@mastra/factory 0.24.0-alpha.11 → 0.24.0-alpha.13

package/dist/routes/tenant-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-credentials.js","names":["#orgId","#userId","#scope","#credentials","#deploymentProviders","#fetchedAt","#hydrating","#hydrate","#snapshot"],"sources":["../../src/routes/tenant-credentials.ts"],"sourcesContent":["/**\n * Per-tenant credential store for model resolution (deployed mode).\n *\n * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a\n * store synchronously, so this module keeps a small per-tenant **snapshot** of\n * credentials from one exclusive scope hydrated from the `model-credentials`\n * domain. The snapshot serves the gateway's synchronous\n * path-selection reads (`get` / `getStoredApiKey`); the fetch-time\n * `getApiKey` is authoritative — it re-resolves against the domain and\n * refreshes expired OAuth tokens under the domain's row lock, so a slightly\n * stale snapshot can never send an expired token upstream.\n *\n * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted\n * after the web auth gate) so the first model call of a request already sees\n * the caller's credentials. This store explicitly disables the SDK's\n * environment fallback so server-shell credentials never leak into tenants.\n */\n\nimport type {\n  CredentialTenant as SdkCredentialTenant,\n  CredentialTenantResolver,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport {\n  prepareCredentialTenant,\n  resolveTenantFromRequestContext,\n  setCredentialStoreProvider,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport { getOAuthProvider, PROVIDER_DEFAULT_MODELS } from '@mastra/code-sdk/auth/storage';\nimport type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MiddlewareHandler } from 'hono';\n\nimport { isOAuthCredentialExpired } from '../storage/domains/credentials/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport { getAuthProviderId, getTenantCredentialsStorage, tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_TENANTS = 1000;\n\nexport class TenantCredentialStore implements CredentialStore {\n  readonly allowEnvironmentFallback = false;\n  readonly #orgId: string;\n  readonly #userId: string;\n  readonly #scope: SdkCredentialTenant['credentialScope'];\n  readonly #credentials: ModelCredentialsStorage | undefined;\n  readonly #deploymentProviders: ReadonlySet<string>;\n  #snapshot = new Map<string, AuthCredential>();\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(\n    orgId: string,\n    userId: string,\n    credentials: ModelCredentialsStorage | undefined,\n    scope: SdkCredentialTenant['credentialScope'],\n    deploymentProviders: ReadonlySet<string> = new Set(),\n  ) {\n    this.#orgId = orgId;\n    this.#userId = userId;\n    this.#credentials = credentials;\n    this.#scope = scope;\n    this.#deploymentProviders = deploymentProviders;\n  }\n\n  /** Providers the operator opted in to run on the server process's own credentials. */\n  allowsDeploymentCredentials(provider: string): boolean {\n    return this.#deploymentProviders.has(provider);\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) return; // Keep the last tenant-scoped snapshot.\n    const records = await storage.listCredentials(this.#orgId, this.#userId);\n    const next = new Map<string, AuthCredential>();\n    const storageScope = this.#scope === 'factory' ? 'org' : 'user';\n    for (const record of records.filter(r => r.scope === storageScope)) {\n      next.set(record.provider, record.credential);\n    }\n    this.#snapshot = next;\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  reload(): void {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n  }\n\n  get(provider: string): AuthCredential | undefined {\n    return this.#snapshot.get(provider);\n  }\n\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.#snapshot.get(provider);\n    return cred?.type === 'api_key' ? cred.key : undefined;\n  }\n\n  /**\n   * Authoritative fetch-time resolution: re-reads only the selected scope and\n   * refreshes expired OAuth tokens under the domain's row lock. Mirrors\n   * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or\n   * failed refresh (caller surfaces a re-login error).\n   */\n  async getApiKey(provider: string): Promise<string | undefined> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) {\n      // Domain unavailable: best effort from the snapshot; expired OAuth\n      // tokens cannot be refreshed without the domain's lock.\n      const cred = this.#snapshot.get(provider);\n      if (cred?.type === 'api_key') return cred.key;\n      if (cred?.type === 'oauth' && !isOAuthCredentialExpired(cred)) {\n        return getOAuthProvider(provider)?.getApiKey(cred);\n      }\n      return undefined;\n    }\n\n    const resolved = await storage.resolveCredential(\n      this.#orgId,\n      this.#userId,\n      provider,\n      this.#scope === 'factory' ? 'org' : 'user',\n    );\n    if (!resolved) {\n      this.#snapshot.delete(provider);\n      return undefined;\n    }\n    this.#snapshot.set(provider, resolved.credential);\n\n    if (resolved.credential.type === 'api_key') {\n      return resolved.credential.key;\n    }\n\n    const oauthProvider = getOAuthProvider(provider);\n    if (!oauthProvider) return undefined;\n\n    if (!isOAuthCredentialExpired(resolved.credential)) {\n      return oauthProvider.getApiKey(resolved.credential);\n    }\n\n    // Refresh at the scope the credential actually lives at (OAuth rows are\n    // user-scoped by policy, but resolve defensively from the record).\n    const rowTenant = resolved.scope === 'user' ? { orgId: this.#orgId, userId: this.#userId } : { orgId: this.#orgId };\n    try {\n      const refreshed = await storage.refreshOAuth(rowTenant, provider, async current => ({\n        type: 'oauth' as const,\n        ...(await oauthProvider.refreshToken(current)),\n      }));\n      if (!refreshed) return undefined;\n      this.#snapshot.set(provider, refreshed);\n      return oauthProvider.getApiKey(refreshed);\n    } catch {\n      // Refresh failed — user needs to re-login (same posture as AuthStorage).\n      return undefined;\n    }\n  }\n}\n\nconst tenantStores = new Map<string, TenantCredentialStore>();\nlet registeredCredentials: ModelCredentialsStorage | undefined;\nlet registeredDeploymentProviders: ReadonlySet<string> = new Set();\n\nfunction storeFor(tenant: SdkCredentialTenant, credentials: ModelCredentialsStorage): TenantCredentialStore {\n  const orgId = tenantOrgId(tenant);\n  const key = `${orgId}\\u0000${tenant.userId}\\u0000${tenant.credentialScope}`;\n  let store = tenantStores.get(key);\n  if (!store) {\n    if (tenantStores.size >= MAX_CACHED_TENANTS) {\n      const oldest = tenantStores.keys().next().value;\n      if (oldest !== undefined) tenantStores.delete(oldest);\n    }\n    store = new TenantCredentialStore(\n      orgId,\n      tenant.userId,\n      credentials,\n      tenant.credentialScope,\n      registeredDeploymentProviders,\n    );\n    tenantStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Register the web tenant credential store provider with the SDK. Called by\n * the factory after storage init with the `model-credentials` domain handle;\n * from then on `resolveModel` uses per-tenant credentials and the SDK skips\n * the `loadStoredApiKeysIntoEnv` env side-channel. `deploymentProviders` are\n * the providers the operator opted in to authenticate with the server\n * process's own credentials (see `MastraFactoryConfig.deploymentModelProviders`).\n */\nexport function registerTenantCredentialResolver(\n  credentials: ModelCredentialsStorage,\n  deploymentProviders: ReadonlySet<string> = new Set(),\n  resolveTenant?: CredentialTenantResolver,\n): void {\n  registeredCredentials = credentials;\n  registeredDeploymentProviders = deploymentProviders;\n  tenantStores.clear();\n  setCredentialStoreProvider(\n    tenant => storeFor(tenant, credentials),\n    resolveTenant\n      ? async requestContext => {\n          const tenant = await resolveTenant(requestContext);\n          if (tenant) await storeFor(tenant, credentials).ensureFresh();\n          return tenant;\n        }\n      : undefined,\n  );\n}\n\n/**\n * Prime the tenant stores for a request context built outside the web layer,\n * such as a webhook-triggered session run. The auth middleware does this for\n * HTTP requests; a run that starts without one would otherwise resolve its\n * model against an empty snapshot and fail closed. No-op before registration.\n */\nexport async function primeTenantCredentialsForRequestContext(requestContext: RequestContext): Promise<void> {\n  if (!registeredCredentials) return;\n  await prepareCredentialTenant(requestContext);\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) return;\n  await storeFor(tenant, registeredCredentials).ensureFresh();\n}\n\n/** Prime one already-resolved Factory session tenant before entering the agent run. */\nexport async function primeTenantCredentialsForTenant(tenant: SdkCredentialTenant): Promise<void> {\n  if (!registeredCredentials) return;\n  try {\n    await storeFor(tenant, registeredCredentials).ensureFresh();\n  } catch (error) {\n    console.warn('[factory] Failed to prime scoped tenant model credentials', {\n      orgId: tenant.orgId,\n      userId: tenant.userId,\n      credentialScope: tenant.credentialScope,\n      error,\n    });\n  }\n}\n\n/**\n * The model a session should fall back to when its scope has no chosen default:\n * the provider default (`PROVIDER_DEFAULT_MODELS`) of the first provider the\n * tenant is connected to. Returns `undefined` when `currentModelId` is already\n * usable, when no connected provider has a default, or before registration.\n */\nexport async function resolveTenantProviderDefaultModel(\n  tenant: SdkCredentialTenant,\n  currentModelId: string | undefined,\n): Promise<string | undefined> {\n  if (!registeredCredentials) return undefined;\n  const store = storeFor(tenant, registeredCredentials);\n  await store.ensureFresh();\n  const usable = (modelId: string) => {\n    const provider = modelId.split('/')[0] ?? '';\n    return store.get(getAuthProviderId(provider)) !== undefined || store.allowsDeploymentCredentials(provider);\n  };\n  if (currentModelId && usable(currentModelId)) return undefined;\n  return Object.entries(PROVIDER_DEFAULT_MODELS).find(([provider]) => store.get(provider) !== undefined)?.[1];\n}\n\n/** Test hook: clear registration and cached tenant snapshots. */\nexport function resetTenantCredentialResolverForTests(): void {\n  setCredentialStoreProvider(undefined);\n  registeredCredentials = undefined;\n  registeredDeploymentProviders = new Set();\n  tenantStores.clear();\n}\n\n/**\n * Drop cached snapshots after a credential write so the change is visible to\n * the next model call immediately instead of after the snapshot TTL. An org\n * write affects every member's resolved view, so all stores under the org are\n * invalidated; a user write only drops that user's store.\n */\nexport function invalidateTenantCredentialSnapshots(tenant: { orgId: string; userId?: string }): void {\n  if (tenant.userId) {\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}\\u0000user`);\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}\\u0000factory`);\n    return;\n  }\n  for (const key of tenantStores.keys()) {\n    if (key.startsWith(`${tenant.orgId}\\u0000`)) tenantStores.delete(key);\n  }\n}\n\n/**\n * Middleware mounted after the web auth gate: primes both exclusive credential\n * scopes because the HTTP principal is known before the controller session is.\n * Cheap when fresh because each store has a TTL.\n */\nexport async function primeTenantCredentials({\n  tenant,\n  credentials,\n}: {\n  tenant: Pick<SdkCredentialTenant, 'orgId' | 'userId'> & Partial<Pick<SdkCredentialTenant, 'credentialScope'>>;\n  credentials: ModelCredentialsStorage;\n}): Promise<void> {\n  await Promise.all([\n    storeFor({ ...tenant, credentialScope: 'user' }, credentials).ensureFresh(),\n    storeFor({ ...tenant, credentialScope: 'factory' }, credentials).ensureFresh(),\n  ]);\n}\n\nexport function createTenantCredentialPrimer({\n  auth,\n  credentials,\n}: {\n  auth: RouteAuth;\n  credentials: ModelCredentialsStorage;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const tenant = auth.tenant(c);\n    if (tenant) {\n      try {\n        await primeTenantCredentials({ tenant, credentials });\n      } catch (error) {\n        console.warn('[factory] Failed to prime tenant model credentials', {\n          orgId: tenant.orgId,\n          userId: tenant.userId,\n          error,\n        });\n      }\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAsCA,MAAM,kBAAkB;;AAGxB,MAAM,qBAAqB;AAE3B,IAAa,wBAAb,MAA8D;CAC5D,2BAAoC;CACpC;CACA;CACA;CACA;CACA;CACA,4BAAY,IAAI,IAA4B;CAC5C,aAAa;CACb;CAEA,YACE,OACA,QACA,aACA,OACA,sCAA2C,IAAI,IAAI,GACnD;EACA,KAAKA,SAAS;EACd,KAAKC,UAAU;EACf,KAAKE,eAAe;EACpB,KAAKD,SAAS;EACd,KAAKE,uBAAuB;CAC9B;;CAGA,4BAA4B,UAA2B;EACrD,OAAO,KAAKA,qBAAqB,IAAI,QAAQ;CAC/C;;CAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;EACjD,IAAI,MAAM,KAAKC,aAAa,iBAAiB;EAC7C,KAAKC,eAAe,KAAKC,SAAS,CAAC,CAAC,cAAc;GAChD,KAAKD,aAAa,KAAA;EACpB,CAAC;EACD,MAAM,KAAKA;CACb;CAEA,MAAMC,WAA0B;EAC9B,MAAM,UAAU,MAAM,4BAA4B,KAAKJ,YAAY;EACnE,IAAI,CAAC,SAAS;EACd,MAAM,UAAU,MAAM,QAAQ,gBAAgB,KAAKH,QAAQ,KAAKC,OAAO;EACvE,MAAM,uBAAO,IAAI,IAA4B;EAC7C,MAAM,eAAe,KAAKC,WAAW,YAAY,QAAQ;EACzD,KAAK,MAAM,UAAU,QAAQ,QAAO,MAAK,EAAE,UAAU,YAAY,GAC/D,KAAK,IAAI,OAAO,UAAU,OAAO,UAAU;EAE7C,KAAKM,YAAY;EACjB,KAAKH,aAAa,KAAK,IAAI;CAC7B;;CAGA,SAAe;EACb,IAAI,KAAK,IAAI,IAAI,KAAKA,cAAc,iBAClC,KAAU,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;CAE1C;CAEA,IAAI,UAA8C;EAChD,OAAO,KAAKG,UAAU,IAAI,QAAQ;CACpC;CAEA,gBAAgB,UAAsC;EACpD,MAAM,OAAO,KAAKA,UAAU,IAAI,QAAQ;EACxC,OAAO,MAAM,SAAS,YAAY,KAAK,MAAM,KAAA;CAC/C;;;;;;;CAQA,MAAM,UAAU,UAA+C;EAC7D,MAAM,UAAU,MAAM,4BAA4B,KAAKL,YAAY;EACnE,IAAI,CAAC,SAAS;GAGZ,MAAM,OAAO,KAAKK,UAAU,IAAI,QAAQ;GACxC,IAAI,MAAM,SAAS,WAAW,OAAO,KAAK;GAC1C,IAAI,MAAM,SAAS,WAAW,CAAC,yBAAyB,IAAI,GAC1D,OAAO,iBAAiB,QAAQ,CAAC,EAAE,UAAU,IAAI;GAEnD;EACF;EAEA,MAAM,WAAW,MAAM,QAAQ,kBAC7B,KAAKR,QACL,KAAKC,SACL,UACA,KAAKC,WAAW,YAAY,QAAQ,MACtC;EACA,IAAI,CAAC,UAAU;GACb,KAAKM,UAAU,OAAO,QAAQ;GAC9B;EACF;EACA,KAAKA,UAAU,IAAI,UAAU,SAAS,UAAU;EAEhD,IAAI,SAAS,WAAW,SAAS,WAC/B,OAAO,SAAS,WAAW;EAG7B,MAAM,gBAAgB,iBAAiB,QAAQ;EAC/C,IAAI,CAAC,eAAe,OAAO,KAAA;EAE3B,IAAI,CAAC,yBAAyB,SAAS,UAAU,GAC/C,OAAO,cAAc,UAAU,SAAS,UAAU;EAKpD,MAAM,YAAY,SAAS,UAAU,SAAS;GAAE,OAAO,KAAKR;GAAQ,QAAQ,KAAKC;EAAQ,IAAI,EAAE,OAAO,KAAKD,OAAO;EAClH,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,aAAa,WAAW,UAAU,OAAM,aAAY;IAClF,MAAM;IACN,GAAI,MAAM,cAAc,aAAa,OAAO;GAC9C,EAAE;GACF,IAAI,CAAC,WAAW,OAAO,KAAA;GACvB,KAAKQ,UAAU,IAAI,UAAU,SAAS;GACtC,OAAO,cAAc,UAAU,SAAS;EAC1C,QAAQ;GAEN;EACF;CACF;AACF;AAEA,MAAM,+BAAe,IAAI,IAAmC;AAC5D,IAAI;AACJ,IAAI,gDAAqD,IAAI,IAAI;AAEjE,SAAS,SAAS,QAA6B,aAA6D;CAC1G,MAAM,QAAQ,YAAY,MAAM;CAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,OAAO,OAAO,QAAQ,OAAO;CAC1D,IAAI,QAAQ,aAAa,IAAI,GAAG;CAChC,IAAI,CAAC,OAAO;EACV,IAAI,aAAa,QAAQ,oBAAoB;GAC3C,MAAM,SAAS,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,IAAI,WAAW,KAAA,GAAW,aAAa,OAAO,MAAM;EACtD;EACA,QAAQ,IAAI,sBACV,OACA,OAAO,QACP,aACA,OAAO,iBACP,6BACF;EACA,aAAa,IAAI,KAAK,KAAK;CAC7B;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,iCACd,aACA,sCAA2C,IAAI,IAAI,GACnD,eACM;CACN,wBAAwB;CACxB,gCAAgC;CAChC,aAAa,MAAM;CACnB,4BACE,WAAU,SAAS,QAAQ,WAAW,GACtC,gBACI,OAAM,mBAAkB;EACtB,MAAM,SAAS,MAAM,cAAc,cAAc;EACjD,IAAI,QAAQ,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,YAAY;EAC5D,OAAO;CACT,IACA,KAAA,CACN;AACF;;;;;;;AAQA,eAAsB,wCAAwC,gBAA+C;CAC3G,IAAI,CAAC,uBAAuB;CAC5B,MAAM,wBAAwB,cAAc;CAC5C,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;CACb,MAAM,SAAS,QAAQ,qBAAqB,CAAC,CAAC,YAAY;AAC5D;;AAGA,eAAsB,gCAAgC,QAA4C;CAChG,IAAI,CAAC,uBAAuB;CAC5B,IAAI;EACF,MAAM,SAAS,QAAQ,qBAAqB,CAAC,CAAC,YAAY;CAC5D,SAAS,OAAO;EACd,QAAQ,KAAK,6DAA6D;GACxE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,iBAAiB,OAAO;GACxB;EACF,CAAC;CACH;AACF;;;;;;;AAQA,eAAsB,kCACpB,QACA,gBAC6B;CAC7B,IAAI,CAAC,uBAAuB,OAAO,KAAA;CACnC,MAAM,QAAQ,SAAS,QAAQ,qBAAqB;CACpD,MAAM,MAAM,YAAY;CACxB,MAAM,UAAU,YAAoB;EAClC,MAAM,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM;EAC1C,OAAO,MAAM,IAAI,kBAAkB,QAAQ,CAAC,MAAM,KAAA,KAAa,MAAM,4BAA4B,QAAQ;CAC3G;CACA,IAAI,kBAAkB,OAAO,cAAc,GAAG,OAAO,KAAA;CACrD,OAAO,OAAO,QAAQ,uBAAuB,CAAC,CAAC,MAAM,CAAC,cAAc,MAAM,IAAI,QAAQ,MAAM,KAAA,CAAS,CAAC,GAAG;AAC3G;;AAGA,SAAgB,wCAA8C;CAC5D,2BAA2B,KAAA,CAAS;CACpC,wBAAwB,KAAA;CACxB,gDAAgC,IAAI,IAAI;CACxC,aAAa,MAAM;AACrB;;;;;;;AAQA,SAAgB,oCAAoC,QAAkD;CACpG,IAAI,OAAO,QAAQ;EACjB,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrE,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,cAAc;EACxE;CACF;CACA,KAAK,MAAM,OAAO,aAAa,KAAK,GAClC,IAAI,IAAI,WAAW,GAAG,OAAO,MAAM,OAAO,GAAG,aAAa,OAAO,GAAG;AAExE;;;;;;AAOA,eAAsB,uBAAuB,EAC3C,QACA,eAIgB;CAChB,MAAM,QAAQ,IAAI,CAChB,SAAS;EAAE,GAAG;EAAQ,iBAAiB;CAAO,GAAG,WAAW,CAAC,CAAC,YAAY,GAC1E,SAAS;EAAE,GAAG;EAAQ,iBAAiB;CAAU,GAAG,WAAW,CAAC,CAAC,YAAY,CAC/E,CAAC;AACH;AAEA,SAAgB,6BAA6B,EAC3C,MACA,eAIoB;CACpB,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,SAAS,KAAK,OAAO,CAAC;EAC5B,IAAI,QACF,IAAI;GACF,MAAM,uBAAuB;IAAE;IAAQ;GAAY,CAAC;EACtD,SAAS,OAAO;GACd,QAAQ,KAAK,sDAAsD;IACjE,OAAO,OAAO;IACd,QAAQ,OAAO;IACf;GACF,CAAC;EACH;EAEF,MAAM,KAAK;CACb;AACF"}
+{"version":3,"file":"tenant-credentials.js","names":[],"sources":["../../src/routes/tenant-credentials.ts"],"sourcesContent":["/**\n * Per-tenant credential store for model resolution (deployed mode).\n *\n * The SDK's `resolveModel` asks the registered `CredentialStoreProvider` for a\n * store synchronously, so this module keeps a small per-tenant **snapshot** of\n * credentials from one exclusive scope hydrated from the `model-credentials`\n * domain. The snapshot serves the gateway's synchronous\n * path-selection reads (`get` / `getStoredApiKey`); the fetch-time\n * `getApiKey` is authoritative — it re-resolves against the domain and\n * refreshes expired OAuth tokens under the domain's row lock, so a slightly\n * stale snapshot can never send an expired token upstream.\n *\n * Snapshots are primed per request by `createTenantCredentialPrimer` (mounted\n * after the web auth gate) so the first model call of a request already sees\n * the caller's credentials. This store explicitly disables the SDK's\n * environment fallback so server-shell credentials never leak into tenants.\n */\n\nimport type {\n  CredentialTenant as SdkCredentialTenant,\n  CredentialTenantResolver,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport {\n  prepareCredentialTenant,\n  resolveTenantFromRequestContext,\n  setCredentialStoreProvider,\n} from '@mastra/code-sdk/agents/credential-resolver';\nimport { getOAuthProvider, PROVIDER_DEFAULT_MODELS } from '@mastra/code-sdk/auth/storage';\nimport type { AuthCredential, CredentialStore } from '@mastra/code-sdk/auth/types';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { MiddlewareHandler } from 'hono';\n\nimport { isOAuthCredentialExpired } from '../storage/domains/credentials/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport { getAuthProviderId, getTenantCredentialsStorage, tenantOrgId } from './provider-credentials.js';\nimport type { RouteAuth } from './route.js';\n\n/** How long a hydrated snapshot is considered fresh. */\nconst SNAPSHOT_TTL_MS = 15_000;\n\n/** Cap on cached tenant stores; oldest-inserted evicted beyond this. */\nconst MAX_CACHED_TENANTS = 1000;\n\nexport class TenantCredentialStore implements CredentialStore {\n  readonly allowEnvironmentFallback = false;\n  readonly #orgId: string;\n  readonly #userId: string;\n  readonly #scope: SdkCredentialTenant['credentialScope'];\n  readonly #credentials: ModelCredentialsStorage | undefined;\n  readonly #deploymentProviders: ReadonlySet<string>;\n  #snapshot = new Map<string, AuthCredential>();\n  #fetchedAt = 0;\n  #hydrating: Promise<void> | undefined;\n\n  constructor(\n    orgId: string,\n    userId: string,\n    credentials: ModelCredentialsStorage | undefined,\n    scope: SdkCredentialTenant['credentialScope'],\n    deploymentProviders: ReadonlySet<string> = new Set(),\n  ) {\n    this.#orgId = orgId;\n    this.#userId = userId;\n    this.#credentials = credentials;\n    this.#scope = scope;\n    this.#deploymentProviders = deploymentProviders;\n  }\n\n  /** Providers the operator opted in to run on the server process's own credentials. */\n  allowsDeploymentCredentials(provider: string): boolean {\n    return this.#deploymentProviders.has(provider);\n  }\n\n  /** Hydrate the snapshot when stale; coalesces concurrent callers. */\n  async ensureFresh(now = Date.now()): Promise<void> {\n    if (now - this.#fetchedAt < SNAPSHOT_TTL_MS) return;\n    this.#hydrating ??= this.#hydrate().finally(() => {\n      this.#hydrating = undefined;\n    });\n    await this.#hydrating;\n  }\n\n  async #hydrate(): Promise<void> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) return; // Keep the last tenant-scoped snapshot.\n    const records = await storage.listCredentials(this.#orgId, this.#userId);\n    const next = new Map<string, AuthCredential>();\n    const storageScope = this.#scope === 'factory' ? 'org' : 'user';\n    for (const record of records.filter(r => r.scope === storageScope)) {\n      next.set(record.provider, record.credential);\n    }\n    this.#snapshot = next;\n    this.#fetchedAt = Date.now();\n  }\n\n  /** Sync by contract; kicks a background re-hydrate when the snapshot is stale. */\n  reload(): void {\n    if (Date.now() - this.#fetchedAt >= SNAPSHOT_TTL_MS) {\n      void this.ensureFresh().catch(() => {});\n    }\n  }\n\n  get(provider: string): AuthCredential | undefined {\n    return this.#snapshot.get(provider);\n  }\n\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.#snapshot.get(provider);\n    return cred?.type === 'api_key' ? cred.key : undefined;\n  }\n\n  /**\n   * Authoritative fetch-time resolution: re-reads only the selected scope and\n   * refreshes expired OAuth tokens under the domain's row lock. Mirrors\n   * `AuthStorage.getApiKey` semantics: `undefined` on missing credential or\n   * failed refresh (caller surfaces a re-login error).\n   */\n  async getApiKey(provider: string): Promise<string | undefined> {\n    const storage = await getTenantCredentialsStorage(this.#credentials);\n    if (!storage) {\n      // Domain unavailable: best effort from the snapshot; expired OAuth\n      // tokens cannot be refreshed without the domain's lock.\n      const cred = this.#snapshot.get(provider);\n      if (cred?.type === 'api_key') return cred.key;\n      if (cred?.type === 'oauth' && !isOAuthCredentialExpired(cred)) {\n        return getOAuthProvider(provider)?.getApiKey(cred);\n      }\n      return undefined;\n    }\n\n    const resolved = await storage.resolveCredential(\n      this.#orgId,\n      this.#userId,\n      provider,\n      this.#scope === 'factory' ? 'org' : 'user',\n    );\n    if (!resolved) {\n      this.#snapshot.delete(provider);\n      return undefined;\n    }\n    this.#snapshot.set(provider, resolved.credential);\n\n    if (resolved.credential.type === 'api_key') {\n      return resolved.credential.key;\n    }\n\n    const oauthProvider = getOAuthProvider(provider);\n    if (!oauthProvider) return undefined;\n\n    if (!isOAuthCredentialExpired(resolved.credential)) {\n      return oauthProvider.getApiKey(resolved.credential);\n    }\n\n    // Refresh at the scope the credential actually lives at (OAuth rows are\n    // user-scoped by policy, but resolve defensively from the record).\n    const rowTenant = resolved.scope === 'user' ? { orgId: this.#orgId, userId: this.#userId } : { orgId: this.#orgId };\n    try {\n      const refreshed = await storage.refreshOAuth(rowTenant, provider, async current => ({\n        type: 'oauth' as const,\n        ...(await oauthProvider.refreshToken(current)),\n      }));\n      if (!refreshed) return undefined;\n      this.#snapshot.set(provider, refreshed);\n      return oauthProvider.getApiKey(refreshed);\n    } catch {\n      // Refresh failed — user needs to re-login (same posture as AuthStorage).\n      return undefined;\n    }\n  }\n}\n\nconst tenantStores = new Map<string, TenantCredentialStore>();\nlet registeredCredentials: ModelCredentialsStorage | undefined;\nlet registeredDeploymentProviders: ReadonlySet<string> = new Set();\n\nfunction storeFor(tenant: SdkCredentialTenant, credentials: ModelCredentialsStorage): TenantCredentialStore {\n  const orgId = tenantOrgId(tenant);\n  const key = `${orgId}\\u0000${tenant.userId}\\u0000${tenant.credentialScope}`;\n  let store = tenantStores.get(key);\n  if (!store) {\n    if (tenantStores.size >= MAX_CACHED_TENANTS) {\n      const oldest = tenantStores.keys().next().value;\n      if (oldest !== undefined) tenantStores.delete(oldest);\n    }\n    store = new TenantCredentialStore(\n      orgId,\n      tenant.userId,\n      credentials,\n      tenant.credentialScope,\n      registeredDeploymentProviders,\n    );\n    tenantStores.set(key, store);\n  }\n  return store;\n}\n\n/**\n * Register the web tenant credential store provider with the SDK. Called by\n * the factory after storage init with the `model-credentials` domain handle;\n * from then on `resolveModel` uses per-tenant credentials and the SDK skips\n * the `loadStoredApiKeysIntoEnv` env side-channel. `deploymentProviders` are\n * the providers the operator opted in to authenticate with the server\n * process's own credentials (see `MastraFactoryConfig.deploymentModelProviders`).\n */\nexport function registerTenantCredentialResolver(\n  credentials: ModelCredentialsStorage,\n  deploymentProviders: ReadonlySet<string> = new Set(),\n  resolveTenant?: CredentialTenantResolver,\n): void {\n  registeredCredentials = credentials;\n  registeredDeploymentProviders = deploymentProviders;\n  tenantStores.clear();\n  setCredentialStoreProvider(\n    tenant => storeFor(tenant, credentials),\n    resolveTenant\n      ? async requestContext => {\n          const tenant = await resolveTenant(requestContext);\n          if (tenant) await storeFor(tenant, credentials).ensureFresh();\n          return tenant;\n        }\n      : undefined,\n  );\n}\n\n/**\n * Prime the tenant stores for a request context built outside the web layer,\n * such as a webhook-triggered session run. The auth middleware does this for\n * HTTP requests; a run that starts without one would otherwise resolve its\n * model against an empty snapshot and fail closed. No-op before registration.\n */\nexport async function primeTenantCredentialsForRequestContext(requestContext: RequestContext): Promise<void> {\n  if (!registeredCredentials) return;\n  await prepareCredentialTenant(requestContext);\n  const tenant = resolveTenantFromRequestContext(requestContext);\n  if (!tenant) return;\n  await storeFor(tenant, registeredCredentials).ensureFresh();\n}\n\n/** Prime one already-resolved Factory session tenant before entering the agent run. */\nexport async function primeTenantCredentialsForTenant(tenant: SdkCredentialTenant): Promise<void> {\n  if (!registeredCredentials) return;\n  try {\n    await storeFor(tenant, registeredCredentials).ensureFresh();\n  } catch (error) {\n    console.warn('[factory] Failed to prime scoped tenant model credentials', {\n      orgId: tenant.orgId,\n      userId: tenant.userId,\n      credentialScope: tenant.credentialScope,\n      error,\n    });\n  }\n}\n\n/**\n * The model a session should fall back to when its scope has no chosen default:\n * the provider default (`PROVIDER_DEFAULT_MODELS`) of the first provider the\n * tenant is connected to. Returns `undefined` when `currentModelId` is already\n * usable, when no connected provider has a default, or before registration.\n */\nexport async function resolveTenantProviderDefaultModel(\n  tenant: SdkCredentialTenant,\n  currentModelId: string | undefined,\n): Promise<string | undefined> {\n  if (!registeredCredentials) return undefined;\n  const store = storeFor(tenant, registeredCredentials);\n  await store.ensureFresh();\n  const usable = (modelId: string) => {\n    const provider = modelId.split('/')[0] ?? '';\n    return store.get(getAuthProviderId(provider)) !== undefined || store.allowsDeploymentCredentials(provider);\n  };\n  if (currentModelId && usable(currentModelId)) return undefined;\n  return Object.entries(PROVIDER_DEFAULT_MODELS).find(([provider]) => store.get(provider) !== undefined)?.[1];\n}\n\n/** Test hook: clear registration and cached tenant snapshots. */\nexport function resetTenantCredentialResolverForTests(): void {\n  setCredentialStoreProvider(undefined);\n  registeredCredentials = undefined;\n  registeredDeploymentProviders = new Set();\n  tenantStores.clear();\n}\n\n/**\n * Drop cached snapshots after a credential write so the change is visible to\n * the next model call immediately instead of after the snapshot TTL. An org\n * write affects every member's resolved view, so all stores under the org are\n * invalidated; a user write only drops that user's store.\n */\nexport function invalidateTenantCredentialSnapshots(tenant: { orgId: string; userId?: string }): void {\n  if (tenant.userId) {\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}\\u0000user`);\n    tenantStores.delete(`${tenant.orgId}\\u0000${tenant.userId}\\u0000factory`);\n    return;\n  }\n  for (const key of tenantStores.keys()) {\n    if (key.startsWith(`${tenant.orgId}\\u0000`)) tenantStores.delete(key);\n  }\n}\n\n/**\n * Middleware mounted after the web auth gate: primes both exclusive credential\n * scopes because the HTTP principal is known before the controller session is.\n * Cheap when fresh because each store has a TTL.\n */\nexport async function primeTenantCredentials({\n  tenant,\n  credentials,\n}: {\n  tenant: Pick<SdkCredentialTenant, 'orgId' | 'userId'> & Partial<Pick<SdkCredentialTenant, 'credentialScope'>>;\n  credentials: ModelCredentialsStorage;\n}): Promise<void> {\n  await Promise.all([\n    storeFor({ ...tenant, credentialScope: 'user' }, credentials).ensureFresh(),\n    storeFor({ ...tenant, credentialScope: 'factory' }, credentials).ensureFresh(),\n  ]);\n}\n\nexport function createTenantCredentialPrimer({\n  auth,\n  credentials,\n}: {\n  auth: RouteAuth;\n  credentials: ModelCredentialsStorage;\n}): MiddlewareHandler {\n  return async (c, next) => {\n    const tenant = auth.tenant(c);\n    if (tenant) {\n      try {\n        await primeTenantCredentials({ tenant, credentials });\n      } catch (error) {\n        console.warn('[factory] Failed to prime tenant model credentials', {\n          orgId: tenant.orgId,\n          userId: tenant.userId,\n          error,\n        });\n      }\n    }\n    await next();\n  };\n}\n"],"mappings":";;;;;;AAsCA,MAAM,kBAAkB;;AAGxB,MAAM,qBAAqB;AAE3B,IAAa,wBAAb,MAA8D;CAC5D,2BAAoC;CACpC;CACA;CACA;CACA;CACA;CACA,4BAAY,IAAI,IAA4B;CAC5C,aAAa;CACb;CAEA,YACE,OACA,QACA,aACA,OACA,sCAA2C,IAAI,IAAI,GACnD;EACA,KAAK,SAAS;EACd,KAAK,UAAU;EACf,KAAK,eAAe;EACpB,KAAK,SAAS;EACd,KAAK,uBAAuB;CAC9B;;CAGA,4BAA4B,UAA2B;EACrD,OAAO,KAAK,qBAAqB,IAAI,QAAQ;CAC/C;;CAGA,MAAM,YAAY,MAAM,KAAK,IAAI,GAAkB;EACjD,IAAI,MAAM,KAAK,aAAa,iBAAiB;EAC7C,KAAK,eAAe,KAAK,SAAS,CAAC,CAAC,cAAc;GAChD,KAAK,aAAa,KAAA;EACpB,CAAC;EACD,MAAM,KAAK;CACb;CAEA,MAAM,WAA0B;EAC9B,MAAM,UAAU,MAAM,4BAA4B,KAAK,YAAY;EACnE,IAAI,CAAC,SAAS;EACd,MAAM,UAAU,MAAM,QAAQ,gBAAgB,KAAK,QAAQ,KAAK,OAAO;EACvE,MAAM,uBAAO,IAAI,IAA4B;EAC7C,MAAM,eAAe,KAAK,WAAW,YAAY,QAAQ;EACzD,KAAK,MAAM,UAAU,QAAQ,QAAO,MAAK,EAAE,UAAU,YAAY,GAC/D,KAAK,IAAI,OAAO,UAAU,OAAO,UAAU;EAE7C,KAAK,YAAY;EACjB,KAAK,aAAa,KAAK,IAAI;CAC7B;;CAGA,SAAe;EACb,IAAI,KAAK,IAAI,IAAI,KAAK,cAAc,iBAClC,KAAU,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;CAE1C;CAEA,IAAI,UAA8C;EAChD,OAAO,KAAK,UAAU,IAAI,QAAQ;CACpC;CAEA,gBAAgB,UAAsC;EACpD,MAAM,OAAO,KAAK,UAAU,IAAI,QAAQ;EACxC,OAAO,MAAM,SAAS,YAAY,KAAK,MAAM,KAAA;CAC/C;;;;;;;CAQA,MAAM,UAAU,UAA+C;EAC7D,MAAM,UAAU,MAAM,4BAA4B,KAAK,YAAY;EACnE,IAAI,CAAC,SAAS;GAGZ,MAAM,OAAO,KAAK,UAAU,IAAI,QAAQ;GACxC,IAAI,MAAM,SAAS,WAAW,OAAO,KAAK;GAC1C,IAAI,MAAM,SAAS,WAAW,CAAC,yBAAyB,IAAI,GAC1D,OAAO,iBAAiB,QAAQ,CAAC,EAAE,UAAU,IAAI;GAEnD;EACF;EAEA,MAAM,WAAW,MAAM,QAAQ,kBAC7B,KAAK,QACL,KAAK,SACL,UACA,KAAK,WAAW,YAAY,QAAQ,MACtC;EACA,IAAI,CAAC,UAAU;GACb,KAAK,UAAU,OAAO,QAAQ;GAC9B;EACF;EACA,KAAK,UAAU,IAAI,UAAU,SAAS,UAAU;EAEhD,IAAI,SAAS,WAAW,SAAS,WAC/B,OAAO,SAAS,WAAW;EAG7B,MAAM,gBAAgB,iBAAiB,QAAQ;EAC/C,IAAI,CAAC,eAAe,OAAO,KAAA;EAE3B,IAAI,CAAC,yBAAyB,SAAS,UAAU,GAC/C,OAAO,cAAc,UAAU,SAAS,UAAU;EAKpD,MAAM,YAAY,SAAS,UAAU,SAAS;GAAE,OAAO,KAAK;GAAQ,QAAQ,KAAK;EAAQ,IAAI,EAAE,OAAO,KAAK,OAAO;EAClH,IAAI;GACF,MAAM,YAAY,MAAM,QAAQ,aAAa,WAAW,UAAU,OAAM,aAAY;IAClF,MAAM;IACN,GAAI,MAAM,cAAc,aAAa,OAAO;GAC9C,EAAE;GACF,IAAI,CAAC,WAAW,OAAO,KAAA;GACvB,KAAK,UAAU,IAAI,UAAU,SAAS;GACtC,OAAO,cAAc,UAAU,SAAS;EAC1C,QAAQ;GAEN;EACF;CACF;AACF;AAEA,MAAM,+BAAe,IAAI,IAAmC;AAC5D,IAAI;AACJ,IAAI,gDAAqD,IAAI,IAAI;AAEjE,SAAS,SAAS,QAA6B,aAA6D;CAC1G,MAAM,QAAQ,YAAY,MAAM;CAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,OAAO,OAAO,QAAQ,OAAO;CAC1D,IAAI,QAAQ,aAAa,IAAI,GAAG;CAChC,IAAI,CAAC,OAAO;EACV,IAAI,aAAa,QAAQ,oBAAoB;GAC3C,MAAM,SAAS,aAAa,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;GAC1C,IAAI,WAAW,KAAA,GAAW,aAAa,OAAO,MAAM;EACtD;EACA,QAAQ,IAAI,sBACV,OACA,OAAO,QACP,aACA,OAAO,iBACP,6BACF;EACA,aAAa,IAAI,KAAK,KAAK;CAC7B;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,iCACd,aACA,sCAA2C,IAAI,IAAI,GACnD,eACM;CACN,wBAAwB;CACxB,gCAAgC;CAChC,aAAa,MAAM;CACnB,4BACE,WAAU,SAAS,QAAQ,WAAW,GACtC,gBACI,OAAM,mBAAkB;EACtB,MAAM,SAAS,MAAM,cAAc,cAAc;EACjD,IAAI,QAAQ,MAAM,SAAS,QAAQ,WAAW,CAAC,CAAC,YAAY;EAC5D,OAAO;CACT,IACA,KAAA,CACN;AACF;;;;;;;AAQA,eAAsB,wCAAwC,gBAA+C;CAC3G,IAAI,CAAC,uBAAuB;CAC5B,MAAM,wBAAwB,cAAc;CAC5C,MAAM,SAAS,gCAAgC,cAAc;CAC7D,IAAI,CAAC,QAAQ;CACb,MAAM,SAAS,QAAQ,qBAAqB,CAAC,CAAC,YAAY;AAC5D;;AAGA,eAAsB,gCAAgC,QAA4C;CAChG,IAAI,CAAC,uBAAuB;CAC5B,IAAI;EACF,MAAM,SAAS,QAAQ,qBAAqB,CAAC,CAAC,YAAY;CAC5D,SAAS,OAAO;EACd,QAAQ,KAAK,6DAA6D;GACxE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,iBAAiB,OAAO;GACxB;EACF,CAAC;CACH;AACF;;;;;;;AAQA,eAAsB,kCACpB,QACA,gBAC6B;CAC7B,IAAI,CAAC,uBAAuB,OAAO,KAAA;CACnC,MAAM,QAAQ,SAAS,QAAQ,qBAAqB;CACpD,MAAM,MAAM,YAAY;CACxB,MAAM,UAAU,YAAoB;EAClC,MAAM,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM;EAC1C,OAAO,MAAM,IAAI,kBAAkB,QAAQ,CAAC,MAAM,KAAA,KAAa,MAAM,4BAA4B,QAAQ;CAC3G;CACA,IAAI,kBAAkB,OAAO,cAAc,GAAG,OAAO,KAAA;CACrD,OAAO,OAAO,QAAQ,uBAAuB,CAAC,CAAC,MAAM,CAAC,cAAc,MAAM,IAAI,QAAQ,MAAM,KAAA,CAAS,CAAC,GAAG;AAC3G;;AAGA,SAAgB,wCAA8C;CAC5D,2BAA2B,KAAA,CAAS;CACpC,wBAAwB,KAAA;CACxB,gDAAgC,IAAI,IAAI;CACxC,aAAa,MAAM;AACrB;;;;;;;AAQA,SAAgB,oCAAoC,QAAkD;CACpG,IAAI,OAAO,QAAQ;EACjB,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,WAAW;EACrE,aAAa,OAAO,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,cAAc;EACxE;CACF;CACA,KAAK,MAAM,OAAO,aAAa,KAAK,GAClC,IAAI,IAAI,WAAW,GAAG,OAAO,MAAM,OAAO,GAAG,aAAa,OAAO,GAAG;AAExE;;;;;;AAOA,eAAsB,uBAAuB,EAC3C,QACA,eAIgB;CAChB,MAAM,QAAQ,IAAI,CAChB,SAAS;EAAE,GAAG;EAAQ,iBAAiB;CAAO,GAAG,WAAW,CAAC,CAAC,YAAY,GAC1E,SAAS;EAAE,GAAG;EAAQ,iBAAiB;CAAU,GAAG,WAAW,CAAC,CAAC,YAAY,CAC/E,CAAC;AACH;AAEA,SAAgB,6BAA6B,EAC3C,MACA,eAIoB;CACpB,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,SAAS,KAAK,OAAO,CAAC;EAC5B,IAAI,QACF,IAAI;GACF,MAAM,uBAAuB;IAAE;IAAQ;GAAY,CAAC;EACtD,SAAS,OAAO;GACd,QAAQ,KAAK,sDAAsD;IACjE,OAAO,OAAO;IACd,QAAQ,OAAO;IACf;GACF,CAAC;EACH;EAEF,MAAM,KAAK;CACb;AACF"}

package/dist/routes/work-items.js.map

@@ -1 +1 @@
-{"version":3,"file":"work-items.js","names":["#boards","#defaultBoards","#resolveTenant","#resolveProject","#auditWorkItemPatch","#proposalRoute"],"sources":["../../src/routes/work-items.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for Factory work items (the kanban board).\n *\n * Registered alongside the other `/web/*` routes behind the host auth gate.\n * The board is org-wide: every route re-resolves the caller's `(orgId, userId)`\n * tenant and scopes reads/writes by `orgId`, so any org member sees and moves\n * the same cards while `created_by` / stage history record who acted.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { createBoardRegistry } from '../boards/index.js';\nimport type { BoardRegistry } from '../boards/index.js';\nimport { EXTERNAL_SOURCE_MISSING_KEY } from '../integrations/issue-reconciler.js';\nimport { decisionRetryable, overtakenDecisionIds } from '../rules/decision-applicability.js';\nimport type {\n  FactoryStartCoordinator,\n  FactoryStartPreparedResult,\n  FactoryStartRequest,\n} from '../rules/start-coordinator.js';\nimport { FactoryStartTransitionError, WorkItemRepositoryError } from '../rules/start-coordinator.js';\nimport type { FactoryTransitionRequest, FactoryTransitionService } from '../rules/transition-service.js';\nimport type { WorkItemSource } from '../rules/types.js';\nimport type { LiveSessions } from '../session/live-sessions.js';\nimport { auditRequestOrigin } from '../storage/domains/audit/domain.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport { effectiveModelScope } from '../storage/domains/projects/base.js';\nimport type { EffectiveModelScope, FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport { thresholdsOrDefault } from '../storage/domains/queue-health/base.js';\nimport type {\n  CreateWorkItemInput,\n  FactoryDeferredDecisionRecord,\n  UpdateWorkItemInput,\n  WorkItemRow,\n  WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\nimport {\n  FACTORY_PULL_REQUEST_RECONCILIATION_KEY,\n  FACTORY_RULE_MATERIALIZATION_KEY,\n  WorkItemRelationError,\n  WorkItemUpdateConflictError,\n} from '../storage/domains/work-items/base.js';\nimport { computeFactoryMetrics, parseMetricsRange } from '../storage/domains/work-items/metrics.js';\nimport { createFactoryWorkItem } from '../work-items/create-work-item.js';\nimport { resolveFactoryProposal, retryFactoryDecision } from '../work-items/decision-actions.js';\nimport { buildAttentionRoutes, factoryDecisionType } from './attention.js';\nimport { FACTORY_ROUTE_CONTRACTS } from './contracts.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface WorkItemRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Factory projects domain — validates the `:id` project belongs to the caller's org. */\n  projects: FactoryProjectsStorage;\n  /** Work-items domain backing the kanban board. */\n  workItems: WorkItemsStorage;\n  /** Boards installed for this Factory instance. */\n  boardRegistry?: BoardRegistry;\n  /** Comments domain — backs the mention attention provider. */\n  comments: WorkItemCommentsStorage;\n  /** Per-project queue-health threshold config. */\n  queueHealth: QueueHealthStorage;\n  /** Governed stage-transition service. Stage moves 503 when absent. */\n  transitionService?: Pick<FactoryTransitionService, 'transition' | 'configVersion'>;\n  /** Coordinator that binds a Factory run before dispatching its kickoff. */\n  startCoordinator?: Pick<FactoryStartCoordinator, 'prepare'>;\n  /** Materialized sessions, read to report which of the listed cards are being worked or wait on someone. */\n  liveSessions: Pick<LiveSessions, 'isRunning' | 'parked' | 'parkedIn'>;\n}\n\n/** The card as clients see it, without the dispatcher's internal bookkeeping. */\nfunction toWireWorkItem(item: WorkItemRow): WorkItemRow {\n  if (\n    !item.metadata ||\n    (!(FACTORY_RULE_MATERIALIZATION_KEY in item.metadata) &&\n      !(FACTORY_PULL_REQUEST_RECONCILIATION_KEY in item.metadata) &&\n      !(EXTERNAL_SOURCE_MISSING_KEY in item.metadata))\n  ) {\n    return item;\n  }\n  return { ...item, metadata: publicWorkItemMetadata(item.metadata) ?? {} };\n}\n\n/** Session ids of the listed cards that the predicate picks, each once. */\nfunction sessionIdsWhere(items: WorkItemRow[], predicate: (sessionId: string) => boolean): string[] {\n  const picked = new Set<string>();\n  for (const item of items) {\n    for (const { sessionId } of Object.values(item.sessions)) {\n      if (predicate(sessionId)) picked.add(sessionId);\n    }\n  }\n  return [...picked];\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction publicWorkItemMetadata(value: Record<string, unknown> | null): Record<string, unknown> | null {\n  if (value === null) return null;\n  const {\n    [FACTORY_RULE_MATERIALIZATION_KEY]: _materialization,\n    [FACTORY_PULL_REQUEST_RECONCILIATION_KEY]: _reconciliation,\n    [EXTERNAL_SOURCE_MISSING_KEY]: _externalSourceMissingAt,\n    ...metadata\n  } = value;\n  return metadata;\n}\n\n/** Validate an untrusted create body. Unknown keys are dropped. */\nexport function parseCreateWorkItem(body: unknown): CreateWorkItemInput | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemCreate.bodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\n/** Validate an untrusted patch body. Unknown keys are dropped. */\nexport function parseUpdateWorkItem(body: unknown): UpdateWorkItemInput | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemUpdate.bodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nasync function readJson(c: Context): Promise<unknown | undefined> {\n  try {\n    return await c.req.json();\n  } catch {\n    return undefined;\n  }\n}\n\n/** Fields a PATCH touched, for the bounded `updated` event summary. */\nfunction patchedFields(patch: Record<string, unknown>): string[] {\n  return Object.keys(patch).filter(key => patch[key] !== undefined);\n}\n\nfunction parseTransitionBody(\n  body: unknown,\n): Omit<FactoryTransitionRequest, 'orgId' | 'factoryProjectId' | 'workItemId' | 'actor'> | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemTransition.bodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction parseStartBody(\n  body: unknown,\n  tenant: { orgId: string; userId: string },\n  factoryProjectId: string,\n  modelScope: EffectiveModelScope,\n): FactoryStartRequest | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemStart.bodySchema.safeParse(body);\n  return parsed.success ? { ...tenant, factoryProjectId, modelScope, ...parsed.data } : null;\n}\n\nfunction encodeDecisionCursor(decision: FactoryDeferredDecisionRecord): string {\n  return Buffer.from(JSON.stringify([decision.createdAt.toISOString(), decision.id]), 'utf8').toString('base64url');\n}\n\n/** A proposed transition names the seat its lane addresses, so the card can label what approving starts. */\nfunction summaryRole(boards: BoardRegistry, decision: Record<string, unknown>): string | null {\n  if (typeof decision.role === 'string') return decision.role.slice(0, 32);\n  if (decision.type !== 'transition') return null;\n  const { board, stage } = decision;\n  if (typeof board !== 'string' || typeof stage !== 'string') return null;\n  return boards.get(board)?.roleForPhase(stage) ?? null;\n}\n\n/** A linked-card decision names where the card is synced from, so the UI can say \"GitHub\" rather than \"a linked card\". */\nfunction summarySource(decision: Record<string, unknown>): WorkItemSource | null {\n  if (decision.type !== 'upsertLinkedWorkItem') return null;\n  const source = decision.source;\n  return source === 'github-issue' ||\n    source === 'github-pr' ||\n    source === 'gitlab-issue' ||\n    source === 'gitlab-pr' ||\n    source === 'linear-issue' ||\n    source === 'manual'\n    ? source\n    : null;\n}\n\nfunction decisionSummary(boards: BoardRegistry, decision: FactoryDeferredDecisionRecord, overtaken = false) {\n  return {\n    id: decision.id,\n    evaluationId: decision.evaluationId,\n    workItemId: decision.workItemId,\n    type: factoryDecisionType(decision),\n    role: summaryRole(boards, decision.decision),\n    source: summarySource(decision.decision),\n    status: decision.status,\n    attempts: decision.attempts,\n    failureOccurrence: decision.failureOccurrence,\n    failureCode: decision.failureCode,\n    canRetry: decisionRetryable(decision, overtaken),\n    lastError: decision.lastError?.slice(0, 512) ?? null,\n    createdAt: decision.createdAt.toISOString(),\n    updatedAt: decision.updatedAt.toISOString(),\n    completedAt: decision.completedAt?.toISOString() ?? null,\n  };\n}\n\nexport class WorkItemRoutes extends Route<WorkItemRoutesDeps> {\n  #defaultBoards: BoardRegistry | undefined;\n\n  get #boards(): BoardRegistry {\n    return this.deps.boardRegistry ?? (this.#defaultBoards ??= createBoardRegistry());\n  }\n\n  /** Resolve the `(orgId, userId)` tenant or a ready-to-return error response. */\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'The Factory board requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  /**\n   * Resolve the tenant AND the org-owned project from the `:id` param. Work\n   * items hang off a project, so listing/creating requires the project to\n   * exist in the caller's org.\n   */\n  async #resolveProject(c: Context): Promise<\n    | {\n        orgId: string;\n        userId: string;\n        factoryProjectId: string;\n        modelScope: EffectiveModelScope;\n        defaultModelId: string | null;\n      }\n    | { response: Response }\n  > {\n    const tenant = await this.#resolveTenant(c);\n    if ('response' in tenant) return tenant;\n\n    const parsedPath = FACTORY_ROUTE_CONTRACTS.projectGet.pathSchema.safeParse({ id: c.req.param('id') });\n    if (!parsedPath.success) {\n      return { response: c.json({ error: 'Project not found' }, 404) };\n    }\n    const projectId = parsedPath.data.id;\n    const { projects } = this.deps;\n    await projects.ensureReady();\n    const project = await projects.get({ orgId: tenant.orgId, id: projectId });\n    if (!project) {\n      return { response: c.json({ error: 'Project not found' }, 404) };\n    }\n    // Work-item starts are runs, so a hybrid Factory resolves the Factory's scope here.\n    const modelScope = effectiveModelScope(project.modelScope, 'run');\n    return {\n      ...tenant,\n      factoryProjectId: projectId,\n      modelScope,\n      defaultModelId: modelScope === 'factory' ? project.defaultModelId : null,\n    };\n  }\n\n  async #auditWorkItemPatch({\n    context,\n    item,\n    patch,\n  }: {\n    context: Context;\n    item: WorkItemRow;\n    patch: Record<string, unknown>;\n  }): Promise<void> {\n    await this.deps.audit.emit({\n      context,\n      input: {\n        action: 'factory.work_item.updated',\n        factoryProjectId: item.factoryProjectId,\n        targets: [{ type: 'work_item', id: item.id, name: item.title }],\n        metadata: { fields: patchedFields(patch) },\n      },\n    });\n  }\n\n  /** Releasing a parked run and dropping it: same request, opposite outcomes, both audited as consent. */\n  #proposalRoute({ verb }: { verb: 'approve' | 'dismiss' }): ApiRoute {\n    const { audit, workItems } = this.deps;\n    const contract =\n      verb === 'approve' ? FACTORY_ROUTE_CONTRACTS.decisionApprove : FACTORY_ROUTE_CONTRACTS.decisionDismiss;\n    return registerApiRoute(contract.path, {\n      method: contract.method,\n      requiresAuth: false,\n      handler: async c => {\n        const context = loose(c);\n        const resolved = await this.#resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        const parsedPath = contract.pathSchema.safeParse({\n          id: resolved.factoryProjectId,\n          decisionId: context.req.param('decisionId'),\n        });\n        if (!parsedPath.success) return c.json({ error: 'invalid_decision_id' }, 422);\n        const { decisionId } = parsedPath.data;\n        const settled = await resolveFactoryProposal({\n          workItems,\n          audit: input => audit.emit({ context, input }),\n          orgId: resolved.orgId,\n          factoryProjectId: resolved.factoryProjectId,\n          userId: resolved.userId,\n          decisionId,\n          action: verb,\n        });\n        if (!settled.ok) return c.json({ error: settled.code }, 409);\n        const { decision } = settled;\n        return c.json({ decision: decisionSummary(this.#boards, decision) });\n      },\n    });\n  }\n\n  /** Build the Factory work-item routes as Mastra `apiRoutes`. */\n  routes(): ApiRoute[] {\n    const { audit, workItems, queueHealth, transitionService, startCoordinator, liveSessions } = this.deps;\n    return [\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.boardCatalog.path, {\n        method: FACTORY_ROUTE_CONTRACTS.boardCatalog.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          return c.json({\n            boards: [...this.#boards].map(([id, board]) => ({\n              id,\n              title: board.title,\n              initialPhase: board.initialPhase,\n              phases: Object.entries(board.phases).map(([phaseId, phase]) => ({\n                id: phaseId,\n                title: phase.title,\n                kind: phase.kind,\n                ...(phase.kind === 'working' ? { role: phase.role } : {}),\n                transitions: (board.transitions[phaseId] ?? []).map(({ outcome, to }) => ({ outcome, to })),\n              })),\n            })),\n          });\n        },\n      }),\n      // ── List the org's work items for a project, and which are being worked ─\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemList.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemList.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          await workItems.ensureReady();\n          const items = await workItems.list({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n          });\n          return c.json({\n            workItems: items.map(toWireWorkItem),\n            runningSessionIds: sessionIdsWhere(items, sessionId => liveSessions.isRunning(sessionId)),\n            parkedSessionIds: sessionIdsWhere(items, sessionId => liveSessions.parked(sessionId) !== undefined),\n          });\n        },\n      }),\n\n      // ── Flow metrics aggregated over the project's work items ───────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.metricsGet.path, {\n        method: FACTORY_ROUTE_CONTRACTS.metricsGet.method,\n        requiresAuth: false,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n          const query = FACTORY_ROUTE_CONTRACTS.metricsGet.querySchema.safeParse({\n            from: context.req.query('from'),\n            to: context.req.query('to'),\n          });\n          if (!query.success) return c.json({ error: 'invalid_metrics_range' }, 400);\n          const { windowStart, windowEnd } = parseMetricsRange(query.data.from, query.data.to, new Date());\n          await workItems.ensureReady();\n          const items = await workItems.list({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n          });\n          return c.json({ metrics: computeFactoryMetrics(items, { windowStart, windowEnd }) });\n        },\n      }),\n\n      // ── Per-project queue-health age-threshold config (seconds) ─────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.healthThresholdsGet.path, {\n        method: FACTORY_ROUTE_CONTRACTS.healthThresholdsGet.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          await queueHealth.ensureReady();\n          const stored = await queueHealth.getConfig(resolved.orgId, resolved.factoryProjectId);\n          // Validate at the read choke point: `getConfig` round-trips a stored\n          // JSONB row, and only `saveConfig` validates on write — a corrupted or\n          // hand-edited row (empty / non-ascending) would otherwise flow to the\n          // chart and invert bucket colors. Fall back to the default on invalid.\n          return c.json({ thresholds: thresholdsOrDefault(stored) });\n        },\n      }),\n\n      // ── Bounded durable rule-decision status ────────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.decisionList.path, {\n        method: FACTORY_ROUTE_CONTRACTS.decisionList.method,\n        requiresAuth: false,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n\n          const query = FACTORY_ROUTE_CONTRACTS.decisionList.querySchema.safeParse({\n            statuses: context.req.query('statuses'),\n            before: context.req.query('before'),\n            limit: context.req.query('limit'),\n          });\n          if (!query.success) {\n            const field = query.error.issues[0]?.path[0];\n            return c.json({ error: field === 'before' ? 'invalid_cursor' : 'invalid_decision_query' }, 400);\n          }\n          await workItems.ensureReady();\n          const page = await workItems.listDeferredDecisionPage({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            statuses: query.data.statuses,\n            before: query.data.before,\n            limit: query.data.limit,\n          });\n          const last = page.decisions.at(-1);\n          const overtaken = await overtakenDecisionIds(\n            workItems,\n            this.#boards,\n            resolved,\n            page.decisions.filter(decision => decision.status === 'failed'),\n          );\n          return c.json({\n            decisions: page.decisions.map(decision =>\n              decisionSummary(this.#boards, decision, overtaken.has(decision.id)),\n            ),\n            ...(page.hasMore && last ? { nextCursor: encodeDecisionCursor(last) } : {}),\n          });\n        },\n      }),\n\n      ...buildAttentionRoutes({\n        workItems,\n        boards: this.#boards,\n        comments: this.deps.comments,\n        liveSessions,\n        resolveProject: context => this.#resolveProject(loose(context)),\n      }),\n\n      this.#proposalRoute({ verb: 'approve' }),\n      this.#proposalRoute({ verb: 'dismiss' }),\n\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.decisionRetry.path, {\n        method: FACTORY_ROUTE_CONTRACTS.decisionRetry.method,\n        requiresAuth: false,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.decisionRetry.pathSchema.safeParse({\n            id: resolved.factoryProjectId,\n            decisionId: context.req.param('decisionId'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'invalid_decision_id' }, 422);\n          const { decisionId } = parsedPath.data;\n          const retried = await retryFactoryDecision({\n            workItems,\n            boards: this.#boards,\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            decisionId,\n          });\n          if (!retried.ok) return c.json({ error: retried.code }, 409);\n          const { decision } = retried;\n          return c.json({ decision: decisionSummary(this.#boards, decision) });\n        },\n      }),\n\n      // ── Create (upsert on sourceKey) a work item ─────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemCreate.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemCreate.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n\n          const body = await readJson(loose(c));\n          if (body === undefined) return c.json({ error: 'Invalid JSON body' }, 400);\n          const input = parseCreateWorkItem(body);\n          if (!input) return c.json({ error: 'invalid_work_item' }, 400);\n          try {\n            const created = await createFactoryWorkItem({\n              workItems,\n              boards: this.#boards,\n              transitionService,\n              audit: auditInput => audit.emit({ context: loose(c), input: auditInput }),\n              orgId: resolved.orgId,\n              userId: resolved.userId,\n              factoryProjectId: resolved.factoryProjectId,\n              input,\n              origin: auditRequestOrigin(loose(c)),\n            });\n            switch (created.status) {\n              case 'refused':\n                if (created.code === 'factory_transitions_unavailable') return c.json({ error: created.code }, 503);\n                return c.json(\n                  { error: created.code, message: created.message },\n                  created.code === 'invalid_board' ? 422 : 409,\n                );\n              case 'rejected':\n                return c.json({ status: 'rejected', code: created.code, reason: created.reason }, 422);\n              case 'reused': {\n                // Source-key reuse: the POST updated an existing card, not created one.\n                const { stages: _stages, sessions: _sessions, ...boundedPatch } = input;\n                await this.#auditWorkItemPatch({\n                  context: loose(c),\n                  item: created.item,\n                  patch: boundedPatch as unknown as Record<string, unknown>,\n                });\n                return c.json({ workItem: toWireWorkItem(created.item) });\n              }\n              case 'created':\n                return c.json({ workItem: toWireWorkItem(created.item) });\n            }\n          } catch (error) {\n            if (error instanceof WorkItemRelationError) {\n              return c.json({ error: error.code, message: error.message }, 400);\n            }\n            throw error;\n          }\n        },\n      }),\n\n      // ── Authoritative stage transition ──────────────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemTransition.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemTransition.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          const context = loose(c);\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.workItemTransition.pathSchema.safeParse({\n            id: resolved.factoryProjectId,\n            workItemId: context.req.param('workItemId'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n          const { workItemId } = parsedPath.data;\n          const parsed = parseTransitionBody(await readJson(context));\n          if (!parsed) return c.json({ error: 'invalid_transition_request' }, 400);\n          if (!transitionService) {\n            return c.json({ error: 'factory_transition_unavailable' }, 503);\n          }\n          await workItems.ensureReady();\n          const result = await transitionService.transition({\n            ...parsed,\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            workItemId,\n            actor: { type: 'human', id: resolved.userId },\n            ...auditRequestOrigin(loose(c)),\n            ingress: {\n              ...parsed.ingress,\n              identity: `human:${resolved.userId}:${parsed.ingress.identity}`,\n            },\n          });\n          if (result.status === 'accepted') return c.json({ result });\n          return c.json({ result }, result.code === 'stale' ? 409 : 422);\n        },\n      }),\n\n      // ── Bind a Factory run before dispatching its kickoff ────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemStart.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemStart.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          if (!startCoordinator) {\n            return c.json({ error: 'factory_start_unavailable' }, 503);\n          }\n          const input = parseStartBody(\n            await readJson(loose(c)),\n            resolved,\n            resolved.factoryProjectId,\n            resolved.modelScope,\n          );\n          if (!input) return c.json({ error: 'invalid_factory_start' }, 400);\n          input.requestContext = loose(c).get('requestContext');\n          input.defaultModelId = resolved.defaultModelId ?? undefined;\n          await workItems.ensureReady();\n          let prepared: FactoryStartPreparedResult;\n          try {\n            prepared = await startCoordinator.prepare(input);\n          } catch (error) {\n            if (error instanceof FactoryStartTransitionError) {\n              return c.json({ result: error.result }, error.result.code === 'stale' ? 409 : 422);\n            }\n            if (error instanceof WorkItemRepositoryError) {\n              return c.json({ error: error.code, message: error.message, candidates: error.candidates }, 409);\n            }\n            throw error;\n          }\n          return c.json({ prepared }, 202);\n        },\n      }),\n\n      // ── Patch non-stage metadata / sessions / title ──────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemUpdate.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemUpdate.method,\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          const context = loose(c);\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.workItemUpdate.pathSchema.safeParse({\n            id: context.req.param('id'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n          const { id } = parsedPath.data;\n\n          const body = await readJson(context);\n          if (body === undefined) return c.json({ error: 'Invalid JSON body' }, 400);\n          const patch = parseUpdateWorkItem(body);\n          if (!patch) return c.json({ error: 'invalid_work_item_patch' }, 400);\n\n          await workItems.ensureReady();\n          const existing = await workItems.get({ orgId: tenant.orgId, id });\n          if (!existing) return c.json({ error: 'Work item not found' }, 404);\n          if (patch.board !== undefined) {\n            const board = this.#boards.get(patch.board);\n            const stage = patch.stages?.length === 1 ? patch.stages[0] : undefined;\n            if (existing.board !== null) {\n              return c.json({ error: 'board_already_assigned' }, 409);\n            }\n            if (!board) {\n              return c.json({ error: 'board_not_installed' }, 400);\n            }\n            if (!stage || !Object.prototype.hasOwnProperty.call(board.phases, stage)) {\n              return c.json({ error: 'invalid_board_migration_phase' }, 400);\n            }\n          } else if (patch.stages !== undefined) {\n            return c.json(\n              { error: 'governed_transition_required', message: 'Use the Factory transition endpoint to move stages.' },\n              409,\n            );\n          }\n\n          try {\n            const updated = await workItems.update({\n              orgId: tenant.orgId,\n              id,\n              userId: tenant.userId,\n              patch,\n              ...(patch.board !== undefined ? { expectedRevision: existing.revision, expectedBoard: null } : {}),\n            });\n            if (!updated) return c.json({ error: 'Work item not found' }, 404);\n            await this.#auditWorkItemPatch({\n              context: loose(c),\n              item: updated.item,\n              patch: patch as Record<string, unknown>,\n            });\n            return c.json({ workItem: toWireWorkItem(updated.item) });\n          } catch (error) {\n            if (error instanceof WorkItemRelationError) {\n              return c.json({ error: error.code, message: error.message }, 400);\n            }\n            if (error instanceof WorkItemUpdateConflictError) {\n              return c.json({ error: error.reason === 'board' ? 'board_already_assigned' : error.code }, 409);\n            }\n            throw error;\n          }\n        },\n      }),\n\n      // ── Remove a work item ───────────────────────────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemDelete.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemDelete.method,\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          const context = loose(c);\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.workItemDelete.pathSchema.safeParse({\n            id: context.req.param('id'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n          const { id } = parsedPath.data;\n\n          await workItems.ensureReady();\n          const deleted = await workItems.delete({ orgId: tenant.orgId, id });\n          if (!deleted) return c.json({ error: 'Work item not found' }, 404);\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.work_item.deleted',\n              factoryProjectId: deleted.factoryProjectId,\n              targets: [{ type: 'work_item', id: deleted.id, name: deleted.title }],\n            },\n          });\n          return c.json({ ok: true });\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2EA,SAAS,eAAe,MAAgC;CACtD,IACE,CAAC,KAAK,YACL,EAAA,mCAAsC,KAAK,aAC1C,EAAA,sCAA6C,KAAK,aAClD,EAAA,6BAAiC,KAAK,WAExC,OAAO;CAET,OAAO;EAAE,GAAG;EAAM,UAAU,uBAAuB,KAAK,QAAQ,KAAK,CAAC;CAAE;AAC1E;;AAGA,SAAS,gBAAgB,OAAsB,WAAqD;CAClG,MAAM,yBAAS,IAAI,IAAY;CAC/B,KAAK,MAAM,QAAQ,OACjB,KAAK,MAAM,EAAE,eAAe,OAAO,OAAO,KAAK,QAAQ,GACrD,IAAI,UAAU,SAAS,GAAG,OAAO,IAAI,SAAS;CAGlD,OAAO,CAAC,GAAG,MAAM;AACnB;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAIA,SAAS,uBAAuB,OAAuE;CACrG,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,GACH,mCAAmC,mBACnC,0CAA0C,kBAC1C,8BAA8B,0BAC/B,GAAG,aACD;CACJ,OAAO;AACT;;AAGA,SAAgB,oBAAoB,MAA2C;CAC7E,MAAM,SAAS,wBAAwB,eAAe,WAAW,UAAU,IAAI;CAC/E,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;;AAGA,SAAgB,oBAAoB,MAA2C;CAC7E,MAAM,SAAS,wBAAwB,eAAe,WAAW,UAAU,IAAI;CAC/E,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAe,SAAS,GAA0C;CAChE,IAAI;EACF,OAAO,MAAM,EAAE,IAAI,KAAK;CAC1B,QAAQ;EACN;CACF;AACF;;AAGA,SAAS,cAAc,OAA0C;CAC/D,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,QAAO,QAAO,MAAM,SAAS,KAAA,CAAS;AAClE;AAEA,SAAS,oBACP,MAC8F;CAC9F,MAAM,SAAS,wBAAwB,mBAAmB,WAAW,UAAU,IAAI;CACnF,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,eACP,MACA,QACA,kBACA,YAC4B;CAC5B,MAAM,SAAS,wBAAwB,cAAc,WAAW,UAAU,IAAI;CAC9E,OAAO,OAAO,UAAU;EAAE,GAAG;EAAQ;EAAkB;EAAY,GAAG,OAAO;CAAK,IAAI;AACxF;AAEA,SAAS,qBAAqB,UAAiD;CAC7E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,SAAS,UAAU,YAAY,GAAG,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;AAClH;;AAGA,SAAS,YAAY,QAAuB,UAAkD;CAC5F,IAAI,OAAO,SAAS,SAAS,UAAU,OAAO,SAAS,KAAK,MAAM,GAAG,EAAE;CACvE,IAAI,SAAS,SAAS,cAAc,OAAO;CAC3C,MAAM,EAAE,OAAO,UAAU;CACzB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAU,OAAO;CACnE,OAAO,OAAO,IAAI,KAAK,CAAC,EAAE,aAAa,KAAK,KAAK;AACnD;;AAGA,SAAS,cAAc,UAA0D;CAC/E,IAAI,SAAS,SAAS,wBAAwB,OAAO;CACrD,MAAM,SAAS,SAAS;CACxB,OAAO,WAAW,kBAChB,WAAW,eACX,WAAW,kBACX,WAAW,eACX,WAAW,kBACX,WAAW,WACT,SACA;AACN;AAEA,SAAS,gBAAgB,QAAuB,UAAyC,YAAY,OAAO;CAC1G,OAAO;EACL,IAAI,SAAS;EACb,cAAc,SAAS;EACvB,YAAY,SAAS;EACrB,MAAM,oBAAoB,QAAQ;EAClC,MAAM,YAAY,QAAQ,SAAS,QAAQ;EAC3C,QAAQ,cAAc,SAAS,QAAQ;EACvC,QAAQ,SAAS;EACjB,UAAU,SAAS;EACnB,mBAAmB,SAAS;EAC5B,aAAa,SAAS;EACtB,UAAU,kBAAkB,UAAU,SAAS;EAC/C,WAAW,SAAS,WAAW,MAAM,GAAG,GAAG,KAAK;EAChD,WAAW,SAAS,UAAU,YAAY;EAC1C,WAAW,SAAS,UAAU,YAAY;EAC1C,aAAa,SAAS,aAAa,YAAY,KAAK;CACtD;AACF;AAEA,IAAa,iBAAb,cAAoC,MAA0B;CAC5D;CAEA,IAAIA,UAAyB;EAC3B,OAAO,KAAK,KAAK,kBAAkB,KAAKC,mBAAmB,oBAAoB;CACjF;;CAGA,MAAMC,eAAe,GAAiF;EACpG,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;EACjC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;EACtC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAA8C,GACzF,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;;;;;;CAOA,MAAMC,gBAAgB,GASpB;EACA,MAAM,SAAS,MAAM,KAAKD,eAAe,CAAC;EAC1C,IAAI,cAAc,QAAQ,OAAO;EAEjC,MAAM,aAAa,wBAAwB,WAAW,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;EACpG,IAAI,CAAC,WAAW,SACd,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG,EAAE;EAEjE,MAAM,YAAY,WAAW,KAAK;EAClC,MAAM,EAAE,aAAa,KAAK;EAC1B,MAAM,SAAS,YAAY;EAC3B,MAAM,UAAU,MAAM,SAAS,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI;EAAU,CAAC;EACzE,IAAI,CAAC,SACH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG,EAAE;EAGjE,MAAM,aAAa,oBAAoB,QAAQ,YAAY,KAAK;EAChE,OAAO;GACL,GAAG;GACH,kBAAkB;GAClB;GACA,gBAAgB,eAAe,YAAY,QAAQ,iBAAiB;EACtE;CACF;CAEA,MAAME,oBAAoB,EACxB,SACA,MACA,SAKgB;EAChB,MAAM,KAAK,KAAK,MAAM,KAAK;GACzB;GACA,OAAO;IACL,QAAQ;IACR,kBAAkB,KAAK;IACvB,SAAS,CAAC;KAAE,MAAM;KAAa,IAAI,KAAK;KAAI,MAAM,KAAK;IAAM,CAAC;IAC9D,UAAU,EAAE,QAAQ,cAAc,KAAK,EAAE;GAC3C;EACF,CAAC;CACH;;CAGA,eAAe,EAAE,QAAmD;EAClE,MAAM,EAAE,OAAO,cAAc,KAAK;EAClC,MAAM,WACJ,SAAS,YAAY,wBAAwB,kBAAkB,wBAAwB;EACzF,OAAO,iBAAiB,SAAS,MAAM;GACrC,QAAQ,SAAS;GACjB,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,UAAU,MAAM,CAAC;IACvB,MAAM,WAAW,MAAM,KAAKD,gBAAgB,OAAO;IACnD,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,aAAa,SAAS,WAAW,UAAU;KAC/C,IAAI,SAAS;KACb,YAAY,QAAQ,IAAI,MAAM,YAAY;IAC5C,CAAC;IACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;IAC5E,MAAM,EAAE,eAAe,WAAW;IAClC,MAAM,UAAU,MAAM,uBAAuB;KAC3C;KACA,QAAO,UAAS,MAAM,KAAK;MAAE;MAAS;KAAM,CAAC;KAC7C,OAAO,SAAS;KAChB,kBAAkB,SAAS;KAC3B,QAAQ,SAAS;KACjB;KACA,QAAQ;IACV,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,KAAK,GAAG,GAAG;IAC3D,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,KAAK,EAAE,UAAU,gBAAgB,KAAKH,SAAS,QAAQ,EAAE,CAAC;GACrE;EACF,CAAC;CACH;;CAGA,SAAqB;EACnB,MAAM,EAAE,OAAO,WAAW,aAAa,mBAAmB,kBAAkB,iBAAiB,KAAK;EAClG,OAAO;GACL,iBAAiB,wBAAwB,aAAa,MAAM;IAC1D,QAAQ,wBAAwB,aAAa;IAC7C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAKG,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,OAAO,EAAE,KAAK,EACZ,QAAQ,CAAC,GAAG,KAAKH,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,YAAY;MAC9C;MACA,OAAO,MAAM;MACb,cAAc,MAAM;MACpB,QAAQ,OAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY;OAC9D,IAAI;OACJ,OAAO,MAAM;OACb,MAAM,MAAM;OACZ,GAAI,MAAM,SAAS,YAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;OACvD,cAAc,MAAM,YAAY,YAAY,CAAC,EAAA,CAAG,KAAK,EAAE,SAAS,UAAU;QAAE;QAAS;OAAG,EAAE;MAC5F,EAAE;KACJ,EAAE,EACJ,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,wBAAwB,aAAa,MAAM;IAC1D,QAAQ,wBAAwB,aAAa;IAC7C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAKG,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,UAAU,YAAY;KAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK;MACjC,OAAO,SAAS;MAChB,kBAAkB,SAAS;KAC7B,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,WAAW,MAAM,IAAI,cAAc;MACnC,mBAAmB,gBAAgB,QAAO,cAAa,aAAa,UAAU,SAAS,CAAC;MACxF,kBAAkB,gBAAgB,QAAO,cAAa,aAAa,OAAO,SAAS,MAAM,KAAA,CAAS;KACpG,CAAC;IACH;GACF,CAAC;GAGD,iBAAiB,wBAAwB,WAAW,MAAM;IACxD,QAAQ,wBAAwB,WAAW;IAC3C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,WAAW,MAAM,KAAKA,gBAAgB,OAAO;KACnD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,QAAQ,wBAAwB,WAAW,YAAY,UAAU;MACrE,MAAM,QAAQ,IAAI,MAAM,MAAM;MAC9B,IAAI,QAAQ,IAAI,MAAM,IAAI;KAC5B,CAAC;KACD,IAAI,CAAC,MAAM,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;KACzE,MAAM,EAAE,aAAa,cAAc,kBAAkB,MAAM,KAAK,MAAM,MAAM,KAAK,oBAAI,IAAI,KAAK,CAAC;KAC/F,MAAM,UAAU,YAAY;KAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK;MACjC,OAAO,SAAS;MAChB,kBAAkB,SAAS;KAC7B,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,SAAS,sBAAsB,OAAO;MAAE;MAAa;KAAU,CAAC,EAAE,CAAC;IACrF;GACF,CAAC;GAGD,iBAAiB,wBAAwB,oBAAoB,MAAM;IACjE,QAAQ,wBAAwB,oBAAoB;IACpD,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAKA,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,YAAY,YAAY;KAC9B,MAAM,SAAS,MAAM,YAAY,UAAU,SAAS,OAAO,SAAS,gBAAgB;KAKpF,OAAO,EAAE,KAAK,EAAE,YAAY,oBAAoB,MAAM,EAAE,CAAC;IAC3D;GACF,CAAC;GAGD,iBAAiB,wBAAwB,aAAa,MAAM;IAC1D,QAAQ,wBAAwB,aAAa;IAC7C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,WAAW,MAAM,KAAKA,gBAAgB,OAAO;KACnD,IAAI,cAAc,UAAU,OAAO,SAAS;KAE5C,MAAM,QAAQ,wBAAwB,aAAa,YAAY,UAAU;MACvE,UAAU,QAAQ,IAAI,MAAM,UAAU;MACtC,QAAQ,QAAQ,IAAI,MAAM,QAAQ;MAClC,OAAO,QAAQ,IAAI,MAAM,OAAO;KAClC,CAAC;KACD,IAAI,CAAC,MAAM,SAAS;MAClB,MAAM,QAAQ,MAAM,MAAM,OAAO,EAAE,EAAE,KAAK;MAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,UAAU,WAAW,mBAAmB,yBAAyB,GAAG,GAAG;KAChG;KACA,MAAM,UAAU,YAAY;KAC5B,MAAM,OAAO,MAAM,UAAU,yBAAyB;MACpD,OAAO,SAAS;MAChB,kBAAkB,SAAS;MAC3B,UAAU,MAAM,KAAK;MACrB,QAAQ,MAAM,KAAK;MACnB,OAAO,MAAM,KAAK;KACpB,CAAC;KACD,MAAM,OAAO,KAAK,UAAU,GAAG,EAAE;KACjC,MAAM,YAAY,MAAM,qBACtB,WACA,KAAKH,SACL,UACA,KAAK,UAAU,QAAO,aAAY,SAAS,WAAW,QAAQ,CAChE;KACA,OAAO,EAAE,KAAK;MACZ,WAAW,KAAK,UAAU,KAAI,aAC5B,gBAAgB,KAAKA,SAAS,UAAU,UAAU,IAAI,SAAS,EAAE,CAAC,CACpE;MACA,GAAI,KAAK,WAAW,OAAO,EAAE,YAAY,qBAAqB,IAAI,EAAE,IAAI,CAAC;KAC3E,CAAC;IACH;GACF,CAAC;GAED,GAAG,qBAAqB;IACtB;IACA,QAAQ,KAAKA;IACb,UAAU,KAAK,KAAK;IACpB;IACA,iBAAgB,YAAW,KAAKG,gBAAgB,MAAM,OAAO,CAAC;GAChE,CAAC;GAED,KAAKE,eAAe,EAAE,MAAM,UAAU,CAAC;GACvC,KAAKA,eAAe,EAAE,MAAM,UAAU,CAAC;GAEvC,iBAAiB,wBAAwB,cAAc,MAAM;IAC3D,QAAQ,wBAAwB,cAAc;IAC9C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,WAAW,MAAM,KAAKF,gBAAgB,OAAO;KACnD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,aAAa,wBAAwB,cAAc,WAAW,UAAU;MAC5E,IAAI,SAAS;MACb,YAAY,QAAQ,IAAI,MAAM,YAAY;KAC5C,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,eAAe,WAAW;KAClC,MAAM,UAAU,MAAM,qBAAqB;MACzC;MACA,QAAQ,KAAKH;MACb,OAAO,SAAS;MAChB,kBAAkB,SAAS;MAC3B;KACF,CAAC;KACD,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,KAAK,GAAG,GAAG;KAC3D,MAAM,EAAE,aAAa;KACrB,OAAO,EAAE,KAAK,EAAE,UAAU,gBAAgB,KAAKA,SAAS,QAAQ,EAAE,CAAC;IACrE;GACF,CAAC;GAGD,iBAAiB,wBAAwB,eAAe,MAAM;IAC5D,QAAQ,wBAAwB,eAAe;IAC/C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAKG,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAE5C,MAAM,OAAO,MAAM,SAAS,MAAM,CAAC,CAAC;KACpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzE,MAAM,QAAQ,oBAAoB,IAAI;KACtC,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC7D,IAAI;MACF,MAAM,UAAU,MAAM,sBAAsB;OAC1C;OACA,QAAQ,KAAKH;OACb;OACA,QAAO,eAAc,MAAM,KAAK;QAAE,SAAS,MAAM,CAAC;QAAG,OAAO;OAAW,CAAC;OACxE,OAAO,SAAS;OAChB,QAAQ,SAAS;OACjB,kBAAkB,SAAS;OAC3B;OACA,QAAQ,mBAAmB,MAAM,CAAC,CAAC;MACrC,CAAC;MACD,QAAQ,QAAQ,QAAhB;OACE,KAAK;QACH,IAAI,QAAQ,SAAS,mCAAmC,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,KAAK,GAAG,GAAG;QAClG,OAAO,EAAE,KACP;SAAE,OAAO,QAAQ;SAAM,SAAS,QAAQ;QAAQ,GAChD,QAAQ,SAAS,kBAAkB,MAAM,GAC3C;OACF,KAAK,YACH,OAAO,EAAE,KAAK;QAAE,QAAQ;QAAY,MAAM,QAAQ;QAAM,QAAQ,QAAQ;OAAO,GAAG,GAAG;OACvF,KAAK,UAAU;QAEb,MAAM,EAAE,QAAQ,SAAS,UAAU,WAAW,GAAG,iBAAiB;QAClE,MAAM,KAAKI,oBAAoB;SAC7B,SAAS,MAAM,CAAC;SAChB,MAAM,QAAQ;SACd,OAAO;QACT,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,UAAU,eAAe,QAAQ,IAAI,EAAE,CAAC;OAC1D;OACA,KAAK,WACH,OAAO,EAAE,KAAK,EAAE,UAAU,eAAe,QAAQ,IAAI,EAAE,CAAC;MAC5D;KACF,SAAS,OAAO;MACd,IAAI,iBAAiB,uBACnB,OAAO,EAAE,KAAK;OAAE,OAAO,MAAM;OAAM,SAAS,MAAM;MAAQ,GAAG,GAAG;MAElE,MAAM;KACR;IACF;GACF,CAAC;GAGD,iBAAiB,wBAAwB,mBAAmB,MAAM;IAChE,QAAQ,wBAAwB,mBAAmB;IACnD,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAKD,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,aAAa,wBAAwB,mBAAmB,WAAW,UAAU;MACjF,IAAI,SAAS;MACb,YAAY,QAAQ,IAAI,MAAM,YAAY;KAC5C,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,eAAe,WAAW;KAClC,MAAM,SAAS,oBAAoB,MAAM,SAAS,OAAO,CAAC;KAC1D,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;KACvE,IAAI,CAAC,mBACH,OAAO,EAAE,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;KAEhE,MAAM,UAAU,YAAY;KAC5B,MAAM,SAAS,MAAM,kBAAkB,WAAW;MAChD,GAAG;MACH,OAAO,SAAS;MAChB,kBAAkB,SAAS;MAC3B;MACA,OAAO;OAAE,MAAM;OAAS,IAAI,SAAS;MAAO;MAC5C,GAAG,mBAAmB,MAAM,CAAC,CAAC;MAC9B,SAAS;OACP,GAAG,OAAO;OACV,UAAU,SAAS,SAAS,OAAO,GAAG,OAAO,QAAQ;MACvD;KACF,CAAC;KACD,IAAI,OAAO,WAAW,YAAY,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;KAC1D,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,SAAS,UAAU,MAAM,GAAG;IAC/D;GACF,CAAC;GAGD,iBAAiB,wBAAwB,cAAc,MAAM;IAC3D,QAAQ,wBAAwB,cAAc;IAC9C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAKA,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,IAAI,CAAC,kBACH,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAE3D,MAAM,QAAQ,eACZ,MAAM,SAAS,MAAM,CAAC,CAAC,GACvB,UACA,SAAS,kBACT,SAAS,UACX;KACA,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;KACjE,MAAM,iBAAiB,MAAM,CAAC,CAAC,CAAC,IAAI,gBAAgB;KACpD,MAAM,iBAAiB,SAAS,kBAAkB,KAAA;KAClD,MAAM,UAAU,YAAY;KAC5B,IAAI;KACJ,IAAI;MACF,WAAW,MAAM,iBAAiB,QAAQ,KAAK;KACjD,SAAS,OAAO;MACd,IAAI,iBAAiB,6BACnB,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,SAAS,UAAU,MAAM,GAAG;MAEnF,IAAI,iBAAiB,yBACnB,OAAO,EAAE,KAAK;OAAE,OAAO,MAAM;OAAM,SAAS,MAAM;OAAS,YAAY,MAAM;MAAW,GAAG,GAAG;MAEhG,MAAM;KACR;KACA,OAAO,EAAE,KAAK,EAAE,SAAS,GAAG,GAAG;IACjC;GACF,CAAC;GAGD,iBAAiB,wBAAwB,eAAe,MAAM;IAC5D,QAAQ,wBAAwB,eAAe;IAC/C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKD,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,aAAa,wBAAwB,eAAe,WAAW,UAAU,EAC7E,IAAI,QAAQ,IAAI,MAAM,IAAI,EAC5B,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,OAAO,WAAW;KAE1B,MAAM,OAAO,MAAM,SAAS,OAAO;KACnC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzE,MAAM,QAAQ,oBAAoB,IAAI;KACtC,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;KAEnE,MAAM,UAAU,YAAY;KAC5B,MAAM,WAAW,MAAM,UAAU,IAAI;MAAE,OAAO,OAAO;MAAO;KAAG,CAAC;KAChE,IAAI,CAAC,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAClE,IAAI,MAAM,UAAU,KAAA,GAAW;MAC7B,MAAM,QAAQ,KAAKF,QAAQ,IAAI,MAAM,KAAK;MAC1C,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,MAAM,OAAO,KAAK,KAAA;MAC7D,IAAI,SAAS,UAAU,MACrB,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;MAExD,IAAI,CAAC,OACH,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;MAErD,IAAI,CAAC,SAAS,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,QAAQ,KAAK,GACrE,OAAO,EAAE,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;KAEjE,OAAO,IAAI,MAAM,WAAW,KAAA,GAC1B,OAAO,EAAE,KACP;MAAE,OAAO;MAAgC,SAAS;KAAsD,GACxG,GACF;KAGF,IAAI;MACF,MAAM,UAAU,MAAM,UAAU,OAAO;OACrC,OAAO,OAAO;OACd;OACA,QAAQ,OAAO;OACf;OACA,GAAI,MAAM,UAAU,KAAA,IAAY;QAAE,kBAAkB,SAAS;QAAU,eAAe;OAAK,IAAI,CAAC;MAClG,CAAC;MACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;MACjE,MAAM,KAAKI,oBAAoB;OAC7B,SAAS,MAAM,CAAC;OAChB,MAAM,QAAQ;OACP;MACT,CAAC;MACD,OAAO,EAAE,KAAK,EAAE,UAAU,eAAe,QAAQ,IAAI,EAAE,CAAC;KAC1D,SAAS,OAAO;MACd,IAAI,iBAAiB,uBACnB,OAAO,EAAE,KAAK;OAAE,OAAO,MAAM;OAAM,SAAS,MAAM;MAAQ,GAAG,GAAG;MAElE,IAAI,iBAAiB,6BACnB,OAAO,EAAE,KAAK,EAAE,OAAO,MAAM,WAAW,UAAU,2BAA2B,MAAM,KAAK,GAAG,GAAG;MAEhG,MAAM;KACR;IACF;GACF,CAAC;GAGD,iBAAiB,wBAAwB,eAAe,MAAM;IAC5D,QAAQ,wBAAwB,eAAe;IAC/C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKF,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,aAAa,wBAAwB,eAAe,WAAW,UAAU,EAC7E,IAAI,QAAQ,IAAI,MAAM,IAAI,EAC5B,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,OAAO,WAAW;KAE1B,MAAM,UAAU,YAAY;KAC5B,MAAM,UAAU,MAAM,UAAU,OAAO;MAAE,OAAO,OAAO;MAAO;KAAG,CAAC;KAClE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KACjE,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,kBAAkB,QAAQ;OAC1B,SAAS,CAAC;QAAE,MAAM;QAAa,IAAI,QAAQ;QAAI,MAAM,QAAQ;OAAM,CAAC;MACtE;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"work-items.js","names":[],"sources":["../../src/routes/work-items.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for Factory work items (the kanban board).\n *\n * Registered alongside the other `/web/*` routes behind the host auth gate.\n * The board is org-wide: every route re-resolves the caller's `(orgId, userId)`\n * tenant and scopes reads/writes by `orgId`, so any org member sees and moves\n * the same cards while `created_by` / stage history record who acted.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { createBoardRegistry } from '../boards/index.js';\nimport type { BoardRegistry } from '../boards/index.js';\nimport { EXTERNAL_SOURCE_MISSING_KEY } from '../integrations/issue-reconciler.js';\nimport { decisionRetryable, overtakenDecisionIds } from '../rules/decision-applicability.js';\nimport type {\n  FactoryStartCoordinator,\n  FactoryStartPreparedResult,\n  FactoryStartRequest,\n} from '../rules/start-coordinator.js';\nimport { FactoryStartTransitionError, WorkItemRepositoryError } from '../rules/start-coordinator.js';\nimport type { FactoryTransitionRequest, FactoryTransitionService } from '../rules/transition-service.js';\nimport type { WorkItemSource } from '../rules/types.js';\nimport type { LiveSessions } from '../session/live-sessions.js';\nimport { auditRequestOrigin } from '../storage/domains/audit/domain.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { WorkItemCommentsStorage } from '../storage/domains/comments/base.js';\nimport { effectiveModelScope } from '../storage/domains/projects/base.js';\nimport type { EffectiveModelScope, FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport { thresholdsOrDefault } from '../storage/domains/queue-health/base.js';\nimport type {\n  CreateWorkItemInput,\n  FactoryDeferredDecisionRecord,\n  UpdateWorkItemInput,\n  WorkItemRow,\n  WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\nimport {\n  FACTORY_PULL_REQUEST_RECONCILIATION_KEY,\n  FACTORY_RULE_MATERIALIZATION_KEY,\n  WorkItemRelationError,\n  WorkItemUpdateConflictError,\n} from '../storage/domains/work-items/base.js';\nimport { computeFactoryMetrics, parseMetricsRange } from '../storage/domains/work-items/metrics.js';\nimport { createFactoryWorkItem } from '../work-items/create-work-item.js';\nimport { resolveFactoryProposal, retryFactoryDecision } from '../work-items/decision-actions.js';\nimport { buildAttentionRoutes, factoryDecisionType } from './attention.js';\nimport { FACTORY_ROUTE_CONTRACTS } from './contracts.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface WorkItemRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Factory projects domain — validates the `:id` project belongs to the caller's org. */\n  projects: FactoryProjectsStorage;\n  /** Work-items domain backing the kanban board. */\n  workItems: WorkItemsStorage;\n  /** Boards installed for this Factory instance. */\n  boardRegistry?: BoardRegistry;\n  /** Comments domain — backs the mention attention provider. */\n  comments: WorkItemCommentsStorage;\n  /** Per-project queue-health threshold config. */\n  queueHealth: QueueHealthStorage;\n  /** Governed stage-transition service. Stage moves 503 when absent. */\n  transitionService?: Pick<FactoryTransitionService, 'transition' | 'configVersion'>;\n  /** Coordinator that binds a Factory run before dispatching its kickoff. */\n  startCoordinator?: Pick<FactoryStartCoordinator, 'prepare'>;\n  /** Materialized sessions, read to report which of the listed cards are being worked or wait on someone. */\n  liveSessions: Pick<LiveSessions, 'isRunning' | 'parked' | 'parkedIn'>;\n}\n\n/** The card as clients see it, without the dispatcher's internal bookkeeping. */\nfunction toWireWorkItem(item: WorkItemRow): WorkItemRow {\n  if (\n    !item.metadata ||\n    (!(FACTORY_RULE_MATERIALIZATION_KEY in item.metadata) &&\n      !(FACTORY_PULL_REQUEST_RECONCILIATION_KEY in item.metadata) &&\n      !(EXTERNAL_SOURCE_MISSING_KEY in item.metadata))\n  ) {\n    return item;\n  }\n  return { ...item, metadata: publicWorkItemMetadata(item.metadata) ?? {} };\n}\n\n/** Session ids of the listed cards that the predicate picks, each once. */\nfunction sessionIdsWhere(items: WorkItemRow[], predicate: (sessionId: string) => boolean): string[] {\n  const picked = new Set<string>();\n  for (const item of items) {\n    for (const { sessionId } of Object.values(item.sessions)) {\n      if (predicate(sessionId)) picked.add(sessionId);\n    }\n  }\n  return [...picked];\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction publicWorkItemMetadata(value: Record<string, unknown> | null): Record<string, unknown> | null {\n  if (value === null) return null;\n  const {\n    [FACTORY_RULE_MATERIALIZATION_KEY]: _materialization,\n    [FACTORY_PULL_REQUEST_RECONCILIATION_KEY]: _reconciliation,\n    [EXTERNAL_SOURCE_MISSING_KEY]: _externalSourceMissingAt,\n    ...metadata\n  } = value;\n  return metadata;\n}\n\n/** Validate an untrusted create body. Unknown keys are dropped. */\nexport function parseCreateWorkItem(body: unknown): CreateWorkItemInput | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemCreate.bodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\n/** Validate an untrusted patch body. Unknown keys are dropped. */\nexport function parseUpdateWorkItem(body: unknown): UpdateWorkItemInput | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemUpdate.bodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nasync function readJson(c: Context): Promise<unknown | undefined> {\n  try {\n    return await c.req.json();\n  } catch {\n    return undefined;\n  }\n}\n\n/** Fields a PATCH touched, for the bounded `updated` event summary. */\nfunction patchedFields(patch: Record<string, unknown>): string[] {\n  return Object.keys(patch).filter(key => patch[key] !== undefined);\n}\n\nfunction parseTransitionBody(\n  body: unknown,\n): Omit<FactoryTransitionRequest, 'orgId' | 'factoryProjectId' | 'workItemId' | 'actor'> | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemTransition.bodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction parseStartBody(\n  body: unknown,\n  tenant: { orgId: string; userId: string },\n  factoryProjectId: string,\n  modelScope: EffectiveModelScope,\n): FactoryStartRequest | null {\n  const parsed = FACTORY_ROUTE_CONTRACTS.workItemStart.bodySchema.safeParse(body);\n  return parsed.success ? { ...tenant, factoryProjectId, modelScope, ...parsed.data } : null;\n}\n\nfunction encodeDecisionCursor(decision: FactoryDeferredDecisionRecord): string {\n  return Buffer.from(JSON.stringify([decision.createdAt.toISOString(), decision.id]), 'utf8').toString('base64url');\n}\n\n/** A proposed transition names the seat its lane addresses, so the card can label what approving starts. */\nfunction summaryRole(boards: BoardRegistry, decision: Record<string, unknown>): string | null {\n  if (typeof decision.role === 'string') return decision.role.slice(0, 32);\n  if (decision.type !== 'transition') return null;\n  const { board, stage } = decision;\n  if (typeof board !== 'string' || typeof stage !== 'string') return null;\n  return boards.get(board)?.roleForPhase(stage) ?? null;\n}\n\n/** A linked-card decision names where the card is synced from, so the UI can say \"GitHub\" rather than \"a linked card\". */\nfunction summarySource(decision: Record<string, unknown>): WorkItemSource | null {\n  if (decision.type !== 'upsertLinkedWorkItem') return null;\n  const source = decision.source;\n  return source === 'github-issue' ||\n    source === 'github-pr' ||\n    source === 'gitlab-issue' ||\n    source === 'gitlab-pr' ||\n    source === 'linear-issue' ||\n    source === 'manual'\n    ? source\n    : null;\n}\n\nfunction decisionSummary(boards: BoardRegistry, decision: FactoryDeferredDecisionRecord, overtaken = false) {\n  return {\n    id: decision.id,\n    evaluationId: decision.evaluationId,\n    workItemId: decision.workItemId,\n    type: factoryDecisionType(decision),\n    role: summaryRole(boards, decision.decision),\n    source: summarySource(decision.decision),\n    status: decision.status,\n    attempts: decision.attempts,\n    failureOccurrence: decision.failureOccurrence,\n    failureCode: decision.failureCode,\n    canRetry: decisionRetryable(decision, overtaken),\n    lastError: decision.lastError?.slice(0, 512) ?? null,\n    createdAt: decision.createdAt.toISOString(),\n    updatedAt: decision.updatedAt.toISOString(),\n    completedAt: decision.completedAt?.toISOString() ?? null,\n  };\n}\n\nexport class WorkItemRoutes extends Route<WorkItemRoutesDeps> {\n  #defaultBoards: BoardRegistry | undefined;\n\n  get #boards(): BoardRegistry {\n    return this.deps.boardRegistry ?? (this.#defaultBoards ??= createBoardRegistry());\n  }\n\n  /** Resolve the `(orgId, userId)` tenant or a ready-to-return error response. */\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'The Factory board requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  /**\n   * Resolve the tenant AND the org-owned project from the `:id` param. Work\n   * items hang off a project, so listing/creating requires the project to\n   * exist in the caller's org.\n   */\n  async #resolveProject(c: Context): Promise<\n    | {\n        orgId: string;\n        userId: string;\n        factoryProjectId: string;\n        modelScope: EffectiveModelScope;\n        defaultModelId: string | null;\n      }\n    | { response: Response }\n  > {\n    const tenant = await this.#resolveTenant(c);\n    if ('response' in tenant) return tenant;\n\n    const parsedPath = FACTORY_ROUTE_CONTRACTS.projectGet.pathSchema.safeParse({ id: c.req.param('id') });\n    if (!parsedPath.success) {\n      return { response: c.json({ error: 'Project not found' }, 404) };\n    }\n    const projectId = parsedPath.data.id;\n    const { projects } = this.deps;\n    await projects.ensureReady();\n    const project = await projects.get({ orgId: tenant.orgId, id: projectId });\n    if (!project) {\n      return { response: c.json({ error: 'Project not found' }, 404) };\n    }\n    // Work-item starts are runs, so a hybrid Factory resolves the Factory's scope here.\n    const modelScope = effectiveModelScope(project.modelScope, 'run');\n    return {\n      ...tenant,\n      factoryProjectId: projectId,\n      modelScope,\n      defaultModelId: modelScope === 'factory' ? project.defaultModelId : null,\n    };\n  }\n\n  async #auditWorkItemPatch({\n    context,\n    item,\n    patch,\n  }: {\n    context: Context;\n    item: WorkItemRow;\n    patch: Record<string, unknown>;\n  }): Promise<void> {\n    await this.deps.audit.emit({\n      context,\n      input: {\n        action: 'factory.work_item.updated',\n        factoryProjectId: item.factoryProjectId,\n        targets: [{ type: 'work_item', id: item.id, name: item.title }],\n        metadata: { fields: patchedFields(patch) },\n      },\n    });\n  }\n\n  /** Releasing a parked run and dropping it: same request, opposite outcomes, both audited as consent. */\n  #proposalRoute({ verb }: { verb: 'approve' | 'dismiss' }): ApiRoute {\n    const { audit, workItems } = this.deps;\n    const contract =\n      verb === 'approve' ? FACTORY_ROUTE_CONTRACTS.decisionApprove : FACTORY_ROUTE_CONTRACTS.decisionDismiss;\n    return registerApiRoute(contract.path, {\n      method: contract.method,\n      requiresAuth: false,\n      handler: async c => {\n        const context = loose(c);\n        const resolved = await this.#resolveProject(context);\n        if ('response' in resolved) return resolved.response;\n        const parsedPath = contract.pathSchema.safeParse({\n          id: resolved.factoryProjectId,\n          decisionId: context.req.param('decisionId'),\n        });\n        if (!parsedPath.success) return c.json({ error: 'invalid_decision_id' }, 422);\n        const { decisionId } = parsedPath.data;\n        const settled = await resolveFactoryProposal({\n          workItems,\n          audit: input => audit.emit({ context, input }),\n          orgId: resolved.orgId,\n          factoryProjectId: resolved.factoryProjectId,\n          userId: resolved.userId,\n          decisionId,\n          action: verb,\n        });\n        if (!settled.ok) return c.json({ error: settled.code }, 409);\n        const { decision } = settled;\n        return c.json({ decision: decisionSummary(this.#boards, decision) });\n      },\n    });\n  }\n\n  /** Build the Factory work-item routes as Mastra `apiRoutes`. */\n  routes(): ApiRoute[] {\n    const { audit, workItems, queueHealth, transitionService, startCoordinator, liveSessions } = this.deps;\n    return [\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.boardCatalog.path, {\n        method: FACTORY_ROUTE_CONTRACTS.boardCatalog.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          return c.json({\n            boards: [...this.#boards].map(([id, board]) => ({\n              id,\n              title: board.title,\n              initialPhase: board.initialPhase,\n              phases: Object.entries(board.phases).map(([phaseId, phase]) => ({\n                id: phaseId,\n                title: phase.title,\n                kind: phase.kind,\n                ...(phase.kind === 'working' ? { role: phase.role } : {}),\n                transitions: (board.transitions[phaseId] ?? []).map(({ outcome, to }) => ({ outcome, to })),\n              })),\n            })),\n          });\n        },\n      }),\n      // ── List the org's work items for a project, and which are being worked ─\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemList.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemList.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          await workItems.ensureReady();\n          const items = await workItems.list({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n          });\n          return c.json({\n            workItems: items.map(toWireWorkItem),\n            runningSessionIds: sessionIdsWhere(items, sessionId => liveSessions.isRunning(sessionId)),\n            parkedSessionIds: sessionIdsWhere(items, sessionId => liveSessions.parked(sessionId) !== undefined),\n          });\n        },\n      }),\n\n      // ── Flow metrics aggregated over the project's work items ───────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.metricsGet.path, {\n        method: FACTORY_ROUTE_CONTRACTS.metricsGet.method,\n        requiresAuth: false,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n          const query = FACTORY_ROUTE_CONTRACTS.metricsGet.querySchema.safeParse({\n            from: context.req.query('from'),\n            to: context.req.query('to'),\n          });\n          if (!query.success) return c.json({ error: 'invalid_metrics_range' }, 400);\n          const { windowStart, windowEnd } = parseMetricsRange(query.data.from, query.data.to, new Date());\n          await workItems.ensureReady();\n          const items = await workItems.list({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n          });\n          return c.json({ metrics: computeFactoryMetrics(items, { windowStart, windowEnd }) });\n        },\n      }),\n\n      // ── Per-project queue-health age-threshold config (seconds) ─────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.healthThresholdsGet.path, {\n        method: FACTORY_ROUTE_CONTRACTS.healthThresholdsGet.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          await queueHealth.ensureReady();\n          const stored = await queueHealth.getConfig(resolved.orgId, resolved.factoryProjectId);\n          // Validate at the read choke point: `getConfig` round-trips a stored\n          // JSONB row, and only `saveConfig` validates on write — a corrupted or\n          // hand-edited row (empty / non-ascending) would otherwise flow to the\n          // chart and invert bucket colors. Fall back to the default on invalid.\n          return c.json({ thresholds: thresholdsOrDefault(stored) });\n        },\n      }),\n\n      // ── Bounded durable rule-decision status ────────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.decisionList.path, {\n        method: FACTORY_ROUTE_CONTRACTS.decisionList.method,\n        requiresAuth: false,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n\n          const query = FACTORY_ROUTE_CONTRACTS.decisionList.querySchema.safeParse({\n            statuses: context.req.query('statuses'),\n            before: context.req.query('before'),\n            limit: context.req.query('limit'),\n          });\n          if (!query.success) {\n            const field = query.error.issues[0]?.path[0];\n            return c.json({ error: field === 'before' ? 'invalid_cursor' : 'invalid_decision_query' }, 400);\n          }\n          await workItems.ensureReady();\n          const page = await workItems.listDeferredDecisionPage({\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            statuses: query.data.statuses,\n            before: query.data.before,\n            limit: query.data.limit,\n          });\n          const last = page.decisions.at(-1);\n          const overtaken = await overtakenDecisionIds(\n            workItems,\n            this.#boards,\n            resolved,\n            page.decisions.filter(decision => decision.status === 'failed'),\n          );\n          return c.json({\n            decisions: page.decisions.map(decision =>\n              decisionSummary(this.#boards, decision, overtaken.has(decision.id)),\n            ),\n            ...(page.hasMore && last ? { nextCursor: encodeDecisionCursor(last) } : {}),\n          });\n        },\n      }),\n\n      ...buildAttentionRoutes({\n        workItems,\n        boards: this.#boards,\n        comments: this.deps.comments,\n        liveSessions,\n        resolveProject: context => this.#resolveProject(loose(context)),\n      }),\n\n      this.#proposalRoute({ verb: 'approve' }),\n      this.#proposalRoute({ verb: 'dismiss' }),\n\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.decisionRetry.path, {\n        method: FACTORY_ROUTE_CONTRACTS.decisionRetry.method,\n        requiresAuth: false,\n        handler: async c => {\n          const context = loose(c);\n          const resolved = await this.#resolveProject(context);\n          if ('response' in resolved) return resolved.response;\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.decisionRetry.pathSchema.safeParse({\n            id: resolved.factoryProjectId,\n            decisionId: context.req.param('decisionId'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'invalid_decision_id' }, 422);\n          const { decisionId } = parsedPath.data;\n          const retried = await retryFactoryDecision({\n            workItems,\n            boards: this.#boards,\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            decisionId,\n          });\n          if (!retried.ok) return c.json({ error: retried.code }, 409);\n          const { decision } = retried;\n          return c.json({ decision: decisionSummary(this.#boards, decision) });\n        },\n      }),\n\n      // ── Create (upsert on sourceKey) a work item ─────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemCreate.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemCreate.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n\n          const body = await readJson(loose(c));\n          if (body === undefined) return c.json({ error: 'Invalid JSON body' }, 400);\n          const input = parseCreateWorkItem(body);\n          if (!input) return c.json({ error: 'invalid_work_item' }, 400);\n          try {\n            const created = await createFactoryWorkItem({\n              workItems,\n              boards: this.#boards,\n              transitionService,\n              audit: auditInput => audit.emit({ context: loose(c), input: auditInput }),\n              orgId: resolved.orgId,\n              userId: resolved.userId,\n              factoryProjectId: resolved.factoryProjectId,\n              input,\n              origin: auditRequestOrigin(loose(c)),\n            });\n            switch (created.status) {\n              case 'refused':\n                if (created.code === 'factory_transitions_unavailable') return c.json({ error: created.code }, 503);\n                return c.json(\n                  { error: created.code, message: created.message },\n                  created.code === 'invalid_board' ? 422 : 409,\n                );\n              case 'rejected':\n                return c.json({ status: 'rejected', code: created.code, reason: created.reason }, 422);\n              case 'reused': {\n                // Source-key reuse: the POST updated an existing card, not created one.\n                const { stages: _stages, sessions: _sessions, ...boundedPatch } = input;\n                await this.#auditWorkItemPatch({\n                  context: loose(c),\n                  item: created.item,\n                  patch: boundedPatch as unknown as Record<string, unknown>,\n                });\n                return c.json({ workItem: toWireWorkItem(created.item) });\n              }\n              case 'created':\n                return c.json({ workItem: toWireWorkItem(created.item) });\n            }\n          } catch (error) {\n            if (error instanceof WorkItemRelationError) {\n              return c.json({ error: error.code, message: error.message }, 400);\n            }\n            throw error;\n          }\n        },\n      }),\n\n      // ── Authoritative stage transition ──────────────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemTransition.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemTransition.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          const context = loose(c);\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.workItemTransition.pathSchema.safeParse({\n            id: resolved.factoryProjectId,\n            workItemId: context.req.param('workItemId'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n          const { workItemId } = parsedPath.data;\n          const parsed = parseTransitionBody(await readJson(context));\n          if (!parsed) return c.json({ error: 'invalid_transition_request' }, 400);\n          if (!transitionService) {\n            return c.json({ error: 'factory_transition_unavailable' }, 503);\n          }\n          await workItems.ensureReady();\n          const result = await transitionService.transition({\n            ...parsed,\n            orgId: resolved.orgId,\n            factoryProjectId: resolved.factoryProjectId,\n            workItemId,\n            actor: { type: 'human', id: resolved.userId },\n            ...auditRequestOrigin(loose(c)),\n            ingress: {\n              ...parsed.ingress,\n              identity: `human:${resolved.userId}:${parsed.ingress.identity}`,\n            },\n          });\n          if (result.status === 'accepted') return c.json({ result });\n          return c.json({ result }, result.code === 'stale' ? 409 : 422);\n        },\n      }),\n\n      // ── Bind a Factory run before dispatching its kickoff ────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemStart.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemStart.method,\n        requiresAuth: false,\n        handler: async c => {\n          const resolved = await this.#resolveProject(loose(c));\n          if ('response' in resolved) return resolved.response;\n          if (!startCoordinator) {\n            return c.json({ error: 'factory_start_unavailable' }, 503);\n          }\n          const input = parseStartBody(\n            await readJson(loose(c)),\n            resolved,\n            resolved.factoryProjectId,\n            resolved.modelScope,\n          );\n          if (!input) return c.json({ error: 'invalid_factory_start' }, 400);\n          input.requestContext = loose(c).get('requestContext');\n          input.defaultModelId = resolved.defaultModelId ?? undefined;\n          await workItems.ensureReady();\n          let prepared: FactoryStartPreparedResult;\n          try {\n            prepared = await startCoordinator.prepare(input);\n          } catch (error) {\n            if (error instanceof FactoryStartTransitionError) {\n              return c.json({ result: error.result }, error.result.code === 'stale' ? 409 : 422);\n            }\n            if (error instanceof WorkItemRepositoryError) {\n              return c.json({ error: error.code, message: error.message, candidates: error.candidates }, 409);\n            }\n            throw error;\n          }\n          return c.json({ prepared }, 202);\n        },\n      }),\n\n      // ── Patch non-stage metadata / sessions / title ──────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemUpdate.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemUpdate.method,\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          const context = loose(c);\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.workItemUpdate.pathSchema.safeParse({\n            id: context.req.param('id'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n          const { id } = parsedPath.data;\n\n          const body = await readJson(context);\n          if (body === undefined) return c.json({ error: 'Invalid JSON body' }, 400);\n          const patch = parseUpdateWorkItem(body);\n          if (!patch) return c.json({ error: 'invalid_work_item_patch' }, 400);\n\n          await workItems.ensureReady();\n          const existing = await workItems.get({ orgId: tenant.orgId, id });\n          if (!existing) return c.json({ error: 'Work item not found' }, 404);\n          if (patch.board !== undefined) {\n            const board = this.#boards.get(patch.board);\n            const stage = patch.stages?.length === 1 ? patch.stages[0] : undefined;\n            if (existing.board !== null) {\n              return c.json({ error: 'board_already_assigned' }, 409);\n            }\n            if (!board) {\n              return c.json({ error: 'board_not_installed' }, 400);\n            }\n            if (!stage || !Object.prototype.hasOwnProperty.call(board.phases, stage)) {\n              return c.json({ error: 'invalid_board_migration_phase' }, 400);\n            }\n          } else if (patch.stages !== undefined) {\n            return c.json(\n              { error: 'governed_transition_required', message: 'Use the Factory transition endpoint to move stages.' },\n              409,\n            );\n          }\n\n          try {\n            const updated = await workItems.update({\n              orgId: tenant.orgId,\n              id,\n              userId: tenant.userId,\n              patch,\n              ...(patch.board !== undefined ? { expectedRevision: existing.revision, expectedBoard: null } : {}),\n            });\n            if (!updated) return c.json({ error: 'Work item not found' }, 404);\n            await this.#auditWorkItemPatch({\n              context: loose(c),\n              item: updated.item,\n              patch: patch as Record<string, unknown>,\n            });\n            return c.json({ workItem: toWireWorkItem(updated.item) });\n          } catch (error) {\n            if (error instanceof WorkItemRelationError) {\n              return c.json({ error: error.code, message: error.message }, 400);\n            }\n            if (error instanceof WorkItemUpdateConflictError) {\n              return c.json({ error: error.reason === 'board' ? 'board_already_assigned' : error.code }, 409);\n            }\n            throw error;\n          }\n        },\n      }),\n\n      // ── Remove a work item ───────────────────────────────────────────────────\n      registerApiRoute(FACTORY_ROUTE_CONTRACTS.workItemDelete.path, {\n        method: FACTORY_ROUTE_CONTRACTS.workItemDelete.method,\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          const context = loose(c);\n          const parsedPath = FACTORY_ROUTE_CONTRACTS.workItemDelete.pathSchema.safeParse({\n            id: context.req.param('id'),\n          });\n          if (!parsedPath.success) return c.json({ error: 'Work item not found' }, 404);\n          const { id } = parsedPath.data;\n\n          await workItems.ensureReady();\n          const deleted = await workItems.delete({ orgId: tenant.orgId, id });\n          if (!deleted) return c.json({ error: 'Work item not found' }, 404);\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.work_item.deleted',\n              factoryProjectId: deleted.factoryProjectId,\n              targets: [{ type: 'work_item', id: deleted.id, name: deleted.title }],\n            },\n          });\n          return c.json({ ok: true });\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2EA,SAAS,eAAe,MAAgC;CACtD,IACE,CAAC,KAAK,YACL,EAAA,mCAAsC,KAAK,aAC1C,EAAA,sCAA6C,KAAK,aAClD,EAAA,6BAAiC,KAAK,WAExC,OAAO;CAET,OAAO;EAAE,GAAG;EAAM,UAAU,uBAAuB,KAAK,QAAQ,KAAK,CAAC;CAAE;AAC1E;;AAGA,SAAS,gBAAgB,OAAsB,WAAqD;CAClG,MAAM,yBAAS,IAAI,IAAY;CAC/B,KAAK,MAAM,QAAQ,OACjB,KAAK,MAAM,EAAE,eAAe,OAAO,OAAO,KAAK,QAAQ,GACrD,IAAI,UAAU,SAAS,GAAG,OAAO,IAAI,SAAS;CAGlD,OAAO,CAAC,GAAG,MAAM;AACnB;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAIA,SAAS,uBAAuB,OAAuE;CACrG,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,GACH,mCAAmC,mBACnC,0CAA0C,kBAC1C,8BAA8B,0BAC/B,GAAG,aACD;CACJ,OAAO;AACT;;AAGA,SAAgB,oBAAoB,MAA2C;CAC7E,MAAM,SAAS,wBAAwB,eAAe,WAAW,UAAU,IAAI;CAC/E,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;;AAGA,SAAgB,oBAAoB,MAA2C;CAC7E,MAAM,SAAS,wBAAwB,eAAe,WAAW,UAAU,IAAI;CAC/E,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAe,SAAS,GAA0C;CAChE,IAAI;EACF,OAAO,MAAM,EAAE,IAAI,KAAK;CAC1B,QAAQ;EACN;CACF;AACF;;AAGA,SAAS,cAAc,OAA0C;CAC/D,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,QAAO,QAAO,MAAM,SAAS,KAAA,CAAS;AAClE;AAEA,SAAS,oBACP,MAC8F;CAC9F,MAAM,SAAS,wBAAwB,mBAAmB,WAAW,UAAU,IAAI;CACnF,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,eACP,MACA,QACA,kBACA,YAC4B;CAC5B,MAAM,SAAS,wBAAwB,cAAc,WAAW,UAAU,IAAI;CAC9E,OAAO,OAAO,UAAU;EAAE,GAAG;EAAQ;EAAkB;EAAY,GAAG,OAAO;CAAK,IAAI;AACxF;AAEA,SAAS,qBAAqB,UAAiD;CAC7E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,SAAS,UAAU,YAAY,GAAG,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;AAClH;;AAGA,SAAS,YAAY,QAAuB,UAAkD;CAC5F,IAAI,OAAO,SAAS,SAAS,UAAU,OAAO,SAAS,KAAK,MAAM,GAAG,EAAE;CACvE,IAAI,SAAS,SAAS,cAAc,OAAO;CAC3C,MAAM,EAAE,OAAO,UAAU;CACzB,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAU,OAAO;CACnE,OAAO,OAAO,IAAI,KAAK,CAAC,EAAE,aAAa,KAAK,KAAK;AACnD;;AAGA,SAAS,cAAc,UAA0D;CAC/E,IAAI,SAAS,SAAS,wBAAwB,OAAO;CACrD,MAAM,SAAS,SAAS;CACxB,OAAO,WAAW,kBAChB,WAAW,eACX,WAAW,kBACX,WAAW,eACX,WAAW,kBACX,WAAW,WACT,SACA;AACN;AAEA,SAAS,gBAAgB,QAAuB,UAAyC,YAAY,OAAO;CAC1G,OAAO;EACL,IAAI,SAAS;EACb,cAAc,SAAS;EACvB,YAAY,SAAS;EACrB,MAAM,oBAAoB,QAAQ;EAClC,MAAM,YAAY,QAAQ,SAAS,QAAQ;EAC3C,QAAQ,cAAc,SAAS,QAAQ;EACvC,QAAQ,SAAS;EACjB,UAAU,SAAS;EACnB,mBAAmB,SAAS;EAC5B,aAAa,SAAS;EACtB,UAAU,kBAAkB,UAAU,SAAS;EAC/C,WAAW,SAAS,WAAW,MAAM,GAAG,GAAG,KAAK;EAChD,WAAW,SAAS,UAAU,YAAY;EAC1C,WAAW,SAAS,UAAU,YAAY;EAC1C,aAAa,SAAS,aAAa,YAAY,KAAK;CACtD;AACF;AAEA,IAAa,iBAAb,cAAoC,MAA0B;CAC5D;CAEA,IAAI,UAAyB;EAC3B,OAAO,KAAK,KAAK,kBAAkB,KAAK,mBAAmB,oBAAoB;CACjF;;CAGA,MAAM,eAAe,GAAiF;EACpG,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;EACjC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;EACtC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAA8C,GACzF,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;;;;;;CAOA,MAAM,gBAAgB,GASpB;EACA,MAAM,SAAS,MAAM,KAAK,eAAe,CAAC;EAC1C,IAAI,cAAc,QAAQ,OAAO;EAEjC,MAAM,aAAa,wBAAwB,WAAW,WAAW,UAAU,EAAE,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;EACpG,IAAI,CAAC,WAAW,SACd,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG,EAAE;EAEjE,MAAM,YAAY,WAAW,KAAK;EAClC,MAAM,EAAE,aAAa,KAAK;EAC1B,MAAM,SAAS,YAAY;EAC3B,MAAM,UAAU,MAAM,SAAS,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI;EAAU,CAAC;EACzE,IAAI,CAAC,SACH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG,EAAE;EAGjE,MAAM,aAAa,oBAAoB,QAAQ,YAAY,KAAK;EAChE,OAAO;GACL,GAAG;GACH,kBAAkB;GAClB;GACA,gBAAgB,eAAe,YAAY,QAAQ,iBAAiB;EACtE;CACF;CAEA,MAAM,oBAAoB,EACxB,SACA,MACA,SAKgB;EAChB,MAAM,KAAK,KAAK,MAAM,KAAK;GACzB;GACA,OAAO;IACL,QAAQ;IACR,kBAAkB,KAAK;IACvB,SAAS,CAAC;KAAE,MAAM;KAAa,IAAI,KAAK;KAAI,MAAM,KAAK;IAAM,CAAC;IAC9D,UAAU,EAAE,QAAQ,cAAc,KAAK,EAAE;GAC3C;EACF,CAAC;CACH;;CAGA,eAAe,EAAE,QAAmD;EAClE,MAAM,EAAE,OAAO,cAAc,KAAK;EAClC,MAAM,WACJ,SAAS,YAAY,wBAAwB,kBAAkB,wBAAwB;EACzF,OAAO,iBAAiB,SAAS,MAAM;GACrC,QAAQ,SAAS;GACjB,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,UAAU,MAAM,CAAC;IACvB,MAAM,WAAW,MAAM,KAAK,gBAAgB,OAAO;IACnD,IAAI,cAAc,UAAU,OAAO,SAAS;IAC5C,MAAM,aAAa,SAAS,WAAW,UAAU;KAC/C,IAAI,SAAS;KACb,YAAY,QAAQ,IAAI,MAAM,YAAY;IAC5C,CAAC;IACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;IAC5E,MAAM,EAAE,eAAe,WAAW;IAClC,MAAM,UAAU,MAAM,uBAAuB;KAC3C;KACA,QAAO,UAAS,MAAM,KAAK;MAAE;MAAS;KAAM,CAAC;KAC7C,OAAO,SAAS;KAChB,kBAAkB,SAAS;KAC3B,QAAQ,SAAS;KACjB;KACA,QAAQ;IACV,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,KAAK,GAAG,GAAG;IAC3D,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,KAAK,EAAE,UAAU,gBAAgB,KAAK,SAAS,QAAQ,EAAE,CAAC;GACrE;EACF,CAAC;CACH;;CAGA,SAAqB;EACnB,MAAM,EAAE,OAAO,WAAW,aAAa,mBAAmB,kBAAkB,iBAAiB,KAAK;EAClG,OAAO;GACL,iBAAiB,wBAAwB,aAAa,MAAM;IAC1D,QAAQ,wBAAwB,aAAa;IAC7C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,OAAO,EAAE,KAAK,EACZ,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,YAAY;MAC9C;MACA,OAAO,MAAM;MACb,cAAc,MAAM;MACpB,QAAQ,OAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY;OAC9D,IAAI;OACJ,OAAO,MAAM;OACb,MAAM,MAAM;OACZ,GAAI,MAAM,SAAS,YAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;OACvD,cAAc,MAAM,YAAY,YAAY,CAAC,EAAA,CAAG,KAAK,EAAE,SAAS,UAAU;QAAE;QAAS;OAAG,EAAE;MAC5F,EAAE;KACJ,EAAE,EACJ,CAAC;IACH;GACF,CAAC;GAED,iBAAiB,wBAAwB,aAAa,MAAM;IAC1D,QAAQ,wBAAwB,aAAa;IAC7C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,UAAU,YAAY;KAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK;MACjC,OAAO,SAAS;MAChB,kBAAkB,SAAS;KAC7B,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,WAAW,MAAM,IAAI,cAAc;MACnC,mBAAmB,gBAAgB,QAAO,cAAa,aAAa,UAAU,SAAS,CAAC;MACxF,kBAAkB,gBAAgB,QAAO,cAAa,aAAa,OAAO,SAAS,MAAM,KAAA,CAAS;KACpG,CAAC;IACH;GACF,CAAC;GAGD,iBAAiB,wBAAwB,WAAW,MAAM;IACxD,QAAQ,wBAAwB,WAAW;IAC3C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,WAAW,MAAM,KAAK,gBAAgB,OAAO;KACnD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,QAAQ,wBAAwB,WAAW,YAAY,UAAU;MACrE,MAAM,QAAQ,IAAI,MAAM,MAAM;MAC9B,IAAI,QAAQ,IAAI,MAAM,IAAI;KAC5B,CAAC;KACD,IAAI,CAAC,MAAM,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;KACzE,MAAM,EAAE,aAAa,cAAc,kBAAkB,MAAM,KAAK,MAAM,MAAM,KAAK,oBAAI,IAAI,KAAK,CAAC;KAC/F,MAAM,UAAU,YAAY;KAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK;MACjC,OAAO,SAAS;MAChB,kBAAkB,SAAS;KAC7B,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,SAAS,sBAAsB,OAAO;MAAE;MAAa;KAAU,CAAC,EAAE,CAAC;IACrF;GACF,CAAC;GAGD,iBAAiB,wBAAwB,oBAAoB,MAAM;IACjE,QAAQ,wBAAwB,oBAAoB;IACpD,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,YAAY,YAAY;KAC9B,MAAM,SAAS,MAAM,YAAY,UAAU,SAAS,OAAO,SAAS,gBAAgB;KAKpF,OAAO,EAAE,KAAK,EAAE,YAAY,oBAAoB,MAAM,EAAE,CAAC;IAC3D;GACF,CAAC;GAGD,iBAAiB,wBAAwB,aAAa,MAAM;IAC1D,QAAQ,wBAAwB,aAAa;IAC7C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,WAAW,MAAM,KAAK,gBAAgB,OAAO;KACnD,IAAI,cAAc,UAAU,OAAO,SAAS;KAE5C,MAAM,QAAQ,wBAAwB,aAAa,YAAY,UAAU;MACvE,UAAU,QAAQ,IAAI,MAAM,UAAU;MACtC,QAAQ,QAAQ,IAAI,MAAM,QAAQ;MAClC,OAAO,QAAQ,IAAI,MAAM,OAAO;KAClC,CAAC;KACD,IAAI,CAAC,MAAM,SAAS;MAClB,MAAM,QAAQ,MAAM,MAAM,OAAO,EAAE,EAAE,KAAK;MAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,UAAU,WAAW,mBAAmB,yBAAyB,GAAG,GAAG;KAChG;KACA,MAAM,UAAU,YAAY;KAC5B,MAAM,OAAO,MAAM,UAAU,yBAAyB;MACpD,OAAO,SAAS;MAChB,kBAAkB,SAAS;MAC3B,UAAU,MAAM,KAAK;MACrB,QAAQ,MAAM,KAAK;MACnB,OAAO,MAAM,KAAK;KACpB,CAAC;KACD,MAAM,OAAO,KAAK,UAAU,GAAG,EAAE;KACjC,MAAM,YAAY,MAAM,qBACtB,WACA,KAAK,SACL,UACA,KAAK,UAAU,QAAO,aAAY,SAAS,WAAW,QAAQ,CAChE;KACA,OAAO,EAAE,KAAK;MACZ,WAAW,KAAK,UAAU,KAAI,aAC5B,gBAAgB,KAAK,SAAS,UAAU,UAAU,IAAI,SAAS,EAAE,CAAC,CACpE;MACA,GAAI,KAAK,WAAW,OAAO,EAAE,YAAY,qBAAqB,IAAI,EAAE,IAAI,CAAC;KAC3E,CAAC;IACH;GACF,CAAC;GAED,GAAG,qBAAqB;IACtB;IACA,QAAQ,KAAK;IACb,UAAU,KAAK,KAAK;IACpB;IACA,iBAAgB,YAAW,KAAK,gBAAgB,MAAM,OAAO,CAAC;GAChE,CAAC;GAED,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;GACvC,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;GAEvC,iBAAiB,wBAAwB,cAAc,MAAM;IAC3D,QAAQ,wBAAwB,cAAc;IAC9C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,WAAW,MAAM,KAAK,gBAAgB,OAAO;KACnD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,aAAa,wBAAwB,cAAc,WAAW,UAAU;MAC5E,IAAI,SAAS;MACb,YAAY,QAAQ,IAAI,MAAM,YAAY;KAC5C,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,eAAe,WAAW;KAClC,MAAM,UAAU,MAAM,qBAAqB;MACzC;MACA,QAAQ,KAAK;MACb,OAAO,SAAS;MAChB,kBAAkB,SAAS;MAC3B;KACF,CAAC;KACD,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,KAAK,GAAG,GAAG;KAC3D,MAAM,EAAE,aAAa;KACrB,OAAO,EAAE,KAAK,EAAE,UAAU,gBAAgB,KAAK,SAAS,QAAQ,EAAE,CAAC;IACrE;GACF,CAAC;GAGD,iBAAiB,wBAAwB,eAAe,MAAM;IAC5D,QAAQ,wBAAwB,eAAe;IAC/C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAE5C,MAAM,OAAO,MAAM,SAAS,MAAM,CAAC,CAAC;KACpC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzE,MAAM,QAAQ,oBAAoB,IAAI;KACtC,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KAC7D,IAAI;MACF,MAAM,UAAU,MAAM,sBAAsB;OAC1C;OACA,QAAQ,KAAK;OACb;OACA,QAAO,eAAc,MAAM,KAAK;QAAE,SAAS,MAAM,CAAC;QAAG,OAAO;OAAW,CAAC;OACxE,OAAO,SAAS;OAChB,QAAQ,SAAS;OACjB,kBAAkB,SAAS;OAC3B;OACA,QAAQ,mBAAmB,MAAM,CAAC,CAAC;MACrC,CAAC;MACD,QAAQ,QAAQ,QAAhB;OACE,KAAK;QACH,IAAI,QAAQ,SAAS,mCAAmC,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,KAAK,GAAG,GAAG;QAClG,OAAO,EAAE,KACP;SAAE,OAAO,QAAQ;SAAM,SAAS,QAAQ;QAAQ,GAChD,QAAQ,SAAS,kBAAkB,MAAM,GAC3C;OACF,KAAK,YACH,OAAO,EAAE,KAAK;QAAE,QAAQ;QAAY,MAAM,QAAQ;QAAM,QAAQ,QAAQ;OAAO,GAAG,GAAG;OACvF,KAAK,UAAU;QAEb,MAAM,EAAE,QAAQ,SAAS,UAAU,WAAW,GAAG,iBAAiB;QAClE,MAAM,KAAK,oBAAoB;SAC7B,SAAS,MAAM,CAAC;SAChB,MAAM,QAAQ;SACd,OAAO;QACT,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,UAAU,eAAe,QAAQ,IAAI,EAAE,CAAC;OAC1D;OACA,KAAK,WACH,OAAO,EAAE,KAAK,EAAE,UAAU,eAAe,QAAQ,IAAI,EAAE,CAAC;MAC5D;KACF,SAAS,OAAO;MACd,IAAI,iBAAiB,uBACnB,OAAO,EAAE,KAAK;OAAE,OAAO,MAAM;OAAM,SAAS,MAAM;MAAQ,GAAG,GAAG;MAElE,MAAM;KACR;IACF;GACF,CAAC;GAGD,iBAAiB,wBAAwB,mBAAmB,MAAM;IAChE,QAAQ,wBAAwB,mBAAmB;IACnD,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,aAAa,wBAAwB,mBAAmB,WAAW,UAAU;MACjF,IAAI,SAAS;MACb,YAAY,QAAQ,IAAI,MAAM,YAAY;KAC5C,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,eAAe,WAAW;KAClC,MAAM,SAAS,oBAAoB,MAAM,SAAS,OAAO,CAAC;KAC1D,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;KACvE,IAAI,CAAC,mBACH,OAAO,EAAE,KAAK,EAAE,OAAO,iCAAiC,GAAG,GAAG;KAEhE,MAAM,UAAU,YAAY;KAC5B,MAAM,SAAS,MAAM,kBAAkB,WAAW;MAChD,GAAG;MACH,OAAO,SAAS;MAChB,kBAAkB,SAAS;MAC3B;MACA,OAAO;OAAE,MAAM;OAAS,IAAI,SAAS;MAAO;MAC5C,GAAG,mBAAmB,MAAM,CAAC,CAAC;MAC9B,SAAS;OACP,GAAG,OAAO;OACV,UAAU,SAAS,SAAS,OAAO,GAAG,OAAO,QAAQ;MACvD;KACF,CAAC;KACD,IAAI,OAAO,WAAW,YAAY,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;KAC1D,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,SAAS,UAAU,MAAM,GAAG;IAC/D;GACF,CAAC;GAGD,iBAAiB,wBAAwB,cAAc,MAAM;IAC3D,QAAQ,wBAAwB,cAAc;IAC9C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,WAAW,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;KACpD,IAAI,cAAc,UAAU,OAAO,SAAS;KAC5C,IAAI,CAAC,kBACH,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAE3D,MAAM,QAAQ,eACZ,MAAM,SAAS,MAAM,CAAC,CAAC,GACvB,UACA,SAAS,kBACT,SAAS,UACX;KACA,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,GAAG,GAAG;KACjE,MAAM,iBAAiB,MAAM,CAAC,CAAC,CAAC,IAAI,gBAAgB;KACpD,MAAM,iBAAiB,SAAS,kBAAkB,KAAA;KAClD,MAAM,UAAU,YAAY;KAC5B,IAAI;KACJ,IAAI;MACF,WAAW,MAAM,iBAAiB,QAAQ,KAAK;KACjD,SAAS,OAAO;MACd,IAAI,iBAAiB,6BACnB,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,SAAS,UAAU,MAAM,GAAG;MAEnF,IAAI,iBAAiB,yBACnB,OAAO,EAAE,KAAK;OAAE,OAAO,MAAM;OAAM,SAAS,MAAM;OAAS,YAAY,MAAM;MAAW,GAAG,GAAG;MAEhG,MAAM;KACR;KACA,OAAO,EAAE,KAAK,EAAE,SAAS,GAAG,GAAG;IACjC;GACF,CAAC;GAGD,iBAAiB,wBAAwB,eAAe,MAAM;IAC5D,QAAQ,wBAAwB,eAAe;IAC/C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,aAAa,wBAAwB,eAAe,WAAW,UAAU,EAC7E,IAAI,QAAQ,IAAI,MAAM,IAAI,EAC5B,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,OAAO,WAAW;KAE1B,MAAM,OAAO,MAAM,SAAS,OAAO;KACnC,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACzE,MAAM,QAAQ,oBAAoB,IAAI;KACtC,IAAI,CAAC,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;KAEnE,MAAM,UAAU,YAAY;KAC5B,MAAM,WAAW,MAAM,UAAU,IAAI;MAAE,OAAO,OAAO;MAAO;KAAG,CAAC;KAChE,IAAI,CAAC,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAClE,IAAI,MAAM,UAAU,KAAA,GAAW;MAC7B,MAAM,QAAQ,KAAK,QAAQ,IAAI,MAAM,KAAK;MAC1C,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,MAAM,OAAO,KAAK,KAAA;MAC7D,IAAI,SAAS,UAAU,MACrB,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,GAAG,GAAG;MAExD,IAAI,CAAC,OACH,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;MAErD,IAAI,CAAC,SAAS,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,QAAQ,KAAK,GACrE,OAAO,EAAE,KAAK,EAAE,OAAO,gCAAgC,GAAG,GAAG;KAEjE,OAAO,IAAI,MAAM,WAAW,KAAA,GAC1B,OAAO,EAAE,KACP;MAAE,OAAO;MAAgC,SAAS;KAAsD,GACxG,GACF;KAGF,IAAI;MACF,MAAM,UAAU,MAAM,UAAU,OAAO;OACrC,OAAO,OAAO;OACd;OACA,QAAQ,OAAO;OACf;OACA,GAAI,MAAM,UAAU,KAAA,IAAY;QAAE,kBAAkB,SAAS;QAAU,eAAe;OAAK,IAAI,CAAC;MAClG,CAAC;MACD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;MACjE,MAAM,KAAK,oBAAoB;OAC7B,SAAS,MAAM,CAAC;OAChB,MAAM,QAAQ;OACP;MACT,CAAC;MACD,OAAO,EAAE,KAAK,EAAE,UAAU,eAAe,QAAQ,IAAI,EAAE,CAAC;KAC1D,SAAS,OAAO;MACd,IAAI,iBAAiB,uBACnB,OAAO,EAAE,KAAK;OAAE,OAAO,MAAM;OAAM,SAAS,MAAM;MAAQ,GAAG,GAAG;MAElE,IAAI,iBAAiB,6BACnB,OAAO,EAAE,KAAK,EAAE,OAAO,MAAM,WAAW,UAAU,2BAA2B,MAAM,KAAK,GAAG,GAAG;MAEhG,MAAM;KACR;IACF;GACF,CAAC;GAGD,iBAAiB,wBAAwB,eAAe,MAAM;IAC5D,QAAQ,wBAAwB,eAAe;IAC/C,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,MAAM,UAAU,MAAM,CAAC;KACvB,MAAM,aAAa,wBAAwB,eAAe,WAAW,UAAU,EAC7E,IAAI,QAAQ,IAAI,MAAM,IAAI,EAC5B,CAAC;KACD,IAAI,CAAC,WAAW,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAC5E,MAAM,EAAE,OAAO,WAAW;KAE1B,MAAM,UAAU,YAAY;KAC5B,MAAM,UAAU,MAAM,UAAU,OAAO;MAAE,OAAO,OAAO;MAAO;KAAG,CAAC;KAClE,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KACjE,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,kBAAkB,QAAQ;OAC1B,SAAS,CAAC;QAAE,MAAM;QAAa,IAAI,QAAQ;QAAI,MAAM,QAAQ;OAAM,CAAC;MACtE;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC;IAC5B;GACF,CAAC;EACH;CACF;AACF"}

package/dist/rules/binding-context.js

@@ -15,7 +15,8 @@ function getFactorySessionCoordinates(requestContext) {
 function getFactorySessionAddress(requestContext) {
 	const coordinates = getFactorySessionCoordinates(requestContext);
 	if (!coordinates || !requestContext || typeof requestContext.get !== "function") return null;
-	const orgId = getFactoryAuthOrgId(getFactoryAuthUserFromContext(requestContext));
+	const user = getFactoryAuthUserFromContext(requestContext);
+	const orgId = getFactoryAuthOrgId(user);
 	if (!orgId) return null;
 	return {
 		orgId,
@@ -76,7 +77,8 @@ async function resolveFactorySessionAddress(options) {
 	if (!requestContext || typeof requestContext.get !== "function") return null;
 	const context = requestContext.get("controller");
 	if (!context?.threadId || !context.resourceId || !context.sessionId) return null;
-	const orgId = getFactoryAuthOrgId(getFactoryAuthUserFromContext(requestContext));
+	const user = getFactoryAuthUserFromContext(requestContext);
+	const orgId = getFactoryAuthOrgId(user);
 	if (!orgId) return null;
 	const binding = await options.storage.findActiveRunBindingByThread({
 		orgId,

package/dist/rules/binding-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding-context.js","names":[],"sources":["../../src/rules/binding-context.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { getFactoryAuthOrgId, getFactoryAuthUserFromContext } from '../auth.js';\nimport type {\n  FactoryRunBindingAddress,\n  FactoryRunBindingRecord,\n  FactoryRunBindingSessionAddress,\n  WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  factoryOrgId?: string;\n  projectRepositoryId?: string;\n  untrustedCheckout?: boolean;\n  baseRef?: string;\n}\n\ntype FactorySessionControllerContext = AgentControllerRequestContext<FactorySessionState>;\n\n/** Minimal source-control session lookup used to heal recovered session state. */\nexport interface FactorySessionSourceLookup {\n  getBySessionId(\n    sessionId: string,\n  ): Promise<{ orgId: string; projectRepositoryId: string | null; baseBranch: string } | null>;\n}\n\nexport function getFactorySessionCoordinates(\n  requestContext: RequestContext | undefined,\n): FactoryRunBindingSessionAddress | null {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  const factoryProjectId = context?.getState().factoryProjectId;\n  if (!context?.threadId || !context.resourceId || !context.sessionId || !factoryProjectId) return null;\n  return {\n    factoryProjectId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.sessionId,\n  };\n}\n\nexport function getFactorySessionAddress(requestContext: RequestContext | undefined): FactoryRunBindingAddress | null {\n  const coordinates = getFactorySessionCoordinates(requestContext);\n  if (!coordinates || !requestContext || typeof requestContext.get !== 'function') return null;\n  const user = getFactoryAuthUserFromContext(requestContext);\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n  return { orgId, ...coordinates };\n}\n\n/**\n * Read the session's factory scoping off controller state: the project whose\n * shared settings row applies to its runs, plus the org rung that row is keyed\n * by (`factoryOrgId` is seeded at session start and is authoritative for\n * downstream identity reads — the owner id is a user, never an org).\n */\nexport function readFactorySessionScope(\n  requestContext: RequestContext | undefined,\n): { factoryProjectId: string; factoryOrgId?: string } | null {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  const state = context?.getState();\n  const factoryProjectId = state?.factoryProjectId;\n  if (typeof factoryProjectId !== 'string' || factoryProjectId.length === 0) return null;\n  const factoryOrgId = state?.factoryOrgId;\n  return {\n    factoryProjectId,\n    ...(typeof factoryOrgId === 'string' && factoryOrgId.length > 0 ? { factoryOrgId } : {}),\n  };\n}\n\n/**\n * Read the active run binding for this session when controller state has lost\n * `factoryProjectId` — a crash-recovered session (\"Continue\") is recreated with\n * empty state, so the binding table is the only remaining source of the project\n * whose shared settings row applies to the run. Read-only, unlike\n * `resolveFactorySessionAddress`: it neither heals state nor touches source\n * control, so input processors can call it before any tool has run.\n */\nexport async function findSessionRunBinding(\n  requestContext: RequestContext | undefined,\n  storage: Pick<WorkItemsStorage, 'findActiveRunBindingByThread'>,\n): Promise<FactoryRunBindingRecord | null> {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  if (!context?.threadId || !context.resourceId || !context.sessionId) return null;\n  const orgId = getFactoryAuthOrgId(getFactoryAuthUserFromContext(requestContext));\n  if (!orgId) return null;\n  return storage.findActiveRunBindingByThread({\n    orgId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.sessionId,\n  });\n}\n\nexport interface FactorySessionAddressResolution {\n  address: FactoryRunBindingAddress;\n  /** Present only when the address was recovered from the binding table. */\n  binding?: FactoryRunBindingRecord;\n}\n\n/**\n * Resolve the bound session address, falling back to the active binding row\n * when the in-memory session state is missing `factoryProjectId` — a server\n * crash drops controller sessions, and a resumed session (\"Continue\") is\n * recreated with empty state, which silently unregistered the transition\n * tool. On recovery the lost state is healed back onto the session (including\n * the `untrustedCheckout`/`baseRef` security posture the start coordinator\n * originally seeded) so later reads resolve directly.\n */\nexport async function resolveFactorySessionAddress(options: {\n  requestContext: RequestContext | undefined;\n  storage: Pick<WorkItemsStorage, 'findActiveRunBindingByThread' | 'get'>;\n  sessions?: FactorySessionSourceLookup;\n  /**\n   * Resolve through the binding table even when state already carries\n   * `factoryProjectId`, so the row heals the rest of the session state. Prompt\n   * creation uses this: a partially persisted state can keep the project id\n   * while the untrusted-checkout posture is gone, and the direct short-circuit\n   * would take that id as proof the session is intact.\n   */\n  forceBindingLookup?: boolean;\n}): Promise<FactorySessionAddressResolution | null> {\n  const direct = options.forceBindingLookup ? null : getFactorySessionAddress(options.requestContext);\n  if (direct) return { address: direct };\n\n  const requestContext = options.requestContext;\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  if (!context?.threadId || !context.resourceId || !context.sessionId) return null;\n  const user = getFactoryAuthUserFromContext(requestContext);\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n\n  const binding = await options.storage.findActiveRunBindingByThread({\n    orgId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.sessionId,\n  });\n  if (!binding) return null;\n\n  await healRecoveredSessionState({ context, binding, storage: options.storage, sessions: options.sessions });\n\n  return {\n    address: {\n      orgId,\n      factoryProjectId: binding.factoryProjectId,\n      threadId: context.threadId,\n      resourceId: context.resourceId,\n      sessionId: context.sessionId,\n    },\n    binding,\n  };\n}\n\nasync function healRecoveredSessionState(options: {\n  context: FactorySessionControllerContext;\n  binding: FactoryRunBindingRecord;\n  storage: Pick<WorkItemsStorage, 'get'>;\n  sessions?: FactorySessionSourceLookup;\n}): Promise<void> {\n  const { binding } = options;\n  // `factoryOrgId` mirrors the start coordinator's seed: the binding row holds\n  // the authoritative org id, so crash-recovered sessions heal it for free.\n  const updates: FactorySessionState = { factoryProjectId: binding.factoryProjectId, factoryOrgId: binding.orgId };\n  // Security posture first, from the binding row alone (no I/O): review-bound\n  // sessions run against attacker-writable checkouts, so `untrustedCheckout`\n  // must survive even if the enrichment lookups below fail transiently.\n  if (binding.role === 'review') {\n    updates.untrustedCheckout = true;\n  }\n  // Best-effort enrichment mirroring the start coordinator's original seed:\n  // PR-sourced work items are untrusted regardless of role, and `baseRef`\n  // restores the trusted instruction source for untrusted checkouts.\n  try {\n    const item = await options.storage.get({ orgId: binding.orgId, id: binding.workItemId });\n    const foundSession = (await options.sessions?.getBySessionId(binding.sessionId)) ?? null;\n    const sourceSession = foundSession?.orgId === binding.orgId ? foundSession : null;\n    if (sourceSession?.projectRepositoryId) {\n      updates.projectRepositoryId = sourceSession.projectRepositoryId;\n    }\n    const untrusted = updates.untrustedCheckout === true || item?.externalSource?.type === 'pull-request';\n    if (untrusted) {\n      updates.untrustedCheckout = true;\n      const metadataBaseBranch = item?.metadata?.baseBranch;\n      const baseRef =\n        sourceSession?.baseBranch ||\n        (typeof metadataBaseBranch === 'string' && metadataBaseBranch ? metadataBaseBranch : undefined);\n      if (baseRef) updates.baseRef = baseRef;\n    } else {\n      // Record the trusted verdict explicitly so a healed session carries every\n      // trust field; the prompt-time recovery check treats a missing flag as\n      // \"not yet verified\" and would otherwise re-run on every prompt. Left\n      // unset when enrichment fails so the next prompt retries the lookup.\n      updates.untrustedCheckout = false;\n    }\n  } catch {\n    // Enrichment is best-effort; the address itself only needs the binding.\n  }\n  try {\n    await options.context.setState(updates);\n  } catch {\n    // State healing must never block tool registration on the recovered address.\n  }\n}\n"],"mappings":";;AA4BA,SAAgB,6BACd,gBACwC;CACxC,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,MAAM,mBAAmB,SAAS,SAAS,CAAC,CAAC;CAC7C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa,CAAC,kBAAkB,OAAO;CACjG,OAAO;EACL;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB;AACF;AAEA,SAAgB,yBAAyB,gBAA6E;CACpH,MAAM,cAAc,6BAA6B,cAAc;CAC/D,IAAI,CAAC,eAAe,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CAExF,MAAM,QAAQ,oBADD,8BAA8B,cACN,CAAC;CACtC,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO;EAAE;EAAO,GAAG;CAAY;AACjC;;;;;;;AAQA,SAAgB,wBACd,gBAC4D;CAC5D,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CAExE,MAAM,QADU,eAAe,IAAI,YACf,CAAC,EAAE,SAAS;CAChC,MAAM,mBAAmB,OAAO;CAChC,IAAI,OAAO,qBAAqB,YAAY,iBAAiB,WAAW,GAAG,OAAO;CAClF,MAAM,eAAe,OAAO;CAC5B,OAAO;EACL;EACA,GAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;CACxF;AACF;;;;;;;;;AAUA,eAAsB,sBACpB,gBACA,SACyC;CACzC,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,QAAQ,WAAW,OAAO;CAC5E,MAAM,QAAQ,oBAAoB,8BAA8B,cAAc,CAAC;CAC/E,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO,QAAQ,6BAA6B;EAC1C;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;AACH;;;;;;;;;;AAiBA,eAAsB,6BAA6B,SAYC;CAClD,MAAM,SAAS,QAAQ,qBAAqB,OAAO,yBAAyB,QAAQ,cAAc;CAClG,IAAI,QAAQ,OAAO,EAAE,SAAS,OAAO;CAErC,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,QAAQ,WAAW,OAAO;CAE5E,MAAM,QAAQ,oBADD,8BAA8B,cACN,CAAC;CACtC,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,UAAU,MAAM,QAAQ,QAAQ,6BAA6B;EACjE;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CACD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,0BAA0B;EAAE;EAAS;EAAS,SAAS,QAAQ;EAAS,UAAU,QAAQ;CAAS,CAAC;CAE1G,OAAO;EACL,SAAS;GACP;GACA,kBAAkB,QAAQ;GAC1B,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,WAAW,QAAQ;EACrB;EACA;CACF;AACF;AAEA,eAAe,0BAA0B,SAKvB;CAChB,MAAM,EAAE,YAAY;CAGpB,MAAM,UAA+B;EAAE,kBAAkB,QAAQ;EAAkB,cAAc,QAAQ;CAAM;CAI/G,IAAI,QAAQ,SAAS,UACnB,QAAQ,oBAAoB;CAK9B,IAAI;EACF,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI;GAAE,OAAO,QAAQ;GAAO,IAAI,QAAQ;EAAW,CAAC;EACvF,MAAM,eAAgB,MAAM,QAAQ,UAAU,eAAe,QAAQ,SAAS,KAAM;EACpF,MAAM,gBAAgB,cAAc,UAAU,QAAQ,QAAQ,eAAe;EAC7E,IAAI,eAAe,qBACjB,QAAQ,sBAAsB,cAAc;EAG9C,IADkB,QAAQ,sBAAsB,QAAQ,MAAM,gBAAgB,SAAS,gBACxE;GACb,QAAQ,oBAAoB;GAC5B,MAAM,qBAAqB,MAAM,UAAU;GAC3C,MAAM,UACJ,eAAe,eACd,OAAO,uBAAuB,YAAY,qBAAqB,qBAAqB,KAAA;GACvF,IAAI,SAAS,QAAQ,UAAU;EACjC,OAKE,QAAQ,oBAAoB;CAEhC,QAAQ,CAER;CACA,IAAI;EACF,MAAM,QAAQ,QAAQ,SAAS,OAAO;CACxC,QAAQ,CAER;AACF"}
+{"version":3,"file":"binding-context.js","names":[],"sources":["../../src/rules/binding-context.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { getFactoryAuthOrgId, getFactoryAuthUserFromContext } from '../auth.js';\nimport type {\n  FactoryRunBindingAddress,\n  FactoryRunBindingRecord,\n  FactoryRunBindingSessionAddress,\n  WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  factoryOrgId?: string;\n  projectRepositoryId?: string;\n  untrustedCheckout?: boolean;\n  baseRef?: string;\n}\n\ntype FactorySessionControllerContext = AgentControllerRequestContext<FactorySessionState>;\n\n/** Minimal source-control session lookup used to heal recovered session state. */\nexport interface FactorySessionSourceLookup {\n  getBySessionId(\n    sessionId: string,\n  ): Promise<{ orgId: string; projectRepositoryId: string | null; baseBranch: string } | null>;\n}\n\nexport function getFactorySessionCoordinates(\n  requestContext: RequestContext | undefined,\n): FactoryRunBindingSessionAddress | null {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  const factoryProjectId = context?.getState().factoryProjectId;\n  if (!context?.threadId || !context.resourceId || !context.sessionId || !factoryProjectId) return null;\n  return {\n    factoryProjectId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.sessionId,\n  };\n}\n\nexport function getFactorySessionAddress(requestContext: RequestContext | undefined): FactoryRunBindingAddress | null {\n  const coordinates = getFactorySessionCoordinates(requestContext);\n  if (!coordinates || !requestContext || typeof requestContext.get !== 'function') return null;\n  const user = getFactoryAuthUserFromContext(requestContext);\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n  return { orgId, ...coordinates };\n}\n\n/**\n * Read the session's factory scoping off controller state: the project whose\n * shared settings row applies to its runs, plus the org rung that row is keyed\n * by (`factoryOrgId` is seeded at session start and is authoritative for\n * downstream identity reads — the owner id is a user, never an org).\n */\nexport function readFactorySessionScope(\n  requestContext: RequestContext | undefined,\n): { factoryProjectId: string; factoryOrgId?: string } | null {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  const state = context?.getState();\n  const factoryProjectId = state?.factoryProjectId;\n  if (typeof factoryProjectId !== 'string' || factoryProjectId.length === 0) return null;\n  const factoryOrgId = state?.factoryOrgId;\n  return {\n    factoryProjectId,\n    ...(typeof factoryOrgId === 'string' && factoryOrgId.length > 0 ? { factoryOrgId } : {}),\n  };\n}\n\n/**\n * Read the active run binding for this session when controller state has lost\n * `factoryProjectId` — a crash-recovered session (\"Continue\") is recreated with\n * empty state, so the binding table is the only remaining source of the project\n * whose shared settings row applies to the run. Read-only, unlike\n * `resolveFactorySessionAddress`: it neither heals state nor touches source\n * control, so input processors can call it before any tool has run.\n */\nexport async function findSessionRunBinding(\n  requestContext: RequestContext | undefined,\n  storage: Pick<WorkItemsStorage, 'findActiveRunBindingByThread'>,\n): Promise<FactoryRunBindingRecord | null> {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  if (!context?.threadId || !context.resourceId || !context.sessionId) return null;\n  const orgId = getFactoryAuthOrgId(getFactoryAuthUserFromContext(requestContext));\n  if (!orgId) return null;\n  return storage.findActiveRunBindingByThread({\n    orgId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.sessionId,\n  });\n}\n\nexport interface FactorySessionAddressResolution {\n  address: FactoryRunBindingAddress;\n  /** Present only when the address was recovered from the binding table. */\n  binding?: FactoryRunBindingRecord;\n}\n\n/**\n * Resolve the bound session address, falling back to the active binding row\n * when the in-memory session state is missing `factoryProjectId` — a server\n * crash drops controller sessions, and a resumed session (\"Continue\") is\n * recreated with empty state, which silently unregistered the transition\n * tool. On recovery the lost state is healed back onto the session (including\n * the `untrustedCheckout`/`baseRef` security posture the start coordinator\n * originally seeded) so later reads resolve directly.\n */\nexport async function resolveFactorySessionAddress(options: {\n  requestContext: RequestContext | undefined;\n  storage: Pick<WorkItemsStorage, 'findActiveRunBindingByThread' | 'get'>;\n  sessions?: FactorySessionSourceLookup;\n  /**\n   * Resolve through the binding table even when state already carries\n   * `factoryProjectId`, so the row heals the rest of the session state. Prompt\n   * creation uses this: a partially persisted state can keep the project id\n   * while the untrusted-checkout posture is gone, and the direct short-circuit\n   * would take that id as proof the session is intact.\n   */\n  forceBindingLookup?: boolean;\n}): Promise<FactorySessionAddressResolution | null> {\n  const direct = options.forceBindingLookup ? null : getFactorySessionAddress(options.requestContext);\n  if (direct) return { address: direct };\n\n  const requestContext = options.requestContext;\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  if (!context?.threadId || !context.resourceId || !context.sessionId) return null;\n  const user = getFactoryAuthUserFromContext(requestContext);\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n\n  const binding = await options.storage.findActiveRunBindingByThread({\n    orgId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.sessionId,\n  });\n  if (!binding) return null;\n\n  await healRecoveredSessionState({ context, binding, storage: options.storage, sessions: options.sessions });\n\n  return {\n    address: {\n      orgId,\n      factoryProjectId: binding.factoryProjectId,\n      threadId: context.threadId,\n      resourceId: context.resourceId,\n      sessionId: context.sessionId,\n    },\n    binding,\n  };\n}\n\nasync function healRecoveredSessionState(options: {\n  context: FactorySessionControllerContext;\n  binding: FactoryRunBindingRecord;\n  storage: Pick<WorkItemsStorage, 'get'>;\n  sessions?: FactorySessionSourceLookup;\n}): Promise<void> {\n  const { binding } = options;\n  // `factoryOrgId` mirrors the start coordinator's seed: the binding row holds\n  // the authoritative org id, so crash-recovered sessions heal it for free.\n  const updates: FactorySessionState = { factoryProjectId: binding.factoryProjectId, factoryOrgId: binding.orgId };\n  // Security posture first, from the binding row alone (no I/O): review-bound\n  // sessions run against attacker-writable checkouts, so `untrustedCheckout`\n  // must survive even if the enrichment lookups below fail transiently.\n  if (binding.role === 'review') {\n    updates.untrustedCheckout = true;\n  }\n  // Best-effort enrichment mirroring the start coordinator's original seed:\n  // PR-sourced work items are untrusted regardless of role, and `baseRef`\n  // restores the trusted instruction source for untrusted checkouts.\n  try {\n    const item = await options.storage.get({ orgId: binding.orgId, id: binding.workItemId });\n    const foundSession = (await options.sessions?.getBySessionId(binding.sessionId)) ?? null;\n    const sourceSession = foundSession?.orgId === binding.orgId ? foundSession : null;\n    if (sourceSession?.projectRepositoryId) {\n      updates.projectRepositoryId = sourceSession.projectRepositoryId;\n    }\n    const untrusted = updates.untrustedCheckout === true || item?.externalSource?.type === 'pull-request';\n    if (untrusted) {\n      updates.untrustedCheckout = true;\n      const metadataBaseBranch = item?.metadata?.baseBranch;\n      const baseRef =\n        sourceSession?.baseBranch ||\n        (typeof metadataBaseBranch === 'string' && metadataBaseBranch ? metadataBaseBranch : undefined);\n      if (baseRef) updates.baseRef = baseRef;\n    } else {\n      // Record the trusted verdict explicitly so a healed session carries every\n      // trust field; the prompt-time recovery check treats a missing flag as\n      // \"not yet verified\" and would otherwise re-run on every prompt. Left\n      // unset when enrichment fails so the next prompt retries the lookup.\n      updates.untrustedCheckout = false;\n    }\n  } catch {\n    // Enrichment is best-effort; the address itself only needs the binding.\n  }\n  try {\n    await options.context.setState(updates);\n  } catch {\n    // State healing must never block tool registration on the recovered address.\n  }\n}\n"],"mappings":";;AA4BA,SAAgB,6BACd,gBACwC;CACxC,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,MAAM,mBAAmB,SAAS,SAAS,CAAC,CAAC;CAC7C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa,CAAC,kBAAkB,OAAO;CACjG,OAAO;EACL;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB;AACF;AAEA,SAAgB,yBAAyB,gBAA6E;CACpH,MAAM,cAAc,6BAA6B,cAAc;CAC/D,IAAI,CAAC,eAAe,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxF,MAAM,OAAO,8BAA8B,cAAc;CACzD,MAAM,QAAQ,oBAAoB,IAAI;CACtC,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO;EAAE;EAAO,GAAG;CAAY;AACjC;;;;;;;AAQA,SAAgB,wBACd,gBAC4D;CAC5D,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CAExE,MAAM,QADU,eAAe,IAAI,YACf,CAAC,EAAE,SAAS;CAChC,MAAM,mBAAmB,OAAO;CAChC,IAAI,OAAO,qBAAqB,YAAY,iBAAiB,WAAW,GAAG,OAAO;CAClF,MAAM,eAAe,OAAO;CAC5B,OAAO;EACL;EACA,GAAI,OAAO,iBAAiB,YAAY,aAAa,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;CACxF;AACF;;;;;;;;;AAUA,eAAsB,sBACpB,gBACA,SACyC;CACzC,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,QAAQ,WAAW,OAAO;CAC5E,MAAM,QAAQ,oBAAoB,8BAA8B,cAAc,CAAC;CAC/E,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO,QAAQ,6BAA6B;EAC1C;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;AACH;;;;;;;;;;AAiBA,eAAsB,6BAA6B,SAYC;CAClD,MAAM,SAAS,QAAQ,qBAAqB,OAAO,yBAAyB,QAAQ,cAAc;CAClG,IAAI,QAAQ,OAAO,EAAE,SAAS,OAAO;CAErC,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,QAAQ,WAAW,OAAO;CAC5E,MAAM,OAAO,8BAA8B,cAAc;CACzD,MAAM,QAAQ,oBAAoB,IAAI;CACtC,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,UAAU,MAAM,QAAQ,QAAQ,6BAA6B;EACjE;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CACD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,0BAA0B;EAAE;EAAS;EAAS,SAAS,QAAQ;EAAS,UAAU,QAAQ;CAAS,CAAC;CAE1G,OAAO;EACL,SAAS;GACP;GACA,kBAAkB,QAAQ;GAC1B,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,WAAW,QAAQ;EACrB;EACA;CACF;AACF;AAEA,eAAe,0BAA0B,SAKvB;CAChB,MAAM,EAAE,YAAY;CAGpB,MAAM,UAA+B;EAAE,kBAAkB,QAAQ;EAAkB,cAAc,QAAQ;CAAM;CAI/G,IAAI,QAAQ,SAAS,UACnB,QAAQ,oBAAoB;CAK9B,IAAI;EACF,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI;GAAE,OAAO,QAAQ;GAAO,IAAI,QAAQ;EAAW,CAAC;EACvF,MAAM,eAAgB,MAAM,QAAQ,UAAU,eAAe,QAAQ,SAAS,KAAM;EACpF,MAAM,gBAAgB,cAAc,UAAU,QAAQ,QAAQ,eAAe;EAC7E,IAAI,eAAe,qBACjB,QAAQ,sBAAsB,cAAc;EAG9C,IADkB,QAAQ,sBAAsB,QAAQ,MAAM,gBAAgB,SAAS,gBACxE;GACb,QAAQ,oBAAoB;GAC5B,MAAM,qBAAqB,MAAM,UAAU;GAC3C,MAAM,UACJ,eAAe,eACd,OAAO,uBAAuB,YAAY,qBAAqB,qBAAqB,KAAA;GACvF,IAAI,SAAS,QAAQ,UAAU;EACjC,OAKE,QAAQ,oBAAoB;CAEhC,QAAQ,CAER;CACA,IAAI;EACF,MAAM,QAAQ,QAAQ,SAAS,OAAO;CACxC,QAAQ,CAER;AACF"}

package/dist/rules/dispatcher.js

@@ -20,8 +20,8 @@ const MAX_ATTEMPTS = 5;
 const MAX_PLAN_APPROVALS = 3;
 const MAX_ERROR_LENGTH = 512;
 const MAX_BACKOFF_MS = 6e4;
-const RUN_REGISTRY_HEARTBEAT_MS = 10 * 6e4;
-const SKILL_COMPLETION_OBSERVATION_TIMEOUT_MS = 360 * 6e4;
+const RUN_REGISTRY_HEARTBEAT_MS = 6e5;
+const SKILL_COMPLETION_OBSERVATION_TIMEOUT_MS = 216e5;
 const MAX_IN_FLIGHT = 25;
 /**
 * Decisions that may start or wake an agent run and so hold a run slot. A
@@ -31,8 +31,8 @@ const MAX_IN_FLIGHT = 25;
 const isRunBearingDecision = (decision) => decision.type === "invokeSkill" || decision.type === "sendMessage";
 const isBookkeepingDecision = (decision) => !isRunBearingDecision(decision);
 const BOOKKEEPING_MAX_IN_FLIGHT = 4;
-const STALE_BINDING_SWEEP_INTERVAL_MS = 10 * 6e4;
-const STALE_BINDING_TTL_MS = 1440 * 6e4;
+const STALE_BINDING_SWEEP_INTERVAL_MS = 6e5;
+const STALE_BINDING_TTL_MS = 864e5;
 const RECONCILE_INTERVAL_MS = 3e4;
 /** The card moved on before this run could act; it settles as superseded, not succeeded. */
 var FactoryDecisionSuperseded = class extends Error {};