@mastra/factory 0.14.0-alpha.2 → 0.14.0-alpha.3

package/dist/storage/domains/audit/agent-audit.js

@@ -1,28 +1,27 @@
+import { executableCommand, runsPullRequestCreate } from "../../../session/shell-commands.js";
 //#region src/storage/domains/audit/agent-audit.ts
 /** Match command-start positions while ignoring command text embedded in heredoc bodies. */
 const GIT_COMMIT_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+commit(?:\s|$)/;
 const GIT_PUSH_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+push(?:\s|$)/;
-function stripHeredocBodies(command) {
-	const lines = command.split("\n");
-	const executableLines = [];
-	let delimiter;
-	for (const line of lines) {
-		if (delimiter) {
-			if (line.trim() === delimiter) delimiter = void 0;
-			continue;
-		}
-		executableLines.push(line);
-		delimiter = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/)?.[2];
-	}
-	return executableLines.join("\n");
+/** `gh pr create` prints the new pull request URL alone on the last line, and nothing else does. */
+const CREATED_PULL_REQUEST_URL_RE = /^https:\/\/\S+\/pull\/\d+$/;
+/**
+* The pull request `gh pr create` actually opened, or nothing. A command that
+* printed no URL created no pull request: `--dry-run` prints a preview, `--web`
+* prints a `/compare/` link, and a failure prints its exit code last.
+*/
+function createdPullRequestUrl(output) {
+	if (typeof output !== "string") return void 0;
+	const lastLine = output.trimEnd().split("\n").at(-1)?.trim();
+	return lastLine !== void 0 && CREATED_PULL_REQUEST_URL_RE.test(lastLine) ? lastLine : void 0;
 }
 /** Parse the branch from a plain `git push <remote> <branch>` invocation. */
 function parsePushedBranch(command) {
 	return command.match(/(?:^|\n|;|&&|\|\|)\s*git\s+push\s+(?:-[^\s]+\s+)*([^\s;&|-][^\s;&|]*)\s+([^\s;&|-][^\s;&|]*)/)?.[2];
 }
 /**
-* Detect externally-visible git side effects in a completed tool call and
-* record `factory.agent.*` audit events for them. One command can emit
+* Detect externally-visible git and GitHub side effects in a completed tool
+* call and record `factory.agent.*` audit events for them. One command can emit
 * multiple events (`git commit && git push` emits both). Never throws.
 */
 async function observeAgentGitAction({ audit, toolContext }) {
@@ -30,16 +29,17 @@ async function observeAgentGitAction({ audit, toolContext }) {
 		if (toolContext.toolName !== "execute_command" || toolContext.error) return;
 		const rawCommand = toolContext.input?.command;
 		if (typeof rawCommand !== "string") return;
-		const command = stripHeredocBodies(rawCommand);
+		const command = executableCommand(rawCommand);
 		const worktreePath = toolContext.context.get("controller")?.scope;
+		const targets = worktreePath ? [{
+			type: "worktree",
+			id: worktreePath
+		}] : [];
 		if (GIT_COMMIT_RE.test(command)) await audit.emitAgent({
 			requestContext: toolContext.context,
 			input: {
 				action: "factory.agent.commit",
-				targets: worktreePath ? [{
-					type: "worktree",
-					id: worktreePath
-				}] : []
+				targets
 			}
 		});
 		if (GIT_PUSH_RE.test(command)) {
@@ -48,14 +48,23 @@ async function observeAgentGitAction({ audit, toolContext }) {
 				requestContext: toolContext.context,
 				input: {
 					action: "factory.agent.push",
-					targets: worktreePath ? [{
-						type: "worktree",
-						id: worktreePath
-					}] : [],
+					targets,
 					...branch ? { metadata: { branch } } : {}
 				}
 			});
 		}
+		const pullRequestUrl = runsPullRequestCreate(rawCommand) ? createdPullRequestUrl(toolContext.output) : void 0;
+		if (pullRequestUrl) await audit.emitAgent({
+			requestContext: toolContext.context,
+			input: {
+				action: "factory.agent.pr_opened",
+				targets: [{
+					type: "pull_request",
+					id: pullRequestUrl
+				}, ...targets],
+				metadata: { url: pullRequestUrl }
+			}
+		});
 	} catch (err) {
 		console.warn("[Audit] Failed to observe agent git action", { error: err instanceof Error ? err.message : String(err) });
 	}

package/dist/storage/domains/audit/agent-audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-audit.js","names":[],"sources":["../../../../src/storage/domains/audit/agent-audit.ts"],"sourcesContent":["/**\n * Agent-level audit event detection (Audit v1.1).\n *\n * Git actions performed by agents inside runs never touch web routes, so this\n * observer detects externally-visible git side effects and delegates recording\n * to the factory-owned audit domain.\n */\n\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport type { AuditAgentEmitter } from './domain.js';\n\ntype FactorySessionState = { factoryProjectId?: string; projectRepositoryId?: string };\n\ninterface ToolObserverContext {\n  toolName: string;\n  input: unknown;\n  output?: unknown;\n  error?: unknown;\n  context: RequestContext;\n}\n\n/** Match command-start positions while ignoring command text embedded in heredoc bodies. */\nconst GIT_COMMIT_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+commit(?:\\s|$)/;\nconst GIT_PUSH_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push(?:\\s|$)/;\n\nfunction stripHeredocBodies(command: string): string {\n  const lines = command.split('\\n');\n  const executableLines: string[] = [];\n  let delimiter: string | undefined;\n\n  for (const line of lines) {\n    if (delimiter) {\n      if (line.trim() === delimiter) delimiter = undefined;\n      continue;\n    }\n    executableLines.push(line);\n    const heredoc = line.match(/<<-?\\s*(['\"]?)([A-Za-z_][A-Za-z0-9_]*)\\1/);\n    delimiter = heredoc?.[2];\n  }\n\n  return executableLines.join('\\n');\n}\n\n/** Parse the branch from a plain `git push <remote> <branch>` invocation. */\nfunction parsePushedBranch(command: string): string | undefined {\n  const match = command.match(\n    /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push\\s+(?:-[^\\s]+\\s+)*([^\\s;&|-][^\\s;&|]*)\\s+([^\\s;&|-][^\\s;&|]*)/,\n  );\n  return match?.[2];\n}\n\n/**\n * Detect externally-visible git side effects in a completed tool call and\n * record `factory.agent.*` audit events for them. One command can emit\n * multiple events (`git commit && git push` emits both). Never throws.\n */\nexport async function observeAgentGitAction({\n  audit,\n  toolContext,\n}: {\n  audit: AuditAgentEmitter;\n  toolContext: ToolObserverContext;\n}): Promise<void> {\n  try {\n    if (toolContext.toolName !== 'execute_command' || toolContext.error) return;\n    const rawCommand = (toolContext.input as { command?: unknown } | undefined)?.command;\n    if (typeof rawCommand !== 'string') return;\n    const command = stripHeredocBodies(rawCommand);\n\n    const controller = toolContext.context.get('controller') as\n      | AgentControllerRequestContext<FactorySessionState>\n      | undefined;\n    const worktreePath = controller?.scope;\n\n    if (GIT_COMMIT_RE.test(command)) {\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.commit',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n        },\n      });\n    }\n\n    if (GIT_PUSH_RE.test(command)) {\n      const branch = parsePushedBranch(command);\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.push',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n          ...(branch ? { metadata: { branch } } : {}),\n        },\n      });\n    }\n  } catch (err) {\n    console.warn('[Audit] Failed to observe agent git action', {\n      error: err instanceof Error ? err.message : String(err),\n    });\n  }\n}\n"],"mappings":";;AAwBA,MAAM,gBAAgB;AACtB,MAAM,cAAc;AAEpB,SAAS,mBAAmB,SAAyB;CACnD,MAAM,QAAQ,QAAQ,MAAM,IAAI;CAChC,MAAM,kBAA4B,CAAC;CACnC,IAAI;CAEJ,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,WAAW;GACb,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,KAAA;GAC3C;EACF;EACA,gBAAgB,KAAK,IAAI;EAEzB,YADgB,KAAK,MAAM,0CACT,CAAC,GAAG;CACxB;CAEA,OAAO,gBAAgB,KAAK,IAAI;AAClC;;AAGA,SAAS,kBAAkB,SAAqC;CAI9D,OAHc,QAAQ,MACpB,8FAES,CAAC,GAAG;AACjB;;;;;;AAOA,eAAsB,sBAAsB,EAC1C,OACA,eAIgB;CAChB,IAAI;EACF,IAAI,YAAY,aAAa,qBAAqB,YAAY,OAAO;EACrE,MAAM,aAAc,YAAY,OAA6C;EAC7E,IAAI,OAAO,eAAe,UAAU;EACpC,MAAM,UAAU,mBAAmB,UAAU;EAK7C,MAAM,eAHa,YAAY,QAAQ,IAAI,YAGb,CAAC,EAAE;EAEjC,IAAI,cAAc,KAAK,OAAO,GAC5B,MAAM,MAAM,UAAU;GACpB,gBAAgB,YAAY;GAC5B,OAAO;IACL,QAAQ;IACR,SAAS,eAAe,CAAC;KAAE,MAAM;KAAY,IAAI;IAAa,CAAC,IAAI,CAAC;GACtE;EACF,CAAC;EAGH,IAAI,YAAY,KAAK,OAAO,GAAG;GAC7B,MAAM,SAAS,kBAAkB,OAAO;GACxC,MAAM,MAAM,UAAU;IACpB,gBAAgB,YAAY;IAC5B,OAAO;KACL,QAAQ;KACR,SAAS,eAAe,CAAC;MAAE,MAAM;MAAY,IAAI;KAAa,CAAC,IAAI,CAAC;KACpE,GAAI,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;IAC3C;GACF,CAAC;EACH;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,8CAA8C,EACzD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;CACH;AACF"}
+{"version":3,"file":"agent-audit.js","names":[],"sources":["../../../../src/storage/domains/audit/agent-audit.ts"],"sourcesContent":["/**\n * Git and GitHub actions performed by agents inside runs never touch web routes,\n * so this observer detects their externally-visible side effects in the command\n * and delegates recording to the factory-owned audit domain.\n */\n\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport { executableCommand, runsPullRequestCreate } from '../../../session/shell-commands.js';\nimport type { AuditAgentEmitter } from './domain.js';\n\ntype FactorySessionState = { factoryProjectId?: string; projectRepositoryId?: string };\n\ninterface ToolObserverContext {\n  toolName: string;\n  input: unknown;\n  output?: unknown;\n  error?: unknown;\n  context: RequestContext;\n}\n\n/** Match command-start positions while ignoring command text embedded in heredoc bodies. */\nconst GIT_COMMIT_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+commit(?:\\s|$)/;\nconst GIT_PUSH_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push(?:\\s|$)/;\n/** `gh pr create` prints the new pull request URL alone on the last line, and nothing else does. */\nconst CREATED_PULL_REQUEST_URL_RE = /^https:\\/\\/\\S+\\/pull\\/\\d+$/;\n\n/**\n * The pull request `gh pr create` actually opened, or nothing. A command that\n * printed no URL created no pull request: `--dry-run` prints a preview, `--web`\n * prints a `/compare/` link, and a failure prints its exit code last.\n */\nfunction createdPullRequestUrl(output: unknown): string | undefined {\n  if (typeof output !== 'string') return undefined;\n  const lastLine = output.trimEnd().split('\\n').at(-1)?.trim();\n  return lastLine !== undefined && CREATED_PULL_REQUEST_URL_RE.test(lastLine) ? lastLine : undefined;\n}\n\n/** Parse the branch from a plain `git push <remote> <branch>` invocation. */\nfunction parsePushedBranch(command: string): string | undefined {\n  const match = command.match(\n    /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push\\s+(?:-[^\\s]+\\s+)*([^\\s;&|-][^\\s;&|]*)\\s+([^\\s;&|-][^\\s;&|]*)/,\n  );\n  return match?.[2];\n}\n\n/**\n * Detect externally-visible git and GitHub side effects in a completed tool\n * call and record `factory.agent.*` audit events for them. One command can emit\n * multiple events (`git commit && git push` emits both). Never throws.\n */\nexport async function observeAgentGitAction({\n  audit,\n  toolContext,\n}: {\n  audit: AuditAgentEmitter;\n  toolContext: ToolObserverContext;\n}): Promise<void> {\n  try {\n    if (toolContext.toolName !== 'execute_command' || toolContext.error) return;\n    const rawCommand = (toolContext.input as { command?: unknown } | undefined)?.command;\n    if (typeof rawCommand !== 'string') return;\n    const command = executableCommand(rawCommand);\n\n    const controller = toolContext.context.get('controller') as\n      | AgentControllerRequestContext<FactorySessionState>\n      | undefined;\n    const worktreePath = controller?.scope;\n    const targets = worktreePath ? [{ type: 'worktree', id: worktreePath }] : [];\n\n    if (GIT_COMMIT_RE.test(command)) {\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: { action: 'factory.agent.commit', targets },\n      });\n    }\n\n    if (GIT_PUSH_RE.test(command)) {\n      const branch = parsePushedBranch(command);\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: { action: 'factory.agent.push', targets, ...(branch ? { metadata: { branch } } : {}) },\n      });\n    }\n\n    const pullRequestUrl = runsPullRequestCreate(rawCommand) ? createdPullRequestUrl(toolContext.output) : undefined;\n    if (pullRequestUrl) {\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.pr_opened',\n          targets: [{ type: 'pull_request', id: pullRequestUrl }, ...targets],\n          metadata: { url: pullRequestUrl },\n        },\n      });\n    }\n  } catch (err) {\n    console.warn('[Audit] Failed to observe agent git action', {\n      error: err instanceof Error ? err.message : String(err),\n    });\n  }\n}\n"],"mappings":";;;AAuBA,MAAM,gBAAgB;AACtB,MAAM,cAAc;;AAEpB,MAAM,8BAA8B;;;;;;AAOpC,SAAS,sBAAsB,QAAqC;CAClE,IAAI,OAAO,WAAW,UAAU,OAAO,KAAA;CACvC,MAAM,WAAW,OAAO,QAAQ,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK;CAC3D,OAAO,aAAa,KAAA,KAAa,4BAA4B,KAAK,QAAQ,IAAI,WAAW,KAAA;AAC3F;;AAGA,SAAS,kBAAkB,SAAqC;CAI9D,OAHc,QAAQ,MACpB,8FAES,CAAC,GAAG;AACjB;;;;;;AAOA,eAAsB,sBAAsB,EAC1C,OACA,eAIgB;CAChB,IAAI;EACF,IAAI,YAAY,aAAa,qBAAqB,YAAY,OAAO;EACrE,MAAM,aAAc,YAAY,OAA6C;EAC7E,IAAI,OAAO,eAAe,UAAU;EACpC,MAAM,UAAU,kBAAkB,UAAU;EAK5C,MAAM,eAHa,YAAY,QAAQ,IAAI,YAGb,CAAC,EAAE;EACjC,MAAM,UAAU,eAAe,CAAC;GAAE,MAAM;GAAY,IAAI;EAAa,CAAC,IAAI,CAAC;EAE3E,IAAI,cAAc,KAAK,OAAO,GAC5B,MAAM,MAAM,UAAU;GACpB,gBAAgB,YAAY;GAC5B,OAAO;IAAE,QAAQ;IAAwB;GAAQ;EACnD,CAAC;EAGH,IAAI,YAAY,KAAK,OAAO,GAAG;GAC7B,MAAM,SAAS,kBAAkB,OAAO;GACxC,MAAM,MAAM,UAAU;IACpB,gBAAgB,YAAY;IAC5B,OAAO;KAAE,QAAQ;KAAsB;KAAS,GAAI,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;IAAG;GAC9F,CAAC;EACH;EAEA,MAAM,iBAAiB,sBAAsB,UAAU,IAAI,sBAAsB,YAAY,MAAM,IAAI,KAAA;EACvG,IAAI,gBACF,MAAM,MAAM,UAAU;GACpB,gBAAgB,YAAY;GAC5B,OAAO;IACL,QAAQ;IACR,SAAS,CAAC;KAAE,MAAM;KAAgB,IAAI;IAAe,GAAG,GAAG,OAAO;IAClE,UAAU,EAAE,KAAK,eAAe;GAClC;EACF,CAAC;CAEL,SAAS,KAAK;EACZ,QAAQ,KAAK,8CAA8C,EACzD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;CACH;AACF"}

package/dist/storage/domains/audit/base.d.ts

@@ -2,41 +2,20 @@
  * Factory audit events domain — the append-only "who did what, when" trail
  * behind the software factory.
  *
- * One `audit_events` row records a single audited mutation (work-item change,
- * stage move, run start, worktree create/delete, git action, intake config
- * change). Rows are append-only: there is no update/delete API, and the table
- * is the local source of truth even when the WorkOS Audit Logs mirror is
- * unavailable.
+ * Rows are append-only: there is no update/delete API, and the table is the
+ * local source of truth even when the WorkOS Audit Logs mirror is unavailable.
+ * Tenancy is org-first, like `work_items`: `actor_id` records who acted but
+ * never scopes reads.
  *
- * Tenancy is **org-first**, like `work_items`: events are scoped by `org_id`
- * and (usually) `factory_project_id`; `actor_id` records who acted but never
- * scopes reads.
- *
- * v1 action taxonomy (register these in the WorkOS dashboard under
- * Audit Logs → Events for the export mirror to accept them):
- *   - factory.work_item.created
- *   - factory.work_item.updated
- *   - factory.work_item.stage_moved
- *   - factory.work_item.deleted
- *   - factory.run.started
- *   - factory.worktree.created
- *   - factory.worktree.deleted
- *   - factory.git.commit
- *   - factory.git.push
- *   - factory.git.pr_opened
- *   - factory.intake.config_updated
- *
- * v1.1 adds agent-level actions (also register these in WorkOS):
- *   - factory.agent.commit
- *   - factory.agent.push
- *   - factory.agent.pr_opened
+ * The actions the trail holds are listed in `./actions.ts`.
  *
  * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`
  * and `metadata.startedBy = <userId>` chaining accountability back to the human
- * whose message drove the run.
+ * whose message drove the run. Rule-driven events carry `actor_type = 'system'`.
  */
 import { FactoryStorageDomain } from '@mastra/core/storage';
 import type { CollectionSchema } from '@mastra/core/storage';
+import type { AuditActorType } from './actors.js';
 /** What an audit event acted on (WorkOS Audit Logs target shape). */
 export interface AuditTarget {
     /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */
@@ -46,8 +25,19 @@ export interface AuditTarget {
     /** Human-readable label (work-item title, branch name...). */
     name?: string;
 }
-/** Who performed the audited action. */
-export type AuditActorType = 'human' | 'agent';
+export type { AuditActorType } from './actors.js';
+/** Display name and avatar of a human actor, stamped at record time because MastraAuthStudio cannot resolve users by id. */
+export interface AuditActorProfileInput {
+    name?: string;
+    avatarUrl?: string;
+}
+export declare const ACTOR_PROFILE_METADATA_KEY = "__actorProfile";
+export declare function auditAgentName(modeId: string): string;
+export declare function auditActorProfile(user: {
+    name?: string;
+    email?: string;
+    avatarUrl?: string;
+} | undefined): AuditActorProfileInput | undefined;
 /** Request context captured alongside the event. */
 export interface AuditContext {
     /** Client IP (first hop of `x-forwarded-for`) when available. */
@@ -78,13 +68,14 @@ export interface AuditEventRow {
     context: AuditContext;
     occurredAt: Date;
 }
-export interface RecordAuditEventInput {
+export interface RecordAuditEventInput<Action extends string = string> {
+    idempotencyKey?: string;
     orgId: string;
     actorId: string;
     /** Who performed the action; defaults to 'human'. */
     actorType?: AuditActorType;
-    /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */
-    action: string;
+    actorProfile?: AuditActorProfileInput;
+    action: Action;
     targets: AuditTarget[];
     metadata?: Record<string, unknown>;
     factoryProjectId?: string;
@@ -133,6 +124,10 @@ export declare class AuditStorage extends FactoryStorageDomain {
     dangerouslyClearAll(): Promise<void>;
     /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */
     record(input: RecordAuditEventInput): Promise<AuditEventRow>;
+    recordOnce(input: RecordAuditEventInput): Promise<{
+        event: AuditEventRow;
+        created: boolean;
+    }>;
     /** List an org's audit events newest-first with keyset pagination. */
     list(input: ListAuditEventsInput): Promise<AuditEventPage>;
 }

package/dist/storage/domains/audit/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0DAA0D;IAC1D,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzG;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjE;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO9F;AAED,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAC;AAiCF;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,oBAAoB;;;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C,0FAA0F;IACpF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBlE,sEAAsE;IAChE,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CA2BjE"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,4HAA4H;AAC5H,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAE3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACtE,sBAAsB,GAAG,SAAS,CAKpC;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0DAA0D;IAC1D,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzG;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjE;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO9F;AAED,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAC;AAiCF;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,oBAAoB;;;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C,0FAA0F;IACpF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAK5D,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAmCnG,sEAAsE;IAChE,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CA2BjE"}

package/dist/storage/domains/audit/base.js

@@ -1,42 +1,34 @@
-import { FactoryStorageDomain } from "@mastra/core/storage";
+import { createHash } from "crypto";
+import { FactoryStorageDomain, UniqueViolationError } from "@mastra/core/storage";
 //#region src/storage/domains/audit/base.ts
 /**
 * Factory audit events domain — the append-only "who did what, when" trail
 * behind the software factory.
 *
-* One `audit_events` row records a single audited mutation (work-item change,
-* stage move, run start, worktree create/delete, git action, intake config
-* change). Rows are append-only: there is no update/delete API, and the table
-* is the local source of truth even when the WorkOS Audit Logs mirror is
-* unavailable.
+* Rows are append-only: there is no update/delete API, and the table is the
+* local source of truth even when the WorkOS Audit Logs mirror is unavailable.
+* Tenancy is org-first, like `work_items`: `actor_id` records who acted but
+* never scopes reads.
 *
-* Tenancy is **org-first**, like `work_items`: events are scoped by `org_id`
-* and (usually) `factory_project_id`; `actor_id` records who acted but never
-* scopes reads.
-*
-* v1 action taxonomy (register these in the WorkOS dashboard under
-* Audit Logs → Events for the export mirror to accept them):
-*   - factory.work_item.created
-*   - factory.work_item.updated
-*   - factory.work_item.stage_moved
-*   - factory.work_item.deleted
-*   - factory.run.started
-*   - factory.worktree.created
-*   - factory.worktree.deleted
-*   - factory.git.commit
-*   - factory.git.push
-*   - factory.git.pr_opened
-*   - factory.intake.config_updated
-*
-* v1.1 adds agent-level actions (also register these in WorkOS):
-*   - factory.agent.commit
-*   - factory.agent.push
-*   - factory.agent.pr_opened
+* The actions the trail holds are listed in `./actions.ts`.
 *
 * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`
 * and `metadata.startedBy = <userId>` chaining accountability back to the human
-* whose message drove the run.
+* whose message drove the run. Rule-driven events carry `actor_type = 'system'`.
 */
+const ACTOR_PROFILE_METADATA_KEY = "__actorProfile";
+function auditAgentName(modeId) {
+	return `${modeId} agent`;
+}
+function auditActorProfile(user) {
+	const name = user?.name?.trim() || user?.email?.trim();
+	const avatarUrl = user?.avatarUrl?.trim();
+	if (!name && !avatarUrl) return void 0;
+	return {
+		...name ? { name } : {},
+		...avatarUrl ? { avatarUrl } : {}
+	};
+}
 /** Metadata is a bounded summary — never full payloads, never secrets. */
 const MAX_METADATA_JSON_LENGTH = 4096;
 const DEFAULT_PAGE_SIZE = 50;
@@ -142,13 +134,48 @@ var AuditStorage = class extends FactoryStorageDomain {
 	}
 	/** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */
 	async record(input) {
+		if (input.idempotencyKey) return (await this.recordOnce(input)).event;
+		return this.#insert(input);
+	}
+	async recordOnce(input) {
+		if (!input.idempotencyKey) throw new Error("An audit idempotency key is required");
+		const hash = createHash("sha256").update(JSON.stringify([
+			input.orgId,
+			input.factoryProjectId ?? null,
+			input.action,
+			input.idempotencyKey
+		])).digest("hex");
+		const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+		try {
+			return {
+				event: await this.#insert(input, id),
+				created: true
+			};
+		} catch (error) {
+			if (!(error instanceof UniqueViolationError)) throw error;
+			const existing = await this.#db.findOne("audit_events", {
+				id,
+				org_id: input.orgId
+			});
+			if (!existing) throw error;
+			return {
+				event: toRow(existing),
+				created: false
+			};
+		}
+	}
+	async #insert(input, id) {
 		return toRow(await this.#db.insertOne("audit_events", {
+			...id ? { id } : {},
 			org_id: input.orgId,
 			actor_id: input.actorId,
 			actor_type: input.actorType ?? "human",
 			action: input.action,
 			targets: input.targets,
-			metadata: boundAuditMetadata(input.metadata),
+			metadata: boundAuditMetadata(input.actorProfile ? {
+				...input.metadata,
+				[ACTOR_PROFILE_METADATA_KEY]: input.actorProfile
+			} : input.metadata),
 			factory_project_id: input.factoryProjectId ?? null,
 			project_repository_id: input.projectRepositoryId ?? null,
 			context: input.context ?? {},
@@ -178,6 +205,6 @@ var AuditStorage = class extends FactoryStorageDomain {
 	}
 };
 //#endregion
-export { AUDIT_EVENTS_SCHEMA, AuditStorage, boundAuditMetadata, clampAuditLimit, decodeAuditCursor, encodeAuditCursor };
+export { ACTOR_PROFILE_METADATA_KEY, AUDIT_EVENTS_SCHEMA, AuditStorage, auditActorProfile, auditAgentName, boundAuditMetadata, clampAuditLimit, decodeAuditCursor, encodeAuditCursor };
 
 //# sourceMappingURL=base.js.map

package/dist/storage/domains/audit/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","names":["#db"],"sources":["../../../../src/storage/domains/audit/base.ts"],"sourcesContent":["/**\n * Factory audit events domain — the append-only \"who did what, when\" trail\n * behind the software factory.\n *\n * One `audit_events` row records a single audited mutation (work-item change,\n * stage move, run start, worktree create/delete, git action, intake config\n * change). Rows are append-only: there is no update/delete API, and the table\n * is the local source of truth even when the WorkOS Audit Logs mirror is\n * unavailable.\n *\n * Tenancy is **org-first**, like `work_items`: events are scoped by `org_id`\n * and (usually) `factory_project_id`; `actor_id` records who acted but never\n * scopes reads.\n *\n * v1 action taxonomy (register these in the WorkOS dashboard under\n * Audit Logs → Events for the export mirror to accept them):\n *   - factory.work_item.created\n *   - factory.work_item.updated\n *   - factory.work_item.stage_moved\n *   - factory.work_item.deleted\n *   - factory.run.started\n *   - factory.worktree.created\n *   - factory.worktree.deleted\n *   - factory.git.commit\n *   - factory.git.push\n *   - factory.git.pr_opened\n *   - factory.intake.config_updated\n *\n * v1.1 adds agent-level actions (also register these in WorkOS):\n *   - factory.agent.commit\n *   - factory.agent.push\n *   - factory.agent.pr_opened\n *\n * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`\n * and `metadata.startedBy = <userId>` chaining accountability back to the human\n * whose message drove the run.\n */\n\nimport { FactoryStorageDomain } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\n/** What an audit event acted on (WorkOS Audit Logs target shape). */\nexport interface AuditTarget {\n  /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */\n  type: string;\n  /** Stable identifier of the target (row id, branch name, issue number...). */\n  id: string;\n  /** Human-readable label (work-item title, branch name...). */\n  name?: string;\n}\n\n/** Who performed the audited action. */\nexport type AuditActorType = 'human' | 'agent';\n\n/** Request context captured alongside the event. */\nexport interface AuditContext {\n  /** Client IP (first hop of `x-forwarded-for`) when available. */\n  location?: string;\n  /** Request `user-agent` header when available. */\n  userAgent?: string;\n}\n\n/** One persisted audit event. */\nexport interface AuditEventRow {\n  id: string;\n  /** Owning WorkOS organization id — the trail is org-wide. */\n  orgId: string;\n  /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */\n  actorId: string;\n  /** Whether a human or an agent (inside a run) performed the action. */\n  actorType: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  /** What was acted on. */\n  targets: AuditTarget[];\n  /** Bounded event summary — never full payloads, never secrets. */\n  metadata: Record<string, unknown>;\n  /** Factory project the event is scoped to; null for org-level events. */\n  factoryProjectId: string | null;\n  /** Project-repository link affected by a repository-specific action. */\n  projectRepositoryId: string | null;\n  /** Request context (`x-forwarded-for` / `user-agent`). */\n  context: AuditContext;\n  occurredAt: Date;\n}\n\nexport interface RecordAuditEventInput {\n  orgId: string;\n  actorId: string;\n  /** Who performed the action; defaults to 'human'. */\n  actorType?: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  context?: AuditContext;\n  occurredAt?: Date;\n}\n\n/** A fully-normalized event ready to persist (id assigned on insert). */\nexport type AuditEventInsert = Omit<AuditEventRow, 'id'>;\n\nexport interface ListAuditEventsInput {\n  orgId: string;\n  factoryProjectId?: string;\n  /** Restrict to these actions (exact match). */\n  actions?: string[];\n  actorId?: string;\n  /** Opaque cursor from a previous page (`nextCursor`). */\n  before?: string;\n  limit?: number;\n}\n\nexport interface AuditEventPage {\n  events: AuditEventRow[];\n  /** Pass back as `before` to fetch the next (older) page; absent at the end. */\n  nextCursor?: string;\n}\n\n/** Metadata is a bounded summary — never full payloads, never secrets. */\nconst MAX_METADATA_JSON_LENGTH = 4096;\n\nconst DEFAULT_PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 200;\n\n/** Truncate oversized metadata rather than dropping the whole event. */\nexport function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {};\n  try {\n    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;\n  } catch {\n    return { truncated: true };\n  }\n  return { truncated: true };\n}\n\n/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */\nexport function clampAuditLimit(limit: number | undefined): number {\n  const normalized = typeof limit === 'number' && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;\n  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);\n}\n\n/** Encode the `(occurredAt, id)` keyset cursor of a row. */\nexport function encodeAuditCursor(row: AuditEventRow): string {\n  return `${row.occurredAt.toISOString()}_${row.id}`;\n}\n\n/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */\nexport function decodeAuditCursor(cursor: string): { occurredAt: Date; id: string } | undefined {\n  const sep = cursor.lastIndexOf('_');\n  if (sep <= 0) return undefined;\n  const occurredAt = new Date(cursor.slice(0, sep));\n  const id = cursor.slice(sep + 1);\n  if (Number.isNaN(occurredAt.getTime()) || !id) return undefined;\n  return { occurredAt, id };\n}\n\nexport const AUDIT_EVENTS_SCHEMA: CollectionSchema = {\n  name: 'audit_events',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    actor_id: { type: 'text' },\n    actor_type: { type: 'text', default: 'human' },\n    action: { type: 'text' },\n    targets: { type: 'json' },\n    metadata: { type: 'json' },\n    factory_project_id: { type: 'text', nullable: true },\n    project_repository_id: { type: 'text', nullable: true },\n    context: { type: 'json' },\n    occurred_at: { type: 'timestamp' },\n  },\n  indexes: [\n    { name: 'audit_events_org_occurred_idx', columns: ['org_id', 'occurred_at'] },\n    { name: 'audit_events_org_project_occurred_idx', columns: ['org_id', 'factory_project_id', 'occurred_at'] },\n  ],\n};\n\n/** Column shape of one `audit_events` row as returned by ops. */\ninterface AuditEventDbRow extends Record<string, unknown> {\n  id: string;\n  org_id: string;\n  actor_id: string;\n  actor_type: AuditActorType;\n  action: string;\n  targets: AuditTarget[];\n  metadata: Record<string, unknown>;\n  factory_project_id: string | null;\n  project_repository_id: string | null;\n  context: AuditContext;\n  occurred_at: Date;\n}\n\nfunction toRow(db: AuditEventDbRow): AuditEventRow {\n  return {\n    id: db.id,\n    orgId: db.org_id,\n    actorId: db.actor_id,\n    actorType: db.actor_type,\n    action: db.action,\n    targets: db.targets,\n    metadata: db.metadata,\n    factoryProjectId: db.factory_project_id,\n    projectRepositoryId: db.project_repository_id,\n    context: db.context,\n    occurredAt: db.occurred_at,\n  };\n}\n\n/**\n * Audit event storage, written once against the generic `FactoryStorageOps`\n * surface. `record()` normalizes inputs (defaults, metadata bounding);\n * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.\n */\nexport class AuditStorage extends FactoryStorageDomain {\n  constructor() {\n    super('audit');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('audit_events', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow> {\n    const inserted = await this.#db.insertOne<AuditEventDbRow>('audit_events', {\n      org_id: input.orgId,\n      actor_id: input.actorId,\n      actor_type: input.actorType ?? 'human',\n      action: input.action,\n      targets: input.targets,\n      metadata: boundAuditMetadata(input.metadata),\n      factory_project_id: input.factoryProjectId ?? null,\n      project_repository_id: input.projectRepositoryId ?? null,\n      context: input.context ?? {},\n      occurred_at: input.occurredAt ?? new Date(),\n    });\n    return toRow(inserted);\n  }\n\n  /** List an org's audit events newest-first with keyset pagination. */\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    const limit = clampAuditLimit(input.limit);\n\n    const where: CollectionWhere = { org_id: input.orgId };\n    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;\n    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };\n    if (input.actorId) where.actor_id = input.actorId;\n\n    const cursor = input.before ? decodeAuditCursor(input.before) : undefined;\n\n    const rows = await this.#db.findMany<AuditEventDbRow>('audit_events', where, {\n      orderBy: [\n        ['occurred_at', 'desc'],\n        ['id', 'desc'],\n      ],\n      limit: limit + 1,\n      ...(cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}),\n    });\n\n    const events = rows.slice(0, limit).map(toRow);\n    const hasMore = rows.length > limit;\n    const last = events[events.length - 1];\n    return {\n      events,\n      ...(hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0HA,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,SAAgB,mBAAmB,UAAwE;CACzG,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;EACF,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,UAAU,0BAA0B,OAAO;CAC1E,QAAQ;EACN,OAAO,EAAE,WAAW,KAAK;CAC3B;CACA,OAAO,EAAE,WAAW,KAAK;AAC3B;;AAGA,SAAgB,gBAAgB,OAAmC;CAEjE,OAAO,KAAK,IAAI,KAAK,IADF,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,mBACxD,CAAC,GAAG,aAAa;AACxD;;AAGA,SAAgB,kBAAkB,KAA4B;CAC5D,OAAO,GAAG,IAAI,WAAW,YAAY,EAAE,GAAG,IAAI;AAChD;;AAGA,SAAgB,kBAAkB,QAA8D;CAC9F,MAAM,MAAM,OAAO,YAAY,GAAG;CAClC,IAAI,OAAO,GAAG,OAAO,KAAA;CACrB,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC;CAChD,MAAM,KAAK,OAAO,MAAM,MAAM,CAAC;CAC/B,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAA;CACtD,OAAO;EAAE;EAAY;CAAG;AAC1B;AAEA,MAAa,sBAAwC;CACnD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,UAAU,EAAE,MAAM,OAAO;EACzB,YAAY;GAAE,MAAM;GAAQ,SAAS;EAAQ;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,uBAAuB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACtD,SAAS,EAAE,MAAM,OAAO;EACxB,aAAa,EAAE,MAAM,YAAY;CACnC;CACA,SAAS,CACP;EAAE,MAAM;EAAiC,SAAS,CAAC,UAAU,aAAa;CAAE,GAC5E;EAAE,MAAM;EAAyC,SAAS;GAAC;GAAU;GAAsB;EAAa;CAAE,CAC5G;AACF;AAiBA,SAAS,MAAM,IAAoC;CACjD,OAAO;EACL,IAAI,GAAG;EACP,OAAO,GAAG;EACV,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,QAAQ,GAAG;EACX,SAAS,GAAG;EACZ,UAAU,GAAG;EACb,kBAAkB,GAAG;EACrB,qBAAqB,GAAG;EACxB,SAAS,GAAG;EACZ,YAAY,GAAG;CACjB;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,qBAAqB;CACrD,cAAc;EACZ,MAAM,OAAO;CACf;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,mBAAmB,CAAC;CACpD;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,gBAAgB,CAAC,CAAC;CAC9C;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,OAAO,OAAsD;EAajE,OAAO,MAAM,MAZU,KAAKA,IAAI,UAA2B,gBAAgB;GACzE,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,YAAY,MAAM,aAAa;GAC/B,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,mBAAmB,MAAM,QAAQ;GAC3C,oBAAoB,MAAM,oBAAoB;GAC9C,uBAAuB,MAAM,uBAAuB;GACpD,SAAS,MAAM,WAAW,CAAC;GAC3B,aAAa,MAAM,8BAAc,IAAI,KAAK;EAC5C,CAAC,CACoB;CACvB;;CAGA,MAAM,KAAK,OAAsD;EAC/D,MAAM,QAAQ,gBAAgB,MAAM,KAAK;EAEzC,MAAM,QAAyB,EAAE,QAAQ,MAAM,MAAM;EACrD,IAAI,MAAM,kBAAkB,MAAM,qBAAqB,MAAM;EAC7D,IAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EAClF,IAAI,MAAM,SAAS,MAAM,WAAW,MAAM;EAE1C,MAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI,KAAA;EAEhE,MAAM,OAAO,MAAM,KAAKA,IAAI,SAA0B,gBAAgB,OAAO;GAC3E,SAAS,CACP,CAAC,eAAe,MAAM,GACtB,CAAC,MAAM,MAAM,CACf;GACA,OAAO,QAAQ;GACf,GAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,YAAY,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC;EACzE,CAAC;EAED,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;EAC7C,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,OAAO,OAAO,OAAO,SAAS;EACpC,OAAO;GACL;GACA,GAAI,WAAW,OAAO,EAAE,YAAY,kBAAkB,IAAI,EAAE,IAAI,CAAC;EACnE;CACF;AACF"}
+{"version":3,"file":"base.js","names":["#db","#insert"],"sources":["../../../../src/storage/domains/audit/base.ts"],"sourcesContent":["/**\n * Factory audit events domain — the append-only \"who did what, when\" trail\n * behind the software factory.\n *\n * Rows are append-only: there is no update/delete API, and the table is the\n * local source of truth even when the WorkOS Audit Logs mirror is unavailable.\n * Tenancy is org-first, like `work_items`: `actor_id` records who acted but\n * never scopes reads.\n *\n * The actions the trail holds are listed in `./actions.ts`.\n *\n * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`\n * and `metadata.startedBy = <userId>` chaining accountability back to the human\n * whose message drove the run. Rule-driven events carry `actor_type = 'system'`.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\nimport type { AuditActorType } from './actors.js';\n\n/** What an audit event acted on (WorkOS Audit Logs target shape). */\nexport interface AuditTarget {\n  /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */\n  type: string;\n  /** Stable identifier of the target (row id, branch name, issue number...). */\n  id: string;\n  /** Human-readable label (work-item title, branch name...). */\n  name?: string;\n}\n\nexport type { AuditActorType } from './actors.js';\n\n/** Display name and avatar of a human actor, stamped at record time because MastraAuthStudio cannot resolve users by id. */\nexport interface AuditActorProfileInput {\n  name?: string;\n  avatarUrl?: string;\n}\n\nexport const ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\nexport function auditAgentName(modeId: string): string {\n  return `${modeId} agent`;\n}\n\nexport function auditActorProfile(\n  user: { name?: string; email?: string; avatarUrl?: string } | undefined,\n): AuditActorProfileInput | undefined {\n  const name = user?.name?.trim() || user?.email?.trim();\n  const avatarUrl = user?.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\n/** Request context captured alongside the event. */\nexport interface AuditContext {\n  /** Client IP (first hop of `x-forwarded-for`) when available. */\n  location?: string;\n  /** Request `user-agent` header when available. */\n  userAgent?: string;\n}\n\n/** One persisted audit event. */\nexport interface AuditEventRow {\n  id: string;\n  /** Owning WorkOS organization id — the trail is org-wide. */\n  orgId: string;\n  /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */\n  actorId: string;\n  /** Whether a human or an agent (inside a run) performed the action. */\n  actorType: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  /** What was acted on. */\n  targets: AuditTarget[];\n  /** Bounded event summary — never full payloads, never secrets. */\n  metadata: Record<string, unknown>;\n  /** Factory project the event is scoped to; null for org-level events. */\n  factoryProjectId: string | null;\n  /** Project-repository link affected by a repository-specific action. */\n  projectRepositoryId: string | null;\n  /** Request context (`x-forwarded-for` / `user-agent`). */\n  context: AuditContext;\n  occurredAt: Date;\n}\n\nexport interface RecordAuditEventInput<Action extends string = string> {\n  idempotencyKey?: string;\n  orgId: string;\n  actorId: string;\n  /** Who performed the action; defaults to 'human'. */\n  actorType?: AuditActorType;\n  actorProfile?: AuditActorProfileInput;\n  action: Action;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  context?: AuditContext;\n  occurredAt?: Date;\n}\n\n/** A fully-normalized event ready to persist (id assigned on insert). */\nexport type AuditEventInsert = Omit<AuditEventRow, 'id'>;\n\nexport interface ListAuditEventsInput {\n  orgId: string;\n  factoryProjectId?: string;\n  /** Restrict to these actions (exact match). */\n  actions?: string[];\n  actorId?: string;\n  /** Opaque cursor from a previous page (`nextCursor`). */\n  before?: string;\n  limit?: number;\n}\n\nexport interface AuditEventPage {\n  events: AuditEventRow[];\n  /** Pass back as `before` to fetch the next (older) page; absent at the end. */\n  nextCursor?: string;\n}\n\n/** Metadata is a bounded summary — never full payloads, never secrets. */\nconst MAX_METADATA_JSON_LENGTH = 4096;\n\nconst DEFAULT_PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 200;\n\n/** Truncate oversized metadata rather than dropping the whole event. */\nexport function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {};\n  try {\n    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;\n  } catch {\n    return { truncated: true };\n  }\n  return { truncated: true };\n}\n\n/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */\nexport function clampAuditLimit(limit: number | undefined): number {\n  const normalized = typeof limit === 'number' && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;\n  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);\n}\n\n/** Encode the `(occurredAt, id)` keyset cursor of a row. */\nexport function encodeAuditCursor(row: AuditEventRow): string {\n  return `${row.occurredAt.toISOString()}_${row.id}`;\n}\n\n/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */\nexport function decodeAuditCursor(cursor: string): { occurredAt: Date; id: string } | undefined {\n  const sep = cursor.lastIndexOf('_');\n  if (sep <= 0) return undefined;\n  const occurredAt = new Date(cursor.slice(0, sep));\n  const id = cursor.slice(sep + 1);\n  if (Number.isNaN(occurredAt.getTime()) || !id) return undefined;\n  return { occurredAt, id };\n}\n\nexport const AUDIT_EVENTS_SCHEMA: CollectionSchema = {\n  name: 'audit_events',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    actor_id: { type: 'text' },\n    actor_type: { type: 'text', default: 'human' },\n    action: { type: 'text' },\n    targets: { type: 'json' },\n    metadata: { type: 'json' },\n    factory_project_id: { type: 'text', nullable: true },\n    project_repository_id: { type: 'text', nullable: true },\n    context: { type: 'json' },\n    occurred_at: { type: 'timestamp' },\n  },\n  indexes: [\n    { name: 'audit_events_org_occurred_idx', columns: ['org_id', 'occurred_at'] },\n    { name: 'audit_events_org_project_occurred_idx', columns: ['org_id', 'factory_project_id', 'occurred_at'] },\n  ],\n};\n\n/** Column shape of one `audit_events` row as returned by ops. */\ninterface AuditEventDbRow extends Record<string, unknown> {\n  id: string;\n  org_id: string;\n  actor_id: string;\n  actor_type: AuditActorType;\n  action: string;\n  targets: AuditTarget[];\n  metadata: Record<string, unknown>;\n  factory_project_id: string | null;\n  project_repository_id: string | null;\n  context: AuditContext;\n  occurred_at: Date;\n}\n\nfunction toRow(db: AuditEventDbRow): AuditEventRow {\n  return {\n    id: db.id,\n    orgId: db.org_id,\n    actorId: db.actor_id,\n    actorType: db.actor_type,\n    action: db.action,\n    targets: db.targets,\n    metadata: db.metadata,\n    factoryProjectId: db.factory_project_id,\n    projectRepositoryId: db.project_repository_id,\n    context: db.context,\n    occurredAt: db.occurred_at,\n  };\n}\n\n/**\n * Audit event storage, written once against the generic `FactoryStorageOps`\n * surface. `record()` normalizes inputs (defaults, metadata bounding);\n * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.\n */\nexport class AuditStorage extends FactoryStorageDomain {\n  constructor() {\n    super('audit');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('audit_events', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow> {\n    if (input.idempotencyKey) return (await this.recordOnce(input)).event;\n    return this.#insert(input);\n  }\n\n  async recordOnce(input: RecordAuditEventInput): Promise<{ event: AuditEventRow; created: boolean }> {\n    if (!input.idempotencyKey) throw new Error('An audit idempotency key is required');\n    const hash = createHash('sha256')\n      .update(JSON.stringify([input.orgId, input.factoryProjectId ?? null, input.action, input.idempotencyKey]))\n      .digest('hex');\n    const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;\n    try {\n      return { event: await this.#insert(input, id), created: true };\n    } catch (error) {\n      if (!(error instanceof UniqueViolationError)) throw error;\n      const existing = await this.#db.findOne<AuditEventDbRow>('audit_events', { id, org_id: input.orgId });\n      if (!existing) throw error;\n      return { event: toRow(existing), created: false };\n    }\n  }\n\n  async #insert(input: RecordAuditEventInput, id?: string): Promise<AuditEventRow> {\n    const inserted = await this.#db.insertOne<AuditEventDbRow>('audit_events', {\n      ...(id ? { id } : {}),\n      org_id: input.orgId,\n      actor_id: input.actorId,\n      actor_type: input.actorType ?? 'human',\n      action: input.action,\n      targets: input.targets,\n      metadata: boundAuditMetadata(\n        input.actorProfile ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: input.actorProfile } : input.metadata,\n      ),\n      factory_project_id: input.factoryProjectId ?? null,\n      project_repository_id: input.projectRepositoryId ?? null,\n      context: input.context ?? {},\n      occurred_at: input.occurredAt ?? new Date(),\n    });\n    return toRow(inserted);\n  }\n\n  /** List an org's audit events newest-first with keyset pagination. */\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    const limit = clampAuditLimit(input.limit);\n\n    const where: CollectionWhere = { org_id: input.orgId };\n    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;\n    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };\n    if (input.actorId) where.actor_id = input.actorId;\n\n    const cursor = input.before ? decodeAuditCursor(input.before) : undefined;\n\n    const rows = await this.#db.findMany<AuditEventDbRow>('audit_events', where, {\n      orderBy: [\n        ['occurred_at', 'desc'],\n        ['id', 'desc'],\n      ],\n      limit: limit + 1,\n      ...(cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}),\n    });\n\n    const events = rows.slice(0, limit).map(toRow);\n    const hasMore = rows.length > limit;\n    const last = events[events.length - 1];\n    return {\n      events,\n      ...(hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyCA,MAAa,6BAA6B;AAE1C,SAAgB,eAAe,QAAwB;CACrD,OAAO,GAAG,OAAO;AACnB;AAEA,SAAgB,kBACd,MACoC;CACpC,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK;CACrD,MAAM,YAAY,MAAM,WAAW,KAAK;CACxC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;;AAuEA,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,SAAgB,mBAAmB,UAAwE;CACzG,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;EACF,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,UAAU,0BAA0B,OAAO;CAC1E,QAAQ;EACN,OAAO,EAAE,WAAW,KAAK;CAC3B;CACA,OAAO,EAAE,WAAW,KAAK;AAC3B;;AAGA,SAAgB,gBAAgB,OAAmC;CAEjE,OAAO,KAAK,IAAI,KAAK,IADF,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,mBACxD,CAAC,GAAG,aAAa;AACxD;;AAGA,SAAgB,kBAAkB,KAA4B;CAC5D,OAAO,GAAG,IAAI,WAAW,YAAY,EAAE,GAAG,IAAI;AAChD;;AAGA,SAAgB,kBAAkB,QAA8D;CAC9F,MAAM,MAAM,OAAO,YAAY,GAAG;CAClC,IAAI,OAAO,GAAG,OAAO,KAAA;CACrB,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC;CAChD,MAAM,KAAK,OAAO,MAAM,MAAM,CAAC;CAC/B,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAA;CACtD,OAAO;EAAE;EAAY;CAAG;AAC1B;AAEA,MAAa,sBAAwC;CACnD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,UAAU,EAAE,MAAM,OAAO;EACzB,YAAY;GAAE,MAAM;GAAQ,SAAS;EAAQ;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,uBAAuB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACtD,SAAS,EAAE,MAAM,OAAO;EACxB,aAAa,EAAE,MAAM,YAAY;CACnC;CACA,SAAS,CACP;EAAE,MAAM;EAAiC,SAAS,CAAC,UAAU,aAAa;CAAE,GAC5E;EAAE,MAAM;EAAyC,SAAS;GAAC;GAAU;GAAsB;EAAa;CAAE,CAC5G;AACF;AAiBA,SAAS,MAAM,IAAoC;CACjD,OAAO;EACL,IAAI,GAAG;EACP,OAAO,GAAG;EACV,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,QAAQ,GAAG;EACX,SAAS,GAAG;EACZ,UAAU,GAAG;EACb,kBAAkB,GAAG;EACrB,qBAAqB,GAAG;EACxB,SAAS,GAAG;EACZ,YAAY,GAAG;CACjB;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,qBAAqB;CACrD,cAAc;EACZ,MAAM,OAAO;CACf;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,mBAAmB,CAAC;CACpD;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,gBAAgB,CAAC,CAAC;CAC9C;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,OAAO,OAAsD;EACjE,IAAI,MAAM,gBAAgB,QAAQ,MAAM,KAAK,WAAW,KAAK,EAAA,CAAG;EAChE,OAAO,KAAKC,QAAQ,KAAK;CAC3B;CAEA,MAAM,WAAW,OAAmF;EAClG,IAAI,CAAC,MAAM,gBAAgB,MAAM,IAAI,MAAM,sCAAsC;EACjF,MAAM,OAAO,WAAW,QAAQ,CAAC,CAC9B,OAAO,KAAK,UAAU;GAAC,MAAM;GAAO,MAAM,oBAAoB;GAAM,MAAM;GAAQ,MAAM;EAAc,CAAC,CAAC,CAAC,CACzG,OAAO,KAAK;EACf,MAAM,KAAK,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE;EACtH,IAAI;GACF,OAAO;IAAE,OAAO,MAAM,KAAKA,QAAQ,OAAO,EAAE;IAAG,SAAS;GAAK;EAC/D,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;GACpD,MAAM,WAAW,MAAM,KAAKD,IAAI,QAAyB,gBAAgB;IAAE;IAAI,QAAQ,MAAM;GAAM,CAAC;GACpG,IAAI,CAAC,UAAU,MAAM;GACrB,OAAO;IAAE,OAAO,MAAM,QAAQ;IAAG,SAAS;GAAM;EAClD;CACF;CAEA,MAAMC,QAAQ,OAA8B,IAAqC;EAgB/E,OAAO,MAAM,MAfU,KAAKD,IAAI,UAA2B,gBAAgB;GACzE,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;GACnB,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,YAAY,MAAM,aAAa;GAC/B,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,mBACR,MAAM,eAAe;IAAE,GAAG,MAAM;KAAW,6BAA6B,MAAM;GAAa,IAAI,MAAM,QACvG;GACA,oBAAoB,MAAM,oBAAoB;GAC9C,uBAAuB,MAAM,uBAAuB;GACpD,SAAS,MAAM,WAAW,CAAC;GAC3B,aAAa,MAAM,8BAAc,IAAI,KAAK;EAC5C,CAAC,CACoB;CACvB;;CAGA,MAAM,KAAK,OAAsD;EAC/D,MAAM,QAAQ,gBAAgB,MAAM,KAAK;EAEzC,MAAM,QAAyB,EAAE,QAAQ,MAAM,MAAM;EACrD,IAAI,MAAM,kBAAkB,MAAM,qBAAqB,MAAM;EAC7D,IAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EAClF,IAAI,MAAM,SAAS,MAAM,WAAW,MAAM;EAE1C,MAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI,KAAA;EAEhE,MAAM,OAAO,MAAM,KAAKA,IAAI,SAA0B,gBAAgB,OAAO;GAC3E,SAAS,CACP,CAAC,eAAe,MAAM,GACtB,CAAC,MAAM,MAAM,CACf;GACA,OAAO,QAAQ;GACf,GAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,YAAY,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC;EACzE,CAAC;EAED,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;EAC7C,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,OAAO,OAAO,OAAO,SAAS;EACpC,OAAO;GACL;GACA,GAAI,WAAW,OAAO,EAAE,YAAY,kBAAkB,IAAI,EAAE,IAAI,CAAC;EACnE;CACF;AACF"}

package/dist/storage/domains/audit/domain.d.ts

@@ -3,16 +3,17 @@ import type { ApiRoute, IUserProvider } from '@mastra/core/server';
 import type { Context } from 'hono';
 import type { RouteAuth } from '../../../routes/route.js';
 import type { FactoryProjectsStorage } from '../projects/base.js';
-import type { AuditContext, AuditEventPage, AuditEventRow, AuditStorage, AuditTarget, ListAuditEventsInput, RecordAuditEventInput } from './base.js';
+import type { AuditAction } from './actions.js';
+import type { AuditActorProfileInput, AuditContext, AuditEventPage, AuditEventRow, AuditStorage, AuditTarget, ListAuditEventsInput, RecordAuditEventInput } from './base.js';
 export interface EmitAuditInput {
-    action: string;
+    action: AuditAction;
     factoryProjectId?: string;
     projectRepositoryId?: string;
     targets: AuditTarget[];
     metadata?: Record<string, unknown>;
 }
 export interface EmitAgentAuditInput {
-    action: string;
+    action: AuditAction;
     targets: AuditTarget[];
     metadata?: Record<string, unknown>;
 }
@@ -28,6 +29,8 @@ export interface AuditAgentEmitter {
         input: EmitAgentAuditInput;
     }): Promise<void>;
 }
+/** Records with an explicit actor, for the paths that have no request: rule transitions, run starts, run ends, supervisor tools. */
+export type AuditRecorder = Pick<AuditDomain, 'record'>;
 /** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */
 export interface AuditSink {
     id: string;
@@ -35,11 +38,6 @@ export interface AuditSink {
         event: AuditEventRow;
     }): Promise<void>;
 }
-export interface AuditActorProfile {
-    id: string;
-    name: string;
-    avatarUrl?: string;
-}
 export interface AuditDomainOptions {
     auth: RouteAuth;
     /** Audit storage domain handle. */
@@ -57,11 +55,16 @@ export interface AuditDomainOptions {
     } | undefined;
 }
 export declare function auditRequestContext(c: Context): AuditContext;
+/** Who a browser request is and where it came from: the pair every funnel row carries. */
+export declare function auditRequestOrigin(c: Context): {
+    actorProfile: AuditActorProfileInput | undefined;
+    context: AuditContext;
+};
 /** Factory-owned audit behavior backed by the audit storage domain. */
 export declare class AuditDomain implements AuditEmitter, AuditAgentEmitter {
     #private;
     constructor({ auth, audit, projects, users, sinks, agentTenant }: AuditDomainOptions);
-    record(input: RecordAuditEventInput): Promise<AuditEventRow | null>;
+    record(input: RecordAuditEventInput<AuditAction>): Promise<AuditEventRow | null>;
     list(input: ListAuditEventsInput): Promise<AuditEventPage>;
     emit({ context, input }: {
         context: Context;

package/dist/storage/domains/audit/domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/domain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAOD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAwCD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,mEAAmE;IACnE,QAAQ,EAAE,sBAAsB,CAAC;IACjC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,mFAAmF;IACnF,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACnG;AAkDD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAO5D;AAED,uEAAuE;AACvE,qBAAa,WAAY,YAAW,YAAY,EAAE,iBAAiB;;gBAQrD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAU,EAAE,WAAW,EAAE,EAAE,kBAAkB;IAgBnF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA0BnE,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAK1D,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BpF,SAAS,CAAC,EACd,cAAc,EACd,KAAK,GACN,EAAE;QACD,cAAc,EAAE,cAAc,CAAC;QAC/B,KAAK,EAAE,mBAAmB,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IA+FjB,MAAM,IAAI,QAAQ,EAAE;CAyCrB"}
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/domain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,WAAW,CAAC;AAInB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,oIAAoI;AACpI,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAExD,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAmBD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,mEAAmE;IACnE,QAAQ,EAAE,sBAAsB,CAAC;IACjC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,mFAAmF;IACnF,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACnG;AAsCD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAO5D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG;IAC9C,YAAY,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACjD,OAAO,EAAE,YAAY,CAAC;CACvB,CAEA;AAED,uEAAuE;AACvE,qBAAa,WAAY,YAAW,YAAY,EAAE,iBAAiB;;gBAQrD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAU,EAAE,WAAW,EAAE,EAAE,kBAAkB;IAgBnF,MAAM,CAAC,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA6BhF,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAK1D,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBpF,SAAS,CAAC,EACd,cAAc,EACd,KAAK,GACN,EAAE;QACD,cAAc,EAAE,cAAc,CAAC;QAC/B,KAAK,EAAE,mBAAmB,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IA+FjB,MAAM,IAAI,QAAQ,EAAE;CAiDrB"}