@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/storage/domains/audit/domain.js

@@ -0,0 +1,167 @@
+import { registerApiRoute } from "@mastra/core/server";
+//#region src/storage/domains/audit/domain.ts
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_ACTION_FILTERS = 16;
+function loose(c) {
+	return c;
+}
+function parseActionsParam(raw) {
+	if (!raw) return void 0;
+	const actions = raw.split(",").map((action) => action.trim()).filter(Boolean).slice(0, MAX_ACTION_FILTERS);
+	return actions.length > 0 ? actions : void 0;
+}
+function parseLimitParam(raw) {
+	if (!raw) return void 0;
+	const limit = Number.parseInt(raw, 10);
+	return Number.isFinite(limit) ? limit : void 0;
+}
+function auditRequestContext(c) {
+	const location = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
+	const userAgent = c.req.header("user-agent");
+	return {
+		...location ? { location } : {},
+		...userAgent ? { userAgent } : {}
+	};
+}
+/** Factory-owned audit behavior backed by the audit storage domain. */
+var AuditDomain = class {
+	#auth;
+	#audit;
+	#projects;
+	#sinks;
+	#agentTenant;
+	constructor({ auth, audit, projects, sinks = [], agentTenant }) {
+		this.#auth = auth;
+		this.#audit = audit;
+		this.#projects = projects;
+		this.#sinks = sinks;
+		this.#agentTenant = agentTenant;
+		const ids = /* @__PURE__ */ new Set();
+		for (const sink of this.#sinks) {
+			if (!sink.id) throw new Error("Audit integration id must not be empty");
+			if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);
+			ids.add(sink.id);
+		}
+	}
+	async record(input) {
+		try {
+			await this.#audit.ensureReady();
+			const row = await this.#audit.record(input);
+			for (const sink of this.#sinks) {
+				if (!sink.audit) continue;
+				Promise.resolve().then(() => sink.audit?.({ event: row })).catch((err) => {
+					console.warn("[Audit] Audit integration failed", {
+						integration: sink.id,
+						action: row.action,
+						error: err instanceof Error ? err.message : String(err)
+					});
+				});
+			}
+			return row;
+		} catch (err) {
+			console.warn("[Audit] Failed to record audit event", {
+				action: input.action,
+				error: err instanceof Error ? err.message : String(err)
+			});
+			return null;
+		}
+	}
+	async list(input) {
+		await this.#audit.ensureReady();
+		return this.#audit.list(input);
+	}
+	async emit({ context, input }) {
+		try {
+			const tenant = this.#auth.tenant(context);
+			if (!tenant?.orgId) return;
+			await this.record({
+				orgId: tenant.orgId,
+				actorId: tenant.userId,
+				action: input.action,
+				targets: input.targets,
+				metadata: input.metadata,
+				factoryProjectId: input.factoryProjectId,
+				projectRepositoryId: input.projectRepositoryId,
+				context: auditRequestContext(context)
+			});
+		} catch (err) {
+			console.warn("[Audit] Failed to emit audit event", {
+				action: input.action,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		}
+	}
+	async emitAgent({ requestContext, input }) {
+		try {
+			const context = requestContext.get("controller");
+			const tenant = this.#agentTenant?.(requestContext);
+			const orgId = tenant?.orgId;
+			const userId = tenant?.userId;
+			const threadId = context?.threadId;
+			const state = context?.getState();
+			if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;
+			await this.record({
+				orgId,
+				actorId: `agent:${threadId}`,
+				actorType: "agent",
+				action: input.action,
+				targets: input.targets,
+				metadata: {
+					...input.metadata,
+					startedBy: userId
+				},
+				factoryProjectId: state.factoryProjectId,
+				projectRepositoryId: state.projectRepositoryId,
+				context: {}
+			});
+		} catch (err) {
+			console.warn("[Audit] Failed to emit agent audit event", {
+				action: input.action,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		}
+	}
+	routes() {
+		return [registerApiRoute("/web/factory/projects/:id/audit", {
+			method: "GET",
+			handler: async (cc) => {
+				const c = loose(cc);
+				const tenant = await this.#resolveTenant(c);
+				if ("response" in tenant) return tenant.response;
+				const projectId = c.req.param("id");
+				if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: "Project not found" }, 404);
+				await this.#projects.ensureReady();
+				if (!await this.#projects.get({
+					orgId: tenant.orgId,
+					id: projectId
+				})) return c.json({ error: "Project not found" }, 404);
+				const page = await this.list({
+					orgId: tenant.orgId,
+					factoryProjectId: projectId,
+					actions: parseActionsParam(c.req.query("actions")),
+					actorId: c.req.query("actor") || void 0,
+					before: c.req.query("before") || void 0,
+					limit: parseLimitParam(c.req.query("limit"))
+				});
+				return c.json(page);
+			}
+		})];
+	}
+	async #resolveTenant(c) {
+		await this.#auth.ensureUser(c);
+		const tenant = this.#auth.tenant(c);
+		if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+		if (!tenant.orgId) return { response: c.json({
+			error: "organization_required",
+			message: "The audit trail requires an organization."
+		}, 403) };
+		return {
+			orgId: tenant.orgId,
+			userId: tenant.userId
+		};
+	}
+};
+//#endregion
+export { AuditDomain, auditRequestContext };
+
+//# sourceMappingURL=domain.js.map

package/dist/storage/domains/audit/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","names":["#auth","#audit","#projects","#sinks","#agentTenant","#resolveTenant"],"sources":["../../../../src/storage/domains/audit/domain.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../../routes/route.js';\nimport type { FactoryProjectsStorage } from '../projects/base.js';\nimport type {\n  AuditContext,\n  AuditEventPage,\n  AuditEventRow,\n  AuditStorage,\n  AuditTarget,\n  ListAuditEventsInput,\n  RecordAuditEventInput,\n} from './base.js';\n\nexport interface EmitAuditInput {\n  action: string;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface EmitAgentAuditInput {\n  action: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface AuditEmitter {\n  emit(args: { context: Context; input: EmitAuditInput }): Promise<void>;\n}\n\nexport interface AuditAgentEmitter {\n  emitAgent(args: { requestContext: RequestContext; input: EmitAgentAuditInput }): Promise<void>;\n}\n\n/** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */\nexport interface AuditSink {\n  id: string;\n  audit?(args: { event: AuditEventRow }): Promise<void>;\n}\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n}\n\nexport interface AuditDomainOptions {\n  auth: RouteAuth;\n  /** Audit storage domain handle. */\n  audit: AuditStorage;\n  /** Projects domain handle, used to scope the audit trail route. */\n  projects: FactoryProjectsStorage;\n  /** Best-effort fan-out destinations notified after each recorded event. */\n  sinks?: AuditSink[];\n  /** Resolve the acting tenant for agent-emitted events from the request context. */\n  agentTenant?: (requestContext: RequestContext) => { orgId?: string; userId?: string } | undefined;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_ACTION_FILTERS = 16;\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction parseActionsParam(raw: string | undefined): string[] | undefined {\n  if (!raw) return undefined;\n  const actions = raw\n    .split(',')\n    .map(action => action.trim())\n    .filter(Boolean)\n    .slice(0, MAX_ACTION_FILTERS);\n  return actions.length > 0 ? actions : undefined;\n}\n\nfunction parseLimitParam(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const limit = Number.parseInt(raw, 10);\n  return Number.isFinite(limit) ? limit : undefined;\n}\n\nexport function auditRequestContext(c: Context): AuditContext {\n  const location = c.req.header('x-forwarded-for')?.split(',')[0]?.trim();\n  const userAgent = c.req.header('user-agent');\n  return {\n    ...(location ? { location } : {}),\n    ...(userAgent ? { userAgent } : {}),\n  };\n}\n\n/** Factory-owned audit behavior backed by the audit storage domain. */\nexport class AuditDomain implements AuditEmitter, AuditAgentEmitter {\n  readonly #auth: RouteAuth;\n  readonly #audit: AuditStorage;\n  readonly #projects: FactoryProjectsStorage;\n  readonly #sinks: AuditSink[];\n  readonly #agentTenant: AuditDomainOptions['agentTenant'];\n\n  constructor({ auth, audit, projects, sinks = [], agentTenant }: AuditDomainOptions) {\n    this.#auth = auth;\n    this.#audit = audit;\n    this.#projects = projects;\n    this.#sinks = sinks;\n    this.#agentTenant = agentTenant;\n\n    const ids = new Set<string>();\n    for (const sink of this.#sinks) {\n      if (!sink.id) throw new Error('Audit integration id must not be empty');\n      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);\n      ids.add(sink.id);\n    }\n  }\n\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow | null> {\n    try {\n      await this.#audit.ensureReady();\n      const row = await this.#audit.record(input);\n      for (const sink of this.#sinks) {\n        if (!sink.audit) continue;\n        void Promise.resolve()\n          .then(() => sink.audit?.({ event: row }))\n          .catch(err => {\n            console.warn('[Audit] Audit integration failed', {\n              integration: sink.id,\n              action: row.action,\n              error: err instanceof Error ? err.message : String(err),\n            });\n          });\n      }\n      return row;\n    } catch (err) {\n      console.warn('[Audit] Failed to record audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return null;\n    }\n  }\n\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    await this.#audit.ensureReady();\n    return this.#audit.list(input);\n  }\n\n  async emit({ context, input }: { context: Context; input: EmitAuditInput }): Promise<void> {\n    try {\n      const tenant = this.#auth.tenant(context);\n      if (!tenant?.orgId) return;\n      await this.record({\n        orgId: tenant.orgId,\n        actorId: tenant.userId,\n        action: input.action,\n        targets: input.targets,\n        metadata: input.metadata,\n        factoryProjectId: input.factoryProjectId,\n        projectRepositoryId: input.projectRepositoryId,\n        context: auditRequestContext(context),\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async emitAgent({\n    requestContext,\n    input,\n  }: {\n    requestContext: RequestContext;\n    input: EmitAgentAuditInput;\n  }): Promise<void> {\n    try {\n      const context = requestContext.get('controller') as\n        | AgentControllerRequestContext<FactorySessionState>\n        | undefined;\n      const tenant = this.#agentTenant?.(requestContext);\n      const orgId = tenant?.orgId;\n      const userId = tenant?.userId;\n      const threadId = context?.threadId;\n      const state = context?.getState();\n      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;\n\n      await this.record({\n        orgId,\n        actorId: `agent:${threadId}`,\n        actorType: 'agent',\n        action: input.action,\n        targets: input.targets,\n        metadata: { ...input.metadata, startedBy: userId },\n        factoryProjectId: state.factoryProjectId,\n        projectRepositoryId: state.projectRepositoryId,\n        context: {},\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit agent audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects/:id/audit', {\n        method: 'GET',\n        handler: async cc => {\n          const c = loose(cc);\n          const tenant = await this.#resolveTenant(c);\n          if ('response' in tenant) return tenant.response;\n\n          const projectId = c.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: 'Project not found' }, 404);\n          await this.#projects.ensureReady();\n          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });\n          if (!project) return c.json({ error: 'Project not found' }, 404);\n\n          const page = await this.list({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            actions: parseActionsParam(c.req.query('actions')),\n            actorId: c.req.query('actor') || undefined,\n            before: c.req.query('before') || undefined,\n            limit: parseLimitParam(c.req.query('limit')),\n          });\n          return c.json(page);\n        },\n      }),\n    ];\n  }\n\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.#auth.ensureUser(c);\n    const tenant = this.#auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json({ error: 'organization_required', message: 'The audit trail requires an organization.' }, 403),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n}\n"],"mappings":";;AA+DA,MAAM,UAAU;AAChB,MAAM,qBAAqB;AAE3B,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,kBAAkB,KAA+C;CACxE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,UAAU,IACb,MAAM,GAAG,CAAC,CACV,KAAI,WAAU,OAAO,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO,CAAC,CACf,MAAM,GAAG,kBAAkB;CAC9B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AAEA,SAAS,gBAAgB,KAA6C;CACpE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;CACrC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AAC1C;AAEA,SAAgB,oBAAoB,GAA0B;CAC5D,MAAM,WAAW,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;CACtE,MAAM,YAAY,EAAE,IAAI,OAAO,YAAY;CAC3C,OAAO;EACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;AAGA,IAAa,cAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,EAAE,MAAM,OAAO,UAAU,QAAQ,CAAC,GAAG,eAAmC;EAClF,KAAKA,QAAQ;EACb,KAAKC,SAAS;EACd,KAAKC,YAAY;EACjB,KAAKC,SAAS;EACd,KAAKC,eAAe;EAEpB,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,KAAKD,QAAQ;GAC9B,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,wCAAwC;GACtE,IAAI,IAAI,IAAI,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG,EAAE;GACnF,IAAI,IAAI,KAAK,EAAE;EACjB;CACF;CAEA,MAAM,OAAO,OAA6D;EACxE,IAAI;GACF,MAAM,KAAKF,OAAO,YAAY;GAC9B,MAAM,MAAM,MAAM,KAAKA,OAAO,OAAO,KAAK;GAC1C,KAAK,MAAM,QAAQ,KAAKE,QAAQ;IAC9B,IAAI,CAAC,KAAK,OAAO;IACjB,QAAa,QAAQ,CAAC,CACnB,WAAW,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CACxC,OAAM,QAAO;KACZ,QAAQ,KAAK,oCAAoC;MAC/C,aAAa,KAAK;MAClB,QAAQ,IAAI;MACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KACxD,CAAC;IACH,CAAC;GACL;GACA,OAAO;EACT,SAAS,KAAK;GACZ,QAAQ,KAAK,wCAAwC;IACnD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAM,KAAK,OAAsD;EAC/D,MAAM,KAAKF,OAAO,YAAY;EAC9B,OAAO,KAAKA,OAAO,KAAK,KAAK;CAC/B;CAEA,MAAM,KAAK,EAAE,SAAS,SAAqE;EACzF,IAAI;GACF,MAAM,SAAS,KAAKD,MAAM,OAAO,OAAO;GACxC,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,KAAK,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,oBAAoB,OAAO;GACtC,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC;IACjD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAM,UAAU,EACd,gBACA,SAIgB;EAChB,IAAI;GACF,MAAM,UAAU,eAAe,IAAI,YAAY;GAG/C,MAAM,SAAS,KAAKI,eAAe,cAAc;GACjD,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,WAAW,SAAS;GAC1B,MAAM,QAAQ,SAAS,SAAS;GAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,kBAAkB;GAEhE,MAAM,KAAK,OAAO;IAChB;IACA,SAAS,SAAS;IAClB,WAAW;IACX,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;KAAE,GAAG,MAAM;KAAU,WAAW;IAAO;IACjD,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,CAAC;GACZ,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,4CAA4C;IACvD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,SAAqB;EACnB,OAAO,CACL,iBAAiB,mCAAmC;GAClD,QAAQ;GACR,SAAS,OAAM,OAAM;IACnB,MAAM,IAAI,MAAM,EAAE;IAClB,MAAM,SAAS,MAAM,KAAKC,eAAe,CAAC;IAC1C,IAAI,cAAc,QAAQ,OAAO,OAAO;IAExC,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC7F,MAAM,KAAKH,UAAU,YAAY;IAEjC,IAAI,CAAC,MADiB,KAAKA,UAAU,IAAI;KAAE,OAAO,OAAO;KAAO,IAAI;IAAU,CAAC,GACjE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,OAAO,MAAM,KAAK,KAAK;KAC3B,OAAO,OAAO;KACd,kBAAkB;KAClB,SAAS,kBAAkB,EAAE,IAAI,MAAM,SAAS,CAAC;KACjD,SAAS,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACjC,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK,KAAA;KACjC,OAAO,gBAAgB,EAAE,IAAI,MAAM,OAAO,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,IAAI;GACpB;EACF,CAAC,CACH;CACF;CAEA,MAAMG,eAAe,GAAiF;EACpG,MAAM,KAAKL,MAAM,WAAW,CAAC;EAC7B,MAAM,SAAS,KAAKA,MAAM,OAAO,CAAC;EAClC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KAAK;GAAE,OAAO;GAAyB,SAAS;EAA4C,GAAG,GAAG,EAChH;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;AACF"}

package/dist/storage/domains/channel-identity/base.d.ts

@@ -0,0 +1,96 @@
+import { FactoryStorageDomain } from '@mastra/core/storage';
+import type { CollectionSchema } from '@mastra/core/storage';
+/**
+ * A reverse index from a platform sender identity to a Mastra tenant.
+ *
+ * Inbound channel events (a Slack DM, a Discord mention, ...) carry only the
+ * platform-side sender ids — there is no Mastra `(orgId, userId)` on the event.
+ * Model credentials, however, resolve **per-tenant**, so a channel run cannot
+ * load the sender's stored model credentials until we know which tenant the
+ * sender is. This domain holds that mapping: an authenticated web user links
+ * their platform account, and the dispatch seam reads it back to stamp the
+ * tenant onto the run's request context.
+ *
+ * One row per `(platform, external_team_id, external_user_id)` — the same
+ * platform user in two workspaces (two team ids) is two independent links, so
+ * multi-workspace falls out of the key. `platform` is generic (`'slack'` today,
+ * reusable for Discord/Telegram later). The `external_` prefix disambiguates
+ * the platform-side ids from the tenant ids (`org_id` / `user_id`) that cohabit
+ * the row.
+ */
+export interface ChannelAccountLink {
+    /** Undefined for personal accounts (no organization). */
+    orgId?: string;
+    userId: string;
+    /**
+     * Which Factory project this sender's channel runs route to. Unset until
+     * the user picks one (or the dispatch path auto-stamps their only factory).
+     */
+    defaultFactoryProjectId?: string;
+    linkedAt: Date;
+}
+/** The reverse-lookup key: a platform sender identity. */
+export interface ChannelAccountLinkKey {
+    platform: string;
+    externalTeamId: string;
+    externalUserId: string;
+}
+/**
+ * Human-readable labels for a linked identity, captured at link time (e.g.
+ * from Slack OIDC id_token claims). Display-only — never part of the key.
+ */
+export interface ChannelAccountLinkNames {
+    externalTeamName?: string;
+    externalUserName?: string;
+}
+export declare const CHANNEL_ACCOUNT_LINKS_SCHEMA: CollectionSchema;
+/** A link row with its platform sender key, as listed for a tenant user. */
+export interface ChannelAccountLinkEntry extends ChannelAccountLink, ChannelAccountLinkKey, ChannelAccountLinkNames {
+}
+export declare class ChannelIdentityStorage extends FactoryStorageDomain {
+    #private;
+    constructor();
+    init(): Promise<void>;
+    dangerouslyClearAll(): Promise<void>;
+    /**
+     * Bind a platform sender identity to a Mastra tenant. Last-write-wins: a
+     * re-link (e.g. the same Slack user connecting a different tenant) replaces
+     * the stored tenant and refreshes `linkedAt`.
+     */
+    saveAccountLink({ platform, externalTeamId, externalUserId, orgId, userId, externalTeamName, externalUserName, }: ChannelAccountLinkKey & ChannelAccountLinkNames & {
+        orgId?: string;
+        userId: string;
+    }): Promise<ChannelAccountLink>;
+    /**
+     * Set (or clear, with `null`) which Factory project a link's channel runs
+     * route to. The `userId` guard makes this self-service only — a caller can
+     * never repoint another tenant's link. Returns whether a row was updated.
+     *
+     * Note: `saveAccountLink` deliberately omits this column from its upsert
+     * row, so a re-link keeps the stored default.
+     */
+    setDefaultFactory({ platform, externalTeamId, externalUserId, userId, factoryProjectId, }: ChannelAccountLinkKey & {
+        userId: string;
+        factoryProjectId: string | null;
+    }): Promise<boolean>;
+    /** Resolve the tenant a platform sender is linked to, or `null` if unlinked. */
+    getAccountLink({ platform, externalTeamId, externalUserId, }: ChannelAccountLinkKey): Promise<ChannelAccountLink | null>;
+    /** Remove a platform sender's link. Returns whether a row was deleted. */
+    deleteAccountLink({ platform, externalTeamId, externalUserId }: ChannelAccountLinkKey): Promise<boolean>;
+    /**
+     * All platform identities linked to a tenant user, for the "Connected
+     * accounts" settings surface. Keyed by the tenant `userId` alone — a link
+     * belongs to the person, and their personal/org context at link time does
+     * not change who may see or sever it.
+     */
+    listAccountLinksForUser(userId: string): Promise<ChannelAccountLinkEntry[]>;
+    /**
+     * Remove one of the tenant user's own links, addressed by its sender key.
+     * The `userId` guard makes the delete self-service only: a caller can never
+     * sever another tenant's link even with a known sender key.
+     */
+    deleteAccountLinkForUser({ userId, platform, externalTeamId, externalUserId, }: ChannelAccountLinkKey & {
+        userId: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/channel-identity/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/channel-identity/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,4BAA4B,EAAE,gBAoB1C,CAAC;AAwBF,4EAA4E;AAC5E,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;CAAG;AAatH,qBAAa,sBAAuB,SAAQ,oBAAoB;;;IAKxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C;;;;OAIG;IACG,eAAe,CAAC,EACpB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,gBAAgB,GACjB,EAAE,qBAAqB,GACtB,uBAAuB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkB5F;;;;;;;OAOG;IACG,iBAAiB,CAAC,EACtB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,gBAAgB,GACjB,EAAE,qBAAqB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjG,gFAAgF;IAC1E,cAAc,CAAC,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAS7D,0EAA0E;IACpE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9G;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAKjF;;;;OAIG;IACG,wBAAwB,CAAC,EAC7B,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CASjE"}

package/dist/storage/domains/channel-identity/base.js

@@ -0,0 +1,149 @@
+import { FactoryStorageDomain } from "@mastra/core/storage";
+//#region src/storage/domains/channel-identity/base.ts
+const CHANNEL_ACCOUNT_LINKS_SCHEMA = {
+	name: "channel_account_links",
+	columns: {
+		id: { type: "uuid-pk" },
+		platform: { type: "text" },
+		external_team_id: { type: "text" },
+		external_user_id: { type: "text" },
+		org_id: {
+			type: "text",
+			nullable: true
+		},
+		user_id: { type: "text" },
+		external_team_name: {
+			type: "text",
+			nullable: true
+		},
+		external_user_name: {
+			type: "text",
+			nullable: true
+		},
+		default_factory_project_id: {
+			type: "text",
+			nullable: true
+		},
+		linked_at: { type: "timestamp" }
+	},
+	uniqueIndexes: [{
+		name: "channel_account_links_sender_key",
+		columns: [
+			"platform",
+			"external_team_id",
+			"external_user_id"
+		]
+	}]
+};
+function toLink(row) {
+	return {
+		...row.org_id ? { orgId: row.org_id } : {},
+		userId: row.user_id,
+		...row.default_factory_project_id ? { defaultFactoryProjectId: row.default_factory_project_id } : {},
+		linkedAt: row.linked_at
+	};
+}
+function toEntry(row) {
+	return {
+		...toLink(row),
+		platform: row.platform,
+		externalTeamId: row.external_team_id,
+		externalUserId: row.external_user_id,
+		...row.external_team_name ? { externalTeamName: row.external_team_name } : {},
+		...row.external_user_name ? { externalUserName: row.external_user_name } : {}
+	};
+}
+var ChannelIdentityStorage = class extends FactoryStorageDomain {
+	constructor() {
+		super("channel-identity");
+	}
+	async init() {
+		await this.ensureCollections([CHANNEL_ACCOUNT_LINKS_SCHEMA]);
+	}
+	async dangerouslyClearAll() {
+		await this.ops.deleteMany("channel_account_links", {});
+	}
+	get #db() {
+		return this.ops;
+	}
+	/**
+	* Bind a platform sender identity to a Mastra tenant. Last-write-wins: a
+	* re-link (e.g. the same Slack user connecting a different tenant) replaces
+	* the stored tenant and refreshes `linkedAt`.
+	*/
+	async saveAccountLink({ platform, externalTeamId, externalUserId, orgId, userId, externalTeamName, externalUserName }) {
+		return toLink(await this.#db.upsertOne("channel_account_links", [
+			"platform",
+			"external_team_id",
+			"external_user_id"
+		], {
+			platform,
+			external_team_id: externalTeamId,
+			external_user_id: externalUserId,
+			org_id: orgId ?? null,
+			user_id: userId,
+			external_team_name: externalTeamName ?? null,
+			external_user_name: externalUserName ?? null,
+			linked_at: /* @__PURE__ */ new Date()
+		}));
+	}
+	/**
+	* Set (or clear, with `null`) which Factory project a link's channel runs
+	* route to. The `userId` guard makes this self-service only — a caller can
+	* never repoint another tenant's link. Returns whether a row was updated.
+	*
+	* Note: `saveAccountLink` deliberately omits this column from its upsert
+	* row, so a re-link keeps the stored default.
+	*/
+	async setDefaultFactory({ platform, externalTeamId, externalUserId, userId, factoryProjectId }) {
+		return await this.#db.updateMany("channel_account_links", {
+			user_id: userId,
+			platform,
+			external_team_id: externalTeamId,
+			external_user_id: externalUserId
+		}, { default_factory_project_id: factoryProjectId }) > 0;
+	}
+	/** Resolve the tenant a platform sender is linked to, or `null` if unlinked. */
+	async getAccountLink({ platform, externalTeamId, externalUserId }) {
+		const row = await this.#db.findOne("channel_account_links", {
+			platform,
+			external_team_id: externalTeamId,
+			external_user_id: externalUserId
+		});
+		return row ? toLink(row) : null;
+	}
+	/** Remove a platform sender's link. Returns whether a row was deleted. */
+	async deleteAccountLink({ platform, externalTeamId, externalUserId }) {
+		return await this.#db.deleteMany("channel_account_links", {
+			platform,
+			external_team_id: externalTeamId,
+			external_user_id: externalUserId
+		}) > 0;
+	}
+	/**
+	* All platform identities linked to a tenant user, for the "Connected
+	* accounts" settings surface. Keyed by the tenant `userId` alone — a link
+	* belongs to the person, and their personal/org context at link time does
+	* not change who may see or sever it.
+	*/
+	async listAccountLinksForUser(userId) {
+		return (await this.#db.findMany("channel_account_links", { user_id: userId })).map(toEntry);
+	}
+	/**
+	* Remove one of the tenant user's own links, addressed by its sender key.
+	* The `userId` guard makes the delete self-service only: a caller can never
+	* sever another tenant's link even with a known sender key.
+	*/
+	async deleteAccountLinkForUser({ userId, platform, externalTeamId, externalUserId }) {
+		return await this.#db.deleteMany("channel_account_links", {
+			user_id: userId,
+			platform,
+			external_team_id: externalTeamId,
+			external_user_id: externalUserId
+		}) > 0;
+	}
+};
+//#endregion
+export { CHANNEL_ACCOUNT_LINKS_SCHEMA, ChannelIdentityStorage };
+
+//# sourceMappingURL=base.js.map

package/dist/storage/domains/channel-identity/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","names":["#db"],"sources":["../../../../src/storage/domains/channel-identity/base.ts"],"sourcesContent":["import { FactoryStorageDomain } from '@mastra/core/storage';\nimport type { CollectionSchema, FactoryStorageOps } from '@mastra/core/storage';\n\n/**\n * A reverse index from a platform sender identity to a Mastra tenant.\n *\n * Inbound channel events (a Slack DM, a Discord mention, ...) carry only the\n * platform-side sender ids — there is no Mastra `(orgId, userId)` on the event.\n * Model credentials, however, resolve **per-tenant**, so a channel run cannot\n * load the sender's stored model credentials until we know which tenant the\n * sender is. This domain holds that mapping: an authenticated web user links\n * their platform account, and the dispatch seam reads it back to stamp the\n * tenant onto the run's request context.\n *\n * One row per `(platform, external_team_id, external_user_id)` — the same\n * platform user in two workspaces (two team ids) is two independent links, so\n * multi-workspace falls out of the key. `platform` is generic (`'slack'` today,\n * reusable for Discord/Telegram later). The `external_` prefix disambiguates\n * the platform-side ids from the tenant ids (`org_id` / `user_id`) that cohabit\n * the row.\n */\nexport interface ChannelAccountLink {\n  /** Undefined for personal accounts (no organization). */\n  orgId?: string;\n  userId: string;\n  /**\n   * Which Factory project this sender's channel runs route to. Unset until\n   * the user picks one (or the dispatch path auto-stamps their only factory).\n   */\n  defaultFactoryProjectId?: string;\n  linkedAt: Date;\n}\n\n/** The reverse-lookup key: a platform sender identity. */\nexport interface ChannelAccountLinkKey {\n  platform: string;\n  externalTeamId: string;\n  externalUserId: string;\n}\n\n/**\n * Human-readable labels for a linked identity, captured at link time (e.g.\n * from Slack OIDC id_token claims). Display-only — never part of the key.\n */\nexport interface ChannelAccountLinkNames {\n  externalTeamName?: string;\n  externalUserName?: string;\n}\n\nexport const CHANNEL_ACCOUNT_LINKS_SCHEMA: CollectionSchema = {\n  name: 'channel_account_links',\n  columns: {\n    id: { type: 'uuid-pk' },\n    platform: { type: 'text' },\n    external_team_id: { type: 'text' },\n    external_user_id: { type: 'text' },\n    org_id: { type: 'text', nullable: true },\n    user_id: { type: 'text' },\n    external_team_name: { type: 'text', nullable: true },\n    external_user_name: { type: 'text', nullable: true },\n    default_factory_project_id: { type: 'text', nullable: true },\n    linked_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    {\n      name: 'channel_account_links_sender_key',\n      columns: ['platform', 'external_team_id', 'external_user_id'],\n    },\n  ],\n};\n\ninterface ChannelAccountLinkDbRow extends Record<string, unknown> {\n  id: string;\n  platform: string;\n  external_team_id: string;\n  external_user_id: string;\n  org_id: string | null;\n  user_id: string;\n  external_team_name: string | null;\n  external_user_name: string | null;\n  default_factory_project_id: string | null;\n  linked_at: Date;\n}\n\nfunction toLink(row: ChannelAccountLinkDbRow): ChannelAccountLink {\n  return {\n    ...(row.org_id ? { orgId: row.org_id } : {}),\n    userId: row.user_id,\n    ...(row.default_factory_project_id ? { defaultFactoryProjectId: row.default_factory_project_id } : {}),\n    linkedAt: row.linked_at,\n  };\n}\n\n/** A link row with its platform sender key, as listed for a tenant user. */\nexport interface ChannelAccountLinkEntry extends ChannelAccountLink, ChannelAccountLinkKey, ChannelAccountLinkNames {}\n\nfunction toEntry(row: ChannelAccountLinkDbRow): ChannelAccountLinkEntry {\n  return {\n    ...toLink(row),\n    platform: row.platform,\n    externalTeamId: row.external_team_id,\n    externalUserId: row.external_user_id,\n    ...(row.external_team_name ? { externalTeamName: row.external_team_name } : {}),\n    ...(row.external_user_name ? { externalUserName: row.external_user_name } : {}),\n  };\n}\n\nexport class ChannelIdentityStorage extends FactoryStorageDomain {\n  constructor() {\n    super('channel-identity');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([CHANNEL_ACCOUNT_LINKS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('channel_account_links', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /**\n   * Bind a platform sender identity to a Mastra tenant. Last-write-wins: a\n   * re-link (e.g. the same Slack user connecting a different tenant) replaces\n   * the stored tenant and refreshes `linkedAt`.\n   */\n  async saveAccountLink({\n    platform,\n    externalTeamId,\n    externalUserId,\n    orgId,\n    userId,\n    externalTeamName,\n    externalUserName,\n  }: ChannelAccountLinkKey &\n    ChannelAccountLinkNames & { orgId?: string; userId: string }): Promise<ChannelAccountLink> {\n    const row = await this.#db.upsertOne<ChannelAccountLinkDbRow>(\n      'channel_account_links',\n      ['platform', 'external_team_id', 'external_user_id'],\n      {\n        platform,\n        external_team_id: externalTeamId,\n        external_user_id: externalUserId,\n        org_id: orgId ?? null,\n        user_id: userId,\n        external_team_name: externalTeamName ?? null,\n        external_user_name: externalUserName ?? null,\n        linked_at: new Date(),\n      },\n    );\n    return toLink(row);\n  }\n\n  /**\n   * Set (or clear, with `null`) which Factory project a link's channel runs\n   * route to. The `userId` guard makes this self-service only — a caller can\n   * never repoint another tenant's link. Returns whether a row was updated.\n   *\n   * Note: `saveAccountLink` deliberately omits this column from its upsert\n   * row, so a re-link keeps the stored default.\n   */\n  async setDefaultFactory({\n    platform,\n    externalTeamId,\n    externalUserId,\n    userId,\n    factoryProjectId,\n  }: ChannelAccountLinkKey & { userId: string; factoryProjectId: string | null }): Promise<boolean> {\n    const updated = await this.#db.updateMany(\n      'channel_account_links',\n      {\n        user_id: userId,\n        platform,\n        external_team_id: externalTeamId,\n        external_user_id: externalUserId,\n      },\n      { default_factory_project_id: factoryProjectId },\n    );\n    return updated > 0;\n  }\n\n  /** Resolve the tenant a platform sender is linked to, or `null` if unlinked. */\n  async getAccountLink({\n    platform,\n    externalTeamId,\n    externalUserId,\n  }: ChannelAccountLinkKey): Promise<ChannelAccountLink | null> {\n    const row = await this.#db.findOne<ChannelAccountLinkDbRow>('channel_account_links', {\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return row ? toLink(row) : null;\n  }\n\n  /** Remove a platform sender's link. Returns whether a row was deleted. */\n  async deleteAccountLink({ platform, externalTeamId, externalUserId }: ChannelAccountLinkKey): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('channel_account_links', {\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return deleted > 0;\n  }\n\n  /**\n   * All platform identities linked to a tenant user, for the \"Connected\n   * accounts\" settings surface. Keyed by the tenant `userId` alone — a link\n   * belongs to the person, and their personal/org context at link time does\n   * not change who may see or sever it.\n   */\n  async listAccountLinksForUser(userId: string): Promise<ChannelAccountLinkEntry[]> {\n    const rows = await this.#db.findMany<ChannelAccountLinkDbRow>('channel_account_links', { user_id: userId });\n    return rows.map(toEntry);\n  }\n\n  /**\n   * Remove one of the tenant user's own links, addressed by its sender key.\n   * The `userId` guard makes the delete self-service only: a caller can never\n   * sever another tenant's link even with a known sender key.\n   */\n  async deleteAccountLinkForUser({\n    userId,\n    platform,\n    externalTeamId,\n    externalUserId,\n  }: ChannelAccountLinkKey & { userId: string }): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('channel_account_links', {\n      user_id: userId,\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return deleted > 0;\n  }\n}\n"],"mappings":";;AAiDA,MAAa,+BAAiD;CAC5D,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,UAAU,EAAE,MAAM,OAAO;EACzB,kBAAkB,EAAE,MAAM,OAAO;EACjC,kBAAkB,EAAE,MAAM,OAAO;EACjC,QAAQ;GAAE,MAAM;GAAQ,UAAU;EAAK;EACvC,SAAS,EAAE,MAAM,OAAO;EACxB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,4BAA4B;GAAE,MAAM;GAAQ,UAAU;EAAK;EAC3D,WAAW,EAAE,MAAM,YAAY;CACjC;CACA,eAAe,CACb;EACE,MAAM;EACN,SAAS;GAAC;GAAY;GAAoB;EAAkB;CAC9D,CACF;AACF;AAeA,SAAS,OAAO,KAAkD;CAChE,OAAO;EACL,GAAI,IAAI,SAAS,EAAE,OAAO,IAAI,OAAO,IAAI,CAAC;EAC1C,QAAQ,IAAI;EACZ,GAAI,IAAI,6BAA6B,EAAE,yBAAyB,IAAI,2BAA2B,IAAI,CAAC;EACpG,UAAU,IAAI;CAChB;AACF;AAKA,SAAS,QAAQ,KAAuD;CACtE,OAAO;EACL,GAAG,OAAO,GAAG;EACb,UAAU,IAAI;EACd,gBAAgB,IAAI;EACpB,gBAAgB,IAAI;EACpB,GAAI,IAAI,qBAAqB,EAAE,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;EAC7E,GAAI,IAAI,qBAAqB,EAAE,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;CAC/E;AACF;AAEA,IAAa,yBAAb,cAA4C,qBAAqB;CAC/D,cAAc;EACZ,MAAM,kBAAkB;CAC1B;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,4BAA4B,CAAC;CAC7D;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,yBAAyB,CAAC,CAAC;CACvD;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;;;;;CAOA,MAAM,gBAAgB,EACpB,UACA,gBACA,gBACA,OACA,QACA,kBACA,oBAE2F;EAe3F,OAAO,OAAO,MAdI,KAAKA,IAAI,UACzB,yBACA;GAAC;GAAY;GAAoB;EAAkB,GACnD;GACE;GACA,kBAAkB;GAClB,kBAAkB;GAClB,QAAQ,SAAS;GACjB,SAAS;GACT,oBAAoB,oBAAoB;GACxC,oBAAoB,oBAAoB;GACxC,2BAAW,IAAI,KAAK;EACtB,CACF,CACiB;CACnB;;;;;;;;;CAUA,MAAM,kBAAkB,EACtB,UACA,gBACA,gBACA,QACA,oBACgG;EAWhG,OAAO,MAVe,KAAKA,IAAI,WAC7B,yBACA;GACE,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;EACpB,GACA,EAAE,4BAA4B,iBAAiB,CACjD,IACiB;CACnB;;CAGA,MAAM,eAAe,EACnB,UACA,gBACA,kBAC4D;EAC5D,MAAM,MAAM,MAAM,KAAKA,IAAI,QAAiC,yBAAyB;GACnF;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC;EACD,OAAO,MAAM,OAAO,GAAG,IAAI;CAC7B;;CAGA,MAAM,kBAAkB,EAAE,UAAU,gBAAgB,kBAA2D;EAM7G,OAAO,MALe,KAAKA,IAAI,WAAW,yBAAyB;GACjE;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC,IACgB;CACnB;;;;;;;CAQA,MAAM,wBAAwB,QAAoD;EAEhF,QAAO,MADY,KAAKA,IAAI,SAAkC,yBAAyB,EAAE,SAAS,OAAO,CAAC,EAAA,CAC9F,IAAI,OAAO;CACzB;;;;;;CAOA,MAAM,yBAAyB,EAC7B,QACA,UACA,gBACA,kBAC+D;EAO/D,OAAO,MANe,KAAKA,IAAI,WAAW,yBAAyB;GACjE,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC,IACgB;CACnB;AACF"}

package/dist/storage/domains/credentials/base.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Model provider credentials domain — tenant-scoped OAuth tokens and API keys
+ * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,
+ * xAI, plus plain API-key providers).
+ *
+ * Tenancy is two-level:
+ * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and
+ *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are
+ *   personal subscriptions, and sharing one would bill/rate-limit a single
+ *   account for the whole org.
+ * - **org-scoped** rows (`userId` absent): shared API keys set by an org
+ *   admin, inherited by every member.
+ *
+ * Resolution order at model-call time is user > org (the caller layers server
+ * env vars underneath as a final fallback).
+ *
+ * Secrets posture: credentials are stored server-side only and never returned
+ * to the client (same as `linear_connections.access_token`). Encryption at
+ * rest is out of scope, matching the existing posture.
+ *
+ * The domain also owns `oauth_login_sessions`: pending web login flows
+ * (paste-code PKCE verifiers, device-code poll state) persisted server-side so
+ * any replica can complete or poll a flow started on another.
+ */
+import type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';
+import { FactoryStorageDomain } from '@mastra/core/storage';
+import type { CollectionSchema } from '@mastra/core/storage';
+/** Owning tenant of a credential row. `userId` absent = org-scoped row. */
+export interface CredentialTenant {
+    orgId: string;
+    userId?: string;
+}
+/** Which tenancy level a credential row lives at. */
+export type CredentialScope = 'user' | 'org';
+/** One stored credential, annotated with its scope. */
+export interface CredentialRecord {
+    provider: string;
+    scope: CredentialScope;
+    credential: AuthCredential;
+    updatedAt: Date;
+}
+/** Result of per-caller resolution: the winning credential and its scope. */
+export interface ResolvedCredential {
+    provider: string;
+    scope: CredentialScope;
+    credential: AuthCredential;
+}
+/** Kind of pending web login flow a session row tracks. */
+export type LoginSessionKind = 'paste-code' | 'device-code';
+/** One pending OAuth login flow, persisted so any replica can continue it. */
+export interface LoginSessionRow {
+    sessionId: string;
+    orgId: string;
+    userId: string;
+    provider: string;
+    kind: LoginSessionKind;
+    /** Serialized flow state (PKCE verifier, device-code pending state, ...). */
+    pending: Record<string, unknown>;
+    expiresAt: Date;
+    /** Earliest time the next upstream poll is allowed (device-code flows). */
+    nextPollAt: Date | null;
+    createdAt: Date;
+}
+export interface CreateLoginSessionInput {
+    sessionId: string;
+    orgId: string;
+    userId: string;
+    provider: string;
+    kind: LoginSessionKind;
+    pending: Record<string, unknown>;
+    expiresAt: Date;
+    nextPollAt?: Date | null;
+}
+/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */
+export declare function isOAuthCredentialExpired(credential: OAuthCredential, now?: number): boolean;
+/** OAuth plan credentials are personal and must always have an owning user. */
+export declare function assertCredentialScope(tenant: CredentialTenant, credential: AuthCredential): void;
+export declare const MODEL_CREDENTIALS_SCHEMA: CollectionSchema;
+export declare const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema;
+/**
+ * Model-credentials storage, written once against the generic
+ * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`
+ * ride `updateAtomic` so concurrent replicas serialize instead of
+ * invalidating each other's rotating tokens / double-claiming a flow.
+ */
+export declare class ModelCredentialsStorage extends FactoryStorageDomain {
+    #private;
+    constructor();
+    init(): Promise<void>;
+    dangerouslyClearAll(): Promise<void>;
+    /** Read the tenant's credential for a provider at exactly that scope. */
+    getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined>;
+    /** Upsert the tenant's credential (`created_at` is preserved on update). */
+    setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void>;
+    /** Delete the tenant's credential at exactly that scope. True when a row was removed. */
+    removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean>;
+    /** All credentials visible to a user: their own rows plus the org's shared rows. */
+    listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]>;
+    /**
+     * Resolve the credential a caller should use for a provider: the user's own
+     * row wins over the org's shared row.
+     */
+    resolveCredential(orgId: string, userId: string, provider: string): Promise<ResolvedCredential | undefined>;
+    /**
+     * Refresh the tenant's OAuth credential under the backend's atomic
+     * read-modify-write so concurrent replicas don't invalidate each other's
+     * rotating refresh tokens. The expiry is re-checked under the lock —
+     * another replica may have refreshed already, in which case `refreshFn` is
+     * skipped and the fresh credential is returned. Returns `undefined` when no
+     * OAuth row exists for the tenant.
+     */
+    refreshOAuth(tenant: CredentialTenant, provider: string, refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>): Promise<OAuthCredential | undefined>;
+    /** Persist a pending login flow started by a web route. */
+    createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow>;
+    /**
+     * Read a pending login flow. An expired session is deleted on read (TTL
+     * cleanup) and reported as absent.
+     */
+    getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined>;
+    /**
+     * Atomically claim a due login session for one upstream completion/poll attempt.
+     * Returns undefined when the session is missing, expired, owned by another
+     * tenant/provider, or already claimed by a concurrent request.
+     */
+    claimLoginSession(sessionId: string, owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>): Promise<LoginSessionRow | undefined>;
+    /** Update a pending flow's serialized state and/or next allowed poll time. */
+    touchLoginSession(sessionId: string, updates: {
+        pending?: Record<string, unknown>;
+        nextPollAt?: Date | null;
+    }): Promise<void>;
+    /** Remove a pending login flow (completed, cancelled, or failed). */
+    deleteLoginSession(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/credentials/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/credentials/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,aAAa,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAE/F;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAIhG;AAED,eAAO,MAAM,wBAAwB,EAAE,gBAsBtC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,gBAazC,CAAC;AA2CF;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;;;IAKzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1C,yEAAyE;IACnE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKpG,4EAA4E;IACtE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1G,yFAAyF;IACnF,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpF,oFAAoF;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAsBjF;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAgBjH;;;;;;;OAOG;IACG,YAAY,CAChB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,GAChE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAqBvC,2DAA2D;IACrD,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAelF;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC,GACrE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IA0BvC,8EAA8E;IACxE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GACvE,OAAO,CAAC,IAAI,CAAC;IAQhB,qEAAqE;IAC/D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}