@mastra/factory 0.2.2-alpha.1 → 0.2.2-alpha.2

package/dist/state-signing.js

@@ -1,48 +1,77 @@
-// src/state-signing.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-var STATE_MAX_AGE_MS = 10 * 60 * 1e3;
+//#region src/state-signing.ts
+/**
+* Shared OAuth/install `state` signing for web integrations.
+*
+* Both the GitHub and Linear OAuth flows round-trip a signed `state` value
+* through the third party to bind the callback to the `(orgId, userId)` tenant
+* that initiated it (CSRF protection + tenant routing). The signer is a system
+* facility: `MastraFactory` creates ONE signer at boot and hands it to every
+* registered integration through `IntegrationContext` (see
+* `./factory-integration.ts`), so all integrations sign and verify with the
+* same secret.
+*
+* Secret resolution happens in the factory, not here: explicit
+* `config.stateSecret` → the GitHub integration's webhook secret → a
+* per-process random secret. A random secret is NOT stable across replicas —
+* a `state` signed by one replica cannot be verified by another — which is
+* what the `stable` flag reports. The factory fails loud at boot when a
+* registered integration requires a stable signer but only a random one is
+* available.
+*
+* The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url
+* signature) is unchanged from the previous `github/config.ts` implementation
+* so in-flight OAuth states survive a deploy.
+*/
+/** Signed `state` values expire after this window to bound the CSRF token. */
+const STATE_MAX_AGE_MS = 600 * 1e3;
+/**
+* Create a state signer. With a `secret`, the signer is deployment-stable
+* (`stable: true`); without one it falls back to a per-process random secret
+* (`stable: false`).
+*/
 function createStateSigner(secret) {
-  const stable = typeof secret === "string" && secret.length > 0;
-  const key = stable ? secret : randomBytes(32).toString("hex");
-  return {
-    stable,
-    sign(orgId, userId) {
-      const payload = {
-        orgId,
-        userId,
-        nonce: randomBytes(8).toString("hex"),
-        issuedAt: Date.now()
-      };
-      const body = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-      const sig = createHmac("sha256", key).update(body).digest("base64url");
-      return `${body}.${sig}`;
-    },
-    verify(state) {
-      if (!state) return null;
-      const dot = state.lastIndexOf(".");
-      if (dot <= 0) return null;
-      const body = state.slice(0, dot);
-      const sig = state.slice(dot + 1);
-      const expected = createHmac("sha256", key).update(body).digest("base64url");
-      const sigBuf = Buffer.from(sig);
-      const expectedBuf = Buffer.from(expected);
-      if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
-        return null;
-      }
-      try {
-        const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
-        if (typeof parsed.orgId !== "string" || typeof parsed.userId !== "string") return null;
-        if (typeof parsed.issuedAt !== "number" || !Number.isFinite(parsed.issuedAt)) return null;
-        const age = Date.now() - parsed.issuedAt;
-        if (age < 0 || age > STATE_MAX_AGE_MS) return null;
-        return { orgId: parsed.orgId, userId: parsed.userId };
-      } catch {
-        return null;
-      }
-    }
-  };
+	const stable = typeof secret === "string" && secret.length > 0;
+	const key = stable ? secret : randomBytes(32).toString("hex");
+	return {
+		stable,
+		sign(orgId, userId) {
+			const payload = {
+				orgId,
+				userId,
+				nonce: randomBytes(8).toString("hex"),
+				issuedAt: Date.now()
+			};
+			const body = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+			return `${body}.${createHmac("sha256", key).update(body).digest("base64url")}`;
+		},
+		verify(state) {
+			if (!state) return null;
+			const dot = state.lastIndexOf(".");
+			if (dot <= 0) return null;
+			const body = state.slice(0, dot);
+			const sig = state.slice(dot + 1);
+			const expected = createHmac("sha256", key).update(body).digest("base64url");
+			const sigBuf = Buffer.from(sig);
+			const expectedBuf = Buffer.from(expected);
+			if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) return null;
+			try {
+				const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+				if (typeof parsed.orgId !== "string" || typeof parsed.userId !== "string") return null;
+				if (typeof parsed.issuedAt !== "number" || !Number.isFinite(parsed.issuedAt)) return null;
+				const age = Date.now() - parsed.issuedAt;
+				if (age < 0 || age > STATE_MAX_AGE_MS) return null;
+				return {
+					orgId: parsed.orgId,
+					userId: parsed.userId
+				};
+			} catch {
+				return null;
+			}
+		}
+	};
 }
-export {
-  createStateSigner
-};
+//#endregion
+export { createStateSigner };
+
 //# sourceMappingURL=state-signing.js.map

package/dist/state-signing.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/state-signing.ts"],"sourcesContent":["/**\n * Shared OAuth/install `state` signing for web integrations.\n *\n * Both the GitHub and Linear OAuth flows round-trip a signed `state` value\n * through the third party to bind the callback to the `(orgId, userId)` tenant\n * that initiated it (CSRF protection + tenant routing). The signer is a system\n * facility: `MastraFactory` creates ONE signer at boot and hands it to every\n * registered integration through `IntegrationContext` (see\n * `./factory-integration.ts`), so all integrations sign and verify with the\n * same secret.\n *\n * Secret resolution happens in the factory, not here: explicit\n * `config.stateSecret` → the GitHub integration's webhook secret → a\n * per-process random secret. A random secret is NOT stable across replicas —\n * a `state` signed by one replica cannot be verified by another — which is\n * what the `stable` flag reports. The factory fails loud at boot when a\n * registered integration requires a stable signer but only a random one is\n * available.\n *\n * The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url\n * signature) is unchanged from the previous `github/config.ts` implementation\n * so in-flight OAuth states survive a deploy.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\n\n/** Verified `(orgId, userId)` tenant carried by a signed `state`. */\nexport interface StateTenant {\n  orgId: string;\n  userId: string;\n}\n\n/** Signs and verifies OAuth `state` values bound to a `(orgId, userId)` tenant. */\nexport interface StateSigner {\n  /** Build a signed `state` bound to the tenant. */\n  sign(orgId: string, userId: string): string;\n  /** Verify a signed `state`; returns the bound tenant, or `null` if invalid. */\n  verify(state: string | undefined): StateTenant | null;\n  /**\n   * True when the signer was built from an explicit deployment-stable secret.\n   * False means a per-process random secret: fine for single-process/local\n   * dev, broken for multi-replica deploys (see module docs).\n   */\n  readonly stable: boolean;\n}\n\ninterface StatePayload {\n  orgId: string;\n  userId: string;\n  nonce: string;\n  issuedAt: number;\n}\n\n/** Signed `state` values expire after this window to bound the CSRF token. */\nconst STATE_MAX_AGE_MS = 10 * 60 * 1000;\n\n/**\n * Create a state signer. With a `secret`, the signer is deployment-stable\n * (`stable: true`); without one it falls back to a per-process random secret\n * (`stable: false`).\n */\nexport function createStateSigner(secret?: string): StateSigner {\n  const stable = typeof secret === 'string' && secret.length > 0;\n  const key = stable ? secret : randomBytes(32).toString('hex');\n  return {\n    stable,\n    sign(orgId: string, userId: string): string {\n      const payload: StatePayload = {\n        orgId,\n        userId,\n        nonce: randomBytes(8).toString('hex'),\n        issuedAt: Date.now(),\n      };\n      const body = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');\n      const sig = createHmac('sha256', key).update(body).digest('base64url');\n      return `${body}.${sig}`;\n    },\n    verify(state: string | undefined): StateTenant | null {\n      if (!state) return null;\n      const dot = state.lastIndexOf('.');\n      if (dot <= 0) return null;\n      const body = state.slice(0, dot);\n      const sig = state.slice(dot + 1);\n      const expected = createHmac('sha256', key).update(body).digest('base64url');\n      const sigBuf = Buffer.from(sig);\n      const expectedBuf = Buffer.from(expected);\n      if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n        return null;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as StatePayload;\n        if (typeof parsed.orgId !== 'string' || typeof parsed.userId !== 'string') return null;\n        if (typeof parsed.issuedAt !== 'number' || !Number.isFinite(parsed.issuedAt)) return null;\n        const age = Date.now() - parsed.issuedAt;\n        if (age < 0 || age > STATE_MAX_AGE_MS) return null;\n        return { orgId: parsed.orgId, userId: parsed.userId };\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n"],"mappings":";AAwBA,SAAS,YAAY,aAAa,uBAAuB;AA8BzD,IAAM,mBAAmB,KAAK,KAAK;AAO5B,SAAS,kBAAkB,QAA8B;AAC9D,QAAM,SAAS,OAAO,WAAW,YAAY,OAAO,SAAS;AAC7D,QAAM,MAAM,SAAS,SAAS,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5D,SAAO;AAAA,IACL;AAAA,IACA,KAAK,OAAe,QAAwB;AAC1C,YAAM,UAAwB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,OAAO,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,QACpC,UAAU,KAAK,IAAI;AAAA,MACrB;AACA,YAAM,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,EAAE,SAAS,WAAW;AAC9E,YAAM,MAAM,WAAW,UAAU,GAAG,EAAE,OAAO,IAAI,EAAE,OAAO,WAAW;AACrE,aAAO,GAAG,IAAI,IAAI,GAAG;AAAA,IACvB;AAAA,IACA,OAAO,OAA+C;AACpD,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,MAAM,MAAM,YAAY,GAAG;AACjC,UAAI,OAAO,EAAG,QAAO;AACrB,YAAM,OAAO,MAAM,MAAM,GAAG,GAAG;AAC/B,YAAM,MAAM,MAAM,MAAM,MAAM,CAAC;AAC/B,YAAM,WAAW,WAAW,UAAU,GAAG,EAAE,OAAO,IAAI,EAAE,OAAO,WAAW;AAC1E,YAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,YAAM,cAAc,OAAO,KAAK,QAAQ;AACxC,UAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAAG;AACjF,eAAO;AAAA,MACT;AACA,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,EAAE,SAAS,MAAM,CAAC;AACzE,YAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,WAAW,SAAU,QAAO;AAClF,YAAI,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,OAAO,QAAQ,EAAG,QAAO;AACrF,cAAM,MAAM,KAAK,IAAI,IAAI,OAAO;AAChC,YAAI,MAAM,KAAK,MAAM,iBAAkB,QAAO;AAC9C,eAAO,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AAAA,MACtD,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"file":"state-signing.js","names":[],"sources":["../src/state-signing.ts"],"sourcesContent":["/**\n * Shared OAuth/install `state` signing for web integrations.\n *\n * Both the GitHub and Linear OAuth flows round-trip a signed `state` value\n * through the third party to bind the callback to the `(orgId, userId)` tenant\n * that initiated it (CSRF protection + tenant routing). The signer is a system\n * facility: `MastraFactory` creates ONE signer at boot and hands it to every\n * registered integration through `IntegrationContext` (see\n * `./factory-integration.ts`), so all integrations sign and verify with the\n * same secret.\n *\n * Secret resolution happens in the factory, not here: explicit\n * `config.stateSecret` → the GitHub integration's webhook secret → a\n * per-process random secret. A random secret is NOT stable across replicas —\n * a `state` signed by one replica cannot be verified by another — which is\n * what the `stable` flag reports. The factory fails loud at boot when a\n * registered integration requires a stable signer but only a random one is\n * available.\n *\n * The wire format (base64url JSON payload + `.` + HMAC-SHA256 base64url\n * signature) is unchanged from the previous `github/config.ts` implementation\n * so in-flight OAuth states survive a deploy.\n */\n\nimport { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';\n\n/** Verified `(orgId, userId)` tenant carried by a signed `state`. */\nexport interface StateTenant {\n  orgId: string;\n  userId: string;\n}\n\n/** Signs and verifies OAuth `state` values bound to a `(orgId, userId)` tenant. */\nexport interface StateSigner {\n  /** Build a signed `state` bound to the tenant. */\n  sign(orgId: string, userId: string): string;\n  /** Verify a signed `state`; returns the bound tenant, or `null` if invalid. */\n  verify(state: string | undefined): StateTenant | null;\n  /**\n   * True when the signer was built from an explicit deployment-stable secret.\n   * False means a per-process random secret: fine for single-process/local\n   * dev, broken for multi-replica deploys (see module docs).\n   */\n  readonly stable: boolean;\n}\n\ninterface StatePayload {\n  orgId: string;\n  userId: string;\n  nonce: string;\n  issuedAt: number;\n}\n\n/** Signed `state` values expire after this window to bound the CSRF token. */\nconst STATE_MAX_AGE_MS = 10 * 60 * 1000;\n\n/**\n * Create a state signer. With a `secret`, the signer is deployment-stable\n * (`stable: true`); without one it falls back to a per-process random secret\n * (`stable: false`).\n */\nexport function createStateSigner(secret?: string): StateSigner {\n  const stable = typeof secret === 'string' && secret.length > 0;\n  const key = stable ? secret : randomBytes(32).toString('hex');\n  return {\n    stable,\n    sign(orgId: string, userId: string): string {\n      const payload: StatePayload = {\n        orgId,\n        userId,\n        nonce: randomBytes(8).toString('hex'),\n        issuedAt: Date.now(),\n      };\n      const body = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');\n      const sig = createHmac('sha256', key).update(body).digest('base64url');\n      return `${body}.${sig}`;\n    },\n    verify(state: string | undefined): StateTenant | null {\n      if (!state) return null;\n      const dot = state.lastIndexOf('.');\n      if (dot <= 0) return null;\n      const body = state.slice(0, dot);\n      const sig = state.slice(dot + 1);\n      const expected = createHmac('sha256', key).update(body).digest('base64url');\n      const sigBuf = Buffer.from(sig);\n      const expectedBuf = Buffer.from(expected);\n      if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n        return null;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as StatePayload;\n        if (typeof parsed.orgId !== 'string' || typeof parsed.userId !== 'string') return null;\n        if (typeof parsed.issuedAt !== 'number' || !Number.isFinite(parsed.issuedAt)) return null;\n        const age = Date.now() - parsed.issuedAt;\n        if (age < 0 || age > STATE_MAX_AGE_MS) return null;\n        return { orgId: parsed.orgId, userId: parsed.userId };\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,MAAM,mBAAmB,MAAU;;;;;;AAOnC,SAAgB,kBAAkB,QAA8B;CAC9D,MAAM,SAAS,OAAO,WAAW,YAAY,OAAO,SAAS;CAC7D,MAAM,MAAM,SAAS,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAC5D,OAAO;EACL;EACA,KAAK,OAAe,QAAwB;GAC1C,MAAM,UAAwB;IAC5B;IACA;IACA,OAAO,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK;IACpC,UAAU,KAAK,IAAI;GACrB;GACA,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;GAE9E,OAAO,GAAG,KAAK,GADH,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WACtC;EACtB;EACA,OAAO,OAA+C;GACpD,IAAI,CAAC,OAAO,OAAO;GACnB,MAAM,MAAM,MAAM,YAAY,GAAG;GACjC,IAAI,OAAO,GAAG,OAAO;GACrB,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;GAC/B,MAAM,MAAM,MAAM,MAAM,MAAM,CAAC;GAC/B,MAAM,WAAW,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;GAC1E,MAAM,SAAS,OAAO,KAAK,GAAG;GAC9B,MAAM,cAAc,OAAO,KAAK,QAAQ;GACxC,IAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAC9E,OAAO;GAET,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;IACzE,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,OAAO,WAAW,UAAU,OAAO;IAClF,IAAI,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,OAAO,QAAQ,GAAG,OAAO;IACrF,MAAM,MAAM,KAAK,IAAI,IAAI,OAAO;IAChC,IAAI,MAAM,KAAK,MAAM,kBAAkB,OAAO;IAC9C,OAAO;KAAE,OAAO,OAAO;KAAO,QAAQ,OAAO;IAAO;GACtD,QAAQ;IACN,OAAO;GACT;EACF;CACF;AACF"}

package/dist/storage/domains/audit/agent-audit.js

@@ -1,65 +1,66 @@
-// src/storage/domains/audit/agent-audit.ts
-var GIT_COMMIT_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+commit(?:\s|$)/;
-var GIT_PUSH_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+push(?:\s|$)/;
+//#region src/storage/domains/audit/agent-audit.ts
+/** Match command-start positions while ignoring command text embedded in heredoc bodies. */
+const GIT_COMMIT_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+commit(?:\s|$)/;
+const GIT_PUSH_RE = /(?:^|\n|;|&&|\|\|)\s*git\s+push(?:\s|$)/;
 function stripHeredocBodies(command) {
-  const lines = command.split("\n");
-  const executableLines = [];
-  let delimiter;
-  for (const line of lines) {
-    if (delimiter) {
-      if (line.trim() === delimiter) delimiter = void 0;
-      continue;
-    }
-    executableLines.push(line);
-    const heredoc = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);
-    delimiter = heredoc?.[2];
-  }
-  return executableLines.join("\n");
+	const lines = command.split("\n");
+	const executableLines = [];
+	let delimiter;
+	for (const line of lines) {
+		if (delimiter) {
+			if (line.trim() === delimiter) delimiter = void 0;
+			continue;
+		}
+		executableLines.push(line);
+		delimiter = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/)?.[2];
+	}
+	return executableLines.join("\n");
 }
+/** Parse the branch from a plain `git push <remote> <branch>` invocation. */
 function parsePushedBranch(command) {
-  const match = command.match(
-    /(?:^|\n|;|&&|\|\|)\s*git\s+push\s+(?:-[^\s]+\s+)*([^\s;&|-][^\s;&|]*)\s+([^\s;&|-][^\s;&|]*)/
-  );
-  return match?.[2];
+	return command.match(/(?:^|\n|;|&&|\|\|)\s*git\s+push\s+(?:-[^\s]+\s+)*([^\s;&|-][^\s;&|]*)\s+([^\s;&|-][^\s;&|]*)/)?.[2];
 }
-async function observeAgentGitAction({
-  audit,
-  toolContext
-}) {
-  try {
-    if (toolContext.toolName !== "execute_command" || toolContext.error) return;
-    const rawCommand = toolContext.input?.command;
-    if (typeof rawCommand !== "string") return;
-    const command = stripHeredocBodies(rawCommand);
-    const controller = toolContext.context.get("controller");
-    const worktreePath = controller?.scope;
-    if (GIT_COMMIT_RE.test(command)) {
-      await audit.emitAgent({
-        requestContext: toolContext.context,
-        input: {
-          action: "factory.agent.commit",
-          targets: worktreePath ? [{ type: "worktree", id: worktreePath }] : []
-        }
-      });
-    }
-    if (GIT_PUSH_RE.test(command)) {
-      const branch = parsePushedBranch(command);
-      await audit.emitAgent({
-        requestContext: toolContext.context,
-        input: {
-          action: "factory.agent.push",
-          targets: worktreePath ? [{ type: "worktree", id: worktreePath }] : [],
-          ...branch ? { metadata: { branch } } : {}
-        }
-      });
-    }
-  } catch (err) {
-    console.warn("[Audit] Failed to observe agent git action", {
-      error: err instanceof Error ? err.message : String(err)
-    });
-  }
+/**
+* Detect externally-visible git side effects in a completed tool call and
+* record `factory.agent.*` audit events for them. One command can emit
+* multiple events (`git commit && git push` emits both). Never throws.
+*/
+async function observeAgentGitAction({ audit, toolContext }) {
+	try {
+		if (toolContext.toolName !== "execute_command" || toolContext.error) return;
+		const rawCommand = toolContext.input?.command;
+		if (typeof rawCommand !== "string") return;
+		const command = stripHeredocBodies(rawCommand);
+		const worktreePath = toolContext.context.get("controller")?.scope;
+		if (GIT_COMMIT_RE.test(command)) await audit.emitAgent({
+			requestContext: toolContext.context,
+			input: {
+				action: "factory.agent.commit",
+				targets: worktreePath ? [{
+					type: "worktree",
+					id: worktreePath
+				}] : []
+			}
+		});
+		if (GIT_PUSH_RE.test(command)) {
+			const branch = parsePushedBranch(command);
+			await audit.emitAgent({
+				requestContext: toolContext.context,
+				input: {
+					action: "factory.agent.push",
+					targets: worktreePath ? [{
+						type: "worktree",
+						id: worktreePath
+					}] : [],
+					...branch ? { metadata: { branch } } : {}
+				}
+			});
+		}
+	} catch (err) {
+		console.warn("[Audit] Failed to observe agent git action", { error: err instanceof Error ? err.message : String(err) });
+	}
 }
-export {
-  observeAgentGitAction
-};
+//#endregion
+export { observeAgentGitAction };
+
 //# sourceMappingURL=agent-audit.js.map

package/dist/storage/domains/audit/agent-audit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/storage/domains/audit/agent-audit.ts"],"sourcesContent":["/**\n * Agent-level audit event detection (Audit v1.1).\n *\n * Git actions performed by agents inside runs never touch web routes, so this\n * observer detects externally-visible git side effects and delegates recording\n * to the factory-owned audit domain.\n */\n\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport type { AuditAgentEmitter } from './domain.js';\n\ntype FactorySessionState = { factoryProjectId?: string; projectRepositoryId?: string };\n\ninterface ToolObserverContext {\n  toolName: string;\n  input: unknown;\n  output?: unknown;\n  error?: unknown;\n  context: RequestContext;\n}\n\n/** Match command-start positions while ignoring command text embedded in heredoc bodies. */\nconst GIT_COMMIT_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+commit(?:\\s|$)/;\nconst GIT_PUSH_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push(?:\\s|$)/;\n\nfunction stripHeredocBodies(command: string): string {\n  const lines = command.split('\\n');\n  const executableLines: string[] = [];\n  let delimiter: string | undefined;\n\n  for (const line of lines) {\n    if (delimiter) {\n      if (line.trim() === delimiter) delimiter = undefined;\n      continue;\n    }\n    executableLines.push(line);\n    const heredoc = line.match(/<<-?\\s*(['\"]?)([A-Za-z_][A-Za-z0-9_]*)\\1/);\n    delimiter = heredoc?.[2];\n  }\n\n  return executableLines.join('\\n');\n}\n\n/** Parse the branch from a plain `git push <remote> <branch>` invocation. */\nfunction parsePushedBranch(command: string): string | undefined {\n  const match = command.match(\n    /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push\\s+(?:-[^\\s]+\\s+)*([^\\s;&|-][^\\s;&|]*)\\s+([^\\s;&|-][^\\s;&|]*)/,\n  );\n  return match?.[2];\n}\n\n/**\n * Detect externally-visible git side effects in a completed tool call and\n * record `factory.agent.*` audit events for them. One command can emit\n * multiple events (`git commit && git push` emits both). Never throws.\n */\nexport async function observeAgentGitAction({\n  audit,\n  toolContext,\n}: {\n  audit: AuditAgentEmitter;\n  toolContext: ToolObserverContext;\n}): Promise<void> {\n  try {\n    if (toolContext.toolName !== 'execute_command' || toolContext.error) return;\n    const rawCommand = (toolContext.input as { command?: unknown } | undefined)?.command;\n    if (typeof rawCommand !== 'string') return;\n    const command = stripHeredocBodies(rawCommand);\n\n    const controller = toolContext.context.get('controller') as\n      | AgentControllerRequestContext<FactorySessionState>\n      | undefined;\n    const worktreePath = controller?.scope;\n\n    if (GIT_COMMIT_RE.test(command)) {\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.commit',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n        },\n      });\n    }\n\n    if (GIT_PUSH_RE.test(command)) {\n      const branch = parsePushedBranch(command);\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.push',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n          ...(branch ? { metadata: { branch } } : {}),\n        },\n      });\n    }\n  } catch (err) {\n    console.warn('[Audit] Failed to observe agent git action', {\n      error: err instanceof Error ? err.message : String(err),\n    });\n  }\n}\n"],"mappings":";AAwBA,IAAM,gBAAgB;AACtB,IAAM,cAAc;AAEpB,SAAS,mBAAmB,SAAyB;AACnD,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,QAAM,kBAA4B,CAAC;AACnC,MAAI;AAEJ,aAAW,QAAQ,OAAO;AACxB,QAAI,WAAW;AACb,UAAI,KAAK,KAAK,MAAM,UAAW,aAAY;AAC3C;AAAA,IACF;AACA,oBAAgB,KAAK,IAAI;AACzB,UAAM,UAAU,KAAK,MAAM,0CAA0C;AACrE,gBAAY,UAAU,CAAC;AAAA,EACzB;AAEA,SAAO,gBAAgB,KAAK,IAAI;AAClC;AAGA,SAAS,kBAAkB,SAAqC;AAC9D,QAAM,QAAQ,QAAQ;AAAA,IACpB;AAAA,EACF;AACA,SAAO,QAAQ,CAAC;AAClB;AAOA,eAAsB,sBAAsB;AAAA,EAC1C;AAAA,EACA;AACF,GAGkB;AAChB,MAAI;AACF,QAAI,YAAY,aAAa,qBAAqB,YAAY,MAAO;AACrE,UAAM,aAAc,YAAY,OAA6C;AAC7E,QAAI,OAAO,eAAe,SAAU;AACpC,UAAM,UAAU,mBAAmB,UAAU;AAE7C,UAAM,aAAa,YAAY,QAAQ,IAAI,YAAY;AAGvD,UAAM,eAAe,YAAY;AAEjC,QAAI,cAAc,KAAK,OAAO,GAAG;AAC/B,YAAM,MAAM,UAAU;AAAA,QACpB,gBAAgB,YAAY;AAAA,QAC5B,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS,eAAe,CAAC,EAAE,MAAM,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC;AAAA,QACtE;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,YAAY,KAAK,OAAO,GAAG;AAC7B,YAAM,SAAS,kBAAkB,OAAO;AACxC,YAAM,MAAM,UAAU;AAAA,QACpB,gBAAgB,YAAY;AAAA,QAC5B,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS,eAAe,CAAC,EAAE,MAAM,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC;AAAA,UACpE,GAAI,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,8CAA8C;AAAA,MACzD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,IACxD,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"file":"agent-audit.js","names":[],"sources":["../../../../src/storage/domains/audit/agent-audit.ts"],"sourcesContent":["/**\n * Agent-level audit event detection (Audit v1.1).\n *\n * Git actions performed by agents inside runs never touch web routes, so this\n * observer detects externally-visible git side effects and delegates recording\n * to the factory-owned audit domain.\n */\n\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\n\nimport type { AuditAgentEmitter } from './domain.js';\n\ntype FactorySessionState = { factoryProjectId?: string; projectRepositoryId?: string };\n\ninterface ToolObserverContext {\n  toolName: string;\n  input: unknown;\n  output?: unknown;\n  error?: unknown;\n  context: RequestContext;\n}\n\n/** Match command-start positions while ignoring command text embedded in heredoc bodies. */\nconst GIT_COMMIT_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+commit(?:\\s|$)/;\nconst GIT_PUSH_RE = /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push(?:\\s|$)/;\n\nfunction stripHeredocBodies(command: string): string {\n  const lines = command.split('\\n');\n  const executableLines: string[] = [];\n  let delimiter: string | undefined;\n\n  for (const line of lines) {\n    if (delimiter) {\n      if (line.trim() === delimiter) delimiter = undefined;\n      continue;\n    }\n    executableLines.push(line);\n    const heredoc = line.match(/<<-?\\s*(['\"]?)([A-Za-z_][A-Za-z0-9_]*)\\1/);\n    delimiter = heredoc?.[2];\n  }\n\n  return executableLines.join('\\n');\n}\n\n/** Parse the branch from a plain `git push <remote> <branch>` invocation. */\nfunction parsePushedBranch(command: string): string | undefined {\n  const match = command.match(\n    /(?:^|\\n|;|&&|\\|\\|)\\s*git\\s+push\\s+(?:-[^\\s]+\\s+)*([^\\s;&|-][^\\s;&|]*)\\s+([^\\s;&|-][^\\s;&|]*)/,\n  );\n  return match?.[2];\n}\n\n/**\n * Detect externally-visible git side effects in a completed tool call and\n * record `factory.agent.*` audit events for them. One command can emit\n * multiple events (`git commit && git push` emits both). Never throws.\n */\nexport async function observeAgentGitAction({\n  audit,\n  toolContext,\n}: {\n  audit: AuditAgentEmitter;\n  toolContext: ToolObserverContext;\n}): Promise<void> {\n  try {\n    if (toolContext.toolName !== 'execute_command' || toolContext.error) return;\n    const rawCommand = (toolContext.input as { command?: unknown } | undefined)?.command;\n    if (typeof rawCommand !== 'string') return;\n    const command = stripHeredocBodies(rawCommand);\n\n    const controller = toolContext.context.get('controller') as\n      | AgentControllerRequestContext<FactorySessionState>\n      | undefined;\n    const worktreePath = controller?.scope;\n\n    if (GIT_COMMIT_RE.test(command)) {\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.commit',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n        },\n      });\n    }\n\n    if (GIT_PUSH_RE.test(command)) {\n      const branch = parsePushedBranch(command);\n      await audit.emitAgent({\n        requestContext: toolContext.context,\n        input: {\n          action: 'factory.agent.push',\n          targets: worktreePath ? [{ type: 'worktree', id: worktreePath }] : [],\n          ...(branch ? { metadata: { branch } } : {}),\n        },\n      });\n    }\n  } catch (err) {\n    console.warn('[Audit] Failed to observe agent git action', {\n      error: err instanceof Error ? err.message : String(err),\n    });\n  }\n}\n"],"mappings":";;AAwBA,MAAM,gBAAgB;AACtB,MAAM,cAAc;AAEpB,SAAS,mBAAmB,SAAyB;CACnD,MAAM,QAAQ,QAAQ,MAAM,IAAI;CAChC,MAAM,kBAA4B,CAAC;CACnC,IAAI;CAEJ,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,WAAW;GACb,IAAI,KAAK,KAAK,MAAM,WAAW,YAAY,KAAA;GAC3C;EACF;EACA,gBAAgB,KAAK,IAAI;EAEzB,YADgB,KAAK,MAAM,0CACT,CAAC,GAAG;CACxB;CAEA,OAAO,gBAAgB,KAAK,IAAI;AAClC;;AAGA,SAAS,kBAAkB,SAAqC;CAI9D,OAHc,QAAQ,MACpB,8FAES,CAAC,GAAG;AACjB;;;;;;AAOA,eAAsB,sBAAsB,EAC1C,OACA,eAIgB;CAChB,IAAI;EACF,IAAI,YAAY,aAAa,qBAAqB,YAAY,OAAO;EACrE,MAAM,aAAc,YAAY,OAA6C;EAC7E,IAAI,OAAO,eAAe,UAAU;EACpC,MAAM,UAAU,mBAAmB,UAAU;EAK7C,MAAM,eAHa,YAAY,QAAQ,IAAI,YAGb,CAAC,EAAE;EAEjC,IAAI,cAAc,KAAK,OAAO,GAC5B,MAAM,MAAM,UAAU;GACpB,gBAAgB,YAAY;GAC5B,OAAO;IACL,QAAQ;IACR,SAAS,eAAe,CAAC;KAAE,MAAM;KAAY,IAAI;IAAa,CAAC,IAAI,CAAC;GACtE;EACF,CAAC;EAGH,IAAI,YAAY,KAAK,OAAO,GAAG;GAC7B,MAAM,SAAS,kBAAkB,OAAO;GACxC,MAAM,MAAM,UAAU;IACpB,gBAAgB,YAAY;IAC5B,OAAO;KACL,QAAQ;KACR,SAAS,eAAe,CAAC;MAAE,MAAM;MAAY,IAAI;KAAa,CAAC,IAAI,CAAC;KACpE,GAAI,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;IAC3C;GACF,CAAC;EACH;CACF,SAAS,KAAK;EACZ,QAAQ,KAAK,8CAA8C,EACzD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;CACH;AACF"}

package/dist/storage/domains/audit/base.js

@@ -1,127 +1,184 @@
-// src/storage/domains/audit/base.ts
 import { FactoryStorageDomain } from "@mastra/core/storage";
-var MAX_METADATA_JSON_LENGTH = 4096;
-var DEFAULT_PAGE_SIZE = 50;
-var MAX_PAGE_SIZE = 200;
+//#region src/storage/domains/audit/base.ts
+/**
+* Factory audit events domain — the append-only "who did what, when" trail
+* behind the software factory.
+*
+* One `audit_events` row records a single audited mutation (work-item change,
+* stage move, run start, worktree create/delete, git action, intake config
+* change). Rows are append-only: there is no update/delete API, and the table
+* is the local source of truth even when the WorkOS Audit Logs mirror is
+* unavailable.
+*
+* Tenancy is **org-first**, like `work_items`: events are scoped by `org_id`
+* and (usually) `factory_project_id`; `actor_id` records who acted but never
+* scopes reads.
+*
+* v1 action taxonomy (register these in the WorkOS dashboard under
+* Audit Logs → Events for the export mirror to accept them):
+*   - factory.work_item.created
+*   - factory.work_item.updated
+*   - factory.work_item.stage_moved
+*   - factory.work_item.deleted
+*   - factory.run.started
+*   - factory.worktree.created
+*   - factory.worktree.deleted
+*   - factory.triage.started
+*   - factory.git.commit
+*   - factory.git.push
+*   - factory.git.pr_opened
+*   - factory.intake.config_updated
+*
+* v1.1 adds agent-level actions (also register these in WorkOS):
+*   - factory.agent.commit
+*   - factory.agent.push
+*   - factory.agent.pr_opened
+*
+* Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`
+* and `metadata.startedBy = <userId>` chaining accountability back to the human
+* whose message drove the run.
+*/
+/** Metadata is a bounded summary — never full payloads, never secrets. */
+const MAX_METADATA_JSON_LENGTH = 4096;
+const DEFAULT_PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 200;
+/** Truncate oversized metadata rather than dropping the whole event. */
 function boundAuditMetadata(metadata) {
-  if (!metadata) return {};
-  try {
-    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;
-  } catch {
-    return { truncated: true };
-  }
-  return { truncated: true };
+	if (!metadata) return {};
+	try {
+		if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;
+	} catch {
+		return { truncated: true };
+	}
+	return { truncated: true };
 }
+/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */
 function clampAuditLimit(limit) {
-  const normalized = typeof limit === "number" && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;
-  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);
+	return Math.min(Math.max(typeof limit === "number" && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE, 1), MAX_PAGE_SIZE);
 }
+/** Encode the `(occurredAt, id)` keyset cursor of a row. */
 function encodeAuditCursor(row) {
-  return `${row.occurredAt.toISOString()}_${row.id}`;
+	return `${row.occurredAt.toISOString()}_${row.id}`;
 }
+/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */
 function decodeAuditCursor(cursor) {
-  const sep = cursor.lastIndexOf("_");
-  if (sep <= 0) return void 0;
-  const occurredAt = new Date(cursor.slice(0, sep));
-  const id = cursor.slice(sep + 1);
-  if (Number.isNaN(occurredAt.getTime()) || !id) return void 0;
-  return { occurredAt, id };
+	const sep = cursor.lastIndexOf("_");
+	if (sep <= 0) return void 0;
+	const occurredAt = new Date(cursor.slice(0, sep));
+	const id = cursor.slice(sep + 1);
+	if (Number.isNaN(occurredAt.getTime()) || !id) return void 0;
+	return {
+		occurredAt,
+		id
+	};
 }
-var AUDIT_EVENTS_SCHEMA = {
-  name: "audit_events",
-  columns: {
-    id: { type: "uuid-pk" },
-    org_id: { type: "text" },
-    actor_id: { type: "text" },
-    actor_type: { type: "text", default: "human" },
-    action: { type: "text" },
-    targets: { type: "json" },
-    metadata: { type: "json" },
-    factory_project_id: { type: "text", nullable: true },
-    project_repository_id: { type: "text", nullable: true },
-    context: { type: "json" },
-    occurred_at: { type: "timestamp" }
-  },
-  indexes: [
-    { name: "audit_events_org_occurred_idx", columns: ["org_id", "occurred_at"] },
-    { name: "audit_events_org_project_occurred_idx", columns: ["org_id", "factory_project_id", "occurred_at"] }
-  ]
+const AUDIT_EVENTS_SCHEMA = {
+	name: "audit_events",
+	columns: {
+		id: { type: "uuid-pk" },
+		org_id: { type: "text" },
+		actor_id: { type: "text" },
+		actor_type: {
+			type: "text",
+			default: "human"
+		},
+		action: { type: "text" },
+		targets: { type: "json" },
+		metadata: { type: "json" },
+		factory_project_id: {
+			type: "text",
+			nullable: true
+		},
+		project_repository_id: {
+			type: "text",
+			nullable: true
+		},
+		context: { type: "json" },
+		occurred_at: { type: "timestamp" }
+	},
+	indexes: [{
+		name: "audit_events_org_occurred_idx",
+		columns: ["org_id", "occurred_at"]
+	}, {
+		name: "audit_events_org_project_occurred_idx",
+		columns: [
+			"org_id",
+			"factory_project_id",
+			"occurred_at"
+		]
+	}]
 };
 function toRow(db) {
-  return {
-    id: db.id,
-    orgId: db.org_id,
-    actorId: db.actor_id,
-    actorType: db.actor_type,
-    action: db.action,
-    targets: db.targets,
-    metadata: db.metadata,
-    factoryProjectId: db.factory_project_id,
-    projectRepositoryId: db.project_repository_id,
-    context: db.context,
-    occurredAt: db.occurred_at
-  };
+	return {
+		id: db.id,
+		orgId: db.org_id,
+		actorId: db.actor_id,
+		actorType: db.actor_type,
+		action: db.action,
+		targets: db.targets,
+		metadata: db.metadata,
+		factoryProjectId: db.factory_project_id,
+		projectRepositoryId: db.project_repository_id,
+		context: db.context,
+		occurredAt: db.occurred_at
+	};
 }
+/**
+* Audit event storage, written once against the generic `FactoryStorageOps`
+* surface. `record()` normalizes inputs (defaults, metadata bounding);
+* `list()` is keyset-paginated on `(occurred_at, id)` newest-first.
+*/
 var AuditStorage = class extends FactoryStorageDomain {
-  constructor() {
-    super("audit");
-  }
-  async init() {
-    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);
-  }
-  async dangerouslyClearAll() {
-    await this.ops.deleteMany("audit_events", {});
-  }
-  get #db() {
-    return this.ops;
-  }
-  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */
-  async record(input) {
-    const inserted = await this.#db.insertOne("audit_events", {
-      org_id: input.orgId,
-      actor_id: input.actorId,
-      actor_type: input.actorType ?? "human",
-      action: input.action,
-      targets: input.targets,
-      metadata: boundAuditMetadata(input.metadata),
-      factory_project_id: input.factoryProjectId ?? null,
-      project_repository_id: input.projectRepositoryId ?? null,
-      context: input.context ?? {},
-      occurred_at: input.occurredAt ?? /* @__PURE__ */ new Date()
-    });
-    return toRow(inserted);
-  }
-  /** List an org's audit events newest-first with keyset pagination. */
-  async list(input) {
-    const limit = clampAuditLimit(input.limit);
-    const where = { org_id: input.orgId };
-    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;
-    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };
-    if (input.actorId) where.actor_id = input.actorId;
-    const cursor = input.before ? decodeAuditCursor(input.before) : void 0;
-    const rows = await this.#db.findMany("audit_events", where, {
-      orderBy: [
-        ["occurred_at", "desc"],
-        ["id", "desc"]
-      ],
-      limit: limit + 1,
-      ...cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}
-    });
-    const events = rows.slice(0, limit).map(toRow);
-    const hasMore = rows.length > limit;
-    const last = events[events.length - 1];
-    return {
-      events,
-      ...hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}
-    };
-  }
-};
-export {
-  AUDIT_EVENTS_SCHEMA,
-  AuditStorage,
-  boundAuditMetadata,
-  clampAuditLimit,
-  decodeAuditCursor,
-  encodeAuditCursor
+	constructor() {
+		super("audit");
+	}
+	async init() {
+		await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);
+	}
+	async dangerouslyClearAll() {
+		await this.ops.deleteMany("audit_events", {});
+	}
+	get #db() {
+		return this.ops;
+	}
+	/** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */
+	async record(input) {
+		return toRow(await this.#db.insertOne("audit_events", {
+			org_id: input.orgId,
+			actor_id: input.actorId,
+			actor_type: input.actorType ?? "human",
+			action: input.action,
+			targets: input.targets,
+			metadata: boundAuditMetadata(input.metadata),
+			factory_project_id: input.factoryProjectId ?? null,
+			project_repository_id: input.projectRepositoryId ?? null,
+			context: input.context ?? {},
+			occurred_at: input.occurredAt ?? /* @__PURE__ */ new Date()
+		}));
+	}
+	/** List an org's audit events newest-first with keyset pagination. */
+	async list(input) {
+		const limit = clampAuditLimit(input.limit);
+		const where = { org_id: input.orgId };
+		if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;
+		if (input.actions && input.actions.length > 0) where.action = { in: input.actions };
+		if (input.actorId) where.actor_id = input.actorId;
+		const cursor = input.before ? decodeAuditCursor(input.before) : void 0;
+		const rows = await this.#db.findMany("audit_events", where, {
+			orderBy: [["occurred_at", "desc"], ["id", "desc"]],
+			limit: limit + 1,
+			...cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}
+		});
+		const events = rows.slice(0, limit).map(toRow);
+		const hasMore = rows.length > limit;
+		const last = events[events.length - 1];
+		return {
+			events,
+			...hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}
+		};
+	}
 };
+//#endregion
+export { AUDIT_EVENTS_SCHEMA, AuditStorage, boundAuditMetadata, clampAuditLimit, decodeAuditCursor, encodeAuditCursor };
+
 //# sourceMappingURL=base.js.map