@mastra/factory 0.24.0-alpha.1 → 0.24.0-alpha.3

package/dist/integrations/subscription-session.js

@@ -53,6 +53,30 @@ async function prepareSessionRunContext(requestContext, sessionId, sourceControl
 	await primeTenantCredentialsForRequestContext(requestContext);
 	return "prepared";
 }
+/**
+* Create the controller session for a Factory session that isn't live, as its
+* row's owner in the row's organization. Used when an event or message has to
+* reach a session nobody has open: there is no signed-in user, so the session
+* runs as the person it belongs to.
+*/
+async function createSessionAsRowOwner(controller, args) {
+	const requestContext = new RequestContext();
+	requestContext.set("user", {
+		workosId: args.row.userId,
+		organizationId: args.row.orgId
+	});
+	const session = await controller.createSession({
+		id: args.sessionId,
+		ownerId: args.row.userId,
+		resourceId: args.ownerResourceId,
+		scope: args.scope,
+		tags: args.tags,
+		...args.threadId ? { threadId: args.threadId } : {},
+		requestContext
+	});
+	await seedSessionOrg(session, args.row.orgId);
+	return session;
+}
 async function resolveSubscriptionSession(controller, subscription, options) {
 	const { label } = options;
 	const { sessionId, resourceId, threadId } = subscription;
@@ -69,20 +93,13 @@ async function resolveSubscriptionSession(controller, subscription, options) {
 		};
 		const sessionRow = await options.sourceControl?.sessions.getBySessionId(sessionId);
 		if (!sessionRow) throw new Error(`${label} subscription ${subscription.id} has no Factory session ${sessionId} to run as.`);
-		const requestContext = new RequestContext();
-		requestContext.set("user", {
-			workosId: sessionRow.userId,
-			organizationId: sessionRow.orgId
-		});
-		session = await controller.createSession({
-			id: sessionId,
-			ownerId: sessionRow.userId,
-			resourceId: ownerResourceId,
+		session = await createSessionAsRowOwner(controller, {
+			sessionId,
+			ownerResourceId,
+			row: sessionRow,
 			scope,
-			tags,
-			requestContext
+			tags
 		});
-		await seedSessionOrg(session, sessionRow.orgId);
 	} else if (!hasResolvedOrg(session.state?.get()?.factoryOrgId)) try {
 		const sessionRow = await options.sourceControl?.sessions.getBySessionId(sessionId);
 		await seedSessionOrg(session, sessionRow?.orgId);
@@ -99,6 +116,6 @@ async function resolveSubscriptionSession(controller, subscription, options) {
 	return session;
 }
 //#endregion
-export { prepareSessionRunContext, resolveSubscriptionSession, subscriptionRunContext };
+export { createSessionAsRowOwner, prepareSessionRunContext, resolveSubscriptionSession, subscriptionRunContext };
 
 //# sourceMappingURL=subscription-session.js.map

package/dist/integrations/subscription-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-session.js","names":[],"sources":["../../src/integrations/subscription-session.ts"],"sourcesContent":["import type { MountedMastraCode } from '@mastra/code-sdk';\nimport { RequestContext } from '@mastra/core/request-context';\n\nimport { primeTenantCredentialsForRequestContext } from '../routes/tenant-credentials.js';\nimport { hasResolvedOrg, seedSessionOrg } from '../session/org-seed.js';\nimport type { IntegrationSubscription } from '../storage/domains/integrations/base.js';\n\n/** The Factory session row fields a woken session has to run as. */\nexport type FactorySessionOwner = { userId: string; orgId: string };\n\nexport interface SubscriptionSessionLookup {\n  sessions: { getBySessionId(sessionId: string): Promise<FactorySessionOwner | null> };\n}\n\n/**\n * Bring the session that owns a subscribed thread online so a provider event\n * can be delivered to it. Provider-neutral: GitHub and GitLab subscriptions\n * carry the same session binding and differ only in their target data.\n */\nexport type SubscriptionSessionRow = IntegrationSubscription<{\n  projectRepositoryId: string;\n  subscribedByUserId?: string | null;\n}>;\n\n/**\n * The request context a provider-triggered run executes under: the user who\n * subscribed the thread, in the subscription's organization. A webhook carries\n * no signed-in user and tenant credential resolution fails closed without one,\n * so a woken run would otherwise stop before it could persist or answer the\n * notification. The subscription row already names that user, so delivery\n * costs no extra read; an older row without one falls back to the Factory\n * session's owner, the identity used when a session is recreated for delivery.\n */\nexport async function subscriptionRunContext(\n  subscription: SubscriptionSessionRow,\n  sourceControl: SubscriptionSessionLookup | undefined,\n): Promise<RequestContext | undefined> {\n  let userId = subscription.data.subscribedByUserId ?? undefined;\n  let orgId: string | undefined = subscription.orgId;\n  if (!userId && subscription.sessionId && sourceControl) {\n    const sessionRow = await sourceControl.sessions.getBySessionId(subscription.sessionId);\n    userId = sessionRow?.userId;\n    orgId = sessionRow?.orgId ?? orgId;\n  }\n  if (!userId || !hasResolvedOrg(orgId)) return undefined;\n  const requestContext = new RequestContext();\n  requestContext.set('user', { workosId: userId, organizationId: orgId });\n  // The web auth middleware primes credential snapshots per request; a\n  // webhook-triggered run has no request, so prime here or the model resolves\n  // against an empty snapshot and the run fails closed before persisting. A\n  // priming failure propagates: handing back an unprimed context would let the\n  // caller accept the delivery, and retire a terminal subscription, for a run\n  // that then fails without its credentials and cannot be redelivered.\n  try {\n    await primeTenantCredentialsForRequestContext(requestContext);\n  } catch (error) {\n    throw new Error(`Unable to prime tenant credentials for subscription ${subscription.id}; not delivered.`, {\n      cause: error,\n    });\n  }\n  return requestContext;\n}\n\n/**\n * Attach the Factory session's owner, in its organization, to the request\n * context of a run that has no inbound request (a notification or peer-signal\n * wake), and prime that tenant's credentials. The live session's `ownerId`\n * isn't used: sessions opened from the browser or Slack are owned by the\n * controller id, not a user. Leaves the context alone when `sessionId` names no\n * Factory session or its org is unresolved, so credential resolution fails\n * closed.\n */\nexport async function prepareSessionRunContext(\n  requestContext: RequestContext,\n  sessionId: string,\n  sourceControl: SubscriptionSessionLookup,\n  options?: { expectedOrgId?: string },\n): Promise<'prepared' | 'session-not-found' | 'organization-unresolved' | 'organization-mismatch'> {\n  const sessionRow = await sourceControl.sessions.getBySessionId(sessionId);\n  if (!sessionRow) return 'session-not-found';\n  if (!hasResolvedOrg(sessionRow.orgId)) return 'organization-unresolved';\n  if (options?.expectedOrgId !== undefined && sessionRow.orgId !== options.expectedOrgId) {\n    return 'organization-mismatch';\n  }\n  requestContext.set('user', { workosId: sessionRow.userId, organizationId: sessionRow.orgId });\n  await primeTenantCredentialsForRequestContext(requestContext);\n  return 'prepared';\n}\n\nexport async function resolveSubscriptionSession(\n  controller: MountedMastraCode['controller'],\n  subscription: SubscriptionSessionRow,\n  options: { label: string; sourceControl?: SubscriptionSessionLookup },\n) {\n  const { label } = options;\n  const { sessionId, resourceId, threadId } = subscription;\n  if (!sessionId || !resourceId || !threadId) {\n    throw new Error(`${label} subscription ${subscription.id} is missing its session binding.`);\n  }\n  // Read the thread straight from storage before touching sessions. This answers\n  // two questions at once, and `queryThreadById` does it without constructing a\n  // session (so no workspace or sandbox is provisioned just to make the check).\n  //\n  // First: do we even have this thread? A change request's events can reach a\n  // deployment that never owned the subscribed thread, and delivery must not\n  // fabricate a session for a thread that lives somewhere else.\n  //\n  // Second: which resource owns it? The subscription records the Factory project\n  // as its `resourceId`, but an unscoped session is registered under its own id,\n  // so the stored value routinely names a resource that does not own the thread.\n  // The thread row is the authoritative answer; the stored id is only a fallback.\n  const thread = await controller.queryThreadById({ threadId });\n  if (!thread) return undefined;\n  const ownerResourceId = thread.resourceId || resourceId;\n  const scope = subscription.sessionScope || undefined;\n  let session = await controller.getSessionByResource(ownerResourceId, scope);\n  if (!session) {\n    const tags = {\n      factoryProjectId: resourceId,\n      projectRepositoryId: subscription.data.projectRepositoryId,\n    };\n    // Creating the session resolves its workspace, which authorizes the caller\n    // against the Factory session row — no signed-in user, so run as its owner.\n    // The session is created under the resource that owns the thread, so the\n    // thread switch below resolves; the persisted Factory session is keyed by\n    // the subscription's session ID.\n    const sessionRow = await options.sourceControl?.sessions.getBySessionId(sessionId);\n    if (!sessionRow) {\n      throw new Error(`${label} subscription ${subscription.id} has no Factory session ${sessionId} to run as.`);\n    }\n    const requestContext = new RequestContext();\n    requestContext.set('user', { workosId: sessionRow.userId, organizationId: sessionRow.orgId });\n    session = await controller.createSession({\n      id: sessionId,\n      ownerId: sessionRow.userId,\n      resourceId: ownerResourceId,\n      scope,\n      tags,\n      requestContext,\n    });\n    await seedSessionOrg(session, sessionRow.orgId);\n  } else if (!hasResolvedOrg(session.state?.get()?.factoryOrgId)) {\n    // A session created before the org seed existed carries the project tag and\n    // no org, so capture would refuse for the rest of its life even though the\n    // org is recoverable. Heal it — but only here, and only when it is missing:\n    // hoisting the row fetch above would make an existing-session delivery throw\n    // on a missing row where it previously succeeded, and fetching it every time\n    // would add a storage read to every delivery. A row that is missing or a\n    // lookup that throws leaves the session marked unresolved, and delivery\n    // continues either way.\n    try {\n      const sessionRow = await options.sourceControl?.sessions.getBySessionId(sessionId);\n      await seedSessionOrg(session, sessionRow?.orgId);\n    } catch (error) {\n      console.warn(`[${label} webhook] Unable to resolve the session organization.`, error);\n      await seedSessionOrg(session, undefined);\n    }\n  } else if (session.state?.get()?.factoryOrgUnresolved) {\n    // The org is present, so an earlier failed resolution left a stale marker\n    // behind. Clear it without a storage read — nothing else re-seeds a session\n    // once the start hook has run, so the marker would otherwise outlive its\n    // cause.\n    await seedSessionOrg(session, session.state.get()?.factoryOrgId);\n  }\n  if (session.thread.getId() !== threadId) {\n    await session.thread.switch({ threadId, emitEvent: false });\n  }\n  if (session.thread.getId() !== threadId) {\n    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);\n  }\n  return session;\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,eAAsB,uBACpB,cACA,eACqC;CACrC,IAAI,SAAS,aAAa,KAAK,sBAAsB,KAAA;CACrD,IAAI,QAA4B,aAAa;CAC7C,IAAI,CAAC,UAAU,aAAa,aAAa,eAAe;EACtD,MAAM,aAAa,MAAM,cAAc,SAAS,eAAe,aAAa,SAAS;EACrF,SAAS,YAAY;EACrB,QAAQ,YAAY,SAAS;CAC/B;CACA,IAAI,CAAC,UAAU,CAAC,eAAe,KAAK,GAAG,OAAO,KAAA;CAC9C,MAAM,iBAAiB,IAAI,eAAe;CAC1C,eAAe,IAAI,QAAQ;EAAE,UAAU;EAAQ,gBAAgB;CAAM,CAAC;CAOtE,IAAI;EACF,MAAM,wCAAwC,cAAc;CAC9D,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,uDAAuD,aAAa,GAAG,mBAAmB,EACxG,OAAO,MACT,CAAC;CACH;CACA,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,yBACpB,gBACA,WACA,eACA,SACiG;CACjG,MAAM,aAAa,MAAM,cAAc,SAAS,eAAe,SAAS;CACxE,IAAI,CAAC,YAAY,OAAO;CACxB,IAAI,CAAC,eAAe,WAAW,KAAK,GAAG,OAAO;CAC9C,IAAI,SAAS,kBAAkB,KAAA,KAAa,WAAW,UAAU,QAAQ,eACvE,OAAO;CAET,eAAe,IAAI,QAAQ;EAAE,UAAU,WAAW;EAAQ,gBAAgB,WAAW;CAAM,CAAC;CAC5F,MAAM,wCAAwC,cAAc;CAC5D,OAAO;AACT;AAEA,eAAsB,2BACpB,YACA,cACA,SACA;CACA,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,WAAW,YAAY,aAAa;CAC5C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAChC,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB,aAAa,GAAG,iCAAiC;CAc5F,MAAM,SAAS,MAAM,WAAW,gBAAgB,EAAE,SAAS,CAAC;CAC5D,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,MAAM,kBAAkB,OAAO,cAAc;CAC7C,MAAM,QAAQ,aAAa,gBAAgB,KAAA;CAC3C,IAAI,UAAU,MAAM,WAAW,qBAAqB,iBAAiB,KAAK;CAC1E,IAAI,CAAC,SAAS;EACZ,MAAM,OAAO;GACX,kBAAkB;GAClB,qBAAqB,aAAa,KAAK;EACzC;EAMA,MAAM,aAAa,MAAM,QAAQ,eAAe,SAAS,eAAe,SAAS;EACjF,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB,aAAa,GAAG,0BAA0B,UAAU,YAAY;EAE3G,MAAM,iBAAiB,IAAI,eAAe;EAC1C,eAAe,IAAI,QAAQ;GAAE,UAAU,WAAW;GAAQ,gBAAgB,WAAW;EAAM,CAAC;EAC5F,UAAU,MAAM,WAAW,cAAc;GACvC,IAAI;GACJ,SAAS,WAAW;GACpB,YAAY;GACZ;GACA;GACA;EACF,CAAC;EACD,MAAM,eAAe,SAAS,WAAW,KAAK;CAChD,OAAO,IAAI,CAAC,eAAe,QAAQ,OAAO,IAAI,CAAC,EAAE,YAAY,GAS3D,IAAI;EACF,MAAM,aAAa,MAAM,QAAQ,eAAe,SAAS,eAAe,SAAS;EACjF,MAAM,eAAe,SAAS,YAAY,KAAK;CACjD,SAAS,OAAO;EACd,QAAQ,KAAK,IAAI,MAAM,wDAAwD,KAAK;EACpF,MAAM,eAAe,SAAS,KAAA,CAAS;CACzC;MACK,IAAI,QAAQ,OAAO,IAAI,CAAC,EAAE,sBAK/B,MAAM,eAAe,SAAS,QAAQ,MAAM,IAAI,CAAC,EAAE,YAAY;CAEjE,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,QAAQ,OAAO,OAAO;EAAE;EAAU,WAAW;CAAM,CAAC;CAE5D,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,IAAI,MAAM,WAAW,UAAU,uBAAuB,SAAS,EAAE;CAEzE,OAAO;AACT"}
+{"version":3,"file":"subscription-session.js","names":[],"sources":["../../src/integrations/subscription-session.ts"],"sourcesContent":["import type { MountedMastraCode } from '@mastra/code-sdk';\nimport { RequestContext } from '@mastra/core/request-context';\n\nimport { primeTenantCredentialsForRequestContext } from '../routes/tenant-credentials.js';\nimport { hasResolvedOrg, seedSessionOrg } from '../session/org-seed.js';\nimport type { IntegrationSubscription } from '../storage/domains/integrations/base.js';\n\n/** The Factory session row fields a woken session has to run as. */\nexport type FactorySessionOwner = { userId: string; orgId: string };\n\nexport interface SubscriptionSessionLookup {\n  sessions: { getBySessionId(sessionId: string): Promise<FactorySessionOwner | null> };\n}\n\n/**\n * Bring the session that owns a subscribed thread online so a provider event\n * can be delivered to it. Provider-neutral: GitHub and GitLab subscriptions\n * carry the same session binding and differ only in their target data.\n */\nexport type SubscriptionSessionRow = IntegrationSubscription<{\n  projectRepositoryId: string;\n  subscribedByUserId?: string | null;\n}>;\n\n/**\n * The request context a provider-triggered run executes under: the user who\n * subscribed the thread, in the subscription's organization. A webhook carries\n * no signed-in user and tenant credential resolution fails closed without one,\n * so a woken run would otherwise stop before it could persist or answer the\n * notification. The subscription row already names that user, so delivery\n * costs no extra read; an older row without one falls back to the Factory\n * session's owner, the identity used when a session is recreated for delivery.\n */\nexport async function subscriptionRunContext(\n  subscription: SubscriptionSessionRow,\n  sourceControl: SubscriptionSessionLookup | undefined,\n): Promise<RequestContext | undefined> {\n  let userId = subscription.data.subscribedByUserId ?? undefined;\n  let orgId: string | undefined = subscription.orgId;\n  if (!userId && subscription.sessionId && sourceControl) {\n    const sessionRow = await sourceControl.sessions.getBySessionId(subscription.sessionId);\n    userId = sessionRow?.userId;\n    orgId = sessionRow?.orgId ?? orgId;\n  }\n  if (!userId || !hasResolvedOrg(orgId)) return undefined;\n  const requestContext = new RequestContext();\n  requestContext.set('user', { workosId: userId, organizationId: orgId });\n  // The web auth middleware primes credential snapshots per request; a\n  // webhook-triggered run has no request, so prime here or the model resolves\n  // against an empty snapshot and the run fails closed before persisting. A\n  // priming failure propagates: handing back an unprimed context would let the\n  // caller accept the delivery, and retire a terminal subscription, for a run\n  // that then fails without its credentials and cannot be redelivered.\n  try {\n    await primeTenantCredentialsForRequestContext(requestContext);\n  } catch (error) {\n    throw new Error(`Unable to prime tenant credentials for subscription ${subscription.id}; not delivered.`, {\n      cause: error,\n    });\n  }\n  return requestContext;\n}\n\n/**\n * Attach the Factory session's owner, in its organization, to the request\n * context of a run that has no inbound request (a notification or peer-signal\n * wake), and prime that tenant's credentials. The live session's `ownerId`\n * isn't used: sessions opened from the browser or Slack are owned by the\n * controller id, not a user. Leaves the context alone when `sessionId` names no\n * Factory session or its org is unresolved, so credential resolution fails\n * closed.\n */\nexport async function prepareSessionRunContext(\n  requestContext: RequestContext,\n  sessionId: string,\n  sourceControl: SubscriptionSessionLookup,\n  options?: { expectedOrgId?: string },\n): Promise<'prepared' | 'session-not-found' | 'organization-unresolved' | 'organization-mismatch'> {\n  const sessionRow = await sourceControl.sessions.getBySessionId(sessionId);\n  if (!sessionRow) return 'session-not-found';\n  if (!hasResolvedOrg(sessionRow.orgId)) return 'organization-unresolved';\n  if (options?.expectedOrgId !== undefined && sessionRow.orgId !== options.expectedOrgId) {\n    return 'organization-mismatch';\n  }\n  requestContext.set('user', { workosId: sessionRow.userId, organizationId: sessionRow.orgId });\n  await primeTenantCredentialsForRequestContext(requestContext);\n  return 'prepared';\n}\n\n/**\n * Create the controller session for a Factory session that isn't live, as its\n * row's owner in the row's organization. Used when an event or message has to\n * reach a session nobody has open: there is no signed-in user, so the session\n * runs as the person it belongs to.\n */\nexport async function createSessionAsRowOwner(\n  controller: Pick<MountedMastraCode['controller'], 'createSession'>,\n  args: {\n    sessionId: string;\n    ownerResourceId: string;\n    row: FactorySessionOwner;\n    tags: Record<string, string>;\n    scope?: string;\n    /** Bind this exact thread at creation instead of resuming or creating another. */\n    threadId?: string;\n  },\n) {\n  const requestContext = new RequestContext();\n  requestContext.set('user', { workosId: args.row.userId, organizationId: args.row.orgId });\n  const session = await controller.createSession({\n    id: args.sessionId,\n    ownerId: args.row.userId,\n    resourceId: args.ownerResourceId,\n    scope: args.scope,\n    tags: args.tags,\n    ...(args.threadId ? { threadId: args.threadId } : {}),\n    requestContext,\n  });\n  await seedSessionOrg(session, args.row.orgId);\n  return session;\n}\n\nexport async function resolveSubscriptionSession(\n  controller: MountedMastraCode['controller'],\n  subscription: SubscriptionSessionRow,\n  options: { label: string; sourceControl?: SubscriptionSessionLookup },\n) {\n  const { label } = options;\n  const { sessionId, resourceId, threadId } = subscription;\n  if (!sessionId || !resourceId || !threadId) {\n    throw new Error(`${label} subscription ${subscription.id} is missing its session binding.`);\n  }\n  // Read the thread straight from storage before touching sessions. This answers\n  // two questions at once, and `queryThreadById` does it without constructing a\n  // session (so no workspace or sandbox is provisioned just to make the check).\n  //\n  // First: do we even have this thread? A change request's events can reach a\n  // deployment that never owned the subscribed thread, and delivery must not\n  // fabricate a session for a thread that lives somewhere else.\n  //\n  // Second: which resource owns it? The subscription records the Factory project\n  // as its `resourceId`, but an unscoped session is registered under its own id,\n  // so the stored value routinely names a resource that does not own the thread.\n  // The thread row is the authoritative answer; the stored id is only a fallback.\n  const thread = await controller.queryThreadById({ threadId });\n  if (!thread) return undefined;\n  const ownerResourceId = thread.resourceId || resourceId;\n  const scope = subscription.sessionScope || undefined;\n  let session = await controller.getSessionByResource(ownerResourceId, scope);\n  if (!session) {\n    const tags = {\n      factoryProjectId: resourceId,\n      projectRepositoryId: subscription.data.projectRepositoryId,\n    };\n    // Creating the session resolves its workspace, which authorizes the caller\n    // against the Factory session row — no signed-in user, so run as its owner.\n    // The session is created under the resource that owns the thread, so the\n    // thread switch below resolves; the persisted Factory session is keyed by\n    // the subscription's session ID.\n    const sessionRow = await options.sourceControl?.sessions.getBySessionId(sessionId);\n    if (!sessionRow) {\n      throw new Error(`${label} subscription ${subscription.id} has no Factory session ${sessionId} to run as.`);\n    }\n    session = await createSessionAsRowOwner(controller, {\n      sessionId,\n      ownerResourceId,\n      row: sessionRow,\n      scope,\n      tags,\n    });\n  } else if (!hasResolvedOrg(session.state?.get()?.factoryOrgId)) {\n    // A session created before the org seed existed carries the project tag and\n    // no org, so capture would refuse for the rest of its life even though the\n    // org is recoverable. Heal it — but only here, and only when it is missing:\n    // hoisting the row fetch above would make an existing-session delivery throw\n    // on a missing row where it previously succeeded, and fetching it every time\n    // would add a storage read to every delivery. A row that is missing or a\n    // lookup that throws leaves the session marked unresolved, and delivery\n    // continues either way.\n    try {\n      const sessionRow = await options.sourceControl?.sessions.getBySessionId(sessionId);\n      await seedSessionOrg(session, sessionRow?.orgId);\n    } catch (error) {\n      console.warn(`[${label} webhook] Unable to resolve the session organization.`, error);\n      await seedSessionOrg(session, undefined);\n    }\n  } else if (session.state?.get()?.factoryOrgUnresolved) {\n    // The org is present, so an earlier failed resolution left a stale marker\n    // behind. Clear it without a storage read — nothing else re-seeds a session\n    // once the start hook has run, so the marker would otherwise outlive its\n    // cause.\n    await seedSessionOrg(session, session.state.get()?.factoryOrgId);\n  }\n  if (session.thread.getId() !== threadId) {\n    await session.thread.switch({ threadId, emitEvent: false });\n  }\n  if (session.thread.getId() !== threadId) {\n    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);\n  }\n  return session;\n}\n"],"mappings":";;;;;;;;;;;;;AAiCA,eAAsB,uBACpB,cACA,eACqC;CACrC,IAAI,SAAS,aAAa,KAAK,sBAAsB,KAAA;CACrD,IAAI,QAA4B,aAAa;CAC7C,IAAI,CAAC,UAAU,aAAa,aAAa,eAAe;EACtD,MAAM,aAAa,MAAM,cAAc,SAAS,eAAe,aAAa,SAAS;EACrF,SAAS,YAAY;EACrB,QAAQ,YAAY,SAAS;CAC/B;CACA,IAAI,CAAC,UAAU,CAAC,eAAe,KAAK,GAAG,OAAO,KAAA;CAC9C,MAAM,iBAAiB,IAAI,eAAe;CAC1C,eAAe,IAAI,QAAQ;EAAE,UAAU;EAAQ,gBAAgB;CAAM,CAAC;CAOtE,IAAI;EACF,MAAM,wCAAwC,cAAc;CAC9D,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,uDAAuD,aAAa,GAAG,mBAAmB,EACxG,OAAO,MACT,CAAC;CACH;CACA,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,yBACpB,gBACA,WACA,eACA,SACiG;CACjG,MAAM,aAAa,MAAM,cAAc,SAAS,eAAe,SAAS;CACxE,IAAI,CAAC,YAAY,OAAO;CACxB,IAAI,CAAC,eAAe,WAAW,KAAK,GAAG,OAAO;CAC9C,IAAI,SAAS,kBAAkB,KAAA,KAAa,WAAW,UAAU,QAAQ,eACvE,OAAO;CAET,eAAe,IAAI,QAAQ;EAAE,UAAU,WAAW;EAAQ,gBAAgB,WAAW;CAAM,CAAC;CAC5F,MAAM,wCAAwC,cAAc;CAC5D,OAAO;AACT;;;;;;;AAQA,eAAsB,wBACpB,YACA,MASA;CACA,MAAM,iBAAiB,IAAI,eAAe;CAC1C,eAAe,IAAI,QAAQ;EAAE,UAAU,KAAK,IAAI;EAAQ,gBAAgB,KAAK,IAAI;CAAM,CAAC;CACxF,MAAM,UAAU,MAAM,WAAW,cAAc;EAC7C,IAAI,KAAK;EACT,SAAS,KAAK,IAAI;EAClB,YAAY,KAAK;EACjB,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;EACnD;CACF,CAAC;CACD,MAAM,eAAe,SAAS,KAAK,IAAI,KAAK;CAC5C,OAAO;AACT;AAEA,eAAsB,2BACpB,YACA,cACA,SACA;CACA,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,WAAW,YAAY,aAAa;CAC5C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAChC,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB,aAAa,GAAG,iCAAiC;CAc5F,MAAM,SAAS,MAAM,WAAW,gBAAgB,EAAE,SAAS,CAAC;CAC5D,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,MAAM,kBAAkB,OAAO,cAAc;CAC7C,MAAM,QAAQ,aAAa,gBAAgB,KAAA;CAC3C,IAAI,UAAU,MAAM,WAAW,qBAAqB,iBAAiB,KAAK;CAC1E,IAAI,CAAC,SAAS;EACZ,MAAM,OAAO;GACX,kBAAkB;GAClB,qBAAqB,aAAa,KAAK;EACzC;EAMA,MAAM,aAAa,MAAM,QAAQ,eAAe,SAAS,eAAe,SAAS;EACjF,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB,aAAa,GAAG,0BAA0B,UAAU,YAAY;EAE3G,UAAU,MAAM,wBAAwB,YAAY;GAClD;GACA;GACA,KAAK;GACL;GACA;EACF,CAAC;CACH,OAAO,IAAI,CAAC,eAAe,QAAQ,OAAO,IAAI,CAAC,EAAE,YAAY,GAS3D,IAAI;EACF,MAAM,aAAa,MAAM,QAAQ,eAAe,SAAS,eAAe,SAAS;EACjF,MAAM,eAAe,SAAS,YAAY,KAAK;CACjD,SAAS,OAAO;EACd,QAAQ,KAAK,IAAI,MAAM,wDAAwD,KAAK;EACpF,MAAM,eAAe,SAAS,KAAA,CAAS;CACzC;MACK,IAAI,QAAQ,OAAO,IAAI,CAAC,EAAE,sBAK/B,MAAM,eAAe,SAAS,QAAQ,MAAM,IAAI,CAAC,EAAE,YAAY;CAEjE,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,QAAQ,OAAO,OAAO;EAAE;EAAU,WAAW;CAAM,CAAC;CAE5D,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,IAAI,MAAM,WAAW,UAAU,uBAAuB,SAAS,EAAE;CAEzE,OAAO;AACT"}

package/dist/mcp/disconnect.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Emits `close` on the `toReqRes` response when the HTTP client cancels the
+ * body, so the MCP transport aborts instead of writing into a closed stream.
+ * Mirrors `@mastra/hono`'s helper, which isn't exported.
+ */
+export declare function propagateClientDisconnect(fetchResponse: Response, res: {
+    emit: (event: string) => void;
+    destroy?: () => void;
+}): Response;
+//# sourceMappingURL=disconnect.d.ts.map

package/dist/mcp/disconnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disconnect.d.ts","sourceRoot":"","sources":["../../src/mcp/disconnect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,QAAQ,EACvB,GAAG,EAAE;IAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GAC3D,QAAQ,CA+CV"}

package/dist/mcp/disconnect.js

@@ -0,0 +1,44 @@
+//#region src/mcp/disconnect.ts
+/**
+* Emits `close` on the `toReqRes` response when the HTTP client cancels the
+* body, so the MCP transport aborts instead of writing into a closed stream.
+* Mirrors `@mastra/hono`'s helper, which isn't exported.
+*/
+function propagateClientDisconnect(fetchResponse, res) {
+	const upstream = fetchResponse.body;
+	if (!upstream) return fetchResponse;
+	let disconnected = false;
+	const disconnect = () => {
+		if (disconnected) return;
+		disconnected = true;
+		try {
+			res.emit("close");
+		} catch {}
+		reader.read().then(function drain({ done }) {
+			return done ? void 0 : reader.read().then(drain);
+		}, () => {});
+	};
+	const reader = upstream.getReader();
+	const body = new ReadableStream({
+		async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			controller.enqueue(value);
+		},
+		cancel() {
+			disconnect();
+		}
+	});
+	return new Response(body, {
+		status: fetchResponse.status,
+		statusText: fetchResponse.statusText,
+		headers: fetchResponse.headers
+	});
+}
+//#endregion
+export { propagateClientDisconnect };
+
+//# sourceMappingURL=disconnect.js.map

package/dist/mcp/disconnect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disconnect.js","names":[],"sources":["../../src/mcp/disconnect.ts"],"sourcesContent":["/**\n * Emits `close` on the `toReqRes` response when the HTTP client cancels the\n * body, so the MCP transport aborts instead of writing into a closed stream.\n * Mirrors `@mastra/hono`'s helper, which isn't exported.\n */\nexport function propagateClientDisconnect(\n  fetchResponse: Response,\n  res: { emit: (event: string) => void; destroy?: () => void },\n): Response {\n  const upstream = fetchResponse.body;\n  if (!upstream) return fetchResponse;\n\n  let disconnected = false;\n  const disconnect = () => {\n    if (disconnected) return;\n    disconnected = true;\n    try {\n      res.emit('close');\n    } catch {\n      // Already torn down - the transport has nothing left to clean up.\n    }\n    // Deliberately *not* cancelling or destroying the bridge stream here. `fetch-to-node`\n    // buffers writes and flushes them from a cork timer; tearing its controller down leaves\n    // that pending flush to enqueue into a closed controller, which throws an unhandled\n    // ERR_INVALID_STATE from a timer callback - the very crash this guards against.\n    // Emitting `close` aborts the transport, which ends the response, so the bridge closes\n    // its own controller in the right order once buffered data has drained.\n    void reader.read().then(\n      function drain({ done }): unknown {\n        return done ? undefined : reader.read().then(drain);\n      },\n      () => {},\n    );\n  };\n\n  const reader = upstream.getReader();\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      const { done, value } = await reader.read();\n      if (done) {\n        controller.close();\n        return;\n      }\n      controller.enqueue(value);\n    },\n    cancel() {\n      disconnect();\n    },\n  });\n\n  return new Response(body, {\n    status: fetchResponse.status,\n    statusText: fetchResponse.statusText,\n    headers: fetchResponse.headers,\n  });\n}\n"],"mappings":";;;;;;AAKA,SAAgB,0BACd,eACA,KACU;CACV,MAAM,WAAW,cAAc;CAC/B,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,eAAe;CACnB,MAAM,mBAAmB;EACvB,IAAI,cAAc;EAClB,eAAe;EACf,IAAI;GACF,IAAI,KAAK,OAAO;EAClB,QAAQ,CAER;EAOA,OAAY,KAAK,CAAC,CAAC,KACjB,SAAS,MAAM,EAAE,QAAiB;GAChC,OAAO,OAAO,KAAA,IAAY,OAAO,KAAK,CAAC,CAAC,KAAK,KAAK;EACpD,SACM,CAAC,CACT;CACF;CAEA,MAAM,SAAS,SAAS,UAAU;CAClC,MAAM,OAAO,IAAI,eAA2B;EAC1C,MAAM,KAAK,YAAY;GACrB,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;IACR,WAAW,MAAM;IACjB;GACF;GACA,WAAW,QAAQ,KAAK;EAC1B;EACA,SAAS;GACP,WAAW;EACb;CACF,CAAC;CAED,OAAO,IAAI,SAAS,MAAM;EACxB,QAAQ,cAAc;EACtB,YAAY,cAAc;EAC1B,SAAS,cAAc;CACzB,CAAC;AACH"}

package/dist/mcp/routes.d.ts

@@ -0,0 +1,46 @@
+import type { ApiRoute } from '@mastra/core/server';
+import type { Tool } from '@mastra/core/tools';
+import type { RouteAuth } from '../routes/route.js';
+import type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { FactoryToolDependencies, FactoryToolScope } from '../tools/index.js';
+export declare const FACTORY_MCP_PATH = "/web/factory/projects/:projectId/mcp";
+export interface FactoryMcpConfig {
+    /** Serve the MCP endpoint. Default `true`; it is never served without an auth provider. */
+    enabled?: boolean;
+    /**
+     * OAuth authorization servers advertised in the protected-resource metadata
+     * (RFC 9728) so clients like ChatGPT know where to sign in. Defaults to the
+     * `MASTRA_FACTORY_MCP_AUTHORIZATION_SERVER` env var, then to Mastra Platform's
+     * AuthKit when the Factory uses Platform auth. The endpoint isn't served
+     * without one, since clients would have nowhere to sign in.
+     */
+    authorizationServers?: string[];
+}
+/** Mastra Platform's WorkOS AuthKit, which issues tokens Platform's `/auth/verify` accepts. */
+export declare const PLATFORM_MCP_AUTHORIZATION_SERVER = "https://auth-kit.mastra.ai";
+export declare function resolveMcpAuthorizationServers(providerName: string | undefined, config: FactoryMcpConfig | undefined, env?: Record<string, string | undefined>): string[];
+export interface FactoryMcpRoutesDeps {
+    auth: RouteAuth;
+    publicOrigin: string;
+    authorizationServers: string[];
+    projects: Pick<FactoryProjectsStorage, 'get'>;
+    /** Source-control handles a connector session can be filed under, tried in order. */
+    sourceControls: readonly SourceControlStorageHandle[];
+    tools: FactoryToolDependencies;
+    version?: string;
+}
+/** The connector session a user's MCP client acts from: one per user and Factory, stable across requests. */
+export declare function connectorSessionId(orgId: string, userId: string, factoryProjectId: string): string;
+/** The tools a signed-in person's MCP client sees for one Factory. */
+export declare function createFactoryMcpTools(scope: FactoryToolScope, deps: FactoryMcpRoutesDeps, options?: {
+    persistedSession?: boolean;
+}): Record<string, Tool<any, any, any, any>>;
+/**
+ * The Factory's MCP endpoint: Streamable HTTP at
+ * `/web/factory/projects/:projectId/mcp`, plus its RFC 9728 protected-resource
+ * metadata. Callers sign in with OAuth through the Factory's auth provider and
+ * get the tools a web UI session would, under the same permissions.
+ */
+export declare function buildFactoryMcpRoutes(deps: FactoryMcpRoutesDeps): ApiRoute[];
+//# sourceMappingURL=routes.d.ts.map

package/dist/mcp/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/mcp/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAQ/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAG5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGnF,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AASvE,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,+FAA+F;AAC/F,eAAO,MAAM,iCAAiC,+BAA+B,CAAC;AAE9E,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,qFAAqF;IACrF,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,KAAK,EAAE,uBAAuB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6GAA6G;AAC7G,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAGlG;AAyFD,sEAAsE;AACtE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,oBAAoB,EAC1B,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAe1C;AAwED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAoB5E"}

package/dist/mcp/routes.js

@@ -0,0 +1,243 @@
+import "../platform-auth-host.js";
+import { getFactoryAuthUser } from "../auth.js";
+import { FactorySourceSessionResolutionError, ensureFactorySourceSession } from "../session/factory-session.js";
+import { auditActorProfile } from "../storage/domains/audit/base.js";
+import { FACTORY_TOOL_ANNOTATIONS } from "../tools/annotations.js";
+import { createFactoryTools } from "../tools/index.js";
+import { propagateClientDisconnect } from "./disconnect.js";
+import { registerApiRoute } from "@mastra/core/server";
+import { createHash } from "crypto";
+import { z } from "zod";
+import { createTool } from "@mastra/core/tools";
+import { MCPServer } from "@mastra/mcp";
+import { toFetchResponse, toReqRes } from "fetch-to-node";
+//#region src/mcp/routes.ts
+const FACTORY_MCP_PATH = "/web/factory/projects/:projectId/mcp";
+const PROTECTED_RESOURCE_PREFIX = "/.well-known/oauth-protected-resource";
+/**
+* Tools an MCP client never gets. `factory_message_origin` answers the session
+* that started this one; a connector session is started by a person, not a session.
+*/
+const EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["factory_message_origin"]);
+/** Mastra Platform's WorkOS AuthKit, which issues tokens Platform's `/auth/verify` accepts. */
+const PLATFORM_MCP_AUTHORIZATION_SERVER = "https://auth-kit.mastra.ai";
+function resolveMcpAuthorizationServers(providerName, config, env = process.env) {
+	if (config?.authorizationServers?.length) return config.authorizationServers;
+	const fromEnv = env.MASTRA_FACTORY_MCP_AUTHORIZATION_SERVER?.trim();
+	if (fromEnv) return [fromEnv];
+	if (providerName === "mastra-studio") return [PLATFORM_MCP_AUTHORIZATION_SERVER];
+	return [];
+}
+/** The connector session a user's MCP client acts from: one per user and Factory, stable across requests. */
+function connectorSessionId(orgId, userId, factoryProjectId) {
+	const hex = createHash("sha256").update(`mcp\0${orgId}\0${userId}\0${factoryProjectId}`).digest("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-5${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+/**
+* Get or create the private user session behind a person's MCP client, so
+* session-scoped tools (start/signal sessions, follow work items) have a real
+* session to act from. A Factory without a connected repository has nowhere to
+* file one; its tools still run against the stable id.
+*/
+async function ensureConnectorSession(deps, args) {
+	const sessionId = connectorSessionId(args.orgId, args.userId, args.factoryProjectId);
+	if (await deps.tools.sessions.getBySessionId(sessionId)) return {
+		sessionId,
+		persisted: true
+	};
+	for (const sourceControl of deps.sourceControls) try {
+		await ensureFactorySourceSession({
+			sourceControl,
+			orgId: args.orgId,
+			factoryProjectId: args.factoryProjectId,
+			branch: `factory/mcp-${sessionId.slice(0, 8)}`,
+			attributeToUserId: args.userId,
+			sessionId,
+			visibility: "private"
+		});
+		return {
+			sessionId,
+			persisted: true
+		};
+	} catch (error) {
+		if (!(error instanceof FactorySourceSessionResolutionError)) throw error;
+	}
+	return {
+		sessionId,
+		persisted: false
+	};
+}
+function workItemUrl(publicOrigin, factoryProjectId, workItemId) {
+	return `${publicOrigin}/factory/${encodeURIComponent(factoryProjectId)}/work-items/${encodeURIComponent(workItemId)}`;
+}
+/**
+* `search` and `fetch`, the two tools ChatGPT's connectors and deep research
+* look for, answered from the Factory's work items.
+*/
+function createSearchFetchTools(scope, deps, inspect) {
+	const project = {
+		orgId: scope.orgId,
+		factoryProjectId: scope.factoryProjectId
+	};
+	return {
+		search: createTool({
+			id: "search",
+			description: "Search this Factory’s work items by title or id. Returns matching items with ids to pass to `fetch`.",
+			inputSchema: z.object({ query: z.string().describe("Words to look for in work item titles.") }),
+			execute: async ({ query }) => {
+				const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
+				return { results: (await deps.tools.workItems.list(project)).filter((item) => {
+					const haystack = `${item.id} ${item.title}`.toLowerCase();
+					return terms.every((term) => haystack.includes(term));
+				}).slice(0, 20).map((item) => ({
+					id: item.id,
+					title: item.title,
+					url: workItemUrl(deps.publicOrigin, scope.factoryProjectId, item.id)
+				})) };
+			}
+		}),
+		fetch: createTool({
+			id: "fetch",
+			description: "Fetch everything the Factory knows about one work item, by the id `search` returned.",
+			inputSchema: z.object({ id: z.string().describe("Work item id.") }),
+			execute: async ({ id }, context) => {
+				if (!inspect?.execute) throw new Error("Work item details are unavailable.");
+				const details = await inspect.execute({ workItem: id }, context);
+				return {
+					id,
+					title: details.item?.title ?? id,
+					text: JSON.stringify(details, null, 2),
+					url: workItemUrl(deps.publicOrigin, scope.factoryProjectId, id),
+					metadata: { factoryProjectId: scope.factoryProjectId }
+				};
+			}
+		})
+	};
+}
+/** The tools a signed-in person's MCP client sees for one Factory. */
+function createFactoryMcpTools(scope, deps, options = {}) {
+	const factoryTools = createFactoryTools({
+		scope,
+		deps: deps.tools
+	});
+	const tools = {};
+	for (const [name, tool] of Object.entries(factoryTools)) {
+		if (EXCLUDED_TOOLS.has(name)) continue;
+		if (name === "factory_start_session" && options.persistedSession === false) continue;
+		tools[name] = tool;
+	}
+	Object.assign(tools, createSearchFetchTools(scope, deps, factoryTools.factory_inspect_work_item));
+	for (const [name, tool] of Object.entries(tools)) {
+		const annotations = FACTORY_TOOL_ANNOTATIONS[name];
+		if (annotations) tool.mcp = {
+			...tool.mcp,
+			annotations
+		};
+	}
+	return tools;
+}
+function resourceMetadataUrl(deps, mcpPath) {
+	return `${deps.publicOrigin}${PROTECTED_RESOURCE_PREFIX}${mcpPath}`;
+}
+function unauthorized(deps, mcpPath, error = "unauthorized") {
+	return new Response(JSON.stringify({ error }), {
+		status: 401,
+		headers: {
+			"Content-Type": "application/json",
+			"WWW-Authenticate": `Bearer resource_metadata="${resourceMetadataUrl(deps, mcpPath)}"`
+		}
+	});
+}
+async function handleMcp(deps, c) {
+	const factoryProjectId = c.req.param("projectId") ?? "";
+	const mcpPath = new URL(c.req.url).pathname;
+	await deps.auth.ensureUser(c);
+	const tenant = deps.auth.tenant(c);
+	if (!tenant) return unauthorized(deps, mcpPath);
+	if (!tenant.orgId) return c.json({ error: "organization_required" }, 403);
+	const project = await deps.projects.get({
+		orgId: tenant.orgId,
+		id: factoryProjectId
+	});
+	if (!project) return c.json({ error: "not_found" }, 404);
+	const { sessionId, persisted } = await ensureConnectorSession(deps, {
+		orgId: tenant.orgId,
+		userId: tenant.userId,
+		factoryProjectId
+	});
+	const actorProfile = auditActorProfile(getFactoryAuthUser(c));
+	const scope = {
+		orgId: tenant.orgId,
+		factoryProjectId,
+		userId: tenant.userId,
+		sessionId,
+		resourceId: sessionId,
+		threadId: sessionId,
+		kind: "user",
+		interactive: true,
+		...actorProfile ? { actorProfile } : {}
+	};
+	const server = new MCPServer({
+		id: `factory-${factoryProjectId}`,
+		name: `${project.name ?? "Mastra"} Factory`,
+		version: deps.version ?? "1.0.0",
+		description: "Manage work items, sessions and decisions in a Mastra Factory.",
+		tools: createFactoryMcpTools(scope, deps, { persistedSession: persisted })
+	});
+	const { req, res } = toReqRes(c.req.raw);
+	const done = server.startHTTP({
+		url: new URL(c.req.url),
+		httpPath: mcpPath,
+		req,
+		res
+	}).catch(() => {
+		if (!res.headersSent) {
+			res.writeHead(500, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({
+				jsonrpc: "2.0",
+				error: {
+					code: -32603,
+					message: "Internal server error"
+				},
+				id: null
+			}));
+		}
+	}).finally(() => void server.close());
+	const response = propagateClientDisconnect(await toFetchResponse(res), res);
+	if (res.writableEnded) await done;
+	return response;
+}
+/**
+* The Factory's MCP endpoint: Streamable HTTP at
+* `/web/factory/projects/:projectId/mcp`, plus its RFC 9728 protected-resource
+* metadata. Callers sign in with OAuth through the Factory's auth provider and
+* get the tools a web UI session would, under the same permissions.
+*/
+function buildFactoryMcpRoutes(deps) {
+	const handler = (c) => handleMcp(deps, c);
+	return [...[
+		"POST",
+		"GET",
+		"DELETE"
+	].map((method) => registerApiRoute(FACTORY_MCP_PATH, {
+		method,
+		requiresAuth: false,
+		handler
+	})), registerApiRoute(`${PROTECTED_RESOURCE_PREFIX}${FACTORY_MCP_PATH}`, {
+		method: "GET",
+		requiresAuth: false,
+		handler: (c) => {
+			const mcpPath = new URL(c.req.url).pathname.slice(37);
+			return c.json({
+				resource: `${deps.publicOrigin}${mcpPath}`,
+				authorization_servers: deps.authorizationServers,
+				bearer_methods_supported: ["header"],
+				resource_name: "Mastra Factory"
+			});
+		}
+	})];
+}
+//#endregion
+export { FACTORY_MCP_PATH, PLATFORM_MCP_AUTHORIZATION_SERVER, buildFactoryMcpRoutes, connectorSessionId, createFactoryMcpTools, resolveMcpAuthorizationServers };
+
+//# sourceMappingURL=routes.js.map

package/dist/mcp/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","names":[],"sources":["../../src/mcp/routes.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport { createTool } from '@mastra/core/tools';\nimport type { Tool } from '@mastra/core/tools';\nimport { MCPServer } from '@mastra/mcp';\nimport { toFetchResponse, toReqRes } from 'fetch-to-node';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\n\nimport { getFactoryAuthUser } from '../auth.js';\nimport { PLATFORM_AUTH_PROVIDER } from '../platform-auth-host.js';\nimport type { RouteAuth } from '../routes/route.js';\nimport { ensureFactorySourceSession, FactorySourceSessionResolutionError } from '../session/factory-session.js';\nimport { auditActorProfile } from '../storage/domains/audit/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport { FACTORY_TOOL_ANNOTATIONS } from '../tools/annotations.js';\nimport { createFactoryTools } from '../tools/index.js';\nimport type { FactoryToolDependencies, FactoryToolScope } from '../tools/index.js';\nimport { propagateClientDisconnect } from './disconnect.js';\n\nexport const FACTORY_MCP_PATH = '/web/factory/projects/:projectId/mcp';\nconst PROTECTED_RESOURCE_PREFIX = '/.well-known/oauth-protected-resource';\n\n/**\n * Tools an MCP client never gets. `factory_message_origin` answers the session\n * that started this one; a connector session is started by a person, not a session.\n */\nconst EXCLUDED_TOOLS = new Set(['factory_message_origin']);\n\nexport interface FactoryMcpConfig {\n  /** Serve the MCP endpoint. Default `true`; it is never served without an auth provider. */\n  enabled?: boolean;\n  /**\n   * OAuth authorization servers advertised in the protected-resource metadata\n   * (RFC 9728) so clients like ChatGPT know where to sign in. Defaults to the\n   * `MASTRA_FACTORY_MCP_AUTHORIZATION_SERVER` env var, then to Mastra Platform's\n   * AuthKit when the Factory uses Platform auth. The endpoint isn't served\n   * without one, since clients would have nowhere to sign in.\n   */\n  authorizationServers?: string[];\n}\n\n/** Mastra Platform's WorkOS AuthKit, which issues tokens Platform's `/auth/verify` accepts. */\nexport const PLATFORM_MCP_AUTHORIZATION_SERVER = 'https://auth-kit.mastra.ai';\n\nexport function resolveMcpAuthorizationServers(\n  providerName: string | undefined,\n  config: FactoryMcpConfig | undefined,\n  env: Record<string, string | undefined> = process.env,\n): string[] {\n  if (config?.authorizationServers?.length) return config.authorizationServers;\n  const fromEnv = env.MASTRA_FACTORY_MCP_AUTHORIZATION_SERVER?.trim();\n  if (fromEnv) return [fromEnv];\n  if (providerName === PLATFORM_AUTH_PROVIDER) return [PLATFORM_MCP_AUTHORIZATION_SERVER];\n  return [];\n}\n\nexport interface FactoryMcpRoutesDeps {\n  auth: RouteAuth;\n  publicOrigin: string;\n  authorizationServers: string[];\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  /** Source-control handles a connector session can be filed under, tried in order. */\n  sourceControls: readonly SourceControlStorageHandle[];\n  tools: FactoryToolDependencies;\n  version?: string;\n}\n\n/** The connector session a user's MCP client acts from: one per user and Factory, stable across requests. */\nexport function connectorSessionId(orgId: string, userId: string, factoryProjectId: string): string {\n  const hex = createHash('sha256').update(`mcp\\0${orgId}\\0${userId}\\0${factoryProjectId}`).digest('hex');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-5${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;\n}\n\n/**\n * Get or create the private user session behind a person's MCP client, so\n * session-scoped tools (start/signal sessions, follow work items) have a real\n * session to act from. A Factory without a connected repository has nowhere to\n * file one; its tools still run against the stable id.\n */\nasync function ensureConnectorSession(\n  deps: FactoryMcpRoutesDeps,\n  args: { orgId: string; userId: string; factoryProjectId: string },\n): Promise<{ sessionId: string; persisted: boolean }> {\n  const sessionId = connectorSessionId(args.orgId, args.userId, args.factoryProjectId);\n  if (await deps.tools.sessions.getBySessionId(sessionId)) return { sessionId, persisted: true };\n  for (const sourceControl of deps.sourceControls) {\n    try {\n      await ensureFactorySourceSession({\n        sourceControl,\n        orgId: args.orgId,\n        factoryProjectId: args.factoryProjectId,\n        branch: `factory/mcp-${sessionId.slice(0, 8)}`,\n        attributeToUserId: args.userId,\n        sessionId,\n        visibility: 'private',\n      });\n      return { sessionId, persisted: true };\n    } catch (error) {\n      if (!(error instanceof FactorySourceSessionResolutionError)) throw error;\n    }\n  }\n  return { sessionId, persisted: false };\n}\n\nfunction workItemUrl(publicOrigin: string, factoryProjectId: string, workItemId: string): string {\n  return `${publicOrigin}/factory/${encodeURIComponent(factoryProjectId)}/work-items/${encodeURIComponent(workItemId)}`;\n}\n\n/**\n * `search` and `fetch`, the two tools ChatGPT's connectors and deep research\n * look for, answered from the Factory's work items.\n */\nfunction createSearchFetchTools(\n  scope: FactoryToolScope,\n  deps: FactoryMcpRoutesDeps,\n  inspect: Tool<any, any, any, any> | undefined,\n): Record<string, Tool<any, any, any, any>> {\n  const project = { orgId: scope.orgId, factoryProjectId: scope.factoryProjectId };\n  return {\n    search: createTool({\n      id: 'search',\n      description:\n        'Search this Factory’s work items by title or id. Returns matching items with ids to pass to `fetch`.',\n      inputSchema: z.object({ query: z.string().describe('Words to look for in work item titles.') }),\n      execute: async ({ query }) => {\n        const terms = query.toLowerCase().split(/\\s+/).filter(Boolean);\n        const items = await deps.tools.workItems.list(project);\n        const results = items\n          .filter(item => {\n            const haystack = `${item.id} ${item.title}`.toLowerCase();\n            return terms.every(term => haystack.includes(term));\n          })\n          .slice(0, 20)\n          .map(item => ({\n            id: item.id,\n            title: item.title,\n            url: workItemUrl(deps.publicOrigin, scope.factoryProjectId, item.id),\n          }));\n        return { results };\n      },\n    }),\n    fetch: createTool({\n      id: 'fetch',\n      description: 'Fetch everything the Factory knows about one work item, by the id `search` returned.',\n      inputSchema: z.object({ id: z.string().describe('Work item id.') }),\n      execute: async ({ id }, context) => {\n        if (!inspect?.execute) throw new Error('Work item details are unavailable.');\n        const details = (await inspect.execute({ workItem: id }, context)) as { item?: { title?: string } };\n        return {\n          id,\n          title: details.item?.title ?? id,\n          text: JSON.stringify(details, null, 2),\n          url: workItemUrl(deps.publicOrigin, scope.factoryProjectId, id),\n          metadata: { factoryProjectId: scope.factoryProjectId },\n        };\n      },\n    }),\n  };\n}\n\n/** The tools a signed-in person's MCP client sees for one Factory. */\nexport function createFactoryMcpTools(\n  scope: FactoryToolScope,\n  deps: FactoryMcpRoutesDeps,\n  options: { persistedSession?: boolean } = {},\n): Record<string, Tool<any, any, any, any>> {\n  const factoryTools = createFactoryTools({ scope, deps: deps.tools }) as Record<string, Tool<any, any, any, any>>;\n  const tools: Record<string, Tool<any, any, any, any>> = {};\n  for (const [name, tool] of Object.entries(factoryTools)) {\n    if (EXCLUDED_TOOLS.has(name)) continue;\n    // Starting a sub-session needs a real parent session row to file it under.\n    if (name === 'factory_start_session' && options.persistedSession === false) continue;\n    tools[name] = tool;\n  }\n  Object.assign(tools, createSearchFetchTools(scope, deps, factoryTools.factory_inspect_work_item));\n  for (const [name, tool] of Object.entries(tools)) {\n    const annotations = FACTORY_TOOL_ANNOTATIONS[name];\n    if (annotations) tool.mcp = { ...tool.mcp, annotations };\n  }\n  return tools;\n}\n\nfunction resourceMetadataUrl(deps: FactoryMcpRoutesDeps, mcpPath: string): string {\n  return `${deps.publicOrigin}${PROTECTED_RESOURCE_PREFIX}${mcpPath}`;\n}\n\nfunction unauthorized(deps: FactoryMcpRoutesDeps, mcpPath: string, error = 'unauthorized'): Response {\n  return new Response(JSON.stringify({ error }), {\n    status: 401,\n    headers: {\n      'Content-Type': 'application/json',\n      'WWW-Authenticate': `Bearer resource_metadata=\"${resourceMetadataUrl(deps, mcpPath)}\"`,\n    },\n  });\n}\n\nasync function handleMcp(deps: FactoryMcpRoutesDeps, c: Context): Promise<Response> {\n  const factoryProjectId = c.req.param('projectId') ?? '';\n  const mcpPath = new URL(c.req.url).pathname;\n\n  await deps.auth.ensureUser(c);\n  const tenant = deps.auth.tenant(c);\n  if (!tenant) return unauthorized(deps, mcpPath);\n  if (!tenant.orgId) return c.json({ error: 'organization_required' }, 403);\n\n  const project = await deps.projects.get({ orgId: tenant.orgId, id: factoryProjectId });\n  if (!project) return c.json({ error: 'not_found' }, 404);\n\n  const { sessionId, persisted } = await ensureConnectorSession(deps, {\n    orgId: tenant.orgId,\n    userId: tenant.userId,\n    factoryProjectId,\n  });\n  const actorProfile = auditActorProfile(getFactoryAuthUser(c));\n  const scope: FactoryToolScope = {\n    orgId: tenant.orgId,\n    factoryProjectId,\n    userId: tenant.userId,\n    sessionId,\n    resourceId: sessionId,\n    threadId: sessionId,\n    kind: 'user',\n    // A signed-in person is driving the client: the same reach as a web UI turn.\n    interactive: true,\n    ...(actorProfile ? { actorProfile } : {}),\n  };\n\n  const server = new MCPServer({\n    id: `factory-${factoryProjectId}`,\n    name: `${project.name ?? 'Mastra'} Factory`,\n    version: deps.version ?? '1.0.0',\n    description: 'Manage work items, sessions and decisions in a Mastra Factory.',\n    tools: createFactoryMcpTools(scope, deps, { persistedSession: persisted }),\n  });\n\n  const { req, res } = toReqRes(c.req.raw);\n  const done = server\n    .startHTTP({ url: new URL(c.req.url), httpPath: mcpPath, req, res })\n    .catch(() => {\n      if (!res.headersSent) {\n        res.writeHead(500, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({ jsonrpc: '2.0', error: { code: -32603, message: 'Internal server error' }, id: null }),\n        );\n      }\n    })\n    .finally(() => void server.close());\n  const response = propagateClientDisconnect(await toFetchResponse(res), res);\n  if (res.writableEnded) await done;\n  return response;\n}\n\n/**\n * The Factory's MCP endpoint: Streamable HTTP at\n * `/web/factory/projects/:projectId/mcp`, plus its RFC 9728 protected-resource\n * metadata. Callers sign in with OAuth through the Factory's auth provider and\n * get the tools a web UI session would, under the same permissions.\n */\nexport function buildFactoryMcpRoutes(deps: FactoryMcpRoutesDeps): ApiRoute[] {\n  const handler = (c: unknown) => handleMcp(deps, c as Context);\n  return [\n    ...(['POST', 'GET', 'DELETE'] as const).map(method =>\n      registerApiRoute(FACTORY_MCP_PATH, { method, requiresAuth: false, handler }),\n    ),\n    registerApiRoute(`${PROTECTED_RESOURCE_PREFIX}${FACTORY_MCP_PATH}`, {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => {\n        const mcpPath = new URL(c.req.url).pathname.slice(PROTECTED_RESOURCE_PREFIX.length);\n        return c.json({\n          resource: `${deps.publicOrigin}${mcpPath}`,\n          authorization_servers: deps.authorizationServers,\n          bearer_methods_supported: ['header'],\n          resource_name: 'Mastra Factory',\n        });\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;AAuBA,MAAa,mBAAmB;AAChC,MAAM,4BAA4B;;;;;AAMlC,MAAM,iCAAiB,IAAI,IAAI,CAAC,wBAAwB,CAAC;;AAgBzD,MAAa,oCAAoC;AAEjD,SAAgB,+BACd,cACA,QACA,MAA0C,QAAQ,KACxC;CACV,IAAI,QAAQ,sBAAsB,QAAQ,OAAO,OAAO;CACxD,MAAM,UAAU,IAAI,yCAAyC,KAAK;CAClE,IAAI,SAAS,OAAO,CAAC,OAAO;CAC5B,IAAI,iBAAA,iBAAyC,OAAO,CAAC,iCAAiC;CACtF,OAAO,CAAC;AACV;;AAcA,SAAgB,mBAAmB,OAAe,QAAgB,kBAAkC;CAClG,MAAM,MAAM,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,MAAM,IAAI,OAAO,IAAI,kBAAkB,CAAC,CAAC,OAAO,KAAK;CACrG,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,IAAI,IAAI,MAAM,IAAI,EAAE,EAAE,IAAI,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE;AAC/G;;;;;;;AAQA,eAAe,uBACb,MACA,MACoD;CACpD,MAAM,YAAY,mBAAmB,KAAK,OAAO,KAAK,QAAQ,KAAK,gBAAgB;CACnF,IAAI,MAAM,KAAK,MAAM,SAAS,eAAe,SAAS,GAAG,OAAO;EAAE;EAAW,WAAW;CAAK;CAC7F,KAAK,MAAM,iBAAiB,KAAK,gBAC/B,IAAI;EACF,MAAM,2BAA2B;GAC/B;GACA,OAAO,KAAK;GACZ,kBAAkB,KAAK;GACvB,QAAQ,eAAe,UAAU,MAAM,GAAG,CAAC;GAC3C,mBAAmB,KAAK;GACxB;GACA,YAAY;EACd,CAAC;EACD,OAAO;GAAE;GAAW,WAAW;EAAK;CACtC,SAAS,OAAO;EACd,IAAI,EAAE,iBAAiB,sCAAsC,MAAM;CACrE;CAEF,OAAO;EAAE;EAAW,WAAW;CAAM;AACvC;AAEA,SAAS,YAAY,cAAsB,kBAA0B,YAA4B;CAC/F,OAAO,GAAG,aAAa,WAAW,mBAAmB,gBAAgB,EAAE,cAAc,mBAAmB,UAAU;AACpH;;;;;AAMA,SAAS,uBACP,OACA,MACA,SAC0C;CAC1C,MAAM,UAAU;EAAE,OAAO,MAAM;EAAO,kBAAkB,MAAM;CAAiB;CAC/E,OAAO;EACL,QAAQ,WAAW;GACjB,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,wCAAwC,EAAE,CAAC;GAC9F,SAAS,OAAO,EAAE,YAAY;IAC5B,MAAM,QAAQ,MAAM,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO;IAa7D,OAAO,EAAE,UAXO,MADI,KAAK,MAAM,UAAU,KAAK,OAAO,EAAA,CAElD,QAAO,SAAQ;KACd,MAAM,WAAW,GAAG,KAAK,GAAG,GAAG,KAAK,QAAQ,YAAY;KACxD,OAAO,MAAM,OAAM,SAAQ,SAAS,SAAS,IAAI,CAAC;IACpD,CAAC,CAAC,CACD,MAAM,GAAG,EAAE,CAAC,CACZ,KAAI,UAAS;KACZ,IAAI,KAAK;KACT,OAAO,KAAK;KACZ,KAAK,YAAY,KAAK,cAAc,MAAM,kBAAkB,KAAK,EAAE;IACrE,EACa,EAAE;GACnB;EACF,CAAC;EACD,OAAO,WAAW;GAChB,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,SAAS,eAAe,EAAE,CAAC;GAClE,SAAS,OAAO,EAAE,MAAM,YAAY;IAClC,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,MAAM,oCAAoC;IAC3E,MAAM,UAAW,MAAM,QAAQ,QAAQ,EAAE,UAAU,GAAG,GAAG,OAAO;IAChE,OAAO;KACL;KACA,OAAO,QAAQ,MAAM,SAAS;KAC9B,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC;KACrC,KAAK,YAAY,KAAK,cAAc,MAAM,kBAAkB,EAAE;KAC9D,UAAU,EAAE,kBAAkB,MAAM,iBAAiB;IACvD;GACF;EACF,CAAC;CACH;AACF;;AAGA,SAAgB,sBACd,OACA,MACA,UAA0C,CAAC,GACD;CAC1C,MAAM,eAAe,mBAAmB;EAAE;EAAO,MAAM,KAAK;CAAM,CAAC;CACnE,MAAM,QAAkD,CAAC;CACzD,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,YAAY,GAAG;EACvD,IAAI,eAAe,IAAI,IAAI,GAAG;EAE9B,IAAI,SAAS,2BAA2B,QAAQ,qBAAqB,OAAO;EAC5E,MAAM,QAAQ;CAChB;CACA,OAAO,OAAO,OAAO,uBAAuB,OAAO,MAAM,aAAa,yBAAyB,CAAC;CAChG,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;EAChD,MAAM,cAAc,yBAAyB;EAC7C,IAAI,aAAa,KAAK,MAAM;GAAE,GAAG,KAAK;GAAK;EAAY;CACzD;CACA,OAAO;AACT;AAEA,SAAS,oBAAoB,MAA4B,SAAyB;CAChF,OAAO,GAAG,KAAK,eAAe,4BAA4B;AAC5D;AAEA,SAAS,aAAa,MAA4B,SAAiB,QAAQ,gBAA0B;CACnG,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,MAAM,CAAC,GAAG;EAC7C,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,oBAAoB,6BAA6B,oBAAoB,MAAM,OAAO,EAAE;EACtF;CACF,CAAC;AACH;AAEA,eAAe,UAAU,MAA4B,GAA+B;CAClF,MAAM,mBAAmB,EAAE,IAAI,MAAM,WAAW,KAAK;CACrD,MAAM,UAAU,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC;CAEnC,MAAM,KAAK,KAAK,WAAW,CAAC;CAC5B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;CACjC,IAAI,CAAC,QAAQ,OAAO,aAAa,MAAM,OAAO;CAC9C,IAAI,CAAC,OAAO,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;CAExE,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI;EAAE,OAAO,OAAO;EAAO,IAAI;CAAiB,CAAC;CACrF,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;CAEvD,MAAM,EAAE,WAAW,cAAc,MAAM,uBAAuB,MAAM;EAClE,OAAO,OAAO;EACd,QAAQ,OAAO;EACf;CACF,CAAC;CACD,MAAM,eAAe,kBAAkB,mBAAmB,CAAC,CAAC;CAC5D,MAAM,QAA0B;EAC9B,OAAO,OAAO;EACd;EACA,QAAQ,OAAO;EACf;EACA,YAAY;EACZ,UAAU;EACV,MAAM;EAEN,aAAa;EACb,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;CACzC;CAEA,MAAM,SAAS,IAAI,UAAU;EAC3B,IAAI,WAAW;EACf,MAAM,GAAG,QAAQ,QAAQ,SAAS;EAClC,SAAS,KAAK,WAAW;EACzB,aAAa;EACb,OAAO,sBAAsB,OAAO,MAAM,EAAE,kBAAkB,UAAU,CAAC;CAC3E,CAAC;CAED,MAAM,EAAE,KAAK,QAAQ,SAAS,EAAE,IAAI,GAAG;CACvC,MAAM,OAAO,OACV,UAAU;EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,GAAG;EAAG,UAAU;EAAS;EAAK;CAAI,CAAC,CAAC,CACnE,YAAY;EACX,IAAI,CAAC,IAAI,aAAa;GACpB,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;GACzD,IAAI,IACF,KAAK,UAAU;IAAE,SAAS;IAAO,OAAO;KAAE,MAAM;KAAQ,SAAS;IAAwB;IAAG,IAAI;GAAK,CAAC,CACxG;EACF;CACF,CAAC,CAAC,CACD,cAAc,KAAK,OAAO,MAAM,CAAC;CACpC,MAAM,WAAW,0BAA0B,MAAM,gBAAgB,GAAG,GAAG,GAAG;CAC1E,IAAI,IAAI,eAAe,MAAM;CAC7B,OAAO;AACT;;;;;;;AAQA,SAAgB,sBAAsB,MAAwC;CAC5E,MAAM,WAAW,MAAe,UAAU,MAAM,CAAY;CAC5D,OAAO,CACL,GAAI;EAAC;EAAQ;EAAO;CAAQ,CAAC,CAAW,KAAI,WAC1C,iBAAiB,kBAAkB;EAAE;EAAQ,cAAc;EAAO;CAAQ,CAAC,CAC7E,GACA,iBAAiB,GAAG,4BAA4B,oBAAoB;EAClE,QAAQ;EACR,cAAc;EACd,UAAS,MAAK;GACZ,MAAM,UAAU,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,MAAM,EAAgC;GAClF,OAAO,EAAE,KAAK;IACZ,UAAU,GAAG,KAAK,eAAe;IACjC,uBAAuB,KAAK;IAC5B,0BAA0B,CAAC,QAAQ;IACnC,eAAe;GACjB,CAAC;EACH;CACF,CAAC,CACH;AACF"}

package/dist/provider-display-name.d.ts

@@ -0,0 +1,2 @@
+export declare function providerDisplayName(provider: string): string;
+//# sourceMappingURL=provider-display-name.d.ts.map

package/dist/provider-display-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-display-name.d.ts","sourceRoot":"","sources":["../src/provider-display-name.ts"],"names":[],"mappings":"AASA,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ5D"}

package/dist/provider-display-name.js

@@ -0,0 +1,16 @@
+//#region src/provider-display-name.ts
+const PROVIDER_DISPLAY_NAMES = {
+	anthropic: "Anthropic",
+	"github-copilot": "GitHub Copilot",
+	"kimi-code-plan-cn": "Kimi",
+	openai: "OpenAI",
+	"openai-codex": "OpenAI",
+	xai: "xAI"
+};
+function providerDisplayName(provider) {
+	return PROVIDER_DISPLAY_NAMES[provider] ?? provider.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+//#endregion
+export { providerDisplayName };
+
+//# sourceMappingURL=provider-display-name.js.map

package/dist/provider-display-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-display-name.js","names":[],"sources":["../src/provider-display-name.ts"],"sourcesContent":["const PROVIDER_DISPLAY_NAMES: Record<string, string> = {\n  anthropic: 'Anthropic',\n  'github-copilot': 'GitHub Copilot',\n  'kimi-code-plan-cn': 'Kimi',\n  openai: 'OpenAI',\n  'openai-codex': 'OpenAI',\n  xai: 'xAI',\n};\n\nexport function providerDisplayName(provider: string): string {\n  return (\n    PROVIDER_DISPLAY_NAMES[provider] ??\n    provider\n      .split('-')\n      .map(part => part.charAt(0).toUpperCase() + part.slice(1))\n      .join(' ')\n  );\n}\n"],"mappings":";AAAA,MAAM,yBAAiD;CACrD,WAAW;CACX,kBAAkB;CAClB,qBAAqB;CACrB,QAAQ;CACR,gBAAgB;CAChB,KAAK;AACP;AAEA,SAAgB,oBAAoB,UAA0B;CAC5D,OACE,uBAAuB,aACvB,SACG,MAAM,GAAG,CAAC,CACV,KAAI,SAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CACzD,KAAK,GAAG;AAEf"}

package/dist/routes/config.js

@@ -1,4 +1,4 @@
-import { WEB_OAUTH_FLOW_KINDS, getAuthProviderId, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId } from "./provider-credentials.js";
+import { WEB_OAUTH_PROVIDERS, getAuthProviderId, listTenantCredentialsForRequest, resolveCredentialContext, tenantOrgId } from "./provider-credentials.js";
 import { resolveFactoryModelPolicy } from "../session/credential-policy.js";
 import "../session/memory-settings-hydration.js";
 import { factoryMemorySettingsUserId } from "../storage/domains/memory-settings/base.js";
@@ -57,7 +57,7 @@ async function listProviders({ controller, authStorage, tenantCredentials, deplo
 		else if (authStorage?.hasStoredApiKey(model.provider)) source = "stored";
 		else if (model.apiKeyEnvVar && process.env[model.apiKeyEnvVar]) source = "env";
 		else if (model.hasApiKey) source = "env";
-		const flowKind = WEB_OAUTH_FLOW_KINDS[model.provider];
+		const flowKind = WEB_OAUTH_PROVIDERS[model.provider]?.flow;
 		seen.set(model.provider, {
 			provider: model.provider,
 			envVar: model.apiKeyEnvVar,