@mastra/factory 0.6.0-alpha.1 → 0.6.0-alpha.3

package/dist/routes/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","names":["posixPath"],"sources":["../../src/routes/fs.ts"],"sourcesContent":["import { lstat, open, readdir, realpath, stat } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { isAbsolute, join, posix as posixPath, resolve, sep } from 'node:path';\n\nimport { SandboxFilesystem } from '@mastra/code-sdk/agents/sandbox-filesystem';\nimport { detectProject, getResourceIdOverride } from '@mastra/code-sdk/utils/project';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { MaterializationSandbox, SandboxFleet } from '../sandbox/fleet.js';\nimport type { SourceControlSession } from '../storage/domains/source-control/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * Server-side directory browser for the web project picker.\n *\n * The browser cannot read absolute filesystem paths (the File System Access API\n * only exposes a directory *name*), so the picker must ask the server — which\n * does have filesystem access — to enumerate directories. The result is real\n * absolute paths the user can select without typing.\n *\n * All access is confined to a configured `root` (default: the user's home\n * directory). Requests that try to escape the root via `..` or symlinks are\n * clamped back to the root.\n */\n\nexport interface DirectoryEntry {\n  name: string;\n  /** Absolute path to the entry. */\n  path: string;\n}\n\nexport interface DirectoryListing {\n  /** The allowed root; clients cannot browse above this. */\n  root: string;\n  /** The absolute path that was listed. */\n  path: string;\n  /** Parent directory path, or null when `path` is the root. */\n  parent: string | null;\n  /** Subdirectories of `path` (directories only, sorted, hidden excluded). */\n  entries: DirectoryEntry[];\n}\n\nexport interface WorkspaceRenderedEntry {\n  name: string;\n  /** Path relative to the configured rendered root. */\n  path: string;\n  type: 'file' | 'directory';\n  size: number;\n  updatedAt: string;\n}\n\nexport interface WorkspaceRenderedListing {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Configured workspace-relative rendered root, e.g. `.artifacts`. */\n  root: string;\n  /** The confined absolute path for the rendered root. */\n  rootPath: string;\n  entries: WorkspaceRenderedEntry[];\n}\n\nexport interface WorkspaceFile {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Workspace-relative file path. */\n  path: string;\n  name: string;\n  size: number;\n  updatedAt: string;\n  contentType: 'text' | 'unsupported';\n  content?: string;\n  truncated?: boolean;\n}\n\nexport type WorkspaceChangeStatus =\n  | 'modified'\n  | 'added'\n  | 'deleted'\n  | 'renamed'\n  | 'copied'\n  | 'untracked'\n  | 'conflicted';\n\nexport interface WorkspaceChange {\n  path: string;\n  previousPath?: string;\n  status: WorkspaceChangeStatus;\n  additions?: number;\n  deletions?: number;\n  binary?: boolean;\n}\n\nexport interface WorkspaceChanges {\n  workspacePath: string;\n  available: boolean;\n  changes: WorkspaceChange[];\n  additions?: number;\n  deletions?: number;\n}\n\nexport interface WorkspaceDiff {\n  workspacePath: string;\n  path: string;\n  patch: string;\n  truncated: boolean;\n}\n\nexport type ArtifactEntry = WorkspaceRenderedEntry;\n\nexport interface ArtifactListing {\n  /** The confined workspace/project root. */\n  rootPath: string;\n  /** The workspace artifact directory. */\n  artifactsPath: string;\n  entries: ArtifactEntry[];\n}\n\nconst MAX_TEXT_FILE_BYTES = 512 * 1024;\nconst MAX_DIFF_BYTES = 512 * 1024;\nconst WORKSPACE_NUMSTAT_SCRIPT = `\nset -e\nworkdir=$1\nindex_file=$(mktemp)\nuntracked_file=$(mktemp)\nobject_dir=$(mktemp -d)\ntrap 'rm -f \"$index_file\" \"$untracked_file\"; rm -rf \"$object_dir\"' EXIT\nrm -f \"$index_file\"\ngit -C \"$workdir\" diff --numstat -z --find-renames --no-ext-diff --no-textconv HEAD\ngit -C \"$workdir\" ls-files --others --exclude-standard -z >\"$untracked_file\"\ngit_dir=$(git -C \"$workdir\" rev-parse --absolute-git-dir)\nexport GIT_INDEX_FILE=\"$index_file\"\nexport GIT_OBJECT_DIRECTORY=\"$object_dir\"\nexport GIT_ALTERNATE_OBJECT_DIRECTORIES=\"$git_dir/objects\"\ngit -C \"$workdir\" read-tree --empty\ngit -C \"$workdir\" update-index --add -z --stdin <\"$untracked_file\"\nempty_tree=$(git -C \"$workdir\" hash-object -t tree /dev/null)\ngit -C \"$workdir\" diff --cached --numstat -z --no-ext-diff --no-textconv \"$empty_tree\"\n`;\nconst BOUNDED_GIT_DIFF_SCRIPT = `\nallow_exit_one=$1\nshift\nstatus_file=$(mktemp)\nstderr_file=$(mktemp)\ntrap 'rm -f \"$status_file\" \"$stderr_file\"' EXIT\n(\n  git \"$@\" 2>\"$stderr_file\"\n  printf '%s' \"$?\" >\"$status_file\"\n) | head -c ${MAX_DIFF_BYTES + 1}\nstatus=$(cat \"$status_file\")\ncase \"$status\" in\n  0|141) exit 0 ;;\n  1) [ \"$allow_exit_one\" = \"1\" ] && exit 0 ;;\nesac\ncat \"$stderr_file\" >&2\nexit \"\\${status:-1}\"\n`;\nconst TEXT_DECODER = new TextDecoder('utf-8', { fatal: true });\nconst APPROVED_RENDERED_ROOTS = new Set(['.artifacts']);\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/** Resolve the browsable root, defaulting to the user's home directory. */\nexport function resolveFsRoot(root?: string): string {\n  return resolve(root && root.trim() ? root : homedir());\n}\n\n/** True when `candidate` is `root` or nested under it. */\nfunction isWithinRoot(candidate: string, root: string): boolean {\n  if (candidate === root) return true;\n  const rootWithSep = root.endsWith(sep) ? root : root + sep;\n  return candidate.startsWith(rootWithSep);\n}\n\nasync function realOrResolved(path: string): Promise<string> {\n  try {\n    return await realpath(path);\n  } catch {\n    return path;\n  }\n}\n\n/**\n * Resolve a path's real location (following symlinks) and confirm it stays\n * within `root`. Returns the real path when confined, or `null` when it escapes\n * the root or does not exist. Used so a symlink inside the root that points\n * outside it cannot be browsed or selected.\n */\nasync function realPathWithinRoot(candidate: string, root: string): Promise<string | null> {\n  try {\n    const real = await realpath(candidate);\n    return isWithinRoot(real, root) ? real : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction assertRelativePath(path: string, label: string): string {\n  const trimmed = path.trim();\n  if (!trimmed) throw new Error(`Missing required query param: ${label}`);\n  if (isAbsolute(trimmed)) throw new Error(`${label} must be relative`);\n  if (trimmed.split(/[\\\\/]+/).includes('..')) throw new Error(`${label} escapes workspace`);\n  const normalized = resolve('/', trimmed).slice(1);\n  if (!normalized || normalized === '..' || normalized.startsWith(`..${sep}`))\n    throw new Error(`${label} escapes workspace`);\n  return normalized;\n}\n\nfunction assertApprovedRenderedRoot(renderedRoot: string): string {\n  const safeRoot = assertRelativePath(renderedRoot, 'root');\n  if (!APPROVED_RENDERED_ROOTS.has(safeRoot)) throw new Error('Root is not approved for rendered workspace access');\n  return safeRoot;\n}\n\nasync function confinedWorkspacePath(\n  root: string,\n  workspacePath: string,\n): Promise<{ resolvedRoot: string; workspace: string }> {\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n  const candidate = isAbsolute(workspacePath) ? resolve(workspacePath) : resolve(resolvedRoot, workspacePath);\n  const workspace = await realPathWithinRoot(candidate, resolvedRoot);\n  if (!workspace) throw new Error('Path is outside the browsable root');\n  return { resolvedRoot, workspace };\n}\n\nasync function confinedWorkspaceRelativePath(\n  root: string,\n  workspacePath: string,\n  relativePath: string,\n): Promise<{ workspace: string; path: string; relativePath: string }> {\n  const safeRelativePath = assertRelativePath(relativePath, 'path');\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const candidate = resolve(workspace, safeRelativePath);\n  if (!isWithinRoot(candidate, workspace)) throw new Error('Path escapes workspace');\n  const confinedPath = await realPathWithinRoot(candidate, workspace);\n  if (!confinedPath) throw new Error('Path is outside the workspace');\n  return { workspace, path: confinedPath, relativePath: safeRelativePath };\n}\n\n/**\n * List the directories inside `requestedPath`, confined to `root`. An absent or\n * out-of-root path is clamped to the root, so the worst a malicious client can\n * do is browse within the allowed root.\n */\nexport async function listDirectory(root: string, requestedPath?: string): Promise<DirectoryListing> {\n  // Resolve the root through symlinks so all confinement checks compare real\n  // paths; a symlink that escapes the root is then reliably detectable.\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n\n  let target = resolvedRoot;\n  if (requestedPath && requestedPath.trim()) {\n    const candidate = isAbsolute(requestedPath) ? resolve(requestedPath) : resolve(resolvedRoot, requestedPath);\n    // Follow symlinks and re-confirm the real target stays within the root.\n    target = (await realPathWithinRoot(candidate, resolvedRoot)) ?? resolvedRoot;\n  }\n\n  // Confirm the target is a real directory; fall back to root otherwise.\n  try {\n    const info = await stat(target);\n    if (!info.isDirectory()) target = resolvedRoot;\n  } catch {\n    target = resolvedRoot;\n  }\n\n  const dirents = await readdir(target, { withFileTypes: true });\n  const entries: DirectoryEntry[] = [];\n  for (const dirent of dirents) {\n    if (dirent.name.startsWith('.')) continue; // skip dotfiles/dirs\n    const entryPath = join(target, dirent.name);\n    let isDir = dirent.isDirectory();\n    if (dirent.isSymbolicLink()) {\n      // Only surface symlinks whose real target is a directory inside the root,\n      // so a link pointing outside the root can't be browsed or selected.\n      const real = await realPathWithinRoot(entryPath, resolvedRoot);\n      isDir = real ? (await stat(real).catch(() => null))?.isDirectory() === true : false;\n    }\n    if (isDir) entries.push({ name: dirent.name, path: entryPath });\n  }\n  entries.sort((a, b) => a.name.localeCompare(b.name));\n\n  const parent = target === resolvedRoot ? null : resolve(target, '..');\n\n  return { root: resolvedRoot, path: target, parent, entries };\n}\n\nasync function listRenderedEntries(rootPath: string, currentPath = rootPath): Promise<WorkspaceRenderedEntry[]> {\n  const dirents = await readdir(currentPath, { withFileTypes: true });\n  const entries: WorkspaceRenderedEntry[] = [];\n\n  for (const dirent of dirents) {\n    const entryPath = join(currentPath, dirent.name);\n    const info = await lstat(entryPath);\n    const relativePath = entryPath.slice(rootPath.length + 1);\n\n    if (info.isDirectory()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'directory',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n      entries.push(...(await listRenderedEntries(rootPath, entryPath)));\n      continue;\n    }\n\n    if (info.isFile()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'file',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n    }\n  }\n\n  return entries.sort((a, b) => a.path.localeCompare(b.path));\n}\n\nexport async function listWorkspaceRenderedPath(\n  root: string,\n  workspacePath: string,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const renderedPath = resolve(workspace, safeRoot);\n  if (!isWithinRoot(renderedPath, workspace)) throw new Error('Root escapes workspace');\n\n  const confinedRootPath = await realPathWithinRoot(renderedPath, workspace);\n  if (!confinedRootPath) return { workspacePath: workspace, root: safeRoot, rootPath: renderedPath, entries: [] };\n\n  const info = await stat(confinedRootPath);\n  if (!info.isDirectory()) return { workspacePath: workspace, root: safeRoot, rootPath: confinedRootPath, entries: [] };\n\n  return {\n    workspacePath: workspace,\n    root: safeRoot,\n    rootPath: confinedRootPath,\n    entries: await listRenderedEntries(confinedRootPath),\n  };\n}\n\nexport async function readWorkspaceFile(root: string, workspacePath: string, path: string): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  const relativeRoot = safePath.split('/')[0] ?? '';\n  assertApprovedRenderedRoot(relativeRoot);\n  const {\n    workspace,\n    path: confinedPath,\n    relativePath,\n  } = await confinedWorkspaceRelativePath(root, workspacePath, path);\n  const info = await lstat(confinedPath);\n  if (info.isDirectory()) throw new Error('Path is a directory');\n  if (!info.isFile()) throw new Error('Unsupported file type');\n\n  const bytesToRead = Math.min(info.size, MAX_TEXT_FILE_BYTES);\n  const contentBuffer = Buffer.alloc(bytesToRead);\n  const handle = await open(confinedPath, 'r');\n  try {\n    await handle.read(contentBuffer, 0, bytesToRead, 0);\n  } finally {\n    await handle.close();\n  }\n\n  try {\n    const content = TEXT_DECODER.decode(contentBuffer);\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'text',\n      content,\n      truncated: info.size > MAX_TEXT_FILE_BYTES,\n    };\n  } catch {\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'unsupported',\n    };\n  }\n}\n\nexport async function listArtifacts(root: string, workspacePath: string): Promise<ArtifactListing> {\n  const listing = await listWorkspaceRenderedPath(root, workspacePath, '.artifacts');\n  return {\n    rootPath: listing.workspacePath,\n    artifactsPath: listing.rootPath,\n    entries: listing.entries,\n  };\n}\n\n// ── Session-backed workspace access ──────────────────────────────────────────\n//\n// The web UI identifies a Factory session workspace by its session id (a UUID),\n// not by a server-local filesystem path — the session's files live inside the\n// session's sandbox (a remote VM on deployed factories). These helpers resolve\n// the session, enforce that the caller owns it, reattach to its sandbox, and\n// serve the approved rendered roots through `SandboxFilesystem`.\n\n/** Dependencies for resolving a `workspacePath` that is a Factory session id. */\nexport interface SessionFsDeps {\n  auth: RouteAuth;\n  fleet: SandboxFleet;\n  sessions: { getBySessionId(sessionId: string): Promise<SourceControlSession | null> };\n}\n\n/**\n * Resolve a `workspacePath` query param as a Factory session id. Returns the\n * session when one exists and the caller owns it, `null` when no session\n * matches (the caller should fall back to local-path handling), and throws\n * when a session exists but belongs to another tenant.\n */\nasync function resolveAuthorizedSession(\n  c: Context,\n  deps: SessionFsDeps | undefined,\n  workspacePath: string,\n): Promise<SourceControlSession | null> {\n  if (!deps) return null;\n  const session = await deps.sessions.getBySessionId(workspacePath);\n  if (!session) return null;\n  if (deps.auth.enabled()) {\n    await deps.auth.ensureUser(c);\n    const tenant = deps.auth.tenant(c);\n    if (!tenant || tenant.orgId !== session.orgId || tenant.userId !== session.userId) {\n      throw new Error('Session is not available to the current user');\n    }\n  }\n  return session;\n}\n\ninterface SessionSandboxHandle {\n  sandbox: MaterializationSandbox;\n  filesystem: SandboxFilesystem;\n  workdir: string;\n}\n\n/**\n * Reattach to the session's sandbox and wrap its workdir in a\n * `SandboxFilesystem`. Returns `null` when the session has no provisioned\n * sandbox yet (nothing materialized → nothing to list), or when the sandbox\n * can no longer be reattached (e.g. torn down by the provider's idle GC).\n * This is a passive read path, so it never re-provisions: the session's\n * filesystem is preserved in its provider checkpoint and comes back the next\n * time the workspace is actually opened (e.g. by sending a message).\n */\nasync function sessionSandbox(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n): Promise<SessionSandboxHandle | null> {\n  if (!fleet.enabled || !session.sandboxId || !session.sandboxWorkdir) return null;\n  let sandbox: Awaited<ReturnType<SandboxFleet['reattachSandbox']>>;\n  try {\n    sandbox = await fleet.reattachSandbox(session.sandboxId, { workingDirectory: session.sandboxWorkdir });\n  } catch {\n    // Sandbox is gone (idle GC) or unreachable. Degrade to an empty view\n    // rather than surfacing a 500 from a file-viewer panel.\n    return null;\n  }\n  return {\n    sandbox,\n    filesystem: new SandboxFilesystem({ sandbox, workdir: session.sandboxWorkdir }),\n    workdir: session.sandboxWorkdir,\n  };\n}\n\n/** List an approved rendered root inside a Factory session's sandbox workdir. */\nexport async function listSessionRenderedPath(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const rootPath = posixPath.join(session.sandboxWorkdir ?? '', safeRoot);\n  const empty: WorkspaceRenderedListing = { workspacePath: session.sessionId, root: safeRoot, rootPath, entries: [] };\n\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) return empty;\n\n  // One round trip: emit \"type\\tsize\\tmtime\\tpath\" per entry. `safeRoot` comes\n  // from a fixed allowlist so interpolating it (quoted) is safe.\n  const quotedRoot = `'${rootPath.replace(/'/g, `'\\\\''`)}'`;\n  const result = await handle.sandbox.executeCommand(\n    'sh',\n    [\n      '-c',\n      `test -d ${quotedRoot} && find ${quotedRoot} -mindepth 1 -printf '%y\\\\t%s\\\\t%T@\\\\t%p\\\\n' 2>/dev/null || true`,\n    ],\n    { timeout: 30_000 },\n  );\n  if (result.exitCode !== 0) return empty;\n\n  const entries: WorkspaceRenderedEntry[] = [];\n  for (const line of result.stdout.split('\\n')) {\n    if (!line) continue;\n    const [type, sizeStr, mtimeStr, ...pathParts] = line.split('\\t');\n    const fullPath = pathParts.join('\\t');\n    if (!fullPath || !fullPath.startsWith(`${rootPath}/`)) continue;\n    const relativePath = fullPath.slice(rootPath.length + 1);\n    entries.push({\n      name: posixPath.basename(relativePath),\n      path: relativePath,\n      type: type === 'd' ? 'directory' : 'file',\n      size: type === 'd' ? 0 : Number(sizeStr) || 0,\n      updatedAt: new Date((Number(mtimeStr) || 0) * 1000).toISOString(),\n    });\n  }\n  entries.sort((a, b) => a.path.localeCompare(b.path));\n\n  return { workspacePath: session.sessionId, root: safeRoot, rootPath, entries };\n}\n\n/** Read a file under an approved rendered root inside a session's sandbox. */\nexport async function readSessionWorkspaceFile(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  path: string,\n): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  assertApprovedRenderedRoot(safePath.split('/')[0] ?? '');\n\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) throw new Error('Session workspace is not available');\n  const { filesystem } = handle;\n  const info = await filesystem.stat(safePath);\n  if (info.type === 'directory') throw new Error('Path is a directory');\n\n  const buffer = (await filesystem.readFile(safePath)) as Buffer;\n  const truncated = buffer.length > MAX_TEXT_FILE_BYTES;\n  const base = {\n    workspacePath: session.sessionId,\n    path: safePath,\n    name: posixPath.basename(safePath),\n    size: buffer.length,\n    updatedAt: info.modifiedAt.toISOString(),\n  };\n  try {\n    const content = TEXT_DECODER.decode(truncated ? buffer.subarray(0, MAX_TEXT_FILE_BYTES) : buffer);\n    return { ...base, contentType: 'text', content, truncated };\n  } catch {\n    return { ...base, contentType: 'unsupported' };\n  }\n}\n\nfunction changeStatus(code: string): WorkspaceChangeStatus {\n  if (code === '??') return 'untracked';\n  if (code.includes('U') || code === 'AA' || code === 'DD') return 'conflicted';\n  if (code.includes('R')) return 'renamed';\n  if (code.includes('C')) return 'copied';\n  if (code.includes('D')) return 'deleted';\n  if (code.includes('A')) return 'added';\n  return 'modified';\n}\n\nexport function parseWorkspaceChanges(output: string): WorkspaceChange[] {\n  const records = output.split('\\0');\n  const changes: WorkspaceChange[] = [];\n\n  for (let index = 0; index < records.length; index += 1) {\n    const record = records[index];\n    if (!record || record.length < 4) continue;\n    const code = record.slice(0, 2);\n    const path = record.slice(3);\n    const status = changeStatus(code);\n    if (status === 'renamed' || status === 'copied') {\n      const previousPath = records[index + 1];\n      if (previousPath) index += 1;\n      changes.push({ path, previousPath: previousPath || undefined, status });\n      continue;\n    }\n    changes.push({ path, status });\n  }\n\n  return changes.toSorted((a, b) => a.path.localeCompare(b.path));\n}\n\nexport function parseWorkspaceChangeStats(output: string) {\n  const records = output.split('\\0');\n  const stats = new Map<string, { additions?: number; deletions?: number; binary?: boolean }>();\n\n  for (let index = 0; index < records.length; index += 1) {\n    const record = records[index];\n    if (!record) continue;\n    const firstTab = record.indexOf('\\t');\n    const secondTab = record.indexOf('\\t', firstTab + 1);\n    if (firstTab < 0 || secondTab < 0) continue;\n\n    const additionsText = record.slice(0, firstTab);\n    const deletionsText = record.slice(firstTab + 1, secondTab);\n    let path = record.slice(secondTab + 1);\n    if (!path) {\n      const renamedPath = records[index + 2];\n      if (!renamedPath) continue;\n      path = renamedPath;\n      index += 2;\n    }\n    if (path.startsWith('./')) path = path.slice(2);\n\n    if (additionsText === '-' || deletionsText === '-') {\n      stats.set(path, { binary: true });\n      continue;\n    }\n\n    const additions = Number(additionsText);\n    const deletions = Number(deletionsText);\n    if (Number.isFinite(additions) && Number.isFinite(deletions)) stats.set(path, { additions, deletions });\n  }\n\n  return stats;\n}\n\nfunction unavailableWorkspaceChanges(workspacePath: string): WorkspaceChanges {\n  return { workspacePath, available: false, changes: [] };\n}\n\nexport async function listSessionWorkspaceChanges(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n): Promise<WorkspaceChanges> {\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) return unavailableWorkspaceChanges(session.sessionId);\n\n  const [statusResult, statsResult] = await Promise.all([\n    handle.sandbox.executeCommand(\n      'git',\n      ['-C', handle.workdir, 'status', '--porcelain=v1', '-z', '--untracked-files=all'],\n      { timeout: 30_000 },\n    ),\n    handle.sandbox.executeCommand('sh', ['-c', WORKSPACE_NUMSTAT_SCRIPT, 'mastracode-numstat', handle.workdir], {\n      timeout: 30_000,\n    }),\n  ]);\n  if (statusResult.exitCode !== 0) return unavailableWorkspaceChanges(session.sessionId);\n\n  const changes = parseWorkspaceChanges(statusResult.stdout);\n  if (statsResult.exitCode !== 0) {\n    return { workspacePath: session.sessionId, available: true, changes };\n  }\n\n  const stats = parseWorkspaceChangeStats(statsResult.stdout);\n  let additions = 0;\n  let deletions = 0;\n  const changesWithStats = changes.map(change => {\n    const changeStats = stats.get(change.path);\n    additions += changeStats?.additions ?? 0;\n    deletions += changeStats?.deletions ?? 0;\n    return { ...change, ...changeStats };\n  });\n\n  return { workspacePath: session.sessionId, available: true, changes: changesWithStats, additions, deletions };\n}\n\nasync function executeBoundedGitDiff(sandbox: MaterializationSandbox, args: string[], allowExitOne = false) {\n  return sandbox.executeCommand(\n    'sh',\n    ['-c', BOUNDED_GIT_DIFF_SCRIPT, 'mastracode-diff', allowExitOne ? '1' : '0', ...args],\n    { timeout: 30_000 },\n  );\n}\n\nfunction truncatePatch(patchBuffer: Buffer): string {\n  const patch = patchBuffer.subarray(0, MAX_DIFF_BYTES).toString('utf8');\n  const lastNewline = patch.lastIndexOf('\\n');\n  if (lastNewline >= 0) return patch.slice(0, lastNewline + 1);\n  return patch.replace(/\\uFFFD+$/, '');\n}\n\nexport async function readSessionWorkspaceDiff(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  path: string,\n  previousPath?: string,\n): Promise<WorkspaceDiff> {\n  const safePath = assertRelativePath(path, 'path');\n  const safePreviousPath = previousPath ? assertRelativePath(previousPath, 'previousPath') : undefined;\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) throw new Error('Session workspace is not available');\n\n  const pathspecs = safePreviousPath ? [safePreviousPath, safePath] : [safePath];\n  let result = await executeBoundedGitDiff(handle.sandbox, [\n    '--literal-pathspecs',\n    '-C',\n    handle.workdir,\n    'diff',\n    '--find-renames',\n    '--no-ext-diff',\n    '--no-color',\n    '--unified=3',\n    'HEAD',\n    '--',\n    ...pathspecs,\n  ]);\n  if (result.exitCode !== 0) throw new Error(result.stderr || 'Unable to read workspace diff');\n\n  if (!result.stdout) {\n    const untracked = await handle.sandbox.executeCommand(\n      'git',\n      ['--literal-pathspecs', '-C', handle.workdir, 'ls-files', '--others', '--exclude-standard', '--', safePath],\n      { timeout: 30_000 },\n    );\n    if (untracked.exitCode === 0 && untracked.stdout.trim()) {\n      result = await executeBoundedGitDiff(\n        handle.sandbox,\n        [\n          '-C',\n          handle.workdir,\n          'diff',\n          '--no-index',\n          '--no-ext-diff',\n          '--no-color',\n          '--unified=3',\n          '--',\n          '/dev/null',\n          safePath,\n        ],\n        true,\n      );\n      if (result.exitCode !== 0 && result.exitCode !== 1) {\n        throw new Error(result.stderr || 'Unable to read workspace diff');\n      }\n    }\n  }\n\n  const patchBuffer = Buffer.from(result.stdout);\n  const truncated = patchBuffer.length > MAX_DIFF_BYTES;\n  return {\n    workspacePath: session.sessionId,\n    path: safePath,\n    patch: truncated ? truncatePatch(patchBuffer) : result.stdout,\n    truncated,\n  };\n}\n\nexport interface ResolvedCodebase {\n  /**\n   * The resourceId the TUI would use for this path — derived identically so a\n   * project opened in the terminal and in the web app resolve to the SAME\n   * session (and therefore the same threads).\n   */\n  resourceId: string;\n  name: string;\n  rootPath: string;\n  gitUrl?: string;\n  gitBranch?: string;\n}\n\n/**\n * Resolve a project path to the same resourceId the TUI uses. Mirrors\n * `createMastraCode`: detect the project, then apply any resourceId override\n * (MASTRA_RESOURCE_ID env var or `.mastracode/database.json`). This is the\n * shared continuity point — start in the TUI, continue on the web, same path\n * → same resourceId → same session.\n */\nexport function resolveCodebase(projectPath: string): ResolvedCodebase {\n  const info = detectProject(projectPath);\n  const override = getResourceIdOverride(info.rootPath);\n  return {\n    resourceId: override ?? info.resourceId,\n    name: info.name,\n    rootPath: info.rootPath,\n    gitUrl: info.gitUrl,\n    gitBranch: info.gitBranch,\n  };\n}\n\n/**\n * Build the web filesystem routes as Mastra `apiRoutes`:\n *   - `GET /web/fs/list?path=...`        — browse directories (confined to root)\n *   - `GET /web/codebase/resolve?path=...` — TUI-compatible codebase resourceId\n */\nexport function buildFsRoutes(options: { root?: string; sessionFs?: SessionFsDeps } = {}): ApiRoute[] {\n  const root = resolveFsRoot(options.root);\n  const sessionFs = options.sessionFs;\n\n  return [\n    registerApiRoute('/web/fs/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        try {\n          const listing = await listDirectory(root, path);\n          return c.json(listing);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/artifacts/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          return c.json(await listArtifacts(root, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status = message === 'Path is outside the browsable root' ? 403 : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/rendered/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const renderedRoot = c.req.query('root');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!renderedRoot) return c.json({ error: 'Missing required query param: root' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (session && sessionFs) {\n            return c.json(await listSessionRenderedPath(sessionFs.fleet, session, renderedRoot));\n          }\n          return c.json(await listWorkspaceRenderedPath(root, workspacePath, renderedRoot));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved') ||\n            message.includes('not available')\n              ? 403\n              : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/changes', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (!session || !sessionFs) return c.json(unavailableWorkspaceChanges(workspacePath));\n          return c.json(await listSessionWorkspaceChanges(sessionFs.fleet, session));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, message.includes('not available') ? 403 : 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/changes/diff', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const path = c.req.query('path');\n        const previousPath = c.req.query('previousPath');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (!session || !sessionFs) return c.json({ error: 'Session workspace is not available' }, 403);\n          return c.json(await readSessionWorkspaceDiff(sessionFs.fleet, session, path, previousPath));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('relative') || message.includes('escapes') || message.includes('not available')\n              ? 403\n              : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/file', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const path = c.req.query('path');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (session && sessionFs) {\n            return c.json(await readSessionWorkspaceFile(sessionFs.fleet, session, path));\n          }\n          return c.json(await readWorkspaceFile(root, workspacePath, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved') ||\n            message.includes('not available')\n              ? 403\n              : message.includes('directory')\n                ? 400\n                : message.includes('not found')\n                  ? 404\n                  : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/codebase/resolve', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        // Confine resolution to the browsable root (following symlinks), so this\n        // endpoint can't be used to probe arbitrary filesystem paths. The web UI\n        // only ever resolves directories the user picked via the root-confined\n        // browser, so legitimate requests are always within the root.\n        const confined = await realPathWithinRoot(isAbsolute(path) ? resolve(path) : resolve(root, path), root);\n        if (!confined) return c.json({ error: 'Path is outside the browsable root' }, 403);\n        try {\n          return c.json(resolveCodebase(confined));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;;;;AAuHA,MAAM,sBAAsB,MAAM;AAClC,MAAM,iBAAiB,MAAM;AAC7B,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;AAmBjC,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;AAkBhC,MAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAC7D,MAAM,0CAA0B,IAAI,IAAI,CAAC,YAAY,CAAC;;AAGtD,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;AAGA,SAAgB,cAAc,MAAuB;CACnD,OAAO,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC;AACvD;;AAGA,SAAS,aAAa,WAAmB,MAAuB;CAC9D,IAAI,cAAc,MAAM,OAAO;CAC/B,MAAM,cAAc,KAAK,SAAS,GAAG,IAAI,OAAO,OAAO;CACvD,OAAO,UAAU,WAAW,WAAW;AACzC;AAEA,eAAe,eAAe,MAA+B;CAC3D,IAAI;EACF,OAAO,MAAM,SAAS,IAAI;CAC5B,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;AAQA,eAAe,mBAAmB,WAAmB,MAAsC;CACzF,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,SAAS;EACrC,OAAO,aAAa,MAAM,IAAI,IAAI,OAAO;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,MAAc,OAAuB;CAC/D,MAAM,UAAU,KAAK,KAAK;CAC1B,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,iCAAiC,OAAO;CACtE,IAAI,WAAW,OAAO,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,kBAAkB;CACpE,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CACxF,MAAM,aAAa,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;CAChD,IAAI,CAAC,cAAc,eAAe,QAAQ,WAAW,WAAW,KAAK,KAAK,GACxE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAC9C,OAAO;AACT;AAEA,SAAS,2BAA2B,cAA8B;CAChE,MAAM,WAAW,mBAAmB,cAAc,MAAM;CACxD,IAAI,CAAC,wBAAwB,IAAI,QAAQ,GAAG,MAAM,IAAI,MAAM,oDAAoD;CAChH,OAAO;AACT;AAEA,eAAe,sBACb,MACA,eACsD;CACtD,MAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;CAE7D,MAAM,YAAY,MAAM,mBADN,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa,GACpD,YAAY;CAClE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,oCAAoC;CACpE,OAAO;EAAE;EAAc;CAAU;AACnC;AAEA,eAAe,8BACb,MACA,eACA,cACoE;CACpE,MAAM,mBAAmB,mBAAmB,cAAc,MAAM;CAChE,MAAM,EAAE,cAAc,MAAM,sBAAsB,MAAM,aAAa;CACrE,MAAM,YAAY,QAAQ,WAAW,gBAAgB;CACrD,IAAI,CAAC,aAAa,WAAW,SAAS,GAAG,MAAM,IAAI,MAAM,wBAAwB;CACjF,MAAM,eAAe,MAAM,mBAAmB,WAAW,SAAS;CAClE,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,+BAA+B;CAClE,OAAO;EAAE;EAAW,MAAM;EAAc,cAAc;CAAiB;AACzE;;;;;;AAOA,eAAsB,cAAc,MAAc,eAAmD;CAGnG,MAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;CAE7D,IAAI,SAAS;CACb,IAAI,iBAAiB,cAAc,KAAK,GAGtC,SAAU,MAAM,mBAFE,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa,GAE5D,YAAY,KAAM;CAIlE,IAAI;EAEF,IAAI,EAAC,MADc,KAAK,MAAM,EAAA,CACpB,YAAY,GAAG,SAAS;CACpC,QAAQ;EACN,SAAS;CACX;CAEA,MAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC;CAC7D,MAAM,UAA4B,CAAC;CACnC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,KAAK,WAAW,GAAG,GAAG;EACjC,MAAM,YAAY,KAAK,QAAQ,OAAO,IAAI;EAC1C,IAAI,QAAQ,OAAO,YAAY;EAC/B,IAAI,OAAO,eAAe,GAAG;GAG3B,MAAM,OAAO,MAAM,mBAAmB,WAAW,YAAY;GAC7D,QAAQ,QAAQ,MAAM,KAAK,IAAI,CAAC,CAAC,YAAY,IAAI,EAAA,EAAI,YAAY,MAAM,OAAO;EAChF;EACA,IAAI,OAAO,QAAQ,KAAK;GAAE,MAAM,OAAO;GAAM,MAAM;EAAU,CAAC;CAChE;CACA,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;CAEnD,MAAM,SAAS,WAAW,eAAe,OAAO,QAAQ,QAAQ,IAAI;CAEpE,OAAO;EAAE,MAAM;EAAc,MAAM;EAAQ;EAAQ;CAAQ;AAC7D;AAEA,eAAe,oBAAoB,UAAkB,cAAc,UAA6C;CAC9G,MAAM,UAAU,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC;CAClE,MAAM,UAAoC,CAAC;CAE3C,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,YAAY,KAAK,aAAa,OAAO,IAAI;EAC/C,MAAM,OAAO,MAAM,MAAM,SAAS;EAClC,MAAM,eAAe,UAAU,MAAM,SAAS,SAAS,CAAC;EAExD,IAAI,KAAK,YAAY,GAAG;GACtB,QAAQ,KAAK;IACX,MAAM,OAAO;IACb,MAAM;IACN,MAAM;IACN,MAAM,KAAK;IACX,WAAW,KAAK,MAAM,YAAY;GACpC,CAAC;GACD,QAAQ,KAAK,GAAI,MAAM,oBAAoB,UAAU,SAAS,CAAE;GAChE;EACF;EAEA,IAAI,KAAK,OAAO,GACd,QAAQ,KAAK;GACX,MAAM,OAAO;GACb,MAAM;GACN,MAAM;GACN,MAAM,KAAK;GACX,WAAW,KAAK,MAAM,YAAY;EACpC,CAAC;CAEL;CAEA,OAAO,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC5D;AAEA,eAAsB,0BACpB,MACA,eACA,cACmC;CACnC,MAAM,WAAW,2BAA2B,YAAY;CACxD,MAAM,EAAE,cAAc,MAAM,sBAAsB,MAAM,aAAa;CACrE,MAAM,eAAe,QAAQ,WAAW,QAAQ;CAChD,IAAI,CAAC,aAAa,cAAc,SAAS,GAAG,MAAM,IAAI,MAAM,wBAAwB;CAEpF,MAAM,mBAAmB,MAAM,mBAAmB,cAAc,SAAS;CACzE,IAAI,CAAC,kBAAkB,OAAO;EAAE,eAAe;EAAW,MAAM;EAAU,UAAU;EAAc,SAAS,CAAC;CAAE;CAG9G,IAAI,EAAC,MADc,KAAK,gBAAgB,EAAA,CAC9B,YAAY,GAAG,OAAO;EAAE,eAAe;EAAW,MAAM;EAAU,UAAU;EAAkB,SAAS,CAAC;CAAE;CAEpH,OAAO;EACL,eAAe;EACf,MAAM;EACN,UAAU;EACV,SAAS,MAAM,oBAAoB,gBAAgB;CACrD;AACF;AAEA,eAAsB,kBAAkB,MAAc,eAAuB,MAAsC;CAGjH,2BAFiB,mBAAmB,MAAM,MACd,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EACR;CACvC,MAAM,EACJ,WACA,MAAM,cACN,iBACE,MAAM,8BAA8B,MAAM,eAAe,IAAI;CACjE,MAAM,OAAO,MAAM,MAAM,YAAY;CACrC,IAAI,KAAK,YAAY,GAAG,MAAM,IAAI,MAAM,qBAAqB;CAC7D,IAAI,CAAC,KAAK,OAAO,GAAG,MAAM,IAAI,MAAM,uBAAuB;CAE3D,MAAM,cAAc,KAAK,IAAI,KAAK,MAAM,mBAAmB;CAC3D,MAAM,gBAAgB,OAAO,MAAM,WAAW;CAC9C,MAAM,SAAS,MAAM,KAAK,cAAc,GAAG;CAC3C,IAAI;EACF,MAAM,OAAO,KAAK,eAAe,GAAG,aAAa,CAAC;CACpD,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CAEA,IAAI;EACF,MAAM,UAAU,aAAa,OAAO,aAAa;EACjD,OAAO;GACL,eAAe;GACf,MAAM;GACN,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GACvC,MAAM,KAAK;GACX,WAAW,KAAK,MAAM,YAAY;GAClC,aAAa;GACb;GACA,WAAW,KAAK,OAAO;EACzB;CACF,QAAQ;EACN,OAAO;GACL,eAAe;GACf,MAAM;GACN,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GACvC,MAAM,KAAK;GACX,WAAW,KAAK,MAAM,YAAY;GAClC,aAAa;EACf;CACF;AACF;AAEA,eAAsB,cAAc,MAAc,eAAiD;CACjG,MAAM,UAAU,MAAM,0BAA0B,MAAM,eAAe,YAAY;CACjF,OAAO;EACL,UAAU,QAAQ;EAClB,eAAe,QAAQ;EACvB,SAAS,QAAQ;CACnB;AACF;;;;;;;AAuBA,eAAe,yBACb,GACA,MACA,eACsC;CACtC,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,MAAM,KAAK,SAAS,eAAe,aAAa;CAChE,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,KAAK,KAAK,QAAQ,GAAG;EACvB,MAAM,KAAK,KAAK,WAAW,CAAC;EAC5B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;EACjC,IAAI,CAAC,UAAU,OAAO,UAAU,QAAQ,SAAS,OAAO,WAAW,QAAQ,QACzE,MAAM,IAAI,MAAM,8CAA8C;CAElE;CACA,OAAO;AACT;;;;;;;;;;AAiBA,eAAe,eACb,OACA,SACsC;CACtC,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,aAAa,CAAC,QAAQ,gBAAgB,OAAO;CAC5E,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,MAAM,gBAAgB,QAAQ,WAAW,EAAE,kBAAkB,QAAQ,eAAe,CAAC;CACvG,QAAQ;EAGN,OAAO;CACT;CACA,OAAO;EACL;EACA,YAAY,IAAI,kBAAkB;GAAE;GAAS,SAAS,QAAQ;EAAe,CAAC;EAC9E,SAAS,QAAQ;CACnB;AACF;;AAGA,eAAsB,wBACpB,OACA,SACA,cACmC;CACnC,MAAM,WAAW,2BAA2B,YAAY;CACxD,MAAM,WAAWA,MAAU,KAAK,QAAQ,kBAAkB,IAAI,QAAQ;CACtE,MAAM,QAAkC;EAAE,eAAe,QAAQ;EAAW,MAAM;EAAU;EAAU,SAAS,CAAC;CAAE;CAElH,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,OAAO;CAIpB,MAAM,aAAa,IAAI,SAAS,QAAQ,MAAM,OAAO,EAAE;CACvD,MAAM,SAAS,MAAM,OAAO,QAAQ,eAClC,MACA,CACE,MACA,WAAW,WAAW,WAAW,WAAW,iEAC9C,GACA,EAAE,SAAS,IAAO,CACpB;CACA,IAAI,OAAO,aAAa,GAAG,OAAO;CAElC,MAAM,UAAoC,CAAC;CAC3C,KAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,IAAI,GAAG;EAC5C,IAAI,CAAC,MAAM;EACX,MAAM,CAAC,MAAM,SAAS,UAAU,GAAG,aAAa,KAAK,MAAM,GAAI;EAC/D,MAAM,WAAW,UAAU,KAAK,GAAI;EACpC,IAAI,CAAC,YAAY,CAAC,SAAS,WAAW,GAAG,SAAS,EAAE,GAAG;EACvD,MAAM,eAAe,SAAS,MAAM,SAAS,SAAS,CAAC;EACvD,QAAQ,KAAK;GACX,MAAMA,MAAU,SAAS,YAAY;GACrC,MAAM;GACN,MAAM,SAAS,MAAM,cAAc;GACnC,MAAM,SAAS,MAAM,IAAI,OAAO,OAAO,KAAK;GAC5C,4BAAW,IAAI,MAAM,OAAO,QAAQ,KAAK,KAAK,GAAI,EAAA,CAAE,YAAY;EAClE,CAAC;CACH;CACA,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;CAEnD,OAAO;EAAE,eAAe,QAAQ;EAAW,MAAM;EAAU;EAAU;CAAQ;AAC/E;;AAGA,eAAsB,yBACpB,OACA,SACA,MACwB;CACxB,MAAM,WAAW,mBAAmB,MAAM,MAAM;CAChD,2BAA2B,SAAS,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE;CAEvD,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,oCAAoC;CACjE,MAAM,EAAE,eAAe;CACvB,MAAM,OAAO,MAAM,WAAW,KAAK,QAAQ;CAC3C,IAAI,KAAK,SAAS,aAAa,MAAM,IAAI,MAAM,qBAAqB;CAEpE,MAAM,SAAU,MAAM,WAAW,SAAS,QAAQ;CAClD,MAAM,YAAY,OAAO,SAAS;CAClC,MAAM,OAAO;EACX,eAAe,QAAQ;EACvB,MAAM;EACN,MAAMA,MAAU,SAAS,QAAQ;EACjC,MAAM,OAAO;EACb,WAAW,KAAK,WAAW,YAAY;CACzC;CACA,IAAI;EACF,MAAM,UAAU,aAAa,OAAO,YAAY,OAAO,SAAS,GAAG,mBAAmB,IAAI,MAAM;EAChG,OAAO;GAAE,GAAG;GAAM,aAAa;GAAQ;GAAS;EAAU;CAC5D,QAAQ;EACN,OAAO;GAAE,GAAG;GAAM,aAAa;EAAc;CAC/C;AACF;AAEA,SAAS,aAAa,MAAqC;CACzD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,KAAK,SAAS,GAAG,KAAK,SAAS,QAAQ,SAAS,MAAM,OAAO;CACjE,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,OAAO;AACT;AAEA,SAAgB,sBAAsB,QAAmC;CACvE,MAAM,UAAU,OAAO,MAAM,IAAI;CACjC,MAAM,UAA6B,CAAC;CAEpC,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;EAClC,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC;EAC9B,MAAM,OAAO,OAAO,MAAM,CAAC;EAC3B,MAAM,SAAS,aAAa,IAAI;EAChC,IAAI,WAAW,aAAa,WAAW,UAAU;GAC/C,MAAM,eAAe,QAAQ,QAAQ;GACrC,IAAI,cAAc,SAAS;GAC3B,QAAQ,KAAK;IAAE;IAAM,cAAc,gBAAgB,KAAA;IAAW;GAAO,CAAC;GACtE;EACF;EACA,QAAQ,KAAK;GAAE;GAAM;EAAO,CAAC;CAC/B;CAEA,OAAO,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAChE;AAEA,SAAgB,0BAA0B,QAAgB;CACxD,MAAM,UAAU,OAAO,MAAM,IAAI;CACjC,MAAM,wBAAQ,IAAI,IAA0E;CAE5F,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IAAI,CAAC,QAAQ;EACb,MAAM,WAAW,OAAO,QAAQ,GAAI;EACpC,MAAM,YAAY,OAAO,QAAQ,KAAM,WAAW,CAAC;EACnD,IAAI,WAAW,KAAK,YAAY,GAAG;EAEnC,MAAM,gBAAgB,OAAO,MAAM,GAAG,QAAQ;EAC9C,MAAM,gBAAgB,OAAO,MAAM,WAAW,GAAG,SAAS;EAC1D,IAAI,OAAO,OAAO,MAAM,YAAY,CAAC;EACrC,IAAI,CAAC,MAAM;GACT,MAAM,cAAc,QAAQ,QAAQ;GACpC,IAAI,CAAC,aAAa;GAClB,OAAO;GACP,SAAS;EACX;EACA,IAAI,KAAK,WAAW,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC;EAE9C,IAAI,kBAAkB,OAAO,kBAAkB,KAAK;GAClD,MAAM,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAChC;EACF;EAEA,MAAM,YAAY,OAAO,aAAa;EACtC,MAAM,YAAY,OAAO,aAAa;EACtC,IAAI,OAAO,SAAS,SAAS,KAAK,OAAO,SAAS,SAAS,GAAG,MAAM,IAAI,MAAM;GAAE;GAAW;EAAU,CAAC;CACxG;CAEA,OAAO;AACT;AAEA,SAAS,4BAA4B,eAAyC;CAC5E,OAAO;EAAE;EAAe,WAAW;EAAO,SAAS,CAAC;CAAE;AACxD;AAEA,eAAsB,4BACpB,OACA,SAC2B;CAC3B,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,OAAO,4BAA4B,QAAQ,SAAS;CAEjE,MAAM,CAAC,cAAc,eAAe,MAAM,QAAQ,IAAI,CACpD,OAAO,QAAQ,eACb,OACA;EAAC;EAAM,OAAO;EAAS;EAAU;EAAkB;EAAM;CAAuB,GAChF,EAAE,SAAS,IAAO,CACpB,GACA,OAAO,QAAQ,eAAe,MAAM;EAAC;EAAM;EAA0B;EAAsB,OAAO;CAAO,GAAG,EAC1G,SAAS,IACX,CAAC,CACH,CAAC;CACD,IAAI,aAAa,aAAa,GAAG,OAAO,4BAA4B,QAAQ,SAAS;CAErF,MAAM,UAAU,sBAAsB,aAAa,MAAM;CACzD,IAAI,YAAY,aAAa,GAC3B,OAAO;EAAE,eAAe,QAAQ;EAAW,WAAW;EAAM;CAAQ;CAGtE,MAAM,QAAQ,0BAA0B,YAAY,MAAM;CAC1D,IAAI,YAAY;CAChB,IAAI,YAAY;CAChB,MAAM,mBAAmB,QAAQ,KAAI,WAAU;EAC7C,MAAM,cAAc,MAAM,IAAI,OAAO,IAAI;EACzC,aAAa,aAAa,aAAa;EACvC,aAAa,aAAa,aAAa;EACvC,OAAO;GAAE,GAAG;GAAQ,GAAG;EAAY;CACrC,CAAC;CAED,OAAO;EAAE,eAAe,QAAQ;EAAW,WAAW;EAAM,SAAS;EAAkB;EAAW;CAAU;AAC9G;AAEA,eAAe,sBAAsB,SAAiC,MAAgB,eAAe,OAAO;CAC1G,OAAO,QAAQ,eACb,MACA;EAAC;EAAM;EAAyB;EAAmB,eAAe,MAAM;EAAK,GAAG;CAAI,GACpF,EAAE,SAAS,IAAO,CACpB;AACF;AAEA,SAAS,cAAc,aAA6B;CAClD,MAAM,QAAQ,YAAY,SAAS,GAAG,cAAc,CAAC,CAAC,SAAS,MAAM;CACrE,MAAM,cAAc,MAAM,YAAY,IAAI;CAC1C,IAAI,eAAe,GAAG,OAAO,MAAM,MAAM,GAAG,cAAc,CAAC;CAC3D,OAAO,MAAM,QAAQ,YAAY,EAAE;AACrC;AAEA,eAAsB,yBACpB,OACA,SACA,MACA,cACwB;CACxB,MAAM,WAAW,mBAAmB,MAAM,MAAM;CAChD,MAAM,mBAAmB,eAAe,mBAAmB,cAAc,cAAc,IAAI,KAAA;CAC3F,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,oCAAoC;CAEjE,MAAM,YAAY,mBAAmB,CAAC,kBAAkB,QAAQ,IAAI,CAAC,QAAQ;CAC7E,IAAI,SAAS,MAAM,sBAAsB,OAAO,SAAS;EACvD;EACA;EACA,OAAO;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL,CAAC;CACD,IAAI,OAAO,aAAa,GAAG,MAAM,IAAI,MAAM,OAAO,UAAU,+BAA+B;CAE3F,IAAI,CAAC,OAAO,QAAQ;EAClB,MAAM,YAAY,MAAM,OAAO,QAAQ,eACrC,OACA;GAAC;GAAuB;GAAM,OAAO;GAAS;GAAY;GAAY;GAAsB;GAAM;EAAQ,GAC1G,EAAE,SAAS,IAAO,CACpB;EACA,IAAI,UAAU,aAAa,KAAK,UAAU,OAAO,KAAK,GAAG;GACvD,SAAS,MAAM,sBACb,OAAO,SACP;IACE;IACA,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,GACA,IACF;GACA,IAAI,OAAO,aAAa,KAAK,OAAO,aAAa,GAC/C,MAAM,IAAI,MAAM,OAAO,UAAU,+BAA+B;EAEpE;CACF;CAEA,MAAM,cAAc,OAAO,KAAK,OAAO,MAAM;CAC7C,MAAM,YAAY,YAAY,SAAS;CACvC,OAAO;EACL,eAAe,QAAQ;EACvB,MAAM;EACN,OAAO,YAAY,cAAc,WAAW,IAAI,OAAO;EACvD;CACF;AACF;;;;;;;;AAsBA,SAAgB,gBAAgB,aAAuC;CACrE,MAAM,OAAO,cAAc,WAAW;CAEtC,OAAO;EACL,YAFe,sBAAsB,KAAK,QAEvB,KAAK,KAAK;EAC7B,MAAM,KAAK;EACX,UAAU,KAAK;EACf,QAAQ,KAAK;EACb,WAAW,KAAK;CAClB;AACF;;;;;;AAOA,SAAgB,cAAc,UAAwD,CAAC,GAAe;CACpG,MAAM,OAAO,cAAc,QAAQ,IAAI;CACvC,MAAM,YAAY,QAAQ;CAE1B,OAAO;EACL,iBAAiB,gBAAgB;GAC/B,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI;KACF,MAAM,UAAU,MAAM,cAAc,MAAM,IAAI;KAC9C,OAAO,EAAE,KAAK,OAAO;IACvB,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;IACvC;GACF;EACF,CAAC;EACD,iBAAiB,uBAAuB;GACtC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAC7E,IAAI;KACF,OAAO,EAAE,KAAK,MAAM,cAAc,MAAM,IAAI,CAAC;IAC/C,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SAAS,YAAY,uCAAuC,MAAM;KACxE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,gCAAgC;GAC/C,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,eAAe,EAAE,IAAI,MAAM,MAAM;IACvC,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IACrF,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,WAAW,WACb,OAAO,EAAE,KAAK,MAAM,wBAAwB,UAAU,OAAO,SAAS,YAAY,CAAC;KAErF,OAAO,EAAE,KAAK,MAAM,0BAA0B,MAAM,eAAe,YAAY,CAAC;IAClF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,eAAe,IAC5B,MACA;KACN,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,0BAA0B;GACzC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,EAAE,KAAK,4BAA4B,aAAa,CAAC;KACpF,OAAO,EAAE,KAAK,MAAM,4BAA4B,UAAU,OAAO,OAAO,CAAC;IAC3E,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,QAAQ,SAAS,eAAe,IAAI,MAAM,GAAG;IACjF;GACF;EACF,CAAC;EACD,iBAAiB,+BAA+B;GAC9C,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,MAAM,eAAe,EAAE,IAAI,MAAM,cAAc;IAC/C,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAC7E,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;KAC9F,OAAO,EAAE,KAAK,MAAM,yBAAyB,UAAU,OAAO,SAAS,MAAM,YAAY,CAAC;IAC5F,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SACJ,QAAQ,SAAS,UAAU,KAAK,QAAQ,SAAS,SAAS,KAAK,QAAQ,SAAS,eAAe,IAC3F,MACA;KACN,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,uBAAuB;GACtC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAC7E,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,WAAW,WACb,OAAO,EAAE,KAAK,MAAM,yBAAyB,UAAU,OAAO,SAAS,IAAI,CAAC;KAE9E,OAAO,EAAE,KAAK,MAAM,kBAAkB,MAAM,eAAe,IAAI,CAAC;IAClE,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,eAAe,IAC5B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA;KACV,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,yBAAyB;GACxC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAK7E,MAAM,WAAW,MAAM,mBAAmB,WAAW,IAAI,IAAI,QAAQ,IAAI,IAAI,QAAQ,MAAM,IAAI,GAAG,IAAI;IACtG,IAAI,CAAC,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IACjF,IAAI;KACF,OAAO,EAAE,KAAK,gBAAgB,QAAQ,CAAC;IACzC,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;IACvC;GACF;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"fs.js","names":["posixPath"],"sources":["../../src/routes/fs.ts"],"sourcesContent":["import { lstat, open, readdir, realpath, stat } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { isAbsolute, join, posix as posixPath, resolve, sep } from 'node:path';\n\nimport { SandboxFilesystem } from '@mastra/code-sdk/agents/sandbox-filesystem';\nimport { detectProject, getResourceIdOverride } from '@mastra/code-sdk/utils/project';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { MaterializationSandbox, SandboxFleet } from '../sandbox/fleet.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { SourceControlSession } from '../storage/domains/source-control/base.js';\nimport type { RouteAuth } from './route.js';\n\n/**\n * Server-side directory browser for the web project picker.\n *\n * The browser cannot read absolute filesystem paths (the File System Access API\n * only exposes a directory *name*), so the picker must ask the server — which\n * does have filesystem access — to enumerate directories. The result is real\n * absolute paths the user can select without typing.\n *\n * All access is confined to a configured `root` (default: the user's home\n * directory). Requests that try to escape the root via `..` or symlinks are\n * clamped back to the root.\n */\n\nexport interface DirectoryEntry {\n  name: string;\n  /** Absolute path to the entry. */\n  path: string;\n}\n\nexport interface DirectoryListing {\n  /** The allowed root; clients cannot browse above this. */\n  root: string;\n  /** The absolute path that was listed. */\n  path: string;\n  /** Parent directory path, or null when `path` is the root. */\n  parent: string | null;\n  /** Subdirectories of `path` (directories only, sorted, hidden excluded). */\n  entries: DirectoryEntry[];\n}\n\nexport interface WorkspaceRenderedEntry {\n  name: string;\n  /** Path relative to the configured rendered root. */\n  path: string;\n  type: 'file' | 'directory';\n  size: number;\n  updatedAt: string;\n}\n\nexport interface WorkspaceRenderedListing {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Configured workspace-relative rendered root, e.g. `.artifacts`. */\n  root: string;\n  /** The confined absolute path for the rendered root. */\n  rootPath: string;\n  entries: WorkspaceRenderedEntry[];\n}\n\nexport interface WorkspaceFile {\n  /** The confined workspace/project root. */\n  workspacePath: string;\n  /** Workspace-relative file path. */\n  path: string;\n  name: string;\n  size: number;\n  updatedAt: string;\n  contentType: 'text' | 'unsupported';\n  content?: string;\n  truncated?: boolean;\n}\n\nexport interface WorkspaceFilesListing {\n  /** The Factory session resource id. */\n  workspacePath: string;\n  /** The agent thread whose terminal file list was captured. */\n  threadId: string;\n  files: Array<{ path: string }>;\n}\n\nexport type WorkspaceChangeStatus =\n  | 'modified'\n  | 'added'\n  | 'deleted'\n  | 'renamed'\n  | 'copied'\n  | 'untracked'\n  | 'conflicted';\n\nexport interface WorkspaceChange {\n  path: string;\n  previousPath?: string;\n  status: WorkspaceChangeStatus;\n  additions?: number;\n  deletions?: number;\n  binary?: boolean;\n}\n\nexport interface WorkspaceChanges {\n  workspacePath: string;\n  available: boolean;\n  changes: WorkspaceChange[];\n  additions?: number;\n  deletions?: number;\n}\n\nexport interface WorkspaceDiff {\n  workspacePath: string;\n  path: string;\n  patch: string;\n  truncated: boolean;\n}\n\nexport type ArtifactEntry = WorkspaceRenderedEntry;\n\nexport interface ArtifactListing {\n  /** The confined workspace/project root. */\n  rootPath: string;\n  /** The workspace artifact directory. */\n  artifactsPath: string;\n  entries: ArtifactEntry[];\n}\n\nconst MAX_TEXT_FILE_BYTES = 512 * 1024;\nconst MAX_DIFF_BYTES = 512 * 1024;\nconst WORKSPACE_NUMSTAT_SCRIPT = `\nset -e\nworkdir=$1\nindex_file=$(mktemp)\nuntracked_file=$(mktemp)\nobject_dir=$(mktemp -d)\ntrap 'rm -f \"$index_file\" \"$untracked_file\"; rm -rf \"$object_dir\"' EXIT\nrm -f \"$index_file\"\ngit -C \"$workdir\" diff --numstat -z --find-renames --no-ext-diff --no-textconv HEAD\ngit -C \"$workdir\" ls-files --others --exclude-standard -z >\"$untracked_file\"\ngit_dir=$(git -C \"$workdir\" rev-parse --absolute-git-dir)\nexport GIT_INDEX_FILE=\"$index_file\"\nexport GIT_OBJECT_DIRECTORY=\"$object_dir\"\nexport GIT_ALTERNATE_OBJECT_DIRECTORIES=\"$git_dir/objects\"\ngit -C \"$workdir\" read-tree --empty\ngit -C \"$workdir\" update-index --add -z --stdin <\"$untracked_file\"\nempty_tree=$(git -C \"$workdir\" hash-object -t tree /dev/null)\ngit -C \"$workdir\" diff --cached --numstat -z --no-ext-diff --no-textconv \"$empty_tree\"\n`;\nconst BOUNDED_GIT_DIFF_SCRIPT = `\nallow_exit_one=$1\nshift\nstatus_file=$(mktemp)\nstderr_file=$(mktemp)\ntrap 'rm -f \"$status_file\" \"$stderr_file\"' EXIT\n(\n  git \"$@\" 2>\"$stderr_file\"\n  printf '%s' \"$?\" >\"$status_file\"\n) | head -c ${MAX_DIFF_BYTES + 1}\nstatus=$(cat \"$status_file\")\ncase \"$status\" in\n  0|141) exit 0 ;;\n  1) [ \"$allow_exit_one\" = \"1\" ] && exit 0 ;;\nesac\ncat \"$stderr_file\" >&2\nexit \"\\${status:-1}\"\n`;\nconst TEXT_DECODER = new TextDecoder('utf-8', { fatal: true });\nconst APPROVED_RENDERED_ROOTS = new Set(['.artifacts']);\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/** Resolve the browsable root, defaulting to the user's home directory. */\nexport function resolveFsRoot(root?: string): string {\n  return resolve(root && root.trim() ? root : homedir());\n}\n\n/** True when `candidate` is `root` or nested under it. */\nfunction isWithinRoot(candidate: string, root: string): boolean {\n  if (candidate === root) return true;\n  const rootWithSep = root.endsWith(sep) ? root : root + sep;\n  return candidate.startsWith(rootWithSep);\n}\n\nasync function realOrResolved(path: string): Promise<string> {\n  try {\n    return await realpath(path);\n  } catch {\n    return path;\n  }\n}\n\n/**\n * Resolve a path's real location (following symlinks) and confirm it stays\n * within `root`. Returns the real path when confined, or `null` when it escapes\n * the root or does not exist. Used so a symlink inside the root that points\n * outside it cannot be browsed or selected.\n */\nasync function realPathWithinRoot(candidate: string, root: string): Promise<string | null> {\n  try {\n    const real = await realpath(candidate);\n    return isWithinRoot(real, root) ? real : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction assertRelativePath(path: string, label: string): string {\n  const trimmed = path.trim();\n  if (!trimmed) throw new Error(`Missing required query param: ${label}`);\n  if (isAbsolute(trimmed)) throw new Error(`${label} must be relative`);\n  if (trimmed.split(/[\\\\/]+/).includes('..')) throw new Error(`${label} escapes workspace`);\n  const normalized = resolve('/', trimmed).slice(1);\n  if (!normalized || normalized === '..' || normalized.startsWith(`..${sep}`))\n    throw new Error(`${label} escapes workspace`);\n  return normalized;\n}\n\nfunction assertApprovedRenderedRoot(renderedRoot: string): string {\n  const safeRoot = assertRelativePath(renderedRoot, 'root');\n  if (!APPROVED_RENDERED_ROOTS.has(safeRoot)) throw new Error('Root is not approved for rendered workspace access');\n  return safeRoot;\n}\n\nasync function confinedWorkspacePath(\n  root: string,\n  workspacePath: string,\n): Promise<{ resolvedRoot: string; workspace: string }> {\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n  const candidate = isAbsolute(workspacePath) ? resolve(workspacePath) : resolve(resolvedRoot, workspacePath);\n  const workspace = await realPathWithinRoot(candidate, resolvedRoot);\n  if (!workspace) throw new Error('Path is outside the browsable root');\n  return { resolvedRoot, workspace };\n}\n\nasync function confinedWorkspaceRelativePath(\n  root: string,\n  workspacePath: string,\n  relativePath: string,\n): Promise<{ workspace: string; path: string; relativePath: string }> {\n  const safeRelativePath = assertRelativePath(relativePath, 'path');\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const candidate = resolve(workspace, safeRelativePath);\n  if (!isWithinRoot(candidate, workspace)) throw new Error('Path escapes workspace');\n  const confinedPath = await realPathWithinRoot(candidate, workspace);\n  if (!confinedPath) throw new Error('Path is outside the workspace');\n  return { workspace, path: confinedPath, relativePath: safeRelativePath };\n}\n\n/**\n * List the directories inside `requestedPath`, confined to `root`. An absent or\n * out-of-root path is clamped to the root, so the worst a malicious client can\n * do is browse within the allowed root.\n */\nexport async function listDirectory(root: string, requestedPath?: string): Promise<DirectoryListing> {\n  // Resolve the root through symlinks so all confinement checks compare real\n  // paths; a symlink that escapes the root is then reliably detectable.\n  const resolvedRoot = await realOrResolved(resolveFsRoot(root));\n\n  let target = resolvedRoot;\n  if (requestedPath && requestedPath.trim()) {\n    const candidate = isAbsolute(requestedPath) ? resolve(requestedPath) : resolve(resolvedRoot, requestedPath);\n    // Follow symlinks and re-confirm the real target stays within the root.\n    target = (await realPathWithinRoot(candidate, resolvedRoot)) ?? resolvedRoot;\n  }\n\n  // Confirm the target is a real directory; fall back to root otherwise.\n  try {\n    const info = await stat(target);\n    if (!info.isDirectory()) target = resolvedRoot;\n  } catch {\n    target = resolvedRoot;\n  }\n\n  const dirents = await readdir(target, { withFileTypes: true });\n  const entries: DirectoryEntry[] = [];\n  for (const dirent of dirents) {\n    if (dirent.name.startsWith('.')) continue; // skip dotfiles/dirs\n    const entryPath = join(target, dirent.name);\n    let isDir = dirent.isDirectory();\n    if (dirent.isSymbolicLink()) {\n      // Only surface symlinks whose real target is a directory inside the root,\n      // so a link pointing outside the root can't be browsed or selected.\n      const real = await realPathWithinRoot(entryPath, resolvedRoot);\n      isDir = real ? (await stat(real).catch(() => null))?.isDirectory() === true : false;\n    }\n    if (isDir) entries.push({ name: dirent.name, path: entryPath });\n  }\n  entries.sort((a, b) => a.name.localeCompare(b.name));\n\n  const parent = target === resolvedRoot ? null : resolve(target, '..');\n\n  return { root: resolvedRoot, path: target, parent, entries };\n}\n\nasync function listRenderedEntries(rootPath: string, currentPath = rootPath): Promise<WorkspaceRenderedEntry[]> {\n  const dirents = await readdir(currentPath, { withFileTypes: true });\n  const entries: WorkspaceRenderedEntry[] = [];\n\n  for (const dirent of dirents) {\n    const entryPath = join(currentPath, dirent.name);\n    const info = await lstat(entryPath);\n    const relativePath = entryPath.slice(rootPath.length + 1);\n\n    if (info.isDirectory()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'directory',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n      entries.push(...(await listRenderedEntries(rootPath, entryPath)));\n      continue;\n    }\n\n    if (info.isFile()) {\n      entries.push({\n        name: dirent.name,\n        path: relativePath,\n        type: 'file',\n        size: info.size,\n        updatedAt: info.mtime.toISOString(),\n      });\n    }\n  }\n\n  return entries.sort((a, b) => a.path.localeCompare(b.path));\n}\n\nexport async function listWorkspaceRenderedPath(\n  root: string,\n  workspacePath: string,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const { workspace } = await confinedWorkspacePath(root, workspacePath);\n  const renderedPath = resolve(workspace, safeRoot);\n  if (!isWithinRoot(renderedPath, workspace)) throw new Error('Root escapes workspace');\n\n  const confinedRootPath = await realPathWithinRoot(renderedPath, workspace);\n  if (!confinedRootPath) return { workspacePath: workspace, root: safeRoot, rootPath: renderedPath, entries: [] };\n\n  const info = await stat(confinedRootPath);\n  if (!info.isDirectory()) return { workspacePath: workspace, root: safeRoot, rootPath: confinedRootPath, entries: [] };\n\n  return {\n    workspacePath: workspace,\n    root: safeRoot,\n    rootPath: confinedRootPath,\n    entries: await listRenderedEntries(confinedRootPath),\n  };\n}\n\nexport async function readWorkspaceFile(root: string, workspacePath: string, path: string): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  const relativeRoot = safePath.split('/')[0] ?? '';\n  assertApprovedRenderedRoot(relativeRoot);\n  const {\n    workspace,\n    path: confinedPath,\n    relativePath,\n  } = await confinedWorkspaceRelativePath(root, workspacePath, path);\n  const info = await lstat(confinedPath);\n  if (info.isDirectory()) throw new Error('Path is a directory');\n  if (!info.isFile()) throw new Error('Unsupported file type');\n\n  const bytesToRead = Math.min(info.size, MAX_TEXT_FILE_BYTES);\n  const contentBuffer = Buffer.alloc(bytesToRead);\n  const handle = await open(confinedPath, 'r');\n  try {\n    await handle.read(contentBuffer, 0, bytesToRead, 0);\n  } finally {\n    await handle.close();\n  }\n\n  try {\n    const content = TEXT_DECODER.decode(contentBuffer);\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'text',\n      content,\n      truncated: info.size > MAX_TEXT_FILE_BYTES,\n    };\n  } catch {\n    return {\n      workspacePath: workspace,\n      path: relativePath,\n      name: relativePath.split('/').pop() ?? relativePath,\n      size: info.size,\n      updatedAt: info.mtime.toISOString(),\n      contentType: 'unsupported',\n    };\n  }\n}\n\nexport async function listArtifacts(root: string, workspacePath: string): Promise<ArtifactListing> {\n  const listing = await listWorkspaceRenderedPath(root, workspacePath, '.artifacts');\n  return {\n    rootPath: listing.workspacePath,\n    artifactsPath: listing.rootPath,\n    entries: listing.entries,\n  };\n}\n\n// ── Session-backed workspace access ──────────────────────────────────────────\n//\n// The web UI identifies a Factory session workspace by its session id (a UUID),\n// not by a server-local filesystem path — the session's files live inside the\n// session's sandbox (a remote VM on deployed factories). These helpers resolve\n// the session, enforce that the caller owns it, reattach to its sandbox, and\n// serve the approved rendered roots through `SandboxFilesystem`.\n\n/** Dependencies for resolving a `workspacePath` that is a Factory session id. */\nexport interface SessionFsDeps {\n  auth: RouteAuth;\n  fleet: SandboxFleet;\n  sessions: { getBySessionId(sessionId: string): Promise<SourceControlSession | null> };\n  filesystem: Pick<FilesystemStorage, 'listFiles'>;\n}\n\n/**\n * Resolve a `workspacePath` query param as a Factory session id. Returns the\n * session when one exists and the caller owns it, `null` when no session\n * matches (the caller should fall back to local-path handling), and throws\n * when a session exists but belongs to another tenant.\n */\nasync function resolveAuthorizedSession(\n  c: Context,\n  deps: SessionFsDeps | undefined,\n  workspacePath: string,\n): Promise<SourceControlSession | null> {\n  if (!deps) return null;\n  const session = await deps.sessions.getBySessionId(workspacePath);\n  if (!session) return null;\n  if (deps.auth.enabled()) {\n    await deps.auth.ensureUser(c);\n    const tenant = deps.auth.tenant(c);\n    if (!tenant || tenant.orgId !== session.orgId || tenant.userId !== session.userId) {\n      throw new Error('Session is not available to the current user');\n    }\n  }\n  return session;\n}\n\nexport async function listSessionFilesystemFiles(\n  filesystem: Pick<FilesystemStorage, 'listFiles'>,\n  session: SourceControlSession,\n  threadId: string,\n): Promise<WorkspaceFilesListing> {\n  const safeThreadId = threadId.trim();\n  if (!safeThreadId) throw new Error('Missing required query param: threadId');\n\n  return {\n    workspacePath: session.sessionId,\n    threadId: safeThreadId,\n    files: await filesystem.listFiles({ resourceId: session.sessionId, threadId: safeThreadId }),\n  };\n}\n\ninterface SessionSandboxHandle {\n  sandbox: MaterializationSandbox;\n  filesystem: SandboxFilesystem;\n  workdir: string;\n}\n\n/**\n * Reattach to the session's sandbox and wrap its workdir in a\n * `SandboxFilesystem`. Returns `null` when the session has no provisioned\n * sandbox yet (nothing materialized → nothing to list), or when the sandbox\n * can no longer be reattached (e.g. torn down by the provider's idle GC).\n * This is a passive read path, so it never re-provisions: the session's\n * filesystem is preserved in its provider checkpoint and comes back the next\n * time the workspace is actually opened (e.g. by sending a message).\n */\nasync function sessionSandbox(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n): Promise<SessionSandboxHandle | null> {\n  if (!fleet.enabled || !session.sandboxId || !session.sandboxWorkdir) return null;\n  let sandbox: Awaited<ReturnType<SandboxFleet['reattachSandbox']>>;\n  try {\n    sandbox = await fleet.reattachSandbox(session.sandboxId, { workingDirectory: session.sandboxWorkdir });\n  } catch {\n    // Sandbox is gone (idle GC) or unreachable. Degrade to an empty view\n    // rather than surfacing a 500 from a file-viewer panel.\n    return null;\n  }\n  return {\n    sandbox,\n    filesystem: new SandboxFilesystem({ sandbox, workdir: session.sandboxWorkdir }),\n    workdir: session.sandboxWorkdir,\n  };\n}\n\n/** List an approved rendered root inside a Factory session's sandbox workdir. */\nexport async function listSessionRenderedPath(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  renderedRoot: string,\n): Promise<WorkspaceRenderedListing> {\n  const safeRoot = assertApprovedRenderedRoot(renderedRoot);\n  const rootPath = posixPath.join(session.sandboxWorkdir ?? '', safeRoot);\n  const empty: WorkspaceRenderedListing = { workspacePath: session.sessionId, root: safeRoot, rootPath, entries: [] };\n\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) return empty;\n\n  // One round trip: emit \"type\\tsize\\tmtime\\tpath\" per entry. `safeRoot` comes\n  // from a fixed allowlist so interpolating it (quoted) is safe.\n  const quotedRoot = `'${rootPath.replace(/'/g, `'\\\\''`)}'`;\n  const result = await handle.sandbox.executeCommand(\n    'sh',\n    [\n      '-c',\n      `test -d ${quotedRoot} && find ${quotedRoot} -mindepth 1 -printf '%y\\\\t%s\\\\t%T@\\\\t%p\\\\n' 2>/dev/null || true`,\n    ],\n    { timeout: 30_000 },\n  );\n  if (result.exitCode !== 0) return empty;\n\n  const entries: WorkspaceRenderedEntry[] = [];\n  for (const line of result.stdout.split('\\n')) {\n    if (!line) continue;\n    const [type, sizeStr, mtimeStr, ...pathParts] = line.split('\\t');\n    const fullPath = pathParts.join('\\t');\n    if (!fullPath || !fullPath.startsWith(`${rootPath}/`)) continue;\n    const relativePath = fullPath.slice(rootPath.length + 1);\n    entries.push({\n      name: posixPath.basename(relativePath),\n      path: relativePath,\n      type: type === 'd' ? 'directory' : 'file',\n      size: type === 'd' ? 0 : Number(sizeStr) || 0,\n      updatedAt: new Date((Number(mtimeStr) || 0) * 1000).toISOString(),\n    });\n  }\n  entries.sort((a, b) => a.path.localeCompare(b.path));\n\n  return { workspacePath: session.sessionId, root: safeRoot, rootPath, entries };\n}\n\n/** Read a file inside a session's sandbox. Paths outside rendered roots require a persisted-file allowlist check in the route. */\nexport async function readSessionWorkspaceFile(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  path: string,\n  options: { allowUnapprovedPath?: boolean } = {},\n): Promise<WorkspaceFile> {\n  const safePath = assertRelativePath(path, 'path');\n  if (!options.allowUnapprovedPath) assertApprovedRenderedRoot(safePath.split('/')[0] ?? '');\n\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) throw new Error('Session workspace is not available');\n  const { filesystem } = handle;\n  const info = await filesystem.stat(safePath);\n  if (info.type === 'directory') throw new Error('Path is a directory');\n\n  const buffer = (await filesystem.readFile(safePath)) as Buffer;\n  const truncated = buffer.length > MAX_TEXT_FILE_BYTES;\n  const base = {\n    workspacePath: session.sessionId,\n    path: safePath,\n    name: posixPath.basename(safePath),\n    size: buffer.length,\n    updatedAt: info.modifiedAt.toISOString(),\n  };\n  try {\n    const content = TEXT_DECODER.decode(truncated ? buffer.subarray(0, MAX_TEXT_FILE_BYTES) : buffer);\n    return { ...base, contentType: 'text', content, truncated };\n  } catch {\n    return { ...base, contentType: 'unsupported' };\n  }\n}\n\nfunction changeStatus(code: string): WorkspaceChangeStatus {\n  if (code === '??') return 'untracked';\n  if (code.includes('U') || code === 'AA' || code === 'DD') return 'conflicted';\n  if (code.includes('R')) return 'renamed';\n  if (code.includes('C')) return 'copied';\n  if (code.includes('D')) return 'deleted';\n  if (code.includes('A')) return 'added';\n  return 'modified';\n}\n\nexport function parseWorkspaceChanges(output: string): WorkspaceChange[] {\n  const records = output.split('\\0');\n  const changes: WorkspaceChange[] = [];\n\n  for (let index = 0; index < records.length; index += 1) {\n    const record = records[index];\n    if (!record || record.length < 4) continue;\n    const code = record.slice(0, 2);\n    const path = record.slice(3);\n    const status = changeStatus(code);\n    if (status === 'renamed' || status === 'copied') {\n      const previousPath = records[index + 1];\n      if (previousPath) index += 1;\n      changes.push({ path, previousPath: previousPath || undefined, status });\n      continue;\n    }\n    changes.push({ path, status });\n  }\n\n  return changes.toSorted((a, b) => a.path.localeCompare(b.path));\n}\n\nexport function parseWorkspaceChangeStats(output: string) {\n  const records = output.split('\\0');\n  const stats = new Map<string, { additions?: number; deletions?: number; binary?: boolean }>();\n\n  for (let index = 0; index < records.length; index += 1) {\n    const record = records[index];\n    if (!record) continue;\n    const firstTab = record.indexOf('\\t');\n    const secondTab = record.indexOf('\\t', firstTab + 1);\n    if (firstTab < 0 || secondTab < 0) continue;\n\n    const additionsText = record.slice(0, firstTab);\n    const deletionsText = record.slice(firstTab + 1, secondTab);\n    let path = record.slice(secondTab + 1);\n    if (!path) {\n      const renamedPath = records[index + 2];\n      if (!renamedPath) continue;\n      path = renamedPath;\n      index += 2;\n    }\n    if (path.startsWith('./')) path = path.slice(2);\n\n    if (additionsText === '-' || deletionsText === '-') {\n      stats.set(path, { binary: true });\n      continue;\n    }\n\n    const additions = Number(additionsText);\n    const deletions = Number(deletionsText);\n    if (Number.isFinite(additions) && Number.isFinite(deletions)) stats.set(path, { additions, deletions });\n  }\n\n  return stats;\n}\n\nfunction unavailableWorkspaceChanges(workspacePath: string): WorkspaceChanges {\n  return { workspacePath, available: false, changes: [] };\n}\n\nexport async function listSessionWorkspaceChanges(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n): Promise<WorkspaceChanges> {\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) return unavailableWorkspaceChanges(session.sessionId);\n\n  const [statusResult, statsResult] = await Promise.all([\n    handle.sandbox.executeCommand(\n      'git',\n      ['-C', handle.workdir, 'status', '--porcelain=v1', '-z', '--untracked-files=all'],\n      { timeout: 30_000 },\n    ),\n    handle.sandbox.executeCommand('sh', ['-c', WORKSPACE_NUMSTAT_SCRIPT, 'mastracode-numstat', handle.workdir], {\n      timeout: 30_000,\n    }),\n  ]);\n  if (statusResult.exitCode !== 0) return unavailableWorkspaceChanges(session.sessionId);\n\n  const changes = parseWorkspaceChanges(statusResult.stdout);\n  if (statsResult.exitCode !== 0) {\n    return { workspacePath: session.sessionId, available: true, changes };\n  }\n\n  const stats = parseWorkspaceChangeStats(statsResult.stdout);\n  let additions = 0;\n  let deletions = 0;\n  const changesWithStats = changes.map(change => {\n    const changeStats = stats.get(change.path);\n    additions += changeStats?.additions ?? 0;\n    deletions += changeStats?.deletions ?? 0;\n    return { ...change, ...changeStats };\n  });\n\n  return { workspacePath: session.sessionId, available: true, changes: changesWithStats, additions, deletions };\n}\n\nasync function executeBoundedGitDiff(sandbox: MaterializationSandbox, args: string[], allowExitOne = false) {\n  return sandbox.executeCommand(\n    'sh',\n    ['-c', BOUNDED_GIT_DIFF_SCRIPT, 'mastracode-diff', allowExitOne ? '1' : '0', ...args],\n    { timeout: 30_000 },\n  );\n}\n\nfunction truncatePatch(patchBuffer: Buffer): string {\n  const patch = patchBuffer.subarray(0, MAX_DIFF_BYTES).toString('utf8');\n  const lastNewline = patch.lastIndexOf('\\n');\n  if (lastNewline >= 0) return patch.slice(0, lastNewline + 1);\n  return patch.replace(/\\uFFFD+$/, '');\n}\n\nexport async function readSessionWorkspaceDiff(\n  fleet: SandboxFleet,\n  session: SourceControlSession,\n  path: string,\n  previousPath?: string,\n): Promise<WorkspaceDiff> {\n  const safePath = assertRelativePath(path, 'path');\n  const safePreviousPath = previousPath ? assertRelativePath(previousPath, 'previousPath') : undefined;\n  const handle = await sessionSandbox(fleet, session);\n  if (!handle) throw new Error('Session workspace is not available');\n\n  const pathspecs = safePreviousPath ? [safePreviousPath, safePath] : [safePath];\n  let result = await executeBoundedGitDiff(handle.sandbox, [\n    '--literal-pathspecs',\n    '-C',\n    handle.workdir,\n    'diff',\n    '--find-renames',\n    '--no-ext-diff',\n    '--no-color',\n    '--unified=3',\n    'HEAD',\n    '--',\n    ...pathspecs,\n  ]);\n  if (result.exitCode !== 0) throw new Error(result.stderr || 'Unable to read workspace diff');\n\n  if (!result.stdout) {\n    const untracked = await handle.sandbox.executeCommand(\n      'git',\n      ['--literal-pathspecs', '-C', handle.workdir, 'ls-files', '--others', '--exclude-standard', '--', safePath],\n      { timeout: 30_000 },\n    );\n    if (untracked.exitCode === 0 && untracked.stdout.trim()) {\n      result = await executeBoundedGitDiff(\n        handle.sandbox,\n        [\n          '-C',\n          handle.workdir,\n          'diff',\n          '--no-index',\n          '--no-ext-diff',\n          '--no-color',\n          '--unified=3',\n          '--',\n          '/dev/null',\n          safePath,\n        ],\n        true,\n      );\n      if (result.exitCode !== 0 && result.exitCode !== 1) {\n        throw new Error(result.stderr || 'Unable to read workspace diff');\n      }\n    }\n  }\n\n  const patchBuffer = Buffer.from(result.stdout);\n  const truncated = patchBuffer.length > MAX_DIFF_BYTES;\n  return {\n    workspacePath: session.sessionId,\n    path: safePath,\n    patch: truncated ? truncatePatch(patchBuffer) : result.stdout,\n    truncated,\n  };\n}\n\nexport interface ResolvedCodebase {\n  /**\n   * The resourceId the TUI would use for this path — derived identically so a\n   * project opened in the terminal and in the web app resolve to the SAME\n   * session (and therefore the same threads).\n   */\n  resourceId: string;\n  name: string;\n  rootPath: string;\n  gitUrl?: string;\n  gitBranch?: string;\n}\n\n/**\n * Resolve a project path to the same resourceId the TUI uses. Mirrors\n * `createMastraCode`: detect the project, then apply any resourceId override\n * (MASTRA_RESOURCE_ID env var or `.mastracode/database.json`). This is the\n * shared continuity point — start in the TUI, continue on the web, same path\n * → same resourceId → same session.\n */\nexport function resolveCodebase(projectPath: string): ResolvedCodebase {\n  const info = detectProject(projectPath);\n  const override = getResourceIdOverride(info.rootPath);\n  return {\n    resourceId: override ?? info.resourceId,\n    name: info.name,\n    rootPath: info.rootPath,\n    gitUrl: info.gitUrl,\n    gitBranch: info.gitBranch,\n  };\n}\n\n/**\n * Build the web filesystem routes as Mastra `apiRoutes`:\n *   - `GET /web/fs/list?path=...`        — browse directories (confined to root)\n *   - `GET /web/codebase/resolve?path=...` — TUI-compatible codebase resourceId\n */\nexport function buildFsRoutes(options: { root?: string; sessionFs?: SessionFsDeps } = {}): ApiRoute[] {\n  const root = resolveFsRoot(options.root);\n  const sessionFs = options.sessionFs;\n\n  return [\n    registerApiRoute('/web/fs/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        try {\n          const listing = await listDirectory(root, path);\n          return c.json(listing);\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/artifacts/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          return c.json(await listArtifacts(root, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status = message === 'Path is outside the browsable root' ? 403 : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/rendered/list', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const renderedRoot = c.req.query('root');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!renderedRoot) return c.json({ error: 'Missing required query param: root' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (session && sessionFs) {\n            return c.json(await listSessionRenderedPath(sessionFs.fleet, session, renderedRoot));\n          }\n          return c.json(await listWorkspaceRenderedPath(root, workspacePath, renderedRoot));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved') ||\n            message.includes('not available')\n              ? 403\n              : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/files', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const threadId = c.req.query('threadId')?.trim();\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!threadId) return c.json({ error: 'Missing required query param: threadId' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (!session || !sessionFs) return c.json({ error: 'Session workspace is not available' }, 403);\n          return c.json(await listSessionFilesystemFiles(sessionFs.filesystem, session, threadId));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status = message.includes('not available') ? 403 : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/changes', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (!session || !sessionFs) return c.json(unavailableWorkspaceChanges(workspacePath));\n          return c.json(await listSessionWorkspaceChanges(sessionFs.fleet, session));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, message.includes('not available') ? 403 : 500);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/changes/diff', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const path = c.req.query('path');\n        const previousPath = c.req.query('previousPath');\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (!session || !sessionFs) return c.json({ error: 'Session workspace is not available' }, 403);\n          return c.json(await readSessionWorkspaceDiff(sessionFs.fleet, session, path, previousPath));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('relative') || message.includes('escapes') || message.includes('not available')\n              ? 403\n              : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/workspace/file', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const workspacePath = c.req.query('workspacePath');\n        const path = c.req.query('path');\n        const requestedThreadId = c.req.query('threadId');\n        const threadId = requestedThreadId?.trim();\n        if (!workspacePath) return c.json({ error: 'Missing required query param: workspacePath' }, 400);\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        if (requestedThreadId !== undefined && !threadId) {\n          return c.json({ error: 'Missing required query param: threadId' }, 400);\n        }\n        try {\n          const session = await resolveAuthorizedSession(loose(c), sessionFs, workspacePath);\n          if (session && sessionFs) {\n            if (threadId) {\n              const safePath = assertRelativePath(path, 'path');\n              const listing = await listSessionFilesystemFiles(sessionFs.filesystem, session, threadId);\n              if (!listing.files.some(file => file.path === safePath)) {\n                return c.json({ error: 'Path is not available for this thread' }, 404);\n              }\n              return c.json(\n                await readSessionWorkspaceFile(sessionFs.fleet, session, safePath, { allowUnapprovedPath: true }),\n              );\n            }\n            return c.json(await readSessionWorkspaceFile(sessionFs.fleet, session, path));\n          }\n          if (threadId) return c.json({ error: 'Session workspace is not available' }, 403);\n          return c.json(await readWorkspaceFile(root, workspacePath, path));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const status =\n            message.includes('outside') ||\n            message.includes('relative') ||\n            message.includes('escapes') ||\n            message.includes('not approved') ||\n            message.includes('not available')\n              ? 403\n              : message.includes('directory')\n                ? 400\n                : message.includes('not found')\n                  ? 404\n                  : 500;\n          return c.json({ error: message }, status);\n        }\n      },\n    }),\n    registerApiRoute('/web/codebase/resolve', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const path = c.req.query('path');\n        if (!path) return c.json({ error: 'Missing required query param: path' }, 400);\n        // Confine resolution to the browsable root (following symlinks), so this\n        // endpoint can't be used to probe arbitrary filesystem paths. The web UI\n        // only ever resolves directories the user picked via the root-confined\n        // browser, so legitimate requests are always within the root.\n        const confined = await realPathWithinRoot(isAbsolute(path) ? resolve(path) : resolve(root, path), root);\n        if (!confined) return c.json({ error: 'Path is outside the browsable root' }, 403);\n        try {\n          return c.json(resolveCodebase(confined));\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          return c.json({ error: message }, 500);\n        }\n      },\n    }),\n  ];\n}\n"],"mappings":";;;;;;;AAgIA,MAAM,sBAAsB,MAAM;AAClC,MAAM,iBAAiB,MAAM;AAC7B,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;AAmBjC,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;AAkBhC,MAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAC7D,MAAM,0CAA0B,IAAI,IAAI,CAAC,YAAY,CAAC;;AAGtD,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;AAGA,SAAgB,cAAc,MAAuB;CACnD,OAAO,QAAQ,QAAQ,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC;AACvD;;AAGA,SAAS,aAAa,WAAmB,MAAuB;CAC9D,IAAI,cAAc,MAAM,OAAO;CAC/B,MAAM,cAAc,KAAK,SAAS,GAAG,IAAI,OAAO,OAAO;CACvD,OAAO,UAAU,WAAW,WAAW;AACzC;AAEA,eAAe,eAAe,MAA+B;CAC3D,IAAI;EACF,OAAO,MAAM,SAAS,IAAI;CAC5B,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;AAQA,eAAe,mBAAmB,WAAmB,MAAsC;CACzF,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,SAAS;EACrC,OAAO,aAAa,MAAM,IAAI,IAAI,OAAO;CAC3C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,MAAc,OAAuB;CAC/D,MAAM,UAAU,KAAK,KAAK;CAC1B,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,iCAAiC,OAAO;CACtE,IAAI,WAAW,OAAO,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,kBAAkB;CACpE,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CACxF,MAAM,aAAa,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;CAChD,IAAI,CAAC,cAAc,eAAe,QAAQ,WAAW,WAAW,KAAK,KAAK,GACxE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAC9C,OAAO;AACT;AAEA,SAAS,2BAA2B,cAA8B;CAChE,MAAM,WAAW,mBAAmB,cAAc,MAAM;CACxD,IAAI,CAAC,wBAAwB,IAAI,QAAQ,GAAG,MAAM,IAAI,MAAM,oDAAoD;CAChH,OAAO;AACT;AAEA,eAAe,sBACb,MACA,eACsD;CACtD,MAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;CAE7D,MAAM,YAAY,MAAM,mBADN,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa,GACpD,YAAY;CAClE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,oCAAoC;CACpE,OAAO;EAAE;EAAc;CAAU;AACnC;AAEA,eAAe,8BACb,MACA,eACA,cACoE;CACpE,MAAM,mBAAmB,mBAAmB,cAAc,MAAM;CAChE,MAAM,EAAE,cAAc,MAAM,sBAAsB,MAAM,aAAa;CACrE,MAAM,YAAY,QAAQ,WAAW,gBAAgB;CACrD,IAAI,CAAC,aAAa,WAAW,SAAS,GAAG,MAAM,IAAI,MAAM,wBAAwB;CACjF,MAAM,eAAe,MAAM,mBAAmB,WAAW,SAAS;CAClE,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,+BAA+B;CAClE,OAAO;EAAE;EAAW,MAAM;EAAc,cAAc;CAAiB;AACzE;;;;;;AAOA,eAAsB,cAAc,MAAc,eAAmD;CAGnG,MAAM,eAAe,MAAM,eAAe,cAAc,IAAI,CAAC;CAE7D,IAAI,SAAS;CACb,IAAI,iBAAiB,cAAc,KAAK,GAGtC,SAAU,MAAM,mBAFE,WAAW,aAAa,IAAI,QAAQ,aAAa,IAAI,QAAQ,cAAc,aAAa,GAE5D,YAAY,KAAM;CAIlE,IAAI;EAEF,IAAI,EAAC,MADc,KAAK,MAAM,EAAA,CACpB,YAAY,GAAG,SAAS;CACpC,QAAQ;EACN,SAAS;CACX;CAEA,MAAM,UAAU,MAAM,QAAQ,QAAQ,EAAE,eAAe,KAAK,CAAC;CAC7D,MAAM,UAA4B,CAAC;CACnC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,KAAK,WAAW,GAAG,GAAG;EACjC,MAAM,YAAY,KAAK,QAAQ,OAAO,IAAI;EAC1C,IAAI,QAAQ,OAAO,YAAY;EAC/B,IAAI,OAAO,eAAe,GAAG;GAG3B,MAAM,OAAO,MAAM,mBAAmB,WAAW,YAAY;GAC7D,QAAQ,QAAQ,MAAM,KAAK,IAAI,CAAC,CAAC,YAAY,IAAI,EAAA,EAAI,YAAY,MAAM,OAAO;EAChF;EACA,IAAI,OAAO,QAAQ,KAAK;GAAE,MAAM,OAAO;GAAM,MAAM;EAAU,CAAC;CAChE;CACA,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;CAEnD,MAAM,SAAS,WAAW,eAAe,OAAO,QAAQ,QAAQ,IAAI;CAEpE,OAAO;EAAE,MAAM;EAAc,MAAM;EAAQ;EAAQ;CAAQ;AAC7D;AAEA,eAAe,oBAAoB,UAAkB,cAAc,UAA6C;CAC9G,MAAM,UAAU,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC;CAClE,MAAM,UAAoC,CAAC;CAE3C,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,YAAY,KAAK,aAAa,OAAO,IAAI;EAC/C,MAAM,OAAO,MAAM,MAAM,SAAS;EAClC,MAAM,eAAe,UAAU,MAAM,SAAS,SAAS,CAAC;EAExD,IAAI,KAAK,YAAY,GAAG;GACtB,QAAQ,KAAK;IACX,MAAM,OAAO;IACb,MAAM;IACN,MAAM;IACN,MAAM,KAAK;IACX,WAAW,KAAK,MAAM,YAAY;GACpC,CAAC;GACD,QAAQ,KAAK,GAAI,MAAM,oBAAoB,UAAU,SAAS,CAAE;GAChE;EACF;EAEA,IAAI,KAAK,OAAO,GACd,QAAQ,KAAK;GACX,MAAM,OAAO;GACb,MAAM;GACN,MAAM;GACN,MAAM,KAAK;GACX,WAAW,KAAK,MAAM,YAAY;EACpC,CAAC;CAEL;CAEA,OAAO,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC5D;AAEA,eAAsB,0BACpB,MACA,eACA,cACmC;CACnC,MAAM,WAAW,2BAA2B,YAAY;CACxD,MAAM,EAAE,cAAc,MAAM,sBAAsB,MAAM,aAAa;CACrE,MAAM,eAAe,QAAQ,WAAW,QAAQ;CAChD,IAAI,CAAC,aAAa,cAAc,SAAS,GAAG,MAAM,IAAI,MAAM,wBAAwB;CAEpF,MAAM,mBAAmB,MAAM,mBAAmB,cAAc,SAAS;CACzE,IAAI,CAAC,kBAAkB,OAAO;EAAE,eAAe;EAAW,MAAM;EAAU,UAAU;EAAc,SAAS,CAAC;CAAE;CAG9G,IAAI,EAAC,MADc,KAAK,gBAAgB,EAAA,CAC9B,YAAY,GAAG,OAAO;EAAE,eAAe;EAAW,MAAM;EAAU,UAAU;EAAkB,SAAS,CAAC;CAAE;CAEpH,OAAO;EACL,eAAe;EACf,MAAM;EACN,UAAU;EACV,SAAS,MAAM,oBAAoB,gBAAgB;CACrD;AACF;AAEA,eAAsB,kBAAkB,MAAc,eAAuB,MAAsC;CAGjH,2BAFiB,mBAAmB,MAAM,MACd,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EACR;CACvC,MAAM,EACJ,WACA,MAAM,cACN,iBACE,MAAM,8BAA8B,MAAM,eAAe,IAAI;CACjE,MAAM,OAAO,MAAM,MAAM,YAAY;CACrC,IAAI,KAAK,YAAY,GAAG,MAAM,IAAI,MAAM,qBAAqB;CAC7D,IAAI,CAAC,KAAK,OAAO,GAAG,MAAM,IAAI,MAAM,uBAAuB;CAE3D,MAAM,cAAc,KAAK,IAAI,KAAK,MAAM,mBAAmB;CAC3D,MAAM,gBAAgB,OAAO,MAAM,WAAW;CAC9C,MAAM,SAAS,MAAM,KAAK,cAAc,GAAG;CAC3C,IAAI;EACF,MAAM,OAAO,KAAK,eAAe,GAAG,aAAa,CAAC;CACpD,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CAEA,IAAI;EACF,MAAM,UAAU,aAAa,OAAO,aAAa;EACjD,OAAO;GACL,eAAe;GACf,MAAM;GACN,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GACvC,MAAM,KAAK;GACX,WAAW,KAAK,MAAM,YAAY;GAClC,aAAa;GACb;GACA,WAAW,KAAK,OAAO;EACzB;CACF,QAAQ;EACN,OAAO;GACL,eAAe;GACf,MAAM;GACN,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GACvC,MAAM,KAAK;GACX,WAAW,KAAK,MAAM,YAAY;GAClC,aAAa;EACf;CACF;AACF;AAEA,eAAsB,cAAc,MAAc,eAAiD;CACjG,MAAM,UAAU,MAAM,0BAA0B,MAAM,eAAe,YAAY;CACjF,OAAO;EACL,UAAU,QAAQ;EAClB,eAAe,QAAQ;EACvB,SAAS,QAAQ;CACnB;AACF;;;;;;;AAwBA,eAAe,yBACb,GACA,MACA,eACsC;CACtC,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,MAAM,KAAK,SAAS,eAAe,aAAa;CAChE,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,KAAK,KAAK,QAAQ,GAAG;EACvB,MAAM,KAAK,KAAK,WAAW,CAAC;EAC5B,MAAM,SAAS,KAAK,KAAK,OAAO,CAAC;EACjC,IAAI,CAAC,UAAU,OAAO,UAAU,QAAQ,SAAS,OAAO,WAAW,QAAQ,QACzE,MAAM,IAAI,MAAM,8CAA8C;CAElE;CACA,OAAO;AACT;AAEA,eAAsB,2BACpB,YACA,SACA,UACgC;CAChC,MAAM,eAAe,SAAS,KAAK;CACnC,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,wCAAwC;CAE3E,OAAO;EACL,eAAe,QAAQ;EACvB,UAAU;EACV,OAAO,MAAM,WAAW,UAAU;GAAE,YAAY,QAAQ;GAAW,UAAU;EAAa,CAAC;CAC7F;AACF;;;;;;;;;;AAiBA,eAAe,eACb,OACA,SACsC;CACtC,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,aAAa,CAAC,QAAQ,gBAAgB,OAAO;CAC5E,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,MAAM,gBAAgB,QAAQ,WAAW,EAAE,kBAAkB,QAAQ,eAAe,CAAC;CACvG,QAAQ;EAGN,OAAO;CACT;CACA,OAAO;EACL;EACA,YAAY,IAAI,kBAAkB;GAAE;GAAS,SAAS,QAAQ;EAAe,CAAC;EAC9E,SAAS,QAAQ;CACnB;AACF;;AAGA,eAAsB,wBACpB,OACA,SACA,cACmC;CACnC,MAAM,WAAW,2BAA2B,YAAY;CACxD,MAAM,WAAWA,MAAU,KAAK,QAAQ,kBAAkB,IAAI,QAAQ;CACtE,MAAM,QAAkC;EAAE,eAAe,QAAQ;EAAW,MAAM;EAAU;EAAU,SAAS,CAAC;CAAE;CAElH,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,OAAO;CAIpB,MAAM,aAAa,IAAI,SAAS,QAAQ,MAAM,OAAO,EAAE;CACvD,MAAM,SAAS,MAAM,OAAO,QAAQ,eAClC,MACA,CACE,MACA,WAAW,WAAW,WAAW,WAAW,iEAC9C,GACA,EAAE,SAAS,IAAO,CACpB;CACA,IAAI,OAAO,aAAa,GAAG,OAAO;CAElC,MAAM,UAAoC,CAAC;CAC3C,KAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,IAAI,GAAG;EAC5C,IAAI,CAAC,MAAM;EACX,MAAM,CAAC,MAAM,SAAS,UAAU,GAAG,aAAa,KAAK,MAAM,GAAI;EAC/D,MAAM,WAAW,UAAU,KAAK,GAAI;EACpC,IAAI,CAAC,YAAY,CAAC,SAAS,WAAW,GAAG,SAAS,EAAE,GAAG;EACvD,MAAM,eAAe,SAAS,MAAM,SAAS,SAAS,CAAC;EACvD,QAAQ,KAAK;GACX,MAAMA,MAAU,SAAS,YAAY;GACrC,MAAM;GACN,MAAM,SAAS,MAAM,cAAc;GACnC,MAAM,SAAS,MAAM,IAAI,OAAO,OAAO,KAAK;GAC5C,4BAAW,IAAI,MAAM,OAAO,QAAQ,KAAK,KAAK,GAAI,EAAA,CAAE,YAAY;EAClE,CAAC;CACH;CACA,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;CAEnD,OAAO;EAAE,eAAe,QAAQ;EAAW,MAAM;EAAU;EAAU;CAAQ;AAC/E;;AAGA,eAAsB,yBACpB,OACA,SACA,MACA,UAA6C,CAAC,GACtB;CACxB,MAAM,WAAW,mBAAmB,MAAM,MAAM;CAChD,IAAI,CAAC,QAAQ,qBAAqB,2BAA2B,SAAS,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE;CAEzF,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,oCAAoC;CACjE,MAAM,EAAE,eAAe;CACvB,MAAM,OAAO,MAAM,WAAW,KAAK,QAAQ;CAC3C,IAAI,KAAK,SAAS,aAAa,MAAM,IAAI,MAAM,qBAAqB;CAEpE,MAAM,SAAU,MAAM,WAAW,SAAS,QAAQ;CAClD,MAAM,YAAY,OAAO,SAAS;CAClC,MAAM,OAAO;EACX,eAAe,QAAQ;EACvB,MAAM;EACN,MAAMA,MAAU,SAAS,QAAQ;EACjC,MAAM,OAAO;EACb,WAAW,KAAK,WAAW,YAAY;CACzC;CACA,IAAI;EACF,MAAM,UAAU,aAAa,OAAO,YAAY,OAAO,SAAS,GAAG,mBAAmB,IAAI,MAAM;EAChG,OAAO;GAAE,GAAG;GAAM,aAAa;GAAQ;GAAS;EAAU;CAC5D,QAAQ;EACN,OAAO;GAAE,GAAG;GAAM,aAAa;EAAc;CAC/C;AACF;AAEA,SAAS,aAAa,MAAqC;CACzD,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,KAAK,SAAS,GAAG,KAAK,SAAS,QAAQ,SAAS,MAAM,OAAO;CACjE,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,IAAI,KAAK,SAAS,GAAG,GAAG,OAAO;CAC/B,OAAO;AACT;AAEA,SAAgB,sBAAsB,QAAmC;CACvE,MAAM,UAAU,OAAO,MAAM,IAAI;CACjC,MAAM,UAA6B,CAAC;CAEpC,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;EAClC,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC;EAC9B,MAAM,OAAO,OAAO,MAAM,CAAC;EAC3B,MAAM,SAAS,aAAa,IAAI;EAChC,IAAI,WAAW,aAAa,WAAW,UAAU;GAC/C,MAAM,eAAe,QAAQ,QAAQ;GACrC,IAAI,cAAc,SAAS;GAC3B,QAAQ,KAAK;IAAE;IAAM,cAAc,gBAAgB,KAAA;IAAW;GAAO,CAAC;GACtE;EACF;EACA,QAAQ,KAAK;GAAE;GAAM;EAAO,CAAC;CAC/B;CAEA,OAAO,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAChE;AAEA,SAAgB,0BAA0B,QAAgB;CACxD,MAAM,UAAU,OAAO,MAAM,IAAI;CACjC,MAAM,wBAAQ,IAAI,IAA0E;CAE5F,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IAAI,CAAC,QAAQ;EACb,MAAM,WAAW,OAAO,QAAQ,GAAI;EACpC,MAAM,YAAY,OAAO,QAAQ,KAAM,WAAW,CAAC;EACnD,IAAI,WAAW,KAAK,YAAY,GAAG;EAEnC,MAAM,gBAAgB,OAAO,MAAM,GAAG,QAAQ;EAC9C,MAAM,gBAAgB,OAAO,MAAM,WAAW,GAAG,SAAS;EAC1D,IAAI,OAAO,OAAO,MAAM,YAAY,CAAC;EACrC,IAAI,CAAC,MAAM;GACT,MAAM,cAAc,QAAQ,QAAQ;GACpC,IAAI,CAAC,aAAa;GAClB,OAAO;GACP,SAAS;EACX;EACA,IAAI,KAAK,WAAW,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC;EAE9C,IAAI,kBAAkB,OAAO,kBAAkB,KAAK;GAClD,MAAM,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAChC;EACF;EAEA,MAAM,YAAY,OAAO,aAAa;EACtC,MAAM,YAAY,OAAO,aAAa;EACtC,IAAI,OAAO,SAAS,SAAS,KAAK,OAAO,SAAS,SAAS,GAAG,MAAM,IAAI,MAAM;GAAE;GAAW;EAAU,CAAC;CACxG;CAEA,OAAO;AACT;AAEA,SAAS,4BAA4B,eAAyC;CAC5E,OAAO;EAAE;EAAe,WAAW;EAAO,SAAS,CAAC;CAAE;AACxD;AAEA,eAAsB,4BACpB,OACA,SAC2B;CAC3B,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,OAAO,4BAA4B,QAAQ,SAAS;CAEjE,MAAM,CAAC,cAAc,eAAe,MAAM,QAAQ,IAAI,CACpD,OAAO,QAAQ,eACb,OACA;EAAC;EAAM,OAAO;EAAS;EAAU;EAAkB;EAAM;CAAuB,GAChF,EAAE,SAAS,IAAO,CACpB,GACA,OAAO,QAAQ,eAAe,MAAM;EAAC;EAAM;EAA0B;EAAsB,OAAO;CAAO,GAAG,EAC1G,SAAS,IACX,CAAC,CACH,CAAC;CACD,IAAI,aAAa,aAAa,GAAG,OAAO,4BAA4B,QAAQ,SAAS;CAErF,MAAM,UAAU,sBAAsB,aAAa,MAAM;CACzD,IAAI,YAAY,aAAa,GAC3B,OAAO;EAAE,eAAe,QAAQ;EAAW,WAAW;EAAM;CAAQ;CAGtE,MAAM,QAAQ,0BAA0B,YAAY,MAAM;CAC1D,IAAI,YAAY;CAChB,IAAI,YAAY;CAChB,MAAM,mBAAmB,QAAQ,KAAI,WAAU;EAC7C,MAAM,cAAc,MAAM,IAAI,OAAO,IAAI;EACzC,aAAa,aAAa,aAAa;EACvC,aAAa,aAAa,aAAa;EACvC,OAAO;GAAE,GAAG;GAAQ,GAAG;EAAY;CACrC,CAAC;CAED,OAAO;EAAE,eAAe,QAAQ;EAAW,WAAW;EAAM,SAAS;EAAkB;EAAW;CAAU;AAC9G;AAEA,eAAe,sBAAsB,SAAiC,MAAgB,eAAe,OAAO;CAC1G,OAAO,QAAQ,eACb,MACA;EAAC;EAAM;EAAyB;EAAmB,eAAe,MAAM;EAAK,GAAG;CAAI,GACpF,EAAE,SAAS,IAAO,CACpB;AACF;AAEA,SAAS,cAAc,aAA6B;CAClD,MAAM,QAAQ,YAAY,SAAS,GAAG,cAAc,CAAC,CAAC,SAAS,MAAM;CACrE,MAAM,cAAc,MAAM,YAAY,IAAI;CAC1C,IAAI,eAAe,GAAG,OAAO,MAAM,MAAM,GAAG,cAAc,CAAC;CAC3D,OAAO,MAAM,QAAQ,YAAY,EAAE;AACrC;AAEA,eAAsB,yBACpB,OACA,SACA,MACA,cACwB;CACxB,MAAM,WAAW,mBAAmB,MAAM,MAAM;CAChD,MAAM,mBAAmB,eAAe,mBAAmB,cAAc,cAAc,IAAI,KAAA;CAC3F,MAAM,SAAS,MAAM,eAAe,OAAO,OAAO;CAClD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,oCAAoC;CAEjE,MAAM,YAAY,mBAAmB,CAAC,kBAAkB,QAAQ,IAAI,CAAC,QAAQ;CAC7E,IAAI,SAAS,MAAM,sBAAsB,OAAO,SAAS;EACvD;EACA;EACA,OAAO;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL,CAAC;CACD,IAAI,OAAO,aAAa,GAAG,MAAM,IAAI,MAAM,OAAO,UAAU,+BAA+B;CAE3F,IAAI,CAAC,OAAO,QAAQ;EAClB,MAAM,YAAY,MAAM,OAAO,QAAQ,eACrC,OACA;GAAC;GAAuB;GAAM,OAAO;GAAS;GAAY;GAAY;GAAsB;GAAM;EAAQ,GAC1G,EAAE,SAAS,IAAO,CACpB;EACA,IAAI,UAAU,aAAa,KAAK,UAAU,OAAO,KAAK,GAAG;GACvD,SAAS,MAAM,sBACb,OAAO,SACP;IACE;IACA,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACF,GACA,IACF;GACA,IAAI,OAAO,aAAa,KAAK,OAAO,aAAa,GAC/C,MAAM,IAAI,MAAM,OAAO,UAAU,+BAA+B;EAEpE;CACF;CAEA,MAAM,cAAc,OAAO,KAAK,OAAO,MAAM;CAC7C,MAAM,YAAY,YAAY,SAAS;CACvC,OAAO;EACL,eAAe,QAAQ;EACvB,MAAM;EACN,OAAO,YAAY,cAAc,WAAW,IAAI,OAAO;EACvD;CACF;AACF;;;;;;;;AAsBA,SAAgB,gBAAgB,aAAuC;CACrE,MAAM,OAAO,cAAc,WAAW;CAEtC,OAAO;EACL,YAFe,sBAAsB,KAAK,QAEvB,KAAK,KAAK;EAC7B,MAAM,KAAK;EACX,UAAU,KAAK;EACf,QAAQ,KAAK;EACb,WAAW,KAAK;CAClB;AACF;;;;;;AAOA,SAAgB,cAAc,UAAwD,CAAC,GAAe;CACpG,MAAM,OAAO,cAAc,QAAQ,IAAI;CACvC,MAAM,YAAY,QAAQ;CAE1B,OAAO;EACL,iBAAiB,gBAAgB;GAC/B,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI;KACF,MAAM,UAAU,MAAM,cAAc,MAAM,IAAI;KAC9C,OAAO,EAAE,KAAK,OAAO;IACvB,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;IACvC;GACF;EACF,CAAC;EACD,iBAAiB,uBAAuB;GACtC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAC7E,IAAI;KACF,OAAO,EAAE,KAAK,MAAM,cAAc,MAAM,IAAI,CAAC;IAC/C,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SAAS,YAAY,uCAAuC,MAAM;KACxE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,gCAAgC;GAC/C,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,eAAe,EAAE,IAAI,MAAM,MAAM;IACvC,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,cAAc,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IACrF,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,WAAW,WACb,OAAO,EAAE,KAAK,MAAM,wBAAwB,UAAU,OAAO,SAAS,YAAY,CAAC;KAErF,OAAO,EAAE,KAAK,MAAM,0BAA0B,MAAM,eAAe,YAAY,CAAC;IAClF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,eAAe,IAC5B,MACA;KACN,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,wBAAwB;GACvC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,WAAW,EAAE,IAAI,MAAM,UAAU,CAAC,EAAE,KAAK;IAC/C,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,yCAAyC,GAAG,GAAG;IACrF,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;KAC9F,OAAO,EAAE,KAAK,MAAM,2BAA2B,UAAU,YAAY,SAAS,QAAQ,CAAC;IACzF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SAAS,QAAQ,SAAS,eAAe,IAAI,MAAM;KACzD,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,0BAA0B;GACzC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,EAAE,KAAK,4BAA4B,aAAa,CAAC;KACpF,OAAO,EAAE,KAAK,MAAM,4BAA4B,UAAU,OAAO,OAAO,CAAC;IAC3E,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,QAAQ,SAAS,eAAe,IAAI,MAAM,GAAG;IACjF;GACF;EACF,CAAC;EACD,iBAAiB,+BAA+B;GAC9C,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,MAAM,eAAe,EAAE,IAAI,MAAM,cAAc;IAC/C,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAC7E,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;KAC9F,OAAO,EAAE,KAAK,MAAM,yBAAyB,UAAU,OAAO,SAAS,MAAM,YAAY,CAAC;IAC5F,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SACJ,QAAQ,SAAS,UAAU,KAAK,QAAQ,SAAS,SAAS,KAAK,QAAQ,SAAS,eAAe,IAC3F,MACA;KACN,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,uBAAuB;GACtC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,gBAAgB,EAAE,IAAI,MAAM,eAAe;IACjD,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,MAAM,oBAAoB,EAAE,IAAI,MAAM,UAAU;IAChD,MAAM,WAAW,mBAAmB,KAAK;IACzC,IAAI,CAAC,eAAe,OAAO,EAAE,KAAK,EAAE,OAAO,8CAA8C,GAAG,GAAG;IAC/F,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAC7E,IAAI,sBAAsB,KAAA,KAAa,CAAC,UACtC,OAAO,EAAE,KAAK,EAAE,OAAO,yCAAyC,GAAG,GAAG;IAExE,IAAI;KACF,MAAM,UAAU,MAAM,yBAAyB,MAAM,CAAC,GAAG,WAAW,aAAa;KACjF,IAAI,WAAW,WAAW;MACxB,IAAI,UAAU;OACZ,MAAM,WAAW,mBAAmB,MAAM,MAAM;OAEhD,IAAI,EAAC,MADiB,2BAA2B,UAAU,YAAY,SAAS,QAAQ,EAAA,CAC3E,MAAM,MAAK,SAAQ,KAAK,SAAS,QAAQ,GACpD,OAAO,EAAE,KAAK,EAAE,OAAO,wCAAwC,GAAG,GAAG;OAEvE,OAAO,EAAE,KACP,MAAM,yBAAyB,UAAU,OAAO,SAAS,UAAU,EAAE,qBAAqB,KAAK,CAAC,CAClG;MACF;MACA,OAAO,EAAE,KAAK,MAAM,yBAAyB,UAAU,OAAO,SAAS,IAAI,CAAC;KAC9E;KACA,IAAI,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;KAChF,OAAO,EAAE,KAAK,MAAM,kBAAkB,MAAM,eAAe,IAAI,CAAC;IAClE,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,SACJ,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,UAAU,KAC3B,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,eAAe,IAC5B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA,QAAQ,SAAS,WAAW,IAC1B,MACA;KACV,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,MAAM;IAC1C;GACF;EACF,CAAC;EACD,iBAAiB,yBAAyB;GACxC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IAK7E,MAAM,WAAW,MAAM,mBAAmB,WAAW,IAAI,IAAI,QAAQ,IAAI,IAAI,QAAQ,MAAM,IAAI,GAAG,IAAI;IACtG,IAAI,CAAC,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,qCAAqC,GAAG,GAAG;IACjF,IAAI;KACF,OAAO,EAAE,KAAK,gBAAgB,QAAQ,CAAC;IACzC,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,OAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;IACvC;GACF;EACF,CAAC;CACH;AACF"}

package/dist/routes/surface.d.ts

@@ -15,6 +15,7 @@ import type { AuditEmitter } from '../storage/domains/audit/domain.js';
 import type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';
 import type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';
 import type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';
+import type { FilesystemStorage } from '../storage/domains/filesystem/base.js';
 import type { IntakeStorage } from '../storage/domains/intake/base.js';
 import type { IntegrationStorage } from '../storage/domains/integrations/base.js';
 import type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';
@@ -51,6 +52,7 @@ export interface FactoryApiRoutesDeps {
         modelCredentials: ModelCredentialsStorage;
         memorySettings: MemorySettingsStorage;
         customProviders: CustomProvidersStorage;
+        filesystem: FilesystemStorage;
         modelPacks: ModelPacksStorage;
         projects: FactoryProjectsStorage;
         queueHealth: QueueHealthStorage;

package/dist/routes/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAM9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,EAAE,YAAY,CAAC;IACpB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,cAAc,EAAE,qBAAqB,CAAC;QACtC,eAAe,EAAE,sBAAsB,CAAC;QACxC,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;QAC5B,eAAe,EAAE,sBAAsB,CAAC;KACzC,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,KAAK,EAAE,YAAY,CAAC;IACpB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAiDD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,MAAM,CAsBtF;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,uBAAuB,EACpC,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EACpB,YAAY,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,sBAAsB,CACpH,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,IAAI,CACX,oBAAoB,CAAC,SAAS,CAAC,EAC/B,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAC3E,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CAsBpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAkH/E"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/routes/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAM9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,qEAAqE;IACrE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,EAAE,YAAY,CAAC;IACpB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,mFAAmF;IACnF,OAAO,EAAE;QACP,MAAM,EAAE,aAAa,CAAC;QACtB,gBAAgB,EAAE,uBAAuB,CAAC;QAC1C,cAAc,EAAE,qBAAqB,CAAC;QACtC,eAAe,EAAE,sBAAsB,CAAC;QACxC,UAAU,EAAE,iBAAiB,CAAC;QAC9B,UAAU,EAAE,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,sBAAsB,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC;QAChC,SAAS,EAAE,gBAAgB,CAAC;QAC5B,eAAe,EAAE,sBAAsB,CAAC;KACzC,CAAC;IACF,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,KAAK,EAAE,YAAY,CAAC;IACpB,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,iBAAiB,EAAE,wBAAwB,CAAC;QAC5C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3E,KAAK,IAAI,CAAC;CACZ;AAiDD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,MAAM,CAsBtF;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,uBAAuB,EACpC,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CACR,oBAAoB,EACpB,YAAY,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,sBAAsB,CACpH,GAAG;IACF,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,IAAI,CACX,oBAAoB,CAAC,SAAS,CAAC,EAC/B,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,gBAAgB,CAC3E,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EACD,aAAa,EAAE,MAAM,GACpB,kBAAkB,CAsBpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAmH/E"}

package/dist/routes/surface.js

@@ -241,7 +241,8 @@ function assembleFactoryApiRoutes(deps) {
 			sessionFs: {
 				auth: deps.auth,
 				fleet: deps.fleet,
-				sessions: deps.sourceControlStorage.forIntegration("github").sessions
+				sessions: deps.sourceControlStorage.forIntegration("github").sessions,
+				filesystem: deps.domains.filesystem
 			}
 		}),
 		...new ConfigRoutes({

package/dist/routes/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport type { SandboxFleet } from '../sandbox/fleet.js';\nimport { ensureFactorySourceSession, resolveFactoryDefaultModelId } from '../session/factory-session.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport type { SourceControlStorage } from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox fleet constructed by the factory (disabled when no machine). */\n  fleet: SandboxFleet;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  factoryTransitionService?: FactoryTransitionService;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\nexport function factoryRuleBranch(item: FactoryBindingPreparationInput['item']): string {\n  const metadata = item.metadata ?? {};\n  const issueNumber = metadata.githubIssueNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'issue' &&\n    typeof issueNumber === 'number'\n  ) {\n    return `factory/issue-${issueNumber}`;\n  }\n  const pullRequestNumber = metadata.githubPullRequestNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'pull-request' &&\n    typeof pullRequestNumber === 'number'\n  ) {\n    return `factory/pr-${pullRequestNumber}`;\n  }\n  if (item.externalSource?.integrationId === 'linear' && typeof metadata.identifier === 'string') {\n    return `factory/linear-${metadata.identifier.toLowerCase()}`;\n  }\n  throw new Error('Factory skill invocation requires a supported issue or pull request identifier.');\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: FactoryStartCoordinator,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  const branch = factoryRuleBranch(input.item);\n  const repositorySlug =\n    typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n  const preparedSession = await ensureFactorySourceSession({\n    sourceControl: github.sourceControlStorage,\n    orgId: input.record.orgId,\n    factoryProjectId: input.record.factoryProjectId,\n    repositorySlug,\n    branch,\n  });\n  const destinationStage = input.item.stages.length === 1 ? input.item.stages[0] : undefined;\n  if (!destinationStage) throw new Error('Factory skill invocation requires one exclusive board stage.');\n\n  await coordinator.prepare({\n    orgId: input.record.orgId,\n    userId: preparedSession.userId,\n    factoryProjectId: input.record.factoryProjectId,\n    sessionId: preparedSession.sessionId,\n    defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n    threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n    kickoffKey: input.record.id,\n    destinationStage: destinationStage as 'intake' | 'triage' | 'planning' | 'execute' | 'review' | 'done',\n    workItem: {\n      id: input.item.id,\n      role: input.role,\n      input: {\n        externalSource: input.item.externalSource,\n        parentWorkItemId: input.item.parentWorkItemId,\n        title: input.item.title,\n        stages: ['intake'],\n        sessions: input.item.sessions,\n        metadata: input.item.metadata,\n      },\n    },\n  });\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    'controller' | 'publicOrigin' | 'auth' | 'fleet' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    fleet: deps.fleet,\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              fleet: deps.fleet,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        fleet: deps.fleet,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      memorySettings: deps.domains.memorySettings,\n      customProviders: deps.domains.customProviders,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;AAqFA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAsD;CACtF,MAAM,WAAW,KAAK,YAAY,CAAC;CACnC,MAAM,cAAc,SAAS,qBAAqB,SAAS;CAC3D,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,WAC7B,OAAO,gBAAgB,UAEvB,OAAO,iBAAiB;CAE1B,MAAM,oBAAoB,SAAS,2BAA2B,SAAS;CACvE,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,kBAC7B,OAAO,sBAAsB,UAE7B,OAAO,cAAc;CAEvB,IAAI,KAAK,gBAAgB,kBAAkB,YAAY,OAAO,SAAS,eAAe,UACpF,OAAO,kBAAkB,SAAS,WAAW,YAAY;CAE3D,MAAM,IAAI,MAAM,iFAAiF;AACnG;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,MAAM,SAAS,kBAAkB,MAAM,IAAI;CAC3C,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;CACzF,MAAM,kBAAkB,MAAM,2BAA2B;EACvD,eAAe,OAAO;EACtB,OAAO,MAAM,OAAO;EACpB,kBAAkB,MAAM,OAAO;EAC/B;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK,KAAA;CACjF,IAAI,CAAC,kBAAkB,MAAM,IAAI,MAAM,8DAA8D;CAErG,MAAM,YAAY,QAAQ;EACxB,OAAO,MAAM,OAAO;EACpB,QAAQ,gBAAgB;EACxB,kBAAkB,MAAM,OAAO;EAC/B,WAAW,gBAAgB;EAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;EAC1F,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;EACxE,YAAY,MAAM,OAAO;EACP;EAClB,UAAU;GACR,IAAI,MAAM,KAAK;GACf,MAAM,MAAM;GACZ,OAAO;IACL,gBAAgB,MAAM,KAAK;IAC3B,kBAAkB,MAAM,KAAK;IAC7B,OAAO,MAAM,KAAK;IAClB,QAAQ,CAAC,QAAQ;IACjB,UAAU,MAAM,KAAK;IACrB,UAAU,MAAM,KAAK;GACvB;EACF;CACF,CAAC;AACH;;;;;;;AAQA,SAAgB,wBACd,MAmBA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,OAAO,KAAK;GACd,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;GAC/D;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,aAAa,KAAK,QAAQ;GAC1B;GACA;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}
+{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport type { SandboxFleet } from '../sandbox/fleet.js';\nimport { ensureFactorySourceSession, resolveFactoryDefaultModelId } from '../session/factory-session.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport type { SourceControlStorage } from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox fleet constructed by the factory (disabled when no machine). */\n  fleet: SandboxFleet;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  factoryTransitionService?: FactoryTransitionService;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\nexport function factoryRuleBranch(item: FactoryBindingPreparationInput['item']): string {\n  const metadata = item.metadata ?? {};\n  const issueNumber = metadata.githubIssueNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'issue' &&\n    typeof issueNumber === 'number'\n  ) {\n    return `factory/issue-${issueNumber}`;\n  }\n  const pullRequestNumber = metadata.githubPullRequestNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'pull-request' &&\n    typeof pullRequestNumber === 'number'\n  ) {\n    return `factory/pr-${pullRequestNumber}`;\n  }\n  if (item.externalSource?.integrationId === 'linear' && typeof metadata.identifier === 'string') {\n    return `factory/linear-${metadata.identifier.toLowerCase()}`;\n  }\n  throw new Error('Factory skill invocation requires a supported issue or pull request identifier.');\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: FactoryStartCoordinator,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  const branch = factoryRuleBranch(input.item);\n  const repositorySlug =\n    typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n  const preparedSession = await ensureFactorySourceSession({\n    sourceControl: github.sourceControlStorage,\n    orgId: input.record.orgId,\n    factoryProjectId: input.record.factoryProjectId,\n    repositorySlug,\n    branch,\n  });\n  const destinationStage = input.item.stages.length === 1 ? input.item.stages[0] : undefined;\n  if (!destinationStage) throw new Error('Factory skill invocation requires one exclusive board stage.');\n\n  await coordinator.prepare({\n    orgId: input.record.orgId,\n    userId: preparedSession.userId,\n    factoryProjectId: input.record.factoryProjectId,\n    sessionId: preparedSession.sessionId,\n    defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n    threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n    kickoffKey: input.record.id,\n    destinationStage: destinationStage as 'intake' | 'triage' | 'planning' | 'execute' | 'review' | 'done',\n    workItem: {\n      id: input.item.id,\n      role: input.role,\n      input: {\n        externalSource: input.item.externalSource,\n        parentWorkItemId: input.item.parentWorkItemId,\n        title: input.item.title,\n        stages: ['intake'],\n        sessions: input.item.sessions,\n        metadata: input.item.metadata,\n      },\n    },\n  });\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    'controller' | 'publicOrigin' | 'auth' | 'fleet' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    fleet: deps.fleet,\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              fleet: deps.fleet,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        fleet: deps.fleet,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      memorySettings: deps.domains.memorySettings,\n      customProviders: deps.domains.customProviders,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;AAuFA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAsD;CACtF,MAAM,WAAW,KAAK,YAAY,CAAC;CACnC,MAAM,cAAc,SAAS,qBAAqB,SAAS;CAC3D,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,WAC7B,OAAO,gBAAgB,UAEvB,OAAO,iBAAiB;CAE1B,MAAM,oBAAoB,SAAS,2BAA2B,SAAS;CACvE,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,kBAC7B,OAAO,sBAAsB,UAE7B,OAAO,cAAc;CAEvB,IAAI,KAAK,gBAAgB,kBAAkB,YAAY,OAAO,SAAS,eAAe,UACpF,OAAO,kBAAkB,SAAS,WAAW,YAAY;CAE3D,MAAM,IAAI,MAAM,iFAAiF;AACnG;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,MAAM,SAAS,kBAAkB,MAAM,IAAI;CAC3C,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;CACzF,MAAM,kBAAkB,MAAM,2BAA2B;EACvD,eAAe,OAAO;EACtB,OAAO,MAAM,OAAO;EACpB,kBAAkB,MAAM,OAAO;EAC/B;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK,KAAA;CACjF,IAAI,CAAC,kBAAkB,MAAM,IAAI,MAAM,8DAA8D;CAErG,MAAM,YAAY,QAAQ;EACxB,OAAO,MAAM,OAAO;EACpB,QAAQ,gBAAgB;EACxB,kBAAkB,MAAM,OAAO;EAC/B,WAAW,gBAAgB;EAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;EAC1F,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;EACxE,YAAY,MAAM,OAAO;EACP;EAClB,UAAU;GACR,IAAI,MAAM,KAAK;GACf,MAAM,MAAM;GACZ,OAAO;IACL,gBAAgB,MAAM,KAAK;IAC3B,kBAAkB,MAAM,KAAK;IAC7B,OAAO,MAAM,KAAK;IAClB,QAAQ,CAAC,QAAQ;IACjB,UAAU,MAAM,KAAK;IACrB,UAAU,MAAM,KAAK;GACvB;EACF;CACF,CAAC;AACH;;;;;;;AAQA,SAAgB,wBACd,MAmBA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,OAAO,KAAK;GACd,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,aAAa,KAAK,QAAQ;GAC1B;GACA;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}

package/dist/rules/binding-context.d.ts

@@ -1,5 +1,32 @@
 import type { RequestContext } from '@mastra/core/request-context';
-import type { FactoryRunBindingAddress, FactoryRunBindingSessionAddress } from '../storage/domains/work-items/base.js';
+import type { FactoryRunBindingAddress, FactoryRunBindingRecord, FactoryRunBindingSessionAddress, WorkItemsStorage } from '../storage/domains/work-items/base.js';
+/** Minimal source-control session lookup used to heal recovered session state. */
+export interface FactorySessionSourceLookup {
+    getBySessionId(sessionId: string): Promise<{
+        orgId: string;
+        projectRepositoryId: string;
+        baseBranch: string;
+    } | null>;
+}
 export declare function getFactorySessionCoordinates(requestContext: RequestContext | undefined): FactoryRunBindingSessionAddress | null;
 export declare function getFactorySessionAddress(requestContext: RequestContext | undefined): FactoryRunBindingAddress | null;
+export interface FactorySessionAddressResolution {
+    address: FactoryRunBindingAddress;
+    /** Present only when the address was recovered from the binding table. */
+    binding?: FactoryRunBindingRecord;
+}
+/**
+ * Resolve the bound session address, falling back to the active binding row
+ * when the in-memory session state is missing `factoryProjectId` — a server
+ * crash drops controller sessions, and a resumed session ("Continue") is
+ * recreated with empty state, which silently unregistered the transition
+ * tool. On recovery the lost state is healed back onto the session (including
+ * the `untrustedCheckout`/`baseRef` security posture the start coordinator
+ * originally seeded) so later reads resolve directly.
+ */
+export declare function resolveFactorySessionAddress(options: {
+    requestContext: RequestContext | undefined;
+    storage: Pick<WorkItemsStorage, 'findActiveRunBindingByThread' | 'get'>;
+    sessions?: FactorySessionSourceLookup;
+}): Promise<FactorySessionAddressResolution | null>;
 //# sourceMappingURL=binding-context.d.ts.map

package/dist/rules/binding-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding-context.d.ts","sourceRoot":"","sources":["../../src/rules/binding-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,OAAO,KAAK,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAMvH,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,cAAc,GAAG,SAAS,GACzC,+BAA+B,GAAG,IAAI,CAWxC;AAED,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,wBAAwB,GAAG,IAAI,CAOpH"}
+{"version":3,"file":"binding-context.d.ts","sourceRoot":"","sources":["../../src/rules/binding-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,gBAAgB,EACjB,MAAM,uCAAuC,CAAC;AAW/C,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACvH;AAED,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,cAAc,GAAG,SAAS,GACzC,+BAA+B,GAAG,IAAI,CAWxC;AAED,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,wBAAwB,GAAG,IAAI,CAOpH;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,wBAAwB,CAAC;IAClC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,uBAAuB,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC1D,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,8BAA8B,GAAG,KAAK,CAAC,CAAC;IACxE,QAAQ,CAAC,EAAE,0BAA0B,CAAC;CACvC,GAAG,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAgClD"}

package/dist/rules/binding-context.js

@@ -22,7 +22,72 @@ function getFactorySessionAddress(requestContext) {
 		...coordinates
 	};
 }
+/**
+* Resolve the bound session address, falling back to the active binding row
+* when the in-memory session state is missing `factoryProjectId` — a server
+* crash drops controller sessions, and a resumed session ("Continue") is
+* recreated with empty state, which silently unregistered the transition
+* tool. On recovery the lost state is healed back onto the session (including
+* the `untrustedCheckout`/`baseRef` security posture the start coordinator
+* originally seeded) so later reads resolve directly.
+*/
+async function resolveFactorySessionAddress(options) {
+	const direct = getFactorySessionAddress(options.requestContext);
+	if (direct) return { address: direct };
+	const requestContext = options.requestContext;
+	if (!requestContext || typeof requestContext.get !== "function") return null;
+	const context = requestContext.get("controller");
+	if (!context?.threadId || !context.resourceId) return null;
+	const orgId = getFactoryAuthOrgId(requestContext.get("user"));
+	if (!orgId) return null;
+	const binding = await options.storage.findActiveRunBindingByThread({
+		orgId,
+		threadId: context.threadId,
+		resourceId: context.resourceId,
+		sessionId: context.resourceId
+	});
+	if (!binding) return null;
+	await healRecoveredSessionState({
+		context,
+		binding,
+		storage: options.storage,
+		sessions: options.sessions
+	});
+	return {
+		address: {
+			orgId,
+			factoryProjectId: binding.factoryProjectId,
+			threadId: context.threadId,
+			resourceId: context.resourceId,
+			sessionId: context.resourceId
+		},
+		binding
+	};
+}
+async function healRecoveredSessionState(options) {
+	const { binding } = options;
+	const updates = { factoryProjectId: binding.factoryProjectId };
+	if (binding.role === "review") updates.untrustedCheckout = true;
+	try {
+		const item = await options.storage.get({
+			orgId: binding.orgId,
+			id: binding.workItemId
+		});
+		const foundSession = await options.sessions?.getBySessionId(binding.sessionId) ?? null;
+		const sourceSession = foundSession?.orgId === binding.orgId ? foundSession : null;
+		if (sourceSession) updates.projectRepositoryId = sourceSession.projectRepositoryId;
+		if (updates.untrustedCheckout === true || item?.externalSource?.type === "pull-request") {
+			updates.untrustedCheckout = true;
+			const metadataBaseBranch = item?.metadata?.baseBranch;
+			const baseRef = sourceSession?.baseBranch || (typeof metadataBaseBranch === "string" && metadataBaseBranch ? metadataBaseBranch : void 0);
+			if (baseRef) updates.baseRef = baseRef;
+		}
+	} catch {}
+	try {
+		await options.context.setState(updates);
+	} catch {}
+}
 //#endregion
-export { getFactorySessionAddress, getFactorySessionCoordinates };
+export { getFactorySessionAddress, getFactorySessionCoordinates, resolveFactorySessionAddress };
 
 //# sourceMappingURL=binding-context.js.map

package/dist/rules/binding-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding-context.js","names":[],"sources":["../../src/rules/binding-context.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport type { FactoryAuthUser } from '../auth.js';\nimport { getFactoryAuthOrgId } from '../auth.js';\nimport type { FactoryRunBindingAddress, FactoryRunBindingSessionAddress } from '../storage/domains/work-items/base.js';\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n}\n\nexport function getFactorySessionCoordinates(\n  requestContext: RequestContext | undefined,\n): FactoryRunBindingSessionAddress | null {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as AgentControllerRequestContext<FactorySessionState> | undefined;\n  const factoryProjectId = context?.getState().factoryProjectId;\n  if (!context?.threadId || !context.resourceId || !factoryProjectId) return null;\n  return {\n    factoryProjectId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.resourceId,\n  };\n}\n\nexport function getFactorySessionAddress(requestContext: RequestContext | undefined): FactoryRunBindingAddress | null {\n  const coordinates = getFactorySessionCoordinates(requestContext);\n  if (!coordinates || !requestContext || typeof requestContext.get !== 'function') return null;\n  const user = requestContext.get('user') as FactoryAuthUser | undefined;\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n  return { orgId, ...coordinates };\n}\n"],"mappings":";;AAWA,SAAgB,6BACd,gBACwC;CACxC,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,MAAM,mBAAmB,SAAS,SAAS,CAAC,CAAC;CAC7C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,kBAAkB,OAAO;CAC3E,OAAO;EACL;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB;AACF;AAEA,SAAgB,yBAAyB,gBAA6E;CACpH,MAAM,cAAc,6BAA6B,cAAc;CAC/D,IAAI,CAAC,eAAe,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CAExF,MAAM,QAAQ,oBADD,eAAe,IAAI,MACK,CAAC;CACtC,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO;EAAE;EAAO,GAAG;CAAY;AACjC"}
+{"version":3,"file":"binding-context.js","names":[],"sources":["../../src/rules/binding-context.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport type { FactoryAuthUser } from '../auth.js';\nimport { getFactoryAuthOrgId } from '../auth.js';\nimport type {\n  FactoryRunBindingAddress,\n  FactoryRunBindingRecord,\n  FactoryRunBindingSessionAddress,\n  WorkItemsStorage,\n} from '../storage/domains/work-items/base.js';\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  untrustedCheckout?: boolean;\n  baseRef?: string;\n}\n\ntype FactorySessionControllerContext = AgentControllerRequestContext<FactorySessionState>;\n\n/** Minimal source-control session lookup used to heal recovered session state. */\nexport interface FactorySessionSourceLookup {\n  getBySessionId(sessionId: string): Promise<{ orgId: string; projectRepositoryId: string; baseBranch: string } | null>;\n}\n\nexport function getFactorySessionCoordinates(\n  requestContext: RequestContext | undefined,\n): FactoryRunBindingSessionAddress | null {\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  const factoryProjectId = context?.getState().factoryProjectId;\n  if (!context?.threadId || !context.resourceId || !factoryProjectId) return null;\n  return {\n    factoryProjectId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.resourceId,\n  };\n}\n\nexport function getFactorySessionAddress(requestContext: RequestContext | undefined): FactoryRunBindingAddress | null {\n  const coordinates = getFactorySessionCoordinates(requestContext);\n  if (!coordinates || !requestContext || typeof requestContext.get !== 'function') return null;\n  const user = requestContext.get('user') as FactoryAuthUser | undefined;\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n  return { orgId, ...coordinates };\n}\n\nexport interface FactorySessionAddressResolution {\n  address: FactoryRunBindingAddress;\n  /** Present only when the address was recovered from the binding table. */\n  binding?: FactoryRunBindingRecord;\n}\n\n/**\n * Resolve the bound session address, falling back to the active binding row\n * when the in-memory session state is missing `factoryProjectId` — a server\n * crash drops controller sessions, and a resumed session (\"Continue\") is\n * recreated with empty state, which silently unregistered the transition\n * tool. On recovery the lost state is healed back onto the session (including\n * the `untrustedCheckout`/`baseRef` security posture the start coordinator\n * originally seeded) so later reads resolve directly.\n */\nexport async function resolveFactorySessionAddress(options: {\n  requestContext: RequestContext | undefined;\n  storage: Pick<WorkItemsStorage, 'findActiveRunBindingByThread' | 'get'>;\n  sessions?: FactorySessionSourceLookup;\n}): Promise<FactorySessionAddressResolution | null> {\n  const direct = getFactorySessionAddress(options.requestContext);\n  if (direct) return { address: direct };\n\n  const requestContext = options.requestContext;\n  if (!requestContext || typeof requestContext.get !== 'function') return null;\n  const context = requestContext.get('controller') as FactorySessionControllerContext | undefined;\n  if (!context?.threadId || !context.resourceId) return null;\n  const user = requestContext.get('user') as FactoryAuthUser | undefined;\n  const orgId = getFactoryAuthOrgId(user);\n  if (!orgId) return null;\n\n  const binding = await options.storage.findActiveRunBindingByThread({\n    orgId,\n    threadId: context.threadId,\n    resourceId: context.resourceId,\n    sessionId: context.resourceId,\n  });\n  if (!binding) return null;\n\n  await healRecoveredSessionState({ context, binding, storage: options.storage, sessions: options.sessions });\n\n  return {\n    address: {\n      orgId,\n      factoryProjectId: binding.factoryProjectId,\n      threadId: context.threadId,\n      resourceId: context.resourceId,\n      sessionId: context.resourceId,\n    },\n    binding,\n  };\n}\n\nasync function healRecoveredSessionState(options: {\n  context: FactorySessionControllerContext;\n  binding: FactoryRunBindingRecord;\n  storage: Pick<WorkItemsStorage, 'get'>;\n  sessions?: FactorySessionSourceLookup;\n}): Promise<void> {\n  const { binding } = options;\n  const updates: FactorySessionState = { factoryProjectId: binding.factoryProjectId };\n  // Security posture first, from the binding row alone (no I/O): review-bound\n  // sessions run against attacker-writable checkouts, so `untrustedCheckout`\n  // must survive even if the enrichment lookups below fail transiently.\n  if (binding.role === 'review') {\n    updates.untrustedCheckout = true;\n  }\n  // Best-effort enrichment mirroring the start coordinator's original seed:\n  // PR-sourced work items are untrusted regardless of role, and `baseRef`\n  // restores the trusted instruction source for untrusted checkouts.\n  try {\n    const item = await options.storage.get({ orgId: binding.orgId, id: binding.workItemId });\n    const foundSession = (await options.sessions?.getBySessionId(binding.sessionId)) ?? null;\n    const sourceSession = foundSession?.orgId === binding.orgId ? foundSession : null;\n    if (sourceSession) {\n      updates.projectRepositoryId = sourceSession.projectRepositoryId;\n    }\n    const untrusted = updates.untrustedCheckout === true || item?.externalSource?.type === 'pull-request';\n    if (untrusted) {\n      updates.untrustedCheckout = true;\n      const metadataBaseBranch = item?.metadata?.baseBranch;\n      const baseRef =\n        sourceSession?.baseBranch ||\n        (typeof metadataBaseBranch === 'string' && metadataBaseBranch ? metadataBaseBranch : undefined);\n      if (baseRef) updates.baseRef = baseRef;\n    }\n  } catch {\n    // Enrichment is best-effort; the address itself only needs the binding.\n  }\n  try {\n    await options.context.setState(updates);\n  } catch {\n    // State healing must never block tool registration on the recovered address.\n  }\n}\n"],"mappings":";;AA0BA,SAAgB,6BACd,gBACwC;CACxC,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,MAAM,mBAAmB,SAAS,SAAS,CAAC,CAAC;CAC7C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,cAAc,CAAC,kBAAkB,OAAO;CAC3E,OAAO;EACL;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB;AACF;AAEA,SAAgB,yBAAyB,gBAA6E;CACpH,MAAM,cAAc,6BAA6B,cAAc;CAC/D,IAAI,CAAC,eAAe,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CAExF,MAAM,QAAQ,oBADD,eAAe,IAAI,MACK,CAAC;CACtC,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO;EAAE;EAAO,GAAG;CAAY;AACjC;;;;;;;;;;AAiBA,eAAsB,6BAA6B,SAIC;CAClD,MAAM,SAAS,yBAAyB,QAAQ,cAAc;CAC9D,IAAI,QAAQ,OAAO,EAAE,SAAS,OAAO;CAErC,MAAM,iBAAiB,QAAQ;CAC/B,IAAI,CAAC,kBAAkB,OAAO,eAAe,QAAQ,YAAY,OAAO;CACxE,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,IAAI,CAAC,SAAS,YAAY,CAAC,QAAQ,YAAY,OAAO;CAEtD,MAAM,QAAQ,oBADD,eAAe,IAAI,MACK,CAAC;CACtC,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,UAAU,MAAM,QAAQ,QAAQ,6BAA6B;EACjE;EACA,UAAU,QAAQ;EAClB,YAAY,QAAQ;EACpB,WAAW,QAAQ;CACrB,CAAC;CACD,IAAI,CAAC,SAAS,OAAO;CAErB,MAAM,0BAA0B;EAAE;EAAS;EAAS,SAAS,QAAQ;EAAS,UAAU,QAAQ;CAAS,CAAC;CAE1G,OAAO;EACL,SAAS;GACP;GACA,kBAAkB,QAAQ;GAC1B,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,WAAW,QAAQ;EACrB;EACA;CACF;AACF;AAEA,eAAe,0BAA0B,SAKvB;CAChB,MAAM,EAAE,YAAY;CACpB,MAAM,UAA+B,EAAE,kBAAkB,QAAQ,iBAAiB;CAIlF,IAAI,QAAQ,SAAS,UACnB,QAAQ,oBAAoB;CAK9B,IAAI;EACF,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI;GAAE,OAAO,QAAQ;GAAO,IAAI,QAAQ;EAAW,CAAC;EACvF,MAAM,eAAgB,MAAM,QAAQ,UAAU,eAAe,QAAQ,SAAS,KAAM;EACpF,MAAM,gBAAgB,cAAc,UAAU,QAAQ,QAAQ,eAAe;EAC7E,IAAI,eACF,QAAQ,sBAAsB,cAAc;EAG9C,IADkB,QAAQ,sBAAsB,QAAQ,MAAM,gBAAgB,SAAS,gBACxE;GACb,QAAQ,oBAAoB;GAC5B,MAAM,qBAAqB,MAAM,UAAU;GAC3C,MAAM,UACJ,eAAe,eACd,OAAO,uBAAuB,YAAY,qBAAqB,qBAAqB,KAAA;GACvF,IAAI,SAAS,QAAQ,UAAU;EACjC;CACF,QAAQ,CAER;CACA,IAAI;EACF,MAAM,QAAQ,QAAQ,SAAS,OAAO;CACxC,QAAQ,CAER;AACF"}

package/dist/rules/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/rules/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EASV,YAAY,EACZ,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAwXjE,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,qBAAqB,EAC3B,SAAS,GAAE,qBAA0B,GACpC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAQ/B;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CAAE,GAAG,YAAY,CAW/G;AAED,wBAAgB,mBAAmB,IAAI,YAAY,CAElD"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/rules/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EASV,YAAY,EACZ,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAuajE,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,qBAAqB,EAC3B,SAAS,GAAE,qBAA0B,GACpC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAQ/B;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CAAE,GAAG,YAAY,CAW/G;AAED,wBAAgB,mBAAmB,IAAI,YAAY,CAElD"}