@agent-native/core 0.70.3 → 0.72.0

package/dist/audit/record.js

@@ -0,0 +1,106 @@
+/**
+ * Audit capture entry point, called from the `defineAction` audit wrapper after
+ * an action runs (success or error). Best-effort: any failure here is swallowed
+ * so auditing never breaks the action it observes.
+ *
+ * This module touches the DB (`store.js`), so `action.ts` loads it lazily via
+ * dynamic import on the first audited call — keeping the DB client out of every
+ * bundle that merely defines actions.
+ */
+import { deriveActorKind, isAuditDisabled, shouldRecordAudit, } from "./config.js";
+import { redactArgsToJson } from "./redact.js";
+import { insertAuditEvent } from "./store.js";
+function errorCode(error) {
+    if (!error)
+        return null;
+    if (typeof error === "object") {
+        const e = error;
+        if (typeof e.errorCode === "string")
+            return e.errorCode;
+        if (typeof e.code === "string")
+            return e.code;
+        if (typeof e.name === "string")
+            return e.name;
+    }
+    return "error";
+}
+function safeTarget(config, args, result, meta) {
+    if (!config?.target)
+        return null;
+    try {
+        return config.target(args, result, meta) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function safeSummary(config, args, result, meta) {
+    if (!config?.summary)
+        return null;
+    try {
+        const s = config.summary(args, result, meta);
+        return typeof s === "string" ? s.slice(0, 500) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Record one audit event. Resolves the actor, target, ownership (for scoped
+ * reads), and redacted inputs, then appends a row. Never throws.
+ */
+export async function recordActionAudit(input) {
+    try {
+        if (isAuditDisabled())
+            return;
+        const ctx = input.ctx;
+        const actionName = ctx?.actionName;
+        // No name → an internal/programmatic run() with no dispatch context. Skip
+        // rather than write a nameless row.
+        if (!actionName)
+            return;
+        if (!shouldRecordAudit(input.config, actionName))
+            return;
+        const caller = ctx?.caller ?? "http";
+        const actorEmail = ctx?.userEmail ?? null;
+        const meta = {
+            status: input.status,
+            caller,
+            userEmail: ctx?.userEmail,
+            orgId: ctx?.orgId ?? null,
+        };
+        const target = safeTarget(input.config, input.args, input.result, meta);
+        const summary = safeSummary(input.config, input.args, input.result, meta);
+        const recordInputs = input.config?.recordInputs !== false;
+        const inputJson = recordInputs ? redactArgsToJson(input.args) : null;
+        const event = {
+            id: crypto.randomUUID(),
+            createdAt: Date.now(),
+            action: actionName,
+            caller,
+            actorKind: deriveActorKind(caller, actorEmail),
+            actorEmail,
+            orgId: ctx?.orgId ?? null,
+            threadId: ctx?.threadId ?? null,
+            turnId: ctx?.turnId ?? null,
+            targetType: target?.type ?? null,
+            targetId: target?.id ?? null,
+            status: input.status,
+            summary,
+            input: inputJson,
+            errorCode: input.status === "error" ? errorCode(input.error) : null,
+            // Scope reads to the resource owner when the action declares one,
+            // otherwise to the actor (the common self-mutation case).
+            ownerEmail: target?.ownerEmail ?? actorEmail,
+            visibility: target?.visibility ?? "private",
+        };
+        // org_id used for scoping defaults to the target's, else the actor's org.
+        if (target?.orgId !== undefined)
+            event.orgId = target.orgId;
+        await insertAuditEvent(event);
+    }
+    catch {
+        // Best-effort — auditing must never break the audited action.
+    }
+}
+//# sourceMappingURL=record.js.map

package/dist/audit/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../src/audit/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA4B9C,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAgE,CAAC;QAC3E,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,MAAqC,EACrC,IAAa,EACb,MAAe,EACf,IAAmB;IAEnB,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAAqC,EACrC,IAAa,EACb,MAAe,EACf,IAAmB;IAEnB,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,IAAI,CAAC;QACH,IAAI,eAAe,EAAE;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,CAAC;QACnC,0EAA0E;QAC1E,oCAAoC;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO;QAEzD,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAkB;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1E,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,KAAK,KAAK,CAAC;QAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;YAClB,MAAM;YACN,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9C,UAAU;YACV,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;YACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;YAC/B,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI;YAC3B,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;YAChC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;YACP,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACnE,kEAAkE;YAClE,0DAA0D;YAC1D,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,UAAU;YAC5C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;SAC5C,CAAC;QACF,0EAA0E;QAC1E,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAE5D,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC","sourcesContent":["/**\n * Audit capture entry point, called from the `defineAction` audit wrapper after\n * an action runs (success or error). Best-effort: any failure here is swallowed\n * so auditing never breaks the action it observes.\n *\n * This module touches the DB (`store.js`), so `action.ts` loads it lazily via\n * dynamic import on the first audited call — keeping the DB client out of every\n * bundle that merely defines actions.\n */\nimport {\n  deriveActorKind,\n  isAuditDisabled,\n  shouldRecordAudit,\n} from \"./config.js\";\nimport { redactArgsToJson } from \"./redact.js\";\nimport { insertAuditEvent } from \"./store.js\";\nimport type {\n  ActionAuditConfig,\n  AuditCallMeta,\n  AuditEvent,\n  AuditStatus,\n  AuditTarget,\n} from \"./types.js\";\n\n/** Minimal view of the action run context the recorder needs. */\nexport interface AuditRunContextLike {\n  actionName?: string;\n  caller?: string;\n  userEmail?: string;\n  orgId?: string | null;\n  threadId?: string;\n  turnId?: string;\n}\n\nexport interface RecordActionAuditInput {\n  config: ActionAuditConfig | undefined;\n  args: unknown;\n  ctx: AuditRunContextLike | undefined;\n  status: AuditStatus;\n  result?: unknown;\n  error?: unknown;\n}\n\nfunction errorCode(error: unknown): string | null {\n  if (!error) return null;\n  if (typeof error === \"object\") {\n    const e = error as { errorCode?: unknown; code?: unknown; name?: unknown };\n    if (typeof e.errorCode === \"string\") return e.errorCode;\n    if (typeof e.code === \"string\") return e.code;\n    if (typeof e.name === \"string\") return e.name;\n  }\n  return \"error\";\n}\n\nfunction safeTarget(\n  config: ActionAuditConfig | undefined,\n  args: unknown,\n  result: unknown,\n  meta: AuditCallMeta,\n): AuditTarget | null {\n  if (!config?.target) return null;\n  try {\n    return config.target(args, result, meta) ?? null;\n  } catch {\n    return null;\n  }\n}\n\nfunction safeSummary(\n  config: ActionAuditConfig | undefined,\n  args: unknown,\n  result: unknown,\n  meta: AuditCallMeta,\n): string | null {\n  if (!config?.summary) return null;\n  try {\n    const s = config.summary(args, result, meta);\n    return typeof s === \"string\" ? s.slice(0, 500) : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Record one audit event. Resolves the actor, target, ownership (for scoped\n * reads), and redacted inputs, then appends a row. Never throws.\n */\nexport async function recordActionAudit(\n  input: RecordActionAuditInput,\n): Promise<void> {\n  try {\n    if (isAuditDisabled()) return;\n    const ctx = input.ctx;\n    const actionName = ctx?.actionName;\n    // No name → an internal/programmatic run() with no dispatch context. Skip\n    // rather than write a nameless row.\n    if (!actionName) return;\n    if (!shouldRecordAudit(input.config, actionName)) return;\n\n    const caller = ctx?.caller ?? \"http\";\n    const actorEmail = ctx?.userEmail ?? null;\n    const meta: AuditCallMeta = {\n      status: input.status,\n      caller,\n      userEmail: ctx?.userEmail,\n      orgId: ctx?.orgId ?? null,\n    };\n\n    const target = safeTarget(input.config, input.args, input.result, meta);\n    const summary = safeSummary(input.config, input.args, input.result, meta);\n\n    const recordInputs = input.config?.recordInputs !== false;\n    const inputJson = recordInputs ? redactArgsToJson(input.args) : null;\n\n    const event: AuditEvent = {\n      id: crypto.randomUUID(),\n      createdAt: Date.now(),\n      action: actionName,\n      caller,\n      actorKind: deriveActorKind(caller, actorEmail),\n      actorEmail,\n      orgId: ctx?.orgId ?? null,\n      threadId: ctx?.threadId ?? null,\n      turnId: ctx?.turnId ?? null,\n      targetType: target?.type ?? null,\n      targetId: target?.id ?? null,\n      status: input.status,\n      summary,\n      input: inputJson,\n      errorCode: input.status === \"error\" ? errorCode(input.error) : null,\n      // Scope reads to the resource owner when the action declares one,\n      // otherwise to the actor (the common self-mutation case).\n      ownerEmail: target?.ownerEmail ?? actorEmail,\n      visibility: target?.visibility ?? \"private\",\n    };\n    // org_id used for scoping defaults to the target's, else the actor's org.\n    if (target?.orgId !== undefined) event.orgId = target.orgId;\n\n    await insertAuditEvent(event);\n  } catch {\n    // Best-effort — auditing must never break the audited action.\n  }\n}\n"]}

package/dist/audit/redact.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Redaction for audit-captured arguments.
+ *
+ * The audit log must never become a secondary store of secrets. Before any
+ * call arguments are persisted we:
+ *  - drop values under credential-looking keys (token, secret, password, …),
+ *  - redact string values that look like bearer tokens / long opaque keys,
+ *  - truncate oversized strings and cap the serialized payload size.
+ *
+ * This mirrors the framework's standing rule that credential-looking literals
+ * never land in source, logs, or fixtures.
+ */
+/** Heuristic: does a bare string value look like a secret? */
+declare function looksSecret(value: string): boolean;
+declare function redact(value: unknown, depth: number): unknown;
+/**
+ * Redact and serialize call arguments to a capped JSON string, or `null` when
+ * there is nothing to record. Never throws.
+ */
+export declare function redactArgsToJson(args: unknown): string | null;
+/** Exposed for tests. */
+export declare const __test: {
+    looksSecret: typeof looksSecret;
+    redact: typeof redact;
+    SENSITIVE_KEY: RegExp;
+};
+export {};
+//# sourceMappingURL=redact.d.ts.map

package/dist/audit/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/audit/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,8DAA8D;AAC9D,iBAAS,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAkB3C;AAUD,iBAAS,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA0BtD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAqB7D;AAED,yBAAyB;AACzB,eAAO,MAAM,MAAM;;;;CAAyC,CAAC"}

package/dist/audit/redact.js

@@ -0,0 +1,109 @@
+/**
+ * Redaction for audit-captured arguments.
+ *
+ * The audit log must never become a secondary store of secrets. Before any
+ * call arguments are persisted we:
+ *  - drop values under credential-looking keys (token, secret, password, …),
+ *  - redact string values that look like bearer tokens / long opaque keys,
+ *  - truncate oversized strings and cap the serialized payload size.
+ *
+ * This mirrors the framework's standing rule that credential-looking literals
+ * never land in source, logs, or fixtures.
+ */
+const SENSITIVE_KEY = /(pass(word|phrase)?|secret|token|api[_-]?key|apikey|authorization|bearer|credential|cookie|session[_-]?(id|token)|private[_-]?key|client[_-]?secret|signing[_-]?secret|access[_-]?key|refresh[_-]?token|webhook[_-]?(url|secret))/i;
+const REDACTED = "[redacted]";
+const MAX_STRING = 2000;
+const MAX_DEPTH = 6;
+const MAX_KEYS = 100;
+const MAX_ARRAY = 100;
+const MAX_JSON = 8000;
+/** Heuristic: does a bare string value look like a secret? */
+function looksSecret(value) {
+    if (/^bearer\s+\S/i.test(value))
+        return true;
+    // Long, unbroken, high-entropy-ish opaque token (hex/base64url, no spaces).
+    if (value.length >= 32 && /^[A-Za-z0-9_\-+/=.]+$/.test(value))
+        return true;
+    // Common secret prefixes (Stripe, GitHub, OpenAI, Slack, AWS, …).
+    if (/^(sk|pk|rk|ghp|gho|xox[baprs]|AKIA|AIza|ya29)[-_]/i.test(value)) {
+        return true;
+    }
+    // Webhook URLs carry their secret in the path — redact regardless of the key
+    // they arrive under (e.g. a generic `value` field holding a Slack webhook).
+    if (/^https?:\/\/(hooks\.slack\.com\/|[^/]*\.webhook\.office\.com\/|(canary\.|ptb\.)?discord(app)?\.com\/api\/webhooks\/|hooks\.zapier\.com\/|maker\.ifttt\.com\/|discord\.com\/api\/webhooks\/)/i.test(value)) {
+        return true;
+    }
+    return false;
+}
+function redactString(value) {
+    if (looksSecret(value))
+        return REDACTED;
+    if (value.length > MAX_STRING) {
+        return `${value.slice(0, MAX_STRING)}…(${value.length - MAX_STRING} more chars)`;
+    }
+    return value;
+}
+function redact(value, depth) {
+    if (value == null)
+        return value;
+    if (typeof value === "string")
+        return redactString(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return value;
+    if (depth >= MAX_DEPTH)
+        return "[…]";
+    if (Array.isArray(value)) {
+        const out = value.slice(0, MAX_ARRAY).map((v) => redact(v, depth + 1));
+        if (value.length > MAX_ARRAY)
+            out.push(`…(${value.length - MAX_ARRAY} more)`);
+        return out;
+    }
+    if (typeof value === "object") {
+        const out = {};
+        let n = 0;
+        for (const [k, v] of Object.entries(value)) {
+            if (n >= MAX_KEYS) {
+                out["…"] = "(truncated)";
+                break;
+            }
+            n += 1;
+            out[k] = SENSITIVE_KEY.test(k) ? REDACTED : redact(v, depth + 1);
+        }
+        return out;
+    }
+    // Functions, symbols, bigint, etc. — not serializable / not interesting.
+    return undefined;
+}
+/**
+ * Redact and serialize call arguments to a capped JSON string, or `null` when
+ * there is nothing to record. Never throws.
+ */
+export function redactArgsToJson(args) {
+    try {
+        if (args == null)
+            return null;
+        const redacted = redact(args, 0);
+        if (redacted === undefined)
+            return null;
+        const json = JSON.stringify(redacted);
+        if (json == null)
+            return null;
+        if (json.length > MAX_JSON) {
+            // Slicing the serialized JSON would yield an unparseable string. Wrap a
+            // preview in a valid envelope so `get-audit-event` can always JSON.parse
+            // the stored `input`.
+            return JSON.stringify({
+                _auditTruncated: true,
+                originalBytes: json.length,
+                preview: json.slice(0, MAX_JSON),
+            });
+        }
+        return json;
+    }
+    catch {
+        return null;
+    }
+}
+/** Exposed for tests. */
+export const __test = { looksSecret, redact, SENSITIVE_KEY };
+//# sourceMappingURL=redact.js.map

package/dist/audit/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/audit/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,aAAa,GACjB,oOAAoO,CAAC;AAEvO,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB,8DAA8D;AAC9D,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,4EAA4E;IAC5E,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,kEAAkE;IAClE,IAAI,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,IACE,8LAA8L,CAAC,IAAI,CACjM,KAAK,CACN,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,UAAU,cAAc,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAC1B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAClB,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,yEAAyE;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,CAAC;QACH,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC3B,wEAAwE;YACxE,yEAAyE;YACzE,sBAAsB;YACtB,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,eAAe,EAAE,IAAI;gBACrB,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yBAAyB;AACzB,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC","sourcesContent":["/**\n * Redaction for audit-captured arguments.\n *\n * The audit log must never become a secondary store of secrets. Before any\n * call arguments are persisted we:\n *  - drop values under credential-looking keys (token, secret, password, …),\n *  - redact string values that look like bearer tokens / long opaque keys,\n *  - truncate oversized strings and cap the serialized payload size.\n *\n * This mirrors the framework's standing rule that credential-looking literals\n * never land in source, logs, or fixtures.\n */\n\nconst SENSITIVE_KEY =\n  /(pass(word|phrase)?|secret|token|api[_-]?key|apikey|authorization|bearer|credential|cookie|session[_-]?(id|token)|private[_-]?key|client[_-]?secret|signing[_-]?secret|access[_-]?key|refresh[_-]?token|webhook[_-]?(url|secret))/i;\n\nconst REDACTED = \"[redacted]\";\nconst MAX_STRING = 2000;\nconst MAX_DEPTH = 6;\nconst MAX_KEYS = 100;\nconst MAX_ARRAY = 100;\nconst MAX_JSON = 8000;\n\n/** Heuristic: does a bare string value look like a secret? */\nfunction looksSecret(value: string): boolean {\n  if (/^bearer\\s+\\S/i.test(value)) return true;\n  // Long, unbroken, high-entropy-ish opaque token (hex/base64url, no spaces).\n  if (value.length >= 32 && /^[A-Za-z0-9_\\-+/=.]+$/.test(value)) return true;\n  // Common secret prefixes (Stripe, GitHub, OpenAI, Slack, AWS, …).\n  if (/^(sk|pk|rk|ghp|gho|xox[baprs]|AKIA|AIza|ya29)[-_]/i.test(value)) {\n    return true;\n  }\n  // Webhook URLs carry their secret in the path — redact regardless of the key\n  // they arrive under (e.g. a generic `value` field holding a Slack webhook).\n  if (\n    /^https?:\\/\\/(hooks\\.slack\\.com\\/|[^/]*\\.webhook\\.office\\.com\\/|(canary\\.|ptb\\.)?discord(app)?\\.com\\/api\\/webhooks\\/|hooks\\.zapier\\.com\\/|maker\\.ifttt\\.com\\/|discord\\.com\\/api\\/webhooks\\/)/i.test(\n      value,\n    )\n  ) {\n    return true;\n  }\n  return false;\n}\n\nfunction redactString(value: string): string {\n  if (looksSecret(value)) return REDACTED;\n  if (value.length > MAX_STRING) {\n    return `${value.slice(0, MAX_STRING)}…(${value.length - MAX_STRING} more chars)`;\n  }\n  return value;\n}\n\nfunction redact(value: unknown, depth: number): unknown {\n  if (value == null) return value;\n  if (typeof value === \"string\") return redactString(value);\n  if (typeof value === \"number\" || typeof value === \"boolean\") return value;\n  if (depth >= MAX_DEPTH) return \"[…]\";\n  if (Array.isArray(value)) {\n    const out = value.slice(0, MAX_ARRAY).map((v) => redact(v, depth + 1));\n    if (value.length > MAX_ARRAY)\n      out.push(`…(${value.length - MAX_ARRAY} more)`);\n    return out;\n  }\n  if (typeof value === \"object\") {\n    const out: Record<string, unknown> = {};\n    let n = 0;\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      if (n >= MAX_KEYS) {\n        out[\"…\"] = \"(truncated)\";\n        break;\n      }\n      n += 1;\n      out[k] = SENSITIVE_KEY.test(k) ? REDACTED : redact(v, depth + 1);\n    }\n    return out;\n  }\n  // Functions, symbols, bigint, etc. — not serializable / not interesting.\n  return undefined;\n}\n\n/**\n * Redact and serialize call arguments to a capped JSON string, or `null` when\n * there is nothing to record. Never throws.\n */\nexport function redactArgsToJson(args: unknown): string | null {\n  try {\n    if (args == null) return null;\n    const redacted = redact(args, 0);\n    if (redacted === undefined) return null;\n    const json = JSON.stringify(redacted);\n    if (json == null) return null;\n    if (json.length > MAX_JSON) {\n      // Slicing the serialized JSON would yield an unparseable string. Wrap a\n      // preview in a valid envelope so `get-audit-event` can always JSON.parse\n      // the stored `input`.\n      return JSON.stringify({\n        _auditTruncated: true,\n        originalBytes: json.length,\n        preview: json.slice(0, MAX_JSON),\n      });\n    }\n    return json;\n  } catch {\n    return null;\n  }\n}\n\n/** Exposed for tests. */\nexport const __test = { looksSecret, redact, SENSITIVE_KEY };\n"]}

package/dist/audit/store.d.ts

@@ -0,0 +1,14 @@
+import type { AuditEvent, AuditQueryFilters } from "./types.js";
+export declare function ensureAuditTables(): Promise<void>;
+export declare function insertAuditEvent(event: AuditEvent): Promise<void>;
+export interface AuditReadScope {
+    userEmail?: string;
+    orgId?: string | null;
+}
+export declare function queryAuditEvents(scope: AuditReadScope, filters?: AuditQueryFilters): Promise<AuditEvent[]>;
+export declare function getAuditEventById(id: string, scope: AuditReadScope): Promise<AuditEvent | null>;
+/** Purge audit rows older than `cutoffMs`. Returns the deleted row count. */
+export declare function deleteOldAuditEvents(cutoffMs: number): Promise<number>;
+/** Test-only: reset the cached init promise so a fresh DB re-creates tables. */
+export declare function __resetAuditInitForTests(): void;
+//# sourceMappingURL=store.d.ts.map

package/dist/audit/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAIpB,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmDvD;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BvE;AAwBD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA2CD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,CAsCvB;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAW5B;AAED,6EAA6E;AAC7E,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ5E;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C"}

package/dist/audit/store.js

@@ -0,0 +1,219 @@
+/**
+ * SQL persistence for the framework audit log.
+ *
+ * Follows the same raw-SQL, provider-agnostic pattern as observability/store.ts
+ * and usage/store.ts — framework tables use `getDbExec()` + `intType()` rather
+ * than Drizzle ORM (which is for template-level schemas). One append-only table
+ * `agent_audit_log`; reads are scoped to the caller's identity in SQL (no
+ * shares table — audit rows are never individually shared).
+ */
+import { getDbExec, intType, retryOnDdlRace } from "../db/client.js";
+let _initPromise;
+export async function ensureAuditTables() {
+    if (!_initPromise) {
+        _initPromise = (async () => {
+            const client = getDbExec();
+            await retryOnDdlRace(() => client.execute(`
+        CREATE TABLE IF NOT EXISTS agent_audit_log (
+          id TEXT PRIMARY KEY,
+          created_at ${intType()} NOT NULL,
+          action TEXT NOT NULL,
+          caller TEXT NOT NULL,
+          actor_kind TEXT NOT NULL,
+          actor_email TEXT,
+          org_id TEXT,
+          thread_id TEXT,
+          turn_id TEXT,
+          target_type TEXT,
+          target_id TEXT,
+          status TEXT NOT NULL DEFAULT 'success',
+          summary TEXT,
+          input TEXT,
+          error_code TEXT,
+          owner_email TEXT,
+          visibility TEXT NOT NULL DEFAULT 'private'
+        )
+      `));
+            const indexes = [
+                `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,
+                `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,
+                `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`,
+                `CREATE INDEX IF NOT EXISTS idx_audit_turn ON agent_audit_log (turn_id)`,
+                `CREATE INDEX IF NOT EXISTS idx_audit_actor ON agent_audit_log (actor_email, created_at)`,
+                `CREATE INDEX IF NOT EXISTS idx_audit_created ON agent_audit_log (created_at)`,
+            ];
+            for (const sql of indexes) {
+                try {
+                    await client.execute(sql);
+                }
+                catch {
+                    // Index creation is best-effort; a racing boot may have created it.
+                }
+            }
+        })().catch((err) => {
+            // Allow a later call to retry if the first init failed.
+            _initPromise = undefined;
+            throw err;
+        });
+    }
+    return _initPromise;
+}
+export async function insertAuditEvent(event) {
+    await ensureAuditTables();
+    const client = getDbExec();
+    await client.execute({
+        sql: `INSERT INTO agent_audit_log
+      (id, created_at, action, caller, actor_kind, actor_email, org_id,
+       thread_id, turn_id, target_type, target_id, status, summary, input,
+       error_code, owner_email, visibility)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+            event.id,
+            event.createdAt,
+            event.action,
+            event.caller,
+            event.actorKind,
+            event.actorEmail,
+            event.orgId,
+            event.threadId,
+            event.turnId,
+            event.targetType,
+            event.targetId,
+            event.status,
+            event.summary,
+            event.input,
+            event.errorCode,
+            event.ownerEmail,
+            event.visibility,
+        ],
+    });
+}
+function mapRow(row) {
+    return {
+        id: String(row.id),
+        createdAt: Number(row.created_at),
+        action: String(row.action),
+        caller: String(row.caller),
+        actorKind: row.actor_kind,
+        actorEmail: row.actor_email ?? null,
+        orgId: row.org_id ?? null,
+        threadId: row.thread_id ?? null,
+        turnId: row.turn_id ?? null,
+        targetType: row.target_type ?? null,
+        targetId: row.target_id ?? null,
+        status: row.status,
+        summary: row.summary ?? null,
+        input: row.input ?? null,
+        errorCode: row.error_code ?? null,
+        ownerEmail: row.owner_email ?? null,
+        visibility: (row.visibility ?? "private"),
+    };
+}
+/**
+ * Build the access-scoping WHERE fragment + args. A caller sees audit rows they
+ * own, plus org-visible rows in their org. With no identity, nothing matches —
+ * the audit log never leaks cross-tenant. Mirrors the core ownership clause of
+ * `accessFilter` (minus shares, which audit rows don't have).
+ */
+function scopeClause(scope) {
+    const clauses = [];
+    const args = [];
+    if (scope.userEmail) {
+        if (scope.orgId) {
+            // Constrain the owner's rows to the active org — plus legacy/solo rows
+            // that predate org-scoping (org_id IS NULL) — mirroring sharing's
+            // `ownerScopeFilter`, so switching orgs doesn't surface another org's
+            // trail.
+            clauses.push("(owner_email = ? AND (org_id = ? OR org_id IS NULL))");
+            args.push(scope.userEmail, scope.orgId);
+        }
+        else {
+            clauses.push("owner_email = ?");
+            args.push(scope.userEmail);
+        }
+    }
+    if (scope.orgId) {
+        clauses.push("(visibility = 'org' AND org_id = ?)");
+        args.push(scope.orgId);
+    }
+    if (clauses.length === 0)
+        return { sql: "1=0", args };
+    return { sql: `(${clauses.join(" OR ")})`, args };
+}
+const MAX_LIMIT = 500;
+const DEFAULT_LIMIT = 100;
+// Columns returned by the list surface — deliberately EXCLUDES `input` so a
+// timeline query never streams every event's (redacted) request body in bulk.
+// Fetch the full payload one event at a time via `getAuditEventById`.
+const LIST_COLUMNS = "id, created_at, action, caller, actor_kind, actor_email, org_id, " +
+    "thread_id, turn_id, target_type, target_id, status, summary, " +
+    "error_code, owner_email, visibility";
+export async function queryAuditEvents(scope, filters = {}) {
+    await ensureAuditTables();
+    if (!scope.userEmail && !scope.orgId)
+        return [];
+    const client = getDbExec();
+    const scoped = scopeClause(scope);
+    const where = [scoped.sql];
+    const args = [...scoped.args];
+    const push = (clause, value) => {
+        where.push(clause);
+        args.push(value);
+    };
+    if (filters.targetType)
+        push("target_type = ?", filters.targetType);
+    if (filters.targetId)
+        push("target_id = ?", filters.targetId);
+    if (filters.actorKind)
+        push("actor_kind = ?", filters.actorKind);
+    if (filters.actorEmail)
+        push("actor_email = ?", filters.actorEmail);
+    if (filters.status)
+        push("status = ?", filters.status);
+    if (filters.threadId)
+        push("thread_id = ?", filters.threadId);
+    if (filters.turnId)
+        push("turn_id = ?", filters.turnId);
+    if (filters.action)
+        push("action = ?", filters.action);
+    if (typeof filters.sinceMs === "number") {
+        push("created_at >= ?", Math.floor(filters.sinceMs));
+    }
+    const limit = Math.min(Math.max(1, Math.floor(filters.limit ?? DEFAULT_LIMIT)), MAX_LIMIT);
+    const result = await client.execute({
+        sql: `SELECT ${LIST_COLUMNS} FROM agent_audit_log
+          WHERE ${where.join(" AND ")}
+          ORDER BY created_at DESC
+          LIMIT ?`,
+        args: [...args, limit],
+    });
+    return (result.rows ?? []).map(mapRow);
+}
+export async function getAuditEventById(id, scope) {
+    await ensureAuditTables();
+    if (!scope.userEmail && !scope.orgId)
+        return null;
+    const client = getDbExec();
+    const scoped = scopeClause(scope);
+    const result = await client.execute({
+        sql: `SELECT * FROM agent_audit_log WHERE id = ? AND ${scoped.sql} LIMIT 1`,
+        args: [id, ...scoped.args],
+    });
+    const row = (result.rows ?? [])[0];
+    return row ? mapRow(row) : null;
+}
+/** Purge audit rows older than `cutoffMs`. Returns the deleted row count. */
+export async function deleteOldAuditEvents(cutoffMs) {
+    await ensureAuditTables();
+    const client = getDbExec();
+    const result = await client.execute({
+        sql: `DELETE FROM agent_audit_log WHERE created_at < ?`,
+        args: [Math.floor(cutoffMs)],
+    });
+    return Number(result.rowsAffected ?? 0);
+}
+/** Test-only: reset the cached init promise so a fresh DB re-creates tables. */
+export function __resetAuditInitForTests() {
+    _initPromise = undefined;
+}
+//# sourceMappingURL=store.js.map

package/dist/audit/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOrE,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAE3B,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC;;;uBAGA,OAAO,EAAE;;;;;;;;;;;;;;;;;OAiBzB,CAAC,CACD,CAAC;YAEF,MAAM,OAAO,GAAG;gBACd,yFAAyF;gBACzF,kFAAkF;gBAClF,qGAAqG;gBACrG,wEAAwE;gBACxE,yFAAyF;gBACzF,8EAA8E;aAC/E,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,wDAAwD;YACxD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IACtD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;;iEAIwD;QAC7D,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,UAAU;SACjB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ;IACtB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;QACxB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QACjC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAoB;KAC7D,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAqB;IACxC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,SAAS;YACT,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,4EAA4E;AAC5E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,YAAY,GAChB,mEAAmE;IACnE,+DAA+D;IAC/D,qCAAqC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAqB,EACrB,UAA6B,EAAE;IAE/B,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAU,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAU,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,EACvD,SAAS,CACV,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,UAAU,YAAY;kBACb,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;;kBAEnB;QACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,KAAqB;IAErB,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,kDAAkD,MAAM,CAAC,GAAG,UAAU;QAC3E,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,kDAAkD;QACvD,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB;IACtC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * SQL persistence for the framework audit log.\n *\n * Follows the same raw-SQL, provider-agnostic pattern as observability/store.ts\n * and usage/store.ts — framework tables use `getDbExec()` + `intType()` rather\n * than Drizzle ORM (which is for template-level schemas). One append-only table\n * `agent_audit_log`; reads are scoped to the caller's identity in SQL (no\n * shares table — audit rows are never individually shared).\n */\nimport { getDbExec, intType, retryOnDdlRace } from \"../db/client.js\";\nimport type {\n  AuditEvent,\n  AuditQueryFilters,\n  AuditVisibility,\n} from \"./types.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nexport async function ensureAuditTables(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n\n      await retryOnDdlRace(() =>\n        client.execute(`\n        CREATE TABLE IF NOT EXISTS agent_audit_log (\n          id TEXT PRIMARY KEY,\n          created_at ${intType()} NOT NULL,\n          action TEXT NOT NULL,\n          caller TEXT NOT NULL,\n          actor_kind TEXT NOT NULL,\n          actor_email TEXT,\n          org_id TEXT,\n          thread_id TEXT,\n          turn_id TEXT,\n          target_type TEXT,\n          target_id TEXT,\n          status TEXT NOT NULL DEFAULT 'success',\n          summary TEXT,\n          input TEXT,\n          error_code TEXT,\n          owner_email TEXT,\n          visibility TEXT NOT NULL DEFAULT 'private'\n        )\n      `),\n      );\n\n      const indexes = [\n        `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,\n        `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,\n        `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`,\n        `CREATE INDEX IF NOT EXISTS idx_audit_turn ON agent_audit_log (turn_id)`,\n        `CREATE INDEX IF NOT EXISTS idx_audit_actor ON agent_audit_log (actor_email, created_at)`,\n        `CREATE INDEX IF NOT EXISTS idx_audit_created ON agent_audit_log (created_at)`,\n      ];\n      for (const sql of indexes) {\n        try {\n          await client.execute(sql);\n        } catch {\n          // Index creation is best-effort; a racing boot may have created it.\n        }\n      }\n    })().catch((err) => {\n      // Allow a later call to retry if the first init failed.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function insertAuditEvent(event: AuditEvent): Promise<void> {\n  await ensureAuditTables();\n  const client = getDbExec();\n  await client.execute({\n    sql: `INSERT INTO agent_audit_log\n      (id, created_at, action, caller, actor_kind, actor_email, org_id,\n       thread_id, turn_id, target_type, target_id, status, summary, input,\n       error_code, owner_email, visibility)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      event.id,\n      event.createdAt,\n      event.action,\n      event.caller,\n      event.actorKind,\n      event.actorEmail,\n      event.orgId,\n      event.threadId,\n      event.turnId,\n      event.targetType,\n      event.targetId,\n      event.status,\n      event.summary,\n      event.input,\n      event.errorCode,\n      event.ownerEmail,\n      event.visibility,\n    ],\n  });\n}\n\nfunction mapRow(row: any): AuditEvent {\n  return {\n    id: String(row.id),\n    createdAt: Number(row.created_at),\n    action: String(row.action),\n    caller: String(row.caller),\n    actorKind: row.actor_kind,\n    actorEmail: row.actor_email ?? null,\n    orgId: row.org_id ?? null,\n    threadId: row.thread_id ?? null,\n    turnId: row.turn_id ?? null,\n    targetType: row.target_type ?? null,\n    targetId: row.target_id ?? null,\n    status: row.status,\n    summary: row.summary ?? null,\n    input: row.input ?? null,\n    errorCode: row.error_code ?? null,\n    ownerEmail: row.owner_email ?? null,\n    visibility: (row.visibility ?? \"private\") as AuditVisibility,\n  };\n}\n\nexport interface AuditReadScope {\n  userEmail?: string;\n  orgId?: string | null;\n}\n\n/**\n * Build the access-scoping WHERE fragment + args. A caller sees audit rows they\n * own, plus org-visible rows in their org. With no identity, nothing matches —\n * the audit log never leaks cross-tenant. Mirrors the core ownership clause of\n * `accessFilter` (minus shares, which audit rows don't have).\n */\nfunction scopeClause(scope: AuditReadScope): { sql: string; args: any[] } {\n  const clauses: string[] = [];\n  const args: any[] = [];\n  if (scope.userEmail) {\n    if (scope.orgId) {\n      // Constrain the owner's rows to the active org — plus legacy/solo rows\n      // that predate org-scoping (org_id IS NULL) — mirroring sharing's\n      // `ownerScopeFilter`, so switching orgs doesn't surface another org's\n      // trail.\n      clauses.push(\"(owner_email = ? AND (org_id = ? OR org_id IS NULL))\");\n      args.push(scope.userEmail, scope.orgId);\n    } else {\n      clauses.push(\"owner_email = ?\");\n      args.push(scope.userEmail);\n    }\n  }\n  if (scope.orgId) {\n    clauses.push(\"(visibility = 'org' AND org_id = ?)\");\n    args.push(scope.orgId);\n  }\n  if (clauses.length === 0) return { sql: \"1=0\", args };\n  return { sql: `(${clauses.join(\" OR \")})`, args };\n}\n\nconst MAX_LIMIT = 500;\nconst DEFAULT_LIMIT = 100;\n\n// Columns returned by the list surface — deliberately EXCLUDES `input` so a\n// timeline query never streams every event's (redacted) request body in bulk.\n// Fetch the full payload one event at a time via `getAuditEventById`.\nconst LIST_COLUMNS =\n  \"id, created_at, action, caller, actor_kind, actor_email, org_id, \" +\n  \"thread_id, turn_id, target_type, target_id, status, summary, \" +\n  \"error_code, owner_email, visibility\";\n\nexport async function queryAuditEvents(\n  scope: AuditReadScope,\n  filters: AuditQueryFilters = {},\n): Promise<AuditEvent[]> {\n  await ensureAuditTables();\n  if (!scope.userEmail && !scope.orgId) return [];\n  const client = getDbExec();\n\n  const scoped = scopeClause(scope);\n  const where: string[] = [scoped.sql];\n  const args: any[] = [...scoped.args];\n\n  const push = (clause: string, value: any) => {\n    where.push(clause);\n    args.push(value);\n  };\n  if (filters.targetType) push(\"target_type = ?\", filters.targetType);\n  if (filters.targetId) push(\"target_id = ?\", filters.targetId);\n  if (filters.actorKind) push(\"actor_kind = ?\", filters.actorKind);\n  if (filters.actorEmail) push(\"actor_email = ?\", filters.actorEmail);\n  if (filters.status) push(\"status = ?\", filters.status);\n  if (filters.threadId) push(\"thread_id = ?\", filters.threadId);\n  if (filters.turnId) push(\"turn_id = ?\", filters.turnId);\n  if (filters.action) push(\"action = ?\", filters.action);\n  if (typeof filters.sinceMs === \"number\") {\n    push(\"created_at >= ?\", Math.floor(filters.sinceMs));\n  }\n\n  const limit = Math.min(\n    Math.max(1, Math.floor(filters.limit ?? DEFAULT_LIMIT)),\n    MAX_LIMIT,\n  );\n\n  const result = await client.execute({\n    sql: `SELECT ${LIST_COLUMNS} FROM agent_audit_log\n          WHERE ${where.join(\" AND \")}\n          ORDER BY created_at DESC\n          LIMIT ?`,\n    args: [...args, limit],\n  });\n  return (result.rows ?? []).map(mapRow);\n}\n\nexport async function getAuditEventById(\n  id: string,\n  scope: AuditReadScope,\n): Promise<AuditEvent | null> {\n  await ensureAuditTables();\n  if (!scope.userEmail && !scope.orgId) return null;\n  const client = getDbExec();\n  const scoped = scopeClause(scope);\n  const result = await client.execute({\n    sql: `SELECT * FROM agent_audit_log WHERE id = ? AND ${scoped.sql} LIMIT 1`,\n    args: [id, ...scoped.args],\n  });\n  const row = (result.rows ?? [])[0];\n  return row ? mapRow(row) : null;\n}\n\n/** Purge audit rows older than `cutoffMs`. Returns the deleted row count. */\nexport async function deleteOldAuditEvents(cutoffMs: number): Promise<number> {\n  await ensureAuditTables();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `DELETE FROM agent_audit_log WHERE created_at < ?`,\n    args: [Math.floor(cutoffMs)],\n  });\n  return Number(result.rowsAffected ?? 0);\n}\n\n/** Test-only: reset the cached init promise so a fresh DB re-creates tables. */\nexport function __resetAuditInitForTests(): void {\n  _initPromise = undefined;\n}\n"]}