npm - @agent-native/core - Versions diffs - 0.92.12 → 0.93.0 - Mend

@agent-native/core 0.92.12 → 0.93.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (772) hide show

package/dist/agent/types.d.ts CHANGED Viewed

@@ -255,6 +255,28 @@ export type AgentChatEvent = {
     type: "agent_call";
     agent: string;
     status: "start" | "done" | "error";
+} | {
+    /**
+     * Periodic liveness for an in-flight cross-app A2A call. Emitted by the
+     * `call-agent` action once per throttle window ONLY when a real poll
+     * round-trip to the remote agent succeeds and reports a non-terminal
+     * state — never on a timer, so a hung/dead remote emits nothing and the
+     * stuck-detector can still fire. Counts as real progress in
+     * `run-manager`'s `shouldBumpProgressForEvent` (any non-special event
+     * type does), which keeps `last_progress_at` fresh so a slow-but-healthy
+     * sub-agent call doesn't trip the client's stuck banner. A distinct
+     * event type (not an `agent_call` status) so existing `agent_call`
+     * consumers that treat "not start/done" as a failure don't render an
+     * in-flight tick as an error.
+     */
+    type: "agent_call_progress";
+    agent: string;
+    /** Remote A2A task state for this poll, e.g. "working" | "submitted". */
+    state: string;
+    /** Elapsed wall-clock seconds since the cross-app call began. */
+    elapsedSeconds: number;
+    /** Optional short text surfaced from the remote poll, when present. */
+    detail?: string;
 } | {
     type: "agent_call_text";
     agent: string;

package/dist/agent/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACnD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACvD,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,qBAAqB,GAAG;QACnC,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,8BAA8B,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CACN,KAAK,EAAE,MAAM;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,GAAG,KACR,mBAAmB,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACjD,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,kBAAkB,CAAC,EACf,aAAa,GACb,YAAY,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,qBAAqB,CAAC;QAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B;;;;;WAKG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;;;;;WAKG;QACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;QAC5C;;;;;WAKG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GACxE;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACpC,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AACH;;;GAGG;GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IACE;;;;;OAKG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EACF,aAAa,GACb,YAAY,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,qBAAqB,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACnD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oBAAoB,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACvD,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,qBAAqB,GAAG;QACnC,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,8BAA8B,GACtC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CACN,KAAK,EAAE,MAAM;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,GAAG,KACR,mBAAmB,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACjD,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,kBAAkB,CAAC,EACf,aAAa,GACb,YAAY,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,qBAAqB,CAAC;QAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B;;;;;WAKG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;;;;;WAKG;QACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;QAC5C;;;;;WAKG;QACH,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GACxE;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACpC,GACD;IACE;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;CAC7C,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AACH;;;GAGG;GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IACE;;;;;OAKG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EACF,aAAa,GACb,YAAY,GACZ,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,qBAAqB,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC"}

package/dist/agent/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionChatUIConfig } from \"../action-ui.js\";\nimport type { AgentMcpAppPayload } from \"../mcp-client/app-result.js\";\nimport type { ReasoningEffort } from \"../shared/reasoning-effort.js\";\n\nexport interface AgentNativeJsonSchema {\n type?: string \| string[];\n description?: string;\n enum?: unknown[];\n const?: unknown;\n properties?: Record<string, AgentNativeJsonSchema>;\n required?: string[];\n additionalProperties?: boolean \| AgentNativeJsonSchema;\n items?: AgentNativeJsonSchema;\n oneOf?: AgentNativeJsonSchema[];\n anyOf?: AgentNativeJsonSchema[];\n allOf?: AgentNativeJsonSchema[];\n not?: AgentNativeJsonSchema;\n minLength?: number;\n maxLength?: number;\n pattern?: string;\n minimum?: number;\n maximum?: number;\n minItems?: number;\n maxItems?: number;\n}\n\nexport interface ActionTool {\n description: string;\n parameters?: AgentNativeJsonSchema & {\n type: \"object\";\n properties: Record<string, AgentNativeJsonSchema>;\n required?: string[];\n };\n}\n\n/** @deprecated Use `ActionTool` instead /\nexport type ScriptTool = ActionTool;\n\nexport interface AgentMessage {\n role: \"user\" \| \"assistant\";\n content: string;\n}\n\nexport type AgentChatStructuredContentPart =\n \| { type: \"text\"; text: string }\n \| {\n type: \"tool-call\";\n id?: string;\n toolCallId?: string;\n name?: string;\n toolName?: string;\n input?: unknown;\n args?: unknown;\n }\n \| {\n type: \"tool-result\";\n toolCallId: string;\n /* Persisted for replay; omitted in older rows is backfilled server-side. /\n toolName?: string;\n toolInput?: string;\n content: string;\n isError?: boolean;\n };\n\nexport interface AgentChatStructuredMessage {\n role: \"user\" \| \"assistant\";\n content: AgentChatStructuredContentPart[];\n}\n\nexport interface AgentChatReference {\n type: \"file\" \| \"skill\" \| \"mention\" \| \"agent\" \| \"custom-agent\";\n path: string;\n name: string;\n source: string;\n refType?: string;\n refId?: string;\n slotKey?: string;\n slotLabel?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface MentionProviderItem {\n id: string;\n label: string;\n description?: string;\n icon?: string;\n refType: string;\n refId?: string;\n refPath?: string;\n slotKey?: string;\n slotLabel?: string;\n metadata?: Record<string, unknown>;\n clearsSlots?: string[];\n relatedReferences?: MentionProviderReference[];\n}\n\nexport interface MentionProviderReference {\n label: string;\n icon?: string;\n source?: string;\n refType: string;\n refId?: string \| null;\n refPath?: string \| null;\n slotKey?: string;\n slotLabel?: string;\n metadata?: Record<string, unknown>;\n clearsSlots?: string[];\n relatedReferences?: MentionProviderReference[];\n}\n\nexport interface MentionProvider {\n label: string;\n icon?: string;\n search: (\n query: string,\n /* The H3 event for the current request — use to make internal API calls /\n event?: any,\n ) => MentionProviderItem[] \| Promise<MentionProviderItem[]>;\n}\n\nexport interface AgentChatAttachment {\n type: string;\n name: string;\n data?: string;\n contentType?: string;\n text?: string;\n}\n\nexport interface AgentChatScope {\n type: string;\n id: string;\n label?: string;\n}\n\nexport interface AgentChatRequest {\n message: string;\n /\n User-visible text to persist in chat history. `message` may be normalized\n * for the model (for example mention markup or internal continuation text).\n /\n displayMessage?: string;\n history?: AgentMessage[];\n /\n Provider-neutral transcript used for run recovery. Unlike `history`,\n * this preserves assistant tool calls and matching tool results so\n * continuation turns do not re-run completed read-only tools.\n /\n structuredHistory?: AgentChatStructuredMessage[];\n references?: AgentChatReference[];\n threadId?: string;\n attachments?: AgentChatAttachment[];\n /* Internal retry/continuation requests should not create visible user turns. /\n internalContinuation?: boolean;\n /\n Internal marker set ONLY by the durable-background self-dispatch (see\n * `AGENT_CHAT_BACKGROUND_RUN_FIELD`). Present when the agent-chat handler is\n * re-entered as the background worker: it carries the pre-claimed `runId` and\n * logical `turnId` so the worker runs the loop inline with the background\n * soft-timeout instead of re-claiming the slot or re-dispatching. Untrusted\n * on its own — the `_process-run` route HMAC-verifies the dispatch before\n * invoking the handler. Absent on every normal client request.\n /\n __backgroundRun?: {\n runId: string;\n turnId?: string;\n continuationReason?:\n \| \"run_timeout\"\n \| \"loop_limit\"\n \| \"no_progress\"\n \| \"stream_ended\"\n \| \"gateway_timeout\"\n \| \"network_interrupted\";\n actionPreparationTool?: string;\n /\n Number of server-driven background→background continuations already\n * chained into this logical turn (0 on the first chunk). The worker\n * increments this when it re-fires `_process-run` at a soft-timeout\n * boundary and refuses to chain past `MAX_BACKGROUND_RUN_CONTINUATIONS`.\n /\n continuationCount?: number;\n /\n True when the dispatcher expects the self-POST to land in a real\n * Netlify `-background` function rather than the ~60s synchronous function.\n * This is diagnostic only; the 15-minute budget is unlocked by the worker's\n * actual runtime marker.\n /\n backgroundFunctionRuntimeExpected?: boolean;\n /\n True when the dispatch body carries ONLY this marker and the worker\n * must rehydrate the full request body from the run row's\n * `dispatch_payload` column (`readRunDispatchPayload`). Keeps the\n * self-POST under Netlify's 256KB background-function body cap.\n /\n payloadRef?: boolean;\n };\n /\n Stable identity for the logical assistant turn this request belongs to.\n * The client sends the SAME turnId for the initial POST and every\n * auto-continuation re-POST of one turn, so the server can fold each\n * continuation run's output onto a single durable assistant message instead\n * of dropping the earlier chunks. Defaults to the run id when absent.\n /\n turnId?: string;\n /* Execution mode for this turn. Plan mode is read-only and proposes before acting. /\n mode?: \"act\" \| \"plan\";\n /* Per-request model override (ephemeral, from the composer model picker). /\n model?: string;\n /* Per-request engine override (sent alongside model for cross-provider switches). /\n engine?: string;\n /* Per-request reasoning effort override (ephemeral, from the composer picker). /\n effort?: ReasoningEffort;\n /* Usage-tracking label for this call (e.g. \"chat\", \"summarize\"). Default: \"chat\". /\n usageLabel?: string;\n /* Stable browser tab id so screen/url context and navigation commands are tab-scoped. /\n browserTabId?: string;\n /* Resource scope for this chat thread, e.g. the deck currently bound to the tab. /\n scope?: AgentChatScope \| null;\n /* When true, expose this chat turn as a user-visible run in RunsTray. /\n trackInRunsTray?: boolean;\n /\n Approval grants for human-in-the-loop actions. Each entry is a stable\n * approval key (see the `approval_required` event's `approvalKey`). When the\n * agent calls an action declared `needsApproval`, the loop pauses and emits\n * `approval_required`; the client re-issues the turn (typically an empty\n * continuation) with the approved call's key here so the gate lets it run.\n * Keys not present here keep the action paused. The model never sees or sets\n * this — it is supplied by the human's approve affordance.\n /\n approvedToolCalls?: string[];\n}\n\nexport type AgentToolInput = Record<string, unknown>;\n\nexport type AgentChatEvent =\n \| { type: \"text\"; text: string }\n \| { type: \"thinking\"; text: string }\n \| {\n type: \"activity\";\n label: string;\n tool?: string;\n id?: string;\n progressBytes?: number;\n }\n \| { type: \"stream_keepalive\" }\n \| { type: \"tool_start\"; tool: string; id?: string; input: AgentToolInput }\n \| {\n type: \"tool_done\";\n tool: string;\n id?: string;\n input?: AgentToolInput;\n result: string;\n isError?: boolean;\n completedSideEffect?: boolean;\n mcpApp?: AgentMcpAppPayload;\n chatUI?: ActionChatUIConfig;\n }\n \| {\n /\n The agent tried to call an action declared `needsApproval` and the loop\n * paused instead of executing it. The client should surface an\n * approve/deny affordance; on approve, re-issue the turn with\n * `approvedToolCalls: [approvalKey]` so the gate lets this call run.\n /\n type: \"approval_required\";\n tool: string;\n input: Record<string, string>;\n /* Stable key the client echoes back in `approvedToolCalls` to approve. /\n approvalKey: string;\n /* The model-side tool-call id for this paused call, when available. /\n toolCallId?: string;\n }\n \| {\n type: \"agent_call\";\n agent: string;\n status: \"start\" \| \"done\" \| \"error\";\n }\n \| { type: \"agent_call_text\"; agent: string; text: string }\n \| {\n type: \"agent_task\";\n taskId: string;\n threadId: string;\n description: string;\n status: \"running\" \| \"completed\" \| \"errored\";\n }\n \| {\n type: \"agent_task_update\";\n taskId: string;\n preview: string;\n currentStep?: string;\n }\n \| {\n type: \"agent_task_complete\";\n taskId: string;\n summary: string;\n }\n \| { type: \"done\" }\n \| {\n type: \"error\";\n error: string;\n /\n Optional machine-readable error code. Builder gateway uses codes\n * like \"credits-limit-monthly\" / \"unauthorized\" / \"gateway_not_enabled\"\n * so the chat UI can render a structured CTA (e.g. upgrade button).\n /\n errorCode?: string;\n /* Optional link paired with errorCode — e.g. Builder billing page. /\n upgradeUrl?: string;\n /* Optional details for expandable UI/debugging. /\n details?: string;\n /* True when the user can reasonably continue/retry from partial work. /\n recoverable?: boolean;\n }\n /\n Legacy SSE terminal event. New streams emit\n * `{ type: \"error\", errorCode: \"missing_credentials\" }` instead.\n /\n \| { type: \"missing_api_key\" }\n \| { type: \"loop_limit\"; maxIterations?: number }\n \| {\n /\n An in-loop `Processor` aborted the run via `abort()` (which throws a\n * `TripWire`). The loop catches it, emits this event, stops cleanly, and\n * surfaces the reason as a final assistant message. Structural hook for\n * real-time guardrails and a proof-of-done / coverage gate.\n /\n type: \"tripwire\";\n reason: string;\n /* Name of the processor that aborted, when it declared one. */\n processor?: string;\n }\n \| {\n type: \"auto_continue\";\n reason:\n \| \"run_timeout\"\n \| \"loop_limit\"\n \| \"no_progress\"\n \| \"stream_ended\"\n \| \"gateway_timeout\"\n \| \"network_interrupted\";\n maxIterations?: number;\n }\n \| { type: \"clear\" };\n\nexport interface RunEvent {\n seq: number;\n event: AgentChatEvent;\n}\n\nexport type RunStatus = \"running\" \| \"completed\" \| \"errored\" \| \"aborted\";\n"]}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionChatUIConfig } from \"../action-ui.js\";\nimport type { AgentMcpAppPayload } from \"../mcp-client/app-result.js\";\nimport type { ReasoningEffort } from \"../shared/reasoning-effort.js\";\n\nexport interface AgentNativeJsonSchema {\n type?: string \| string[];\n description?: string;\n enum?: unknown[];\n const?: unknown;\n properties?: Record<string, AgentNativeJsonSchema>;\n required?: string[];\n additionalProperties?: boolean \| AgentNativeJsonSchema;\n items?: AgentNativeJsonSchema;\n oneOf?: AgentNativeJsonSchema[];\n anyOf?: AgentNativeJsonSchema[];\n allOf?: AgentNativeJsonSchema[];\n not?: AgentNativeJsonSchema;\n minLength?: number;\n maxLength?: number;\n pattern?: string;\n minimum?: number;\n maximum?: number;\n minItems?: number;\n maxItems?: number;\n}\n\nexport interface ActionTool {\n description: string;\n parameters?: AgentNativeJsonSchema & {\n type: \"object\";\n properties: Record<string, AgentNativeJsonSchema>;\n required?: string[];\n };\n}\n\n/** @deprecated Use `ActionTool` instead /\nexport type ScriptTool = ActionTool;\n\nexport interface AgentMessage {\n role: \"user\" \| \"assistant\";\n content: string;\n}\n\nexport type AgentChatStructuredContentPart =\n \| { type: \"text\"; text: string }\n \| {\n type: \"tool-call\";\n id?: string;\n toolCallId?: string;\n name?: string;\n toolName?: string;\n input?: unknown;\n args?: unknown;\n }\n \| {\n type: \"tool-result\";\n toolCallId: string;\n /* Persisted for replay; omitted in older rows is backfilled server-side. /\n toolName?: string;\n toolInput?: string;\n content: string;\n isError?: boolean;\n };\n\nexport interface AgentChatStructuredMessage {\n role: \"user\" \| \"assistant\";\n content: AgentChatStructuredContentPart[];\n}\n\nexport interface AgentChatReference {\n type: \"file\" \| \"skill\" \| \"mention\" \| \"agent\" \| \"custom-agent\";\n path: string;\n name: string;\n source: string;\n refType?: string;\n refId?: string;\n slotKey?: string;\n slotLabel?: string;\n metadata?: Record<string, unknown>;\n}\n\nexport interface MentionProviderItem {\n id: string;\n label: string;\n description?: string;\n icon?: string;\n refType: string;\n refId?: string;\n refPath?: string;\n slotKey?: string;\n slotLabel?: string;\n metadata?: Record<string, unknown>;\n clearsSlots?: string[];\n relatedReferences?: MentionProviderReference[];\n}\n\nexport interface MentionProviderReference {\n label: string;\n icon?: string;\n source?: string;\n refType: string;\n refId?: string \| null;\n refPath?: string \| null;\n slotKey?: string;\n slotLabel?: string;\n metadata?: Record<string, unknown>;\n clearsSlots?: string[];\n relatedReferences?: MentionProviderReference[];\n}\n\nexport interface MentionProvider {\n label: string;\n icon?: string;\n search: (\n query: string,\n /* The H3 event for the current request — use to make internal API calls /\n event?: any,\n ) => MentionProviderItem[] \| Promise<MentionProviderItem[]>;\n}\n\nexport interface AgentChatAttachment {\n type: string;\n name: string;\n data?: string;\n contentType?: string;\n text?: string;\n}\n\nexport interface AgentChatScope {\n type: string;\n id: string;\n label?: string;\n}\n\nexport interface AgentChatRequest {\n message: string;\n /\n User-visible text to persist in chat history. `message` may be normalized\n * for the model (for example mention markup or internal continuation text).\n /\n displayMessage?: string;\n history?: AgentMessage[];\n /\n Provider-neutral transcript used for run recovery. Unlike `history`,\n * this preserves assistant tool calls and matching tool results so\n * continuation turns do not re-run completed read-only tools.\n /\n structuredHistory?: AgentChatStructuredMessage[];\n references?: AgentChatReference[];\n threadId?: string;\n attachments?: AgentChatAttachment[];\n /* Internal retry/continuation requests should not create visible user turns. /\n internalContinuation?: boolean;\n /\n Internal marker set ONLY by the durable-background self-dispatch (see\n * `AGENT_CHAT_BACKGROUND_RUN_FIELD`). Present when the agent-chat handler is\n * re-entered as the background worker: it carries the pre-claimed `runId` and\n * logical `turnId` so the worker runs the loop inline with the background\n * soft-timeout instead of re-claiming the slot or re-dispatching. Untrusted\n * on its own — the `_process-run` route HMAC-verifies the dispatch before\n * invoking the handler. Absent on every normal client request.\n /\n __backgroundRun?: {\n runId: string;\n turnId?: string;\n continuationReason?:\n \| \"run_timeout\"\n \| \"loop_limit\"\n \| \"no_progress\"\n \| \"stream_ended\"\n \| \"gateway_timeout\"\n \| \"network_interrupted\";\n actionPreparationTool?: string;\n /\n Number of server-driven background→background continuations already\n * chained into this logical turn (0 on the first chunk). The worker\n * increments this when it re-fires `_process-run` at a soft-timeout\n * boundary and refuses to chain past `MAX_BACKGROUND_RUN_CONTINUATIONS`.\n /\n continuationCount?: number;\n /\n True when the dispatcher expects the self-POST to land in a real\n * Netlify `-background` function rather than the ~60s synchronous function.\n * This is diagnostic only; the 15-minute budget is unlocked by the worker's\n * actual runtime marker.\n /\n backgroundFunctionRuntimeExpected?: boolean;\n /\n True when the dispatch body carries ONLY this marker and the worker\n * must rehydrate the full request body from the run row's\n * `dispatch_payload` column (`readRunDispatchPayload`). Keeps the\n * self-POST under Netlify's 256KB background-function body cap.\n /\n payloadRef?: boolean;\n };\n /\n Stable identity for the logical assistant turn this request belongs to.\n * The client sends the SAME turnId for the initial POST and every\n * auto-continuation re-POST of one turn, so the server can fold each\n * continuation run's output onto a single durable assistant message instead\n * of dropping the earlier chunks. Defaults to the run id when absent.\n /\n turnId?: string;\n /* Execution mode for this turn. Plan mode is read-only and proposes before acting. /\n mode?: \"act\" \| \"plan\";\n /* Per-request model override (ephemeral, from the composer model picker). /\n model?: string;\n /* Per-request engine override (sent alongside model for cross-provider switches). /\n engine?: string;\n /* Per-request reasoning effort override (ephemeral, from the composer picker). /\n effort?: ReasoningEffort;\n /* Usage-tracking label for this call (e.g. \"chat\", \"summarize\"). Default: \"chat\". /\n usageLabel?: string;\n /* Stable browser tab id so screen/url context and navigation commands are tab-scoped. /\n browserTabId?: string;\n /* Resource scope for this chat thread, e.g. the deck currently bound to the tab. /\n scope?: AgentChatScope \| null;\n /* When true, expose this chat turn as a user-visible run in RunsTray. /\n trackInRunsTray?: boolean;\n /\n Approval grants for human-in-the-loop actions. Each entry is a stable\n * approval key (see the `approval_required` event's `approvalKey`). When the\n * agent calls an action declared `needsApproval`, the loop pauses and emits\n * `approval_required`; the client re-issues the turn (typically an empty\n * continuation) with the approved call's key here so the gate lets it run.\n * Keys not present here keep the action paused. The model never sees or sets\n * this — it is supplied by the human's approve affordance.\n /\n approvedToolCalls?: string[];\n}\n\nexport type AgentToolInput = Record<string, unknown>;\n\nexport type AgentChatEvent =\n \| { type: \"text\"; text: string }\n \| { type: \"thinking\"; text: string }\n \| {\n type: \"activity\";\n label: string;\n tool?: string;\n id?: string;\n progressBytes?: number;\n }\n \| { type: \"stream_keepalive\" }\n \| { type: \"tool_start\"; tool: string; id?: string; input: AgentToolInput }\n \| {\n type: \"tool_done\";\n tool: string;\n id?: string;\n input?: AgentToolInput;\n result: string;\n isError?: boolean;\n completedSideEffect?: boolean;\n mcpApp?: AgentMcpAppPayload;\n chatUI?: ActionChatUIConfig;\n }\n \| {\n /\n The agent tried to call an action declared `needsApproval` and the loop\n * paused instead of executing it. The client should surface an\n * approve/deny affordance; on approve, re-issue the turn with\n * `approvedToolCalls: [approvalKey]` so the gate lets this call run.\n /\n type: \"approval_required\";\n tool: string;\n input: Record<string, string>;\n /* Stable key the client echoes back in `approvedToolCalls` to approve. /\n approvalKey: string;\n /* The model-side tool-call id for this paused call, when available. /\n toolCallId?: string;\n }\n \| {\n type: \"agent_call\";\n agent: string;\n status: \"start\" \| \"done\" \| \"error\";\n }\n \| {\n /\n Periodic liveness for an in-flight cross-app A2A call. Emitted by the\n * `call-agent` action once per throttle window ONLY when a real poll\n * round-trip to the remote agent succeeds and reports a non-terminal\n * state — never on a timer, so a hung/dead remote emits nothing and the\n * stuck-detector can still fire. Counts as real progress in\n * `run-manager`'s `shouldBumpProgressForEvent` (any non-special event\n * type does), which keeps `last_progress_at` fresh so a slow-but-healthy\n * sub-agent call doesn't trip the client's stuck banner. A distinct\n * event type (not an `agent_call` status) so existing `agent_call`\n * consumers that treat \"not start/done\" as a failure don't render an\n * in-flight tick as an error.\n /\n type: \"agent_call_progress\";\n agent: string;\n /* Remote A2A task state for this poll, e.g. \"working\" \| \"submitted\". /\n state: string;\n /* Elapsed wall-clock seconds since the cross-app call began. /\n elapsedSeconds: number;\n /* Optional short text surfaced from the remote poll, when present. /\n detail?: string;\n }\n \| { type: \"agent_call_text\"; agent: string; text: string }\n \| {\n type: \"agent_task\";\n taskId: string;\n threadId: string;\n description: string;\n status: \"running\" \| \"completed\" \| \"errored\";\n }\n \| {\n type: \"agent_task_update\";\n taskId: string;\n preview: string;\n currentStep?: string;\n }\n \| {\n type: \"agent_task_complete\";\n taskId: string;\n summary: string;\n }\n \| { type: \"done\" }\n \| {\n type: \"error\";\n error: string;\n /\n Optional machine-readable error code. Builder gateway uses codes\n * like \"credits-limit-monthly\" / \"unauthorized\" / \"gateway_not_enabled\"\n * so the chat UI can render a structured CTA (e.g. upgrade button).\n /\n errorCode?: string;\n /* Optional link paired with errorCode — e.g. Builder billing page. /\n upgradeUrl?: string;\n /* Optional details for expandable UI/debugging. /\n details?: string;\n /* True when the user can reasonably continue/retry from partial work. /\n recoverable?: boolean;\n }\n /\n Legacy SSE terminal event. New streams emit\n * `{ type: \"error\", errorCode: \"missing_credentials\" }` instead.\n /\n \| { type: \"missing_api_key\" }\n \| { type: \"loop_limit\"; maxIterations?: number }\n \| {\n /\n An in-loop `Processor` aborted the run via `abort()` (which throws a\n * `TripWire`). The loop catches it, emits this event, stops cleanly, and\n * surfaces the reason as a final assistant message. Structural hook for\n * real-time guardrails and a proof-of-done / coverage gate.\n /\n type: \"tripwire\";\n reason: string;\n /* Name of the processor that aborted, when it declared one. */\n processor?: string;\n }\n \| {\n type: \"auto_continue\";\n reason:\n \| \"run_timeout\"\n \| \"loop_limit\"\n \| \"no_progress\"\n \| \"stream_ended\"\n \| \"gateway_timeout\"\n \| \"network_interrupted\";\n maxIterations?: number;\n }\n \| { type: \"clear\" };\n\nexport interface RunEvent {\n seq: number;\n event: AgentChatEvent;\n}\n\nexport type RunStatus = \"running\" \| \"completed\" \| \"errored\" \| \"aborted\";\n"]}

package/dist/audit/record.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/audit/record.ts"],"names":[],"mappings":"~~AAgBA~~,OAAO,KAAK,EACV,iBAAiB,EAGjB,WAAW,EAEZ,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA0CD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,~~CAqDf~~"}
1	+ {"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/audit/record.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,iBAAiB,EAGjB,WAAW,EAEZ,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA0CD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmFf"}

package/dist/audit/record.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { getIntegrationRequestContext } from "../server/request-context.js";
 /**
  * Audit capture entry point, called from the `defineAction` audit wrapper after
  * an action runs (success or error). Best-effort: any failure here is swallowed
@@ -73,6 +74,7 @@ export async function recordActionAudit(input) {
         const summary = safeSummary(input.config, input.args, input.result, meta);
         const recordInputs = input.config?.recordInputs !== false;
         const inputJson = recordInputs ? redactArgsToJson(input.args) : null;
+        const hasExplicitTargetVisibility = target?.visibility !== undefined;
         const event = {
             id: crypto.randomUUID(),
             createdAt: Date.now(),
@@ -94,6 +96,33 @@ export async function recordActionAudit(input) {
             ownerEmail: target?.ownerEmail ?? actorEmail,
             visibility: target?.visibility ?? "private",
         };
+        const lineage = getIntegrationRequestContext()?.lineage;
+        const integration = getIntegrationRequestContext();
+        if (integration) {
+            if (ctx?.orgId &&
+                event.visibility === "private" &&
+                !hasExplicitTargetVisibility) {
+                event.visibility = "org";
+            }
+            event.runId = lineage?.runId ?? null;
+            event.taskId = integration.taskId;
+            event.parentTaskId = lineage?.parentTaskId ?? null;
+            event.sourceKind = lineage?.source?.kind ?? null;
+            event.sourcePlatform = lineage?.source?.platform ?? null;
+            event.sourceId = lineage?.source?.id ?? null;
+            event.sourceUrl = lineage?.source?.url ?? null;
+            event.networkProtocol = lineage?.network?.protocol ?? null;
+            event.networkId = lineage?.network?.id ?? null;
+            event.networkPeer = lineage?.network?.peer ?? null;
+            if (!event.networkProtocol && actionName === "provider-api-request") {
+                event.networkProtocol = "provider-api";
+                event.networkId = target?.id ?? "provider-api-request";
+            }
+            if (!event.networkProtocol && actionName === "call-agent") {
+                event.networkProtocol = "a2a";
+                event.networkId = target?.id ?? "call-agent";
+            }
+        }
         // org_id used for scoping defaults to the target's, else the actor's org.
         if (target?.orgId !== undefined)
             event.orgId = target.orgId;

package/dist/audit/record.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"record.js","sourceRoot":"","sources":["../../src/audit/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA4B9C,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAgE,CAAC;QAC3E,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,MAAqC,EACrC,IAAa,EACb,MAAe,EACf,IAAmB;IAEnB,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAAqC,EACrC,IAAa,EACb,MAAe,EACf,IAAmB;IAEnB,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,IAAI,CAAC;QACH,IAAI,eAAe,EAAE;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,CAAC;QACnC,0EAA0E;QAC1E,oCAAoC;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO;QAEzD,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAkB;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1E,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,KAAK,KAAK,CAAC;QAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;YAClB,MAAM;YACN,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9C,UAAU;YACV,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;YACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;YAC/B,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI;YAC3B,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;YAChC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;YACP,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACnE,kEAAkE;YAClE,0DAA0D;YAC1D,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,UAAU;YAC5C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;SAC5C,CAAC;QACF,0EAA0E;QAC1E,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAE5D,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC","sourcesContent":["/*\n Audit capture entry point, called from the `defineAction` audit wrapper after\n * an action runs (success or error). Best-effort: any failure here is swallowed\n * so auditing never breaks the action it observes.\n \n This module touches the DB (`store.js`), so `action.ts` loads it lazily via\n * dynamic import on the first audited call — keeping the DB client out of every\n * bundle that merely defines actions.\n /\nimport {\n deriveActorKind,\n isAuditDisabled,\n shouldRecordAudit,\n} from \"./config.js\";\nimport { redactArgsToJson } from \"./redact.js\";\nimport { insertAuditEvent } from \"./store.js\";\nimport type {\n ActionAuditConfig,\n AuditCallMeta,\n AuditEvent,\n AuditStatus,\n AuditTarget,\n} from \"./types.js\";\n\n/* Minimal view of the action run context the recorder needs. /\nexport interface AuditRunContextLike {\n actionName?: string;\n caller?: string;\n userEmail?: string;\n orgId?: string \| null;\n threadId?: string;\n turnId?: string;\n}\n\nexport interface RecordActionAuditInput {\n config: ActionAuditConfig \| undefined;\n args: unknown;\n ctx: AuditRunContextLike \| undefined;\n status: AuditStatus;\n result?: unknown;\n error?: unknown;\n}\n\nfunction errorCode(error: unknown): string \| null {\n if (!error) return null;\n if (typeof error === \"object\") {\n const e = error as { errorCode?: unknown; code?: unknown; name?: unknown };\n if (typeof e.errorCode === \"string\") return e.errorCode;\n if (typeof e.code === \"string\") return e.code;\n if (typeof e.name === \"string\") return e.name;\n }\n return \"error\";\n}\n\nfunction safeTarget(\n config: ActionAuditConfig \| undefined,\n args: unknown,\n result: unknown,\n meta: AuditCallMeta,\n): AuditTarget \| null {\n if (!config?.target) return null;\n try {\n return config.target(args, result, meta) ?? null;\n } catch {\n return null;\n }\n}\n\nfunction safeSummary(\n config: ActionAuditConfig \| undefined,\n args: unknown,\n result: unknown,\n meta: AuditCallMeta,\n): string \| null {\n if (!config?.summary) return null;\n try {\n const s = config.summary(args, result, meta);\n return typeof s === \"string\" ? s.slice(0, 500) : null;\n } catch {\n return null;\n }\n}\n\n/\n Record one audit event. Resolves the actor, target, ownership (for scoped\n * reads), and redacted inputs, then appends a row. Never throws.\n */\nexport async function recordActionAudit(\n input: RecordActionAuditInput,\n): Promise<void> {\n try {\n if (isAuditDisabled()) return;\n const ctx = input.ctx;\n const actionName = ctx?.actionName;\n // No name → an internal/programmatic run() with no dispatch context. Skip\n // rather than write a nameless row.\n if (!actionName) return;\n if (!shouldRecordAudit(input.config, actionName)) return;\n\n const caller = ctx?.caller ?? \"http\";\n const actorEmail = ctx?.userEmail ?? null;\n const meta: AuditCallMeta = {\n status: input.status,\n caller,\n userEmail: ctx?.userEmail,\n orgId: ctx?.orgId ?? null,\n };\n\n const target = safeTarget(input.config, input.args, input.result, meta);\n const summary = safeSummary(input.config, input.args, input.result, meta);\n\n const recordInputs = input.config?.recordInputs !== false;\n const inputJson = recordInputs ? redactArgsToJson(input.args) : null;\n\n const event: AuditEvent = {\n id: crypto.randomUUID(),\n createdAt: Date.now(),\n action: actionName,\n caller,\n actorKind: deriveActorKind(caller, actorEmail),\n actorEmail,\n orgId: ctx?.orgId ?? null,\n threadId: ctx?.threadId ?? null,\n turnId: ctx?.turnId ?? null,\n targetType: target?.type ?? null,\n targetId: target?.id ?? null,\n status: input.status,\n summary,\n input: inputJson,\n errorCode: input.status === \"error\" ? errorCode(input.error) : null,\n // Scope reads to the resource owner when the action declares one,\n // otherwise to the actor (the common self-mutation case).\n ownerEmail: target?.ownerEmail ?? actorEmail,\n visibility: target?.visibility ?? \"private\",\n };\n // org_id used for scoping defaults to the target's, else the actor's org.\n if (target?.orgId !== undefined) event.orgId = target.orgId;\n\n await insertAuditEvent(event);\n } catch {\n // Best-effort — auditing must never break the audited action.\n }\n}\n"]}
1	+ {"version":3,"file":"record.js","sourceRoot":"","sources":["../../src/audit/record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E;;;;;;;;GAQG;AACH,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA4B9C,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAgE,CAAC;QAC3E,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CACjB,MAAqC,EACrC,IAAa,EACb,MAAe,EACf,IAAmB;IAEnB,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAAqC,EACrC,IAAa,EACb,MAAe,EACf,IAAmB;IAEnB,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,IAAI,CAAC;QACH,IAAI,eAAe,EAAE;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,CAAC;QACnC,0EAA0E;QAC1E,oCAAoC;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO;QAEzD,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAkB;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM;YACN,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;SAC1B,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE1E,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,KAAK,KAAK,CAAC;QAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,MAAM,2BAA2B,GAAG,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC;QACrE,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,UAAU;YAClB,MAAM;YACN,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9C,UAAU;YACV,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;YACzB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;YAC/B,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI;YAC3B,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;YAChC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;YACP,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACnE,kEAAkE;YAClE,0DAA0D;YAC1D,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,UAAU;YAC5C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,SAAS;SAC5C,CAAC;QACF,MAAM,OAAO,GAAG,4BAA4B,EAAE,EAAE,OAAO,CAAC;QACxD,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,IACE,GAAG,EAAE,KAAK;gBACV,KAAK,CAAC,UAAU,KAAK,SAAS;gBAC9B,CAAC,2BAA2B,EAC5B,CAAC;gBACD,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YAC3B,CAAC;YACD,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;YACrC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;YAClC,KAAK,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;YACnD,KAAK,CAAC,UAAU,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;YACjD,KAAK,CAAC,cAAc,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;YACzD,KAAK,CAAC,QAAQ,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC;YAC7C,KAAK,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;YAC/C,KAAK,CAAC,eAAe,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC;YAC3D,KAAK,CAAC,SAAS,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC;YAC/C,KAAK,CAAC,WAAW,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;gBACpE,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC;gBACvC,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,EAAE,IAAI,sBAAsB,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAC1D,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC;gBAC9B,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,EAAE,IAAI,YAAY,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAE5D,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC","sourcesContent":["import { getIntegrationRequestContext } from \"../server/request-context.js\";\n/*\n Audit capture entry point, called from the `defineAction` audit wrapper after\n * an action runs (success or error). Best-effort: any failure here is swallowed\n * so auditing never breaks the action it observes.\n \n This module touches the DB (`store.js`), so `action.ts` loads it lazily via\n * dynamic import on the first audited call — keeping the DB client out of every\n * bundle that merely defines actions.\n /\nimport {\n deriveActorKind,\n isAuditDisabled,\n shouldRecordAudit,\n} from \"./config.js\";\nimport { redactArgsToJson } from \"./redact.js\";\nimport { insertAuditEvent } from \"./store.js\";\nimport type {\n ActionAuditConfig,\n AuditCallMeta,\n AuditEvent,\n AuditStatus,\n AuditTarget,\n} from \"./types.js\";\n\n/* Minimal view of the action run context the recorder needs. /\nexport interface AuditRunContextLike {\n actionName?: string;\n caller?: string;\n userEmail?: string;\n orgId?: string \| null;\n threadId?: string;\n turnId?: string;\n}\n\nexport interface RecordActionAuditInput {\n config: ActionAuditConfig \| undefined;\n args: unknown;\n ctx: AuditRunContextLike \| undefined;\n status: AuditStatus;\n result?: unknown;\n error?: unknown;\n}\n\nfunction errorCode(error: unknown): string \| null {\n if (!error) return null;\n if (typeof error === \"object\") {\n const e = error as { errorCode?: unknown; code?: unknown; name?: unknown };\n if (typeof e.errorCode === \"string\") return e.errorCode;\n if (typeof e.code === \"string\") return e.code;\n if (typeof e.name === \"string\") return e.name;\n }\n return \"error\";\n}\n\nfunction safeTarget(\n config: ActionAuditConfig \| undefined,\n args: unknown,\n result: unknown,\n meta: AuditCallMeta,\n): AuditTarget \| null {\n if (!config?.target) return null;\n try {\n return config.target(args, result, meta) ?? null;\n } catch {\n return null;\n }\n}\n\nfunction safeSummary(\n config: ActionAuditConfig \| undefined,\n args: unknown,\n result: unknown,\n meta: AuditCallMeta,\n): string \| null {\n if (!config?.summary) return null;\n try {\n const s = config.summary(args, result, meta);\n return typeof s === \"string\" ? s.slice(0, 500) : null;\n } catch {\n return null;\n }\n}\n\n/\n Record one audit event. Resolves the actor, target, ownership (for scoped\n * reads), and redacted inputs, then appends a row. Never throws.\n */\nexport async function recordActionAudit(\n input: RecordActionAuditInput,\n): Promise<void> {\n try {\n if (isAuditDisabled()) return;\n const ctx = input.ctx;\n const actionName = ctx?.actionName;\n // No name → an internal/programmatic run() with no dispatch context. Skip\n // rather than write a nameless row.\n if (!actionName) return;\n if (!shouldRecordAudit(input.config, actionName)) return;\n\n const caller = ctx?.caller ?? \"http\";\n const actorEmail = ctx?.userEmail ?? null;\n const meta: AuditCallMeta = {\n status: input.status,\n caller,\n userEmail: ctx?.userEmail,\n orgId: ctx?.orgId ?? null,\n };\n\n const target = safeTarget(input.config, input.args, input.result, meta);\n const summary = safeSummary(input.config, input.args, input.result, meta);\n\n const recordInputs = input.config?.recordInputs !== false;\n const inputJson = recordInputs ? redactArgsToJson(input.args) : null;\n\n const hasExplicitTargetVisibility = target?.visibility !== undefined;\n const event: AuditEvent = {\n id: crypto.randomUUID(),\n createdAt: Date.now(),\n action: actionName,\n caller,\n actorKind: deriveActorKind(caller, actorEmail),\n actorEmail,\n orgId: ctx?.orgId ?? null,\n threadId: ctx?.threadId ?? null,\n turnId: ctx?.turnId ?? null,\n targetType: target?.type ?? null,\n targetId: target?.id ?? null,\n status: input.status,\n summary,\n input: inputJson,\n errorCode: input.status === \"error\" ? errorCode(input.error) : null,\n // Scope reads to the resource owner when the action declares one,\n // otherwise to the actor (the common self-mutation case).\n ownerEmail: target?.ownerEmail ?? actorEmail,\n visibility: target?.visibility ?? \"private\",\n };\n const lineage = getIntegrationRequestContext()?.lineage;\n const integration = getIntegrationRequestContext();\n if (integration) {\n if (\n ctx?.orgId &&\n event.visibility === \"private\" &&\n !hasExplicitTargetVisibility\n ) {\n event.visibility = \"org\";\n }\n event.runId = lineage?.runId ?? null;\n event.taskId = integration.taskId;\n event.parentTaskId = lineage?.parentTaskId ?? null;\n event.sourceKind = lineage?.source?.kind ?? null;\n event.sourcePlatform = lineage?.source?.platform ?? null;\n event.sourceId = lineage?.source?.id ?? null;\n event.sourceUrl = lineage?.source?.url ?? null;\n event.networkProtocol = lineage?.network?.protocol ?? null;\n event.networkId = lineage?.network?.id ?? null;\n event.networkPeer = lineage?.network?.peer ?? null;\n if (!event.networkProtocol && actionName === \"provider-api-request\") {\n event.networkProtocol = \"provider-api\";\n event.networkId = target?.id ?? \"provider-api-request\";\n }\n if (!event.networkProtocol && actionName === \"call-agent\") {\n event.networkProtocol = \"a2a\";\n event.networkId = target?.id ?? \"call-agent\";\n }\n }\n // org_id used for scoping defaults to the target's, else the actor's org.\n if (target?.orgId !== undefined) event.orgId = target.orgId;\n\n await insertAuditEvent(event);\n } catch {\n // Best-effort — auditing must never break the audited action.\n }\n}\n"]}

package/dist/audit/store.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"~~AAWA~~,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAIpB,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,~~CAiFvD~~;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,~~CA6BvE~~;~~AAwBD~~,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA2CD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,~~CAsCvB~~;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAW5B;AAED,6EAA6E;AAC7E,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ5E;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C"}
1	+ {"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAIpB,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAqHvD;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCvE;AAkCD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA2CD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,CA0CvB;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAW5B;AAED,6EAA6E;AAC7E,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ5E;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C"}

package/dist/audit/store.js CHANGED Viewed

@@ -8,7 +8,7 @@
  * shares table — audit rows are never individually shared).
  */
 import { getDbExec, intType, isPostgres } from "../db/client.js";
-import { ensureTableExists, ensureIndexExists } from "../db/ddl-guard.js";
+import { ensureColumnExists, ensureTableExists, ensureIndexExists, } from "../db/ddl-guard.js";
 let _initPromise;
 export async function ensureAuditTables() {
     if (!_initPromise) {
@@ -33,12 +33,37 @@ export async function ensureAuditTables() {
           error_code TEXT,
           owner_email TEXT,
           visibility TEXT NOT NULL DEFAULT 'private'
+          ,run_id TEXT
+          ,task_id TEXT
+          ,parent_task_id TEXT
+          ,source_kind TEXT
+          ,source_platform TEXT
+          ,source_id TEXT
+          ,source_url TEXT
+          ,network_protocol TEXT
+          ,network_id TEXT
+          ,network_peer TEXT
         )
       `;
+            const lineageColumns = [
+                "run_id",
+                "task_id",
+                "parent_task_id",
+                "source_kind",
+                "source_platform",
+                "source_id",
+                "source_url",
+                "network_protocol",
+                "network_id",
+                "network_peer",
+            ];
             if (isPostgres()) {
                 // PG-guard: probe information_schema / pg_indexes before issuing DDL to
                 // avoid ACCESS EXCLUSIVE lock contention in fresh background-worker processes.
                 await ensureTableExists("agent_audit_log", createSql);
+                for (const column of lineageColumns) {
+                    await ensureColumnExists("agent_audit_log", column, `ALTER TABLE agent_audit_log ADD COLUMN IF NOT EXISTS ${column} TEXT`);
+                }
                 await ensureIndexExists("idx_audit_owner", `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`);
                 await ensureIndexExists("idx_audit_org", `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`);
                 await ensureIndexExists("idx_audit_target", `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`);
@@ -49,6 +74,12 @@ export async function ensureAuditTables() {
             }
             // SQLite (local dev): no lock problem — keep the original behaviour.
             await client.execute(createSql);
+            for (const column of lineageColumns) {
+                try {
+                    await client.execute(`ALTER TABLE agent_audit_log ADD COLUMN ${column} TEXT`);
+                }
+                catch { }
+            }
             const indexes = [
                 `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,
                 `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,
@@ -80,8 +111,10 @@ export async function insertAuditEvent(event) {
         sql: `INSERT INTO agent_audit_log
       (id, created_at, action, caller, actor_kind, actor_email, org_id,
        thread_id, turn_id, target_type, target_id, status, summary, input,
-       error_code, owner_email, visibility)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       error_code, owner_email, visibility, run_id, task_id, parent_task_id,
+       source_kind, source_platform, source_id, source_url, network_protocol,
+       network_id, network_peer)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             event.id,
             event.createdAt,
@@ -100,6 +133,16 @@ export async function insertAuditEvent(event) {
             event.errorCode,
             event.ownerEmail,
             event.visibility,
+            event.runId ?? null,
+            event.taskId ?? null,
+            event.parentTaskId ?? null,
+            event.sourceKind ?? null,
+            event.sourcePlatform ?? null,
+            event.sourceId ?? null,
+            event.sourceUrl ?? null,
+            event.networkProtocol ?? null,
+            event.networkId ?? null,
+            event.networkPeer ?? null,
         ],
     });
 }
@@ -122,6 +165,16 @@ function mapRow(row) {
         errorCode: row.error_code ?? null,
         ownerEmail: row.owner_email ?? null,
         visibility: (row.visibility ?? "private"),
+        runId: row.run_id ?? null,
+        taskId: row.task_id ?? null,
+        parentTaskId: row.parent_task_id ?? null,
+        sourceKind: row.source_kind ?? null,
+        sourcePlatform: row.source_platform ?? null,
+        sourceId: row.source_id ?? null,
+        sourceUrl: row.source_url ?? null,
+        networkProtocol: row.network_protocol ?? null,
+        networkId: row.network_id ?? null,
+        networkPeer: row.network_peer ?? null,
     };
 }
 /**
@@ -191,6 +244,12 @@ export async function queryAuditEvents(scope, filters = {}) {
         push("turn_id = ?", filters.turnId);
     if (filters.action)
         push("action = ?", filters.action);
+    if (filters.taskId)
+        push("task_id = ?", filters.taskId);
+    if (filters.runId)
+        push("run_id = ?", filters.runId);
+    if (filters.sourcePlatform)
+        push("source_platform = ?", filters.sourcePlatform);
     if (typeof filters.sinceMs === "number") {
         push("created_at >= ?", Math.floor(filters.sinceMs));
     }

package/dist/audit/store.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAO1E,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;uBAGD,OAAO,EAAE;;;;;;;;;;;;;;;;;OAiBzB,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,wEAAwE;gBACxE,+EAA+E;gBAC/E,MAAM,iBAAiB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;gBACtD,MAAM,iBAAiB,CACrB,iBAAiB,EACjB,yFAAyF,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,eAAe,EACf,kFAAkF,CACnF,CAAC;gBACF,MAAM,iBAAiB,CACrB,kBAAkB,EAClB,qGAAqG,CACtG,CAAC;gBACF,MAAM,iBAAiB,CACrB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;gBACF,MAAM,iBAAiB,CACrB,iBAAiB,EACjB,yFAAyF,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,mBAAmB,EACnB,8EAA8E,CAC/E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG;gBACd,yFAAyF;gBACzF,kFAAkF;gBAClF,qGAAqG;gBACrG,wEAAwE;gBACxE,yFAAyF;gBACzF,8EAA8E;aAC/E,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,wDAAwD;YACxD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IACtD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;;iEAIwD;QAC7D,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,UAAU;SACjB;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ;IACtB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;QACxB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QACjC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAoB;KAC7D,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAqB;IACxC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,SAAS;YACT,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,4EAA4E;AAC5E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,YAAY,GAChB,mEAAmE;IACnE,+DAA+D;IAC/D,qCAAqC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAqB,EACrB,OAAO,GAAsB,EAAE;IAE/B,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAU,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAU,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,EACvD,SAAS,CACV,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,UAAU,YAAY;kBACb,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;;kBAEnB;QACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,KAAqB;IAErB,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,kDAAkD,MAAM,CAAC,GAAG,UAAU;QAC3E,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,kDAAkD;QACvD,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB;IACtC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC","sourcesContent":["/*\n SQL persistence for the framework audit log.\n \n Follows the same raw-SQL, provider-agnostic pattern as observability/store.ts\n * and usage/store.ts — framework tables use `getDbExec()` + `intType()` rather\n * than Drizzle ORM (which is for template-level schemas). One append-only table\n * `agent_audit_log`; reads are scoped to the caller's identity in SQL (no\n * shares table — audit rows are never individually shared).\n /\nimport { getDbExec, intType, isPostgres } from \"../db/client.js\";\nimport { ensureTableExists, ensureIndexExists } from \"../db/ddl-guard.js\";\nimport type {\n AuditEvent,\n AuditQueryFilters,\n AuditVisibility,\n} from \"./types.js\";\n\nlet _initPromise: Promise<void> \| undefined;\n\nexport async function ensureAuditTables(): Promise<void> {\n if (!_initPromise) {\n _initPromise = (async () => {\n const client = getDbExec();\n const createSql = `\n CREATE TABLE IF NOT EXISTS agent_audit_log (\n id TEXT PRIMARY KEY,\n created_at ${intType()} NOT NULL,\n action TEXT NOT NULL,\n caller TEXT NOT NULL,\n actor_kind TEXT NOT NULL,\n actor_email TEXT,\n org_id TEXT,\n thread_id TEXT,\n turn_id TEXT,\n target_type TEXT,\n target_id TEXT,\n status TEXT NOT NULL DEFAULT 'success',\n summary TEXT,\n input TEXT,\n error_code TEXT,\n owner_email TEXT,\n visibility TEXT NOT NULL DEFAULT 'private'\n )\n `;\n\n if (isPostgres()) {\n // PG-guard: probe information_schema / pg_indexes before issuing DDL to\n // avoid ACCESS EXCLUSIVE lock contention in fresh background-worker processes.\n await ensureTableExists(\"agent_audit_log\", createSql);\n await ensureIndexExists(\n \"idx_audit_owner\",\n `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_org\",\n `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_target\",\n `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_turn\",\n `CREATE INDEX IF NOT EXISTS idx_audit_turn ON agent_audit_log (turn_id)`,\n );\n await ensureIndexExists(\n \"idx_audit_actor\",\n `CREATE INDEX IF NOT EXISTS idx_audit_actor ON agent_audit_log (actor_email, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_created\",\n `CREATE INDEX IF NOT EXISTS idx_audit_created ON agent_audit_log (created_at)`,\n );\n return;\n }\n\n // SQLite (local dev): no lock problem — keep the original behaviour.\n await client.execute(createSql);\n const indexes = [\n `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_turn ON agent_audit_log (turn_id)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_actor ON agent_audit_log (actor_email, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_created ON agent_audit_log (created_at)`,\n ];\n for (const sql of indexes) {\n try {\n await client.execute(sql);\n } catch {\n // Index creation is best-effort; a racing boot may have created it.\n }\n }\n })().catch((err) => {\n // Allow a later call to retry if the first init failed.\n _initPromise = undefined;\n throw err;\n });\n }\n return _initPromise;\n}\n\nexport async function insertAuditEvent(event: AuditEvent): Promise<void> {\n await ensureAuditTables();\n const client = getDbExec();\n await client.execute({\n sql: `INSERT INTO agent_audit_log\n (id, created_at, action, caller, actor_kind, actor_email, org_id,\n thread_id, turn_id, target_type, target_id, status, summary, input,\n error_code, owner_email, visibility)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n event.id,\n event.createdAt,\n event.action,\n event.caller,\n event.actorKind,\n event.actorEmail,\n event.orgId,\n event.threadId,\n event.turnId,\n event.targetType,\n event.targetId,\n event.status,\n event.summary,\n event.input,\n event.errorCode,\n event.ownerEmail,\n event.visibility,\n ],\n });\n}\n\nfunction mapRow(row: any): AuditEvent {\n return {\n id: String(row.id),\n createdAt: Number(row.created_at),\n action: String(row.action),\n caller: String(row.caller),\n actorKind: row.actor_kind,\n actorEmail: row.actor_email ?? null,\n orgId: row.org_id ?? null,\n threadId: row.thread_id ?? null,\n turnId: row.turn_id ?? null,\n targetType: row.target_type ?? null,\n targetId: row.target_id ?? null,\n status: row.status,\n summary: row.summary ?? null,\n input: row.input ?? null,\n errorCode: row.error_code ?? null,\n ownerEmail: row.owner_email ?? null,\n visibility: (row.visibility ?? \"private\") as AuditVisibility,\n };\n}\n\nexport interface AuditReadScope {\n userEmail?: string;\n orgId?: string \| null;\n}\n\n/\n Build the access-scoping WHERE fragment + args. A caller sees audit rows they\n * own, plus org-visible rows in their org. With no identity, nothing matches —\n * the audit log never leaks cross-tenant. Mirrors the core ownership clause of\n * `accessFilter` (minus shares, which audit rows don't have).\n /\nfunction scopeClause(scope: AuditReadScope): { sql: string; args: any[] } {\n const clauses: string[] = [];\n const args: any[] = [];\n if (scope.userEmail) {\n if (scope.orgId) {\n // Constrain the owner's rows to the active org — plus legacy/solo rows\n // that predate org-scoping (org_id IS NULL) — mirroring sharing's\n // `ownerScopeFilter`, so switching orgs doesn't surface another org's\n // trail.\n clauses.push(\"(owner_email = ? AND (org_id = ? OR org_id IS NULL))\");\n args.push(scope.userEmail, scope.orgId);\n } else {\n clauses.push(\"owner_email = ?\");\n args.push(scope.userEmail);\n }\n }\n if (scope.orgId) {\n clauses.push(\"(visibility = 'org' AND org_id = ?)\");\n args.push(scope.orgId);\n }\n if (clauses.length === 0) return { sql: \"1=0\", args };\n return { sql: `(${clauses.join(\" OR \")})`, args };\n}\n\nconst MAX_LIMIT = 500;\nconst DEFAULT_LIMIT = 100;\n\n// Columns returned by the list surface — deliberately EXCLUDES `input` so a\n// timeline query never streams every event's (redacted) request body in bulk.\n// Fetch the full payload one event at a time via `getAuditEventById`.\nconst LIST_COLUMNS =\n \"id, created_at, action, caller, actor_kind, actor_email, org_id, \" +\n \"thread_id, turn_id, target_type, target_id, status, summary, \" +\n \"error_code, owner_email, visibility\";\n\nexport async function queryAuditEvents(\n scope: AuditReadScope,\n filters: AuditQueryFilters = {},\n): Promise<AuditEvent[]> {\n await ensureAuditTables();\n if (!scope.userEmail && !scope.orgId) return [];\n const client = getDbExec();\n\n const scoped = scopeClause(scope);\n const where: string[] = [scoped.sql];\n const args: any[] = [...scoped.args];\n\n const push = (clause: string, value: any) => {\n where.push(clause);\n args.push(value);\n };\n if (filters.targetType) push(\"target_type = ?\", filters.targetType);\n if (filters.targetId) push(\"target_id = ?\", filters.targetId);\n if (filters.actorKind) push(\"actor_kind = ?\", filters.actorKind);\n if (filters.actorEmail) push(\"actor_email = ?\", filters.actorEmail);\n if (filters.status) push(\"status = ?\", filters.status);\n if (filters.threadId) push(\"thread_id = ?\", filters.threadId);\n if (filters.turnId) push(\"turn_id = ?\", filters.turnId);\n if (filters.action) push(\"action = ?\", filters.action);\n if (typeof filters.sinceMs === \"number\") {\n push(\"created_at >= ?\", Math.floor(filters.sinceMs));\n }\n\n const limit = Math.min(\n Math.max(1, Math.floor(filters.limit ?? DEFAULT_LIMIT)),\n MAX_LIMIT,\n );\n\n const result = await client.execute({\n sql: `SELECT ${LIST_COLUMNS} FROM agent_audit_log\n WHERE ${where.join(\" AND \")}\n ORDER BY created_at DESC\n LIMIT ?`,\n args: [...args, limit],\n });\n return (result.rows ?? []).map(mapRow);\n}\n\nexport async function getAuditEventById(\n id: string,\n scope: AuditReadScope,\n): Promise<AuditEvent \| null> {\n await ensureAuditTables();\n if (!scope.userEmail && !scope.orgId) return null;\n const client = getDbExec();\n const scoped = scopeClause(scope);\n const result = await client.execute({\n sql: `SELECT FROM agent_audit_log WHERE id = ? AND ${scoped.sql} LIMIT 1`,\n args: [id, ...scoped.args],\n });\n const row = (result.rows ?? [])[0];\n return row ? mapRow(row) : null;\n}\n\n/** Purge audit rows older than `cutoffMs`. Returns the deleted row count. /\nexport async function deleteOldAuditEvents(cutoffMs: number): Promise<number> {\n await ensureAuditTables();\n const client = getDbExec();\n const result = await client.execute({\n sql: `DELETE FROM agent_audit_log WHERE created_at < ?`,\n args: [Math.floor(cutoffMs)],\n });\n return Number(result.rowsAffected ?? 0);\n}\n\n/* Test-only: reset the cached init promise so a fresh DB re-creates tables. */\nexport function __resetAuditInitForTests(): void {\n _initPromise = undefined;\n}\n"]}
1	+ {"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/audit/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAO5B,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;uBAGD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BzB,CAAC;YACF,MAAM,cAAc,GAAG;gBACrB,QAAQ;gBACR,SAAS;gBACT,gBAAgB;gBAChB,aAAa;gBACb,iBAAiB;gBACjB,WAAW;gBACX,YAAY;gBACZ,kBAAkB;gBAClB,YAAY;gBACZ,cAAc;aACf,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,wEAAwE;gBACxE,+EAA+E;gBAC/E,MAAM,iBAAiB,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;gBACtD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;oBACpC,MAAM,kBAAkB,CACtB,iBAAiB,EACjB,MAAM,EACN,wDAAwD,MAAM,OAAO,CACtE,CAAC;gBACJ,CAAC;gBACD,MAAM,iBAAiB,CACrB,iBAAiB,EACjB,yFAAyF,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,eAAe,EACf,kFAAkF,CACnF,CAAC;gBACF,MAAM,iBAAiB,CACrB,kBAAkB,EAClB,qGAAqG,CACtG,CAAC;gBACF,MAAM,iBAAiB,CACrB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;gBACF,MAAM,iBAAiB,CACrB,iBAAiB,EACjB,yFAAyF,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,mBAAmB,EACnB,8EAA8E,CAC/E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,CAClB,0CAA0C,MAAM,OAAO,CACxD,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YACD,MAAM,OAAO,GAAG;gBACd,yFAAyF;gBACzF,kFAAkF;gBAClF,qGAAqG;gBACrG,wEAAwE;gBACxE,yFAAyF;gBACzF,8EAA8E;aAC/E,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,wDAAwD;YACxD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IACtD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;;;;+FAMsF;QAC3F,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,MAAM,IAAI,IAAI;YACpB,KAAK,CAAC,YAAY,IAAI,IAAI;YAC1B,KAAK,CAAC,UAAU,IAAI,IAAI;YACxB,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5B,KAAK,CAAC,QAAQ,IAAI,IAAI;YACtB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,eAAe,IAAI,IAAI;YAC7B,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,WAAW,IAAI,IAAI;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ;IACtB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;QACxB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QACjC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAoB;QAC5D,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC3B,YAAY,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QACxC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,cAAc,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC3C,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QACjC,eAAe,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC7C,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QACjC,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAqB;IACxC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,SAAS;YACT,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,4EAA4E;AAC5E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,YAAY,GAChB,mEAAmE;IACnE,+DAA+D;IAC/D,qCAAqC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAqB,EACrB,OAAO,GAAsB,EAAE;IAE/B,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAU,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAU,EAAE,EAAE;QAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,cAAc;QACxB,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,EACvD,SAAS,CACV,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,UAAU,YAAY;kBACb,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;;kBAEnB;QACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,KAAqB;IAErB,MAAM,iBAAiB,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,kDAAkD,MAAM,CAAC,GAAG,UAAU;QAC3E,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,iBAAiB,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,kDAAkD;QACvD,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB;IACtC,YAAY,GAAG,SAAS,CAAC;AAC3B,CAAC","sourcesContent":["/*\n SQL persistence for the framework audit log.\n \n Follows the same raw-SQL, provider-agnostic pattern as observability/store.ts\n * and usage/store.ts — framework tables use `getDbExec()` + `intType()` rather\n * than Drizzle ORM (which is for template-level schemas). One append-only table\n * `agent_audit_log`; reads are scoped to the caller's identity in SQL (no\n * shares table — audit rows are never individually shared).\n /\nimport { getDbExec, intType, isPostgres } from \"../db/client.js\";\nimport {\n ensureColumnExists,\n ensureTableExists,\n ensureIndexExists,\n} from \"../db/ddl-guard.js\";\nimport type {\n AuditEvent,\n AuditQueryFilters,\n AuditVisibility,\n} from \"./types.js\";\n\nlet _initPromise: Promise<void> \| undefined;\n\nexport async function ensureAuditTables(): Promise<void> {\n if (!_initPromise) {\n _initPromise = (async () => {\n const client = getDbExec();\n const createSql = `\n CREATE TABLE IF NOT EXISTS agent_audit_log (\n id TEXT PRIMARY KEY,\n created_at ${intType()} NOT NULL,\n action TEXT NOT NULL,\n caller TEXT NOT NULL,\n actor_kind TEXT NOT NULL,\n actor_email TEXT,\n org_id TEXT,\n thread_id TEXT,\n turn_id TEXT,\n target_type TEXT,\n target_id TEXT,\n status TEXT NOT NULL DEFAULT 'success',\n summary TEXT,\n input TEXT,\n error_code TEXT,\n owner_email TEXT,\n visibility TEXT NOT NULL DEFAULT 'private'\n ,run_id TEXT\n ,task_id TEXT\n ,parent_task_id TEXT\n ,source_kind TEXT\n ,source_platform TEXT\n ,source_id TEXT\n ,source_url TEXT\n ,network_protocol TEXT\n ,network_id TEXT\n ,network_peer TEXT\n )\n `;\n const lineageColumns = [\n \"run_id\",\n \"task_id\",\n \"parent_task_id\",\n \"source_kind\",\n \"source_platform\",\n \"source_id\",\n \"source_url\",\n \"network_protocol\",\n \"network_id\",\n \"network_peer\",\n ];\n\n if (isPostgres()) {\n // PG-guard: probe information_schema / pg_indexes before issuing DDL to\n // avoid ACCESS EXCLUSIVE lock contention in fresh background-worker processes.\n await ensureTableExists(\"agent_audit_log\", createSql);\n for (const column of lineageColumns) {\n await ensureColumnExists(\n \"agent_audit_log\",\n column,\n `ALTER TABLE agent_audit_log ADD COLUMN IF NOT EXISTS ${column} TEXT`,\n );\n }\n await ensureIndexExists(\n \"idx_audit_owner\",\n `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_org\",\n `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_target\",\n `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_turn\",\n `CREATE INDEX IF NOT EXISTS idx_audit_turn ON agent_audit_log (turn_id)`,\n );\n await ensureIndexExists(\n \"idx_audit_actor\",\n `CREATE INDEX IF NOT EXISTS idx_audit_actor ON agent_audit_log (actor_email, created_at)`,\n );\n await ensureIndexExists(\n \"idx_audit_created\",\n `CREATE INDEX IF NOT EXISTS idx_audit_created ON agent_audit_log (created_at)`,\n );\n return;\n }\n\n // SQLite (local dev): no lock problem — keep the original behaviour.\n await client.execute(createSql);\n for (const column of lineageColumns) {\n try {\n await client.execute(\n `ALTER TABLE agent_audit_log ADD COLUMN ${column} TEXT`,\n );\n } catch {}\n }\n const indexes = [\n `CREATE INDEX IF NOT EXISTS idx_audit_owner ON agent_audit_log (owner_email, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_org ON agent_audit_log (org_id, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_target ON agent_audit_log (target_type, target_id, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_turn ON agent_audit_log (turn_id)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_actor ON agent_audit_log (actor_email, created_at)`,\n `CREATE INDEX IF NOT EXISTS idx_audit_created ON agent_audit_log (created_at)`,\n ];\n for (const sql of indexes) {\n try {\n await client.execute(sql);\n } catch {\n // Index creation is best-effort; a racing boot may have created it.\n }\n }\n })().catch((err) => {\n // Allow a later call to retry if the first init failed.\n _initPromise = undefined;\n throw err;\n });\n }\n return _initPromise;\n}\n\nexport async function insertAuditEvent(event: AuditEvent): Promise<void> {\n await ensureAuditTables();\n const client = getDbExec();\n await client.execute({\n sql: `INSERT INTO agent_audit_log\n (id, created_at, action, caller, actor_kind, actor_email, org_id,\n thread_id, turn_id, target_type, target_id, status, summary, input,\n error_code, owner_email, visibility, run_id, task_id, parent_task_id,\n source_kind, source_platform, source_id, source_url, network_protocol,\n network_id, network_peer)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n event.id,\n event.createdAt,\n event.action,\n event.caller,\n event.actorKind,\n event.actorEmail,\n event.orgId,\n event.threadId,\n event.turnId,\n event.targetType,\n event.targetId,\n event.status,\n event.summary,\n event.input,\n event.errorCode,\n event.ownerEmail,\n event.visibility,\n event.runId ?? null,\n event.taskId ?? null,\n event.parentTaskId ?? null,\n event.sourceKind ?? null,\n event.sourcePlatform ?? null,\n event.sourceId ?? null,\n event.sourceUrl ?? null,\n event.networkProtocol ?? null,\n event.networkId ?? null,\n event.networkPeer ?? null,\n ],\n });\n}\n\nfunction mapRow(row: any): AuditEvent {\n return {\n id: String(row.id),\n createdAt: Number(row.created_at),\n action: String(row.action),\n caller: String(row.caller),\n actorKind: row.actor_kind,\n actorEmail: row.actor_email ?? null,\n orgId: row.org_id ?? null,\n threadId: row.thread_id ?? null,\n turnId: row.turn_id ?? null,\n targetType: row.target_type ?? null,\n targetId: row.target_id ?? null,\n status: row.status,\n summary: row.summary ?? null,\n input: row.input ?? null,\n errorCode: row.error_code ?? null,\n ownerEmail: row.owner_email ?? null,\n visibility: (row.visibility ?? \"private\") as AuditVisibility,\n runId: row.run_id ?? null,\n taskId: row.task_id ?? null,\n parentTaskId: row.parent_task_id ?? null,\n sourceKind: row.source_kind ?? null,\n sourcePlatform: row.source_platform ?? null,\n sourceId: row.source_id ?? null,\n sourceUrl: row.source_url ?? null,\n networkProtocol: row.network_protocol ?? null,\n networkId: row.network_id ?? null,\n networkPeer: row.network_peer ?? null,\n };\n}\n\nexport interface AuditReadScope {\n userEmail?: string;\n orgId?: string \| null;\n}\n\n/\n Build the access-scoping WHERE fragment + args. A caller sees audit rows they\n * own, plus org-visible rows in their org. With no identity, nothing matches —\n * the audit log never leaks cross-tenant. Mirrors the core ownership clause of\n * `accessFilter` (minus shares, which audit rows don't have).\n /\nfunction scopeClause(scope: AuditReadScope): { sql: string; args: any[] } {\n const clauses: string[] = [];\n const args: any[] = [];\n if (scope.userEmail) {\n if (scope.orgId) {\n // Constrain the owner's rows to the active org — plus legacy/solo rows\n // that predate org-scoping (org_id IS NULL) — mirroring sharing's\n // `ownerScopeFilter`, so switching orgs doesn't surface another org's\n // trail.\n clauses.push(\"(owner_email = ? AND (org_id = ? OR org_id IS NULL))\");\n args.push(scope.userEmail, scope.orgId);\n } else {\n clauses.push(\"owner_email = ?\");\n args.push(scope.userEmail);\n }\n }\n if (scope.orgId) {\n clauses.push(\"(visibility = 'org' AND org_id = ?)\");\n args.push(scope.orgId);\n }\n if (clauses.length === 0) return { sql: \"1=0\", args };\n return { sql: `(${clauses.join(\" OR \")})`, args };\n}\n\nconst MAX_LIMIT = 500;\nconst DEFAULT_LIMIT = 100;\n\n// Columns returned by the list surface — deliberately EXCLUDES `input` so a\n// timeline query never streams every event's (redacted) request body in bulk.\n// Fetch the full payload one event at a time via `getAuditEventById`.\nconst LIST_COLUMNS =\n \"id, created_at, action, caller, actor_kind, actor_email, org_id, \" +\n \"thread_id, turn_id, target_type, target_id, status, summary, \" +\n \"error_code, owner_email, visibility\";\n\nexport async function queryAuditEvents(\n scope: AuditReadScope,\n filters: AuditQueryFilters = {},\n): Promise<AuditEvent[]> {\n await ensureAuditTables();\n if (!scope.userEmail && !scope.orgId) return [];\n const client = getDbExec();\n\n const scoped = scopeClause(scope);\n const where: string[] = [scoped.sql];\n const args: any[] = [...scoped.args];\n\n const push = (clause: string, value: any) => {\n where.push(clause);\n args.push(value);\n };\n if (filters.targetType) push(\"target_type = ?\", filters.targetType);\n if (filters.targetId) push(\"target_id = ?\", filters.targetId);\n if (filters.actorKind) push(\"actor_kind = ?\", filters.actorKind);\n if (filters.actorEmail) push(\"actor_email = ?\", filters.actorEmail);\n if (filters.status) push(\"status = ?\", filters.status);\n if (filters.threadId) push(\"thread_id = ?\", filters.threadId);\n if (filters.turnId) push(\"turn_id = ?\", filters.turnId);\n if (filters.action) push(\"action = ?\", filters.action);\n if (filters.taskId) push(\"task_id = ?\", filters.taskId);\n if (filters.runId) push(\"run_id = ?\", filters.runId);\n if (filters.sourcePlatform)\n push(\"source_platform = ?\", filters.sourcePlatform);\n if (typeof filters.sinceMs === \"number\") {\n push(\"created_at >= ?\", Math.floor(filters.sinceMs));\n }\n\n const limit = Math.min(\n Math.max(1, Math.floor(filters.limit ?? DEFAULT_LIMIT)),\n MAX_LIMIT,\n );\n\n const result = await client.execute({\n sql: `SELECT ${LIST_COLUMNS} FROM agent_audit_log\n WHERE ${where.join(\" AND \")}\n ORDER BY created_at DESC\n LIMIT ?`,\n args: [...args, limit],\n });\n return (result.rows ?? []).map(mapRow);\n}\n\nexport async function getAuditEventById(\n id: string,\n scope: AuditReadScope,\n): Promise<AuditEvent \| null> {\n await ensureAuditTables();\n if (!scope.userEmail && !scope.orgId) return null;\n const client = getDbExec();\n const scoped = scopeClause(scope);\n const result = await client.execute({\n sql: `SELECT FROM agent_audit_log WHERE id = ? AND ${scoped.sql} LIMIT 1`,\n args: [id, ...scoped.args],\n });\n const row = (result.rows ?? [])[0];\n return row ? mapRow(row) : null;\n}\n\n/** Purge audit rows older than `cutoffMs`. Returns the deleted row count. /\nexport async function deleteOldAuditEvents(cutoffMs: number): Promise<number> {\n await ensureAuditTables();\n const client = getDbExec();\n const result = await client.execute({\n sql: `DELETE FROM agent_audit_log WHERE created_at < ?`,\n args: [Math.floor(cutoffMs)],\n });\n return Number(result.rowsAffected ?? 0);\n}\n\n/* Test-only: reset the cached init promise so a fresh DB re-creates tables. */\nexport function __resetAuditInitForTests(): void {\n _initPromise = undefined;\n}\n"]}

package/dist/audit/types.d.ts CHANGED Viewed

@@ -97,6 +97,16 @@ export interface AuditEvent {
     /** Denormalized owner used to scope reads (defaults to the actor). */
     ownerEmail: string | null;
     visibility: AuditVisibility;
+    runId?: string | null;
+    taskId?: string | null;
+    parentTaskId?: string | null;
+    sourceKind?: string | null;
+    sourcePlatform?: string | null;
+    sourceId?: string | null;
+    sourceUrl?: string | null;
+    networkProtocol?: string | null;
+    networkId?: string | null;
+    networkPeer?: string | null;
 }
 /** Filters for `queryAuditEvents`. */
 export interface AuditQueryFilters {
@@ -108,6 +118,9 @@ export interface AuditQueryFilters {
     threadId?: string;
     turnId?: string;
     action?: string;
+    taskId?: string;
+    runId?: string;
+    sourcePlatform?: string;
     sinceMs?: number;
     limit?: number;
 }

package/dist/audit/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,MAAM,CAAC,EAAE,CACP,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,aAAa,KAChB,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,MAAM,CAAC;CACvE;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,cAAc,CAAC;IAC1B,qEAAqE;IACrE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oDAAoD;IACpD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,MAAM,CAAC,EAAE,CACP,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,aAAa,KAChB,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,MAAM,CAAC;CACvE;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,cAAc,CAAC;IAC1B,qEAAqE;IACrE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oDAAoD;IACpD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/audit/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG","sourcesContent":["/*\n Types for the framework audit log.\n \n The audit log is a durable, complete, access-scoped, append-only record of\n * who mutated what app data, when, from where, and — when it was the agent —\n in which run. It is deliberately distinct from observability (sampled\n agent-run telemetry) and tracking (fire-and-forget product analytics): audit\n * rows are complete, locally queryable, and scoped to the data they describe.\n \n Capture happens automatically at the action-execution seam (`defineAction`):\n * every mutating action records an audit event after it runs. Read-only (GET /\n * `readOnly`) actions are skipped unless they opt in via `audit.onRead`.\n /\n\n/* Outcome of an audited action call. /\nexport type AuditStatus = \"success\" \| \"error\" \| \"denied\";\n\n/\n Who performed the mutation.\n * - `agent` — the in-app assistant / sub-agents / A2A (caller `\"tool\"`).\n * - `human` — a person via the UI, HTTP, CLI, or an external MCP client.\n * - `system` — no resolved identity (background jobs, schedules).\n /\nexport type AuditActorKind = \"agent\" \| \"human\" \| \"system\";\n\nexport type AuditVisibility = \"private\" \| \"org\" \| \"public\";\n\n/\n The resource an action mutated, plus the ownership used to scope who can\n * read the resulting audit event. Returned by an action's `audit.target`.\n \n `ownerEmail` / `orgId` / `visibility` default to the actor's identity when\n * omitted, which is correct for the common case where a user mutates their own\n * data. Provide them explicitly when a user edits a resource owned by someone\n * else so the owner sees the change in their audit trail.\n /\nexport interface AuditTarget {\n type?: string;\n id?: string;\n ownerEmail?: string \| null;\n orgId?: string \| null;\n visibility?: AuditVisibility;\n}\n\n/* Metadata about the call, passed to `audit.target` / `audit.summary`. /\nexport interface AuditCallMeta {\n status: AuditStatus;\n caller: string;\n userEmail?: string;\n orgId?: string \| null;\n}\n\n/\n Per-action audit configuration, set on `defineAction({ audit })`.\n \n Audit is default-on for mutating actions — you only need this object to\n * tune capture (declare the target, customize the summary) or to opt a\n * read-only action in / a noisy action out.\n /\nexport interface ActionAuditConfig {\n /\n Force audit on (`true`) or off (`false`). Overrides every default,\n * including the read-only skip and the high-frequency denylist. When\n * omitted, mutating actions are audited and read-only actions are not.\n /\n enabled?: boolean;\n /\n Audit this action even though it is read-only (GET). Use for sensitive\n * reads worth recording — secret access, bulk export. Ignored when\n * `enabled` is set explicitly.\n /\n onRead?: boolean;\n /* Capture the (redacted) call arguments. Default `true`. /\n recordInputs?: boolean;\n /* Resolve the mutated resource + its ownership for scoped reads. /\n target?: (\n args: any,\n result: unknown,\n meta: AuditCallMeta,\n ) => AuditTarget \| null \| undefined;\n /* Build a short human-readable summary line for the event. /\n summary?: (args: any, result: unknown, meta: AuditCallMeta) => string;\n}\n\n/* A persisted audit event. /\nexport interface AuditEvent {\n id: string;\n createdAt: number;\n /* Action name (the registry key, e.g. `delete-recording`). /\n action: string;\n /* Invocation surface: tool \| frontend \| http \| cli \| mcp \| a2a. /\n caller: string;\n actorKind: AuditActorKind;\n /* Human on whose behalf it ran — populated even for agent calls. /\n actorEmail: string \| null;\n orgId: string \| null;\n /* Agent conversation thread, when caller is the agent loop. /\n threadId: string \| null;\n /* Agent turn that produced the mutation — the unit of one agent response. /\n turnId: string \| null;\n targetType: string \| null;\n targetId: string \| null;\n status: AuditStatus;\n summary: string \| null;\n /* Redacted JSON of the call arguments, or null. /\n input: string \| null;\n errorCode: string \| null;\n /* Denormalized owner used to scope reads (defaults to the actor). /\n ownerEmail: string \| null;\n visibility: AuditVisibility;\n}\n\n/* Filters for `queryAuditEvents`. */\nexport interface AuditQueryFilters {\n targetType?: string;\n targetId?: string;\n actorKind?: AuditActorKind;\n actorEmail?: string;\n status?: AuditStatus;\n threadId?: string;\n turnId?: string;\n action?: string;\n sinceMs?: number;\n limit?: number;\n}\n"]}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG","sourcesContent":["/*\n Types for the framework audit log.\n \n The audit log is a durable, complete, access-scoped, append-only record of\n * who mutated what app data, when, from where, and — when it was the agent —\n in which run. It is deliberately distinct from observability (sampled\n agent-run telemetry) and tracking (fire-and-forget product analytics): audit\n * rows are complete, locally queryable, and scoped to the data they describe.\n \n Capture happens automatically at the action-execution seam (`defineAction`):\n * every mutating action records an audit event after it runs. Read-only (GET /\n * `readOnly`) actions are skipped unless they opt in via `audit.onRead`.\n /\n\n/* Outcome of an audited action call. /\nexport type AuditStatus = \"success\" \| \"error\" \| \"denied\";\n\n/\n Who performed the mutation.\n * - `agent` — the in-app assistant / sub-agents / A2A (caller `\"tool\"`).\n * - `human` — a person via the UI, HTTP, CLI, or an external MCP client.\n * - `system` — no resolved identity (background jobs, schedules).\n /\nexport type AuditActorKind = \"agent\" \| \"human\" \| \"system\";\n\nexport type AuditVisibility = \"private\" \| \"org\" \| \"public\";\n\n/\n The resource an action mutated, plus the ownership used to scope who can\n * read the resulting audit event. Returned by an action's `audit.target`.\n \n `ownerEmail` / `orgId` / `visibility` default to the actor's identity when\n * omitted, which is correct for the common case where a user mutates their own\n * data. Provide them explicitly when a user edits a resource owned by someone\n * else so the owner sees the change in their audit trail.\n /\nexport interface AuditTarget {\n type?: string;\n id?: string;\n ownerEmail?: string \| null;\n orgId?: string \| null;\n visibility?: AuditVisibility;\n}\n\n/* Metadata about the call, passed to `audit.target` / `audit.summary`. /\nexport interface AuditCallMeta {\n status: AuditStatus;\n caller: string;\n userEmail?: string;\n orgId?: string \| null;\n}\n\n/\n Per-action audit configuration, set on `defineAction({ audit })`.\n \n Audit is default-on for mutating actions — you only need this object to\n * tune capture (declare the target, customize the summary) or to opt a\n * read-only action in / a noisy action out.\n /\nexport interface ActionAuditConfig {\n /\n Force audit on (`true`) or off (`false`). Overrides every default,\n * including the read-only skip and the high-frequency denylist. When\n * omitted, mutating actions are audited and read-only actions are not.\n /\n enabled?: boolean;\n /\n Audit this action even though it is read-only (GET). Use for sensitive\n * reads worth recording — secret access, bulk export. Ignored when\n * `enabled` is set explicitly.\n /\n onRead?: boolean;\n /* Capture the (redacted) call arguments. Default `true`. /\n recordInputs?: boolean;\n /* Resolve the mutated resource + its ownership for scoped reads. /\n target?: (\n args: any,\n result: unknown,\n meta: AuditCallMeta,\n ) => AuditTarget \| null \| undefined;\n /* Build a short human-readable summary line for the event. /\n summary?: (args: any, result: unknown, meta: AuditCallMeta) => string;\n}\n\n/* A persisted audit event. /\nexport interface AuditEvent {\n id: string;\n createdAt: number;\n /* Action name (the registry key, e.g. `delete-recording`). /\n action: string;\n /* Invocation surface: tool \| frontend \| http \| cli \| mcp \| a2a. /\n caller: string;\n actorKind: AuditActorKind;\n /* Human on whose behalf it ran — populated even for agent calls. /\n actorEmail: string \| null;\n orgId: string \| null;\n /* Agent conversation thread, when caller is the agent loop. /\n threadId: string \| null;\n /* Agent turn that produced the mutation — the unit of one agent response. /\n turnId: string \| null;\n targetType: string \| null;\n targetId: string \| null;\n status: AuditStatus;\n summary: string \| null;\n /* Redacted JSON of the call arguments, or null. /\n input: string \| null;\n errorCode: string \| null;\n /* Denormalized owner used to scope reads (defaults to the actor). /\n ownerEmail: string \| null;\n visibility: AuditVisibility;\n runId?: string \| null;\n taskId?: string \| null;\n parentTaskId?: string \| null;\n sourceKind?: string \| null;\n sourcePlatform?: string \| null;\n sourceId?: string \| null;\n sourceUrl?: string \| null;\n networkProtocol?: string \| null;\n networkId?: string \| null;\n networkPeer?: string \| null;\n}\n\n/* Filters for `queryAuditEvents`. */\nexport interface AuditQueryFilters {\n targetType?: string;\n targetId?: string;\n actorKind?: AuditActorKind;\n actorEmail?: string;\n status?: AuditStatus;\n threadId?: string;\n turnId?: string;\n action?: string;\n taskId?: string;\n runId?: string;\n sourcePlatform?: string;\n sinceMs?: number;\n limit?: number;\n}\n"]}