create-factory 0.0.0-aggregate-trace-20261015182851

package/LICENSE.md

@@ -0,0 +1,32 @@
+Portions of this software are licensed as follows:
+
+- All content that resides under any directory named `ee/` within this
+  repository, including but not limited to:
+  - `@mastra/core/auth/ee`
+  - `@mastra/core/agent-builder/ee`
+  - `@mastra/editor/ee`
+
+  is licensed under the license defined in [`ee/LICENSE`](https://github.com/mastra-ai/mastra/blob/main/ee/LICENSE).
+
+- All third-party components incorporated into the Mastra Software are
+  licensed under the original license provided by the owner of the
+  applicable component.
+
+- Content outside of the above-mentioned directories or restrictions is
+  available under the "Apache License 2.0" as defined below.
+
+# Apache License 2.0
+
+Copyright (c) 2025 Kepler Software, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,58 @@
+# create-factory
+
+Mastra Factory is an open source environment for building software with coding agents. Connect your repository to turn issues into plans, implementations, and reviewed pull requests.
+
+`create-factory` is the recommended way to scaffold your Mastra Factory. By default,
+
+## Installation
+
+> [!IMPORTANT]
+> Make sure that you have Node.js 22.13.0 or later installed on your system.
+
+Run the latest version directly with your package manager.
+
+Using npm:
+
+```bash
+npx create-factory@latest
+```
+
+Using Yarn:
+
+```bash
+yarn dlx create-factory@latest
+```
+
+Using pnpm:
+
+```bash
+pnpm create factory@latest
+```
+
+## Usage
+
+The interactive setup asks where to create the project and helps configure your Mastra Factory project.
+
+By default, the setup wizard provisions Mastra platform resources during setup, enabling you to fully run Mastra Factory on platform or locally with cloud-backed capabilities. If you prefer to [self-host](https://factory.mastra.ai/deployment#self-host) Mastra Factory, run the setup with the `--no-platform` flag.
+
+```bash
+npx create-factory@latest -- --no-platform
+```
+
+Pass `--help` to see all options:
+
+```bash
+npx create-factory@latest --help
+```
+
+## Documentation
+
+- [create-factory CLI reference](https://factory.mastra.ai/reference/create-factory)
+
+## Changelog
+
+See the [package changelog](https://github.com/mastra-ai/mastra/blob/main/mastracode/mastra-factory/CHANGELOG.md) for version history and release notes.
+
+## Support
+
+We have an [open community Discord](https://discord.gg/mastra-ai). Come and say hello and let us know if you have any questions or need any help getting things running.

package/dist/index.js

@@ -0,0 +1,726 @@
+#! /usr/bin/env node
+import fs, { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { Command } from "commander";
+import { PosthogAnalytics, setAnalytics } from "mastra/dist/analytics/index.js";
+import * as p from "@clack/prompts";
+import { LoginCancelledError, MASTRA_PLATFORM_API_URL, authHeaders, extractApiErrorDetail, fetchOrgs, getToken, loadCredentials, platformFetch, resolveCurrentOrg } from "mastra/internal/auth";
+import color from "picocolors";
+import { x } from "tinyexec";
+import fs$1 from "node:fs/promises";
+//#region src/env.ts
+/**
+* Idempotently update a `.env` file.
+*
+* Replaces any existing `KEY=` line (commented or not) with `KEY=value`.
+* Appends missing keys at the end of the file. Preserves other lines
+* verbatim. Values are written raw — do not pass secrets that contain
+* newlines or leading spaces (WorkOS `sk_` keys and Neon connection strings
+* are safe).
+*/
+function upsertEnvFile(envPath, updates) {
+	const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, "utf8") : "";
+	const lines = existing === "" ? [] : existing.split("\n");
+	const remaining = new Map(Object.entries(updates));
+	const patched = lines.map((line) => {
+		const match = /^(\s*#\s*)?([A-Z][A-Z0-9_]*)\s*=/.exec(line);
+		if (!match) return line;
+		const key = match[2];
+		if (!remaining.has(key)) return line;
+		const value = remaining.get(key);
+		remaining.delete(key);
+		return `${key}=${value}`;
+	});
+	if (remaining.size > 0) {
+		if (patched.length > 0 && patched[patched.length - 1] !== "") patched.push("");
+		for (const [key, value] of remaining) patched.push(`${key}=${value}`);
+	}
+	const output = patched.join("\n");
+	fs.writeFileSync(envPath, output, { mode: 384 });
+	try {
+		fs.chmodSync(envPath, 384);
+	} catch {}
+}
+//#endregion
+//#region src/platform.ts
+/**
+* Common failure path: read `detail`/`message` out of the JSON body if the
+* response wasn't JSON-parseable, fall back to the raw text.
+*/
+async function extractError(res) {
+	const text = await res.text().catch(() => "");
+	if (!text) return `${res.status} ${res.statusText}`;
+	try {
+		const detail = extractApiErrorDetail(JSON.parse(text));
+		if (detail) return detail;
+	} catch {}
+	return text.slice(0, 500);
+}
+var PlatformApiError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.name = "PlatformApiError";
+		this.status = status;
+	}
+};
+/** POST /v1/server/projects — create a server project (Railway-provisioned). */
+async function createServerProject({ token, orgId, name, region }) {
+	const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/server/projects`, {
+		method: "POST",
+		headers: {
+			...authHeaders(token, orgId),
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			name,
+			region,
+			factoryEnabled: true
+		})
+	});
+	if (!res.ok) throw new PlatformApiError(res.status, `Failed to create project — ${await extractError(res)}`);
+	return (await res.json()).project;
+}
+async function ensureProductionEnvironment({ token, orgId, projectId, region }) {
+	const url = `${MASTRA_PLATFORM_API_URL}/v1/projects/${encodeURIComponent(projectId)}/environments`;
+	const headers = authHeaders(token, orgId);
+	const res = await platformFetch(url, { headers });
+	if (!res.ok) throw new PlatformApiError(res.status, `Failed to list environments — ${await extractError(res)}`);
+	const production = (await res.json()).environments.find((environment) => environment.type === "production");
+	if (production) return production.id;
+	const created = await platformFetch(url, {
+		method: "POST",
+		headers: {
+			...headers,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			name: "production",
+			type: "production",
+			region
+		})
+	});
+	if (!created.ok) throw new PlatformApiError(created.status, `Failed to create production environment — ${await extractError(created)}`);
+	return (await created.json()).environment.id;
+}
+/**
+* POST /v1/auth/tokens — mint an `sk_` WorkOS org API key.
+* Returns the plaintext secret; the platform never returns it again.
+*/
+async function mintOrgApiKey({ token, orgId, keyName }) {
+	const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/auth/tokens`, {
+		method: "POST",
+		headers: {
+			...authHeaders(token, orgId),
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ name: keyName })
+	});
+	if (!res.ok) throw new PlatformApiError(res.status, `Failed to create API key — ${await extractError(res)}`);
+	return (await res.json()).secret;
+}
+/**
+* POST /v1/server/projects/:id/databases — attach a Neon Postgres database.
+* Returns immediately with `status: 'provisioning'`; poll for `ready`.
+*
+* Note: this route requires `requireRole('admin')`. Non-admin org members
+* will get a 403.
+*/
+async function attachNeonDatabase({ token, orgId, projectId, name, regionId }) {
+	const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/server/projects/${encodeURIComponent(projectId)}/databases`, {
+		method: "POST",
+		headers: {
+			...authHeaders(token, orgId),
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			kind: "neon",
+			name,
+			regionId
+		})
+	});
+	if (!res.ok) {
+		if (res.status === 403) throw new PlatformApiError(403, `Attaching a database requires the admin role in your organization. Ask an org admin to run \`create-factory\`, or attach a database from the dashboard.`);
+		throw new PlatformApiError(res.status, `Failed to attach Neon database — ${await extractError(res)}`);
+	}
+	return (await res.json()).database;
+}
+/** GET /v1/server/projects/:id/databases/:dbId — status poll target. */
+async function getDatabaseStatus({ token, orgId, projectId, databaseId, signal }) {
+	const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/server/projects/${encodeURIComponent(projectId)}/databases/${encodeURIComponent(databaseId)}`, {
+		headers: authHeaders(token, orgId),
+		signal
+	});
+	if (!res.ok) throw new PlatformApiError(res.status, `Failed to read database status — ${await extractError(res)}`);
+	return (await res.json()).database;
+}
+/** GET /v1/server/projects/:id/databases/:dbId/connection — only 200s when `ready`. */
+async function getDatabaseConnection({ token, orgId, projectId, databaseId }) {
+	const res = await platformFetch(`${MASTRA_PLATFORM_API_URL}/v1/server/projects/${encodeURIComponent(projectId)}/databases/${encodeURIComponent(databaseId)}/connection`, { headers: authHeaders(token, orgId) });
+	if (!res.ok) throw new PlatformApiError(res.status, `Failed to fetch connection string — ${await extractError(res)}`);
+	return await res.json();
+}
+/**
+* Poll `getDatabaseStatus` until the database is `ready`.
+*
+* Each poll is bounded by the *remaining* overall budget via a per-request
+* `AbortSignal`, so a hung `platformFetch` can't blow past `timeoutMs`. When
+* an outer `signal` is supplied it composes with the per-request timeout —
+* whichever fires first aborts the in-flight request.
+*
+* @param intervalMs how often to poll (default 2s)
+* @param timeoutMs total budget (default 60s)
+*/
+async function waitForDatabaseReady({ token, orgId, projectId, databaseId, intervalMs = 2e3, timeoutMs = 6e4, signal }) {
+	const deadline = Date.now() + timeoutMs;
+	let lastStatus = "provisioning";
+	const timeoutError = () => new PlatformApiError(504, `Neon database is still ${lastStatus} after ${Math.round(timeoutMs / 1e3)}s. Check the dashboard or retry \`mastra login\` + re-run.`);
+	while (true) {
+		signal?.throwIfAborted();
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw timeoutError();
+		const perRequestSignal = composeSignals(signal, AbortSignal.timeout(remaining));
+		let row;
+		try {
+			row = await getDatabaseStatus({
+				token,
+				orgId,
+				projectId,
+				databaseId,
+				signal: perRequestSignal
+			});
+		} catch (err) {
+			if (err instanceof DOMException && err.name === "TimeoutError") throw timeoutError();
+			throw err;
+		}
+		lastStatus = row.status;
+		if (row.status === "ready") return row;
+		if (row.status === "failed") throw new PlatformApiError(500, `Neon provisioning failed${row.error ? ` — ${row.error}` : ""}`);
+		if (Date.now() >= deadline) throw timeoutError();
+		await new Promise((resolve) => setTimeout(resolve, intervalMs));
+	}
+}
+/**
+* Compose an outer AbortSignal with a per-request timeout signal. Uses
+* `AbortSignal.any` where available (Node ≥20.3); falls back to a manual
+* proxy for older runtimes.
+*/
+function composeSignals(outer, inner) {
+	if (!outer) return inner;
+	if (typeof AbortSignal.any === "function") return AbortSignal.any([outer, inner]);
+	const controller = new AbortController();
+	const abort = (reason) => controller.abort(reason);
+	if (outer.aborted) abort(outer.reason);
+	else outer.addEventListener("abort", () => abort(outer.reason), { once: true });
+	if (inner.aborted) abort(inner.reason);
+	else inner.addEventListener("abort", () => abort(inner.reason), { once: true });
+	return controller.signal;
+}
+//#endregion
+//#region src/utils/clone.ts
+/** Rewrite the scaffolded package.json name to the chosen project name. */
+async function renameProject(projectPath, projectName) {
+	const pkgPath = path.join(projectPath, "package.json");
+	const pkg = JSON.parse(await fs$1.readFile(pkgPath, "utf8"));
+	pkg.name = toPackageName(projectName);
+	await fs$1.writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+}
+/** Best-effort conversion of a directory name into a valid npm package name. */
+function toPackageName(name) {
+	return name.toLowerCase().replace(/[^a-z0-9-_.~]+/g, "-").replace(/^[-_.]+|[-_.]+$/g, "") || "mastra-factory";
+}
+async function pathExists(filePath) {
+	try {
+		await fs$1.access(filePath);
+		return true;
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function directoryExists(dirPath) {
+	try {
+		return (await fs$1.stat(dirPath)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+async function cloneTemplate(repoUrl, targetPath) {
+	if (await pathExists(targetPath)) throw new Error(`Directory ${path.basename(targetPath)} already exists`);
+	const tempRoot = await fs$1.mkdtemp(path.join(path.dirname(targetPath), `.${path.basename(targetPath)}-`));
+	const tempTarget = path.join(tempRoot, "template");
+	try {
+		try {
+			await x("npx", [
+				"degit",
+				repoUrl.replace("https://github.com/", ""),
+				tempTarget
+			], {
+				throwOnError: true,
+				nodeOptions: { cwd: process.cwd() }
+			});
+			if ((await fs$1.readdir(tempTarget)).length === 0) throw new Error("degit completed without cloning template files");
+		} catch {
+			await fs$1.rm(tempTarget, {
+				recursive: true,
+				force: true
+			});
+			try {
+				await x("git", [
+					"clone",
+					repoUrl,
+					tempTarget
+				], {
+					throwOnError: true,
+					nodeOptions: { cwd: process.cwd() }
+				});
+				const gitDir = path.join(tempTarget, ".git");
+				if (await directoryExists(gitDir)) await fs$1.rm(gitDir, {
+					recursive: true,
+					force: true
+				});
+			} catch (gitError) {
+				throw new Error(`Failed to clone repository: ${gitError instanceof Error ? gitError.message : "Unknown error"}`);
+			}
+		}
+		if (await pathExists(targetPath)) throw new Error(`Directory ${path.basename(targetPath)} already exists`);
+		await fs$1.rename(tempTarget, targetPath);
+	} finally {
+		await fs$1.rm(tempRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+//#region src/utils/pm.ts
+function detectPackageManager() {
+	const userAgent = process.env.npm_config_user_agent || "";
+	const execPath = process.env.npm_execpath || "";
+	if (userAgent.includes("bun")) return "bun";
+	if (userAgent.includes("yarn")) return "yarn";
+	if (userAgent.includes("pnpm")) return "pnpm";
+	if (userAgent.includes("npm")) return "npm";
+	if (execPath.includes("bun")) return "bun";
+	if (execPath.includes("yarn")) return "yarn";
+	if (execPath.includes("pnpm")) return "pnpm";
+	if (execPath.includes("npm")) return "npm";
+	return "npm";
+}
+function getInstallArgs(packageManager) {
+	switch (packageManager) {
+		case "npm": return [
+			"install",
+			"--no-audit",
+			"--no-fund"
+		];
+		default: return ["install"];
+	}
+}
+//#endregion
+//#region src/create.ts
+const PROJECT_REGION_OPTIONS = [{
+	value: "eu",
+	label: "🇪🇺 eu"
+}, {
+	value: "us",
+	label: "🇺🇸 us"
+}];
+const NEON_REGION_BY_PROJECT_REGION = {
+	eu: "aws-eu-central-1",
+	us: "aws-us-west-2"
+};
+function parseProjectRegion(region) {
+	if (region === "eu" || region === "us") return region;
+	throw new Error(`Invalid --region "${region}". Expected one of: eu, us.`);
+}
+async function create(args) {
+	p.intro(color.inverse(" Mastra Factory "));
+	const requestedRegion = args.region ? parseProjectRegion(args.region) : void 0;
+	const projectName = args.projectName ?? await p.text({
+		message: "What do you want to name your project?",
+		placeholder: "my-mastra-factory",
+		validate: (value) => {
+			if (!value?.trim()) return `Project name can't be empty`;
+			if (fs.existsSync(path.resolve(value.trim()))) return `Directory ${value.trim()} already exists`;
+		}
+	});
+	if (p.isCancel(projectName)) {
+		p.cancel("Operation cancelled");
+		process.exit(0);
+	}
+	const projectPath = path.resolve(projectName);
+	const packageManager = detectPackageManager();
+	args.analytics.trackEvent("sf_create_started", {
+		package_manager: packageManager,
+		no_platform: Boolean(args.noPlatform)
+	});
+	const spinner = p.spinner();
+	spinner.start("Downloading the Mastra Factory template...");
+	try {
+		await cloneTemplate(args.template, projectPath);
+		await renameProject(projectPath, projectName);
+		const envPath = path.join(projectPath, ".env");
+		fs.copyFileSync(path.join(projectPath, ".env.example"), envPath);
+		try {
+			fs.chmodSync(envPath, 384);
+		} catch {}
+		spinner.stop("Template downloaded.");
+	} catch (err) {
+		spinner.stop("Template download failed.");
+		throw err;
+	}
+	const installSpinner = p.spinner();
+	installSpinner.start(`Installing dependencies...`);
+	try {
+		await x(packageManager, getInstallArgs(packageManager), {
+			throwOnError: true,
+			nodeOptions: { cwd: projectPath }
+		});
+		installSpinner.stop("Dependencies installed.");
+	} catch (err) {
+		installSpinner.stop("Dependency install failed.");
+		throw new Error(`${err instanceof Error ? err.message : String(err)}\nYou can retry manually: cd ${projectName} && ${packageManager} install`);
+	}
+	let platformResult = null;
+	let platformError = null;
+	let platformSkipped = false;
+	if (!args.noPlatform) try {
+		platformResult = await runPlatformProvisioning({
+			projectName,
+			projectPath,
+			region: requestedRegion,
+			org: args.org
+		});
+	} catch (err) {
+		if (err instanceof LoginCancelledError) {
+			platformSkipped = true;
+			p.log.info("Skipping Mastra platform setup.");
+		} else {
+			platformError = err instanceof Error ? err.message : String(err);
+			p.log.warn(`Platform provisioning failed: ${platformError}`);
+		}
+	}
+	let gitignoreOk = true;
+	try {
+		ensureEnvGitignored(projectPath);
+	} catch (err) {
+		gitignoreOk = false;
+		const detail = err instanceof Error ? err.message : String(err);
+		p.log.warn(`Could not update .gitignore to protect .env (${detail}). Skipping git init to avoid committing secrets. Add ".env" to .gitignore manually before running 'git init && git add -A'.`);
+	}
+	if (gitignoreOk) try {
+		await x("git", ["init", "-q"], {
+			throwOnError: true,
+			nodeOptions: { cwd: projectPath }
+		});
+		await x("git", ["add", "-A"], {
+			throwOnError: true,
+			nodeOptions: { cwd: projectPath }
+		});
+		await x("git", [
+			"commit",
+			"-q",
+			"-m",
+			"Initial commit from create-factory"
+		], {
+			throwOnError: true,
+			nodeOptions: { cwd: projectPath }
+		});
+	} catch {
+		p.log.warn("git init failed — you can initialize the repository yourself later.");
+	}
+	args.analytics.trackEvent("sf_create_completed", {
+		package_manager: packageManager,
+		no_platform: Boolean(args.noPlatform),
+		platform_provisioned: platformResult !== null
+	});
+	const lines = [
+		color.green("Your Mastra Factory is ready!"),
+		"",
+		`${color.cyan("cd")} ${projectName}`,
+		color.cyan(`${packageManager} run dev`),
+		"",
+		`Factory UI     ${color.underline("http://localhost:4111")}`,
+		""
+	];
+	if (platformResult) lines.push(`${color.green("Provisioned on Mastra platform")} in ${color.cyan(platformResult.orgName)}:`, `  - Project ${color.cyan(platformResult.project.name)}`, `  - Postgres database (credentials written to ${color.cyan(".env")})`, `  - Sandboxes (code agent sessions run here)`, "", `Manage your project at ${color.underline("https://projects.mastra.ai")}`);
+	else if (platformSkipped) lines.push(`${color.yellow("Skipped Mastra platform setup.")} Configure ${color.cyan(".env")} manually before running.`);
+	else if (args.noPlatform) lines.push(`${color.yellow("Skipped platform provisioning (--no-platform).")} Configure ${color.cyan(".env")} manually before running.`);
+	else if (platformError) lines.push(`${color.yellow("Platform provisioning failed:")} ${platformError}`, `Any credentials that were minted before the failure have been written to ${color.cyan(".env")}. Re-run \`npx create factory\` after fixing, or fill in the rest manually from ${color.underline("https://platform.mastra.ai")}.`);
+	else lines.push("Open the Factory UI to finish setup (models, integrations, database).");
+	p.note(lines.join("\n"), "Next steps");
+}
+async function runPlatformProvisioning({ projectName, projectPath, region, org }) {
+	const envAccumulator = {};
+	const envPath = path.join(projectPath, ".env");
+	let flushed = false;
+	const flush = () => {
+		if (flushed || Object.keys(envAccumulator).length === 0) return;
+		upsertEnvFile(envPath, envAccumulator);
+		flushed = true;
+	};
+	try {
+		if (!process.env.MASTRA_API_TOKEN && !await loadCredentials()) {
+			const proceed = await p.text({
+				message: "Mastra account is required, press enter to continue...",
+				defaultValue: ""
+			});
+			if (p.isCancel(proceed)) {
+				p.cancel("Operation cancelled");
+				process.exit(0);
+			}
+		}
+		p.log.info("Signing in to Mastra…");
+		const token = await getToken(void 0, { skipOnInput: true });
+		const { orgId, orgName } = org ? await resolveOrgFromFlag(token, org) : await resolveCurrentOrg(token, { forcePrompt: true });
+		p.log.info(`Using organization ${color.cyan(orgName)}.`);
+		envAccumulator.MASTRA_ORGANIZATION_ID = orgId;
+		const projectRegion = region ?? await p.select({
+			message: "Where should your Factory project run?",
+			options: [...PROJECT_REGION_OPTIONS]
+		});
+		if (p.isCancel(projectRegion)) {
+			p.cancel("Operation cancelled");
+			process.exit(0);
+		}
+		const projectSpinner = p.spinner();
+		projectSpinner.start(`Creating platform project "${projectName}"…`);
+		let project;
+		try {
+			project = await createServerProject({
+				token,
+				orgId,
+				name: projectName,
+				region: projectRegion
+			});
+			projectSpinner.stop(`Created platform project ${color.cyan(project.slug)}.`);
+		} catch (err) {
+			projectSpinner.stop("Project creation failed.");
+			throw err;
+		}
+		envAccumulator.MASTRA_PROJECT_ID = project.id;
+		const keySpinner = p.spinner();
+		keySpinner.start("Creating platform API key…");
+		let secretKey;
+		try {
+			secretKey = await mintOrgApiKey({
+				token,
+				orgId,
+				keyName: `create-factory: ${projectName}`
+			});
+			keySpinner.stop("Platform API key created.");
+		} catch (err) {
+			keySpinner.stop("API key creation failed.");
+			throw err;
+		}
+		envAccumulator.MASTRA_PLATFORM_SECRET_KEY = secretKey;
+		const environmentSpinner = p.spinner();
+		environmentSpinner.start("Configuring production environment…");
+		try {
+			envAccumulator.MASTRA_ENVIRONMENT_ID = await ensureProductionEnvironment({
+				token,
+				orgId,
+				projectId: project.id,
+				region: projectRegion
+			});
+			environmentSpinner.stop("Production environment ready.");
+		} catch (err) {
+			environmentSpinner.stop("Environment setup failed.");
+			throw err;
+		}
+		const neonSpinner = p.spinner();
+		neonSpinner.start("Provisioning Neon Postgres database…");
+		let databaseUrl;
+		try {
+			const attached = await attachNeonDatabase({
+				token,
+				orgId,
+				projectId: project.id,
+				name: sanitizeDatabaseName(projectName),
+				regionId: NEON_REGION_BY_PROJECT_REGION[projectRegion]
+			});
+			const ready = await waitForDatabaseReady({
+				token,
+				orgId,
+				projectId: project.id,
+				databaseId: attached.id
+			});
+			const dbEnv = (await getDatabaseConnection({
+				token,
+				orgId,
+				projectId: project.id,
+				databaseId: ready.id
+			})).envVars.find((v) => v.name === "DATABASE_URL");
+			if (!dbEnv?.value) throw new PlatformApiError(500, "Platform connection response missing DATABASE_URL.");
+			databaseUrl = dbEnv.value;
+			neonSpinner.stop("Neon database ready.");
+		} catch (err) {
+			neonSpinner.stop("Database provisioning failed.");
+			throw err;
+		}
+		envAccumulator.DATABASE_URL = databaseUrl;
+		flush();
+		return {
+			orgId,
+			orgName,
+			project,
+			secretKey,
+			databaseUrl
+		};
+	} finally {
+		flush();
+	}
+}
+/**
+* `--org <value>` matches by org id or exact name. Not a substring match —
+* an ambiguous or non-existent value bails with a clear message instead of
+* silently picking the wrong org.
+*/
+async function resolveOrgFromFlag(token, value) {
+	const orgs = await fetchOrgs(token);
+	const match = orgs.find((o) => o.id === value || o.name === value);
+	if (!match) {
+		const available = orgs.map((o) => `${o.name} (${o.id})`).join(", ") || "(none)";
+		throw new Error(`No organization matched --org "${value}". Available: ${available}.`);
+	}
+	return {
+		orgId: match.id,
+		orgName: match.name
+	};
+}
+/**
+* Neon display-name charset: `[a-zA-Z0-9_-]+`, up to 64 chars. Drop anything
+* outside that, and clip length.
+*/
+function sanitizeDatabaseName(projectName) {
+	return (projectName.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/^-+|-+$/g, "") || "factory").slice(0, 64);
+}
+/**
+* Append `.env` to the scaffolded project's `.gitignore` if it isn't already
+* ignored. Runs before the initial `git add -A` so freshly-provisioned platform
+* credentials (MASTRA_PLATFORM_SECRET_KEY, DATABASE_URL) never reach the
+* initial commit.
+*
+* Throws if `.gitignore` cannot be written. Callers MUST treat this as fatal
+* for the git-init step when `.env` may already contain platform secrets —
+* silently continuing would stage secrets into the initial commit.
+*/
+function ensureEnvGitignored(projectPath) {
+	const gitignorePath = path.join(projectPath, ".gitignore");
+	const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
+	if (existing.split(/\r?\n/).map((line) => line.trim()).some((line) => {
+		if (!line || line.startsWith("#")) return false;
+		return line === ".env" || line === ".env*" || line === "/.env" || line === "/.env*";
+	})) return;
+	const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+	fs.writeFileSync(gitignorePath, `${existing}${prefix}\n# Added by create-factory to protect platform credentials\n.env\n`);
+}
+//#endregion
+//#region src/utils/redact.ts
+/**
+* Sanitizes error messages before they are sent to analytics.
+*
+* Failure telemetry reports `error.message`, and several failure paths embed
+* user-supplied input in their messages: a clone failure includes the full
+* `git clone <url>` command (a custom template URL can identify a private repo
+* and may carry embedded credentials), and `--region`/`--org` validation
+* errors echo the raw flag value back. The user still sees the original
+* message on stderr — only the analytics copy is redacted.
+*/
+const REDACTED = "[redacted]";
+/** Strips `user:password@` credentials from any URL in the message. */
+function stripUrlCredentials(message) {
+	return message.replace(/\/\/[^\s/@]+@/g, `//${REDACTED}@`);
+}
+/**
+* A value can surface in messages in derived forms: without embedded
+* credentials (git may omit them when echoing the URL) or with the
+* `https://github.com/` prefix stripped (degit's repo shorthand).
+*/
+function variantsOf(value) {
+	const variants = /* @__PURE__ */ new Set([value, value.replace(/\/\/[^\s/@]+@/g, "//")]);
+	for (const variant of [...variants]) if (variant.startsWith("https://github.com/")) variants.add(variant.slice(19));
+	return [...variants];
+}
+/**
+* Redacts every literal occurrence (and derived variant) of the provided
+* user-supplied values, any URL credentials, and the org list echoed by
+* `--org` mismatch errors.
+*/
+function redactErrorMessage(message, sensitiveValues = []) {
+	let redacted = message;
+	for (const value of sensitiveValues) {
+		if (!value) continue;
+		for (const variant of variantsOf(value)) redacted = redacted.split(variant).join(REDACTED);
+	}
+	redacted = stripUrlCredentials(redacted);
+	redacted = redacted.replace(/Available: .*$/s, `Available: ${REDACTED}.`);
+	return redacted;
+}
+/** Returns a copy of `error` safe to report to analytics. */
+function redactError(error, sensitiveValues = []) {
+	const message = error instanceof Error ? error.message : String(error);
+	return new Error(redactErrorMessage(message, sensitiveValues));
+}
+//#endregion
+//#region src/index.ts
+const pkg = JSON.parse(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8"));
+const analytics = new PosthogAnalytics({
+	apiKey: "phc_SBLpZVAB6jmHOct9CABq3PF0Yn5FU3G2FgT4xUr2XrT",
+	host: "https://us.posthog.com",
+	version: pkg.version
+});
+setAnalytics(analytics);
+const program = new Command();
+const DEFAULT_TEMPLATE_REPO = "https://github.com/mastra-ai/softwarefactory-template";
+program.name("create-factory").description("Create a new Mastra Factory project").argument("[project-name]", "Directory name of the project").option("--template <template-name>", "Create a project from a template (public GitHub URL)", DEFAULT_TEMPLATE_REPO).option("--no-platform", "Skip Mastra platform sign-in, project, and Neon provisioning").option("--org <org>", "Mastra organization id or name — skips the interactive org picker").option("--region <region>", "Platform project region (eu or us); prompts when omitted").version(pkg.version, "-v, --version").action(async (projectNameArg, args) => {
+	const region = args.region ? String(args.region) : void 0;
+	const validRegion = region === "eu" || region === "us" ? region : void 0;
+	const sensitiveValues = [
+		args.template === DEFAULT_TEMPLATE_REPO ? void 0 : args.template,
+		args.org ? String(args.org) : void 0,
+		validRegion ? void 0 : region,
+		projectNameArg
+	];
+	let rawError;
+	try {
+		await analytics.trackCommandExecution({
+			command: "create-factory",
+			args: {
+				default_template: args.template === DEFAULT_TEMPLATE_REPO,
+				no_platform: args.platform === false,
+				has_org: Boolean(args.org),
+				region: validRegion ?? (region ? "invalid" : void 0)
+			},
+			execution: async () => {
+				try {
+					await create({
+						projectName: projectNameArg,
+						template: args.template,
+						noPlatform: args.platform === false,
+						org: args.org ? String(args.org) : void 0,
+						region,
+						analytics
+					});
+				} catch (err) {
+					rawError = err;
+					throw redactError(err, sensitiveValues);
+				}
+			}
+		});
+	} catch (err) {
+		throw rawError ?? err;
+	}
+});
+try {
+	await program.parseAsync(process.argv);
+} catch (err) {
+	console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+	process.exitCode = 1;
+} finally {
+	await analytics.shutdown(1e3);
+}
+//#endregion
+export {};

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "create-factory",
+  "version": "0.0.0-aggregate-trace-20261015182851",
+  "description": "Create a Mastra Factory project: an agent-powered software delivery environment built on Mastra. Run `npm create factory` to scaffold and get started.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "bin": {
+    "create-factory": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mastra-ai/mastra.git",
+    "directory": "mastracode/mastra-factory"
+  },
+  "homepage": "https://mastra.ai",
+  "bugs": {
+    "url": "https://github.com/mastra-ai/mastra/issues"
+  },
+  "keywords": [
+    "mastra",
+    "software-factory",
+    "create",
+    "scaffold",
+    "cli",
+    "agents",
+    "ai"
+  ],
+  "dependencies": {
+    "@clack/prompts": "^1.7.0",
+    "commander": "^14.0.3",
+    "picocolors": "^1.1.1",
+    "tinyexec": "^1.2.4",
+    "mastra": "0.0.0-aggregate-trace-20261015182851"
+  },
+  "devDependencies": {
+    "@types/node": "22.20.1",
+    "eslint": "^10.4.1",
+    "tsdown": "0.22.9",
+    "typescript": "^7.0.2",
+    "vitest": "4.1.11",
+    "@internal/lint": "0.0.0-aggregate-trace-20261015182851"
+  },
+  "scripts": {
+    "build": "tsdown --silent --config tsdown.config.ts",
+    "check": "tsc --noEmit",
+    "test": "vitest run",
+    "lint": "oxlint . && eslint .",
+    "lint:fix": "oxlint --fix . && eslint --fix ."
+  }
+}