@mastra/factory 0.24.0-alpha.9 → 0.25.0-alpha.0

package/dist/factory.js

@@ -19,8 +19,10 @@ import { recordFactoryPullRequestProvenance, resolveFactoryPullRequestParentWork
 import { dismissStaleFactoryReviews } from "./integrations/github/stale-reviews.js";
 import { PlatformApiClient, platformApiClientConfigFromEnv } from "./integrations/platform/api-client.js";
 import { buildPlatformConnectRoutes } from "./integrations/platform/connect/routes.js";
+import { createSessionAccessGuard } from "./routes/session-access.js";
 import { observeSessionFirstExec } from "./session/first-exec-capture.js";
 import { observeSessionFilesystem } from "./session/filesystem-capture.js";
+import { sessionMemoryResourceId, sessionStampCounts } from "./session/session-threads.js";
 import { createPlaintextFactorySecretEncryption } from "./secret-encryption.js";
 import { ModelCredentialsStorage } from "./storage/domains/credentials/base.js";
 import { createTenantCredentialPrimer, primeTenantCredentials, registerTenantCredentialResolver } from "./routes/tenant-credentials.js";
@@ -64,14 +66,14 @@ import { createFactoryTransitionTools } from "./rules/tools.js";
 import { CallbackFactorySandbox } from "./sandbox/callback-factory-sandbox.js";
 import { SessionRetirementCoordinator } from "./sandbox/session-retirement.js";
 import { handleServerError } from "./server-error.js";
-import { FactoryChannelReplyProcessor } from "./session/channel-reply-processor.js";
-import { FactoryChannelSessionLinkProcessor } from "./session/channel-session-link-processor.js";
 import { hydrateSessionDefaultModel } from "./session/default-model-hydration.js";
 import { observeSessionFirstMessage } from "./session/first-message-capture.js";
 import { LiveSessions } from "./session/live-sessions.js";
 import { FactoryReplyCredentialProcessor } from "./session/reply-credential-processor.js";
+import { migrateSessionResources, privatizeOwnerResourceSessions } from "./session/resource-migration.js";
 import { createSourceControlTools } from "./session/source-control-tools.js";
-import { readFactoryThinkingLevel, resolveFactoryThinkingLevel } from "./session/thinking-default.js";
+import { resolveFactoryThinkingLevel } from "./session/thinking-default.js";
+import { observeSessionThreadStamp } from "./session/thread-session-stamp.js";
 import { observeSessionThreadTitle } from "./session/thread-title-mirror.js";
 import { createSpaStaticMiddleware, resolveUiDistDir } from "./spa-static.js";
 import { createStateSigner } from "./state-signing.js";
@@ -83,10 +85,13 @@ import { CustomProvidersStorage } from "./storage/domains/custom-providers/base.
 import { FilesystemStorage } from "./storage/domains/filesystem/base.js";
 import { IntegrationStorage } from "./storage/domains/integrations/base.js";
 import { ModelDefaultsStorage } from "./storage/domains/model-defaults/base.js";
+import { createFactorySandboxTools } from "./tools/sandbox-tools.js";
 import { FactorySessionsStateProcessor } from "./tools/sessions-state-processor.js";
+import { RequestContext } from "@mastra/core/request-context";
 import { hasAuthInit, isUserProvider } from "@mastra/core/server";
 import { MastraAuthStudio } from "@mastra/auth-studio";
 import { prepareAgentControllerMount } from "@mastra/code-sdk";
+import { getDynamicMemory } from "@mastra/code-sdk/agents/memory";
 import { AgentControllerChannels } from "@mastra/core/channels";
 import { EventEmitterPubSub } from "@mastra/core/events";
 import { describeFactorySandbox, isFactorySandbox } from "@mastra/core/workspace";
@@ -112,6 +117,12 @@ import { describeFactorySandbox, isFactorySandbox } from "@mastra/core/workspace
 * and the storage domains those capabilities require.
 */
 const CONTROLLER_ID = "code";
+/**
+* Providers whose sandbox a session's agent may recreate itself. Each needs
+* its `destroy()` to leave the instance able to start a fresh VM, proven
+* against the real provider.
+*/
+const SELF_RECREATE_SANDBOX_PROVIDERS = /* @__PURE__ */ new Set(["platform"]);
 /** Why a wake couldn't be run as its Factory session's owner. */
 const WAKE_OWNER_UNRESOLVED = {
 	"session-not-found": "no Factory session row names its owner",
@@ -123,53 +134,18 @@ function hasPlatformCredentials() {
 }
 /**
 * Default auth provider — `MastraAuthStudio`, which proxies identity to the
-* shared Mastra platform API. `MastraAuthStudio` resolves `MASTRA_SHARED_API_URL`,
-* `MASTRA_ORGANIZATION_ID`, and `MASTRA_COOKIE_DOMAIN` from env on its own —
-* this helper only derives a cookie-domain fallback from the factory's
-* `publicUrl`.
-*
-* Cookie-domain resolution (Studio picks the first that wins):
-*   1. explicit `MASTRA_COOKIE_DOMAIN` env, if set;
-*   2. `.mastra.ai` when `sharedApiUrl` is on `.mastra.ai`;
-*   3. this parent-domain fallback derived from `publicUrl` — so a deploy on
-*      `https://foo.mastra.cloud` mints cookies with `Domain=.mastra.cloud`
-*      without the caller wiring the env var by hand.
-*   4. otherwise host-only (no `Domain=`), which is correct for `localhost`.
-*/
-function buildDefaultStudioAuth(publicUrl) {
-	return new MastraAuthStudio({ cookieDomain: parentDomainFromPublicUrl(publicUrl) });
-}
-/**
-* Derive a parent cookie domain from `publicUrl` by stripping the leftmost
-* label — the same shape platform-API's env injection uses (see
-* `platform/servers/api/src/lib/studio-env-vars.ts`: `.${routingDomain.replace(/^[^.]+\./, '')}`).
+* shared Mastra platform API and resolves its own env (`MASTRA_SHARED_API_URL`,
+* `MASTRA_ORGANIZATION_ID`, ...).
 *
-* Rather than a generic `strip-left-label` heuristic — which either emits
-* cookies scoped to a public suffix (`sub.example.co.uk` → `.example.co.uk`
-* requires PSL data to be safe) or misclassifies numeric hostnames like
-* `3scale.example.com` as IPv4 — we only derive a parent domain when the
-* host sits under one of the platform's known registrable domains. Anything
-* else (custom domains, arbitrary tenant hostnames, IPs, `localhost`)
-* falls through to host-only cookies. Callers that need a different scope
-* pass `MASTRA_COOKIE_DOMAIN` explicitly (Studio honors that first).
+* The session cookie is **host-only** (`__Host-wos-session` on secure
+* deployments). No parent `Domain` (e.g. `.mastra.cloud`) is derived from
+* `publicUrl`: a parent-scoped session cookie is sent by the browser to every
+* host under that parent, including other tenants' deployments. Callers that
+* really want a domain-scoped cookie pass their own `MastraAuthStudio` (with
+* `cookieDomain`) via `auth:`.
 */
-const KNOWN_PLATFORM_COOKIE_PARENTS = ["mastra.cloud", "mastra.ai"];
-function isIpLiteral(hostname) {
-	if (hostname.includes(":")) return true;
-	return /^\d+(?:\.\d+){3}$/.test(hostname);
-}
-function parentDomainFromPublicUrl(publicUrl) {
-	let hostname;
-	try {
-		hostname = new URL(publicUrl).hostname.toLowerCase();
-	} catch {
-		return;
-	}
-	if (hostname === "localhost" || isIpLiteral(hostname)) return void 0;
-	for (const parent of KNOWN_PLATFORM_COOKIE_PARENTS) {
-		if (hostname === parent) return void 0;
-		if (hostname.endsWith(`.${parent}`)) return `.${parent}`;
-	}
+function buildDefaultStudioAuth() {
+	return new MastraAuthStudio();
 }
 /** A session parking or being answered is inbox news, so the registry bumps the project's feed. */
 function liveSessionsTouchingTheFeed(controller, eventBus) {
@@ -221,6 +197,8 @@ var MastraFactory = class {
 	#factoryProcessor;
 	/** Environment builds through the sandbox's `builds`; undefined when the sandbox has none. */
 	#environmentBuilds;
+	/** The background session resource migration; resolves `true` when it moved run bindings. */
+	#sessionResourceMigration;
 	#preparing = false;
 	constructor(config) {
 		if (!config?.storage) throw new Error("MastraFactory: 'storage' is required. Pass a FactoryStorage backend — e.g. new PgFactoryStorage({ connectionString }) from '@mastra/pg' for deployments, or new LibSQLFactoryStorage({ url }) from '@mastra/libsql' for local dev.");
@@ -257,13 +235,14 @@ var MastraFactory = class {
 		const pubsub = this.#config.pubsub;
 		const eventBus = pubsub ?? new EventEmitterPubSub();
 		const configuredAuth = this.#config.auth;
-		const auth = configuredAuth === null ? void 0 : configuredAuth ?? buildDefaultStudioAuth(publicOrigin);
+		const auth = configuredAuth === null ? void 0 : configuredAuth ?? buildDefaultStudioAuth();
 		if (auth && !this.#config.secretEncryption) console.warn("[factory] auth is enabled but 'secretEncryption' is not configured. Persisted model credentials, custom-provider API keys, and integration secrets will be stored as plaintext. Provide 'secretEncryption' (e.g. via FACTORY_CREDENTIAL_ENCRYPTION_KEY) to encrypt them at rest.");
 		const secretEncryption = this.#config.secretEncryption ?? createPlaintextFactorySecretEncryption();
 		const deploymentModelProviders = resolveDeploymentModelProviders(this.#config.deploymentModelProviders);
 		const routeAuth = createFactoryRouteAuth(auth);
 		const mcpConfig = this.#config.mcp;
 		const mcpAuthorizationServers = mcpConfig === false || mcpConfig?.enabled === false ? [] : resolveMcpAuthorizationServers(auth?.name, mcpConfig);
+		const mcpEnabled = Boolean(auth) && mcpAuthorizationServers.length > 0;
 		const integrations = [...this.#config.integrations ?? []];
 		const explicitGithub = integrations.some((integration) => integration.id === "github");
 		let installedPlatformGithub = false;
@@ -366,7 +345,8 @@ var MastraFactory = class {
 				projects: factoryProjectsStorage,
 				auth: routeAuth,
 				intake: intakeStorage,
-				...integrationSourceControl ? { sourceControl: integrationSourceControl } : {}
+				...integrationSourceControl ? { sourceControl: integrationSourceControl } : {},
+				channels: () => this.#prepared?.base.controller.getChannels()
 			});
 			if (integration.versionControl && integrationSourceControl) integration.versionControl.initialize({ storage: integrationSourceControl });
 		}
@@ -393,6 +373,31 @@ var MastraFactory = class {
 		});
 		const intakeReady = integrations.some((integration) => integration.intake !== void 0) && storage.isDomainReady("intake");
 		const factoryReady = storage.isDomainReady("projects") && storage.isDomainReady("work-items");
+		if (storage.isDomainReady("source-control") && storage.isDomainReady("work-items")) this.#sessionResourceMigration = timedPhase("background.migrate.sessionResources", async () => {
+			try {
+				const mastraStorage = storage.getMastraStorage();
+				const memory = await mastraStorage.getStore("memory");
+				if (!memory) return false;
+				const sessionMemory = getDynamicMemory(mastraStorage, vector);
+				const report = await migrateSessionResources({
+					sessions: sourceControlStorage,
+					workItems: workItemsStorage,
+					...storage.isDomainReady("integrations") ? { integrations: integrationStorage } : {},
+					memory,
+					threads: sessionMemory({ requestContext: new RequestContext() })
+				});
+				await sessionMemory.settled();
+				await privatizeOwnerResourceSessions({
+					sessions: sourceControlStorage,
+					workItems: workItemsStorage,
+					memory
+				});
+				return report.runBindings > 0;
+			} catch (error) {
+				console.warn(`[factory] session resource migration stopped early: ${error instanceof Error ? error.message : error}`);
+				return false;
+			}
+		});
 		const knowledgeEnabled = this.#config.knowledge !== void 0 || process.env.MASTRACODE_EXPERIMENTAL_SUBCONSCIOUS === "1";
 		const githubIntegration = integrations.find((integration) => integration.id === "github");
 		const gitlabIntegration = integrations.find((integration) => integration.id === "gitlab" && integration.intake && integration.versionControl);
@@ -427,7 +432,7 @@ var MastraFactory = class {
 			abortSession: async (binding) => {
 				const controller = this.#prepared?.base.controller;
 				if (!controller) return;
-				const session = await controller.getSessionByResource(binding.resourceId);
+				const session = await controller.getSession(binding.sessionId);
 				if (session?.stream.isActive()) session.abort();
 			},
 			...retireTerminalSessions ? { releaseSandboxes: retireTerminalSessions } : {}
@@ -448,6 +453,7 @@ var MastraFactory = class {
 				deliver: (target, notification, options) => deliverFactorySessionNotification({
 					controller: messaging.controller,
 					sessions: sourceControlSessions,
+					runs: workItemsStorage,
 					target,
 					notification,
 					...options
@@ -460,10 +466,29 @@ var MastraFactory = class {
 			reporting: factoryReporting
 		};
 		const reportSessionRunEnd = createSessionRunEndReporter(sessionReports);
-		const failWake = async ({ resourceId, threadId }, reason) => {
-			const message = `Factory session ${resourceId} can't be woken as its owner: ${reason}.`;
+		const resolveWakeSession = async ({ resourceId, threadId, thread }) => {
+			const stamp = (thread === void 0 ? await this.#prepared?.base.controller.queryThreadById({ threadId }) : thread)?.metadata?.factorySessionId;
+			const candidates = [.../* @__PURE__ */ new Set([
+				typeof stamp === "string" ? stamp : "",
+				threadId,
+				resourceId
+			])].filter(Boolean);
+			for (const sessionId of candidates) {
+				const row = await sourceControlSessions.getBySessionId(sessionId);
+				if (row && (!(sessionId !== threadId && sessionId !== resourceId) || sessionStampCounts(row, resourceId)) && (resourceId === sessionId || resourceId === await sessionMemoryResourceId(this.#prepared?.base.controller, row, workItemsStorage))) return {
+					sessionId,
+					row
+				};
+			}
+			return {
+				sessionId: threadId,
+				row: null
+			};
+		};
+		const failWake = async ({ sessionId, threadId }, reason) => {
+			const message = `Factory session ${sessionId} can't be woken as its owner: ${reason}.`;
 			await reportSessionRunEnd({
-				sessionId: resourceId,
+				sessionId,
 				threadId,
 				since: /* @__PURE__ */ new Date(),
 				outcome: {
@@ -603,7 +628,7 @@ var MastraFactory = class {
 			...sessionRetirement ? { sessionRetirement } : {},
 			...workItemsReady ? {
 				workItems: workItemsStorage,
-				controller: { getSessionByResource: async (resourceId) => this.#prepared?.base.controller.getSessionByResource(resourceId) }
+				controller: { getSession: async (sessionId) => this.#prepared?.base.controller.getSession(sessionId) }
 			} : {}
 		});
 		const loadMemorySettings = async ({ requestContext, binding }) => {
@@ -635,12 +660,18 @@ var MastraFactory = class {
 			}
 			requestContext.set("mastra__factoryMemorySettings", layerPersonalMemorySettings(record, personal));
 		};
+		const resolveDefaultThinkingLevel = (requestContext) => resolveFactoryThinkingLevel(requestContext, {
+			projects: factoryProjectsStorage,
+			sourceControl: sourceControlSessions,
+			workItems: workItemsStorage,
+			modelDefaults: modelDefaultsStorage
+		});
 		const factoryProcessor = workItemsReady ? new FactoryPhaseStateProcessor({
 			configVersion,
 			storage: workItemsStorage,
 			boards: this.#boards,
 			loadMemorySettings,
-			factoryThinkingLevel: (factoryProjectId) => readFactoryThinkingLevel(factoryProjectsStorage, factoryProjectId),
+			defaultThinkingLevel: resolveDefaultThinkingLevel,
 			...transitionService ? { transitionService } : {},
 			...githubIntegration ? { recordPullRequestProvenance: (input) => recordFactoryPullRequestProvenance(githubIntegration, sourceControlStorage.forIntegration("github"), integrationStorage.forIntegration("github"), workItemsStorage, input) } : {},
 			messageReader: { listMessages: async (input) => {
@@ -658,6 +689,7 @@ var MastraFactory = class {
 				if (proto.constructor?.name === "LibSQLFactoryStorage") return "libsql";
 			}
 		})();
+		const integrationInputProcessors = integrations.flatMap((integration) => integration.processors?.input ?? []);
 		const toolIntegrations = integrationRegistrations.filter(({ integration }) => integration.agentTools || integration.sessionTools);
 		const sourceControlToolProviders = integrations.flatMap((integration) => integration.versionControl ? [{
 			id: integration.id,
@@ -666,13 +698,12 @@ var MastraFactory = class {
 		}] : []);
 		const prepared = await timedPhase("prepare.controllerMount", () => prepareAgentControllerMount({
 			controllerId: CONTROLLER_ID,
+			browser: this.#config.browser,
 			coAuthor: { name: "mastra-platform[bot]" },
 			...this.#config.disableBuiltinTools?.length ? { disableBuiltinTools: this.#config.disableBuiltinTools } : {},
 			modes: false,
-			resolveDefaultThinkingLevel: ({ requestContext }) => resolveFactoryThinkingLevel(requestContext, {
-				projects: factoryProjectsStorage,
-				sourceControl: sourceControlSessions
-			}),
+			subagents: [],
+			resolveDefaultThinkingLevel: ({ requestContext }) => resolveDefaultThinkingLevel(requestContext),
 			workspace: createWorkspaceFactory({
 				...sandboxConfig ? { sandbox: sandboxConfig } : {},
 				...this.#config.sandboxStart ? { sandboxStart: this.#config.sandboxStart } : {},
@@ -690,15 +721,26 @@ var MastraFactory = class {
 			prepareWakeRequestContext: async ({ requestContext, resourceId, threadId }) => {
 				if (!storage.isDomainReady("source-control")) {
 					if (auth) await failWake({
-						resourceId,
+						sessionId: threadId,
 						threadId
 					}, "session storage is not ready");
 					return;
 				}
-				const prepared = await prepareSessionRunContext(requestContext, resourceId, { sessions: sourceControlSessions });
+				const { sessionId, row } = await resolveWakeSession({
+					resourceId,
+					threadId
+				});
+				if (!row) {
+					if (auth) await failWake({
+						sessionId,
+						threadId
+					}, WAKE_OWNER_UNRESOLVED["session-not-found"]);
+					return;
+				}
+				const prepared = await prepareSessionRunContext(requestContext, sessionId, { sessions: sourceControlSessions });
 				if (prepared !== "prepared") {
 					if (auth) await failWake({
-						resourceId,
+						sessionId,
 						threadId
 					}, WAKE_OWNER_UNRESOLVED[prepared]);
 					return;
@@ -708,26 +750,33 @@ var MastraFactory = class {
 			...auth ? { resumeWakeSession: async ({ resourceId, threadId }) => {
 				const controller = this.#prepared?.base.controller;
 				if (!controller) return failWake({
-					resourceId,
+					sessionId: threadId,
 					threadId
 				}, "the Factory is not started");
 				const thread = await controller.queryThreadById({ threadId });
 				if (!thread || thread.resourceId !== resourceId) return failWake({
-					resourceId,
+					sessionId: threadId,
 					threadId
 				}, `thread ${threadId} is not the session's`);
-				const row = storage.isDomainReady("source-control") ? await sourceControlSessions.getBySessionId(resourceId) : null;
-				if (!row?.factoryProjectId) return failWake({
+				const { sessionId, row } = storage.isDomainReady("source-control") ? await resolveWakeSession({
 					resourceId,
+					threadId,
+					thread
+				}) : {
+					sessionId: threadId,
+					row: null
+				};
+				if (!row?.factoryProjectId) return failWake({
+					sessionId,
 					threadId
 				}, WAKE_OWNER_UNRESOLVED["session-not-found"]);
 				if (!hasResolvedOrg(row.orgId)) return failWake({
-					resourceId,
+					sessionId,
 					threadId
 				}, WAKE_OWNER_UNRESOLVED["organization-unresolved"]);
-				if (await controller.getSessionByResource(resourceId)) return;
+				if (await controller.getSession(sessionId)) return;
 				await createSessionAsRowOwner(controller, {
-					sessionId: resourceId,
+					sessionId,
 					ownerResourceId: resourceId,
 					row,
 					tags: {
@@ -740,7 +789,7 @@ var MastraFactory = class {
 			disableSettingsOmSeed: true,
 			hostInstructions: async ({ requestContext }) => {
 				const context = requestContext.get("controller");
-				if (context?.threadId && context.resourceId) {
+				if (context?.threadId && context.sessionId) {
 					const current = context.getState();
 					if (!(Boolean(current.factoryProjectId) && Boolean(current.factoryOrgId) && typeof current.untrustedCheckout === "boolean")) {
 						const recovered = await resolveFactorySessionAddress({
@@ -767,7 +816,6 @@ var MastraFactory = class {
 			...mastraStorageBackend ? { storageBackend: mastraStorageBackend } : {},
 			...this.#config.knowledge ? { knowledge: this.#config.knowledge } : {},
 			inputProcessors: async ({ requestContext }) => {
-				const channelReplyProcessor = new FactoryChannelReplyProcessor();
 				const environmentProcessor = new FactoryEnvironmentStateProcessor();
 				const sessionsProcessor = workItemsStorage && storage.isDomainReady("source-control") ? [new FactorySessionsStateProcessor({
 					authEnabled: routeAuth.enabled(),
@@ -776,7 +824,7 @@ var MastraFactory = class {
 					workItems: workItemsStorage,
 					boards: this.#boards,
 					isRunning: async (sessionId) => {
-						return (await this.#prepared?.base.controller.getSessionByResource(sessionId))?.stream.isActive() ?? false;
+						return (await this.#prepared?.base.controller.getSession(sessionId))?.stream.isActive() ?? false;
 					},
 					lastActivity: async (threadId) => {
 						const thread = await this.#prepared?.base.controller.queryThreadById({ threadId });
@@ -787,7 +835,7 @@ var MastraFactory = class {
 				if (factoryProcessor) {
 					await factoryProcessor.prepareMemorySettings(requestContext);
 					return [
-						channelReplyProcessor,
+						...integrationInputProcessors,
 						environmentProcessor,
 						...sessionsProcessor,
 						factoryProcessor
@@ -802,14 +850,14 @@ var MastraFactory = class {
 					reportMemorySettingsUnavailable(requestContext, error instanceof Error ? error.message : String(error));
 				}
 				return [
-					channelReplyProcessor,
+					...integrationInputProcessors,
 					environmentProcessor,
 					...sessionsProcessor
 				];
 			},
-			outputProcessors: [new FactoryChannelSessionLinkProcessor(), new FactoryReplyCredentialProcessor()],
+			outputProcessors: [...integrations.flatMap((integration) => integration.processors?.output ?? []), new FactoryReplyCredentialProcessor()],
 			...vector ? { vector } : {},
-			...toolIntegrations.length > 0 || sourceControlToolProviders.length > 0 || workItemsStorage && transitionService ? { extraTools: async ({ requestContext }) => {
+			extraTools: async ({ requestContext }) => {
 				const tools = {};
 				const toolOwners = /* @__PURE__ */ new Map();
 				const mergeTools = (ownerId, contributed) => {
@@ -896,10 +944,16 @@ var MastraFactory = class {
 							projects: factoryProjectsStorage,
 							workItems: workItemsStorage
 						});
-						if (scope) mergeTools("factory-tools", createFactoryTools({
-							scope,
-							deps: factoryToolDeps
-						}));
+						if (scope) {
+							mergeTools("factory-tools", createFactoryTools({
+								scope,
+								deps: factoryToolDeps
+							}));
+							if (sessionRetirement && sandboxConfig && SELF_RECREATE_SANDBOX_PROVIDERS.has(sandboxConfig.provider)) mergeTools("factory-sandbox-tools", createFactorySandboxTools(scope, {
+								sessions: sourceControlSessions,
+								resetSandbox: (input) => sessionRetirement.resetSessionSandbox(input)
+							}));
+						}
 					}
 				}
 				for (const { integration, ready, ensureReady } of toolIntegrations) {
@@ -912,7 +966,7 @@ var MastraFactory = class {
 					if (integration.sessionTools) mergeTools(integration.id, integration.sessionTools({ requestContext }));
 				}
 				return tools;
-			} } : {},
+			},
 			postToolObserver: async (toolContext) => {
 				const requestContext = toolContext.context?.requestContext;
 				if (requestContext) await observeAgentGitAction({
@@ -951,7 +1005,7 @@ var MastraFactory = class {
 			} : {},
 			buildApiRoutes: ({ controller, authStorage }) => [
 				...auth ? buildAuthRoutes(auth, { publicUrl: publicOrigin }) : buildAuthDisabledRoutes(),
-				...auth && mcpAuthorizationServers.length > 0 ? buildFactoryMcpRoutes({
+				...mcpEnabled ? buildFactoryMcpRoutes({
 					auth: routeAuth,
 					publicOrigin,
 					authorizationServers: mcpAuthorizationServers,
@@ -978,6 +1032,14 @@ var MastraFactory = class {
 					sandbox: sandboxConfig,
 					...environmentBuilds ? { onRepositoryPush: environmentBuilds.onRepositoryPush } : {},
 					sessionRetirement,
+					moveThread: async ({ threadId, resourceId }) => {
+						const sessionMemory = getDynamicMemory(storage.getMastraStorage(), vector);
+						await sessionMemory({ requestContext: new RequestContext() }).updateThreadResourceId({
+							threadId,
+							resourceId
+						});
+						await sessionMemory.settled();
+					},
 					factoryStorage: storage,
 					integrationStorage,
 					sourceControlStorage,
@@ -987,6 +1049,7 @@ var MastraFactory = class {
 					intakeReady,
 					factoryReady,
 					knowledgeEnabled,
+					mcpEnabled,
 					deploymentModelProviders,
 					knowledgeKey: this.#config.knowledge?.key,
 					configVersion,
@@ -1057,10 +1120,19 @@ var MastraFactory = class {
 				}) : []
 			],
 			buildServerConfig: () => {
-				const cors = allowedOrigins.length ? { cors: {
+				const mcpCors = {
+					allowHeaders: [
+						"Mcp-Protocol-Version",
+						"Mcp-Method",
+						"Mcp-Name"
+					],
+					exposeHeaders: ["WWW-Authenticate"]
+				};
+				const cors = { cors: allowedOrigins.length ? {
 					origin: allowedOrigins,
-					credentials: true
-				} } : {};
+					credentials: true,
+					...mcpCors
+				} : mcpCors };
 				const onError = { onError: handleServerError };
 				const uiDist = resolveUiDistDir();
 				const spa = uiDist ? [createSpaStaticMiddleware(uiDist)] : [];
@@ -1084,6 +1156,16 @@ var MastraFactory = class {
 					middleware: [
 						...timing,
 						createFactoryAuthGate(auth),
+						createSessionAccessGuard({
+							auth: routeAuth,
+							sessions: sourceControlSessions,
+							projects: { get: async (args) => {
+								if (!storage.isDomainReady("projects")) return null;
+								await factoryProjectsStorage.ensureReady();
+								return factoryProjectsStorage.get(args);
+							} },
+							controller: () => this.#prepared?.base.controller
+						}),
 						createTenantCredentialPrimer({
 							auth: routeAuth,
 							credentials: modelCredentialsStorage
@@ -1111,15 +1193,16 @@ var MastraFactory = class {
 			observeSessionThreadTitle(session, { sourceControl: { sessions: sourceControlSessions } });
 			observeSessionRunEnd(session, { audit: auditDomain });
 			observeSessionRunReports(session, (outcome, since) => reportSessionRunEnd({
-				sessionId: session.identity.getResourceId(),
+				sessionId: session.identity.getId(),
 				threadId: session.thread.getId(),
 				outcome,
 				since
 			}), { onApprovalRequested: (request) => notifyApprovalRequested({
-				sessionId: session.identity.getResourceId(),
+				sessionId: session.identity.getId(),
 				threadId: session.thread.getId(),
 				...request
 			}) });
+			observeSessionThreadStamp(session);
 		});
 		prepared.base.controller.onSessionCreated((session) => hydrateSessionMemorySettings(session, { sourceControl: { sessions: sourceControlSessions } }), { blocking: true });
 		prepared.base.controller.onSessionCreated((session) => hydrateSessionDefaultModel(session, {
@@ -1208,6 +1291,7 @@ var MastraFactory = class {
 		await timedPhase("finalize.controller", () => this.#prepared.finalize());
 		await this.#environmentBuilds?.probeSchedules();
 		await timedPhase("finalize.reconcileBoundThreads", () => this.#factoryProcessor?.reconcileAllBoundThreads() ?? Promise.resolve());
+		this.#sessionResourceMigration?.then((movedRunBindings) => movedRunBindings ? this.#factoryProcessor?.reconcileAllBoundThreads() : void 0).catch((error) => console.warn(`[factory] reconciling bound threads after the session resource migration failed: ${error instanceof Error ? error.message : error}`));
 		this.#dispatcher?.start();
 	}
 	/** Stop Factory-owned background dispatch before the host process shuts down. */