@mastra/factory 0.18.0 → 0.18.1-alpha.0

package/dist/session/source-control-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-control-tools.d.ts","sourceRoot":"","sources":["../../src/session/source-control-tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAMnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAIV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AAQnD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,0BAA0B,CAAC;IACpC,cAAc,EAAE,cAAc,CAAC;CAChC;AAiGD,wBAAgB,wBAAwB,CAAC,EACvC,cAAc,EACd,SAAS,EACT,KAAK,GACN,EAAE;IACD,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAChD,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GAAG,gBAAgB,CA4YnB"}
+{"version":3,"file":"source-control-tools.d.ts","sourceRoot":"","sources":["../../src/session/source-control-tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAMnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAKhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAIV,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AAQnD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,0BAA0B,CAAC;IACpC,cAAc,EAAE,cAAc,CAAC;CAChC;AAYD,KAAK,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE7D,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUrG;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CASxF;AAuFD,wBAAgB,wBAAwB,CAAC,EACvC,cAAc,EACd,SAAS,EACT,KAAK,GACN,EAAE;IACD,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAChD,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GAAG,gBAAgB,CAibnB"}

package/dist/session/source-control-tools.js

@@ -1,10 +1,32 @@
 import { getFactoryAuthOrgId, getFactoryAuthUserFromContext, getFactoryAuthUserId } from "../auth.js";
 import { mergeRequestNumberFromBranch } from "../work-item-branch.js";
+import { normalizedVerdictLine } from "../review-verdict.js";
 import { resolveSessionWorkdir } from "../sandbox/session-sandbox.js";
 import { pushRepositoryBranch, refreshMergeRequestCheckout } from "../integrations/github/sandbox.js";
 import { createTool } from "@mastra/core/tools";
 import { z } from "zod";
 //#region src/session/source-control-tools.ts
+/** Returns why a review's leading `Verdict:` line contradicts the submitted event, if it does. */
+function verdictEventMismatch(event, body) {
+	const match = /^verdict: ?(approve|request changes|changes requested)\b/.exec(normalizedVerdictLine(body) ?? "");
+	if (!match) return void 0;
+	const verdict = match[1] === "approve" ? "approve" : "request changes";
+	const allowed = verdict === "approve" ? ["approve"] : ["request-changes", "comment"];
+	if (allowed.includes(event)) return void 0;
+	return `Review body opens with "Verdict: ${verdict}" but event is "${event}". Nothing was posted. Use event ${allowed.map((e) => `"${e}"`).join(" or ")} for this body, or regenerate the body for the verdict you intend.`;
+}
+const REVIEWED_HEAD_LINE = /^[\s*_>-]*reviewed head[*_]*:[*_]*\s*(.*)$/gim;
+const FULL_SHA = /^`?([0-9a-f]{40}|[0-9a-f]{64})`?(?:\s|$)/i;
+/**
+* Returns the full SHA named by the body's `Reviewed head:` lines, `null` when any line is malformed or the lines
+* disagree, or `undefined` when absent.
+*/
+function reviewedHeadFromBody(body) {
+	const shas = new Set([...(body ?? "").matchAll(REVIEWED_HEAD_LINE)].map((line) => FULL_SHA.exec(line[1].trim())?.[1]?.toLowerCase() ?? null));
+	if (shas.size === 0) return void 0;
+	if (shas.size > 1) return null;
+	return [...shas][0];
+}
 function authIdentity(requestContext) {
 	const user = getFactoryAuthUserFromContext(requestContext);
 	return {
@@ -404,13 +426,40 @@ function createSourceControlTools({ requestContext, providers, audit }) {
 			}).refine((input) => input.event === "approve" || Boolean(input.body?.trim()), {
 				path: ["body"],
 				message: "request-changes and comment reviews require a body."
+			}).superRefine((input, ctx) => {
+				const mismatch = verdictEventMismatch(input.event, input.body);
+				if (mismatch) ctx.addIssue({
+					code: "custom",
+					path: ["body"],
+					message: mismatch
+				});
+				const reviewedHead = reviewedHeadFromBody(input.body);
+				if (reviewedHead === null) ctx.addIssue({
+					code: "custom",
+					path: ["body"],
+					message: "Every \"Reviewed head:\" line must name the same full 40- or 64-character commit SHA."
+				});
+				else if (reviewedHead && input.commitId && input.commitId.toLowerCase() !== reviewedHead) ctx.addIssue({
+					code: "custom",
+					path: ["commitId"],
+					message: `Review body says "Reviewed head: ${reviewedHead}" but commitId is ${input.commitId}. Nothing was posted. Re-review the current head and regenerate the body before publishing.`
+				});
 			}),
 			execute: async (input) => {
 				const target = await withTarget();
+				const reviewedHead = reviewedHeadFromBody(input.body);
+				if (reviewedHead) {
+					const pullRequest = await target.provider.versionControl.getPullRequest({
+						...await reference(target),
+						pullRequestId: changeRequestId(input.changeRequestId)
+					});
+					if (!pullRequest) throw new Error(`Change request ${input.changeRequestId} was not found; nothing was posted.`);
+					if (pullRequest.headSha && pullRequest.headSha.toLowerCase() !== reviewedHead) throw new Error(`Review body says "Reviewed head: ${reviewedHead}" but the current change-request head is ${pullRequest.headSha}. Nothing was posted. Re-review the current head and regenerate the body before publishing.`);
+				}
 				const base = {
 					...await reference(target),
 					pullRequestId: changeRequestId(input.changeRequestId),
-					...input.commitId !== void 0 ? { commitId: input.commitId } : {}
+					...input.commitId !== void 0 ? { commitId: input.commitId } : reviewedHead ? { commitId: reviewedHead } : {}
 				};
 				if (input.event === "approve") return target.provider.versionControl.createReview({
 					...base,
@@ -467,6 +516,6 @@ function createSourceControlTools({ requestContext, providers, audit }) {
 	};
 }
 //#endregion
-export { createSourceControlTools };
+export { createSourceControlTools, reviewedHeadFromBody, verdictEventMismatch };
 
 //# sourceMappingURL=source-control-tools.js.map

package/dist/session/source-control-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-control-tools.js","names":[],"sources":["../../src/session/source-control-tools.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { createTool } from '@mastra/core/tools';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport { z } from 'zod';\n\nimport { getFactoryAuthOrgId, getFactoryAuthUserFromContext, getFactoryAuthUserId } from '../auth.js';\nimport type { VersionControl } from '../capabilities/version-control.js';\nimport type { IntegrationTools } from '../integrations/base.js';\nimport { pushRepositoryBranch, refreshMergeRequestCheckout } from '../integrations/github/sandbox.js';\nimport type { ExecutableSandbox } from '../sandbox/materialization.js';\nimport { resolveSessionWorkdir } from '../sandbox/session-sandbox.js';\nimport type { AuditAgentEmitter } from '../storage/domains/audit/domain.js';\nimport type {\n  ProjectRepository,\n  SourceControlRepository,\n  SourceControlSession,\n  SourceControlStorageHandle,\n} from '../storage/domains/source-control/base.js';\nimport { mergeRequestNumberFromBranch } from '../work-item-branch.js';\n\ntype RepositorySessionState = {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n};\n\nexport interface SourceControlToolProvider {\n  id: string;\n  storage: SourceControlStorageHandle;\n  versionControl: VersionControl;\n}\n\ninterface SessionTarget {\n  context: AgentControllerRequestContext<RepositorySessionState>;\n  provider: SourceControlToolProvider;\n  session: SourceControlSession;\n  projectRepository: ProjectRepository;\n  repository: SourceControlRepository;\n  orgId: string;\n  userId: string;\n}\n\nfunction authIdentity(requestContext: RequestContext) {\n  const user = getFactoryAuthUserFromContext(requestContext);\n  return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n}\n\nasync function resolveSessionTarget(\n  requestContext: RequestContext,\n  providers: readonly SourceControlToolProvider[],\n): Promise<SessionTarget> {\n  const context = requestContext.get('controller') as AgentControllerRequestContext<RepositorySessionState> | undefined;\n  const { orgId, userId } = authIdentity(requestContext);\n  if (!context?.resourceId || !orgId || !userId) {\n    throw new Error('Source-control tools require an authenticated repository session.');\n  }\n\n  const matches = (\n    await Promise.all(\n      providers.map(async provider => ({\n        provider,\n        session: await provider.storage.sessions.getBySessionId(context.resourceId),\n      })),\n    )\n  ).filter(\n    (match): match is { provider: SourceControlToolProvider; session: SourceControlSession } => match.session !== null,\n  );\n  if (matches.length !== 1) {\n    throw new Error(\n      matches.length === 0\n        ? 'The active session is not backed by a source-control repository.'\n        : 'The active session is ambiguous across source-control providers.',\n    );\n  }\n\n  const { provider, session } = matches[0]!;\n  if (session.orgId !== orgId || (session.visibility === 'private' && session.userId !== userId)) {\n    throw new Error('The active source-control session is not available to the authenticated user.');\n  }\n  const projectRepository = await provider.storage.projectRepositories.get({\n    orgId,\n    id: session.projectRepositoryId,\n  });\n  if (!projectRepository) throw new Error('The active project repository was not found.');\n  const state = context.getState();\n  if (state.projectRepositoryId && state.projectRepositoryId !== projectRepository.id) {\n    throw new Error('The active source-control session does not match its controller repository.');\n  }\n  const connection = await provider.storage.connections.get({ orgId, id: projectRepository.connectionId });\n  if (!connection) throw new Error('The active source-control connection was not found.');\n  if (state.factoryProjectId && state.factoryProjectId !== connection.factoryProjectId) {\n    throw new Error('The active source-control session does not match its Factory project.');\n  }\n  const repository = await provider.storage.repositories.get({ orgId, id: projectRepository.repositoryId });\n  if (!repository) throw new Error('The active source-control repository was not found.');\n  return { context, provider, session, projectRepository, repository, orgId, userId };\n}\n\nfunction changeRequestId(value: string | number): string {\n  return String(value);\n}\n\nfunction executableSandbox(value: unknown): WorkspaceSandbox & ExecutableSandbox {\n  const sandbox = value as Partial<ExecutableSandbox> | undefined;\n  if (!sandbox?.executeCommand) throw new Error('The active Factory workspace has no executable sandbox.');\n  return sandbox as WorkspaceSandbox & ExecutableSandbox;\n}\n\nasync function emitAgentAudit(\n  audit: AuditAgentEmitter,\n  requestContext: RequestContext,\n  input: Parameters<AuditAgentEmitter['emitAgent']>[0]['input'],\n): Promise<void> {\n  try {\n    await audit.emitAgent({ requestContext, input });\n  } catch (error) {\n    console.warn('[Audit] Failed to record brokered source-control action', {\n      action: input.action,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\nconst changeRequestSchema = z.object({\n  changeRequestId: z.union([z.string().trim().min(1), z.number().int().positive()]),\n});\n\nexport function createSourceControlTools({\n  requestContext,\n  providers,\n  audit,\n}: {\n  requestContext: RequestContext;\n  providers: readonly SourceControlToolProvider[];\n  audit: AuditAgentEmitter;\n}): IntegrationTools {\n  if (!requestContext || typeof (requestContext as { get?: unknown }).get !== 'function') return {};\n  const controller = requestContext.get('controller') as\n    | AgentControllerRequestContext<RepositorySessionState>\n    | undefined;\n  const identity = authIdentity(requestContext);\n  if (!controller?.resourceId || !identity.orgId || !identity.userId || providers.length === 0) return {};\n\n  const withTarget = () => resolveSessionTarget(requestContext, providers);\n  const reference = async (target: SessionTarget) => ({\n    ...(await target.provider.versionControl.getRepositoryTarget({\n      orgId: target.orgId,\n      repositoryId: target.repository.id,\n    })),\n    actingUserId: target.userId,\n  });\n\n  return {\n    source_control_refresh_change_request_checkout: createTool({\n      id: 'source_control_refresh_change_request_checkout',\n      description:\n        'Refresh the active GitLab review session checkout to its current MR head. The MR, repository, branch, and credential are resolved server-side; no provider credentials enter the agent workspace.',\n      inputSchema: z.object({}),\n      execute: async (_input, { workspace }) => {\n        const target = await withTarget();\n        const mergeRequestNumber = mergeRequestNumberFromBranch(target.session.branch);\n        if (target.provider.id !== 'gitlab' || mergeRequestNumber === undefined) {\n          throw new Error('Checkout refresh is only available in a bound GitLab merge-request review session.');\n        }\n        const ref = await reference(target);\n        const mergeRequest = await target.provider.versionControl.getPullRequest({\n          ...ref,\n          pullRequestId: String(mergeRequestNumber),\n        });\n        if (!mergeRequest || mergeRequest.state !== 'open' || mergeRequest.merged) {\n          throw new Error('The bound GitLab merge request is no longer open.');\n        }\n        const sandbox = executableSandbox(workspace?.sandbox);\n        const workdir = await resolveSessionWorkdir(target.session.id, sandbox, target.repository.slug);\n        const access = await target.provider.versionControl.getRepositoryAccess({\n          orgId: target.orgId,\n          repositoryId: target.repository.id,\n        });\n        const result = await refreshMergeRequestCheckout(sandbox, workdir, {\n          branch: target.session.branch,\n          mergeRequestNumber,\n          expectedHeadSha: mergeRequest.headSha,\n          access,\n        });\n        return result;\n      },\n    }),\n    source_control_push_branch: createTool({\n      id: 'source_control_push_branch',\n      description:\n        'Push the active Factory session branch to its connected source-control provider. Credentials are resolved and scrubbed server-side; this tool takes no token, repository, remote, or branch arguments.',\n      inputSchema: z.object({}),\n      execute: async (_input, { workspace }) => {\n        const target = await withTarget();\n        const sandbox = executableSandbox(workspace?.sandbox);\n        const workdir = await resolveSessionWorkdir(target.session.id, sandbox, target.repository.slug);\n        const access = await target.provider.versionControl.getRepositoryAccess({\n          orgId: target.orgId,\n          repositoryId: target.repository.id,\n        });\n        await pushRepositoryBranch(sandbox, workdir, target.session.branch, access, target.repository.slug);\n        await emitAgentAudit(audit, requestContext, {\n          action: 'factory.agent.push',\n          targets: [{ type: 'repository', id: target.repository.slug }],\n          metadata: { branch: target.session.branch, provider: target.provider.id },\n        });\n        return { pushed: true, branch: target.session.branch, repository: target.repository.slug };\n      },\n    }),\n    source_control_get_change_request: createTool({\n      id: 'source_control_get_change_request',\n      description:\n        'Read a pull request or merge request in the active Factory repository by its numeric repository-local ID.',\n      inputSchema: changeRequestSchema,\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.getPullRequest({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n        });\n      },\n    }),\n    source_control_list_change_request_reviews: createTool({\n      id: 'source_control_list_change_request_reviews',\n      description: 'List submitted reviews and approvals on a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ cursor: z.string().trim().min(1).optional() }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.listReviews({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),\n        });\n      },\n    }),\n    source_control_create_change_request: createTool({\n      id: 'source_control_create_change_request',\n      description:\n        'Open a pull request or merge request from the active Factory session branch into its persisted base branch. Push the branch with source_control_push_branch first.',\n      inputSchema: z.object({\n        title: z.string().trim().min(1),\n        body: z.string().optional(),\n        draft: z.boolean().optional(),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        const created = await target.provider.versionControl.createPullRequest({\n          ...(await reference(target)),\n          title: input.title,\n          ...(input.body !== undefined ? { body: input.body } : {}),\n          baseBranch: target.session.baseBranch,\n          headBranch: target.session.branch,\n          ...(input.draft !== undefined ? { draft: input.draft } : {}),\n        });\n        await emitAgentAudit(audit, requestContext, {\n          action: 'factory.agent.pr_opened',\n          targets: [\n            { type: 'pull_request', id: created.url },\n            { type: 'repository', id: target.repository.slug },\n          ],\n          metadata: { url: created.url, provider: target.provider.id },\n        });\n        return created;\n      },\n    }),\n    source_control_update_change_request: createTool({\n      id: 'source_control_update_change_request',\n      description: 'Update the title, body, target branch, or open/closed state of a change request.',\n      inputSchema: changeRequestSchema.extend({\n        title: z.string().trim().min(1).optional(),\n        body: z.string().nullable().optional(),\n        baseBranch: z.string().trim().min(1).optional(),\n        state: z.enum(['open', 'closed']).optional(),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.updatePullRequest({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.title !== undefined ? { title: input.title } : {}),\n          ...(input.body !== undefined ? { body: input.body } : {}),\n          ...(input.baseBranch !== undefined ? { baseBranch: input.baseBranch } : {}),\n          ...(input.state !== undefined ? { state: input.state } : {}),\n        });\n      },\n    }),\n    source_control_comment_change_request: createTool({\n      id: 'source_control_comment_change_request',\n      description: 'Add a top-level comment to a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ body: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.createComment({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          body: input.body,\n        });\n      },\n    }),\n    source_control_list_change_request_comments: createTool({\n      id: 'source_control_list_change_request_comments',\n      description: 'List top-level comments on a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ cursor: z.string().trim().min(1).optional() }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.listComments({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),\n        });\n      },\n    }),\n    source_control_update_change_request_comment: createTool({\n      id: 'source_control_update_change_request_comment',\n      description: 'Edit a top-level pull-request or merge-request comment in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1), body: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.updateComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n          body: input.body,\n        });\n      },\n    }),\n    source_control_delete_change_request_comment: createTool({\n      id: 'source_control_delete_change_request_comment',\n      description: 'Delete a top-level pull-request or merge-request comment in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        await target.provider.versionControl.deleteComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n        });\n        return { deleted: true };\n      },\n    }),\n    source_control_list_diff_comments: createTool({\n      id: 'source_control_list_diff_comments',\n      description:\n        'List line-anchored review comments and discussion replies on a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ cursor: z.string().trim().min(1).optional() }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.listReviewComments({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),\n        });\n      },\n    }),\n    source_control_create_diff_comment: createTool({\n      id: 'source_control_create_diff_comment',\n      description:\n        'Create a line-anchored review comment or reply to an existing diff discussion. Use replyToId alone for a reply; otherwise provide commitId, path, line, and side.',\n      // A root-level union is not representable as provider function parameters, which must be\n      // an object schema, so both modes share one object shape and a refinement.\n      inputSchema: changeRequestSchema\n        .extend({\n          body: z.string().trim().min(1),\n          replyToId: z.string().trim().min(1).optional(),\n          commitId: z.string().trim().min(1).optional(),\n          path: z.string().trim().min(1).optional(),\n          line: z.number().int().positive().optional(),\n          side: z.enum(['left', 'right']).optional(),\n          startLine: z.number().int().positive().optional(),\n          startSide: z.enum(['left', 'right']).optional(),\n        })\n        .refine(\n          input => {\n            const anchorFields = [input.commitId, input.path, input.line, input.side];\n            const anchor = anchorFields.every(field => field !== undefined);\n            const reply = input.replyToId !== undefined;\n            return (\n              (reply ? anchorFields.every(field => field === undefined) : anchor) &&\n              (input.startLine === undefined) === (input.startSide === undefined)\n            );\n          },\n          {\n            message:\n              'Provide replyToId alone to reply to a diff thread, or commitId, path, line, and side to start one. startLine and startSide must be provided together.',\n          },\n        ),\n      execute: async input => {\n        const target = await withTarget();\n        const base = {\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          body: input.body,\n        };\n        if (input.replyToId !== undefined) {\n          return target.provider.versionControl.createReviewComment({ ...base, replyToId: input.replyToId });\n        }\n        if (\n          input.commitId === undefined ||\n          input.path === undefined ||\n          input.line === undefined ||\n          input.side === undefined\n        ) {\n          throw new Error('commitId, path, line, and side are required to start a new diff thread.');\n        }\n        return target.provider.versionControl.createReviewComment({\n          ...base,\n          commitId: input.commitId,\n          path: input.path,\n          line: input.line,\n          side: input.side,\n          ...(input.startLine !== undefined && input.startSide !== undefined\n            ? { startLine: input.startLine, startSide: input.startSide }\n            : {}),\n        });\n      },\n    }),\n    source_control_update_diff_comment: createTool({\n      id: 'source_control_update_diff_comment',\n      description: 'Edit a line-anchored review comment or discussion reply in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1), body: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.updateReviewComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n          body: input.body,\n        });\n      },\n    }),\n    source_control_delete_diff_comment: createTool({\n      id: 'source_control_delete_diff_comment',\n      description: 'Delete a line-anchored review comment or discussion reply in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        await target.provider.versionControl.deleteReviewComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n        });\n        return { deleted: true };\n      },\n    }),\n    source_control_resolve_diff_thread: createTool({\n      id: 'source_control_resolve_diff_thread',\n      description:\n        'Resolve or reopen the review thread containing a diff comment. Providers without resolvable threads return an explicit limitation.',\n      inputSchema: z.object({\n        commentId: z.string().trim().min(1),\n        resolved: z.boolean().default(true),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        const resolveReviewThread = target.provider.versionControl.resolveReviewThread;\n        if (!resolveReviewThread) {\n          throw new Error(`${target.provider.id} does not support resolving review threads.`);\n        }\n        await resolveReviewThread({\n          ...(await reference(target)),\n          commentId: input.commentId,\n          resolved: input.resolved,\n        });\n        return { resolved: input.resolved };\n      },\n    }),\n    source_control_review_change_request: createTool({\n      id: 'source_control_review_change_request',\n      description:\n        'Submit an approve, request-changes, or comment review to a change request. Provider limitations are returned explicitly.',\n      inputSchema: changeRequestSchema\n        .extend({\n          event: z.enum(['approve', 'request-changes', 'comment']),\n          body: z.string().optional(),\n          commitId: z.string().trim().min(1).optional(),\n        })\n        .refine(input => input.event === 'approve' || Boolean(input.body?.trim()), {\n          path: ['body'],\n          message: 'request-changes and comment reviews require a body.',\n        }),\n      execute: async input => {\n        const target = await withTarget();\n        const base = {\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.commitId !== undefined ? { commitId: input.commitId } : {}),\n        };\n        if (input.event === 'approve') {\n          return target.provider.versionControl.createReview({\n            ...base,\n            event: 'approve',\n            ...(input.body !== undefined ? { body: input.body } : {}),\n          });\n        }\n        return target.provider.versionControl.createReview({ ...base, event: input.event, body: input.body! });\n      },\n    }),\n    source_control_request_reviewers: createTool({\n      id: 'source_control_request_reviewers',\n      description:\n        'Request individual or team reviewers on a pull request or merge request. Provider limitations are returned explicitly.',\n      inputSchema: changeRequestSchema.extend({\n        users: z.array(z.string().trim().min(1)).default([]),\n        teams: z.array(z.string().trim().min(1)).default([]),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.requestReviewers({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          users: input.users,\n          teams: input.teams,\n        });\n      },\n    }),\n    source_control_merge_change_request: createTool({\n      id: 'source_control_merge_change_request',\n      description: 'Merge a pull request or merge request using the requested provider-supported merge method.',\n      inputSchema: changeRequestSchema.extend({\n        method: z.enum(['merge', 'squash', 'rebase']).optional(),\n        commitTitle: z.string().optional(),\n        commitMessage: z.string().optional(),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.mergePullRequest({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.method !== undefined ? { method: input.method } : {}),\n          ...(input.commitTitle !== undefined ? { commitTitle: input.commitTitle } : {}),\n          ...(input.commitMessage !== undefined ? { commitMessage: input.commitMessage } : {}),\n        });\n      },\n    }),\n  };\n}\n"],"mappings":";;;;;;;AA0CA,SAAS,aAAa,gBAAgC;CACpD,MAAM,OAAO,8BAA8B,cAAc;CACzD,OAAO;EAAE,OAAO,oBAAoB,IAAI;EAAG,QAAQ,qBAAqB,IAAI;CAAE;AAChF;AAEA,eAAe,qBACb,gBACA,WACwB;CACxB,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,MAAM,EAAE,OAAO,WAAW,aAAa,cAAc;CACrD,IAAI,CAAC,SAAS,cAAc,CAAC,SAAS,CAAC,QACrC,MAAM,IAAI,MAAM,mEAAmE;CAGrF,MAAM,WACJ,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAM,cAAa;EAC/B;EACA,SAAS,MAAM,SAAS,QAAQ,SAAS,eAAe,QAAQ,UAAU;CAC5E,EAAE,CACJ,EAAA,CACA,QACC,UAA2F,MAAM,YAAY,IAChH;CACA,IAAI,QAAQ,WAAW,GACrB,MAAM,IAAI,MACR,QAAQ,WAAW,IACf,qEACA,kEACN;CAGF,MAAM,EAAE,UAAU,YAAY,QAAQ;CACtC,IAAI,QAAQ,UAAU,SAAU,QAAQ,eAAe,aAAa,QAAQ,WAAW,QACrF,MAAM,IAAI,MAAM,+EAA+E;CAEjG,MAAM,oBAAoB,MAAM,SAAS,QAAQ,oBAAoB,IAAI;EACvE;EACA,IAAI,QAAQ;CACd,CAAC;CACD,IAAI,CAAC,mBAAmB,MAAM,IAAI,MAAM,8CAA8C;CACtF,MAAM,QAAQ,QAAQ,SAAS;CAC/B,IAAI,MAAM,uBAAuB,MAAM,wBAAwB,kBAAkB,IAC/E,MAAM,IAAI,MAAM,6EAA6E;CAE/F,MAAM,aAAa,MAAM,SAAS,QAAQ,YAAY,IAAI;EAAE;EAAO,IAAI,kBAAkB;CAAa,CAAC;CACvG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CACtF,IAAI,MAAM,oBAAoB,MAAM,qBAAqB,WAAW,kBAClE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,MAAM,aAAa,MAAM,SAAS,QAAQ,aAAa,IAAI;EAAE;EAAO,IAAI,kBAAkB;CAAa,CAAC;CACxG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CACtF,OAAO;EAAE;EAAS;EAAU;EAAS;EAAmB;EAAY;EAAO;CAAO;AACpF;AAEA,SAAS,gBAAgB,OAAgC;CACvD,OAAO,OAAO,KAAK;AACrB;AAEA,SAAS,kBAAkB,OAAsD;CAC/E,MAAM,UAAU;CAChB,IAAI,CAAC,SAAS,gBAAgB,MAAM,IAAI,MAAM,yDAAyD;CACvG,OAAO;AACT;AAEA,eAAe,eACb,OACA,gBACA,OACe;CACf,IAAI;EACF,MAAM,MAAM,UAAU;GAAE;GAAgB;EAAM,CAAC;CACjD,SAAS,OAAO;EACd,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,MAAM;GACd,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EACnC,iBAAiB,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAClF,CAAC;AAED,SAAgB,yBAAyB,EACvC,gBACA,WACA,SAKmB;CACnB,IAAI,CAAC,kBAAkB,OAAQ,eAAqC,QAAQ,YAAY,OAAO,CAAC;CAChG,MAAM,aAAa,eAAe,IAAI,YAAY;CAGlD,MAAM,WAAW,aAAa,cAAc;CAC5C,IAAI,CAAC,YAAY,cAAc,CAAC,SAAS,SAAS,CAAC,SAAS,UAAU,UAAU,WAAW,GAAG,OAAO,CAAC;CAEtG,MAAM,mBAAmB,qBAAqB,gBAAgB,SAAS;CACvE,MAAM,YAAY,OAAO,YAA2B;EAClD,GAAI,MAAM,OAAO,SAAS,eAAe,oBAAoB;GAC3D,OAAO,OAAO;GACd,cAAc,OAAO,WAAW;EAClC,CAAC;EACD,cAAc,OAAO;CACvB;CAEA,OAAO;EACL,gDAAgD,WAAW;GACzD,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO,CAAC,CAAC;GACxB,SAAS,OAAO,QAAQ,EAAE,gBAAgB;IACxC,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,qBAAqB,6BAA6B,OAAO,QAAQ,MAAM;IAC7E,IAAI,OAAO,SAAS,OAAO,YAAY,uBAAuB,KAAA,GAC5D,MAAM,IAAI,MAAM,oFAAoF;IAEtG,MAAM,MAAM,MAAM,UAAU,MAAM;IAClC,MAAM,eAAe,MAAM,OAAO,SAAS,eAAe,eAAe;KACvE,GAAG;KACH,eAAe,OAAO,kBAAkB;IAC1C,CAAC;IACD,IAAI,CAAC,gBAAgB,aAAa,UAAU,UAAU,aAAa,QACjE,MAAM,IAAI,MAAM,mDAAmD;IAErE,MAAM,UAAU,kBAAkB,WAAW,OAAO;IACpD,MAAM,UAAU,MAAM,sBAAsB,OAAO,QAAQ,IAAI,SAAS,OAAO,WAAW,IAAI;IAC9F,MAAM,SAAS,MAAM,OAAO,SAAS,eAAe,oBAAoB;KACtE,OAAO,OAAO;KACd,cAAc,OAAO,WAAW;IAClC,CAAC;IAOD,OAAO,MANc,4BAA4B,SAAS,SAAS;KACjE,QAAQ,OAAO,QAAQ;KACvB;KACA,iBAAiB,aAAa;KAC9B;IACF,CAAC;GAEH;EACF,CAAC;EACD,4BAA4B,WAAW;GACrC,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO,CAAC,CAAC;GACxB,SAAS,OAAO,QAAQ,EAAE,gBAAgB;IACxC,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,UAAU,kBAAkB,WAAW,OAAO;IACpD,MAAM,UAAU,MAAM,sBAAsB,OAAO,QAAQ,IAAI,SAAS,OAAO,WAAW,IAAI;IAC9F,MAAM,SAAS,MAAM,OAAO,SAAS,eAAe,oBAAoB;KACtE,OAAO,OAAO;KACd,cAAc,OAAO,WAAW;IAClC,CAAC;IACD,MAAM,qBAAqB,SAAS,SAAS,OAAO,QAAQ,QAAQ,QAAQ,OAAO,WAAW,IAAI;IAClG,MAAM,eAAe,OAAO,gBAAgB;KAC1C,QAAQ;KACR,SAAS,CAAC;MAAE,MAAM;MAAc,IAAI,OAAO,WAAW;KAAK,CAAC;KAC5D,UAAU;MAAE,QAAQ,OAAO,QAAQ;MAAQ,UAAU,OAAO,SAAS;KAAG;IAC1E,CAAC;IACD,OAAO;KAAE,QAAQ;KAAM,QAAQ,OAAO,QAAQ;KAAQ,YAAY,OAAO,WAAW;IAAK;GAC3F;EACF,CAAC;EACD,mCAAmC,WAAW;GAC5C,IAAI;GACJ,aACE;GACF,aAAa;GACb,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,eAAe;KACnD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;IACtD,CAAC;GACH;EACF,CAAC;EACD,4CAA4C,WAAW;GACrD,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;GACvF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,YAAY;KAChD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,sCAAsC,WAAW;GAC/C,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO;IACpB,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,OAAO,EAAE,QAAQ,CAAC,CAAC,SAAS;GAC9B,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,UAAU,MAAM,OAAO,SAAS,eAAe,kBAAkB;KACrE,GAAI,MAAM,UAAU,MAAM;KAC1B,OAAO,MAAM;KACb,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;KACvD,YAAY,OAAO,QAAQ;KAC3B,YAAY,OAAO,QAAQ;KAC3B,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,eAAe,OAAO,gBAAgB;KAC1C,QAAQ;KACR,SAAS,CACP;MAAE,MAAM;MAAgB,IAAI,QAAQ;KAAI,GACxC;MAAE,MAAM;MAAc,IAAI,OAAO,WAAW;KAAK,CACnD;KACA,UAAU;MAAE,KAAK,QAAQ;MAAK,UAAU,OAAO,SAAS;KAAG;IAC7D,CAAC;IACD,OAAO;GACT;EACF,CAAC;EACD,sCAAsC,WAAW;GAC/C,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO;IACtC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;IACrC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC9C,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,SAAS;GAC7C,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,kBAAkB;KACtD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;KAC1D,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;KACvD,GAAI,MAAM,eAAe,KAAA,IAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;KACzE,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;IAC5D,CAAC;GACH;EACF,CAAC;EACD,uCAAuC,WAAW;GAChD,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;GAC1E,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,cAAc;KAClD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,MAAM,MAAM;IACd,CAAC;GACH;EACF,CAAC;EACD,6CAA6C,WAAW;GACtD,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;GACvF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,aAAa;KACjD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,8CAA8C,WAAW;GACvD,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO;IAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAAG,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;GAAE,CAAC;GAC7F,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,cAAc;KAClD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;KACjB,MAAM,MAAM;IACd,CAAC;GACH;EACF,CAAC;EACD,8CAA8C,WAAW;GACvD,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;GAC7D,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO,SAAS,eAAe,cAAc;KACjD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,KAAK;GACzB;EACF,CAAC;EACD,mCAAmC,WAAW;GAC5C,IAAI;GACJ,aACE;GACF,aAAa,oBAAoB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;GACvF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,mBAAmB;KACvD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aACE;GAGF,aAAa,oBACV,OAAO;IACN,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC7C,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC5C,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IACxC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;IAC3C,MAAM,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,SAAS;IACzC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;IAChD,WAAW,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,SAAS;GAChD,CAAC,CAAC,CACD,QACC,UAAS;IACP,MAAM,eAAe;KAAC,MAAM;KAAU,MAAM;KAAM,MAAM;KAAM,MAAM;IAAI;IACxE,MAAM,SAAS,aAAa,OAAM,UAAS,UAAU,KAAA,CAAS;IAE9D,QADc,MAAM,cAAc,KAAA,IAEvB,aAAa,OAAM,UAAS,UAAU,KAAA,CAAS,IAAI,WAC3D,MAAM,cAAc,KAAA,OAAgB,MAAM,cAAc,KAAA;GAE7D,GACA,EACE,SACE,wJACJ,CACF;GACF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO;KACX,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,MAAM,MAAM;IACd;IACA,IAAI,MAAM,cAAc,KAAA,GACtB,OAAO,OAAO,SAAS,eAAe,oBAAoB;KAAE,GAAG;KAAM,WAAW,MAAM;IAAU,CAAC;IAEnG,IACE,MAAM,aAAa,KAAA,KACnB,MAAM,SAAS,KAAA,KACf,MAAM,SAAS,KAAA,KACf,MAAM,SAAS,KAAA,GAEf,MAAM,IAAI,MAAM,yEAAyE;IAE3F,OAAO,OAAO,SAAS,eAAe,oBAAoB;KACxD,GAAG;KACH,UAAU,MAAM;KAChB,MAAM,MAAM;KACZ,MAAM,MAAM;KACZ,MAAM,MAAM;KACZ,GAAI,MAAM,cAAc,KAAA,KAAa,MAAM,cAAc,KAAA,IACrD;MAAE,WAAW,MAAM;MAAW,WAAW,MAAM;KAAU,IACzD,CAAC;IACP,CAAC;GACH;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO;IAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAAG,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;GAAE,CAAC;GAC7F,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,oBAAoB;KACxD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;KACjB,MAAM,MAAM;IACd,CAAC;GACH;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;GAC7D,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO,SAAS,eAAe,oBAAoB;KACvD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,KAAK;GACzB;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAClC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;GACpC,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,sBAAsB,OAAO,SAAS,eAAe;IAC3D,IAAI,CAAC,qBACH,MAAM,IAAI,MAAM,GAAG,OAAO,SAAS,GAAG,4CAA4C;IAEpF,MAAM,oBAAoB;KACxB,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;KACjB,UAAU,MAAM;IAClB,CAAC;IACD,OAAO,EAAE,UAAU,MAAM,SAAS;GACpC;EACF,CAAC;EACD,sCAAsC,WAAW;GAC/C,IAAI;GACJ,aACE;GACF,aAAa,oBACV,OAAO;IACN,OAAO,EAAE,KAAK;KAAC;KAAW;KAAmB;IAAS,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;GAC9C,CAAC,CAAC,CACD,QAAO,UAAS,MAAM,UAAU,aAAa,QAAQ,MAAM,MAAM,KAAK,CAAC,GAAG;IACzE,MAAM,CAAC,MAAM;IACb,SAAS;GACX,CAAC;GACH,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO;KACX,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;IACrE;IACA,IAAI,MAAM,UAAU,WAClB,OAAO,OAAO,SAAS,eAAe,aAAa;KACjD,GAAG;KACH,OAAO;KACP,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;IACzD,CAAC;IAEH,OAAO,OAAO,SAAS,eAAe,aAAa;KAAE,GAAG;KAAM,OAAO,MAAM;KAAO,MAAM,MAAM;IAAM,CAAC;GACvG;EACF,CAAC;EACD,kCAAkC,WAAW;GAC3C,IAAI;GACJ,aACE;GACF,aAAa,oBAAoB,OAAO;IACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;GACrD,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,iBAAiB;KACrD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,OAAO,MAAM;KACb,OAAO,MAAM;IACf,CAAC;GACH;EACF,CAAC;EACD,qCAAqC,WAAW;GAC9C,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO;IACtC,QAAQ,EAAE,KAAK;KAAC;KAAS;KAAU;IAAQ,CAAC,CAAC,CAAC,SAAS;IACvD,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;IACjC,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;GACrC,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,iBAAiB;KACrD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;KAC7D,GAAI,MAAM,gBAAgB,KAAA,IAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;KAC5E,GAAI,MAAM,kBAAkB,KAAA,IAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;IACpF,CAAC;GACH;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"source-control-tools.js","names":[],"sources":["../../src/session/source-control-tools.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport { createTool } from '@mastra/core/tools';\nimport type { WorkspaceSandbox } from '@mastra/core/workspace';\nimport { z } from 'zod';\n\nimport { getFactoryAuthOrgId, getFactoryAuthUserFromContext, getFactoryAuthUserId } from '../auth.js';\nimport type { VersionControl } from '../capabilities/version-control.js';\nimport type { IntegrationTools } from '../integrations/base.js';\nimport { pushRepositoryBranch, refreshMergeRequestCheckout } from '../integrations/github/sandbox.js';\nimport { normalizedVerdictLine } from '../review-verdict.js';\nimport type { ExecutableSandbox } from '../sandbox/materialization.js';\nimport { resolveSessionWorkdir } from '../sandbox/session-sandbox.js';\nimport type { AuditAgentEmitter } from '../storage/domains/audit/domain.js';\nimport type {\n  ProjectRepository,\n  SourceControlRepository,\n  SourceControlSession,\n  SourceControlStorageHandle,\n} from '../storage/domains/source-control/base.js';\nimport { mergeRequestNumberFromBranch } from '../work-item-branch.js';\n\ntype RepositorySessionState = {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n};\n\nexport interface SourceControlToolProvider {\n  id: string;\n  storage: SourceControlStorageHandle;\n  versionControl: VersionControl;\n}\n\ninterface SessionTarget {\n  context: AgentControllerRequestContext<RepositorySessionState>;\n  provider: SourceControlToolProvider;\n  session: SourceControlSession;\n  projectRepository: ProjectRepository;\n  repository: SourceControlRepository;\n  orgId: string;\n  userId: string;\n}\n\ntype ReviewEvent = 'approve' | 'request-changes' | 'comment';\n\n/** Returns why a review's leading `Verdict:` line contradicts the submitted event, if it does. */\nexport function verdictEventMismatch(event: ReviewEvent, body: string | undefined): string | undefined {\n  const match = /^verdict: ?(approve|request changes|changes requested)\\b/.exec(normalizedVerdictLine(body) ?? '');\n  if (!match) return undefined;\n  const verdict = match[1] === 'approve' ? 'approve' : 'request changes';\n  // GitLab has no request-changes state, so a blocking verdict is published as a comment review.\n  const allowed: ReviewEvent[] = verdict === 'approve' ? ['approve'] : ['request-changes', 'comment'];\n  if (allowed.includes(event)) return undefined;\n  return `Review body opens with \"Verdict: ${verdict}\" but event is \"${event}\". Nothing was posted. Use event ${allowed\n    .map(e => `\"${e}\"`)\n    .join(' or ')} for this body, or regenerate the body for the verdict you intend.`;\n}\n\nconst REVIEWED_HEAD_LINE = /^[\\s*_>-]*reviewed head[*_]*:[*_]*\\s*(.*)$/gim;\nconst FULL_SHA = /^`?([0-9a-f]{40}|[0-9a-f]{64})`?(?:\\s|$)/i;\n\n/**\n * Returns the full SHA named by the body's `Reviewed head:` lines, `null` when any line is malformed or the lines\n * disagree, or `undefined` when absent.\n */\nexport function reviewedHeadFromBody(body: string | undefined): string | null | undefined {\n  const shas = new Set(\n    [...(body ?? '').matchAll(REVIEWED_HEAD_LINE)].map(\n      line => FULL_SHA.exec(line[1]!.trim())?.[1]?.toLowerCase() ?? null,\n    ),\n  );\n  if (shas.size === 0) return undefined;\n  if (shas.size > 1) return null;\n  return [...shas][0];\n}\n\nfunction authIdentity(requestContext: RequestContext) {\n  const user = getFactoryAuthUserFromContext(requestContext);\n  return { orgId: getFactoryAuthOrgId(user), userId: getFactoryAuthUserId(user) };\n}\n\nasync function resolveSessionTarget(\n  requestContext: RequestContext,\n  providers: readonly SourceControlToolProvider[],\n): Promise<SessionTarget> {\n  const context = requestContext.get('controller') as AgentControllerRequestContext<RepositorySessionState> | undefined;\n  const { orgId, userId } = authIdentity(requestContext);\n  if (!context?.resourceId || !orgId || !userId) {\n    throw new Error('Source-control tools require an authenticated repository session.');\n  }\n\n  const matches = (\n    await Promise.all(\n      providers.map(async provider => ({\n        provider,\n        session: await provider.storage.sessions.getBySessionId(context.resourceId),\n      })),\n    )\n  ).filter(\n    (match): match is { provider: SourceControlToolProvider; session: SourceControlSession } => match.session !== null,\n  );\n  if (matches.length !== 1) {\n    throw new Error(\n      matches.length === 0\n        ? 'The active session is not backed by a source-control repository.'\n        : 'The active session is ambiguous across source-control providers.',\n    );\n  }\n\n  const { provider, session } = matches[0]!;\n  if (session.orgId !== orgId || (session.visibility === 'private' && session.userId !== userId)) {\n    throw new Error('The active source-control session is not available to the authenticated user.');\n  }\n  const projectRepository = await provider.storage.projectRepositories.get({\n    orgId,\n    id: session.projectRepositoryId,\n  });\n  if (!projectRepository) throw new Error('The active project repository was not found.');\n  const state = context.getState();\n  if (state.projectRepositoryId && state.projectRepositoryId !== projectRepository.id) {\n    throw new Error('The active source-control session does not match its controller repository.');\n  }\n  const connection = await provider.storage.connections.get({ orgId, id: projectRepository.connectionId });\n  if (!connection) throw new Error('The active source-control connection was not found.');\n  if (state.factoryProjectId && state.factoryProjectId !== connection.factoryProjectId) {\n    throw new Error('The active source-control session does not match its Factory project.');\n  }\n  const repository = await provider.storage.repositories.get({ orgId, id: projectRepository.repositoryId });\n  if (!repository) throw new Error('The active source-control repository was not found.');\n  return { context, provider, session, projectRepository, repository, orgId, userId };\n}\n\nfunction changeRequestId(value: string | number): string {\n  return String(value);\n}\n\nfunction executableSandbox(value: unknown): WorkspaceSandbox & ExecutableSandbox {\n  const sandbox = value as Partial<ExecutableSandbox> | undefined;\n  if (!sandbox?.executeCommand) throw new Error('The active Factory workspace has no executable sandbox.');\n  return sandbox as WorkspaceSandbox & ExecutableSandbox;\n}\n\nasync function emitAgentAudit(\n  audit: AuditAgentEmitter,\n  requestContext: RequestContext,\n  input: Parameters<AuditAgentEmitter['emitAgent']>[0]['input'],\n): Promise<void> {\n  try {\n    await audit.emitAgent({ requestContext, input });\n  } catch (error) {\n    console.warn('[Audit] Failed to record brokered source-control action', {\n      action: input.action,\n      error: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\nconst changeRequestSchema = z.object({\n  changeRequestId: z.union([z.string().trim().min(1), z.number().int().positive()]),\n});\n\nexport function createSourceControlTools({\n  requestContext,\n  providers,\n  audit,\n}: {\n  requestContext: RequestContext;\n  providers: readonly SourceControlToolProvider[];\n  audit: AuditAgentEmitter;\n}): IntegrationTools {\n  if (!requestContext || typeof (requestContext as { get?: unknown }).get !== 'function') return {};\n  const controller = requestContext.get('controller') as\n    | AgentControllerRequestContext<RepositorySessionState>\n    | undefined;\n  const identity = authIdentity(requestContext);\n  if (!controller?.resourceId || !identity.orgId || !identity.userId || providers.length === 0) return {};\n\n  const withTarget = () => resolveSessionTarget(requestContext, providers);\n  const reference = async (target: SessionTarget) => ({\n    ...(await target.provider.versionControl.getRepositoryTarget({\n      orgId: target.orgId,\n      repositoryId: target.repository.id,\n    })),\n    actingUserId: target.userId,\n  });\n\n  return {\n    source_control_refresh_change_request_checkout: createTool({\n      id: 'source_control_refresh_change_request_checkout',\n      description:\n        'Refresh the active GitLab review session checkout to its current MR head. The MR, repository, branch, and credential are resolved server-side; no provider credentials enter the agent workspace.',\n      inputSchema: z.object({}),\n      execute: async (_input, { workspace }) => {\n        const target = await withTarget();\n        const mergeRequestNumber = mergeRequestNumberFromBranch(target.session.branch);\n        if (target.provider.id !== 'gitlab' || mergeRequestNumber === undefined) {\n          throw new Error('Checkout refresh is only available in a bound GitLab merge-request review session.');\n        }\n        const ref = await reference(target);\n        const mergeRequest = await target.provider.versionControl.getPullRequest({\n          ...ref,\n          pullRequestId: String(mergeRequestNumber),\n        });\n        if (!mergeRequest || mergeRequest.state !== 'open' || mergeRequest.merged) {\n          throw new Error('The bound GitLab merge request is no longer open.');\n        }\n        const sandbox = executableSandbox(workspace?.sandbox);\n        const workdir = await resolveSessionWorkdir(target.session.id, sandbox, target.repository.slug);\n        const access = await target.provider.versionControl.getRepositoryAccess({\n          orgId: target.orgId,\n          repositoryId: target.repository.id,\n        });\n        const result = await refreshMergeRequestCheckout(sandbox, workdir, {\n          branch: target.session.branch,\n          mergeRequestNumber,\n          expectedHeadSha: mergeRequest.headSha,\n          access,\n        });\n        return result;\n      },\n    }),\n    source_control_push_branch: createTool({\n      id: 'source_control_push_branch',\n      description:\n        'Push the active Factory session branch to its connected source-control provider. Credentials are resolved and scrubbed server-side; this tool takes no token, repository, remote, or branch arguments.',\n      inputSchema: z.object({}),\n      execute: async (_input, { workspace }) => {\n        const target = await withTarget();\n        const sandbox = executableSandbox(workspace?.sandbox);\n        const workdir = await resolveSessionWorkdir(target.session.id, sandbox, target.repository.slug);\n        const access = await target.provider.versionControl.getRepositoryAccess({\n          orgId: target.orgId,\n          repositoryId: target.repository.id,\n        });\n        await pushRepositoryBranch(sandbox, workdir, target.session.branch, access, target.repository.slug);\n        await emitAgentAudit(audit, requestContext, {\n          action: 'factory.agent.push',\n          targets: [{ type: 'repository', id: target.repository.slug }],\n          metadata: { branch: target.session.branch, provider: target.provider.id },\n        });\n        return { pushed: true, branch: target.session.branch, repository: target.repository.slug };\n      },\n    }),\n    source_control_get_change_request: createTool({\n      id: 'source_control_get_change_request',\n      description:\n        'Read a pull request or merge request in the active Factory repository by its numeric repository-local ID.',\n      inputSchema: changeRequestSchema,\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.getPullRequest({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n        });\n      },\n    }),\n    source_control_list_change_request_reviews: createTool({\n      id: 'source_control_list_change_request_reviews',\n      description: 'List submitted reviews and approvals on a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ cursor: z.string().trim().min(1).optional() }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.listReviews({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),\n        });\n      },\n    }),\n    source_control_create_change_request: createTool({\n      id: 'source_control_create_change_request',\n      description:\n        'Open a pull request or merge request from the active Factory session branch into its persisted base branch. Push the branch with source_control_push_branch first.',\n      inputSchema: z.object({\n        title: z.string().trim().min(1),\n        body: z.string().optional(),\n        draft: z.boolean().optional(),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        const created = await target.provider.versionControl.createPullRequest({\n          ...(await reference(target)),\n          title: input.title,\n          ...(input.body !== undefined ? { body: input.body } : {}),\n          baseBranch: target.session.baseBranch,\n          headBranch: target.session.branch,\n          ...(input.draft !== undefined ? { draft: input.draft } : {}),\n        });\n        await emitAgentAudit(audit, requestContext, {\n          action: 'factory.agent.pr_opened',\n          targets: [\n            { type: 'pull_request', id: created.url },\n            { type: 'repository', id: target.repository.slug },\n          ],\n          metadata: { url: created.url, provider: target.provider.id },\n        });\n        return created;\n      },\n    }),\n    source_control_update_change_request: createTool({\n      id: 'source_control_update_change_request',\n      description: 'Update the title, body, target branch, or open/closed state of a change request.',\n      inputSchema: changeRequestSchema.extend({\n        title: z.string().trim().min(1).optional(),\n        body: z.string().nullable().optional(),\n        baseBranch: z.string().trim().min(1).optional(),\n        state: z.enum(['open', 'closed']).optional(),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.updatePullRequest({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.title !== undefined ? { title: input.title } : {}),\n          ...(input.body !== undefined ? { body: input.body } : {}),\n          ...(input.baseBranch !== undefined ? { baseBranch: input.baseBranch } : {}),\n          ...(input.state !== undefined ? { state: input.state } : {}),\n        });\n      },\n    }),\n    source_control_comment_change_request: createTool({\n      id: 'source_control_comment_change_request',\n      description: 'Add a top-level comment to a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ body: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.createComment({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          body: input.body,\n        });\n      },\n    }),\n    source_control_list_change_request_comments: createTool({\n      id: 'source_control_list_change_request_comments',\n      description: 'List top-level comments on a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ cursor: z.string().trim().min(1).optional() }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.listComments({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),\n        });\n      },\n    }),\n    source_control_update_change_request_comment: createTool({\n      id: 'source_control_update_change_request_comment',\n      description: 'Edit a top-level pull-request or merge-request comment in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1), body: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.updateComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n          body: input.body,\n        });\n      },\n    }),\n    source_control_delete_change_request_comment: createTool({\n      id: 'source_control_delete_change_request_comment',\n      description: 'Delete a top-level pull-request or merge-request comment in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        await target.provider.versionControl.deleteComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n        });\n        return { deleted: true };\n      },\n    }),\n    source_control_list_diff_comments: createTool({\n      id: 'source_control_list_diff_comments',\n      description:\n        'List line-anchored review comments and discussion replies on a pull request or merge request in the active repository.',\n      inputSchema: changeRequestSchema.extend({ cursor: z.string().trim().min(1).optional() }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.listReviewComments({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.cursor !== undefined ? { cursor: input.cursor } : {}),\n        });\n      },\n    }),\n    source_control_create_diff_comment: createTool({\n      id: 'source_control_create_diff_comment',\n      description:\n        'Create a line-anchored review comment or reply to an existing diff discussion. Use replyToId alone for a reply; otherwise provide commitId, path, line, and side.',\n      // A root-level union is not representable as provider function parameters, which must be\n      // an object schema, so both modes share one object shape and a refinement.\n      inputSchema: changeRequestSchema\n        .extend({\n          body: z.string().trim().min(1),\n          replyToId: z.string().trim().min(1).optional(),\n          commitId: z.string().trim().min(1).optional(),\n          path: z.string().trim().min(1).optional(),\n          line: z.number().int().positive().optional(),\n          side: z.enum(['left', 'right']).optional(),\n          startLine: z.number().int().positive().optional(),\n          startSide: z.enum(['left', 'right']).optional(),\n        })\n        .refine(\n          input => {\n            const anchorFields = [input.commitId, input.path, input.line, input.side];\n            const anchor = anchorFields.every(field => field !== undefined);\n            const reply = input.replyToId !== undefined;\n            return (\n              (reply ? anchorFields.every(field => field === undefined) : anchor) &&\n              (input.startLine === undefined) === (input.startSide === undefined)\n            );\n          },\n          {\n            message:\n              'Provide replyToId alone to reply to a diff thread, or commitId, path, line, and side to start one. startLine and startSide must be provided together.',\n          },\n        ),\n      execute: async input => {\n        const target = await withTarget();\n        const base = {\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          body: input.body,\n        };\n        if (input.replyToId !== undefined) {\n          return target.provider.versionControl.createReviewComment({ ...base, replyToId: input.replyToId });\n        }\n        if (\n          input.commitId === undefined ||\n          input.path === undefined ||\n          input.line === undefined ||\n          input.side === undefined\n        ) {\n          throw new Error('commitId, path, line, and side are required to start a new diff thread.');\n        }\n        return target.provider.versionControl.createReviewComment({\n          ...base,\n          commitId: input.commitId,\n          path: input.path,\n          line: input.line,\n          side: input.side,\n          ...(input.startLine !== undefined && input.startSide !== undefined\n            ? { startLine: input.startLine, startSide: input.startSide }\n            : {}),\n        });\n      },\n    }),\n    source_control_update_diff_comment: createTool({\n      id: 'source_control_update_diff_comment',\n      description: 'Edit a line-anchored review comment or discussion reply in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1), body: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.updateReviewComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n          body: input.body,\n        });\n      },\n    }),\n    source_control_delete_diff_comment: createTool({\n      id: 'source_control_delete_diff_comment',\n      description: 'Delete a line-anchored review comment or discussion reply in the active repository.',\n      inputSchema: z.object({ commentId: z.string().trim().min(1) }),\n      execute: async input => {\n        const target = await withTarget();\n        await target.provider.versionControl.deleteReviewComment({\n          ...(await reference(target)),\n          commentId: input.commentId,\n        });\n        return { deleted: true };\n      },\n    }),\n    source_control_resolve_diff_thread: createTool({\n      id: 'source_control_resolve_diff_thread',\n      description:\n        'Resolve or reopen the review thread containing a diff comment. Providers without resolvable threads return an explicit limitation.',\n      inputSchema: z.object({\n        commentId: z.string().trim().min(1),\n        resolved: z.boolean().default(true),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        const resolveReviewThread = target.provider.versionControl.resolveReviewThread;\n        if (!resolveReviewThread) {\n          throw new Error(`${target.provider.id} does not support resolving review threads.`);\n        }\n        await resolveReviewThread({\n          ...(await reference(target)),\n          commentId: input.commentId,\n          resolved: input.resolved,\n        });\n        return { resolved: input.resolved };\n      },\n    }),\n    source_control_review_change_request: createTool({\n      id: 'source_control_review_change_request',\n      description:\n        'Submit an approve, request-changes, or comment review to a change request. Provider limitations are returned explicitly.',\n      inputSchema: changeRequestSchema\n        .extend({\n          event: z.enum(['approve', 'request-changes', 'comment']),\n          body: z.string().optional(),\n          commitId: z.string().trim().min(1).optional(),\n        })\n        .refine(input => input.event === 'approve' || Boolean(input.body?.trim()), {\n          path: ['body'],\n          message: 'request-changes and comment reviews require a body.',\n        })\n        .superRefine((input, ctx) => {\n          const mismatch = verdictEventMismatch(input.event, input.body);\n          if (mismatch) ctx.addIssue({ code: 'custom', path: ['body'], message: mismatch });\n          const reviewedHead = reviewedHeadFromBody(input.body);\n          if (reviewedHead === null) {\n            ctx.addIssue({\n              code: 'custom',\n              path: ['body'],\n              message: 'Every \"Reviewed head:\" line must name the same full 40- or 64-character commit SHA.',\n            });\n          } else if (reviewedHead && input.commitId && input.commitId.toLowerCase() !== reviewedHead) {\n            ctx.addIssue({\n              code: 'custom',\n              path: ['commitId'],\n              message: `Review body says \"Reviewed head: ${reviewedHead}\" but commitId is ${input.commitId}. Nothing was posted. Re-review the current head and regenerate the body before publishing.`,\n            });\n          }\n        }),\n      execute: async input => {\n        const target = await withTarget();\n        const reviewedHead = reviewedHeadFromBody(input.body);\n        if (reviewedHead) {\n          const pullRequest = await target.provider.versionControl.getPullRequest({\n            ...(await reference(target)),\n            pullRequestId: changeRequestId(input.changeRequestId),\n          });\n          if (!pullRequest) {\n            throw new Error(`Change request ${input.changeRequestId} was not found; nothing was posted.`);\n          }\n          if (pullRequest.headSha && pullRequest.headSha.toLowerCase() !== reviewedHead) {\n            throw new Error(\n              `Review body says \"Reviewed head: ${reviewedHead}\" but the current change-request head is ${pullRequest.headSha}. Nothing was posted. Re-review the current head and regenerate the body before publishing.`,\n            );\n          }\n        }\n        const base = {\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.commitId !== undefined\n            ? { commitId: input.commitId }\n            : reviewedHead\n              ? { commitId: reviewedHead }\n              : {}),\n        };\n        if (input.event === 'approve') {\n          return target.provider.versionControl.createReview({\n            ...base,\n            event: 'approve',\n            ...(input.body !== undefined ? { body: input.body } : {}),\n          });\n        }\n        return target.provider.versionControl.createReview({ ...base, event: input.event, body: input.body! });\n      },\n    }),\n    source_control_request_reviewers: createTool({\n      id: 'source_control_request_reviewers',\n      description:\n        'Request individual or team reviewers on a pull request or merge request. Provider limitations are returned explicitly.',\n      inputSchema: changeRequestSchema.extend({\n        users: z.array(z.string().trim().min(1)).default([]),\n        teams: z.array(z.string().trim().min(1)).default([]),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.requestReviewers({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          users: input.users,\n          teams: input.teams,\n        });\n      },\n    }),\n    source_control_merge_change_request: createTool({\n      id: 'source_control_merge_change_request',\n      description: 'Merge a pull request or merge request using the requested provider-supported merge method.',\n      inputSchema: changeRequestSchema.extend({\n        method: z.enum(['merge', 'squash', 'rebase']).optional(),\n        commitTitle: z.string().optional(),\n        commitMessage: z.string().optional(),\n      }),\n      execute: async input => {\n        const target = await withTarget();\n        return target.provider.versionControl.mergePullRequest({\n          ...(await reference(target)),\n          pullRequestId: changeRequestId(input.changeRequestId),\n          ...(input.method !== undefined ? { method: input.method } : {}),\n          ...(input.commitTitle !== undefined ? { commitTitle: input.commitTitle } : {}),\n          ...(input.commitMessage !== undefined ? { commitMessage: input.commitMessage } : {}),\n        });\n      },\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;AA8CA,SAAgB,qBAAqB,OAAoB,MAA8C;CACrG,MAAM,QAAQ,2DAA2D,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/G,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,UAAU,MAAM,OAAO,YAAY,YAAY;CAErD,MAAM,UAAyB,YAAY,YAAY,CAAC,SAAS,IAAI,CAAC,mBAAmB,SAAS;CAClG,IAAI,QAAQ,SAAS,KAAK,GAAG,OAAO,KAAA;CACpC,OAAO,oCAAoC,QAAQ,kBAAkB,MAAM,mCAAmC,QAC3G,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAClB,KAAK,MAAM,EAAE;AAClB;AAEA,MAAM,qBAAqB;AAC3B,MAAM,WAAW;;;;;AAMjB,SAAgB,qBAAqB,MAAqD;CACxF,MAAM,OAAO,IAAI,IACf,CAAC,IAAI,QAAQ,GAAA,CAAI,SAAS,kBAAkB,CAAC,CAAC,CAAC,KAC7C,SAAQ,SAAS,KAAK,KAAK,EAAE,CAAE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,KAAK,IAChE,CACF;CACA,IAAI,KAAK,SAAS,GAAG,OAAO,KAAA;CAC5B,IAAI,KAAK,OAAO,GAAG,OAAO;CAC1B,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB;AAEA,SAAS,aAAa,gBAAgC;CACpD,MAAM,OAAO,8BAA8B,cAAc;CACzD,OAAO;EAAE,OAAO,oBAAoB,IAAI;EAAG,QAAQ,qBAAqB,IAAI;CAAE;AAChF;AAEA,eAAe,qBACb,gBACA,WACwB;CACxB,MAAM,UAAU,eAAe,IAAI,YAAY;CAC/C,MAAM,EAAE,OAAO,WAAW,aAAa,cAAc;CACrD,IAAI,CAAC,SAAS,cAAc,CAAC,SAAS,CAAC,QACrC,MAAM,IAAI,MAAM,mEAAmE;CAGrF,MAAM,WACJ,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAM,cAAa;EAC/B;EACA,SAAS,MAAM,SAAS,QAAQ,SAAS,eAAe,QAAQ,UAAU;CAC5E,EAAE,CACJ,EAAA,CACA,QACC,UAA2F,MAAM,YAAY,IAChH;CACA,IAAI,QAAQ,WAAW,GACrB,MAAM,IAAI,MACR,QAAQ,WAAW,IACf,qEACA,kEACN;CAGF,MAAM,EAAE,UAAU,YAAY,QAAQ;CACtC,IAAI,QAAQ,UAAU,SAAU,QAAQ,eAAe,aAAa,QAAQ,WAAW,QACrF,MAAM,IAAI,MAAM,+EAA+E;CAEjG,MAAM,oBAAoB,MAAM,SAAS,QAAQ,oBAAoB,IAAI;EACvE;EACA,IAAI,QAAQ;CACd,CAAC;CACD,IAAI,CAAC,mBAAmB,MAAM,IAAI,MAAM,8CAA8C;CACtF,MAAM,QAAQ,QAAQ,SAAS;CAC/B,IAAI,MAAM,uBAAuB,MAAM,wBAAwB,kBAAkB,IAC/E,MAAM,IAAI,MAAM,6EAA6E;CAE/F,MAAM,aAAa,MAAM,SAAS,QAAQ,YAAY,IAAI;EAAE;EAAO,IAAI,kBAAkB;CAAa,CAAC;CACvG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CACtF,IAAI,MAAM,oBAAoB,MAAM,qBAAqB,WAAW,kBAClE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,MAAM,aAAa,MAAM,SAAS,QAAQ,aAAa,IAAI;EAAE;EAAO,IAAI,kBAAkB;CAAa,CAAC;CACxG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CACtF,OAAO;EAAE;EAAS;EAAU;EAAS;EAAmB;EAAY;EAAO;CAAO;AACpF;AAEA,SAAS,gBAAgB,OAAgC;CACvD,OAAO,OAAO,KAAK;AACrB;AAEA,SAAS,kBAAkB,OAAsD;CAC/E,MAAM,UAAU;CAChB,IAAI,CAAC,SAAS,gBAAgB,MAAM,IAAI,MAAM,yDAAyD;CACvG,OAAO;AACT;AAEA,eAAe,eACb,OACA,gBACA,OACe;CACf,IAAI;EACF,MAAM,MAAM,UAAU;GAAE;GAAgB;EAAM,CAAC;CACjD,SAAS,OAAO;EACd,QAAQ,KAAK,2DAA2D;GACtE,QAAQ,MAAM;GACd,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC9D,CAAC;CACH;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EACnC,iBAAiB,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAClF,CAAC;AAED,SAAgB,yBAAyB,EACvC,gBACA,WACA,SAKmB;CACnB,IAAI,CAAC,kBAAkB,OAAQ,eAAqC,QAAQ,YAAY,OAAO,CAAC;CAChG,MAAM,aAAa,eAAe,IAAI,YAAY;CAGlD,MAAM,WAAW,aAAa,cAAc;CAC5C,IAAI,CAAC,YAAY,cAAc,CAAC,SAAS,SAAS,CAAC,SAAS,UAAU,UAAU,WAAW,GAAG,OAAO,CAAC;CAEtG,MAAM,mBAAmB,qBAAqB,gBAAgB,SAAS;CACvE,MAAM,YAAY,OAAO,YAA2B;EAClD,GAAI,MAAM,OAAO,SAAS,eAAe,oBAAoB;GAC3D,OAAO,OAAO;GACd,cAAc,OAAO,WAAW;EAClC,CAAC;EACD,cAAc,OAAO;CACvB;CAEA,OAAO;EACL,gDAAgD,WAAW;GACzD,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO,CAAC,CAAC;GACxB,SAAS,OAAO,QAAQ,EAAE,gBAAgB;IACxC,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,qBAAqB,6BAA6B,OAAO,QAAQ,MAAM;IAC7E,IAAI,OAAO,SAAS,OAAO,YAAY,uBAAuB,KAAA,GAC5D,MAAM,IAAI,MAAM,oFAAoF;IAEtG,MAAM,MAAM,MAAM,UAAU,MAAM;IAClC,MAAM,eAAe,MAAM,OAAO,SAAS,eAAe,eAAe;KACvE,GAAG;KACH,eAAe,OAAO,kBAAkB;IAC1C,CAAC;IACD,IAAI,CAAC,gBAAgB,aAAa,UAAU,UAAU,aAAa,QACjE,MAAM,IAAI,MAAM,mDAAmD;IAErE,MAAM,UAAU,kBAAkB,WAAW,OAAO;IACpD,MAAM,UAAU,MAAM,sBAAsB,OAAO,QAAQ,IAAI,SAAS,OAAO,WAAW,IAAI;IAC9F,MAAM,SAAS,MAAM,OAAO,SAAS,eAAe,oBAAoB;KACtE,OAAO,OAAO;KACd,cAAc,OAAO,WAAW;IAClC,CAAC;IAOD,OAAO,MANc,4BAA4B,SAAS,SAAS;KACjE,QAAQ,OAAO,QAAQ;KACvB;KACA,iBAAiB,aAAa;KAC9B;IACF,CAAC;GAEH;EACF,CAAC;EACD,4BAA4B,WAAW;GACrC,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO,CAAC,CAAC;GACxB,SAAS,OAAO,QAAQ,EAAE,gBAAgB;IACxC,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,UAAU,kBAAkB,WAAW,OAAO;IACpD,MAAM,UAAU,MAAM,sBAAsB,OAAO,QAAQ,IAAI,SAAS,OAAO,WAAW,IAAI;IAC9F,MAAM,SAAS,MAAM,OAAO,SAAS,eAAe,oBAAoB;KACtE,OAAO,OAAO;KACd,cAAc,OAAO,WAAW;IAClC,CAAC;IACD,MAAM,qBAAqB,SAAS,SAAS,OAAO,QAAQ,QAAQ,QAAQ,OAAO,WAAW,IAAI;IAClG,MAAM,eAAe,OAAO,gBAAgB;KAC1C,QAAQ;KACR,SAAS,CAAC;MAAE,MAAM;MAAc,IAAI,OAAO,WAAW;KAAK,CAAC;KAC5D,UAAU;MAAE,QAAQ,OAAO,QAAQ;MAAQ,UAAU,OAAO,SAAS;KAAG;IAC1E,CAAC;IACD,OAAO;KAAE,QAAQ;KAAM,QAAQ,OAAO,QAAQ;KAAQ,YAAY,OAAO,WAAW;IAAK;GAC3F;EACF,CAAC;EACD,mCAAmC,WAAW;GAC5C,IAAI;GACJ,aACE;GACF,aAAa;GACb,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,eAAe;KACnD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;IACtD,CAAC;GACH;EACF,CAAC;EACD,4CAA4C,WAAW;GACrD,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;GACvF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,YAAY;KAChD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,sCAAsC,WAAW;GAC/C,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO;IACpB,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,OAAO,EAAE,QAAQ,CAAC,CAAC,SAAS;GAC9B,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,UAAU,MAAM,OAAO,SAAS,eAAe,kBAAkB;KACrE,GAAI,MAAM,UAAU,MAAM;KAC1B,OAAO,MAAM;KACb,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;KACvD,YAAY,OAAO,QAAQ;KAC3B,YAAY,OAAO,QAAQ;KAC3B,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,eAAe,OAAO,gBAAgB;KAC1C,QAAQ;KACR,SAAS,CACP;MAAE,MAAM;MAAgB,IAAI,QAAQ;KAAI,GACxC;MAAE,MAAM;MAAc,IAAI,OAAO,WAAW;KAAK,CACnD;KACA,UAAU;MAAE,KAAK,QAAQ;MAAK,UAAU,OAAO,SAAS;KAAG;IAC7D,CAAC;IACD,OAAO;GACT;EACF,CAAC;EACD,sCAAsC,WAAW;GAC/C,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO;IACtC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IACzC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;IACrC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC9C,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,SAAS;GAC7C,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,kBAAkB;KACtD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;KAC1D,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;KACvD,GAAI,MAAM,eAAe,KAAA,IAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;KACzE,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;IAC5D,CAAC;GACH;EACF,CAAC;EACD,uCAAuC,WAAW;GAChD,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;GAC1E,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,cAAc;KAClD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,MAAM,MAAM;IACd,CAAC;GACH;EACF,CAAC;EACD,6CAA6C,WAAW;GACtD,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;GACvF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,aAAa;KACjD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,8CAA8C,WAAW;GACvD,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO;IAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAAG,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;GAAE,CAAC;GAC7F,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,cAAc;KAClD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;KACjB,MAAM,MAAM;IACd,CAAC;GACH;EACF,CAAC;EACD,8CAA8C,WAAW;GACvD,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;GAC7D,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO,SAAS,eAAe,cAAc;KACjD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,KAAK;GACzB;EACF,CAAC;EACD,mCAAmC,WAAW;GAC5C,IAAI;GACJ,aACE;GACF,aAAa,oBAAoB,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;GACvF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,mBAAmB;KACvD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/D,CAAC;GACH;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aACE;GAGF,aAAa,oBACV,OAAO;IACN,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC7C,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IAC5C,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;IACxC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;IAC3C,MAAM,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,SAAS;IACzC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;IAChD,WAAW,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,SAAS;GAChD,CAAC,CAAC,CACD,QACC,UAAS;IACP,MAAM,eAAe;KAAC,MAAM;KAAU,MAAM;KAAM,MAAM;KAAM,MAAM;IAAI;IACxE,MAAM,SAAS,aAAa,OAAM,UAAS,UAAU,KAAA,CAAS;IAE9D,QADc,MAAM,cAAc,KAAA,IAEvB,aAAa,OAAM,UAAS,UAAU,KAAA,CAAS,IAAI,WAC3D,MAAM,cAAc,KAAA,OAAgB,MAAM,cAAc,KAAA;GAE7D,GACA,EACE,SACE,wJACJ,CACF;GACF,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO;KACX,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,MAAM,MAAM;IACd;IACA,IAAI,MAAM,cAAc,KAAA,GACtB,OAAO,OAAO,SAAS,eAAe,oBAAoB;KAAE,GAAG;KAAM,WAAW,MAAM;IAAU,CAAC;IAEnG,IACE,MAAM,aAAa,KAAA,KACnB,MAAM,SAAS,KAAA,KACf,MAAM,SAAS,KAAA,KACf,MAAM,SAAS,KAAA,GAEf,MAAM,IAAI,MAAM,yEAAyE;IAE3F,OAAO,OAAO,SAAS,eAAe,oBAAoB;KACxD,GAAG;KACH,UAAU,MAAM;KAChB,MAAM,MAAM;KACZ,MAAM,MAAM;KACZ,MAAM,MAAM;KACZ,GAAI,MAAM,cAAc,KAAA,KAAa,MAAM,cAAc,KAAA,IACrD;MAAE,WAAW,MAAM;MAAW,WAAW,MAAM;KAAU,IACzD,CAAC;IACP,CAAC;GACH;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO;IAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAAG,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;GAAE,CAAC;GAC7F,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,oBAAoB;KACxD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;KACjB,MAAM,MAAM;IACd,CAAC;GACH;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aAAa;GACb,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;GAC7D,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,OAAO,SAAS,eAAe,oBAAoB;KACvD,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;IACnB,CAAC;IACD,OAAO,EAAE,SAAS,KAAK;GACzB;EACF,CAAC;EACD,oCAAoC,WAAW;GAC7C,IAAI;GACJ,aACE;GACF,aAAa,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAClC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;GACpC,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,sBAAsB,OAAO,SAAS,eAAe;IAC3D,IAAI,CAAC,qBACH,MAAM,IAAI,MAAM,GAAG,OAAO,SAAS,GAAG,4CAA4C;IAEpF,MAAM,oBAAoB;KACxB,GAAI,MAAM,UAAU,MAAM;KAC1B,WAAW,MAAM;KACjB,UAAU,MAAM;IAClB,CAAC;IACD,OAAO,EAAE,UAAU,MAAM,SAAS;GACpC;EACF,CAAC;EACD,sCAAsC,WAAW;GAC/C,IAAI;GACJ,aACE;GACF,aAAa,oBACV,OAAO;IACN,OAAO,EAAE,KAAK;KAAC;KAAW;KAAmB;IAAS,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;IAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;GAC9C,CAAC,CAAC,CACD,QAAO,UAAS,MAAM,UAAU,aAAa,QAAQ,MAAM,MAAM,KAAK,CAAC,GAAG;IACzE,MAAM,CAAC,MAAM;IACb,SAAS;GACX,CAAC,CAAC,CACD,aAAa,OAAO,QAAQ;IAC3B,MAAM,WAAW,qBAAqB,MAAM,OAAO,MAAM,IAAI;IAC7D,IAAI,UAAU,IAAI,SAAS;KAAE,MAAM;KAAU,MAAM,CAAC,MAAM;KAAG,SAAS;IAAS,CAAC;IAChF,MAAM,eAAe,qBAAqB,MAAM,IAAI;IACpD,IAAI,iBAAiB,MACnB,IAAI,SAAS;KACX,MAAM;KACN,MAAM,CAAC,MAAM;KACb,SAAS;IACX,CAAC;SACI,IAAI,gBAAgB,MAAM,YAAY,MAAM,SAAS,YAAY,MAAM,cAC5E,IAAI,SAAS;KACX,MAAM;KACN,MAAM,CAAC,UAAU;KACjB,SAAS,oCAAoC,aAAa,oBAAoB,MAAM,SAAS;IAC/F,CAAC;GAEL,CAAC;GACH,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,MAAM,eAAe,qBAAqB,MAAM,IAAI;IACpD,IAAI,cAAc;KAChB,MAAM,cAAc,MAAM,OAAO,SAAS,eAAe,eAAe;MACtE,GAAI,MAAM,UAAU,MAAM;MAC1B,eAAe,gBAAgB,MAAM,eAAe;KACtD,CAAC;KACD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,kBAAkB,MAAM,gBAAgB,oCAAoC;KAE9F,IAAI,YAAY,WAAW,YAAY,QAAQ,YAAY,MAAM,cAC/D,MAAM,IAAI,MACR,oCAAoC,aAAa,2CAA2C,YAAY,QAAQ,4FAClH;IAEJ;IACA,MAAM,OAAO;KACX,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,aAAa,KAAA,IACnB,EAAE,UAAU,MAAM,SAAS,IAC3B,eACE,EAAE,UAAU,aAAa,IACzB,CAAC;IACT;IACA,IAAI,MAAM,UAAU,WAClB,OAAO,OAAO,SAAS,eAAe,aAAa;KACjD,GAAG;KACH,OAAO;KACP,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;IACzD,CAAC;IAEH,OAAO,OAAO,SAAS,eAAe,aAAa;KAAE,GAAG;KAAM,OAAO,MAAM;KAAO,MAAM,MAAM;IAAM,CAAC;GACvG;EACF,CAAC;EACD,kCAAkC,WAAW;GAC3C,IAAI;GACJ,aACE;GACF,aAAa,oBAAoB,OAAO;IACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;GACrD,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,iBAAiB;KACrD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,OAAO,MAAM;KACb,OAAO,MAAM;IACf,CAAC;GACH;EACF,CAAC;EACD,qCAAqC,WAAW;GAC9C,IAAI;GACJ,aAAa;GACb,aAAa,oBAAoB,OAAO;IACtC,QAAQ,EAAE,KAAK;KAAC;KAAS;KAAU;IAAQ,CAAC,CAAC,CAAC,SAAS;IACvD,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;IACjC,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;GACrC,CAAC;GACD,SAAS,OAAM,UAAS;IACtB,MAAM,SAAS,MAAM,WAAW;IAChC,OAAO,OAAO,SAAS,eAAe,iBAAiB;KACrD,GAAI,MAAM,UAAU,MAAM;KAC1B,eAAe,gBAAgB,MAAM,eAAe;KACpD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;KAC7D,GAAI,MAAM,gBAAgB,KAAA,IAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;KAC5E,GAAI,MAAM,kBAAkB,KAAA,IAAY,EAAE,eAAe,MAAM,cAAc,IAAI,CAAC;IACpF,CAAC;GACH;EACF,CAAC;CACH;AACF"}

package/dist/state-signing.js

@@ -1,4 +1,4 @@
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { createHmac, timingSafeEqual } from "crypto";
 //#region src/state-signing.ts
 /**
 * Shared OAuth/install `state` signing for web integrations.
@@ -33,7 +33,7 @@ const STATE_MAX_AGE_MS = 600 * 1e3;
 */
 function createStateSigner(secret) {
 	const stable = typeof secret === "string" && secret.length > 0;
-	const key = stable ? secret : randomBytes(32).toString("hex");
+	const key = stable ? secret : Buffer.from(globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32))).toString("hex");
 	return {
 		stable,
 		sign(orgId, userId, context) {
@@ -41,7 +41,7 @@ function createStateSigner(secret) {
 				orgId,
 				userId,
 				...context?.factoryProjectId ? { factoryProjectId: context.factoryProjectId } : {},
-				nonce: randomBytes(8).toString("hex"),
+				nonce: Buffer.from(globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(8))).toString("hex"),
 				issuedAt: Date.now()
 			};
 			const body = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");

package/dist/state-signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-signing.js","names":[],"sources":["../src/state-signing.ts"],"sourcesContent":["/**\n * Shared OAuth/install `state` signing for web integrations.\n *\n * The GitHub, Linear, and Slack OAuth/OIDC flows each round-trip a signed `state`\n * value\n * through the third party to bind the callback to the `(orgId, userId)` tenant\n * that initiated it (CSRF protection + tenant routing). The signer is a system\n * facility: `MastraFactory` creates ONE signer at boot and hands it to every\n * registered integration through `IntegrationContext` (see\n * `./factory-integration.ts`), so all integrations sign and verify with the\n * same secret.\n *\n * Secret resolution happens in the factory, not here: explicit\n * `config.stateSecret` → the GitHub integration's webhook secret → a\n * per-process random secret. A random secret is NOT stable across replicas —\n * a `state` signed by one replica cannot be verified by another — which is\n * what the `stable` flag reports. The factory fails loud at boot when a\n * registered integration requires a stable signer but only a random one is\n * available.\n *\n * The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url\n * signature) is unchanged from the previous `github/config.ts` implementation\n * so in-flight OAuth states survive a deploy.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\n\n/** Verified tenant and optional Factory context carried by a signed `state`. */\nexport interface StateTenant {\n  orgId: string;\n  userId: string;\n  /** Factory that initiated the integration flow, when the caller supplied one. */\n  factoryProjectId?: string;\n  /**\n   * Per-`state` random value. A signed `state` stays valid for its whole\n   * lifetime, so a flow that must not run twice off one `state` (account\n   * binding, for instance) can key single-use bookkeeping on this.\n   */\n  nonce: string;\n}\n\n/** Signs and verifies OAuth `state` values bound to a tenant and optional Factory. */\nexport interface StateSigner {\n  /** Build a signed `state` bound to the tenant and optional initiating Factory. */\n  sign(orgId: string, userId: string, context?: { factoryProjectId?: string }): string;\n  /** Verify a signed `state`; returns the bound tenant, or `null` if invalid. */\n  verify(state: string | undefined): StateTenant | null;\n  /**\n   * True when the signer was built from an explicit deployment-stable secret.\n   * False means a per-process random secret: fine for single-process/local\n   * dev, broken for multi-replica deploys (see module docs).\n   */\n  readonly stable: boolean;\n}\n\ninterface StatePayload {\n  orgId: string;\n  userId: string;\n  factoryProjectId?: string;\n  nonce: string;\n  issuedAt: number;\n}\n\n/** Signed `state` values expire after this window to bound the CSRF token. */\nconst STATE_MAX_AGE_MS = 10 * 60 * 1000;\n\n/**\n * Create a state signer. With a `secret`, the signer is deployment-stable\n * (`stable: true`); without one it falls back to a per-process random secret\n * (`stable: false`).\n */\nexport function createStateSigner(secret?: string): StateSigner {\n  const stable = typeof secret === 'string' && secret.length > 0;\n  const key = stable ? secret : randomBytes(32).toString('hex');\n  return {\n    stable,\n    sign(orgId: string, userId: string, context?: { factoryProjectId?: string }): string {\n      const payload: StatePayload = {\n        orgId,\n        userId,\n        ...(context?.factoryProjectId ? { factoryProjectId: context.factoryProjectId } : {}),\n        nonce: randomBytes(8).toString('hex'),\n        issuedAt: Date.now(),\n      };\n      const body = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');\n      const sig = createHmac('sha256', key).update(body).digest('base64url');\n      return `${body}.${sig}`;\n    },\n    verify(state: string | undefined): StateTenant | null {\n      if (!state) return null;\n      const dot = state.lastIndexOf('.');\n      if (dot <= 0) return null;\n      const body = state.slice(0, dot);\n      const sig = state.slice(dot + 1);\n      const expected = createHmac('sha256', key).update(body).digest('base64url');\n      const sigBuf = Buffer.from(sig);\n      const expectedBuf = Buffer.from(expected);\n      if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n        return null;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as StatePayload;\n        if (typeof parsed.orgId !== 'string' || typeof parsed.userId !== 'string') return null;\n        if (typeof parsed.issuedAt !== 'number' || !Number.isFinite(parsed.issuedAt)) return null;\n        if (typeof parsed.nonce !== 'string' || parsed.nonce.length === 0) return null;\n        if (\n          parsed.factoryProjectId !== undefined &&\n          (typeof parsed.factoryProjectId !== 'string' || parsed.factoryProjectId.length === 0)\n        ) {\n          return null;\n        }\n        const age = Date.now() - parsed.issuedAt;\n        if (age < 0 || age > STATE_MAX_AGE_MS) return null;\n        return {\n          orgId: parsed.orgId,\n          userId: parsed.userId,\n          ...(parsed.factoryProjectId ? { factoryProjectId: parsed.factoryProjectId } : {}),\n          nonce: parsed.nonce,\n        };\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,MAAM,mBAAmB,MAAU;;;;;;AAOnC,SAAgB,kBAAkB,QAA8B;CAC9D,MAAM,SAAS,OAAO,WAAW,YAAY,OAAO,SAAS;CAC7D,MAAM,MAAM,SAAS,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAC5D,OAAO;EACL;EACA,KAAK,OAAe,QAAgB,SAAiD;GACnF,MAAM,UAAwB;IAC5B;IACA;IACA,GAAI,SAAS,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;IAClF,OAAO,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK;IACpC,UAAU,KAAK,IAAI;GACrB;GACA,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;GAE9E,OAAO,GAAG,KAAK,GADH,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WACtC;EACtB;EACA,OAAO,OAA+C;GACpD,IAAI,CAAC,OAAO,OAAO;GACnB,MAAM,MAAM,MAAM,YAAY,GAAG;GACjC,IAAI,OAAO,GAAG,OAAO;GACrB,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;GAC/B,MAAM,MAAM,MAAM,MAAM,MAAM,CAAC;GAC/B,MAAM,WAAW,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;GAC1E,MAAM,SAAS,OAAO,KAAK,GAAG;GAC9B,MAAM,cAAc,OAAO,KAAK,QAAQ;GACxC,IAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAC9E,OAAO;GAET,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;IACzE,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,WAAW,UAAU,OAAO;IAClF,IAAI,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,OAAO,QAAQ,GAAG,OAAO;IACrF,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,WAAW,GAAG,OAAO;IAC1E,IACE,OAAO,qBAAqB,KAAA,MAC3B,OAAO,OAAO,qBAAqB,YAAY,OAAO,iBAAiB,WAAW,IAEnF,OAAO;IAET,MAAM,MAAM,KAAK,IAAI,IAAI,OAAO;IAChC,IAAI,MAAM,KAAK,MAAM,kBAAkB,OAAO;IAC9C,OAAO;KACL,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;KAC/E,OAAO,OAAO;IAChB;GACF,QAAQ;IACN,OAAO;GACT;EACF;CACF;AACF"}
+{"version":3,"file":"state-signing.js","names":[],"sources":["../src/state-signing.ts"],"sourcesContent":["/**\n * Shared OAuth/install `state` signing for web integrations.\n *\n * The GitHub, Linear, and Slack OAuth/OIDC flows each round-trip a signed `state`\n * value\n * through the third party to bind the callback to the `(orgId, userId)` tenant\n * that initiated it (CSRF protection + tenant routing). The signer is a system\n * facility: `MastraFactory` creates ONE signer at boot and hands it to every\n * registered integration through `IntegrationContext` (see\n * `./factory-integration.ts`), so all integrations sign and verify with the\n * same secret.\n *\n * Secret resolution happens in the factory, not here: explicit\n * `config.stateSecret` → the GitHub integration's webhook secret → a\n * per-process random secret. A random secret is NOT stable across replicas —\n * a `state` signed by one replica cannot be verified by another — which is\n * what the `stable` flag reports. The factory fails loud at boot when a\n * registered integration requires a stable signer but only a random one is\n * available.\n *\n * The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url\n * signature) is unchanged from the previous `github/config.ts` implementation\n * so in-flight OAuth states survive a deploy.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\n/** Verified tenant and optional Factory context carried by a signed `state`. */\nexport interface StateTenant {\n  orgId: string;\n  userId: string;\n  /** Factory that initiated the integration flow, when the caller supplied one. */\n  factoryProjectId?: string;\n  /**\n   * Per-`state` random value. A signed `state` stays valid for its whole\n   * lifetime, so a flow that must not run twice off one `state` (account\n   * binding, for instance) can key single-use bookkeeping on this.\n   */\n  nonce: string;\n}\n\n/** Signs and verifies OAuth `state` values bound to a tenant and optional Factory. */\nexport interface StateSigner {\n  /** Build a signed `state` bound to the tenant and optional initiating Factory. */\n  sign(orgId: string, userId: string, context?: { factoryProjectId?: string }): string;\n  /** Verify a signed `state`; returns the bound tenant, or `null` if invalid. */\n  verify(state: string | undefined): StateTenant | null;\n  /**\n   * True when the signer was built from an explicit deployment-stable secret.\n   * False means a per-process random secret: fine for single-process/local\n   * dev, broken for multi-replica deploys (see module docs).\n   */\n  readonly stable: boolean;\n}\n\ninterface StatePayload {\n  orgId: string;\n  userId: string;\n  factoryProjectId?: string;\n  nonce: string;\n  issuedAt: number;\n}\n\n/** Signed `state` values expire after this window to bound the CSRF token. */\nconst STATE_MAX_AGE_MS = 10 * 60 * 1000;\n\n/**\n * Create a state signer. With a `secret`, the signer is deployment-stable\n * (`stable: true`); without one it falls back to a per-process random secret\n * (`stable: false`).\n */\nexport function createStateSigner(secret?: string): StateSigner {\n  const stable = typeof secret === 'string' && secret.length > 0;\n  const key = stable ? secret : Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(32))).toString('hex');\n  return {\n    stable,\n    sign(orgId: string, userId: string, context?: { factoryProjectId?: string }): string {\n      const payload: StatePayload = {\n        orgId,\n        userId,\n        ...(context?.factoryProjectId ? { factoryProjectId: context.factoryProjectId } : {}),\n        nonce: Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(8))).toString('hex'),\n        issuedAt: Date.now(),\n      };\n      const body = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');\n      const sig = createHmac('sha256', key).update(body).digest('base64url');\n      return `${body}.${sig}`;\n    },\n    verify(state: string | undefined): StateTenant | null {\n      if (!state) return null;\n      const dot = state.lastIndexOf('.');\n      if (dot <= 0) return null;\n      const body = state.slice(0, dot);\n      const sig = state.slice(dot + 1);\n      const expected = createHmac('sha256', key).update(body).digest('base64url');\n      const sigBuf = Buffer.from(sig);\n      const expectedBuf = Buffer.from(expected);\n      if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n        return null;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as StatePayload;\n        if (typeof parsed.orgId !== 'string' || typeof parsed.userId !== 'string') return null;\n        if (typeof parsed.issuedAt !== 'number' || !Number.isFinite(parsed.issuedAt)) return null;\n        if (typeof parsed.nonce !== 'string' || parsed.nonce.length === 0) return null;\n        if (\n          parsed.factoryProjectId !== undefined &&\n          (typeof parsed.factoryProjectId !== 'string' || parsed.factoryProjectId.length === 0)\n        ) {\n          return null;\n        }\n        const age = Date.now() - parsed.issuedAt;\n        if (age < 0 || age > STATE_MAX_AGE_MS) return null;\n        return {\n          orgId: parsed.orgId,\n          userId: parsed.userId,\n          ...(parsed.factoryProjectId ? { factoryProjectId: parsed.factoryProjectId } : {}),\n          nonce: parsed.nonce,\n        };\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,MAAM,mBAAmB,MAAU;;;;;;AAOnC,SAAgB,kBAAkB,QAA8B;CAC9D,MAAM,SAAS,OAAO,WAAW,YAAY,OAAO,SAAS;CAC7D,MAAM,MAAM,SAAS,SAAS,OAAO,KAAK,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;CAC/G,OAAO;EACL;EACA,KAAK,OAAe,QAAgB,SAAiD;GACnF,MAAM,UAAwB;IAC5B;IACA;IACA,GAAI,SAAS,mBAAmB,EAAE,kBAAkB,QAAQ,iBAAiB,IAAI,CAAC;IAClF,OAAO,OAAO,KAAK,WAAW,OAAO,gCAAgB,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK;IACvF,UAAU,KAAK,IAAI;GACrB;GACA,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;GAE9E,OAAO,GAAG,KAAK,GADH,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WACtC;EACtB;EACA,OAAO,OAA+C;GACpD,IAAI,CAAC,OAAO,OAAO;GACnB,MAAM,MAAM,MAAM,YAAY,GAAG;GACjC,IAAI,OAAO,GAAG,OAAO;GACrB,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;GAC/B,MAAM,MAAM,MAAM,MAAM,MAAM,CAAC;GAC/B,MAAM,WAAW,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;GAC1E,MAAM,SAAS,OAAO,KAAK,GAAG;GAC9B,MAAM,cAAc,OAAO,KAAK,QAAQ;GACxC,IAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAC9E,OAAO;GAET,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;IACzE,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,WAAW,UAAU,OAAO;IAClF,IAAI,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,OAAO,QAAQ,GAAG,OAAO;IACrF,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,WAAW,GAAG,OAAO;IAC1E,IACE,OAAO,qBAAqB,KAAA,MAC3B,OAAO,OAAO,qBAAqB,YAAY,OAAO,iBAAiB,WAAW,IAEnF,OAAO;IAET,MAAM,MAAM,KAAK,IAAI,IAAI,OAAO;IAChC,IAAI,MAAM,KAAK,MAAM,kBAAkB,OAAO;IAC9C,OAAO;KACL,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,GAAI,OAAO,mBAAmB,EAAE,kBAAkB,OAAO,iBAAiB,IAAI,CAAC;KAC/E,OAAO,OAAO;IAChB;GACF,QAAQ;IACN,OAAO;GACT;EACF;CACF;AACF"}

package/dist/storage/domains/audit/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,4HAA4H;AAC5H,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAE3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACtE,sBAAsB,GAAG,SAAS,CAKpC;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0DAA0D;IAC1D,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzG;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjE;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO9F;AAED,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAC;AAiCF;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,oBAAoB;;;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C,0FAA0F;IACpF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAK5D,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAmCnG,sEAAsE;IAChE,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CA2BjE"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,4HAA4H;AAC5H,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAE3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACtE,sBAAsB,GAAG,SAAS,CAKpC;AAED,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0DAA0D;IAC1D,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzG;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGjE;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO9F;AAED,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAC;AAiCF;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,oBAAoB;;;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ1C,0FAA0F;IACpF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAK5D,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAwCnG,sEAAsE;IAChE,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CA2BjE"}

package/dist/storage/domains/audit/base.js

@@ -1,4 +1,3 @@
-import { createHash } from "crypto";
 import { FactoryStorageDomain, UniqueViolationError } from "@mastra/core/storage";
 //#region src/storage/domains/audit/base.ts
 /**
@@ -139,12 +138,12 @@ var AuditStorage = class extends FactoryStorageDomain {
 	}
 	async recordOnce(input) {
 		if (!input.idempotencyKey) throw new Error("An audit idempotency key is required");
-		const hash = createHash("sha256").update(JSON.stringify([
+		const hash = Buffer.from(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([
 			input.orgId,
 			input.factoryProjectId ?? null,
 			input.action,
 			input.idempotencyKey
-		])).digest("hex");
+		])))).toString("hex");
 		const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
 		try {
 			return {

package/dist/storage/domains/audit/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","names":["#db","#insert"],"sources":["../../../../src/storage/domains/audit/base.ts"],"sourcesContent":["/**\n * Factory audit events domain — the append-only \"who did what, when\" trail\n * behind the software factory.\n *\n * Rows are append-only: there is no update/delete API, and the table is the\n * local source of truth even when the WorkOS Audit Logs mirror is unavailable.\n * Tenancy is org-first, like `work_items`: `actor_id` records who acted but\n * never scopes reads.\n *\n * The actions the trail holds are listed in `./actions.ts`.\n *\n * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`\n * and `metadata.startedBy = <userId>` chaining accountability back to the human\n * whose message drove the run. Rule-driven events carry `actor_type = 'system'`.\n */\n\nimport { createHash } from 'node:crypto';\n\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\nimport type { AuditActorType } from './actors.js';\n\n/** What an audit event acted on (WorkOS Audit Logs target shape). */\nexport interface AuditTarget {\n  /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */\n  type: string;\n  /** Stable identifier of the target (row id, branch name, issue number...). */\n  id: string;\n  /** Human-readable label (work-item title, branch name...). */\n  name?: string;\n}\n\nexport type { AuditActorType } from './actors.js';\n\n/** Display name and avatar of a human actor, stamped at record time because MastraAuthStudio cannot resolve users by id. */\nexport interface AuditActorProfileInput {\n  name?: string;\n  avatarUrl?: string;\n}\n\nexport const ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\nexport function auditAgentName(modeId: string): string {\n  return `${modeId} agent`;\n}\n\nexport function auditActorProfile(\n  user: { name?: string; email?: string; avatarUrl?: string } | undefined,\n): AuditActorProfileInput | undefined {\n  const name = user?.name?.trim() || user?.email?.trim();\n  const avatarUrl = user?.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\n/** Request context captured alongside the event. */\nexport interface AuditContext {\n  /** Client IP (first hop of `x-forwarded-for`) when available. */\n  location?: string;\n  /** Request `user-agent` header when available. */\n  userAgent?: string;\n}\n\n/** One persisted audit event. */\nexport interface AuditEventRow {\n  id: string;\n  /** Owning WorkOS organization id — the trail is org-wide. */\n  orgId: string;\n  /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */\n  actorId: string;\n  /** Whether a human or an agent (inside a run) performed the action. */\n  actorType: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  /** What was acted on. */\n  targets: AuditTarget[];\n  /** Bounded event summary — never full payloads, never secrets. */\n  metadata: Record<string, unknown>;\n  /** Factory project the event is scoped to; null for org-level events. */\n  factoryProjectId: string | null;\n  /** Project-repository link affected by a repository-specific action. */\n  projectRepositoryId: string | null;\n  /** Request context (`x-forwarded-for` / `user-agent`). */\n  context: AuditContext;\n  occurredAt: Date;\n}\n\nexport interface RecordAuditEventInput<Action extends string = string> {\n  idempotencyKey?: string;\n  orgId: string;\n  actorId: string;\n  /** Who performed the action; defaults to 'human'. */\n  actorType?: AuditActorType;\n  actorProfile?: AuditActorProfileInput;\n  action: Action;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  context?: AuditContext;\n  occurredAt?: Date;\n}\n\n/** A fully-normalized event ready to persist (id assigned on insert). */\nexport type AuditEventInsert = Omit<AuditEventRow, 'id'>;\n\nexport interface ListAuditEventsInput {\n  orgId: string;\n  factoryProjectId?: string;\n  /** Restrict to these actions (exact match). */\n  actions?: string[];\n  actorId?: string;\n  /** Opaque cursor from a previous page (`nextCursor`). */\n  before?: string;\n  limit?: number;\n}\n\nexport interface AuditEventPage {\n  events: AuditEventRow[];\n  /** Pass back as `before` to fetch the next (older) page; absent at the end. */\n  nextCursor?: string;\n}\n\n/** Metadata is a bounded summary — never full payloads, never secrets. */\nconst MAX_METADATA_JSON_LENGTH = 4096;\n\nconst DEFAULT_PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 200;\n\n/** Truncate oversized metadata rather than dropping the whole event. */\nexport function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {};\n  try {\n    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;\n  } catch {\n    return { truncated: true };\n  }\n  return { truncated: true };\n}\n\n/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */\nexport function clampAuditLimit(limit: number | undefined): number {\n  const normalized = typeof limit === 'number' && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;\n  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);\n}\n\n/** Encode the `(occurredAt, id)` keyset cursor of a row. */\nexport function encodeAuditCursor(row: AuditEventRow): string {\n  return `${row.occurredAt.toISOString()}_${row.id}`;\n}\n\n/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */\nexport function decodeAuditCursor(cursor: string): { occurredAt: Date; id: string } | undefined {\n  const sep = cursor.lastIndexOf('_');\n  if (sep <= 0) return undefined;\n  const occurredAt = new Date(cursor.slice(0, sep));\n  const id = cursor.slice(sep + 1);\n  if (Number.isNaN(occurredAt.getTime()) || !id) return undefined;\n  return { occurredAt, id };\n}\n\nexport const AUDIT_EVENTS_SCHEMA: CollectionSchema = {\n  name: 'audit_events',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    actor_id: { type: 'text' },\n    actor_type: { type: 'text', default: 'human' },\n    action: { type: 'text' },\n    targets: { type: 'json' },\n    metadata: { type: 'json' },\n    factory_project_id: { type: 'text', nullable: true },\n    project_repository_id: { type: 'text', nullable: true },\n    context: { type: 'json' },\n    occurred_at: { type: 'timestamp' },\n  },\n  indexes: [\n    { name: 'audit_events_org_occurred_idx', columns: ['org_id', 'occurred_at'] },\n    { name: 'audit_events_org_project_occurred_idx', columns: ['org_id', 'factory_project_id', 'occurred_at'] },\n  ],\n};\n\n/** Column shape of one `audit_events` row as returned by ops. */\ninterface AuditEventDbRow extends Record<string, unknown> {\n  id: string;\n  org_id: string;\n  actor_id: string;\n  actor_type: AuditActorType;\n  action: string;\n  targets: AuditTarget[];\n  metadata: Record<string, unknown>;\n  factory_project_id: string | null;\n  project_repository_id: string | null;\n  context: AuditContext;\n  occurred_at: Date;\n}\n\nfunction toRow(db: AuditEventDbRow): AuditEventRow {\n  return {\n    id: db.id,\n    orgId: db.org_id,\n    actorId: db.actor_id,\n    actorType: db.actor_type,\n    action: db.action,\n    targets: db.targets,\n    metadata: db.metadata,\n    factoryProjectId: db.factory_project_id,\n    projectRepositoryId: db.project_repository_id,\n    context: db.context,\n    occurredAt: db.occurred_at,\n  };\n}\n\n/**\n * Audit event storage, written once against the generic `FactoryStorageOps`\n * surface. `record()` normalizes inputs (defaults, metadata bounding);\n * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.\n */\nexport class AuditStorage extends FactoryStorageDomain {\n  constructor() {\n    super('audit');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('audit_events', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow> {\n    if (input.idempotencyKey) return (await this.recordOnce(input)).event;\n    return this.#insert(input);\n  }\n\n  async recordOnce(input: RecordAuditEventInput): Promise<{ event: AuditEventRow; created: boolean }> {\n    if (!input.idempotencyKey) throw new Error('An audit idempotency key is required');\n    const hash = createHash('sha256')\n      .update(JSON.stringify([input.orgId, input.factoryProjectId ?? null, input.action, input.idempotencyKey]))\n      .digest('hex');\n    const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;\n    try {\n      return { event: await this.#insert(input, id), created: true };\n    } catch (error) {\n      if (!(error instanceof UniqueViolationError)) throw error;\n      const existing = await this.#db.findOne<AuditEventDbRow>('audit_events', { id, org_id: input.orgId });\n      if (!existing) throw error;\n      return { event: toRow(existing), created: false };\n    }\n  }\n\n  async #insert(input: RecordAuditEventInput, id?: string): Promise<AuditEventRow> {\n    const inserted = await this.#db.insertOne<AuditEventDbRow>('audit_events', {\n      ...(id ? { id } : {}),\n      org_id: input.orgId,\n      actor_id: input.actorId,\n      actor_type: input.actorType ?? 'human',\n      action: input.action,\n      targets: input.targets,\n      metadata: boundAuditMetadata(\n        input.actorProfile ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: input.actorProfile } : input.metadata,\n      ),\n      factory_project_id: input.factoryProjectId ?? null,\n      project_repository_id: input.projectRepositoryId ?? null,\n      context: input.context ?? {},\n      occurred_at: input.occurredAt ?? new Date(),\n    });\n    return toRow(inserted);\n  }\n\n  /** List an org's audit events newest-first with keyset pagination. */\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    const limit = clampAuditLimit(input.limit);\n\n    const where: CollectionWhere = { org_id: input.orgId };\n    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;\n    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };\n    if (input.actorId) where.actor_id = input.actorId;\n\n    const cursor = input.before ? decodeAuditCursor(input.before) : undefined;\n\n    const rows = await this.#db.findMany<AuditEventDbRow>('audit_events', where, {\n      orderBy: [\n        ['occurred_at', 'desc'],\n        ['id', 'desc'],\n      ],\n      limit: limit + 1,\n      ...(cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}),\n    });\n\n    const events = rows.slice(0, limit).map(toRow);\n    const hasMore = rows.length > limit;\n    const last = events[events.length - 1];\n    return {\n      events,\n      ...(hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyCA,MAAa,6BAA6B;AAE1C,SAAgB,eAAe,QAAwB;CACrD,OAAO,GAAG,OAAO;AACnB;AAEA,SAAgB,kBACd,MACoC;CACpC,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK;CACrD,MAAM,YAAY,MAAM,WAAW,KAAK;CACxC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;;AAuEA,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,SAAgB,mBAAmB,UAAwE;CACzG,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;EACF,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,UAAU,0BAA0B,OAAO;CAC1E,QAAQ;EACN,OAAO,EAAE,WAAW,KAAK;CAC3B;CACA,OAAO,EAAE,WAAW,KAAK;AAC3B;;AAGA,SAAgB,gBAAgB,OAAmC;CAEjE,OAAO,KAAK,IAAI,KAAK,IADF,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,mBACxD,CAAC,GAAG,aAAa;AACxD;;AAGA,SAAgB,kBAAkB,KAA4B;CAC5D,OAAO,GAAG,IAAI,WAAW,YAAY,EAAE,GAAG,IAAI;AAChD;;AAGA,SAAgB,kBAAkB,QAA8D;CAC9F,MAAM,MAAM,OAAO,YAAY,GAAG;CAClC,IAAI,OAAO,GAAG,OAAO,KAAA;CACrB,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC;CAChD,MAAM,KAAK,OAAO,MAAM,MAAM,CAAC;CAC/B,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAA;CACtD,OAAO;EAAE;EAAY;CAAG;AAC1B;AAEA,MAAa,sBAAwC;CACnD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,UAAU,EAAE,MAAM,OAAO;EACzB,YAAY;GAAE,MAAM;GAAQ,SAAS;EAAQ;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,uBAAuB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACtD,SAAS,EAAE,MAAM,OAAO;EACxB,aAAa,EAAE,MAAM,YAAY;CACnC;CACA,SAAS,CACP;EAAE,MAAM;EAAiC,SAAS,CAAC,UAAU,aAAa;CAAE,GAC5E;EAAE,MAAM;EAAyC,SAAS;GAAC;GAAU;GAAsB;EAAa;CAAE,CAC5G;AACF;AAiBA,SAAS,MAAM,IAAoC;CACjD,OAAO;EACL,IAAI,GAAG;EACP,OAAO,GAAG;EACV,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,QAAQ,GAAG;EACX,SAAS,GAAG;EACZ,UAAU,GAAG;EACb,kBAAkB,GAAG;EACrB,qBAAqB,GAAG;EACxB,SAAS,GAAG;EACZ,YAAY,GAAG;CACjB;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,qBAAqB;CACrD,cAAc;EACZ,MAAM,OAAO;CACf;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,mBAAmB,CAAC;CACpD;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,gBAAgB,CAAC,CAAC;CAC9C;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,OAAO,OAAsD;EACjE,IAAI,MAAM,gBAAgB,QAAQ,MAAM,KAAK,WAAW,KAAK,EAAA,CAAG;EAChE,OAAO,KAAKC,QAAQ,KAAK;CAC3B;CAEA,MAAM,WAAW,OAAmF;EAClG,IAAI,CAAC,MAAM,gBAAgB,MAAM,IAAI,MAAM,sCAAsC;EACjF,MAAM,OAAO,WAAW,QAAQ,CAAC,CAC9B,OAAO,KAAK,UAAU;GAAC,MAAM;GAAO,MAAM,oBAAoB;GAAM,MAAM;GAAQ,MAAM;EAAc,CAAC,CAAC,CAAC,CACzG,OAAO,KAAK;EACf,MAAM,KAAK,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE;EACtH,IAAI;GACF,OAAO;IAAE,OAAO,MAAM,KAAKA,QAAQ,OAAO,EAAE;IAAG,SAAS;GAAK;EAC/D,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;GACpD,MAAM,WAAW,MAAM,KAAKD,IAAI,QAAyB,gBAAgB;IAAE;IAAI,QAAQ,MAAM;GAAM,CAAC;GACpG,IAAI,CAAC,UAAU,MAAM;GACrB,OAAO;IAAE,OAAO,MAAM,QAAQ;IAAG,SAAS;GAAM;EAClD;CACF;CAEA,MAAMC,QAAQ,OAA8B,IAAqC;EAgB/E,OAAO,MAAM,MAfU,KAAKD,IAAI,UAA2B,gBAAgB;GACzE,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;GACnB,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,YAAY,MAAM,aAAa;GAC/B,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,mBACR,MAAM,eAAe;IAAE,GAAG,MAAM;KAAW,6BAA6B,MAAM;GAAa,IAAI,MAAM,QACvG;GACA,oBAAoB,MAAM,oBAAoB;GAC9C,uBAAuB,MAAM,uBAAuB;GACpD,SAAS,MAAM,WAAW,CAAC;GAC3B,aAAa,MAAM,8BAAc,IAAI,KAAK;EAC5C,CAAC,CACoB;CACvB;;CAGA,MAAM,KAAK,OAAsD;EAC/D,MAAM,QAAQ,gBAAgB,MAAM,KAAK;EAEzC,MAAM,QAAyB,EAAE,QAAQ,MAAM,MAAM;EACrD,IAAI,MAAM,kBAAkB,MAAM,qBAAqB,MAAM;EAC7D,IAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EAClF,IAAI,MAAM,SAAS,MAAM,WAAW,MAAM;EAE1C,MAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI,KAAA;EAEhE,MAAM,OAAO,MAAM,KAAKA,IAAI,SAA0B,gBAAgB,OAAO;GAC3E,SAAS,CACP,CAAC,eAAe,MAAM,GACtB,CAAC,MAAM,MAAM,CACf;GACA,OAAO,QAAQ;GACf,GAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,YAAY,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC;EACzE,CAAC;EAED,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;EAC7C,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,OAAO,OAAO,OAAO,SAAS;EACpC,OAAO;GACL;GACA,GAAI,WAAW,OAAO,EAAE,YAAY,kBAAkB,IAAI,EAAE,IAAI,CAAC;EACnE;CACF;AACF"}
+{"version":3,"file":"base.js","names":["#db","#insert"],"sources":["../../../../src/storage/domains/audit/base.ts"],"sourcesContent":["/**\n * Factory audit events domain — the append-only \"who did what, when\" trail\n * behind the software factory.\n *\n * Rows are append-only: there is no update/delete API, and the table is the\n * local source of truth even when the WorkOS Audit Logs mirror is unavailable.\n * Tenancy is org-first, like `work_items`: `actor_id` records who acted but\n * never scopes reads.\n *\n * The actions the trail holds are listed in `./actions.ts`.\n *\n * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`\n * and `metadata.startedBy = <userId>` chaining accountability back to the human\n * whose message drove the run. Rule-driven events carry `actor_type = 'system'`.\n */\n\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\nimport type { AuditActorType } from './actors.js';\n\n/** What an audit event acted on (WorkOS Audit Logs target shape). */\nexport interface AuditTarget {\n  /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */\n  type: string;\n  /** Stable identifier of the target (row id, branch name, issue number...). */\n  id: string;\n  /** Human-readable label (work-item title, branch name...). */\n  name?: string;\n}\n\nexport type { AuditActorType } from './actors.js';\n\n/** Display name and avatar of a human actor, stamped at record time because MastraAuthStudio cannot resolve users by id. */\nexport interface AuditActorProfileInput {\n  name?: string;\n  avatarUrl?: string;\n}\n\nexport const ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\nexport function auditAgentName(modeId: string): string {\n  return `${modeId} agent`;\n}\n\nexport function auditActorProfile(\n  user: { name?: string; email?: string; avatarUrl?: string } | undefined,\n): AuditActorProfileInput | undefined {\n  const name = user?.name?.trim() || user?.email?.trim();\n  const avatarUrl = user?.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\n/** Request context captured alongside the event. */\nexport interface AuditContext {\n  /** Client IP (first hop of `x-forwarded-for`) when available. */\n  location?: string;\n  /** Request `user-agent` header when available. */\n  userAgent?: string;\n}\n\n/** One persisted audit event. */\nexport interface AuditEventRow {\n  id: string;\n  /** Owning WorkOS organization id — the trail is org-wide. */\n  orgId: string;\n  /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */\n  actorId: string;\n  /** Whether a human or an agent (inside a run) performed the action. */\n  actorType: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  /** What was acted on. */\n  targets: AuditTarget[];\n  /** Bounded event summary — never full payloads, never secrets. */\n  metadata: Record<string, unknown>;\n  /** Factory project the event is scoped to; null for org-level events. */\n  factoryProjectId: string | null;\n  /** Project-repository link affected by a repository-specific action. */\n  projectRepositoryId: string | null;\n  /** Request context (`x-forwarded-for` / `user-agent`). */\n  context: AuditContext;\n  occurredAt: Date;\n}\n\nexport interface RecordAuditEventInput<Action extends string = string> {\n  idempotencyKey?: string;\n  orgId: string;\n  actorId: string;\n  /** Who performed the action; defaults to 'human'. */\n  actorType?: AuditActorType;\n  actorProfile?: AuditActorProfileInput;\n  action: Action;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  context?: AuditContext;\n  occurredAt?: Date;\n}\n\n/** A fully-normalized event ready to persist (id assigned on insert). */\nexport type AuditEventInsert = Omit<AuditEventRow, 'id'>;\n\nexport interface ListAuditEventsInput {\n  orgId: string;\n  factoryProjectId?: string;\n  /** Restrict to these actions (exact match). */\n  actions?: string[];\n  actorId?: string;\n  /** Opaque cursor from a previous page (`nextCursor`). */\n  before?: string;\n  limit?: number;\n}\n\nexport interface AuditEventPage {\n  events: AuditEventRow[];\n  /** Pass back as `before` to fetch the next (older) page; absent at the end. */\n  nextCursor?: string;\n}\n\n/** Metadata is a bounded summary — never full payloads, never secrets. */\nconst MAX_METADATA_JSON_LENGTH = 4096;\n\nconst DEFAULT_PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 200;\n\n/** Truncate oversized metadata rather than dropping the whole event. */\nexport function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {};\n  try {\n    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;\n  } catch {\n    return { truncated: true };\n  }\n  return { truncated: true };\n}\n\n/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */\nexport function clampAuditLimit(limit: number | undefined): number {\n  const normalized = typeof limit === 'number' && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;\n  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);\n}\n\n/** Encode the `(occurredAt, id)` keyset cursor of a row. */\nexport function encodeAuditCursor(row: AuditEventRow): string {\n  return `${row.occurredAt.toISOString()}_${row.id}`;\n}\n\n/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */\nexport function decodeAuditCursor(cursor: string): { occurredAt: Date; id: string } | undefined {\n  const sep = cursor.lastIndexOf('_');\n  if (sep <= 0) return undefined;\n  const occurredAt = new Date(cursor.slice(0, sep));\n  const id = cursor.slice(sep + 1);\n  if (Number.isNaN(occurredAt.getTime()) || !id) return undefined;\n  return { occurredAt, id };\n}\n\nexport const AUDIT_EVENTS_SCHEMA: CollectionSchema = {\n  name: 'audit_events',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    actor_id: { type: 'text' },\n    actor_type: { type: 'text', default: 'human' },\n    action: { type: 'text' },\n    targets: { type: 'json' },\n    metadata: { type: 'json' },\n    factory_project_id: { type: 'text', nullable: true },\n    project_repository_id: { type: 'text', nullable: true },\n    context: { type: 'json' },\n    occurred_at: { type: 'timestamp' },\n  },\n  indexes: [\n    { name: 'audit_events_org_occurred_idx', columns: ['org_id', 'occurred_at'] },\n    { name: 'audit_events_org_project_occurred_idx', columns: ['org_id', 'factory_project_id', 'occurred_at'] },\n  ],\n};\n\n/** Column shape of one `audit_events` row as returned by ops. */\ninterface AuditEventDbRow extends Record<string, unknown> {\n  id: string;\n  org_id: string;\n  actor_id: string;\n  actor_type: AuditActorType;\n  action: string;\n  targets: AuditTarget[];\n  metadata: Record<string, unknown>;\n  factory_project_id: string | null;\n  project_repository_id: string | null;\n  context: AuditContext;\n  occurred_at: Date;\n}\n\nfunction toRow(db: AuditEventDbRow): AuditEventRow {\n  return {\n    id: db.id,\n    orgId: db.org_id,\n    actorId: db.actor_id,\n    actorType: db.actor_type,\n    action: db.action,\n    targets: db.targets,\n    metadata: db.metadata,\n    factoryProjectId: db.factory_project_id,\n    projectRepositoryId: db.project_repository_id,\n    context: db.context,\n    occurredAt: db.occurred_at,\n  };\n}\n\n/**\n * Audit event storage, written once against the generic `FactoryStorageOps`\n * surface. `record()` normalizes inputs (defaults, metadata bounding);\n * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.\n */\nexport class AuditStorage extends FactoryStorageDomain {\n  constructor() {\n    super('audit');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('audit_events', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow> {\n    if (input.idempotencyKey) return (await this.recordOnce(input)).event;\n    return this.#insert(input);\n  }\n\n  async recordOnce(input: RecordAuditEventInput): Promise<{ event: AuditEventRow; created: boolean }> {\n    if (!input.idempotencyKey) throw new Error('An audit idempotency key is required');\n    const hash = Buffer.from(\n      await globalThis.crypto.subtle.digest(\n        'SHA-256',\n        new TextEncoder().encode(\n          JSON.stringify([input.orgId, input.factoryProjectId ?? null, input.action, input.idempotencyKey]),\n        ),\n      ),\n    ).toString('hex');\n    const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;\n    try {\n      return { event: await this.#insert(input, id), created: true };\n    } catch (error) {\n      if (!(error instanceof UniqueViolationError)) throw error;\n      const existing = await this.#db.findOne<AuditEventDbRow>('audit_events', { id, org_id: input.orgId });\n      if (!existing) throw error;\n      return { event: toRow(existing), created: false };\n    }\n  }\n\n  async #insert(input: RecordAuditEventInput, id?: string): Promise<AuditEventRow> {\n    const inserted = await this.#db.insertOne<AuditEventDbRow>('audit_events', {\n      ...(id ? { id } : {}),\n      org_id: input.orgId,\n      actor_id: input.actorId,\n      actor_type: input.actorType ?? 'human',\n      action: input.action,\n      targets: input.targets,\n      metadata: boundAuditMetadata(\n        input.actorProfile ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: input.actorProfile } : input.metadata,\n      ),\n      factory_project_id: input.factoryProjectId ?? null,\n      project_repository_id: input.projectRepositoryId ?? null,\n      context: input.context ?? {},\n      occurred_at: input.occurredAt ?? new Date(),\n    });\n    return toRow(inserted);\n  }\n\n  /** List an org's audit events newest-first with keyset pagination. */\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    const limit = clampAuditLimit(input.limit);\n\n    const where: CollectionWhere = { org_id: input.orgId };\n    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;\n    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };\n    if (input.actorId) where.actor_id = input.actorId;\n\n    const cursor = input.before ? decodeAuditCursor(input.before) : undefined;\n\n    const rows = await this.#db.findMany<AuditEventDbRow>('audit_events', where, {\n      orderBy: [\n        ['occurred_at', 'desc'],\n        ['id', 'desc'],\n      ],\n      limit: limit + 1,\n      ...(cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}),\n    });\n\n    const events = rows.slice(0, limit).map(toRow);\n    const hasMore = rows.length > limit;\n    const last = events[events.length - 1];\n    return {\n      events,\n      ...(hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuCA,MAAa,6BAA6B;AAE1C,SAAgB,eAAe,QAAwB;CACrD,OAAO,GAAG,OAAO;AACnB;AAEA,SAAgB,kBACd,MACoC;CACpC,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK;CACrD,MAAM,YAAY,MAAM,WAAW,KAAK;CACxC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;;AAuEA,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,SAAgB,mBAAmB,UAAwE;CACzG,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;EACF,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,UAAU,0BAA0B,OAAO;CAC1E,QAAQ;EACN,OAAO,EAAE,WAAW,KAAK;CAC3B;CACA,OAAO,EAAE,WAAW,KAAK;AAC3B;;AAGA,SAAgB,gBAAgB,OAAmC;CAEjE,OAAO,KAAK,IAAI,KAAK,IADF,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,mBACxD,CAAC,GAAG,aAAa;AACxD;;AAGA,SAAgB,kBAAkB,KAA4B;CAC5D,OAAO,GAAG,IAAI,WAAW,YAAY,EAAE,GAAG,IAAI;AAChD;;AAGA,SAAgB,kBAAkB,QAA8D;CAC9F,MAAM,MAAM,OAAO,YAAY,GAAG;CAClC,IAAI,OAAO,GAAG,OAAO,KAAA;CACrB,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC;CAChD,MAAM,KAAK,OAAO,MAAM,MAAM,CAAC;CAC/B,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAA;CACtD,OAAO;EAAE;EAAY;CAAG;AAC1B;AAEA,MAAa,sBAAwC;CACnD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,UAAU,EAAE,MAAM,OAAO;EACzB,YAAY;GAAE,MAAM;GAAQ,SAAS;EAAQ;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,uBAAuB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACtD,SAAS,EAAE,MAAM,OAAO;EACxB,aAAa,EAAE,MAAM,YAAY;CACnC;CACA,SAAS,CACP;EAAE,MAAM;EAAiC,SAAS,CAAC,UAAU,aAAa;CAAE,GAC5E;EAAE,MAAM;EAAyC,SAAS;GAAC;GAAU;GAAsB;EAAa;CAAE,CAC5G;AACF;AAiBA,SAAS,MAAM,IAAoC;CACjD,OAAO;EACL,IAAI,GAAG;EACP,OAAO,GAAG;EACV,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,QAAQ,GAAG;EACX,SAAS,GAAG;EACZ,UAAU,GAAG;EACb,kBAAkB,GAAG;EACrB,qBAAqB,GAAG;EACxB,SAAS,GAAG;EACZ,YAAY,GAAG;CACjB;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,qBAAqB;CACrD,cAAc;EACZ,MAAM,OAAO;CACf;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,mBAAmB,CAAC;CACpD;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,gBAAgB,CAAC,CAAC;CAC9C;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,OAAO,OAAsD;EACjE,IAAI,MAAM,gBAAgB,QAAQ,MAAM,KAAK,WAAW,KAAK,EAAA,CAAG;EAChE,OAAO,KAAKC,QAAQ,KAAK;CAC3B;CAEA,MAAM,WAAW,OAAmF;EAClG,IAAI,CAAC,MAAM,gBAAgB,MAAM,IAAI,MAAM,sCAAsC;EACjF,MAAM,OAAO,OAAO,KAClB,MAAM,WAAW,OAAO,OAAO,OAC7B,WACA,IAAI,YAAY,CAAC,CAAC,OAChB,KAAK,UAAU;GAAC,MAAM;GAAO,MAAM,oBAAoB;GAAM,MAAM;GAAQ,MAAM;EAAc,CAAC,CAClG,CACF,CACF,CAAC,CAAC,SAAS,KAAK;EAChB,MAAM,KAAK,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE;EACtH,IAAI;GACF,OAAO;IAAE,OAAO,MAAM,KAAKA,QAAQ,OAAO,EAAE;IAAG,SAAS;GAAK;EAC/D,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;GACpD,MAAM,WAAW,MAAM,KAAKD,IAAI,QAAyB,gBAAgB;IAAE;IAAI,QAAQ,MAAM;GAAM,CAAC;GACpG,IAAI,CAAC,UAAU,MAAM;GACrB,OAAO;IAAE,OAAO,MAAM,QAAQ;IAAG,SAAS;GAAM;EAClD;CACF;CAEA,MAAMC,QAAQ,OAA8B,IAAqC;EAgB/E,OAAO,MAAM,MAfU,KAAKD,IAAI,UAA2B,gBAAgB;GACzE,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;GACnB,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,YAAY,MAAM,aAAa;GAC/B,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,mBACR,MAAM,eAAe;IAAE,GAAG,MAAM;KAAW,6BAA6B,MAAM;GAAa,IAAI,MAAM,QACvG;GACA,oBAAoB,MAAM,oBAAoB;GAC9C,uBAAuB,MAAM,uBAAuB;GACpD,SAAS,MAAM,WAAW,CAAC;GAC3B,aAAa,MAAM,8BAAc,IAAI,KAAK;EAC5C,CAAC,CACoB;CACvB;;CAGA,MAAM,KAAK,OAAsD;EAC/D,MAAM,QAAQ,gBAAgB,MAAM,KAAK;EAEzC,MAAM,QAAyB,EAAE,QAAQ,MAAM,MAAM;EACrD,IAAI,MAAM,kBAAkB,MAAM,qBAAqB,MAAM;EAC7D,IAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EAClF,IAAI,MAAM,SAAS,MAAM,WAAW,MAAM;EAE1C,MAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI,KAAA;EAEhE,MAAM,OAAO,MAAM,KAAKA,IAAI,SAA0B,gBAAgB,OAAO;GAC3E,SAAS,CACP,CAAC,eAAe,MAAM,GACtB,CAAC,MAAM,MAAM,CACf;GACA,OAAO,QAAQ;GACf,GAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,YAAY,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC;EACzE,CAAC;EAED,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;EAC7C,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,OAAO,OAAO,OAAO,SAAS;EACpC,OAAO;GACL;GACA,GAAI,WAAW,OAAO,EAAE,YAAY,kBAAkB,IAAI,EAAE,IAAI,CAAC;EACnE;CACF;AACF"}

package/dist/storage/domains/source-control/inmemory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inmemory.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/source-control/inmemory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,+BAA+B,EAC/B,yCAAyC,EACzC,+BAA+B,EAC/B,+BAA+B,EAC/B,0BAA0B,EAC1B,iBAAiB,EACjB,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,oCAAoC,EACpC,kCAAkC,EACnC,MAAM,WAAW,CAAC;AAEnB,uEAAuE;AACvE,qBAAa,4BAA6B,YAAW,0BAA0B;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,yBAAyB,EAAE,CAAM;IACpD,gBAAgB,EAAE,uBAAuB,EAAE,CAAM;IACjD,eAAe,EAAE,8BAA8B,EAAE,CAAM;IACvD,uBAAuB,EAAE,iBAAiB,EAAE,CAAM;IAClD,YAAY,EAAE,oBAAoB,EAAE,CAAM;gBAE9B,aAAa,SAAW;IAIpC,QAAQ,CAAC,aAAa;0BACI;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;6BAErD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;mDAKjG;YACD,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,MAAM,CAAC;SACpB,KAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;wBAEvB,oCAAoC,KAAG,OAAO,CAAC,yBAAyB,CAAC;gCA2BjE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,OAAO,CAAC;MAM9E;IAEF,QAAQ,CAAC,YAAY;0CACqB;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE;6BAItD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;mEAS/F;YACD,KAAK,EAAE,MAAM,CAAC;YACd,cAAc,EAAE,MAAM,CAAC;YACvB,UAAU,EAAE,MAAM,CAAC;SACpB;sDAImD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE;oCAOxG;YACD,KAAK,EAAE,MAAM,CAAC;YACd,KAAK,EAAE,kCAAkC,CAAC;SAC3C,KAAG,OAAO,CAAC,uBAAuB,CAAC;iEAkCjC;YACD,KAAK,EAAE,MAAM,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,iBAAiB,EAAE,MAAM,CAAC;SAC3B;MA2BD;IAEF,QAAQ,CAAC,WAAW;qCACiB;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,gBAAgB,EAAE,MAAM,CAAA;SAAE;6BAEnD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;wBAKnF,yCAAyC,KAAG,OAAO,CAAC,8BAA8B,CAAC;gCAsB3E;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,OAAO,CAAC;MAK9E;IAEF,QAAQ,CAAC,mBAAmB;wCACY;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE;0CAIvC,OAAO,CAAC,+BAA+B,EAAE,CAAC;sFAmB7E;YACD,sBAAsB,EAAE,MAAM,CAAC;YAC/B,oBAAoB,EAAE,MAAM,CAAC;SAC9B,KAAG,OAAO,CAAC,+BAA+B,EAAE,CAAC;6BA0BnB;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;sBAKxE,0BAA0B,KAAG,OAAO,CAAC,iBAAiB,CAAC;wCA+BxE;YACD,KAAK,EAAE,MAAM,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,4BAA4B,CAAC;SACrC,KAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;gCAMP;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,OAAO,CAAC;MAS9E;IAEF,QAAQ,CAAC,QAAQ;sDACqC;YAAE,mBAAmB,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE;2DAMhD;YAAE,mBAAmB,EAAE,MAAM,CAAA;SAAE;oCAEtD,MAAM,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;uCAM1C;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,IAAI,CAAC;iEAWtF;YACD,mBAAmB,EAAE,MAAM,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,MAAM,CAAC;SAChB,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;wBAIlB,+BAA+B,KAAG,OAAO,CAAC,oBAAoB,CAAC;yDA2BlF;YACD,EAAE,EAAE,MAAM,CAAC;YACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,cAAc,EAAE,MAAM,CAAC;SACxB;mCAIgC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE;0CAIP;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE;iDAId;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE;qBAMjD,MAAM;MAGzB;CACH"}
+{"version":3,"file":"inmemory.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/source-control/inmemory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,+BAA+B,EAC/B,yCAAyC,EACzC,+BAA+B,EAC/B,+BAA+B,EAC/B,0BAA0B,EAC1B,iBAAiB,EACjB,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,oCAAoC,EACpC,kCAAkC,EACnC,MAAM,WAAW,CAAC;AAEnB,uEAAuE;AACvE,qBAAa,4BAA6B,YAAW,0BAA0B;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,yBAAyB,EAAE,CAAM;IACpD,gBAAgB,EAAE,uBAAuB,EAAE,CAAM;IACjD,eAAe,EAAE,8BAA8B,EAAE,CAAM;IACvD,uBAAuB,EAAE,iBAAiB,EAAE,CAAM;IAClD,YAAY,EAAE,oBAAoB,EAAE,CAAM;gBAE9B,aAAa,SAAW;IAIpC,QAAQ,CAAC,aAAa;0BACI;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;6BAErD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;mDAKjG;YACD,KAAK,EAAE,MAAM,CAAC;YACd,UAAU,EAAE,MAAM,CAAC;SACpB,KAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;wBAEvB,oCAAoC,KAAG,OAAO,CAAC,yBAAyB,CAAC;gCA2BjE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,OAAO,CAAC;MAM9E;IAEF,QAAQ,CAAC,YAAY;0CACqB;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE;6BAItD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;mEAS/F;YACD,KAAK,EAAE,MAAM,CAAC;YACd,cAAc,EAAE,MAAM,CAAC;YACvB,UAAU,EAAE,MAAM,CAAC;SACpB;sDAImD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE;oCAOxG;YACD,KAAK,EAAE,MAAM,CAAC;YACd,KAAK,EAAE,kCAAkC,CAAC;SAC3C,KAAG,OAAO,CAAC,uBAAuB,CAAC;iEAkCjC;YACD,KAAK,EAAE,MAAM,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,iBAAiB,EAAE,MAAM,CAAC;SAC3B;MA2BD;IAEF,QAAQ,CAAC,WAAW;qCACiB;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,gBAAgB,EAAE,MAAM,CAAA;SAAE;6BAEnD;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;wBAKnF,yCAAyC,KAAG,OAAO,CAAC,8BAA8B,CAAC;gCAsB3E;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,OAAO,CAAC;MAK9E;IAEF,QAAQ,CAAC,mBAAmB;wCACY;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE;0CAIvC,OAAO,CAAC,+BAA+B,EAAE,CAAC;sFAmB7E;YACD,sBAAsB,EAAE,MAAM,CAAC;YAC/B,oBAAoB,EAAE,MAAM,CAAC;SAC9B,KAAG,OAAO,CAAC,+BAA+B,EAAE,CAAC;6BA0BnB;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;sBAKxE,0BAA0B,KAAG,OAAO,CAAC,iBAAiB,CAAC;wCA+BxE;YACD,KAAK,EAAE,MAAM,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,4BAA4B,CAAC;SACrC,KAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;gCAMP;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,OAAO,CAAC;MAS9E;IAEF,QAAQ,CAAC,QAAQ;sDACqC;YAAE,mBAAmB,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE;2DAMhD;YAAE,mBAAmB,EAAE,MAAM,CAAA;SAAE;oCAEtD,MAAM,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;uCAM1C;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,KAAG,OAAO,CAAC,IAAI,CAAC;iEAWtF;YACD,mBAAmB,EAAE,MAAM,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,MAAM,CAAC;SAChB,KAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;wBAIlB,+BAA+B,KAAG,OAAO,CAAC,oBAAoB,CAAC;yDA2BlF;YACD,EAAE,EAAE,MAAM,CAAC;YACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,cAAc,EAAE,MAAM,CAAC;SACxB;mCAIgC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE;0CAIP;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE;iDAId;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE;qBAMjD,MAAM;MAGzB;CACH"}

package/dist/storage/domains/source-control/inmemory.js

@@ -1,4 +1,3 @@
-import { randomUUID } from "crypto";
 import { UniqueViolationError } from "@mastra/core/storage";
 //#region src/storage/domains/source-control/inmemory.ts
 /** In-memory provider-scoped source-control handle for route tests. */
@@ -28,7 +27,7 @@ var SourceControlStorageInMemory = class {
 				return existing;
 			}
 			const created = {
-				id: randomUUID(),
+				id: globalThis.crypto.randomUUID(),
 				integrationId: this.integrationId,
 				orgId: input.orgId,
 				connectedByUserId: input.connectedByUserId,
@@ -92,7 +91,7 @@ var SourceControlStorageInMemory = class {
 				return existing;
 			}
 			const created = {
-				id: randomUUID(),
+				id: globalThis.crypto.randomUUID(),
 				installationId: input.installationId,
 				externalId: input.externalId,
 				slug: input.slug,
@@ -140,7 +139,7 @@ var SourceControlStorageInMemory = class {
 			const existing = this.connectionsRows.find((row) => row.factoryProjectId === input.factoryProjectId && row.integrationId === this.integrationId && row.installationId === input.installationId);
 			if (existing) return existing;
 			const created = {
-				id: randomUUID(),
+				id: globalThis.crypto.randomUUID(),
 				factoryProjectId: input.factoryProjectId,
 				integrationId: this.integrationId,
 				installationId: input.installationId,
@@ -219,7 +218,7 @@ var SourceControlStorageInMemory = class {
 			if (existing) return existing;
 			const now = /* @__PURE__ */ new Date();
 			const created = {
-				id: randomUUID(),
+				id: globalThis.crypto.randomUUID(),
 				connectionId: input.connectionId,
 				repositoryId: input.repositoryId,
 				createdByUserId: input.createdByUserId,
@@ -274,7 +273,7 @@ var SourceControlStorageInMemory = class {
 			if (this.sessionsRows.some((row) => row.sessionId === input.sessionId)) throw new UniqueViolationError("Source-control session ID already exists");
 			const now = /* @__PURE__ */ new Date();
 			const session = {
-				id: randomUUID(),
+				id: globalThis.crypto.randomUUID(),
 				...input,
 				title: input.title ?? null,
 				visibility: input.visibility ?? "org",