@mastra/factory 0.2.2-alpha.1 → 0.2.2-alpha.2

package/dist/integrations/github/routes.js

@@ -1,1918 +1,1309 @@
-// src/integrations/github/routes.ts
-import { randomUUID } from "crypto";
+import { clearGithubPat, getGithubPat, getGithubPatStatus, setGithubPat } from "./pat.js";
+import { listPullRequestSubscriptionsForThread, subscribeToPullRequest } from "./subscriptions.js";
+import { SandboxBudgetError } from "../../sandbox/fleet.js";
+import { getGithubFeatureDiagnostics, isGithubFeatureEnabled } from "./config.js";
+import { MaterializeError, WorktreeError, commitAll, computeWorktreePath, ensureProjectSandbox, isValidGitRef as isValidGitRef$1, materializeRepo, pushBranch, teardownProjectSandbox } from "./sandbox.js";
+import { handleGithubWebhook } from "./webhook.js";
 import { registerApiRoute } from "@mastra/core/server";
+import { randomUUID } from "crypto";
 import { streamSSE } from "hono/streaming";
-
-// src/sandbox/fleet.ts
-import path from "path";
-function reportProgress(onProgress, event) {
-  if (!onProgress) return;
-  try {
-    onProgress(event);
-  } catch {
-  }
-}
-var SandboxBudgetError = class extends Error {
-  constructor(max) {
-    super(
-      `Sandbox budget exceeded: this server already has ${max} active sandbox(es), the configured per-replica maximum. Close an existing repository's sandbox and try again.`
-    );
-    this.max = max;
-    this.name = "SandboxBudgetError";
-  }
-  max;
-  code = "sandbox-budget-exceeded";
-};
-
-// src/integrations/github/config.ts
-var GITHUB_APP_ENV_VARS = [
-  "GITHUB_APP_ID",
-  "GITHUB_APP_PRIVATE_KEY",
-  "GITHUB_APP_CLIENT_ID",
-  "GITHUB_APP_CLIENT_SECRET",
-  "GITHUB_APP_SLUG"
-];
-function isGithubFeatureEnabled(options) {
-  return options.github !== void 0 && options.auth.enabled();
-}
-function getGithubFeatureDiagnostics(options) {
-  const { github, auth, appDbConfigured, stateSigner, fleet } = options;
-  return {
-    githubAppConfigured: github !== void 0,
-    factoryAuthEnabled: auth.enabled(),
-    appDbConfigured,
-    stateSecretConfigured: stateSigner?.stable ?? false,
-    sandboxEnabled: fleet?.enabled ?? false,
-    sandboxProvider: fleet?.provider ?? "none",
-    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS]
-  };
-}
-
-// src/integrations/github/pat.ts
-var PAT_SETTINGS_USER_ID = "__github_org_settings__";
-var FIELD_FOR_KIND = {
-  default: "pat",
-  reviewer: "reviewerPat"
-};
-function asToken(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-async function getGithubPat(getStorage, orgId, kind = "default") {
-  try {
-    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
-    if (!settings) return null;
-    if (kind === "reviewer") return asToken(settings.reviewerPat) ?? asToken(settings.pat);
-    return asToken(settings.pat);
-  } catch {
-    return null;
-  }
-}
-async function getGithubPatStatus(getStorage, orgId) {
-  try {
-    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
-    return {
-      configured: asToken(settings?.pat) !== null,
-      reviewerConfigured: asToken(settings?.reviewerPat) !== null
-    };
-  } catch {
-    return { configured: false, reviewerConfigured: false };
-  }
-}
-async function setGithubPat(storage, orgId, pat, kind = "default") {
-  const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID) ?? {};
-  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, { ...existing, [FIELD_FOR_KIND[kind]]: pat });
-}
-async function clearGithubPat(storage, orgId, kind = "default") {
-  const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID);
-  const field = FIELD_FOR_KIND[kind];
-  if (!existing?.[field]) return;
-  const { [field]: _removed, ...rest } = existing;
-  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, rest);
-}
-
-// src/integrations/github/sandbox.ts
-import { createHash } from "crypto";
-function bindingStore(row, storage) {
-  return {
-    sandboxId: row.sandboxId,
-    setSandboxId: (id) => id === null ? storage.clearBinding({ id: row.id }) : storage.setSandboxId({ id: row.id, sandboxId: id }),
-    clear: () => storage.clearBinding({ id: row.id })
-  };
-}
-async function ensureProjectSandbox(options) {
-  const { fleet, row, storage, token, onProgress } = options;
-  return fleet.ensureSandbox(bindingStore(row, storage), { GH_TOKEN: token }, onProgress);
-}
-async function teardownProjectSandbox(options) {
-  const { fleet, row, storage, sandbox } = options;
-  return fleet.teardownSandbox(bindingStore(row, storage), sandbox);
-}
-function shellQuote(value) {
-  return `'` + value.split(`'`).join(`'\\''`) + `'`;
-}
-var DEFAULT_COMMAND_TIMEOUT_MS = 15 * 6e4;
-var CHECKOUT_COMMAND_TIMEOUT_MS = 5 * 6e4;
-async function sh(sandbox, script, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
-  let timer;
-  const hangGuard = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      const phase = options.phase ? ` during ${options.phase}` : "";
-      reject(new Error(`Sandbox command timed out after ${Math.round(timeoutMs / 1e3)}s${phase}.`));
-    }, timeoutMs);
-    timer.unref?.();
-  });
-  try {
-    return await Promise.race([sandbox.executeCommand("sh", ["-c", script], { timeout: timeoutMs }), hangGuard]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-var MaterializeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "MaterializeError";
-  }
-  code;
-};
-function tokenUrl(repoFullName, token) {
-  return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
-}
-function cleanUrl(repoFullName) {
-  return `https://github.com/${repoFullName}.git`;
-}
-async function materializeRepo(options) {
-  const { row: sandboxRow, repoInfo, sandbox, token, storage, onProgress } = options;
-  const workdir = sandboxRow.sandboxWorkdir;
-  const repo = repoInfo.repoFullName;
-  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
-    throw new MaterializeError(`Refusing to materialize: invalid repo full name '${repo}'.`, "clone-failed");
-  }
-  if (!/^[A-Za-z0-9_./-]+$/.test(repoInfo.defaultBranch)) {
-    throw new MaterializeError(
-      `Refusing to materialize: invalid default branch '${repoInfo.defaultBranch}'.`,
-      "clone-failed"
-    );
-  }
-  const gitVersion = await sh(sandbox, "git --version");
-  if (gitVersion.exitCode !== 0) {
-    throw new MaterializeError(
-      "git is not installed in the sandbox. The sandbox template must include git.",
-      "git-missing"
-    );
-  }
-  const authUrl = tokenUrl(repo, token);
-  const alreadyMaterialized = await hasExistingCheckout(sandbox, workdir, repo);
-  let succeeded = false;
-  try {
-    if (!alreadyMaterialized) {
-      reportProgress(onProgress, {
-        phase: "cloning",
-        message: `Cloning ${repo} (first open can take a minute)\u2026`
-      });
-      const clone = await sh(
-        sandbox,
-        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`,
-        { phase: "repository clone" }
-      );
-      if (clone.exitCode !== 0) {
-        throw classifyGitFailure(clone, "clone-failed");
-      }
-    } else {
-      reportProgress(onProgress, { phase: "pulling", message: `Updating ${repo} to the latest changes\u2026` });
-      const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
-      if (setUrl.exitCode !== 0) {
-        throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
-      }
-      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`, { phase: "repository pull" });
-      if (pull.exitCode !== 0) {
-        throw classifyGitFailure(pull, "pull-failed");
-      }
-    }
-    succeeded = true;
-  } finally {
-    await scrubRemote(sandbox, workdir, repo, succeeded);
-  }
-  reportProgress(onProgress, { phase: "finalizing", message: "Finalizing workspace\u2026" });
-  await storage.markMaterialized({ id: sandboxRow.id });
-}
-async function hasExistingCheckout(sandbox, workdir, repoFullName) {
-  const result = await sh(sandbox, `git -C ${shellQuote(workdir)} remote get-url origin`);
-  if (result.exitCode !== 0) return false;
-  const url = result.stdout.trim().toLowerCase();
-  const suffix = `github.com/${repoFullName.toLowerCase()}`;
-  return url.endsWith(`${suffix}.git`) || url.endsWith(suffix);
-}
-async function scrubRemote(sandbox, workdir, repoFullName, expectGitDir) {
-  const result = await sh(
-    sandbox,
-    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(cleanUrl(repoFullName))}`
-  );
-  if (result.exitCode !== 0 && expectGitDir) {
-    throw new MaterializeError(
-      `Failed to scrub installation token from git remote: ${result.stderr.trim() || result.stdout.trim()}`,
-      "pull-failed"
-    );
-  }
-}
-function classifyGitFailure(result, fallback) {
-  const stderr = result.stderr || "";
-  if (/could not resolve host|failed to connect|network is unreachable|Connection timed out/i.test(stderr)) {
-    return new MaterializeError(
-      "The sandbox could not reach github.com. The sandbox network must allow outbound egress to github.com.",
-      "egress-blocked"
-    );
-  }
-  const verb = fallback === "clone-failed" ? "clone" : fallback === "pull-failed" ? "pull" : "push";
-  return new MaterializeError(`git ${verb} failed: ${stderr}`, fallback);
-}
-function isValidGitRef(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= 255 && // Reject leading-dash refs (e.g. `--mirror`) so the value can never be
-  // parsed as a git option when interpolated into a command.
-  !value.startsWith("-") && /^[A-Za-z0-9_./-]+$/.test(value);
-}
-function resolveGitIdentity(identity) {
-  const login = (identity.login || "").trim();
-  const name = (identity.name || "").trim() || login || "Mastra Code";
-  const email = (identity.email || "").trim() || (login ? `${login}@users.noreply.github.com` : "mastra-code@users.noreply.github.com");
-  return { name, email };
-}
-async function configureGitIdentity(sandbox, workdir, identity) {
-  const { name, email } = resolveGitIdentity(identity);
-  const setName = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.name ${shellQuote(name)}`);
-  if (setName.exitCode !== 0) {
-    throw new MaterializeError(`Failed to set git user.name: ${setName.stderr.trim()}`, "commit-failed");
-  }
-  const setEmail = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.email ${shellQuote(email)}`);
-  if (setEmail.exitCode !== 0) {
-    throw new MaterializeError(`Failed to set git user.email: ${setEmail.stderr.trim()}`, "commit-failed");
-  }
-}
-async function withInstallToken(sandbox, workdir, repoFullName, token, fn) {
-  if (!/^[\w.-]+\/[\w.-]+$/.test(repoFullName)) {
-    throw new MaterializeError(`Refusing to push: invalid repo full name '${repoFullName}'.`, "push-failed");
-  }
-  const setUrl = await sh(
-    sandbox,
-    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(tokenUrl(repoFullName, token))}`
-  );
-  if (setUrl.exitCode !== 0) {
-    await scrubRemote(sandbox, workdir, repoFullName, false);
-    throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr.trim()}`, "push-failed");
-  }
-  try {
-    return await fn();
-  } finally {
-    await scrubRemote(sandbox, workdir, repoFullName, true);
-  }
-}
-async function pushBranch(sandbox, workdir, branch, token, repoFullName) {
-  if (!isValidGitRef(branch)) {
-    throw new MaterializeError(`Refusing to push: invalid branch name '${branch}'.`, "push-failed");
-  }
-  await withInstallToken(sandbox, workdir, repoFullName, token, async () => {
-    const push = await sh(sandbox, `git -C ${shellQuote(workdir)} push -u origin ${shellQuote(branch)}`);
-    if (push.exitCode !== 0) {
-      throw classifyGitFailure(push, "push-failed");
-    }
-  });
-}
-async function commitAll(sandbox, workdir, message, identity) {
-  await configureGitIdentity(sandbox, workdir, identity);
-  const add = await sh(sandbox, `git -C ${shellQuote(workdir)} add -A`);
-  if (add.exitCode !== 0) {
-    throw new MaterializeError(`git add failed: ${add.stderr.trim() || add.stdout.trim()}`, "commit-failed");
-  }
-  const staged = await sh(sandbox, `git -C ${shellQuote(workdir)} diff --cached --quiet`);
-  if (staged.exitCode === 0) {
-    return { committed: false };
-  }
-  const commit = await sh(sandbox, `git -C ${shellQuote(workdir)} commit -m ${shellQuote(message)}`);
-  if (commit.exitCode !== 0) {
-    throw new MaterializeError(`git commit failed: ${commit.stderr.trim() || commit.stdout.trim()}`, "commit-failed");
-  }
-  return { committed: true };
-}
-var WorktreeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "WorktreeError";
-  }
-  code;
-};
-function safeBranchDir(branch) {
-  const sanitized = branch.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/\/+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 100) || "work";
-  if (sanitized === branch) return sanitized;
-  const hash = createHash("sha256").update(branch).digest("hex").slice(0, 8);
-  return `${sanitized}-${hash}`;
-}
-function computeWorktreePath(repoWorkdir, branch) {
-  const parent = repoWorkdir.replace(/\/+$/, "").split("/").slice(0, -1).join("/") || "";
-  return `${parent}/worktrees/${safeBranchDir(branch)}`;
-}
-
-// src/integrations/github/subscriptions.ts
-function changeRequestTargetKey(input) {
-  return `change-request:${input.installationExternalId}:${input.repositoryExternalId}:${input.changeRequestId}`;
-}
-function sameSession(row, input) {
-  return row.orgId === input.orgId && row.sessionId === input.sessionId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "");
-}
-async function subscribeToPullRequest(input, storage) {
-  const targetKey = changeRequestTargetKey(input);
-  const existing = (await storage.subscriptions.listByTarget(targetKey)).find((row) => sameSession(row, input));
-  if (existing) {
-    if (existing.status !== "open") await storage.subscriptions.updateStatus(existing.id, "open");
-    return { ...existing, status: "open" };
-  }
-  return storage.subscriptions.create({
-    orgId: input.orgId,
-    targetKey,
-    sessionId: input.sessionId,
-    resourceId: input.resourceId,
-    threadId: input.threadId,
-    sessionScope: input.sessionScope ?? "",
-    status: "open",
-    data: {
-      installationExternalId: input.installationExternalId,
-      projectRepositoryId: input.projectRepositoryId,
-      repositoryExternalId: input.repositoryExternalId,
-      repositorySlug: input.repositorySlug,
-      changeRequestId: input.changeRequestId,
-      ownerId: input.ownerId,
-      source: input.source,
-      subscribedByUserId: input.subscribedByUserId ?? null
-    }
-  });
-}
-async function listPullRequestSubscriptionsForThread(input, storage) {
-  const rows = await storage.subscriptions.listByThread(input.resourceId, input.threadId);
-  return rows.filter(
-    (row) => row.orgId === input.orgId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "")
-  );
-}
-async function listPullRequestSubscriptionsForWebhook(input, options, storage) {
-  const rows = await storage.subscriptions.listByTarget(changeRequestTargetKey(input));
-  return options?.includeTerminal ? rows : rows.filter((row) => row.status === "open");
-}
-function retirePullRequestSubscription(id, status, storage) {
-  return storage.subscriptions.updateStatus(id, status);
-}
-
-// src/integrations/github/webhook.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var SUPPORTED_GITHUB_WEBHOOK_EVENTS = /* @__PURE__ */ new Set([
-  "issues",
-  "issue_comment",
-  "pull_request",
-  "pull_request_review",
-  "pull_request_review_comment"
-]);
-function normalizeHeader(value) {
-  if (!value) return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function verifySignature(rawBody, signature, secret) {
-  if (!signature.startsWith("sha256=")) return false;
-  const signatureHex = signature.slice("sha256=".length);
-  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;
-  const expectedHex = createHmac("sha256", secret).update(rawBody).digest("hex");
-  const received = Buffer.from(signatureHex, "hex");
-  const expected = Buffer.from(expectedHex, "hex");
-  return received.length === expected.length && timingSafeEqual(received, expected);
-}
-async function parseGithubWebhook(c, secret) {
-  if (!secret) {
-    return { status: 401, body: { error: "unauthorized", message: "GitHub webhook secret is not configured" } };
-  }
-  const event = normalizeHeader(c.req.header("x-github-event"));
-  const deliveryId = normalizeHeader(c.req.header("x-github-delivery"));
-  const signature = normalizeHeader(c.req.header("x-hub-signature-256"));
-  if (!event) return { status: 400, body: { error: "bad_request", message: "Missing x-github-event header" } };
-  if (!deliveryId) return { status: 400, body: { error: "bad_request", message: "Missing x-github-delivery header" } };
-  if (!signature)
-    return { status: 401, body: { error: "unauthorized", message: "Missing x-hub-signature-256 header" } };
-  const rawBody = await c.req.text();
-  if (!verifySignature(rawBody, signature, secret)) {
-    return { status: 401, body: { error: "unauthorized", message: "Invalid GitHub webhook signature" } };
-  }
-  let payload;
-  try {
-    payload = JSON.parse(rawBody);
-  } catch {
-    return { status: 400, body: { error: "bad_request", message: "Malformed JSON payload" } };
-  }
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { status: 400, body: { error: "bad_request", message: "Payload must be a JSON object" } };
-  }
-  return { event, deliveryId, payload };
-}
-function getObject(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function getString(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function getNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function getBoolean(value) {
-  return typeof value === "boolean" ? value : void 0;
-}
-function getLabels(value) {
-  if (!Array.isArray(value)) return [];
-  return value.map((label) => typeof label === "string" ? label : getString(getObject(label)?.name)).filter((label) => Boolean(label));
-}
-function getIssueTriageRunInput(parsed) {
-  if (parsed.event !== "issues" || getString(parsed.payload.action) !== "opened") return null;
-  const repository = getString(getObject(parsed.payload.repository)?.full_name);
-  const issue = getObject(parsed.payload.issue);
-  const sender = getString(getObject(parsed.payload.sender)?.login);
-  const installationId = getNumber(getObject(parsed.payload.installation)?.id);
-  const issueNumber = getNumber(issue?.number);
-  const issueTitle = getString(issue?.title);
-  const issueUrl = getString(issue?.html_url);
-  if (!repository || !installationId || !issueNumber || !issueTitle || !issueUrl) return null;
-  return {
-    repository,
-    issueNumber,
-    issueTitle,
-    issueUrl,
-    labels: getLabels(issue?.labels),
-    sender,
-    installationId
-  };
-}
-function normalizeGithubWebhookMetadata(parsed) {
-  const { event, deliveryId, payload } = parsed;
-  const repository = getObject(payload.repository);
-  const issue = getObject(payload.issue);
-  const pullRequest = getObject(payload.pull_request);
-  const sender = getObject(payload.sender);
-  const installation = getObject(payload.installation);
-  const issuePullRequest = getObject(issue?.pull_request);
-  return {
-    event,
-    action: getString(payload.action),
-    deliveryId,
-    repository: getString(repository?.full_name),
-    repositoryId: getNumber(repository?.id),
-    issueNumber: getNumber(issue?.number),
-    pullRequestNumber: getNumber(pullRequest?.number) ?? (event === "issue_comment" && issuePullRequest ? getNumber(issue?.number) : void 0),
-    sender: getString(sender?.login),
-    senderType: getString(sender?.type),
-    installationId: getNumber(installation?.id)
-  };
-}
-function notificationSummary(metadata, label) {
-  const actor = metadata.sender ? `${metadata.sender} ` : "";
-  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;
-}
-function notificationTargetUrl(event, payload) {
-  if (event === "issue_comment" || event === "pull_request_review_comment") {
-    return getString(getObject(payload.comment)?.html_url);
-  }
-  if (event === "pull_request_review") {
-    return getString(getObject(payload.review)?.html_url);
-  }
-  return getString(getObject(payload.pull_request)?.html_url);
-}
-function classifyGithubWebhook(parsed) {
-  const metadata = normalizeGithubWebhookMetadata(parsed);
-  const { event, payload } = parsed;
-  const action = metadata.action;
-  if (!action || !metadata.repositoryId || !metadata.installationId || !metadata.pullRequestNumber || !metadata.repository) {
-    return void 0;
-  }
-  let priority;
-  let kind;
-  let label;
-  let terminal = false;
-  if (event === "pull_request_review" && action === "submitted") {
-    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll("_", "-");
-    priority = state === "approved" || state === "changes-requested" ? "urgent" : "high";
-    kind = state === "approved" ? "review-approved" : state === "changes-requested" ? "review-changes-requested" : "review-submitted";
-    label = state === "approved" ? "approved the pull request" : state === "changes-requested" ? "requested changes" : "submitted a review";
-  } else if (event === "pull_request" && action === "closed") {
-    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;
-    priority = "urgent";
-    kind = merged ? "pull-request-merged" : "pull-request-closed";
-    label = merged ? "merged the pull request" : "closed the pull request";
-    terminal = true;
-  } else if (event === "issue_comment" && action === "created") {
-    priority = "high";
-    kind = "issue-comment-created";
-    label = "commented";
-  } else if (event === "pull_request_review_comment" && action === "created") {
-    priority = "high";
-    kind = "review-comment-created";
-    label = "left a review comment";
-  } else if (event === "pull_request" && action === "reopened") {
-    priority = "high";
-    kind = "pull-request-reopened";
-    label = "reopened the pull request";
-  } else if (event === "pull_request_review" && action === "dismissed") {
-    priority = "high";
-    kind = "review-dismissed";
-    label = "dismissed a review";
-  } else if (event === "pull_request" && [
-    "synchronize",
-    "ready_for_review",
-    "converted_to_draft",
-    "assigned",
-    "unassigned",
-    "review_requested",
-    "review_request_removed"
-  ].includes(action)) {
-    priority = "medium";
-    kind = `pull-request-${action.replaceAll("_", "-")}`;
-    label = action.replaceAll("_", " ");
-  } else if (event === "pull_request" && ["edited", "labeled", "unlabeled", "milestoned", "demilestoned"].includes(action)) {
-    priority = "low";
-    kind = `pull-request-${action.replaceAll("_", "-")}`;
-    label = action.replaceAll("_", " ");
-  } else {
-    return void 0;
-  }
-  return {
-    action,
-    kind,
-    priority,
-    summary: notificationSummary(metadata, label),
-    terminal,
-    metadata: {
-      ...metadata,
-      pullRequestNumber: metadata.pullRequestNumber,
-      repositoryId: metadata.repositoryId,
-      installationId: metadata.installationId
-    },
-    payload
-  };
-}
-async function resolveSubscriptionSession(controller, subscription) {
-  const { sessionId, resourceId, threadId } = subscription;
-  if (!sessionId || !resourceId || !threadId) {
-    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);
-  }
-  const scope = subscription.sessionScope || void 0;
-  let session = await controller.getSessionByResource(resourceId, scope);
-  if (!session) {
-    const tags = {
-      factoryProjectId: resourceId,
-      projectRepositoryId: subscription.data.projectRepositoryId,
-      ...scope ? { worktreePath: scope } : {}
-    };
-    session = await controller.createSession({
-      id: sessionId,
-      ownerId: subscription.data.ownerId,
-      resourceId,
-      scope,
-      tags
-    });
-  }
-  if (session.thread.getId() !== threadId) {
-    await session.thread.switch({ threadId, emitEvent: false });
-  }
-  if (session.thread.getId() !== threadId) {
-    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);
-  }
-  return session;
-}
-var AUTHORIZED_BOTS = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
-var AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
-var PERMISSION_CHECK_TIMEOUT_MS = 5e3;
-var AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
-  "issue-comment-created",
-  "review-comment-created",
-  "review-submitted",
-  "review-approved",
-  "review-changes-requested",
-  "review-dismissed"
-]);
-async function isAuthorizedGithubSender(notification, github) {
-  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;
-  const sender = notification.metadata.sender;
-  const repository = notification.metadata.repository;
-  if (!sender || !repository) return false;
-  const normalizedSender = sender.toLowerCase();
-  if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) {
-    return AUTHORIZED_BOTS.has(normalizedSender);
-  }
-  if (!github) return false;
-  const abortController = new AbortController();
-  let timeout;
-  try {
-    const permission = await Promise.race([
-      github.getRepositoryCollaboratorPermission(
-        notification.metadata.installationId,
-        repository,
-        sender,
-        abortController.signal
-      ),
-      new Promise((resolve) => {
-        timeout = setTimeout(() => {
-          abortController.abort();
-          resolve(void 0);
-        }, PERMISSION_CHECK_TIMEOUT_MS);
-      })
-    ]);
-    return permission !== void 0 && AUTHORIZED_PERMISSIONS.has(permission);
-  } catch {
-    return false;
-  } finally {
-    if (timeout) clearTimeout(timeout);
-  }
-}
-async function dispatchGithubWebhook(parsed, dependencies) {
-  const notification = classifyGithubWebhook(parsed);
-  if (!notification) return { delivered: 0, failed: 0, ignored: true };
-  const isAuthorizedSender = dependencies.isAuthorizedSender ?? ((n) => isAuthorizedGithubSender(n, dependencies.github));
-  if (!await isAuthorizedSender(notification)) {
-    return { delivered: 0, failed: 0, ignored: true };
-  }
-  const target = {
-    installationExternalId: notification.metadata.installationId.toString(),
-    repositoryExternalId: notification.metadata.repositoryId.toString(),
-    changeRequestId: notification.metadata.pullRequestNumber.toString()
-  };
-  const listSubscriptions = dependencies.listSubscriptions ?? ((subscriptionTarget, options) => {
-    if (!dependencies.github) throw new Error("GitHub integration is required to load webhook subscriptions.");
-    return listPullRequestSubscriptionsForWebhook(
-      subscriptionTarget,
-      options,
-      dependencies.github.integrationStorage
-    );
-  });
-  const retireSubscription = dependencies.retireSubscription ?? ((id, status) => {
-    if (!dependencies.github) throw new Error("GitHub integration is required to retire webhook subscriptions.");
-    return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);
-  });
-  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === "reopened" });
-  let delivered = 0;
-  let failed = 0;
-  for (const subscription of subscriptions) {
-    try {
-      const session = await resolveSubscriptionSession(dependencies.controller, subscription);
-      const result = await session.sendNotificationSignal({
-        source: "github",
-        kind: notification.kind,
-        summary: notification.summary,
-        priority: notification.priority,
-        payload: notification.payload,
-        sourceId: parsed.deliveryId,
-        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,
-        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,
-        metadata: {
-          event: notification.metadata.event,
-          action: notification.action,
-          repository: notification.metadata.repository,
-          issueNumber: notification.metadata.issueNumber,
-          pullRequestNumber: notification.metadata.pullRequestNumber,
-          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),
-          deliveryId: parsed.deliveryId
-        }
-      });
-      await Promise.all([result.persisted, result.accepted].filter(Boolean));
-      if (notification.terminal) {
-        await retireSubscription(subscription.id, notification.kind === "pull-request-merged" ? "merged" : "closed");
-      } else if (notification.action === "reopened") {
-        await retireSubscription(subscription.id, "open");
-      }
-      delivered += 1;
-    } catch (error) {
-      failed += 1;
-      dependencies.onTargetError?.(subscription, error);
-    }
-  }
-  return { delivered, failed, ignored: false };
-}
-async function handleGithubWebhook(c, options) {
-  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);
-  if ("status" in parsed) return parsed;
-  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {
-    return { status: 202, body: { ok: true, ignored: true } };
-  }
-  const metadata = normalizeGithubWebhookMetadata(parsed);
-  console.info("[GitHub Webhook]", metadata);
-  if (options.ingestFactoryEvent) {
-    await options.ingestFactoryEvent(parsed);
-  } else {
-    const issueTriageRun = getIssueTriageRunInput(parsed);
-    if (issueTriageRun && options.runIssueTriage) {
-      void options.runIssueTriage(issueTriageRun).catch((error) => {
-        console.error("[GitHub Webhook] Failed to run issue triage", {
-          deliveryId: metadata.deliveryId,
-          repository: metadata.repository,
-          issueNumber: metadata.issueNumber,
-          error: error instanceof Error ? error.message : String(error)
-        });
-      });
-    }
-  }
-  if (!options.controller) {
-    return { status: 202, body: { ok: true } };
-  }
-  const result = await dispatchGithubWebhook(parsed, options);
-  if (result.failed > 0) {
-    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);
-  }
-  return { status: 202, body: { ok: true, ...result.ignored ? { ignored: true } : {} } };
-}
-
-// src/integrations/github/routes.ts
-var sessionOperationLocks = /* @__PURE__ */ new Map();
+//#region src/integrations/github/routes.ts
+/**
+* Mastra `apiRoutes` for the GitHub App project feature.
+*
+* Registered alongside the other `/web/*` routes, behind the host auth gate.
+* Every route additionally re-checks the authenticated user via the injected
+* `RouteAuth` seam and scopes all rows by that user's stable id, so a user can
+* only ever see and operate on their own installations and projects.
+*
+* When the feature is disabled (`isGithubFeatureEnabled()` false), `buildGithubRoutes`
+* returns only `GET /web/github/status`, which reports `enabled:false`
+* so the SPA can cleanly hide all GitHub UI.
+*/
+const sessionOperationLocks = /* @__PURE__ */ new Map();
+/**
+* Serialize same-session mutations within one Factory process. Factory sessions
+* normally issue these operations sequentially, so this lock is probably not
+* necessary; keep the cheap local guard until that invariant is enforced by
+* the request protocol. It intentionally does not consume a database connection.
+*/
 function withSessionOperationLock(sessionId, fn) {
-  const previous = sessionOperationLocks.get(sessionId) ?? Promise.resolve();
-  const next = previous.then(fn, fn);
-  const tail = next.then(
-    () => void 0,
-    () => void 0
-  );
-  sessionOperationLocks.set(sessionId, tail);
-  void tail.then(() => {
-    if (sessionOperationLocks.get(sessionId) === tail) sessionOperationLocks.delete(sessionId);
-  });
-  return next;
-}
+	const next = (sessionOperationLocks.get(sessionId) ?? Promise.resolve()).then(fn, fn);
+	const tail = next.then(() => void 0, () => void 0);
+	sessionOperationLocks.set(sessionId, tail);
+	tail.then(() => {
+		if (sessionOperationLocks.get(sessionId) === tail) sessionOperationLocks.delete(sessionId);
+	});
+	return next;
+}
+/** Erase a route handler's path-parameterized context to a plain `Context`. */
 function loose(c) {
-  return c;
+	return c;
 }
+/**
+* Resolve the Factory project's default model for a triage run. Best-effort:
+* a missing project or an uninitialized storage domain simply means "no
+* default", never a failed run.
+*/
 async function resolveFactoryDefaultModelId(projects, factoryProjectId) {
-  if (!projects || !factoryProjectId) return void 0;
-  try {
-    const project = await projects.getById({ id: factoryProjectId });
-    return project?.defaultModelId ?? void 0;
-  } catch {
-    return void 0;
-  }
+	if (!projects || !factoryProjectId) return void 0;
+	try {
+		return (await projects.getById({ id: factoryProjectId }))?.defaultModelId ?? void 0;
+	} catch {
+		return;
+	}
 }
 function pullRequestNumberFromUrl(value, expectedRepo) {
-  try {
-    const url = new URL(value);
-    const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
-    if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) {
-      return void 0;
-    }
-    const number = Number(match[2]);
-    return Number.isInteger(number) && number > 0 ? number : void 0;
-  } catch {
-    return void 0;
-  }
+	try {
+		const url = new URL(value);
+		const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
+		if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) return;
+		const number = Number(match[2]);
+		return Number.isInteger(number) && number > 0 ? number : void 0;
+	} catch {
+		return;
+	}
 }
 function isCanonicalGithubIssueUrl(value, repoFullName, issueNumber) {
-  try {
-    const url = new URL(value);
-    const [owner, repo] = repoFullName.split("/");
-    return url.protocol === "https:" && url.hostname === "github.com" && url.pathname === `/${owner}/${repo}/issues/${issueNumber}` && url.search === "" && url.hash === "";
-  } catch {
-    return false;
-  }
-}
-function isValidGitRef2(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= 255 && /^[A-Za-z0-9_./-]+$/.test(value);
-}
+	try {
+		const url = new URL(value);
+		const [owner, repo] = repoFullName.split("/");
+		return url.protocol === "https:" && url.hostname === "github.com" && url.pathname === `/${owner}/${repo}/issues/${issueNumber}` && url.search === "" && url.hash === "";
+	} catch {
+		return false;
+	}
+}
+/**
+* Validate a git branch/ref name against a strict whitelist. The value is later
+* interpolated into a shell `git clone --branch` command, so it must never
+* contain shell metacharacters. We accept only git-ref-safe characters and
+* reject anything else rather than relying on shell quoting alone.
+*/
+function isValidGitRef(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 255 && /^[A-Za-z0-9_./-]+$/.test(value);
+}
+/**
+* Resolve the org-scoped tenant for a GitHub request. GitHub project features
+* are org-owned, so they require both a signed-in user and a WorkOS
+* organization. Returns the `(orgId, userId)` tenant (with `orgId` narrowed to a
+* non-null string) or a ready-to-return error response: 401 when unauthenticated,
+* 403 when the user has no organization (personal account).
+*
+* Resolves the session from the request cookie itself (via `auth.ensureUser`)
+* instead of relying on the auth gate's context stash: on platform deploys
+* custom `apiRoutes` run on an isolated sub-app context where the gate's
+* `c.set(...)` is invisible. When the gate stash IS visible (local Hono
+* server), `auth.ensureUser` returns the cached user and this is a no-op.
+*/
 async function resolveOrgTenant(c, auth) {
-  await auth.ensureUser(c);
-  const tenant = auth.tenant(c);
-  if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
-  if (!tenant.orgId) {
-    return {
-      response: c.json(
-        {
-          error: "organization_required",
-          message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
-        },
-        403
-      )
-    };
-  }
-  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };
-}
+	await auth.ensureUser(c);
+	const tenant = auth.tenant(c);
+	if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+	if (!tenant.orgId) return { response: c.json({
+		error: "organization_required",
+		message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
+	}, 403) };
+	return { tenant: {
+		orgId: tenant.orgId,
+		userId: tenant.userId
+	} };
+}
+/**
+* Parse a 1-based `page` query param. Missing means page 1; anything that is
+* not a small positive integer is rejected (`null`).
+*/
 function parseListPage(raw) {
-  if (raw === void 0) return 1;
-  if (!/^\d{1,5}$/.test(raw)) return null;
-  const page = Number(raw);
-  return page >= 1 ? page : null;
+	if (raw === void 0) return 1;
+	if (!/^\d{1,5}$/.test(raw)) return null;
+	const page = Number(raw);
+	return page >= 1 ? page : null;
 }
-var VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set(["auto-triaged", "needs-approval"]);
+const VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set(["auto-triaged", "needs-approval"]);
 function parseIssueLabelFilter(raw) {
-  if (raw === void 0 || raw === "") return void 0;
-  if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
-  return null;
+	if (raw === void 0 || raw === "") return void 0;
+	if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
+	return null;
 }
 function parseIssueNumberParam(raw) {
-  if (!raw || !/^\d{1,10}$/.test(raw)) return null;
-  const issueNumber = Number(raw);
-  return Number.isSafeInteger(issueNumber) && issueNumber > 0 ? issueNumber : null;
+	if (!raw || !/^\d{1,10}$/.test(raw)) return null;
+	const issueNumber = Number(raw);
+	return Number.isSafeInteger(issueNumber) && issueNumber > 0 ? issueNumber : null;
 }
 function parseStringList(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((item) => typeof item === "string" && item.length > 0);
+	if (!Array.isArray(value)) return [];
+	return value.filter((item) => typeof item === "string" && item.length > 0);
 }
 async function resolveProjectRepository(args) {
-  const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
-    orgId: args.orgId,
-    id: args.projectRepositoryId
-  });
-  if (!projectRepository) return null;
-  const connection = await args.github.sourceControlStorage.connections.get({
-    orgId: args.orgId,
-    id: projectRepository.connectionId
-  });
-  if (!connection) return null;
-  const repository = await args.github.sourceControlStorage.repositories.get({
-    orgId: args.orgId,
-    id: projectRepository.repositoryId
-  });
-  if (!repository) return null;
-  const installation = await args.github.sourceControlStorage.installations.get({
-    orgId: args.orgId,
-    id: connection.installationId
-  });
-  if (!installation) return null;
-  return {
-    ...projectRepository,
-    connection,
-    installation,
-    repository,
-    factoryProjectId: connection.factoryProjectId,
-    defaultBranch: projectRepository.branch ?? repository.defaultBranch
-  };
+	const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
+		orgId: args.orgId,
+		id: args.projectRepositoryId
+	});
+	if (!projectRepository) return null;
+	const connection = await args.github.sourceControlStorage.connections.get({
+		orgId: args.orgId,
+		id: projectRepository.connectionId
+	});
+	if (!connection) return null;
+	const repository = await args.github.sourceControlStorage.repositories.get({
+		orgId: args.orgId,
+		id: projectRepository.repositoryId
+	});
+	if (!repository) return null;
+	const installation = await args.github.sourceControlStorage.installations.get({
+		orgId: args.orgId,
+		id: connection.installationId
+	});
+	if (!installation) return null;
+	return {
+		...projectRepository,
+		connection,
+		installation,
+		repository,
+		factoryProjectId: connection.factoryProjectId,
+		defaultBranch: projectRepository.branch ?? repository.defaultBranch
+	};
 }
 function polledIssueEvent(project, issue) {
-  const repositoryId = Number(project.repository.externalId);
-  return {
-    event: "issues",
-    deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
-    payload: {
-      action: "opened",
-      installation: { id: Number(project.installation.externalId) },
-      repository: { id: repositoryId, full_name: project.repository.slug },
-      sender: { login: issue.author ?? "__unknown__" },
-      issue: {
-        number: issue.number,
-        title: issue.title,
-        html_url: issue.url,
-        created_at: issue.createdAt,
-        labels: issue.labels.map((name) => ({ name }))
-      }
-    }
-  };
+	const repositoryId = Number(project.repository.externalId);
+	return {
+		event: "issues",
+		deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
+		payload: {
+			action: "opened",
+			installation: { id: Number(project.installation.externalId) },
+			repository: {
+				id: repositoryId,
+				full_name: project.repository.slug
+			},
+			sender: { login: issue.author ?? "__unknown__" },
+			issue: {
+				number: issue.number,
+				title: issue.title,
+				html_url: issue.url,
+				created_at: issue.createdAt,
+				labels: issue.labels.map((name) => ({ name }))
+			}
+		}
+	};
 }
 function polledPullRequestEvent(project, pullRequest) {
-  const repositoryId = Number(project.repository.externalId);
-  return {
-    event: "pull_request",
-    deliveryId: `poll:${repositoryId}:pull-request:${pullRequest.number}:${pullRequest.createdAt}`,
-    payload: {
-      action: "opened",
-      installation: { id: Number(project.installation.externalId) },
-      repository: { id: repositoryId, full_name: project.repository.slug },
-      sender: { login: pullRequest.author ?? "__unknown__" },
-      pull_request: {
-        number: pullRequest.number,
-        title: pullRequest.title,
-        html_url: pullRequest.url,
-        created_at: pullRequest.createdAt,
-        state: "open",
-        merged: false,
-        head: { ref: pullRequest.headBranch },
-        base: { ref: pullRequest.baseBranch }
-      }
-    }
-  };
+	const repositoryId = Number(project.repository.externalId);
+	return {
+		event: "pull_request",
+		deliveryId: `poll:${repositoryId}:pull-request:${pullRequest.number}:${pullRequest.createdAt}`,
+		payload: {
+			action: "opened",
+			installation: { id: Number(project.installation.externalId) },
+			repository: {
+				id: repositoryId,
+				full_name: project.repository.slug
+			},
+			sender: { login: pullRequest.author ?? "__unknown__" },
+			pull_request: {
+				number: pullRequest.number,
+				title: pullRequest.title,
+				html_url: pullRequest.url,
+				created_at: pullRequest.createdAt,
+				state: "open",
+				merged: false,
+				head: { ref: pullRequest.headBranch },
+				base: { ref: pullRequest.baseBranch }
+			}
+		}
+	};
 }
 async function ingestPolledEvents(events, ingestFactoryEvent) {
-  if (!ingestFactoryEvent) return;
-  const results = await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)));
-  const rejected = results.find((result) => result.status === "rejected");
-  if (rejected) throw rejected.reason;
-}
+	if (!ingestFactoryEvent) return;
+	const rejected = (await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)))).find((result) => result.status === "rejected");
+	if (rejected) throw rejected.reason;
+}
+/**
+* Build the GitHub routes as Mastra `apiRoutes`. When the feature is disabled,
+* returns only the `status` route so the SPA can detect the disabled state.
+*/
 function buildGithubRoutes(options) {
-  const routes = [];
-  const { auth, fleet, storage, github, stateSigner, emitAudit } = options;
-  const diagnostics = () => getGithubFeatureDiagnostics({ github, auth, appDbConfigured: storage !== void 0, stateSigner, fleet });
-  routes.push(
-    registerApiRoute("/web/github/status", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
-          return c.json({
-            enabled: false,
-            connected: false,
-            installations: [],
-            reason: "missing_config",
-            diagnostics: diagnostics()
-          });
-        }
-        await auth.ensureUser(loose(c));
-        const tenant = auth.tenant(loose(c));
-        if (!tenant) return c.json({ error: "unauthorized", reason: "auth_required" }, 401);
-        if (!tenant.orgId) {
-          return c.json({
-            enabled: true,
-            sandboxEnabled: fleet.enabled,
-            organizationRequired: true,
-            connected: false,
-            installations: [],
-            reason: "organization_required",
-            diagnostics: diagnostics()
-          });
-        }
-        const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
-        const connected = rows.length > 0;
-        return c.json({
-          enabled: true,
-          sandboxEnabled: fleet.enabled,
-          connected,
-          installations: rows.map((r) => ({
-            installationId: Number(r.externalId),
-            accountLogin: r.accountName,
-            accountType: r.accountType
-          })),
-          reason: connected ? "ready" : "not_connected",
-          diagnostics: diagnostics()
-        });
-      }
-    })
-  );
-  if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
-    return routes;
-  }
-  const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
-  const verifyState = (state) => stateSigner.verify(state);
-  const { runIssueTriage } = options;
-  const runBoardIssueTriage = runIssueTriage ? async (input) => {
-    if (!input.resourceId || !input.projectPath) {
-      throw new Error("GitHub issue triage requires an explicit Factory project repository");
-    }
-    await github.addIssueLabels(input.installationId, input.repository, input.issueNumber, ["auto-triaged"]);
-    return runIssueTriage({
-      ...input,
-      defaultModelId: input.defaultModelId ?? await resolveFactoryDefaultModelId(options.projects, input.resourceId),
-      labels: input.labels.includes("auto-triaged") ? input.labels : [...input.labels, "auto-triaged"]
-    });
-  } : void 0;
-  routes.push(
-    registerApiRoute("/web/github/subscriptions", {
-      method: "GET",
-      handler: async (c) => {
-        await auth.ensureUser(loose(c));
-        const tenant = auth.tenant(loose(c));
-        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
-        const resourceId = c.req.query("resourceId");
-        const threadId = c.req.query("threadId");
-        const sessionScope = c.req.query("scope");
-        if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
-        const subscriptions = await listPullRequestSubscriptionsForThread(
-          {
-            orgId: tenant.orgId,
-            resourceId,
-            threadId,
-            sessionScope
-          },
-          github.integrationStorage
-        );
-        return c.json({
-          subscriptions: subscriptions.map((subscription) => ({
-            id: subscription.id,
-            repoFullName: subscription.data.repositorySlug,
-            pullRequestNumber: Number(subscription.data.changeRequestId),
-            status: subscription.status,
-            url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
-          }))
-        });
-      }
-    }),
-    registerApiRoute("/web/github/webhook", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const result = await handleGithubWebhook(loose(c), {
-          github,
-          runIssueTriage: runBoardIssueTriage,
-          ingestFactoryEvent: options.ingestFactoryEvent,
-          ...options.controller ? {
-            controller: options.controller,
-            onTargetError: (subscription, error) => {
-              console.warn(
-                `[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`,
-                error
-              );
-            }
-          } : {}
-        });
-        return c.json(result.body, result.status);
-      }
-    })
-  );
-  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
-  routes.push(
-    registerApiRoute("/auth/github/connect", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
-        if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
-        return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/auth/github/callback", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        const state = c.req.query("state");
-        if (!state) {
-          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
-        }
-        const stateTenant = verifyState(state);
-        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
-          console.warn(
-            "[GitHub] Install callback rejected: state/tenant mismatch.",
-            JSON.stringify({
-              stateValid: Boolean(stateTenant),
-              stateOrgId: stateTenant?.orgId,
-              stateUserId: stateTenant?.userId,
-              sessionOrgId: orgId,
-              sessionUserId: userId
-            })
-          );
-          return c.redirect("/?github=error");
-        }
-        const code = c.req.query("code");
-        if (!code) {
-          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
-        }
-        try {
-          const userToken = await github.exchangeOAuthCode(code, redirectUri);
-          const installations = await github.listUserInstallations(userToken);
-          if (installations.length === 0) {
-            return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
-          }
-          for (const inst of installations) {
-            await github.sourceControlStorage.installations.upsert({
-              orgId,
-              connectedByUserId: userId,
-              externalId: inst.installationId.toString(),
-              accountName: inst.accountLogin,
-              accountType: inst.accountType
-            });
-          }
-        } catch (error) {
-          console.warn(
-            `[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`,
-            error
-          );
-          return c.redirect("/?github=error");
-        }
-        return c.redirect("/?github=connected");
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/repos", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const orgId = resolved.tenant.orgId;
-        const installs = await github.sourceControlStorage.installations.list({ orgId });
-        const query = (c.req.query("q") ?? "").toLowerCase();
-        const listed = await Promise.all(
-          installs.map(async (inst) => {
-            try {
-              return { inst, list: await github.listInstallationRepos(Number(inst.externalId)) };
-            } catch (err) {
-              if (err.status !== 404) throw err;
-              console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
-              await github.sourceControlStorage.installations.delete({ orgId, id: inst.id });
-              return { inst, list: [] };
-            }
-          })
-        );
-        const matches = [];
-        const seenRepositoryIds = /* @__PURE__ */ new Set();
-        for (const { inst, list } of listed) {
-          for (const repo of list) {
-            if (query && !repo.fullName.toLowerCase().includes(query)) continue;
-            if (seenRepositoryIds.has(repo.id)) continue;
-            seenRepositoryIds.add(repo.id);
-            matches.push({ inst, repo });
-          }
-        }
-        const repos = new Array(matches.length);
-        const upsertConcurrency = 10;
-        for (let start = 0; start < matches.length; start += upsertConcurrency) {
-          await Promise.all(
-            matches.slice(start, start + upsertConcurrency).map(async ({ inst, repo }, offset) => {
-              const repository = await github.sourceControlStorage.repositories.upsert({
-                orgId,
-                input: {
-                  installationId: inst.id,
-                  externalId: repo.id.toString(),
-                  slug: repo.fullName,
-                  defaultBranch: isValidGitRef2(repo.defaultBranch) ? repo.defaultBranch : "main",
-                  providerMetadata: { private: repo.private, owner: repo.owner }
-                }
-              });
-              repos[start + offset] = {
-                ...repo,
-                installationStorageId: inst.id,
-                repositoryStorageId: repository.id,
-                sandboxProvider: fleet.provider,
-                sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
-              };
-            })
-          );
-        }
-        return c.json({ repos });
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/ensure", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        if (!fleet.enabled) {
-          return c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503);
-        }
-        const projectRepositoryId = c.req.param("id");
-        if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
-        const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
-        if (!project) {
-          return c.json({ error: "Project repository not found" }, 404);
-        }
-        const wantsStream = (c.req.header("accept") ?? "").includes("text/event-stream");
-        if (wantsStream) {
-          return streamSSE(loose(c), async (stream) => {
-            try {
-              const result = await prepareProject({
-                github,
-                fleet,
-                project,
-                userId,
-                onProgress: (ev) => void stream.writeSSE({ event: "progress", data: JSON.stringify(ev) })
-              });
-              await stream.writeSSE({ event: "done", data: JSON.stringify(result) });
-            } catch (err) {
-              await stream.writeSSE({ event: "error", data: JSON.stringify(ensureErrorPayload(err).body) });
-            }
-          });
-        }
-        try {
-          const result = await prepareProject({ github, fleet, project, userId });
-          return c.json(result);
-        } catch (err) {
-          const { status, body } = ensureErrorPayload(err);
-          return c.json(body, status);
-        }
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/issues", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        const page = parseListPage(c.req.query("page"));
-        if (page === null) return c.json({ error: "invalid_page" }, 400);
-        const label = parseIssueLabelFilter(c.req.query("label"));
-        if (label === null) return c.json({ error: "invalid_label" }, 400);
-        try {
-          const { issues, nextCursor } = await github.intake.listIssues({
-            connection: {
-              type: "app-installation",
-              installationId: Number(loaded.project.installation.externalId)
-            },
-            sourceIds: [loaded.project.repository.slug],
-            labels: label ? [label] : void 0,
-            cursor: String(page)
-          });
-          const responseIssues = issues.map((issue) => ({
-            number: Number(issue.id),
-            title: issue.title,
-            url: issue.url,
-            author: issue.author,
-            labels: issue.labels,
-            comments: issue.commentCount ?? 0,
-            createdAt: issue.createdAt,
-            updatedAt: issue.updatedAt
-          }));
-          await ingestPolledEvents(
-            responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)),
-            options.ingestFactoryEvent
-          );
-          return c.json({
-            issues: responseIssues,
-            nextPage: nextCursor === null ? null : Number(nextCursor)
-          });
-        } catch (err) {
-          return c.json(
-            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
-            502
-          );
-        }
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/issues/:number/triage", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { project, sandboxRow } = owned;
-        const issueNumber = parseIssueNumberParam(c.req.param("number"));
-        if (issueNumber === null) return c.json({ error: "invalid_issue_number" }, 400);
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 5e3) {
-          return c.json({ error: "invalid_title" }, 400);
-        }
-        if (typeof body.url !== "string" || body.url.trim().length === 0 || body.url.length > 2048 || !isCanonicalGithubIssueUrl(body.url, project.repository.slug, issueNumber)) {
-          return c.json({ error: "invalid_url" }, 400);
-        }
-        if (!runIssueTriage) return c.json({ error: "triage_unavailable" }, 503);
-        const branch = `factory/issue-${issueNumber}`;
-        const projectPath = computeWorktreePath(sandboxRow.sandboxWorkdir, branch);
-        await github.addIssueLabels(Number(project.installation.externalId), project.repository.slug, issueNumber, [
-          "auto-triaged"
-        ]);
-        const result = await runIssueTriage({
-          repository: project.repository.slug,
-          issueNumber,
-          issueTitle: body.title,
-          issueUrl: body.url,
-          labels: parseStringList(body.labels),
-          installationId: Number(project.installation.externalId),
-          resourceId: project.factoryProjectId,
-          projectPath,
-          branch,
-          defaultModelId: await resolveFactoryDefaultModelId(options.projects, project.factoryProjectId)
-        });
-        await emitAudit?.({
-          context: loose(c),
-          input: {
-            action: "factory.triage.started",
-            factoryProjectId: project.factoryProjectId,
-            projectRepositoryId: project.id,
-            targets: [{ type: "issue", id: String(issueNumber), name: body.title }],
-            metadata: { issueNumber, branch, threadId: result.threadId }
-          }
-        });
-        return c.json(
-          {
-            ok: true,
-            threadId: result.threadId,
-            projectPath: result.projectPath ?? projectPath,
-            branch: result.branch ?? branch
-          },
-          202
-        );
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/prs", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        const page = parseListPage(c.req.query("page"));
-        if (page === null) return c.json({ error: "invalid_page" }, 400);
-        try {
-          const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
-            connection: {
-              type: "app-installation",
-              installationId: Number(loaded.project.installation.externalId)
-            },
-            sourceId: loaded.project.repository.slug,
-            includeDrafts: false,
-            cursor: String(page)
-          });
-          const responsePullRequests = pullRequests.map((pr) => ({
-            number: Number(pr.id),
-            title: pr.title,
-            url: pr.url,
-            author: pr.author,
-            baseBranch: pr.baseBranch,
-            headBranch: pr.headBranch,
-            createdAt: pr.createdAt,
-            updatedAt: pr.updatedAt
-          }));
-          await ingestPolledEvents(
-            responsePullRequests.map((pullRequest) => polledPullRequestEvent(loaded.project, pullRequest)),
-            options.ingestFactoryEvent
-          );
-          return c.json({
-            pullRequests: responsePullRequests,
-            nextPage: nextCursor === null ? null : Number(nextCursor)
-          });
-        } catch (err) {
-          return c.json(
-            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
-            502
-          );
-        }
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/settings", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        return c.json({ setupCommand: loaded.project.setupCommand });
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/settings", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (body.setupCommand !== null && typeof body.setupCommand !== "string") {
-          return c.json({ error: "Invalid setupCommand" }, 400);
-        }
-        if (typeof body.setupCommand === "string" && body.setupCommand.length > 2e3) {
-          return c.json({ error: "setupCommand too long (max 2000 characters)" }, 400);
-        }
-        if (typeof body.setupCommand === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(body.setupCommand)) {
-          return c.json({ error: "setupCommand contains control characters" }, 400);
-        }
-        const setupCommand = typeof body.setupCommand === "string" && body.setupCommand.trim().length > 0 ? body.setupCommand.trim() : null;
-        await github.sourceControlStorage.projectRepositories.update({
-          orgId: loaded.project.installation.orgId,
-          id: loaded.project.id,
-          input: { setupCommand }
-        });
-        return c.json({ setupCommand });
-      }
-    })
-  );
-  const parsePatKind = (value) => {
-    if (value === void 0 || value === null || value === "default") return "default";
-    if (value === "reviewer") return "reviewer";
-    return null;
-  };
-  routes.push(
-    registerApiRoute("/web/github/pat", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
-      }
-    }),
-    registerApiRoute("/web/github/pat", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        const kind = parsePatKind(body.kind);
-        if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
-        const token = typeof body.token === "string" ? body.token.trim() : "";
-        if (!token) return c.json({ error: "A token is required" }, 400);
-        if (token.length > 500) return c.json({ error: "Token too long (max 500 characters)" }, 400);
-        if (/\s/.test(token)) return c.json({ error: "Token must not contain whitespace" }, 400);
-        await setGithubPat(github.integrationStorage, resolved.tenant.orgId, token, kind);
-        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
-      }
-    }),
-    registerApiRoute("/web/github/pat", {
-      method: "DELETE",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const kind = parsePatKind(c.req.query("kind"));
-        if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
-        await clearGithubPat(github.integrationStorage, resolved.tenant.orgId, kind);
-        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
-      }
-    })
-  );
-  routes.push(...buildProjectGitRoutes({ github, auth, fleet, emitAudit }));
-  return routes;
-}
+	const routes = [];
+	const { auth, fleet, storage, github, stateSigner, emitAudit } = options;
+	const diagnostics = () => getGithubFeatureDiagnostics({
+		github,
+		auth,
+		appDbConfigured: storage !== void 0,
+		stateSigner,
+		fleet
+	});
+	routes.push(registerApiRoute("/web/github/status", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			if (!isGithubFeatureEnabled({
+				github,
+				auth
+			}) || !github || !stateSigner) return c.json({
+				enabled: false,
+				connected: false,
+				installations: [],
+				reason: "missing_config",
+				diagnostics: diagnostics()
+			});
+			await auth.ensureUser(loose(c));
+			const tenant = auth.tenant(loose(c));
+			if (!tenant) return c.json({
+				error: "unauthorized",
+				reason: "auth_required"
+			}, 401);
+			if (!tenant.orgId) return c.json({
+				enabled: true,
+				sandboxEnabled: fleet.enabled,
+				organizationRequired: true,
+				connected: false,
+				installations: [],
+				reason: "organization_required",
+				diagnostics: diagnostics()
+			});
+			const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
+			const connected = rows.length > 0;
+			return c.json({
+				enabled: true,
+				sandboxEnabled: fleet.enabled,
+				connected,
+				installations: rows.map((r) => ({
+					installationId: Number(r.externalId),
+					accountLogin: r.accountName,
+					accountType: r.accountType
+				})),
+				reason: connected ? "ready" : "not_connected",
+				diagnostics: diagnostics()
+			});
+		}
+	}));
+	if (!isGithubFeatureEnabled({
+		github,
+		auth
+	}) || !github || !stateSigner) return routes;
+	const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
+	const verifyState = (state) => stateSigner.verify(state);
+	const { runIssueTriage } = options;
+	const runBoardIssueTriage = runIssueTriage ? async (input) => {
+		if (!input.resourceId || !input.projectPath) throw new Error("GitHub issue triage requires an explicit Factory project repository");
+		await github.addIssueLabels(input.installationId, input.repository, input.issueNumber, ["auto-triaged"]);
+		return runIssueTriage({
+			...input,
+			defaultModelId: input.defaultModelId ?? await resolveFactoryDefaultModelId(options.projects, input.resourceId),
+			labels: input.labels.includes("auto-triaged") ? input.labels : [...input.labels, "auto-triaged"]
+		});
+	} : void 0;
+	routes.push(registerApiRoute("/web/github/subscriptions", {
+		method: "GET",
+		handler: async (c) => {
+			await auth.ensureUser(loose(c));
+			const tenant = auth.tenant(loose(c));
+			if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+			const resourceId = c.req.query("resourceId");
+			const threadId = c.req.query("threadId");
+			const sessionScope = c.req.query("scope");
+			if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
+			const subscriptions = await listPullRequestSubscriptionsForThread({
+				orgId: tenant.orgId,
+				resourceId,
+				threadId,
+				sessionScope
+			}, github.integrationStorage);
+			return c.json({ subscriptions: subscriptions.map((subscription) => ({
+				id: subscription.id,
+				repoFullName: subscription.data.repositorySlug,
+				pullRequestNumber: Number(subscription.data.changeRequestId),
+				status: subscription.status,
+				url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
+			})) });
+		}
+	}), registerApiRoute("/web/github/webhook", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const result = await handleGithubWebhook(loose(c), {
+				github,
+				runIssueTriage: runBoardIssueTriage,
+				ingestFactoryEvent: options.ingestFactoryEvent,
+				...options.controller ? {
+					controller: options.controller,
+					onTargetError: (subscription, error) => {
+						console.warn(`[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`, error);
+					}
+				} : {}
+			});
+			return c.json(result.body, result.status);
+		}
+	}));
+	const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
+	routes.push(registerApiRoute("/auth/github/connect", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
+			if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
+			return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
+		}
+	}));
+	routes.push(registerApiRoute("/auth/github/callback", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			const state = c.req.query("state");
+			if (!state) return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+			const stateTenant = verifyState(state);
+			if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
+				console.warn("[GitHub] Install callback rejected: state/tenant mismatch.", JSON.stringify({
+					stateValid: Boolean(stateTenant),
+					stateOrgId: stateTenant?.orgId,
+					stateUserId: stateTenant?.userId,
+					sessionOrgId: orgId,
+					sessionUserId: userId
+				}));
+				return c.redirect("/?github=error");
+			}
+			const code = c.req.query("code");
+			if (!code) return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+			try {
+				const userToken = await github.exchangeOAuthCode(code, redirectUri);
+				const installations = await github.listUserInstallations(userToken);
+				if (installations.length === 0) return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
+				for (const inst of installations) await github.sourceControlStorage.installations.upsert({
+					orgId,
+					connectedByUserId: userId,
+					externalId: inst.installationId.toString(),
+					accountName: inst.accountLogin,
+					accountType: inst.accountType
+				});
+			} catch (error) {
+				console.warn(`[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`, error);
+				return c.redirect("/?github=error");
+			}
+			return c.redirect("/?github=connected");
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/repos", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const orgId = resolved.tenant.orgId;
+			const installs = await github.sourceControlStorage.installations.list({ orgId });
+			const query = (c.req.query("q") ?? "").toLowerCase();
+			const listed = await Promise.all(installs.map(async (inst) => {
+				try {
+					return {
+						inst,
+						list: await github.listInstallationRepos(Number(inst.externalId))
+					};
+				} catch (err) {
+					if (err.status !== 404) throw err;
+					console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
+					await github.sourceControlStorage.installations.delete({
+						orgId,
+						id: inst.id
+					});
+					return {
+						inst,
+						list: []
+					};
+				}
+			}));
+			const matches = [];
+			const seenRepositoryIds = /* @__PURE__ */ new Set();
+			for (const { inst, list } of listed) for (const repo of list) {
+				if (query && !repo.fullName.toLowerCase().includes(query)) continue;
+				if (seenRepositoryIds.has(repo.id)) continue;
+				seenRepositoryIds.add(repo.id);
+				matches.push({
+					inst,
+					repo
+				});
+			}
+			const repos = new Array(matches.length);
+			const upsertConcurrency = 10;
+			for (let start = 0; start < matches.length; start += upsertConcurrency) await Promise.all(matches.slice(start, start + upsertConcurrency).map(async ({ inst, repo }, offset) => {
+				const repository = await github.sourceControlStorage.repositories.upsert({
+					orgId,
+					input: {
+						installationId: inst.id,
+						externalId: repo.id.toString(),
+						slug: repo.fullName,
+						defaultBranch: isValidGitRef(repo.defaultBranch) ? repo.defaultBranch : "main",
+						providerMetadata: {
+							private: repo.private,
+							owner: repo.owner
+						}
+					}
+				});
+				repos[start + offset] = {
+					...repo,
+					installationStorageId: inst.id,
+					repositoryStorageId: repository.id,
+					sandboxProvider: fleet.provider,
+					sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
+				};
+			}));
+			return c.json({ repos });
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/ensure", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const { orgId, userId } = resolved.tenant;
+			if (!fleet.enabled) return c.json({
+				error: "sandbox_not_configured",
+				message: "No sandbox provider is configured."
+			}, 503);
+			const projectRepositoryId = c.req.param("id");
+			if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
+			const project = await resolveProjectRepository({
+				github,
+				orgId,
+				projectRepositoryId
+			});
+			if (!project) return c.json({ error: "Project repository not found" }, 404);
+			if ((c.req.header("accept") ?? "").includes("text/event-stream")) return streamSSE(loose(c), async (stream) => {
+				try {
+					const result = await prepareProject({
+						github,
+						fleet,
+						project,
+						userId,
+						onProgress: (ev) => void stream.writeSSE({
+							event: "progress",
+							data: JSON.stringify(ev)
+						})
+					});
+					await stream.writeSSE({
+						event: "done",
+						data: JSON.stringify(result)
+					});
+				} catch (err) {
+					await stream.writeSSE({
+						event: "error",
+						data: JSON.stringify(ensureErrorPayload(err).body)
+					});
+				}
+			});
+			try {
+				const result = await prepareProject({
+					github,
+					fleet,
+					project,
+					userId
+				});
+				return c.json(result);
+			} catch (err) {
+				const { status, body } = ensureErrorPayload(err);
+				return c.json(body, status);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/issues", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const page = parseListPage(c.req.query("page"));
+			if (page === null) return c.json({ error: "invalid_page" }, 400);
+			const label = parseIssueLabelFilter(c.req.query("label"));
+			if (label === null) return c.json({ error: "invalid_label" }, 400);
+			try {
+				const { issues, nextCursor } = await github.intake.listIssues({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceIds: [loaded.project.repository.slug],
+					labels: label ? [label] : void 0,
+					cursor: String(page)
+				});
+				const responseIssues = issues.map((issue) => ({
+					number: Number(issue.id),
+					title: issue.title,
+					url: issue.url,
+					author: issue.author,
+					labels: issue.labels,
+					comments: issue.commentCount ?? 0,
+					createdAt: issue.createdAt,
+					updatedAt: issue.updatedAt
+				}));
+				await ingestPolledEvents(responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)), options.ingestFactoryEvent);
+				return c.json({
+					issues: responseIssues,
+					nextPage: nextCursor === null ? null : Number(nextCursor)
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/issues/:number/triage", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const owned = await loadOwnedProject({
+				github,
+				auth,
+				fleet,
+				c: loose(c)
+			});
+			if ("response" in owned) return owned.response;
+			const { project, sandboxRow } = owned;
+			const issueNumber = parseIssueNumberParam(c.req.param("number"));
+			if (issueNumber === null) return c.json({ error: "invalid_issue_number" }, 400);
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 5e3) return c.json({ error: "invalid_title" }, 400);
+			if (typeof body.url !== "string" || body.url.trim().length === 0 || body.url.length > 2048 || !isCanonicalGithubIssueUrl(body.url, project.repository.slug, issueNumber)) return c.json({ error: "invalid_url" }, 400);
+			if (!runIssueTriage) return c.json({ error: "triage_unavailable" }, 503);
+			const branch = `factory/issue-${issueNumber}`;
+			const projectPath = computeWorktreePath(sandboxRow.sandboxWorkdir, branch);
+			await github.addIssueLabels(Number(project.installation.externalId), project.repository.slug, issueNumber, ["auto-triaged"]);
+			const result = await runIssueTriage({
+				repository: project.repository.slug,
+				issueNumber,
+				issueTitle: body.title,
+				issueUrl: body.url,
+				labels: parseStringList(body.labels),
+				installationId: Number(project.installation.externalId),
+				resourceId: project.factoryProjectId,
+				projectPath,
+				branch,
+				defaultModelId: await resolveFactoryDefaultModelId(options.projects, project.factoryProjectId)
+			});
+			await emitAudit?.({
+				context: loose(c),
+				input: {
+					action: "factory.triage.started",
+					factoryProjectId: project.factoryProjectId,
+					projectRepositoryId: project.id,
+					targets: [{
+						type: "issue",
+						id: String(issueNumber),
+						name: body.title
+					}],
+					metadata: {
+						issueNumber,
+						branch,
+						threadId: result.threadId
+					}
+				}
+			});
+			return c.json({
+				ok: true,
+				threadId: result.threadId,
+				projectPath: result.projectPath ?? projectPath,
+				branch: result.branch ?? branch
+			}, 202);
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/prs", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			const page = parseListPage(c.req.query("page"));
+			if (page === null) return c.json({ error: "invalid_page" }, 400);
+			try {
+				const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
+					connection: {
+						type: "app-installation",
+						installationId: Number(loaded.project.installation.externalId)
+					},
+					sourceId: loaded.project.repository.slug,
+					includeDrafts: false,
+					cursor: String(page)
+				});
+				const responsePullRequests = pullRequests.map((pr) => ({
+					number: Number(pr.id),
+					title: pr.title,
+					url: pr.url,
+					author: pr.author,
+					baseBranch: pr.baseBranch,
+					headBranch: pr.headBranch,
+					createdAt: pr.createdAt,
+					updatedAt: pr.updatedAt
+				}));
+				await ingestPolledEvents(responsePullRequests.map((pullRequest) => polledPullRequestEvent(loaded.project, pullRequest)), options.ingestFactoryEvent);
+				return c.json({
+					pullRequests: responsePullRequests,
+					nextPage: nextCursor === null ? null : Number(nextCursor)
+				});
+			} catch (err) {
+				return c.json({
+					error: "github_fetch_failed",
+					message: err instanceof Error ? err.message : String(err)
+				}, 502);
+			}
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/settings", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			return c.json({ setupCommand: loaded.project.setupCommand });
+		}
+	}));
+	routes.push(registerApiRoute("/web/github/projects/:id/settings", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const loaded = await loadOrgProject({
+				github,
+				auth,
+				c: loose(c)
+			});
+			if ("response" in loaded) return loaded.response;
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			if (body.setupCommand !== null && typeof body.setupCommand !== "string") return c.json({ error: "Invalid setupCommand" }, 400);
+			if (typeof body.setupCommand === "string" && body.setupCommand.length > 2e3) return c.json({ error: "setupCommand too long (max 2000 characters)" }, 400);
+			if (typeof body.setupCommand === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(body.setupCommand)) return c.json({ error: "setupCommand contains control characters" }, 400);
+			const setupCommand = typeof body.setupCommand === "string" && body.setupCommand.trim().length > 0 ? body.setupCommand.trim() : null;
+			await github.sourceControlStorage.projectRepositories.update({
+				orgId: loaded.project.installation.orgId,
+				id: loaded.project.id,
+				input: { setupCommand }
+			});
+			return c.json({ setupCommand });
+		}
+	}));
+	const parsePatKind = (value) => {
+		if (value === void 0 || value === null || value === "default") return "default";
+		if (value === "reviewer") return "reviewer";
+		return null;
+	};
+	routes.push(registerApiRoute("/web/github/pat", {
+		method: "GET",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}), registerApiRoute("/web/github/pat", {
+		method: "POST",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			let body;
+			try {
+				body = await c.req.json();
+			} catch {
+				return c.json({ error: "Invalid JSON body" }, 400);
+			}
+			const kind = parsePatKind(body.kind);
+			if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+			const token = typeof body.token === "string" ? body.token.trim() : "";
+			if (!token) return c.json({ error: "A token is required" }, 400);
+			if (token.length > 500) return c.json({ error: "Token too long (max 500 characters)" }, 400);
+			if (/\s/.test(token)) return c.json({ error: "Token must not contain whitespace" }, 400);
+			await setGithubPat(github.integrationStorage, resolved.tenant.orgId, token, kind);
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}), registerApiRoute("/web/github/pat", {
+		method: "DELETE",
+		requiresAuth: false,
+		handler: async (c) => {
+			const resolved = await resolveOrgTenant(loose(c), auth);
+			if ("response" in resolved) return resolved.response;
+			const kind = parsePatKind(c.req.query("kind"));
+			if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
+			await clearGithubPat(github.integrationStorage, resolved.tenant.orgId, kind);
+			return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
+		}
+	}));
+	routes.push(...buildProjectGitRoutes({
+		github,
+		auth,
+		fleet,
+		emitAudit
+	}));
+	return routes;
+}
+/**
+* Load the org-owned project for a read-only GitHub API route. Unlike
+* `loadOwnedProject`, this never touches sandbox state — the issues/PR list
+* routes only need the repo + installation, so they work before a sandbox is
+* ever provisioned.
+*/
 async function loadOrgProject(options) {
-  const { github, auth, c } = options;
-  const resolved = await resolveOrgTenant(c, auth);
-  if ("response" in resolved) return { response: resolved.response };
-  const { orgId, userId } = resolved.tenant;
-  const projectRepositoryId = c.req.param("id");
-  if (!projectRepositoryId) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
-  if (!project) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  return { project, userId };
-}
+	const { github, auth, c } = options;
+	const resolved = await resolveOrgTenant(c, auth);
+	if ("response" in resolved) return { response: resolved.response };
+	const { orgId, userId } = resolved.tenant;
+	const projectRepositoryId = c.req.param("id");
+	if (!projectRepositoryId) return { response: c.json({ error: "Project repository not found" }, 404) };
+	const project = await resolveProjectRepository({
+		github,
+		orgId,
+		projectRepositoryId
+	});
+	if (!project) return { response: c.json({ error: "Project repository not found" }, 404) };
+	return {
+		project,
+		userId
+	};
+}
+/** Derive a commit/author identity from the authenticated host user. */
 function identityFromUser(user) {
-  const u = user;
-  return { name: u?.name ?? null, email: u?.email ?? null };
-}
+	const u = user;
+	return {
+		name: u?.name ?? null,
+		email: u?.email ?? null
+	};
+}
+/**
+* Resolve a live, started sandbox for the caller's per-user sandbox binding. The
+* sandbox must already have been provisioned (`sandboxId` set) — the git write
+* routes never clone, they operate on the existing checkout.
+*/
 async function resolveProjectSandbox(options) {
-  const { fleet, sandboxRow } = options;
-  if (!sandboxRow.sandboxId) {
-    throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
-  }
-  return fleet.reattachSandbox(sandboxRow.sandboxId);
-}
+	const { fleet, sandboxRow } = options;
+	if (!sandboxRow.sandboxId) throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
+	return fleet.reattachSandbox(sandboxRow.sandboxId);
+}
+/**
+* Load (or create) the caller's per-(project,user) sandbox binding row. The
+* binding inherits its workdir from the org-owned project, but `sandboxId` /
+* `materializedAt` stay null until the user first opens the project.
+*/
 async function loadOrCreateSandboxRow(github, project, userId) {
-  return github.sourceControlStorage.sandboxes.getOrCreate({ projectRepository: project, userId });
-}
+	return github.sourceControlStorage.sandboxes.getOrCreate({
+		projectRepository: project,
+		userId
+	});
+}
+/**
+* Provision/reattach the caller's sandbox and materialize the repo into it,
+* emitting coarse progress events as each server step happens. Shared by both
+* the JSON and SSE variants of the `/ensure` route. Throws on failure so the
+* caller can shape the response (HTTP status vs SSE `error` event).
+*/
 async function prepareProject(options) {
-  const { github, fleet, userId, onProgress } = options;
-  let project = options.project;
-  if (project.sandboxProvider !== fleet.provider) {
-    const sandboxWorkdir = fleet.computeWorkdir(project.repository.slug);
-    await github.sourceControlStorage.projectRepositories.update({
-      orgId: project.installation.orgId,
-      id: project.id,
-      input: { sandboxProvider: fleet.provider, sandboxWorkdir }
-    });
-    project = { ...project, sandboxProvider: fleet.provider, sandboxWorkdir };
-  }
-  let sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-  if (sandboxRow.sandboxWorkdir !== project.sandboxWorkdir) {
-    await github.sourceControlStorage.sandboxes.setWorkdir({
-      id: sandboxRow.id,
-      sandboxWorkdir: project.sandboxWorkdir
-    });
-    sandboxRow = { ...sandboxRow, sandboxWorkdir: project.sandboxWorkdir, materializedAt: null };
-  }
-  const access = await github.versionControl.getRepositoryAccess({
-    orgId: project.installation.orgId,
-    repositoryId: project.repository.id
-  });
-  if (!access.authorization) {
-    throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
-  }
-  const ghCliToken = await getGithubPat(() => github.integrationStorage, project.installation.orgId) ?? access.authorization.token;
-  const sandbox = await ensureProjectSandbox({
-    fleet,
-    row: sandboxRow,
-    storage: github.sourceControlStorage.sandboxes,
-    token: ghCliToken,
-    onProgress
-  });
-  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
-  const finalRow = fresh ?? sandboxRow;
-  await materializeRepo({
-    row: finalRow,
-    repoInfo: { repoFullName: project.repository.slug, defaultBranch: project.defaultBranch },
-    sandbox,
-    token: access.authorization.token,
-    storage: github.sourceControlStorage.sandboxes,
-    onProgress
-  });
-  const result = {
-    resourceId: project.factoryProjectId,
-    factoryProjectId: project.factoryProjectId,
-    projectRepositoryId: project.id,
-    sandboxId: finalRow.sandboxId,
-    sandboxWorkdir: finalRow.sandboxWorkdir
-  };
-  const done = { phase: "done", message: "Workspace ready." };
-  onProgress?.(done);
-  return result;
-}
+	const { github, fleet, userId, onProgress } = options;
+	let project = options.project;
+	if (project.sandboxProvider !== fleet.provider) {
+		const sandboxWorkdir = fleet.computeWorkdir(project.repository.slug);
+		await github.sourceControlStorage.projectRepositories.update({
+			orgId: project.installation.orgId,
+			id: project.id,
+			input: {
+				sandboxProvider: fleet.provider,
+				sandboxWorkdir
+			}
+		});
+		project = {
+			...project,
+			sandboxProvider: fleet.provider,
+			sandboxWorkdir
+		};
+	}
+	let sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+	if (sandboxRow.sandboxWorkdir !== project.sandboxWorkdir) {
+		await github.sourceControlStorage.sandboxes.setWorkdir({
+			id: sandboxRow.id,
+			sandboxWorkdir: project.sandboxWorkdir
+		});
+		sandboxRow = {
+			...sandboxRow,
+			sandboxWorkdir: project.sandboxWorkdir,
+			materializedAt: null
+		};
+	}
+	const access = await github.versionControl.getRepositoryAccess({
+		orgId: project.installation.orgId,
+		repositoryId: project.repository.id
+	});
+	if (!access.authorization) throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
+	const ghCliToken = await getGithubPat(() => github.integrationStorage, project.installation.orgId) ?? access.authorization.token;
+	const sandbox = await ensureProjectSandbox({
+		fleet,
+		row: sandboxRow,
+		storage: github.sourceControlStorage.sandboxes,
+		token: ghCliToken,
+		onProgress
+	});
+	const finalRow = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id }) ?? sandboxRow;
+	await materializeRepo({
+		row: finalRow,
+		repoInfo: {
+			repoFullName: project.repository.slug,
+			defaultBranch: project.defaultBranch
+		},
+		sandbox,
+		token: access.authorization.token,
+		storage: github.sourceControlStorage.sandboxes,
+		onProgress
+	});
+	const result = {
+		resourceId: project.factoryProjectId,
+		factoryProjectId: project.factoryProjectId,
+		projectRepositoryId: project.id,
+		sandboxId: finalRow.sandboxId,
+		sandboxWorkdir: finalRow.sandboxWorkdir
+	};
+	onProgress?.({
+		phase: "done",
+		message: "Workspace ready."
+	});
+	return result;
+}
+/** Shape an /ensure failure into an HTTP status + JSON body (also used as the SSE error payload). */
 function ensureErrorPayload(err) {
-  if (err instanceof SandboxBudgetError) {
-    return { status: 429, body: { error: err.code, message: err.message } };
-  }
-  if (err instanceof MaterializeError) {
-    return { status: 502, body: { error: err.code, message: err.message } };
-  }
-  return {
-    status: 500,
-    body: { error: "materialize_failed", message: err instanceof Error ? err.message : String(err) }
-  };
-}
+	if (err instanceof SandboxBudgetError) return {
+		status: 429,
+		body: {
+			error: err.code,
+			message: err.message
+		}
+	};
+	if (err instanceof MaterializeError) return {
+		status: 502,
+		body: {
+			error: err.code,
+			message: err.message
+		}
+	};
+	return {
+		status: 500,
+		body: {
+			error: "materialize_failed",
+			message: err instanceof Error ? err.message : String(err)
+		}
+	};
+}
+/** Map a sandbox/worktree error to an actionable HTTP response. */
 function gitErrorResponse(c, err) {
-  if (err instanceof WorktreeError) {
-    return c.json({ error: err.code, message: err.message }, err.code === "invalid-branch" ? 400 : 502);
-  }
-  if (err instanceof MaterializeError) {
-    return c.json({ error: err.code, message: err.message }, 502);
-  }
-  return c.json({ error: "git_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-}
+	if (err instanceof WorktreeError) return c.json({
+		error: err.code,
+		message: err.message
+	}, err.code === "invalid-branch" ? 400 : 502);
+	if (err instanceof MaterializeError) return c.json({
+		error: err.code,
+		message: err.message
+	}, 502);
+	return c.json({
+		error: "git_failed",
+		message: err instanceof Error ? err.message : String(err)
+	}, 500);
+}
+/**
+* Load the org-owned project and the caller's per-user sandbox binding for a git
+* route. Centralizes the auth + org/ownership checks every git route shares:
+* the project is scoped by `(id, orgId)`, the sandbox binding by
+* `(projectRepositoryId, userId)`. Returns the tenant, project, and sandbox row, or
+* a ready-to-return error response.
+*/
 async function loadOwnedProject(options) {
-  const { github, auth, fleet, c } = options;
-  const resolved = await resolveOrgTenant(c, auth);
-  if ("response" in resolved) return { response: resolved.response };
-  const { orgId, userId } = resolved.tenant;
-  if (!fleet.enabled) {
-    return {
-      response: c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503)
-    };
-  }
-  const projectRepositoryId = c.req.param("id");
-  if (!projectRepositoryId) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
-  if (!project) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-  return { orgId, userId, project, sandboxRow };
-}
-function buildProjectGitRoutes({
-  github,
-  auth,
-  fleet,
-  emitAudit
-}) {
-  return [
-    // ── Create / list Factory sessions ──────────────────────────────────────
-    registerApiRoute("/web/github/projects/:id/sessions", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        const projectRepositoryId = c.req.param("id");
-        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
-        if (!project) return c.json({ error: "Project repository not found" }, 404);
-        const sessions = await github.sourceControlStorage.sessions.list({ projectRepositoryId: project.id, userId });
-        return c.json({ sessions });
-      }
-    }),
-    registerApiRoute("/web/github/projects/:id/sessions", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        const projectRepositoryId = c.req.param("id");
-        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
-        if (!project) return c.json({ error: "Project repository not found" }, 404);
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (!isValidGitRef(body.branch)) return c.json({ error: "Invalid branch" }, 400);
-        const baseBranch = body.baseBranch === void 0 ? project.defaultBranch : body.baseBranch;
-        if (!isValidGitRef(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
-        const session = await github.sourceControlStorage.sessions.create({
-          sessionId: randomUUID(),
-          projectRepositoryId: project.id,
-          orgId,
-          userId,
-          branch: body.branch,
-          baseBranch
-        });
-        return c.json({ session });
-      }
-    }),
-    registerApiRoute("/web/user-sessions/:sessionId", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
-        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
-          return c.json({ error: "Session not found" }, 404);
-        }
-        return c.json({ session });
-      }
-    }),
-    registerApiRoute("/web/user-sessions/:sessionId", {
-      method: "DELETE",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
-        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
-          return c.json({ error: "Session not found" }, 404);
-        }
-        let sandbox;
-        if (session.sandboxId) {
-          try {
-            sandbox = await fleet.reattachSandbox(session.sandboxId);
-          } catch {
-          }
-          await fleet.teardownSandbox(
-            {
-              sandboxId: session.sandboxId,
-              setSandboxId: async () => {
-              },
-              clear: async () => {
-                await github.sourceControlStorage.sessions.setSandbox({
-                  id: session.id,
-                  sandboxId: null,
-                  sandboxWorkdir: session.sandboxWorkdir ?? ""
-                });
-              }
-            },
-            sandbox
-          );
-        }
-        await github.sourceControlStorage.sessions.delete(session.id);
-        return c.json({ removed: true });
-      }
-    }),
-    // ── Stage all + commit inside a Factory session workspace ──────────────
-    registerApiRoute("/web/github/projects/:id/commit", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { userId, project } = owned;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) {
-          return c.json({ error: "Invalid message" }, 400);
-        }
-        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
-        if (!sessionWorkspace) {
-          return c.json({ error: "Invalid sessionId" }, 400);
-        }
-        const { workdir, sandboxBinding } = sessionWorkspace;
-        try {
-          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-            const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
-            const result = await commitAll(
-              sandbox,
-              workdir,
-              body.message,
-              identityFromUser(await auth.ensureUser(loose(c)))
-            );
-            if (result.committed) {
-              await emitAudit?.({
-                context: loose(c),
-                input: {
-                  action: "factory.git.commit",
-                  factoryProjectId: project.factoryProjectId,
-                  projectRepositoryId: project.id,
-                  targets: [{ type: "session", id: sessionWorkspace.session.sessionId }],
-                  metadata: { sessionId: sessionWorkspace.session.sessionId }
-                }
-              });
-            }
-            return c.json({ committed: result.committed });
-          });
-        } catch (err) {
-          return gitErrorResponse(loose(c), err);
-        }
-      }
-    }),
-    // ── Push a branch back to GitHub ────────────────────────────────────────
-    registerApiRoute("/web/github/projects/:id/push", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { orgId, userId, project } = owned;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (!isValidGitRef(body.branch)) {
-          return c.json({ error: "Invalid branch" }, 400);
-        }
-        const branch = body.branch;
-        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
-        if (!sessionWorkspace) {
-          return c.json({ error: "Invalid sessionId" }, 400);
-        }
-        const { workdir, sandboxBinding } = sessionWorkspace;
-        try {
-          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-            const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
-            const access = await github.versionControl.getRepositoryAccess({
-              orgId,
-              repositoryId: project.repository.id
-            });
-            if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
-            await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
-            await emitAudit?.({
-              context: loose(c),
-              input: {
-                action: "factory.git.push",
-                factoryProjectId: project.factoryProjectId,
-                projectRepositoryId: project.id,
-                targets: [{ type: "branch", id: branch }],
-                metadata: { branch, sessionId: sessionWorkspace.session.sessionId }
-              }
-            });
-            return c.json({ pushed: true, branch });
-          });
-        } catch (err) {
-          return gitErrorResponse(loose(c), err);
-        }
-      }
-    }),
-    // ── Open a pull request through the version-control capability ─────────
-    registerApiRoute("/web/github/projects/:id/pr", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { orgId, userId, project } = owned;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (!isValidGitRef(body.branch)) {
-          return c.json({ error: "Invalid branch" }, 400);
-        }
-        const base = body.base === void 0 ? project.defaultBranch : body.base;
-        if (!isValidGitRef(base)) {
-          return c.json({ error: "Invalid base" }, 400);
-        }
-        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) {
-          return c.json({ error: "Invalid title" }, 400);
-        }
-        if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) {
-          return c.json({ error: "Invalid body" }, 400);
-        }
-        const head = body.branch;
-        const title = body.title;
-        const prBody = body.body;
-        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
-        if (!sessionWorkspace) {
-          return c.json({ error: "Invalid sessionId" }, 400);
-        }
-        try {
-          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-            const result = await github.versionControl.createPullRequest({
-              connection: {
-                type: "app-installation",
-                installationId: Number(project.installation.externalId)
-              },
-              sourceId: project.repository.slug,
-              baseBranch: base,
-              headBranch: head,
-              title,
-              body: prBody,
-              actingUserId: userId
-            });
-            await emitAudit?.({
-              context: loose(c),
-              input: {
-                action: "factory.git.pr_opened",
-                factoryProjectId: project.factoryProjectId,
-                projectRepositoryId: project.id,
-                targets: [{ type: "pull_request", id: result.url, name: title }],
-                metadata: { branch: head, base, url: result.url }
-              }
-            });
-            const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
-            if (pullRequestNumber) {
-              const sessionId = sessionWorkspace.session.sessionId;
-              await subscribeToPullRequest(
-                {
-                  orgId,
-                  installationExternalId: project.installation.externalId,
-                  projectRepositoryId: project.id,
-                  repositoryExternalId: project.repository.externalId,
-                  repositorySlug: project.repository.slug,
-                  changeRequestId: pullRequestNumber.toString(),
-                  sessionId,
-                  ownerId: userId,
-                  resourceId: sessionId,
-                  threadId: sessionId,
-                  source: "factory-pr-create",
-                  subscribedByUserId: userId
-                },
-                github.integrationStorage
-              ).catch((error) => {
-                console.warn(
-                  `[GitHub] Pull request ${result.url} was created but automatic subscription failed.`,
-                  error
-                );
-              });
-            }
-            return c.json({ url: result.url });
-          });
-        } catch (err) {
-          return c.json(
-            { error: "github_pr_create_failed", message: err instanceof Error ? err.message : String(err) },
-            502
-          );
-        }
-      }
-    }),
-    // ── Tear down the caller's sandbox for a project ────────────────────────
-    // Per-user teardown only: drops the caller's `(project, user)` sandbox
-    // binding and stops the VM, freeing a slot in the per-replica budget. Project
-    // deletion at the org level is out of scope (org admin model is later).
-    registerApiRoute("/web/github/projects/:id/sandbox", {
-      method: "DELETE",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { sandboxRow } = owned;
-        if (!sandboxRow.sandboxId) {
-          return c.json({ tornDown: false });
-        }
-        try {
-          return await withSessionOperationLock(`sandbox:${sandboxRow.id}`, async () => {
-            const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId);
-            await teardownProjectSandbox({
-              fleet,
-              row: sandboxRow,
-              storage: github.sourceControlStorage.sandboxes,
-              sandbox
-            });
-            return c.json({ tornDown: true });
-          });
-        } catch (err) {
-          return gitErrorResponse(loose(c), err);
-        }
-      }
-    })
-  ];
-}
+	const { github, auth, fleet, c } = options;
+	const resolved = await resolveOrgTenant(c, auth);
+	if ("response" in resolved) return { response: resolved.response };
+	const { orgId, userId } = resolved.tenant;
+	if (!fleet.enabled) return { response: c.json({
+		error: "sandbox_not_configured",
+		message: "No sandbox provider is configured."
+	}, 503) };
+	const projectRepositoryId = c.req.param("id");
+	if (!projectRepositoryId) return { response: c.json({ error: "Project repository not found" }, 404) };
+	const project = await resolveProjectRepository({
+		github,
+		orgId,
+		projectRepositoryId
+	});
+	if (!project) return { response: c.json({ error: "Project repository not found" }, 404) };
+	return {
+		orgId,
+		userId,
+		project,
+		sandboxRow: await loadOrCreateSandboxRow(github, project, userId)
+	};
+}
+function buildProjectGitRoutes({ github, auth, fleet, emitAudit }) {
+	return [
+		registerApiRoute("/web/github/projects/:id/sessions", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const projectRepositoryId = c.req.param("id");
+				const project = projectRepositoryId ? await resolveProjectRepository({
+					github,
+					orgId,
+					projectRepositoryId
+				}) : null;
+				if (!project) return c.json({ error: "Project repository not found" }, 404);
+				const sessions = await github.sourceControlStorage.sessions.list({
+					projectRepositoryId: project.id,
+					userId
+				});
+				return c.json({ sessions });
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/sessions", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const { orgId, userId } = resolved.tenant;
+				const projectRepositoryId = c.req.param("id");
+				const project = projectRepositoryId ? await resolveProjectRepository({
+					github,
+					orgId,
+					projectRepositoryId
+				}) : null;
+				if (!project) return c.json({ error: "Project repository not found" }, 404);
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef$1(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const baseBranch = body.baseBranch === void 0 ? project.defaultBranch : body.baseBranch;
+				if (!isValidGitRef$1(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
+				const session = await github.sourceControlStorage.sessions.create({
+					sessionId: randomUUID(),
+					projectRepositoryId: project.id,
+					orgId,
+					userId,
+					branch: body.branch,
+					baseBranch
+				});
+				return c.json({ session });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+				if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				return c.json({ session });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), auth);
+				if ("response" in resolved) return resolved.response;
+				const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+				if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
+				let sandbox;
+				if (session.sandboxId) {
+					try {
+						sandbox = await fleet.reattachSandbox(session.sandboxId);
+					} catch {}
+					await fleet.teardownSandbox({
+						sandboxId: session.sandboxId,
+						setSandboxId: async () => {},
+						clear: async () => {
+							await github.sourceControlStorage.sessions.setSandbox({
+								id: session.id,
+								sandboxId: null,
+								sandboxWorkdir: session.sandboxWorkdir ?? ""
+							});
+						}
+					}, sandbox);
+				}
+				await github.sourceControlStorage.sessions.delete(session.id);
+				return c.json({ removed: true });
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/commit", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) return c.json({ error: "Invalid message" }, 400);
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				const { workdir, sandboxBinding } = sessionWorkspace;
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const result = await commitAll(await resolveProjectSandbox({
+							fleet,
+							sandboxRow: sandboxBinding
+						}), workdir, body.message, identityFromUser(await auth.ensureUser(loose(c))));
+						if (result.committed) await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.commit",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "session",
+									id: sessionWorkspace.session.sessionId
+								}],
+								metadata: { sessionId: sessionWorkspace.session.sessionId }
+							}
+						});
+						return c.json({ committed: result.committed });
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/push", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { orgId, userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef$1(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const branch = body.branch;
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				const { workdir, sandboxBinding } = sessionWorkspace;
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const sandbox = await resolveProjectSandbox({
+							fleet,
+							sandboxRow: sandboxBinding
+						});
+						const access = await github.versionControl.getRepositoryAccess({
+							orgId,
+							repositoryId: project.repository.id
+						});
+						if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
+						await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
+						await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.push",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "branch",
+									id: branch
+								}],
+								metadata: {
+									branch,
+									sessionId: sessionWorkspace.session.sessionId
+								}
+							}
+						});
+						return c.json({
+							pushed: true,
+							branch
+						});
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/pr", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { orgId, userId, project } = owned;
+				let body;
+				try {
+					body = await c.req.json();
+				} catch {
+					return c.json({ error: "Invalid JSON body" }, 400);
+				}
+				if (!isValidGitRef$1(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+				const base = body.base === void 0 ? project.defaultBranch : body.base;
+				if (!isValidGitRef$1(base)) return c.json({ error: "Invalid base" }, 400);
+				if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) return c.json({ error: "Invalid title" }, 400);
+				if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) return c.json({ error: "Invalid body" }, 400);
+				const head = body.branch;
+				const title = body.title;
+				const prBody = body.body;
+				const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+				if (!sessionWorkspace) return c.json({ error: "Invalid sessionId" }, 400);
+				try {
+					return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
+						const result = await github.versionControl.createPullRequest({
+							connection: {
+								type: "app-installation",
+								installationId: Number(project.installation.externalId)
+							},
+							sourceId: project.repository.slug,
+							baseBranch: base,
+							headBranch: head,
+							title,
+							body: prBody,
+							actingUserId: userId
+						});
+						await emitAudit?.({
+							context: loose(c),
+							input: {
+								action: "factory.git.pr_opened",
+								factoryProjectId: project.factoryProjectId,
+								projectRepositoryId: project.id,
+								targets: [{
+									type: "pull_request",
+									id: result.url,
+									name: title
+								}],
+								metadata: {
+									branch: head,
+									base,
+									url: result.url
+								}
+							}
+						});
+						const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
+						if (pullRequestNumber) {
+							const sessionId = sessionWorkspace.session.sessionId;
+							await subscribeToPullRequest({
+								orgId,
+								installationExternalId: project.installation.externalId,
+								projectRepositoryId: project.id,
+								repositoryExternalId: project.repository.externalId,
+								repositorySlug: project.repository.slug,
+								changeRequestId: pullRequestNumber.toString(),
+								sessionId,
+								ownerId: userId,
+								resourceId: sessionId,
+								threadId: sessionId,
+								source: "factory-pr-create",
+								subscribedByUserId: userId
+							}, github.integrationStorage).catch((error) => {
+								console.warn(`[GitHub] Pull request ${result.url} was created but automatic subscription failed.`, error);
+							});
+						}
+						return c.json({ url: result.url });
+					});
+				} catch (err) {
+					return c.json({
+						error: "github_pr_create_failed",
+						message: err instanceof Error ? err.message : String(err)
+					}, 502);
+				}
+			}
+		}),
+		registerApiRoute("/web/github/projects/:id/sandbox", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				const owned = await loadOwnedProject({
+					github,
+					auth,
+					fleet,
+					c: loose(c)
+				});
+				if ("response" in owned) return owned.response;
+				const { sandboxRow } = owned;
+				if (!sandboxRow.sandboxId) return c.json({ tornDown: false });
+				try {
+					return await withSessionOperationLock(`sandbox:${sandboxRow.id}`, async () => {
+						const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId);
+						await teardownProjectSandbox({
+							fleet,
+							row: sandboxRow,
+							storage: github.sourceControlStorage.sandboxes,
+							sandbox
+						});
+						return c.json({ tornDown: true });
+					});
+				} catch (err) {
+					return gitErrorResponse(loose(c), err);
+				}
+			}
+		})
+	];
+}
+/** Resolve the materialized workspace owned by a Factory session. */
 async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
-  if (typeof sessionId !== "string") {
-    return void 0;
-  }
-  const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
-  if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) {
-    return void 0;
-  }
-  return {
-    session,
-    workdir: session.sandboxWorkdir,
-    sandboxBinding: {
-      id: session.id,
-      projectRepositoryId: session.projectRepositoryId,
-      userId: session.userId,
-      sandboxId: session.sandboxId,
-      sandboxWorkdir: session.sandboxWorkdir,
-      materializedAt: session.materializedAt,
-      createdAt: session.createdAt
-    }
-  };
-}
-export {
-  buildGithubRoutes
-};
+	if (typeof sessionId !== "string") return;
+	const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+	if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) return;
+	return {
+		session,
+		workdir: session.sandboxWorkdir,
+		sandboxBinding: {
+			id: session.id,
+			projectRepositoryId: session.projectRepositoryId,
+			userId: session.userId,
+			sandboxId: session.sandboxId,
+			sandboxWorkdir: session.sandboxWorkdir,
+			materializedAt: session.materializedAt,
+			createdAt: session.createdAt
+		}
+	};
+}
+//#endregion
+export { buildGithubRoutes };
+
 //# sourceMappingURL=routes.js.map