@mastra/factory 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/spa-static.js

@@ -0,0 +1,104 @@
+import { dirname, extname, join, normalize, resolve, sep } from "path";
+import { readFile, stat } from "fs/promises";
+import { existsSync } from "fs";
+import { fileURLToPath } from "url";
+//#region src/spa-static.ts
+/**
+* Same-origin SPA serving for production.
+*
+* In dev the SPA is served by Vite (:5173) which proxies API paths to the
+* server (:4111) — this module is effectively idle there. In production the
+* built SPA (vite output) is served by the API server itself at `/`, so the
+* app is a single origin and no CORS / separate static host is required.
+*
+* The middleware is mounted via the Mastra entry's `server.middleware`, which
+* the deployer applies before routes: real file hits and SPA navigations are
+* answered here, everything else falls through to the API routes.
+*/
+const MIME = {
+	".html": "text/html; charset=utf-8",
+	".js": "text/javascript; charset=utf-8",
+	".mjs": "text/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json",
+	".webmanifest": "application/manifest+json",
+	".map": "application/json",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".webp": "image/webp",
+	".ico": "image/x-icon",
+	".txt": "text/plain; charset=utf-8",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".ttf": "font/ttf",
+	".wasm": "application/wasm"
+};
+/** Server-owned path prefixes the SPA middleware must never answer for. */
+const SERVER_PREFIXES = [
+	"/api",
+	"/web",
+	"/auth",
+	"/connect"
+];
+/**
+* Locate the built SPA (a dir containing `index.html`). Checked in order:
+*   1. `MASTRACODE_UI_DIST` — explicit override for custom layouts.
+*   2. `factory/` under cwd — both `mastra dev` (cwd is the Mastra public dir)
+*      and `mastra start` (cwd is `.mastra/output`) expose assets this way.
+*   3. `factory/` next to the bundled server module.
+*   4. Source-layout fallbacks under `MASTRA_PROJECT_ROOT` or cwd.
+* Returns `undefined` when no build is found (e.g. plain `mastra dev` without
+* a prior vite build), in which case the middleware is simply not mounted.
+*/
+function resolveUiDistDir() {
+	const projectRoot = process.env.MASTRA_PROJECT_ROOT?.trim();
+	const candidates = [
+		process.env.MASTRACODE_UI_DIST,
+		resolve(process.cwd(), "factory"),
+		join(dirname(fileURLToPath(import.meta.url)), "factory"),
+		projectRoot && resolve(projectRoot, "src/mastra/public/factory"),
+		resolve(process.cwd(), "src/mastra/public/factory")
+	];
+	for (const candidate of candidates) if (candidate && existsSync(join(candidate, "index.html"))) return resolve(candidate);
+}
+async function isFile(path) {
+	try {
+		return (await stat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+async function serveFile(c, filePath, immutable) {
+	const data = await readFile(filePath);
+	c.header("Content-Type", MIME[extname(filePath).toLowerCase()] ?? "application/octet-stream");
+	c.header("Cache-Control", immutable ? "public, max-age=31536000, immutable" : "no-cache");
+	return c.body(new Uint8Array(data));
+}
+/**
+* Hono middleware serving the built SPA from `uiDist`:
+*   - exact file hits (js/css/assets) are served directly,
+*   - GET navigations to non-server paths fall back to `index.html` (SPA
+*     client-side routing),
+*   - `/api`, `/web`, `/auth` and non-GET requests always pass through.
+*/
+function createSpaStaticMiddleware(uiDist) {
+	return async (c, next) => {
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") return next();
+		const path = c.req.path;
+		if (SERVER_PREFIXES.some((prefix) => path === prefix || path.startsWith(`${prefix}/`))) return next();
+		const relative = normalize(decodeURIComponent(path)).replace(/^[/\\]+/, "");
+		const filePath = resolve(uiDist, relative);
+		const uiDistPrefix = uiDist.endsWith(sep) ? uiDist : uiDist + sep;
+		if (filePath.startsWith(uiDistPrefix) && relative !== "" && await isFile(filePath)) return serveFile(c, filePath, relative.startsWith("assets/"));
+		const accept = c.req.header("Accept") ?? "";
+		if (path === "/" || accept.includes("text/html")) return serveFile(c, join(uiDist, "index.html"), false);
+		return next();
+	};
+}
+//#endregion
+export { createSpaStaticMiddleware, resolveUiDistDir };
+
+//# sourceMappingURL=spa-static.js.map

package/dist/spa-static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spa-static.js","names":[],"sources":["../src/spa-static.ts"],"sourcesContent":["/**\n * Same-origin SPA serving for production.\n *\n * In dev the SPA is served by Vite (:5173) which proxies API paths to the\n * server (:4111) — this module is effectively idle there. In production the\n * built SPA (vite output) is served by the API server itself at `/`, so the\n * app is a single origin and no CORS / separate static host is required.\n *\n * The middleware is mounted via the Mastra entry's `server.middleware`, which\n * the deployer applies before routes: real file hits and SPA navigations are\n * answered here, everything else falls through to the API routes.\n */\n\nimport { existsSync } from 'node:fs';\nimport { readFile, stat } from 'node:fs/promises';\nimport { dirname, extname, join, normalize, resolve, sep } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nimport type { Context } from 'hono';\n\nconst MIME: Record<string, string> = {\n  '.html': 'text/html; charset=utf-8',\n  '.js': 'text/javascript; charset=utf-8',\n  '.mjs': 'text/javascript; charset=utf-8',\n  '.css': 'text/css; charset=utf-8',\n  '.json': 'application/json',\n  '.webmanifest': 'application/manifest+json',\n  '.map': 'application/json',\n  '.svg': 'image/svg+xml',\n  '.png': 'image/png',\n  '.jpg': 'image/jpeg',\n  '.jpeg': 'image/jpeg',\n  '.gif': 'image/gif',\n  '.webp': 'image/webp',\n  '.ico': 'image/x-icon',\n  '.txt': 'text/plain; charset=utf-8',\n  '.woff': 'font/woff',\n  '.woff2': 'font/woff2',\n  '.ttf': 'font/ttf',\n  '.wasm': 'application/wasm',\n};\n\n/** Server-owned path prefixes the SPA middleware must never answer for. */\nconst SERVER_PREFIXES = ['/api', '/web', '/auth', '/connect'];\n\n/**\n * Locate the built SPA (a dir containing `index.html`). Checked in order:\n *   1. `MASTRACODE_UI_DIST` — explicit override for custom layouts.\n *   2. `factory/` under cwd — both `mastra dev` (cwd is the Mastra public dir)\n *      and `mastra start` (cwd is `.mastra/output`) expose assets this way.\n *   3. `factory/` next to the bundled server module.\n *   4. Source-layout fallbacks under `MASTRA_PROJECT_ROOT` or cwd.\n * Returns `undefined` when no build is found (e.g. plain `mastra dev` without\n * a prior vite build), in which case the middleware is simply not mounted.\n */\nexport function resolveUiDistDir(): string | undefined {\n  const projectRoot = process.env.MASTRA_PROJECT_ROOT?.trim();\n  const candidates = [\n    process.env.MASTRACODE_UI_DIST,\n    resolve(process.cwd(), 'factory'),\n    join(dirname(fileURLToPath(import.meta.url)), 'factory'),\n    projectRoot && resolve(projectRoot, 'src/mastra/public/factory'),\n    resolve(process.cwd(), 'src/mastra/public/factory'),\n  ];\n  for (const candidate of candidates) {\n    if (candidate && existsSync(join(candidate, 'index.html'))) return resolve(candidate);\n  }\n  return undefined;\n}\n\nasync function isFile(path: string): Promise<boolean> {\n  try {\n    return (await stat(path)).isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function serveFile(c: Context, filePath: string, immutable: boolean): Promise<Response> {\n  const data = await readFile(filePath);\n  c.header('Content-Type', MIME[extname(filePath).toLowerCase()] ?? 'application/octet-stream');\n  // Vite emits content-hashed filenames under assets/ — cache those forever;\n  // index.html (and anything unhashed) must revalidate so deploys roll out.\n  c.header('Cache-Control', immutable ? 'public, max-age=31536000, immutable' : 'no-cache');\n  return c.body(new Uint8Array(data));\n}\n\n/**\n * Hono middleware serving the built SPA from `uiDist`:\n *   - exact file hits (js/css/assets) are served directly,\n *   - GET navigations to non-server paths fall back to `index.html` (SPA\n *     client-side routing),\n *   - `/api`, `/web`, `/auth` and non-GET requests always pass through.\n */\nexport function createSpaStaticMiddleware(uiDist: string) {\n  return async (c: Context, next: () => Promise<void>): Promise<Response | void> => {\n    if (c.req.method !== 'GET' && c.req.method !== 'HEAD') return next();\n    const path = c.req.path;\n    if (SERVER_PREFIXES.some(prefix => path === prefix || path.startsWith(`${prefix}/`))) return next();\n\n    // Resolve the request path inside uiDist, rejecting traversal escapes.\n    const relative = normalize(decodeURIComponent(path)).replace(/^[/\\\\]+/, '');\n    const filePath = resolve(uiDist, relative);\n    // Use a trailing separator so a sibling like \"ui.key\" can't slip past the\n    // prefix check (same pattern as fs-routes.ts isWithinRoot).\n    const uiDistPrefix = uiDist.endsWith(sep) ? uiDist : uiDist + sep;\n    if (filePath.startsWith(uiDistPrefix) && relative !== '' && (await isFile(filePath))) {\n      return serveFile(c, filePath, relative.startsWith('assets/'));\n    }\n\n    // SPA fallback: serve index.html for root and html navigations.\n    const accept = c.req.header('Accept') ?? '';\n    if (path === '/' || accept.includes('text/html')) {\n      return serveFile(c, join(uiDist, 'index.html'), false);\n    }\n\n    return next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,MAAM,OAA+B;CACnC,SAAS;CACT,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,gBAAgB;CAChB,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,SAAS;CACT,UAAU;CACV,QAAQ;CACR,SAAS;AACX;;AAGA,MAAM,kBAAkB;CAAC;CAAQ;CAAQ;CAAS;AAAU;;;;;;;;;;;AAY5D,SAAgB,mBAAuC;CACrD,MAAM,cAAc,QAAQ,IAAI,qBAAqB,KAAK;CAC1D,MAAM,aAAa;EACjB,QAAQ,IAAI;EACZ,QAAQ,QAAQ,IAAI,GAAG,SAAS;EAChC,KAAK,QAAQ,cAAc,OAAO,KAAK,GAAG,CAAC,GAAG,SAAS;EACvD,eAAe,QAAQ,aAAa,2BAA2B;EAC/D,QAAQ,QAAQ,IAAI,GAAG,2BAA2B;CACpD;CACA,KAAK,MAAM,aAAa,YACtB,IAAI,aAAa,WAAW,KAAK,WAAW,YAAY,CAAC,GAAG,OAAO,QAAQ,SAAS;AAGxF;AAEA,eAAe,OAAO,MAAgC;CACpD,IAAI;EACF,QAAQ,MAAM,KAAK,IAAI,EAAA,CAAG,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,UAAU,GAAY,UAAkB,WAAuC;CAC5F,MAAM,OAAO,MAAM,SAAS,QAAQ;CACpC,EAAE,OAAO,gBAAgB,KAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY,MAAM,0BAA0B;CAG5F,EAAE,OAAO,iBAAiB,YAAY,wCAAwC,UAAU;CACxF,OAAO,EAAE,KAAK,IAAI,WAAW,IAAI,CAAC;AACpC;;;;;;;;AASA,SAAgB,0BAA0B,QAAgB;CACxD,OAAO,OAAO,GAAY,SAAwD;EAChF,IAAI,EAAE,IAAI,WAAW,SAAS,EAAE,IAAI,WAAW,QAAQ,OAAO,KAAK;EACnE,MAAM,OAAO,EAAE,IAAI;EACnB,IAAI,gBAAgB,MAAK,WAAU,SAAS,UAAU,KAAK,WAAW,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,KAAK;EAGlG,MAAM,WAAW,UAAU,mBAAmB,IAAI,CAAC,CAAC,CAAC,QAAQ,WAAW,EAAE;EAC1E,MAAM,WAAW,QAAQ,QAAQ,QAAQ;EAGzC,MAAM,eAAe,OAAO,SAAS,GAAG,IAAI,SAAS,SAAS;EAC9D,IAAI,SAAS,WAAW,YAAY,KAAK,aAAa,MAAO,MAAM,OAAO,QAAQ,GAChF,OAAO,UAAU,GAAG,UAAU,SAAS,WAAW,SAAS,CAAC;EAI9D,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK;EACzC,IAAI,SAAS,OAAO,OAAO,SAAS,WAAW,GAC7C,OAAO,UAAU,GAAG,KAAK,QAAQ,YAAY,GAAG,KAAK;EAGvD,OAAO,KAAK;CACd;AACF"}

package/dist/state-signing.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared OAuth/install `state` signing for web integrations.
+ *
+ * The GitHub, Linear, and Slack OAuth/OIDC flows each round-trip a signed `state`
+ * value
+ * through the third party to bind the callback to the `(orgId, userId)` tenant
+ * that initiated it (CSRF protection + tenant routing). The signer is a system
+ * facility: `MastraFactory` creates ONE signer at boot and hands it to every
+ * registered integration through `IntegrationContext` (see
+ * `./factory-integration.ts`), so all integrations sign and verify with the
+ * same secret.
+ *
+ * Secret resolution happens in the factory, not here: explicit
+ * `config.stateSecret` → the GitHub integration's webhook secret → a
+ * per-process random secret. A random secret is NOT stable across replicas —
+ * a `state` signed by one replica cannot be verified by another — which is
+ * what the `stable` flag reports. The factory fails loud at boot when a
+ * registered integration requires a stable signer but only a random one is
+ * available.
+ *
+ * The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url
+ * signature) is unchanged from the previous `github/config.ts` implementation
+ * so in-flight OAuth states survive a deploy.
+ */
+/** Verified tenant and optional Factory context carried by a signed `state`. */
+export interface StateTenant {
+    orgId: string;
+    userId: string;
+    /** Factory that initiated the integration flow, when the caller supplied one. */
+    factoryProjectId?: string;
+    /**
+     * Per-`state` random value. A signed `state` stays valid for its whole
+     * lifetime, so a flow that must not run twice off one `state` (account
+     * binding, for instance) can key single-use bookkeeping on this.
+     */
+    nonce: string;
+}
+/** Signs and verifies OAuth `state` values bound to a tenant and optional Factory. */
+export interface StateSigner {
+    /** Build a signed `state` bound to the tenant and optional initiating Factory. */
+    sign(orgId: string, userId: string, context?: {
+        factoryProjectId?: string;
+    }): string;
+    /** Verify a signed `state`; returns the bound tenant, or `null` if invalid. */
+    verify(state: string | undefined): StateTenant | null;
+    /**
+     * True when the signer was built from an explicit deployment-stable secret.
+     * False means a per-process random secret: fine for single-process/local
+     * dev, broken for multi-replica deploys (see module docs).
+     */
+    readonly stable: boolean;
+}
+/**
+ * Create a state signer. With a `secret`, the signer is deployment-stable
+ * (`stable: true`); without one it falls back to a per-process random secret
+ * (`stable: false`).
+ */
+export declare function createStateSigner(secret?: string): StateSigner;
+//# sourceMappingURL=state-signing.d.ts.map

package/dist/state-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-signing.d.ts","sourceRoot":"","sources":["../src/state-signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACrF,+EAA+E;IAC/E,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,IAAI,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,CAqD9D"}

package/dist/state-signing.js

@@ -0,0 +1,83 @@
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+//#region src/state-signing.ts
+/**
+* Shared OAuth/install `state` signing for web integrations.
+*
+* The GitHub, Linear, and Slack OAuth/OIDC flows each round-trip a signed `state`
+* value
+* through the third party to bind the callback to the `(orgId, userId)` tenant
+* that initiated it (CSRF protection + tenant routing). The signer is a system
+* facility: `MastraFactory` creates ONE signer at boot and hands it to every
+* registered integration through `IntegrationContext` (see
+* `./factory-integration.ts`), so all integrations sign and verify with the
+* same secret.
+*
+* Secret resolution happens in the factory, not here: explicit
+* `config.stateSecret` → the GitHub integration's webhook secret → a
+* per-process random secret. A random secret is NOT stable across replicas —
+* a `state` signed by one replica cannot be verified by another — which is
+* what the `stable` flag reports. The factory fails loud at boot when a
+* registered integration requires a stable signer but only a random one is
+* available.
+*
+* The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url
+* signature) is unchanged from the previous `github/config.ts` implementation
+* so in-flight OAuth states survive a deploy.
+*/
+/** Signed `state` values expire after this window to bound the CSRF token. */
+const STATE_MAX_AGE_MS = 600 * 1e3;
+/**
+* Create a state signer. With a `secret`, the signer is deployment-stable
+* (`stable: true`); without one it falls back to a per-process random secret
+* (`stable: false`).
+*/
+function createStateSigner(secret) {
+	const stable = typeof secret === "string" && secret.length > 0;
+	const key = stable ? secret : randomBytes(32).toString("hex");
+	return {
+		stable,
+		sign(orgId, userId, context) {
+			const payload = {
+				orgId,
+				userId,
+				...context?.factoryProjectId ? { factoryProjectId: context.factoryProjectId } : {},
+				nonce: randomBytes(8).toString("hex"),
+				issuedAt: Date.now()
+			};
+			const body = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+			return `${body}.${createHmac("sha256", key).update(body).digest("base64url")}`;
+		},
+		verify(state) {
+			if (!state) return null;
+			const dot = state.lastIndexOf(".");
+			if (dot <= 0) return null;
+			const body = state.slice(0, dot);
+			const sig = state.slice(dot + 1);
+			const expected = createHmac("sha256", key).update(body).digest("base64url");
+			const sigBuf = Buffer.from(sig);
+			const expectedBuf = Buffer.from(expected);
+			if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) return null;
+			try {
+				const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+				if (typeof parsed.orgId !== "string" || typeof parsed.userId !== "string") return null;
+				if (typeof parsed.issuedAt !== "number" || !Number.isFinite(parsed.issuedAt)) return null;
+				if (typeof parsed.nonce !== "string" || parsed.nonce.length === 0) return null;
+				if (parsed.factoryProjectId !== void 0 && (typeof parsed.factoryProjectId !== "string" || parsed.factoryProjectId.length === 0)) return null;
+				const age = Date.now() - parsed.issuedAt;
+				if (age < 0 || age > STATE_MAX_AGE_MS) return null;
+				return {
+					orgId: parsed.orgId,
+					userId: parsed.userId,
+					...parsed.factoryProjectId ? { factoryProjectId: parsed.factoryProjectId } : {},
+					nonce: parsed.nonce
+				};
+			} catch {
+				return null;
+			}
+		}
+	};
+}
+//#endregion
+export { createStateSigner };
+
+//# sourceMappingURL=state-signing.js.map

package/dist/state-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-signing.js","names":[],"sources":["../src/state-signing.ts"],"sourcesContent":["/**\n * Shared OAuth/install `state` signing for web integrations.\n *\n * The GitHub, Linear, and Slack OAuth/OIDC flows each round-trip a signed `state`\n * value\n * through the third party to bind the callback to the `(orgId, userId)` tenant\n * that initiated it (CSRF protection + tenant routing). The signer is a system\n * facility: `MastraFactory` creates ONE signer at boot and hands it to every\n * registered integration through `IntegrationContext` (see\n * `./factory-integration.ts`), so all integrations sign and verify with the\n * same secret.\n *\n * Secret resolution happens in the factory, not here: explicit\n * `config.stateSecret` → the GitHub integration's webhook secret → a\n * per-process random secret. A random secret is NOT stable across replicas —\n * a `state` signed by one replica cannot be verified by another — which is\n * what the `stable` flag reports. The factory fails loud at boot when a\n * registered integration requires a stable signer but only a random one is\n * available.\n *\n * The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url\n * signature) is unchanged from the previous `github/config.ts` implementation\n * so in-flight OAuth states survive a deploy.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\n\n/** Verified tenant and optional Factory context carried by a signed `state`. */\nexport interface StateTenant {\n  orgId: string;\n  userId: string;\n  /** Factory that initiated the integration flow, when the caller supplied one. */\n  factoryProjectId?: string;\n  /**\n   * Per-`state` random value. A signed `state` stays valid for its whole\n   * lifetime, so a flow that must not run twice off one `state` (account\n   * binding, for instance) can key single-use bookkeeping on this.\n   */\n  nonce: string;\n}\n\n/** Signs and verifies OAuth `state` values bound to a tenant and optional Factory. */\nexport interface StateSigner {\n  /** Build a signed `state` bound to the tenant and optional initiating Factory. */\n  sign(orgId: string, userId: string, context?: { factoryProjectId?: string }): string;\n  /** Verify a signed `state`; returns the bound tenant, or `null` if invalid. */\n  verify(state: string | undefined): StateTenant | null;\n  /**\n   * True when the signer was built from an explicit deployment-stable secret.\n   * False means a per-process random secret: fine for single-process/local\n   * dev, broken for multi-replica deploys (see module docs).\n   */\n  readonly stable: boolean;\n}\n\ninterface StatePayload {\n  orgId: string;\n  userId: string;\n  factoryProjectId?: string;\n  nonce: string;\n  issuedAt: number;\n}\n\n/** Signed `state` values expire after this window to bound the CSRF token. */\nconst STATE_MAX_AGE_MS = 10 * 60 * 1000;\n\n/**\n * Create a state signer. With a `secret`, the signer is deployment-stable\n * (`stable: true`); without one it falls back to a per-process random secret\n * (`stable: false`).\n */\nexport function createStateSigner(secret?: string): StateSigner {\n  const stable = typeof secret === 'string' && secret.length > 0;\n  const key = stable ? secret : randomBytes(32).toString('hex');\n  return {\n    stable,\n    sign(orgId: string, userId: string, context?: { factoryProjectId?: string }): string {\n      const payload: StatePayload = {\n        orgId,\n        userId,\n        ...(context?.factoryProjectId ? { factoryProjectId: context.factoryProjectId } : {}),\n        nonce: randomBytes(8).toString('hex'),\n        issuedAt: Date.now(),\n      };\n      const body = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');\n      const sig = createHmac('sha256', key).update(body).digest('base64url');\n      return `${body}.${sig}`;\n    },\n    verify(state: string | undefined): StateTenant | null {\n      if (!state) return null;\n      const dot = state.lastIndexOf('.');\n      if (dot <= 0) return null;\n      const body = state.slice(0, dot);\n      const sig = state.slice(dot + 1);\n      const expected = createHmac('sha256', key).update(body).digest('base64url');\n      const sigBuf = Buffer.from(sig);\n      const expectedBuf = Buffer.from(expected);\n      if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n        return null;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as StatePayload;\n        if (typeof parsed.orgId !== 'string' || typeof parsed.userId !== 'string') return null;\n        if (typeof parsed.issuedAt !== 'number' || !Number.isFinite(parsed.issuedAt)) return null;\n        if (typeof parsed.nonce !== 'string' || parsed.nonce.length === 0) return null;\n        if (\n          parsed.factoryProjectId !== undefined &&\n          (typeof parsed.factoryProjectId !== 'string' || parsed.factoryProjectId.length === 0)\n        ) {\n          return null;\n        }\n        const age = Date.now() - parsed.issuedAt;\n        if (age < 0 || age > STATE_MAX_AGE_MS) return null;\n        return {\n          orgId: parsed.orgId,\n          userId: parsed.userId,\n          ...(parsed.factoryProjectId ? { factoryProjectId: parsed.factoryProjectId } : {}),\n          nonce: parsed.nonce,\n        };\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,MAAM,mBAAmB,MAAU;;;;;;AAOnC,SAAgB,kBAAkB,QAA8B;CAC9D,MAAM,SAAS,OAAO,WAAW,YAAY,OAAO,SAAS;CAC7D,MAAM,MAAM,SAAS,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAC5D,OAAO;EACL;EACA,KAAK,OAAe,QAAgB,SAAiD;GACnF,MAAM,UAAwB;IAC5B;IACA;IACA,GAAI,SAAS,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;IAClF,OAAO,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK;IACpC,UAAU,KAAK,IAAI;GACrB;GACA,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;GAE9E,OAAO,GAAG,KAAK,GADH,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WACtC;EACtB;EACA,OAAO,OAA+C;GACpD,IAAI,CAAC,OAAO,OAAO;GACnB,MAAM,MAAM,MAAM,YAAY,GAAG;GACjC,IAAI,OAAO,GAAG,OAAO;GACrB,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;GAC/B,MAAM,MAAM,MAAM,MAAM,MAAM,CAAC;GAC/B,MAAM,WAAW,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;GAC1E,MAAM,SAAS,OAAO,KAAK,GAAG;GAC9B,MAAM,cAAc,OAAO,KAAK,QAAQ;GACxC,IAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAC9E,OAAO;GAET,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;IACzE,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,WAAW,UAAU,OAAO;IAClF,IAAI,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,OAAO,QAAQ,GAAG,OAAO;IACrF,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,WAAW,GAAG,OAAO;IAC1E,IACE,OAAO,qBAAqB,KAAA,MAC3B,OAAO,OAAO,qBAAqB,YAAY,OAAO,iBAAiB,WAAW,IAEnF,OAAO;IAET,MAAM,MAAM,KAAK,IAAI,IAAI,OAAO;IAChC,IAAI,MAAM,KAAK,MAAM,kBAAkB,OAAO;IAC9C,OAAO;KACL,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;KAC/E,OAAO,OAAO;IAChB;GACF,QAAQ;IACN,OAAO;GACT;EACF;CACF;AACF"}

package/dist/storage/domains/audit/agent-audit.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Agent-level audit event detection (Audit v1.1).
+ *
+ * Git actions performed by agents inside runs never touch web routes, so this
+ * observer detects externally-visible git side effects and delegates recording
+ * to the factory-owned audit domain.
+ */
+import type { RequestContext } from '@mastra/core/request-context';
+import type { AuditAgentEmitter } from './domain.js';
+interface ToolObserverContext {
+    toolName: string;
+    input: unknown;
+    output?: unknown;
+    error?: unknown;
+    context: RequestContext;
+}
+/**
+ * Detect externally-visible git side effects in a completed tool call and
+ * record `factory.agent.*` audit events for them. One command can emit
+ * multiple events (`git commit && git push` emits both). Never throws.
+ */
+export declare function observeAgentGitAction({ audit, toolContext, }: {
+    audit: AuditAgentEmitter;
+    toolContext: ToolObserverContext;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=agent-audit.d.ts.map

package/dist/storage/domains/audit/agent-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-audit.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/agent-audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;CACzB;AAgCD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,KAAK,EACL,WAAW,GACZ,EAAE;IACD,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,mBAAmB,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB"}

package/dist/storage/domains/audit/agent-audit.js

@@ -0,0 +1,66 @@
+//#region src/storage/domains/audit/agent-audit.ts
+/** Match command-start positions while ignoring command text embedded in heredoc bodies. */
+const GIT_COMMIT_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+commit(?:\s|$)/;
+const GIT_PUSH_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+push(?:\s|$)/;
+function stripHeredocBodies(command) {
+	const lines = command.split("\n");
+	const executableLines = [];
+	let delimiter;
+	for (const line of lines) {
+		if (delimiter) {
+			if (line.trim() === delimiter) delimiter = void 0;
+			continue;
+		}
+		executableLines.push(line);
+		delimiter = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/)?.[2];
+	}
+	return executableLines.join("\n");
+}
+/** Parse the branch from a plain `git push <remote> <branch>` invocation. */
+function parsePushedBranch(command) {
+	return command.match(/(?:^|\n|;|&&|\|\|)\s*git\s+push\s+(?:-[^\s]+\s+)*([^\s;&|-][^\s;&|]*)\s+([^\s;&|-][^\s;&|]*)/)?.[2];
+}
+/**
+* Detect externally-visible git side effects in a completed tool call and
+* record `factory.agent.*` audit events for them. One command can emit
+* multiple events (`git commit && git push` emits both). Never throws.
+*/
+async function observeAgentGitAction({ audit, toolContext }) {
+	try {
+		if (toolContext.toolName !== "execute_command" || toolContext.error) return;
+		const rawCommand = toolContext.input?.command;
+		if (typeof rawCommand !== "string") return;
+		const command = stripHeredocBodies(rawCommand);
+		const worktreePath = toolContext.context.get("controller")?.scope;
+		if (GIT_COMMIT_RE.test(command)) await audit.emitAgent({
+			requestContext: toolContext.context,
+			input: {
+				action: "factory.agent.commit",
+				targets: worktreePath ? [{
+					type: "worktree",
+					id: worktreePath
+				}] : []
+			}
+		});
+		if (GIT_PUSH_RE.test(command)) {
+			const branch = parsePushedBranch(command);
+			await audit.emitAgent({
+				requestContext: toolContext.context,
+				input: {
+					action: "factory.agent.push",
+					targets: worktreePath ? [{
+						type: "worktree",
+						id: worktreePath
+					}] : [],
+					...branch ? { metadata: { branch } } : {}
+				}
+			});
+		}
+	} catch (err) {
+		console.warn("[Audit] Failed to observe agent git action", { error: err instanceof Error ? err.message : String(err) });
+	}
+}
+//#endregion
+export { observeAgentGitAction };
+
+//# sourceMappingURL=agent-audit.js.map

package/dist/storage/domains/audit/agent-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-audit.js","names":[],"sources":["../../../../src/storage/domains/audit/agent-audit.ts"],"sourcesContent":["/**\n * Agent-level audit event detection (Audit v1.1).\n *\n * Git actions performed by agents inside runs never touch web routes, so this\n * observer detects externally-visible git side effects and delegates recording\n * to the factory-owned audit domain.\n */\n\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport type { AuditAgentEmitter } from './domain.js';\n\ntype FactorySessionState = { factoryProjectId?: string; projectRepositoryId?: string };\n\ninterface ToolObserverContext {\n  toolName: string;\n  input: unknown;\n  output?: unknown;\n  error?: unknown;\n  context: RequestContext;\n}\n\n/** Match command-start positions while ignoring command text embedded in heredoc bodies. */\nconst GIT_COMMIT_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+commit(?:\\s|$)/;\nconst GIT_PUSH_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push(?:\\s|$)/;\n\nfunction stripHeredocBodies(command: string): string {\n  const lines = command.split('\\n');\n  const executableLines: string[] = [];\n  let delimiter: string | undefined;\n\n  for (const line of lines) {\n    if (delimiter) {\n      if (line.trim() === delimiter) delimiter = undefined;\n      continue;\n    }\n    executableLines.push(line);\n    const heredoc = line.match(/<<-?\\s*(['\"]?)([A-Za-z_][A-Za-z0-9_]*)\\1/);\n    delimiter = heredoc?.[2];\n  }\n\n  return executableLines.join('\\n');\n}\n\n/** Parse the branch from a plain `git push <remote> <branch>` invocation. */\nfunction parsePushedBranch(command: string): string | undefined {\n  const match = command.match(\n    /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push\\s+(?:-[^\\s]+\\s+)*([^\\s;&|-][^\\s;&|]*)\\s+([^\\s;&|-][^\\s;&|]*)/,\n  );\n  return match?.[2];\n}\n\n/**\n * Detect externally-visible git side effects in a completed tool call and\n * record `factory.agent.*` audit events for them. One command can emit\n * multiple events (`git commit && git push` emits both). Never throws.\n */\nexport async function observeAgentGitAction({\n  audit,\n  toolContext,\n}: {\n  audit: AuditAgentEmitter;\n  toolContext: ToolObserverContext;\n}): Promise<void> {\n  try {\n    if (toolContext.toolName !== 'execute_command' || toolContext.error) return;\n    const rawCommand = (toolContext.input as { command?: unknown } | undefined)?.command;\n    if (typeof rawCommand !== 'string') return;\n    const command = stripHeredocBodies(rawCommand);\n\n    const controller = toolContext.context.get('controller') as\n      | AgentControllerRequestContext<FactorySessionState>\n      | undefined;\n    const worktreePath = controller?.scope;\n\n    if (GIT_COMMIT_RE.test(command)) {\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.commit',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n        },\n      });\n    }\n\n    if (GIT_PUSH_RE.test(command)) {\n      const branch = parsePushedBranch(command);\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.push',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n          ...(branch ? { metadata: { branch } } : {}),\n        },\n      });\n    }\n  } catch (err) {\n    console.warn('[Audit] Failed to observe agent git action', {\n      error: err instanceof Error ? err.message : String(err),\n    });\n  }\n}\n"],"mappings":";;AAwBA,MAAM,gBAAgB;AACtB,MAAM,cAAc;AAEpB,SAAS,mBAAmB,SAAyB;CACnD,MAAM,QAAQ,QAAQ,MAAM,IAAI;CAChC,MAAM,kBAA4B,CAAC;CACnC,IAAI;CAEJ,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,WAAW;GACb,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,KAAA;GAC3C;EACF;EACA,gBAAgB,KAAK,IAAI;EAEzB,YADgB,KAAK,MAAM,0CACT,CAAC,GAAG;CACxB;CAEA,OAAO,gBAAgB,KAAK,IAAI;AAClC;;AAGA,SAAS,kBAAkB,SAAqC;CAI9D,OAHc,QAAQ,MACpB,8FAES,CAAC,GAAG;AACjB;;;;;;AAOA,eAAsB,sBAAsB,EAC1C,OACA,eAIgB;CAChB,IAAI;EACF,IAAI,YAAY,aAAa,qBAAqB,YAAY,OAAO;EACrE,MAAM,aAAc,YAAY,OAA6C;EAC7E,IAAI,OAAO,eAAe,UAAU;EACpC,MAAM,UAAU,mBAAmB,UAAU;EAK7C,MAAM,eAHa,YAAY,QAAQ,IAAI,YAGb,CAAC,EAAE;EAEjC,IAAI,cAAc,KAAK,OAAO,GAC5B,MAAM,MAAM,UAAU;GACpB,gBAAgB,YAAY;GAC5B,OAAO;IACL,QAAQ;IACR,SAAS,eAAe,CAAC;KAAE,MAAM;KAAY,IAAI;IAAa,CAAC,IAAI,CAAC;GACtE;EACF,CAAC;EAGH,IAAI,YAAY,KAAK,OAAO,GAAG;GAC7B,MAAM,SAAS,kBAAkB,OAAO;GACxC,MAAM,MAAM,UAAU;IACpB,gBAAgB,YAAY;IAC5B,OAAO;KACL,QAAQ;KACR,SAAS,eAAe,CAAC;MAAE,MAAM;MAAY,IAAI;KAAa,CAAC,IAAI,CAAC;KACpE,GAAI,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;IAC3C;GACF,CAAC;EACH;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,8CAA8C,EACzD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;CACH;AACF"}

package/dist/storage/domains/audit/base.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Factory audit events domain — the append-only "who did what, when" trail
+ * behind the software factory.
+ *
+ * One `audit_events` row records a single audited mutation (work-item change,
+ * stage move, run start, worktree create/delete, git action, intake config
+ * change). Rows are append-only: there is no update/delete API, and the table
+ * is the local source of truth even when the WorkOS Audit Logs mirror is
+ * unavailable.
+ *
+ * Tenancy is **org-first**, like `work_items`: events are scoped by `org_id`
+ * and (usually) `factory_project_id`; `actor_id` records who acted but never
+ * scopes reads.
+ *
+ * v1 action taxonomy (register these in the WorkOS dashboard under
+ * Audit Logs → Events for the export mirror to accept them):
+ *   - factory.work_item.created
+ *   - factory.work_item.updated
+ *   - factory.work_item.stage_moved
+ *   - factory.work_item.deleted
+ *   - factory.run.started
+ *   - factory.worktree.created
+ *   - factory.worktree.deleted
+ *   - factory.triage.started
+ *   - factory.git.commit
+ *   - factory.git.push
+ *   - factory.git.pr_opened
+ *   - factory.intake.config_updated
+ *
+ * v1.1 adds agent-level actions (also register these in WorkOS):
+ *   - factory.agent.commit
+ *   - factory.agent.push
+ *   - factory.agent.pr_opened
+ *
+ * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`
+ * and `metadata.startedBy = <userId>` chaining accountability back to the human
+ * whose message drove the run.
+ */
+import { FactoryStorageDomain } from '@mastra/core/storage';
+import type { CollectionSchema } from '@mastra/core/storage';
+/** What an audit event acted on (WorkOS Audit Logs target shape). */
+export interface AuditTarget {
+    /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */
+    type: string;
+    /** Stable identifier of the target (row id, branch name, issue number...). */
+    id: string;
+    /** Human-readable label (work-item title, branch name...). */
+    name?: string;
+}
+/** Who performed the audited action. */
+export type AuditActorType = 'human' | 'agent';
+/** Request context captured alongside the event. */
+export interface AuditContext {
+    /** Client IP (first hop of `x-forwarded-for`) when available. */
+    location?: string;
+    /** Request `user-agent` header when available. */
+    userAgent?: string;
+}
+/** One persisted audit event. */
+export interface AuditEventRow {
+    id: string;
+    /** Owning WorkOS organization id — the trail is org-wide. */
+    orgId: string;
+    /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */
+    actorId: string;
+    /** Whether a human or an agent (inside a run) performed the action. */
+    actorType: AuditActorType;
+    /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */
+    action: string;
+    /** What was acted on. */
+    targets: AuditTarget[];
+    /** Bounded event summary — never full payloads, never secrets. */
+    metadata: Record<string, unknown>;
+    /** Factory project the event is scoped to; null for org-level events. */
+    factoryProjectId: string | null;
+    /** Project-repository link affected by a repository-specific action. */
+    projectRepositoryId: string | null;
+    /** Request context (`x-forwarded-for` / `user-agent`). */
+    context: AuditContext;
+    occurredAt: Date;
+}
+export interface RecordAuditEventInput {
+    orgId: string;
+    actorId: string;
+    /** Who performed the action; defaults to 'human'. */
+    actorType?: AuditActorType;
+    /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */
+    action: string;
+    targets: AuditTarget[];
+    metadata?: Record<string, unknown>;
+    factoryProjectId?: string;
+    projectRepositoryId?: string;
+    context?: AuditContext;
+    occurredAt?: Date;
+}
+/** A fully-normalized event ready to persist (id assigned on insert). */
+export type AuditEventInsert = Omit<AuditEventRow, 'id'>;
+export interface ListAuditEventsInput {
+    orgId: string;
+    factoryProjectId?: string;
+    /** Restrict to these actions (exact match). */
+    actions?: string[];
+    actorId?: string;
+    /** Opaque cursor from a previous page (`nextCursor`). */
+    before?: string;
+    limit?: number;
+}
+export interface AuditEventPage {
+    events: AuditEventRow[];
+    /** Pass back as `before` to fetch the next (older) page; absent at the end. */
+    nextCursor?: string;
+}
+/** Truncate oversized metadata rather than dropping the whole event. */
+export declare function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown>;
+/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */
+export declare function clampAuditLimit(limit: number | undefined): number;
+/** Encode the `(occurredAt, id)` keyset cursor of a row. */
+export declare function encodeAuditCursor(row: AuditEventRow): string;
+/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */
+export declare function decodeAuditCursor(cursor: string): {
+    occurredAt: Date;
+    id: string;
+} | undefined;
+export declare const AUDIT_EVENTS_SCHEMA: CollectionSchema;
+/**
+ * Audit event storage, written once against the generic `FactoryStorageOps`
+ * surface. `record()` normalizes inputs (defaults, metadata bounding);
+ * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.
+ */
+export declare class AuditStorage extends FactoryStorageDomain {
+    #private;
+    constructor();
+    init(): Promise<void>;
+    dangerouslyClearAll(): Promise<void>;
+    /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */
+    record(input: RecordAuditEventInput): Promise<AuditEventRow>;
+    /** List an org's audit events newest-first with keyset pagination. */
+    list(input: ListAuditEventsInput): Promise<AuditEventPage>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/audit/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0DAA0D;IAC1D,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzG;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjE;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO9F;AAED,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAC;AAiCF;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,oBAAoB;;;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C,0FAA0F;IACpF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBlE,sEAAsE;IAChE,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CA2BjE"}