@mastra/factory 0.7.1-alpha.4 → 0.8.0-alpha.10

package/dist/routes/surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport { isFactoryRuleStage } from '../rules/types.js';\nimport type { SandboxFleet } from '../sandbox/fleet.js';\nimport { ensureFactorySourceSession, resolveFactoryDefaultModelId } from '../session/factory-session.js';\nimport { LiveSessions } from '../session/live-sessions.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport type { SourceControlStorage } from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox fleet constructed by the factory (disabled when no machine). */\n  fleet: SandboxFleet;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  factoryTransitionService?: FactoryTransitionService;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\nexport function factoryRuleBranch(item: FactoryBindingPreparationInput['item']): string {\n  const metadata = item.metadata ?? {};\n  const issueNumber = metadata.githubIssueNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'issue' &&\n    typeof issueNumber === 'number'\n  ) {\n    return `factory/issue-${issueNumber}`;\n  }\n  const pullRequestNumber = metadata.githubPullRequestNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'pull-request' &&\n    typeof pullRequestNumber === 'number'\n  ) {\n    return `factory/pr-${pullRequestNumber}`;\n  }\n  if (item.externalSource?.integrationId === 'linear' && typeof metadata.identifier === 'string') {\n    return `factory/linear-${metadata.identifier.toLowerCase()}`;\n  }\n  throw new Error('Factory skill invocation requires a supported issue or pull request identifier.');\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: FactoryStartCoordinator,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  const branch = factoryRuleBranch(input.item);\n  const repositorySlug =\n    typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n  const preparedSession = await ensureFactorySourceSession({\n    sourceControl: github.sourceControlStorage,\n    orgId: input.record.orgId,\n    factoryProjectId: input.record.factoryProjectId,\n    repositorySlug,\n    branch,\n  });\n  const destinationStage = input.item.stages.length === 1 ? input.item.stages[0] : undefined;\n  if (!isFactoryRuleStage(destinationStage))\n    throw new Error('Factory skill invocation requires one exclusive board stage.');\n\n  await coordinator.prepare({\n    orgId: input.record.orgId,\n    userId: preparedSession.userId,\n    factoryProjectId: input.record.factoryProjectId,\n    sessionId: preparedSession.sessionId,\n    defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n    threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n    kickoffKey: input.record.id,\n    destinationStage,\n    workItem: {\n      id: input.item.id,\n      role: input.role,\n      input: {\n        externalSource: input.item.externalSource,\n        parentWorkItemId: input.item.parentWorkItemId,\n        title: input.item.title,\n        stages: ['intake'],\n        sessions: input.item.sessions,\n        metadata: input.item.metadata,\n      },\n    },\n  });\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    'controller' | 'publicOrigin' | 'auth' | 'fleet' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    fleet: deps.fleet,\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              fleet: deps.fleet,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        fleet: deps.fleet,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      memorySettings: deps.domains.memorySettings,\n      customProviders: deps.domains.customProviders,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n          liveSessions: new LiveSessions(deps.controller),\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAyFA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAsD;CACtF,MAAM,WAAW,KAAK,YAAY,CAAC;CACnC,MAAM,cAAc,SAAS,qBAAqB,SAAS;CAC3D,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,WAC7B,OAAO,gBAAgB,UAEvB,OAAO,iBAAiB;CAE1B,MAAM,oBAAoB,SAAS,2BAA2B,SAAS;CACvE,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,kBAC7B,OAAO,sBAAsB,UAE7B,OAAO,cAAc;CAEvB,IAAI,KAAK,gBAAgB,kBAAkB,YAAY,OAAO,SAAS,eAAe,UACpF,OAAO,kBAAkB,SAAS,WAAW,YAAY;CAE3D,MAAM,IAAI,MAAM,iFAAiF;AACnG;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,MAAM,SAAS,kBAAkB,MAAM,IAAI;CAC3C,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;CACzF,MAAM,kBAAkB,MAAM,2BAA2B;EACvD,eAAe,OAAO;EACtB,OAAO,MAAM,OAAO;EACpB,kBAAkB,MAAM,OAAO;EAC/B;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK,KAAA;CACjF,IAAI,CAAC,mBAAmB,gBAAgB,GACtC,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,YAAY,QAAQ;EACxB,OAAO,MAAM,OAAO;EACpB,QAAQ,gBAAgB;EACxB,kBAAkB,MAAM,OAAO;EAC/B,WAAW,gBAAgB;EAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;EAC1F,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;EACxE,YAAY,MAAM,OAAO;EACzB;EACA,UAAU;GACR,IAAI,MAAM,KAAK;GACf,MAAM,MAAM;GACZ,OAAO;IACL,gBAAgB,MAAM,KAAK;IAC3B,kBAAkB,MAAM,KAAK;IAC7B,OAAO,MAAM,KAAK;IAClB,QAAQ,CAAC,QAAQ;IACjB,UAAU,MAAM,KAAK;IACrB,UAAU,MAAM,KAAK;GACvB;EACF;CACF,CAAC;AACH;;;;;;;AAQA,SAAgB,wBACd,MAmBA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,OAAO,KAAK;GACd,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,aAAa,KAAK,QAAQ;GAC1B;GACA;GACA,cAAc,IAAI,aAAa,KAAK,UAAU;EAChD,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}
+{"version":3,"file":"surface.js","names":[],"sources":["../../src/routes/surface.ts"],"sourcesContent":["import type { AuthStorage } from '@mastra/code-sdk/auth/storage';\nimport type { MastraCodeState } from '@mastra/code-sdk/schema';\nimport type { AgentController } from '@mastra/core/agent-controller';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { FactoryStorage } from '@mastra/core/storage';\n\nimport type { FactoryIntegration, IntegrationContext } from '../integrations/base.js';\nimport { getGithubFeatureDiagnostics } from '../integrations/github/config.js';\nimport type { GithubIntegration } from '../integrations/github/integration.js';\nimport type { FactoryBindingPreparationInput } from '../rules/dispatcher.js';\nimport { FactoryStartCoordinator } from '../rules/start-coordinator.js';\nimport { FactoryTransitionService } from '../rules/transition-service.js';\nimport type { FactoryRules } from '../rules/types.js';\nimport { isFactoryRuleStage } from '../rules/types.js';\nimport type { SandboxFleet } from '../sandbox/fleet.js';\nimport { ensureFactorySourceSession, resolveFactoryDefaultModelId } from '../session/factory-session.js';\nimport { LiveSessions } from '../session/live-sessions.js';\nimport type { StateSigner } from '../state-signing.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport type { ChannelIdentityStorage } from '../storage/domains/channel-identity/base.js';\nimport type { ModelCredentialsStorage } from '../storage/domains/credentials/base.js';\nimport type { CustomProvidersStorage } from '../storage/domains/custom-providers/base.js';\nimport type { FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { IntegrationStorage } from '../storage/domains/integrations/base.js';\nimport type { MemorySettingsStorage } from '../storage/domains/memory-settings/base.js';\nimport type { ModelPacksStorage } from '../storage/domains/model-packs/base.js';\nimport type { FactoryProjectsStorage } from '../storage/domains/projects/base.js';\nimport type { QueueHealthStorage } from '../storage/domains/queue-health/base.js';\nimport type { SourceControlStorage } from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { ConfigRoutes } from './config.js';\nimport { invalidateCustomProvidersSnapshots } from './custom-provider-source.js';\nimport { buildFsRoutes } from './fs.js';\nimport { IntakeRoutes } from './intake.js';\nimport { OAuthRoutes } from './oauth.js';\nimport type { RouteAuth } from './route.js';\nimport { SkillRoutes } from './skills.js';\nimport { invalidateTenantCredentialSnapshots } from './tenant-credentials.js';\nimport { WorkItemRoutes } from './work-items.js';\n\nexport interface IntegrationRegistration {\n  integration: FactoryIntegration;\n  ready: boolean;\n  ensureReady: () => Promise<void>;\n}\n\nexport interface FactoryApiRoutesDeps {\n  controllerId: string;\n  controller: AgentController<MastraCodeState>;\n  /** Request-auth seam threaded from the host (no service locator). */\n  auth: RouteAuth;\n  authStorage: AuthStorage;\n  audit: AuditEmitter;\n  fsRoot?: string;\n  publicOrigin: string;\n  stateSigner?: StateSigner;\n  /** Sandbox fleet constructed by the factory (disabled when no machine). */\n  fleet: SandboxFleet;\n  /** Root factory storage backend (distributed locks, app-db diagnostics). */\n  factoryStorage?: FactoryStorage;\n  integrationStorage: IntegrationStorage;\n  sourceControlStorage: SourceControlStorage;\n  /** App-table domain handles, registered and owned by `MastraFactory.prepare()`. */\n  domains: {\n    intake: IntakeStorage;\n    modelCredentials: ModelCredentialsStorage;\n    memorySettings: MemorySettingsStorage;\n    customProviders: CustomProvidersStorage;\n    filesystem: FilesystemStorage;\n    modelPacks: ModelPacksStorage;\n    projects: FactoryProjectsStorage;\n    queueHealth: QueueHealthStorage;\n    workItems: WorkItemsStorage;\n    channelIdentity: ChannelIdentityStorage;\n  };\n  integrations?: IntegrationRegistration[];\n  intakeReady: boolean;\n  factoryReady: boolean;\n  /** Resolved Factory rule set, threaded from the host (no service locator). */\n  rules: FactoryRules;\n  factoryTransitionService?: FactoryTransitionService;\n  sessionRetirement?: import('../sandbox/session-retirement.js').SessionRetirementCoordinator;\n  onFactoryRuntime?: (runtime: {\n    transitionService: FactoryTransitionService;\n    prepareBinding?: (input: FactoryBindingPreparationInput) => Promise<void>;\n  }) => void;\n}\n\nfunction guardIntegrationRoutes({\n  integration,\n  ready,\n  ensureReady,\n  routes,\n}: IntegrationRegistration & { routes: ApiRoute[] }): ApiRoute[] {\n  if (ready) return routes;\n  return routes.map(route => {\n    if ('handler' in route) {\n      const handler = route.handler;\n      return {\n        ...route,\n        handler: async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context, async () => {});\n        },\n      };\n    }\n\n    const createHandler = route.createHandler;\n    return {\n      ...route,\n      createHandler: async (args: Parameters<typeof createHandler>[0]) => {\n        const handler = await createHandler(args);\n        return async (context: Parameters<typeof handler>[0]) => {\n          try {\n            await ensureReady();\n          } catch {\n            return context.json(\n              { error: 'integration_unavailable', message: `${integration.id} integration is unavailable.` },\n              503,\n            );\n          }\n          return handler(context);\n        };\n      },\n    };\n  });\n}\n\nexport function factoryRuleBranch(item: FactoryBindingPreparationInput['item']): string {\n  const metadata = item.metadata ?? {};\n  const issueNumber = metadata.githubIssueNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'issue' &&\n    typeof issueNumber === 'number'\n  ) {\n    return `factory/issue-${issueNumber}`;\n  }\n  const pullRequestNumber = metadata.githubPullRequestNumber ?? metadata.number;\n  if (\n    item.externalSource?.integrationId === 'github' &&\n    item.externalSource.type === 'pull-request' &&\n    typeof pullRequestNumber === 'number'\n  ) {\n    return `factory/pr-${pullRequestNumber}`;\n  }\n  if (item.externalSource?.integrationId === 'linear' && typeof metadata.identifier === 'string') {\n    return `factory/linear-${metadata.identifier.toLowerCase()}`;\n  }\n  throw new Error('Factory skill invocation requires a supported issue or pull request identifier.');\n}\n\n/**\n * Start a factory run for a rule binding: ensure the source-control session the\n * coordinator requires, then hand it to `prepare` along with the factory's\n * default model. Exported for tests — this is the autonomous entry point with no\n * browser and no interactive user, so nothing else would catch a regression in\n * what it forwards.\n */\nexport async function prepareFactoryRuleBinding(\n  github: GithubIntegration,\n  coordinator: FactoryStartCoordinator,\n  projects: FactoryProjectsStorage,\n  input: FactoryBindingPreparationInput,\n): Promise<void> {\n  const branch = factoryRuleBranch(input.item);\n  const repositorySlug =\n    typeof input.item.metadata?.repository === 'string' ? input.item.metadata.repository : undefined;\n  const preparedSession = await ensureFactorySourceSession({\n    sourceControl: github.sourceControlStorage,\n    orgId: input.record.orgId,\n    factoryProjectId: input.record.factoryProjectId,\n    repositorySlug,\n    branch,\n  });\n  const destinationStage = input.item.stages.length === 1 ? input.item.stages[0] : undefined;\n  if (!isFactoryRuleStage(destinationStage))\n    throw new Error('Factory skill invocation requires one exclusive board stage.');\n\n  await coordinator.prepare({\n    orgId: input.record.orgId,\n    userId: preparedSession.userId,\n    factoryProjectId: input.record.factoryProjectId,\n    sessionId: preparedSession.sessionId,\n    defaultModelId: await resolveFactoryDefaultModelId(projects, input.record.factoryProjectId),\n    threadTitle: `${input.role === 'review' ? 'PR' : 'Issue'}: ${input.item.title}`,\n    kickoffKey: input.record.id,\n    destinationStage,\n    workItem: {\n      id: input.item.id,\n      role: input.role,\n      input: {\n        externalSource: input.item.externalSource,\n        parentWorkItemId: input.item.parentWorkItemId,\n        title: input.item.title,\n        stages: ['intake'],\n        sessions: input.item.sessions,\n        metadata: input.item.metadata,\n      },\n    },\n  });\n}\n\n/**\n * Build the {@link IntegrationContext} handed to an integration when the\n * factory collects its capabilities (routes, workers). One shape everywhere:\n * `assembleFactoryApiRoutes` uses it per registration, and `MastraFactory` uses it\n * when collecting integration workers at finalize.\n */\nexport function buildIntegrationContext(\n  deps: Pick<\n    FactoryApiRoutesDeps,\n    'controller' | 'publicOrigin' | 'auth' | 'fleet' | 'factoryStorage' | 'integrationStorage' | 'sourceControlStorage'\n  > & {\n    stateSigner: StateSigner;\n    emitAudit?: AuditEmitter['emit'];\n    rules: FactoryRules;\n    factoryReady: boolean;\n    domains: Pick<\n      FactoryApiRoutesDeps['domains'],\n      'projects' | 'intake' | 'workItems' | 'channelIdentity' | 'memorySettings'\n    >;\n    /**\n     * Stable id of the registered source-control-owning integration (today:\n     * `'github'` when registered). Every call site must derive and pass it so\n     * `routes()`, `channels()`, and `workers()` all see the same context shape.\n     */\n    sourceControlOwnerId?: string;\n  },\n  integrationId: string,\n): IntegrationContext {\n  return {\n    auth: deps.auth,\n    fleet: deps.fleet,\n    factoryStorage: deps.factoryStorage,\n    baseUrl: deps.publicOrigin,\n    controller: deps.controller,\n    stateSigner: deps.stateSigner,\n    storage: {\n      generic: deps.integrationStorage.forIntegration(integrationId),\n      sourceControl: deps.sourceControlStorage.forIntegration(integrationId),\n      ...(deps.sourceControlOwnerId\n        ? { sourceControlOwner: deps.sourceControlStorage.forIntegration(deps.sourceControlOwnerId) }\n        : {}),\n      projects: deps.domains.projects,\n      intake: deps.domains.intake,\n      channelIdentity: deps.domains.channelIdentity,\n      memorySettings: deps.domains.memorySettings,\n    },\n    ...(deps.factoryReady ? { rules: { config: deps.rules, workItems: deps.domains.workItems } } : {}),\n    ...(deps.emitAudit ? { hooks: { emitAudit: deps.emitAudit } } : {}),\n  };\n}\n\n/**\n * Disabled-status stub for the well-known integration ids. The SPA polls\n * `/web/github/status` and `/web/linear/status` unconditionally, so when an\n * integration is absent (or not ready) the status contract must still hold.\n * Unknown custom ids get no stub — the SPA doesn't poll them.\n */\nfunction disabledIntegrationStatusRoutes(deps: FactoryApiRoutesDeps, id: string, configured = false): ApiRoute[] {\n  if (id === 'github') {\n    return [\n      registerApiRoute('/web/github/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            installations: [],\n            reason: 'missing_config',\n            diagnostics: getGithubFeatureDiagnostics({\n              github: undefined,\n              auth: deps.auth,\n              appDbConfigured: deps.factoryStorage !== undefined,\n              stateSigner: deps.stateSigner,\n              fleet: deps.fleet,\n            }),\n          }),\n      }),\n    ];\n  }\n  if (id === 'linear') {\n    return [\n      registerApiRoute('/web/linear/status', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: c =>\n          c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: {\n              linearAppConfigured: configured,\n              factoryAuthEnabled: deps.auth.enabled(),\n              appDbConfigured: true,\n            },\n          }),\n      }),\n    ];\n  }\n  return [];\n}\n\n/**\n * Stub for `GET /web/channel-accounts` when NO Slack integration is\n * registered. The SPA's Connections section polls the path unconditionally;\n * without a stub the SPA fallback serves HTML, which the UI can only read as\n * \"old server / unknown\". The machine-readable reason lets it say the truth:\n * the integration isn't registered.\n *\n * Mounted only for ABSENT slack — a registered integration owns the path via\n * its connect routes (or, when the state signer is unstable, gets no routes\n * at all and the UI falls back to the generic copy). Static payload, leaks\n * nothing → no auth needed, same posture as the github/linear stubs.\n */\nfunction absentSlackChannelAccountsRoutes(): ApiRoute[] {\n  return [\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: c => c.json({ accounts: [], canConnect: false, reason: 'not_registered' }),\n    }),\n  ];\n}\n\n/**\n * Assemble the custom `/web/*` API routes as Mastra `server.apiRoutes`:\n *   - fs browser routes (project picker), confined to `fsRoot`\n *   - config routes (provider/API-key/model-pack/OM management)\n *   - every registered integration's `routes()` surface (full set when ready,\n *     disabled-status stub otherwise), plus stubs for absent known ids\n */\nexport function assembleFactoryApiRoutes(deps: FactoryApiRoutesDeps): ApiRoute[] {\n  const emitAudit: AuditEmitter['emit'] = args => deps.audit.emit(args);\n  const registrations = deps.integrations ?? [];\n  const githubRegistration = registrations.find(({ integration }) => integration.id === 'github');\n  const githubStorage = githubRegistration ? deps.sourceControlStorage.forIntegration('github') : undefined;\n  const githubIntegration = githubRegistration?.integration as GithubIntegration | undefined;\n\n  const integrationRoutes = registrations.flatMap(registration => {\n    const { integration } = registration;\n    if (!deps.stateSigner) return disabledIntegrationStatusRoutes(deps, integration.id, true);\n    const context = buildIntegrationContext(\n      {\n        ...deps,\n        stateSigner: deps.stateSigner,\n        emitAudit,\n        ...(githubRegistration ? { sourceControlOwnerId: 'github' } : {}),\n      },\n      integration.id,\n    );\n    return guardIntegrationRoutes({ ...registration, routes: integration.routes(context) });\n  });\n  // Absent known integrations still get their disabled-status stub.\n  const absentStubs = ['github', 'linear']\n    .filter(id => !registrations.some(({ integration }) => integration.id === id))\n    .flatMap(id => disabledIntegrationStatusRoutes(deps, id));\n  // Absent slack gets the channel-accounts not-registered stub (registered\n  // slack owns the path via its own connect routes).\n  const slackAbsentStubs = registrations.some(({ integration }) => integration.id === 'slack')\n    ? []\n    : absentSlackChannelAccountsRoutes();\n\n  const transitionService = deps.factoryReady\n    ? (deps.factoryTransitionService ??\n      new FactoryTransitionService({ rules: deps.rules, storage: deps.domains.workItems }))\n    : undefined;\n  const startCoordinator = transitionService\n    ? new FactoryStartCoordinator(\n        deps.controller,\n        deps.domains.workItems,\n        transitionService,\n        githubIntegration?.sourceControlStorage,\n        deps.domains.memorySettings,\n      )\n    : undefined;\n  if (transitionService && startCoordinator) {\n    deps.onFactoryRuntime?.({\n      transitionService,\n      ...(githubIntegration\n        ? {\n            prepareBinding: (input: FactoryBindingPreparationInput) =>\n              prepareFactoryRuleBinding(githubIntegration, startCoordinator, deps.domains.projects, input),\n          }\n        : {}),\n    });\n  }\n\n  return [\n    ...buildFsRoutes({\n      root: deps.fsRoot,\n      sessionFs: {\n        auth: deps.auth,\n        fleet: deps.fleet,\n        sessions: deps.sourceControlStorage.forIntegration('github').sessions,\n        filesystem: deps.domains.filesystem,\n      },\n    }),\n    ...new ConfigRoutes({\n      auth: deps.auth,\n      controller: deps.controller,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      modelPacks: deps.domains.modelPacks,\n      memorySettings: deps.domains.memorySettings,\n      customProviders: deps.domains.customProviders,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n      onCustomProvidersChanged: invalidateCustomProvidersSnapshots,\n    }).routes(),\n    ...new OAuthRoutes({\n      auth: deps.auth,\n      authStorage: deps.authStorage,\n      modelCredentials: deps.domains.modelCredentials,\n      onCredentialsChanged: invalidateTenantCredentialSnapshots,\n    }).routes(),\n    ...new SkillRoutes({\n      auth: deps.auth,\n      controllerId: deps.controllerId,\n      controller: deps.controller,\n      sourceControlStorage: githubStorage,\n      ensureSourceControlReady: githubRegistration?.ensureReady,\n    }).routes(),\n    ...integrationRoutes,\n    ...absentStubs,\n    ...slackAbsentStubs,\n    ...(deps.intakeReady\n      ? new IntakeRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          intake: deps.domains.intake,\n          projects: deps.domains.projects,\n          integrations: (deps.integrations ?? []).flatMap(({ integration }) =>\n            integration.intake ? [{ id: integration.id, intake: integration.intake }] : [],\n          ),\n        }).routes()\n      : []),\n    ...(deps.factoryReady\n      ? new WorkItemRoutes({\n          auth: deps.auth,\n          audit: deps.audit,\n          projects: deps.domains.projects,\n          workItems: deps.domains.workItems,\n          queueHealth: deps.domains.queueHealth,\n          transitionService,\n          startCoordinator,\n          liveSessions: new LiveSessions(deps.controller),\n        }).routes()\n      : []),\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0FA,SAAS,uBAAuB,EAC9B,aACA,OACA,aACA,UAC+D;CAC/D,IAAI,OAAO,OAAO;CAClB,OAAO,OAAO,KAAI,UAAS;EACzB,IAAI,aAAa,OAAO;GACtB,MAAM,UAAU,MAAM;GACtB,OAAO;IACL,GAAG;IACH,SAAS,OAAO,YAA2C;KACzD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC;IACxC;GACF;EACF;EAEA,MAAM,gBAAgB,MAAM;EAC5B,OAAO;GACL,GAAG;GACH,eAAe,OAAO,SAA8C;IAClE,MAAM,UAAU,MAAM,cAAc,IAAI;IACxC,OAAO,OAAO,YAA2C;KACvD,IAAI;MACF,MAAM,YAAY;KACpB,QAAQ;MACN,OAAO,QAAQ,KACb;OAAE,OAAO;OAA2B,SAAS,GAAG,YAAY,GAAG;MAA8B,GAC7F,GACF;KACF;KACA,OAAO,QAAQ,OAAO;IACxB;GACF;EACF;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAsD;CACtF,MAAM,WAAW,KAAK,YAAY,CAAC;CACnC,MAAM,cAAc,SAAS,qBAAqB,SAAS;CAC3D,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,WAC7B,OAAO,gBAAgB,UAEvB,OAAO,iBAAiB;CAE1B,MAAM,oBAAoB,SAAS,2BAA2B,SAAS;CACvE,IACE,KAAK,gBAAgB,kBAAkB,YACvC,KAAK,eAAe,SAAS,kBAC7B,OAAO,sBAAsB,UAE7B,OAAO,cAAc;CAEvB,IAAI,KAAK,gBAAgB,kBAAkB,YAAY,OAAO,SAAS,eAAe,UACpF,OAAO,kBAAkB,SAAS,WAAW,YAAY;CAE3D,MAAM,IAAI,MAAM,iFAAiF;AACnG;;;;;;;;AASA,eAAsB,0BACpB,QACA,aACA,UACA,OACe;CACf,MAAM,SAAS,kBAAkB,MAAM,IAAI;CAC3C,MAAM,iBACJ,OAAO,MAAM,KAAK,UAAU,eAAe,WAAW,MAAM,KAAK,SAAS,aAAa,KAAA;CACzF,MAAM,kBAAkB,MAAM,2BAA2B;EACvD,eAAe,OAAO;EACtB,OAAO,MAAM,OAAO;EACpB,kBAAkB,MAAM,OAAO;EAC/B;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,MAAM,KAAK,OAAO,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK,KAAA;CACjF,IAAI,CAAC,mBAAmB,gBAAgB,GACtC,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,YAAY,QAAQ;EACxB,OAAO,MAAM,OAAO;EACpB,QAAQ,gBAAgB;EACxB,kBAAkB,MAAM,OAAO;EAC/B,WAAW,gBAAgB;EAC3B,gBAAgB,MAAM,6BAA6B,UAAU,MAAM,OAAO,gBAAgB;EAC1F,aAAa,GAAG,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,MAAM,KAAK;EACxE,YAAY,MAAM,OAAO;EACzB;EACA,UAAU;GACR,IAAI,MAAM,KAAK;GACf,MAAM,MAAM;GACZ,OAAO;IACL,gBAAgB,MAAM,KAAK;IAC3B,kBAAkB,MAAM,KAAK;IAC7B,OAAO,MAAM,KAAK;IAClB,QAAQ,CAAC,QAAQ;IACjB,UAAU,MAAM,KAAK;IACrB,UAAU,MAAM,KAAK;GACvB;EACF;CACF,CAAC;AACH;;;;;;;AAQA,SAAgB,wBACd,MAmBA,eACoB;CACpB,OAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,SAAS;GACP,SAAS,KAAK,mBAAmB,eAAe,aAAa;GAC7D,eAAe,KAAK,qBAAqB,eAAe,aAAa;GACrE,GAAI,KAAK,uBACL,EAAE,oBAAoB,KAAK,qBAAqB,eAAe,KAAK,oBAAoB,EAAE,IAC1F,CAAC;GACL,UAAU,KAAK,QAAQ;GACvB,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,KAAK,QAAQ;GAC9B,gBAAgB,KAAK,QAAQ;EAC/B;EACA,GAAI,KAAK,eAAe,EAAE,OAAO;GAAE,QAAQ,KAAK;GAAO,WAAW,KAAK,QAAQ;EAAU,EAAE,IAAI,CAAC;EAChG,GAAI,KAAK,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,IAAI,CAAC;CACnE;AACF;;;;;;;AAQA,SAAS,gCAAgC,MAA4B,IAAY,aAAa,OAAmB;CAC/G,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,eAAe,CAAC;GAChB,QAAQ;GACR,aAAa,4BAA4B;IACvC,QAAQ,KAAA;IACR,MAAM,KAAK;IACX,iBAAiB,KAAK,mBAAmB,KAAA;IACzC,aAAa,KAAK;IAClB,OAAO,KAAK;GACd,CAAC;EACH,CAAC;CACL,CAAC,CACH;CAEF,IAAI,OAAO,UACT,OAAO,CACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,UAAS,MACP,EAAE,KAAK;GACL,SAAS;GACT,WAAW;GACX,WAAW;GACX,QAAQ;GACR,aAAa;IACX,qBAAqB;IACrB,oBAAoB,KAAK,KAAK,QAAQ;IACtC,iBAAiB;GACnB;EACF,CAAC;CACL,CAAC,CACH;CAEF,OAAO,CAAC;AACV;;;;;;;;;;;;;AAcA,SAAS,mCAA+C;CACtD,OAAO,CACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,UAAS,MAAK,EAAE,KAAK;GAAE,UAAU,CAAC;GAAG,YAAY;GAAO,QAAQ;EAAiB,CAAC;CACpF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAAyB,MAAwC;CAC/E,MAAM,aAAkC,SAAQ,KAAK,MAAM,KAAK,IAAI;CACpE,MAAM,gBAAgB,KAAK,gBAAgB,CAAC;CAC5C,MAAM,qBAAqB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,QAAQ;CAC9F,MAAM,gBAAgB,qBAAqB,KAAK,qBAAqB,eAAe,QAAQ,IAAI,KAAA;CAChG,MAAM,oBAAoB,oBAAoB;CAE9C,MAAM,oBAAoB,cAAc,SAAQ,iBAAgB;EAC9D,MAAM,EAAE,gBAAgB;EACxB,IAAI,CAAC,KAAK,aAAa,OAAO,gCAAgC,MAAM,YAAY,IAAI,IAAI;EACxF,MAAM,UAAU,wBACd;GACE,GAAG;GACH,aAAa,KAAK;GAClB;GACA,GAAI,qBAAqB,EAAE,sBAAsB,SAAS,IAAI,CAAC;EACjE,GACA,YAAY,EACd;EACA,OAAO,uBAAuB;GAAE,GAAG;GAAc,QAAQ,YAAY,OAAO,OAAO;EAAE,CAAC;CACxF,CAAC;CAED,MAAM,cAAc,CAAC,UAAU,QAAQ,CAAC,CACrC,QAAO,OAAM,CAAC,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,EAAE,CAAC,CAAC,CAC7E,SAAQ,OAAM,gCAAgC,MAAM,EAAE,CAAC;CAG1D,MAAM,mBAAmB,cAAc,MAAM,EAAE,kBAAkB,YAAY,OAAO,OAAO,IACvF,CAAC,IACD,iCAAiC;CAErC,MAAM,oBAAoB,KAAK,eAC1B,KAAK,4BACN,IAAI,yBAAyB;EAAE,OAAO,KAAK;EAAO,SAAS,KAAK,QAAQ;CAAU,CAAC,IACnF,KAAA;CACJ,MAAM,mBAAmB,oBACrB,IAAI,wBACF,KAAK,YACL,KAAK,QAAQ,WACb,mBACA,mBAAmB,sBACnB,KAAK,QAAQ,cACf,IACA,KAAA;CACJ,IAAI,qBAAqB,kBACvB,KAAK,mBAAmB;EACtB;EACA,GAAI,oBACA,EACE,iBAAiB,UACf,0BAA0B,mBAAmB,kBAAkB,KAAK,QAAQ,UAAU,KAAK,EAC/F,IACA,CAAC;CACP,CAAC;CAGH,OAAO;EACL,GAAG,cAAc;GACf,MAAM,KAAK;GACX,WAAW;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,UAAU,KAAK,qBAAqB,eAAe,QAAQ,CAAC,CAAC;IAC7D,YAAY,KAAK,QAAQ;GAC3B;EACF,CAAC;EACD,GAAG,IAAI,aAAa;GAClB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,YAAY,KAAK,QAAQ;GACzB,gBAAgB,KAAK,QAAQ;GAC7B,iBAAiB,KAAK,QAAQ;GAC9B,sBAAsB;GACtB,0BAA0B;EAC5B,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,kBAAkB,KAAK,QAAQ;GAC/B,sBAAsB;EACxB,CAAC,CAAC,CAAC,OAAO;EACV,GAAG,IAAI,YAAY;GACjB,MAAM,KAAK;GACX,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,sBAAsB;GACtB,0BAA0B,oBAAoB;EAChD,CAAC,CAAC,CAAC,OAAO;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAI,KAAK,cACL,IAAI,aAAa;GACf,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;GACvB,eAAe,KAAK,gBAAgB,CAAC,EAAA,CAAG,SAAS,EAAE,kBACjD,YAAY,SAAS,CAAC;IAAE,IAAI,YAAY;IAAI,QAAQ,YAAY;GAAO,CAAC,IAAI,CAAC,CAC/E;EACF,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;EACL,GAAI,KAAK,eACL,IAAI,eAAe;GACjB,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK,QAAQ;GACvB,WAAW,KAAK,QAAQ;GACxB,aAAa,KAAK,QAAQ;GAC1B;GACA;GACA,cAAc,IAAI,aAAa,KAAK,UAAU;EAChD,CAAC,CAAC,CAAC,OAAO,IACV,CAAC;CACP;AACF"}

package/dist/rules/start-coordinator.js

@@ -1,6 +1,6 @@
 import { hydrateFactorySession } from "../session/factory-session.js";
-import { formatSkillActivation } from "@mastra/core/workspace";
 import { RequestContext } from "@mastra/core/request-context";
+import { formatSkillActivation } from "@mastra/core/workspace";
 //#region src/rules/start-coordinator.ts
 var FactoryStartTransitionError = class extends Error {
 	result;

package/dist/sandbox/session-retirement.d.ts

@@ -0,0 +1,40 @@
+import type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../storage/domains/work-items/base.js';
+import type { SandboxFleet } from './fleet.js';
+type RetirementFleet = Pick<SandboxFleet, 'provider' | 'reattachSandbox' | 'teardownSandbox'>;
+type WarningLogger = (message: string, details: Record<string, unknown>) => void;
+export interface SessionRetirementCoordinatorOptions {
+    fleet: RetirementFleet;
+    invalidateSession?: (sessionId: string) => Promise<void> | void;
+    warn?: WarningLogger;
+}
+export interface RetireSessionInput {
+    sourceControl: SourceControlStorageHandle;
+    orgId: string;
+    sessionId: string;
+    deleteSession: boolean;
+}
+/**
+ * Owns terminal and destructive session cleanup. Each session is serialized so
+ * duplicate role bindings and competing deletion/transition requests cannot
+ * run teardown concurrently. Once the sandbox binding is cleared, later calls
+ * are idempotent no-ops apart from cache invalidation or requested row deletion.
+ */
+export declare class SessionRetirementCoordinator {
+    #private;
+    constructor(options: SessionRetirementCoordinatorOptions);
+    retireSession(input: RetireSessionInput): Promise<void>;
+    retireWorkItemSessions(options: {
+        workItems: Pick<WorkItemsStorage, 'get'>;
+        sourceControl: SourceControlStorageHandle;
+        orgId: string;
+        workItemId: string;
+    }): Promise<void>;
+    retireProjectRepositorySessions(options: {
+        sourceControl: SourceControlStorageHandle;
+        orgId: string;
+        projectRepositoryId: string;
+    }): Promise<void>;
+}
+export {};
+//# sourceMappingURL=session-retirement.d.ts.map

package/dist/sandbox/session-retirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-retirement.d.ts","sourceRoot":"","sources":["../../src/sandbox/session-retirement.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAGV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAA+C,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5F,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,iBAAiB,GAAG,iBAAiB,CAAC,CAAC;AAC9F,KAAK,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAEjF,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,eAAe,CAAC;IACvB,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,0BAA0B,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;CACxB;AAQD;;;;;GAKG;AACH,qBAAa,4BAA4B;;gBAM3B,OAAO,EAAE,mCAAmC;IAMlD,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWvD,sBAAsB,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACzC,aAAa,EAAE,0BAA0B,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBX,+BAA+B,CAAC,OAAO,EAAE;QAC7C,aAAa,EAAE,0BAA0B,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;CAwLlB"}

package/dist/sandbox/session-retirement.js

@@ -0,0 +1,221 @@
+import { DEFAULT_COMMAND_TIMEOUT_MS, runWorktreeTeardown } from "../integrations/github/sandbox.js";
+import { cleanReleasedSandbox } from "../integrations/github/sandbox-release.js";
+//#region src/sandbox/session-retirement.ts
+function boundedError(error) {
+	const detail = error instanceof Error ? error.message : String(error);
+	if (detail.length <= 2e3) return detail;
+	return `${detail.slice(0, 200)}...${detail.slice(-1797)}`;
+}
+/**
+* Owns terminal and destructive session cleanup. Each session is serialized so
+* duplicate role bindings and competing deletion/transition requests cannot
+* run teardown concurrently. Once the sandbox binding is cleared, later calls
+* are idempotent no-ops apart from cache invalidation or requested row deletion.
+*/
+var SessionRetirementCoordinator = class {
+	#fleet;
+	#invalidateSession;
+	#warn;
+	#locks = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#fleet = options.fleet;
+		this.#invalidateSession = options.invalidateSession ?? (() => {});
+		this.#warn = options.warn ?? ((message, details) => console.warn(`[Mastra Factory] ${message}`, details));
+	}
+	async retireSession(input) {
+		const current = (this.#locks.get(input.sessionId) ?? Promise.resolve()).catch(() => {}).then(() => this.#retireSession(input));
+		this.#locks.set(input.sessionId, current);
+		try {
+			await current;
+		} finally {
+			if (this.#locks.get(input.sessionId) === current) this.#locks.delete(input.sessionId);
+		}
+	}
+	async retireWorkItemSessions(options) {
+		const item = await options.workItems.get({
+			orgId: options.orgId,
+			id: options.workItemId
+		});
+		if (!item) return;
+		const sessionIds = [...new Set(Object.values(item.sessions).map((session) => session.sessionId))];
+		await Promise.all(sessionIds.map((sessionId) => this.retireSession({
+			sourceControl: options.sourceControl,
+			orgId: options.orgId,
+			sessionId,
+			deleteSession: false
+		})));
+	}
+	async retireProjectRepositorySessions(options) {
+		const sessions = await options.sourceControl.sessions.listByProjectRepository({ projectRepositoryId: options.projectRepositoryId });
+		await Promise.all(sessions.map((session) => this.retireSession({
+			sourceControl: options.sourceControl,
+			orgId: options.orgId,
+			sessionId: session.sessionId,
+			deleteSession: true
+		})));
+	}
+	async #retireSession(input) {
+		const session = await input.sourceControl.sessions.getBySessionId(input.sessionId);
+		if (!session || session.orgId !== input.orgId) return;
+		try {
+			let projectRepository;
+			try {
+				projectRepository = await input.sourceControl.projectRepositories.get({
+					orgId: input.orgId,
+					id: session.projectRepositoryId
+				});
+			} catch (error) {
+				this.#warn("Factory repository settings could not be loaded for session retirement", {
+					orgId: session.orgId,
+					sessionId: session.sessionId,
+					projectRepositoryId: session.projectRepositoryId,
+					error: boundedError(error)
+				});
+			}
+			let sandbox;
+			if (session.sandboxId && session.sandboxWorkdir) {
+				try {
+					sandbox = await this.#fleet.reattachSandbox(session.sandboxId, {
+						actingUserId: session.userId,
+						...this.#fleet.provider === "local" ? { workingDirectory: session.sandboxWorkdir } : {}
+					});
+				} catch (error) {
+					this.#warn("Factory session sandbox could not be reattached for retirement", {
+						orgId: session.orgId,
+						sessionId: session.sessionId,
+						projectRepositoryId: session.projectRepositoryId,
+						sandboxId: session.sandboxId,
+						error: boundedError(error)
+					});
+				}
+				if (sandbox && projectRepository?.teardownCommand) try {
+					await runWorktreeTeardown(sandbox, session.sandboxWorkdir, projectRepository.teardownCommand, { timeoutMs: DEFAULT_COMMAND_TIMEOUT_MS });
+				} catch (error) {
+					this.#warn("Factory worktree teardown failed", {
+						orgId: session.orgId,
+						sessionId: session.sessionId,
+						projectRepositoryId: session.projectRepositoryId,
+						sandboxId: session.sandboxId,
+						error: boundedError(error)
+					});
+				}
+				if (this.#fleet.provider === "local") await this.#destroyLocalSandbox(input.sourceControl, session, sandbox);
+				else await this.#releaseRemoteSandbox(input.sourceControl, session, sandbox);
+			}
+		} finally {
+			try {
+				await this.#invalidateSession(session.sessionId);
+			} catch (error) {
+				this.#warn("Factory session workspace cache invalidation failed", {
+					orgId: session.orgId,
+					sessionId: session.sessionId,
+					projectRepositoryId: session.projectRepositoryId,
+					error: boundedError(error)
+				});
+			}
+			if (input.deleteSession) await input.sourceControl.sessions.delete(session.id);
+		}
+	}
+	async #releaseRemoteSandbox(sourceControl, session, sandbox) {
+		const sandboxId = session.sandboxId;
+		const sandboxWorkdir = session.sandboxWorkdir;
+		if (!sandboxId || !sandboxWorkdir) return;
+		await cleanReleasedSandbox({
+			fleet: this.#fleet,
+			sourceControl,
+			orgId: session.orgId,
+			projectRepositoryId: session.projectRepositoryId,
+			sandboxId,
+			sandboxWorkdir,
+			actingUserId: session.userId,
+			...sandbox ? { sandbox } : {}
+		});
+		try {
+			await sourceControl.sandboxPool.release({
+				orgId: session.orgId,
+				projectRepositoryId: session.projectRepositoryId,
+				userId: session.userId,
+				sandboxId,
+				sandboxWorkdir
+			});
+		} catch (error) {
+			this.#warn("Factory remote sandbox release failed", {
+				orgId: session.orgId,
+				sessionId: session.sessionId,
+				projectRepositoryId: session.projectRepositoryId,
+				sandboxId,
+				error: boundedError(error)
+			});
+		}
+		try {
+			await sourceControl.sessions.setSandbox({
+				id: session.id,
+				sandboxId: null,
+				sandboxWorkdir
+			});
+		} catch (error) {
+			this.#warn("Factory remote sandbox binding could not be cleared", {
+				orgId: session.orgId,
+				sessionId: session.sessionId,
+				projectRepositoryId: session.projectRepositoryId,
+				sandboxId,
+				error: boundedError(error)
+			});
+		}
+	}
+	async #destroyLocalSandbox(sourceControl, session, sandbox) {
+		const sandboxWorkdir = session.sandboxWorkdir ?? "";
+		const binding = {
+			get sandboxId() {
+				return session.sandboxId;
+			},
+			setSandboxId: async (sandboxId) => {
+				await sourceControl.sessions.setSandbox({
+					id: session.id,
+					sandboxId,
+					sandboxWorkdir
+				});
+				session.sandboxId = sandboxId;
+			},
+			clear: async () => {
+				await sourceControl.sessions.setSandbox({
+					id: session.id,
+					sandboxId: null,
+					sandboxWorkdir
+				});
+				session.sandboxId = null;
+			}
+		};
+		try {
+			await this.#fleet.teardownSandbox(binding, sandbox);
+		} catch (error) {
+			this.#warn("Factory local sandbox destruction failed", {
+				orgId: session.orgId,
+				sessionId: session.sessionId,
+				projectRepositoryId: session.projectRepositoryId,
+				sandboxId: session.sandboxId,
+				error: boundedError(error)
+			});
+		}
+		if (session.sandboxId) try {
+			await sourceControl.sessions.setSandbox({
+				id: session.id,
+				sandboxId: null,
+				sandboxWorkdir
+			});
+			session.sandboxId = null;
+		} catch (error) {
+			this.#warn("Factory local sandbox binding could not be cleared", {
+				orgId: session.orgId,
+				sessionId: session.sessionId,
+				projectRepositoryId: session.projectRepositoryId,
+				sandboxId: session.sandboxId,
+				error: boundedError(error)
+			});
+		}
+	}
+};
+//#endregion
+export { SessionRetirementCoordinator };
+
+//# sourceMappingURL=session-retirement.js.map

package/dist/sandbox/session-retirement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-retirement.js","names":["#fleet","#invalidateSession","#warn","#locks","#retireSession","#destroyLocalSandbox","#releaseRemoteSandbox"],"sources":["../../src/sandbox/session-retirement.ts"],"sourcesContent":["import { cleanReleasedSandbox } from '../integrations/github/sandbox-release.js';\nimport { DEFAULT_COMMAND_TIMEOUT_MS, runWorktreeTeardown } from '../integrations/github/sandbox.js';\nimport type {\n  ProjectRepository,\n  SourceControlSession,\n  SourceControlStorageHandle,\n} from '../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { MaterializationSandbox, SandboxBindingStore, SandboxFleet } from './fleet.js';\n\ntype RetirementFleet = Pick<SandboxFleet, 'provider' | 'reattachSandbox' | 'teardownSandbox'>;\ntype WarningLogger = (message: string, details: Record<string, unknown>) => void;\n\nexport interface SessionRetirementCoordinatorOptions {\n  fleet: RetirementFleet;\n  invalidateSession?: (sessionId: string) => Promise<void> | void;\n  warn?: WarningLogger;\n}\n\nexport interface RetireSessionInput {\n  sourceControl: SourceControlStorageHandle;\n  orgId: string;\n  sessionId: string;\n  deleteSession: boolean;\n}\n\nfunction boundedError(error: unknown): string {\n  const detail = error instanceof Error ? error.message : String(error);\n  if (detail.length <= 2000) return detail;\n  return `${detail.slice(0, 200)}...${detail.slice(-1797)}`;\n}\n\n/**\n * Owns terminal and destructive session cleanup. Each session is serialized so\n * duplicate role bindings and competing deletion/transition requests cannot\n * run teardown concurrently. Once the sandbox binding is cleared, later calls\n * are idempotent no-ops apart from cache invalidation or requested row deletion.\n */\nexport class SessionRetirementCoordinator {\n  readonly #fleet: RetirementFleet;\n  readonly #invalidateSession: NonNullable<SessionRetirementCoordinatorOptions['invalidateSession']>;\n  readonly #warn: WarningLogger;\n  readonly #locks = new Map<string, Promise<void>>();\n\n  constructor(options: SessionRetirementCoordinatorOptions) {\n    this.#fleet = options.fleet;\n    this.#invalidateSession = options.invalidateSession ?? (() => {});\n    this.#warn = options.warn ?? ((message, details) => console.warn(`[Mastra Factory] ${message}`, details));\n  }\n\n  async retireSession(input: RetireSessionInput): Promise<void> {\n    const previous = this.#locks.get(input.sessionId) ?? Promise.resolve();\n    const current = previous.catch(() => {}).then(() => this.#retireSession(input));\n    this.#locks.set(input.sessionId, current);\n    try {\n      await current;\n    } finally {\n      if (this.#locks.get(input.sessionId) === current) this.#locks.delete(input.sessionId);\n    }\n  }\n\n  async retireWorkItemSessions(options: {\n    workItems: Pick<WorkItemsStorage, 'get'>;\n    sourceControl: SourceControlStorageHandle;\n    orgId: string;\n    workItemId: string;\n  }): Promise<void> {\n    const item = await options.workItems.get({ orgId: options.orgId, id: options.workItemId });\n    if (!item) return;\n    const sessionIds = [...new Set(Object.values(item.sessions).map(session => session.sessionId))];\n    await Promise.all(\n      sessionIds.map(sessionId =>\n        this.retireSession({\n          sourceControl: options.sourceControl,\n          orgId: options.orgId,\n          sessionId,\n          deleteSession: false,\n        }),\n      ),\n    );\n  }\n\n  async retireProjectRepositorySessions(options: {\n    sourceControl: SourceControlStorageHandle;\n    orgId: string;\n    projectRepositoryId: string;\n  }): Promise<void> {\n    const sessions = await options.sourceControl.sessions.listByProjectRepository({\n      projectRepositoryId: options.projectRepositoryId,\n    });\n    await Promise.all(\n      sessions.map(session =>\n        this.retireSession({\n          sourceControl: options.sourceControl,\n          orgId: options.orgId,\n          sessionId: session.sessionId,\n          deleteSession: true,\n        }),\n      ),\n    );\n  }\n\n  async #retireSession(input: RetireSessionInput): Promise<void> {\n    const session = await input.sourceControl.sessions.getBySessionId(input.sessionId);\n    if (!session || session.orgId !== input.orgId) return;\n\n    try {\n      let projectRepository: ProjectRepository | null | undefined;\n      try {\n        projectRepository = await input.sourceControl.projectRepositories.get({\n          orgId: input.orgId,\n          id: session.projectRepositoryId,\n        });\n      } catch (error) {\n        this.#warn('Factory repository settings could not be loaded for session retirement', {\n          orgId: session.orgId,\n          sessionId: session.sessionId,\n          projectRepositoryId: session.projectRepositoryId,\n          error: boundedError(error),\n        });\n      }\n      let sandbox: MaterializationSandbox | undefined;\n\n      if (session.sandboxId && session.sandboxWorkdir) {\n        try {\n          sandbox = await this.#fleet.reattachSandbox(session.sandboxId, {\n            actingUserId: session.userId,\n            ...(this.#fleet.provider === 'local' ? { workingDirectory: session.sandboxWorkdir } : {}),\n          });\n        } catch (error) {\n          this.#warn('Factory session sandbox could not be reattached for retirement', {\n            orgId: session.orgId,\n            sessionId: session.sessionId,\n            projectRepositoryId: session.projectRepositoryId,\n            sandboxId: session.sandboxId,\n            error: boundedError(error),\n          });\n        }\n\n        if (sandbox && projectRepository?.teardownCommand) {\n          try {\n            await runWorktreeTeardown(sandbox, session.sandboxWorkdir, projectRepository.teardownCommand, {\n              timeoutMs: DEFAULT_COMMAND_TIMEOUT_MS,\n            });\n          } catch (error) {\n            this.#warn('Factory worktree teardown failed', {\n              orgId: session.orgId,\n              sessionId: session.sessionId,\n              projectRepositoryId: session.projectRepositoryId,\n              sandboxId: session.sandboxId,\n              error: boundedError(error),\n            });\n          }\n        }\n\n        if (this.#fleet.provider === 'local') {\n          await this.#destroyLocalSandbox(input.sourceControl, session, sandbox);\n        } else {\n          await this.#releaseRemoteSandbox(input.sourceControl, session, sandbox);\n        }\n      }\n    } finally {\n      try {\n        await this.#invalidateSession(session.sessionId);\n      } catch (error) {\n        this.#warn('Factory session workspace cache invalidation failed', {\n          orgId: session.orgId,\n          sessionId: session.sessionId,\n          projectRepositoryId: session.projectRepositoryId,\n          error: boundedError(error),\n        });\n      }\n\n      if (input.deleteSession) await input.sourceControl.sessions.delete(session.id);\n    }\n  }\n\n  async #releaseRemoteSandbox(\n    sourceControl: SourceControlStorageHandle,\n    session: SourceControlSession,\n    sandbox: MaterializationSandbox | undefined,\n  ): Promise<void> {\n    const sandboxId = session.sandboxId;\n    const sandboxWorkdir = session.sandboxWorkdir;\n    if (!sandboxId || !sandboxWorkdir) return;\n    await cleanReleasedSandbox({\n      fleet: this.#fleet,\n      sourceControl,\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      sandboxId,\n      sandboxWorkdir,\n      actingUserId: session.userId,\n      ...(sandbox ? { sandbox } : {}),\n    });\n    try {\n      await sourceControl.sandboxPool.release({\n        orgId: session.orgId,\n        projectRepositoryId: session.projectRepositoryId,\n        userId: session.userId,\n        sandboxId,\n        sandboxWorkdir,\n      });\n    } catch (error) {\n      this.#warn('Factory remote sandbox release failed', {\n        orgId: session.orgId,\n        sessionId: session.sessionId,\n        projectRepositoryId: session.projectRepositoryId,\n        sandboxId,\n        error: boundedError(error),\n      });\n    }\n    try {\n      await sourceControl.sessions.setSandbox({ id: session.id, sandboxId: null, sandboxWorkdir });\n    } catch (error) {\n      this.#warn('Factory remote sandbox binding could not be cleared', {\n        orgId: session.orgId,\n        sessionId: session.sessionId,\n        projectRepositoryId: session.projectRepositoryId,\n        sandboxId,\n        error: boundedError(error),\n      });\n    }\n  }\n\n  async #destroyLocalSandbox(\n    sourceControl: SourceControlStorageHandle,\n    session: SourceControlSession,\n    sandbox: MaterializationSandbox | undefined,\n  ): Promise<void> {\n    const sandboxWorkdir = session.sandboxWorkdir ?? '';\n    const binding: SandboxBindingStore = {\n      get sandboxId() {\n        return session.sandboxId;\n      },\n      setSandboxId: async sandboxId => {\n        await sourceControl.sessions.setSandbox({ id: session.id, sandboxId, sandboxWorkdir });\n        session.sandboxId = sandboxId;\n      },\n      clear: async () => {\n        await sourceControl.sessions.setSandbox({ id: session.id, sandboxId: null, sandboxWorkdir });\n        session.sandboxId = null;\n      },\n    };\n    try {\n      await this.#fleet.teardownSandbox(binding, sandbox);\n    } catch (error) {\n      this.#warn('Factory local sandbox destruction failed', {\n        orgId: session.orgId,\n        sessionId: session.sessionId,\n        projectRepositoryId: session.projectRepositoryId,\n        sandboxId: session.sandboxId,\n        error: boundedError(error),\n      });\n    }\n    if (session.sandboxId) {\n      try {\n        await sourceControl.sessions.setSandbox({ id: session.id, sandboxId: null, sandboxWorkdir });\n        session.sandboxId = null;\n      } catch (error) {\n        this.#warn('Factory local sandbox binding could not be cleared', {\n          orgId: session.orgId,\n          sessionId: session.sessionId,\n          projectRepositoryId: session.projectRepositoryId,\n          sandboxId: session.sandboxId,\n          error: boundedError(error),\n        });\n      }\n    }\n  }\n}\n"],"mappings":";;;AA0BA,SAAS,aAAa,OAAwB;CAC5C,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACpE,IAAI,OAAO,UAAU,KAAM,OAAO;CAClC,OAAO,GAAG,OAAO,MAAM,GAAG,GAAG,EAAE,KAAK,OAAO,MAAM,KAAK;AACxD;;;;;;;AAQA,IAAa,+BAAb,MAA0C;CACxC;CACA;CACA;CACA,yBAAkB,IAAI,IAA2B;CAEjD,YAAY,SAA8C;EACxD,KAAKA,SAAS,QAAQ;EACtB,KAAKC,qBAAqB,QAAQ,4BAA4B,CAAC;EAC/D,KAAKC,QAAQ,QAAQ,UAAU,SAAS,YAAY,QAAQ,KAAK,oBAAoB,WAAW,OAAO;CACzG;CAEA,MAAM,cAAc,OAA0C;EAE5D,MAAM,WADW,KAAKC,OAAO,IAAI,MAAM,SAAS,KAAK,QAAQ,QAAQ,EAAA,CAC5C,YAAY,CAAC,CAAC,CAAC,CAAC,WAAW,KAAKC,eAAe,KAAK,CAAC;EAC9E,KAAKD,OAAO,IAAI,MAAM,WAAW,OAAO;EACxC,IAAI;GACF,MAAM;EACR,UAAU;GACR,IAAI,KAAKA,OAAO,IAAI,MAAM,SAAS,MAAM,SAAS,KAAKA,OAAO,OAAO,MAAM,SAAS;EACtF;CACF;CAEA,MAAM,uBAAuB,SAKX;EAChB,MAAM,OAAO,MAAM,QAAQ,UAAU,IAAI;GAAE,OAAO,QAAQ;GAAO,IAAI,QAAQ;EAAW,CAAC;EACzF,IAAI,CAAC,MAAM;EACX,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,KAAI,YAAW,QAAQ,SAAS,CAAC,CAAC;EAC9F,MAAM,QAAQ,IACZ,WAAW,KAAI,cACb,KAAK,cAAc;GACjB,eAAe,QAAQ;GACvB,OAAO,QAAQ;GACf;GACA,eAAe;EACjB,CAAC,CACH,CACF;CACF;CAEA,MAAM,gCAAgC,SAIpB;EAChB,MAAM,WAAW,MAAM,QAAQ,cAAc,SAAS,wBAAwB,EAC5E,qBAAqB,QAAQ,oBAC/B,CAAC;EACD,MAAM,QAAQ,IACZ,SAAS,KAAI,YACX,KAAK,cAAc;GACjB,eAAe,QAAQ;GACvB,OAAO,QAAQ;GACf,WAAW,QAAQ;GACnB,eAAe;EACjB,CAAC,CACH,CACF;CACF;CAEA,MAAMC,eAAe,OAA0C;EAC7D,MAAM,UAAU,MAAM,MAAM,cAAc,SAAS,eAAe,MAAM,SAAS;EACjF,IAAI,CAAC,WAAW,QAAQ,UAAU,MAAM,OAAO;EAE/C,IAAI;GACF,IAAI;GACJ,IAAI;IACF,oBAAoB,MAAM,MAAM,cAAc,oBAAoB,IAAI;KACpE,OAAO,MAAM;KACb,IAAI,QAAQ;IACd,CAAC;GACH,SAAS,OAAO;IACd,KAAKF,MAAM,0EAA0E;KACnF,OAAO,QAAQ;KACf,WAAW,QAAQ;KACnB,qBAAqB,QAAQ;KAC7B,OAAO,aAAa,KAAK;IAC3B,CAAC;GACH;GACA,IAAI;GAEJ,IAAI,QAAQ,aAAa,QAAQ,gBAAgB;IAC/C,IAAI;KACF,UAAU,MAAM,KAAKF,OAAO,gBAAgB,QAAQ,WAAW;MAC7D,cAAc,QAAQ;MACtB,GAAI,KAAKA,OAAO,aAAa,UAAU,EAAE,kBAAkB,QAAQ,eAAe,IAAI,CAAC;KACzF,CAAC;IACH,SAAS,OAAO;KACd,KAAKE,MAAM,kEAAkE;MAC3E,OAAO,QAAQ;MACf,WAAW,QAAQ;MACnB,qBAAqB,QAAQ;MAC7B,WAAW,QAAQ;MACnB,OAAO,aAAa,KAAK;KAC3B,CAAC;IACH;IAEA,IAAI,WAAW,mBAAmB,iBAChC,IAAI;KACF,MAAM,oBAAoB,SAAS,QAAQ,gBAAgB,kBAAkB,iBAAiB,EAC5F,WAAW,2BACb,CAAC;IACH,SAAS,OAAO;KACd,KAAKA,MAAM,oCAAoC;MAC7C,OAAO,QAAQ;MACf,WAAW,QAAQ;MACnB,qBAAqB,QAAQ;MAC7B,WAAW,QAAQ;MACnB,OAAO,aAAa,KAAK;KAC3B,CAAC;IACH;IAGF,IAAI,KAAKF,OAAO,aAAa,SAC3B,MAAM,KAAKK,qBAAqB,MAAM,eAAe,SAAS,OAAO;SAErE,MAAM,KAAKC,sBAAsB,MAAM,eAAe,SAAS,OAAO;GAE1E;EACF,UAAU;GACR,IAAI;IACF,MAAM,KAAKL,mBAAmB,QAAQ,SAAS;GACjD,SAAS,OAAO;IACd,KAAKC,MAAM,uDAAuD;KAChE,OAAO,QAAQ;KACf,WAAW,QAAQ;KACnB,qBAAqB,QAAQ;KAC7B,OAAO,aAAa,KAAK;IAC3B,CAAC;GACH;GAEA,IAAI,MAAM,eAAe,MAAM,MAAM,cAAc,SAAS,OAAO,QAAQ,EAAE;EAC/E;CACF;CAEA,MAAMI,sBACJ,eACA,SACA,SACe;EACf,MAAM,YAAY,QAAQ;EAC1B,MAAM,iBAAiB,QAAQ;EAC/B,IAAI,CAAC,aAAa,CAAC,gBAAgB;EACnC,MAAM,qBAAqB;GACzB,OAAO,KAAKN;GACZ;GACA,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B;GACA;GACA,cAAc,QAAQ;GACtB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC/B,CAAC;EACD,IAAI;GACF,MAAM,cAAc,YAAY,QAAQ;IACtC,OAAO,QAAQ;IACf,qBAAqB,QAAQ;IAC7B,QAAQ,QAAQ;IAChB;IACA;GACF,CAAC;EACH,SAAS,OAAO;GACd,KAAKE,MAAM,yCAAyC;IAClD,OAAO,QAAQ;IACf,WAAW,QAAQ;IACnB,qBAAqB,QAAQ;IAC7B;IACA,OAAO,aAAa,KAAK;GAC3B,CAAC;EACH;EACA,IAAI;GACF,MAAM,cAAc,SAAS,WAAW;IAAE,IAAI,QAAQ;IAAI,WAAW;IAAM;GAAe,CAAC;EAC7F,SAAS,OAAO;GACd,KAAKA,MAAM,uDAAuD;IAChE,OAAO,QAAQ;IACf,WAAW,QAAQ;IACnB,qBAAqB,QAAQ;IAC7B;IACA,OAAO,aAAa,KAAK;GAC3B,CAAC;EACH;CACF;CAEA,MAAMG,qBACJ,eACA,SACA,SACe;EACf,MAAM,iBAAiB,QAAQ,kBAAkB;EACjD,MAAM,UAA+B;GACnC,IAAI,YAAY;IACd,OAAO,QAAQ;GACjB;GACA,cAAc,OAAM,cAAa;IAC/B,MAAM,cAAc,SAAS,WAAW;KAAE,IAAI,QAAQ;KAAI;KAAW;IAAe,CAAC;IACrF,QAAQ,YAAY;GACtB;GACA,OAAO,YAAY;IACjB,MAAM,cAAc,SAAS,WAAW;KAAE,IAAI,QAAQ;KAAI,WAAW;KAAM;IAAe,CAAC;IAC3F,QAAQ,YAAY;GACtB;EACF;EACA,IAAI;GACF,MAAM,KAAKL,OAAO,gBAAgB,SAAS,OAAO;EACpD,SAAS,OAAO;GACd,KAAKE,MAAM,4CAA4C;IACrD,OAAO,QAAQ;IACf,WAAW,QAAQ;IACnB,qBAAqB,QAAQ;IAC7B,WAAW,QAAQ;IACnB,OAAO,aAAa,KAAK;GAC3B,CAAC;EACH;EACA,IAAI,QAAQ,WACV,IAAI;GACF,MAAM,cAAc,SAAS,WAAW;IAAE,IAAI,QAAQ;IAAI,WAAW;IAAM;GAAe,CAAC;GAC3F,QAAQ,YAAY;EACtB,SAAS,OAAO;GACd,KAAKA,MAAM,sDAAsD;IAC/D,OAAO,QAAQ;IACf,WAAW,QAAQ;IACnB,qBAAqB,QAAQ;IAC7B,WAAW,QAAQ;IACnB,OAAO,aAAa,KAAK;GAC3B,CAAC;EACH;CAEJ;AACF"}

package/dist/session/filesystem-capture.d.ts

@@ -22,5 +22,12 @@ export interface FilesystemCaptureDependencies {
 }
 export declare function parseFilesystemCaptureFiles(output: string): FilesystemFile[];
 export declare function captureSessionFilesystem(session: FilesystemCaptureSession, { filesystem, sourceControl }: FilesystemCaptureDependencies): Promise<void>;
+/**
+ * Resolve once the session's in-flight filesystem capture (if any) has
+ * persisted, or after `timeoutMs` so a reader that arrives mid-capture is
+ * never blocked by the execs' worst-case 30s timeouts. Never rejects: the
+ * capture body is fully try/catch contained.
+ */
+export declare function waitForPendingFilesystemCapture(resourceId: string, timeoutMs?: number): Promise<void>;
 export declare function observeSessionFilesystem(session: FilesystemCaptureSession, dependencies: FilesystemCaptureDependencies): () => void;
 //# sourceMappingURL=filesystem-capture.d.ts.map

package/dist/session/filesystem-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-capture.d.ts","sourceRoot":"","sources":["../../src/session/filesystem-capture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAK5F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE;QAAE,aAAa,IAAI,MAAM,CAAA;KAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE;QAAE,SAAS,IAAI,MAAM,CAAA;KAAE,CAAC;IACzC,YAAY,IAAI;QAAE,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;IACnF,gBAAgB,CAAC,QAAQ,EAAE,6BAA6B,GAAG,MAAM,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACpD,aAAa,EAAE;QACb,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;KAC1E,CAAC;CACH;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAmB5E;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,wBAAwB,EACjC,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,6BAA6B,GAC3D,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,YAAY,EAAE,6BAA6B,GAC1C,MAAM,IAAI,CAMZ"}
+{"version":3,"file":"filesystem-capture.d.ts","sourceRoot":"","sources":["../../src/session/filesystem-capture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAK5F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE;QAAE,aAAa,IAAI,MAAM,CAAA;KAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE;QAAE,SAAS,IAAI,MAAM,CAAA;KAAE,CAAC;IACzC,YAAY,IAAI;QAAE,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC;IACnF,gBAAgB,CAAC,QAAQ,EAAE,6BAA6B,GAAG,MAAM,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACpD,aAAa,EAAE;QACb,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;KAC1E,CAAC;CACH;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAmB5E;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,wBAAwB,EACjC,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,6BAA6B,GAC3D,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAYD;;;;;GAKG;AACH,wBAAsB,+BAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3G;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,YAAY,EAAE,6BAA6B,GAC1C,MAAM,IAAI,CAkCZ"}

package/dist/session/filesystem-capture.js

@@ -62,14 +62,51 @@ async function captureSessionFilesystem(session, { filesystem, sourceControl })
 		console.warn("[Factory filesystem capture] Unable to persist files.", error);
 	}
 }
+/**
+* In-flight capture chains keyed by session resource id. Serves two purposes:
+* readers of the persisted file listing (the /web/workspace routes) await the
+* capture for the turn that just ended instead of racing it, and captures for
+* the same resource stay sequential (last write wins) even when multiple
+* scoped sessions observe the same resource id. In-process only: the factory
+* server that runs the session controller also serves those routes.
+*/
+const pendingCaptures = /* @__PURE__ */ new Map();
+/**
+* Resolve once the session's in-flight filesystem capture (if any) has
+* persisted, or after `timeoutMs` so a reader that arrives mid-capture is
+* never blocked by the execs' worst-case 30s timeouts. Never rejects: the
+* capture body is fully try/catch contained.
+*/
+async function waitForPendingFilesystemCapture(resourceId, timeoutMs = 1e4) {
+	const pending = pendingCaptures.get(resourceId);
+	if (!pending) return;
+	let timer;
+	try {
+		await Promise.race([pending, new Promise((resolve) => {
+			timer = setTimeout(resolve, timeoutMs);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
 function observeSessionFilesystem(session, dependencies) {
-	let capture = Promise.resolve();
+	let fallbackChain = Promise.resolve();
 	return session.onBeforeAgentEnd(() => {
-		capture = capture.then(() => captureSessionFilesystem(session, dependencies));
-		return capture;
+		let resourceId;
+		try {
+			resourceId = session.identity.getResourceId();
+		} catch {
+			fallbackChain = fallbackChain.then(() => captureSessionFilesystem(session, dependencies));
+			return;
+		}
+		const chain = (pendingCaptures.get(resourceId) ?? Promise.resolve()).then(() => captureSessionFilesystem(session, dependencies));
+		pendingCaptures.set(resourceId, chain);
+		chain.finally(() => {
+			if (pendingCaptures.get(resourceId) === chain) pendingCaptures.delete(resourceId);
+		});
 	});
 }
 //#endregion
-export { captureSessionFilesystem, observeSessionFilesystem, parseFilesystemCaptureFiles };
+export { captureSessionFilesystem, observeSessionFilesystem, parseFilesystemCaptureFiles, waitForPendingFilesystemCapture };
 
 //# sourceMappingURL=filesystem-capture.js.map

package/dist/session/filesystem-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-capture.js","names":[],"sources":["../../src/session/filesystem-capture.ts"],"sourcesContent":["import type { SessionBeforeAgentEndListener } from '@mastra/core/agent-controller';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\n\nimport type { FilesystemFile, FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\n\nconst GIT_STATUS_ARGS = ['status', '--porcelain=v1', '-z', '--untracked-files=all'];\nconst ARTIFACTS_LIST_COMMAND = 'cd \"$1\" && test -d .artifacts && find .artifacts -type f -print0 || true';\n\nexport interface FilesystemCaptureSession {\n  readonly identity: { getResourceId(): string };\n  readonly thread: { requireId(): string };\n  getWorkspace(): { sandbox?: Pick<WorkspaceSandbox, 'executeCommand'> } | undefined;\n  onBeforeAgentEnd(listener: SessionBeforeAgentEndListener): () => void;\n}\n\nexport interface FilesystemCaptureDependencies {\n  filesystem: Pick<FilesystemStorage, 'replaceFiles'>;\n  sourceControl: {\n    sessions: Pick<SourceControlStorageHandle['sessions'], 'getBySessionId'>;\n  };\n}\n\nexport function parseFilesystemCaptureFiles(output: string): FilesystemFile[] {\n  const files = new Map<string, FilesystemFile>();\n  const records = output.split('\\0');\n\n  for (let index = 0; index < records.length; index += 1) {\n    const record = records[index];\n    if (!record || record.length < 4) continue;\n\n    const code = record.slice(0, 2);\n    let path = record.slice(3);\n    const moved = code.includes('R') || code.includes('C');\n    if (moved) index += 1;\n    if (path.startsWith('./')) path = path.slice(2);\n    if (!path || (!code.includes('U') && code.includes('D') && !moved)) continue;\n\n    files.set(path, { path });\n  }\n\n  return [...files.values()].toSorted((a, b) => a.path.localeCompare(b.path));\n}\n\nexport async function captureSessionFilesystem(\n  session: FilesystemCaptureSession,\n  { filesystem, sourceControl }: FilesystemCaptureDependencies,\n): Promise<void> {\n  try {\n    const resourceId = session.identity.getResourceId();\n    const threadId = session.thread.requireId();\n    const sourceSession = await sourceControl.sessions.getBySessionId(resourceId);\n    // Chat-only sessions run without a workspace; there is nothing to capture.\n    const sandbox = session.getWorkspace()?.sandbox;\n    if (!sourceSession?.sandboxWorkdir || !sandbox?.executeCommand) return;\n\n    const result = await sandbox.executeCommand('git', ['-C', sourceSession.sandboxWorkdir, ...GIT_STATUS_ARGS], {\n      timeout: 30_000,\n    });\n    if (result.exitCode !== 0) {\n      console.warn('[Factory filesystem capture] Unable to inspect Git status.', result.stderr);\n      return;\n    }\n\n    const artifacts = await sandbox.executeCommand(\n      'sh',\n      ['-c', ARTIFACTS_LIST_COMMAND, 'sh', sourceSession.sandboxWorkdir],\n      { timeout: 30_000 },\n    );\n    if (artifacts.exitCode !== 0) {\n      console.warn('[Factory filesystem capture] Unable to list workspace artifacts.', artifacts.stderr);\n      return;\n    }\n\n    const files = new Map(parseFilesystemCaptureFiles(result.stdout).map(file => [file.path, file]));\n    for (const path of artifacts.stdout.split('\\0')) {\n      const normalizedPath = path.replace(/^\\.\\//, '');\n      if (normalizedPath) {\n        files.set(normalizedPath, { path: normalizedPath });\n      }\n    }\n\n    await filesystem.replaceFiles({\n      resourceId,\n      threadId,\n      files: [...files.values()].toSorted((a, b) => a.path.localeCompare(b.path)),\n    });\n  } catch (error) {\n    console.warn('[Factory filesystem capture] Unable to persist files.', error);\n  }\n}\n\nexport function observeSessionFilesystem(\n  session: FilesystemCaptureSession,\n  dependencies: FilesystemCaptureDependencies,\n): () => void {\n  let capture = Promise.resolve();\n  return session.onBeforeAgentEnd(() => {\n    capture = capture.then(() => captureSessionFilesystem(session, dependencies));\n    return capture;\n  });\n}\n"],"mappings":";AAMA,MAAM,kBAAkB;CAAC;CAAU;CAAkB;CAAM;AAAuB;AAClF,MAAM,yBAAyB;AAgB/B,SAAgB,4BAA4B,QAAkC;CAC5E,MAAM,wBAAQ,IAAI,IAA4B;CAC9C,MAAM,UAAU,OAAO,MAAM,IAAI;CAEjC,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;EAElC,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC;EAC9B,IAAI,OAAO,OAAO,MAAM,CAAC;EACzB,MAAM,QAAQ,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG;EACrD,IAAI,OAAO,SAAS;EACpB,IAAI,KAAK,WAAW,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC;EAC9C,IAAI,CAAC,QAAS,CAAC,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG,KAAK,CAAC,OAAQ;EAEpE,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC;CAC1B;CAEA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC5E;AAEA,eAAsB,yBACpB,SACA,EAAE,YAAY,iBACC;CACf,IAAI;EACF,MAAM,aAAa,QAAQ,SAAS,cAAc;EAClD,MAAM,WAAW,QAAQ,OAAO,UAAU;EAC1C,MAAM,gBAAgB,MAAM,cAAc,SAAS,eAAe,UAAU;EAE5E,MAAM,UAAU,QAAQ,aAAa,CAAC,EAAE;EACxC,IAAI,CAAC,eAAe,kBAAkB,CAAC,SAAS,gBAAgB;EAEhE,MAAM,SAAS,MAAM,QAAQ,eAAe,OAAO;GAAC;GAAM,cAAc;GAAgB,GAAG;EAAe,GAAG,EAC3G,SAAS,IACX,CAAC;EACD,IAAI,OAAO,aAAa,GAAG;GACzB,QAAQ,KAAK,8DAA8D,OAAO,MAAM;GACxF;EACF;EAEA,MAAM,YAAY,MAAM,QAAQ,eAC9B,MACA;GAAC;GAAM;GAAwB;GAAM,cAAc;EAAc,GACjE,EAAE,SAAS,IAAO,CACpB;EACA,IAAI,UAAU,aAAa,GAAG;GAC5B,QAAQ,KAAK,oEAAoE,UAAU,MAAM;GACjG;EACF;EAEA,MAAM,QAAQ,IAAI,IAAI,4BAA4B,OAAO,MAAM,CAAC,CAAC,KAAI,SAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;EAC/F,KAAK,MAAM,QAAQ,UAAU,OAAO,MAAM,IAAI,GAAG;GAC/C,MAAM,iBAAiB,KAAK,QAAQ,SAAS,EAAE;GAC/C,IAAI,gBACF,MAAM,IAAI,gBAAgB,EAAE,MAAM,eAAe,CAAC;EAEtD;EAEA,MAAM,WAAW,aAAa;GAC5B;GACA;GACA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;EAC5E,CAAC;CACH,SAAS,OAAO;EACd,QAAQ,KAAK,yDAAyD,KAAK;CAC7E;AACF;AAEA,SAAgB,yBACd,SACA,cACY;CACZ,IAAI,UAAU,QAAQ,QAAQ;CAC9B,OAAO,QAAQ,uBAAuB;EACpC,UAAU,QAAQ,WAAW,yBAAyB,SAAS,YAAY,CAAC;EAC5E,OAAO;CACT,CAAC;AACH"}
+{"version":3,"file":"filesystem-capture.js","names":[],"sources":["../../src/session/filesystem-capture.ts"],"sourcesContent":["import type { SessionBeforeAgentEndListener } from '@mastra/core/agent-controller';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\n\nimport type { FilesystemFile, FilesystemStorage } from '../storage/domains/filesystem/base.js';\nimport type { SourceControlStorageHandle } from '../storage/domains/source-control/base.js';\n\nconst GIT_STATUS_ARGS = ['status', '--porcelain=v1', '-z', '--untracked-files=all'];\nconst ARTIFACTS_LIST_COMMAND = 'cd \"$1\" && test -d .artifacts && find .artifacts -type f -print0 || true';\n\nexport interface FilesystemCaptureSession {\n  readonly identity: { getResourceId(): string };\n  readonly thread: { requireId(): string };\n  getWorkspace(): { sandbox?: Pick<WorkspaceSandbox, 'executeCommand'> } | undefined;\n  onBeforeAgentEnd(listener: SessionBeforeAgentEndListener): () => void;\n}\n\nexport interface FilesystemCaptureDependencies {\n  filesystem: Pick<FilesystemStorage, 'replaceFiles'>;\n  sourceControl: {\n    sessions: Pick<SourceControlStorageHandle['sessions'], 'getBySessionId'>;\n  };\n}\n\nexport function parseFilesystemCaptureFiles(output: string): FilesystemFile[] {\n  const files = new Map<string, FilesystemFile>();\n  const records = output.split('\\0');\n\n  for (let index = 0; index < records.length; index += 1) {\n    const record = records[index];\n    if (!record || record.length < 4) continue;\n\n    const code = record.slice(0, 2);\n    let path = record.slice(3);\n    const moved = code.includes('R') || code.includes('C');\n    if (moved) index += 1;\n    if (path.startsWith('./')) path = path.slice(2);\n    if (!path || (!code.includes('U') && code.includes('D') && !moved)) continue;\n\n    files.set(path, { path });\n  }\n\n  return [...files.values()].toSorted((a, b) => a.path.localeCompare(b.path));\n}\n\nexport async function captureSessionFilesystem(\n  session: FilesystemCaptureSession,\n  { filesystem, sourceControl }: FilesystemCaptureDependencies,\n): Promise<void> {\n  try {\n    const resourceId = session.identity.getResourceId();\n    const threadId = session.thread.requireId();\n    const sourceSession = await sourceControl.sessions.getBySessionId(resourceId);\n    // Chat-only sessions run without a workspace; there is nothing to capture.\n    const sandbox = session.getWorkspace()?.sandbox;\n    if (!sourceSession?.sandboxWorkdir || !sandbox?.executeCommand) return;\n\n    const result = await sandbox.executeCommand('git', ['-C', sourceSession.sandboxWorkdir, ...GIT_STATUS_ARGS], {\n      timeout: 30_000,\n    });\n    if (result.exitCode !== 0) {\n      console.warn('[Factory filesystem capture] Unable to inspect Git status.', result.stderr);\n      return;\n    }\n\n    const artifacts = await sandbox.executeCommand(\n      'sh',\n      ['-c', ARTIFACTS_LIST_COMMAND, 'sh', sourceSession.sandboxWorkdir],\n      { timeout: 30_000 },\n    );\n    if (artifacts.exitCode !== 0) {\n      console.warn('[Factory filesystem capture] Unable to list workspace artifacts.', artifacts.stderr);\n      return;\n    }\n\n    const files = new Map(parseFilesystemCaptureFiles(result.stdout).map(file => [file.path, file]));\n    for (const path of artifacts.stdout.split('\\0')) {\n      const normalizedPath = path.replace(/^\\.\\//, '');\n      if (normalizedPath) {\n        files.set(normalizedPath, { path: normalizedPath });\n      }\n    }\n\n    await filesystem.replaceFiles({\n      resourceId,\n      threadId,\n      files: [...files.values()].toSorted((a, b) => a.path.localeCompare(b.path)),\n    });\n  } catch (error) {\n    console.warn('[Factory filesystem capture] Unable to persist files.', error);\n  }\n}\n\n/**\n * In-flight capture chains keyed by session resource id. Serves two purposes:\n * readers of the persisted file listing (the /web/workspace routes) await the\n * capture for the turn that just ended instead of racing it, and captures for\n * the same resource stay sequential (last write wins) even when multiple\n * scoped sessions observe the same resource id. In-process only: the factory\n * server that runs the session controller also serves those routes.\n */\nconst pendingCaptures = new Map<string, Promise<void>>();\n\n/**\n * Resolve once the session's in-flight filesystem capture (if any) has\n * persisted, or after `timeoutMs` so a reader that arrives mid-capture is\n * never blocked by the execs' worst-case 30s timeouts. Never rejects: the\n * capture body is fully try/catch contained.\n */\nexport async function waitForPendingFilesystemCapture(resourceId: string, timeoutMs = 10_000): Promise<void> {\n  const pending = pendingCaptures.get(resourceId);\n  if (!pending) return;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    await Promise.race([\n      pending,\n      new Promise<void>(resolve => {\n        timer = setTimeout(resolve, timeoutMs);\n      }),\n    ]);\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport function observeSessionFilesystem(\n  session: FilesystemCaptureSession,\n  dependencies: FilesystemCaptureDependencies,\n): () => void {\n  let fallbackChain = Promise.resolve();\n  return session.onBeforeAgentEnd(() => {\n    // Chain so captures stay sequential (last write wins), but do NOT return\n    // the chain: finishAgentRun awaits every listener before emitting\n    // agent_end, and the capture's sandbox execs (git status + artifacts\n    // find, 30s timeouts each) must not gate turn completion. Readers that\n    // need the fresh listing await the pending capture through\n    // waitForPendingFilesystemCapture instead. The un-returned chain cannot\n    // leak an unhandled rejection: captureSessionFilesystem's entire body\n    // runs inside its own try/catch, and disposal of this listener does not\n    // cancel an in-flight chain, so a final turn's capture still persists.\n    let resourceId: string | undefined;\n    try {\n      resourceId = session.identity.getResourceId();\n    } catch {\n      // No resource id means no route can address this session's listing;\n      // keep a per-observer chain so captures still run sequentially.\n      fallbackChain = fallbackChain.then(() => captureSessionFilesystem(session, dependencies));\n      return;\n    }\n    // Extend the resource-level chain rather than a per-session one: sessions\n    // are deduplicated by (resourceId, scope), so multiple scoped sessions can\n    // observe the same resource, and their captures must not interleave.\n    const chain = (pendingCaptures.get(resourceId) ?? Promise.resolve()).then(() =>\n      captureSessionFilesystem(session, dependencies),\n    );\n    pendingCaptures.set(resourceId, chain);\n    void chain.finally(() => {\n      if (pendingCaptures.get(resourceId) === chain) {\n        pendingCaptures.delete(resourceId);\n      }\n    });\n  });\n}\n"],"mappings":";AAMA,MAAM,kBAAkB;CAAC;CAAU;CAAkB;CAAM;AAAuB;AAClF,MAAM,yBAAyB;AAgB/B,SAAgB,4BAA4B,QAAkC;CAC5E,MAAM,wBAAQ,IAAI,IAA4B;CAC9C,MAAM,UAAU,OAAO,MAAM,IAAI;CAEjC,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,SAAS,QAAQ;EACvB,IAAI,CAAC,UAAU,OAAO,SAAS,GAAG;EAElC,MAAM,OAAO,OAAO,MAAM,GAAG,CAAC;EAC9B,IAAI,OAAO,OAAO,MAAM,CAAC;EACzB,MAAM,QAAQ,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG;EACrD,IAAI,OAAO,SAAS;EACpB,IAAI,KAAK,WAAW,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC;EAC9C,IAAI,CAAC,QAAS,CAAC,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG,KAAK,CAAC,OAAQ;EAEpE,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC;CAC1B;CAEA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC5E;AAEA,eAAsB,yBACpB,SACA,EAAE,YAAY,iBACC;CACf,IAAI;EACF,MAAM,aAAa,QAAQ,SAAS,cAAc;EAClD,MAAM,WAAW,QAAQ,OAAO,UAAU;EAC1C,MAAM,gBAAgB,MAAM,cAAc,SAAS,eAAe,UAAU;EAE5E,MAAM,UAAU,QAAQ,aAAa,CAAC,EAAE;EACxC,IAAI,CAAC,eAAe,kBAAkB,CAAC,SAAS,gBAAgB;EAEhE,MAAM,SAAS,MAAM,QAAQ,eAAe,OAAO;GAAC;GAAM,cAAc;GAAgB,GAAG;EAAe,GAAG,EAC3G,SAAS,IACX,CAAC;EACD,IAAI,OAAO,aAAa,GAAG;GACzB,QAAQ,KAAK,8DAA8D,OAAO,MAAM;GACxF;EACF;EAEA,MAAM,YAAY,MAAM,QAAQ,eAC9B,MACA;GAAC;GAAM;GAAwB;GAAM,cAAc;EAAc,GACjE,EAAE,SAAS,IAAO,CACpB;EACA,IAAI,UAAU,aAAa,GAAG;GAC5B,QAAQ,KAAK,oEAAoE,UAAU,MAAM;GACjG;EACF;EAEA,MAAM,QAAQ,IAAI,IAAI,4BAA4B,OAAO,MAAM,CAAC,CAAC,KAAI,SAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;EAC/F,KAAK,MAAM,QAAQ,UAAU,OAAO,MAAM,IAAI,GAAG;GAC/C,MAAM,iBAAiB,KAAK,QAAQ,SAAS,EAAE;GAC/C,IAAI,gBACF,MAAM,IAAI,gBAAgB,EAAE,MAAM,eAAe,CAAC;EAEtD;EAEA,MAAM,WAAW,aAAa;GAC5B;GACA;GACA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;EAC5E,CAAC;CACH,SAAS,OAAO;EACd,QAAQ,KAAK,yDAAyD,KAAK;CAC7E;AACF;;;;;;;;;AAUA,MAAM,kCAAkB,IAAI,IAA2B;;;;;;;AAQvD,eAAsB,gCAAgC,YAAoB,YAAY,KAAuB;CAC3G,MAAM,UAAU,gBAAgB,IAAI,UAAU;CAC9C,IAAI,CAAC,SAAS;CACd,IAAI;CACJ,IAAI;EACF,MAAM,QAAQ,KAAK,CACjB,SACA,IAAI,SAAc,YAAW;GAC3B,QAAQ,WAAW,SAAS,SAAS;EACvC,CAAC,CACH,CAAC;CACH,UAAU;EACR,aAAa,KAAK;CACpB;AACF;AAEA,SAAgB,yBACd,SACA,cACY;CACZ,IAAI,gBAAgB,QAAQ,QAAQ;CACpC,OAAO,QAAQ,uBAAuB;EAUpC,IAAI;EACJ,IAAI;GACF,aAAa,QAAQ,SAAS,cAAc;EAC9C,QAAQ;GAGN,gBAAgB,cAAc,WAAW,yBAAyB,SAAS,YAAY,CAAC;GACxF;EACF;EAIA,MAAM,SAAS,gBAAgB,IAAI,UAAU,KAAK,QAAQ,QAAQ,EAAA,CAAG,WACnE,yBAAyB,SAAS,YAAY,CAChD;EACA,gBAAgB,IAAI,YAAY,KAAK;EACrC,MAAW,cAAc;GACvB,IAAI,gBAAgB,IAAI,UAAU,MAAM,OACtC,gBAAgB,OAAO,UAAU;EAErC,CAAC;CACH,CAAC;AACH"}

package/dist/storage/domains/intake/base.d.ts

@@ -15,6 +15,20 @@ export interface IntakeSelection {
 export type IntakeConfig = Record<string, IntakeSelection>;
 export declare const DEFAULT_INTAKE_CONFIG: IntakeConfig;
 export declare const INTAKE_SETTINGS_SCHEMA: CollectionSchema;
+/**
+ * Binds an intake source to the Factory project its items belong to.
+ *
+ * Intake selections are per user and org-wide, so they cannot say *where* an
+ * ingested item should land. GitHub items are naturally scoped by their linked
+ * repository; providers without that link (Linear) need this explicit binding
+ * so viewing one project's board cannot materialize another project's items.
+ */
+export declare const INTAKE_SOURCE_BINDINGS_SCHEMA: CollectionSchema;
+export interface IntakeSourceBinding {
+    integrationId: string;
+    sourceId: string;
+    factoryProjectId: string;
+}
 export declare class IntakeStorage extends FactoryStorageDomain {
     #private;
     constructor();
@@ -34,5 +48,27 @@ export declare class IntakeStorage extends FactoryStorageDomain {
         userId: string;
         config: IntakeConfig;
     }): Promise<void>;
+    /** Every source binding in the org, optionally narrowed to one integration. */
+    listBindings({ orgId, integrationId, }: {
+        orgId: string;
+        integrationId?: string;
+    }): Promise<IntakeSourceBinding[]>;
+    /** Source ids bound to one Factory project. Empty means "nothing bound". */
+    listBoundSourceIds({ orgId, integrationId, factoryProjectId, }: {
+        orgId: string;
+        integrationId: string;
+        factoryProjectId: string;
+    }): Promise<string[]>;
+    /**
+     * Points a source at a Factory project, replacing any existing binding.
+     * A `null` project clears the binding.
+     */
+    setBinding({ orgId, integrationId, sourceId, factoryProjectId, userId, }: {
+        orgId: string;
+        integrationId: string;
+        sourceId: string;
+        factoryProjectId: string | null;
+        userId?: string;
+    }): Promise<void>;
 }
 //# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/intake/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/intake/base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAE3D,eAAO,MAAM,qBAAqB,EAAE,YAAiB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,EAAE,gBAWpC,CAAC;AAEF,qBAAa,aAAc,SAAQ,oBAAoB;;;IAK/C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQpC,SAAS,CAAC,EACd,KAAK,EACL,MAAM,EACN,cAAc,GACf,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,YAAY,CAAC;IAYnB,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpH"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/intake/base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAE3D,eAAO,MAAM,qBAAqB,EAAE,YAAiB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,EAAE,gBAWpC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,EAAE,gBAmB3C,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAQD,qBAAa,aAAc,SAAQ,oBAAoB;;;IAK/C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IASpC,SAAS,CAAC,EACd,KAAK,EACL,MAAM,EACN,cAAc,GACf,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,YAAY,CAAC;IAYnB,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAanH,+EAA+E;IACzE,YAAY,CAAC,EACjB,KAAK,EACL,aAAa,GACd,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAYlC,4EAA4E;IACtE,kBAAkB,CAAC,EACvB,KAAK,EACL,aAAa,EACb,gBAAgB,GACjB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IASrB;;;OAGG;IACG,UAAU,CAAC,EACf,KAAK,EACL,aAAa,EACb,QAAQ,EACR,gBAAgB,EAChB,MAAM,GACP,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBlB"}