@mastra/factory 0.24.0-alpha.9 → 0.24.0

package/dist/routes/session-access.js

@@ -0,0 +1,165 @@
+import { MASTRA_RESOURCE_ID_KEY } from "@mastra/core/request-context";
+//#region src/routes/session-access.ts
+/**
+* Whether the viewer may read a visible session's conversation. A session on its owner's memory is
+* the owner's alone, whatever its row says.
+*/
+function canReadSessionResource(session, resourceId, viewer) {
+	return viewer.userId === session.userId || resourceId !== session.userId;
+}
+/** Whether a viewer may read or drive a session: same org, and the owner when it is private. */
+function canViewSourceControlSession(session, viewer) {
+	if (session.orgId !== viewer.orgId) return false;
+	return session.visibility !== "private" || session.userId === viewer.userId;
+}
+const SESSION_PATH = /\/agent-controller\/[^/]+\/sessions\/([^/]+)/;
+const CREATE_SESSION_PATH = /\/agent-controller\/[^/]+\/sessions\/?$/;
+const SET_RESOURCE_PATH = /\/agent-controller\/[^/]+\/sessions\/[^/]+\/resource\/?$/;
+const OM_CONFIG_PATH = /^\/web\/config\/om(\/|$)/;
+const MEMORY_PATH = /^\/api\/memory(\/|$)/;
+const ACTIVE_RUNS_PATH = /\/agent-controller\/[^/]+\/active-runs\/?$/;
+async function bodyField(c, field) {
+	const value = (await c.req.raw.clone().json().catch(() => void 0))?.[field];
+	return typeof value === "string" && value ? value : void 0;
+}
+function decodeSegment(segment) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return segment;
+	}
+}
+/** The value of `field` from the query or the body; `null` when they differ, since handlers read one or the other. */
+async function queryOrBody(c, field) {
+	const fromQuery = c.req.query(field) || void 0;
+	const fromBody = c.req.method === "GET" ? void 0 : await bodyField(c, field);
+	if (fromQuery && fromBody && fromQuery !== fromBody) return null;
+	return fromQuery ?? fromBody;
+}
+/** The sessions and memory resources a request addresses. `null` when it names one ambiguously. */
+async function addressed(c) {
+	const path = c.req.path;
+	const method = c.req.method;
+	const sessionMatch = SESSION_PATH.exec(path);
+	if (sessionMatch) {
+		const sessionId = decodeSegment(sessionMatch[1]);
+		const target = method === "POST" && SET_RESOURCE_PATH.test(path) ? await bodyField(c, "newResourceId") : void 0;
+		return {
+			sessionIds: [sessionId],
+			resourceIds: target ? [target] : []
+		};
+	}
+	if (method === "POST" && CREATE_SESSION_PATH.test(path)) {
+		const [sessionId, resourceId] = await Promise.all([bodyField(c, "sessionId"), bodyField(c, "resourceId")]);
+		const id = sessionId ?? resourceId;
+		return {
+			sessionIds: id ? [id] : [],
+			resourceIds: resourceId ? [resourceId] : []
+		};
+	}
+	if (OM_CONFIG_PATH.test(path)) {
+		const sessionId = await queryOrBody(c, "sessionId");
+		if (sessionId === null) return null;
+		return {
+			sessionIds: sessionId ? [sessionId] : [],
+			resourceIds: []
+		};
+	}
+	if (MEMORY_PATH.test(path)) {
+		const resourceId = await queryOrBody(c, "resourceId");
+		if (resourceId === null) return null;
+		return {
+			sessionIds: [],
+			resourceIds: resourceId ? [resourceId] : []
+		};
+	}
+	return {
+		sessionIds: [],
+		resourceIds: []
+	};
+}
+/**
+* Keeps private sessions private. A memory resource says who may read it: a
+* private session runs on its owner's user id, a shared one on its Factory's
+* id, and a session from before resources were shared on its own id. So a
+* caller reaches a resource only when it is their own user id, a Factory in
+* their organization, or a session id whose session they can view; any other
+* resource (another person's user id) answers 404.
+*
+* Session routes (stream, messages, threads, state, OM settings) resolve the
+* session from an in-memory map or its stored thread with no ownership check,
+* so both the session row and the resource it runs on are checked. Memory
+* routes trust a client-supplied resourceId or threadId, so they are bound to
+* the authorized resource, or the caller's own user id when none is named. The
+* controller-wide active-runs list drops runs on unreachable resources.
+* Denials answer 404 so ids do not leak existence. With auth disabled there is
+* no tenant to protect and everything passes through.
+*/
+function createSessionAccessGuard({ auth, sessions, projects, controller }) {
+	const canReachResource = async (resourceId, viewer) => {
+		if (resourceId === viewer.userId) return true;
+		const session = await sessions.getBySessionId(resourceId);
+		if (session) return canViewSourceControlSession(session, viewer);
+		if (!viewer.orgId) return false;
+		return await projects.get({
+			orgId: viewer.orgId,
+			id: resourceId
+		}) !== null;
+	};
+	const sessionResourceId = async (sessionId) => {
+		const lookup = controller();
+		if (!lookup) return sessionId;
+		const live = await lookup.getSession(sessionId);
+		if (live) return live.identity.getResourceId();
+		return (await lookup.queryThreadById({ threadId: sessionId }))?.resourceId ?? sessionId;
+	};
+	const canReachSession = async (sessionId, viewer) => {
+		const session = await sessions.getBySessionId(sessionId);
+		if (session && !canViewSourceControlSession(session, viewer)) return false;
+		const resourceId = await sessionResourceId(sessionId);
+		if (resourceId === sessionId) return true;
+		return canReachResource(resourceId, viewer);
+	};
+	return async (c, next) => {
+		if (!auth.enabled()) return next();
+		const ctx = c;
+		const target = await addressed(ctx);
+		if (!target) return c.json({ error: "The query and body must name the same session" }, 400);
+		const isMemory = MEMORY_PATH.test(ctx.req.path);
+		const isActiveRuns = ctx.req.method === "GET" && ACTIVE_RUNS_PATH.test(ctx.req.path);
+		if (!target.sessionIds.length && !target.resourceIds.length && !isMemory && !isActiveRuns) return next();
+		await auth.ensureUser(ctx);
+		const viewer = auth.tenant(ctx);
+		if (!viewer) return c.json({ error: "Session not found" }, 404);
+		for (const sessionId of target.sessionIds) if (!await canReachSession(sessionId, viewer)) return c.json({ error: "Session not found" }, 404);
+		for (const resourceId of target.resourceIds) if (!await canReachResource(resourceId, viewer)) return c.json({ error: "Session not found" }, 404);
+		if (isMemory) ctx.get("requestContext")?.set(MASTRA_RESOURCE_ID_KEY, target.resourceIds[0] ?? viewer.userId);
+		if (!isActiveRuns) return next();
+		await next();
+		await filterActiveRuns(ctx, (resourceId) => canReachResource(resourceId, viewer));
+	};
+}
+/** Drops runs on resources the caller cannot reach from the controller-wide active-runs list. */
+async function filterActiveRuns(c, canReach) {
+	if (!c.res.ok) return;
+	const body = await c.res.clone().json().catch(() => void 0);
+	if (!body || !Array.isArray(body.runs)) return;
+	const resourceIds = [...new Set(body.runs.flatMap((run) => typeof run.resourceId === "string" ? [run.resourceId] : []))];
+	const reachable = new Map(await Promise.all(resourceIds.map(async (id) => [id, await canReach(id)])));
+	const runs = body.runs.filter((run) => typeof run.resourceId !== "string" || reachable.get(run.resourceId));
+	if (runs.length === body.runs.length) return;
+	const headers = new Headers(c.res.headers);
+	headers.delete("content-length");
+	c.res.headers.delete("content-length");
+	c.res = new Response(JSON.stringify({
+		...body,
+		runs
+	}), {
+		status: c.res.status,
+		headers
+	});
+}
+//#endregion
+export { canReadSessionResource, canViewSourceControlSession, createSessionAccessGuard };
+
+//# sourceMappingURL=session-access.js.map

package/dist/routes/session-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-access.js","names":[],"sources":["../../src/routes/session-access.ts"],"sourcesContent":["import { MASTRA_RESOURCE_ID_KEY } from '@mastra/core/request-context';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { Context, MiddlewareHandler } from 'hono';\n\nimport type { SourceControlSessionLookup } from '../session/factory-session.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { SourceControlSession } from '../storage/domains/source-control/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * Whether the viewer may read a visible session's conversation. A session on its owner's memory is\n * the owner's alone, whatever its row says.\n */\nexport function canReadSessionResource(\n  session: Pick<SourceControlSession, 'userId'>,\n  resourceId: string,\n  viewer: { userId: string },\n): boolean {\n  return viewer.userId === session.userId || resourceId !== session.userId;\n}\n\n/** Whether a viewer may read or drive a session: same org, and the owner when it is private. */\nexport function canViewSourceControlSession(\n  session: Pick<SourceControlSession, 'orgId' | 'userId' | 'visibility'>,\n  viewer: { orgId?: string; userId: string },\n): boolean {\n  if (session.orgId !== viewer.orgId) return false;\n  return session.visibility !== 'private' || session.userId === viewer.userId;\n}\n\n/** The controller reads the guard needs to find which resource a session runs on. */\nexport interface SessionResourceLookup {\n  getSession(sessionId: string): Promise<{ identity: { getResourceId(): string } } | undefined>;\n  queryThreadById(input: { threadId: string }): Promise<{ resourceId: string } | null>;\n}\n\ntype Viewer = { orgId?: string; userId: string };\n\nconst SESSION_PATH = /\\/agent-controller\\/[^/]+\\/sessions\\/([^/]+)/;\nconst CREATE_SESSION_PATH = /\\/agent-controller\\/[^/]+\\/sessions\\/?$/;\nconst SET_RESOURCE_PATH = /\\/agent-controller\\/[^/]+\\/sessions\\/[^/]+\\/resource\\/?$/;\nconst OM_CONFIG_PATH = /^\\/web\\/config\\/om(\\/|$)/;\nconst MEMORY_PATH = /^\\/api\\/memory(\\/|$)/;\nconst ACTIVE_RUNS_PATH = /\\/agent-controller\\/[^/]+\\/active-runs\\/?$/;\n\nasync function bodyField(c: Context, field: string): Promise<string | undefined> {\n  // Read a clone: the Mastra adapter clones `c.req.raw` again to parse params,\n  // which throws once anything has consumed the original body.\n  const body = await c.req.raw\n    .clone()\n    .json()\n    .catch(() => undefined);\n  const value = (body as Record<string, unknown> | undefined)?.[field];\n  return typeof value === 'string' && value ? value : undefined;\n}\n\nfunction decodeSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\n/** The value of `field` from the query or the body; `null` when they differ, since handlers read one or the other. */\nasync function queryOrBody(c: Context, field: string): Promise<string | undefined | null> {\n  const fromQuery = c.req.query(field) || undefined;\n  const fromBody = c.req.method === 'GET' ? undefined : await bodyField(c, field);\n  if (fromQuery && fromBody && fromQuery !== fromBody) return null;\n  return fromQuery ?? fromBody;\n}\n\n/** The sessions and memory resources a request addresses. `null` when it names one ambiguously. */\nasync function addressed(c: Context): Promise<{ sessionIds: string[]; resourceIds: string[] } | null> {\n  const path = c.req.path;\n  const method = c.req.method;\n  const sessionMatch = SESSION_PATH.exec(path);\n  if (sessionMatch) {\n    const sessionId = decodeSegment(sessionMatch[1]!);\n    // Re-keying moves the session onto `newResourceId`, so that resource must be reachable too.\n    const target = method === 'POST' && SET_RESOURCE_PATH.test(path) ? await bodyField(c, 'newResourceId') : undefined;\n    return { sessionIds: [sessionId], resourceIds: target ? [target] : [] };\n  }\n  if (method === 'POST' && CREATE_SESSION_PATH.test(path)) {\n    // Get-or-create: without a `sessionId` the session is addressed by its resourceId.\n    const [sessionId, resourceId] = await Promise.all([bodyField(c, 'sessionId'), bodyField(c, 'resourceId')]);\n    const id = sessionId ?? resourceId;\n    return { sessionIds: id ? [id] : [], resourceIds: resourceId ? [resourceId] : [] };\n  }\n  if (OM_CONFIG_PATH.test(path)) {\n    const sessionId = await queryOrBody(c, 'sessionId');\n    if (sessionId === null) return null;\n    return { sessionIds: sessionId ? [sessionId] : [], resourceIds: [] };\n  }\n  if (MEMORY_PATH.test(path)) {\n    const resourceId = await queryOrBody(c, 'resourceId');\n    if (resourceId === null) return null;\n    return { sessionIds: [], resourceIds: resourceId ? [resourceId] : [] };\n  }\n  return { sessionIds: [], resourceIds: [] };\n}\n\n/**\n * Keeps private sessions private. A memory resource says who may read it: a\n * private session runs on its owner's user id, a shared one on its Factory's\n * id, and a session from before resources were shared on its own id. So a\n * caller reaches a resource only when it is their own user id, a Factory in\n * their organization, or a session id whose session they can view; any other\n * resource (another person's user id) answers 404.\n *\n * Session routes (stream, messages, threads, state, OM settings) resolve the\n * session from an in-memory map or its stored thread with no ownership check,\n * so both the session row and the resource it runs on are checked. Memory\n * routes trust a client-supplied resourceId or threadId, so they are bound to\n * the authorized resource, or the caller's own user id when none is named. The\n * controller-wide active-runs list drops runs on unreachable resources.\n * Denials answer 404 so ids do not leak existence. With auth disabled there is\n * no tenant to protect and everything passes through.\n */\nexport function createSessionAccessGuard({\n  auth,\n  sessions,\n  projects,\n  controller,\n}: {\n  auth: RouteAuth;\n  sessions: Pick<SourceControlSessionLookup, 'getBySessionId'>;\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  /** Resolved per request: the controller is built after the server config. */\n  controller: () => SessionResourceLookup | undefined;\n}): MiddlewareHandler {\n  const canReachResource = async (resourceId: string, viewer: Viewer): Promise<boolean> => {\n    if (resourceId === viewer.userId) return true;\n    const session = await sessions.getBySessionId(resourceId);\n    if (session) return canViewSourceControlSession(session, viewer);\n    if (!viewer.orgId) return false;\n    return (await projects.get({ orgId: viewer.orgId, id: resourceId })) !== null;\n  };\n\n  const sessionResourceId = async (sessionId: string): Promise<string> => {\n    const lookup = controller();\n    if (!lookup) return sessionId;\n    const live = await lookup.getSession(sessionId);\n    if (live) return live.identity.getResourceId();\n    return (await lookup.queryThreadById({ threadId: sessionId }))?.resourceId ?? sessionId;\n  };\n\n  const canReachSession = async (sessionId: string, viewer: Viewer): Promise<boolean> => {\n    const session = await sessions.getBySessionId(sessionId);\n    if (session && !canViewSourceControlSession(session, viewer)) return false;\n    const resourceId = await sessionResourceId(sessionId);\n    // A session on its own id was just checked by its row; one without a row is nobody's private session.\n    if (resourceId === sessionId) return true;\n    return canReachResource(resourceId, viewer);\n  };\n\n  return async (c, next) => {\n    if (!auth.enabled()) return next();\n    const ctx = c as unknown as Context;\n    const target = await addressed(ctx);\n    if (!target) return c.json({ error: 'The query and body must name the same session' }, 400);\n    const isMemory = MEMORY_PATH.test(ctx.req.path);\n    const isActiveRuns = ctx.req.method === 'GET' && ACTIVE_RUNS_PATH.test(ctx.req.path);\n    if (!target.sessionIds.length && !target.resourceIds.length && !isMemory && !isActiveRuns) return next();\n\n    await auth.ensureUser(ctx);\n    const viewer = auth.tenant(ctx);\n    if (!viewer) return c.json({ error: 'Session not found' }, 404);\n    for (const sessionId of target.sessionIds) {\n      if (!(await canReachSession(sessionId, viewer))) return c.json({ error: 'Session not found' }, 404);\n    }\n    for (const resourceId of target.resourceIds) {\n      if (!(await canReachResource(resourceId, viewer))) return c.json({ error: 'Session not found' }, 404);\n    }\n\n    if (isMemory) {\n      // Memory routes only check that a thread belongs to the request's resource\n      // when one is bound server-side. Bind the resource just authorized, or the\n      // caller's own user id, so a threadId cannot reach another resource's thread.\n      const requestContext = ctx.get('requestContext') as RequestContext | undefined;\n      requestContext?.set(MASTRA_RESOURCE_ID_KEY, target.resourceIds[0] ?? viewer.userId);\n    }\n    if (!isActiveRuns) return next();\n    await next();\n    await filterActiveRuns(ctx, resourceId => canReachResource(resourceId, viewer));\n  };\n}\n\n/** Drops runs on resources the caller cannot reach from the controller-wide active-runs list. */\nasync function filterActiveRuns(c: Context, canReach: (resourceId: string) => Promise<boolean>): Promise<void> {\n  if (!c.res.ok) return;\n  const body = (await c.res\n    .clone()\n    .json()\n    .catch(() => undefined)) as { runs?: Array<{ resourceId?: unknown }> } | undefined;\n  if (!body || !Array.isArray(body.runs)) return;\n  const resourceIds = [\n    ...new Set(body.runs.flatMap(run => (typeof run.resourceId === 'string' ? [run.resourceId] : []))),\n  ];\n  const reachable = new Map(await Promise.all(resourceIds.map(async id => [id, await canReach(id)] as const)));\n  const runs = body.runs.filter(run => typeof run.resourceId !== 'string' || reachable.get(run.resourceId));\n  if (runs.length === body.runs.length) return;\n  const headers = new Headers(c.res.headers);\n  headers.delete('content-length');\n  c.res.headers.delete('content-length');\n  c.res = new Response(JSON.stringify({ ...body, runs }), { status: c.res.status, headers });\n}\n"],"mappings":";;;;;;AAaA,SAAgB,uBACd,SACA,YACA,QACS;CACT,OAAO,OAAO,WAAW,QAAQ,UAAU,eAAe,QAAQ;AACpE;;AAGA,SAAgB,4BACd,SACA,QACS;CACT,IAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;CAC3C,OAAO,QAAQ,eAAe,aAAa,QAAQ,WAAW,OAAO;AACvE;AAUA,MAAM,eAAe;AACrB,MAAM,sBAAsB;AAC5B,MAAM,oBAAoB;AAC1B,MAAM,iBAAiB;AACvB,MAAM,cAAc;AACpB,MAAM,mBAAmB;AAEzB,eAAe,UAAU,GAAY,OAA4C;CAO/E,MAAM,SAAS,MAJI,EAAE,IAAI,IACtB,MAAM,CAAC,CACP,KAAK,CAAC,CACN,YAAY,KAAA,CAAS,EAAA,GACsC;CAC9D,OAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ,KAAA;AACtD;AAEA,SAAS,cAAc,SAAyB;CAC9C,IAAI;EACF,OAAO,mBAAmB,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAe,YAAY,GAAY,OAAmD;CACxF,MAAM,YAAY,EAAE,IAAI,MAAM,KAAK,KAAK,KAAA;CACxC,MAAM,WAAW,EAAE,IAAI,WAAW,QAAQ,KAAA,IAAY,MAAM,UAAU,GAAG,KAAK;CAC9E,IAAI,aAAa,YAAY,cAAc,UAAU,OAAO;CAC5D,OAAO,aAAa;AACtB;;AAGA,eAAe,UAAU,GAA6E;CACpG,MAAM,OAAO,EAAE,IAAI;CACnB,MAAM,SAAS,EAAE,IAAI;CACrB,MAAM,eAAe,aAAa,KAAK,IAAI;CAC3C,IAAI,cAAc;EAChB,MAAM,YAAY,cAAc,aAAa,EAAG;EAEhD,MAAM,SAAS,WAAW,UAAU,kBAAkB,KAAK,IAAI,IAAI,MAAM,UAAU,GAAG,eAAe,IAAI,KAAA;EACzG,OAAO;GAAE,YAAY,CAAC,SAAS;GAAG,aAAa,SAAS,CAAC,MAAM,IAAI,CAAC;EAAE;CACxE;CACA,IAAI,WAAW,UAAU,oBAAoB,KAAK,IAAI,GAAG;EAEvD,MAAM,CAAC,WAAW,cAAc,MAAM,QAAQ,IAAI,CAAC,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC,CAAC;EACzG,MAAM,KAAK,aAAa;EACxB,OAAO;GAAE,YAAY,KAAK,CAAC,EAAE,IAAI,CAAC;GAAG,aAAa,aAAa,CAAC,UAAU,IAAI,CAAC;EAAE;CACnF;CACA,IAAI,eAAe,KAAK,IAAI,GAAG;EAC7B,MAAM,YAAY,MAAM,YAAY,GAAG,WAAW;EAClD,IAAI,cAAc,MAAM,OAAO;EAC/B,OAAO;GAAE,YAAY,YAAY,CAAC,SAAS,IAAI,CAAC;GAAG,aAAa,CAAC;EAAE;CACrE;CACA,IAAI,YAAY,KAAK,IAAI,GAAG;EAC1B,MAAM,aAAa,MAAM,YAAY,GAAG,YAAY;EACpD,IAAI,eAAe,MAAM,OAAO;EAChC,OAAO;GAAE,YAAY,CAAC;GAAG,aAAa,aAAa,CAAC,UAAU,IAAI,CAAC;EAAE;CACvE;CACA,OAAO;EAAE,YAAY,CAAC;EAAG,aAAa,CAAC;CAAE;AAC3C;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,yBAAyB,EACvC,MACA,UACA,UACA,cAOoB;CACpB,MAAM,mBAAmB,OAAO,YAAoB,WAAqC;EACvF,IAAI,eAAe,OAAO,QAAQ,OAAO;EACzC,MAAM,UAAU,MAAM,SAAS,eAAe,UAAU;EACxD,IAAI,SAAS,OAAO,4BAA4B,SAAS,MAAM;EAC/D,IAAI,CAAC,OAAO,OAAO,OAAO;EAC1B,OAAQ,MAAM,SAAS,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI;EAAW,CAAC,MAAO;CAC3E;CAEA,MAAM,oBAAoB,OAAO,cAAuC;EACtE,MAAM,SAAS,WAAW;EAC1B,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,OAAO,MAAM,OAAO,WAAW,SAAS;EAC9C,IAAI,MAAM,OAAO,KAAK,SAAS,cAAc;EAC7C,QAAQ,MAAM,OAAO,gBAAgB,EAAE,UAAU,UAAU,CAAC,EAAA,EAAI,cAAc;CAChF;CAEA,MAAM,kBAAkB,OAAO,WAAmB,WAAqC;EACrF,MAAM,UAAU,MAAM,SAAS,eAAe,SAAS;EACvD,IAAI,WAAW,CAAC,4BAA4B,SAAS,MAAM,GAAG,OAAO;EACrE,MAAM,aAAa,MAAM,kBAAkB,SAAS;EAEpD,IAAI,eAAe,WAAW,OAAO;EACrC,OAAO,iBAAiB,YAAY,MAAM;CAC5C;CAEA,OAAO,OAAO,GAAG,SAAS;EACxB,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,KAAK;EACjC,MAAM,MAAM;EACZ,MAAM,SAAS,MAAM,UAAU,GAAG;EAClC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,gDAAgD,GAAG,GAAG;EAC1F,MAAM,WAAW,YAAY,KAAK,IAAI,IAAI,IAAI;EAC9C,MAAM,eAAe,IAAI,IAAI,WAAW,SAAS,iBAAiB,KAAK,IAAI,IAAI,IAAI;EACnF,IAAI,CAAC,OAAO,WAAW,UAAU,CAAC,OAAO,YAAY,UAAU,CAAC,YAAY,CAAC,cAAc,OAAO,KAAK;EAEvG,MAAM,KAAK,WAAW,GAAG;EACzB,MAAM,SAAS,KAAK,OAAO,GAAG;EAC9B,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EAC9D,KAAK,MAAM,aAAa,OAAO,YAC7B,IAAI,CAAE,MAAM,gBAAgB,WAAW,MAAM,GAAI,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EAEpG,KAAK,MAAM,cAAc,OAAO,aAC9B,IAAI,CAAE,MAAM,iBAAiB,YAAY,MAAM,GAAI,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;EAGtG,IAAI,UAKF,IAD2B,IAAI,gBAClB,CAAC,EAAE,IAAI,wBAAwB,OAAO,YAAY,MAAM,OAAO,MAAM;EAEpF,IAAI,CAAC,cAAc,OAAO,KAAK;EAC/B,MAAM,KAAK;EACX,MAAM,iBAAiB,MAAK,eAAc,iBAAiB,YAAY,MAAM,CAAC;CAChF;AACF;;AAGA,eAAe,iBAAiB,GAAY,UAAmE;CAC7G,IAAI,CAAC,EAAE,IAAI,IAAI;CACf,MAAM,OAAQ,MAAM,EAAE,IACnB,MAAM,CAAC,CACP,KAAK,CAAC,CACN,YAAY,KAAA,CAAS;CACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAAI,GAAG;CACxC,MAAM,cAAc,CAClB,GAAG,IAAI,IAAI,KAAK,KAAK,SAAQ,QAAQ,OAAO,IAAI,eAAe,WAAW,CAAC,IAAI,UAAU,IAAI,CAAC,CAAE,CAAC,CACnG;CACA,MAAM,YAAY,IAAI,IAAI,MAAM,QAAQ,IAAI,YAAY,IAAI,OAAM,OAAM,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC,CAAU,CAAC,CAAC;CAC3G,MAAM,OAAO,KAAK,KAAK,QAAO,QAAO,OAAO,IAAI,eAAe,YAAY,UAAU,IAAI,IAAI,UAAU,CAAC;CACxG,IAAI,KAAK,WAAW,KAAK,KAAK,QAAQ;CACtC,MAAM,UAAU,IAAI,QAAQ,EAAE,IAAI,OAAO;CACzC,QAAQ,OAAO,gBAAgB;CAC/B,EAAE,IAAI,QAAQ,OAAO,gBAAgB;CACrC,EAAE,MAAM,IAAI,SAAS,KAAK,UAAU;EAAE,GAAG;EAAM;CAAK,CAAC,GAAG;EAAE,QAAQ,EAAE,IAAI;EAAQ;CAAQ,CAAC;AAC3F"}

package/dist/routes/skills.d.ts

@@ -13,13 +13,11 @@ interface SessionAuthorizationResult {
 }
 export interface SkillRoutesDeps extends RouteDependencies {
     controllerId: string;
-    controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;
+    controller: Pick<AgentController<MastraCodeState>, 'getSession'>;
     sourceControlStorage?: SourceControlStorageHandle;
     ensureSourceControlReady?: () => Promise<void>;
     authorizeSessionAddress?: (context: Context, address: {
-        resourceId: string;
-        projectRepositoryId?: string;
-        scope?: string;
+        sessionId: string;
     }) => Promise<SessionAuthorizationResult>;
 }
 export declare class SkillRoutes extends Route<SkillRoutesDeps> {

package/dist/routes/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAKpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAgBnC,UAAU,0BAA0B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3E,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAC1E,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C;AAiCD,qBAAa,WAAY,SAAQ,KAAK,CAAC,eAAe,CAAC;;IAoErD,MAAM,IAAI,QAAQ,EAAE;CAiFrB"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAanC,UAAU,0BAA0B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,IAAI,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,mBAAmB,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC,CAAC;IACjE,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACrH;AA6BD,qBAAa,WAAY,SAAQ,KAAK,CAAC,eAAe,CAAC;;IAwCrD,MAAM,IAAI,QAAQ,EAAE;CA4ErB"}

package/dist/routes/skills.js

@@ -1,11 +1,9 @@
-import { peekSessionSandbox } from "../sandbox/session-sandbox.js";
 import { Route } from "./route.js";
 import { listFactorySkills } from "../skills/catalog.js";
 import { SkillInvocationError, resolveSkillInvocation } from "../skills/service.js";
 import { registerApiRoute } from "@mastra/core/server";
 //#region src/routes/skills.ts
-const MAX_RESOURCE_ID_LENGTH = 512;
-const MAX_SCOPE_LENGTH = 2048;
+const MAX_SESSION_ID_LENGTH = 512;
 const MAX_ARGUMENTS_LENGTH = 16384;
 const SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -15,22 +13,24 @@ function loose(context) {
 function parseBody(value) {
 	if (!value || typeof value !== "object") return void 0;
 	const input = value;
-	if (typeof input.resourceId !== "string" || input.resourceId.length === 0) return void 0;
-	if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return void 0;
-	if (input.projectRepositoryId !== void 0 && (typeof input.projectRepositoryId !== "string" || !UUID_RE.test(input.projectRepositoryId))) return;
-	if (input.scope !== void 0 && (typeof input.scope !== "string" || input.scope.length > MAX_SCOPE_LENGTH)) return;
+	if (typeof input.sessionId !== "string" || input.sessionId.length === 0) return void 0;
+	if (input.sessionId.length > MAX_SESSION_ID_LENGTH) return void 0;
 	if (typeof input.name !== "string" || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return void 0;
 	if (input.arguments !== void 0) {
 		if (typeof input.arguments !== "string" || input.arguments.length > MAX_ARGUMENTS_LENGTH) return void 0;
 	}
 	return {
-		resourceId: input.resourceId,
-		...input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {},
-		...input.scope ? { scope: input.scope } : {},
+		sessionId: input.sessionId,
 		name: input.name,
 		...input.arguments !== void 0 ? { arguments: input.arguments } : {}
 	};
 }
+const SESSION_FORBIDDEN = {
+	allowed: false,
+	status: 403,
+	code: "session_forbidden",
+	message: "Session access denied."
+};
 var SkillRoutes = class extends Route {
 	async #authorizeSessionAddress(context, address) {
 		const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;
@@ -43,67 +43,25 @@ var SkillRoutes = class extends Route {
 			code: "unauthorized",
 			message: "Authentication required."
 		};
-		if (address.resourceId === tenant.userId) return { allowed: true };
-		if (!UUID_RE.test(address.resourceId) || !address.projectRepositoryId || !UUID_RE.test(address.projectRepositoryId)) return {
+		if (address.sessionId === tenant.userId) return { allowed: true };
+		if (!UUID_RE.test(address.sessionId)) return {
 			allowed: false,
 			status: 400,
 			code: "invalid_request",
 			message: "Invalid skill invocation request."
 		};
-		if (!tenant.orgId || !address.scope) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
-		if (!storage) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
+		if (!tenant.orgId || !storage) return SESSION_FORBIDDEN;
 		if (ensureSourceControlReady) try {
 			await ensureSourceControlReady();
 		} catch {
-			return {
-				allowed: false,
-				status: 403,
-				code: "session_forbidden",
-				message: "Session access denied."
-			};
+			return SESSION_FORBIDDEN;
 		}
-		const projectRepository = await storage.projectRepositories.get({
-			orgId: tenant.orgId,
-			id: address.projectRepositoryId
-		});
-		if (!projectRepository) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
-		const connection = await storage.connections.get({
-			orgId: tenant.orgId,
-			id: projectRepository.connectionId
-		});
-		if (!connection || connection.factoryProjectId !== address.resourceId) return {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
+		const row = await storage.sessions.getBySessionId(address.sessionId);
+		if (!row || row.orgId !== tenant.orgId || !row.projectRepositoryId) return SESSION_FORBIDDEN;
 		return (await storage.sessions.list({
-			projectRepositoryId: address.projectRepositoryId,
+			projectRepositoryId: row.projectRepositoryId,
 			viewerUserId: tenant.userId
-		})).some((row) => {
-			const liveWorkdir = peekSessionSandbox(row.id)?.workdir;
-			return liveWorkdir !== void 0 && liveWorkdir === address.scope;
-		}) ? { allowed: true } : {
-			allowed: false,
-			status: 403,
-			code: "session_forbidden",
-			message: "Session access denied."
-		};
+		})).some((session) => session.sessionId === address.sessionId) ? { allowed: true } : SESSION_FORBIDDEN;
 	}
 	routes() {
 		const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;
@@ -128,11 +86,7 @@ var SkillRoutes = class extends Route {
 				error: "invalid_request",
 				message: "Invalid skill invocation request."
 			}, 400);
-			const authorization = await authorize(c, {
-				resourceId: body.resourceId,
-				projectRepositoryId: body.projectRepositoryId,
-				scope: body.scope
-			});
+			const authorization = await authorize(c, { sessionId: body.sessionId });
 			if (!authorization.allowed) return c.json({
 				error: authorization.code,
 				message: authorization.message

package/dist/routes/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","names":["#authorizeSessionAddress"],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { peekSessionSandbox } from '../sandbox/session-sandbox.js';\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_RESOURCE_ID_LENGTH = 512;\nconst MAX_SCOPE_LENGTH = 2048;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  resourceId: string;\n  projectRepositoryId?: string;\n  scope?: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSessionByResource'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.resourceId !== 'string' || input.resourceId.length === 0) return undefined;\n  if (input.resourceId.length > MAX_RESOURCE_ID_LENGTH) return undefined;\n  if (\n    input.projectRepositoryId !== undefined &&\n    (typeof input.projectRepositoryId !== 'string' || !UUID_RE.test(input.projectRepositoryId))\n  ) {\n    return undefined;\n  }\n  if (input.scope !== undefined && (typeof input.scope !== 'string' || input.scope.length > MAX_SCOPE_LENGTH)) {\n    return undefined;\n  }\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    resourceId: input.resourceId,\n    ...(input.projectRepositoryId ? { projectRepositoryId: input.projectRepositoryId } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { resourceId: string; projectRepositoryId?: string; scope?: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions are keyed by the authenticated WorkOS user id. Their\n    // scope is a client-managed local/user-session worktree and needs no app DB.\n    if (address.resourceId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are keyed by factoryProjectId and explicitly identify the\n    // linked repository whose user-owned worktree supplies the session scope.\n    if (\n      !UUID_RE.test(address.resourceId) ||\n      !address.projectRepositoryId ||\n      !UUID_RE.test(address.projectRepositoryId)\n    ) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !address.scope) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (!storage) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n      }\n    }\n    const projectRepository = await storage.projectRepositories.get({\n      orgId: tenant.orgId,\n      id: address.projectRepositoryId,\n    });\n    if (!projectRepository) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    const connection = await storage.connections.get({ orgId: tenant.orgId, id: projectRepository.connectionId });\n    if (!connection || connection.factoryProjectId !== address.resourceId) {\n      return { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n    }\n    // The scope must be the live workdir of a session the viewer can see under\n    // this repository. The live memoized sandbox entry is the only truth for\n    // workdirs (persisted columns are observability); no running/memoized\n    // sandbox at that path means no grant (fail closed).\n    const sessions = await storage.sessions.list({\n      projectRepositoryId: address.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    const scopeIsLiveSessionWorkdir = sessions.some(row => {\n      const liveWorkdir = peekSessionSandbox(row.id)?.workdir;\n      return liveWorkdir !== undefined && liveWorkdir === address.scope;\n    });\n    return scopeIsLiveSessionWorkdir\n      ? { allowed: true }\n      : { allowed: false, status: 403, code: 'session_forbidden', message: 'Session access denied.' };\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { resourceId: string; projectRepositoryId?: string; scope?: string }) =>\n        this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, {\n        resourceId: body.resourceId,\n        projectRepositoryId: body.projectRepositoryId,\n        scope: body.scope,\n      });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          const requestContext = c.get('requestContext' as never) as RequestContext | undefined;\n          void resolved.session\n            .sendMessage({ content: resolved.message, ...(requestContext ? { requestContext } : {}) })\n            .catch((error: unknown) => {\n              console.error('Workspace skill dispatch failed after acceptance', error);\n            });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,yBAAyB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AA4BhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,WAAW,GAAG,OAAO,KAAA;CAClF,IAAI,MAAM,WAAW,SAAS,wBAAwB,OAAO,KAAA;CAC7D,IACE,MAAM,wBAAwB,KAAA,MAC7B,OAAO,MAAM,wBAAwB,YAAY,CAAC,QAAQ,KAAK,MAAM,mBAAmB,IAEzF;CAEF,IAAI,MAAM,UAAU,KAAA,MAAc,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,mBACxF;CAEF,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,YAAY,MAAM;EAClB,GAAI,MAAM,sBAAsB,EAAE,qBAAqB,MAAM,oBAAoB,IAAI,CAAC;EACtF,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAMA,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,eAAe,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAIjE,IACE,CAAC,QAAQ,KAAK,QAAQ,UAAU,KAChC,CAAC,QAAQ,uBACT,CAAC,QAAQ,KAAK,QAAQ,mBAAmB,GAEzC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,OAC5B,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,CAAC,SACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;IAAE,SAAS;IAAO,QAAQ;IAAK,MAAM;IAAqB,SAAS;GAAyB;EACrG;EAEF,MAAM,oBAAoB,MAAM,QAAQ,oBAAoB,IAAI;GAC9D,OAAO,OAAO;GACd,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAErG,MAAM,aAAa,MAAM,QAAQ,YAAY,IAAI;GAAE,OAAO,OAAO;GAAO,IAAI,kBAAkB;EAAa,CAAC;EAC5G,IAAI,CAAC,cAAc,WAAW,qBAAqB,QAAQ,YACzD,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;EAcrG,QAJkC,MAJX,QAAQ,SAAS,KAAK;GAC3C,qBAAqB,QAAQ;GAC7B,cAAc,OAAO;EACvB,CAAC,EAAA,CAC0C,MAAK,QAAO;GACrD,MAAM,cAAc,mBAAmB,IAAI,EAAE,CAAC,EAAE;GAChD,OAAO,gBAAgB,KAAA,KAAa,gBAAgB,QAAQ;EAC9D,CAC+B,IAC3B,EAAE,SAAS,KAAK,IAChB;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAqB,SAAS;EAAyB;CAClG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAClB,KAAKA,yBAAyB,SAAS,OAAO;EAClD,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG;IACvC,YAAY,KAAK;IACjB,qBAAqB,KAAK;IAC1B,OAAO,KAAK;GACd,CAAC;GACD,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UAAU;KACZ,MAAM,iBAAiB,EAAE,IAAI,gBAAyB;KACtD,SAAc,QACX,YAAY;MAAE,SAAS,SAAS;MAAS,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAAG,CAAC,CAAC,CACzF,OAAO,UAAmB;MACzB,QAAQ,MAAM,oDAAoD,KAAK;KACzE,CAAC;IACL;IACA,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"skills.js","names":[],"sources":["../../src/routes/skills.ts"],"sourcesContent":["import type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { listFactorySkills } from '../skills/catalog.js';\nimport { resolveSkillInvocation, SkillInvocationError } from '../skills/service.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nconst MAX_SESSION_ID_LENGTH = 512;\nconst MAX_ARGUMENTS_LENGTH = 16_384;\nconst SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n\ninterface SkillInvocationBody {\n  sessionId: string;\n  name: string;\n  arguments?: string;\n}\n\ninterface SessionAuthorizationResult {\n  allowed: boolean;\n  status?: 400 | 401 | 403;\n  code?: 'invalid_request' | 'unauthorized' | 'session_forbidden';\n  message?: string;\n}\n\nexport interface SkillRoutesDeps extends RouteDependencies {\n  controllerId: string;\n  controller: Pick<AgentController<MastraCodeState>, 'getSession'>;\n  sourceControlStorage?: SourceControlStorageHandle;\n  ensureSourceControlReady?: () => Promise<void>;\n  authorizeSessionAddress?: (context: Context, address: { sessionId: string }) => Promise<SessionAuthorizationResult>;\n}\n\nfunction loose(context: unknown): Context {\n  return context as Context;\n}\n\nfunction parseBody(value: unknown): SkillInvocationBody | undefined {\n  if (!value || typeof value !== 'object') return undefined;\n  const input = value as Record<string, unknown>;\n  if (typeof input.sessionId !== 'string' || input.sessionId.length === 0) return undefined;\n  if (input.sessionId.length > MAX_SESSION_ID_LENGTH) return undefined;\n  if (typeof input.name !== 'string' || input.name.length > 64 || !SKILL_NAME_RE.test(input.name)) return undefined;\n  if (input.arguments !== undefined) {\n    if (typeof input.arguments !== 'string' || input.arguments.length > MAX_ARGUMENTS_LENGTH) return undefined;\n  }\n  return {\n    sessionId: input.sessionId,\n    name: input.name,\n    ...(input.arguments !== undefined ? { arguments: input.arguments } : {}),\n  };\n}\n\nconst SESSION_FORBIDDEN: SessionAuthorizationResult = {\n  allowed: false,\n  status: 403,\n  code: 'session_forbidden',\n  message: 'Session access denied.',\n};\n\nexport class SkillRoutes extends Route<SkillRoutesDeps> {\n  async #authorizeSessionAddress(\n    context: Context,\n    address: { sessionId: string },\n  ): Promise<SessionAuthorizationResult> {\n    const { auth, sourceControlStorage: storage, ensureSourceControlReady } = this.deps;\n    if (!auth.enabled()) return { allowed: true };\n\n    await auth.ensureUser(context);\n    const tenant = auth.tenant(context);\n    if (!tenant) {\n      return { allowed: false, status: 401, code: 'unauthorized', message: 'Authentication required.' };\n    }\n\n    // Personal sessions created without a session id are addressed by the\n    // authenticated WorkOS user id and need no app DB.\n    if (address.sessionId === tenant.userId) return { allowed: true };\n\n    // Factory sessions are addressed by their source-control session id.\n    if (!UUID_RE.test(address.sessionId)) {\n      return { allowed: false, status: 400, code: 'invalid_request', message: 'Invalid skill invocation request.' };\n    }\n    if (!tenant.orgId || !storage) return SESSION_FORBIDDEN;\n    if (ensureSourceControlReady) {\n      try {\n        await ensureSourceControlReady();\n      } catch {\n        return SESSION_FORBIDDEN;\n      }\n    }\n    const row = await storage.sessions.getBySessionId(address.sessionId);\n    if (!row || row.orgId !== tenant.orgId || !row.projectRepositoryId) return SESSION_FORBIDDEN;\n    // The session must be one the viewer can see under its repository.\n    const visible = await storage.sessions.list({\n      projectRepositoryId: row.projectRepositoryId,\n      viewerUserId: tenant.userId,\n    });\n    return visible.some(session => session.sessionId === address.sessionId) ? { allowed: true } : SESSION_FORBIDDEN;\n  }\n\n  routes(): ApiRoute[] {\n    const { controllerId, controller, authorizeSessionAddress: customAuthorize } = this.deps;\n    const authorize =\n      customAuthorize ??\n      ((context: Context, address: { sessionId: string }) => this.#authorizeSessionAddress(context, address));\n    const handleSkillRequest = async (context: unknown, dispatch: boolean) => {\n      const c = loose(context);\n      if (c.req.param('controllerId') !== controllerId) {\n        return c.json({ error: 'controller_not_found', message: 'Agent controller not found.' }, 404);\n      }\n\n      let rawBody: unknown;\n      try {\n        rawBody = await c.req.json();\n      } catch {\n        return c.json({ error: 'invalid_request', message: 'Invalid JSON body.' }, 400);\n      }\n      const body = parseBody(rawBody);\n      if (!body) {\n        return c.json({ error: 'invalid_request', message: 'Invalid skill invocation request.' }, 400);\n      }\n\n      const authorization = await authorize(c, { sessionId: body.sessionId });\n      if (!authorization.allowed) {\n        return c.json({ error: authorization.code, message: authorization.message }, authorization.status ?? 403);\n      }\n\n      try {\n        const resolved = await resolveSkillInvocation(controller, body);\n        if (dispatch) {\n          const requestContext = c.get('requestContext' as never) as RequestContext | undefined;\n          void resolved.session\n            .sendMessage({ content: resolved.message, ...(requestContext ? { requestContext } : {}) })\n            .catch((error: unknown) => {\n              console.error('Workspace skill dispatch failed after acceptance', error);\n            });\n        }\n        return c.json({ ok: true, skill: resolved.skillName, message: resolved.message });\n      } catch (error) {\n        if (error instanceof SkillInvocationError) {\n          return c.json({ error: error.code, message: error.message }, 404);\n        }\n        throw error;\n      }\n    };\n\n    const handleFactorySkillsList = async (context: unknown) => {\n      const c = loose(context);\n      const { auth } = this.deps;\n      if (auth.enabled()) {\n        await auth.ensureUser(c);\n        if (!auth.tenant(c)) {\n          return c.json({ error: 'unauthorized', message: 'Authentication required.' }, 401);\n        }\n      }\n      return c.json({ skills: await listFactorySkills() });\n    };\n\n    return [\n      registerApiRoute('/web/factory/skills', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: context => handleFactorySkillsList(context),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/prepare', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, false),\n      }),\n      registerApiRoute('/web/agent-controller/:controllerId/skills/invoke', {\n        method: 'POST',\n        requiresAuth: false,\n        handler: context => handleSkillRequest(context, true),\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;AAaA,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;AAC7B,MAAM,gBAAgB;AACtB,MAAM,UAAU;AAuBhB,SAAS,MAAM,SAA2B;CACxC,OAAO;AACT;AAEA,SAAS,UAAU,OAAiD;CAClE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,KAAA;CAChD,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG,OAAO,KAAA;CAChF,IAAI,MAAM,UAAU,SAAS,uBAAuB,OAAO,KAAA;CAC3D,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,GAAG,OAAO,KAAA;CACxG,IAAI,MAAM,cAAc,KAAA,GAClB;MAAA,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,sBAAsB,OAAO,KAAA;CAAA;CAEnG,OAAO;EACL,WAAW,MAAM;EACjB,MAAM,MAAM;EACZ,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACxE;AACF;AAEA,MAAM,oBAAgD;CACpD,SAAS;CACT,QAAQ;CACR,MAAM;CACN,SAAS;AACX;AAEA,IAAa,cAAb,cAAiC,MAAuB;CACtD,MAAM,yBACJ,SACA,SACqC;EACrC,MAAM,EAAE,MAAM,sBAAsB,SAAS,6BAA6B,KAAK;EAC/E,IAAI,CAAC,KAAK,QAAQ,GAAG,OAAO,EAAE,SAAS,KAAK;EAE5C,MAAM,KAAK,WAAW,OAAO;EAC7B,MAAM,SAAS,KAAK,OAAO,OAAO;EAClC,IAAI,CAAC,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAgB,SAAS;EAA2B;EAKlG,IAAI,QAAQ,cAAc,OAAO,QAAQ,OAAO,EAAE,SAAS,KAAK;EAGhE,IAAI,CAAC,QAAQ,KAAK,QAAQ,SAAS,GACjC,OAAO;GAAE,SAAS;GAAO,QAAQ;GAAK,MAAM;GAAmB,SAAS;EAAoC;EAE9G,IAAI,CAAC,OAAO,SAAS,CAAC,SAAS,OAAO;EACtC,IAAI,0BACF,IAAI;GACF,MAAM,yBAAyB;EACjC,QAAQ;GACN,OAAO;EACT;EAEF,MAAM,MAAM,MAAM,QAAQ,SAAS,eAAe,QAAQ,SAAS;EACnE,IAAI,CAAC,OAAO,IAAI,UAAU,OAAO,SAAS,CAAC,IAAI,qBAAqB,OAAO;EAM3E,QAAO,MAJe,QAAQ,SAAS,KAAK;GAC1C,qBAAqB,IAAI;GACzB,cAAc,OAAO;EACvB,CAAC,EAAA,CACc,MAAK,YAAW,QAAQ,cAAc,QAAQ,SAAS,IAAI,EAAE,SAAS,KAAK,IAAI;CAChG;CAEA,SAAqB;EACnB,MAAM,EAAE,cAAc,YAAY,yBAAyB,oBAAoB,KAAK;EACpF,MAAM,YACJ,qBACE,SAAkB,YAAmC,KAAK,yBAAyB,SAAS,OAAO;EACvG,MAAM,qBAAqB,OAAO,SAAkB,aAAsB;GACxE,MAAM,IAAI,MAAM,OAAO;GACvB,IAAI,EAAE,IAAI,MAAM,cAAc,MAAM,cAClC,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA8B,GAAG,GAAG;GAG9F,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,EAAE,IAAI,KAAK;GAC7B,QAAQ;IACN,OAAO,EAAE,KAAK;KAAE,OAAO;KAAmB,SAAS;IAAqB,GAAG,GAAG;GAChF;GACA,MAAM,OAAO,UAAU,OAAO;GAC9B,IAAI,CAAC,MACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAmB,SAAS;GAAoC,GAAG,GAAG;GAG/F,MAAM,gBAAgB,MAAM,UAAU,GAAG,EAAE,WAAW,KAAK,UAAU,CAAC;GACtE,IAAI,CAAC,cAAc,SACjB,OAAO,EAAE,KAAK;IAAE,OAAO,cAAc;IAAM,SAAS,cAAc;GAAQ,GAAG,cAAc,UAAU,GAAG;GAG1G,IAAI;IACF,MAAM,WAAW,MAAM,uBAAuB,YAAY,IAAI;IAC9D,IAAI,UAAU;KACZ,MAAM,iBAAiB,EAAE,IAAI,gBAAyB;KACtD,SAAc,QACX,YAAY;MAAE,SAAS,SAAS;MAAS,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;KAAG,CAAC,CAAC,CACzF,OAAO,UAAmB;MACzB,QAAQ,MAAM,oDAAoD,KAAK;KACzE,CAAC;IACL;IACA,OAAO,EAAE,KAAK;KAAE,IAAI;KAAM,OAAO,SAAS;KAAW,SAAS,SAAS;IAAQ,CAAC;GAClF,SAAS,OAAO;IACd,IAAI,iBAAiB,sBACnB,OAAO,EAAE,KAAK;KAAE,OAAO,MAAM;KAAM,SAAS,MAAM;IAAQ,GAAG,GAAG;IAElE,MAAM;GACR;EACF;EAEA,MAAM,0BAA0B,OAAO,YAAqB;GAC1D,MAAM,IAAI,MAAM,OAAO;GACvB,MAAM,EAAE,SAAS,KAAK;GACtB,IAAI,KAAK,QAAQ,GAAG;IAClB,MAAM,KAAK,WAAW,CAAC;IACvB,IAAI,CAAC,KAAK,OAAO,CAAC,GAChB,OAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;IAA2B,GAAG,GAAG;GAErF;GACA,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,kBAAkB,EAAE,CAAC;EACrD;EAEA,OAAO;GACL,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,wBAAwB,OAAO;GACrD,CAAC;GACD,iBAAiB,sDAAsD;IACrE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,KAAK;GACvD,CAAC;GACD,iBAAiB,qDAAqD;IACpE,QAAQ;IACR,cAAc;IACd,UAAS,YAAW,mBAAmB,SAAS,IAAI;GACtD,CAAC;EACH;CACF;AACF"}

package/dist/routes/source-control-sessions.d.ts

@@ -23,7 +23,12 @@ export interface SourceControlSessionRoutesOptions {
     filesystem?: Pick<FilesystemStorage, 'deleteResourceFiles'>;
     /** How long recreate waits for an aborted run to settle before destroying. */
     abortSettleTimeoutMs?: number;
-    workItems?: Pick<WorkItemsStorage, 'clearSessionReferences'>;
+    workItems?: Pick<WorkItemsStorage, 'clearSessionReferences' | 'hasRunBindingForSession'>;
+    /** Moves a thread, with everything keyed by its resource, when a session's visibility changes. */
+    moveThread?: (input: {
+        threadId: string;
+        resourceId: string;
+    }) => Promise<unknown>;
 }
 export declare function buildSourceControlSessionRoutes(options: SourceControlSessionRoutesOptions): ApiRoute[];
 export {};

package/dist/routes/source-control-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAIrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAY1D,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,sGAAsG;IACtG,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC5D,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;CAC9D;AAoXD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CAsMtG"}
+{"version":3,"file":"source-control-sessions.d.ts","sourceRoot":"","sources":["../../src/routes/source-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAUrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAS5C,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAc1D,KAAK,wBAAwB,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,SAAS,CAAC;IAChB,cAAc,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,wBAAwB,CAAC;IACjC,UAAU,CAAC,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACjD,mFAAmF;IACnF,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,sGAAsG;IACtG,UAAU,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC5D,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;IACzF,kGAAkG;IAClG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpF;AA8XD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,iCAAiC,GAAG,QAAQ,EAAE,CA8TtG"}