@mastra/factory 0.14.1-alpha.1 → 0.14.1-alpha.3

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWxD,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,KAAK,EAAE,kBAAkB,EAAgD,MAAM,wBAAwB,CAAC;AA6B/G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAuCtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAI1D,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC;;;;;;;OAOG;IACH,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,mDAAmD;IACnD,UAAU,CAAC,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmFD,qBAAa,aAAa;;gBASZ,MAAM,EAAE,mBAAmB;IAsBvC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;IAg1BpC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/B,iFAAiF;IAC3E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWxD,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,KAAK,EAAE,kBAAkB,EAAgD,MAAM,wBAAwB,CAAC;AA6B/G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAwCtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAI1D,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC;;;;;;;OAOG;IACH,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,0BAA0B,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,mDAAmD;IACnD,UAAU,CAAC,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmFD,qBAAa,aAAa;;gBASZ,MAAM,EAAE,mBAAmB;IAsBvC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;IAu1BpC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/B,iFAAiF;IAC3E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}

package/dist/factory.js

@@ -17,6 +17,7 @@ import { createCustomProvidersPrimer, registerCustomProvidersSource } from "./ro
 import { ProjectRoutes } from "./routes/projects.js";
 import { MemorySettingsStorage } from "./storage/domains/memory-settings/base.js";
 import { hydrateSessionMemorySettings } from "./session/memory-settings-hydration.js";
+import { refreshFactorySessionMemorySettings } from "./session/factory-session.js";
 import { FactoryTransitionService } from "./rules/transition-service.js";
 import { SourceControlStorage } from "./storage/domains/source-control/base.js";
 import { hydrateSessionModelPack } from "./session/model-pack-hydration.js";
@@ -548,6 +549,12 @@ var MastraFactory = class {
 							},
 							reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),
 							prepareBinding,
+							refreshManagedMemorySettings: ({ binding, session }) => refreshFactorySessionMemorySettings(session, {
+								orgId: binding.orgId,
+								factoryProjectId: binding.factoryProjectId,
+								projects: factoryProjectsStorage,
+								memorySettings: memorySettingsStorage
+							}),
 							feedReader: new FactoryFeedReader(workItemCommentsStorage),
 							primeCredentials: (tenant) => primeTenantCredentials({
 								tenant,

package/dist/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","names":["#config","#boards","#configVersion","#preparing","#dispatcher","#prepared","#factoryProcessor"],"sources":["../src/factory.ts"],"sourcesContent":["/**\n * `MastraFactory` — the single entry point to the whole Mastra Software Factory.\n *\n * The consumer's deploy entry constructs deployment-specific config instances\n * (auth adapter, pubsub) and passes them here explicitly. The only provider\n * defaults constructed here are Platform GitHub, incident.io, and Linear\n * integrations when Platform credentials exist and the caller did not provide\n * those integrations.\n *\n * `prepare()` resolves feature readiness, threads every dependency explicitly,\n * assembles the web routes/middleware, and returns the constructor args for\n * `new Mastra(...)`. The literal `export const mastra = new Mastra(...)` must\n * stay in the entry file — the deployer's `checkConfigExport` Babel plugin\n * only marks the config valid when it finds that literal in the entry AST —\n * so the factory produces args instead of the instance. `finalize()` runs the\n * post-construct boot (controller init + workers).\n *\n * Integration readiness is derived from each instance's declared capabilities\n * and the storage domains those capabilities require.\n */\n\nimport { MastraAuthStudio } from '@mastra/auth-studio';\nimport { prepareAgentControllerMount } from '@mastra/code-sdk';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport { AgentControllerChannels } from '@mastra/core/channels';\nimport { EventEmitterPubSub } from '@mastra/core/events';\nimport type { PubSub } from '@mastra/core/events';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { hasAuthInit, isUserProvider } from '@mastra/core/server';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport {\n  buildAuthRoutes,\n  createFactoryAuthGate,\n  createFactoryRouteAuth,\n  getFactoryAuthOrgId,\n  getFactoryAuthUserFromContext,\n  getFactoryAuthUserId,\n} from './auth.js';\nimport { createBoardRegistry, workItemPhaseSemantics } from './boards/index.js';\nimport type { BoardRegistry, InstalledBoard } from './boards/index.js';\nimport { touchFeed } from './feed-events.js';\nimport type { FactoryIntegration, IntegrationPostToolContext, IntegrationTools } from './integrations/base.js';\nimport { reconcileGithubAcceptanceLabels } from './integrations/github/acceptance-labels.js';\nimport type { GithubIntegration } from './integrations/github/integration.js';\nimport {\n  recordFactoryPullRequestProvenance,\n  resolveFactoryPullRequestParentWorkItemId,\n} from './integrations/github/provenance.js';\nimport type { FactoryPullRequestProvenanceData } from './integrations/github/provenance.js';\nimport { isValidGitRef } from './integrations/github/sandbox.js';\nimport { PlatformGithubIntegration } from './integrations/platform/github/integration.js';\nimport { PlatformIncidentioIntegration } from './integrations/platform/incidentio/integration.js';\nimport { PlatformLinearIntegration } from './integrations/platform/linear/integration.js';\nimport { createCustomProvidersPrimer, registerCustomProvidersSource } from './routes/custom-provider-source.js';\nimport { ProjectRoutes } from './routes/projects.js';\nimport { assembleFactoryApiRoutes, buildIntegrationContext } from './routes/surface.js';\nimport type { FactoryApiRoutesDeps } from './routes/surface.js';\nimport { TelemetryRoutes } from './routes/telemetry.js';\nimport {\n  createTenantCredentialPrimer,\n  primeTenantCredentials,\n  registerTenantCredentialResolver,\n} from './routes/tenant-credentials.js';\nimport { FactoryDecisionDispatcher } from './rules/dispatcher.js';\nimport { FactoryPhaseStateProcessor } from './rules/processor.js';\nimport { createTerminalStageCleanup } from './rules/terminal-cleanup.js';\nimport { createFactoryTransitionTools } from './rules/tools.js';\nimport { FactoryTransitionService } from './rules/transition-service.js';\nimport { assertFactoryConfigVersion, DEFAULT_FACTORY_CONFIG_VERSION } from './rules/validation.js';\nimport { SessionRetirementCoordinator } from './sandbox/session-retirement.js';\nimport type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';\nimport { createPlaintextFactorySecretEncryption } from './secret-encryption.js';\nimport type { FactorySecretEncryption } from './secret-encryption.js';\nimport { handleServerError } from './server-error.js';\nimport { observeSessionFilesystem } from './session/filesystem-capture.js';\nimport { observeSessionFirstExec } from './session/first-exec-capture.js';\nimport { observeSessionFirstMessage } from './session/first-message-capture.js';\nimport { LiveSessions } from './session/live-sessions.js';\nimport { hydrateSessionMemorySettings } from './session/memory-settings-hydration.js';\nimport { hydrateSessionModelPack } from './session/model-pack-hydration.js';\nimport { observeSessionRunEnd } from './session/run-audit.js';\nimport { observeSessionThreadTitle } from './session/thread-title-mirror.js';\nimport { createSpaStaticMiddleware, resolveUiDistDir } from './spa-static.js';\nimport { createStateSigner } from './state-signing.js';\nimport { observeAgentGitAction } from './storage/domains/audit/agent-audit.js';\nimport { AuditStorage } from './storage/domains/audit/base.js';\nimport { AuditDomain } from './storage/domains/audit/domain.js';\nimport { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';\nimport { WorkItemCommentsStorage } from './storage/domains/comments/base.js';\nimport { CommentsDomain } from './storage/domains/comments/domain.js';\nimport { FactoryFeedReader } from './storage/domains/comments/feed-context.js';\nimport type { WorkItemFeedPublisher } from './storage/domains/comments/feed-sync.js';\nimport { ModelCredentialsStorage } from './storage/domains/credentials/base.js';\nimport { CustomProvidersStorage } from './storage/domains/custom-providers/base.js';\nimport { FilesystemStorage } from './storage/domains/filesystem/base.js';\nimport { IntakeStorage } from './storage/domains/intake/base.js';\nimport { IntegrationStorage } from './storage/domains/integrations/base.js';\nimport { MemorySettingsStorage } from './storage/domains/memory-settings/base.js';\nimport { ModelPacksStorage } from './storage/domains/model-packs/base.js';\nimport { FactoryProjectsStorage } from './storage/domains/projects/base.js';\nimport { QueueHealthStorage } from './storage/domains/queue-health/base.js';\nimport { SourceControlStorage } from './storage/domains/source-control/base.js';\nimport { WorkItemsStorage } from './storage/domains/work-items/base.js';\nimport type { WorkItemRow } from './storage/domains/work-items/base.js';\nimport { FactorySupervisorHealthWorker } from './supervisor/health-worker.js';\nimport { SUPERVISOR_INSTRUCTIONS } from './supervisor/instructions.js';\nimport { createFactorySupervisorReadTools } from './supervisor/read-tools.js';\nimport { hydrateSupervisorSession, parseSupervisorResourceId, resolveSupervisorScope } from './supervisor/session.js';\nimport { createFactorySupervisorWriteTools } from './supervisor/write-tools.js';\nimport { timedPhase } from './timing.js';\nimport { createWorkspaceFactory, FactoryWorkspaceRegistry } from './workspace.js';\nimport type { FactorySandboxStart } from './workspace.js';\n\ntype BuildApiRoutesDeps = Pick<FactoryApiRoutesDeps, 'controller' | 'authStorage'>;\n\n/** Constructor args for the `new Mastra(...)` literal in the deploy entry. */\nexport type MastraArgs = NonNullable<ConstructorParameters<typeof Mastra>[0]>;\n\nexport interface MastraFactoryConfig {\n  /**\n   * Auth provider instance — `MastraAuthStudio` (`@mastra/auth-studio`),\n   * `MastraAuthWorkos` (`@mastra/auth-workos`), `MastraAuthBetterAuth`\n   * (`@mastra/auth-better-auth`), or any custom `MastraAuthProvider`. Whatever\n   * instance is passed is the active provider; a passed instance is always\n   * honored as-is.\n   *\n   * Omitted → the factory defaults to `MastraAuthStudio`, proxying auth\n   * through the shared Mastra platform API. `MastraAuthStudio` resolves its\n   * own env (`MASTRA_SHARED_API_URL`, `MASTRA_ORGANIZATION_ID`,\n   * `MASTRA_COOKIE_DOMAIN`).\n   *\n   * Pass `null` to disable auth entirely (open server, local-dev behavior)\n   * without falling back to the default.\n   */\n  auth?: IMastraAuthProvider | null;\n  /**\n   * REQUIRED. Factory storage backend powering BOTH agent storage (threads,\n   * messages, memory, OM — via `getMastraStorage()`) and the app tables\n   * (projects/source-control/audit/intake — via the generic ops surface). Pass a\n   * `PgFactoryStorage` (`@mastra/pg`) for deployments or a\n   * `LibSQLFactoryStorage` (`@mastra/libsql`) for local dev — one backend,\n   * one connection, every feature on.\n   */\n  storage: FactoryStorage;\n  /**\n   * Vector store instance for recall search — `PgVector` (`@mastra/pg`) on\n   * the same database as `storage`. Omitted → the SDK mount's default vector\n   * store resolution applies.\n   */\n  vector?: MastraVector;\n  /**\n   * Distributed event bus instance (e.g. `new RedisStreamsPubSub({ url })`).\n   * When set, streams/workflows/signals ride it across processes and the\n   * controller drops file-based thread locks in favor of pubsub-coordinated\n   * leases. Omitted → in-process default.\n   */\n  pubsub?: PubSub;\n  /**\n   * Browser-facing origin used to build integration OAuth/install callback\n   * URLs and to derive the auth redirect URI. On the platform the SPA is\n   * hosted separately, so this MUST be the public API origin.\n   * Default: `http://localhost:4111` (the local Factory server, which also\n   * serves the UI).\n   */\n  publicUrl?: string;\n  /**\n   * Allowed cross-origin SPA origins. The SPA may be served from a separate\n   * static host, so credentialed requests must be explicitly allowed.\n   */\n  allowedOrigins?: string[];\n  /** Sandbox configuration. Omitted → repository sandboxes are disabled. */\n  sandbox?: MastraFactorySandboxConfig;\n  /**\n   * When a session's sandbox boots: on the agent's first command (`'lazy'`,\n   * the default) or as soon as the session's workspace is first resolved\n   * (`'eager'`), so the boot overlaps the model's own latency.\n   */\n  sandboxStart?: FactorySandboxStart;\n  /** Background Factory dispatcher configuration. */\n  dispatcher?: MastraFactoryDispatcherConfig;\n  /**\n   * Deployment-stable secret for signing integration OAuth `state` values.\n   * Omitted → a per-process random secret, which is fine for single-process\n   * local development but rejected for integrations that declare\n   * `requiresStableStateSigner`.\n   */\n  stateSecret?: string;\n  /**\n   * Encryption boundary for persisted model credentials, custom-provider API\n   * keys, integration connections, and integration settings. Strongly\n   * recommended whenever auth is enabled — omitting it falls back to explicit\n   * plaintext compatibility with a boot-time warning.\n   */\n  secretEncryption?: FactorySecretEncryption;\n  /**\n   * Registered capability providers. The factory registers the pieces each\n   * `FactoryIntegration` instance provides — HTTP routes, storage domains,\n   * agent/session tools, intake, source control, and diagnostics — into the\n   * system. When Platform credentials are configured, missing `github` and\n   * `linear` integrations default to their Platform-backed implementations.\n   */\n  integrations?: FactoryIntegration[];\n  /**\n   * Operator-maintained provenance label stamped on transition audit rows,\n   * deferred decisions, and session kickoff headers so a row can be traced\n   * back to the deployment that produced it. Nothing branches on it.\n   * Default: `factory-config-v1`.\n   */\n  configVersion?: string;\n  /** Board definitions installed for this Factory instance. */\n  boards?: readonly InstalledBoard[];\n  /** Whether the built-in Work and Review boards are installed. Default: true. */\n  includeDefaultBoards?: boolean;\n\n  /**\n   * Platform-specific overrides. `githubAppSlug` identifies Factory's own\n   * GitHub App writes so their webhook deliveries do not retrigger triage.\n   */\n  platform?: {\n    githubAppSlug?: string;\n  };\n}\n\nexport type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';\nexport type { FactorySandboxStart } from './workspace.js';\n\n/**\n * Per-process cap on concurrent background Factory dispatches. Omitted means\n * the dispatcher default; this is a local replica budget, not a global queue\n * limit shared across deployments.\n */\nexport interface MastraFactoryDispatcherConfig {\n  maxInFlight?: number;\n}\n\nconst CONTROLLER_ID = 'code';\n\nfunction hasPlatformCredentials(): boolean {\n  // MASTRA_PLATFORM_ACCESS_TOKEN is the credential Mastra Platform injects\n  // into deployed projects; MASTRA_PLATFORM_SECRET_KEY is the org secret key\n  // written by project scaffolding. Either enables the platform integrations.\n  return Boolean(process.env.MASTRA_PLATFORM_ACCESS_TOKEN?.trim() || process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());\n}\n\n/**\n * Default auth provider — `MastraAuthStudio`, which proxies identity to the\n * shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,\n * `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —\n * this helper only derives a cookie-domain fallback from the factory's\n * `publicUrl`.\n *\n * Cookie-domain resolution (Studio picks the first that wins):\n *   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;\n *   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;\n *   3. this parent-domain fallback derived from `publicUrl` — so a deploy on\n *      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`\n *      without the caller wiring the env var by hand.\n *   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.\n */\nfunction buildDefaultStudioAuth(publicUrl: string): IMastraAuthProvider {\n  return new MastraAuthStudio({\n    cookieDomain: parentDomainFromPublicUrl(publicUrl),\n  });\n}\n\n/**\n * Derive a parent cookie domain from `publicUrl` by stripping the leftmost\n * label — the same shape platform-API's env injection uses (see\n * `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\\./, '')}`).\n *\n * Rather than a generic `strip-left-label` heuristic — which either emits\n * cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`\n * requires PSL data to be safe) or misclassifies numeric hostnames like\n * `3scale.example.com` as IPv4 — we only derive a parent domain when the\n * host sits under one of the platform's known registrable domains. Anything\n * else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)\n * falls through to host-only cookies. Callers that need a different scope\n * pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).\n */\nconst KNOWN_PLATFORM_COOKIE_PARENTS = ['mastra.cloud', 'mastra.ai'] as const;\n\nfunction isIpLiteral(hostname: string): boolean {\n  // IPv6 addresses in URLs are bracketed; `URL.hostname` strips the brackets\n  // but the address itself still contains `:`. IPv4 is four dot-separated\n  // numeric octets — trust the parser to have already validated shape.\n  if (hostname.includes(':')) return true;\n  return /^\\d+(?:\\.\\d+){3}$/.test(hostname);\n}\n\nfunction parentDomainFromPublicUrl(publicUrl: string): string | undefined {\n  let hostname: string;\n  try {\n    hostname = new URL(publicUrl).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (hostname === 'localhost' || isIpLiteral(hostname)) return undefined;\n  for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {\n    // Exact match → we're already on the parent, host-only is correct.\n    // Subdomain match → mint the parent-scoped cookie.\n    if (hostname === parent) return undefined;\n    if (hostname.endsWith(`.${parent}`)) return `.${parent}`;\n  }\n  return undefined;\n}\n\n/** A session parking or being answered is inbox news, so the registry bumps the project's feed. */\nfunction liveSessionsTouchingTheFeed(controller: BuildApiRoutesDeps['controller'], eventBus: PubSub): LiveSessions {\n  const liveSessions = new LiveSessions(controller);\n  liveSessions.onParkedChanged(session => {\n    const { factoryOrgId, factoryProjectId } = session.state.get();\n    if (factoryOrgId && factoryProjectId) touchFeed(eventBus, { orgId: factoryOrgId, factoryProjectId });\n  });\n  return liveSessions;\n}\n\nexport class MastraFactory {\n  readonly #config: MastraFactoryConfig;\n  readonly #boards: BoardRegistry;\n  readonly #configVersion: string;\n  #prepared: Awaited<ReturnType<typeof prepareAgentControllerMount>> | undefined;\n  #dispatcher: FactoryDecisionDispatcher | undefined;\n  #factoryProcessor: FactoryPhaseStateProcessor | undefined;\n  #preparing = false;\n\n  constructor(config: MastraFactoryConfig) {\n    if (!config?.storage) {\n      throw new Error(\n        \"MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. \" +\n          \"new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or \" +\n          \"new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.\",\n      );\n    }\n    this.#boards = createBoardRegistry({\n      boards: config.boards,\n      includeDefaultBoards: config.includeDefaultBoards,\n    });\n    if ('rules' in config) {\n      throw new Error(\n        \"MastraFactory: 'rules' was removed. Set 'configVersion' for the audit label and declare tool-result \" +\n          'rules on the owning board via defineBoard({ tools }).',\n      );\n    }\n    this.#configVersion = assertFactoryConfigVersion(config.configVersion ?? DEFAULT_FACTORY_CONFIG_VERSION);\n    this.#config = config;\n  }\n\n  /**\n   * Resolve feature readiness, wire every dependency explicitly, and assemble\n   * everything needed to construct the server-owned Mastra. Returns the args\n   * for the `new Mastra(...)` literal that must live in the entry file.\n   */\n  async prepare(): Promise<MastraArgs> {\n    // Guard set synchronously (before the first await) so overlapping calls —\n    // not just strictly sequential ones — can't double-seed the runtime\n    // registry or double-run one-time adapter init.\n    if (this.#preparing) throw new Error('MastraFactory.prepare() called twice');\n    this.#preparing = true;\n\n    const publicOrigin = (this.#config.publicUrl ?? 'http://localhost:4111').replace(/\\/+$/, '');\n    const allowedOrigins = (this.#config.allowedOrigins ?? []).map(o => o.replace(/\\/+$/, '')).filter(Boolean);\n    const storage = this.#config.storage;\n    const vector = this.#config.vector;\n    const pubsub = this.#config.pubsub;\n    // One bus for feed/attention events: a second fallback instance would leave\n    // SSE subscribers and producers on different emitters in single-process runs.\n    const eventBus = pubsub ?? new EventEmitterPubSub();\n    // Default auth: honor an explicitly-passed provider (including `null` to\n    // disable auth) as-is; otherwise fall back to `MastraAuthStudio`\n    // (platform-proxied identity). The default derives its cookie domain\n    // from `publicUrl` — deploys on `<sub>.mastra.cloud` mint parent-domain\n    // cookies without the caller wiring `MASTRA_COOKIE_DOMAIN` explicitly.\n    const configuredAuth = this.#config.auth;\n    const auth: IMastraAuthProvider | undefined =\n      configuredAuth === null ? undefined : (configuredAuth ?? buildDefaultStudioAuth(publicOrigin));\n    if (auth && !this.#config.secretEncryption) {\n      console.warn(\n        \"[factory] auth is enabled but 'secretEncryption' is not configured. Persisted model credentials, \" +\n          'custom-provider API keys, and integration secrets will be stored as plaintext. Provide ' +\n          \"'secretEncryption' (e.g. via FACTORY_CREDENTIAL_ENCRYPTION_KEY) to encrypt them at rest.\",\n      );\n    }\n    const secretEncryption = this.#config.secretEncryption ?? createPlaintextFactorySecretEncryption();\n    // One RouteAuth seam per boot, closed over the resolved provider. Every\n    // factory route module receives this handle — no service locator.\n    const routeAuth = createFactoryRouteAuth(auth);\n\n    // Explicit integrations win. Platform credentials fill only missing\n    // provider slots so callers can override each integration independently.\n    const integrations = [...(this.#config.integrations ?? [])];\n    if (hasPlatformCredentials()) {\n      if (!integrations.some(integration => integration.id === 'github')) {\n        integrations.push(new PlatformGithubIntegration({ slug: this.#config.platform?.githubAppSlug }));\n      }\n      if (\n        process.env.MASTRA_INCIDENT_IO_CONNECTION_ID?.trim() &&\n        !integrations.some(integration => integration.id === 'incidentio')\n      ) {\n        integrations.push(new PlatformIncidentioIntegration());\n      }\n      if (!integrations.some(integration => integration.id === 'linear')) {\n        integrations.push(new PlatformLinearIntegration());\n      }\n    }\n\n    // Validate ids up front so a copy-paste duplicate fails loud instead of one\n    // instance silently shadowing the other.\n    const integrationIds = new Set<string>();\n    for (const integration of integrations) {\n      if (integrationIds.has(integration.id)) {\n        throw new Error(`MastraFactory: duplicate integration id '${integration.id}' in 'integrations'.`);\n      }\n      integrationIds.add(integration.id);\n    }\n    const configVersion = this.#configVersion;\n\n    // FactoryStorage owns every app-table domain and initializes them through\n    // the same lifecycle as the backend connection.\n    const intakeStorage = storage.registerDomain(new IntakeStorage());\n    const auditStorage = storage.registerDomain(new AuditStorage());\n    const workItemsStorage = storage.registerDomain(new WorkItemsStorage());\n    workItemsStorage.onAttentionChanged(scope => touchFeed(eventBus, scope));\n    workItemsStorage.useTerminalPhasePredicate(item => workItemPhaseSemantics(this.#boards, item)?.kind === 'terminal');\n    const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage(secretEncryption));\n    const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());\n    const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());\n    const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage(secretEncryption));\n    const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());\n    // Generic integration storage (connections/subscriptions/settings) — the\n    // default persistence surface for integrations without a bespoke domain.\n    const integrationStorage = storage.registerDomain(new IntegrationStorage(secretEncryption));\n    const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());\n    const filesystemStorage = storage.registerDomain(new FilesystemStorage());\n    const sourceControlStorage = storage.registerDomain(new SourceControlStorage());\n    // Reverse index from a platform sender (Slack/Discord/...) to a Mastra\n    // tenant, so inbound channel events can resolve the sender's model creds.\n    const channelIdentityStorage = storage.registerDomain(new ChannelIdentityStorage());\n    const workItemCommentsStorage = storage.registerDomain(new WorkItemCommentsStorage());\n    // Every app-table domain handle the route builders and integrations need,\n    // threaded explicitly (no service locator).\n    const domains = {\n      intake: intakeStorage,\n      modelCredentials: modelCredentialsStorage,\n      modelPacks: modelPacksStorage,\n      memorySettings: memorySettingsStorage,\n      customProviders: customProvidersStorage,\n      filesystem: filesystemStorage,\n      projects: factoryProjectsStorage,\n      queueHealth: queueHealthStorage,\n      workItems: workItemsStorage,\n      channelIdentity: channelIdentityStorage,\n      comments: workItemCommentsStorage,\n    };\n    const auditDomain = new AuditDomain({\n      auth: routeAuth,\n      audit: auditStorage,\n      projects: factoryProjectsStorage,\n      users: auth && isUserProvider(auth) ? auth : undefined,\n      sinks: integrations,\n      agentTenant: requestContext => {\n        const user = getFactoryAuthUserFromContext(requestContext);\n        return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n      },\n    });\n    // Held by reference: the channel attach below pushes into it, long after this.\n    const feedPublishers: WorkItemFeedPublisher[] = [];\n    const commentsDomain = new CommentsDomain({\n      auth: routeAuth,\n      comments: workItemCommentsStorage,\n      workItems: workItemsStorage,\n      projects: factoryProjectsStorage,\n      channelIdentity: channelIdentityStorage,\n      audit: auditDomain,\n      publishers: feedPublishers,\n      pubsub: eventBus,\n    });\n\n    // The sandbox config is a bare callback constructing a session's sandbox\n    // from intent. Shape-only validation: probing it with a synthetic ctx at\n    // boot would construct against a fake session, so only the type is\n    // checked.\n    const sandboxConfig = this.#config.sandbox;\n    if (sandboxConfig !== undefined && typeof sandboxConfig !== 'function') {\n      // An object here is almost certainly the pre-callback config, which\n      // described a fleet the factory managed itself. That fleet is gone:\n      // sandboxes are per session and the host constructs them, so say what to\n      // write instead rather than only naming the expected type.\n      if (typeof sandboxConfig === 'object' && sandboxConfig !== null) {\n        throw new Error(\n          `MastraFactory: 'sandbox' is now a callback, not an options object. It receives a FactorySandboxContext and returns a MastraSandbox, so the host chooses the provider per session:\\n` +\n            `  sandbox: ctx => new E2BSandbox({ id: ctx.sessionId })\\n` +\n            `The old options map three ways: 'machine' becomes the provider instance you construct inside the callback (one per session instead of one cloned template); 'workdir' is gone — remote providers clone into the VM's home directory and local providers check out under their own workingDirectory; 'maxSandboxes' is gone with the sandbox fleet — there is one sandbox per session and no pool to cap. Omit 'sandbox' entirely to disable sandboxes.`,\n        );\n      }\n      throw new Error(\n        `MastraFactory: 'sandbox' must be a function constructing a MastraSandbox from a FactorySandboxContext.`,\n      );\n    }\n\n    const workspaceRegistry = new FactoryWorkspaceRegistry();\n\n    // One shared OAuth state signer per boot. The deploy entry supplies a\n    // replica-stable secret when needed; otherwise local development gets a\n    // per-process random signer (`stable: false`).\n    const stateSigner = createStateSigner(this.#config.stateSecret);\n\n    // One-time provider initialization with factory-level context (e.g.\n    // better-auth builds its default instance on the backend's auth\n    // database, WorkOS derives its redirect URI from the public URL).\n    // Failures surface here, at prepare() — a misconfigured provider must\n    // not boot.\n    if (auth && hasAuthInit(auth)) {\n      await timedPhase('prepare.auth.init', () =>\n        auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins }),\n      );\n    }\n\n    // Single init path: backend connection failure is a hard boot error;\n    // registered app domains initialize fail-soft inside FactoryStorage.\n    await timedPhase('prepare.storage.init', () => storage.init());\n\n    // Per-tenant model credentials: once the credentials domain is up, model\n    // resolution goes through the caller's own store and the SDK stops\n    // mirroring stored API keys into process.env.\n    //\n    // Only register when a real auth adapter gates callers. In local /\n    // auth-disabled mode there is no authenticated tenant, so registering would\n    // force every model call through an empty tenant store (fail-closed, no env\n    // fallback) and break chat with \"Not logged in\". Leaving it unregistered\n    // lets the SDK fall back to the file-backed AuthStorage (auth.json) — the\n    // same store the local /login and Settings pages read and write.\n    if (auth) {\n      registerTenantCredentialResolver(modelCredentialsStorage);\n    }\n\n    // Custom providers: DB-backed in both modes (org rows in tenant mode, the\n    // sentinel `local` org in no-auth mode). Once registered, model resolution\n    // and the gateway catalog never read settings.json custom providers.\n    registerCustomProvidersSource({ storage: customProvidersStorage, authEnabled: Boolean(auth) });\n\n    for (const integration of integrations) {\n      integration.initialize?.({\n        storage: integrationStorage.forIntegration(integration.id),\n        projects: factoryProjectsStorage,\n        auth: routeAuth,\n      });\n      if (integration.versionControl) {\n        integration.versionControl.initialize({\n          storage: sourceControlStorage.forIntegration(integration.id),\n        });\n      }\n    }\n\n    // Every integration uses generic integration storage. Version-control\n    // providers additionally require the source-control storage domain. Readiness\n    // is derived solely from capability presence, never from provider ids.\n    const integrationRegistrations = integrations.map(integration => {\n      const requiredDomains = [\n        'integrations',\n        ...(integration.versionControl ? ['source-control'] : []),\n        // Channels resolve an inbound sender to a tenant through the reverse\n        // index; without it every message would dispatch tenant-less.\n        ...(integration.channels ? ['channel-identity'] : []),\n      ];\n      return {\n        integration,\n        ready: requiredDomains.every(domain => storage.isDomainReady(domain)),\n        ensureReady: async () => {\n          for (const domain of requiredDomains) await storage.ensureDomainReady(domain);\n        },\n      };\n    });\n    const intakeReady =\n      integrations.some(integration => integration.intake !== undefined) && storage.isDomainReady('intake');\n    const factoryReady = storage.isDomainReady('projects') && storage.isDomainReady('work-items');\n    const knowledgeEnabled = process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === '1';\n    const githubIntegration = integrations.find(integration => integration.id === 'github') as\n      | GithubIntegration\n      | undefined;\n    const workItemsReady = storage.isDomainReady('work-items');\n    const sessionRetirement =\n      sandboxConfig && storage.isDomainReady('source-control')\n        ? new SessionRetirementCoordinator({\n            invalidateSession: sessionId => workspaceRegistry.invalidateSession(sessionId),\n          })\n        : undefined;\n    const retireTerminalSessions =\n      sessionRetirement && githubIntegration && workItemsReady\n        ? async ({ orgId, workItemId }: { orgId: string; workItemId: string }) =>\n            sessionRetirement.retireWorkItemSessions({\n              workItems: workItemsStorage,\n              sourceControl: sourceControlStorage.forIntegration(githubIntegration.id),\n              orgId,\n              workItemId,\n            })\n        : undefined;\n    // Terminal-stage cleanup: ingest any trailing tool results from the item's\n    // bound threads, then revoke the bindings so completed items leave the\n    // reconcile walk (the active-binding set otherwise grows forever), and\n    // finally release the item's sandboxes. Each step is best-effort — a\n    // committed transition never fails on cleanup.\n    const onTerminalStage = workItemsReady\n      ? createTerminalStageCleanup({\n          workItems: workItemsStorage,\n          // `factoryProcessor` is assigned below in this scope; the cleanup\n          // only runs on transitions long after bootstrap completes.\n          reconcileBinding: async (binding): Promise<void> => {\n            await factoryProcessor?.reconcileBinding(binding);\n          },\n          // Session retirement supersedes the older direct sandbox release: it\n          // invalidates the session and stops/destroys its sandbox.\n          ...(retireTerminalSessions ? { releaseSandboxes: retireTerminalSessions } : {}),\n        })\n      : retireTerminalSessions;\n    const transitionService = workItemsReady\n      ? new FactoryTransitionService({\n          configVersion,\n          boards: this.#boards,\n          storage: workItemsStorage,\n          audit: auditDomain,\n          ...(onTerminalStage ? { onTerminalStage } : {}),\n          ...(githubIntegration\n            ? {\n                onAccepted: (args: { orgId: string; factoryProjectId: string; item: WorkItemRow }) =>\n                  reconcileGithubAcceptanceLabels(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration(githubIntegration.id),\n                    args,\n                  ),\n              }\n            : {}),\n        })\n      : undefined;\n    const projectRoutes = new ProjectRoutes({\n      auth: routeAuth,\n      projects: factoryProjectsStorage,\n      sourceControl: sourceControlStorage,\n      versionControlIntegrationIds: integrations\n        .filter(integration => integration.versionControl)\n        .map(integration => integration.id),\n      ...(githubIntegration\n        ? {\n            resolveRepository: async ({ integrationId, orgId, installationId, externalId, slug }) => {\n              if (integrationId !== githubIntegration.id) return null;\n              const installation = await githubIntegration.sourceControlStorage.installations.get({\n                orgId,\n                id: installationId,\n              });\n              if (!installation) return null;\n              const repositories = await githubIntegration.listInstallationRepos(Number(installation.externalId));\n              const selected = repositories.find(repo => repo.id.toString() === externalId && repo.fullName === slug);\n              if (!selected) return null;\n              return githubIntegration.sourceControlStorage.repositories.upsert({\n                orgId,\n                input: {\n                  installationId,\n                  externalId,\n                  slug: selected.fullName,\n                  defaultBranch: isValidGitRef(selected.defaultBranch) ? selected.defaultBranch : 'main',\n                  providerMetadata: { private: selected.private, owner: selected.owner },\n                },\n              });\n            },\n          }\n        : {}),\n      ...(sessionRetirement ? { sessionRetirement } : {}),\n      ...(workItemsReady ? { workItems: workItemsStorage } : {}),\n    });\n    const factoryProcessor = workItemsReady\n      ? new FactoryPhaseStateProcessor({\n          configVersion,\n          storage: workItemsStorage,\n          boards: this.#boards,\n          ...(transitionService ? { transitionService } : {}),\n          ...(githubIntegration\n            ? {\n                recordPullRequestProvenance: (input: Parameters<typeof recordFactoryPullRequestProvenance>[4]) =>\n                  recordFactoryPullRequestProvenance(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration('github'),\n                    integrationStorage.forIntegration('github'),\n                    workItemsStorage,\n                    input,\n                  ),\n              }\n            : {}),\n          messageReader: {\n            listMessages: async input => {\n              const memory = await storage.getMastraStorage().getStore('memory');\n              return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n            },\n          },\n        })\n      : undefined;\n\n    // Boot assertion: an active integration that signs OAuth `state` needs a\n    // replica-stable signer — a per-process random secret silently breaks the\n    // OAuth callback on any replica that didn't sign the state. Fail loud now\n    // instead. (The built-ins also assert this inside their readiness gates.)\n    for (const { integration } of integrationRegistrations) {\n      if (integration.requiresStableStateSigner && !stateSigner.stable) {\n        throw new Error(\n          `MastraFactory: integration '${integration.id}' signs OAuth state and requires a ` +\n            `replica-stable state secret, but none is configured. Set 'stateSecret' on the factory config.`,\n        );\n      }\n    }\n\n    // The SDK needs to know which backend the injected Mastra store uses\n    // (its own `instanceof` detection breaks when the dependency graph holds\n    // duplicate package copies). Resolve it by walking the FactoryStorage\n    // prototype chain by class name — the factory can't import the concrete\n    // classes since '@mastra/pg' / '@mastra/libsql' are the user's choice.\n    const mastraStorageBackend = (() => {\n      for (let proto = Object.getPrototypeOf(storage); proto; proto = Object.getPrototypeOf(proto)) {\n        if (proto.constructor?.name === 'PgFactoryStorage') return 'pg' as const;\n        if (proto.constructor?.name === 'LibSQLFactoryStorage') return 'libsql' as const;\n      }\n      return undefined;\n    })();\n\n    // Integrations contributing tools to agent sessions: org-scoped\n    // `agentTools` (resolved per request) + session-scoped `sessionTools`.\n    const toolIntegrations = integrationRegistrations.filter(\n      ({ integration }) => integration.agentTools || integration.sessionTools,\n    );\n\n    // Build the real production controller (agents, modes, tools, memory, OM,\n    // MCP, providers) — identical to the terminal app. Agent state lives in\n    // the storage backend's Mastra store alongside the Factory app tables —\n    // one shared database for all users, separated by `resourceId` scoping.\n    const prepared = await timedPhase('prepare.controllerMount', () =>\n      prepareAgentControllerMount({\n        controllerId: CONTROLLER_ID,\n        coAuthor: { name: 'mastra-platform[bot]' },\n        workspace: createWorkspaceFactory({\n          ...(sandboxConfig ? { sandbox: sandboxConfig } : {}),\n          ...(this.#config.sandboxStart ? { sandboxStart: this.#config.sandboxStart } : {}),\n          ...(githubIntegration ? { github: githubIntegration } : {}),\n          ...(factoryProjectsStorage ? { projects: factoryProjectsStorage } : {}),\n          ...(workItemsStorage ? { workItems: workItemsStorage } : {}),\n          workspaceRegistry,\n        }),\n        disableGithubSignals: true,\n        // Memory settings live in the factory's `memory-settings` app table (per\n        // org/user), so the host machine's TUI settings.json must not seed them.\n        disableSettingsOmSeed: true,\n        hostInstructions: ({ requestContext }) => {\n          const context = requestContext.get('controller') as\n            | AgentControllerRequestContext<MastraCodeState>\n            | undefined;\n          return parseSupervisorResourceId(context?.resourceId) ? SUPERVISOR_INSTRUCTIONS : undefined;\n        },\n        // A factory reads the repository it works on and its skill, never the\n        // ~/.claude instructions of whoever hosts the process. On the controller\n        // rather than per session, so webhook-recreated sessions keep it too.\n        // Blank project identity for the same reason: the SDK's defaults seed\n        // sessions with the HOST process's own project root / name / branch,\n        // which must never reach a hosted session's prompt. Repo-backed\n        // sessions get their real workdir pinned by workspace resolution;\n        // chat-only sessions legitimately have no project.\n        // Factory sessions also start fail-closed on org classification: the\n        // unresolved marker is set at birth, a successful org seed clears it,\n        // and a resolved `factoryOrgId` always takes precedence — so a failed\n        // (best-effort) seed can never leave a session classified as local.\n        initialState: {\n          skipGlobalInstructions: true,\n          factoryOrgUnresolved: true,\n          projectPath: '',\n          projectName: '',\n          gitBranch: '',\n        },\n        storage: storage.getMastraStorage(),\n        ...(mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {}),\n        ...(factoryProcessor ? { inputProcessors: [factoryProcessor] } : {}),\n        ...(vector ? { vector } : {}),\n        ...(toolIntegrations.length > 0 || (workItemsStorage && transitionService)\n          ? {\n              extraTools: async ({ requestContext }: { requestContext: RequestContext }) => {\n                const tools: IntegrationTools = {};\n                const toolOwners = new Map<string, string>();\n                const mergeTools = (ownerId: string, contributed: IntegrationTools) => {\n                  for (const [name, tool] of Object.entries(contributed)) {\n                    const owner = toolOwners.get(name);\n                    if (owner) {\n                      throw new Error(\n                        `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`,\n                      );\n                    }\n                    toolOwners.set(name, ownerId);\n                    tools[name] = tool;\n                  }\n                };\n                if (workItemsStorage && transitionService) {\n                  mergeTools(\n                    'factory',\n                    await createFactoryTransitionTools({\n                      requestContext,\n                      storage: workItemsStorage,\n                      transitionService,\n                      // Heals crash-resumed sessions: recovered addresses re-seed\n                      // projectRepositoryId/baseRef from the source session record.\n                      // Only offered while the source-control domain is ready — a\n                      // throwing lookup would abort recovery's catch block and also\n                      // skip the metadata baseRef fallback.\n                      ...(storage.isDomainReady('source-control')\n                        ? { sessions: sourceControlStorage.forIntegration('github').sessions }\n                        : {}),\n                    }),\n                  );\n                  // The supervisor session has no seat, so it never gets the\n                  // transition tool above; it gets the read surface instead,\n                  // and only once the caller's org is shown to own the project.\n                  const supervisorScope = await resolveSupervisorScope({\n                    requestContext,\n                    projects: factoryProjectsStorage,\n                  });\n                  if (supervisorScope) {\n                    const userId = getFactoryAuthUserId(getFactoryAuthUserFromContext(requestContext));\n                    mergeTools(\n                      'factory-supervisor',\n                      createFactorySupervisorReadTools({\n                        scope: supervisorScope,\n                        workItems: workItemsStorage,\n                        boards: this.#boards,\n                        comments: workItemCommentsStorage,\n                        audit: auditStorage,\n                        messageReader: {\n                          listMessages: async input => {\n                            const memory = await storage.getMastraStorage().getStore('memory');\n                            return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n                          },\n                        },\n                      }),\n                    );\n                    if (userId) {\n                      mergeTools(\n                        'factory-supervisor-write',\n                        createFactorySupervisorWriteTools({\n                          scope: supervisorScope,\n                          userId,\n                          workItems: workItemsStorage,\n                          audit: auditDomain,\n                          transitionService,\n                          ...(githubIntegration\n                            ? {\n                                reconcileAcceptanceLabels: (args: {\n                                  orgId: string;\n                                  factoryProjectId: string;\n                                  item: WorkItemRow;\n                                }) =>\n                                  reconcileGithubAcceptanceLabels(\n                                    githubIntegration,\n                                    sourceControlStorage.forIntegration(githubIntegration.id),\n                                    args,\n                                  ),\n                              }\n                            : {}),\n                          signalSession: async ({ sessionId, message }) => {\n                            const session = await prepared.base.controller.getSessionByResource(sessionId);\n                            if (!session) throw new Error('The worker session is not currently available.');\n                            await session.sendMessage({\n                              content: message,\n                              ...(requestContext ? { requestContext } : {}),\n                            });\n                          },\n                        }),\n                      );\n                    }\n                  }\n                }\n                for (const { integration, ready, ensureReady } of toolIntegrations) {\n                  if (!ready && ensureReady) {\n                    try {\n                      await ensureReady();\n                    } catch {\n                      continue;\n                    }\n                  }\n                  if (integration.agentTools) {\n                    mergeTools(integration.id, await integration.agentTools({ requestContext }));\n                  }\n                  if (integration.sessionTools) {\n                    mergeTools(integration.id, integration.sessionTools({ requestContext }));\n                  }\n                }\n                return tools;\n              },\n            }\n          : {}),\n        postToolObserver: async (toolContext: IntegrationPostToolContext) => {\n          const requestContext = (toolContext.context as { requestContext?: RequestContext } | undefined)\n            ?.requestContext;\n          if (requestContext) {\n            await observeAgentGitAction({\n              audit: auditDomain,\n              toolContext: { ...toolContext, context: requestContext },\n            });\n          }\n          await Promise.all(\n            integrations.map(async integration => {\n              if (!integration.postToolObserver) return;\n              try {\n                await integration.postToolObserver({ toolContext, requestContext });\n              } catch (error) {\n                console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);\n              }\n            }),\n          );\n        },\n        ...(pubsub ? { pubsub, crossProcessPubSub: true } : {}),\n        buildApiRoutes: ({ controller, authStorage }: BuildApiRoutesDeps) => [\n          // Public `/auth/*` routes (login/callback/logout/me). Folded in as\n          // `apiRoutes` (not plain Hono routes) because the entry can't touch the\n          // Hono app the deployer generates. `requiresAuth: false`; the gate\n          // skips `/auth/*`.\n          ...(auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : []),\n          ...new TelemetryRoutes({ auth: routeAuth, providerName: auth?.name, publicOrigin, allowedOrigins }).routes(),\n          // Custom `/web/*` routes (fs / config / integrations / factory / audit).\n          ...assembleFactoryApiRoutes({\n            controllerId: CONTROLLER_ID,\n            controller,\n            liveSessions: liveSessionsTouchingTheFeed(controller, eventBus),\n            auth: routeAuth,\n            ...(auth && isUserProvider(auth) ? { users: auth } : {}),\n            authStorage,\n            audit: auditDomain,\n            publicOrigin,\n            stateSigner,\n            sandbox: sandboxConfig,\n            sessionRetirement,\n            factoryStorage: storage,\n            integrationStorage,\n            sourceControlStorage,\n            domains,\n            feed: commentsDomain,\n            integrations: integrationRegistrations,\n            intakeReady,\n            factoryReady,\n            knowledgeEnabled,\n            configVersion,\n            boardRegistry: this.#boards,\n            factoryTransitionService: transitionService,\n            onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {\n              this.#dispatcher ??= new FactoryDecisionDispatcher({\n                controller,\n                transitionService: runtimeTransitionService,\n                storage: storage.getDomain<WorkItemsStorage>('work-items'),\n                audit: auditDomain,\n                boards: this.#boards,\n                maxInFlight: this.#config.dispatcher?.maxInFlight,\n                isAutoRunEnabled: async ({ orgId, factoryProjectId }) => {\n                  await factoryProjectsStorage.ensureReady();\n                  const project = await factoryProjectsStorage.get({ orgId, id: factoryProjectId });\n                  return project?.autoRunEnabled ?? false;\n                },\n                autoApprovePlans: async ({ orgId, factoryProjectId }) => {\n                  await factoryProjectsStorage.ensureReady();\n                  const project = await factoryProjectsStorage.get({ orgId, id: factoryProjectId });\n                  return project?.autoApprovePlans ?? false;\n                },\n                reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n                prepareBinding,\n                feedReader: new FactoryFeedReader(workItemCommentsStorage),\n                primeCredentials: tenant => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage }),\n                resolveLinkedWorkItemParentId: async ({ orgId, factoryProjectId, decision }) => {\n                  if (decision.source !== 'github-pr') return null;\n                  const repositoryId = decision.metadata?.githubRepositoryId;\n                  const pullRequestNumber = decision.metadata?.githubPullRequestNumber;\n                  if (typeof repositoryId !== 'number' || typeof pullRequestNumber !== 'number') return null;\n                  return resolveFactoryPullRequestParentWorkItemId(\n                    integrationStorage.forIntegration<\n                      Record<string, unknown>,\n                      Record<string, unknown>,\n                      FactoryPullRequestProvenanceData\n                    >('github'),\n                    { orgId, factoryProjectId, repositoryId, pullRequestNumber },\n                  );\n                },\n              });\n            },\n          }),\n          ...projectRoutes.routes(),\n          ...auditDomain.routes(),\n          ...commentsDomain.routes(),\n        ],\n        buildServerConfig: () => {\n          const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};\n          // Log route errors with method/path/stack and answer with structured\n          // JSON instead of an opaque `Internal Server Error`. Applied by the\n          // deployer to both the top-level app and the custom-route sub-app.\n          const onError = { onError: handleServerError };\n          // Same-origin SPA: when a vite build is present (see resolveUiDistDir),\n          // serve it at `/` from this server. Mounted last so the auth gate (when\n          // enabled) covers it; it always passes `/api`, `/web`, `/auth` through.\n          const uiDist = resolveUiDistDir();\n          const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];\n          if (!auth) {\n            // Auth disabled: no gate. Still prime the sentinel-local custom\n            // provider snapshot so model calls see DB rows, then SPA + CORS.\n            return {\n              middleware: [\n                createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),\n                ...spa,\n              ],\n              ...cors,\n              ...onError,\n            };\n          }\n\n          // Ordered middleware. The deployer applies these AFTER its context\n          // middleware sets `c.set('mastra', mastra)` and BEFORE routes, so:\n          //   1. gate   — validates the auth session, stashes the user, and 401s /\n          //               redirects unauthenticated requests. Skips public `/auth/*`.\n          //   2. primers — hydrate the caller's model-credential and custom\n          //               provider snapshots so the request's first model call\n          //               resolves tenant credentials and custom providers.\n          //   3. spa    — serves the built UI for everything the server doesn't own.\n          // `auth` also lands on `server.auth` so the core auth middleware (and\n          // Studio's dual-auth routing — see `studio.auth` on the returned args)\n          // authenticates core `/api/*` routes with the same provider.\n          return {\n            auth,\n            middleware: [\n              createFactoryAuthGate(auth),\n              createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),\n              createCustomProvidersPrimer({\n                auth: routeAuth,\n                storage: customProvidersStorage,\n                authEnabled: Boolean(auth),\n              }),\n              ...spa,\n            ],\n            ...cors,\n            ...onError,\n          };\n        },\n      }),\n    );\n\n    prepared.base.controller.onSessionCreated(session => {\n      observeSessionFilesystem(session, {\n        filesystem: filesystemStorage,\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionFirstMessage(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionFirstExec(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionThreadTitle(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionRunEnd(session, { audit: auditDomain });\n    });\n\n    // Supervisor sessions carry their project in the resourceId; re-stamp\n    // scope, instructions and factory defaults on every (re)creation so a\n    // restarted server heals the in-memory state.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSupervisorSession(session, {\n          projects: factoryProjectsStorage,\n          memorySettings: memorySettingsStorage,\n        }).catch(error => {\n          console.warn('[Factory Supervisor] Failed to hydrate supervisor session', {\n            error: error instanceof Error ? error.message : String(error),\n          });\n        }),\n      { blocking: true },\n    );\n\n    // Blocking: `createSession` awaits this seed, so when hydration succeeds\n    // a session's first run starts with the owner's stored OM settings.\n    // Best-effort — failures are logged inside the helper, never thrown, and\n    // the session then falls back to its persisted/default OM configuration.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionMemorySettings(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          projects: factoryProjectsStorage,\n          memorySettings: memorySettingsStorage,\n        }),\n      { blocking: true },\n    );\n\n    // Personal model packs seed interactive user sessions only. Active Factory\n    // run bindings are excluded and continue to use the project default model.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionModelPack(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          workItems: workItemsStorage,\n          modelPacks: modelPacksStorage,\n        }),\n      { blocking: true },\n    );\n\n    this.#prepared = prepared;\n    this.#factoryProcessor = factoryProcessor;\n\n    // Chat-platform channels (Slack, Discord, …) contributed by integrations,\n    // attached to the mounted controller so inbound platform messages reach\n    // the same agents the web UI drives. READY integrations only — readiness\n    // means the `channel-identity` domain's `init()` succeeded, so its link\n    // table is queryable. Without it a sender can't be resolved to a tenant,\n    // and attaching anyway would dispatch runs on default credentials.\n    const channelRegistrations = integrationRegistrations.filter(\n      ({ integration, ready }) => ready && integration.channels,\n    );\n    // `setChannels` replaces rather than merges, so a second provider would\n    // silently never receive a message. Fail loud instead.\n    if (channelRegistrations.length > 1) {\n      throw new Error(\n        `MastraFactory: integrations [${channelRegistrations\n          .map(({ integration }) => integration.id)\n          .join(', ')}] all provide channels, but only one may. Remove all but one.`,\n      );\n    }\n    for (const { integration } of channelRegistrations) {\n      const context = buildIntegrationContext(\n        {\n          controller: prepared.base.controller,\n          publicOrigin,\n          auth: routeAuth,\n          stateSigner,\n          sandbox: sandboxConfig,\n          factoryStorage: storage,\n          integrationStorage,\n          sourceControlStorage,\n          configVersion,\n          boardRegistry: this.#boards,\n          factoryReady,\n          domains,\n          feed: commentsDomain,\n          ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n        },\n        integration.id,\n      );\n      // Integrations return a channels CONFIG; the factory owns construction.\n      prepared.base.controller.setChannels(new AgentControllerChannels(integration.channels!(context)));\n      // A publisher posts through the channel SDK this loop just wired up.\n      const publisher = integration.feedPublisher?.(context);\n      if (publisher) feedPublishers.push(publisher);\n    }\n\n    // Integration lifecycle workers (e.g. polling an upstream without\n    // webhooks): collected from READY integrations only, folded into the\n    // constructor args so `new Mastra(...)` merges them with the default\n    // workers and `finalize()`'s `startWorkers()` starts them alongside the\n    // built-ins. Never passed for the disabled/not-ready case — a worker for\n    // an unavailable integration must not run.\n    const integrationWorkers = [\n      ...(factoryReady\n        ? [\n            new FactorySupervisorHealthWorker({\n              projects: factoryProjectsStorage,\n              workItems: workItemsStorage,\n              boards: this.#boards,\n            }),\n          ]\n        : []),\n      ...integrationRegistrations\n        .filter(({ integration, ready }) => ready && integration.workers)\n        .flatMap(({ integration }) =>\n          integration.workers!(\n            buildIntegrationContext(\n              {\n                controller: prepared.base.controller,\n                publicOrigin,\n                auth: routeAuth,\n                stateSigner,\n                sandbox: sandboxConfig,\n                factoryStorage: storage,\n                integrationStorage,\n                sourceControlStorage,\n                configVersion,\n                boardRegistry: this.#boards,\n                factoryReady,\n                domains,\n                feed: commentsDomain,\n                ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n              },\n              integration.id,\n            ),\n          ),\n        ),\n    ];\n\n    return {\n      ...prepared.mastraArgs,\n      // Same provider on `studio.auth` as on `server.auth` (buildServerConfig):\n      // deployed factories must authenticate BOTH plain API callers and Studio\n      // requests (`x-mastra-client-type: studio` routes to `studio.auth`).\n      ...(auth ? { studio: { auth } } : {}),\n      ...(integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}),\n    };\n  }\n\n  /**\n   * Post-construct boot: initialize the controller (which inherits the\n   * constructed Mastra's storage) and start its workers. Call AFTER the entry\n   * has run `new Mastra(prepare()'s args)`.\n   */\n  async finalize(): Promise<void> {\n    if (!this.#prepared) {\n      throw new Error('MastraFactory.finalize() called before prepare()');\n    }\n    await timedPhase('finalize.controller', () => this.#prepared!.finalize());\n    await timedPhase(\n      'finalize.reconcileBoundThreads',\n      () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n    );\n    this.#dispatcher?.start();\n  }\n\n  /** Stop Factory-owned background dispatch before the host process shuts down. */\n  async shutdown(): Promise<void> {\n    await this.#dispatcher?.stop();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgPA,MAAM,gBAAgB;AAEtB,SAAS,yBAAkC;CAIzC,OAAO,QAAQ,QAAQ,IAAI,8BAA8B,KAAK,KAAK,QAAQ,IAAI,4BAA4B,KAAK,CAAC;AACnH;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,WAAwC;CACtE,OAAO,IAAI,iBAAiB,EAC1B,cAAc,0BAA0B,SAAS,EACnD,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,MAAM,gCAAgC,CAAC,gBAAgB,WAAW;AAElE,SAAS,YAAY,UAA2B;CAI9C,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO;CACnC,OAAO,oBAAoB,KAAK,QAAQ;AAC1C;AAEA,SAAS,0BAA0B,WAAuC;CACxE,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,SAAS,CAAC,CAAC,SAAS,YAAY;CACrD,QAAQ;EACN;CACF;CACA,IAAI,aAAa,eAAe,YAAY,QAAQ,GAAG,OAAO,KAAA;CAC9D,KAAK,MAAM,UAAU,+BAA+B;EAGlD,IAAI,aAAa,QAAQ,OAAO,KAAA;EAChC,IAAI,SAAS,SAAS,IAAI,QAAQ,GAAG,OAAO,IAAI;CAClD;AAEF;;AAGA,SAAS,4BAA4B,YAA8C,UAAgC;CACjH,MAAM,eAAe,IAAI,aAAa,UAAU;CAChD,aAAa,iBAAgB,YAAW;EACtC,MAAM,EAAE,cAAc,qBAAqB,QAAQ,MAAM,IAAI;EAC7D,IAAI,gBAAgB,kBAAkB,UAAU,UAAU;GAAE,OAAO;GAAc;EAAiB,CAAC;CACrG,CAAC;CACD,OAAO;AACT;AAEA,IAAa,gBAAb,MAA2B;CACzB;CACA;CACA;CACA;CACA;CACA;CACA,aAAa;CAEb,YAAY,QAA6B;EACvC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,oOAGF;EAEF,KAAKC,UAAU,oBAAoB;GACjC,QAAQ,OAAO;GACf,sBAAsB,OAAO;EAC/B,CAAC;EACD,IAAI,WAAW,QACb,MAAM,IAAI,MACR,2JAEF;EAEF,KAAKC,iBAAiB,2BAA2B,OAAO,iBAAA,mBAA+C;EACvG,KAAKF,UAAU;CACjB;;;;;;CAOA,MAAM,UAA+B;EAInC,IAAI,KAAKG,YAAY,MAAM,IAAI,MAAM,sCAAsC;EAC3E,KAAKA,aAAa;EAElB,MAAM,gBAAgB,KAAKH,QAAQ,aAAa,wBAAA,CAAyB,QAAQ,QAAQ,EAAE;EAC3F,MAAM,kBAAkB,KAAKA,QAAQ,kBAAkB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO;EACzG,MAAM,UAAU,KAAKA,QAAQ;EAC7B,MAAM,SAAS,KAAKA,QAAQ;EAC5B,MAAM,SAAS,KAAKA,QAAQ;EAG5B,MAAM,WAAW,UAAU,IAAI,mBAAmB;EAMlD,MAAM,iBAAiB,KAAKA,QAAQ;EACpC,MAAM,OACJ,mBAAmB,OAAO,KAAA,IAAa,kBAAkB,uBAAuB,YAAY;EAC9F,IAAI,QAAQ,CAAC,KAAKA,QAAQ,kBACxB,QAAQ,KACN,kRAGF;EAEF,MAAM,mBAAmB,KAAKA,QAAQ,oBAAoB,uCAAuC;EAGjG,MAAM,YAAY,uBAAuB,IAAI;EAI7C,MAAM,eAAe,CAAC,GAAI,KAAKA,QAAQ,gBAAgB,CAAC,CAAE;EAC1D,IAAI,uBAAuB,GAAG;GAC5B,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,EAAE,MAAM,KAAKA,QAAQ,UAAU,cAAc,CAAC,CAAC;GAEjG,IACE,QAAQ,IAAI,kCAAkC,KAAK,KACnD,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,YAAY,GAEjE,aAAa,KAAK,IAAI,8BAA8B,CAAC;GAEvD,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,CAAC;EAErD;EAIA,MAAM,iCAAiB,IAAI,IAAY;EACvC,KAAK,MAAM,eAAe,cAAc;GACtC,IAAI,eAAe,IAAI,YAAY,EAAE,GACnC,MAAM,IAAI,MAAM,4CAA4C,YAAY,GAAG,qBAAqB;GAElG,eAAe,IAAI,YAAY,EAAE;EACnC;EACA,MAAM,gBAAgB,KAAKE;EAI3B,MAAM,gBAAgB,QAAQ,eAAe,IAAI,cAAc,CAAC;EAChE,MAAM,eAAe,QAAQ,eAAe,IAAI,aAAa,CAAC;EAC9D,MAAM,mBAAmB,QAAQ,eAAe,IAAI,iBAAiB,CAAC;EACtE,iBAAiB,oBAAmB,UAAS,UAAU,UAAU,KAAK,CAAC;EACvE,iBAAiB,2BAA0B,SAAQ,uBAAuB,KAAKD,SAAS,IAAI,CAAC,EAAE,SAAS,UAAU;EAClH,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,gBAAgB,CAAC;EACpG,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,wBAAwB,QAAQ,eAAe,IAAI,sBAAsB,CAAC;EAChF,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,gBAAgB,CAAC;EAClG,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,CAAC;EAG1E,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,gBAAgB,CAAC;EAC1F,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,uBAAuB,QAAQ,eAAe,IAAI,qBAAqB,CAAC;EAG9E,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAGpF,MAAM,UAAU;GACd,QAAQ;GACR,kBAAkB;GAClB,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;GACjB,YAAY;GACZ,UAAU;GACV,aAAa;GACb,WAAW;GACX,iBAAiB;GACjB,UAAU;EACZ;EACA,MAAM,cAAc,IAAI,YAAY;GAClC,MAAM;GACN,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,eAAe,IAAI,IAAI,OAAO,KAAA;GAC7C,OAAO;GACP,cAAa,mBAAkB;IAC7B,MAAM,OAAO,8BAA8B,cAAc;IACzD,OAAO;KAAE,OAAO,oBAAoB,IAAI;KAAG,QAAQ,qBAAqB,IAAI;IAAE;GAChF;EACF,CAAC;EAED,MAAM,iBAA0C,CAAC;EACjD,MAAM,iBAAiB,IAAI,eAAe;GACxC,MAAM;GACN,UAAU;GACV,WAAW;GACX,UAAU;GACV,iBAAiB;GACjB,OAAO;GACP,YAAY;GACZ,QAAQ;EACV,CAAC;EAMD,MAAM,gBAAgB,KAAKD,QAAQ;EACnC,IAAI,kBAAkB,KAAA,KAAa,OAAO,kBAAkB,YAAY;GAKtE,IAAI,OAAO,kBAAkB,YAAY,kBAAkB,MACzD,MAAM,IAAI,MACR,oqBAGF;GAEF,MAAM,IAAI,MACR,wGACF;EACF;EAEA,MAAM,oBAAoB,IAAI,yBAAyB;EAKvD,MAAM,cAAc,kBAAkB,KAAKA,QAAQ,WAAW;EAO9D,IAAI,QAAQ,YAAY,IAAI,GAC1B,MAAM,WAAW,2BACf,KAAK,KAAK;GAAE,UAAU,QAAQ,eAAe;GAAG,WAAW;GAAc;EAAe,CAAC,CAC3F;EAKF,MAAM,WAAW,8BAA8B,QAAQ,KAAK,CAAC;EAY7D,IAAI,MACF,iCAAiC,uBAAuB;EAM1D,8BAA8B;GAAE,SAAS;GAAwB,aAAa,QAAQ,IAAI;EAAE,CAAC;EAE7F,KAAK,MAAM,eAAe,cAAc;GACtC,YAAY,aAAa;IACvB,SAAS,mBAAmB,eAAe,YAAY,EAAE;IACzD,UAAU;IACV,MAAM;GACR,CAAC;GACD,IAAI,YAAY,gBACd,YAAY,eAAe,WAAW,EACpC,SAAS,qBAAqB,eAAe,YAAY,EAAE,EAC7D,CAAC;EAEL;EAKA,MAAM,2BAA2B,aAAa,KAAI,gBAAe;GAC/D,MAAM,kBAAkB;IACtB;IACA,GAAI,YAAY,iBAAiB,CAAC,gBAAgB,IAAI,CAAC;IAGvD,GAAI,YAAY,WAAW,CAAC,kBAAkB,IAAI,CAAC;GACrD;GACA,OAAO;IACL;IACA,OAAO,gBAAgB,OAAM,WAAU,QAAQ,cAAc,MAAM,CAAC;IACpE,aAAa,YAAY;KACvB,KAAK,MAAM,UAAU,iBAAiB,MAAM,QAAQ,kBAAkB,MAAM;IAC9E;GACF;EACF,CAAC;EACD,MAAM,cACJ,aAAa,MAAK,gBAAe,YAAY,WAAW,KAAA,CAAS,KAAK,QAAQ,cAAc,QAAQ;EACtG,MAAM,eAAe,QAAQ,cAAc,UAAU,KAAK,QAAQ,cAAc,YAAY;EAC5F,MAAM,mBAAmB,QAAQ,IAAI,yCAAyC;EAC9E,MAAM,oBAAoB,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ;EAGtF,MAAM,iBAAiB,QAAQ,cAAc,YAAY;EACzD,MAAM,oBACJ,iBAAiB,QAAQ,cAAc,gBAAgB,IACnD,IAAI,6BAA6B,EAC/B,oBAAmB,cAAa,kBAAkB,kBAAkB,SAAS,EAC/E,CAAC,IACD,KAAA;EACN,MAAM,yBACJ,qBAAqB,qBAAqB,iBACtC,OAAO,EAAE,OAAO,iBACd,kBAAkB,uBAAuB;GACvC,WAAW;GACX,eAAe,qBAAqB,eAAe,kBAAkB,EAAE;GACvE;GACA;EACF,CAAC,IACH,KAAA;EAMN,MAAM,kBAAkB,iBACpB,2BAA2B;GACzB,WAAW;GAGX,kBAAkB,OAAO,YAA2B;IAClD,MAAM,kBAAkB,iBAAiB,OAAO;GAClD;GAGA,GAAI,yBAAyB,EAAE,kBAAkB,uBAAuB,IAAI,CAAC;EAC/E,CAAC,IACD;EACJ,MAAM,oBAAoB,iBACtB,IAAI,yBAAyB;GAC3B;GACA,QAAQ,KAAKC;GACb,SAAS;GACT,OAAO;GACP,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;GAC7C,GAAI,oBACA,EACE,aAAa,SACX,gCACE,mBACA,qBAAqB,eAAe,kBAAkB,EAAE,GACxD,IACF,EACJ,IACA,CAAC;EACP,CAAC,IACD,KAAA;EACJ,MAAM,gBAAgB,IAAI,cAAc;GACtC,MAAM;GACN,UAAU;GACV,eAAe;GACf,8BAA8B,aAC3B,QAAO,gBAAe,YAAY,cAAc,CAAC,CACjD,KAAI,gBAAe,YAAY,EAAE;GACpC,GAAI,oBACA,EACE,mBAAmB,OAAO,EAAE,eAAe,OAAO,gBAAgB,YAAY,WAAW;IACvF,IAAI,kBAAkB,kBAAkB,IAAI,OAAO;IACnD,MAAM,eAAe,MAAM,kBAAkB,qBAAqB,cAAc,IAAI;KAClF;KACA,IAAI;IACN,CAAC;IACD,IAAI,CAAC,cAAc,OAAO;IAE1B,MAAM,YAAW,MADU,kBAAkB,sBAAsB,OAAO,aAAa,UAAU,CAAC,EAAA,CACpE,MAAK,SAAQ,KAAK,GAAG,SAAS,MAAM,cAAc,KAAK,aAAa,IAAI;IACtG,IAAI,CAAC,UAAU,OAAO;IACtB,OAAO,kBAAkB,qBAAqB,aAAa,OAAO;KAChE;KACA,OAAO;MACL;MACA;MACA,MAAM,SAAS;MACf,eAAe,cAAc,SAAS,aAAa,IAAI,SAAS,gBAAgB;MAChF,kBAAkB;OAAE,SAAS,SAAS;OAAS,OAAO,SAAS;MAAM;KACvE;IACF,CAAC;GACH,EACF,IACA,CAAC;GACL,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,iBAAiB,EAAE,WAAW,iBAAiB,IAAI,CAAC;EAC1D,CAAC;EACD,MAAM,mBAAmB,iBACrB,IAAI,2BAA2B;GAC7B;GACA,SAAS;GACT,QAAQ,KAAKA;GACb,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,oBACA,EACE,8BAA8B,UAC5B,mCACE,mBACA,qBAAqB,eAAe,QAAQ,GAC5C,mBAAmB,eAAe,QAAQ,GAC1C,kBACA,KACF,EACJ,IACA,CAAC;GACL,eAAe,EACb,cAAc,OAAM,UAAS;IAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;KAAE,UAAU,CAAC;KAAG,SAAS;IAAM;GAC9E,EACF;EACF,CAAC,IACD,KAAA;EAMJ,KAAK,MAAM,EAAE,iBAAiB,0BAC5B,IAAI,YAAY,6BAA6B,CAAC,YAAY,QACxD,MAAM,IAAI,MACR,+BAA+B,YAAY,GAAG,iIAEhD;EASJ,MAAM,8BAA8B;GAClC,KAAK,IAAI,QAAQ,OAAO,eAAe,OAAO,GAAG,OAAO,QAAQ,OAAO,eAAe,KAAK,GAAG;IAC5F,IAAI,MAAM,aAAa,SAAS,oBAAoB,OAAO;IAC3D,IAAI,MAAM,aAAa,SAAS,wBAAwB,OAAO;GACjE;EAEF,EAAA,CAAG;EAIH,MAAM,mBAAmB,yBAAyB,QAC/C,EAAE,kBAAkB,YAAY,cAAc,YAAY,YAC7D;EAMA,MAAM,WAAW,MAAM,WAAW,iCAChC,4BAA4B;GAC1B,cAAc;GACd,UAAU,EAAE,MAAM,uBAAuB;GACzC,WAAW,uBAAuB;IAChC,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;IAClD,GAAI,KAAKD,QAAQ,eAAe,EAAE,cAAc,KAAKA,QAAQ,aAAa,IAAI,CAAC;IAC/E,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;IACzD,GAAI,yBAAyB,EAAE,UAAU,uBAAuB,IAAI,CAAC;IACrE,GAAI,mBAAmB,EAAE,WAAW,iBAAiB,IAAI,CAAC;IAC1D;GACF,CAAC;GACD,sBAAsB;GAGtB,uBAAuB;GACvB,mBAAmB,EAAE,qBAAqB;IAIxC,OAAO,0BAHS,eAAe,IAAI,YAGI,CAAC,EAAE,UAAU,IAAI,0BAA0B,KAAA;GACpF;GAaA,cAAc;IACZ,wBAAwB;IACxB,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,WAAW;GACb;GACA,SAAS,QAAQ,iBAAiB;GAClC,GAAI,uBAAuB,EAAE,gBAAgB,qBAAqB,IAAI,CAAC;GACvE,GAAI,mBAAmB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC;GAClE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,GAAI,iBAAiB,SAAS,KAAM,oBAAoB,oBACpD,EACE,YAAY,OAAO,EAAE,qBAAyD;IAC5E,MAAM,QAA0B,CAAC;IACjC,MAAM,6BAAa,IAAI,IAAoB;IAC3C,MAAM,cAAc,SAAiB,gBAAkC;KACrE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GAAG;MACtD,MAAM,QAAQ,WAAW,IAAI,IAAI;MACjC,IAAI,OACF,MAAM,IAAI,MACR,oCAAoC,KAAK,UAAU,QAAQ,oBAAoB,MAAM,GACvF;MAEF,WAAW,IAAI,MAAM,OAAO;MAC5B,MAAM,QAAQ;KAChB;IACF;IACA,IAAI,oBAAoB,mBAAmB;KACzC,WACE,WACA,MAAM,6BAA6B;MACjC;MACA,SAAS;MACT;MAMA,GAAI,QAAQ,cAAc,gBAAgB,IACtC,EAAE,UAAU,qBAAqB,eAAe,QAAQ,CAAC,CAAC,SAAS,IACnE,CAAC;KACP,CAAC,CACH;KAIA,MAAM,kBAAkB,MAAM,uBAAuB;MACnD;MACA,UAAU;KACZ,CAAC;KACD,IAAI,iBAAiB;MACnB,MAAM,SAAS,qBAAqB,8BAA8B,cAAc,CAAC;MACjF,WACE,sBACA,iCAAiC;OAC/B,OAAO;OACP,WAAW;OACX,QAAQ,KAAKC;OACb,UAAU;OACV,OAAO;OACP,eAAe,EACb,cAAc,OAAM,UAAS;QAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;QACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;SAAE,UAAU,CAAC;SAAG,SAAS;QAAM;OAC9E,EACF;MACF,CAAC,CACH;MACA,IAAI,QACF,WACE,4BACA,kCAAkC;OAChC,OAAO;OACP;OACA,WAAW;OACX,OAAO;OACP;OACA,GAAI,oBACA,EACE,4BAA4B,SAK1B,gCACE,mBACA,qBAAqB,eAAe,kBAAkB,EAAE,GACxD,IACF,EACJ,IACA,CAAC;OACL,eAAe,OAAO,EAAE,WAAW,cAAc;QAC/C,MAAM,UAAU,MAAM,SAAS,KAAK,WAAW,qBAAqB,SAAS;QAC7E,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,gDAAgD;QAC9E,MAAM,QAAQ,YAAY;SACxB,SAAS;SACT,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;QAC7C,CAAC;OACH;MACF,CAAC,CACH;KAEJ;IACF;IACA,KAAK,MAAM,EAAE,aAAa,OAAO,iBAAiB,kBAAkB;KAClE,IAAI,CAAC,SAAS,aACZ,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN;KACF;KAEF,IAAI,YAAY,YACd,WAAW,YAAY,IAAI,MAAM,YAAY,WAAW,EAAE,eAAe,CAAC,CAAC;KAE7E,IAAI,YAAY,cACd,WAAW,YAAY,IAAI,YAAY,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3E;IACA,OAAO;GACT,EACF,IACA,CAAC;GACL,kBAAkB,OAAO,gBAA4C;IACnE,MAAM,iBAAkB,YAAY,SAChC;IACJ,IAAI,gBACF,MAAM,sBAAsB;KAC1B,OAAO;KACP,aAAa;MAAE,GAAG;MAAa,SAAS;KAAe;IACzD,CAAC;IAEH,MAAM,QAAQ,IACZ,aAAa,IAAI,OAAM,gBAAe;KACpC,IAAI,CAAC,YAAY,kBAAkB;KACnC,IAAI;MACF,MAAM,YAAY,iBAAiB;OAAE;OAAa;MAAe,CAAC;KACpE,SAAS,OAAO;MACd,QAAQ,KAAK,0BAA0B,YAAY,GAAG,+BAA+B,KAAK;KAC5F;IACF,CAAC,CACH;GACF;GACA,GAAI,SAAS;IAAE;IAAQ,oBAAoB;GAAK,IAAI,CAAC;GACrD,iBAAiB,EAAE,YAAY,kBAAsC;IAKnE,GAAI,OAAO,gBAAgB,MAAM,EAAE,WAAW,aAAa,CAAC,IAAI,CAAC;IACjE,GAAG,IAAI,gBAAgB;KAAE,MAAM;KAAW,cAAc,MAAM;KAAM;KAAc;IAAe,CAAC,CAAC,CAAC,OAAO;IAE3G,GAAG,yBAAyB;KAC1B,cAAc;KACd;KACA,cAAc,4BAA4B,YAAY,QAAQ;KAC9D,MAAM;KACN,GAAI,QAAQ,eAAe,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KACtD;KACA,OAAO;KACP;KACA;KACA,SAAS;KACT;KACA,gBAAgB;KAChB;KACA;KACA;KACA,MAAM;KACN,cAAc;KACd;KACA;KACA;KACA;KACA,eAAe,KAAKA;KACpB,0BAA0B;KAC1B,mBAAmB,EAAE,mBAAmB,0BAA0B,qBAAqB;MACrF,KAAKG,gBAAgB,IAAI,0BAA0B;OACjD;OACA,mBAAmB;OACnB,SAAS,QAAQ,UAA4B,YAAY;OACzD,OAAO;OACP,QAAQ,KAAKH;OACb,aAAa,KAAKD,QAAQ,YAAY;OACtC,kBAAkB,OAAO,EAAE,OAAO,uBAAuB;QACvD,MAAM,uBAAuB,YAAY;QAEzC,QAAO,MADe,uBAAuB,IAAI;SAAE;SAAO,IAAI;QAAiB,CAAC,EAAA,EAChE,kBAAkB;OACpC;OACA,kBAAkB,OAAO,EAAE,OAAO,uBAAuB;QACvD,MAAM,uBAAuB,YAAY;QAEzC,QAAO,MADe,uBAAuB,IAAI;SAAE;SAAO,IAAI;QAAiB,CAAC,EAAA,EAChE,oBAAoB;OACtC;OACA,4BAA4B,kBAAkB,yBAAyB,KAAK,QAAQ,QAAQ;OAC5F;OACA,YAAY,IAAI,kBAAkB,uBAAuB;OACzD,mBAAkB,WAAU,uBAAuB;QAAE;QAAQ,aAAa;OAAwB,CAAC;OACnG,+BAA+B,OAAO,EAAE,OAAO,kBAAkB,eAAe;QAC9E,IAAI,SAAS,WAAW,aAAa,OAAO;QAC5C,MAAM,eAAe,SAAS,UAAU;QACxC,MAAM,oBAAoB,SAAS,UAAU;QAC7C,IAAI,OAAO,iBAAiB,YAAY,OAAO,sBAAsB,UAAU,OAAO;QACtF,OAAO,0CACL,mBAAmB,eAIjB,QAAQ,GACV;SAAE;SAAO;SAAkB;SAAc;QAAkB,CAC7D;OACF;MACF,CAAC;KACH;IACF,CAAC;IACD,GAAG,cAAc,OAAO;IACxB,GAAG,YAAY,OAAO;IACtB,GAAG,eAAe,OAAO;GAC3B;GACA,yBAAyB;IACvB,MAAM,OAAO,eAAe,SAAS,EAAE,MAAM;KAAE,QAAQ;KAAgB,aAAa;IAAK,EAAE,IAAI,CAAC;IAIhG,MAAM,UAAU,EAAE,SAAS,kBAAkB;IAI7C,MAAM,SAAS,iBAAiB;IAChC,MAAM,MAAM,SAAS,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAGH,OAAO;KACL,YAAY,CACV,4BAA4B;MAAE,MAAM;MAAW,SAAS;MAAwB,aAAa;KAAM,CAAC,GACpG,GAAG,GACL;KACA,GAAG;KACH,GAAG;IACL;IAcF,OAAO;KACL;KACA,YAAY;MACV,sBAAsB,IAAI;MAC1B,6BAA6B;OAAE,MAAM;OAAW,aAAa;MAAwB,CAAC;MACtF,4BAA4B;OAC1B,MAAM;OACN,SAAS;OACT,aAAa,QAAQ,IAAI;MAC3B,CAAC;MACD,GAAG;KACL;KACA,GAAG;KACH,GAAG;IACL;GACF;EACF,CAAC,CACH;EAEA,SAAS,KAAK,WAAW,kBAAiB,YAAW;GACnD,yBAAyB,SAAS;IAChC,YAAY;IACZ,eAAe,qBAAqB,eAAe,QAAQ;GAC7D,CAAC;GACD,2BAA2B,SAAS,EAClC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,wBAAwB,SAAS,EAC/B,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,0BAA0B,SAAS,EACjC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,qBAAqB,SAAS,EAAE,OAAO,YAAY,CAAC;EACtD,CAAC;EAKD,SAAS,KAAK,WAAW,kBACvB,YACE,yBAAyB,SAAS;GAChC,UAAU;GACV,gBAAgB;EAClB,CAAC,CAAC,CAAC,OAAM,UAAS;GAChB,QAAQ,KAAK,6DAA6D,EACxE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACH,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAMA,SAAS,KAAK,WAAW,kBACvB,YACE,6BAA6B,SAAS;GACpC,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,UAAU;GACV,gBAAgB;EAClB,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAIA,SAAS,KAAK,WAAW,kBACvB,YACE,wBAAwB,SAAS;GAC/B,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,WAAW;GACX,YAAY;EACd,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAEA,KAAKK,YAAY;EACjB,KAAKC,oBAAoB;EAQzB,MAAM,uBAAuB,yBAAyB,QACnD,EAAE,aAAa,YAAY,SAAS,YAAY,QACnD;EAGA,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,gCAAgC,qBAC7B,KAAK,EAAE,kBAAkB,YAAY,EAAE,CAAC,CACxC,KAAK,IAAI,EAAE,8DAChB;EAEF,KAAK,MAAM,EAAE,iBAAiB,sBAAsB;GAClD,MAAM,UAAU,wBACd;IACE,YAAY,SAAS,KAAK;IAC1B;IACA,MAAM;IACN;IACA,SAAS;IACT,gBAAgB;IAChB;IACA;IACA;IACA,eAAe,KAAKL;IACpB;IACA;IACA,MAAM;IACN,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;GAChE,GACA,YAAY,EACd;GAEA,SAAS,KAAK,WAAW,YAAY,IAAI,wBAAwB,YAAY,SAAU,OAAO,CAAC,CAAC;GAEhG,MAAM,YAAY,YAAY,gBAAgB,OAAO;GACrD,IAAI,WAAW,eAAe,KAAK,SAAS;EAC9C;EAQA,MAAM,qBAAqB,CACzB,GAAI,eACA,CACE,IAAI,8BAA8B;GAChC,UAAU;GACV,WAAW;GACX,QAAQ,KAAKA;EACf,CAAC,CACH,IACA,CAAC,GACL,GAAG,yBACA,QAAQ,EAAE,aAAa,YAAY,SAAS,YAAY,OAAO,CAAC,CAChE,SAAS,EAAE,kBACV,YAAY,QACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA,SAAS;GACT,gBAAgB;GAChB;GACA;GACA;GACA,eAAe,KAAKA;GACpB;GACA;GACA,MAAM;GACN,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EAChE,GACA,YAAY,EACd,CACF,CACF,CACJ;EAEA,OAAO;GACL,GAAG,SAAS;GAIZ,GAAI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;GACnC,GAAI,mBAAmB,SAAS,IAAI,EAAE,SAAS,mBAAmB,IAAI,CAAC;EACzE;CACF;;;;;;CAOA,MAAM,WAA0B;EAC9B,IAAI,CAAC,KAAKI,WACR,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,WAAW,6BAA6B,KAAKA,UAAW,SAAS,CAAC;EACxE,MAAM,WACJ,wCACM,KAAKC,mBAAmB,yBAAyB,KAAK,QAAQ,QAAQ,CAC9E;EACA,KAAKF,aAAa,MAAM;CAC1B;;CAGA,MAAM,WAA0B;EAC9B,MAAM,KAAKA,aAAa,KAAK;CAC/B;AACF"}
+{"version":3,"file":"factory.js","names":["#config","#boards","#configVersion","#preparing","#dispatcher","#prepared","#factoryProcessor"],"sources":["../src/factory.ts"],"sourcesContent":["/**\n * `MastraFactory` — the single entry point to the whole Mastra Software Factory.\n *\n * The consumer's deploy entry constructs deployment-specific config instances\n * (auth adapter, pubsub) and passes them here explicitly. The only provider\n * defaults constructed here are Platform GitHub, incident.io, and Linear\n * integrations when Platform credentials exist and the caller did not provide\n * those integrations.\n *\n * `prepare()` resolves feature readiness, threads every dependency explicitly,\n * assembles the web routes/middleware, and returns the constructor args for\n * `new Mastra(...)`. The literal `export const mastra = new Mastra(...)` must\n * stay in the entry file — the deployer's `checkConfigExport` Babel plugin\n * only marks the config valid when it finds that literal in the entry AST —\n * so the factory produces args instead of the instance. `finalize()` runs the\n * post-construct boot (controller init + workers).\n *\n * Integration readiness is derived from each instance's declared capabilities\n * and the storage domains those capabilities require.\n */\n\nimport { MastraAuthStudio } from '@mastra/auth-studio';\nimport { prepareAgentControllerMount } from '@mastra/code-sdk';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport { AgentControllerChannels } from '@mastra/core/channels';\nimport { EventEmitterPubSub } from '@mastra/core/events';\nimport type { PubSub } from '@mastra/core/events';\nimport type { Mastra } from '@mastra/core/mastra';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { hasAuthInit, isUserProvider } from '@mastra/core/server';\nimport type { IMastraAuthProvider } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\nimport type { MastraVector } from '@mastra/core/vector';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport {\n  buildAuthRoutes,\n  createFactoryAuthGate,\n  createFactoryRouteAuth,\n  getFactoryAuthOrgId,\n  getFactoryAuthUserFromContext,\n  getFactoryAuthUserId,\n} from './auth.js';\nimport { createBoardRegistry, workItemPhaseSemantics } from './boards/index.js';\nimport type { BoardRegistry, InstalledBoard } from './boards/index.js';\nimport { touchFeed } from './feed-events.js';\nimport type { FactoryIntegration, IntegrationPostToolContext, IntegrationTools } from './integrations/base.js';\nimport { reconcileGithubAcceptanceLabels } from './integrations/github/acceptance-labels.js';\nimport type { GithubIntegration } from './integrations/github/integration.js';\nimport {\n  recordFactoryPullRequestProvenance,\n  resolveFactoryPullRequestParentWorkItemId,\n} from './integrations/github/provenance.js';\nimport type { FactoryPullRequestProvenanceData } from './integrations/github/provenance.js';\nimport { isValidGitRef } from './integrations/github/sandbox.js';\nimport { PlatformGithubIntegration } from './integrations/platform/github/integration.js';\nimport { PlatformIncidentioIntegration } from './integrations/platform/incidentio/integration.js';\nimport { PlatformLinearIntegration } from './integrations/platform/linear/integration.js';\nimport { createCustomProvidersPrimer, registerCustomProvidersSource } from './routes/custom-provider-source.js';\nimport { ProjectRoutes } from './routes/projects.js';\nimport { assembleFactoryApiRoutes, buildIntegrationContext } from './routes/surface.js';\nimport type { FactoryApiRoutesDeps } from './routes/surface.js';\nimport { TelemetryRoutes } from './routes/telemetry.js';\nimport {\n  createTenantCredentialPrimer,\n  primeTenantCredentials,\n  registerTenantCredentialResolver,\n} from './routes/tenant-credentials.js';\nimport { FactoryDecisionDispatcher } from './rules/dispatcher.js';\nimport { FactoryPhaseStateProcessor } from './rules/processor.js';\nimport { createTerminalStageCleanup } from './rules/terminal-cleanup.js';\nimport { createFactoryTransitionTools } from './rules/tools.js';\nimport { FactoryTransitionService } from './rules/transition-service.js';\nimport { assertFactoryConfigVersion, DEFAULT_FACTORY_CONFIG_VERSION } from './rules/validation.js';\nimport { SessionRetirementCoordinator } from './sandbox/session-retirement.js';\nimport type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';\nimport { createPlaintextFactorySecretEncryption } from './secret-encryption.js';\nimport type { FactorySecretEncryption } from './secret-encryption.js';\nimport { handleServerError } from './server-error.js';\nimport { refreshFactorySessionMemorySettings } from './session/factory-session.js';\nimport { observeSessionFilesystem } from './session/filesystem-capture.js';\nimport { observeSessionFirstExec } from './session/first-exec-capture.js';\nimport { observeSessionFirstMessage } from './session/first-message-capture.js';\nimport { LiveSessions } from './session/live-sessions.js';\nimport { hydrateSessionMemorySettings } from './session/memory-settings-hydration.js';\nimport { hydrateSessionModelPack } from './session/model-pack-hydration.js';\nimport { observeSessionRunEnd } from './session/run-audit.js';\nimport { observeSessionThreadTitle } from './session/thread-title-mirror.js';\nimport { createSpaStaticMiddleware, resolveUiDistDir } from './spa-static.js';\nimport { createStateSigner } from './state-signing.js';\nimport { observeAgentGitAction } from './storage/domains/audit/agent-audit.js';\nimport { AuditStorage } from './storage/domains/audit/base.js';\nimport { AuditDomain } from './storage/domains/audit/domain.js';\nimport { ChannelIdentityStorage } from './storage/domains/channel-identity/base.js';\nimport { WorkItemCommentsStorage } from './storage/domains/comments/base.js';\nimport { CommentsDomain } from './storage/domains/comments/domain.js';\nimport { FactoryFeedReader } from './storage/domains/comments/feed-context.js';\nimport type { WorkItemFeedPublisher } from './storage/domains/comments/feed-sync.js';\nimport { ModelCredentialsStorage } from './storage/domains/credentials/base.js';\nimport { CustomProvidersStorage } from './storage/domains/custom-providers/base.js';\nimport { FilesystemStorage } from './storage/domains/filesystem/base.js';\nimport { IntakeStorage } from './storage/domains/intake/base.js';\nimport { IntegrationStorage } from './storage/domains/integrations/base.js';\nimport { MemorySettingsStorage } from './storage/domains/memory-settings/base.js';\nimport { ModelPacksStorage } from './storage/domains/model-packs/base.js';\nimport { FactoryProjectsStorage } from './storage/domains/projects/base.js';\nimport { QueueHealthStorage } from './storage/domains/queue-health/base.js';\nimport { SourceControlStorage } from './storage/domains/source-control/base.js';\nimport { WorkItemsStorage } from './storage/domains/work-items/base.js';\nimport type { WorkItemRow } from './storage/domains/work-items/base.js';\nimport { FactorySupervisorHealthWorker } from './supervisor/health-worker.js';\nimport { SUPERVISOR_INSTRUCTIONS } from './supervisor/instructions.js';\nimport { createFactorySupervisorReadTools } from './supervisor/read-tools.js';\nimport { hydrateSupervisorSession, parseSupervisorResourceId, resolveSupervisorScope } from './supervisor/session.js';\nimport { createFactorySupervisorWriteTools } from './supervisor/write-tools.js';\nimport { timedPhase } from './timing.js';\nimport { createWorkspaceFactory, FactoryWorkspaceRegistry } from './workspace.js';\nimport type { FactorySandboxStart } from './workspace.js';\n\ntype BuildApiRoutesDeps = Pick<FactoryApiRoutesDeps, 'controller' | 'authStorage'>;\n\n/** Constructor args for the `new Mastra(...)` literal in the deploy entry. */\nexport type MastraArgs = NonNullable<ConstructorParameters<typeof Mastra>[0]>;\n\nexport interface MastraFactoryConfig {\n  /**\n   * Auth provider instance — `MastraAuthStudio` (`@mastra/auth-studio`),\n   * `MastraAuthWorkos` (`@mastra/auth-workos`), `MastraAuthBetterAuth`\n   * (`@mastra/auth-better-auth`), or any custom `MastraAuthProvider`. Whatever\n   * instance is passed is the active provider; a passed instance is always\n   * honored as-is.\n   *\n   * Omitted → the factory defaults to `MastraAuthStudio`, proxying auth\n   * through the shared Mastra platform API. `MastraAuthStudio` resolves its\n   * own env (`MASTRA_SHARED_API_URL`, `MASTRA_ORGANIZATION_ID`,\n   * `MASTRA_COOKIE_DOMAIN`).\n   *\n   * Pass `null` to disable auth entirely (open server, local-dev behavior)\n   * without falling back to the default.\n   */\n  auth?: IMastraAuthProvider | null;\n  /**\n   * REQUIRED. Factory storage backend powering BOTH agent storage (threads,\n   * messages, memory, OM — via `getMastraStorage()`) and the app tables\n   * (projects/source-control/audit/intake — via the generic ops surface). Pass a\n   * `PgFactoryStorage` (`@mastra/pg`) for deployments or a\n   * `LibSQLFactoryStorage` (`@mastra/libsql`) for local dev — one backend,\n   * one connection, every feature on.\n   */\n  storage: FactoryStorage;\n  /**\n   * Vector store instance for recall search — `PgVector` (`@mastra/pg`) on\n   * the same database as `storage`. Omitted → the SDK mount's default vector\n   * store resolution applies.\n   */\n  vector?: MastraVector;\n  /**\n   * Distributed event bus instance (e.g. `new RedisStreamsPubSub({ url })`).\n   * When set, streams/workflows/signals ride it across processes and the\n   * controller drops file-based thread locks in favor of pubsub-coordinated\n   * leases. Omitted → in-process default.\n   */\n  pubsub?: PubSub;\n  /**\n   * Browser-facing origin used to build integration OAuth/install callback\n   * URLs and to derive the auth redirect URI. On the platform the SPA is\n   * hosted separately, so this MUST be the public API origin.\n   * Default: `http://localhost:4111` (the local Factory server, which also\n   * serves the UI).\n   */\n  publicUrl?: string;\n  /**\n   * Allowed cross-origin SPA origins. The SPA may be served from a separate\n   * static host, so credentialed requests must be explicitly allowed.\n   */\n  allowedOrigins?: string[];\n  /** Sandbox configuration. Omitted → repository sandboxes are disabled. */\n  sandbox?: MastraFactorySandboxConfig;\n  /**\n   * When a session's sandbox boots: on the agent's first command (`'lazy'`,\n   * the default) or as soon as the session's workspace is first resolved\n   * (`'eager'`), so the boot overlaps the model's own latency.\n   */\n  sandboxStart?: FactorySandboxStart;\n  /** Background Factory dispatcher configuration. */\n  dispatcher?: MastraFactoryDispatcherConfig;\n  /**\n   * Deployment-stable secret for signing integration OAuth `state` values.\n   * Omitted → a per-process random secret, which is fine for single-process\n   * local development but rejected for integrations that declare\n   * `requiresStableStateSigner`.\n   */\n  stateSecret?: string;\n  /**\n   * Encryption boundary for persisted model credentials, custom-provider API\n   * keys, integration connections, and integration settings. Strongly\n   * recommended whenever auth is enabled — omitting it falls back to explicit\n   * plaintext compatibility with a boot-time warning.\n   */\n  secretEncryption?: FactorySecretEncryption;\n  /**\n   * Registered capability providers. The factory registers the pieces each\n   * `FactoryIntegration` instance provides — HTTP routes, storage domains,\n   * agent/session tools, intake, source control, and diagnostics — into the\n   * system. When Platform credentials are configured, missing `github` and\n   * `linear` integrations default to their Platform-backed implementations.\n   */\n  integrations?: FactoryIntegration[];\n  /**\n   * Operator-maintained provenance label stamped on transition audit rows,\n   * deferred decisions, and session kickoff headers so a row can be traced\n   * back to the deployment that produced it. Nothing branches on it.\n   * Default: `factory-config-v1`.\n   */\n  configVersion?: string;\n  /** Board definitions installed for this Factory instance. */\n  boards?: readonly InstalledBoard[];\n  /** Whether the built-in Work and Review boards are installed. Default: true. */\n  includeDefaultBoards?: boolean;\n\n  /**\n   * Platform-specific overrides. `githubAppSlug` identifies Factory's own\n   * GitHub App writes so their webhook deliveries do not retrigger triage.\n   */\n  platform?: {\n    githubAppSlug?: string;\n  };\n}\n\nexport type { MastraFactorySandboxConfig } from './sandbox/session-sandbox.js';\nexport type { FactorySandboxStart } from './workspace.js';\n\n/**\n * Per-process cap on concurrent background Factory dispatches. Omitted means\n * the dispatcher default; this is a local replica budget, not a global queue\n * limit shared across deployments.\n */\nexport interface MastraFactoryDispatcherConfig {\n  maxInFlight?: number;\n}\n\nconst CONTROLLER_ID = 'code';\n\nfunction hasPlatformCredentials(): boolean {\n  // MASTRA_PLATFORM_ACCESS_TOKEN is the credential Mastra Platform injects\n  // into deployed projects; MASTRA_PLATFORM_SECRET_KEY is the org secret key\n  // written by project scaffolding. Either enables the platform integrations.\n  return Boolean(process.env.MASTRA_PLATFORM_ACCESS_TOKEN?.trim() || process.env.MASTRA_PLATFORM_SECRET_KEY?.trim());\n}\n\n/**\n * Default auth provider — `MastraAuthStudio`, which proxies identity to the\n * shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,\n * `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —\n * this helper only derives a cookie-domain fallback from the factory's\n * `publicUrl`.\n *\n * Cookie-domain resolution (Studio picks the first that wins):\n *   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;\n *   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;\n *   3. this parent-domain fallback derived from `publicUrl` — so a deploy on\n *      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`\n *      without the caller wiring the env var by hand.\n *   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.\n */\nfunction buildDefaultStudioAuth(publicUrl: string): IMastraAuthProvider {\n  return new MastraAuthStudio({\n    cookieDomain: parentDomainFromPublicUrl(publicUrl),\n  });\n}\n\n/**\n * Derive a parent cookie domain from `publicUrl` by stripping the leftmost\n * label — the same shape platform-API's env injection uses (see\n * `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\\./, '')}`).\n *\n * Rather than a generic `strip-left-label` heuristic — which either emits\n * cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`\n * requires PSL data to be safe) or misclassifies numeric hostnames like\n * `3scale.example.com` as IPv4 — we only derive a parent domain when the\n * host sits under one of the platform's known registrable domains. Anything\n * else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)\n * falls through to host-only cookies. Callers that need a different scope\n * pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).\n */\nconst KNOWN_PLATFORM_COOKIE_PARENTS = ['mastra.cloud', 'mastra.ai'] as const;\n\nfunction isIpLiteral(hostname: string): boolean {\n  // IPv6 addresses in URLs are bracketed; `URL.hostname` strips the brackets\n  // but the address itself still contains `:`. IPv4 is four dot-separated\n  // numeric octets — trust the parser to have already validated shape.\n  if (hostname.includes(':')) return true;\n  return /^\\d+(?:\\.\\d+){3}$/.test(hostname);\n}\n\nfunction parentDomainFromPublicUrl(publicUrl: string): string | undefined {\n  let hostname: string;\n  try {\n    hostname = new URL(publicUrl).hostname.toLowerCase();\n  } catch {\n    return undefined;\n  }\n  if (hostname === 'localhost' || isIpLiteral(hostname)) return undefined;\n  for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {\n    // Exact match → we're already on the parent, host-only is correct.\n    // Subdomain match → mint the parent-scoped cookie.\n    if (hostname === parent) return undefined;\n    if (hostname.endsWith(`.${parent}`)) return `.${parent}`;\n  }\n  return undefined;\n}\n\n/** A session parking or being answered is inbox news, so the registry bumps the project's feed. */\nfunction liveSessionsTouchingTheFeed(controller: BuildApiRoutesDeps['controller'], eventBus: PubSub): LiveSessions {\n  const liveSessions = new LiveSessions(controller);\n  liveSessions.onParkedChanged(session => {\n    const { factoryOrgId, factoryProjectId } = session.state.get();\n    if (factoryOrgId && factoryProjectId) touchFeed(eventBus, { orgId: factoryOrgId, factoryProjectId });\n  });\n  return liveSessions;\n}\n\nexport class MastraFactory {\n  readonly #config: MastraFactoryConfig;\n  readonly #boards: BoardRegistry;\n  readonly #configVersion: string;\n  #prepared: Awaited<ReturnType<typeof prepareAgentControllerMount>> | undefined;\n  #dispatcher: FactoryDecisionDispatcher | undefined;\n  #factoryProcessor: FactoryPhaseStateProcessor | undefined;\n  #preparing = false;\n\n  constructor(config: MastraFactoryConfig) {\n    if (!config?.storage) {\n      throw new Error(\n        \"MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. \" +\n          \"new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or \" +\n          \"new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.\",\n      );\n    }\n    this.#boards = createBoardRegistry({\n      boards: config.boards,\n      includeDefaultBoards: config.includeDefaultBoards,\n    });\n    if ('rules' in config) {\n      throw new Error(\n        \"MastraFactory: 'rules' was removed. Set 'configVersion' for the audit label and declare tool-result \" +\n          'rules on the owning board via defineBoard({ tools }).',\n      );\n    }\n    this.#configVersion = assertFactoryConfigVersion(config.configVersion ?? DEFAULT_FACTORY_CONFIG_VERSION);\n    this.#config = config;\n  }\n\n  /**\n   * Resolve feature readiness, wire every dependency explicitly, and assemble\n   * everything needed to construct the server-owned Mastra. Returns the args\n   * for the `new Mastra(...)` literal that must live in the entry file.\n   */\n  async prepare(): Promise<MastraArgs> {\n    // Guard set synchronously (before the first await) so overlapping calls —\n    // not just strictly sequential ones — can't double-seed the runtime\n    // registry or double-run one-time adapter init.\n    if (this.#preparing) throw new Error('MastraFactory.prepare() called twice');\n    this.#preparing = true;\n\n    const publicOrigin = (this.#config.publicUrl ?? 'http://localhost:4111').replace(/\\/+$/, '');\n    const allowedOrigins = (this.#config.allowedOrigins ?? []).map(o => o.replace(/\\/+$/, '')).filter(Boolean);\n    const storage = this.#config.storage;\n    const vector = this.#config.vector;\n    const pubsub = this.#config.pubsub;\n    // One bus for feed/attention events: a second fallback instance would leave\n    // SSE subscribers and producers on different emitters in single-process runs.\n    const eventBus = pubsub ?? new EventEmitterPubSub();\n    // Default auth: honor an explicitly-passed provider (including `null` to\n    // disable auth) as-is; otherwise fall back to `MastraAuthStudio`\n    // (platform-proxied identity). The default derives its cookie domain\n    // from `publicUrl` — deploys on `<sub>.mastra.cloud` mint parent-domain\n    // cookies without the caller wiring `MASTRA_COOKIE_DOMAIN` explicitly.\n    const configuredAuth = this.#config.auth;\n    const auth: IMastraAuthProvider | undefined =\n      configuredAuth === null ? undefined : (configuredAuth ?? buildDefaultStudioAuth(publicOrigin));\n    if (auth && !this.#config.secretEncryption) {\n      console.warn(\n        \"[factory] auth is enabled but 'secretEncryption' is not configured. Persisted model credentials, \" +\n          'custom-provider API keys, and integration secrets will be stored as plaintext. Provide ' +\n          \"'secretEncryption' (e.g. via FACTORY_CREDENTIAL_ENCRYPTION_KEY) to encrypt them at rest.\",\n      );\n    }\n    const secretEncryption = this.#config.secretEncryption ?? createPlaintextFactorySecretEncryption();\n    // One RouteAuth seam per boot, closed over the resolved provider. Every\n    // factory route module receives this handle — no service locator.\n    const routeAuth = createFactoryRouteAuth(auth);\n\n    // Explicit integrations win. Platform credentials fill only missing\n    // provider slots so callers can override each integration independently.\n    const integrations = [...(this.#config.integrations ?? [])];\n    if (hasPlatformCredentials()) {\n      if (!integrations.some(integration => integration.id === 'github')) {\n        integrations.push(new PlatformGithubIntegration({ slug: this.#config.platform?.githubAppSlug }));\n      }\n      if (\n        process.env.MASTRA_INCIDENT_IO_CONNECTION_ID?.trim() &&\n        !integrations.some(integration => integration.id === 'incidentio')\n      ) {\n        integrations.push(new PlatformIncidentioIntegration());\n      }\n      if (!integrations.some(integration => integration.id === 'linear')) {\n        integrations.push(new PlatformLinearIntegration());\n      }\n    }\n\n    // Validate ids up front so a copy-paste duplicate fails loud instead of one\n    // instance silently shadowing the other.\n    const integrationIds = new Set<string>();\n    for (const integration of integrations) {\n      if (integrationIds.has(integration.id)) {\n        throw new Error(`MastraFactory: duplicate integration id '${integration.id}' in 'integrations'.`);\n      }\n      integrationIds.add(integration.id);\n    }\n    const configVersion = this.#configVersion;\n\n    // FactoryStorage owns every app-table domain and initializes them through\n    // the same lifecycle as the backend connection.\n    const intakeStorage = storage.registerDomain(new IntakeStorage());\n    const auditStorage = storage.registerDomain(new AuditStorage());\n    const workItemsStorage = storage.registerDomain(new WorkItemsStorage());\n    workItemsStorage.onAttentionChanged(scope => touchFeed(eventBus, scope));\n    workItemsStorage.useTerminalPhasePredicate(item => workItemPhaseSemantics(this.#boards, item)?.kind === 'terminal');\n    const modelCredentialsStorage = storage.registerDomain(new ModelCredentialsStorage(secretEncryption));\n    const modelPacksStorage = storage.registerDomain(new ModelPacksStorage());\n    const memorySettingsStorage = storage.registerDomain(new MemorySettingsStorage());\n    const customProvidersStorage = storage.registerDomain(new CustomProvidersStorage(secretEncryption));\n    const queueHealthStorage = storage.registerDomain(new QueueHealthStorage());\n    // Generic integration storage (connections/subscriptions/settings) — the\n    // default persistence surface for integrations without a bespoke domain.\n    const integrationStorage = storage.registerDomain(new IntegrationStorage(secretEncryption));\n    const factoryProjectsStorage = storage.registerDomain(new FactoryProjectsStorage());\n    const filesystemStorage = storage.registerDomain(new FilesystemStorage());\n    const sourceControlStorage = storage.registerDomain(new SourceControlStorage());\n    // Reverse index from a platform sender (Slack/Discord/...) to a Mastra\n    // tenant, so inbound channel events can resolve the sender's model creds.\n    const channelIdentityStorage = storage.registerDomain(new ChannelIdentityStorage());\n    const workItemCommentsStorage = storage.registerDomain(new WorkItemCommentsStorage());\n    // Every app-table domain handle the route builders and integrations need,\n    // threaded explicitly (no service locator).\n    const domains = {\n      intake: intakeStorage,\n      modelCredentials: modelCredentialsStorage,\n      modelPacks: modelPacksStorage,\n      memorySettings: memorySettingsStorage,\n      customProviders: customProvidersStorage,\n      filesystem: filesystemStorage,\n      projects: factoryProjectsStorage,\n      queueHealth: queueHealthStorage,\n      workItems: workItemsStorage,\n      channelIdentity: channelIdentityStorage,\n      comments: workItemCommentsStorage,\n    };\n    const auditDomain = new AuditDomain({\n      auth: routeAuth,\n      audit: auditStorage,\n      projects: factoryProjectsStorage,\n      users: auth && isUserProvider(auth) ? auth : undefined,\n      sinks: integrations,\n      agentTenant: requestContext => {\n        const user = getFactoryAuthUserFromContext(requestContext);\n        return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n      },\n    });\n    // Held by reference: the channel attach below pushes into it, long after this.\n    const feedPublishers: WorkItemFeedPublisher[] = [];\n    const commentsDomain = new CommentsDomain({\n      auth: routeAuth,\n      comments: workItemCommentsStorage,\n      workItems: workItemsStorage,\n      projects: factoryProjectsStorage,\n      channelIdentity: channelIdentityStorage,\n      audit: auditDomain,\n      publishers: feedPublishers,\n      pubsub: eventBus,\n    });\n\n    // The sandbox config is a bare callback constructing a session's sandbox\n    // from intent. Shape-only validation: probing it with a synthetic ctx at\n    // boot would construct against a fake session, so only the type is\n    // checked.\n    const sandboxConfig = this.#config.sandbox;\n    if (sandboxConfig !== undefined && typeof sandboxConfig !== 'function') {\n      // An object here is almost certainly the pre-callback config, which\n      // described a fleet the factory managed itself. That fleet is gone:\n      // sandboxes are per session and the host constructs them, so say what to\n      // write instead rather than only naming the expected type.\n      if (typeof sandboxConfig === 'object' && sandboxConfig !== null) {\n        throw new Error(\n          `MastraFactory: 'sandbox' is now a callback, not an options object. It receives a FactorySandboxContext and returns a MastraSandbox, so the host chooses the provider per session:\\n` +\n            `  sandbox: ctx => new E2BSandbox({ id: ctx.sessionId })\\n` +\n            `The old options map three ways: 'machine' becomes the provider instance you construct inside the callback (one per session instead of one cloned template); 'workdir' is gone — remote providers clone into the VM's home directory and local providers check out under their own workingDirectory; 'maxSandboxes' is gone with the sandbox fleet — there is one sandbox per session and no pool to cap. Omit 'sandbox' entirely to disable sandboxes.`,\n        );\n      }\n      throw new Error(\n        `MastraFactory: 'sandbox' must be a function constructing a MastraSandbox from a FactorySandboxContext.`,\n      );\n    }\n\n    const workspaceRegistry = new FactoryWorkspaceRegistry();\n\n    // One shared OAuth state signer per boot. The deploy entry supplies a\n    // replica-stable secret when needed; otherwise local development gets a\n    // per-process random signer (`stable: false`).\n    const stateSigner = createStateSigner(this.#config.stateSecret);\n\n    // One-time provider initialization with factory-level context (e.g.\n    // better-auth builds its default instance on the backend's auth\n    // database, WorkOS derives its redirect URI from the public URL).\n    // Failures surface here, at prepare() — a misconfigured provider must\n    // not boot.\n    if (auth && hasAuthInit(auth)) {\n      await timedPhase('prepare.auth.init', () =>\n        auth.init({ database: storage.authDatabase?.(), publicUrl: publicOrigin, allowedOrigins }),\n      );\n    }\n\n    // Single init path: backend connection failure is a hard boot error;\n    // registered app domains initialize fail-soft inside FactoryStorage.\n    await timedPhase('prepare.storage.init', () => storage.init());\n\n    // Per-tenant model credentials: once the credentials domain is up, model\n    // resolution goes through the caller's own store and the SDK stops\n    // mirroring stored API keys into process.env.\n    //\n    // Only register when a real auth adapter gates callers. In local /\n    // auth-disabled mode there is no authenticated tenant, so registering would\n    // force every model call through an empty tenant store (fail-closed, no env\n    // fallback) and break chat with \"Not logged in\". Leaving it unregistered\n    // lets the SDK fall back to the file-backed AuthStorage (auth.json) — the\n    // same store the local /login and Settings pages read and write.\n    if (auth) {\n      registerTenantCredentialResolver(modelCredentialsStorage);\n    }\n\n    // Custom providers: DB-backed in both modes (org rows in tenant mode, the\n    // sentinel `local` org in no-auth mode). Once registered, model resolution\n    // and the gateway catalog never read settings.json custom providers.\n    registerCustomProvidersSource({ storage: customProvidersStorage, authEnabled: Boolean(auth) });\n\n    for (const integration of integrations) {\n      integration.initialize?.({\n        storage: integrationStorage.forIntegration(integration.id),\n        projects: factoryProjectsStorage,\n        auth: routeAuth,\n      });\n      if (integration.versionControl) {\n        integration.versionControl.initialize({\n          storage: sourceControlStorage.forIntegration(integration.id),\n        });\n      }\n    }\n\n    // Every integration uses generic integration storage. Version-control\n    // providers additionally require the source-control storage domain. Readiness\n    // is derived solely from capability presence, never from provider ids.\n    const integrationRegistrations = integrations.map(integration => {\n      const requiredDomains = [\n        'integrations',\n        ...(integration.versionControl ? ['source-control'] : []),\n        // Channels resolve an inbound sender to a tenant through the reverse\n        // index; without it every message would dispatch tenant-less.\n        ...(integration.channels ? ['channel-identity'] : []),\n      ];\n      return {\n        integration,\n        ready: requiredDomains.every(domain => storage.isDomainReady(domain)),\n        ensureReady: async () => {\n          for (const domain of requiredDomains) await storage.ensureDomainReady(domain);\n        },\n      };\n    });\n    const intakeReady =\n      integrations.some(integration => integration.intake !== undefined) && storage.isDomainReady('intake');\n    const factoryReady = storage.isDomainReady('projects') && storage.isDomainReady('work-items');\n    const knowledgeEnabled = process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === '1';\n    const githubIntegration = integrations.find(integration => integration.id === 'github') as\n      | GithubIntegration\n      | undefined;\n    const workItemsReady = storage.isDomainReady('work-items');\n    const sessionRetirement =\n      sandboxConfig && storage.isDomainReady('source-control')\n        ? new SessionRetirementCoordinator({\n            invalidateSession: sessionId => workspaceRegistry.invalidateSession(sessionId),\n          })\n        : undefined;\n    const retireTerminalSessions =\n      sessionRetirement && githubIntegration && workItemsReady\n        ? async ({ orgId, workItemId }: { orgId: string; workItemId: string }) =>\n            sessionRetirement.retireWorkItemSessions({\n              workItems: workItemsStorage,\n              sourceControl: sourceControlStorage.forIntegration(githubIntegration.id),\n              orgId,\n              workItemId,\n            })\n        : undefined;\n    // Terminal-stage cleanup: ingest any trailing tool results from the item's\n    // bound threads, then revoke the bindings so completed items leave the\n    // reconcile walk (the active-binding set otherwise grows forever), and\n    // finally release the item's sandboxes. Each step is best-effort — a\n    // committed transition never fails on cleanup.\n    const onTerminalStage = workItemsReady\n      ? createTerminalStageCleanup({\n          workItems: workItemsStorage,\n          // `factoryProcessor` is assigned below in this scope; the cleanup\n          // only runs on transitions long after bootstrap completes.\n          reconcileBinding: async (binding): Promise<void> => {\n            await factoryProcessor?.reconcileBinding(binding);\n          },\n          // Session retirement supersedes the older direct sandbox release: it\n          // invalidates the session and stops/destroys its sandbox.\n          ...(retireTerminalSessions ? { releaseSandboxes: retireTerminalSessions } : {}),\n        })\n      : retireTerminalSessions;\n    const transitionService = workItemsReady\n      ? new FactoryTransitionService({\n          configVersion,\n          boards: this.#boards,\n          storage: workItemsStorage,\n          audit: auditDomain,\n          ...(onTerminalStage ? { onTerminalStage } : {}),\n          ...(githubIntegration\n            ? {\n                onAccepted: (args: { orgId: string; factoryProjectId: string; item: WorkItemRow }) =>\n                  reconcileGithubAcceptanceLabels(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration(githubIntegration.id),\n                    args,\n                  ),\n              }\n            : {}),\n        })\n      : undefined;\n    const projectRoutes = new ProjectRoutes({\n      auth: routeAuth,\n      projects: factoryProjectsStorage,\n      sourceControl: sourceControlStorage,\n      versionControlIntegrationIds: integrations\n        .filter(integration => integration.versionControl)\n        .map(integration => integration.id),\n      ...(githubIntegration\n        ? {\n            resolveRepository: async ({ integrationId, orgId, installationId, externalId, slug }) => {\n              if (integrationId !== githubIntegration.id) return null;\n              const installation = await githubIntegration.sourceControlStorage.installations.get({\n                orgId,\n                id: installationId,\n              });\n              if (!installation) return null;\n              const repositories = await githubIntegration.listInstallationRepos(Number(installation.externalId));\n              const selected = repositories.find(repo => repo.id.toString() === externalId && repo.fullName === slug);\n              if (!selected) return null;\n              return githubIntegration.sourceControlStorage.repositories.upsert({\n                orgId,\n                input: {\n                  installationId,\n                  externalId,\n                  slug: selected.fullName,\n                  defaultBranch: isValidGitRef(selected.defaultBranch) ? selected.defaultBranch : 'main',\n                  providerMetadata: { private: selected.private, owner: selected.owner },\n                },\n              });\n            },\n          }\n        : {}),\n      ...(sessionRetirement ? { sessionRetirement } : {}),\n      ...(workItemsReady ? { workItems: workItemsStorage } : {}),\n    });\n    const factoryProcessor = workItemsReady\n      ? new FactoryPhaseStateProcessor({\n          configVersion,\n          storage: workItemsStorage,\n          boards: this.#boards,\n          ...(transitionService ? { transitionService } : {}),\n          ...(githubIntegration\n            ? {\n                recordPullRequestProvenance: (input: Parameters<typeof recordFactoryPullRequestProvenance>[4]) =>\n                  recordFactoryPullRequestProvenance(\n                    githubIntegration,\n                    sourceControlStorage.forIntegration('github'),\n                    integrationStorage.forIntegration('github'),\n                    workItemsStorage,\n                    input,\n                  ),\n              }\n            : {}),\n          messageReader: {\n            listMessages: async input => {\n              const memory = await storage.getMastraStorage().getStore('memory');\n              return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n            },\n          },\n        })\n      : undefined;\n\n    // Boot assertion: an active integration that signs OAuth `state` needs a\n    // replica-stable signer — a per-process random secret silently breaks the\n    // OAuth callback on any replica that didn't sign the state. Fail loud now\n    // instead. (The built-ins also assert this inside their readiness gates.)\n    for (const { integration } of integrationRegistrations) {\n      if (integration.requiresStableStateSigner && !stateSigner.stable) {\n        throw new Error(\n          `MastraFactory: integration '${integration.id}' signs OAuth state and requires a ` +\n            `replica-stable state secret, but none is configured. Set 'stateSecret' on the factory config.`,\n        );\n      }\n    }\n\n    // The SDK needs to know which backend the injected Mastra store uses\n    // (its own `instanceof` detection breaks when the dependency graph holds\n    // duplicate package copies). Resolve it by walking the FactoryStorage\n    // prototype chain by class name — the factory can't import the concrete\n    // classes since '@mastra/pg' / '@mastra/libsql' are the user's choice.\n    const mastraStorageBackend = (() => {\n      for (let proto = Object.getPrototypeOf(storage); proto; proto = Object.getPrototypeOf(proto)) {\n        if (proto.constructor?.name === 'PgFactoryStorage') return 'pg' as const;\n        if (proto.constructor?.name === 'LibSQLFactoryStorage') return 'libsql' as const;\n      }\n      return undefined;\n    })();\n\n    // Integrations contributing tools to agent sessions: org-scoped\n    // `agentTools` (resolved per request) + session-scoped `sessionTools`.\n    const toolIntegrations = integrationRegistrations.filter(\n      ({ integration }) => integration.agentTools || integration.sessionTools,\n    );\n\n    // Build the real production controller (agents, modes, tools, memory, OM,\n    // MCP, providers) — identical to the terminal app. Agent state lives in\n    // the storage backend's Mastra store alongside the Factory app tables —\n    // one shared database for all users, separated by `resourceId` scoping.\n    const prepared = await timedPhase('prepare.controllerMount', () =>\n      prepareAgentControllerMount({\n        controllerId: CONTROLLER_ID,\n        coAuthor: { name: 'mastra-platform[bot]' },\n        workspace: createWorkspaceFactory({\n          ...(sandboxConfig ? { sandbox: sandboxConfig } : {}),\n          ...(this.#config.sandboxStart ? { sandboxStart: this.#config.sandboxStart } : {}),\n          ...(githubIntegration ? { github: githubIntegration } : {}),\n          ...(factoryProjectsStorage ? { projects: factoryProjectsStorage } : {}),\n          ...(workItemsStorage ? { workItems: workItemsStorage } : {}),\n          workspaceRegistry,\n        }),\n        disableGithubSignals: true,\n        // Memory settings live in the factory's `memory-settings` app table (per\n        // org/user), so the host machine's TUI settings.json must not seed them.\n        disableSettingsOmSeed: true,\n        hostInstructions: ({ requestContext }) => {\n          const context = requestContext.get('controller') as\n            | AgentControllerRequestContext<MastraCodeState>\n            | undefined;\n          return parseSupervisorResourceId(context?.resourceId) ? SUPERVISOR_INSTRUCTIONS : undefined;\n        },\n        // A factory reads the repository it works on and its skill, never the\n        // ~/.claude instructions of whoever hosts the process. On the controller\n        // rather than per session, so webhook-recreated sessions keep it too.\n        // Blank project identity for the same reason: the SDK's defaults seed\n        // sessions with the HOST process's own project root / name / branch,\n        // which must never reach a hosted session's prompt. Repo-backed\n        // sessions get their real workdir pinned by workspace resolution;\n        // chat-only sessions legitimately have no project.\n        // Factory sessions also start fail-closed on org classification: the\n        // unresolved marker is set at birth, a successful org seed clears it,\n        // and a resolved `factoryOrgId` always takes precedence — so a failed\n        // (best-effort) seed can never leave a session classified as local.\n        initialState: {\n          skipGlobalInstructions: true,\n          factoryOrgUnresolved: true,\n          projectPath: '',\n          projectName: '',\n          gitBranch: '',\n        },\n        storage: storage.getMastraStorage(),\n        ...(mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {}),\n        ...(factoryProcessor ? { inputProcessors: [factoryProcessor] } : {}),\n        ...(vector ? { vector } : {}),\n        ...(toolIntegrations.length > 0 || (workItemsStorage && transitionService)\n          ? {\n              extraTools: async ({ requestContext }: { requestContext: RequestContext }) => {\n                const tools: IntegrationTools = {};\n                const toolOwners = new Map<string, string>();\n                const mergeTools = (ownerId: string, contributed: IntegrationTools) => {\n                  for (const [name, tool] of Object.entries(contributed)) {\n                    const owner = toolOwners.get(name);\n                    if (owner) {\n                      throw new Error(\n                        `MastraFactory: integration tool '${name}' from '${ownerId}' conflicts with '${owner}'.`,\n                      );\n                    }\n                    toolOwners.set(name, ownerId);\n                    tools[name] = tool;\n                  }\n                };\n                if (workItemsStorage && transitionService) {\n                  mergeTools(\n                    'factory',\n                    await createFactoryTransitionTools({\n                      requestContext,\n                      storage: workItemsStorage,\n                      transitionService,\n                      // Heals crash-resumed sessions: recovered addresses re-seed\n                      // projectRepositoryId/baseRef from the source session record.\n                      // Only offered while the source-control domain is ready — a\n                      // throwing lookup would abort recovery's catch block and also\n                      // skip the metadata baseRef fallback.\n                      ...(storage.isDomainReady('source-control')\n                        ? { sessions: sourceControlStorage.forIntegration('github').sessions }\n                        : {}),\n                    }),\n                  );\n                  // The supervisor session has no seat, so it never gets the\n                  // transition tool above; it gets the read surface instead,\n                  // and only once the caller's org is shown to own the project.\n                  const supervisorScope = await resolveSupervisorScope({\n                    requestContext,\n                    projects: factoryProjectsStorage,\n                  });\n                  if (supervisorScope) {\n                    const userId = getFactoryAuthUserId(getFactoryAuthUserFromContext(requestContext));\n                    mergeTools(\n                      'factory-supervisor',\n                      createFactorySupervisorReadTools({\n                        scope: supervisorScope,\n                        workItems: workItemsStorage,\n                        boards: this.#boards,\n                        comments: workItemCommentsStorage,\n                        audit: auditStorage,\n                        messageReader: {\n                          listMessages: async input => {\n                            const memory = await storage.getMastraStorage().getStore('memory');\n                            return memory ? memory.listMessages(input) : { messages: [], hasMore: false };\n                          },\n                        },\n                      }),\n                    );\n                    if (userId) {\n                      mergeTools(\n                        'factory-supervisor-write',\n                        createFactorySupervisorWriteTools({\n                          scope: supervisorScope,\n                          userId,\n                          workItems: workItemsStorage,\n                          audit: auditDomain,\n                          transitionService,\n                          ...(githubIntegration\n                            ? {\n                                reconcileAcceptanceLabels: (args: {\n                                  orgId: string;\n                                  factoryProjectId: string;\n                                  item: WorkItemRow;\n                                }) =>\n                                  reconcileGithubAcceptanceLabels(\n                                    githubIntegration,\n                                    sourceControlStorage.forIntegration(githubIntegration.id),\n                                    args,\n                                  ),\n                              }\n                            : {}),\n                          signalSession: async ({ sessionId, message }) => {\n                            const session = await prepared.base.controller.getSessionByResource(sessionId);\n                            if (!session) throw new Error('The worker session is not currently available.');\n                            await session.sendMessage({\n                              content: message,\n                              ...(requestContext ? { requestContext } : {}),\n                            });\n                          },\n                        }),\n                      );\n                    }\n                  }\n                }\n                for (const { integration, ready, ensureReady } of toolIntegrations) {\n                  if (!ready && ensureReady) {\n                    try {\n                      await ensureReady();\n                    } catch {\n                      continue;\n                    }\n                  }\n                  if (integration.agentTools) {\n                    mergeTools(integration.id, await integration.agentTools({ requestContext }));\n                  }\n                  if (integration.sessionTools) {\n                    mergeTools(integration.id, integration.sessionTools({ requestContext }));\n                  }\n                }\n                return tools;\n              },\n            }\n          : {}),\n        postToolObserver: async (toolContext: IntegrationPostToolContext) => {\n          const requestContext = (toolContext.context as { requestContext?: RequestContext } | undefined)\n            ?.requestContext;\n          if (requestContext) {\n            await observeAgentGitAction({\n              audit: auditDomain,\n              toolContext: { ...toolContext, context: requestContext },\n            });\n          }\n          await Promise.all(\n            integrations.map(async integration => {\n              if (!integration.postToolObserver) return;\n              try {\n                await integration.postToolObserver({ toolContext, requestContext });\n              } catch (error) {\n                console.warn(`[factory] Integration '${integration.id}' post-tool observer failed:`, error);\n              }\n            }),\n          );\n        },\n        ...(pubsub ? { pubsub, crossProcessPubSub: true } : {}),\n        buildApiRoutes: ({ controller, authStorage }: BuildApiRoutesDeps) => [\n          // Public `/auth/*` routes (login/callback/logout/me). Folded in as\n          // `apiRoutes` (not plain Hono routes) because the entry can't touch the\n          // Hono app the deployer generates. `requiresAuth: false`; the gate\n          // skips `/auth/*`.\n          ...(auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : []),\n          ...new TelemetryRoutes({ auth: routeAuth, providerName: auth?.name, publicOrigin, allowedOrigins }).routes(),\n          // Custom `/web/*` routes (fs / config / integrations / factory / audit).\n          ...assembleFactoryApiRoutes({\n            controllerId: CONTROLLER_ID,\n            controller,\n            liveSessions: liveSessionsTouchingTheFeed(controller, eventBus),\n            auth: routeAuth,\n            ...(auth && isUserProvider(auth) ? { users: auth } : {}),\n            authStorage,\n            audit: auditDomain,\n            publicOrigin,\n            stateSigner,\n            sandbox: sandboxConfig,\n            sessionRetirement,\n            factoryStorage: storage,\n            integrationStorage,\n            sourceControlStorage,\n            domains,\n            feed: commentsDomain,\n            integrations: integrationRegistrations,\n            intakeReady,\n            factoryReady,\n            knowledgeEnabled,\n            configVersion,\n            boardRegistry: this.#boards,\n            factoryTransitionService: transitionService,\n            onFactoryRuntime: ({ transitionService: runtimeTransitionService, prepareBinding }) => {\n              this.#dispatcher ??= new FactoryDecisionDispatcher({\n                controller,\n                transitionService: runtimeTransitionService,\n                storage: storage.getDomain<WorkItemsStorage>('work-items'),\n                audit: auditDomain,\n                boards: this.#boards,\n                maxInFlight: this.#config.dispatcher?.maxInFlight,\n                isAutoRunEnabled: async ({ orgId, factoryProjectId }) => {\n                  await factoryProjectsStorage.ensureReady();\n                  const project = await factoryProjectsStorage.get({ orgId, id: factoryProjectId });\n                  return project?.autoRunEnabled ?? false;\n                },\n                autoApprovePlans: async ({ orgId, factoryProjectId }) => {\n                  await factoryProjectsStorage.ensureReady();\n                  const project = await factoryProjectsStorage.get({ orgId, id: factoryProjectId });\n                  return project?.autoApprovePlans ?? false;\n                },\n                reconcileToolResults: () => factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n                prepareBinding,\n                refreshManagedMemorySettings: ({ binding, session }) =>\n                  refreshFactorySessionMemorySettings(session, {\n                    orgId: binding.orgId,\n                    factoryProjectId: binding.factoryProjectId,\n                    projects: factoryProjectsStorage,\n                    memorySettings: memorySettingsStorage,\n                  }),\n                feedReader: new FactoryFeedReader(workItemCommentsStorage),\n                primeCredentials: tenant => primeTenantCredentials({ tenant, credentials: modelCredentialsStorage }),\n                resolveLinkedWorkItemParentId: async ({ orgId, factoryProjectId, decision }) => {\n                  if (decision.source !== 'github-pr') return null;\n                  const repositoryId = decision.metadata?.githubRepositoryId;\n                  const pullRequestNumber = decision.metadata?.githubPullRequestNumber;\n                  if (typeof repositoryId !== 'number' || typeof pullRequestNumber !== 'number') return null;\n                  return resolveFactoryPullRequestParentWorkItemId(\n                    integrationStorage.forIntegration<\n                      Record<string, unknown>,\n                      Record<string, unknown>,\n                      FactoryPullRequestProvenanceData\n                    >('github'),\n                    { orgId, factoryProjectId, repositoryId, pullRequestNumber },\n                  );\n                },\n              });\n            },\n          }),\n          ...projectRoutes.routes(),\n          ...auditDomain.routes(),\n          ...commentsDomain.routes(),\n        ],\n        buildServerConfig: () => {\n          const cors = allowedOrigins.length ? { cors: { origin: allowedOrigins, credentials: true } } : {};\n          // Log route errors with method/path/stack and answer with structured\n          // JSON instead of an opaque `Internal Server Error`. Applied by the\n          // deployer to both the top-level app and the custom-route sub-app.\n          const onError = { onError: handleServerError };\n          // Same-origin SPA: when a vite build is present (see resolveUiDistDir),\n          // serve it at `/` from this server. Mounted last so the auth gate (when\n          // enabled) covers it; it always passes `/api`, `/web`, `/auth` through.\n          const uiDist = resolveUiDistDir();\n          const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];\n          if (!auth) {\n            // Auth disabled: no gate. Still prime the sentinel-local custom\n            // provider snapshot so model calls see DB rows, then SPA + CORS.\n            return {\n              middleware: [\n                createCustomProvidersPrimer({ auth: routeAuth, storage: customProvidersStorage, authEnabled: false }),\n                ...spa,\n              ],\n              ...cors,\n              ...onError,\n            };\n          }\n\n          // Ordered middleware. The deployer applies these AFTER its context\n          // middleware sets `c.set('mastra', mastra)` and BEFORE routes, so:\n          //   1. gate   — validates the auth session, stashes the user, and 401s /\n          //               redirects unauthenticated requests. Skips public `/auth/*`.\n          //   2. primers — hydrate the caller's model-credential and custom\n          //               provider snapshots so the request's first model call\n          //               resolves tenant credentials and custom providers.\n          //   3. spa    — serves the built UI for everything the server doesn't own.\n          // `auth` also lands on `server.auth` so the core auth middleware (and\n          // Studio's dual-auth routing — see `studio.auth` on the returned args)\n          // authenticates core `/api/*` routes with the same provider.\n          return {\n            auth,\n            middleware: [\n              createFactoryAuthGate(auth),\n              createTenantCredentialPrimer({ auth: routeAuth, credentials: modelCredentialsStorage }),\n              createCustomProvidersPrimer({\n                auth: routeAuth,\n                storage: customProvidersStorage,\n                authEnabled: Boolean(auth),\n              }),\n              ...spa,\n            ],\n            ...cors,\n            ...onError,\n          };\n        },\n      }),\n    );\n\n    prepared.base.controller.onSessionCreated(session => {\n      observeSessionFilesystem(session, {\n        filesystem: filesystemStorage,\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionFirstMessage(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionFirstExec(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionThreadTitle(session, {\n        sourceControl: sourceControlStorage.forIntegration('github'),\n      });\n      observeSessionRunEnd(session, { audit: auditDomain });\n    });\n\n    // Supervisor sessions carry their project in the resourceId; re-stamp\n    // scope, instructions and factory defaults on every (re)creation so a\n    // restarted server heals the in-memory state.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSupervisorSession(session, {\n          projects: factoryProjectsStorage,\n          memorySettings: memorySettingsStorage,\n        }).catch(error => {\n          console.warn('[Factory Supervisor] Failed to hydrate supervisor session', {\n            error: error instanceof Error ? error.message : String(error),\n          });\n        }),\n      { blocking: true },\n    );\n\n    // Blocking: `createSession` awaits this seed, so when hydration succeeds\n    // a session's first run starts with the owner's stored OM settings.\n    // Best-effort — failures are logged inside the helper, never thrown, and\n    // the session then falls back to its persisted/default OM configuration.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionMemorySettings(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          projects: factoryProjectsStorage,\n          memorySettings: memorySettingsStorage,\n        }),\n      { blocking: true },\n    );\n\n    // Personal model packs seed interactive user sessions only. Active Factory\n    // run bindings are excluded and continue to use the project default model.\n    prepared.base.controller.onSessionCreated(\n      session =>\n        hydrateSessionModelPack(session, {\n          sourceControl: sourceControlStorage.forIntegration('github'),\n          workItems: workItemsStorage,\n          modelPacks: modelPacksStorage,\n        }),\n      { blocking: true },\n    );\n\n    this.#prepared = prepared;\n    this.#factoryProcessor = factoryProcessor;\n\n    // Chat-platform channels (Slack, Discord, …) contributed by integrations,\n    // attached to the mounted controller so inbound platform messages reach\n    // the same agents the web UI drives. READY integrations only — readiness\n    // means the `channel-identity` domain's `init()` succeeded, so its link\n    // table is queryable. Without it a sender can't be resolved to a tenant,\n    // and attaching anyway would dispatch runs on default credentials.\n    const channelRegistrations = integrationRegistrations.filter(\n      ({ integration, ready }) => ready && integration.channels,\n    );\n    // `setChannels` replaces rather than merges, so a second provider would\n    // silently never receive a message. Fail loud instead.\n    if (channelRegistrations.length > 1) {\n      throw new Error(\n        `MastraFactory: integrations [${channelRegistrations\n          .map(({ integration }) => integration.id)\n          .join(', ')}] all provide channels, but only one may. Remove all but one.`,\n      );\n    }\n    for (const { integration } of channelRegistrations) {\n      const context = buildIntegrationContext(\n        {\n          controller: prepared.base.controller,\n          publicOrigin,\n          auth: routeAuth,\n          stateSigner,\n          sandbox: sandboxConfig,\n          factoryStorage: storage,\n          integrationStorage,\n          sourceControlStorage,\n          configVersion,\n          boardRegistry: this.#boards,\n          factoryReady,\n          domains,\n          feed: commentsDomain,\n          ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n        },\n        integration.id,\n      );\n      // Integrations return a channels CONFIG; the factory owns construction.\n      prepared.base.controller.setChannels(new AgentControllerChannels(integration.channels!(context)));\n      // A publisher posts through the channel SDK this loop just wired up.\n      const publisher = integration.feedPublisher?.(context);\n      if (publisher) feedPublishers.push(publisher);\n    }\n\n    // Integration lifecycle workers (e.g. polling an upstream without\n    // webhooks): collected from READY integrations only, folded into the\n    // constructor args so `new Mastra(...)` merges them with the default\n    // workers and `finalize()`'s `startWorkers()` starts them alongside the\n    // built-ins. Never passed for the disabled/not-ready case — a worker for\n    // an unavailable integration must not run.\n    const integrationWorkers = [\n      ...(factoryReady\n        ? [\n            new FactorySupervisorHealthWorker({\n              projects: factoryProjectsStorage,\n              workItems: workItemsStorage,\n              boards: this.#boards,\n            }),\n          ]\n        : []),\n      ...integrationRegistrations\n        .filter(({ integration, ready }) => ready && integration.workers)\n        .flatMap(({ integration }) =>\n          integration.workers!(\n            buildIntegrationContext(\n              {\n                controller: prepared.base.controller,\n                publicOrigin,\n                auth: routeAuth,\n                stateSigner,\n                sandbox: sandboxConfig,\n                factoryStorage: storage,\n                integrationStorage,\n                sourceControlStorage,\n                configVersion,\n                boardRegistry: this.#boards,\n                factoryReady,\n                domains,\n                feed: commentsDomain,\n                ...(githubIntegration ? { sourceControlOwnerId: 'github' } : {}),\n              },\n              integration.id,\n            ),\n          ),\n        ),\n    ];\n\n    return {\n      ...prepared.mastraArgs,\n      // Same provider on `studio.auth` as on `server.auth` (buildServerConfig):\n      // deployed factories must authenticate BOTH plain API callers and Studio\n      // requests (`x-mastra-client-type: studio` routes to `studio.auth`).\n      ...(auth ? { studio: { auth } } : {}),\n      ...(integrationWorkers.length > 0 ? { workers: integrationWorkers } : {}),\n    };\n  }\n\n  /**\n   * Post-construct boot: initialize the controller (which inherits the\n   * constructed Mastra's storage) and start its workers. Call AFTER the entry\n   * has run `new Mastra(prepare()'s args)`.\n   */\n  async finalize(): Promise<void> {\n    if (!this.#prepared) {\n      throw new Error('MastraFactory.finalize() called before prepare()');\n    }\n    await timedPhase('finalize.controller', () => this.#prepared!.finalize());\n    await timedPhase(\n      'finalize.reconcileBoundThreads',\n      () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve(),\n    );\n    this.#dispatcher?.start();\n  }\n\n  /** Stop Factory-owned background dispatch before the host process shuts down. */\n  async shutdown(): Promise<void> {\n    await this.#dispatcher?.stop();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiPA,MAAM,gBAAgB;AAEtB,SAAS,yBAAkC;CAIzC,OAAO,QAAQ,QAAQ,IAAI,8BAA8B,KAAK,KAAK,QAAQ,IAAI,4BAA4B,KAAK,CAAC;AACnH;;;;;;;;;;;;;;;;AAiBA,SAAS,uBAAuB,WAAwC;CACtE,OAAO,IAAI,iBAAiB,EAC1B,cAAc,0BAA0B,SAAS,EACnD,CAAC;AACH;;;;;;;;;;;;;;;AAgBA,MAAM,gCAAgC,CAAC,gBAAgB,WAAW;AAElE,SAAS,YAAY,UAA2B;CAI9C,IAAI,SAAS,SAAS,GAAG,GAAG,OAAO;CACnC,OAAO,oBAAoB,KAAK,QAAQ;AAC1C;AAEA,SAAS,0BAA0B,WAAuC;CACxE,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,SAAS,CAAC,CAAC,SAAS,YAAY;CACrD,QAAQ;EACN;CACF;CACA,IAAI,aAAa,eAAe,YAAY,QAAQ,GAAG,OAAO,KAAA;CAC9D,KAAK,MAAM,UAAU,+BAA+B;EAGlD,IAAI,aAAa,QAAQ,OAAO,KAAA;EAChC,IAAI,SAAS,SAAS,IAAI,QAAQ,GAAG,OAAO,IAAI;CAClD;AAEF;;AAGA,SAAS,4BAA4B,YAA8C,UAAgC;CACjH,MAAM,eAAe,IAAI,aAAa,UAAU;CAChD,aAAa,iBAAgB,YAAW;EACtC,MAAM,EAAE,cAAc,qBAAqB,QAAQ,MAAM,IAAI;EAC7D,IAAI,gBAAgB,kBAAkB,UAAU,UAAU;GAAE,OAAO;GAAc;EAAiB,CAAC;CACrG,CAAC;CACD,OAAO;AACT;AAEA,IAAa,gBAAb,MAA2B;CACzB;CACA;CACA;CACA;CACA;CACA;CACA,aAAa;CAEb,YAAY,QAA6B;EACvC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,oOAGF;EAEF,KAAKC,UAAU,oBAAoB;GACjC,QAAQ,OAAO;GACf,sBAAsB,OAAO;EAC/B,CAAC;EACD,IAAI,WAAW,QACb,MAAM,IAAI,MACR,2JAEF;EAEF,KAAKC,iBAAiB,2BAA2B,OAAO,iBAAA,mBAA+C;EACvG,KAAKF,UAAU;CACjB;;;;;;CAOA,MAAM,UAA+B;EAInC,IAAI,KAAKG,YAAY,MAAM,IAAI,MAAM,sCAAsC;EAC3E,KAAKA,aAAa;EAElB,MAAM,gBAAgB,KAAKH,QAAQ,aAAa,wBAAA,CAAyB,QAAQ,QAAQ,EAAE;EAC3F,MAAM,kBAAkB,KAAKA,QAAQ,kBAAkB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO;EACzG,MAAM,UAAU,KAAKA,QAAQ;EAC7B,MAAM,SAAS,KAAKA,QAAQ;EAC5B,MAAM,SAAS,KAAKA,QAAQ;EAG5B,MAAM,WAAW,UAAU,IAAI,mBAAmB;EAMlD,MAAM,iBAAiB,KAAKA,QAAQ;EACpC,MAAM,OACJ,mBAAmB,OAAO,KAAA,IAAa,kBAAkB,uBAAuB,YAAY;EAC9F,IAAI,QAAQ,CAAC,KAAKA,QAAQ,kBACxB,QAAQ,KACN,kRAGF;EAEF,MAAM,mBAAmB,KAAKA,QAAQ,oBAAoB,uCAAuC;EAGjG,MAAM,YAAY,uBAAuB,IAAI;EAI7C,MAAM,eAAe,CAAC,GAAI,KAAKA,QAAQ,gBAAgB,CAAC,CAAE;EAC1D,IAAI,uBAAuB,GAAG;GAC5B,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,EAAE,MAAM,KAAKA,QAAQ,UAAU,cAAc,CAAC,CAAC;GAEjG,IACE,QAAQ,IAAI,kCAAkC,KAAK,KACnD,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,YAAY,GAEjE,aAAa,KAAK,IAAI,8BAA8B,CAAC;GAEvD,IAAI,CAAC,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ,GAC/D,aAAa,KAAK,IAAI,0BAA0B,CAAC;EAErD;EAIA,MAAM,iCAAiB,IAAI,IAAY;EACvC,KAAK,MAAM,eAAe,cAAc;GACtC,IAAI,eAAe,IAAI,YAAY,EAAE,GACnC,MAAM,IAAI,MAAM,4CAA4C,YAAY,GAAG,qBAAqB;GAElG,eAAe,IAAI,YAAY,EAAE;EACnC;EACA,MAAM,gBAAgB,KAAKE;EAI3B,MAAM,gBAAgB,QAAQ,eAAe,IAAI,cAAc,CAAC;EAChE,MAAM,eAAe,QAAQ,eAAe,IAAI,aAAa,CAAC;EAC9D,MAAM,mBAAmB,QAAQ,eAAe,IAAI,iBAAiB,CAAC;EACtE,iBAAiB,oBAAmB,UAAS,UAAU,UAAU,KAAK,CAAC;EACvE,iBAAiB,2BAA0B,SAAQ,uBAAuB,KAAKD,SAAS,IAAI,CAAC,EAAE,SAAS,UAAU;EAClH,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,gBAAgB,CAAC;EACpG,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,wBAAwB,QAAQ,eAAe,IAAI,sBAAsB,CAAC;EAChF,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,gBAAgB,CAAC;EAClG,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,CAAC;EAG1E,MAAM,qBAAqB,QAAQ,eAAe,IAAI,mBAAmB,gBAAgB,CAAC;EAC1F,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,oBAAoB,QAAQ,eAAe,IAAI,kBAAkB,CAAC;EACxE,MAAM,uBAAuB,QAAQ,eAAe,IAAI,qBAAqB,CAAC;EAG9E,MAAM,yBAAyB,QAAQ,eAAe,IAAI,uBAAuB,CAAC;EAClF,MAAM,0BAA0B,QAAQ,eAAe,IAAI,wBAAwB,CAAC;EAGpF,MAAM,UAAU;GACd,QAAQ;GACR,kBAAkB;GAClB,YAAY;GACZ,gBAAgB;GAChB,iBAAiB;GACjB,YAAY;GACZ,UAAU;GACV,aAAa;GACb,WAAW;GACX,iBAAiB;GACjB,UAAU;EACZ;EACA,MAAM,cAAc,IAAI,YAAY;GAClC,MAAM;GACN,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,eAAe,IAAI,IAAI,OAAO,KAAA;GAC7C,OAAO;GACP,cAAa,mBAAkB;IAC7B,MAAM,OAAO,8BAA8B,cAAc;IACzD,OAAO;KAAE,OAAO,oBAAoB,IAAI;KAAG,QAAQ,qBAAqB,IAAI;IAAE;GAChF;EACF,CAAC;EAED,MAAM,iBAA0C,CAAC;EACjD,MAAM,iBAAiB,IAAI,eAAe;GACxC,MAAM;GACN,UAAU;GACV,WAAW;GACX,UAAU;GACV,iBAAiB;GACjB,OAAO;GACP,YAAY;GACZ,QAAQ;EACV,CAAC;EAMD,MAAM,gBAAgB,KAAKD,QAAQ;EACnC,IAAI,kBAAkB,KAAA,KAAa,OAAO,kBAAkB,YAAY;GAKtE,IAAI,OAAO,kBAAkB,YAAY,kBAAkB,MACzD,MAAM,IAAI,MACR,oqBAGF;GAEF,MAAM,IAAI,MACR,wGACF;EACF;EAEA,MAAM,oBAAoB,IAAI,yBAAyB;EAKvD,MAAM,cAAc,kBAAkB,KAAKA,QAAQ,WAAW;EAO9D,IAAI,QAAQ,YAAY,IAAI,GAC1B,MAAM,WAAW,2BACf,KAAK,KAAK;GAAE,UAAU,QAAQ,eAAe;GAAG,WAAW;GAAc;EAAe,CAAC,CAC3F;EAKF,MAAM,WAAW,8BAA8B,QAAQ,KAAK,CAAC;EAY7D,IAAI,MACF,iCAAiC,uBAAuB;EAM1D,8BAA8B;GAAE,SAAS;GAAwB,aAAa,QAAQ,IAAI;EAAE,CAAC;EAE7F,KAAK,MAAM,eAAe,cAAc;GACtC,YAAY,aAAa;IACvB,SAAS,mBAAmB,eAAe,YAAY,EAAE;IACzD,UAAU;IACV,MAAM;GACR,CAAC;GACD,IAAI,YAAY,gBACd,YAAY,eAAe,WAAW,EACpC,SAAS,qBAAqB,eAAe,YAAY,EAAE,EAC7D,CAAC;EAEL;EAKA,MAAM,2BAA2B,aAAa,KAAI,gBAAe;GAC/D,MAAM,kBAAkB;IACtB;IACA,GAAI,YAAY,iBAAiB,CAAC,gBAAgB,IAAI,CAAC;IAGvD,GAAI,YAAY,WAAW,CAAC,kBAAkB,IAAI,CAAC;GACrD;GACA,OAAO;IACL;IACA,OAAO,gBAAgB,OAAM,WAAU,QAAQ,cAAc,MAAM,CAAC;IACpE,aAAa,YAAY;KACvB,KAAK,MAAM,UAAU,iBAAiB,MAAM,QAAQ,kBAAkB,MAAM;IAC9E;GACF;EACF,CAAC;EACD,MAAM,cACJ,aAAa,MAAK,gBAAe,YAAY,WAAW,KAAA,CAAS,KAAK,QAAQ,cAAc,QAAQ;EACtG,MAAM,eAAe,QAAQ,cAAc,UAAU,KAAK,QAAQ,cAAc,YAAY;EAC5F,MAAM,mBAAmB,QAAQ,IAAI,yCAAyC;EAC9E,MAAM,oBAAoB,aAAa,MAAK,gBAAe,YAAY,OAAO,QAAQ;EAGtF,MAAM,iBAAiB,QAAQ,cAAc,YAAY;EACzD,MAAM,oBACJ,iBAAiB,QAAQ,cAAc,gBAAgB,IACnD,IAAI,6BAA6B,EAC/B,oBAAmB,cAAa,kBAAkB,kBAAkB,SAAS,EAC/E,CAAC,IACD,KAAA;EACN,MAAM,yBACJ,qBAAqB,qBAAqB,iBACtC,OAAO,EAAE,OAAO,iBACd,kBAAkB,uBAAuB;GACvC,WAAW;GACX,eAAe,qBAAqB,eAAe,kBAAkB,EAAE;GACvE;GACA;EACF,CAAC,IACH,KAAA;EAMN,MAAM,kBAAkB,iBACpB,2BAA2B;GACzB,WAAW;GAGX,kBAAkB,OAAO,YAA2B;IAClD,MAAM,kBAAkB,iBAAiB,OAAO;GAClD;GAGA,GAAI,yBAAyB,EAAE,kBAAkB,uBAAuB,IAAI,CAAC;EAC/E,CAAC,IACD;EACJ,MAAM,oBAAoB,iBACtB,IAAI,yBAAyB;GAC3B;GACA,QAAQ,KAAKC;GACb,SAAS;GACT,OAAO;GACP,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;GAC7C,GAAI,oBACA,EACE,aAAa,SACX,gCACE,mBACA,qBAAqB,eAAe,kBAAkB,EAAE,GACxD,IACF,EACJ,IACA,CAAC;EACP,CAAC,IACD,KAAA;EACJ,MAAM,gBAAgB,IAAI,cAAc;GACtC,MAAM;GACN,UAAU;GACV,eAAe;GACf,8BAA8B,aAC3B,QAAO,gBAAe,YAAY,cAAc,CAAC,CACjD,KAAI,gBAAe,YAAY,EAAE;GACpC,GAAI,oBACA,EACE,mBAAmB,OAAO,EAAE,eAAe,OAAO,gBAAgB,YAAY,WAAW;IACvF,IAAI,kBAAkB,kBAAkB,IAAI,OAAO;IACnD,MAAM,eAAe,MAAM,kBAAkB,qBAAqB,cAAc,IAAI;KAClF;KACA,IAAI;IACN,CAAC;IACD,IAAI,CAAC,cAAc,OAAO;IAE1B,MAAM,YAAW,MADU,kBAAkB,sBAAsB,OAAO,aAAa,UAAU,CAAC,EAAA,CACpE,MAAK,SAAQ,KAAK,GAAG,SAAS,MAAM,cAAc,KAAK,aAAa,IAAI;IACtG,IAAI,CAAC,UAAU,OAAO;IACtB,OAAO,kBAAkB,qBAAqB,aAAa,OAAO;KAChE;KACA,OAAO;MACL;MACA;MACA,MAAM,SAAS;MACf,eAAe,cAAc,SAAS,aAAa,IAAI,SAAS,gBAAgB;MAChF,kBAAkB;OAAE,SAAS,SAAS;OAAS,OAAO,SAAS;MAAM;KACvE;IACF,CAAC;GACH,EACF,IACA,CAAC;GACL,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,iBAAiB,EAAE,WAAW,iBAAiB,IAAI,CAAC;EAC1D,CAAC;EACD,MAAM,mBAAmB,iBACrB,IAAI,2BAA2B;GAC7B;GACA,SAAS;GACT,QAAQ,KAAKA;GACb,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;GACjD,GAAI,oBACA,EACE,8BAA8B,UAC5B,mCACE,mBACA,qBAAqB,eAAe,QAAQ,GAC5C,mBAAmB,eAAe,QAAQ,GAC1C,kBACA,KACF,EACJ,IACA,CAAC;GACL,eAAe,EACb,cAAc,OAAM,UAAS;IAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;IACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;KAAE,UAAU,CAAC;KAAG,SAAS;IAAM;GAC9E,EACF;EACF,CAAC,IACD,KAAA;EAMJ,KAAK,MAAM,EAAE,iBAAiB,0BAC5B,IAAI,YAAY,6BAA6B,CAAC,YAAY,QACxD,MAAM,IAAI,MACR,+BAA+B,YAAY,GAAG,iIAEhD;EASJ,MAAM,8BAA8B;GAClC,KAAK,IAAI,QAAQ,OAAO,eAAe,OAAO,GAAG,OAAO,QAAQ,OAAO,eAAe,KAAK,GAAG;IAC5F,IAAI,MAAM,aAAa,SAAS,oBAAoB,OAAO;IAC3D,IAAI,MAAM,aAAa,SAAS,wBAAwB,OAAO;GACjE;EAEF,EAAA,CAAG;EAIH,MAAM,mBAAmB,yBAAyB,QAC/C,EAAE,kBAAkB,YAAY,cAAc,YAAY,YAC7D;EAMA,MAAM,WAAW,MAAM,WAAW,iCAChC,4BAA4B;GAC1B,cAAc;GACd,UAAU,EAAE,MAAM,uBAAuB;GACzC,WAAW,uBAAuB;IAChC,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;IAClD,GAAI,KAAKD,QAAQ,eAAe,EAAE,cAAc,KAAKA,QAAQ,aAAa,IAAI,CAAC;IAC/E,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;IACzD,GAAI,yBAAyB,EAAE,UAAU,uBAAuB,IAAI,CAAC;IACrE,GAAI,mBAAmB,EAAE,WAAW,iBAAiB,IAAI,CAAC;IAC1D;GACF,CAAC;GACD,sBAAsB;GAGtB,uBAAuB;GACvB,mBAAmB,EAAE,qBAAqB;IAIxC,OAAO,0BAHS,eAAe,IAAI,YAGI,CAAC,EAAE,UAAU,IAAI,0BAA0B,KAAA;GACpF;GAaA,cAAc;IACZ,wBAAwB;IACxB,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,WAAW;GACb;GACA,SAAS,QAAQ,iBAAiB;GAClC,GAAI,uBAAuB,EAAE,gBAAgB,qBAAqB,IAAI,CAAC;GACvE,GAAI,mBAAmB,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC;GAClE,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC3B,GAAI,iBAAiB,SAAS,KAAM,oBAAoB,oBACpD,EACE,YAAY,OAAO,EAAE,qBAAyD;IAC5E,MAAM,QAA0B,CAAC;IACjC,MAAM,6BAAa,IAAI,IAAoB;IAC3C,MAAM,cAAc,SAAiB,gBAAkC;KACrE,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,GAAG;MACtD,MAAM,QAAQ,WAAW,IAAI,IAAI;MACjC,IAAI,OACF,MAAM,IAAI,MACR,oCAAoC,KAAK,UAAU,QAAQ,oBAAoB,MAAM,GACvF;MAEF,WAAW,IAAI,MAAM,OAAO;MAC5B,MAAM,QAAQ;KAChB;IACF;IACA,IAAI,oBAAoB,mBAAmB;KACzC,WACE,WACA,MAAM,6BAA6B;MACjC;MACA,SAAS;MACT;MAMA,GAAI,QAAQ,cAAc,gBAAgB,IACtC,EAAE,UAAU,qBAAqB,eAAe,QAAQ,CAAC,CAAC,SAAS,IACnE,CAAC;KACP,CAAC,CACH;KAIA,MAAM,kBAAkB,MAAM,uBAAuB;MACnD;MACA,UAAU;KACZ,CAAC;KACD,IAAI,iBAAiB;MACnB,MAAM,SAAS,qBAAqB,8BAA8B,cAAc,CAAC;MACjF,WACE,sBACA,iCAAiC;OAC/B,OAAO;OACP,WAAW;OACX,QAAQ,KAAKC;OACb,UAAU;OACV,OAAO;OACP,eAAe,EACb,cAAc,OAAM,UAAS;QAC3B,MAAM,SAAS,MAAM,QAAQ,iBAAiB,CAAC,CAAC,SAAS,QAAQ;QACjE,OAAO,SAAS,OAAO,aAAa,KAAK,IAAI;SAAE,UAAU,CAAC;SAAG,SAAS;QAAM;OAC9E,EACF;MACF,CAAC,CACH;MACA,IAAI,QACF,WACE,4BACA,kCAAkC;OAChC,OAAO;OACP;OACA,WAAW;OACX,OAAO;OACP;OACA,GAAI,oBACA,EACE,4BAA4B,SAK1B,gCACE,mBACA,qBAAqB,eAAe,kBAAkB,EAAE,GACxD,IACF,EACJ,IACA,CAAC;OACL,eAAe,OAAO,EAAE,WAAW,cAAc;QAC/C,MAAM,UAAU,MAAM,SAAS,KAAK,WAAW,qBAAqB,SAAS;QAC7E,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,gDAAgD;QAC9E,MAAM,QAAQ,YAAY;SACxB,SAAS;SACT,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;QAC7C,CAAC;OACH;MACF,CAAC,CACH;KAEJ;IACF;IACA,KAAK,MAAM,EAAE,aAAa,OAAO,iBAAiB,kBAAkB;KAClE,IAAI,CAAC,SAAS,aACZ,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN;KACF;KAEF,IAAI,YAAY,YACd,WAAW,YAAY,IAAI,MAAM,YAAY,WAAW,EAAE,eAAe,CAAC,CAAC;KAE7E,IAAI,YAAY,cACd,WAAW,YAAY,IAAI,YAAY,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3E;IACA,OAAO;GACT,EACF,IACA,CAAC;GACL,kBAAkB,OAAO,gBAA4C;IACnE,MAAM,iBAAkB,YAAY,SAChC;IACJ,IAAI,gBACF,MAAM,sBAAsB;KAC1B,OAAO;KACP,aAAa;MAAE,GAAG;MAAa,SAAS;KAAe;IACzD,CAAC;IAEH,MAAM,QAAQ,IACZ,aAAa,IAAI,OAAM,gBAAe;KACpC,IAAI,CAAC,YAAY,kBAAkB;KACnC,IAAI;MACF,MAAM,YAAY,iBAAiB;OAAE;OAAa;MAAe,CAAC;KACpE,SAAS,OAAO;MACd,QAAQ,KAAK,0BAA0B,YAAY,GAAG,+BAA+B,KAAK;KAC5F;IACF,CAAC,CACH;GACF;GACA,GAAI,SAAS;IAAE;IAAQ,oBAAoB;GAAK,IAAI,CAAC;GACrD,iBAAiB,EAAE,YAAY,kBAAsC;IAKnE,GAAI,OAAO,gBAAgB,MAAM,EAAE,WAAW,aAAa,CAAC,IAAI,CAAC;IACjE,GAAG,IAAI,gBAAgB;KAAE,MAAM;KAAW,cAAc,MAAM;KAAM;KAAc;IAAe,CAAC,CAAC,CAAC,OAAO;IAE3G,GAAG,yBAAyB;KAC1B,cAAc;KACd;KACA,cAAc,4BAA4B,YAAY,QAAQ;KAC9D,MAAM;KACN,GAAI,QAAQ,eAAe,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KACtD;KACA,OAAO;KACP;KACA;KACA,SAAS;KACT;KACA,gBAAgB;KAChB;KACA;KACA;KACA,MAAM;KACN,cAAc;KACd;KACA;KACA;KACA;KACA,eAAe,KAAKA;KACpB,0BAA0B;KAC1B,mBAAmB,EAAE,mBAAmB,0BAA0B,qBAAqB;MACrF,KAAKG,gBAAgB,IAAI,0BAA0B;OACjD;OACA,mBAAmB;OACnB,SAAS,QAAQ,UAA4B,YAAY;OACzD,OAAO;OACP,QAAQ,KAAKH;OACb,aAAa,KAAKD,QAAQ,YAAY;OACtC,kBAAkB,OAAO,EAAE,OAAO,uBAAuB;QACvD,MAAM,uBAAuB,YAAY;QAEzC,QAAO,MADe,uBAAuB,IAAI;SAAE;SAAO,IAAI;QAAiB,CAAC,EAAA,EAChE,kBAAkB;OACpC;OACA,kBAAkB,OAAO,EAAE,OAAO,uBAAuB;QACvD,MAAM,uBAAuB,YAAY;QAEzC,QAAO,MADe,uBAAuB,IAAI;SAAE;SAAO,IAAI;QAAiB,CAAC,EAAA,EAChE,oBAAoB;OACtC;OACA,4BAA4B,kBAAkB,yBAAyB,KAAK,QAAQ,QAAQ;OAC5F;OACA,+BAA+B,EAAE,SAAS,cACxC,oCAAoC,SAAS;QAC3C,OAAO,QAAQ;QACf,kBAAkB,QAAQ;QAC1B,UAAU;QACV,gBAAgB;OAClB,CAAC;OACH,YAAY,IAAI,kBAAkB,uBAAuB;OACzD,mBAAkB,WAAU,uBAAuB;QAAE;QAAQ,aAAa;OAAwB,CAAC;OACnG,+BAA+B,OAAO,EAAE,OAAO,kBAAkB,eAAe;QAC9E,IAAI,SAAS,WAAW,aAAa,OAAO;QAC5C,MAAM,eAAe,SAAS,UAAU;QACxC,MAAM,oBAAoB,SAAS,UAAU;QAC7C,IAAI,OAAO,iBAAiB,YAAY,OAAO,sBAAsB,UAAU,OAAO;QACtF,OAAO,0CACL,mBAAmB,eAIjB,QAAQ,GACV;SAAE;SAAO;SAAkB;SAAc;QAAkB,CAC7D;OACF;MACF,CAAC;KACH;IACF,CAAC;IACD,GAAG,cAAc,OAAO;IACxB,GAAG,YAAY,OAAO;IACtB,GAAG,eAAe,OAAO;GAC3B;GACA,yBAAyB;IACvB,MAAM,OAAO,eAAe,SAAS,EAAE,MAAM;KAAE,QAAQ;KAAgB,aAAa;IAAK,EAAE,IAAI,CAAC;IAIhG,MAAM,UAAU,EAAE,SAAS,kBAAkB;IAI7C,MAAM,SAAS,iBAAiB;IAChC,MAAM,MAAM,SAAS,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAGH,OAAO;KACL,YAAY,CACV,4BAA4B;MAAE,MAAM;MAAW,SAAS;MAAwB,aAAa;KAAM,CAAC,GACpG,GAAG,GACL;KACA,GAAG;KACH,GAAG;IACL;IAcF,OAAO;KACL;KACA,YAAY;MACV,sBAAsB,IAAI;MAC1B,6BAA6B;OAAE,MAAM;OAAW,aAAa;MAAwB,CAAC;MACtF,4BAA4B;OAC1B,MAAM;OACN,SAAS;OACT,aAAa,QAAQ,IAAI;MAC3B,CAAC;MACD,GAAG;KACL;KACA,GAAG;KACH,GAAG;IACL;GACF;EACF,CAAC,CACH;EAEA,SAAS,KAAK,WAAW,kBAAiB,YAAW;GACnD,yBAAyB,SAAS;IAChC,YAAY;IACZ,eAAe,qBAAqB,eAAe,QAAQ;GAC7D,CAAC;GACD,2BAA2B,SAAS,EAClC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,wBAAwB,SAAS,EAC/B,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,0BAA0B,SAAS,EACjC,eAAe,qBAAqB,eAAe,QAAQ,EAC7D,CAAC;GACD,qBAAqB,SAAS,EAAE,OAAO,YAAY,CAAC;EACtD,CAAC;EAKD,SAAS,KAAK,WAAW,kBACvB,YACE,yBAAyB,SAAS;GAChC,UAAU;GACV,gBAAgB;EAClB,CAAC,CAAC,CAAC,OAAM,UAAS;GAChB,QAAQ,KAAK,6DAA6D,EACxE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACH,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAMA,SAAS,KAAK,WAAW,kBACvB,YACE,6BAA6B,SAAS;GACpC,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,UAAU;GACV,gBAAgB;EAClB,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAIA,SAAS,KAAK,WAAW,kBACvB,YACE,wBAAwB,SAAS;GAC/B,eAAe,qBAAqB,eAAe,QAAQ;GAC3D,WAAW;GACX,YAAY;EACd,CAAC,GACH,EAAE,UAAU,KAAK,CACnB;EAEA,KAAKK,YAAY;EACjB,KAAKC,oBAAoB;EAQzB,MAAM,uBAAuB,yBAAyB,QACnD,EAAE,aAAa,YAAY,SAAS,YAAY,QACnD;EAGA,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,gCAAgC,qBAC7B,KAAK,EAAE,kBAAkB,YAAY,EAAE,CAAC,CACxC,KAAK,IAAI,EAAE,8DAChB;EAEF,KAAK,MAAM,EAAE,iBAAiB,sBAAsB;GAClD,MAAM,UAAU,wBACd;IACE,YAAY,SAAS,KAAK;IAC1B;IACA,MAAM;IACN;IACA,SAAS;IACT,gBAAgB;IAChB;IACA;IACA;IACA,eAAe,KAAKL;IACpB;IACA;IACA,MAAM;IACN,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;GAChE,GACA,YAAY,EACd;GAEA,SAAS,KAAK,WAAW,YAAY,IAAI,wBAAwB,YAAY,SAAU,OAAO,CAAC,CAAC;GAEhG,MAAM,YAAY,YAAY,gBAAgB,OAAO;GACrD,IAAI,WAAW,eAAe,KAAK,SAAS;EAC9C;EAQA,MAAM,qBAAqB,CACzB,GAAI,eACA,CACE,IAAI,8BAA8B;GAChC,UAAU;GACV,WAAW;GACX,QAAQ,KAAKA;EACf,CAAC,CACH,IACA,CAAC,GACL,GAAG,yBACA,QAAQ,EAAE,aAAa,YAAY,SAAS,YAAY,OAAO,CAAC,CAChE,SAAS,EAAE,kBACV,YAAY,QACV,wBACE;GACE,YAAY,SAAS,KAAK;GAC1B;GACA,MAAM;GACN;GACA,SAAS;GACT,gBAAgB;GAChB;GACA;GACA;GACA,eAAe,KAAKA;GACpB;GACA;GACA,MAAM;GACN,GAAI,oBAAoB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EAChE,GACA,YAAY,EACd,CACF,CACF,CACJ;EAEA,OAAO;GACL,GAAG,SAAS;GAIZ,GAAI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;GACnC,GAAI,mBAAmB,SAAS,IAAI,EAAE,SAAS,mBAAmB,IAAI,CAAC;EACzE;CACF;;;;;;CAOA,MAAM,WAA0B;EAC9B,IAAI,CAAC,KAAKI,WACR,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,WAAW,6BAA6B,KAAKA,UAAW,SAAS,CAAC;EACxE,MAAM,WACJ,wCACM,KAAKC,mBAAmB,yBAAyB,KAAK,QAAQ,QAAQ,CAC9E;EACA,KAAKF,aAAa,MAAM;CAC1B;;CAGA,MAAM,WAA0B;EAC9B,MAAM,KAAKA,aAAa,KAAK;CAC/B;AACF"}

package/dist/rules/dispatch-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-errors.d.ts","sourceRoot":"","sources":["../../src/rules/dispatch-errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,uCAAuC,CAAC;AAE/C,UAAU,8BAA8B;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAuBD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAKzB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAErF;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,gCAAgC,GAAG,IAAI,GAC5C,8BAA8B,CAEhC"}
+{"version":3,"file":"dispatch-errors.d.ts","sourceRoot":"","sources":["../../src/rules/dispatch-errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,uCAAuC,CAAC;AAE/C,UAAU,8BAA8B;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAwBD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAKzB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAErF;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,gCAAgC,GAAG,IAAI,GAC5C,8BAA8B,CAEhC"}

package/dist/rules/dispatch-errors.js

@@ -56,6 +56,10 @@ const FAILURE_METADATA = {
 		canRetry: true,
 		label: "Pull request creation failed"
 	},
+	run_configuration_invalid: {
+		canRetry: false,
+		label: "Run configuration rejected by provider"
+	},
 	unknown: {
 		canRetry: true,
 		label: "Factory automation failed"

package/dist/rules/dispatch-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-errors.js","names":[],"sources":["../../src/rules/dispatch-errors.ts"],"sourcesContent":["import type {\n  FactoryDispatchFailureCode,\n  StoredFactoryDispatchFailureCode,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactoryDispatchFailureMetadata {\n  canRetry: boolean;\n  label: string;\n}\n\nconst FAILURE_METADATA = {\n  session_unavailable: { canRetry: true, label: 'Factory session unavailable' },\n  source_control_missing: { canRetry: true, label: 'Source-control connection unavailable' },\n  source_repository_missing: { canRetry: true, label: 'Source repository unavailable' },\n  unsupported_provider_item: { canRetry: false, label: 'Unsupported provider work item' },\n  notification_delivery_failed: { canRetry: true, label: 'Factory message delivery failed' },\n  run_overdue: { canRetry: false, label: 'Agent run is overdue' },\n  repository_git_missing: { canRetry: false, label: 'Git is unavailable in the workspace' },\n  repository_egress_blocked: { canRetry: false, label: 'Repository network access is blocked' },\n  repository_clone_failed: { canRetry: true, label: 'Repository clone failed' },\n  repository_pull_failed: { canRetry: true, label: 'Repository update failed' },\n  repository_push_failed: { canRetry: true, label: 'Repository push failed' },\n  repository_commit_failed: { canRetry: true, label: 'Repository commit failed' },\n  repository_cli_missing: { canRetry: false, label: 'GitHub CLI is unavailable in the workspace' },\n  repository_pr_failed: { canRetry: true, label: 'Pull request creation failed' },\n  unknown: { canRetry: true, label: 'Factory automation failed' },\n  // Retired: no path writes these any more, stored rows still read through here.\n  plan_awaiting_approval: { canRetry: false, label: 'Plan waiting for review' },\n  run_awaiting_input: { canRetry: false, label: 'Agent is waiting for an answer' },\n} satisfies Record<StoredFactoryDispatchFailureCode, FactoryDispatchFailureMetadata>;\n\nexport class FactoryDispatchError extends Error {\n  constructor(\n    readonly code: FactoryDispatchFailureCode,\n    message: string,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'FactoryDispatchError';\n  }\n}\n\nexport function factoryDispatchFailureCode(error: unknown): FactoryDispatchFailureCode {\n  return error instanceof FactoryDispatchError ? error.code : 'unknown';\n}\n\nexport function factoryDispatchFailureMetadata(\n  code: StoredFactoryDispatchFailureCode | null,\n): FactoryDispatchFailureMetadata {\n  return code === null ? FAILURE_METADATA.unknown : FAILURE_METADATA[code];\n}\n"],"mappings":";AAUA,MAAM,mBAAmB;CACvB,qBAAqB;EAAE,UAAU;EAAM,OAAO;CAA8B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAwC;CACzF,2BAA2B;EAAE,UAAU;EAAM,OAAO;CAAgC;CACpF,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAiC;CACtF,8BAA8B;EAAE,UAAU;EAAM,OAAO;CAAkC;CACzF,aAAa;EAAE,UAAU;EAAO,OAAO;CAAuB;CAC9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAAsC;CACxF,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAuC;CAC5F,yBAAyB;EAAE,UAAU;EAAM,OAAO;CAA0B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAyB;CAC1E,0BAA0B;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC9E,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA6C;CAC/F,sBAAsB;EAAE,UAAU;EAAM,OAAO;CAA+B;CAC9E,SAAS;EAAE,UAAU;EAAM,OAAO;CAA4B;CAE9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA0B;CAC5E,oBAAoB;EAAE,UAAU;EAAO,OAAO;CAAiC;AACjF;AAEA,IAAa,uBAAb,cAA0C,MAAM;CAEnC;CADX,YACE,MACA,SACA,SACA;EACA,MAAM,SAAS,OAAO;EAJb,KAAA,OAAA;EAKT,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,2BAA2B,OAA4C;CACrF,OAAO,iBAAiB,uBAAuB,MAAM,OAAO;AAC9D;AAEA,SAAgB,+BACd,MACgC;CAChC,OAAO,SAAS,OAAO,iBAAiB,UAAU,iBAAiB;AACrE"}
+{"version":3,"file":"dispatch-errors.js","names":[],"sources":["../../src/rules/dispatch-errors.ts"],"sourcesContent":["import type {\n  FactoryDispatchFailureCode,\n  StoredFactoryDispatchFailureCode,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactoryDispatchFailureMetadata {\n  canRetry: boolean;\n  label: string;\n}\n\nconst FAILURE_METADATA = {\n  session_unavailable: { canRetry: true, label: 'Factory session unavailable' },\n  source_control_missing: { canRetry: true, label: 'Source-control connection unavailable' },\n  source_repository_missing: { canRetry: true, label: 'Source repository unavailable' },\n  unsupported_provider_item: { canRetry: false, label: 'Unsupported provider work item' },\n  notification_delivery_failed: { canRetry: true, label: 'Factory message delivery failed' },\n  run_overdue: { canRetry: false, label: 'Agent run is overdue' },\n  repository_git_missing: { canRetry: false, label: 'Git is unavailable in the workspace' },\n  repository_egress_blocked: { canRetry: false, label: 'Repository network access is blocked' },\n  repository_clone_failed: { canRetry: true, label: 'Repository clone failed' },\n  repository_pull_failed: { canRetry: true, label: 'Repository update failed' },\n  repository_push_failed: { canRetry: true, label: 'Repository push failed' },\n  repository_commit_failed: { canRetry: true, label: 'Repository commit failed' },\n  repository_cli_missing: { canRetry: false, label: 'GitHub CLI is unavailable in the workspace' },\n  repository_pr_failed: { canRetry: true, label: 'Pull request creation failed' },\n  run_configuration_invalid: { canRetry: false, label: 'Run configuration rejected by provider' },\n  unknown: { canRetry: true, label: 'Factory automation failed' },\n  // Retired: no path writes these any more, stored rows still read through here.\n  plan_awaiting_approval: { canRetry: false, label: 'Plan waiting for review' },\n  run_awaiting_input: { canRetry: false, label: 'Agent is waiting for an answer' },\n} satisfies Record<StoredFactoryDispatchFailureCode, FactoryDispatchFailureMetadata>;\n\nexport class FactoryDispatchError extends Error {\n  constructor(\n    readonly code: FactoryDispatchFailureCode,\n    message: string,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'FactoryDispatchError';\n  }\n}\n\nexport function factoryDispatchFailureCode(error: unknown): FactoryDispatchFailureCode {\n  return error instanceof FactoryDispatchError ? error.code : 'unknown';\n}\n\nexport function factoryDispatchFailureMetadata(\n  code: StoredFactoryDispatchFailureCode | null,\n): FactoryDispatchFailureMetadata {\n  return code === null ? FAILURE_METADATA.unknown : FAILURE_METADATA[code];\n}\n"],"mappings":";AAUA,MAAM,mBAAmB;CACvB,qBAAqB;EAAE,UAAU;EAAM,OAAO;CAA8B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAwC;CACzF,2BAA2B;EAAE,UAAU;EAAM,OAAO;CAAgC;CACpF,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAiC;CACtF,8BAA8B;EAAE,UAAU;EAAM,OAAO;CAAkC;CACzF,aAAa;EAAE,UAAU;EAAO,OAAO;CAAuB;CAC9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAAsC;CACxF,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAuC;CAC5F,yBAAyB;EAAE,UAAU;EAAM,OAAO;CAA0B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC5E,wBAAwB;EAAE,UAAU;EAAM,OAAO;CAAyB;CAC1E,0BAA0B;EAAE,UAAU;EAAM,OAAO;CAA2B;CAC9E,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA6C;CAC/F,sBAAsB;EAAE,UAAU;EAAM,OAAO;CAA+B;CAC9E,2BAA2B;EAAE,UAAU;EAAO,OAAO;CAAyC;CAC9F,SAAS;EAAE,UAAU;EAAM,OAAO;CAA4B;CAE9D,wBAAwB;EAAE,UAAU;EAAO,OAAO;CAA0B;CAC5E,oBAAoB;EAAE,UAAU;EAAO,OAAO;CAAiC;AACjF;AAEA,IAAa,uBAAb,cAA0C,MAAM;CAEnC;CADX,YACE,MACA,SACA,SACA;EACA,MAAM,SAAS,OAAO;EAJb,KAAA,OAAA;EAKT,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,2BAA2B,OAA4C;CACrF,OAAO,iBAAiB,uBAAuB,MAAM,OAAO;AAC9D;AAEA,SAAgB,+BACd,MACgC;CAChC,OAAO,SAAS,OAAO,iBAAiB,UAAU,iBAAiB;AACrE"}

package/dist/rules/dispatcher.d.ts

@@ -1,12 +1,13 @@
 import type { MastraCodeState } from '@mastra/code-sdk/schema';
-import type { AgentController } from '@mastra/core/agent-controller';
+import type { AgentController, Session } from '@mastra/core/agent-controller';
 import type { BoardRegistry } from '../boards/index.js';
 import type { AuditRecorder } from '../storage/domains/audit/domain.js';
 import type { FactoryFeedReader } from '../storage/domains/comments/feed-context.js';
-import type { FactoryDeferredDecisionRecord, WorkItemRow, WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { FactoryDeferredDecisionRecord, FactoryRunBindingRecord, WorkItemRow, WorkItemsStorage } from '../storage/domains/work-items/base.js';
 import type { FactoryTransitionService } from './transition-service.js';
 import type { FactoryCommitDecision } from './types.js';
 type FactoryController = Pick<AgentController<MastraCodeState>, 'getSessionByResource' | 'listActiveThreadRuns'>;
+type BoundDispatcherSession = Session<MastraCodeState>;
 export interface FactoryBindingPreparationInput {
     record: FactoryDeferredDecisionRecord;
     item: WorkItemRow;
@@ -32,6 +33,16 @@ export interface FactoryDecisionDispatcherOptions {
     }) => Promise<boolean>;
     reconcileToolResults?: () => Promise<void>;
     prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;
+    /**
+     * Re-applies the factory project's current observational-memory settings to a
+     * reused session before it runs. Fresh preparation hydrates these settings,
+     * but a reused binding keeps the models it was created with; without this a
+     * project whose OM models changed keeps observing with the stale ones.
+     */
+    refreshManagedMemorySettings?: (input: {
+        binding: FactoryRunBindingRecord;
+        session: BoundDispatcherSession;
+    }) => Promise<void>;
     primeCredentials?: (tenant: {
         orgId: string;
         userId: string;

package/dist/rules/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/rules/dispatcher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAyC,MAAM,+BAA+B,CAAC;AAU5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,KAAK,EACV,6BAA6B,EAI7B,WAAW,EACX,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAA4C,MAAM,YAAY,CAAC;AA2LlG,KAAK,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,CAAC,CAAC;AA6BjH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,6BAA6B,CAAC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;IAChE,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,6BAA6B,CAAC,EAAE,CAAC,KAAK,EAAE;QACtC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;YAAE,IAAI,EAAE,sBAAsB,CAAA;SAAE,CAAC,CAAC;KAC5E,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC;CAC9C;AA+GD,qBAAa,yBAAyB;;gBA0BxB,OAAO,EAAE,gCAAgC;IA4BrD,KAAK,IAAI,IAAI;IAOP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,OAAO,CAAC,GAAG,OAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CA44B/C;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;CAW7B,CAAC"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/rules/dispatcher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAgC,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAU5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,KAAK,EACV,6BAA6B,EAG7B,uBAAuB,EACvB,WAAW,EACX,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAA4C,MAAM,YAAY,CAAC;AA4OlG,KAAK,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,CAAC,CAAC;AACjH,KAAK,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AA4BvD,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,6BAA6B,CAAC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;IAChE,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,CAAC,KAAK,EAAE;QACrC,OAAO,EAAE,uBAAuB,CAAC;QACjC,OAAO,EAAE,sBAAsB,CAAC;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,6BAA6B,CAAC,EAAE,CAAC,KAAK,EAAE;QACtC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;YAAE,IAAI,EAAE,sBAAsB,CAAA;SAAE,CAAC,CAAC;KAC5E,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,mCAAmC,CAAC,EAAE,MAAM,CAAC;CAC9C;AA+GD,qBAAa,yBAAyB;;gBA8BxB,OAAO,EAAE,gCAAgC;IA6BrD,KAAK,IAAI,IAAI;IAOP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,OAAO,CAAC,GAAG,OAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAg5B/C;AAED,eAAO,MAAM,0BAA0B;;;;;;;;;;;CAW7B,CAAC"}

package/dist/rules/dispatcher.js

@@ -28,15 +28,28 @@ const RECONCILE_INTERVAL_MS = 3e4;
 function isTerminalFailure(attempts, failureCode) {
 	return attempts >= MAX_ATTEMPTS || !factoryDispatchFailureMetadata(failureCode).canRetry;
 }
+/**
+* Conservative check for observational-memory failures that a retry cannot fix:
+* a provider rejecting the request outright (HTTP 400 / model unsupported /
+* authentication). Anything ambiguous (timeouts, 5xx, rate limits, network
+* blips) is intentionally left retryable to avoid dead-ending a card that would
+* have recovered on its own.
+*/
+function isPermanentProviderRejection(error) {
+	const normalized = error.toLowerCase();
+	return /\bhttp(?:\/\d(?:\.\d)?)?\s*400\b/.test(normalized) || /\bstatus(?:\s*code)?\s*[:=]?\s*400\b/.test(normalized) || /\b400\s*(?:bad request|status)\b/.test(normalized) || normalized.includes("model not supported") || normalized.includes("model is not supported") || normalized.includes("unsupported model") || normalized.includes("not supported with") || normalized.includes("unauthorized") || normalized.includes("authentication") || normalized.includes("invalid") && normalized.includes("model");
+}
 function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStillActive }) {
 	let resolveAgentEnd;
 	let agentEnd;
 	let endReason;
 	let supersededAtEnd;
 	let parked;
+	let omFailure;
 	const arm = () => {
 		endReason = void 0;
 		supersededAtEnd = void 0;
+		omFailure = void 0;
 		agentEnd = new Promise((resolve) => {
 			resolveAgentEnd = resolve;
 		});
@@ -49,6 +62,10 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 			resolveAgentEnd();
 			return;
 		}
+		if (event.type === "om_observation_failed" || event.type === "om_buffering_failed") {
+			if (event.error) omFailure = event.error;
+			return;
+		}
 		if (event.type === "tool_suspended") {
 			parked = {
 				toolName: event.toolName,
@@ -88,7 +105,13 @@ function watchRun(session, { timeoutMs, approvePlans, onAgentEnd, label, runStil
 			}
 			if (!observed) throw new Error(`${label} terminal event was not observed before timeout.`);
 			if (endReason === "error") throw new Error(`${label} ended in error.`);
-			if (endReason === "aborted") throw new Error(`${label} was aborted before it finished.`);
+			if (endReason === "aborted") {
+				if (omFailure) {
+					if (isPermanentProviderRejection(omFailure)) throw new FactoryDispatchError("run_configuration_invalid", `${label} was aborted by an observational-memory failure that will not succeed on retry: ${omFailure}`);
+					throw new Error(`${label} was aborted after an observational-memory failure: ${omFailure}`);
+				}
+				throw new Error(`${label} was aborted before it finished.`);
+			}
 		}
 	};
 }
@@ -205,6 +228,7 @@ var FactoryDecisionDispatcher = class {
 	#autoApprovePlans;
 	#reconcileToolResults;
 	#prepareBinding;
+	#refreshManagedMemorySettings;
 	#primeCredentials;
 	#feedReader;
 	#resolveLinkedWorkItemParentId;
@@ -230,6 +254,7 @@ var FactoryDecisionDispatcher = class {
 		this.#autoApprovePlans = options.autoApprovePlans;
 		this.#reconcileToolResults = options.reconcileToolResults;
 		this.#prepareBinding = options.prepareBinding;
+		this.#refreshManagedMemorySettings = options.refreshManagedMemorySettings;
 		this.#primeCredentials = options.primeCredentials;
 		this.#feedReader = options.feedReader;
 		this.#resolveLinkedWorkItemParentId = options.resolveLinkedWorkItemParentId;
@@ -816,6 +841,10 @@ var FactoryDecisionDispatcher = class {
 		const session = await this.#controller.getSessionByResource(binding.resourceId);
 		if (!session) return void 0;
 		await this.#switchThread(session, binding);
+		await this.#refreshManagedMemorySettings?.({
+			binding,
+			session
+		});
 		return session;
 	}
 	/** Unset means off: a plan nobody asked us to answer is a plan someone should see. */