/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAShF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uCAAuC,CAAC;AAQ/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,cAAc,EAAE,qBAAqB,CAAC;QACtC,eAAe,EAAE,sBAAsB,CAAC;QACxC,UAAU,EAAE,iBAAiB,CAAC;QAC9B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;QAC5B,eAAe,EAAE,sBAAsB,CAAC;QACxC,QAAQ,EAAE,uBAAuB,CAAC;KACnC,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,KAAK,EAAE,YAAY,CAAC;IACpB,kDAAkD;IAClD,aAAa,EAAE,aAAa,CAAC;IAC7B,oFAAoF;IACpF,IAAI,EAAE,cAAc,CAAC;IACrB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,iBAAiB,CAAC,EAAE,OAAO,kCAAkC,EAAE,4BAA4B,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAkFD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EACrD,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,IAAI,CAAC,CAsEf;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EAClB,YAAY,GACZ,cAAc,GACd,MAAM,GACN,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,oBAAoB,GACpB,sBAAsB,CACzB,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,IAAI,CACX,oBAAoB,CAAC,SAAS,CAAC,EAC/B,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAC3E,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CAwBpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAiI/E"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAShF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uCAAuC,CAAC;AAQ/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAe5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,cAAc,EAAE,qBAAqB,CAAC;QACtC,eAAe,EAAE,sBAAsB,CAAC;QACxC,UAAU,EAAE,iBAAiB,CAAC;QAC9B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;QAC5B,eAAe,EAAE,sBAAsB,CAAC;QACxC,QAAQ,EAAE,uBAAuB,CAAC;KACnC,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,aAAa,EAAE,aAAa,CAAC;IAC7B,oFAAoF;IACpF,IAAI,EAAE,cAAc,CAAC;IACrB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,iBAAiB,CAAC,EAAE,OAAO,kCAAkC,EAAE,4BAA4B,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAkFD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,EACrD,QAAQ,EAAE,sBAAsB,EAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,IAAI,CAAC,CA+Ef;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EAClB,YAAY,GACZ,cAAc,GACd,MAAM,GACN,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,oBAAoB,GACpB,sBAAsB,CACzB,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,IAAI,CACX,oBAAoB,CAAC,SAAS,CAAC,EAC/B,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAC3E,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CA4BpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CA2I/E"}

package/dist/routes/surface.js

@@ -1,5 +1,6 @@
+import { boardForWorkItem } from "../boards/semantics.js";
 import { workItemBranch, workItemBranchSource, workItemThreadTitle } from "../work-item-branch.js";
-import { factoryLaneForRole, factoryRuleStage } from "../rules/types.js";
+import "../boards/index.js";
 import { MaterializeError } from "../integrations/github/sandbox.js";
 import { isAgentActor } from "../storage/domains/work-items/base.js";
 import { getGithubFeatureDiagnostics } from "../integrations/github/config.js";
@@ -101,7 +102,7 @@ async function reuseBoundSession(sourceControl, input) {
 * browser and no interactive user, so nothing else would catch a regression in
 * what it forwards.
 */
-async function prepareFactoryRuleBinding(github, coordinator, projects, input) {
+async function prepareFactoryRuleBinding(github, coordinator, projects, boards, input) {
 	try {
 		const source = workItemBranchSource(input.item.externalSource);
 		const branch = workItemBranch({
@@ -109,8 +110,10 @@ async function prepareFactoryRuleBinding(github, coordinator, projects, input) {
 			source,
 			metadata: input.item.metadata
 		});
-		const currentStage = factoryRuleStage(input.item.stages);
-		const destinationStage = currentStage === "intake" ? factoryLaneForRole(input.role) : currentStage;
+		const board = boards.get(boardForWorkItem(input.item));
+		const currentStage = input.item.stages.length === 1 ? input.item.stages[0] : void 0;
+		const currentKind = currentStage === void 0 ? void 0 : board?.phaseKind(currentStage);
+		const destinationStage = currentKind === void 0 ? void 0 : currentKind === "resting" ? board?.phaseForRole(input.role) : currentStage;
 		if (!destinationStage) throw new FactoryDispatchError("unsupported_provider_item", `Factory skill invocation has no destination lane (role "${input.role}", stages [${input.item.stages.join(", ")}]).`);
 		const repositorySlug = typeof input.item.metadata?.repository === "string" ? input.item.metadata.repository : void 0;
 		const approver = input.record.approvedBy ?? void 0;
@@ -184,9 +187,10 @@ function buildIntegrationContext(deps, integrationId) {
 			workItems: deps.domains.workItems,
 			feed: deps.feed
 		} : {},
-		...deps.factoryReady ? { rules: {
-			config: deps.rules,
-			workItems: deps.domains.workItems
+		...deps.factoryReady ? { runtime: {
+			configVersion: deps.configVersion,
+			workItems: deps.domains.workItems,
+			boards: deps.boardRegistry
 		} } : {},
 		...deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}
 	};
@@ -285,13 +289,14 @@ function assembleFactoryApiRoutes(deps) {
 	const absentStubs = ["github", "linear"].filter((id) => !registrations.some(({ integration }) => integration.id === id)).flatMap((id) => disabledIntegrationStatusRoutes(deps, id));
 	const slackAbsentStubs = registrations.some(({ integration }) => integration.id === "slack") ? [] : absentSlackChannelAccountsRoutes();
 	const transitionService = deps.factoryReady ? deps.factoryTransitionService ?? new FactoryTransitionService({
-		rules: deps.rules,
+		configVersion: deps.configVersion,
+		boards: deps.boardRegistry,
 		storage: deps.domains.workItems
 	}) : void 0;
 	const startCoordinator = transitionService ? new FactoryStartCoordinator(deps.controller, deps.domains.workItems, transitionService, githubIntegration?.sourceControlStorage, deps.domains.memorySettings) : void 0;
 	if (transitionService && startCoordinator) deps.onFactoryRuntime?.({
 		transitionService,
-		...githubIntegration ? { prepareBinding: (input) => prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input) } : {}
+		...githubIntegration ? { prepareBinding: (input) => prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, deps.boardRegistry, input) } : {}
 	});
 	return [
 		...buildFsRoutes({

package/dist/routes/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { BoardRegistry } from '../boards/index.js';\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport { MaterializeError } from '../integrations/github/sandbox.js';\nimport { FactoryDispatchError } from '../rules/dispatch-errors.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport { factoryLaneForRole, factoryRuleStage } from '../rules/types.js';\nimport type { MastraFactorySandboxConfig } from '../sandbox/session-sandbox.js';\nimport {\n  ensureFactorySourceSession,\n  FactorySourceSessionResolutionError,\n  resolveFactoryDefaultModelId,\n  resolveFactoryProjectForSession,\n} from '../session/factory-session.js';\nimport type { EnsuredFactorySourceSession } from '../session/factory-session.js';\nimport { LiveSessions } from '../session/live-sessions.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport type { CommentsDomain } from '../storage/domains/comments/domain.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport {\n  SourceControlConnectionNotFoundError,\n  type SourceControlStorage,\n} from '../storage/domains/source-control/base.js';\nimport {\n  isAgentActor,\n  type FactoryDispatchFailureCode,\n  type WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\nimport { workItemBranch, workItemBranchSource, workItemThreadTitle } from '../work-item-branch.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { KnowledgeRoutes } from './knowledge.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nconst MATERIALIZE_FAILURE_CODE = {\n  'git-missing': 'repository_git_missing',\n  'egress-blocked': 'repository_egress_blocked',\n  'clone-failed': 'repository_clone_failed',\n  'pull-failed': 'repository_pull_failed',\n  'push-failed': 'repository_push_failed',\n  'commit-failed': 'repository_commit_failed',\n  'gh-missing': 'repository_cli_missing',\n  'pr-failed': 'repository_pr_failed',\n} satisfies Record<MaterializeError['code'], FactoryDispatchFailureCode>;\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  /** Optional user directory for resolving persisted owners to display profiles. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox surface (enablement, provider label, create callback). */\n  sandbox?: MastraFactorySandboxConfig;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n    comments: WorkItemCommentsStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  knowledgeEnabled: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  /** Boards installed for this Factory instance. */\n  boardRegistry: BoardRegistry;\n  /** Work-item feed service, handed to integrations that ingest platform messages. */\n  feed: CommentsDomain;\n  factoryTransitionService?: FactoryTransitionService;\n  sessionRetirement?: import('../sandbox/session-retirement.js').SessionRetirementCoordinator;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\n/**\n * Resolve the source-control session the work item already holds for this role,\n * when it still resolves to the item's org and factory project. Returns\n * `undefined` when there is no ref or the ref no longer resolves, so the caller\n * falls back to minting one.\n */\nasync function reuseBoundSession(\n  sourceControl: GithubIntegration['sourceControlStorage'],\n  input: FactoryBindingPreparationInput,\n): Promise<EnsuredFactorySourceSession | undefined> {\n  const ref = input.item.sessions[input.role];\n  if (!ref) return undefined;\n  // At least as strict as the coordinator's resolveSourceSession: a ref it\n  // would reject must fall through to minting, not hard-fail the run.\n  const resolved = await resolveFactoryProjectForSession({ sourceControl, sessionId: ref.sessionId });\n  if (\n    !resolved ||\n    resolved.orgId !== input.record.orgId ||\n    resolved.factoryProjectId !== input.record.factoryProjectId\n  ) {\n    return undefined;\n  }\n  const session = await sourceControl.sessions.getBySessionId(ref.sessionId);\n  if (!session) return undefined;\n  return {\n    sessionId: session.sessionId,\n    userId: session.userId,\n    projectRepositoryId: session.projectRepositoryId,\n    branch: session.branch,\n    baseBranch: session.baseBranch,\n  };\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: Pick<FactoryStartCoordinator, 'prepare'>,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  try {\n    const source = workItemBranchSource(input.item.externalSource);\n    const branch = workItemBranch({ id: input.item.id, source, metadata: input.item.metadata });\n    // Only the Intake exit derives a lane from the role: roles don't own lanes,\n    // and the Done close-out running in the triage seat must not drag the card back.\n    const currentStage = factoryRuleStage(input.item.stages);\n    const destinationStage = currentStage === 'intake' ? factoryLaneForRole(input.role) : currentStage;\n    if (!destinationStage) {\n      throw new FactoryDispatchError(\n        'unsupported_provider_item',\n        `Factory skill invocation has no destination lane (role \"${input.role}\", stages [${input.item.stages.join(', ')}]).`,\n      );\n    }\n    const repositorySlug =\n      typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n    // Re-preparing a binding (server restart, retired controller session) must\n    // land in the role's existing session: minting a replacement would repoint\n    // the work item, flip the session's owner to the approver, and orphan the\n    // previous sandbox.\n    const approver = input.record.approvedBy ?? undefined;\n    const preparedSession =\n      (await reuseBoundSession(github.sourceControlStorage, input)) ??\n      (await ensureFactorySourceSession({\n        sourceControl: github.sourceControlStorage,\n        orgId: input.record.orgId,\n        factoryProjectId: input.record.factoryProjectId,\n        repositorySlug,\n        branch,\n        // A person who approved the run is its interactive user: attribute it to\n        // them, not the repo connector. An agent's pre-approval names no person.\n        attributeToUserId: isAgentActor(approver) ? undefined : approver,\n      }));\n\n    await coordinator.prepare({\n      orgId: input.record.orgId,\n      userId: preparedSession.userId,\n      factoryProjectId: input.record.factoryProjectId,\n      sessionId: preparedSession.sessionId,\n      defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n      threadTitle: workItemThreadTitle({ source, title: input.item.title, metadata: input.item.metadata }),\n      kickoffKey: input.record.id,\n      destinationStage,\n      workItem: {\n        id: input.item.id,\n        role: input.role,\n        input: {\n          externalSource: input.item.externalSource,\n          parentWorkItemId: input.item.parentWorkItemId,\n          title: input.item.title,\n          stages: ['intake'],\n          sessions: input.item.sessions,\n          metadata: input.item.metadata,\n        },\n      },\n    });\n  } catch (error) {\n    if (error instanceof FactoryDispatchError) throw error;\n    if (error instanceof FactorySourceSessionResolutionError) {\n      const code = error.reason === 'connection' ? 'source_control_missing' : 'source_repository_missing';\n      throw new FactoryDispatchError(code, error.message, { cause: error });\n    }\n    if (error instanceof SourceControlConnectionNotFoundError) {\n      throw new FactoryDispatchError('source_control_missing', error.message, { cause: error });\n    }\n    if (error instanceof MaterializeError) {\n      throw new FactoryDispatchError(MATERIALIZE_FAILURE_CODE[error.code], error.message, { cause: error });\n    }\n    throw error;\n  }\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    | 'controller'\n    | 'publicOrigin'\n    | 'auth'\n    | 'sandbox'\n    | 'users'\n    | 'factoryStorage'\n    | 'integrationStorage'\n    | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    /** Work-item feed service, so a channel integration can ingest platform messages. */\n    feed: CommentsDomain;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    sandbox: deps.sandbox,\n    ...(deps.users ? { users: deps.users } : {}),\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { workItems: deps.domains.workItems, feed: deps.feed } : {}),\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              sandbox: deps.sandbox,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      sourceControlSessions: deps.sourceControlStorage.forIntegration('github').sessions,\n      memorySettings: deps.domains.memorySettings,\n      factoryProjects: deps.domains.projects,\n      customProviders: deps.domains.customProviders,\n      features: { knowledge: deps.knowledgeEnabled },\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      memorySettings: deps.domains.memorySettings,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          projects: deps.domains.projects,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady && deps.knowledgeEnabled\n      ? new KnowledgeRoutes({\n          auth: deps.auth,\n          projects: deps.domains.projects,\n          knowledge: async () => deps.factoryStorage?.getMastraStorage().getStore('knowledge'),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          boardRegistry: deps.boardRegistry,\n          comments: deps.domains.comments,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n          liveSessions: new LiveSessions(deps.controller),\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8DA,MAAM,2BAA2B;CAC/B,eAAe;CACf,kBAAkB;CAClB,gBAAgB;CAChB,eAAe;CACf,eAAe;CACf,iBAAiB;CACjB,cAAc;CACd,aAAa;AACf;AAyDA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;;;;;;;AAQA,eAAe,kBACb,eACA,OACkD;CAClD,MAAM,MAAM,MAAM,KAAK,SAAS,MAAM;CACtC,IAAI,CAAC,KAAK,OAAO,KAAA;CAGjB,MAAM,WAAW,MAAM,gCAAgC;EAAE;EAAe,WAAW,IAAI;CAAU,CAAC;CAClG,IACE,CAAC,YACD,SAAS,UAAU,MAAM,OAAO,SAChC,SAAS,qBAAqB,MAAM,OAAO,kBAE3C;CAEF,MAAM,UAAU,MAAM,cAAc,SAAS,eAAe,IAAI,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO;EACL,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,qBAAqB,QAAQ;EAC7B,QAAQ,QAAQ;EAChB,YAAY,QAAQ;CACtB;AACF;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,IAAI;EACF,MAAM,SAAS,qBAAqB,MAAM,KAAK,cAAc;EAC7D,MAAM,SAAS,eAAe;GAAE,IAAI,MAAM,KAAK;GAAI;GAAQ,UAAU,MAAM,KAAK;EAAS,CAAC;EAG1F,MAAM,eAAe,iBAAiB,MAAM,KAAK,MAAM;EACvD,MAAM,mBAAmB,iBAAiB,WAAW,mBAAmB,MAAM,IAAI,IAAI;EACtF,IAAI,CAAC,kBACH,MAAM,IAAI,qBACR,6BACA,2DAA2D,MAAM,KAAK,aAAa,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,IAClH;EAEF,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;EAKzF,MAAM,WAAW,MAAM,OAAO,cAAc,KAAA;EAC5C,MAAM,kBACH,MAAM,kBAAkB,OAAO,sBAAsB,KAAK,KAC1D,MAAM,2BAA2B;GAChC,eAAe,OAAO;GACtB,OAAO,MAAM,OAAO;GACpB,kBAAkB,MAAM,OAAO;GAC/B;GACA;GAGA,mBAAmB,aAAa,QAAQ,IAAI,KAAA,IAAY;EAC1D,CAAC;EAEH,MAAM,YAAY,QAAQ;GACxB,OAAO,MAAM,OAAO;GACpB,QAAQ,gBAAgB;GACxB,kBAAkB,MAAM,OAAO;GAC/B,WAAW,gBAAgB;GAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;GAC1F,aAAa,oBAAoB;IAAE;IAAQ,OAAO,MAAM,KAAK;IAAO,UAAU,MAAM,KAAK;GAAS,CAAC;GACnG,YAAY,MAAM,OAAO;GACzB;GACA,UAAU;IACR,IAAI,MAAM,KAAK;IACf,MAAM,MAAM;IACZ,OAAO;KACL,gBAAgB,MAAM,KAAK;KAC3B,kBAAkB,MAAM,KAAK;KAC7B,OAAO,MAAM,KAAK;KAClB,QAAQ,CAAC,QAAQ;KACjB,UAAU,MAAM,KAAK;KACrB,UAAU,MAAM,KAAK;IACvB;GACF;EACF,CAAC;CACH,SAAS,OAAO;EACd,IAAI,iBAAiB,sBAAsB,MAAM;EACjD,IAAI,iBAAiB,qCAEnB,MAAM,IAAI,qBADG,MAAM,WAAW,eAAe,2BAA2B,6BACnC,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtE,IAAI,iBAAiB,sCACnB,MAAM,IAAI,qBAAqB,0BAA0B,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE1F,IAAI,iBAAiB,kBACnB,MAAM,IAAI,qBAAqB,yBAAyB,MAAM,OAAO,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtG,MAAM;CACR;AACF;;;;;;;AAQA,SAAgB,wBACd,MA4BA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,SAAS,KAAK;EACd,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;EAC1C,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe;GAAE,WAAW,KAAK,QAAQ;GAAW,MAAM,KAAK;EAAK,IAAI,CAAC;EAClF,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,SAAS,KAAK;GAChB,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,uBAAuB,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;GAC1E,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,iBAAiB,KAAK,QAAQ;GAC9B,UAAU,EAAE,WAAW,KAAK,iBAAiB;GAC7C,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,gBAAgB,KAAK,QAAQ;GAC7B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;GACvB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,gBAAgB,KAAK,mBAC1B,IAAI,gBAAgB;GAClB,MAAM,KAAK;GACX,UAAU,KAAK,QAAQ;GACvB,WAAW,YAAY,KAAK,gBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW;EACrF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,eAAe,KAAK;GACpB,UAAU,KAAK,QAAQ;GACvB,aAAa,KAAK,QAAQ;GAC1B;GACA;GACA,cAAc,IAAI,aAAa,KAAK,UAAU;EAChD,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}
+{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport { boardForWorkItem } from '../boards/index.js';\nimport type { BoardRegistry } from '../boards/index.js';\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport { MaterializeError } from '../integrations/github/sandbox.js';\nimport { FactoryDispatchError } from '../rules/dispatch-errors.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { MastraFactorySandboxConfig } from '../sandbox/session-sandbox.js';\nimport {\n  ensureFactorySourceSession,\n  FactorySourceSessionResolutionError,\n  resolveFactoryDefaultModelId,\n  resolveFactoryProjectForSession,\n} from '../session/factory-session.js';\nimport type { EnsuredFactorySourceSession } from '../session/factory-session.js';\nimport { LiveSessions } from '../session/live-sessions.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport type { CommentsDomain } from '../storage/domains/comments/domain.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport {\n  SourceControlConnectionNotFoundError,\n  type SourceControlStorage,\n} from '../storage/domains/source-control/base.js';\nimport {\n  isAgentActor,\n  type FactoryDispatchFailureCode,\n  type WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\nimport { workItemBranch, workItemBranchSource, workItemThreadTitle } from '../work-item-branch.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { KnowledgeRoutes } from './knowledge.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nconst MATERIALIZE_FAILURE_CODE = {\n  'git-missing': 'repository_git_missing',\n  'egress-blocked': 'repository_egress_blocked',\n  'clone-failed': 'repository_clone_failed',\n  'pull-failed': 'repository_pull_failed',\n  'push-failed': 'repository_push_failed',\n  'commit-failed': 'repository_commit_failed',\n  'gh-missing': 'repository_cli_missing',\n  'pr-failed': 'repository_pr_failed',\n} satisfies Record<MaterializeError['code'], FactoryDispatchFailureCode>;\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  /** Optional user directory for resolving persisted owners to display profiles. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox surface (enablement, provider label, create callback). */\n  sandbox?: MastraFactorySandboxConfig;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n    comments: WorkItemCommentsStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  knowledgeEnabled: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  configVersion: string;\n  /** Boards installed for this Factory instance. */\n  boardRegistry: BoardRegistry;\n  /** Work-item feed service, handed to integrations that ingest platform messages. */\n  feed: CommentsDomain;\n  factoryTransitionService?: FactoryTransitionService;\n  sessionRetirement?: import('../sandbox/session-retirement.js').SessionRetirementCoordinator;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\n/**\n * Resolve the source-control session the work item already holds for this role,\n * when it still resolves to the item's org and factory project. Returns\n * `undefined` when there is no ref or the ref no longer resolves, so the caller\n * falls back to minting one.\n */\nasync function reuseBoundSession(\n  sourceControl: GithubIntegration['sourceControlStorage'],\n  input: FactoryBindingPreparationInput,\n): Promise<EnsuredFactorySourceSession | undefined> {\n  const ref = input.item.sessions[input.role];\n  if (!ref) return undefined;\n  // At least as strict as the coordinator's resolveSourceSession: a ref it\n  // would reject must fall through to minting, not hard-fail the run.\n  const resolved = await resolveFactoryProjectForSession({ sourceControl, sessionId: ref.sessionId });\n  if (\n    !resolved ||\n    resolved.orgId !== input.record.orgId ||\n    resolved.factoryProjectId !== input.record.factoryProjectId\n  ) {\n    return undefined;\n  }\n  const session = await sourceControl.sessions.getBySessionId(ref.sessionId);\n  if (!session) return undefined;\n  return {\n    sessionId: session.sessionId,\n    userId: session.userId,\n    projectRepositoryId: session.projectRepositoryId,\n    branch: session.branch,\n    baseBranch: session.baseBranch,\n  };\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: Pick<FactoryStartCoordinator, 'prepare'>,\n  projects: FactoryProjectsStorage,\n  boards: BoardRegistry,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  try {\n    const source = workItemBranchSource(input.item.externalSource);\n    const branch = workItemBranch({ id: input.item.id, source, metadata: input.item.metadata });\n    // Only leaving a resting phase derives a lane from the role: roles don't own lanes,\n    // and the Done close-out running in the triage seat must not drag the card back.\n    // Both the current phase and the role's lane come from the installed board; an\n    // unknown board or phase yields no destination rather than a guessed one.\n    const board = boards.get(boardForWorkItem(input.item));\n    const currentStage = input.item.stages.length === 1 ? input.item.stages[0] : undefined;\n    const currentKind = currentStage === undefined ? undefined : board?.phaseKind(currentStage);\n    const destinationStage =\n      currentKind === undefined\n        ? undefined\n        : currentKind === 'resting'\n          ? board?.phaseForRole(input.role)\n          : currentStage;\n    if (!destinationStage) {\n      throw new FactoryDispatchError(\n        'unsupported_provider_item',\n        `Factory skill invocation has no destination lane (role \"${input.role}\", stages [${input.item.stages.join(', ')}]).`,\n      );\n    }\n    const repositorySlug =\n      typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n    // Re-preparing a binding (server restart, retired controller session) must\n    // land in the role's existing session: minting a replacement would repoint\n    // the work item, flip the session's owner to the approver, and orphan the\n    // previous sandbox.\n    const approver = input.record.approvedBy ?? undefined;\n    const preparedSession =\n      (await reuseBoundSession(github.sourceControlStorage, input)) ??\n      (await ensureFactorySourceSession({\n        sourceControl: github.sourceControlStorage,\n        orgId: input.record.orgId,\n        factoryProjectId: input.record.factoryProjectId,\n        repositorySlug,\n        branch,\n        // A person who approved the run is its interactive user: attribute it to\n        // them, not the repo connector. An agent's pre-approval names no person.\n        attributeToUserId: isAgentActor(approver) ? undefined : approver,\n      }));\n\n    await coordinator.prepare({\n      orgId: input.record.orgId,\n      userId: preparedSession.userId,\n      factoryProjectId: input.record.factoryProjectId,\n      sessionId: preparedSession.sessionId,\n      defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n      threadTitle: workItemThreadTitle({ source, title: input.item.title, metadata: input.item.metadata }),\n      kickoffKey: input.record.id,\n      destinationStage,\n      workItem: {\n        id: input.item.id,\n        role: input.role,\n        input: {\n          externalSource: input.item.externalSource,\n          parentWorkItemId: input.item.parentWorkItemId,\n          title: input.item.title,\n          stages: ['intake'],\n          sessions: input.item.sessions,\n          metadata: input.item.metadata,\n        },\n      },\n    });\n  } catch (error) {\n    if (error instanceof FactoryDispatchError) throw error;\n    if (error instanceof FactorySourceSessionResolutionError) {\n      const code = error.reason === 'connection' ? 'source_control_missing' : 'source_repository_missing';\n      throw new FactoryDispatchError(code, error.message, { cause: error });\n    }\n    if (error instanceof SourceControlConnectionNotFoundError) {\n      throw new FactoryDispatchError('source_control_missing', error.message, { cause: error });\n    }\n    if (error instanceof MaterializeError) {\n      throw new FactoryDispatchError(MATERIALIZE_FAILURE_CODE[error.code], error.message, { cause: error });\n    }\n    throw error;\n  }\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    | 'controller'\n    | 'publicOrigin'\n    | 'auth'\n    | 'sandbox'\n    | 'users'\n    | 'factoryStorage'\n    | 'integrationStorage'\n    | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    configVersion: string;\n    boardRegistry: BoardRegistry;\n    factoryReady: boolean;\n    /** Work-item feed service, so a channel integration can ingest platform messages. */\n    feed: CommentsDomain;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    sandbox: deps.sandbox,\n    ...(deps.users ? { users: deps.users } : {}),\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { workItems: deps.domains.workItems, feed: deps.feed } : {}),\n    ...(deps.factoryReady\n      ? {\n          runtime: { configVersion: deps.configVersion, workItems: deps.domains.workItems, boards: deps.boardRegistry },\n        }\n      : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              sandbox: deps.sandbox,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({\n        configVersion: deps.configVersion,\n        boards: deps.boardRegistry,\n        storage: deps.domains.workItems,\n      }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(\n                githubIntegration,\n                startCoordinator,\n                deps.domains.projects,\n                deps.boardRegistry,\n                input,\n              ),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      sourceControlSessions: deps.sourceControlStorage.forIntegration('github').sessions,\n      memorySettings: deps.domains.memorySettings,\n      factoryProjects: deps.domains.projects,\n      customProviders: deps.domains.customProviders,\n      features: { knowledge: deps.knowledgeEnabled },\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      memorySettings: deps.domains.memorySettings,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          projects: deps.domains.projects,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady && deps.knowledgeEnabled\n      ? new KnowledgeRoutes({\n          auth: deps.auth,\n          projects: deps.domains.projects,\n          knowledge: async () => deps.factoryStorage?.getMastraStorage().getStore('knowledge'),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          boardRegistry: deps.boardRegistry,\n          comments: deps.domains.comments,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n          liveSessions: new LiveSessions(deps.controller),\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA6DA,MAAM,2BAA2B;CAC/B,eAAe;CACf,kBAAkB;CAClB,gBAAgB;CAChB,eAAe;CACf,eAAe;CACf,iBAAiB;CACjB,cAAc;CACd,aAAa;AACf;AAyDA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;;;;;;;AAQA,eAAe,kBACb,eACA,OACkD;CAClD,MAAM,MAAM,MAAM,KAAK,SAAS,MAAM;CACtC,IAAI,CAAC,KAAK,OAAO,KAAA;CAGjB,MAAM,WAAW,MAAM,gCAAgC;EAAE;EAAe,WAAW,IAAI;CAAU,CAAC;CAClG,IACE,CAAC,YACD,SAAS,UAAU,MAAM,OAAO,SAChC,SAAS,qBAAqB,MAAM,OAAO,kBAE3C;CAEF,MAAM,UAAU,MAAM,cAAc,SAAS,eAAe,IAAI,SAAS;CACzE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO;EACL,WAAW,QAAQ;EACnB,QAAQ,QAAQ;EAChB,qBAAqB,QAAQ;EAC7B,QAAQ,QAAQ;EAChB,YAAY,QAAQ;CACtB;AACF;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,QACA,OACe;CACf,IAAI;EACF,MAAM,SAAS,qBAAqB,MAAM,KAAK,cAAc;EAC7D,MAAM,SAAS,eAAe;GAAE,IAAI,MAAM,KAAK;GAAI;GAAQ,UAAU,MAAM,KAAK;EAAS,CAAC;EAK1F,MAAM,QAAQ,OAAO,IAAI,iBAAiB,MAAM,IAAI,CAAC;EACrD,MAAM,eAAe,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK,KAAA;EAC7E,MAAM,cAAc,iBAAiB,KAAA,IAAY,KAAA,IAAY,OAAO,UAAU,YAAY;EAC1F,MAAM,mBACJ,gBAAgB,KAAA,IACZ,KAAA,IACA,gBAAgB,YACd,OAAO,aAAa,MAAM,IAAI,IAC9B;EACR,IAAI,CAAC,kBACH,MAAM,IAAI,qBACR,6BACA,2DAA2D,MAAM,KAAK,aAAa,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,IAClH;EAEF,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;EAKzF,MAAM,WAAW,MAAM,OAAO,cAAc,KAAA;EAC5C,MAAM,kBACH,MAAM,kBAAkB,OAAO,sBAAsB,KAAK,KAC1D,MAAM,2BAA2B;GAChC,eAAe,OAAO;GACtB,OAAO,MAAM,OAAO;GACpB,kBAAkB,MAAM,OAAO;GAC/B;GACA;GAGA,mBAAmB,aAAa,QAAQ,IAAI,KAAA,IAAY;EAC1D,CAAC;EAEH,MAAM,YAAY,QAAQ;GACxB,OAAO,MAAM,OAAO;GACpB,QAAQ,gBAAgB;GACxB,kBAAkB,MAAM,OAAO;GAC/B,WAAW,gBAAgB;GAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;GAC1F,aAAa,oBAAoB;IAAE;IAAQ,OAAO,MAAM,KAAK;IAAO,UAAU,MAAM,KAAK;GAAS,CAAC;GACnG,YAAY,MAAM,OAAO;GACzB;GACA,UAAU;IACR,IAAI,MAAM,KAAK;IACf,MAAM,MAAM;IACZ,OAAO;KACL,gBAAgB,MAAM,KAAK;KAC3B,kBAAkB,MAAM,KAAK;KAC7B,OAAO,MAAM,KAAK;KAClB,QAAQ,CAAC,QAAQ;KACjB,UAAU,MAAM,KAAK;KACrB,UAAU,MAAM,KAAK;IACvB;GACF;EACF,CAAC;CACH,SAAS,OAAO;EACd,IAAI,iBAAiB,sBAAsB,MAAM;EACjD,IAAI,iBAAiB,qCAEnB,MAAM,IAAI,qBADG,MAAM,WAAW,eAAe,2BAA2B,6BACnC,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtE,IAAI,iBAAiB,sCACnB,MAAM,IAAI,qBAAqB,0BAA0B,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAE1F,IAAI,iBAAiB,kBACnB,MAAM,IAAI,qBAAqB,yBAAyB,MAAM,OAAO,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;EAEtG,MAAM;CACR;AACF;;;;;;;AAQA,SAAgB,wBACd,MA6BA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,SAAS,KAAK;EACd,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;EAC1C,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe;GAAE,WAAW,KAAK,QAAQ;GAAW,MAAM,KAAK;EAAK,IAAI,CAAC;EAClF,GAAI,KAAK,eACL,EACE,SAAS;GAAE,eAAe,KAAK;GAAe,WAAW,KAAK,QAAQ;GAAW,QAAQ,KAAK;EAAc,EAC9G,IACA,CAAC;EACL,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,SAAS,KAAK;GAChB,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAC3B,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,SAAS,KAAK,QAAQ;CACxB,CAAC,IACD,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BACE,mBACA,kBACA,KAAK,QAAQ,UACb,KAAK,eACL,KACF,EACJ,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,uBAAuB,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;GAC1E,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,iBAAiB,KAAK,QAAQ;GAC9B,UAAU,EAAE,WAAW,KAAK,iBAAiB;GAC7C,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,gBAAgB,KAAK,QAAQ;GAC7B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;GACvB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,gBAAgB,KAAK,mBAC1B,IAAI,gBAAgB;GAClB,MAAM,KAAK;GACX,UAAU,KAAK,QAAQ;GACvB,WAAW,YAAY,KAAK,gBAAgB,iBAAiB,CAAC,CAAC,SAAS,WAAW;EACrF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,eAAe,KAAK;GACpB,UAAU,KAAK,QAAQ;GACvB,aAAa,KAAK,QAAQ;GAC1B;GACA;GACA,cAAc,IAAI,aAAa,KAAK,UAAU;EAChD,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}

package/dist/routes/work-items.d.ts

@@ -31,7 +31,7 @@ export interface WorkItemRoutesDeps extends RouteDependencies {
     /** Per-project queue-health threshold config. */
     queueHealth: QueueHealthStorage;
     /** Governed stage-transition service. Stage moves 503 when absent. */
-    transitionService?: Pick<FactoryTransitionService, 'transition' | 'ruleSetVersion'>;
+    transitionService?: Pick<FactoryTransitionService, 'transition' | 'configVersion'>;
     /** Coordinator that binds a Factory run before dispatching its kickoff. */
     startCoordinator?: Pick<FactoryStartCoordinator, 'prepare'>;
     /** Materialized sessions, read to report which of the listed cards are being worked. */

package/dist/routes/work-items.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work-items.d.ts","sourceRoot":"","sources":["../../src/routes/work-items.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EACV,uBAAuB,EAGxB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAA4B,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAGzG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,KAAK,EACV,mBAAmB,EAInB,mBAAmB,EAKnB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAS/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGnC,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,KAAK,EAAE,YAAY,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,sBAAsB,CAAC;IACjC,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,kDAAkD;IAClD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,EAAE,uBAAuB,CAAC;IAClC,iDAAiD;IACjD,WAAW,EAAE,kBAAkB,CAAC;IAChC,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,gBAAgB,CAAC,CAAC;IACpF,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;IAC5D,wFAAwF;IACxF,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;CAC/C;AAsGD,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA6B7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAsC7E;AAwKD,qBAAa,cAAe,SAAQ,KAAK,CAAC,kBAAkB,CAAC;;IAyJ3D,gEAAgE;IAChE,MAAM,IAAI,QAAQ,EAAE;CAqZrB"}
+{"version":3,"file":"work-items.d.ts","sourceRoot":"","sources":["../../src/routes/work-items.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAKpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EACV,uBAAuB,EAGxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAA4B,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAEzG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,KAAK,EACV,mBAAmB,EAInB,mBAAmB,EAKnB,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAS/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGnC,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,KAAK,EAAE,YAAY,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,sBAAsB,CAAC;IACjC,kDAAkD;IAClD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,kDAAkD;IAClD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,EAAE,uBAAuB,CAAC;IAClC,iDAAiD;IACjD,WAAW,EAAE,kBAAkB,CAAC;IAChC,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,GAAG,eAAe,CAAC,CAAC;IACnF,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;IAC5D,wFAAwF;IACxF,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;CAC/C;AAsGD,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CA6B7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAsC7E;AAuKD,qBAAa,cAAe,SAAQ,KAAK,CAAC,kBAAkB,CAAC;;IA+J3D,gEAAgE;IAChE,MAAM,IAAI,QAAQ,EAAE;CAsZrB"}