@mastra/factory 0.24.0-alpha.0 → 0.24.0-alpha.10

package/dist/routes/skills.js

@@ -1,11 +1,9 @@
-import { peekSessionSandbox } from "../sandbox/session-sandbox.js";
 import { Route } from "./route.js";
 import { listFactorySkills } from "../skills/catalog.js";
 import { SkillInvocationError, resolveSkillInvocation } from "../skills/service.js";
 import { registerApiRoute } from "@mastra/core/server";
 //#region src/routes/skills.ts
-const MAX_RESOURCE_ID_LENGTH = 512;
-const MAX_SCOPE_LENGTH = 2048;
+const MAX_SESSION_ID_LENGTH = 512;
 const MAX_ARGUMENTS_LENGTH = 16384;
 const SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -15,22 +13,24 @@ function loose(context) {
 function parseBody(value) {
 	if (!value || typeof value !== "object") return void 0;
 	const input = value;
-	if (typeof input.resourceId !== "string" || input.resourceId.length === 0) return void 0;
-	if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return void 0;
-	if (input.projectRepositoryId !== void 0 && (typeof input.projectRepositoryId !== "string" || !UUID_RE.test(input.projectRepositoryId))) return;
-	if (input.scope !== void 0 && (typeof input.scope !== "string" || input.scope.length > MAX_SCOPE_LENGTH)) return;
+	if (typeof input.sessionId !== "string" || input.sessionId.length === 0) return void 0;
+	if (input.sessionId.length > MAX_SESSION_ID_LENGTH) return void 0;
 	if (typeof input.name !== "string" || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return void 0;
 	if (input.arguments !== void 0) {
 		if (typeof input.arguments !== "string" || input.arguments.length > MAX_ARGUMENTS_LENGTH) return void 0;
 	}
 	return {
-		resourceId: input.resourceId,
-		...input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {},
-		...input.scope ? { scope: input.scope } : {},
+		sessionId: input.sessionId,
 		name: input.name,
 		...input.arguments !== void 0 ? { arguments: input.arguments } : {}
 	};
 }
+const SESSION_FORBIDDEN = {
+	allowed: false,
+	status: 403,
+	code: "session_forbidden",
+	message: "Session access denied."
+};
 var SkillRoutes = class extends Route {
 	async #authorizeSessionAddress(context, address) {
 		const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;
@@ -43,67 +43,25 @@ var SkillRoutes = class extends Route {
 			code: "unauthorized",
 			message: "Authentication required."
 		};
-		if (address.resourceId === tenant.userId) return { allowed: true };
-		if (!UUID_RE.test(address.resourceId) || !address.projectRepositoryId || !UUID_RE.test(address.projectRepositoryId)) return {
+		if (address.sessionId === tenant.userId) return { allowed: true };
+		if (!UUID_RE.test(address.sessionId)) return {
 			allowed: false,
 			status: 400,
 			code: "invalid_request",
 			message: "Invalid skill invocation request."
 		};
-		if (!tenant.orgId || !address.scope) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
-		if (!storage) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
+		if (!tenant.orgId || !storage) return SESSION_FORBIDDEN;
 		if (ensureSourceControlReady) try {
 			await ensureSourceControlReady();
 		} catch {
-			return {
-				allowed: false,
-				status: 403,
-				code: "session_forbidden",
-				message: "Session access denied."
-			};
+			return SESSION_FORBIDDEN;
 		}
-		const projectRepository = await storage.projectRepositories.get({
-			orgId: tenant.orgId,
-			id: address.projectRepositoryId
-		});
-		if (!projectRepository) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
-		const connection = await storage.connections.get({
-			orgId: tenant.orgId,
-			id: projectRepository.connectionId
-		});
-		if (!connection || connection.factoryProjectId !== address.resourceId) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
+		const row = await storage.sessions.getBySessionId(address.sessionId);
+		if (!row || row.orgId !== tenant.orgId || !row.projectRepositoryId) return SESSION_FORBIDDEN;
 		return (await storage.sessions.list({
-			projectRepositoryId: address.projectRepositoryId,
+			projectRepositoryId: row.projectRepositoryId,
 			viewerUserId: tenant.userId
-		})).some((row) => {
-			const liveWorkdir = peekSessionSandbox(row.id)?.workdir;
-			return liveWorkdir !== void 0 && liveWorkdir === address.scope;
-		}) ? { allowed: true } : {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
+		})).some((session) => session.sessionId === address.sessionId) ? { allowed: true } : SESSION_FORBIDDEN;
 	}
 	routes() {
 		const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;
@@ -128,11 +86,7 @@ var SkillRoutes = class extends Route {
 				error: "invalid_request",
 				message: "Invalid skill invocation request."
 			}, 400);
-			const authorization = await authorize(c, {
-				resourceId: body.resourceId,
-				projectRepositoryId: body.projectRepositoryId,
-				scope: body.scope
-			});
+			const authorization = await authorize(c, { sessionId: body.sessionId });
 			if (!authorization.allowed) return c.json({
 				error: authorization.code,
 				message: authorization.message

package/dist/routes/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","names":["#authorizeSessionAddress"],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { peekSessionSandbox } from '../sandbox/session-sandbox.js';\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_RESOURCE_ID_LENGTH = 512;\nconst MAX_SCOPE_LENGTH = 2048;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  resourceId: string;\n  projectRepositoryId?: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.resourceId !== 'string' || input.resourceId.length === 0) return undefined;\n  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return undefined;\n  if (\n    input.projectRepositoryId !== undefined &&\n    (typeof input.projectRepositoryId !== 'string' || !UUID_RE.test(input.projectRepositoryId))\n  ) {\n    return undefined;\n  }\n  if (input.scope !== undefined && (typeof input.scope !== 'string' || input.scope.length > MAX_SCOPE_LENGTH)) {\n    return undefined;\n  }\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    resourceId: input.resourceId,\n    ...(input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions are keyed by the authenticated WorkOS user id. Their\n    // scope is a client-managed local/user-session worktree and needs no app DB.\n    if (address.resourceId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are keyed by factoryProjectId and explicitly identify the\n    // linked repository whose user-owned worktree supplies the session scope.\n    if (\n      !UUID_RE.test(address.resourceId) ||\n      !address.projectRepositoryId ||\n      !UUID_RE.test(address.projectRepositoryId)\n    ) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !address.scope) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (!storage) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n      }\n    }\n    const projectRepository = await storage.projectRepositories.get({\n      orgId: tenant.orgId,\n      id: address.projectRepositoryId,\n    });\n    if (!projectRepository) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });\n    if (!connection || connection.factoryProjectId !== address.resourceId) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    // The scope must be the live workdir of a session the viewer can see under\n    // this repository. The live memoized sandbox entry is the only truth for\n    // workdirs (persisted columns are observability); no running/memoized\n    // sandbox at that path means no grant (fail closed).\n    const sessions = await storage.sessions.list({\n      projectRepositoryId: address.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    const scopeIsLiveSessionWorkdir = sessions.some(row => {\n      const liveWorkdir = peekSessionSandbox(row.id)?.workdir;\n      return liveWorkdir !== undefined && liveWorkdir === address.scope;\n    });\n    return scopeIsLiveSessionWorkdir\n      ? { allowed: true }\n      : { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { resourceId: string; projectRepositoryId?: string; scope?: string }) =>\n        this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, {\n        resourceId: body.resourceId,\n        projectRepositoryId: body.projectRepositoryId,\n        scope: body.scope,\n      });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          const requestContext = c.get('requestContext' as never) as RequestContext | undefined;\n          void resolved.session\n            .sendMessage({ content: resolved.message, ...(requestContext ? { requestContext } : {}) })\n            .catch((error: unknown) => {\n              console.error('Workspace skill dispatch failed after acceptance', error);\n            });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AA4BhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,WAAW,GAAG,OAAO,KAAA;CAClF,IAAI,MAAM,WAAW,SAAS,wBAAwB,OAAO,KAAA;CAC7D,IACE,MAAM,wBAAwB,KAAA,MAC7B,OAAO,MAAM,wBAAwB,YAAY,CAAC,QAAQ,KAAK,MAAM,mBAAmB,IAEzF;CAEF,IAAI,MAAM,UAAU,KAAA,MAAc,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,mBACxF;CAEF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,YAAY,MAAM;EAClB,GAAI,MAAM,sBAAsB,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;EACtF,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAMA,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,eAAe,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAIjE,IACE,CAAC,QAAQ,KAAK,QAAQ,UAAU,KAChC,CAAC,QAAQ,uBACT,CAAC,QAAQ,KAAK,QAAQ,mBAAmB,GAEzC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,OAC5B,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,CAAC,SACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;IAAE,SAAS;IAAO,QAAQ;IAAK,MAAM;IAAqB,SAAS;GAAyB;EACrG;EAEF,MAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;GAC9D,OAAO,OAAO;GACd,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,MAAM,aAAa,MAAM,QAAQ,YAAY,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC5G,IAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,YACzD,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAcrG,QAJkC,MAJX,QAAQ,SAAS,KAAK;GAC3C,qBAAqB,QAAQ;GAC7B,cAAc,OAAO;EACvB,CAAC,EAAA,CAC0C,MAAK,QAAO;GACrD,MAAM,cAAc,mBAAmB,IAAI,EAAE,CAAC,EAAE;GAChD,OAAO,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ;EAC9D,CAC+B,IAC3B,EAAE,SAAS,KAAK,IAChB;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;CAClG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAClB,KAAKA,yBAAyB,SAAS,OAAO;EAClD,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG;IACvC,YAAY,KAAK;IACjB,qBAAqB,KAAK;IAC1B,OAAO,KAAK;GACd,CAAC;GACD,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UAAU;KACZ,MAAM,iBAAiB,EAAE,IAAI,gBAAyB;KACtD,SAAc,QACX,YAAY;MAAE,SAAS,SAAS;MAAS,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAAG,CAAC,CAAC,CACzF,OAAO,UAAmB;MACzB,QAAQ,MAAM,oDAAoD,KAAK;KACzE,CAAC;IACL;IACA,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"skills.js","names":["#authorizeSessionAddress"],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_SESSION_ID_LENGTH = 512;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  sessionId: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSession'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (context: Context, address: { sessionId: string }) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.sessionId !== 'string' || input.sessionId.length === 0) return undefined;\n  if (input.sessionId.length > MAX_SESSION_ID_LENGTH) return undefined;\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    sessionId: input.sessionId,\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nconst SESSION_FORBIDDEN: SessionAuthorizationResult = {\n  allowed: false,\n  status: 403,\n  code: 'session_forbidden',\n  message: 'Session access denied.',\n};\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { sessionId: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions created without a session id are addressed by the\n    // authenticated WorkOS user id and need no app DB.\n    if (address.sessionId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are addressed by their source-control session id.\n    if (!UUID_RE.test(address.sessionId)) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !storage) return SESSION_FORBIDDEN;\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return SESSION_FORBIDDEN;\n      }\n    }\n    const row = await storage.sessions.getBySessionId(address.sessionId);\n    if (!row || row.orgId !== tenant.orgId || !row.projectRepositoryId) return SESSION_FORBIDDEN;\n    // The session must be one the viewer can see under its repository.\n    const visible = await storage.sessions.list({\n      projectRepositoryId: row.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    return visible.some(session => session.sessionId === address.sessionId) ? { allowed: true } : SESSION_FORBIDDEN;\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { sessionId: string }) => this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, { sessionId: body.sessionId });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          const requestContext = c.get('requestContext' as never) as RequestContext | undefined;\n          void resolved.session\n            .sendMessage({ content: resolved.message, ...(requestContext ? { requestContext } : {}) })\n            .catch((error: unknown) => {\n              console.error('Workspace skill dispatch failed after acceptance', error);\n            });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;AAaA,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAuBhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG,OAAO,KAAA;CAChF,IAAI,MAAM,UAAU,SAAS,uBAAuB,OAAO,KAAA;CAC3D,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,WAAW,MAAM;EACjB,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,MAAM,oBAAgD;CACpD,SAAS;CACT,QAAQ;CACR,MAAM;CACN,SAAS;AACX;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAMA,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,cAAc,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAGhE,IAAI,CAAC,QAAQ,KAAK,QAAQ,SAAS,GACjC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,SAAS,OAAO;EACtC,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;EACT;EAEF,MAAM,MAAM,MAAM,QAAQ,SAAS,eAAe,QAAQ,SAAS;EACnE,IAAI,CAAC,OAAO,IAAI,UAAU,OAAO,SAAS,CAAC,IAAI,qBAAqB,OAAO;EAM3E,QAAO,MAJe,QAAQ,SAAS,KAAK;GAC1C,qBAAqB,IAAI;GACzB,cAAc,OAAO;EACvB,CAAC,EAAA,CACc,MAAK,YAAW,QAAQ,cAAc,QAAQ,SAAS,IAAI,EAAE,SAAS,KAAK,IAAI;CAChG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAAmC,KAAKA,yBAAyB,SAAS,OAAO;EACvG,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG,EAAE,WAAW,KAAK,UAAU,CAAC;GACtE,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UAAU;KACZ,MAAM,iBAAiB,EAAE,IAAI,gBAAyB;KACtD,SAAc,QACX,YAAY;MAAE,SAAS,SAAS;MAAS,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAAG,CAAC,CAAC,CACzF,OAAO,UAAmB;MACzB,QAAQ,MAAM,oDAAoD,KAAK;KACzE,CAAC;IACL;IACA,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}

package/dist/routes/source-control-sessions.d.ts

@@ -1,11 +1,13 @@
 import type { MountedMastraCode } from '@mastra/code-sdk';
 import type { ApiRoute, IUserProvider } from '@mastra/core/server';
 import type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';
+import type { FilesystemStorage } from '../storage/domains/filesystem/base.js';
 import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
 import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
 import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
 import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
 import type { RouteAuth } from './route.js';
+export declare const USER_SESSION_BRANCH_PREFIX = "user/session-";
 type SessionOwnerUserProvider = Pick<IUserProvider, 'getUser'> & Partial<Pick<IUserProvider, 'getUsers'>>;
 export interface SourceControlSessionRoutesOptions {
     auth: RouteAuth;
@@ -15,7 +17,13 @@ export interface SourceControlSessionRoutesOptions {
     controller?: MountedMastraCode['controller'];
     memorySettings: Pick<MemorySettingsStorage, 'get'>;
     sessionRetirement?: SessionRetirementCoordinator;
-    workItems?: Pick<WorkItemsStorage, 'clearSessionReferences'>;
+    /** Whether the host sandbox can recreate a session's sandbox (false for local). */
+    sandboxRecreateSupported?: boolean;
+    /** Turn-end file listings, cleared on recreate so the panel stops showing the old sandbox's files. */
+    filesystem?: Pick<FilesystemStorage, 'deleteResourceFiles'>;
+    /** How long recreate waits for an aborted run to settle before destroying. */
+    abortSettleTimeoutMs?: number;
+    workItems?: Pick<WorkItemsStorage, 'clearSessionReferences' | 'hasRunBindingForSession'>;
 }
 export declare function buildSourceControlSessionRoutes(options: SourceControlSessionRoutesOptions): ApiRoute[];
 export {};

package/dist/routes/source-control-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAGrF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAoB5C,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AA0RD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CA6ItG"}
+{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAKrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAY1D,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,sGAAsG;IACtG,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC5D,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;CAC1F;AAqXD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CA0MtG"}

package/dist/routes/source-control-sessions.js

@@ -1,7 +1,9 @@
 import { isValidGitRef } from "../sandbox/git-ref.js";
 import { waitForPendingFilesystemCapture } from "../session/filesystem-capture.js";
+import { listFactorySessionThreads, sessionMemoryResourceId } from "../session/session-threads.js";
 import { normalizeSessionTitle } from "../session/session-title.js";
 import { reclaimDeletedSessionSandbox } from "../integrations/github/sandbox-release.js";
+import { seedSessionOrg } from "../session/org-seed.js";
 import { RequestContext } from "@mastra/core/request-context";
 import { registerApiRoute } from "@mastra/core/server";
 import { UniqueViolationError } from "@mastra/core/storage";
@@ -15,6 +17,48 @@ const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3
 const MAX_SESSION_OWNER_PROFILES = 100;
 const MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES = 500;
 const SESSION_OWNER_PROFILE_TTL_MS = 5 * 6e4;
+const ABORT_SETTLE_TIMEOUT_MS = 5e3;
+const ABORT_SETTLE_POLL_MS = 50;
+/**
+* Who may manage a session's sandbox: its owner, or an org admin. Private
+* sessions stay owner-only and look missing to everyone else, matching the
+* session GET. The admin check is a provider call, so owners skip it.
+*/
+async function sessionManagePermission(c, auth, tenant, session) {
+	if (session.orgId !== tenant.orgId) return "not-found";
+	const isOwner = session.userId === tenant.userId;
+	if (session.visibility === "private" && !isOwner) return "not-found";
+	if (isOwner) return "allowed";
+	return await auth.isOrganizationAdmin(c, session.orgId) ? "allowed" : "forbidden";
+}
+function canRecreateSandbox(options) {
+	return Boolean(options.sessionRetirement) && options.sandboxRecreateSupported === true;
+}
+function withCapabilities(session, recreateSandbox) {
+	return {
+		...session,
+		capabilities: { recreateSandbox }
+	};
+}
+/** Abort the session's active run and wait (bounded) for it to stop. Returns whether a run was aborted. */
+async function abortActiveRun(controller, sessionId, settleTimeoutMs) {
+	if (!controller) return false;
+	try {
+		const live = await controller.getSession(sessionId);
+		if (!live?.stream.isActive()) return false;
+		live.abort();
+		const deadline = Date.now() + settleTimeoutMs;
+		while (live.stream.isActive() && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, ABORT_SETTLE_POLL_MS));
+		if (live.stream.isActive()) console.warn("[Factory Sessions] Aborted run did not settle before sandbox recreate", { sessionId });
+		return true;
+	} catch (error) {
+		console.warn("[Factory Sessions] Failed to abort the active run before sandbox recreate", {
+			sessionId,
+			error
+		});
+		return false;
+	}
+}
 async function resolveOrgTenant(c, auth) {
 	await auth.ensureUser(c);
 	const tenant = auth.tenant(c);
@@ -66,6 +110,33 @@ async function resolveSession(sourceControls, sessionId) {
 	if (matches.length > 1) throw new Error("Factory session exists in multiple source-control providers.");
 	return matches[0] ?? null;
 }
+/**
+* Start the live conversation for a user session on its own thread (thread id === session id), under its owner's
+* resource. Agent-controller
+* routes only act on started sessions, so the first prompt the page sends right after creation always lands on the
+* thread the page reads, with the org and Factory address already in state. Get-or-create, so retried or repeated
+* creates are safe.
+*/
+async function startUserSessionConversation(controller, session) {
+	if (!controller) return;
+	const requestContext = new RequestContext();
+	requestContext.set("user", {
+		workosId: session.userId,
+		organizationId: session.orgId
+	});
+	const live = await controller.createSession({
+		id: session.sessionId,
+		resourceId: session.userId,
+		threadId: session.sessionId,
+		ownerId: session.userId,
+		requestContext
+	});
+	await seedSessionOrg(live, session.orgId);
+	if (session.factoryProjectId) await live.state.set({
+		factoryProjectId: session.factoryProjectId,
+		...session.projectRepositoryId ? { projectRepositoryId: session.projectRepositoryId } : {}
+	});
+}
 function isJsonObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -193,7 +264,8 @@ function projectSessionRoutes(path, options, resolveOwnerProfiles) {
 				const existing = await project.sourceControl.sessions.getBySessionId(sessionId);
 				if (existing) {
 					if (existing.projectRepositoryId !== project.project.id || existing.orgId !== orgId || existing.userId !== userId || existing.branch !== branch) return c.json({ error: "Session ID conflict" }, 409);
-					return c.json({ session: existing });
+					await startUserSessionConversation(options.controller, existing);
+					return c.json({ session: withCapabilities(existing, canRecreateSandbox(options)) });
 				}
 			}
 			const session = await project.sourceControl.sessions.create({
@@ -213,7 +285,8 @@ function projectSessionRoutes(path, options, resolveOwnerProfiles) {
 				return conflict;
 			});
 			if (requestedSessionId && (session.sessionId !== sessionId || session.projectRepositoryId !== project.project.id || session.orgId !== orgId || session.userId !== userId || session.branch !== branch)) return c.json({ error: "Session ID conflict" }, 409);
-			return c.json({ session });
+			await startUserSessionConversation(options.controller, session);
+			return c.json({ session: withCapabilities(session, canRecreateSandbox(options)) });
 		}
 	})];
 }
@@ -254,7 +327,58 @@ function buildSourceControlSessionRoutes(options) {
 				const session = (await resolveSession(options.sourceControls, c.req.param("sessionId")))?.session;
 				if (!session || session.orgId !== resolved.tenant.orgId || session.visibility === "private" && session.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
 				const owners = await resolveOwnerProfiles([session.userId]);
-				return c.json({ session: withOwnerProfile(session, owners) });
+				const recreateSandbox = canRecreateSandbox(options) && await sessionManagePermission(loose(c), options.auth, resolved.tenant, session) === "allowed";
+				const resourceId = await sessionMemoryResourceId(options.controller, session, options.workItems);
+				return c.json({ session: {
+					...withCapabilities(withOwnerProfile(session, owners), recreateSandbox),
+					resourceId
+				} });
+			}
+		}),
+		registerApiRoute("/web/user-sessions/:sessionId/sandbox/recreate", {
+			method: "POST",
+			requiresAuth: false,
+			handler: async (c) => {
+				const resolved = await resolveOrgTenant(loose(c), options.auth);
+				if ("response" in resolved) return resolved.response;
+				const match = await resolveSession(options.sourceControls, c.req.param("sessionId"));
+				const session = match?.session;
+				if (!match || !session) return c.json({ error: "Session not found" }, 404);
+				const permission = await sessionManagePermission(loose(c), options.auth, resolved.tenant, session);
+				if (permission === "not-found") return c.json({ error: "Session not found" }, 404);
+				if (permission === "forbidden") return c.json({ error: "Only the session's owner or an organization admin can recreate its sandbox." }, 403);
+				const sessionRetirement = options.sessionRetirement;
+				if (!sessionRetirement || !canRecreateSandbox(options)) return c.json({ error: "Recreating sandboxes is not available on this server." }, 503);
+				const aborted = await abortActiveRun(options.controller, session.sessionId, options.abortSettleTimeoutMs ?? ABORT_SETTLE_TIMEOUT_MS);
+				await waitForPendingFilesystemCapture(session.sessionId).catch((error) => {
+					console.warn("[Factory Sessions] Failed to drain filesystem capture before sandbox recreate", {
+						sessionId: session.sessionId,
+						error
+					});
+				});
+				try {
+					if (await sessionRetirement.recreateSessionSandbox({
+						sourceControl: match.sourceControl,
+						orgId: session.orgId,
+						sessionId: session.sessionId
+					}) === "not-found") return c.json({ error: "Session not found" }, 404);
+					await options.filesystem?.deleteResourceFiles({ resourceId: session.sessionId }).catch((error) => {
+						console.warn("[Factory Sessions] Failed to clear file listings after sandbox recreate", {
+							sessionId: session.sessionId,
+							error
+						});
+					});
+					return c.json({
+						recreated: true,
+						aborted
+					});
+				} catch (error) {
+					console.error("[Factory Sessions] Failed to recreate session sandbox", {
+						sessionId: session.sessionId,
+						error
+					});
+					return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+				}
 			}
 		}),
 		registerApiRoute("/web/user-sessions/:sessionId", {
@@ -273,7 +397,7 @@ function buildSourceControlSessionRoutes(options) {
 							error
 						});
 					});
-					await options.controller?.deleteSession({ resourceId: session.sessionId });
+					await options.controller?.deleteSession({ sessionId: session.sessionId });
 				} catch (error) {
 					console.error("[Factory Sessions] Failed to tear down live controller session", {
 						sessionId: session.sessionId,
@@ -315,7 +439,7 @@ function buildSourceControlSessionRoutes(options) {
 				const row = match?.session;
 				if (!match || !row || row.orgId !== resolved.tenant.orgId || row.userId !== resolved.tenant.userId) return c.json({ error: "Session not found" }, 404);
 				if (!options.controller) return c.json({ error: "Sessions are not available on this server." }, 503);
-				const thread = (await options.controller.queryThreads({ resourceId: sessionId })).sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0];
+				const thread = (await listFactorySessionThreads(options.controller, row, options.workItems)).sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0];
 				if (!thread) return c.json({ error: "This session has no conversation to name yet." }, 409);
 				const stored = await options.memorySettings.get({
 					orgId: row.orgId,
@@ -330,7 +454,7 @@ function buildSourceControlSessionRoutes(options) {
 					const title = await nameSession(sessionId, async () => {
 						const generated = await options.controller.generateThreadTitle({
 							threadId: thread.id,
-							resourceId: sessionId,
+							sessionId,
 							requestContext,
 							...stored?.observerModelId ? { model: titleModel(stored.observerModelId) } : {}
 						});
@@ -351,6 +475,6 @@ function buildSourceControlSessionRoutes(options) {
 	];
 }
 //#endregion
-export { buildSourceControlSessionRoutes };
+export { USER_SESSION_BRANCH_PREFIX, buildSourceControlSessionRoutes };
 
 //# sourceMappingURL=source-control-sessions.js.map

package/dist/routes/source-control-sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-control-sessions.js","names":[],"sources":["../../src/routes/source-control-sessions.ts"],"sourcesContent":["import type { MountedMastraCode } from '@mastra/code-sdk';\nimport { resolveModel } from '@mastra/code-sdk/agents/model';\nimport { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport { UniqueViolationError } from '@mastra/core/storage';\nimport type { Context } from 'hono';\n\nimport { reclaimDeletedSessionSandbox } from '../integrations/github/sandbox-release.js';\nimport { isValidGitRef } from '../sandbox/git-ref.js';\nimport type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';\nimport { waitForPendingFilesystemCapture } from '../session/filesystem-capture.js';\nimport { normalizeSessionTitle } from '../session/session-title.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type {\n  ProjectRepository,\n  SourceControlSession,\n  SourceControlStorageHandle,\n} from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteAuth } from './route.js';\n\ntype RouteContext = Context;\n\nfunction loose(c: unknown): RouteContext {\n  return c as RouteContext;\n}\n\nconst USER_SESSION_BRANCH_PREFIX = 'user/session-';\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst MAX_SESSION_OWNER_PROFILES = 100;\nconst MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES = 500;\nconst SESSION_OWNER_PROFILE_TTL_MS = 5 * 60_000;\n\ninterface SessionOwnerProfile {\n  id: string;\n  name: string;\n  avatarUrl?: string;\n}\n\ntype SessionOwnerUserProvider = Pick<IUserProvider, 'getUser'> & Partial<Pick<IUserProvider, 'getUsers'>>;\n\nexport interface SourceControlSessionRoutesOptions {\n  auth: RouteAuth;\n  sourceControls: readonly SourceControlStorageHandle[];\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  users?: SessionOwnerUserProvider;\n  controller?: MountedMastraCode['controller'];\n  memorySettings: Pick<MemorySettingsStorage, 'get'>;\n  sessionRetirement?: SessionRetirementCoordinator;\n  workItems?: Pick<WorkItemsStorage, 'clearSessionReferences'>;\n}\n\ninterface ResolvedProjectRepository {\n  sourceControl: SourceControlStorageHandle;\n  project: ProjectRepository;\n  factoryProjectId: string;\n  defaultBranch: string;\n}\n\nasync function resolveOrgTenant(\n  c: RouteContext,\n  auth: RouteAuth,\n): Promise<{ tenant: { orgId: string; userId: string } } | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return { response: c.json({ error: 'unauthorized', reason: 'auth_required' }, 401) };\n  if (!tenant.orgId) {\n    return {\n      response: c.json(\n        {\n          error: 'organization_required',\n          message: 'Source-control sessions require an organization.',\n        },\n        403,\n      ),\n    };\n  }\n  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };\n}\n\nasync function resolveProjectRepository(\n  sourceControls: readonly SourceControlStorageHandle[],\n  orgId: string,\n  projectRepositoryId: string,\n): Promise<ResolvedProjectRepository | null> {\n  const matches = (\n    await Promise.all(\n      sourceControls.map(async sourceControl => {\n        const project = await sourceControl.projectRepositories.get({ orgId, id: projectRepositoryId });\n        if (!project) return null;\n        const repository = await sourceControl.repositories.get({ orgId, id: project.repositoryId });\n        if (!repository) return null;\n        const connection = await sourceControl.connections.get({ orgId, id: project.connectionId });\n        if (!connection) return null;\n        return {\n          sourceControl,\n          project,\n          factoryProjectId: connection.factoryProjectId,\n          defaultBranch: project.branch ?? repository.defaultBranch,\n        };\n      }),\n    )\n  ).filter((match): match is ResolvedProjectRepository => match !== null);\n  if (matches.length > 1) {\n    throw new Error('Factory project repository exists in multiple source-control providers.');\n  }\n  return matches[0] ?? null;\n}\n\nasync function resolveSession(\n  sourceControls: readonly SourceControlStorageHandle[],\n  sessionId: string,\n): Promise<{ sourceControl: SourceControlStorageHandle; session: SourceControlSession } | null> {\n  const matches = (\n    await Promise.all(\n      sourceControls.map(async sourceControl => ({\n        sourceControl,\n        session: await sourceControl.sessions.getBySessionId(sessionId),\n      })),\n    )\n  ).filter(\n    (match): match is { sourceControl: SourceControlStorageHandle; session: SourceControlSession } =>\n      match.session !== null,\n  );\n  if (matches.length > 1) throw new Error('Factory session exists in multiple source-control providers.');\n  return matches[0] ?? null;\n}\n\nfunction isJsonObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction createSessionNaming() {\n  const inFlight = new Map<string, Promise<string | null>>();\n  return (sessionId: string, run: () => Promise<string | null>) => {\n    const pending = inFlight.get(sessionId);\n    if (pending) return pending;\n    const started = run().finally(() => inFlight.delete(sessionId));\n    inFlight.set(sessionId, started);\n    return started;\n  };\n}\n\nfunction titleModel(modelId: string) {\n  return ({ requestContext }: { requestContext: RequestContext }) =>\n    resolveModel(modelId, { remapForCodexOAuth: true, requestContext });\n}\n\nfunction createSessionOwnerProfileResolver(users: SessionOwnerUserProvider | undefined) {\n  const cache = new Map<string, { profile?: SessionOwnerProfile; expiresAt: number }>();\n  const cacheProfile = (userId: string, profile: SessionOwnerProfile | undefined, expiresAt: number) => {\n    cache.delete(userId);\n    cache.set(userId, { profile, expiresAt });\n    if (cache.size > MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES) {\n      const oldestUserId = cache.keys().next().value;\n      if (oldestUserId !== undefined) cache.delete(oldestUserId);\n    }\n  };\n\n  return async (userIds: string[]): Promise<Map<string, SessionOwnerProfile>> => {\n    if (!users) return new Map();\n    const requestedUserIds = [...new Set(userIds)].slice(0, MAX_SESSION_OWNER_PROFILES);\n    const profiles = new Map<string, SessionOwnerProfile>();\n    const unresolvedUserIds: string[] = [];\n    const now = Date.now();\n\n    for (const userId of requestedUserIds) {\n      const cached = cache.get(userId);\n      if (!cached || cached.expiresAt <= now) {\n        cache.delete(userId);\n        unresolvedUserIds.push(userId);\n      } else if (cached.profile) {\n        profiles.set(userId, cached.profile);\n      }\n    }\n    if (unresolvedUserIds.length === 0) return profiles;\n\n    let resolvedUsers: Array<Awaited<ReturnType<SessionOwnerUserProvider['getUser']>>>;\n    if (users.getUsers) {\n      try {\n        resolvedUsers = await users.getUsers(unresolvedUserIds);\n      } catch (error) {\n        console.warn('[Factory Sessions] Bulk owner profile lookup failed; falling back to individual lookups', {\n          error: error instanceof Error ? error.message : String(error),\n        });\n        resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map(userId => users.getUser(userId))))\n          .filter(result => result.status === 'fulfilled')\n          .map(result => result.value);\n      }\n    } else {\n      resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map(userId => users.getUser(userId))))\n        .filter(result => result.status === 'fulfilled')\n        .map(result => result.value);\n    }\n\n    for (const user of resolvedUsers) {\n      if (!user) continue;\n      const name = user.name?.trim() || user.email?.trim();\n      if (!name) continue;\n      profiles.set(user.id, {\n        id: user.id,\n        name,\n        ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),\n      });\n    }\n    const expiresAt = now + SESSION_OWNER_PROFILE_TTL_MS;\n    for (const userId of unresolvedUserIds) cacheProfile(userId, profiles.get(userId), expiresAt);\n    return profiles;\n  };\n}\n\nfunction withOwnerProfile(session: SourceControlSession, owners: Map<string, SessionOwnerProfile>) {\n  const owner = owners.get(session.userId);\n  return owner ? { ...session, owner } : session;\n}\n\nfunction projectSessionRoutes(\n  path: '/web/source-control/projects/:id/sessions' | '/web/github/projects/:id/sessions',\n  options: SourceControlSessionRoutesOptions,\n  resolveOwnerProfiles: ReturnType<typeof createSessionOwnerProfileResolver>,\n): ApiRoute[] {\n  return [\n    registerApiRoute(path, {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n        const projectRepositoryId = c.req.param('id');\n        const project = projectRepositoryId\n          ? await resolveProjectRepository(options.sourceControls, orgId, projectRepositoryId)\n          : null;\n        if (!project) return c.json({ error: 'Project repository not found' }, 404);\n        const sessions = await project.sourceControl.sessions.list({\n          projectRepositoryId: project.project.id,\n          viewerUserId: userId,\n        });\n        const owners = await resolveOwnerProfiles(sessions.map(session => session.userId));\n        return c.json({ sessions: sessions.map(session => withOwnerProfile(session, owners)) });\n      },\n    }),\n    registerApiRoute(path, {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n        const projectRepositoryId = c.req.param('id');\n        const project = projectRepositoryId\n          ? await resolveProjectRepository(options.sourceControls, orgId, projectRepositoryId)\n          : null;\n        if (!project) return c.json({ error: 'Project repository not found' }, 404);\n        let body: unknown;\n        try {\n          body = await c.req.json();\n        } catch {\n          return c.json({ error: 'Invalid JSON body' }, 400);\n        }\n        if (!isJsonObject(body)) return c.json({ error: 'Invalid JSON body' }, 400);\n        if (body.baseBranch !== undefined && typeof body.baseBranch !== 'string') {\n          return c.json({ error: 'Invalid baseBranch' }, 400);\n        }\n        const baseBranch = body.baseBranch ?? project.defaultBranch;\n        if (!isValidGitRef(baseBranch)) return c.json({ error: 'Invalid baseBranch' }, 400);\n        if (\n          body.sessionId !== undefined &&\n          (typeof body.sessionId !== 'string' || !UUID_PATTERN.test(body.sessionId))\n        ) {\n          return c.json({ error: 'Invalid sessionId' }, 400);\n        }\n        const requestedSessionId = body.sessionId as string | undefined;\n        const sessionId = requestedSessionId ?? globalThis.crypto.randomUUID();\n        if (body.title !== undefined && typeof body.title !== 'string') {\n          return c.json({ error: 'Invalid title' }, 400);\n        }\n        const normalizedTitle = body.title === undefined ? null : normalizeSessionTitle(body.title as string);\n        let branch: string;\n        if (body.branch === undefined) branch = `${USER_SESSION_BRANCH_PREFIX}${sessionId}`;\n        else if (isValidGitRef(body.branch)) branch = body.branch;\n        else return c.json({ error: 'Invalid branch' }, 400);\n\n        if (requestedSessionId) {\n          const existing = await project.sourceControl.sessions.getBySessionId(sessionId);\n          if (existing) {\n            if (\n              existing.projectRepositoryId !== project.project.id ||\n              existing.orgId !== orgId ||\n              existing.userId !== userId ||\n              existing.branch !== branch\n            ) {\n              return c.json({ error: 'Session ID conflict' }, 409);\n            }\n            return c.json({ session: existing });\n          }\n        }\n\n        const session = await project.sourceControl.sessions\n          .create({\n            sessionId,\n            projectRepositoryId: project.project.id,\n            factoryProjectId: project.factoryProjectId,\n            orgId,\n            userId,\n            branch,\n            baseBranch,\n            title: normalizedTitle,\n            visibility: 'org',\n          })\n          .catch(async error => {\n            if (!(error instanceof UniqueViolationError) || !requestedSessionId) throw error;\n            const conflict = await project.sourceControl.sessions.getBySessionId(sessionId);\n            if (!conflict) throw error;\n            return conflict;\n          });\n        if (\n          requestedSessionId &&\n          (session.sessionId !== sessionId ||\n            session.projectRepositoryId !== project.project.id ||\n            session.orgId !== orgId ||\n            session.userId !== userId ||\n            session.branch !== branch)\n        ) {\n          return c.json({ error: 'Session ID conflict' }, 409);\n        }\n        return c.json({ session });\n      },\n    }),\n  ];\n}\n\nexport function buildSourceControlSessionRoutes(options: SourceControlSessionRoutesOptions): ApiRoute[] {\n  const nameSession = createSessionNaming();\n  const resolveOwnerProfiles = createSessionOwnerProfileResolver(options.users);\n  return [\n    registerApiRoute('/web/factory/projects/:id/sessions', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n        const factoryProjectId = c.req.param('id');\n        const project = factoryProjectId ? await options.projects.get({ orgId, id: factoryProjectId }) : null;\n        if (!project) return c.json({ error: 'Factory not found' }, 404);\n        // Storage is partitioned per provider; a Factory's sessions can live in any of them.\n        const sessions = (\n          await Promise.all(\n            options.sourceControls.map(sourceControl =>\n              sourceControl.sessions.listByProject({ orgId, factoryProjectId: project.id, viewerUserId: userId }),\n            ),\n          )\n        ).flat();\n        const owners = await resolveOwnerProfiles(sessions.map(session => session.userId));\n        return c.json({ sessions: sessions.map(session => withOwnerProfile(session, owners)) });\n      },\n    }),\n    ...projectSessionRoutes('/web/source-control/projects/:id/sessions', options, resolveOwnerProfiles),\n    // Compatibility for existing clients; new code uses the provider-neutral path.\n    ...projectSessionRoutes('/web/github/projects/:id/sessions', options, resolveOwnerProfiles),\n    registerApiRoute('/web/user-sessions/:sessionId', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const match = await resolveSession(options.sourceControls, c.req.param('sessionId'));\n        const session = match?.session;\n        if (\n          !session ||\n          session.orgId !== resolved.tenant.orgId ||\n          (session.visibility === 'private' && session.userId !== resolved.tenant.userId)\n        ) {\n          return c.json({ error: 'Session not found' }, 404);\n        }\n        const owners = await resolveOwnerProfiles([session.userId]);\n        return c.json({ session: withOwnerProfile(session, owners) });\n      },\n    }),\n    registerApiRoute('/web/user-sessions/:sessionId', {\n      method: 'DELETE',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const match = await resolveSession(options.sourceControls, c.req.param('sessionId'));\n        const session = match?.session;\n        if (\n          !match ||\n          !session ||\n          session.orgId !== resolved.tenant.orgId ||\n          session.userId !== resolved.tenant.userId\n        ) {\n          return c.json({ error: 'Session not found' }, 404);\n        }\n        try {\n          // Drain the turn's queued filesystem capture while the thread and sandbox still exist.\n          // A failed drain only costs the snapshot; it must not block teardown.\n          await waitForPendingFilesystemCapture(session.sessionId).catch(error => {\n            console.warn('[Factory Sessions] Failed to drain filesystem capture before delete', {\n              sessionId: session.sessionId,\n              error,\n            });\n          });\n          await options.controller?.deleteSession({ resourceId: session.sessionId });\n        } catch (error) {\n          console.error('[Factory Sessions] Failed to tear down live controller session', {\n            sessionId: session.sessionId,\n            error,\n          });\n        }\n        if (options.sessionRetirement) {\n          await options.sessionRetirement.retireSession({\n            sourceControl: match.sourceControl,\n            ...(options.workItems ? { workItems: options.workItems } : {}),\n            orgId: session.orgId,\n            sessionId: session.sessionId,\n            deleteSession: true,\n          });\n        } else {\n          await options.workItems?.clearSessionReferences({ orgId: session.orgId, sessionId: session.sessionId });\n          await match.sourceControl.sessions.delete(session.id);\n          void reclaimDeletedSessionSandbox({ session }).catch((error: unknown) => {\n            console.error('[Factory Sessions] Failed to reclaim sandbox for deleted session', {\n              sessionId: session.sessionId,\n              sandboxId: session.sandboxId,\n              error,\n            });\n          });\n        }\n        return c.json({ removed: true });\n      },\n    }),\n    registerApiRoute('/web/user-sessions/:sessionId/title', {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const sessionId = c.req.param('sessionId');\n        const match = await resolveSession(options.sourceControls, sessionId);\n        const row = match?.session;\n        if (!match || !row || row.orgId !== resolved.tenant.orgId || row.userId !== resolved.tenant.userId) {\n          return c.json({ error: 'Session not found' }, 404);\n        }\n        if (!options.controller) return c.json({ error: 'Sessions are not available on this server.' }, 503);\n        const threads = await options.controller.queryThreads({ resourceId: sessionId });\n        const thread = threads.sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0];\n        if (!thread) return c.json({ error: 'This session has no conversation to name yet.' }, 409);\n        const stored = await options.memorySettings.get({ orgId: row.orgId, userId: row.userId });\n        const requestContext = new RequestContext();\n        requestContext.set('user', { workosId: row.userId, organizationId: row.orgId });\n        try {\n          const title = await nameSession(sessionId, async () => {\n            const generated = await options.controller!.generateThreadTitle({\n              threadId: thread.id,\n              resourceId: sessionId,\n              requestContext,\n              ...(stored?.observerModelId ? { model: titleModel(stored.observerModelId) } : {}),\n            });\n            const named = generated ? normalizeSessionTitle(generated) : null;\n            if (named) await match.sourceControl.sessions.rename({ sessionId, title: named });\n            return named;\n          });\n          if (!title) return c.json({ error: 'The model returned an empty title. Try again.' }, 502);\n          return c.json({ title });\n        } catch (error) {\n          return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n        }\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;;;;;;AAyBA,SAAS,MAAM,GAA0B;CACvC,OAAO;AACT;AAEA,MAAM,6BAA6B;AACnC,MAAM,eAAe;AACrB,MAAM,6BAA6B;AACnC,MAAM,0CAA0C;AAChD,MAAM,+BAA+B,IAAI;AA4BzC,eAAe,iBACb,GACA,MACiF;CACjF,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK;EAAE,OAAO;EAAgB,QAAQ;CAAgB,GAAG,GAAG,EAAE;CAChG,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO,EAAE,QAAQ;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;CAAO,EAAE;AAClE;AAEA,eAAe,yBACb,gBACA,OACA,qBAC2C;CAC3C,MAAM,WACJ,MAAM,QAAQ,IACZ,eAAe,IAAI,OAAM,kBAAiB;EACxC,MAAM,UAAU,MAAM,cAAc,oBAAoB,IAAI;GAAE;GAAO,IAAI;EAAoB,CAAC;EAC9F,IAAI,CAAC,SAAS,OAAO;EACrB,MAAM,aAAa,MAAM,cAAc,aAAa,IAAI;GAAE;GAAO,IAAI,QAAQ;EAAa,CAAC;EAC3F,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,aAAa,MAAM,cAAc,YAAY,IAAI;GAAE;GAAO,IAAI,QAAQ;EAAa,CAAC;EAC1F,IAAI,CAAC,YAAY,OAAO;EACxB,OAAO;GACL;GACA;GACA,kBAAkB,WAAW;GAC7B,eAAe,QAAQ,UAAU,WAAW;EAC9C;CACF,CAAC,CACH,EAAA,CACA,QAAQ,UAA8C,UAAU,IAAI;CACtE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,QAAQ,MAAM;AACvB;AAEA,eAAe,eACb,gBACA,WAC8F;CAC9F,MAAM,WACJ,MAAM,QAAQ,IACZ,eAAe,IAAI,OAAM,mBAAkB;EACzC;EACA,SAAS,MAAM,cAAc,SAAS,eAAe,SAAS;CAChE,EAAE,CACJ,EAAA,CACA,QACC,UACC,MAAM,YAAY,IACtB;CACA,IAAI,QAAQ,SAAS,GAAG,MAAM,IAAI,MAAM,8DAA8D;CACtG,OAAO,QAAQ,MAAM;AACvB;AAEA,SAAS,aAAa,OAAkD;CACtE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,sBAAsB;CAC7B,MAAM,2BAAW,IAAI,IAAoC;CACzD,QAAQ,WAAmB,QAAsC;EAC/D,MAAM,UAAU,SAAS,IAAI,SAAS;EACtC,IAAI,SAAS,OAAO;EACpB,MAAM,UAAU,IAAI,CAAC,CAAC,cAAc,SAAS,OAAO,SAAS,CAAC;EAC9D,SAAS,IAAI,WAAW,OAAO;EAC/B,OAAO;CACT;AACF;AAEA,SAAS,WAAW,SAAiB;CACnC,QAAQ,EAAE,qBACR,aAAa,SAAS;EAAE,oBAAoB;EAAM;CAAe,CAAC;AACtE;AAEA,SAAS,kCAAkC,OAA6C;CACtF,MAAM,wBAAQ,IAAI,IAAkE;CACpF,MAAM,gBAAgB,QAAgB,SAA0C,cAAsB;EACpG,MAAM,OAAO,MAAM;EACnB,MAAM,IAAI,QAAQ;GAAE;GAAS;EAAU,CAAC;EACxC,IAAI,MAAM,OAAO,yCAAyC;GACxD,MAAM,eAAe,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GACzC,IAAI,iBAAiB,KAAA,GAAW,MAAM,OAAO,YAAY;EAC3D;CACF;CAEA,OAAO,OAAO,YAAiE;EAC7E,IAAI,CAAC,OAAO,uBAAO,IAAI,IAAI;EAC3B,MAAM,mBAAmB,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,0BAA0B;EAClF,MAAM,2BAAW,IAAI,IAAiC;EACtD,MAAM,oBAA8B,CAAC;EACrC,MAAM,MAAM,KAAK,IAAI;EAErB,KAAK,MAAM,UAAU,kBAAkB;GACrC,MAAM,SAAS,MAAM,IAAI,MAAM;GAC/B,IAAI,CAAC,UAAU,OAAO,aAAa,KAAK;IACtC,MAAM,OAAO,MAAM;IACnB,kBAAkB,KAAK,MAAM;GAC/B,OAAO,IAAI,OAAO,SAChB,SAAS,IAAI,QAAQ,OAAO,OAAO;EAEvC;EACA,IAAI,kBAAkB,WAAW,GAAG,OAAO;EAE3C,IAAI;EACJ,IAAI,MAAM,UACR,IAAI;GACF,gBAAgB,MAAM,MAAM,SAAS,iBAAiB;EACxD,SAAS,OAAO;GACd,QAAQ,KAAK,2FAA2F,EACtG,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACD,iBAAiB,MAAM,QAAQ,WAAW,kBAAkB,KAAI,WAAU,MAAM,QAAQ,MAAM,CAAC,CAAC,EAAA,CAC7F,QAAO,WAAU,OAAO,WAAW,WAAW,CAAC,CAC/C,KAAI,WAAU,OAAO,KAAK;EAC/B;OAEA,iBAAiB,MAAM,QAAQ,WAAW,kBAAkB,KAAI,WAAU,MAAM,QAAQ,MAAM,CAAC,CAAC,EAAA,CAC7F,QAAO,WAAU,OAAO,WAAW,WAAW,CAAC,CAC/C,KAAI,WAAU,OAAO,KAAK;EAG/B,KAAK,MAAM,QAAQ,eAAe;GAChC,IAAI,CAAC,MAAM;GACX,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK;GACnD,IAAI,CAAC,MAAM;GACX,SAAS,IAAI,KAAK,IAAI;IACpB,IAAI,KAAK;IACT;IACA,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GACxD,CAAC;EACH;EACA,MAAM,YAAY,MAAM;EACxB,KAAK,MAAM,UAAU,mBAAmB,aAAa,QAAQ,SAAS,IAAI,MAAM,GAAG,SAAS;EAC5F,OAAO;CACT;AACF;AAEA,SAAS,iBAAiB,SAA+B,QAA0C;CACjG,MAAM,QAAQ,OAAO,IAAI,QAAQ,MAAM;CACvC,OAAO,QAAQ;EAAE,GAAG;EAAS;CAAM,IAAI;AACzC;AAEA,SAAS,qBACP,MACA,SACA,sBACY;CACZ,OAAO,CACL,iBAAiB,MAAM;EACrB,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;GAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GACnC,MAAM,sBAAsB,EAAE,IAAI,MAAM,IAAI;GAC5C,MAAM,UAAU,sBACZ,MAAM,yBAAyB,QAAQ,gBAAgB,OAAO,mBAAmB,IACjF;GACJ,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;GAC1E,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,KAAK;IACzD,qBAAqB,QAAQ,QAAQ;IACrC,cAAc;GAChB,CAAC;GACD,MAAM,SAAS,MAAM,qBAAqB,SAAS,KAAI,YAAW,QAAQ,MAAM,CAAC;GACjF,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,KAAI,YAAW,iBAAiB,SAAS,MAAM,CAAC,EAAE,CAAC;EACxF;CACF,CAAC,GACD,iBAAiB,MAAM;EACrB,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;GAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GACnC,MAAM,sBAAsB,EAAE,IAAI,MAAM,IAAI;GAC5C,MAAM,UAAU,sBACZ,MAAM,yBAAyB,QAAQ,gBAAgB,OAAO,mBAAmB,IACjF;GACJ,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;GAC1E,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,EAAE,IAAI,KAAK;GAC1B,QAAQ;IACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GACnD;GACA,IAAI,CAAC,aAAa,IAAI,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GAC1E,IAAI,KAAK,eAAe,KAAA,KAAa,OAAO,KAAK,eAAe,UAC9D,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAEpD,MAAM,aAAa,KAAK,cAAc,QAAQ;GAC9C,IAAI,CAAC,cAAc,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,IACE,KAAK,cAAc,KAAA,MAClB,OAAO,KAAK,cAAc,YAAY,CAAC,aAAa,KAAK,KAAK,SAAS,IAExE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GAEnD,MAAM,qBAAqB,KAAK;GAChC,MAAM,YAAY,sBAAsB,WAAW,OAAO,WAAW;GACrE,IAAI,KAAK,UAAU,KAAA,KAAa,OAAO,KAAK,UAAU,UACpD,OAAO,EAAE,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;GAE/C,MAAM,kBAAkB,KAAK,UAAU,KAAA,IAAY,OAAO,sBAAsB,KAAK,KAAe;GACpG,IAAI;GACJ,IAAI,KAAK,WAAW,KAAA,GAAW,SAAS,GAAG,6BAA6B;QACnE,IAAI,cAAc,KAAK,MAAM,GAAG,SAAS,KAAK;QAC9C,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAEnD,IAAI,oBAAoB;IACtB,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,eAAe,SAAS;IAC9E,IAAI,UAAU;KACZ,IACE,SAAS,wBAAwB,QAAQ,QAAQ,MACjD,SAAS,UAAU,SACnB,SAAS,WAAW,UACpB,SAAS,WAAW,QAEpB,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAErD,OAAO,EAAE,KAAK,EAAE,SAAS,SAAS,CAAC;IACrC;GACF;GAEA,MAAM,UAAU,MAAM,QAAQ,cAAc,SACzC,OAAO;IACN;IACA,qBAAqB,QAAQ,QAAQ;IACrC,kBAAkB,QAAQ;IAC1B;IACA;IACA;IACA;IACA,OAAO;IACP,YAAY;GACd,CAAC,CAAC,CACD,MAAM,OAAM,UAAS;IACpB,IAAI,EAAE,iBAAiB,yBAAyB,CAAC,oBAAoB,MAAM;IAC3E,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,eAAe,SAAS;IAC9E,IAAI,CAAC,UAAU,MAAM;IACrB,OAAO;GACT,CAAC;GACH,IACE,uBACC,QAAQ,cAAc,aACrB,QAAQ,wBAAwB,QAAQ,QAAQ,MAChD,QAAQ,UAAU,SAClB,QAAQ,WAAW,UACnB,QAAQ,WAAW,SAErB,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GAErD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;EAC3B;CACF,CAAC,CACH;AACF;AAEA,SAAgB,gCAAgC,SAAwD;CACtG,MAAM,cAAc,oBAAoB;CACxC,MAAM,uBAAuB,kCAAkC,QAAQ,KAAK;CAC5E,OAAO;EACL,iBAAiB,sCAAsC;GACrD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;IACnC,MAAM,mBAAmB,EAAE,IAAI,MAAM,IAAI;IACzC,MAAM,UAAU,mBAAmB,MAAM,QAAQ,SAAS,IAAI;KAAE;KAAO,IAAI;IAAiB,CAAC,IAAI;IACjG,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,YACJ,MAAM,QAAQ,IACZ,QAAQ,eAAe,KAAI,kBACzB,cAAc,SAAS,cAAc;KAAE;KAAO,kBAAkB,QAAQ;KAAI,cAAc;IAAO,CAAC,CACpG,CACF,EAAA,CACA,KAAK;IACP,MAAM,SAAS,MAAM,qBAAqB,SAAS,KAAI,YAAW,QAAQ,MAAM,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,KAAI,YAAW,iBAAiB,SAAS,MAAM,CAAC,EAAE,CAAC;GACxF;EACF,CAAC;EACD,GAAG,qBAAqB,6CAA6C,SAAS,oBAAoB;EAElG,GAAG,qBAAqB,qCAAqC,SAAS,oBAAoB;EAC1F,iBAAiB,iCAAiC;GAChD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAE5C,MAAM,WAAU,MADI,eAAe,QAAQ,gBAAgB,EAAE,IAAI,MAAM,WAAW,CAAC,EAAA,EAC5D;IACvB,IACE,CAAC,WACD,QAAQ,UAAU,SAAS,OAAO,SACjC,QAAQ,eAAe,aAAa,QAAQ,WAAW,SAAS,OAAO,QAExE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAEnD,MAAM,SAAS,MAAM,qBAAqB,CAAC,QAAQ,MAAM,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB,SAAS,MAAM,EAAE,CAAC;GAC9D;EACF,CAAC;EACD,iBAAiB,iCAAiC;GAChD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,QAAQ,MAAM,eAAe,QAAQ,gBAAgB,EAAE,IAAI,MAAM,WAAW,CAAC;IACnF,MAAM,UAAU,OAAO;IACvB,IACE,CAAC,SACD,CAAC,WACD,QAAQ,UAAU,SAAS,OAAO,SAClC,QAAQ,WAAW,SAAS,OAAO,QAEnC,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAEnD,IAAI;KAGF,MAAM,gCAAgC,QAAQ,SAAS,CAAC,CAAC,OAAM,UAAS;MACtE,QAAQ,KAAK,uEAAuE;OAClF,WAAW,QAAQ;OACnB;MACF,CAAC;KACH,CAAC;KACD,MAAM,QAAQ,YAAY,cAAc,EAAE,YAAY,QAAQ,UAAU,CAAC;IAC3E,SAAS,OAAO;KACd,QAAQ,MAAM,kEAAkE;MAC9E,WAAW,QAAQ;MACnB;KACF,CAAC;IACH;IACA,IAAI,QAAQ,mBACV,MAAM,QAAQ,kBAAkB,cAAc;KAC5C,eAAe,MAAM;KACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;KAC5D,OAAO,QAAQ;KACf,WAAW,QAAQ;KACnB,eAAe;IACjB,CAAC;SACI;KACL,MAAM,QAAQ,WAAW,uBAAuB;MAAE,OAAO,QAAQ;MAAO,WAAW,QAAQ;KAAU,CAAC;KACtG,MAAM,MAAM,cAAc,SAAS,OAAO,QAAQ,EAAE;KACpD,6BAAkC,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;MACvE,QAAQ,MAAM,oEAAoE;OAChF,WAAW,QAAQ;OACnB,WAAW,QAAQ;OACnB;MACF,CAAC;KACH,CAAC;IACH;IACA,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;GACjC;EACF,CAAC;EACD,iBAAiB,uCAAuC;GACtD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;IACzC,MAAM,QAAQ,MAAM,eAAe,QAAQ,gBAAgB,SAAS;IACpE,MAAM,MAAM,OAAO;IACnB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,UAAU,SAAS,OAAO,SAAS,IAAI,WAAW,SAAS,OAAO,QAC1F,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAEnD,IAAI,CAAC,QAAQ,YAAY,OAAO,EAAE,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;IAEnG,MAAM,UAAS,MADO,QAAQ,WAAW,aAAa,EAAE,YAAY,UAAU,CAAC,EAAA,CACxD,MAAM,GAAG,MAAM,EAAE,UAAU,QAAQ,IAAI,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,gDAAgD,GAAG,GAAG;IAC1F,MAAM,SAAS,MAAM,QAAQ,eAAe,IAAI;KAAE,OAAO,IAAI;KAAO,QAAQ,IAAI;IAAO,CAAC;IACxF,MAAM,iBAAiB,IAAI,eAAe;IAC1C,eAAe,IAAI,QAAQ;KAAE,UAAU,IAAI;KAAQ,gBAAgB,IAAI;IAAM,CAAC;IAC9E,IAAI;KACF,MAAM,QAAQ,MAAM,YAAY,WAAW,YAAY;MACrD,MAAM,YAAY,MAAM,QAAQ,WAAY,oBAAoB;OAC9D,UAAU,OAAO;OACjB,YAAY;OACZ;OACA,GAAI,QAAQ,kBAAkB,EAAE,OAAO,WAAW,OAAO,eAAe,EAAE,IAAI,CAAC;MACjF,CAAC;MACD,MAAM,QAAQ,YAAY,sBAAsB,SAAS,IAAI;MAC7D,IAAI,OAAO,MAAM,MAAM,cAAc,SAAS,OAAO;OAAE;OAAW,OAAO;MAAM,CAAC;MAChF,OAAO;KACT,CAAC;KACD,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,gDAAgD,GAAG,GAAG;KACzF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;IACzB,SAAS,OAAO;KACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;IACtF;GACF;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"source-control-sessions.js","names":[],"sources":["../../src/routes/source-control-sessions.ts"],"sourcesContent":["import type { MountedMastraCode } from '@mastra/code-sdk';\nimport { resolveModel } from '@mastra/code-sdk/agents/model';\nimport { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport { UniqueViolationError } from '@mastra/core/storage';\nimport type { Context } from 'hono';\n\nimport { reclaimDeletedSessionSandbox } from '../integrations/github/sandbox-release.js';\nimport { isValidGitRef } from '../sandbox/git-ref.js';\nimport type { SessionRetirementCoordinator } from '../sandbox/session-retirement.js';\nimport { waitForPendingFilesystemCapture } from '../session/filesystem-capture.js';\nimport { seedSessionOrg } from '../session/org-seed.js';\nimport { sessionMemoryResourceId, listFactorySessionThreads } from '../session/session-threads.js';\nimport { normalizeSessionTitle } from '../session/session-title.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type {\n  ProjectRepository,\n  SourceControlSession,\n  SourceControlStorageHandle,\n} from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteAuth } from './route.js';\n\ntype RouteContext = Context;\n\nfunction loose(c: unknown): RouteContext {\n  return c as RouteContext;\n}\n\nexport const USER_SESSION_BRANCH_PREFIX = 'user/session-';\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst MAX_SESSION_OWNER_PROFILES = 100;\nconst MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES = 500;\nconst SESSION_OWNER_PROFILE_TTL_MS = 5 * 60_000;\n\ninterface SessionOwnerProfile {\n  id: string;\n  name: string;\n  avatarUrl?: string;\n}\n\ntype SessionOwnerUserProvider = Pick<IUserProvider, 'getUser'> & Partial<Pick<IUserProvider, 'getUsers'>>;\n\nexport interface SourceControlSessionRoutesOptions {\n  auth: RouteAuth;\n  sourceControls: readonly SourceControlStorageHandle[];\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  users?: SessionOwnerUserProvider;\n  controller?: MountedMastraCode['controller'];\n  memorySettings: Pick<MemorySettingsStorage, 'get'>;\n  sessionRetirement?: SessionRetirementCoordinator;\n  /** Whether the host sandbox can recreate a session's sandbox (false for local). */\n  sandboxRecreateSupported?: boolean;\n  /** Turn-end file listings, cleared on recreate so the panel stops showing the old sandbox's files. */\n  filesystem?: Pick<FilesystemStorage, 'deleteResourceFiles'>;\n  /** How long recreate waits for an aborted run to settle before destroying. */\n  abortSettleTimeoutMs?: number;\n  workItems?: Pick<WorkItemsStorage, 'clearSessionReferences' | 'hasRunBindingForSession'>;\n}\n\nconst ABORT_SETTLE_TIMEOUT_MS = 5_000;\nconst ABORT_SETTLE_POLL_MS = 50;\n\ntype SessionManagePermission = 'allowed' | 'forbidden' | 'not-found';\n\n/**\n * Who may manage a session's sandbox: its owner, or an org admin. Private\n * sessions stay owner-only and look missing to everyone else, matching the\n * session GET. The admin check is a provider call, so owners skip it.\n */\nasync function sessionManagePermission(\n  c: RouteContext,\n  auth: RouteAuth,\n  tenant: { orgId: string; userId: string },\n  session: SourceControlSession,\n): Promise<SessionManagePermission> {\n  if (session.orgId !== tenant.orgId) return 'not-found';\n  const isOwner = session.userId === tenant.userId;\n  if (session.visibility === 'private' && !isOwner) return 'not-found';\n  if (isOwner) return 'allowed';\n  return (await auth.isOrganizationAdmin(c, session.orgId)) ? 'allowed' : 'forbidden';\n}\n\nfunction canRecreateSandbox(options: SourceControlSessionRoutesOptions): boolean {\n  return Boolean(options.sessionRetirement) && options.sandboxRecreateSupported === true;\n}\n\nfunction withCapabilities<T extends object>(session: T, recreateSandbox: boolean) {\n  return { ...session, capabilities: { recreateSandbox } };\n}\n\n/** Abort the session's active run and wait (bounded) for it to stop. Returns whether a run was aborted. */\nasync function abortActiveRun(\n  controller: MountedMastraCode['controller'] | undefined,\n  sessionId: string,\n  settleTimeoutMs: number,\n): Promise<boolean> {\n  if (!controller) return false;\n  try {\n    const live = await controller.getSession(sessionId);\n    if (!live?.stream.isActive()) return false;\n    live.abort();\n    const deadline = Date.now() + settleTimeoutMs;\n    while (live.stream.isActive() && Date.now() < deadline) {\n      await new Promise(resolve => setTimeout(resolve, ABORT_SETTLE_POLL_MS));\n    }\n    if (live.stream.isActive()) {\n      console.warn('[Factory Sessions] Aborted run did not settle before sandbox recreate', { sessionId });\n    }\n    return true;\n  } catch (error) {\n    console.warn('[Factory Sessions] Failed to abort the active run before sandbox recreate', { sessionId, error });\n    return false;\n  }\n}\n\ninterface ResolvedProjectRepository {\n  sourceControl: SourceControlStorageHandle;\n  project: ProjectRepository;\n  factoryProjectId: string;\n  defaultBranch: string;\n}\n\nasync function resolveOrgTenant(\n  c: RouteContext,\n  auth: RouteAuth,\n): Promise<{ tenant: { orgId: string; userId: string } } | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return { response: c.json({ error: 'unauthorized', reason: 'auth_required' }, 401) };\n  if (!tenant.orgId) {\n    return {\n      response: c.json(\n        {\n          error: 'organization_required',\n          message: 'Source-control sessions require an organization.',\n        },\n        403,\n      ),\n    };\n  }\n  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };\n}\n\nasync function resolveProjectRepository(\n  sourceControls: readonly SourceControlStorageHandle[],\n  orgId: string,\n  projectRepositoryId: string,\n): Promise<ResolvedProjectRepository | null> {\n  const matches = (\n    await Promise.all(\n      sourceControls.map(async sourceControl => {\n        const project = await sourceControl.projectRepositories.get({ orgId, id: projectRepositoryId });\n        if (!project) return null;\n        const repository = await sourceControl.repositories.get({ orgId, id: project.repositoryId });\n        if (!repository) return null;\n        const connection = await sourceControl.connections.get({ orgId, id: project.connectionId });\n        if (!connection) return null;\n        return {\n          sourceControl,\n          project,\n          factoryProjectId: connection.factoryProjectId,\n          defaultBranch: project.branch ?? repository.defaultBranch,\n        };\n      }),\n    )\n  ).filter((match): match is ResolvedProjectRepository => match !== null);\n  if (matches.length > 1) {\n    throw new Error('Factory project repository exists in multiple source-control providers.');\n  }\n  return matches[0] ?? null;\n}\n\nasync function resolveSession(\n  sourceControls: readonly SourceControlStorageHandle[],\n  sessionId: string,\n): Promise<{ sourceControl: SourceControlStorageHandle; session: SourceControlSession } | null> {\n  const matches = (\n    await Promise.all(\n      sourceControls.map(async sourceControl => ({\n        sourceControl,\n        session: await sourceControl.sessions.getBySessionId(sessionId),\n      })),\n    )\n  ).filter(\n    (match): match is { sourceControl: SourceControlStorageHandle; session: SourceControlSession } =>\n      match.session !== null,\n  );\n  if (matches.length > 1) throw new Error('Factory session exists in multiple source-control providers.');\n  return matches[0] ?? null;\n}\n\n/**\n * Start the live conversation for a user session on its own thread (thread id === session id), under its owner's\n * resource. Agent-controller\n * routes only act on started sessions, so the first prompt the page sends right after creation always lands on the\n * thread the page reads, with the org and Factory address already in state. Get-or-create, so retried or repeated\n * creates are safe.\n */\nasync function startUserSessionConversation(\n  controller: SourceControlSessionRoutesOptions['controller'],\n  session: SourceControlSession,\n): Promise<void> {\n  if (!controller) return;\n  const requestContext = new RequestContext();\n  requestContext.set('user', { workosId: session.userId, organizationId: session.orgId });\n  const live = await controller.createSession({\n    id: session.sessionId,\n    resourceId: session.userId,\n    threadId: session.sessionId,\n    ownerId: session.userId,\n    requestContext,\n  });\n  await seedSessionOrg(live, session.orgId);\n  // Server-side gates (the transition tool, factory-phase processor) resolve the session address from state, so\n  // seed it here rather than waiting for the page to connect.\n  if (session.factoryProjectId) {\n    await live.state.set({\n      factoryProjectId: session.factoryProjectId,\n      ...(session.projectRepositoryId ? { projectRepositoryId: session.projectRepositoryId } : {}),\n    });\n  }\n}\n\nfunction isJsonObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction createSessionNaming() {\n  const inFlight = new Map<string, Promise<string | null>>();\n  return (sessionId: string, run: () => Promise<string | null>) => {\n    const pending = inFlight.get(sessionId);\n    if (pending) return pending;\n    const started = run().finally(() => inFlight.delete(sessionId));\n    inFlight.set(sessionId, started);\n    return started;\n  };\n}\n\nfunction titleModel(modelId: string) {\n  return ({ requestContext }: { requestContext: RequestContext }) =>\n    resolveModel(modelId, { remapForCodexOAuth: true, requestContext });\n}\n\nfunction createSessionOwnerProfileResolver(users: SessionOwnerUserProvider | undefined) {\n  const cache = new Map<string, { profile?: SessionOwnerProfile; expiresAt: number }>();\n  const cacheProfile = (userId: string, profile: SessionOwnerProfile | undefined, expiresAt: number) => {\n    cache.delete(userId);\n    cache.set(userId, { profile, expiresAt });\n    if (cache.size > MAX_SESSION_OWNER_PROFILE_CACHE_ENTRIES) {\n      const oldestUserId = cache.keys().next().value;\n      if (oldestUserId !== undefined) cache.delete(oldestUserId);\n    }\n  };\n\n  return async (userIds: string[]): Promise<Map<string, SessionOwnerProfile>> => {\n    if (!users) return new Map();\n    const requestedUserIds = [...new Set(userIds)].slice(0, MAX_SESSION_OWNER_PROFILES);\n    const profiles = new Map<string, SessionOwnerProfile>();\n    const unresolvedUserIds: string[] = [];\n    const now = Date.now();\n\n    for (const userId of requestedUserIds) {\n      const cached = cache.get(userId);\n      if (!cached || cached.expiresAt <= now) {\n        cache.delete(userId);\n        unresolvedUserIds.push(userId);\n      } else if (cached.profile) {\n        profiles.set(userId, cached.profile);\n      }\n    }\n    if (unresolvedUserIds.length === 0) return profiles;\n\n    let resolvedUsers: Array<Awaited<ReturnType<SessionOwnerUserProvider['getUser']>>>;\n    if (users.getUsers) {\n      try {\n        resolvedUsers = await users.getUsers(unresolvedUserIds);\n      } catch (error) {\n        console.warn('[Factory Sessions] Bulk owner profile lookup failed; falling back to individual lookups', {\n          error: error instanceof Error ? error.message : String(error),\n        });\n        resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map(userId => users.getUser(userId))))\n          .filter(result => result.status === 'fulfilled')\n          .map(result => result.value);\n      }\n    } else {\n      resolvedUsers = (await Promise.allSettled(unresolvedUserIds.map(userId => users.getUser(userId))))\n        .filter(result => result.status === 'fulfilled')\n        .map(result => result.value);\n    }\n\n    for (const user of resolvedUsers) {\n      if (!user) continue;\n      const name = user.name?.trim() || user.email?.trim();\n      if (!name) continue;\n      profiles.set(user.id, {\n        id: user.id,\n        name,\n        ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),\n      });\n    }\n    const expiresAt = now + SESSION_OWNER_PROFILE_TTL_MS;\n    for (const userId of unresolvedUserIds) cacheProfile(userId, profiles.get(userId), expiresAt);\n    return profiles;\n  };\n}\n\nfunction withOwnerProfile(session: SourceControlSession, owners: Map<string, SessionOwnerProfile>) {\n  const owner = owners.get(session.userId);\n  return owner ? { ...session, owner } : session;\n}\n\nfunction projectSessionRoutes(\n  path: '/web/source-control/projects/:id/sessions' | '/web/github/projects/:id/sessions',\n  options: SourceControlSessionRoutesOptions,\n  resolveOwnerProfiles: ReturnType<typeof createSessionOwnerProfileResolver>,\n): ApiRoute[] {\n  return [\n    registerApiRoute(path, {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n        const projectRepositoryId = c.req.param('id');\n        const project = projectRepositoryId\n          ? await resolveProjectRepository(options.sourceControls, orgId, projectRepositoryId)\n          : null;\n        if (!project) return c.json({ error: 'Project repository not found' }, 404);\n        const sessions = await project.sourceControl.sessions.list({\n          projectRepositoryId: project.project.id,\n          viewerUserId: userId,\n        });\n        const owners = await resolveOwnerProfiles(sessions.map(session => session.userId));\n        return c.json({ sessions: sessions.map(session => withOwnerProfile(session, owners)) });\n      },\n    }),\n    registerApiRoute(path, {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n        const projectRepositoryId = c.req.param('id');\n        const project = projectRepositoryId\n          ? await resolveProjectRepository(options.sourceControls, orgId, projectRepositoryId)\n          : null;\n        if (!project) return c.json({ error: 'Project repository not found' }, 404);\n        let body: unknown;\n        try {\n          body = await c.req.json();\n        } catch {\n          return c.json({ error: 'Invalid JSON body' }, 400);\n        }\n        if (!isJsonObject(body)) return c.json({ error: 'Invalid JSON body' }, 400);\n        if (body.baseBranch !== undefined && typeof body.baseBranch !== 'string') {\n          return c.json({ error: 'Invalid baseBranch' }, 400);\n        }\n        const baseBranch = body.baseBranch ?? project.defaultBranch;\n        if (!isValidGitRef(baseBranch)) return c.json({ error: 'Invalid baseBranch' }, 400);\n        if (\n          body.sessionId !== undefined &&\n          (typeof body.sessionId !== 'string' || !UUID_PATTERN.test(body.sessionId))\n        ) {\n          return c.json({ error: 'Invalid sessionId' }, 400);\n        }\n        const requestedSessionId = body.sessionId;\n        const sessionId = requestedSessionId ?? globalThis.crypto.randomUUID();\n        if (body.title !== undefined && typeof body.title !== 'string') {\n          return c.json({ error: 'Invalid title' }, 400);\n        }\n        const normalizedTitle = body.title === undefined ? null : normalizeSessionTitle(body.title);\n        let branch: string;\n        if (body.branch === undefined) branch = `${USER_SESSION_BRANCH_PREFIX}${sessionId}`;\n        else if (isValidGitRef(body.branch)) branch = body.branch;\n        else return c.json({ error: 'Invalid branch' }, 400);\n\n        if (requestedSessionId) {\n          const existing = await project.sourceControl.sessions.getBySessionId(sessionId);\n          if (existing) {\n            if (\n              existing.projectRepositoryId !== project.project.id ||\n              existing.orgId !== orgId ||\n              existing.userId !== userId ||\n              existing.branch !== branch\n            ) {\n              return c.json({ error: 'Session ID conflict' }, 409);\n            }\n            await startUserSessionConversation(options.controller, existing);\n            return c.json({ session: withCapabilities(existing, canRecreateSandbox(options)) });\n          }\n        }\n\n        const session = await project.sourceControl.sessions\n          .create({\n            sessionId,\n            projectRepositoryId: project.project.id,\n            factoryProjectId: project.factoryProjectId,\n            orgId,\n            userId,\n            branch,\n            baseBranch,\n            title: normalizedTitle,\n            visibility: 'org',\n          })\n          .catch(async error => {\n            if (!(error instanceof UniqueViolationError) || !requestedSessionId) throw error;\n            const conflict = await project.sourceControl.sessions.getBySessionId(sessionId);\n            if (!conflict) throw error;\n            return conflict;\n          });\n        if (\n          requestedSessionId &&\n          (session.sessionId !== sessionId ||\n            session.projectRepositoryId !== project.project.id ||\n            session.orgId !== orgId ||\n            session.userId !== userId ||\n            session.branch !== branch)\n        ) {\n          return c.json({ error: 'Session ID conflict' }, 409);\n        }\n        await startUserSessionConversation(options.controller, session);\n        // The creator owns the session, so no admin check is needed.\n        return c.json({ session: withCapabilities(session, canRecreateSandbox(options)) });\n      },\n    }),\n  ];\n}\n\nexport function buildSourceControlSessionRoutes(options: SourceControlSessionRoutesOptions): ApiRoute[] {\n  const nameSession = createSessionNaming();\n  const resolveOwnerProfiles = createSessionOwnerProfileResolver(options.users);\n  return [\n    registerApiRoute('/web/factory/projects/:id/sessions', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n        const factoryProjectId = c.req.param('id');\n        const project = factoryProjectId ? await options.projects.get({ orgId, id: factoryProjectId }) : null;\n        if (!project) return c.json({ error: 'Factory not found' }, 404);\n        // Storage is partitioned per provider; a Factory's sessions can live in any of them.\n        const sessions = (\n          await Promise.all(\n            options.sourceControls.map(sourceControl =>\n              sourceControl.sessions.listByProject({ orgId, factoryProjectId: project.id, viewerUserId: userId }),\n            ),\n          )\n        ).flat();\n        const owners = await resolveOwnerProfiles(sessions.map(session => session.userId));\n        return c.json({ sessions: sessions.map(session => withOwnerProfile(session, owners)) });\n      },\n    }),\n    ...projectSessionRoutes('/web/source-control/projects/:id/sessions', options, resolveOwnerProfiles),\n    // Compatibility for existing clients; new code uses the provider-neutral path.\n    ...projectSessionRoutes('/web/github/projects/:id/sessions', options, resolveOwnerProfiles),\n    registerApiRoute('/web/user-sessions/:sessionId', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const match = await resolveSession(options.sourceControls, c.req.param('sessionId'));\n        const session = match?.session;\n        if (\n          !session ||\n          session.orgId !== resolved.tenant.orgId ||\n          (session.visibility === 'private' && session.userId !== resolved.tenant.userId)\n        ) {\n          return c.json({ error: 'Session not found' }, 404);\n        }\n        const owners = await resolveOwnerProfiles([session.userId]);\n        const recreateSandbox =\n          canRecreateSandbox(options) &&\n          (await sessionManagePermission(loose(c), options.auth, resolved.tenant, session)) === 'allowed';\n        // The client opens the session by its id and creates it under this resource.\n        const resourceId = await sessionMemoryResourceId(options.controller, session, options.workItems);\n        return c.json({\n          session: { ...withCapabilities(withOwnerProfile(session, owners), recreateSandbox), resourceId },\n        });\n      },\n    }),\n    registerApiRoute('/web/user-sessions/:sessionId/sandbox/recreate', {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const match = await resolveSession(options.sourceControls, c.req.param('sessionId'));\n        const session = match?.session;\n        if (!match || !session) return c.json({ error: 'Session not found' }, 404);\n        const permission = await sessionManagePermission(loose(c), options.auth, resolved.tenant, session);\n        if (permission === 'not-found') return c.json({ error: 'Session not found' }, 404);\n        if (permission === 'forbidden') {\n          return c.json({ error: \"Only the session's owner or an organization admin can recreate its sandbox.\" }, 403);\n        }\n        const sessionRetirement = options.sessionRetirement;\n        if (!sessionRetirement || !canRecreateSandbox(options)) {\n          return c.json({ error: 'Recreating sandboxes is not available on this server.' }, 503);\n        }\n\n        const aborted = await abortActiveRun(\n          options.controller,\n          session.sessionId,\n          options.abortSettleTimeoutMs ?? ABORT_SETTLE_TIMEOUT_MS,\n        );\n        await waitForPendingFilesystemCapture(session.sessionId).catch(error => {\n          console.warn('[Factory Sessions] Failed to drain filesystem capture before sandbox recreate', {\n            sessionId: session.sessionId,\n            error,\n          });\n        });\n        try {\n          const outcome = await sessionRetirement.recreateSessionSandbox({\n            sourceControl: match.sourceControl,\n            orgId: session.orgId,\n            sessionId: session.sessionId,\n          });\n          if (outcome === 'not-found') return c.json({ error: 'Session not found' }, 404);\n          // The captured listings describe the destroyed sandbox; the next turn re-captures.\n          await options.filesystem?.deleteResourceFiles({ resourceId: session.sessionId }).catch(error => {\n            console.warn('[Factory Sessions] Failed to clear file listings after sandbox recreate', {\n              sessionId: session.sessionId,\n              error,\n            });\n          });\n          return c.json({ recreated: true, aborted });\n        } catch (error) {\n          console.error('[Factory Sessions] Failed to recreate session sandbox', {\n            sessionId: session.sessionId,\n            error,\n          });\n          return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/user-sessions/:sessionId', {\n      method: 'DELETE',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const match = await resolveSession(options.sourceControls, c.req.param('sessionId'));\n        const session = match?.session;\n        if (\n          !match ||\n          !session ||\n          session.orgId !== resolved.tenant.orgId ||\n          session.userId !== resolved.tenant.userId\n        ) {\n          return c.json({ error: 'Session not found' }, 404);\n        }\n        try {\n          // Drain the turn's queued filesystem capture while the thread and sandbox still exist.\n          // A failed drain only costs the snapshot; it must not block teardown.\n          await waitForPendingFilesystemCapture(session.sessionId).catch(error => {\n            console.warn('[Factory Sessions] Failed to drain filesystem capture before delete', {\n              sessionId: session.sessionId,\n              error,\n            });\n          });\n          await options.controller?.deleteSession({ sessionId: session.sessionId });\n        } catch (error) {\n          console.error('[Factory Sessions] Failed to tear down live controller session', {\n            sessionId: session.sessionId,\n            error,\n          });\n        }\n        if (options.sessionRetirement) {\n          await options.sessionRetirement.retireSession({\n            sourceControl: match.sourceControl,\n            ...(options.workItems ? { workItems: options.workItems } : {}),\n            orgId: session.orgId,\n            sessionId: session.sessionId,\n            deleteSession: true,\n          });\n        } else {\n          await options.workItems?.clearSessionReferences({ orgId: session.orgId, sessionId: session.sessionId });\n          await match.sourceControl.sessions.delete(session.id);\n          void reclaimDeletedSessionSandbox({ session }).catch((error: unknown) => {\n            console.error('[Factory Sessions] Failed to reclaim sandbox for deleted session', {\n              sessionId: session.sessionId,\n              sandboxId: session.sandboxId,\n              error,\n            });\n          });\n        }\n        return c.json({ removed: true });\n      },\n    }),\n    registerApiRoute('/web/user-sessions/:sessionId/title', {\n      method: 'POST',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), options.auth);\n        if ('response' in resolved) return resolved.response;\n        const sessionId = c.req.param('sessionId');\n        const match = await resolveSession(options.sourceControls, sessionId);\n        const row = match?.session;\n        if (!match || !row || row.orgId !== resolved.tenant.orgId || row.userId !== resolved.tenant.userId) {\n          return c.json({ error: 'Session not found' }, 404);\n        }\n        if (!options.controller) return c.json({ error: 'Sessions are not available on this server.' }, 503);\n        const threads = await listFactorySessionThreads(options.controller, row, options.workItems);\n        const thread = threads.sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0];\n        if (!thread) return c.json({ error: 'This session has no conversation to name yet.' }, 409);\n        const stored = await options.memorySettings.get({ orgId: row.orgId, userId: row.userId });\n        const requestContext = new RequestContext();\n        requestContext.set('user', { workosId: row.userId, organizationId: row.orgId });\n        try {\n          const title = await nameSession(sessionId, async () => {\n            const generated = await options.controller!.generateThreadTitle({\n              threadId: thread.id,\n              sessionId,\n              requestContext,\n              ...(stored?.observerModelId ? { model: titleModel(stored.observerModelId) } : {}),\n            });\n            const named = generated ? normalizeSessionTitle(generated) : null;\n            if (named) await match.sourceControl.sessions.rename({ sessionId, title: named });\n            return named;\n          });\n          if (!title) return c.json({ error: 'The model returned an empty title. Try again.' }, 502);\n          return c.json({ title });\n        } catch (error) {\n          return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);\n        }\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;;;;;;;;AA4BA,SAAS,MAAM,GAA0B;CACvC,OAAO;AACT;AAEA,MAAa,6BAA6B;AAC1C,MAAM,eAAe;AACrB,MAAM,6BAA6B;AACnC,MAAM,0CAA0C;AAChD,MAAM,+BAA+B,IAAI;AA2BzC,MAAM,0BAA0B;AAChC,MAAM,uBAAuB;;;;;;AAS7B,eAAe,wBACb,GACA,MACA,QACA,SACkC;CAClC,IAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;CAC3C,MAAM,UAAU,QAAQ,WAAW,OAAO;CAC1C,IAAI,QAAQ,eAAe,aAAa,CAAC,SAAS,OAAO;CACzD,IAAI,SAAS,OAAO;CACpB,OAAQ,MAAM,KAAK,oBAAoB,GAAG,QAAQ,KAAK,IAAK,YAAY;AAC1E;AAEA,SAAS,mBAAmB,SAAqD;CAC/E,OAAO,QAAQ,QAAQ,iBAAiB,KAAK,QAAQ,6BAA6B;AACpF;AAEA,SAAS,iBAAmC,SAAY,iBAA0B;CAChF,OAAO;EAAE,GAAG;EAAS,cAAc,EAAE,gBAAgB;CAAE;AACzD;;AAGA,eAAe,eACb,YACA,WACA,iBACkB;CAClB,IAAI,CAAC,YAAY,OAAO;CACxB,IAAI;EACF,MAAM,OAAO,MAAM,WAAW,WAAW,SAAS;EAClD,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,OAAO;EACrC,KAAK,MAAM;EACX,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,IAAI,IAAI,UAC5C,MAAM,IAAI,SAAQ,YAAW,WAAW,SAAS,oBAAoB,CAAC;EAExE,IAAI,KAAK,OAAO,SAAS,GACvB,QAAQ,KAAK,yEAAyE,EAAE,UAAU,CAAC;EAErG,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,KAAK,6EAA6E;GAAE;GAAW;EAAM,CAAC;EAC9G,OAAO;CACT;AACF;AASA,eAAe,iBACb,GACA,MACiF;CACjF,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK;EAAE,OAAO;EAAgB,QAAQ;CAAgB,GAAG,GAAG,EAAE;CAChG,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO,EAAE,QAAQ;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;CAAO,EAAE;AAClE;AAEA,eAAe,yBACb,gBACA,OACA,qBAC2C;CAC3C,MAAM,WACJ,MAAM,QAAQ,IACZ,eAAe,IAAI,OAAM,kBAAiB;EACxC,MAAM,UAAU,MAAM,cAAc,oBAAoB,IAAI;GAAE;GAAO,IAAI;EAAoB,CAAC;EAC9F,IAAI,CAAC,SAAS,OAAO;EACrB,MAAM,aAAa,MAAM,cAAc,aAAa,IAAI;GAAE;GAAO,IAAI,QAAQ;EAAa,CAAC;EAC3F,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,aAAa,MAAM,cAAc,YAAY,IAAI;GAAE;GAAO,IAAI,QAAQ;EAAa,CAAC;EAC1F,IAAI,CAAC,YAAY,OAAO;EACxB,OAAO;GACL;GACA;GACA,kBAAkB,WAAW;GAC7B,eAAe,QAAQ,UAAU,WAAW;EAC9C;CACF,CAAC,CACH,EAAA,CACA,QAAQ,UAA8C,UAAU,IAAI;CACtE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,QAAQ,MAAM;AACvB;AAEA,eAAe,eACb,gBACA,WAC8F;CAC9F,MAAM,WACJ,MAAM,QAAQ,IACZ,eAAe,IAAI,OAAM,mBAAkB;EACzC;EACA,SAAS,MAAM,cAAc,SAAS,eAAe,SAAS;CAChE,EAAE,CACJ,EAAA,CACA,QACC,UACC,MAAM,YAAY,IACtB;CACA,IAAI,QAAQ,SAAS,GAAG,MAAM,IAAI,MAAM,8DAA8D;CACtG,OAAO,QAAQ,MAAM;AACvB;;;;;;;;AASA,eAAe,6BACb,YACA,SACe;CACf,IAAI,CAAC,YAAY;CACjB,MAAM,iBAAiB,IAAI,eAAe;CAC1C,eAAe,IAAI,QAAQ;EAAE,UAAU,QAAQ;EAAQ,gBAAgB,QAAQ;CAAM,CAAC;CACtF,MAAM,OAAO,MAAM,WAAW,cAAc;EAC1C,IAAI,QAAQ;EACZ,YAAY,QAAQ;EACpB,UAAU,QAAQ;EAClB,SAAS,QAAQ;EACjB;CACF,CAAC;CACD,MAAM,eAAe,MAAM,QAAQ,KAAK;CAGxC,IAAI,QAAQ,kBACV,MAAM,KAAK,MAAM,IAAI;EACnB,kBAAkB,QAAQ;EAC1B,GAAI,QAAQ,sBAAsB,EAAE,qBAAqB,QAAQ,oBAAoB,IAAI,CAAC;CAC5F,CAAC;AAEL;AAEA,SAAS,aAAa,OAAkD;CACtE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,sBAAsB;CAC7B,MAAM,2BAAW,IAAI,IAAoC;CACzD,QAAQ,WAAmB,QAAsC;EAC/D,MAAM,UAAU,SAAS,IAAI,SAAS;EACtC,IAAI,SAAS,OAAO;EACpB,MAAM,UAAU,IAAI,CAAC,CAAC,cAAc,SAAS,OAAO,SAAS,CAAC;EAC9D,SAAS,IAAI,WAAW,OAAO;EAC/B,OAAO;CACT;AACF;AAEA,SAAS,WAAW,SAAiB;CACnC,QAAQ,EAAE,qBACR,aAAa,SAAS;EAAE,oBAAoB;EAAM;CAAe,CAAC;AACtE;AAEA,SAAS,kCAAkC,OAA6C;CACtF,MAAM,wBAAQ,IAAI,IAAkE;CACpF,MAAM,gBAAgB,QAAgB,SAA0C,cAAsB;EACpG,MAAM,OAAO,MAAM;EACnB,MAAM,IAAI,QAAQ;GAAE;GAAS;EAAU,CAAC;EACxC,IAAI,MAAM,OAAO,yCAAyC;GACxD,MAAM,eAAe,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GACzC,IAAI,iBAAiB,KAAA,GAAW,MAAM,OAAO,YAAY;EAC3D;CACF;CAEA,OAAO,OAAO,YAAiE;EAC7E,IAAI,CAAC,OAAO,uBAAO,IAAI,IAAI;EAC3B,MAAM,mBAAmB,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,0BAA0B;EAClF,MAAM,2BAAW,IAAI,IAAiC;EACtD,MAAM,oBAA8B,CAAC;EACrC,MAAM,MAAM,KAAK,IAAI;EAErB,KAAK,MAAM,UAAU,kBAAkB;GACrC,MAAM,SAAS,MAAM,IAAI,MAAM;GAC/B,IAAI,CAAC,UAAU,OAAO,aAAa,KAAK;IACtC,MAAM,OAAO,MAAM;IACnB,kBAAkB,KAAK,MAAM;GAC/B,OAAO,IAAI,OAAO,SAChB,SAAS,IAAI,QAAQ,OAAO,OAAO;EAEvC;EACA,IAAI,kBAAkB,WAAW,GAAG,OAAO;EAE3C,IAAI;EACJ,IAAI,MAAM,UACR,IAAI;GACF,gBAAgB,MAAM,MAAM,SAAS,iBAAiB;EACxD,SAAS,OAAO;GACd,QAAQ,KAAK,2FAA2F,EACtG,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACD,iBAAiB,MAAM,QAAQ,WAAW,kBAAkB,KAAI,WAAU,MAAM,QAAQ,MAAM,CAAC,CAAC,EAAA,CAC7F,QAAO,WAAU,OAAO,WAAW,WAAW,CAAC,CAC/C,KAAI,WAAU,OAAO,KAAK;EAC/B;OAEA,iBAAiB,MAAM,QAAQ,WAAW,kBAAkB,KAAI,WAAU,MAAM,QAAQ,MAAM,CAAC,CAAC,EAAA,CAC7F,QAAO,WAAU,OAAO,WAAW,WAAW,CAAC,CAC/C,KAAI,WAAU,OAAO,KAAK;EAG/B,KAAK,MAAM,QAAQ,eAAe;GAChC,IAAI,CAAC,MAAM;GACX,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK;GACnD,IAAI,CAAC,MAAM;GACX,SAAS,IAAI,KAAK,IAAI;IACpB,IAAI,KAAK;IACT;IACA,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;GACxD,CAAC;EACH;EACA,MAAM,YAAY,MAAM;EACxB,KAAK,MAAM,UAAU,mBAAmB,aAAa,QAAQ,SAAS,IAAI,MAAM,GAAG,SAAS;EAC5F,OAAO;CACT;AACF;AAEA,SAAS,iBAAiB,SAA+B,QAA0C;CACjG,MAAM,QAAQ,OAAO,IAAI,QAAQ,MAAM;CACvC,OAAO,QAAQ;EAAE,GAAG;EAAS;CAAM,IAAI;AACzC;AAEA,SAAS,qBACP,MACA,SACA,sBACY;CACZ,OAAO,CACL,iBAAiB,MAAM;EACrB,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;GAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GACnC,MAAM,sBAAsB,EAAE,IAAI,MAAM,IAAI;GAC5C,MAAM,UAAU,sBACZ,MAAM,yBAAyB,QAAQ,gBAAgB,OAAO,mBAAmB,IACjF;GACJ,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;GAC1E,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,KAAK;IACzD,qBAAqB,QAAQ,QAAQ;IACrC,cAAc;GAChB,CAAC;GACD,MAAM,SAAS,MAAM,qBAAqB,SAAS,KAAI,YAAW,QAAQ,MAAM,CAAC;GACjF,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,KAAI,YAAW,iBAAiB,SAAS,MAAM,CAAC,EAAE,CAAC;EACxF;CACF,CAAC,GACD,iBAAiB,MAAM;EACrB,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;GAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GACnC,MAAM,sBAAsB,EAAE,IAAI,MAAM,IAAI;GAC5C,MAAM,UAAU,sBACZ,MAAM,yBAAyB,QAAQ,gBAAgB,OAAO,mBAAmB,IACjF;GACJ,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;GAC1E,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,EAAE,IAAI,KAAK;GAC1B,QAAQ;IACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GACnD;GACA,IAAI,CAAC,aAAa,IAAI,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GAC1E,IAAI,KAAK,eAAe,KAAA,KAAa,OAAO,KAAK,eAAe,UAC9D,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAEpD,MAAM,aAAa,KAAK,cAAc,QAAQ;GAC9C,IAAI,CAAC,cAAc,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAClF,IACE,KAAK,cAAc,KAAA,MAClB,OAAO,KAAK,cAAc,YAAY,CAAC,aAAa,KAAK,KAAK,SAAS,IAExE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;GAEnD,MAAM,qBAAqB,KAAK;GAChC,MAAM,YAAY,sBAAsB,WAAW,OAAO,WAAW;GACrE,IAAI,KAAK,UAAU,KAAA,KAAa,OAAO,KAAK,UAAU,UACpD,OAAO,EAAE,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;GAE/C,MAAM,kBAAkB,KAAK,UAAU,KAAA,IAAY,OAAO,sBAAsB,KAAK,KAAK;GAC1F,IAAI;GACJ,IAAI,KAAK,WAAW,KAAA,GAAW,SAAS,GAAG,6BAA6B;QACnE,IAAI,cAAc,KAAK,MAAM,GAAG,SAAS,KAAK;QAC9C,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAEnD,IAAI,oBAAoB;IACtB,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,eAAe,SAAS;IAC9E,IAAI,UAAU;KACZ,IACE,SAAS,wBAAwB,QAAQ,QAAQ,MACjD,SAAS,UAAU,SACnB,SAAS,WAAW,UACpB,SAAS,WAAW,QAEpB,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAErD,MAAM,6BAA6B,QAAQ,YAAY,QAAQ;KAC/D,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB,UAAU,mBAAmB,OAAO,CAAC,EAAE,CAAC;IACpF;GACF;GAEA,MAAM,UAAU,MAAM,QAAQ,cAAc,SACzC,OAAO;IACN;IACA,qBAAqB,QAAQ,QAAQ;IACrC,kBAAkB,QAAQ;IAC1B;IACA;IACA;IACA;IACA,OAAO;IACP,YAAY;GACd,CAAC,CAAC,CACD,MAAM,OAAM,UAAS;IACpB,IAAI,EAAE,iBAAiB,yBAAyB,CAAC,oBAAoB,MAAM;IAC3E,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,eAAe,SAAS;IAC9E,IAAI,CAAC,UAAU,MAAM;IACrB,OAAO;GACT,CAAC;GACH,IACE,uBACC,QAAQ,cAAc,aACrB,QAAQ,wBAAwB,QAAQ,QAAQ,MAChD,QAAQ,UAAU,SAClB,QAAQ,WAAW,UACnB,QAAQ,WAAW,SAErB,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;GAErD,MAAM,6BAA6B,QAAQ,YAAY,OAAO;GAE9D,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB,SAAS,mBAAmB,OAAO,CAAC,EAAE,CAAC;EACnF;CACF,CAAC,CACH;AACF;AAEA,SAAgB,gCAAgC,SAAwD;CACtG,MAAM,cAAc,oBAAoB;CACxC,MAAM,uBAAuB,kCAAkC,QAAQ,KAAK;CAC5E,OAAO;EACL,iBAAiB,sCAAsC;GACrD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;IACnC,MAAM,mBAAmB,EAAE,IAAI,MAAM,IAAI;IACzC,MAAM,UAAU,mBAAmB,MAAM,QAAQ,SAAS,IAAI;KAAE;KAAO,IAAI;IAAiB,CAAC,IAAI;IACjG,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,YACJ,MAAM,QAAQ,IACZ,QAAQ,eAAe,KAAI,kBACzB,cAAc,SAAS,cAAc;KAAE;KAAO,kBAAkB,QAAQ;KAAI,cAAc;IAAO,CAAC,CACpG,CACF,EAAA,CACA,KAAK;IACP,MAAM,SAAS,MAAM,qBAAqB,SAAS,KAAI,YAAW,QAAQ,MAAM,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,UAAU,SAAS,KAAI,YAAW,iBAAiB,SAAS,MAAM,CAAC,EAAE,CAAC;GACxF;EACF,CAAC;EACD,GAAG,qBAAqB,6CAA6C,SAAS,oBAAoB;EAElG,GAAG,qBAAqB,qCAAqC,SAAS,oBAAoB;EAC1F,iBAAiB,iCAAiC;GAChD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAE5C,MAAM,WAAU,MADI,eAAe,QAAQ,gBAAgB,EAAE,IAAI,MAAM,WAAW,CAAC,EAAA,EAC5D;IACvB,IACE,CAAC,WACD,QAAQ,UAAU,SAAS,OAAO,SACjC,QAAQ,eAAe,aAAa,QAAQ,WAAW,SAAS,OAAO,QAExE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAEnD,MAAM,SAAS,MAAM,qBAAqB,CAAC,QAAQ,MAAM,CAAC;IAC1D,MAAM,kBACJ,mBAAmB,OAAO,KACzB,MAAM,wBAAwB,MAAM,CAAC,GAAG,QAAQ,MAAM,SAAS,QAAQ,OAAO,MAAO;IAExF,MAAM,aAAa,MAAM,wBAAwB,QAAQ,YAAY,SAAS,QAAQ,SAAS;IAC/F,OAAO,EAAE,KAAK,EACZ,SAAS;KAAE,GAAG,iBAAiB,iBAAiB,SAAS,MAAM,GAAG,eAAe;KAAG;IAAW,EACjG,CAAC;GACH;EACF,CAAC;EACD,iBAAiB,kDAAkD;GACjE,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,QAAQ,MAAM,eAAe,QAAQ,gBAAgB,EAAE,IAAI,MAAM,WAAW,CAAC;IACnF,MAAM,UAAU,OAAO;IACvB,IAAI,CAAC,SAAS,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IACzE,MAAM,aAAa,MAAM,wBAAwB,MAAM,CAAC,GAAG,QAAQ,MAAM,SAAS,QAAQ,OAAO;IACjG,IAAI,eAAe,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IACjF,IAAI,eAAe,aACjB,OAAO,EAAE,KAAK,EAAE,OAAO,8EAA8E,GAAG,GAAG;IAE7G,MAAM,oBAAoB,QAAQ;IAClC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,OAAO,GACnD,OAAO,EAAE,KAAK,EAAE,OAAO,wDAAwD,GAAG,GAAG;IAGvF,MAAM,UAAU,MAAM,eACpB,QAAQ,YACR,QAAQ,WACR,QAAQ,wBAAwB,uBAClC;IACA,MAAM,gCAAgC,QAAQ,SAAS,CAAC,CAAC,OAAM,UAAS;KACtE,QAAQ,KAAK,iFAAiF;MAC5F,WAAW,QAAQ;MACnB;KACF,CAAC;IACH,CAAC;IACD,IAAI;KAMF,IAAI,MALkB,kBAAkB,uBAAuB;MAC7D,eAAe,MAAM;MACrB,OAAO,QAAQ;MACf,WAAW,QAAQ;KACrB,CAAC,MACe,aAAa,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAE9E,MAAM,QAAQ,YAAY,oBAAoB,EAAE,YAAY,QAAQ,UAAU,CAAC,CAAC,CAAC,OAAM,UAAS;MAC9F,QAAQ,KAAK,2EAA2E;OACtF,WAAW,QAAQ;OACnB;MACF,CAAC;KACH,CAAC;KACD,OAAO,EAAE,KAAK;MAAE,WAAW;MAAM;KAAQ,CAAC;IAC5C,SAAS,OAAO;KACd,QAAQ,MAAM,yDAAyD;MACrE,WAAW,QAAQ;MACnB;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;IACtF;GACF;EACF,CAAC;EACD,iBAAiB,iCAAiC;GAChD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,QAAQ,MAAM,eAAe,QAAQ,gBAAgB,EAAE,IAAI,MAAM,WAAW,CAAC;IACnF,MAAM,UAAU,OAAO;IACvB,IACE,CAAC,SACD,CAAC,WACD,QAAQ,UAAU,SAAS,OAAO,SAClC,QAAQ,WAAW,SAAS,OAAO,QAEnC,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAEnD,IAAI;KAGF,MAAM,gCAAgC,QAAQ,SAAS,CAAC,CAAC,OAAM,UAAS;MACtE,QAAQ,KAAK,uEAAuE;OAClF,WAAW,QAAQ;OACnB;MACF,CAAC;KACH,CAAC;KACD,MAAM,QAAQ,YAAY,cAAc,EAAE,WAAW,QAAQ,UAAU,CAAC;IAC1E,SAAS,OAAO;KACd,QAAQ,MAAM,kEAAkE;MAC9E,WAAW,QAAQ;MACnB;KACF,CAAC;IACH;IACA,IAAI,QAAQ,mBACV,MAAM,QAAQ,kBAAkB,cAAc;KAC5C,eAAe,MAAM;KACrB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;KAC5D,OAAO,QAAQ;KACf,WAAW,QAAQ;KACnB,eAAe;IACjB,CAAC;SACI;KACL,MAAM,QAAQ,WAAW,uBAAuB;MAAE,OAAO,QAAQ;MAAO,WAAW,QAAQ;KAAU,CAAC;KACtG,MAAM,MAAM,cAAc,SAAS,OAAO,QAAQ,EAAE;KACpD,6BAAkC,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;MACvE,QAAQ,MAAM,oEAAoE;OAChF,WAAW,QAAQ;OACnB,WAAW,QAAQ;OACnB;MACF,CAAC;KACH,CAAC;IACH;IACA,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;GACjC;EACF,CAAC;EACD,iBAAiB,uCAAuC;GACtD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,QAAQ,IAAI;IAC9D,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,WAAW;IACzC,MAAM,QAAQ,MAAM,eAAe,QAAQ,gBAAgB,SAAS;IACpE,MAAM,MAAM,OAAO;IACnB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,UAAU,SAAS,OAAO,SAAS,IAAI,WAAW,SAAS,OAAO,QAC1F,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAEnD,IAAI,CAAC,QAAQ,YAAY,OAAO,EAAE,KAAK,EAAE,OAAO,6CAA6C,GAAG,GAAG;IAEnG,MAAM,UAAS,MADO,0BAA0B,QAAQ,YAAY,KAAK,QAAQ,SAAS,EAAA,CACnE,MAAM,GAAG,MAAM,EAAE,UAAU,QAAQ,IAAI,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,gDAAgD,GAAG,GAAG;IAC1F,MAAM,SAAS,MAAM,QAAQ,eAAe,IAAI;KAAE,OAAO,IAAI;KAAO,QAAQ,IAAI;IAAO,CAAC;IACxF,MAAM,iBAAiB,IAAI,eAAe;IAC1C,eAAe,IAAI,QAAQ;KAAE,UAAU,IAAI;KAAQ,gBAAgB,IAAI;IAAM,CAAC;IAC9E,IAAI;KACF,MAAM,QAAQ,MAAM,YAAY,WAAW,YAAY;MACrD,MAAM,YAAY,MAAM,QAAQ,WAAY,oBAAoB;OAC9D,UAAU,OAAO;OACjB;OACA;OACA,GAAI,QAAQ,kBAAkB,EAAE,OAAO,WAAW,OAAO,eAAe,EAAE,IAAI,CAAC;MACjF,CAAC;MACD,MAAM,QAAQ,YAAY,sBAAsB,SAAS,IAAI;MAC7D,IAAI,OAAO,MAAM,MAAM,cAAc,SAAS,OAAO;OAAE;OAAW,OAAO;MAAM,CAAC;MAChF,OAAO;KACT,CAAC;KACD,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,gDAAgD,GAAG,GAAG;KACzF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;IACzB,SAAS,OAAO;KACd,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG,GAAG;IACtF;GACF;EACF,CAAC;CACH;AACF"}