@mastra/factory 0.10.2-alpha.3 → 0.11.0

package/dist/storage/domains/audit/domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain.js","names":["#auth","#audit","#projects","#users","#sinks","#agentTenant","#resolveActorProfiles","#resolveTenant"],"sources":["../../../../src/storage/domains/audit/domain.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../../routes/route.js';\nimport type { FactoryProjectsStorage } from '../projects/base.js';\nimport type {\n  AuditContext,\n  AuditEventPage,\n  AuditEventRow,\n  AuditStorage,\n  AuditTarget,\n  ListAuditEventsInput,\n  RecordAuditEventInput,\n} from './base.js';\n\nexport interface EmitAuditInput {\n  action: string;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface EmitAgentAuditInput {\n  action: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface AuditEmitter {\n  emit(args: { context: Context; input: EmitAuditInput }): Promise<void>;\n}\n\nexport interface AuditAgentEmitter {\n  emitAgent(args: { requestContext: RequestContext; input: EmitAgentAuditInput }): Promise<void>;\n}\n\n/** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */\nexport interface AuditSink {\n  id: string;\n  audit?(args: { event: AuditEventRow }): Promise<void>;\n}\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n}\n\nexport interface AuditActorProfile {\n  id: string;\n  name: string;\n  avatarUrl?: string;\n}\n\n/**\n * Reserved metadata key on `AuditEventRow.metadata` that carries the acting\n * human user's display name and avatar captured from the auth context at\n * record time. Read back by `#resolveActorProfiles` so names/avatars work\n * for every auth provider without requiring an `IUserProvider.getUser(id)`\n * implementation — the Studio provider proxies through the shared API and\n * cannot resolve arbitrary users by id.\n */\nconst ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\ninterface StoredActorProfile {\n  name?: string;\n  avatarUrl?: string;\n}\n\nfunction readStoredActorProfile(metadata: Record<string, unknown> | undefined): StoredActorProfile | undefined {\n  if (!metadata) return undefined;\n  const raw = metadata[ACTOR_PROFILE_METADATA_KEY];\n  if (!raw || typeof raw !== 'object') return undefined;\n  const profile = raw as Record<string, unknown>;\n  const name = typeof profile.name === 'string' && profile.name.trim() ? profile.name.trim() : undefined;\n  const avatarUrl =\n    typeof profile.avatarUrl === 'string' && profile.avatarUrl.trim() ? profile.avatarUrl.trim() : undefined;\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\n/** Read the auth gate's stashed user directly from the Hono context. */\nfunction readFactoryAuthUserFromContext(\n  context: Context,\n): { name?: string; email?: string; avatarUrl?: string } | undefined {\n  const user = context.get('factoryAuthUser') as { name?: string; email?: string; avatarUrl?: string } | undefined;\n  return user ?? undefined;\n}\n\nfunction buildActorProfileMetadata(user: {\n  name?: string;\n  email?: string;\n  avatarUrl?: string;\n}): StoredActorProfile | undefined {\n  const name = user.name?.trim() || user.email?.trim();\n  const avatarUrl = user.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\nexport interface AuditDomainOptions {\n  auth: RouteAuth;\n  /** Audit storage domain handle. */\n  audit: AuditStorage;\n  /** Projects domain handle, used to scope the audit trail route. */\n  projects: FactoryProjectsStorage;\n  /** Resolve persisted human actor ids to display names and profile images. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  /** Best-effort fan-out destinations notified after each recorded event. */\n  sinks?: AuditSink[];\n  /** Resolve the acting tenant for agent-emitted events from the request context. */\n  agentTenant?: (requestContext: RequestContext) => { orgId?: string; userId?: string } | undefined;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_ACTION_FILTERS = 16;\nconst MAX_ACTOR_PROFILES = 100;\nconst AUTOMATION_ACTORS = new Set([\n  'factory',\n  'system',\n  'automation',\n  'factory-rule-dispatcher',\n  'factory-tool-result-rule',\n]);\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction parseActionsParam(raw: string | undefined): string[] | undefined {\n  if (!raw) return undefined;\n  const actions = raw\n    .split(',')\n    .map(action => action.trim())\n    .filter(Boolean)\n    .slice(0, MAX_ACTION_FILTERS);\n  return actions.length > 0 ? actions : undefined;\n}\n\nfunction isHumanActorId(actorId: string | undefined): actorId is string {\n  if (!actorId) return false;\n  return !AUTOMATION_ACTORS.has(actorId) && !actorId.startsWith('agent:') && !actorId.startsWith('github:');\n}\n\nfunction parseActorIdsParam(raw: string | undefined): string[] {\n  if (!raw) return [];\n  return [\n    ...new Set(\n      raw\n        .split(',')\n        .map(actorId => actorId.trim())\n        .filter(isHumanActorId),\n    ),\n  ].slice(0, MAX_ACTOR_PROFILES);\n}\n\nfunction parseLimitParam(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const limit = Number.parseInt(raw, 10);\n  return Number.isFinite(limit) ? limit : undefined;\n}\n\nexport function auditRequestContext(c: Context): AuditContext {\n  const location = c.req.header('x-forwarded-for')?.split(',')[0]?.trim();\n  const userAgent = c.req.header('user-agent');\n  return {\n    ...(location ? { location } : {}),\n    ...(userAgent ? { userAgent } : {}),\n  };\n}\n\n/** Factory-owned audit behavior backed by the audit storage domain. */\nexport class AuditDomain implements AuditEmitter, AuditAgentEmitter {\n  readonly #auth: RouteAuth;\n  readonly #audit: AuditStorage;\n  readonly #projects: FactoryProjectsStorage;\n  readonly #users: AuditDomainOptions['users'];\n  readonly #sinks: AuditSink[];\n  readonly #agentTenant: AuditDomainOptions['agentTenant'];\n\n  constructor({ auth, audit, projects, users, sinks = [], agentTenant }: AuditDomainOptions) {\n    this.#auth = auth;\n    this.#audit = audit;\n    this.#projects = projects;\n    this.#users = users;\n    this.#sinks = sinks;\n    this.#agentTenant = agentTenant;\n\n    const ids = new Set<string>();\n    for (const sink of this.#sinks) {\n      if (!sink.id) throw new Error('Audit integration id must not be empty');\n      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);\n      ids.add(sink.id);\n    }\n  }\n\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow | null> {\n    try {\n      await this.#audit.ensureReady();\n      const row = await this.#audit.record(input);\n      for (const sink of this.#sinks) {\n        if (!sink.audit) continue;\n        void Promise.resolve()\n          .then(() => sink.audit?.({ event: row }))\n          .catch(err => {\n            console.warn('[Audit] Audit integration failed', {\n              integration: sink.id,\n              action: row.action,\n              error: err instanceof Error ? err.message : String(err),\n            });\n          });\n      }\n      return row;\n    } catch (err) {\n      console.warn('[Audit] Failed to record audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return null;\n    }\n  }\n\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    await this.#audit.ensureReady();\n    return this.#audit.list(input);\n  }\n\n  async emit({ context, input }: { context: Context; input: EmitAuditInput }): Promise<void> {\n    try {\n      const tenant = this.#auth.tenant(context);\n      if (!tenant?.orgId) return;\n      const user = readFactoryAuthUserFromContext(context);\n      const actorProfile = user ? buildActorProfileMetadata(user) : undefined;\n      const metadata = actorProfile\n        ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: actorProfile }\n        : input.metadata;\n      await this.record({\n        orgId: tenant.orgId,\n        actorId: tenant.userId,\n        action: input.action,\n        targets: input.targets,\n        metadata,\n        factoryProjectId: input.factoryProjectId,\n        projectRepositoryId: input.projectRepositoryId,\n        context: auditRequestContext(context),\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async emitAgent({\n    requestContext,\n    input,\n  }: {\n    requestContext: RequestContext;\n    input: EmitAgentAuditInput;\n  }): Promise<void> {\n    try {\n      const context = requestContext.get('controller') as\n        | AgentControllerRequestContext<FactorySessionState>\n        | undefined;\n      const tenant = this.#agentTenant?.(requestContext);\n      const orgId = tenant?.orgId;\n      const userId = tenant?.userId;\n      const threadId = context?.threadId;\n      const state = context?.getState();\n      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;\n\n      const modeId = context.session.modeId?.trim();\n      const modelId = context.session.modelId?.trim();\n      await this.record({\n        orgId,\n        actorId: `agent:${threadId}`,\n        actorType: 'agent',\n        action: input.action,\n        targets: input.targets,\n        metadata: {\n          ...input.metadata,\n          startedBy: userId,\n          ...(modeId ? { agentName: `${modeId} agent` } : {}),\n          ...(modelId ? { modelId } : {}),\n        },\n        factoryProjectId: state.factoryProjectId,\n        projectRepositoryId: state.projectRepositoryId,\n        context: {},\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit agent audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async #resolveActorProfiles(\n    events: AuditEventRow[],\n    requestedActorIds: string[] = [],\n  ): Promise<Record<string, AuditActorProfile>> {\n    const humanActorIds = [\n      ...new Set(\n        [\n          ...requestedActorIds,\n          ...events.filter(event => event.actorType === 'human').map(event => event.actorId),\n        ].filter(isHumanActorId),\n      ),\n    ].slice(0, MAX_ACTOR_PROFILES);\n    if (humanActorIds.length === 0) return {};\n\n    // Prefer the profile stamped into event metadata at record time: it works\n    // regardless of the auth provider's ability to resolve a user by id\n    // (MastraAuthStudio's getUser() always returns null, WorkOS looks up by\n    // id but every provider stamps here uniformly).\n    const profiles: Record<string, AuditActorProfile> = {};\n    for (const event of events) {\n      if (event.actorType !== 'human') continue;\n      if (!isHumanActorId(event.actorId)) continue;\n      if (profiles[event.actorId]) continue;\n      const stored = readStoredActorProfile(event.metadata);\n      if (!stored?.name) continue;\n      profiles[event.actorId] = {\n        id: event.actorId,\n        name: stored.name,\n        ...(stored.avatarUrl ? { avatarUrl: stored.avatarUrl } : {}),\n      };\n    }\n\n    const unresolved = humanActorIds.filter(actorId => !profiles[actorId]);\n    if (unresolved.length === 0 || !this.#users) return profiles;\n\n    try {\n      const users = this.#users.getUsers\n        ? await this.#users.getUsers(unresolved)\n        : await Promise.all(unresolved.map(actorId => this.#users?.getUser(actorId) ?? null));\n      for (const [index, user] of users.entries()) {\n        if (!user) continue;\n        const name = user.name?.trim() || user.email?.trim() || user.id;\n        const actorId = unresolved[index] ?? user.id;\n        profiles[actorId] = {\n          id: user.id,\n          name,\n          ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),\n        };\n      }\n    } catch (err) {\n      console.warn('[Audit] Failed to resolve audit actor profiles', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n    return profiles;\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects/:id/audit', {\n        method: 'GET',\n        handler: async cc => {\n          const c = loose(cc);\n          const tenant = await this.#resolveTenant(c);\n          if ('response' in tenant) return tenant.response;\n\n          const projectId = c.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: 'Project not found' }, 404);\n          await this.#projects.ensureReady();\n          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });\n          if (!project) return c.json({ error: 'Project not found' }, 404);\n\n          const page = await this.list({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            actions: parseActionsParam(c.req.query('actions')),\n            actorId: c.req.query('actor') || undefined,\n            before: c.req.query('before') || undefined,\n            limit: parseLimitParam(c.req.query('limit')),\n          });\n          const actors = await this.#resolveActorProfiles(page.events, parseActorIdsParam(c.req.query('actorIds')));\n          return c.json({ ...page, actors });\n        },\n      }),\n    ];\n  }\n\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.#auth.ensureUser(c);\n    const tenant = this.#auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json({ error: 'organization_required', message: 'The audit trail requires an organization.' }, 403),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n}\n"],"mappings":";;;;;;;;;;AAiEA,MAAM,6BAA6B;AAOnC,SAAS,uBAAuB,UAA+E;CAC7G,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,MAAM,SAAS;CACrB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAC5C,MAAM,UAAU;CAChB,MAAM,OAAO,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK,IAAI,KAAA;CAC7F,MAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAAI,QAAQ,UAAU,KAAK,IAAI,KAAA;CACjG,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;;AAGA,SAAS,+BACP,SACmE;CAEnE,OADa,QAAQ,IAAI,iBACf,KAAK,KAAA;AACjB;AAEA,SAAS,0BAA0B,MAIA;CACjC,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK;CACnD,MAAM,YAAY,KAAK,WAAW,KAAK;CACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;AAgBA,MAAM,UAAU;AAChB,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,kBAAkB,KAA+C;CACxE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,UAAU,IACb,MAAM,GAAG,CAAC,CACV,KAAI,WAAU,OAAO,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO,CAAC,CACf,MAAM,GAAG,kBAAkB;CAC9B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AAEA,SAAS,eAAe,SAAgD;CACtE,IAAI,CAAC,SAAS,OAAO;CACrB,OAAO,CAAC,kBAAkB,IAAI,OAAO,KAAK,CAAC,QAAQ,WAAW,QAAQ,KAAK,CAAC,QAAQ,WAAW,SAAS;AAC1G;AAEA,SAAS,mBAAmB,KAAmC;CAC7D,IAAI,CAAC,KAAK,OAAO,CAAC;CAClB,OAAO,CACL,GAAG,IAAI,IACL,IACG,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,QAAQ,KAAK,CAAC,CAAC,CAC9B,OAAO,cAAc,CAC1B,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;AAC/B;AAEA,SAAS,gBAAgB,KAA6C;CACpE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;CACrC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AAC1C;AAEA,SAAgB,oBAAoB,GAA0B;CAC5D,MAAM,WAAW,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;CACtE,MAAM,YAAY,EAAE,IAAI,OAAO,YAAY;CAC3C,OAAO;EACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;AAGA,IAAa,cAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,EAAE,MAAM,OAAO,UAAU,OAAO,QAAQ,CAAC,GAAG,eAAmC;EACzF,KAAKA,QAAQ;EACb,KAAKC,SAAS;EACd,KAAKC,YAAY;EACjB,KAAKC,SAAS;EACd,KAAKC,SAAS;EACd,KAAKC,eAAe;EAEpB,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,KAAKD,QAAQ;GAC9B,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,wCAAwC;GACtE,IAAI,IAAI,IAAI,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG,EAAE;GACnF,IAAI,IAAI,KAAK,EAAE;EACjB;CACF;CAEA,MAAM,OAAO,OAA6D;EACxE,IAAI;GACF,MAAM,KAAKH,OAAO,YAAY;GAC9B,MAAM,MAAM,MAAM,KAAKA,OAAO,OAAO,KAAK;GAC1C,KAAK,MAAM,QAAQ,KAAKG,QAAQ;IAC9B,IAAI,CAAC,KAAK,OAAO;IACjB,QAAa,QAAQ,CAAC,CACnB,WAAW,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CACxC,OAAM,QAAO;KACZ,QAAQ,KAAK,oCAAoC;MAC/C,aAAa,KAAK;MAClB,QAAQ,IAAI;MACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KACxD,CAAC;IACH,CAAC;GACL;GACA,OAAO;EACT,SAAS,KAAK;GACZ,QAAQ,KAAK,wCAAwC;IACnD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAM,KAAK,OAAsD;EAC/D,MAAM,KAAKH,OAAO,YAAY;EAC9B,OAAO,KAAKA,OAAO,KAAK,KAAK;CAC/B;CAEA,MAAM,KAAK,EAAE,SAAS,SAAqE;EACzF,IAAI;GACF,MAAM,SAAS,KAAKD,MAAM,OAAO,OAAO;GACxC,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,OAAO,+BAA+B,OAAO;GACnD,MAAM,eAAe,OAAO,0BAA0B,IAAI,IAAI,KAAA;GAC9D,MAAM,WAAW,eACb;IAAE,GAAG,MAAM;KAAW,6BAA6B;GAAa,IAChE,MAAM;GACV,MAAM,KAAK,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,QAAQ,MAAM;IACd,SAAS,MAAM;IACf;IACA,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,oBAAoB,OAAO;GACtC,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC;IACjD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAM,UAAU,EACd,gBACA,SAIgB;EAChB,IAAI;GACF,MAAM,UAAU,eAAe,IAAI,YAAY;GAG/C,MAAM,SAAS,KAAKK,eAAe,cAAc;GACjD,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,WAAW,SAAS;GAC1B,MAAM,QAAQ,SAAS,SAAS;GAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,kBAAkB;GAEhE,MAAM,SAAS,QAAQ,QAAQ,QAAQ,KAAK;GAC5C,MAAM,UAAU,QAAQ,QAAQ,SAAS,KAAK;GAC9C,MAAM,KAAK,OAAO;IAChB;IACA,SAAS,SAAS;IAClB,WAAW;IACX,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;KACR,GAAG,MAAM;KACT,WAAW;KACX,GAAI,SAAS,EAAE,WAAW,GAAG,OAAO,QAAQ,IAAI,CAAC;KACjD,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;IAC/B;IACA,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,CAAC;GACZ,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,4CAA4C;IACvD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAMC,sBACJ,QACA,oBAA8B,CAAC,GACa;EAC5C,MAAM,gBAAgB,CACpB,GAAG,IAAI,IACL,CACE,GAAG,mBACH,GAAG,OAAO,QAAO,UAAS,MAAM,cAAc,OAAO,CAAC,CAAC,KAAI,UAAS,MAAM,OAAO,CACnF,CAAC,CAAC,OAAO,cAAc,CACzB,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;EAC7B,IAAI,cAAc,WAAW,GAAG,OAAO,CAAC;EAMxC,MAAM,WAA8C,CAAC;EACrD,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,MAAM,cAAc,SAAS;GACjC,IAAI,CAAC,eAAe,MAAM,OAAO,GAAG;GACpC,IAAI,SAAS,MAAM,UAAU;GAC7B,MAAM,SAAS,uBAAuB,MAAM,QAAQ;GACpD,IAAI,CAAC,QAAQ,MAAM;GACnB,SAAS,MAAM,WAAW;IACxB,IAAI,MAAM;IACV,MAAM,OAAO;IACb,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC5D;EACF;EAEA,MAAM,aAAa,cAAc,QAAO,YAAW,CAAC,SAAS,QAAQ;EACrE,IAAI,WAAW,WAAW,KAAK,CAAC,KAAKH,QAAQ,OAAO;EAEpD,IAAI;GACF,MAAM,QAAQ,KAAKA,OAAO,WACtB,MAAM,KAAKA,OAAO,SAAS,UAAU,IACrC,MAAM,QAAQ,IAAI,WAAW,KAAI,YAAW,KAAKA,QAAQ,QAAQ,OAAO,KAAK,IAAI,CAAC;GACtF,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GAAG;IAC3C,IAAI,CAAC,MAAM;IACX,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK,KAAK;IAC7D,MAAM,UAAU,WAAW,UAAU,KAAK;IAC1C,SAAS,WAAW;KAClB,IAAI,KAAK;KACT;KACA,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;IACxD;GACF;EACF,SAAS,KAAK;GACZ,QAAQ,KAAK,kDAAkD,EAC7D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;EACH;EACA,OAAO;CACT;CAEA,SAAqB;EACnB,OAAO,CACL,iBAAiB,mCAAmC;GAClD,QAAQ;GACR,SAAS,OAAM,OAAM;IACnB,MAAM,IAAI,MAAM,EAAE;IAClB,MAAM,SAAS,MAAM,KAAKI,eAAe,CAAC;IAC1C,IAAI,cAAc,QAAQ,OAAO,OAAO;IAExC,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC7F,MAAM,KAAKL,UAAU,YAAY;IAEjC,IAAI,CAAC,MADiB,KAAKA,UAAU,IAAI;KAAE,OAAO,OAAO;KAAO,IAAI;IAAU,CAAC,GACjE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,OAAO,MAAM,KAAK,KAAK;KAC3B,OAAO,OAAO;KACd,kBAAkB;KAClB,SAAS,kBAAkB,EAAE,IAAI,MAAM,SAAS,CAAC;KACjD,SAAS,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACjC,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK,KAAA;KACjC,OAAO,gBAAgB,EAAE,IAAI,MAAM,OAAO,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,MAAM,KAAKI,sBAAsB,KAAK,QAAQ,mBAAmB,EAAE,IAAI,MAAM,UAAU,CAAC,CAAC;IACxG,OAAO,EAAE,KAAK;KAAE,GAAG;KAAM;IAAO,CAAC;GACnC;EACF,CAAC,CACH;CACF;CAEA,MAAMC,eAAe,GAAiF;EACpG,MAAM,KAAKP,MAAM,WAAW,CAAC;EAC7B,MAAM,SAAS,KAAKA,MAAM,OAAO,CAAC;EAClC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KAAK;GAAE,OAAO;GAAyB,SAAS;EAA4C,GAAG,GAAG,EAChH;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;AACF"}
+{"version":3,"file":"domain.js","names":["#auth","#audit","#projects","#users","#sinks","#agentTenant","#resolveActorProfiles","#resolveTenant"],"sources":["../../../../src/storage/domains/audit/domain.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { getFactoryAuthUser } from '../../../auth.js';\nimport type { RouteAuth } from '../../../routes/route.js';\nimport type { FactoryProjectsStorage } from '../projects/base.js';\nimport type {\n  AuditContext,\n  AuditEventPage,\n  AuditEventRow,\n  AuditStorage,\n  AuditTarget,\n  ListAuditEventsInput,\n  RecordAuditEventInput,\n} from './base.js';\n\nexport interface EmitAuditInput {\n  action: string;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface EmitAgentAuditInput {\n  action: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface AuditEmitter {\n  emit(args: { context: Context; input: EmitAuditInput }): Promise<void>;\n}\n\nexport interface AuditAgentEmitter {\n  emitAgent(args: { requestContext: RequestContext; input: EmitAgentAuditInput }): Promise<void>;\n}\n\n/** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */\nexport interface AuditSink {\n  id: string;\n  audit?(args: { event: AuditEventRow }): Promise<void>;\n}\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n}\n\nexport interface AuditActorProfile {\n  id: string;\n  name: string;\n  avatarUrl?: string;\n}\n\n/**\n * Reserved metadata key on `AuditEventRow.metadata` that carries the acting\n * human user's display name and avatar captured from the auth context at\n * record time. Read back by `#resolveActorProfiles` so names/avatars work\n * for every auth provider without requiring an `IUserProvider.getUser(id)`\n * implementation — the Studio provider proxies through the shared API and\n * cannot resolve arbitrary users by id.\n */\nconst ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\ninterface StoredActorProfile {\n  name?: string;\n  avatarUrl?: string;\n}\n\nfunction readStoredActorProfile(metadata: Record<string, unknown> | undefined): StoredActorProfile | undefined {\n  if (!metadata) return undefined;\n  const raw = metadata[ACTOR_PROFILE_METADATA_KEY];\n  if (!raw || typeof raw !== 'object') return undefined;\n  const profile = raw as Record<string, unknown>;\n  const name = typeof profile.name === 'string' && profile.name.trim() ? profile.name.trim() : undefined;\n  const avatarUrl =\n    typeof profile.avatarUrl === 'string' && profile.avatarUrl.trim() ? profile.avatarUrl.trim() : undefined;\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\nfunction buildActorProfileMetadata(user: {\n  name?: string;\n  email?: string;\n  avatarUrl?: string;\n}): StoredActorProfile | undefined {\n  const name = user.name?.trim() || user.email?.trim();\n  const avatarUrl = user.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\nexport interface AuditDomainOptions {\n  auth: RouteAuth;\n  /** Audit storage domain handle. */\n  audit: AuditStorage;\n  /** Projects domain handle, used to scope the audit trail route. */\n  projects: FactoryProjectsStorage;\n  /** Resolve persisted human actor ids to display names and profile images. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  /** Best-effort fan-out destinations notified after each recorded event. */\n  sinks?: AuditSink[];\n  /** Resolve the acting tenant for agent-emitted events from the request context. */\n  agentTenant?: (requestContext: RequestContext) => { orgId?: string; userId?: string } | undefined;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_ACTION_FILTERS = 16;\nconst MAX_ACTOR_PROFILES = 100;\nconst AUTOMATION_ACTORS = new Set([\n  'factory',\n  'system',\n  'automation',\n  'factory-rule-dispatcher',\n  'factory-tool-result-rule',\n]);\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction parseActionsParam(raw: string | undefined): string[] | undefined {\n  if (!raw) return undefined;\n  const actions = raw\n    .split(',')\n    .map(action => action.trim())\n    .filter(Boolean)\n    .slice(0, MAX_ACTION_FILTERS);\n  return actions.length > 0 ? actions : undefined;\n}\n\nfunction isHumanActorId(actorId: string | undefined): actorId is string {\n  if (!actorId) return false;\n  return !AUTOMATION_ACTORS.has(actorId) && !actorId.startsWith('agent:') && !actorId.startsWith('github:');\n}\n\nfunction parseActorIdsParam(raw: string | undefined): string[] {\n  if (!raw) return [];\n  return [\n    ...new Set(\n      raw\n        .split(',')\n        .map(actorId => actorId.trim())\n        .filter(isHumanActorId),\n    ),\n  ].slice(0, MAX_ACTOR_PROFILES);\n}\n\nfunction parseLimitParam(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const limit = Number.parseInt(raw, 10);\n  return Number.isFinite(limit) ? limit : undefined;\n}\n\nexport function auditRequestContext(c: Context): AuditContext {\n  const location = c.req.header('x-forwarded-for')?.split(',')[0]?.trim();\n  const userAgent = c.req.header('user-agent');\n  return {\n    ...(location ? { location } : {}),\n    ...(userAgent ? { userAgent } : {}),\n  };\n}\n\n/** Factory-owned audit behavior backed by the audit storage domain. */\nexport class AuditDomain implements AuditEmitter, AuditAgentEmitter {\n  readonly #auth: RouteAuth;\n  readonly #audit: AuditStorage;\n  readonly #projects: FactoryProjectsStorage;\n  readonly #users: AuditDomainOptions['users'];\n  readonly #sinks: AuditSink[];\n  readonly #agentTenant: AuditDomainOptions['agentTenant'];\n\n  constructor({ auth, audit, projects, users, sinks = [], agentTenant }: AuditDomainOptions) {\n    this.#auth = auth;\n    this.#audit = audit;\n    this.#projects = projects;\n    this.#users = users;\n    this.#sinks = sinks;\n    this.#agentTenant = agentTenant;\n\n    const ids = new Set<string>();\n    for (const sink of this.#sinks) {\n      if (!sink.id) throw new Error('Audit integration id must not be empty');\n      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);\n      ids.add(sink.id);\n    }\n  }\n\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow | null> {\n    try {\n      await this.#audit.ensureReady();\n      const row = await this.#audit.record(input);\n      for (const sink of this.#sinks) {\n        if (!sink.audit) continue;\n        void Promise.resolve()\n          .then(() => sink.audit?.({ event: row }))\n          .catch(err => {\n            console.warn('[Audit] Audit integration failed', {\n              integration: sink.id,\n              action: row.action,\n              error: err instanceof Error ? err.message : String(err),\n            });\n          });\n      }\n      return row;\n    } catch (err) {\n      console.warn('[Audit] Failed to record audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return null;\n    }\n  }\n\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    await this.#audit.ensureReady();\n    return this.#audit.list(input);\n  }\n\n  async emit({ context, input }: { context: Context; input: EmitAuditInput }): Promise<void> {\n    try {\n      const tenant = this.#auth.tenant(context);\n      if (!tenant?.orgId) return;\n      const user = getFactoryAuthUser(context);\n      const actorProfile = user ? buildActorProfileMetadata(user) : undefined;\n      const metadata = actorProfile\n        ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: actorProfile }\n        : input.metadata;\n      await this.record({\n        orgId: tenant.orgId,\n        actorId: tenant.userId,\n        action: input.action,\n        targets: input.targets,\n        metadata,\n        factoryProjectId: input.factoryProjectId,\n        projectRepositoryId: input.projectRepositoryId,\n        context: auditRequestContext(context),\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async emitAgent({\n    requestContext,\n    input,\n  }: {\n    requestContext: RequestContext;\n    input: EmitAgentAuditInput;\n  }): Promise<void> {\n    try {\n      const context = requestContext.get('controller') as\n        | AgentControllerRequestContext<FactorySessionState>\n        | undefined;\n      const tenant = this.#agentTenant?.(requestContext);\n      const orgId = tenant?.orgId;\n      const userId = tenant?.userId;\n      const threadId = context?.threadId;\n      const state = context?.getState();\n      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;\n\n      const modeId = context.session.modeId?.trim();\n      const modelId = context.session.modelId?.trim();\n      await this.record({\n        orgId,\n        actorId: `agent:${threadId}`,\n        actorType: 'agent',\n        action: input.action,\n        targets: input.targets,\n        metadata: {\n          ...input.metadata,\n          startedBy: userId,\n          ...(modeId ? { agentName: `${modeId} agent` } : {}),\n          ...(modelId ? { modelId } : {}),\n        },\n        factoryProjectId: state.factoryProjectId,\n        projectRepositoryId: state.projectRepositoryId,\n        context: {},\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit agent audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async #resolveActorProfiles(\n    events: AuditEventRow[],\n    requestedActorIds: string[] = [],\n  ): Promise<Record<string, AuditActorProfile>> {\n    const humanActorIds = [\n      ...new Set(\n        [\n          ...requestedActorIds,\n          ...events.filter(event => event.actorType === 'human').map(event => event.actorId),\n        ].filter(isHumanActorId),\n      ),\n    ].slice(0, MAX_ACTOR_PROFILES);\n    if (humanActorIds.length === 0) return {};\n\n    // Prefer the profile stamped into event metadata at record time: it works\n    // regardless of the auth provider's ability to resolve a user by id\n    // (MastraAuthStudio's getUser() always returns null, WorkOS looks up by\n    // id but every provider stamps here uniformly).\n    const profiles: Record<string, AuditActorProfile> = {};\n    for (const event of events) {\n      if (event.actorType !== 'human') continue;\n      if (!isHumanActorId(event.actorId)) continue;\n      if (profiles[event.actorId]) continue;\n      const stored = readStoredActorProfile(event.metadata);\n      if (!stored?.name) continue;\n      profiles[event.actorId] = {\n        id: event.actorId,\n        name: stored.name,\n        ...(stored.avatarUrl ? { avatarUrl: stored.avatarUrl } : {}),\n      };\n    }\n\n    const unresolved = humanActorIds.filter(actorId => !profiles[actorId]);\n    if (unresolved.length === 0 || !this.#users) return profiles;\n\n    try {\n      const users = this.#users.getUsers\n        ? await this.#users.getUsers(unresolved)\n        : await Promise.all(unresolved.map(actorId => this.#users?.getUser(actorId) ?? null));\n      for (const [index, user] of users.entries()) {\n        if (!user) continue;\n        const name = user.name?.trim() || user.email?.trim() || user.id;\n        const actorId = unresolved[index] ?? user.id;\n        profiles[actorId] = {\n          id: user.id,\n          name,\n          ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),\n        };\n      }\n    } catch (err) {\n      console.warn('[Audit] Failed to resolve audit actor profiles', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n    return profiles;\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects/:id/audit', {\n        method: 'GET',\n        handler: async cc => {\n          const c = loose(cc);\n          const tenant = await this.#resolveTenant(c);\n          if ('response' in tenant) return tenant.response;\n\n          const projectId = c.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: 'Project not found' }, 404);\n          await this.#projects.ensureReady();\n          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });\n          if (!project) return c.json({ error: 'Project not found' }, 404);\n\n          const page = await this.list({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            actions: parseActionsParam(c.req.query('actions')),\n            actorId: c.req.query('actor') || undefined,\n            before: c.req.query('before') || undefined,\n            limit: parseLimitParam(c.req.query('limit')),\n          });\n          const actors = await this.#resolveActorProfiles(page.events, parseActorIdsParam(c.req.query('actorIds')));\n          return c.json({ ...page, actors });\n        },\n      }),\n    ];\n  }\n\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.#auth.ensureUser(c);\n    const tenant = this.#auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json({ error: 'organization_required', message: 'The audit trail requires an organization.' }, 403),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n}\n"],"mappings":";;;;;;;;;;;AAkEA,MAAM,6BAA6B;AAOnC,SAAS,uBAAuB,UAA+E;CAC7G,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,MAAM,SAAS;CACrB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAC5C,MAAM,UAAU;CAChB,MAAM,OAAO,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK,IAAI,KAAA;CAC7F,MAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAAI,QAAQ,UAAU,KAAK,IAAI,KAAA;CACjG,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;AAEA,SAAS,0BAA0B,MAIA;CACjC,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK;CACnD,MAAM,YAAY,KAAK,WAAW,KAAK;CACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;AAgBA,MAAM,UAAU;AAChB,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,kBAAkB,KAA+C;CACxE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,UAAU,IACb,MAAM,GAAG,CAAC,CACV,KAAI,WAAU,OAAO,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO,CAAC,CACf,MAAM,GAAG,kBAAkB;CAC9B,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;AAEA,SAAS,eAAe,SAAgD;CACtE,IAAI,CAAC,SAAS,OAAO;CACrB,OAAO,CAAC,kBAAkB,IAAI,OAAO,KAAK,CAAC,QAAQ,WAAW,QAAQ,KAAK,CAAC,QAAQ,WAAW,SAAS;AAC1G;AAEA,SAAS,mBAAmB,KAAmC;CAC7D,IAAI,CAAC,KAAK,OAAO,CAAC;CAClB,OAAO,CACL,GAAG,IAAI,IACL,IACG,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,QAAQ,KAAK,CAAC,CAAC,CAC9B,OAAO,cAAc,CAC1B,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;AAC/B;AAEA,SAAS,gBAAgB,KAA6C;CACpE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;CACrC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AAC1C;AAEA,SAAgB,oBAAoB,GAA0B;CAC5D,MAAM,WAAW,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;CACtE,MAAM,YAAY,EAAE,IAAI,OAAO,YAAY;CAC3C,OAAO;EACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;AAGA,IAAa,cAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,EAAE,MAAM,OAAO,UAAU,OAAO,QAAQ,CAAC,GAAG,eAAmC;EACzF,KAAKA,QAAQ;EACb,KAAKC,SAAS;EACd,KAAKC,YAAY;EACjB,KAAKC,SAAS;EACd,KAAKC,SAAS;EACd,KAAKC,eAAe;EAEpB,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,KAAKD,QAAQ;GAC9B,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,wCAAwC;GACtE,IAAI,IAAI,IAAI,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG,EAAE;GACnF,IAAI,IAAI,KAAK,EAAE;EACjB;CACF;CAEA,MAAM,OAAO,OAA6D;EACxE,IAAI;GACF,MAAM,KAAKH,OAAO,YAAY;GAC9B,MAAM,MAAM,MAAM,KAAKA,OAAO,OAAO,KAAK;GAC1C,KAAK,MAAM,QAAQ,KAAKG,QAAQ;IAC9B,IAAI,CAAC,KAAK,OAAO;IACjB,QAAa,QAAQ,CAAC,CACnB,WAAW,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CACxC,OAAM,QAAO;KACZ,QAAQ,KAAK,oCAAoC;MAC/C,aAAa,KAAK;MAClB,QAAQ,IAAI;MACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KACxD,CAAC;IACH,CAAC;GACL;GACA,OAAO;EACT,SAAS,KAAK;GACZ,QAAQ,KAAK,wCAAwC;IACnD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAM,KAAK,OAAsD;EAC/D,MAAM,KAAKH,OAAO,YAAY;EAC9B,OAAO,KAAKA,OAAO,KAAK,KAAK;CAC/B;CAEA,MAAM,KAAK,EAAE,SAAS,SAAqE;EACzF,IAAI;GACF,MAAM,SAAS,KAAKD,MAAM,OAAO,OAAO;GACxC,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,OAAO,mBAAmB,OAAO;GACvC,MAAM,eAAe,OAAO,0BAA0B,IAAI,IAAI,KAAA;GAC9D,MAAM,WAAW,eACb;IAAE,GAAG,MAAM;KAAW,6BAA6B;GAAa,IAChE,MAAM;GACV,MAAM,KAAK,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,QAAQ,MAAM;IACd,SAAS,MAAM;IACf;IACA,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,oBAAoB,OAAO;GACtC,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC;IACjD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAM,UAAU,EACd,gBACA,SAIgB;EAChB,IAAI;GACF,MAAM,UAAU,eAAe,IAAI,YAAY;GAG/C,MAAM,SAAS,KAAKK,eAAe,cAAc;GACjD,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,WAAW,SAAS;GAC1B,MAAM,QAAQ,SAAS,SAAS;GAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,kBAAkB;GAEhE,MAAM,SAAS,QAAQ,QAAQ,QAAQ,KAAK;GAC5C,MAAM,UAAU,QAAQ,QAAQ,SAAS,KAAK;GAC9C,MAAM,KAAK,OAAO;IAChB;IACA,SAAS,SAAS;IAClB,WAAW;IACX,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;KACR,GAAG,MAAM;KACT,WAAW;KACX,GAAI,SAAS,EAAE,WAAW,GAAG,OAAO,QAAQ,IAAI,CAAC;KACjD,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;IAC/B;IACA,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,CAAC;GACZ,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,4CAA4C;IACvD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAMC,sBACJ,QACA,oBAA8B,CAAC,GACa;EAC5C,MAAM,gBAAgB,CACpB,GAAG,IAAI,IACL,CACE,GAAG,mBACH,GAAG,OAAO,QAAO,UAAS,MAAM,cAAc,OAAO,CAAC,CAAC,KAAI,UAAS,MAAM,OAAO,CACnF,CAAC,CAAC,OAAO,cAAc,CACzB,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;EAC7B,IAAI,cAAc,WAAW,GAAG,OAAO,CAAC;EAMxC,MAAM,WAA8C,CAAC;EACrD,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,MAAM,cAAc,SAAS;GACjC,IAAI,CAAC,eAAe,MAAM,OAAO,GAAG;GACpC,IAAI,SAAS,MAAM,UAAU;GAC7B,MAAM,SAAS,uBAAuB,MAAM,QAAQ;GACpD,IAAI,CAAC,QAAQ,MAAM;GACnB,SAAS,MAAM,WAAW;IACxB,IAAI,MAAM;IACV,MAAM,OAAO;IACb,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC5D;EACF;EAEA,MAAM,aAAa,cAAc,QAAO,YAAW,CAAC,SAAS,QAAQ;EACrE,IAAI,WAAW,WAAW,KAAK,CAAC,KAAKH,QAAQ,OAAO;EAEpD,IAAI;GACF,MAAM,QAAQ,KAAKA,OAAO,WACtB,MAAM,KAAKA,OAAO,SAAS,UAAU,IACrC,MAAM,QAAQ,IAAI,WAAW,KAAI,YAAW,KAAKA,QAAQ,QAAQ,OAAO,KAAK,IAAI,CAAC;GACtF,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GAAG;IAC3C,IAAI,CAAC,MAAM;IACX,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK,KAAK;IAC7D,MAAM,UAAU,WAAW,UAAU,KAAK;IAC1C,SAAS,WAAW;KAClB,IAAI,KAAK;KACT;KACA,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;IACxD;GACF;EACF,SAAS,KAAK;GACZ,QAAQ,KAAK,kDAAkD,EAC7D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;EACH;EACA,OAAO;CACT;CAEA,SAAqB;EACnB,OAAO,CACL,iBAAiB,mCAAmC;GAClD,QAAQ;GACR,SAAS,OAAM,OAAM;IACnB,MAAM,IAAI,MAAM,EAAE;IAClB,MAAM,SAAS,MAAM,KAAKI,eAAe,CAAC;IAC1C,IAAI,cAAc,QAAQ,OAAO,OAAO;IAExC,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC7F,MAAM,KAAKL,UAAU,YAAY;IAEjC,IAAI,CAAC,MADiB,KAAKA,UAAU,IAAI;KAAE,OAAO,OAAO;KAAO,IAAI;IAAU,CAAC,GACjE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,OAAO,MAAM,KAAK,KAAK;KAC3B,OAAO,OAAO;KACd,kBAAkB;KAClB,SAAS,kBAAkB,EAAE,IAAI,MAAM,SAAS,CAAC;KACjD,SAAS,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACjC,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK,KAAA;KACjC,OAAO,gBAAgB,EAAE,IAAI,MAAM,OAAO,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,MAAM,KAAKI,sBAAsB,KAAK,QAAQ,mBAAmB,EAAE,IAAI,MAAM,UAAU,CAAC,CAAC;IACxG,OAAO,EAAE,KAAK;KAAE,GAAG;KAAM;IAAO,CAAC;GACnC;EACF,CAAC,CACH;CACF;CAEA,MAAMC,eAAe,GAAiF;EACpG,MAAM,KAAKP,MAAM,WAAW,CAAC;EAC7B,MAAM,SAAS,KAAKA,MAAM,OAAO,CAAC;EAClC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KAAK;GAAE,OAAO;GAAyB,SAAS;EAA4C,GAAG,GAAG,EAChH;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;AACF"}

package/dist/storage/domains/channel-identity/base.d.ts

@@ -84,6 +84,10 @@ export declare class ChannelIdentityStorage extends FactoryStorageDomain {
      * not change who may see or sever it.
      */
     listAccountLinksForUser(userId: string): Promise<ChannelAccountLinkEntry[]>;
+    /** All links bound to an organization, for the mention-roster fallback. */
+    listAccountLinksForOrg(orgId: string, { limit }?: {
+        limit?: number;
+    }): Promise<ChannelAccountLinkEntry[]>;
     /**
      * Remove one of the tenant user's own links, addressed by its sender key.
      * The `userId` guard makes the delete self-service only: a caller can never

package/dist/storage/domains/channel-identity/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/channel-identity/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,4BAA4B,EAAE,gBAoB1C,CAAC;AAwBF,4EAA4E;AAC5E,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;CAAG;AAatH,qBAAa,sBAAuB,SAAQ,oBAAoB;;;IAKxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C;;;;OAIG;IACG,eAAe,CAAC,EACpB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,gBAAgB,GACjB,EAAE,qBAAqB,GACtB,uBAAuB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkB5F;;;;;;;OAOG;IACG,iBAAiB,CAAC,EACtB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,gBAAgB,GACjB,EAAE,qBAAqB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjG,gFAAgF;IAC1E,cAAc,CAAC,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAS7D,0EAA0E;IACpE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9G;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAKjF;;;;OAIG;IACG,wBAAwB,CAAC,EAC7B,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CASjE"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/channel-identity/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,4BAA4B,EAAE,gBA0B1C,CAAC;AAwBF,4EAA4E;AAC5E,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB;CAAG;AAatH,qBAAa,sBAAuB,SAAQ,oBAAoB;;;IAKxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C;;;;OAIG;IACG,eAAe,CAAC,EACpB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,gBAAgB,GACjB,EAAE,qBAAqB,GACtB,uBAAuB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkB5F;;;;;;;OAOG;IACG,iBAAiB,CAAC,EACtB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,gBAAgB,GACjB,EAAE,qBAAqB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjG,gFAAgF;IAC1E,cAAc,CAAC,EACnB,QAAQ,EACR,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAS7D,0EAA0E;IACpE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9G;;;;;OAKG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAKjF,2EAA2E;IACrE,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,EAAE,KAAW,EAAE,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAerC;;;;OAIG;IACG,wBAAwB,CAAC,EAC7B,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,GACf,EAAE,qBAAqB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CASjE"}

package/dist/storage/domains/channel-identity/base.js

@@ -33,6 +33,14 @@ const CHANNEL_ACCOUNT_LINKS_SCHEMA = {
 			"external_team_id",
 			"external_user_id"
 		]
+	}],
+	indexes: [{
+		name: "channel_account_links_org_linked_at_id_idx",
+		columns: [
+			"org_id",
+			"linked_at",
+			"id"
+		]
 	}]
 };
 function toLink(row) {
@@ -129,6 +137,13 @@ var ChannelIdentityStorage = class extends FactoryStorageDomain {
 	async listAccountLinksForUser(userId) {
 		return (await this.#db.findMany("channel_account_links", { user_id: userId })).map(toEntry);
 	}
+	/** All links bound to an organization, for the mention-roster fallback. */
+	async listAccountLinksForOrg(orgId, { limit = 200 } = {}) {
+		return (await this.#db.findMany("channel_account_links", { org_id: orgId }, {
+			orderBy: [["linked_at", "desc"], ["id", "desc"]],
+			limit
+		})).map(toEntry);
+	}
 	/**
 	* Remove one of the tenant user's own links, addressed by its sender key.
 	* The `userId` guard makes the delete self-service only: a caller can never

package/dist/storage/domains/channel-identity/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","names":["#db"],"sources":["../../../../src/storage/domains/channel-identity/base.ts"],"sourcesContent":["import { FactoryStorageDomain } from '@mastra/core/storage';\nimport type { CollectionSchema, FactoryStorageOps } from '@mastra/core/storage';\n\n/**\n * A reverse index from a platform sender identity to a Mastra tenant.\n *\n * Inbound channel events (a Slack DM, a Discord mention, ...) carry only the\n * platform-side sender ids — there is no Mastra `(orgId, userId)` on the event.\n * Model credentials, however, resolve **per-tenant**, so a channel run cannot\n * load the sender's stored model credentials until we know which tenant the\n * sender is. This domain holds that mapping: an authenticated web user links\n * their platform account, and the dispatch seam reads it back to stamp the\n * tenant onto the run's request context.\n *\n * One row per `(platform, external_team_id, external_user_id)` — the same\n * platform user in two workspaces (two team ids) is two independent links, so\n * multi-workspace falls out of the key. `platform` is generic (`'slack'` today,\n * reusable for Discord/Telegram later). The `external_` prefix disambiguates\n * the platform-side ids from the tenant ids (`org_id` / `user_id`) that cohabit\n * the row.\n */\nexport interface ChannelAccountLink {\n  /** Undefined for personal accounts (no organization). */\n  orgId?: string;\n  userId: string;\n  /**\n   * Which Factory project this sender's channel runs route to. Unset until\n   * the user picks one (or the dispatch path auto-stamps their only factory).\n   */\n  defaultFactoryProjectId?: string;\n  linkedAt: Date;\n}\n\n/** The reverse-lookup key: a platform sender identity. */\nexport interface ChannelAccountLinkKey {\n  platform: string;\n  externalTeamId: string;\n  externalUserId: string;\n}\n\n/**\n * Human-readable labels for a linked identity, captured at link time (e.g.\n * from Slack OIDC id_token claims). Display-only — never part of the key.\n */\nexport interface ChannelAccountLinkNames {\n  externalTeamName?: string;\n  externalUserName?: string;\n}\n\nexport const CHANNEL_ACCOUNT_LINKS_SCHEMA: CollectionSchema = {\n  name: 'channel_account_links',\n  columns: {\n    id: { type: 'uuid-pk' },\n    platform: { type: 'text' },\n    external_team_id: { type: 'text' },\n    external_user_id: { type: 'text' },\n    org_id: { type: 'text', nullable: true },\n    user_id: { type: 'text' },\n    external_team_name: { type: 'text', nullable: true },\n    external_user_name: { type: 'text', nullable: true },\n    default_factory_project_id: { type: 'text', nullable: true },\n    linked_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    {\n      name: 'channel_account_links_sender_key',\n      columns: ['platform', 'external_team_id', 'external_user_id'],\n    },\n  ],\n};\n\ninterface ChannelAccountLinkDbRow extends Record<string, unknown> {\n  id: string;\n  platform: string;\n  external_team_id: string;\n  external_user_id: string;\n  org_id: string | null;\n  user_id: string;\n  external_team_name: string | null;\n  external_user_name: string | null;\n  default_factory_project_id: string | null;\n  linked_at: Date;\n}\n\nfunction toLink(row: ChannelAccountLinkDbRow): ChannelAccountLink {\n  return {\n    ...(row.org_id ? { orgId: row.org_id } : {}),\n    userId: row.user_id,\n    ...(row.default_factory_project_id ? { defaultFactoryProjectId: row.default_factory_project_id } : {}),\n    linkedAt: row.linked_at,\n  };\n}\n\n/** A link row with its platform sender key, as listed for a tenant user. */\nexport interface ChannelAccountLinkEntry extends ChannelAccountLink, ChannelAccountLinkKey, ChannelAccountLinkNames {}\n\nfunction toEntry(row: ChannelAccountLinkDbRow): ChannelAccountLinkEntry {\n  return {\n    ...toLink(row),\n    platform: row.platform,\n    externalTeamId: row.external_team_id,\n    externalUserId: row.external_user_id,\n    ...(row.external_team_name ? { externalTeamName: row.external_team_name } : {}),\n    ...(row.external_user_name ? { externalUserName: row.external_user_name } : {}),\n  };\n}\n\nexport class ChannelIdentityStorage extends FactoryStorageDomain {\n  constructor() {\n    super('channel-identity');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([CHANNEL_ACCOUNT_LINKS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('channel_account_links', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /**\n   * Bind a platform sender identity to a Mastra tenant. Last-write-wins: a\n   * re-link (e.g. the same Slack user connecting a different tenant) replaces\n   * the stored tenant and refreshes `linkedAt`.\n   */\n  async saveAccountLink({\n    platform,\n    externalTeamId,\n    externalUserId,\n    orgId,\n    userId,\n    externalTeamName,\n    externalUserName,\n  }: ChannelAccountLinkKey &\n    ChannelAccountLinkNames & { orgId?: string; userId: string }): Promise<ChannelAccountLink> {\n    const row = await this.#db.upsertOne<ChannelAccountLinkDbRow>(\n      'channel_account_links',\n      ['platform', 'external_team_id', 'external_user_id'],\n      {\n        platform,\n        external_team_id: externalTeamId,\n        external_user_id: externalUserId,\n        org_id: orgId ?? null,\n        user_id: userId,\n        external_team_name: externalTeamName ?? null,\n        external_user_name: externalUserName ?? null,\n        linked_at: new Date(),\n      },\n    );\n    return toLink(row);\n  }\n\n  /**\n   * Set (or clear, with `null`) which Factory project a link's channel runs\n   * route to. The `userId` guard makes this self-service only — a caller can\n   * never repoint another tenant's link. Returns whether a row was updated.\n   *\n   * Note: `saveAccountLink` deliberately omits this column from its upsert\n   * row, so a re-link keeps the stored default.\n   */\n  async setDefaultFactory({\n    platform,\n    externalTeamId,\n    externalUserId,\n    userId,\n    factoryProjectId,\n  }: ChannelAccountLinkKey & { userId: string; factoryProjectId: string | null }): Promise<boolean> {\n    const updated = await this.#db.updateMany(\n      'channel_account_links',\n      {\n        user_id: userId,\n        platform,\n        external_team_id: externalTeamId,\n        external_user_id: externalUserId,\n      },\n      { default_factory_project_id: factoryProjectId },\n    );\n    return updated > 0;\n  }\n\n  /** Resolve the tenant a platform sender is linked to, or `null` if unlinked. */\n  async getAccountLink({\n    platform,\n    externalTeamId,\n    externalUserId,\n  }: ChannelAccountLinkKey): Promise<ChannelAccountLink | null> {\n    const row = await this.#db.findOne<ChannelAccountLinkDbRow>('channel_account_links', {\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return row ? toLink(row) : null;\n  }\n\n  /** Remove a platform sender's link. Returns whether a row was deleted. */\n  async deleteAccountLink({ platform, externalTeamId, externalUserId }: ChannelAccountLinkKey): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('channel_account_links', {\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return deleted > 0;\n  }\n\n  /**\n   * All platform identities linked to a tenant user, for the \"Connected\n   * accounts\" settings surface. Keyed by the tenant `userId` alone — a link\n   * belongs to the person, and their personal/org context at link time does\n   * not change who may see or sever it.\n   */\n  async listAccountLinksForUser(userId: string): Promise<ChannelAccountLinkEntry[]> {\n    const rows = await this.#db.findMany<ChannelAccountLinkDbRow>('channel_account_links', { user_id: userId });\n    return rows.map(toEntry);\n  }\n\n  /**\n   * Remove one of the tenant user's own links, addressed by its sender key.\n   * The `userId` guard makes the delete self-service only: a caller can never\n   * sever another tenant's link even with a known sender key.\n   */\n  async deleteAccountLinkForUser({\n    userId,\n    platform,\n    externalTeamId,\n    externalUserId,\n  }: ChannelAccountLinkKey & { userId: string }): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('channel_account_links', {\n      user_id: userId,\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return deleted > 0;\n  }\n}\n"],"mappings":";;AAiDA,MAAa,+BAAiD;CAC5D,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,UAAU,EAAE,MAAM,OAAO;EACzB,kBAAkB,EAAE,MAAM,OAAO;EACjC,kBAAkB,EAAE,MAAM,OAAO;EACjC,QAAQ;GAAE,MAAM;GAAQ,UAAU;EAAK;EACvC,SAAS,EAAE,MAAM,OAAO;EACxB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,4BAA4B;GAAE,MAAM;GAAQ,UAAU;EAAK;EAC3D,WAAW,EAAE,MAAM,YAAY;CACjC;CACA,eAAe,CACb;EACE,MAAM;EACN,SAAS;GAAC;GAAY;GAAoB;EAAkB;CAC9D,CACF;AACF;AAeA,SAAS,OAAO,KAAkD;CAChE,OAAO;EACL,GAAI,IAAI,SAAS,EAAE,OAAO,IAAI,OAAO,IAAI,CAAC;EAC1C,QAAQ,IAAI;EACZ,GAAI,IAAI,6BAA6B,EAAE,yBAAyB,IAAI,2BAA2B,IAAI,CAAC;EACpG,UAAU,IAAI;CAChB;AACF;AAKA,SAAS,QAAQ,KAAuD;CACtE,OAAO;EACL,GAAG,OAAO,GAAG;EACb,UAAU,IAAI;EACd,gBAAgB,IAAI;EACpB,gBAAgB,IAAI;EACpB,GAAI,IAAI,qBAAqB,EAAE,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;EAC7E,GAAI,IAAI,qBAAqB,EAAE,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;CAC/E;AACF;AAEA,IAAa,yBAAb,cAA4C,qBAAqB;CAC/D,cAAc;EACZ,MAAM,kBAAkB;CAC1B;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,4BAA4B,CAAC;CAC7D;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,yBAAyB,CAAC,CAAC;CACvD;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;;;;;CAOA,MAAM,gBAAgB,EACpB,UACA,gBACA,gBACA,OACA,QACA,kBACA,oBAE2F;EAe3F,OAAO,OAAO,MAdI,KAAKA,IAAI,UACzB,yBACA;GAAC;GAAY;GAAoB;EAAkB,GACnD;GACE;GACA,kBAAkB;GAClB,kBAAkB;GAClB,QAAQ,SAAS;GACjB,SAAS;GACT,oBAAoB,oBAAoB;GACxC,oBAAoB,oBAAoB;GACxC,2BAAW,IAAI,KAAK;EACtB,CACF,CACiB;CACnB;;;;;;;;;CAUA,MAAM,kBAAkB,EACtB,UACA,gBACA,gBACA,QACA,oBACgG;EAWhG,OAAO,MAVe,KAAKA,IAAI,WAC7B,yBACA;GACE,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;EACpB,GACA,EAAE,4BAA4B,iBAAiB,CACjD,IACiB;CACnB;;CAGA,MAAM,eAAe,EACnB,UACA,gBACA,kBAC4D;EAC5D,MAAM,MAAM,MAAM,KAAKA,IAAI,QAAiC,yBAAyB;GACnF;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC;EACD,OAAO,MAAM,OAAO,GAAG,IAAI;CAC7B;;CAGA,MAAM,kBAAkB,EAAE,UAAU,gBAAgB,kBAA2D;EAM7G,OAAO,MALe,KAAKA,IAAI,WAAW,yBAAyB;GACjE;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC,IACgB;CACnB;;;;;;;CAQA,MAAM,wBAAwB,QAAoD;EAEhF,QAAO,MADY,KAAKA,IAAI,SAAkC,yBAAyB,EAAE,SAAS,OAAO,CAAC,EAAA,CAC9F,IAAI,OAAO;CACzB;;;;;;CAOA,MAAM,yBAAyB,EAC7B,QACA,UACA,gBACA,kBAC+D;EAO/D,OAAO,MANe,KAAKA,IAAI,WAAW,yBAAyB;GACjE,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC,IACgB;CACnB;AACF"}
+{"version":3,"file":"base.js","names":["#db"],"sources":["../../../../src/storage/domains/channel-identity/base.ts"],"sourcesContent":["import { FactoryStorageDomain } from '@mastra/core/storage';\nimport type { CollectionSchema, FactoryStorageOps } from '@mastra/core/storage';\n\n/**\n * A reverse index from a platform sender identity to a Mastra tenant.\n *\n * Inbound channel events (a Slack DM, a Discord mention, ...) carry only the\n * platform-side sender ids — there is no Mastra `(orgId, userId)` on the event.\n * Model credentials, however, resolve **per-tenant**, so a channel run cannot\n * load the sender's stored model credentials until we know which tenant the\n * sender is. This domain holds that mapping: an authenticated web user links\n * their platform account, and the dispatch seam reads it back to stamp the\n * tenant onto the run's request context.\n *\n * One row per `(platform, external_team_id, external_user_id)` — the same\n * platform user in two workspaces (two team ids) is two independent links, so\n * multi-workspace falls out of the key. `platform` is generic (`'slack'` today,\n * reusable for Discord/Telegram later). The `external_` prefix disambiguates\n * the platform-side ids from the tenant ids (`org_id` / `user_id`) that cohabit\n * the row.\n */\nexport interface ChannelAccountLink {\n  /** Undefined for personal accounts (no organization). */\n  orgId?: string;\n  userId: string;\n  /**\n   * Which Factory project this sender's channel runs route to. Unset until\n   * the user picks one (or the dispatch path auto-stamps their only factory).\n   */\n  defaultFactoryProjectId?: string;\n  linkedAt: Date;\n}\n\n/** The reverse-lookup key: a platform sender identity. */\nexport interface ChannelAccountLinkKey {\n  platform: string;\n  externalTeamId: string;\n  externalUserId: string;\n}\n\n/**\n * Human-readable labels for a linked identity, captured at link time (e.g.\n * from Slack OIDC id_token claims). Display-only — never part of the key.\n */\nexport interface ChannelAccountLinkNames {\n  externalTeamName?: string;\n  externalUserName?: string;\n}\n\nexport const CHANNEL_ACCOUNT_LINKS_SCHEMA: CollectionSchema = {\n  name: 'channel_account_links',\n  columns: {\n    id: { type: 'uuid-pk' },\n    platform: { type: 'text' },\n    external_team_id: { type: 'text' },\n    external_user_id: { type: 'text' },\n    org_id: { type: 'text', nullable: true },\n    user_id: { type: 'text' },\n    external_team_name: { type: 'text', nullable: true },\n    external_user_name: { type: 'text', nullable: true },\n    default_factory_project_id: { type: 'text', nullable: true },\n    linked_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    {\n      name: 'channel_account_links_sender_key',\n      columns: ['platform', 'external_team_id', 'external_user_id'],\n    },\n  ],\n  indexes: [\n    {\n      name: 'channel_account_links_org_linked_at_id_idx',\n      columns: ['org_id', 'linked_at', 'id'],\n    },\n  ],\n};\n\ninterface ChannelAccountLinkDbRow extends Record<string, unknown> {\n  id: string;\n  platform: string;\n  external_team_id: string;\n  external_user_id: string;\n  org_id: string | null;\n  user_id: string;\n  external_team_name: string | null;\n  external_user_name: string | null;\n  default_factory_project_id: string | null;\n  linked_at: Date;\n}\n\nfunction toLink(row: ChannelAccountLinkDbRow): ChannelAccountLink {\n  return {\n    ...(row.org_id ? { orgId: row.org_id } : {}),\n    userId: row.user_id,\n    ...(row.default_factory_project_id ? { defaultFactoryProjectId: row.default_factory_project_id } : {}),\n    linkedAt: row.linked_at,\n  };\n}\n\n/** A link row with its platform sender key, as listed for a tenant user. */\nexport interface ChannelAccountLinkEntry extends ChannelAccountLink, ChannelAccountLinkKey, ChannelAccountLinkNames {}\n\nfunction toEntry(row: ChannelAccountLinkDbRow): ChannelAccountLinkEntry {\n  return {\n    ...toLink(row),\n    platform: row.platform,\n    externalTeamId: row.external_team_id,\n    externalUserId: row.external_user_id,\n    ...(row.external_team_name ? { externalTeamName: row.external_team_name } : {}),\n    ...(row.external_user_name ? { externalUserName: row.external_user_name } : {}),\n  };\n}\n\nexport class ChannelIdentityStorage extends FactoryStorageDomain {\n  constructor() {\n    super('channel-identity');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([CHANNEL_ACCOUNT_LINKS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('channel_account_links', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /**\n   * Bind a platform sender identity to a Mastra tenant. Last-write-wins: a\n   * re-link (e.g. the same Slack user connecting a different tenant) replaces\n   * the stored tenant and refreshes `linkedAt`.\n   */\n  async saveAccountLink({\n    platform,\n    externalTeamId,\n    externalUserId,\n    orgId,\n    userId,\n    externalTeamName,\n    externalUserName,\n  }: ChannelAccountLinkKey &\n    ChannelAccountLinkNames & { orgId?: string; userId: string }): Promise<ChannelAccountLink> {\n    const row = await this.#db.upsertOne<ChannelAccountLinkDbRow>(\n      'channel_account_links',\n      ['platform', 'external_team_id', 'external_user_id'],\n      {\n        platform,\n        external_team_id: externalTeamId,\n        external_user_id: externalUserId,\n        org_id: orgId ?? null,\n        user_id: userId,\n        external_team_name: externalTeamName ?? null,\n        external_user_name: externalUserName ?? null,\n        linked_at: new Date(),\n      },\n    );\n    return toLink(row);\n  }\n\n  /**\n   * Set (or clear, with `null`) which Factory project a link's channel runs\n   * route to. The `userId` guard makes this self-service only — a caller can\n   * never repoint another tenant's link. Returns whether a row was updated.\n   *\n   * Note: `saveAccountLink` deliberately omits this column from its upsert\n   * row, so a re-link keeps the stored default.\n   */\n  async setDefaultFactory({\n    platform,\n    externalTeamId,\n    externalUserId,\n    userId,\n    factoryProjectId,\n  }: ChannelAccountLinkKey & { userId: string; factoryProjectId: string | null }): Promise<boolean> {\n    const updated = await this.#db.updateMany(\n      'channel_account_links',\n      {\n        user_id: userId,\n        platform,\n        external_team_id: externalTeamId,\n        external_user_id: externalUserId,\n      },\n      { default_factory_project_id: factoryProjectId },\n    );\n    return updated > 0;\n  }\n\n  /** Resolve the tenant a platform sender is linked to, or `null` if unlinked. */\n  async getAccountLink({\n    platform,\n    externalTeamId,\n    externalUserId,\n  }: ChannelAccountLinkKey): Promise<ChannelAccountLink | null> {\n    const row = await this.#db.findOne<ChannelAccountLinkDbRow>('channel_account_links', {\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return row ? toLink(row) : null;\n  }\n\n  /** Remove a platform sender's link. Returns whether a row was deleted. */\n  async deleteAccountLink({ platform, externalTeamId, externalUserId }: ChannelAccountLinkKey): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('channel_account_links', {\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return deleted > 0;\n  }\n\n  /**\n   * All platform identities linked to a tenant user, for the \"Connected\n   * accounts\" settings surface. Keyed by the tenant `userId` alone — a link\n   * belongs to the person, and their personal/org context at link time does\n   * not change who may see or sever it.\n   */\n  async listAccountLinksForUser(userId: string): Promise<ChannelAccountLinkEntry[]> {\n    const rows = await this.#db.findMany<ChannelAccountLinkDbRow>('channel_account_links', { user_id: userId });\n    return rows.map(toEntry);\n  }\n\n  /** All links bound to an organization, for the mention-roster fallback. */\n  async listAccountLinksForOrg(\n    orgId: string,\n    { limit = 200 }: { limit?: number } = {},\n  ): Promise<ChannelAccountLinkEntry[]> {\n    const rows = await this.#db.findMany<ChannelAccountLinkDbRow>(\n      'channel_account_links',\n      { org_id: orgId },\n      {\n        orderBy: [\n          ['linked_at', 'desc'],\n          ['id', 'desc'],\n        ],\n        limit,\n      },\n    );\n    return rows.map(toEntry);\n  }\n\n  /**\n   * Remove one of the tenant user's own links, addressed by its sender key.\n   * The `userId` guard makes the delete self-service only: a caller can never\n   * sever another tenant's link even with a known sender key.\n   */\n  async deleteAccountLinkForUser({\n    userId,\n    platform,\n    externalTeamId,\n    externalUserId,\n  }: ChannelAccountLinkKey & { userId: string }): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('channel_account_links', {\n      user_id: userId,\n      platform,\n      external_team_id: externalTeamId,\n      external_user_id: externalUserId,\n    });\n    return deleted > 0;\n  }\n}\n"],"mappings":";;AAiDA,MAAa,+BAAiD;CAC5D,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,UAAU,EAAE,MAAM,OAAO;EACzB,kBAAkB,EAAE,MAAM,OAAO;EACjC,kBAAkB,EAAE,MAAM,OAAO;EACjC,QAAQ;GAAE,MAAM;GAAQ,UAAU;EAAK;EACvC,SAAS,EAAE,MAAM,OAAO;EACxB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,4BAA4B;GAAE,MAAM;GAAQ,UAAU;EAAK;EAC3D,WAAW,EAAE,MAAM,YAAY;CACjC;CACA,eAAe,CACb;EACE,MAAM;EACN,SAAS;GAAC;GAAY;GAAoB;EAAkB;CAC9D,CACF;CACA,SAAS,CACP;EACE,MAAM;EACN,SAAS;GAAC;GAAU;GAAa;EAAI;CACvC,CACF;AACF;AAeA,SAAS,OAAO,KAAkD;CAChE,OAAO;EACL,GAAI,IAAI,SAAS,EAAE,OAAO,IAAI,OAAO,IAAI,CAAC;EAC1C,QAAQ,IAAI;EACZ,GAAI,IAAI,6BAA6B,EAAE,yBAAyB,IAAI,2BAA2B,IAAI,CAAC;EACpG,UAAU,IAAI;CAChB;AACF;AAKA,SAAS,QAAQ,KAAuD;CACtE,OAAO;EACL,GAAG,OAAO,GAAG;EACb,UAAU,IAAI;EACd,gBAAgB,IAAI;EACpB,gBAAgB,IAAI;EACpB,GAAI,IAAI,qBAAqB,EAAE,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;EAC7E,GAAI,IAAI,qBAAqB,EAAE,kBAAkB,IAAI,mBAAmB,IAAI,CAAC;CAC/E;AACF;AAEA,IAAa,yBAAb,cAA4C,qBAAqB;CAC/D,cAAc;EACZ,MAAM,kBAAkB;CAC1B;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,4BAA4B,CAAC;CAC7D;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,yBAAyB,CAAC,CAAC;CACvD;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;;;;;CAOA,MAAM,gBAAgB,EACpB,UACA,gBACA,gBACA,OACA,QACA,kBACA,oBAE2F;EAe3F,OAAO,OAAO,MAdI,KAAKA,IAAI,UACzB,yBACA;GAAC;GAAY;GAAoB;EAAkB,GACnD;GACE;GACA,kBAAkB;GAClB,kBAAkB;GAClB,QAAQ,SAAS;GACjB,SAAS;GACT,oBAAoB,oBAAoB;GACxC,oBAAoB,oBAAoB;GACxC,2BAAW,IAAI,KAAK;EACtB,CACF,CACiB;CACnB;;;;;;;;;CAUA,MAAM,kBAAkB,EACtB,UACA,gBACA,gBACA,QACA,oBACgG;EAWhG,OAAO,MAVe,KAAKA,IAAI,WAC7B,yBACA;GACE,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;EACpB,GACA,EAAE,4BAA4B,iBAAiB,CACjD,IACiB;CACnB;;CAGA,MAAM,eAAe,EACnB,UACA,gBACA,kBAC4D;EAC5D,MAAM,MAAM,MAAM,KAAKA,IAAI,QAAiC,yBAAyB;GACnF;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC;EACD,OAAO,MAAM,OAAO,GAAG,IAAI;CAC7B;;CAGA,MAAM,kBAAkB,EAAE,UAAU,gBAAgB,kBAA2D;EAM7G,OAAO,MALe,KAAKA,IAAI,WAAW,yBAAyB;GACjE;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC,IACgB;CACnB;;;;;;;CAQA,MAAM,wBAAwB,QAAoD;EAEhF,QAAO,MADY,KAAKA,IAAI,SAAkC,yBAAyB,EAAE,SAAS,OAAO,CAAC,EAAA,CAC9F,IAAI,OAAO;CACzB;;CAGA,MAAM,uBACJ,OACA,EAAE,QAAQ,QAA4B,CAAC,GACH;EAYpC,QAAO,MAXY,KAAKA,IAAI,SAC1B,yBACA,EAAE,QAAQ,MAAM,GAChB;GACE,SAAS,CACP,CAAC,aAAa,MAAM,GACpB,CAAC,MAAM,MAAM,CACf;GACA;EACF,CACF,EAAA,CACY,IAAI,OAAO;CACzB;;;;;;CAOA,MAAM,yBAAyB,EAC7B,QACA,UACA,gBACA,kBAC+D;EAO/D,OAAO,MANe,KAAKA,IAAI,WAAW,yBAAyB;GACjE,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;EACpB,CAAC,IACgB;CACnB;AACF"}

package/dist/storage/domains/comments/actor.d.ts

@@ -0,0 +1,51 @@
+/**
+ * FactoryActorRef — the one author contract for everything a person, agent, or
+ * integration writes into a factory (comment rows today; thread-message
+ * attribution and agent-authored entries reuse it later).
+ *
+ * Conventions:
+ * - Agent actor ids are `agent:<bindingId>` (the transition-service convention):
+ *   a binding id routes back to the live session via run bindings. Audit's
+ *   `agent:<threadId>` form diverges; both satisfy `isAgentActor`.
+ * - `id` is a namespaced string: only bare WorkOS ids (no `:`) are resolvable
+ *   or mentionable. External senders get `<platform>:<externalUserId>` plus a
+ *   display snapshot captured at write time.
+ */
+import type { ChannelAccountLink } from '../channel-identity/base.js';
+export type FactoryActorKind = 'user' | 'agent' | 'integration';
+/**
+ * Superset of core's channel author metadata — deliberately NOT that exact
+ * shape: `teamId` lives on the raw platform event (never on the author), and
+ * `channel_account_links` keys on `(platform, teamId, userId)`, so ingest must
+ * capture it here or the identity is unlinkable.
+ */
+export interface FactoryActorExternalIdentity {
+    platform: string;
+    teamId?: string;
+    messageId?: string;
+    userId: string;
+    userName?: string;
+    fullName?: string;
+    mention?: string;
+    isBot?: boolean | 'unknown';
+}
+export interface FactoryActorRef {
+    kind: FactoryActorKind;
+    id: string;
+    displayName?: string;
+    avatarUrl?: string;
+    external?: FactoryActorExternalIdentity;
+}
+export declare function isMentionableActorId(id: string): boolean;
+export declare function actorFromAuthUser(userId: string, user?: {
+    name?: string;
+    email?: string;
+    avatarUrl?: string;
+}): FactoryActorRef;
+export declare function actorFromAgentBinding(bindingId: string, displayName?: string): FactoryActorRef;
+/**
+ * A linked platform sender becomes the linked tenant user; an unlinked one
+ * stays a namespaced external identity with its display snapshot.
+ */
+export declare function actorFromChannelAuthor(external: FactoryActorExternalIdentity, link?: Pick<ChannelAccountLink, 'userId'> | null): FactoryActorRef;
+//# sourceMappingURL=actor.d.ts.map

package/dist/storage/domains/comments/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/comments/actor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,4BAA4B,CAAC;CACzC;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,eAAe,CASjB;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,eAAe,CAM9F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,4BAA4B,EACtC,IAAI,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAAG,IAAI,GAC/C,eAAe,CAQjB"}

package/dist/storage/domains/comments/actor.js

@@ -0,0 +1,38 @@
+//#region src/storage/domains/comments/actor.ts
+function isMentionableActorId(id) {
+	return id.length > 0 && !id.includes(":");
+}
+function actorFromAuthUser(userId, user) {
+	const displayName = user?.name?.trim() || user?.email?.trim();
+	const avatarUrl = user?.avatarUrl?.trim();
+	return {
+		kind: "user",
+		id: userId,
+		...displayName ? { displayName } : {},
+		...avatarUrl ? { avatarUrl } : {}
+	};
+}
+function actorFromAgentBinding(bindingId, displayName) {
+	return {
+		kind: "agent",
+		id: `agent:${bindingId}`,
+		...displayName ? { displayName } : {}
+	};
+}
+/**
+* A linked platform sender becomes the linked tenant user; an unlinked one
+* stays a namespaced external identity with its display snapshot.
+*/
+function actorFromChannelAuthor(external, link) {
+	const displayName = external.fullName?.trim() || external.userName?.trim();
+	return {
+		kind: "user",
+		id: link?.userId ?? `${external.platform}:${external.userId}`,
+		...displayName ? { displayName } : {},
+		external
+	};
+}
+//#endregion
+export { actorFromAgentBinding, actorFromAuthUser, actorFromChannelAuthor, isMentionableActorId };
+
+//# sourceMappingURL=actor.js.map

package/dist/storage/domains/comments/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","names":[],"sources":["../../../../src/storage/domains/comments/actor.ts"],"sourcesContent":["/**\n * FactoryActorRef — the one author contract for everything a person, agent, or\n * integration writes into a factory (comment rows today; thread-message\n * attribution and agent-authored entries reuse it later).\n *\n * Conventions:\n * - Agent actor ids are `agent:<bindingId>` (the transition-service convention):\n *   a binding id routes back to the live session via run bindings. Audit's\n *   `agent:<threadId>` form diverges; both satisfy `isAgentActor`.\n * - `id` is a namespaced string: only bare WorkOS ids (no `:`) are resolvable\n *   or mentionable. External senders get `<platform>:<externalUserId>` plus a\n *   display snapshot captured at write time.\n */\n\nimport type { ChannelAccountLink } from '../channel-identity/base.js';\n\nexport type FactoryActorKind = 'user' | 'agent' | 'integration';\n\n/**\n * Superset of core's channel author metadata — deliberately NOT that exact\n * shape: `teamId` lives on the raw platform event (never on the author), and\n * `channel_account_links` keys on `(platform, teamId, userId)`, so ingest must\n * capture it here or the identity is unlinkable.\n */\nexport interface FactoryActorExternalIdentity {\n  platform: string;\n  teamId?: string;\n  messageId?: string;\n  userId: string;\n  userName?: string;\n  fullName?: string;\n  mention?: string;\n  isBot?: boolean | 'unknown';\n}\n\nexport interface FactoryActorRef {\n  kind: FactoryActorKind;\n  id: string;\n  displayName?: string;\n  avatarUrl?: string;\n  external?: FactoryActorExternalIdentity;\n}\n\nexport function isMentionableActorId(id: string): boolean {\n  return id.length > 0 && !id.includes(':');\n}\n\nexport function actorFromAuthUser(\n  userId: string,\n  user?: { name?: string; email?: string; avatarUrl?: string },\n): FactoryActorRef {\n  const displayName = user?.name?.trim() || user?.email?.trim();\n  const avatarUrl = user?.avatarUrl?.trim();\n  return {\n    kind: 'user',\n    id: userId,\n    ...(displayName ? { displayName } : {}),\n    ...(avatarUrl ? { avatarUrl } : {}),\n  };\n}\n\nexport function actorFromAgentBinding(bindingId: string, displayName?: string): FactoryActorRef {\n  return {\n    kind: 'agent',\n    id: `agent:${bindingId}`,\n    ...(displayName ? { displayName } : {}),\n  };\n}\n\n/**\n * A linked platform sender becomes the linked tenant user; an unlinked one\n * stays a namespaced external identity with its display snapshot.\n */\nexport function actorFromChannelAuthor(\n  external: FactoryActorExternalIdentity,\n  link?: Pick<ChannelAccountLink, 'userId'> | null,\n): FactoryActorRef {\n  const displayName = external.fullName?.trim() || external.userName?.trim();\n  return {\n    kind: 'user',\n    id: link?.userId ?? `${external.platform}:${external.userId}`,\n    ...(displayName ? { displayName } : {}),\n    external,\n  };\n}\n"],"mappings":";AA2CA,SAAgB,qBAAqB,IAAqB;CACxD,OAAO,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,GAAG;AAC1C;AAEA,SAAgB,kBACd,QACA,MACiB;CACjB,MAAM,cAAc,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK;CAC5D,MAAM,YAAY,MAAM,WAAW,KAAK;CACxC,OAAO;EACL,MAAM;EACN,IAAI;EACJ,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;AAEA,SAAgB,sBAAsB,WAAmB,aAAuC;CAC9F,OAAO;EACL,MAAM;EACN,IAAI,SAAS;EACb,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC;AACF;;;;;AAMA,SAAgB,uBACd,UACA,MACiB;CACjB,MAAM,cAAc,SAAS,UAAU,KAAK,KAAK,SAAS,UAAU,KAAK;CACzE,OAAO;EACL,MAAM;EACN,IAAI,MAAM,UAAU,GAAG,SAAS,SAAS,GAAG,SAAS;EACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;EACrC;CACF;AACF"}

package/dist/storage/domains/comments/base.d.ts

@@ -0,0 +1,230 @@
+/**
+ * Work-item comments domain — one message list per work item, materialized
+ * from every source. Local creates and platform mirrors (Slack, Linear,
+ * GitHub) share one idempotency story: `external_source` json + derived
+ * `source_key` under a partial unique index, a local retry token being just
+ * another source (`local:comment:<uuid>`).
+ *
+ * Ordering is caller-settable `occurred_at`, never insert time — ingest
+ * backdates to the platform timestamp and retries arrive out of order.
+ * Deletes are soft: the tombstone holds the ordering and its kept
+ * `source_key` stops a redelivery from resurrecting the row.
+ */
+import { FactoryStorageDomain } from '@mastra/core/storage';
+import type { ExternalWorkItemSource } from '../work-items/base.js';
+import type { FactoryActorRef } from './actor.js';
+export { WORK_ITEM_COMMENT_MENTIONS_SCHEMA, WORK_ITEM_COMMENTS_SCHEMA } from './schema.js';
+export type WorkItemCommentKind = 'comment';
+export interface FactoryMentionRef {
+    kind: 'user';
+    id: string;
+}
+export interface WorkItemCommentReplyRef {
+    commentId: string;
+    quote?: string;
+    authorId?: string;
+    authorName?: string;
+}
+export interface WorkItemCommentRow {
+    id: string;
+    orgId: string;
+    factoryProjectId: string;
+    workItemId: string;
+    kind: WorkItemCommentKind;
+    body: string;
+    bodyFormat: string;
+    author: FactoryActorRef;
+    replyTo: WorkItemCommentReplyRef | null;
+    mentions: FactoryMentionRef[];
+    externalSource: ExternalWorkItemSource | null;
+    sourceKey: string | null;
+    occurredAt: Date;
+    editedAt: Date | null;
+    deletedAt: Date | null;
+    deletedBy: string | null;
+    revision: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface CreateWorkItemCommentInput {
+    orgId: string;
+    factoryProjectId: string;
+    workItemId: string;
+    author: FactoryActorRef;
+    body: string;
+    bodyFormat?: string;
+    replyTo?: WorkItemCommentReplyRef;
+    mentions?: FactoryMentionRef[];
+    externalSource?: ExternalWorkItemSource;
+    /** Local idempotent-retry token; mutually exclusive with `externalSource`. */
+    clientToken?: string;
+    occurredAt?: Date;
+}
+export interface EditWorkItemCommentInput {
+    orgId: string;
+    commentId: string;
+    body: string;
+    mentions?: FactoryMentionRef[];
+    /** The acting user; their own handle never becomes a mention row. */
+    editorId?: string;
+    /** When set, the edit only lands if the row is still at this revision. */
+    expectedRevision?: number;
+    now?: Date;
+}
+export interface EditWorkItemCommentResult {
+    comment: WorkItemCommentRow;
+    addedMentions: FactoryMentionRef[];
+    removedMentions: FactoryMentionRef[];
+}
+export interface ListWorkItemCommentsInput {
+    orgId: string;
+    factoryProjectId: string;
+    workItemId: string;
+    before?: string;
+    limit?: number;
+    /**
+     * Anchor the first page on this comment: it and every comment newer than it,
+     * so a deep link opens on the target instead of paging back to find it.
+     * Ignored when the comment is gone, or sits further back than one page holds.
+     */
+    around?: string;
+}
+/** A feed snapshot: how many comments the item had, and when it last moved. */
+export interface FeedActivitySnapshot {
+    commentCount: number;
+    feedActivityAt: Date;
+}
+/**
+ * The refresh reads its snapshot outside the write transaction, so two of them
+ * can interleave and the loser can write last. This is the one rule that keeps
+ * that from undoing a newer refresh: feed activity never moves backwards, and
+ * on the same stamp the fuller count wins.
+ *
+ * Known ceiling: a soft delete sharing a millisecond with a create leaves the
+ * count one high until the next feed mutation recounts. Closing that needs the
+ * aggregate read inside the write transaction, which the ops layer cannot do
+ * without checking out a second pool connection per open transaction.
+ */
+export declare function supersedesFeedActivity(next: FeedActivitySnapshot, stored: FeedActivitySnapshot): boolean;
+export interface WorkItemCommentPage {
+    comments: WorkItemCommentRow[];
+    nextCursor?: string;
+}
+export interface WorkItemMentionRow {
+    id: string;
+    commentId: string;
+    mentionedKind: 'user';
+    mentionedId: string;
+    authorId: string;
+    orgId: string;
+    factoryProjectId: string;
+    workItemId: string;
+    occurredAt: Date;
+}
+export declare const MAX_COMMENT_BODY_LENGTH = 16000;
+export declare const MAX_COMMENT_QUOTE_LENGTH = 500;
+export declare const MAX_COMMENT_MENTIONS = 20;
+/** The one body policy: HTTP parsing and the service both reject on it. */
+export declare function commentBodyError(body: string): string | undefined;
+export declare function clampCommentLimit(limit: number | undefined): number;
+export declare function encodeCommentCursor(row: WorkItemCommentRow): string;
+export declare function decodeCommentCursor(cursor: string): {
+    occurredAt: Date;
+    id: string;
+} | undefined;
+export declare function commentSourceKey(input: {
+    externalSource?: ExternalWorkItemSource;
+    clientToken?: string;
+}): string | null;
+/** A `clientToken` replay that resolved to a different work item or author. */
+export declare class CommentTokenConflictError extends Error {
+    constructor();
+}
+export declare class WorkItemCommentsStorage extends FactoryStorageDomain {
+    #private;
+    constructor();
+    init(): Promise<void>;
+    dangerouslyClearAll(): Promise<void>;
+    create(input: CreateWorkItemCommentInput): Promise<WorkItemCommentRow>;
+    /**
+     * Idempotent counter refresh on the parent work item: both columns are read
+     * back off the comments (never incremented or stamped with the wall clock —
+     * replays and races double an increment, and a replayed create would move a
+     * work item in the feed without adding a comment; a read-back can't drift).
+     * Read BEFORE `updateAtomic`: its mutator runs inside an open transaction
+     * holding a pool connection, and a query in there checks out a second one —
+     * concurrent posts would exhaust the pool. Reading outside means two
+     * refreshes can interleave, so the write goes through
+     * {@link supersedesFeedActivity} rather than landing whatever it read.
+     * Touches ONLY the counter columns: `revision`/`updated_at` are the
+     * stage-transition concurrency token.
+     */
+    refreshWorkItemFeedActivity({ orgId, factoryProjectId, workItemId, now, }: {
+        orgId: string;
+        factoryProjectId: string;
+        workItemId: string;
+        now?: Date;
+    }): Promise<void>;
+    get({ orgId, commentId }: {
+        orgId: string;
+        commentId: string;
+    }): Promise<WorkItemCommentRow | null>;
+    listByIds({ orgId, ids }: {
+        orgId: string;
+        ids: string[];
+    }): Promise<WorkItemCommentRow[]>;
+    list(input: ListWorkItemCommentsInput): Promise<WorkItemCommentPage>;
+    /**
+     * Newest non-deleted comments for run-context injection, newest-first (the
+     * caller reverses for display order).
+     */
+    listRecent({ orgId, factoryProjectId, workItemId, limit, }: {
+        orgId: string;
+        factoryProjectId: string;
+        workItemId: string;
+        limit: number;
+    }): Promise<WorkItemCommentRow[]>;
+    edit(input: EditWorkItemCommentInput): Promise<EditWorkItemCommentResult | 'conflict' | null>;
+    softDelete({ orgId, commentId, deletedBy, now, }: {
+        orgId: string;
+        commentId: string;
+        deletedBy: string;
+        now?: Date;
+    }): Promise<WorkItemCommentRow | null>;
+    /**
+     * Provenance write-back after an outbound publish. First platform wins, and
+     * an existing `source_key` is kept: replacing a `local:comment:<token>` one
+     * would let a client retry duplicate the row. So a web-born comment is never
+     * key-deduped against its own platform echo — the host's bot-sender check is
+     * the only echo layer for those rows (COR-1174).
+     */
+    attachExternalSource({ orgId, commentId, source, }: {
+        orgId: string;
+        commentId: string;
+        source: ExternalWorkItemSource;
+    }): Promise<WorkItemCommentRow | null>;
+    listMentionsForComment(commentId: string): Promise<WorkItemMentionRow[]>;
+    /** Keyset inbox read for the mention attention provider, newest-first. */
+    listMentionsForUser({ orgId, factoryProjectId, userId, before, limit, }: {
+        orgId: string;
+        factoryProjectId: string;
+        userId: string;
+        before?: {
+            occurredAt: Date;
+            id: string;
+        };
+        limit: number;
+    }): Promise<WorkItemMentionRow[]>;
+    countForWorkItem({ orgId, factoryProjectId, workItemId, }: {
+        orgId: string;
+        factoryProjectId: string;
+        workItemId: string;
+    }): Promise<number>;
+    /** Recent distinct comment authors of a project, for the roster fallback. */
+    listRecentAuthors({ orgId, factoryProjectId, limit, }: {
+        orgId: string;
+        factoryProjectId: string;
+        limit?: number;
+    }): Promise<FactoryActorRef[]>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/storage/domains/comments/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/comments/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAElF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAgC,eAAe,EAAE,MAAM,YAAY,CAAC;AAGhF,OAAO,EAAE,iCAAiC,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3F,MAAM,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE5C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,cAAc,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC9C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,IAAI,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAGxG;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKjE;AAKD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGnE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAOhG;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,GAAG,IAAI,CAOhB;AAED,+EAA+E;AAC/E,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AA2GD,qBAAa,uBAAwB,SAAQ,oBAAoB;;;IAKzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKpC,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuE5E;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,EAChC,KAAK,EACL,gBAAgB,EAChB,UAAU,EACV,GAAgB,GACjB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBX,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQnG,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAS1F,IAAI,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA2D1E;;;OAGG;IACG,UAAU,CAAC,EACf,KAAK,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,GACN,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAoB3B,IAAI,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,GAAG,UAAU,GAAG,IAAI,CAAC;IAqD7F,UAAU,CAAC,EACf,KAAK,EACL,SAAS,EACT,SAAS,EACT,GAAgB,GACjB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwBtC;;;;;;OAMG;IACG,oBAAoB,CAAC,EACzB,KAAK,EACL,SAAS,EACT,MAAM,GACP,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAgBhC,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI9E,0EAA0E;IACpE,mBAAmB,CAAC,EACxB,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,MAAM,EACN,KAAK,GACN,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE;YAAE,UAAU,EAAE,IAAI,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAoB3B,gBAAgB,CAAC,EACrB,KAAK,EACL,gBAAgB,EAChB,UAAU,GACX,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC;IAYnB,6EAA6E;IACvE,iBAAiB,CAAC,EACtB,KAAK,EACL,gBAAgB,EAChB,KAAW,GACZ,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAuD/B"}