@mastra/factory 0.22.1-alpha.0 → 0.23.0-alpha.2

package/dist/storage/domains/audit/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","names":["#db","#insert"],"sources":["../../../../src/storage/domains/audit/base.ts"],"sourcesContent":["/**\n * Factory audit events domain — the append-only \"who did what, when\" trail\n * behind the software factory.\n *\n * Rows are append-only: there is no update/delete API, and the table is the\n * local source of truth even when the WorkOS Audit Logs mirror is unavailable.\n * Tenancy is org-first, like `work_items`: `actor_id` records who acted but\n * never scopes reads.\n *\n * The actions the trail holds are listed in `./actions.ts`.\n *\n * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`\n * and `metadata.startedBy = <userId>` chaining accountability back to the human\n * whose message drove the run. Rule-driven events carry `actor_type = 'system'`.\n */\n\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\nimport type { AuditActorType } from './actors.js';\n\n/** What an audit event acted on (WorkOS Audit Logs target shape). */\nexport interface AuditTarget {\n  /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */\n  type: string;\n  /** Stable identifier of the target (row id, branch name, issue number...). */\n  id: string;\n  /** Human-readable label (work-item title, branch name...). */\n  name?: string;\n}\n\nexport type { AuditActorType } from './actors.js';\n\n/** Display name and avatar of a human actor, stamped at record time because MastraAuthStudio cannot resolve users by id. */\nexport interface AuditActorProfileInput {\n  name?: string;\n  avatarUrl?: string;\n}\n\nexport const ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\nexport function auditAgentName(modeId: string): string {\n  return `${modeId} agent`;\n}\n\nexport function auditActorProfile(\n  user: { name?: string; email?: string; avatarUrl?: string } | undefined,\n): AuditActorProfileInput | undefined {\n  const name = user?.name?.trim() || user?.email?.trim();\n  const avatarUrl = user?.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\n/** Request context captured alongside the event. */\nexport interface AuditContext {\n  /** Client IP (first hop of `x-forwarded-for`) when available. */\n  location?: string;\n  /** Request `user-agent` header when available. */\n  userAgent?: string;\n}\n\n/** One persisted audit event. */\nexport interface AuditEventRow {\n  id: string;\n  /** Owning WorkOS organization id — the trail is org-wide. */\n  orgId: string;\n  /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */\n  actorId: string;\n  /** Whether a human or an agent (inside a run) performed the action. */\n  actorType: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  /** What was acted on. */\n  targets: AuditTarget[];\n  /** Bounded event summary — never full payloads, never secrets. */\n  metadata: Record<string, unknown>;\n  /** Factory project the event is scoped to; null for org-level events. */\n  factoryProjectId: string | null;\n  /** Project-repository link affected by a repository-specific action. */\n  projectRepositoryId: string | null;\n  /** Request context (`x-forwarded-for` / `user-agent`). */\n  context: AuditContext;\n  occurredAt: Date;\n}\n\nexport interface RecordAuditEventInput<Action extends string = string> {\n  idempotencyKey?: string;\n  orgId: string;\n  actorId: string;\n  /** Who performed the action; defaults to 'human'. */\n  actorType?: AuditActorType;\n  actorProfile?: AuditActorProfileInput;\n  action: Action;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  context?: AuditContext;\n  occurredAt?: Date;\n}\n\n/** A fully-normalized event ready to persist (id assigned on insert). */\nexport type AuditEventInsert = Omit<AuditEventRow, 'id'>;\n\nexport interface ListAuditEventsInput {\n  orgId: string;\n  factoryProjectId?: string;\n  /** Restrict to these actions (exact match). */\n  actions?: string[];\n  actorId?: string;\n  /** Opaque cursor from a previous page (`nextCursor`). */\n  before?: string;\n  limit?: number;\n}\n\nexport interface AuditEventPage {\n  events: AuditEventRow[];\n  /** Pass back as `before` to fetch the next (older) page; absent at the end. */\n  nextCursor?: string;\n}\n\n/** Metadata is a bounded summary — never full payloads, never secrets. */\nconst MAX_METADATA_JSON_LENGTH = 4096;\n\nconst DEFAULT_PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 200;\n\n/** Truncate oversized metadata rather than dropping the whole event. */\nexport function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {};\n  try {\n    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;\n  } catch {\n    return { truncated: true };\n  }\n  return { truncated: true };\n}\n\n/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */\nexport function clampAuditLimit(limit: number | undefined): number {\n  const normalized = typeof limit === 'number' && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;\n  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);\n}\n\n/** Encode the `(occurredAt, id)` keyset cursor of a row. */\nexport function encodeAuditCursor(row: AuditEventRow): string {\n  return `${row.occurredAt.toISOString()}_${row.id}`;\n}\n\n/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */\nexport function decodeAuditCursor(cursor: string): { occurredAt: Date; id: string } | undefined {\n  const sep = cursor.lastIndexOf('_');\n  if (sep <= 0) return undefined;\n  const occurredAt = new Date(cursor.slice(0, sep));\n  const id = cursor.slice(sep + 1);\n  if (Number.isNaN(occurredAt.getTime()) || !id) return undefined;\n  return { occurredAt, id };\n}\n\nexport const AUDIT_EVENTS_SCHEMA: CollectionSchema = {\n  name: 'audit_events',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    actor_id: { type: 'text' },\n    actor_type: { type: 'text', default: 'human' },\n    action: { type: 'text' },\n    targets: { type: 'json' },\n    metadata: { type: 'json' },\n    factory_project_id: { type: 'text', nullable: true },\n    project_repository_id: { type: 'text', nullable: true },\n    context: { type: 'json' },\n    occurred_at: { type: 'timestamp' },\n  },\n  indexes: [\n    { name: 'audit_events_org_occurred_idx', columns: ['org_id', 'occurred_at'] },\n    { name: 'audit_events_org_project_occurred_idx', columns: ['org_id', 'factory_project_id', 'occurred_at'] },\n  ],\n};\n\n/** Column shape of one `audit_events` row as returned by ops. */\ninterface AuditEventDbRow extends Record<string, unknown> {\n  id: string;\n  org_id: string;\n  actor_id: string;\n  actor_type: AuditActorType;\n  action: string;\n  targets: AuditTarget[];\n  metadata: Record<string, unknown>;\n  factory_project_id: string | null;\n  project_repository_id: string | null;\n  context: AuditContext;\n  occurred_at: Date;\n}\n\nfunction toRow(db: AuditEventDbRow): AuditEventRow {\n  return {\n    id: db.id,\n    orgId: db.org_id,\n    actorId: db.actor_id,\n    actorType: db.actor_type,\n    action: db.action,\n    targets: db.targets,\n    metadata: db.metadata,\n    factoryProjectId: db.factory_project_id,\n    projectRepositoryId: db.project_repository_id,\n    context: db.context,\n    occurredAt: db.occurred_at,\n  };\n}\n\n/**\n * Audit event storage, written once against the generic `FactoryStorageOps`\n * surface. `record()` normalizes inputs (defaults, metadata bounding);\n * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.\n */\nexport class AuditStorage extends FactoryStorageDomain {\n  constructor() {\n    super('audit');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('audit_events', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow> {\n    if (input.idempotencyKey) return (await this.recordOnce(input)).event;\n    return this.#insert(input);\n  }\n\n  async recordOnce(input: RecordAuditEventInput): Promise<{ event: AuditEventRow; created: boolean }> {\n    if (!input.idempotencyKey) throw new Error('An audit idempotency key is required');\n    const hash = Buffer.from(\n      await globalThis.crypto.subtle.digest(\n        'SHA-256',\n        new TextEncoder().encode(\n          JSON.stringify([input.orgId, input.factoryProjectId ?? null, input.action, input.idempotencyKey]),\n        ),\n      ),\n    ).toString('hex');\n    const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;\n    try {\n      return { event: await this.#insert(input, id), created: true };\n    } catch (error) {\n      if (!(error instanceof UniqueViolationError)) throw error;\n      const existing = await this.#db.findOne<AuditEventDbRow>('audit_events', { id, org_id: input.orgId });\n      if (!existing) throw error;\n      return { event: toRow(existing), created: false };\n    }\n  }\n\n  async #insert(input: RecordAuditEventInput, id?: string): Promise<AuditEventRow> {\n    const inserted = await this.#db.insertOne<AuditEventDbRow>('audit_events', {\n      ...(id ? { id } : {}),\n      org_id: input.orgId,\n      actor_id: input.actorId,\n      actor_type: input.actorType ?? 'human',\n      action: input.action,\n      targets: input.targets,\n      metadata: boundAuditMetadata(\n        input.actorProfile ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: input.actorProfile } : input.metadata,\n      ),\n      factory_project_id: input.factoryProjectId ?? null,\n      project_repository_id: input.projectRepositoryId ?? null,\n      context: input.context ?? {},\n      occurred_at: input.occurredAt ?? new Date(),\n    });\n    return toRow(inserted);\n  }\n\n  /** List an org's audit events newest-first with keyset pagination. */\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    const limit = clampAuditLimit(input.limit);\n\n    const where: CollectionWhere = { org_id: input.orgId };\n    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;\n    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };\n    if (input.actorId) where.actor_id = input.actorId;\n\n    const cursor = input.before ? decodeAuditCursor(input.before) : undefined;\n\n    const rows = await this.#db.findMany<AuditEventDbRow>('audit_events', where, {\n      orderBy: [\n        ['occurred_at', 'desc'],\n        ['id', 'desc'],\n      ],\n      limit: limit + 1,\n      ...(cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}),\n    });\n\n    const events = rows.slice(0, limit).map(toRow);\n    const hasMore = rows.length > limit;\n    const last = events[events.length - 1];\n    return {\n      events,\n      ...(hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuCA,MAAa,6BAA6B;AAE1C,SAAgB,eAAe,QAAwB;CACrD,OAAO,GAAG,OAAO;AACnB;AAEA,SAAgB,kBACd,MACoC;CACpC,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK;CACrD,MAAM,YAAY,MAAM,WAAW,KAAK;CACxC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;;AAuEA,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,SAAgB,mBAAmB,UAAwE;CACzG,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;EACF,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,UAAU,0BAA0B,OAAO;CAC1E,QAAQ;EACN,OAAO,EAAE,WAAW,KAAK;CAC3B;CACA,OAAO,EAAE,WAAW,KAAK;AAC3B;;AAGA,SAAgB,gBAAgB,OAAmC;CAEjE,OAAO,KAAK,IAAI,KAAK,IADF,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,mBACxD,CAAC,GAAG,aAAa;AACxD;;AAGA,SAAgB,kBAAkB,KAA4B;CAC5D,OAAO,GAAG,IAAI,WAAW,YAAY,EAAE,GAAG,IAAI;AAChD;;AAGA,SAAgB,kBAAkB,QAA8D;CAC9F,MAAM,MAAM,OAAO,YAAY,GAAG;CAClC,IAAI,OAAO,GAAG,OAAO,KAAA;CACrB,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC;CAChD,MAAM,KAAK,OAAO,MAAM,MAAM,CAAC;CAC/B,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAA;CACtD,OAAO;EAAE;EAAY;CAAG;AAC1B;AAEA,MAAa,sBAAwC;CACnD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,UAAU,EAAE,MAAM,OAAO;EACzB,YAAY;GAAE,MAAM;GAAQ,SAAS;EAAQ;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,uBAAuB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACtD,SAAS,EAAE,MAAM,OAAO;EACxB,aAAa,EAAE,MAAM,YAAY;CACnC;CACA,SAAS,CACP;EAAE,MAAM;EAAiC,SAAS,CAAC,UAAU,aAAa;CAAE,GAC5E;EAAE,MAAM;EAAyC,SAAS;GAAC;GAAU;GAAsB;EAAa;CAAE,CAC5G;AACF;AAiBA,SAAS,MAAM,IAAoC;CACjD,OAAO;EACL,IAAI,GAAG;EACP,OAAO,GAAG;EACV,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,QAAQ,GAAG;EACX,SAAS,GAAG;EACZ,UAAU,GAAG;EACb,kBAAkB,GAAG;EACrB,qBAAqB,GAAG;EACxB,SAAS,GAAG;EACZ,YAAY,GAAG;CACjB;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,qBAAqB;CACrD,cAAc;EACZ,MAAM,OAAO;CACf;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,mBAAmB,CAAC;CACpD;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,gBAAgB,CAAC,CAAC;CAC9C;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,OAAO,OAAsD;EACjE,IAAI,MAAM,gBAAgB,QAAQ,MAAM,KAAK,WAAW,KAAK,EAAA,CAAG;EAChE,OAAO,KAAKC,QAAQ,KAAK;CAC3B;CAEA,MAAM,WAAW,OAAmF;EAClG,IAAI,CAAC,MAAM,gBAAgB,MAAM,IAAI,MAAM,sCAAsC;EACjF,MAAM,OAAO,OAAO,KAClB,MAAM,WAAW,OAAO,OAAO,OAC7B,WACA,IAAI,YAAY,CAAC,CAAC,OAChB,KAAK,UAAU;GAAC,MAAM;GAAO,MAAM,oBAAoB;GAAM,MAAM;GAAQ,MAAM;EAAc,CAAC,CAClG,CACF,CACF,CAAC,CAAC,SAAS,KAAK;EAChB,MAAM,KAAK,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE;EACtH,IAAI;GACF,OAAO;IAAE,OAAO,MAAM,KAAKA,QAAQ,OAAO,EAAE;IAAG,SAAS;GAAK;EAC/D,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;GACpD,MAAM,WAAW,MAAM,KAAKD,IAAI,QAAyB,gBAAgB;IAAE;IAAI,QAAQ,MAAM;GAAM,CAAC;GACpG,IAAI,CAAC,UAAU,MAAM;GACrB,OAAO;IAAE,OAAO,MAAM,QAAQ;IAAG,SAAS;GAAM;EAClD;CACF;CAEA,MAAMC,QAAQ,OAA8B,IAAqC;EAgB/E,OAAO,MAAM,MAfU,KAAKD,IAAI,UAA2B,gBAAgB;GACzE,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;GACnB,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,YAAY,MAAM,aAAa;GAC/B,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,mBACR,MAAM,eAAe;IAAE,GAAG,MAAM;KAAW,6BAA6B,MAAM;GAAa,IAAI,MAAM,QACvG;GACA,oBAAoB,MAAM,oBAAoB;GAC9C,uBAAuB,MAAM,uBAAuB;GACpD,SAAS,MAAM,WAAW,CAAC;GAC3B,aAAa,MAAM,8BAAc,IAAI,KAAK;EAC5C,CAAC,CACoB;CACvB;;CAGA,MAAM,KAAK,OAAsD;EAC/D,MAAM,QAAQ,gBAAgB,MAAM,KAAK;EAEzC,MAAM,QAAyB,EAAE,QAAQ,MAAM,MAAM;EACrD,IAAI,MAAM,kBAAkB,MAAM,qBAAqB,MAAM;EAC7D,IAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EAClF,IAAI,MAAM,SAAS,MAAM,WAAW,MAAM;EAE1C,MAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI,KAAA;EAEhE,MAAM,OAAO,MAAM,KAAKA,IAAI,SAA0B,gBAAgB,OAAO;GAC3E,SAAS,CACP,CAAC,eAAe,MAAM,GACtB,CAAC,MAAM,MAAM,CACf;GACA,OAAO,QAAQ;GACf,GAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,YAAY,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC;EACzE,CAAC;EAED,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;EAC7C,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,OAAO,OAAO,OAAO,SAAS;EACpC,OAAO;GACL;GACA,GAAI,WAAW,OAAO,EAAE,YAAY,kBAAkB,IAAI,EAAE,IAAI,CAAC;EACnE;CACF;AACF"}
+{"version":3,"file":"base.js","names":["#db","#insert"],"sources":["../../../../src/storage/domains/audit/base.ts"],"sourcesContent":["/**\n * Factory audit events domain — the append-only \"who did what, when\" trail\n * behind the software factory.\n *\n * Rows are append-only: there is no update/delete API, and the table is the\n * local source of truth even when the WorkOS Audit Logs mirror is unavailable.\n * Tenancy is org-first, like `work_items`: `actor_id` records who acted but\n * never scopes reads.\n *\n * The actions the trail holds are listed in `./actions.ts`.\n *\n * Agent events carry `actor_type = 'agent'` with `actor_id = 'agent:<threadId>'`\n * and `metadata.startedBy = <userId>` chaining accountability back to the human\n * whose message drove the run. Rule-driven events carry `actor_type = 'system'`.\n */\n\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\n\nimport type { AuditActorType } from './actors.js';\n\n/** What an audit event acted on (WorkOS Audit Logs target shape). */\nexport interface AuditTarget {\n  /** Target kind, e.g. 'work_item', 'worktree', 'issue', 'pull_request'. */\n  type: string;\n  /** Stable identifier of the target (row id, branch name, issue number...). */\n  id: string;\n  /** Human-readable label (work-item title, branch name...). */\n  name?: string;\n}\n\nexport type { AuditActorType } from './actors.js';\n\n/** Display name and avatar of a human actor, stamped at record time because MastraAuthStudio cannot resolve users by id. */\nexport interface AuditActorProfileInput {\n  name?: string;\n  avatarUrl?: string;\n}\n\nexport const ACTOR_PROFILE_METADATA_KEY = '__actorProfile';\n\nexport function auditActorProfile(\n  user: { name?: string; email?: string; avatarUrl?: string } | undefined,\n): AuditActorProfileInput | undefined {\n  const name = user?.name?.trim() || user?.email?.trim();\n  const avatarUrl = user?.avatarUrl?.trim();\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\n/** Request context captured alongside the event. */\nexport interface AuditContext {\n  /** Client IP (first hop of `x-forwarded-for`) when available. */\n  location?: string;\n  /** Request `user-agent` header when available. */\n  userAgent?: string;\n}\n\n/** One persisted audit event. */\nexport interface AuditEventRow {\n  id: string;\n  /** Owning WorkOS organization id — the trail is org-wide. */\n  orgId: string;\n  /** WorkOS user id of whoever performed the action, or `agent:<threadId>`. */\n  actorId: string;\n  /** Whether a human or an agent (inside a run) performed the action. */\n  actorType: AuditActorType;\n  /** Dot-namespaced action, e.g. 'factory.work_item.stage_moved'. */\n  action: string;\n  /** What was acted on. */\n  targets: AuditTarget[];\n  /** Bounded event summary — never full payloads, never secrets. */\n  metadata: Record<string, unknown>;\n  /** Factory project the event is scoped to; null for org-level events. */\n  factoryProjectId: string | null;\n  /** Project-repository link affected by a repository-specific action. */\n  projectRepositoryId: string | null;\n  /** Request context (`x-forwarded-for` / `user-agent`). */\n  context: AuditContext;\n  occurredAt: Date;\n}\n\nexport interface RecordAuditEventInput<Action extends string = string> {\n  idempotencyKey?: string;\n  orgId: string;\n  actorId: string;\n  /** Who performed the action; defaults to 'human'. */\n  actorType?: AuditActorType;\n  actorProfile?: AuditActorProfileInput;\n  action: Action;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  context?: AuditContext;\n  occurredAt?: Date;\n}\n\n/** A fully-normalized event ready to persist (id assigned on insert). */\nexport type AuditEventInsert = Omit<AuditEventRow, 'id'>;\n\nexport interface ListAuditEventsInput {\n  orgId: string;\n  factoryProjectId?: string;\n  /** Restrict to these actions (exact match). */\n  actions?: string[];\n  actorId?: string;\n  /** Opaque cursor from a previous page (`nextCursor`). */\n  before?: string;\n  limit?: number;\n}\n\nexport interface AuditEventPage {\n  events: AuditEventRow[];\n  /** Pass back as `before` to fetch the next (older) page; absent at the end. */\n  nextCursor?: string;\n}\n\n/** Metadata is a bounded summary — never full payloads, never secrets. */\nconst MAX_METADATA_JSON_LENGTH = 4096;\n\nconst DEFAULT_PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 200;\n\n/** Truncate oversized metadata rather than dropping the whole event. */\nexport function boundAuditMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {};\n  try {\n    if (JSON.stringify(metadata).length <= MAX_METADATA_JSON_LENGTH) return metadata;\n  } catch {\n    return { truncated: true };\n  }\n  return { truncated: true };\n}\n\n/** Normalize a requested page size to a finite integer in `[1, MAX_PAGE_SIZE]`. */\nexport function clampAuditLimit(limit: number | undefined): number {\n  const normalized = typeof limit === 'number' && Number.isFinite(limit) ? Math.trunc(limit) : DEFAULT_PAGE_SIZE;\n  return Math.min(Math.max(normalized, 1), MAX_PAGE_SIZE);\n}\n\n/** Encode the `(occurredAt, id)` keyset cursor of a row. */\nexport function encodeAuditCursor(row: AuditEventRow): string {\n  return `${row.occurredAt.toISOString()}_${row.id}`;\n}\n\n/** Decode a cursor back into its `(occurredAt, id)` parts, or `undefined`. */\nexport function decodeAuditCursor(cursor: string): { occurredAt: Date; id: string } | undefined {\n  const sep = cursor.lastIndexOf('_');\n  if (sep <= 0) return undefined;\n  const occurredAt = new Date(cursor.slice(0, sep));\n  const id = cursor.slice(sep + 1);\n  if (Number.isNaN(occurredAt.getTime()) || !id) return undefined;\n  return { occurredAt, id };\n}\n\nexport const AUDIT_EVENTS_SCHEMA: CollectionSchema = {\n  name: 'audit_events',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    actor_id: { type: 'text' },\n    actor_type: { type: 'text', default: 'human' },\n    action: { type: 'text' },\n    targets: { type: 'json' },\n    metadata: { type: 'json' },\n    factory_project_id: { type: 'text', nullable: true },\n    project_repository_id: { type: 'text', nullable: true },\n    context: { type: 'json' },\n    occurred_at: { type: 'timestamp' },\n  },\n  indexes: [\n    { name: 'audit_events_org_occurred_idx', columns: ['org_id', 'occurred_at'] },\n    { name: 'audit_events_org_project_occurred_idx', columns: ['org_id', 'factory_project_id', 'occurred_at'] },\n  ],\n};\n\n/** Column shape of one `audit_events` row as returned by ops. */\ninterface AuditEventDbRow extends Record<string, unknown> {\n  id: string;\n  org_id: string;\n  actor_id: string;\n  actor_type: AuditActorType;\n  action: string;\n  targets: AuditTarget[];\n  metadata: Record<string, unknown>;\n  factory_project_id: string | null;\n  project_repository_id: string | null;\n  context: AuditContext;\n  occurred_at: Date;\n}\n\nfunction toRow(db: AuditEventDbRow): AuditEventRow {\n  return {\n    id: db.id,\n    orgId: db.org_id,\n    actorId: db.actor_id,\n    actorType: db.actor_type,\n    action: db.action,\n    targets: db.targets,\n    metadata: db.metadata,\n    factoryProjectId: db.factory_project_id,\n    projectRepositoryId: db.project_repository_id,\n    context: db.context,\n    occurredAt: db.occurred_at,\n  };\n}\n\n/**\n * Audit event storage, written once against the generic `FactoryStorageOps`\n * surface. `record()` normalizes inputs (defaults, metadata bounding);\n * `list()` is keyset-paginated on `(occurred_at, id)` newest-first.\n */\nexport class AuditStorage extends FactoryStorageDomain {\n  constructor() {\n    super('audit');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([AUDIT_EVENTS_SCHEMA]);\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('audit_events', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  /** Append one audit event. Throws on failure — swallow-on-failure lives in the caller. */\n  async record(input: RecordAuditEventInput): Promise<AuditEventRow> {\n    if (input.idempotencyKey) return (await this.recordOnce(input)).event;\n    return this.#insert(input);\n  }\n\n  async recordOnce(input: RecordAuditEventInput): Promise<{ event: AuditEventRow; created: boolean }> {\n    if (!input.idempotencyKey) throw new Error('An audit idempotency key is required');\n    const hash = Buffer.from(\n      await globalThis.crypto.subtle.digest(\n        'SHA-256',\n        new TextEncoder().encode(\n          JSON.stringify([input.orgId, input.factoryProjectId ?? null, input.action, input.idempotencyKey]),\n        ),\n      ),\n    ).toString('hex');\n    const id = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-8${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;\n    try {\n      return { event: await this.#insert(input, id), created: true };\n    } catch (error) {\n      if (!(error instanceof UniqueViolationError)) throw error;\n      const existing = await this.#db.findOne<AuditEventDbRow>('audit_events', { id, org_id: input.orgId });\n      if (!existing) throw error;\n      return { event: toRow(existing), created: false };\n    }\n  }\n\n  async #insert(input: RecordAuditEventInput, id?: string): Promise<AuditEventRow> {\n    const inserted = await this.#db.insertOne<AuditEventDbRow>('audit_events', {\n      ...(id ? { id } : {}),\n      org_id: input.orgId,\n      actor_id: input.actorId,\n      actor_type: input.actorType ?? 'human',\n      action: input.action,\n      targets: input.targets,\n      metadata: boundAuditMetadata(\n        input.actorProfile ? { ...input.metadata, [ACTOR_PROFILE_METADATA_KEY]: input.actorProfile } : input.metadata,\n      ),\n      factory_project_id: input.factoryProjectId ?? null,\n      project_repository_id: input.projectRepositoryId ?? null,\n      context: input.context ?? {},\n      occurred_at: input.occurredAt ?? new Date(),\n    });\n    return toRow(inserted);\n  }\n\n  /** List an org's audit events newest-first with keyset pagination. */\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    const limit = clampAuditLimit(input.limit);\n\n    const where: CollectionWhere = { org_id: input.orgId };\n    if (input.factoryProjectId) where.factory_project_id = input.factoryProjectId;\n    if (input.actions && input.actions.length > 0) where.action = { in: input.actions };\n    if (input.actorId) where.actor_id = input.actorId;\n\n    const cursor = input.before ? decodeAuditCursor(input.before) : undefined;\n\n    const rows = await this.#db.findMany<AuditEventDbRow>('audit_events', where, {\n      orderBy: [\n        ['occurred_at', 'desc'],\n        ['id', 'desc'],\n      ],\n      limit: limit + 1,\n      ...(cursor ? { cursor: { values: [cursor.occurredAt, cursor.id] } } : {}),\n    });\n\n    const events = rows.slice(0, limit).map(toRow);\n    const hasMore = rows.length > limit;\n    const last = events[events.length - 1];\n    return {\n      events,\n      ...(hasMore && last ? { nextCursor: encodeAuditCursor(last) } : {}),\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuCA,MAAa,6BAA6B;AAE1C,SAAgB,kBACd,MACoC;CACpC,MAAM,OAAO,MAAM,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK;CACrD,MAAM,YAAY,MAAM,WAAW,KAAK;CACxC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;;AAuEA,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,SAAgB,mBAAmB,UAAwE;CACzG,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;EACF,IAAI,KAAK,UAAU,QAAQ,CAAC,CAAC,UAAU,0BAA0B,OAAO;CAC1E,QAAQ;EACN,OAAO,EAAE,WAAW,KAAK;CAC3B;CACA,OAAO,EAAE,WAAW,KAAK;AAC3B;;AAGA,SAAgB,gBAAgB,OAAmC;CAEjE,OAAO,KAAK,IAAI,KAAK,IADF,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,mBACxD,CAAC,GAAG,aAAa;AACxD;;AAGA,SAAgB,kBAAkB,KAA4B;CAC5D,OAAO,GAAG,IAAI,WAAW,YAAY,EAAE,GAAG,IAAI;AAChD;;AAGA,SAAgB,kBAAkB,QAA8D;CAC9F,MAAM,MAAM,OAAO,YAAY,GAAG;CAClC,IAAI,OAAO,GAAG,OAAO,KAAA;CACrB,MAAM,aAAa,IAAI,KAAK,OAAO,MAAM,GAAG,GAAG,CAAC;CAChD,MAAM,KAAK,OAAO,MAAM,MAAM,CAAC;CAC/B,IAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAA;CACtD,OAAO;EAAE;EAAY;CAAG;AAC1B;AAEA,MAAa,sBAAwC;CACnD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,UAAU,EAAE,MAAM,OAAO;EACzB,YAAY;GAAE,MAAM;GAAQ,SAAS;EAAQ;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,oBAAoB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACnD,uBAAuB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACtD,SAAS,EAAE,MAAM,OAAO;EACxB,aAAa,EAAE,MAAM,YAAY;CACnC;CACA,SAAS,CACP;EAAE,MAAM;EAAiC,SAAS,CAAC,UAAU,aAAa;CAAE,GAC5E;EAAE,MAAM;EAAyC,SAAS;GAAC;GAAU;GAAsB;EAAa;CAAE,CAC5G;AACF;AAiBA,SAAS,MAAM,IAAoC;CACjD,OAAO;EACL,IAAI,GAAG;EACP,OAAO,GAAG;EACV,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,QAAQ,GAAG;EACX,SAAS,GAAG;EACZ,UAAU,GAAG;EACb,kBAAkB,GAAG;EACrB,qBAAqB,GAAG;EACxB,SAAS,GAAG;EACZ,YAAY,GAAG;CACjB;AACF;;;;;;AAOA,IAAa,eAAb,cAAkC,qBAAqB;CACrD,cAAc;EACZ,MAAM,OAAO;CACf;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,mBAAmB,CAAC;CACpD;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,gBAAgB,CAAC,CAAC;CAC9C;CAEA,IAAIA,MAAyB;EAC3B,OAAO,KAAK;CACd;;CAGA,MAAM,OAAO,OAAsD;EACjE,IAAI,MAAM,gBAAgB,QAAQ,MAAM,KAAK,WAAW,KAAK,EAAA,CAAG;EAChE,OAAO,KAAKC,QAAQ,KAAK;CAC3B;CAEA,MAAM,WAAW,OAAmF;EAClG,IAAI,CAAC,MAAM,gBAAgB,MAAM,IAAI,MAAM,sCAAsC;EACjF,MAAM,OAAO,OAAO,KAClB,MAAM,WAAW,OAAO,OAAO,OAC7B,WACA,IAAI,YAAY,CAAC,CAAC,OAChB,KAAK,UAAU;GAAC,MAAM;GAAO,MAAM,oBAAoB;GAAM,MAAM;GAAQ,MAAM;EAAc,CAAC,CAClG,CACF,CACF,CAAC,CAAC,SAAS,KAAK;EAChB,MAAM,KAAK,GAAG,KAAK,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE;EACtH,IAAI;GACF,OAAO;IAAE,OAAO,MAAM,KAAKA,QAAQ,OAAO,EAAE;IAAG,SAAS;GAAK;EAC/D,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;GACpD,MAAM,WAAW,MAAM,KAAKD,IAAI,QAAyB,gBAAgB;IAAE;IAAI,QAAQ,MAAM;GAAM,CAAC;GACpG,IAAI,CAAC,UAAU,MAAM;GACrB,OAAO;IAAE,OAAO,MAAM,QAAQ;IAAG,SAAS;GAAM;EAClD;CACF;CAEA,MAAMC,QAAQ,OAA8B,IAAqC;EAgB/E,OAAO,MAAM,MAfU,KAAKD,IAAI,UAA2B,gBAAgB;GACzE,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;GACnB,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,YAAY,MAAM,aAAa;GAC/B,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,mBACR,MAAM,eAAe;IAAE,GAAG,MAAM;KAAW,6BAA6B,MAAM;GAAa,IAAI,MAAM,QACvG;GACA,oBAAoB,MAAM,oBAAoB;GAC9C,uBAAuB,MAAM,uBAAuB;GACpD,SAAS,MAAM,WAAW,CAAC;GAC3B,aAAa,MAAM,8BAAc,IAAI,KAAK;EAC5C,CAAC,CACoB;CACvB;;CAGA,MAAM,KAAK,OAAsD;EAC/D,MAAM,QAAQ,gBAAgB,MAAM,KAAK;EAEzC,MAAM,QAAyB,EAAE,QAAQ,MAAM,MAAM;EACrD,IAAI,MAAM,kBAAkB,MAAM,qBAAqB,MAAM;EAC7D,IAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EAClF,IAAI,MAAM,SAAS,MAAM,WAAW,MAAM;EAE1C,MAAM,SAAS,MAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI,KAAA;EAEhE,MAAM,OAAO,MAAM,KAAKA,IAAI,SAA0B,gBAAgB,OAAO;GAC3E,SAAS,CACP,CAAC,eAAe,MAAM,GACtB,CAAC,MAAM,MAAM,CACf;GACA,OAAO,QAAQ;GACf,GAAI,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,YAAY,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC;EACzE,CAAC;EAED,MAAM,SAAS,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;EAC7C,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,OAAO,OAAO,OAAO,SAAS;EACpC,OAAO;GACL;GACA,GAAI,WAAW,OAAO,EAAE,YAAY,kBAAkB,IAAI,EAAE,IAAI,CAAC;EACnE;CACF;AACF"}

package/dist/storage/domains/audit/domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/domain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,WAAW,CAAC;AAInB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,oIAAoI;AACpI,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAExD,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAmBD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,mEAAmE;IACnE,QAAQ,EAAE,sBAAsB,CAAC;IACjC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,mFAAmF;IACnF,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACnG;AAsCD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAO5D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG;IAC9C,YAAY,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACjD,OAAO,EAAE,YAAY,CAAC;CACvB,CAEA;AAED,uEAAuE;AACvE,qBAAa,WAAY,YAAW,YAAY,EAAE,iBAAiB;;gBAQrD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAU,EAAE,WAAW,EAAE,EAAE,kBAAkB;IAgBnF,MAAM,CAAC,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA6BhF,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAK1D,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBpF,SAAS,CAAC,EACd,cAAc,EACd,KAAK,GACN,EAAE;QACD,cAAc,EAAE,cAAc,CAAC;QAC/B,KAAK,EAAE,mBAAmB,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IA+FjB,MAAM,IAAI,QAAQ,EAAE;CAiDrB"}
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/audit/domain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,WAAW,CAAC;AAInB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,oIAAoI;AACpI,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAExD,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAmBD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,mEAAmE;IACnE,QAAQ,EAAE,sBAAsB,CAAC;IACjC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IACpD,2EAA2E;IAC3E,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,mFAAmF;IACnF,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACnG;AAsCD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAO5D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG;IAC9C,YAAY,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACjD,OAAO,EAAE,YAAY,CAAC;CACvB,CAEA;AAED,uEAAuE;AACvE,qBAAa,WAAY,YAAW,YAAY,EAAE,iBAAiB;;gBAQrD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAU,EAAE,WAAW,EAAE,EAAE,kBAAkB;IAgBnF,MAAM,CAAC,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA6BhF,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAK1D,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBpF,SAAS,CAAC,EACd,cAAc,EACd,KAAK,GACN,EAAE;QACD,cAAc,EAAE,cAAc,CAAC;QAC/B,KAAK,EAAE,mBAAmB,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IA6FjB,MAAM,IAAI,QAAQ,EAAE;CAiDrB"}

package/dist/storage/domains/audit/domain.js

@@ -1,7 +1,7 @@
 import { getFactoryAuthUser } from "../../../auth.js";
 import { auditActionsInNamespaces, isAuditNamespace } from "./actions.js";
 import { isHumanActorId } from "./actors.js";
-import { ACTOR_PROFILE_METADATA_KEY, auditActorProfile, auditAgentName } from "./base.js";
+import { ACTOR_PROFILE_METADATA_KEY, auditActorProfile } from "./base.js";
 import { toWireAuditEvent } from "./wire.js";
 import { registerApiRoute } from "@mastra/core/server";
 //#region src/storage/domains/audit/domain.ts
@@ -136,7 +136,6 @@ var AuditDomain = class {
 			const threadId = context?.threadId;
 			const state = context?.getState();
 			if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;
-			const modeId = context.session.modeId?.trim();
 			const modelId = context.session.modelId?.trim();
 			await this.record({
 				orgId,
@@ -147,7 +146,6 @@ var AuditDomain = class {
 				metadata: {
 					...input.metadata,
 					startedBy: userId,
-					...modeId ? { agentName: auditAgentName(modeId) } : {},
 					...modelId ? { modelId } : {}
 				},
 				factoryProjectId: state.factoryProjectId,

package/dist/storage/domains/audit/domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain.js","names":["#auth","#audit","#projects","#users","#sinks","#agentTenant","#resolveActorProfiles","#resolveTenant"],"sources":["../../../../src/storage/domains/audit/domain.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { getFactoryAuthUser } from '../../../auth.js';\nimport type { RouteAuth } from '../../../routes/route.js';\nimport type { FactoryProjectsStorage } from '../projects/base.js';\nimport { auditActionsInNamespaces, isAuditNamespace } from './actions.js';\nimport type { AuditAction } from './actions.js';\nimport { isHumanActorId } from './actors.js';\nimport { ACTOR_PROFILE_METADATA_KEY, auditActorProfile, auditAgentName } from './base.js';\nimport type {\n  AuditActorProfileInput,\n  AuditContext,\n  AuditEventPage,\n  AuditEventRow,\n  AuditStorage,\n  AuditTarget,\n  ListAuditEventsInput,\n  RecordAuditEventInput,\n} from './base.js';\nimport { toWireAuditEvent } from './wire.js';\nimport type { WireAuditActor, WireAuditPage } from './wire.js';\n\nexport interface EmitAuditInput {\n  action: AuditAction;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface EmitAgentAuditInput {\n  action: AuditAction;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface AuditEmitter {\n  emit(args: { context: Context; input: EmitAuditInput }): Promise<void>;\n}\n\nexport interface AuditAgentEmitter {\n  emitAgent(args: { requestContext: RequestContext; input: EmitAgentAuditInput }): Promise<void>;\n}\n\n/** Records with an explicit actor, for the paths that have no request: rule transitions, run starts, run ends, supervisor tools. */\nexport type AuditRecorder = Pick<AuditDomain, 'record'>;\n\n/** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */\nexport interface AuditSink {\n  id: string;\n  audit?(args: { event: AuditEventRow }): Promise<void>;\n}\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n}\n\nfunction readStoredActorProfile(metadata: Record<string, unknown> | undefined): AuditActorProfileInput | undefined {\n  if (!metadata) return undefined;\n  const raw = metadata[ACTOR_PROFILE_METADATA_KEY];\n  if (!raw || typeof raw !== 'object') return undefined;\n  const profile = raw as Record<string, unknown>;\n  const name = typeof profile.name === 'string' && profile.name.trim() ? profile.name.trim() : undefined;\n  const avatarUrl =\n    typeof profile.avatarUrl === 'string' && profile.avatarUrl.trim() ? profile.avatarUrl.trim() : undefined;\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\nexport interface AuditDomainOptions {\n  auth: RouteAuth;\n  /** Audit storage domain handle. */\n  audit: AuditStorage;\n  /** Projects domain handle, used to scope the audit trail route. */\n  projects: FactoryProjectsStorage;\n  /** Resolve persisted human actor ids to display names and profile images. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  /** Best-effort fan-out destinations notified after each recorded event. */\n  sinks?: AuditSink[];\n  /** Resolve the acting tenant for agent-emitted events from the request context. */\n  agentTenant?: (requestContext: RequestContext) => { orgId?: string; userId?: string } | undefined;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_ACTOR_PROFILES = 100;\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/** The actions a `namespaces=` query names: none when it names only unknown ones, `undefined` when it names nothing. */\nfunction actionsInRequestedNamespaces(raw: string | undefined): string[] | undefined {\n  if (!raw) return undefined;\n  return auditActionsInNamespaces(\n    raw\n      .split(',')\n      .map(namespace => namespace.trim())\n      .filter(isAuditNamespace),\n  );\n}\n\nfunction parseActorIdsParam(raw: string | undefined): string[] {\n  if (!raw) return [];\n  return [\n    ...new Set(\n      raw\n        .split(',')\n        .map(actorId => actorId.trim())\n        .filter(isHumanActorId),\n    ),\n  ].slice(0, MAX_ACTOR_PROFILES);\n}\n\nfunction parseLimitParam(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const limit = Number.parseInt(raw, 10);\n  return Number.isFinite(limit) ? limit : undefined;\n}\n\nexport function auditRequestContext(c: Context): AuditContext {\n  const location = c.req.header('x-forwarded-for')?.split(',')[0]?.trim();\n  const userAgent = c.req.header('user-agent');\n  return {\n    ...(location ? { location } : {}),\n    ...(userAgent ? { userAgent } : {}),\n  };\n}\n\n/** Who a browser request is and where it came from: the pair every funnel row carries. */\nexport function auditRequestOrigin(c: Context): {\n  actorProfile: AuditActorProfileInput | undefined;\n  context: AuditContext;\n} {\n  return { actorProfile: auditActorProfile(getFactoryAuthUser(c)), context: auditRequestContext(c) };\n}\n\n/** Factory-owned audit behavior backed by the audit storage domain. */\nexport class AuditDomain implements AuditEmitter, AuditAgentEmitter {\n  readonly #auth: RouteAuth;\n  readonly #audit: AuditStorage;\n  readonly #projects: FactoryProjectsStorage;\n  readonly #users: AuditDomainOptions['users'];\n  readonly #sinks: AuditSink[];\n  readonly #agentTenant: AuditDomainOptions['agentTenant'];\n\n  constructor({ auth, audit, projects, users, sinks = [], agentTenant }: AuditDomainOptions) {\n    this.#auth = auth;\n    this.#audit = audit;\n    this.#projects = projects;\n    this.#users = users;\n    this.#sinks = sinks;\n    this.#agentTenant = agentTenant;\n\n    const ids = new Set<string>();\n    for (const sink of this.#sinks) {\n      if (!sink.id) throw new Error('Audit integration id must not be empty');\n      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);\n      ids.add(sink.id);\n    }\n  }\n\n  async record(input: RecordAuditEventInput<AuditAction>): Promise<AuditEventRow | null> {\n    try {\n      await this.#audit.ensureReady();\n      const { event: row, created } = input.idempotencyKey\n        ? await this.#audit.recordOnce(input)\n        : { event: await this.#audit.record(input), created: true };\n      if (!created) return row;\n      for (const sink of this.#sinks) {\n        if (!sink.audit) continue;\n        void Promise.resolve()\n          .then(() => sink.audit?.({ event: row }))\n          .catch(err => {\n            console.warn('[Audit] Audit integration failed', {\n              integration: sink.id,\n              action: row.action,\n              error: err instanceof Error ? err.message : String(err),\n            });\n          });\n      }\n      return row;\n    } catch (err) {\n      console.warn('[Audit] Failed to record audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return null;\n    }\n  }\n\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    await this.#audit.ensureReady();\n    return this.#audit.list(input);\n  }\n\n  async emit({ context, input }: { context: Context; input: EmitAuditInput }): Promise<void> {\n    try {\n      const tenant = this.#auth.tenant(context);\n      if (!tenant?.orgId) return;\n      await this.record({\n        orgId: tenant.orgId,\n        actorId: tenant.userId,\n        actorProfile: auditActorProfile(getFactoryAuthUser(context)),\n        action: input.action,\n        targets: input.targets,\n        metadata: input.metadata,\n        factoryProjectId: input.factoryProjectId,\n        projectRepositoryId: input.projectRepositoryId,\n        context: auditRequestContext(context),\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async emitAgent({\n    requestContext,\n    input,\n  }: {\n    requestContext: RequestContext;\n    input: EmitAgentAuditInput;\n  }): Promise<void> {\n    try {\n      const context = requestContext.get('controller') as\n        | AgentControllerRequestContext<FactorySessionState>\n        | undefined;\n      const tenant = this.#agentTenant?.(requestContext);\n      const orgId = tenant?.orgId;\n      const userId = tenant?.userId;\n      const threadId = context?.threadId;\n      const state = context?.getState();\n      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;\n\n      const modeId = context.session.modeId?.trim();\n      const modelId = context.session.modelId?.trim();\n      await this.record({\n        orgId,\n        actorId: `agent:${threadId}`,\n        actorType: 'agent',\n        action: input.action,\n        targets: input.targets,\n        metadata: {\n          ...input.metadata,\n          startedBy: userId,\n          ...(modeId ? { agentName: auditAgentName(modeId) } : {}),\n          ...(modelId ? { modelId } : {}),\n        },\n        factoryProjectId: state.factoryProjectId,\n        projectRepositoryId: state.projectRepositoryId,\n        context: {},\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit agent audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async #resolveActorProfiles(\n    events: AuditEventRow[],\n    requestedActorIds: string[] = [],\n  ): Promise<Record<string, WireAuditActor>> {\n    const humanActorIds = [\n      ...new Set(\n        [\n          ...requestedActorIds,\n          ...events.filter(event => event.actorType === 'human').map(event => event.actorId),\n        ].filter(isHumanActorId),\n      ),\n    ].slice(0, MAX_ACTOR_PROFILES);\n    if (humanActorIds.length === 0) return {};\n\n    // Prefer the profile stamped into event metadata at record time: it works\n    // regardless of the auth provider's ability to resolve a user by id\n    // (MastraAuthStudio's getUser() always returns null, WorkOS looks up by\n    // id but every provider stamps here uniformly).\n    const profiles: Record<string, WireAuditActor> = {};\n    for (const event of events) {\n      if (event.actorType !== 'human') continue;\n      if (!isHumanActorId(event.actorId)) continue;\n      if (profiles[event.actorId]) continue;\n      const stored = readStoredActorProfile(event.metadata);\n      if (!stored?.name) continue;\n      profiles[event.actorId] = {\n        id: event.actorId,\n        name: stored.name,\n        ...(stored.avatarUrl ? { avatarUrl: stored.avatarUrl } : {}),\n      };\n    }\n\n    const unresolved = humanActorIds.filter(actorId => !profiles[actorId]);\n    if (unresolved.length === 0 || !this.#users) return profiles;\n\n    try {\n      const users = this.#users.getUsers\n        ? await this.#users.getUsers(unresolved)\n        : await Promise.all(unresolved.map(actorId => this.#users?.getUser(actorId) ?? null));\n      for (const [index, user] of users.entries()) {\n        if (!user) continue;\n        const name = user.name?.trim() || user.email?.trim() || user.id;\n        const actorId = unresolved[index] ?? user.id;\n        profiles[actorId] = {\n          id: user.id,\n          name,\n          ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),\n        };\n      }\n    } catch (err) {\n      console.warn('[Audit] Failed to resolve audit actor profiles', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n    return profiles;\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects/:id/audit', {\n        method: 'GET',\n        handler: async cc => {\n          const c = loose(cc);\n          const tenant = await this.#resolveTenant(c);\n          if ('response' in tenant) return tenant.response;\n\n          const projectId = c.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: 'Project not found' }, 404);\n          await this.#projects.ensureReady();\n          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });\n          if (!project) return c.json({ error: 'Project not found' }, 404);\n\n          const actions = actionsInRequestedNamespaces(c.req.query('namespaces'));\n          if (actions?.length === 0) return c.json({ error: 'unknown_namespaces' }, 400);\n\n          const page = await this.list({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            actions,\n            actorId: c.req.query('actor') || undefined,\n            before: c.req.query('before') || undefined,\n            limit: parseLimitParam(c.req.query('limit')),\n          });\n          const actors = await this.#resolveActorProfiles(page.events, parseActorIdsParam(c.req.query('actorIds')));\n          const body: WireAuditPage = {\n            events: page.events.map(toWireAuditEvent),\n            actors,\n            ...(page.nextCursor ? { nextCursor: page.nextCursor } : {}),\n          };\n          return c.json(body);\n        },\n      }),\n    ];\n  }\n\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.#auth.ensureUser(c);\n    const tenant = this.#auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json({ error: 'organization_required', message: 'The audit trail requires an organization.' }, 403),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n}\n"],"mappings":";;;;;;;AA8DA,SAAS,uBAAuB,UAAmF;CACjH,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,MAAM,SAAS;CACrB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAC5C,MAAM,UAAU;CAChB,MAAM,OAAO,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK,IAAI,KAAA;CAC7F,MAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAAI,QAAQ,UAAU,KAAK,IAAI,KAAA;CACjG,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;AAgBA,MAAM,UAAU;AAChB,MAAM,qBAAqB;AAE3B,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;AAGA,SAAS,6BAA6B,KAA+C;CACnF,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,OAAO,yBACL,IACG,MAAM,GAAG,CAAC,CACV,KAAI,cAAa,UAAU,KAAK,CAAC,CAAC,CAClC,OAAO,gBAAgB,CAC5B;AACF;AAEA,SAAS,mBAAmB,KAAmC;CAC7D,IAAI,CAAC,KAAK,OAAO,CAAC;CAClB,OAAO,CACL,GAAG,IAAI,IACL,IACG,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,QAAQ,KAAK,CAAC,CAAC,CAC9B,OAAO,cAAc,CAC1B,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;AAC/B;AAEA,SAAS,gBAAgB,KAA6C;CACpE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;CACrC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AAC1C;AAEA,SAAgB,oBAAoB,GAA0B;CAC5D,MAAM,WAAW,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;CACtE,MAAM,YAAY,EAAE,IAAI,OAAO,YAAY;CAC3C,OAAO;EACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;AAGA,SAAgB,mBAAmB,GAGjC;CACA,OAAO;EAAE,cAAc,kBAAkB,mBAAmB,CAAC,CAAC;EAAG,SAAS,oBAAoB,CAAC;CAAE;AACnG;;AAGA,IAAa,cAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,EAAE,MAAM,OAAO,UAAU,OAAO,QAAQ,CAAC,GAAG,eAAmC;EACzF,KAAKA,QAAQ;EACb,KAAKC,SAAS;EACd,KAAKC,YAAY;EACjB,KAAKC,SAAS;EACd,KAAKC,SAAS;EACd,KAAKC,eAAe;EAEpB,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,KAAKD,QAAQ;GAC9B,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,wCAAwC;GACtE,IAAI,IAAI,IAAI,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG,EAAE;GACnF,IAAI,IAAI,KAAK,EAAE;EACjB;CACF;CAEA,MAAM,OAAO,OAA0E;EACrF,IAAI;GACF,MAAM,KAAKH,OAAO,YAAY;GAC9B,MAAM,EAAE,OAAO,KAAK,YAAY,MAAM,iBAClC,MAAM,KAAKA,OAAO,WAAW,KAAK,IAClC;IAAE,OAAO,MAAM,KAAKA,OAAO,OAAO,KAAK;IAAG,SAAS;GAAK;GAC5D,IAAI,CAAC,SAAS,OAAO;GACrB,KAAK,MAAM,QAAQ,KAAKG,QAAQ;IAC9B,IAAI,CAAC,KAAK,OAAO;IACjB,QAAa,QAAQ,CAAC,CACnB,WAAW,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CACxC,OAAM,QAAO;KACZ,QAAQ,KAAK,oCAAoC;MAC/C,aAAa,KAAK;MAClB,QAAQ,IAAI;MACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KACxD,CAAC;IACH,CAAC;GACL;GACA,OAAO;EACT,SAAS,KAAK;GACZ,QAAQ,KAAK,wCAAwC;IACnD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAM,KAAK,OAAsD;EAC/D,MAAM,KAAKH,OAAO,YAAY;EAC9B,OAAO,KAAKA,OAAO,KAAK,KAAK;CAC/B;CAEA,MAAM,KAAK,EAAE,SAAS,SAAqE;EACzF,IAAI;GACF,MAAM,SAAS,KAAKD,MAAM,OAAO,OAAO;GACxC,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,KAAK,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,cAAc,kBAAkB,mBAAmB,OAAO,CAAC;IAC3D,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,oBAAoB,OAAO;GACtC,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC;IACjD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAM,UAAU,EACd,gBACA,SAIgB;EAChB,IAAI;GACF,MAAM,UAAU,eAAe,IAAI,YAAY;GAG/C,MAAM,SAAS,KAAKK,eAAe,cAAc;GACjD,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,WAAW,SAAS;GAC1B,MAAM,QAAQ,SAAS,SAAS;GAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,kBAAkB;GAEhE,MAAM,SAAS,QAAQ,QAAQ,QAAQ,KAAK;GAC5C,MAAM,UAAU,QAAQ,QAAQ,SAAS,KAAK;GAC9C,MAAM,KAAK,OAAO;IAChB;IACA,SAAS,SAAS;IAClB,WAAW;IACX,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;KACR,GAAG,MAAM;KACT,WAAW;KACX,GAAI,SAAS,EAAE,WAAW,eAAe,MAAM,EAAE,IAAI,CAAC;KACtD,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;IAC/B;IACA,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,CAAC;GACZ,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,4CAA4C;IACvD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAMC,sBACJ,QACA,oBAA8B,CAAC,GACU;EACzC,MAAM,gBAAgB,CACpB,GAAG,IAAI,IACL,CACE,GAAG,mBACH,GAAG,OAAO,QAAO,UAAS,MAAM,cAAc,OAAO,CAAC,CAAC,KAAI,UAAS,MAAM,OAAO,CACnF,CAAC,CAAC,OAAO,cAAc,CACzB,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;EAC7B,IAAI,cAAc,WAAW,GAAG,OAAO,CAAC;EAMxC,MAAM,WAA2C,CAAC;EAClD,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,MAAM,cAAc,SAAS;GACjC,IAAI,CAAC,eAAe,MAAM,OAAO,GAAG;GACpC,IAAI,SAAS,MAAM,UAAU;GAC7B,MAAM,SAAS,uBAAuB,MAAM,QAAQ;GACpD,IAAI,CAAC,QAAQ,MAAM;GACnB,SAAS,MAAM,WAAW;IACxB,IAAI,MAAM;IACV,MAAM,OAAO;IACb,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC5D;EACF;EAEA,MAAM,aAAa,cAAc,QAAO,YAAW,CAAC,SAAS,QAAQ;EACrE,IAAI,WAAW,WAAW,KAAK,CAAC,KAAKH,QAAQ,OAAO;EAEpD,IAAI;GACF,MAAM,QAAQ,KAAKA,OAAO,WACtB,MAAM,KAAKA,OAAO,SAAS,UAAU,IACrC,MAAM,QAAQ,IAAI,WAAW,KAAI,YAAW,KAAKA,QAAQ,QAAQ,OAAO,KAAK,IAAI,CAAC;GACtF,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GAAG;IAC3C,IAAI,CAAC,MAAM;IACX,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK,KAAK;IAC7D,MAAM,UAAU,WAAW,UAAU,KAAK;IAC1C,SAAS,WAAW;KAClB,IAAI,KAAK;KACT;KACA,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;IACxD;GACF;EACF,SAAS,KAAK;GACZ,QAAQ,KAAK,kDAAkD,EAC7D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;EACH;EACA,OAAO;CACT;CAEA,SAAqB;EACnB,OAAO,CACL,iBAAiB,mCAAmC;GAClD,QAAQ;GACR,SAAS,OAAM,OAAM;IACnB,MAAM,IAAI,MAAM,EAAE;IAClB,MAAM,SAAS,MAAM,KAAKI,eAAe,CAAC;IAC1C,IAAI,cAAc,QAAQ,OAAO,OAAO;IAExC,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC7F,MAAM,KAAKL,UAAU,YAAY;IAEjC,IAAI,CAAC,MADiB,KAAKA,UAAU,IAAI;KAAE,OAAO,OAAO;KAAO,IAAI;IAAU,CAAC,GACjE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,UAAU,6BAA6B,EAAE,IAAI,MAAM,YAAY,CAAC;IACtE,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAE7E,MAAM,OAAO,MAAM,KAAK,KAAK;KAC3B,OAAO,OAAO;KACd,kBAAkB;KAClB;KACA,SAAS,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACjC,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK,KAAA;KACjC,OAAO,gBAAgB,EAAE,IAAI,MAAM,OAAO,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,MAAM,KAAKI,sBAAsB,KAAK,QAAQ,mBAAmB,EAAE,IAAI,MAAM,UAAU,CAAC,CAAC;IACxG,MAAM,OAAsB;KAC1B,QAAQ,KAAK,OAAO,IAAI,gBAAgB;KACxC;KACA,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;IAC3D;IACA,OAAO,EAAE,KAAK,IAAI;GACpB;EACF,CAAC,CACH;CACF;CAEA,MAAMC,eAAe,GAAiF;EACpG,MAAM,KAAKP,MAAM,WAAW,CAAC;EAC7B,MAAM,SAAS,KAAKA,MAAM,OAAO,CAAC;EAClC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KAAK;GAAE,OAAO;GAAyB,SAAS;EAA4C,GAAG,GAAG,EAChH;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;AACF"}
+{"version":3,"file":"domain.js","names":["#auth","#audit","#projects","#users","#sinks","#agentTenant","#resolveActorProfiles","#resolveTenant"],"sources":["../../../../src/storage/domains/audit/domain.ts"],"sourcesContent":["import type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute, IUserProvider } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport { getFactoryAuthUser } from '../../../auth.js';\nimport type { RouteAuth } from '../../../routes/route.js';\nimport type { FactoryProjectsStorage } from '../projects/base.js';\nimport { auditActionsInNamespaces, isAuditNamespace } from './actions.js';\nimport type { AuditAction } from './actions.js';\nimport { isHumanActorId } from './actors.js';\nimport { ACTOR_PROFILE_METADATA_KEY, auditActorProfile } from './base.js';\nimport type {\n  AuditActorProfileInput,\n  AuditContext,\n  AuditEventPage,\n  AuditEventRow,\n  AuditStorage,\n  AuditTarget,\n  ListAuditEventsInput,\n  RecordAuditEventInput,\n} from './base.js';\nimport { toWireAuditEvent } from './wire.js';\nimport type { WireAuditActor, WireAuditPage } from './wire.js';\n\nexport interface EmitAuditInput {\n  action: AuditAction;\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface EmitAgentAuditInput {\n  action: AuditAction;\n  targets: AuditTarget[];\n  metadata?: Record<string, unknown>;\n}\n\nexport interface AuditEmitter {\n  emit(args: { context: Context; input: EmitAuditInput }): Promise<void>;\n}\n\nexport interface AuditAgentEmitter {\n  emitAgent(args: { requestContext: RequestContext; input: EmitAgentAuditInput }): Promise<void>;\n}\n\n/** Records with an explicit actor, for the paths that have no request: rule transitions, run starts, run ends, supervisor tools. */\nexport type AuditRecorder = Pick<AuditDomain, 'record'>;\n\n/** Best-effort destination for locally persisted audit events (e.g. an integration's audit log). */\nexport interface AuditSink {\n  id: string;\n  audit?(args: { event: AuditEventRow }): Promise<void>;\n}\n\ninterface FactorySessionState {\n  factoryProjectId?: string;\n  projectRepositoryId?: string;\n}\n\nfunction readStoredActorProfile(metadata: Record<string, unknown> | undefined): AuditActorProfileInput | undefined {\n  if (!metadata) return undefined;\n  const raw = metadata[ACTOR_PROFILE_METADATA_KEY];\n  if (!raw || typeof raw !== 'object') return undefined;\n  const profile = raw as Record<string, unknown>;\n  const name = typeof profile.name === 'string' && profile.name.trim() ? profile.name.trim() : undefined;\n  const avatarUrl =\n    typeof profile.avatarUrl === 'string' && profile.avatarUrl.trim() ? profile.avatarUrl.trim() : undefined;\n  if (!name && !avatarUrl) return undefined;\n  return { ...(name ? { name } : {}), ...(avatarUrl ? { avatarUrl } : {}) };\n}\n\nexport interface AuditDomainOptions {\n  auth: RouteAuth;\n  /** Audit storage domain handle. */\n  audit: AuditStorage;\n  /** Projects domain handle, used to scope the audit trail route. */\n  projects: FactoryProjectsStorage;\n  /** Resolve persisted human actor ids to display names and profile images. */\n  users?: Pick<IUserProvider, 'getUser' | 'getUsers'>;\n  /** Best-effort fan-out destinations notified after each recorded event. */\n  sinks?: AuditSink[];\n  /** Resolve the acting tenant for agent-emitted events from the request context. */\n  agentTenant?: (requestContext: RequestContext) => { orgId?: string; userId?: string } | undefined;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MAX_ACTOR_PROFILES = 100;\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\n/** The actions a `namespaces=` query names: none when it names only unknown ones, `undefined` when it names nothing. */\nfunction actionsInRequestedNamespaces(raw: string | undefined): string[] | undefined {\n  if (!raw) return undefined;\n  return auditActionsInNamespaces(\n    raw\n      .split(',')\n      .map(namespace => namespace.trim())\n      .filter(isAuditNamespace),\n  );\n}\n\nfunction parseActorIdsParam(raw: string | undefined): string[] {\n  if (!raw) return [];\n  return [\n    ...new Set(\n      raw\n        .split(',')\n        .map(actorId => actorId.trim())\n        .filter(isHumanActorId),\n    ),\n  ].slice(0, MAX_ACTOR_PROFILES);\n}\n\nfunction parseLimitParam(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const limit = Number.parseInt(raw, 10);\n  return Number.isFinite(limit) ? limit : undefined;\n}\n\nexport function auditRequestContext(c: Context): AuditContext {\n  const location = c.req.header('x-forwarded-for')?.split(',')[0]?.trim();\n  const userAgent = c.req.header('user-agent');\n  return {\n    ...(location ? { location } : {}),\n    ...(userAgent ? { userAgent } : {}),\n  };\n}\n\n/** Who a browser request is and where it came from: the pair every funnel row carries. */\nexport function auditRequestOrigin(c: Context): {\n  actorProfile: AuditActorProfileInput | undefined;\n  context: AuditContext;\n} {\n  return { actorProfile: auditActorProfile(getFactoryAuthUser(c)), context: auditRequestContext(c) };\n}\n\n/** Factory-owned audit behavior backed by the audit storage domain. */\nexport class AuditDomain implements AuditEmitter, AuditAgentEmitter {\n  readonly #auth: RouteAuth;\n  readonly #audit: AuditStorage;\n  readonly #projects: FactoryProjectsStorage;\n  readonly #users: AuditDomainOptions['users'];\n  readonly #sinks: AuditSink[];\n  readonly #agentTenant: AuditDomainOptions['agentTenant'];\n\n  constructor({ auth, audit, projects, users, sinks = [], agentTenant }: AuditDomainOptions) {\n    this.#auth = auth;\n    this.#audit = audit;\n    this.#projects = projects;\n    this.#users = users;\n    this.#sinks = sinks;\n    this.#agentTenant = agentTenant;\n\n    const ids = new Set<string>();\n    for (const sink of this.#sinks) {\n      if (!sink.id) throw new Error('Audit integration id must not be empty');\n      if (ids.has(sink.id)) throw new Error(`Duplicate audit integration id '${sink.id}'`);\n      ids.add(sink.id);\n    }\n  }\n\n  async record(input: RecordAuditEventInput<AuditAction>): Promise<AuditEventRow | null> {\n    try {\n      await this.#audit.ensureReady();\n      const { event: row, created } = input.idempotencyKey\n        ? await this.#audit.recordOnce(input)\n        : { event: await this.#audit.record(input), created: true };\n      if (!created) return row;\n      for (const sink of this.#sinks) {\n        if (!sink.audit) continue;\n        void Promise.resolve()\n          .then(() => sink.audit?.({ event: row }))\n          .catch(err => {\n            console.warn('[Audit] Audit integration failed', {\n              integration: sink.id,\n              action: row.action,\n              error: err instanceof Error ? err.message : String(err),\n            });\n          });\n      }\n      return row;\n    } catch (err) {\n      console.warn('[Audit] Failed to record audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      return null;\n    }\n  }\n\n  async list(input: ListAuditEventsInput): Promise<AuditEventPage> {\n    await this.#audit.ensureReady();\n    return this.#audit.list(input);\n  }\n\n  async emit({ context, input }: { context: Context; input: EmitAuditInput }): Promise<void> {\n    try {\n      const tenant = this.#auth.tenant(context);\n      if (!tenant?.orgId) return;\n      await this.record({\n        orgId: tenant.orgId,\n        actorId: tenant.userId,\n        actorProfile: auditActorProfile(getFactoryAuthUser(context)),\n        action: input.action,\n        targets: input.targets,\n        metadata: input.metadata,\n        factoryProjectId: input.factoryProjectId,\n        projectRepositoryId: input.projectRepositoryId,\n        context: auditRequestContext(context),\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async emitAgent({\n    requestContext,\n    input,\n  }: {\n    requestContext: RequestContext;\n    input: EmitAgentAuditInput;\n  }): Promise<void> {\n    try {\n      const context = requestContext.get('controller') as\n        | AgentControllerRequestContext<FactorySessionState>\n        | undefined;\n      const tenant = this.#agentTenant?.(requestContext);\n      const orgId = tenant?.orgId;\n      const userId = tenant?.userId;\n      const threadId = context?.threadId;\n      const state = context?.getState();\n      if (!orgId || !userId || !threadId || !state?.factoryProjectId) return;\n\n      const modelId = context.session.modelId?.trim();\n      await this.record({\n        orgId,\n        actorId: `agent:${threadId}`,\n        actorType: 'agent',\n        action: input.action,\n        targets: input.targets,\n        metadata: {\n          ...input.metadata,\n          startedBy: userId,\n          ...(modelId ? { modelId } : {}),\n        },\n        factoryProjectId: state.factoryProjectId,\n        projectRepositoryId: state.projectRepositoryId,\n        context: {},\n      });\n    } catch (err) {\n      console.warn('[Audit] Failed to emit agent audit event', {\n        action: input.action,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  async #resolveActorProfiles(\n    events: AuditEventRow[],\n    requestedActorIds: string[] = [],\n  ): Promise<Record<string, WireAuditActor>> {\n    const humanActorIds = [\n      ...new Set(\n        [\n          ...requestedActorIds,\n          ...events.filter(event => event.actorType === 'human').map(event => event.actorId),\n        ].filter(isHumanActorId),\n      ),\n    ].slice(0, MAX_ACTOR_PROFILES);\n    if (humanActorIds.length === 0) return {};\n\n    // Prefer the profile stamped into event metadata at record time: it works\n    // regardless of the auth provider's ability to resolve a user by id\n    // (MastraAuthStudio's getUser() always returns null, WorkOS looks up by\n    // id but every provider stamps here uniformly).\n    const profiles: Record<string, WireAuditActor> = {};\n    for (const event of events) {\n      if (event.actorType !== 'human') continue;\n      if (!isHumanActorId(event.actorId)) continue;\n      if (profiles[event.actorId]) continue;\n      const stored = readStoredActorProfile(event.metadata);\n      if (!stored?.name) continue;\n      profiles[event.actorId] = {\n        id: event.actorId,\n        name: stored.name,\n        ...(stored.avatarUrl ? { avatarUrl: stored.avatarUrl } : {}),\n      };\n    }\n\n    const unresolved = humanActorIds.filter(actorId => !profiles[actorId]);\n    if (unresolved.length === 0 || !this.#users) return profiles;\n\n    try {\n      const users = this.#users.getUsers\n        ? await this.#users.getUsers(unresolved)\n        : await Promise.all(unresolved.map(actorId => this.#users?.getUser(actorId) ?? null));\n      for (const [index, user] of users.entries()) {\n        if (!user) continue;\n        const name = user.name?.trim() || user.email?.trim() || user.id;\n        const actorId = unresolved[index] ?? user.id;\n        profiles[actorId] = {\n          id: user.id,\n          name,\n          ...(user.avatarUrl ? { avatarUrl: user.avatarUrl } : {}),\n        };\n      }\n    } catch (err) {\n      console.warn('[Audit] Failed to resolve audit actor profiles', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n    return profiles;\n  }\n\n  routes(): ApiRoute[] {\n    return [\n      registerApiRoute('/web/factory/projects/:id/audit', {\n        method: 'GET',\n        handler: async cc => {\n          const c = loose(cc);\n          const tenant = await this.#resolveTenant(c);\n          if ('response' in tenant) return tenant.response;\n\n          const projectId = c.req.param('id');\n          if (!projectId || !UUID_RE.test(projectId)) return c.json({ error: 'Project not found' }, 404);\n          await this.#projects.ensureReady();\n          const project = await this.#projects.get({ orgId: tenant.orgId, id: projectId });\n          if (!project) return c.json({ error: 'Project not found' }, 404);\n\n          const actions = actionsInRequestedNamespaces(c.req.query('namespaces'));\n          if (actions?.length === 0) return c.json({ error: 'unknown_namespaces' }, 400);\n\n          const page = await this.list({\n            orgId: tenant.orgId,\n            factoryProjectId: projectId,\n            actions,\n            actorId: c.req.query('actor') || undefined,\n            before: c.req.query('before') || undefined,\n            limit: parseLimitParam(c.req.query('limit')),\n          });\n          const actors = await this.#resolveActorProfiles(page.events, parseActorIdsParam(c.req.query('actorIds')));\n          const body: WireAuditPage = {\n            events: page.events.map(toWireAuditEvent),\n            actors,\n            ...(page.nextCursor ? { nextCursor: page.nextCursor } : {}),\n          };\n          return c.json(body);\n        },\n      }),\n    ];\n  }\n\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.#auth.ensureUser(c);\n    const tenant = this.#auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json({ error: 'organization_required', message: 'The audit trail requires an organization.' }, 403),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n}\n"],"mappings":";;;;;;;AA8DA,SAAS,uBAAuB,UAAmF;CACjH,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,MAAM,SAAS;CACrB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAC5C,MAAM,UAAU;CAChB,MAAM,OAAO,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK,IAAI,KAAA;CAC7F,MAAM,YACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAAI,QAAQ,UAAU,KAAK,IAAI,KAAA;CACjG,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO,KAAA;CAChC,OAAO;EAAE,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CAAG;AAC1E;AAgBA,MAAM,UAAU;AAChB,MAAM,qBAAqB;AAE3B,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;;AAGA,SAAS,6BAA6B,KAA+C;CACnF,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,OAAO,yBACL,IACG,MAAM,GAAG,CAAC,CACV,KAAI,cAAa,UAAU,KAAK,CAAC,CAAC,CAClC,OAAO,gBAAgB,CAC5B;AACF;AAEA,SAAS,mBAAmB,KAAmC;CAC7D,IAAI,CAAC,KAAK,OAAO,CAAC;CAClB,OAAO,CACL,GAAG,IAAI,IACL,IACG,MAAM,GAAG,CAAC,CACV,KAAI,YAAW,QAAQ,KAAK,CAAC,CAAC,CAC9B,OAAO,cAAc,CAC1B,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;AAC/B;AAEA,SAAS,gBAAgB,KAA6C;CACpE,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,MAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;CACrC,OAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AAC1C;AAEA,SAAgB,oBAAoB,GAA0B;CAC5D,MAAM,WAAW,EAAE,IAAI,OAAO,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK;CACtE,MAAM,YAAY,EAAE,IAAI,OAAO,YAAY;CAC3C,OAAO;EACL,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;CACnC;AACF;;AAGA,SAAgB,mBAAmB,GAGjC;CACA,OAAO;EAAE,cAAc,kBAAkB,mBAAmB,CAAC,CAAC;EAAG,SAAS,oBAAoB,CAAC;CAAE;AACnG;;AAGA,IAAa,cAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,EAAE,MAAM,OAAO,UAAU,OAAO,QAAQ,CAAC,GAAG,eAAmC;EACzF,KAAKA,QAAQ;EACb,KAAKC,SAAS;EACd,KAAKC,YAAY;EACjB,KAAKC,SAAS;EACd,KAAKC,SAAS;EACd,KAAKC,eAAe;EAEpB,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,KAAKD,QAAQ;GAC9B,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,wCAAwC;GACtE,IAAI,IAAI,IAAI,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,GAAG,EAAE;GACnF,IAAI,IAAI,KAAK,EAAE;EACjB;CACF;CAEA,MAAM,OAAO,OAA0E;EACrF,IAAI;GACF,MAAM,KAAKH,OAAO,YAAY;GAC9B,MAAM,EAAE,OAAO,KAAK,YAAY,MAAM,iBAClC,MAAM,KAAKA,OAAO,WAAW,KAAK,IAClC;IAAE,OAAO,MAAM,KAAKA,OAAO,OAAO,KAAK;IAAG,SAAS;GAAK;GAC5D,IAAI,CAAC,SAAS,OAAO;GACrB,KAAK,MAAM,QAAQ,KAAKG,QAAQ;IAC9B,IAAI,CAAC,KAAK,OAAO;IACjB,QAAa,QAAQ,CAAC,CACnB,WAAW,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CACxC,OAAM,QAAO;KACZ,QAAQ,KAAK,oCAAoC;MAC/C,aAAa,KAAK;MAClB,QAAQ,IAAI;MACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KACxD,CAAC;IACH,CAAC;GACL;GACA,OAAO;EACT,SAAS,KAAK;GACZ,QAAQ,KAAK,wCAAwC;IACnD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,OAAO;EACT;CACF;CAEA,MAAM,KAAK,OAAsD;EAC/D,MAAM,KAAKH,OAAO,YAAY;EAC9B,OAAO,KAAKA,OAAO,KAAK,KAAK;CAC/B;CAEA,MAAM,KAAK,EAAE,SAAS,SAAqE;EACzF,IAAI;GACF,MAAM,SAAS,KAAKD,MAAM,OAAO,OAAO;GACxC,IAAI,CAAC,QAAQ,OAAO;GACpB,MAAM,KAAK,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,cAAc,kBAAkB,mBAAmB,OAAO,CAAC;IAC3D,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,oBAAoB,OAAO;GACtC,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,sCAAsC;IACjD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAM,UAAU,EACd,gBACA,SAIgB;EAChB,IAAI;GACF,MAAM,UAAU,eAAe,IAAI,YAAY;GAG/C,MAAM,SAAS,KAAKK,eAAe,cAAc;GACjD,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,WAAW,SAAS;GAC1B,MAAM,QAAQ,SAAS,SAAS;GAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,kBAAkB;GAEhE,MAAM,UAAU,QAAQ,QAAQ,SAAS,KAAK;GAC9C,MAAM,KAAK,OAAO;IAChB;IACA,SAAS,SAAS;IAClB,WAAW;IACX,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;KACR,GAAG,MAAM;KACT,WAAW;KACX,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;IAC/B;IACA,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,SAAS,CAAC;GACZ,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,KAAK,4CAA4C;IACvD,QAAQ,MAAM;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;CACF;CAEA,MAAMC,sBACJ,QACA,oBAA8B,CAAC,GACU;EACzC,MAAM,gBAAgB,CACpB,GAAG,IAAI,IACL,CACE,GAAG,mBACH,GAAG,OAAO,QAAO,UAAS,MAAM,cAAc,OAAO,CAAC,CAAC,KAAI,UAAS,MAAM,OAAO,CACnF,CAAC,CAAC,OAAO,cAAc,CACzB,CACF,CAAC,CAAC,MAAM,GAAG,kBAAkB;EAC7B,IAAI,cAAc,WAAW,GAAG,OAAO,CAAC;EAMxC,MAAM,WAA2C,CAAC;EAClD,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,MAAM,cAAc,SAAS;GACjC,IAAI,CAAC,eAAe,MAAM,OAAO,GAAG;GACpC,IAAI,SAAS,MAAM,UAAU;GAC7B,MAAM,SAAS,uBAAuB,MAAM,QAAQ;GACpD,IAAI,CAAC,QAAQ,MAAM;GACnB,SAAS,MAAM,WAAW;IACxB,IAAI,MAAM;IACV,MAAM,OAAO;IACb,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC5D;EACF;EAEA,MAAM,aAAa,cAAc,QAAO,YAAW,CAAC,SAAS,QAAQ;EACrE,IAAI,WAAW,WAAW,KAAK,CAAC,KAAKH,QAAQ,OAAO;EAEpD,IAAI;GACF,MAAM,QAAQ,KAAKA,OAAO,WACtB,MAAM,KAAKA,OAAO,SAAS,UAAU,IACrC,MAAM,QAAQ,IAAI,WAAW,KAAI,YAAW,KAAKA,QAAQ,QAAQ,OAAO,KAAK,IAAI,CAAC;GACtF,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GAAG;IAC3C,IAAI,CAAC,MAAM;IACX,MAAM,OAAO,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK,KAAK;IAC7D,MAAM,UAAU,WAAW,UAAU,KAAK;IAC1C,SAAS,WAAW;KAClB,IAAI,KAAK;KACT;KACA,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;IACxD;GACF;EACF,SAAS,KAAK;GACZ,QAAQ,KAAK,kDAAkD,EAC7D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EACxD,CAAC;EACH;EACA,OAAO;CACT;CAEA,SAAqB;EACnB,OAAO,CACL,iBAAiB,mCAAmC;GAClD,QAAQ;GACR,SAAS,OAAM,OAAM;IACnB,MAAM,IAAI,MAAM,EAAE;IAClB,MAAM,SAAS,MAAM,KAAKI,eAAe,CAAC;IAC1C,IAAI,cAAc,QAAQ,OAAO,OAAO;IAExC,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;IAClC,IAAI,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAC7F,MAAM,KAAKL,UAAU,YAAY;IAEjC,IAAI,CAAC,MADiB,KAAKA,UAAU,IAAI;KAAE,OAAO,OAAO;KAAO,IAAI;IAAU,CAAC,GACjE,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;IAE/D,MAAM,UAAU,6BAA6B,EAAE,IAAI,MAAM,YAAY,CAAC;IACtE,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;IAE7E,MAAM,OAAO,MAAM,KAAK,KAAK;KAC3B,OAAO,OAAO;KACd,kBAAkB;KAClB;KACA,SAAS,EAAE,IAAI,MAAM,OAAO,KAAK,KAAA;KACjC,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK,KAAA;KACjC,OAAO,gBAAgB,EAAE,IAAI,MAAM,OAAO,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,MAAM,KAAKI,sBAAsB,KAAK,QAAQ,mBAAmB,EAAE,IAAI,MAAM,UAAU,CAAC,CAAC;IACxG,MAAM,OAAsB;KAC1B,QAAQ,KAAK,OAAO,IAAI,gBAAgB;KACxC;KACA,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;IAC3D;IACA,OAAO,EAAE,KAAK,IAAI;GACpB;EACF,CAAC,CACH;CACF;CAEA,MAAMC,eAAe,GAAiF;EACpG,MAAM,KAAKP,MAAM,WAAW,CAAC;EAC7B,MAAM,SAAS,KAAKA,MAAM,OAAO,CAAC;EAClC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KAAK;GAAE,OAAO;GAAyB,SAAS;EAA4C,GAAG,GAAG,EAChH;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;AACF"}

package/dist/storage/domains/credentials/base.d.ts

@@ -11,8 +11,8 @@
  * - **org-scoped** rows (`userId` absent): shared API keys set by an org
  *   admin, inherited by every member.
  *
- * Resolution order at model-call time is user > org (the caller layers server
- * env vars underneath as a final fallback).
+ * Model calls resolve exactly one scope: user or org. Deployed tenant stores
+ * never fall back to the other scope or implicitly borrow server environment keys.
  *
  * Secrets posture: credentials are stored server-side only and never returned
  * to the client (same as `linear_connections.access_token`). Encryption at
@@ -101,12 +101,8 @@ export declare class ModelCredentialsStorage extends FactoryStorageDomain {
     removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean>;
     /** All credentials visible to a user: their own rows plus the org's shared rows. */
     listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]>;
-    /**
-     * Resolve the credential a caller should use for a provider. By default the
-     * user's own row wins over the org's shared row; `precedence: 'org'`
-     * (automated factory runs) checks the org's shared row first.
-     */
-    resolveCredential(orgId: string, userId: string, provider: string, precedence?: CredentialScope): Promise<ResolvedCredential | undefined>;
+    /** Resolve a provider credential from exactly one tenancy scope. */
+    resolveCredential(orgId: string, userId: string, provider: string, scope: CredentialScope): Promise<ResolvedCredential | undefined>;
     /**
      * Refresh the tenant's OAuth credential under the backend's atomic
      * read-modify-write so concurrent replicas don't invalidate each other's

package/dist/storage/domains/credentials/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/credentials/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7E,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,aAAa,CAAC;AAE5D,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,KAAK,CAAC;AAElD,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAE/F;AAED,eAAO,MAAM,wBAAwB,EAAE,gBAsBtC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,gBAczC,CAAC;AA6CF;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,GAAE,uBAAkE;IAIrG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB1C,yEAAyE;IACnE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKpG,4EAA4E;IACtE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1G,yFAAyF;IACnF,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpF,oFAAoF;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAsBjF;;;;OAIG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,eAAwB,GACnC,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAwB1C;;;;;;;OAOG;IACG,YAAY,CAChB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,GAChE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAsBvC,2DAA2D;IACrD,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgBlF;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC,GACrE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IA0BvC,8EAA8E;IACxE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GACvE,OAAO,CAAC,IAAI,CAAC;IAQhB,qEAAqE;IAC/D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/credentials/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAE7E,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7C,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,aAAa,CAAC;AAE5D,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,KAAK,CAAC;AAElD,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,2EAA2E;IAC3E,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAE/F;AAED,eAAO,MAAM,wBAAwB,EAAE,gBAsBtC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,gBAczC,CAAC;AA6CF;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,GAAE,uBAAkE;IAIrG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB1C,yEAAyE;IACnE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKpG,4EAA4E;IACtE,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1G,yFAAyF;IACnF,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpF,oFAAoF;IAC9E,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAsBjF,oEAAoE;IAC9D,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAwB1C;;;;;;;OAOG;IACG,YAAY,CAChB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,GAChE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAsBvC,2DAA2D;IACrD,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgBlF;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAU9E;;;;OAIG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC,GACrE,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IA0BvC,8EAA8E;IACxE,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GACvE,OAAO,CAAC,IAAI,CAAC;IAQhB,qEAAqE;IAC/D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}

package/dist/storage/domains/credentials/base.js

@@ -175,12 +175,8 @@ var ModelCredentialsStorage = class extends FactoryStorageDomain {
 			updatedAt: row.updated_at
 		}))]);
 	}
-	/**
-	* Resolve the credential a caller should use for a provider. By default the
-	* user's own row wins over the org's shared row; `precedence: 'org'`
-	* (automated factory runs) checks the org's shared row first.
-	*/
-	async resolveCredential(orgId, userId, provider, precedence = "user") {
+	/** Resolve a provider credential from exactly one tenancy scope. */
+	async resolveCredential(orgId, userId, provider, scope) {
 		const readUser = async () => {
 			const row = await this.#db.findOne("model_provider_credentials", {
 				org_id: orgId,
@@ -205,7 +201,7 @@ var ModelCredentialsStorage = class extends FactoryStorageDomain {
 				credential: await this.#decryptCredential(row.data)
 			} : void 0;
 		};
-		return precedence === "org" ? await readOrg() ?? await readUser() : await readUser() ?? await readOrg();
+		return scope === "org" ? readOrg() : readUser();
 	}
 	/**
 	* Refresh the tenant's OAuth credential under the backend's atomic

package/dist/storage/domains/credentials/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","names":["#migrateCredential","#db","#decryptCredential"],"sources":["../../../../src/storage/domains/credentials/base.ts"],"sourcesContent":["/**\n * Model provider credentials domain — tenant-scoped OAuth tokens and API keys\n * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,\n * xAI, plus plain API-key providers).\n *\n * Tenancy is two-level:\n * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and\n *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are\n *   personal subscriptions, and sharing one would bill/rate-limit a single\n *   account for the whole org.\n * - **org-scoped** rows (`userId` absent): shared API keys set by an org\n *   admin, inherited by every member.\n *\n * Resolution order at model-call time is user > org (the caller layers server\n * env vars underneath as a final fallback).\n *\n * Secrets posture: credentials are stored server-side only and never returned\n * to the client (same as `linear_connections.access_token`). Encryption at\n * rest is out of scope, matching the existing posture.\n *\n * The domain also owns `oauth_login_sessions`: pending web login flows\n * (paste-code PKCE verifiers, device-code poll state) persisted server-side so\n * any replica can complete or poll a flow started on another.\n */\n\nimport type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\nimport { createPlaintextFactorySecretEncryption } from '../../../secret-encryption.js';\nimport type { FactorySecretEncryption } from '../../../secret-encryption.js';\n\n/** Owning tenant of a credential row. `userId` absent = org-scoped row. */\nexport interface CredentialTenant {\n  orgId: string;\n  userId?: string;\n}\n\n/** Which tenancy level a credential row lives at. */\nexport type CredentialScope = 'user' | 'org';\n\n/** One stored credential, annotated with its scope. */\nexport interface CredentialRecord {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n  updatedAt: Date;\n}\n\n/** Result of per-caller resolution: the winning credential and its scope. */\nexport interface ResolvedCredential {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n}\n\n/** Kind of pending web login flow a session row tracks. */\nexport type LoginSessionKind = 'paste-code' | 'device-code';\n\n/** Scope the completed credential should be written to. */\nexport type LoginCredentialScope = 'user' | 'org';\n\n/** One pending OAuth login flow, persisted so any replica can continue it. */\nexport interface LoginSessionRow {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  /** Where the completed credential lands; absent rows default to `'user'`. */\n  credentialScope?: LoginCredentialScope;\n  /** Serialized flow state (PKCE verifier, device-code pending state, ...). */\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  /** Earliest time the next upstream poll is allowed (device-code flows). */\n  nextPollAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateLoginSessionInput {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  credentialScope?: LoginCredentialScope;\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  nextPollAt?: Date | null;\n}\n\n/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */\nexport function isOAuthCredentialExpired(credential: OAuthCredential, now = Date.now()): boolean {\n  return now >= credential.expires;\n}\n\nexport const MODEL_CREDENTIALS_SCHEMA: CollectionSchema = {\n  name: 'model_provider_credentials',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    user_id: { type: 'text', nullable: true },\n    provider: { type: 'text' },\n    type: { type: 'text' },\n    data: { type: 'json' },\n    created_at: { type: 'timestamp' },\n    updated_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared\n    // row), enforced by two partial unique indexes.\n    {\n      name: 'model_provider_credentials_user_unique',\n      columns: ['org_id', 'user_id', 'provider'],\n      whereNotNull: 'user_id',\n    },\n    { name: 'model_provider_credentials_org_unique', columns: ['org_id', 'provider'], whereNull: 'user_id' },\n  ],\n};\n\nexport const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema = {\n  name: 'oauth_login_sessions',\n  columns: {\n    session_id: { type: 'text', primaryKey: true },\n    org_id: { type: 'text' },\n    user_id: { type: 'text' },\n    provider: { type: 'text' },\n    kind: { type: 'text' },\n    credential_scope: { type: 'text', nullable: true },\n    pending: { type: 'json' },\n    expires_at: { type: 'timestamp' },\n    next_poll_at: { type: 'timestamp', nullable: true },\n    created_at: { type: 'timestamp' },\n  },\n};\n\n/** Column shape of one `model_provider_credentials` row as returned by ops. */\ninterface CredentialDbRow extends Record<string, unknown> {\n  id: string;\n  provider: string;\n  user_id: string | null;\n  data: unknown;\n  updated_at: Date;\n}\n\n/** Column shape of one `oauth_login_sessions` row as returned by ops. */\ninterface LoginSessionDbRow extends Record<string, unknown> {\n  session_id: string;\n  org_id: string;\n  user_id: string;\n  provider: string;\n  kind: LoginSessionKind;\n  credential_scope: LoginCredentialScope | null;\n  pending: Record<string, unknown>;\n  expires_at: Date;\n  next_poll_at: Date | null;\n  created_at: Date;\n}\n\nfunction toSessionRow(db: LoginSessionDbRow): LoginSessionRow {\n  return {\n    sessionId: db.session_id,\n    orgId: db.org_id,\n    userId: db.user_id,\n    provider: db.provider,\n    kind: db.kind,\n    ...(db.credential_scope ? { credentialScope: db.credential_scope } : {}),\n    pending: db.pending,\n    expiresAt: db.expires_at,\n    nextPollAt: db.next_poll_at,\n    createdAt: db.created_at,\n  };\n}\n\n/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */\nfunction tenantWhere(tenant: CredentialTenant, provider: string): CollectionWhere {\n  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };\n}\n\n/**\n * Model-credentials storage, written once against the generic\n * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`\n * ride `updateAtomic` so concurrent replicas serialize instead of\n * invalidating each other's rotating tokens / double-claiming a flow.\n */\nexport class ModelCredentialsStorage extends FactoryStorageDomain {\n  constructor(private readonly encryption: FactorySecretEncryption = createPlaintextFactorySecretEncryption()) {\n    super('model-credentials');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);\n    const rows = await this.ops.findMany<CredentialDbRow>('model_provider_credentials', {});\n    await Promise.all(rows.map(row => this.#migrateCredential(row.id)));\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('oauth_login_sessions', {});\n    await this.ops.deleteMany('model_provider_credentials', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  async #decryptCredential(value: unknown): Promise<AuthCredential> {\n    return (await this.encryption.decrypt<AuthCredential>(value)).value;\n  }\n\n  async #migrateCredential(id: string): Promise<void> {\n    await this.#db.updateAtomic<CredentialDbRow>('model_provider_credentials', { id }, async row => {\n      const decrypted = await this.encryption.decrypt<AuthCredential>(row.data);\n      if (!decrypted.needsReencryption) return null;\n      return { data: await this.encryption.encrypt(decrypted.value) };\n    });\n  }\n\n  /** Read the tenant's credential for a provider at exactly that scope. */\n  async getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined> {\n    const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', tenantWhere(tenant, provider));\n    return row ? this.#decryptCredential(row.data) : undefined;\n  }\n\n  /** Upsert the tenant's credential (`created_at` is preserved on update). */\n  async setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void> {\n    const where = tenantWhere(tenant, provider);\n    const encrypted = await this.encryption.encrypt(credential);\n    const update = async () =>\n      this.#db.updateMany('model_provider_credentials', where, {\n        type: credential.type,\n        data: encrypted,\n        updated_at: new Date(),\n      });\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 2; attempt++) {\n      if ((await update()) > 0) return;\n\n      const now = new Date();\n      try {\n        await this.#db.insertOne<CredentialDbRow>('model_provider_credentials', {\n          org_id: tenant.orgId,\n          user_id: tenant.userId ?? null,\n          provider,\n          type: credential.type,\n          data: encrypted,\n          created_at: now,\n          updated_at: now,\n        });\n        return;\n      } catch (error) {\n        if (!(error instanceof UniqueViolationError)) throw error;\n        lastError = error;\n      }\n    }\n    throw lastError;\n  }\n\n  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */\n  async removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('model_provider_credentials', tenantWhere(tenant, provider));\n    return deleted > 0;\n  }\n\n  /** All credentials visible to a user: their own rows plus the org's shared rows. */\n  async listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]> {\n    // SQL `IN` never matches NULL, so the org rows need their own query.\n    const [userRows, orgRows] = await Promise.all([\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: userId }),\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: null }),\n    ]);\n    return Promise.all([\n      ...userRows.map(async row => ({\n        provider: row.provider,\n        scope: 'user' as const,\n        credential: await this.#decryptCredential(row.data),\n        updatedAt: row.updated_at,\n      })),\n      ...orgRows.map(async row => ({\n        provider: row.provider,\n        scope: 'org' as const,\n        credential: await this.#decryptCredential(row.data),\n        updatedAt: row.updated_at,\n      })),\n    ]);\n  }\n\n  /**\n   * Resolve the credential a caller should use for a provider. By default the\n   * user's own row wins over the org's shared row; `precedence: 'org'`\n   * (automated factory runs) checks the org's shared row first.\n   */\n  async resolveCredential(\n    orgId: string,\n    userId: string,\n    provider: string,\n    precedence: CredentialScope = 'user',\n  ): Promise<ResolvedCredential | undefined> {\n    const readUser = async (): Promise<ResolvedCredential | undefined> => {\n      const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n        org_id: orgId,\n        provider,\n        user_id: userId,\n      });\n      return row\n        ? { provider: row.provider, scope: 'user', credential: await this.#decryptCredential(row.data) }\n        : undefined;\n    };\n    const readOrg = async (): Promise<ResolvedCredential | undefined> => {\n      const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n        org_id: orgId,\n        provider,\n        user_id: null,\n      });\n      return row\n        ? { provider: row.provider, scope: 'org', credential: await this.#decryptCredential(row.data) }\n        : undefined;\n    };\n    return precedence === 'org' ? ((await readOrg()) ?? (await readUser())) : ((await readUser()) ?? (await readOrg()));\n  }\n\n  /**\n   * Refresh the tenant's OAuth credential under the backend's atomic\n   * read-modify-write so concurrent replicas don't invalidate each other's\n   * rotating refresh tokens. The expiry is re-checked under the lock —\n   * another replica may have refreshed already, in which case `refreshFn` is\n   * skipped and the fresh credential is returned. Returns `undefined` when no\n   * OAuth row exists for the tenant.\n   */\n  async refreshOAuth(\n    tenant: CredentialTenant,\n    provider: string,\n    refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>,\n  ): Promise<OAuthCredential | undefined> {\n    let result: OAuthCredential | undefined;\n    await this.#db.updateAtomic<CredentialDbRow>(\n      'model_provider_credentials',\n      tenantWhere(tenant, provider),\n      async row => {\n        const decrypted = await this.encryption.decrypt<AuthCredential>(row.data);\n        if (decrypted.value.type !== 'oauth') return null;\n        const current = decrypted.value;\n        // Re-check under the lock: another replica may have refreshed while we waited.\n        if (!isOAuthCredentialExpired(current)) {\n          result = current;\n          return decrypted.needsReencryption ? { data: await this.encryption.encrypt(current) } : null;\n        }\n        const next = await refreshFn(current);\n        result = next;\n        return { data: await this.encryption.encrypt(next), updated_at: new Date() };\n      },\n    );\n    return result;\n  }\n\n  /** Persist a pending login flow started by a web route. */\n  async createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow> {\n    const inserted = await this.#db.insertOne<LoginSessionDbRow>('oauth_login_sessions', {\n      session_id: input.sessionId,\n      org_id: input.orgId,\n      user_id: input.userId,\n      provider: input.provider,\n      kind: input.kind,\n      credential_scope: input.credentialScope ?? null,\n      pending: input.pending,\n      expires_at: input.expiresAt,\n      next_poll_at: input.nextPollAt ?? null,\n      created_at: new Date(),\n    });\n    return toSessionRow(inserted);\n  }\n\n  /**\n   * Read a pending login flow. An expired session is deleted on read (TTL\n   * cleanup) and reported as absent.\n   */\n  async getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined> {\n    const row = await this.#db.findOne<LoginSessionDbRow>('oauth_login_sessions', { session_id: sessionId });\n    if (!row) return undefined;\n    if (row.expires_at.getTime() <= Date.now()) {\n      await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n      return undefined;\n    }\n    return toSessionRow(row);\n  }\n\n  /**\n   * Atomically claim a due login session for one upstream completion/poll attempt.\n   * Returns undefined when the session is missing, expired, owned by another\n   * tenant/provider, or already claimed by a concurrent request.\n   */\n  async claimLoginSession(\n    sessionId: string,\n    owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>,\n  ): Promise<LoginSessionRow | undefined> {\n    const now = Date.now();\n    let claimed = false;\n    const updated = await this.#db.updateAtomic<LoginSessionDbRow>(\n      'oauth_login_sessions',\n      { session_id: sessionId },\n      row => {\n        if (\n          row.org_id !== owner.orgId ||\n          row.user_id !== owner.userId ||\n          row.provider !== owner.provider ||\n          row.kind !== owner.kind\n        ) {\n          return null;\n        }\n        if (row.expires_at.getTime() <= now) return null;\n        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;\n        claimed = true;\n        // Park the next poll at expiry so a concurrent claim loses until the\n        // claimer either touches the session forward or deletes it.\n        return { next_poll_at: row.expires_at };\n      },\n    );\n    return claimed && updated ? toSessionRow(updated) : undefined;\n  }\n\n  /** Update a pending flow's serialized state and/or next allowed poll time. */\n  async touchLoginSession(\n    sessionId: string,\n    updates: { pending?: Record<string, unknown>; nextPollAt?: Date | null },\n  ): Promise<void> {\n    const set: Record<string, unknown> = {};\n    if (updates.pending !== undefined) set.pending = updates.pending;\n    if (updates.nextPollAt !== undefined) set.next_poll_at = updates.nextPollAt;\n    if (Object.keys(set).length === 0) return;\n    await this.#db.updateMany('oauth_login_sessions', { session_id: sessionId }, set);\n  }\n\n  /** Remove a pending login flow (completed, cancelled, or failed). */\n  async deleteLoginSession(sessionId: string): Promise<void> {\n    await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n  }\n}\n"],"mappings":";;;;AA2FA,SAAgB,yBAAyB,YAA6B,MAAM,KAAK,IAAI,GAAY;CAC/F,OAAO,OAAO,WAAW;AAC3B;AAEA,MAAa,2BAA6C;CACxD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS;GAAE,MAAM;GAAQ,UAAU;EAAK;EACxC,UAAU,EAAE,MAAM,OAAO;EACzB,MAAM,EAAE,MAAM,OAAO;EACrB,MAAM,EAAE,MAAM,OAAO;EACrB,YAAY,EAAE,MAAM,YAAY;EAChC,YAAY,EAAE,MAAM,YAAY;CAClC;CACA,eAAe,CAGb;EACE,MAAM;EACN,SAAS;GAAC;GAAU;GAAW;EAAU;EACzC,cAAc;CAChB,GACA;EAAE,MAAM;EAAyC,SAAS,CAAC,UAAU,UAAU;EAAG,WAAW;CAAU,CACzG;AACF;AAEA,MAAa,8BAAgD;CAC3D,MAAM;CACN,SAAS;EACP,YAAY;GAAE,MAAM;GAAQ,YAAY;EAAK;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,MAAM,EAAE,MAAM,OAAO;EACrB,kBAAkB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACjD,SAAS,EAAE,MAAM,OAAO;EACxB,YAAY,EAAE,MAAM,YAAY;EAChC,cAAc;GAAE,MAAM;GAAa,UAAU;EAAK;EAClD,YAAY,EAAE,MAAM,YAAY;CAClC;AACF;AAyBA,SAAS,aAAa,IAAwC;CAC5D,OAAO;EACL,WAAW,GAAG;EACd,OAAO,GAAG;EACV,QAAQ,GAAG;EACX,UAAU,GAAG;EACb,MAAM,GAAG;EACT,GAAI,GAAG,mBAAmB,EAAE,iBAAiB,GAAG,iBAAiB,IAAI,CAAC;EACtE,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,YAAY,GAAG;EACf,WAAW,GAAG;CAChB;AACF;;AAGA,SAAS,YAAY,QAA0B,UAAmC;CAChF,OAAO;EAAE,QAAQ,OAAO;EAAO;EAAU,SAAS,OAAO,UAAU;CAAK;AAC1E;;;;;;;AAQA,IAAa,0BAAb,cAA6C,qBAAqB;CACnC;CAA7B,YAAY,aAAuD,uCAAuC,GAAG;EAC3G,MAAM,mBAAmB;EADE,KAAA,aAAA;CAE7B;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,0BAA0B,2BAA2B,CAAC;EACpF,MAAM,OAAO,MAAM,KAAK,IAAI,SAA0B,8BAA8B,CAAC,CAAC;EACtF,MAAM,QAAQ,IAAI,KAAK,KAAI,QAAO,KAAKA,mBAAmB,IAAI,EAAE,CAAC,CAAC;CACpE;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,wBAAwB,CAAC,CAAC;EACpD,MAAM,KAAK,IAAI,WAAW,8BAA8B,CAAC,CAAC;CAC5D;CAEA,IAAIC,MAAyB;EAC3B,OAAO,KAAK;CACd;CAEA,MAAMC,mBAAmB,OAAyC;EAChE,QAAQ,MAAM,KAAK,WAAW,QAAwB,KAAK,EAAA,CAAG;CAChE;CAEA,MAAMF,mBAAmB,IAA2B;EAClD,MAAM,KAAKC,IAAI,aAA8B,8BAA8B,EAAE,GAAG,GAAG,OAAM,QAAO;GAC9F,MAAM,YAAY,MAAM,KAAK,WAAW,QAAwB,IAAI,IAAI;GACxE,IAAI,CAAC,UAAU,mBAAmB,OAAO;GACzC,OAAO,EAAE,MAAM,MAAM,KAAK,WAAW,QAAQ,UAAU,KAAK,EAAE;EAChE,CAAC;CACH;;CAGA,MAAM,cAAc,QAA0B,UAAuD;EACnG,MAAM,MAAM,MAAM,KAAKA,IAAI,QAAyB,8BAA8B,YAAY,QAAQ,QAAQ,CAAC;EAC/G,OAAO,MAAM,KAAKC,mBAAmB,IAAI,IAAI,IAAI,KAAA;CACnD;;CAGA,MAAM,cAAc,QAA0B,UAAkB,YAA2C;EACzG,MAAM,QAAQ,YAAY,QAAQ,QAAQ;EAC1C,MAAM,YAAY,MAAM,KAAK,WAAW,QAAQ,UAAU;EAC1D,MAAM,SAAS,YACb,KAAKD,IAAI,WAAW,8BAA8B,OAAO;GACvD,MAAM,WAAW;GACjB,MAAM;GACN,4BAAY,IAAI,KAAK;EACvB,CAAC;EAEH,IAAI;EACJ,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;GAC5C,IAAK,MAAM,OAAO,IAAK,GAAG;GAE1B,MAAM,sBAAM,IAAI,KAAK;GACrB,IAAI;IACF,MAAM,KAAKA,IAAI,UAA2B,8BAA8B;KACtE,QAAQ,OAAO;KACf,SAAS,OAAO,UAAU;KAC1B;KACA,MAAM,WAAW;KACjB,MAAM;KACN,YAAY;KACZ,YAAY;IACd,CAAC;IACD;GACF,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;IACpD,YAAY;GACd;EACF;EACA,MAAM;CACR;;CAGA,MAAM,iBAAiB,QAA0B,UAAoC;EAEnF,OAAO,MADe,KAAKA,IAAI,WAAW,8BAA8B,YAAY,QAAQ,QAAQ,CAAC,IACpF;CACnB;;CAGA,MAAM,gBAAgB,OAAe,QAA6C;EAEhF,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,KAAKA,IAAI,SAA0B,8BAA8B;GAAE,QAAQ;GAAO,SAAS;EAAO,CAAC,GACnG,KAAKA,IAAI,SAA0B,8BAA8B;GAAE,QAAQ;GAAO,SAAS;EAAK,CAAC,CACnG,CAAC;EACD,OAAO,QAAQ,IAAI,CACjB,GAAG,SAAS,IAAI,OAAM,SAAQ;GAC5B,UAAU,IAAI;GACd,OAAO;GACP,YAAY,MAAM,KAAKC,mBAAmB,IAAI,IAAI;GAClD,WAAW,IAAI;EACjB,EAAE,GACF,GAAG,QAAQ,IAAI,OAAM,SAAQ;GAC3B,UAAU,IAAI;GACd,OAAO;GACP,YAAY,MAAM,KAAKA,mBAAmB,IAAI,IAAI;GAClD,WAAW,IAAI;EACjB,EAAE,CACJ,CAAC;CACH;;;;;;CAOA,MAAM,kBACJ,OACA,QACA,UACA,aAA8B,QACW;EACzC,MAAM,WAAW,YAAqD;GACpE,MAAM,MAAM,MAAM,KAAKD,IAAI,QAAyB,8BAA8B;IAChF,QAAQ;IACR;IACA,SAAS;GACX,CAAC;GACD,OAAO,MACH;IAAE,UAAU,IAAI;IAAU,OAAO;IAAQ,YAAY,MAAM,KAAKC,mBAAmB,IAAI,IAAI;GAAE,IAC7F,KAAA;EACN;EACA,MAAM,UAAU,YAAqD;GACnE,MAAM,MAAM,MAAM,KAAKD,IAAI,QAAyB,8BAA8B;IAChF,QAAQ;IACR;IACA,SAAS;GACX,CAAC;GACD,OAAO,MACH;IAAE,UAAU,IAAI;IAAU,OAAO;IAAO,YAAY,MAAM,KAAKC,mBAAmB,IAAI,IAAI;GAAE,IAC5F,KAAA;EACN;EACA,OAAO,eAAe,QAAU,MAAM,QAAQ,KAAO,MAAM,SAAS,IAAQ,MAAM,SAAS,KAAO,MAAM,QAAQ;CAClH;;;;;;;;;CAUA,MAAM,aACJ,QACA,UACA,WACsC;EACtC,IAAI;EACJ,MAAM,KAAKD,IAAI,aACb,8BACA,YAAY,QAAQ,QAAQ,GAC5B,OAAM,QAAO;GACX,MAAM,YAAY,MAAM,KAAK,WAAW,QAAwB,IAAI,IAAI;GACxE,IAAI,UAAU,MAAM,SAAS,SAAS,OAAO;GAC7C,MAAM,UAAU,UAAU;GAE1B,IAAI,CAAC,yBAAyB,OAAO,GAAG;IACtC,SAAS;IACT,OAAO,UAAU,oBAAoB,EAAE,MAAM,MAAM,KAAK,WAAW,QAAQ,OAAO,EAAE,IAAI;GAC1F;GACA,MAAM,OAAO,MAAM,UAAU,OAAO;GACpC,SAAS;GACT,OAAO;IAAE,MAAM,MAAM,KAAK,WAAW,QAAQ,IAAI;IAAG,4BAAY,IAAI,KAAK;GAAE;EAC7E,CACF;EACA,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAA0D;EAajF,OAAO,aAAa,MAZG,KAAKA,IAAI,UAA6B,wBAAwB;GACnF,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,kBAAkB,MAAM,mBAAmB;GAC3C,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,cAAc,MAAM,cAAc;GAClC,4BAAY,IAAI,KAAK;EACvB,CAAC,CAC2B;CAC9B;;;;;CAMA,MAAM,gBAAgB,WAAyD;EAC7E,MAAM,MAAM,MAAM,KAAKA,IAAI,QAA2B,wBAAwB,EAAE,YAAY,UAAU,CAAC;EACvG,IAAI,CAAC,KAAK,OAAO,KAAA;EACjB,IAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,IAAI,GAAG;GAC1C,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;GAC3E;EACF;EACA,OAAO,aAAa,GAAG;CACzB;;;;;;CAOA,MAAM,kBACJ,WACA,OACsC;EACtC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,UAAU;EACd,MAAM,UAAU,MAAM,KAAKA,IAAI,aAC7B,wBACA,EAAE,YAAY,UAAU,IACxB,QAAO;GACL,IACE,IAAI,WAAW,MAAM,SACrB,IAAI,YAAY,MAAM,UACtB,IAAI,aAAa,MAAM,YACvB,IAAI,SAAS,MAAM,MAEnB,OAAO;GAET,IAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,OAAO;GAC5C,IAAI,IAAI,gBAAgB,IAAI,aAAa,QAAQ,IAAI,KAAK,OAAO;GACjE,UAAU;GAGV,OAAO,EAAE,cAAc,IAAI,WAAW;EACxC,CACF;EACA,OAAO,WAAW,UAAU,aAAa,OAAO,IAAI,KAAA;CACtD;;CAGA,MAAM,kBACJ,WACA,SACe;EACf,MAAM,MAA+B,CAAC;EACtC,IAAI,QAAQ,YAAY,KAAA,GAAW,IAAI,UAAU,QAAQ;EACzD,IAAI,QAAQ,eAAe,KAAA,GAAW,IAAI,eAAe,QAAQ;EACjE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG;EACnC,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,GAAG,GAAG;CAClF;;CAGA,MAAM,mBAAmB,WAAkC;EACzD,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;CAC7E;AACF"}
+{"version":3,"file":"base.js","names":["#migrateCredential","#db","#decryptCredential"],"sources":["../../../../src/storage/domains/credentials/base.ts"],"sourcesContent":["/**\n * Model provider credentials domain — tenant-scoped OAuth tokens and API keys\n * for model providers (Anthropic/Claude Max, OpenAI Codex, GitHub Copilot,\n * xAI, plus plain API-key providers).\n *\n * Tenancy is two-level:\n * - **user-scoped** rows (`userId` present): personal plan OAuth tokens and\n *   personal API keys. OAuth plan tokens are ONLY ever user-scoped — they are\n *   personal subscriptions, and sharing one would bill/rate-limit a single\n *   account for the whole org.\n * - **org-scoped** rows (`userId` absent): shared API keys set by an org\n *   admin, inherited by every member.\n *\n * Model calls resolve exactly one scope: user or org. Deployed tenant stores\n * never fall back to the other scope or implicitly borrow server environment keys.\n *\n * Secrets posture: credentials are stored server-side only and never returned\n * to the client (same as `linear_connections.access_token`). Encryption at\n * rest is out of scope, matching the existing posture.\n *\n * The domain also owns `oauth_login_sessions`: pending web login flows\n * (paste-code PKCE verifiers, device-code poll state) persisted server-side so\n * any replica can complete or poll a flow started on another.\n */\n\nimport type { AuthCredential, OAuthCredential } from '@mastra/code-sdk/auth/types';\nimport { FactoryStorageDomain, UniqueViolationError } from '@mastra/core/storage';\nimport type { CollectionSchema, CollectionWhere, FactoryStorageOps } from '@mastra/core/storage';\nimport { createPlaintextFactorySecretEncryption } from '../../../secret-encryption.js';\nimport type { FactorySecretEncryption } from '../../../secret-encryption.js';\n\n/** Owning tenant of a credential row. `userId` absent = org-scoped row. */\nexport interface CredentialTenant {\n  orgId: string;\n  userId?: string;\n}\n\n/** Which tenancy level a credential row lives at. */\nexport type CredentialScope = 'user' | 'org';\n\n/** One stored credential, annotated with its scope. */\nexport interface CredentialRecord {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n  updatedAt: Date;\n}\n\n/** Result of per-caller resolution: the winning credential and its scope. */\nexport interface ResolvedCredential {\n  provider: string;\n  scope: CredentialScope;\n  credential: AuthCredential;\n}\n\n/** Kind of pending web login flow a session row tracks. */\nexport type LoginSessionKind = 'paste-code' | 'device-code';\n\n/** Scope the completed credential should be written to. */\nexport type LoginCredentialScope = 'user' | 'org';\n\n/** One pending OAuth login flow, persisted so any replica can continue it. */\nexport interface LoginSessionRow {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  /** Where the completed credential lands; absent rows default to `'user'`. */\n  credentialScope?: LoginCredentialScope;\n  /** Serialized flow state (PKCE verifier, device-code pending state, ...). */\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  /** Earliest time the next upstream poll is allowed (device-code flows). */\n  nextPollAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateLoginSessionInput {\n  sessionId: string;\n  orgId: string;\n  userId: string;\n  provider: string;\n  kind: LoginSessionKind;\n  credentialScope?: LoginCredentialScope;\n  pending: Record<string, unknown>;\n  expiresAt: Date;\n  nextPollAt?: Date | null;\n}\n\n/** Mirror of `AuthStorage.getApiKey()`'s expiry check. */\nexport function isOAuthCredentialExpired(credential: OAuthCredential, now = Date.now()): boolean {\n  return now >= credential.expires;\n}\n\nexport const MODEL_CREDENTIALS_SCHEMA: CollectionSchema = {\n  name: 'model_provider_credentials',\n  columns: {\n    id: { type: 'uuid-pk' },\n    org_id: { type: 'text' },\n    user_id: { type: 'text', nullable: true },\n    provider: { type: 'text' },\n    type: { type: 'text' },\n    data: { type: 'json' },\n    created_at: { type: 'timestamp' },\n    updated_at: { type: 'timestamp' },\n  },\n  uniqueIndexes: [\n    // Scope is encoded in `user_id` nullability (NULL = org-scoped shared\n    // row), enforced by two partial unique indexes.\n    {\n      name: 'model_provider_credentials_user_unique',\n      columns: ['org_id', 'user_id', 'provider'],\n      whereNotNull: 'user_id',\n    },\n    { name: 'model_provider_credentials_org_unique', columns: ['org_id', 'provider'], whereNull: 'user_id' },\n  ],\n};\n\nexport const OAUTH_LOGIN_SESSIONS_SCHEMA: CollectionSchema = {\n  name: 'oauth_login_sessions',\n  columns: {\n    session_id: { type: 'text', primaryKey: true },\n    org_id: { type: 'text' },\n    user_id: { type: 'text' },\n    provider: { type: 'text' },\n    kind: { type: 'text' },\n    credential_scope: { type: 'text', nullable: true },\n    pending: { type: 'json' },\n    expires_at: { type: 'timestamp' },\n    next_poll_at: { type: 'timestamp', nullable: true },\n    created_at: { type: 'timestamp' },\n  },\n};\n\n/** Column shape of one `model_provider_credentials` row as returned by ops. */\ninterface CredentialDbRow extends Record<string, unknown> {\n  id: string;\n  provider: string;\n  user_id: string | null;\n  data: unknown;\n  updated_at: Date;\n}\n\n/** Column shape of one `oauth_login_sessions` row as returned by ops. */\ninterface LoginSessionDbRow extends Record<string, unknown> {\n  session_id: string;\n  org_id: string;\n  user_id: string;\n  provider: string;\n  kind: LoginSessionKind;\n  credential_scope: LoginCredentialScope | null;\n  pending: Record<string, unknown>;\n  expires_at: Date;\n  next_poll_at: Date | null;\n  created_at: Date;\n}\n\nfunction toSessionRow(db: LoginSessionDbRow): LoginSessionRow {\n  return {\n    sessionId: db.session_id,\n    orgId: db.org_id,\n    userId: db.user_id,\n    provider: db.provider,\n    kind: db.kind,\n    ...(db.credential_scope ? { credentialScope: db.credential_scope } : {}),\n    pending: db.pending,\n    expiresAt: db.expires_at,\n    nextPollAt: db.next_poll_at,\n    createdAt: db.created_at,\n  };\n}\n\n/** Filter selecting exactly the tenant's row for a provider (`null` = org row). */\nfunction tenantWhere(tenant: CredentialTenant, provider: string): CollectionWhere {\n  return { org_id: tenant.orgId, provider, user_id: tenant.userId ?? null };\n}\n\n/**\n * Model-credentials storage, written once against the generic\n * `FactoryStorageOps` surface. `refreshOAuth()` and `claimLoginSession()`\n * ride `updateAtomic` so concurrent replicas serialize instead of\n * invalidating each other's rotating tokens / double-claiming a flow.\n */\nexport class ModelCredentialsStorage extends FactoryStorageDomain {\n  constructor(private readonly encryption: FactorySecretEncryption = createPlaintextFactorySecretEncryption()) {\n    super('model-credentials');\n  }\n\n  async init(): Promise<void> {\n    await this.ensureCollections([MODEL_CREDENTIALS_SCHEMA, OAUTH_LOGIN_SESSIONS_SCHEMA]);\n    const rows = await this.ops.findMany<CredentialDbRow>('model_provider_credentials', {});\n    await Promise.all(rows.map(row => this.#migrateCredential(row.id)));\n  }\n\n  async dangerouslyClearAll(): Promise<void> {\n    await this.ops.deleteMany('oauth_login_sessions', {});\n    await this.ops.deleteMany('model_provider_credentials', {});\n  }\n\n  get #db(): FactoryStorageOps {\n    return this.ops;\n  }\n\n  async #decryptCredential(value: unknown): Promise<AuthCredential> {\n    return (await this.encryption.decrypt<AuthCredential>(value)).value;\n  }\n\n  async #migrateCredential(id: string): Promise<void> {\n    await this.#db.updateAtomic<CredentialDbRow>('model_provider_credentials', { id }, async row => {\n      const decrypted = await this.encryption.decrypt<AuthCredential>(row.data);\n      if (!decrypted.needsReencryption) return null;\n      return { data: await this.encryption.encrypt(decrypted.value) };\n    });\n  }\n\n  /** Read the tenant's credential for a provider at exactly that scope. */\n  async getCredential(tenant: CredentialTenant, provider: string): Promise<AuthCredential | undefined> {\n    const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', tenantWhere(tenant, provider));\n    return row ? this.#decryptCredential(row.data) : undefined;\n  }\n\n  /** Upsert the tenant's credential (`created_at` is preserved on update). */\n  async setCredential(tenant: CredentialTenant, provider: string, credential: AuthCredential): Promise<void> {\n    const where = tenantWhere(tenant, provider);\n    const encrypted = await this.encryption.encrypt(credential);\n    const update = async () =>\n      this.#db.updateMany('model_provider_credentials', where, {\n        type: credential.type,\n        data: encrypted,\n        updated_at: new Date(),\n      });\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < 2; attempt++) {\n      if ((await update()) > 0) return;\n\n      const now = new Date();\n      try {\n        await this.#db.insertOne<CredentialDbRow>('model_provider_credentials', {\n          org_id: tenant.orgId,\n          user_id: tenant.userId ?? null,\n          provider,\n          type: credential.type,\n          data: encrypted,\n          created_at: now,\n          updated_at: now,\n        });\n        return;\n      } catch (error) {\n        if (!(error instanceof UniqueViolationError)) throw error;\n        lastError = error;\n      }\n    }\n    throw lastError;\n  }\n\n  /** Delete the tenant's credential at exactly that scope. True when a row was removed. */\n  async removeCredential(tenant: CredentialTenant, provider: string): Promise<boolean> {\n    const deleted = await this.#db.deleteMany('model_provider_credentials', tenantWhere(tenant, provider));\n    return deleted > 0;\n  }\n\n  /** All credentials visible to a user: their own rows plus the org's shared rows. */\n  async listCredentials(orgId: string, userId: string): Promise<CredentialRecord[]> {\n    // SQL `IN` never matches NULL, so the org rows need their own query.\n    const [userRows, orgRows] = await Promise.all([\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: userId }),\n      this.#db.findMany<CredentialDbRow>('model_provider_credentials', { org_id: orgId, user_id: null }),\n    ]);\n    return Promise.all([\n      ...userRows.map(async row => ({\n        provider: row.provider,\n        scope: 'user' as const,\n        credential: await this.#decryptCredential(row.data),\n        updatedAt: row.updated_at,\n      })),\n      ...orgRows.map(async row => ({\n        provider: row.provider,\n        scope: 'org' as const,\n        credential: await this.#decryptCredential(row.data),\n        updatedAt: row.updated_at,\n      })),\n    ]);\n  }\n\n  /** Resolve a provider credential from exactly one tenancy scope. */\n  async resolveCredential(\n    orgId: string,\n    userId: string,\n    provider: string,\n    scope: CredentialScope,\n  ): Promise<ResolvedCredential | undefined> {\n    const readUser = async (): Promise<ResolvedCredential | undefined> => {\n      const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n        org_id: orgId,\n        provider,\n        user_id: userId,\n      });\n      return row\n        ? { provider: row.provider, scope: 'user', credential: await this.#decryptCredential(row.data) }\n        : undefined;\n    };\n    const readOrg = async (): Promise<ResolvedCredential | undefined> => {\n      const row = await this.#db.findOne<CredentialDbRow>('model_provider_credentials', {\n        org_id: orgId,\n        provider,\n        user_id: null,\n      });\n      return row\n        ? { provider: row.provider, scope: 'org', credential: await this.#decryptCredential(row.data) }\n        : undefined;\n    };\n    return scope === 'org' ? readOrg() : readUser();\n  }\n\n  /**\n   * Refresh the tenant's OAuth credential under the backend's atomic\n   * read-modify-write so concurrent replicas don't invalidate each other's\n   * rotating refresh tokens. The expiry is re-checked under the lock —\n   * another replica may have refreshed already, in which case `refreshFn` is\n   * skipped and the fresh credential is returned. Returns `undefined` when no\n   * OAuth row exists for the tenant.\n   */\n  async refreshOAuth(\n    tenant: CredentialTenant,\n    provider: string,\n    refreshFn: (current: OAuthCredential) => Promise<OAuthCredential>,\n  ): Promise<OAuthCredential | undefined> {\n    let result: OAuthCredential | undefined;\n    await this.#db.updateAtomic<CredentialDbRow>(\n      'model_provider_credentials',\n      tenantWhere(tenant, provider),\n      async row => {\n        const decrypted = await this.encryption.decrypt<AuthCredential>(row.data);\n        if (decrypted.value.type !== 'oauth') return null;\n        const current = decrypted.value;\n        // Re-check under the lock: another replica may have refreshed while we waited.\n        if (!isOAuthCredentialExpired(current)) {\n          result = current;\n          return decrypted.needsReencryption ? { data: await this.encryption.encrypt(current) } : null;\n        }\n        const next = await refreshFn(current);\n        result = next;\n        return { data: await this.encryption.encrypt(next), updated_at: new Date() };\n      },\n    );\n    return result;\n  }\n\n  /** Persist a pending login flow started by a web route. */\n  async createLoginSession(input: CreateLoginSessionInput): Promise<LoginSessionRow> {\n    const inserted = await this.#db.insertOne<LoginSessionDbRow>('oauth_login_sessions', {\n      session_id: input.sessionId,\n      org_id: input.orgId,\n      user_id: input.userId,\n      provider: input.provider,\n      kind: input.kind,\n      credential_scope: input.credentialScope ?? null,\n      pending: input.pending,\n      expires_at: input.expiresAt,\n      next_poll_at: input.nextPollAt ?? null,\n      created_at: new Date(),\n    });\n    return toSessionRow(inserted);\n  }\n\n  /**\n   * Read a pending login flow. An expired session is deleted on read (TTL\n   * cleanup) and reported as absent.\n   */\n  async getLoginSession(sessionId: string): Promise<LoginSessionRow | undefined> {\n    const row = await this.#db.findOne<LoginSessionDbRow>('oauth_login_sessions', { session_id: sessionId });\n    if (!row) return undefined;\n    if (row.expires_at.getTime() <= Date.now()) {\n      await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n      return undefined;\n    }\n    return toSessionRow(row);\n  }\n\n  /**\n   * Atomically claim a due login session for one upstream completion/poll attempt.\n   * Returns undefined when the session is missing, expired, owned by another\n   * tenant/provider, or already claimed by a concurrent request.\n   */\n  async claimLoginSession(\n    sessionId: string,\n    owner: Pick<LoginSessionRow, 'orgId' | 'userId' | 'provider' | 'kind'>,\n  ): Promise<LoginSessionRow | undefined> {\n    const now = Date.now();\n    let claimed = false;\n    const updated = await this.#db.updateAtomic<LoginSessionDbRow>(\n      'oauth_login_sessions',\n      { session_id: sessionId },\n      row => {\n        if (\n          row.org_id !== owner.orgId ||\n          row.user_id !== owner.userId ||\n          row.provider !== owner.provider ||\n          row.kind !== owner.kind\n        ) {\n          return null;\n        }\n        if (row.expires_at.getTime() <= now) return null;\n        if (row.next_poll_at && row.next_poll_at.getTime() > now) return null;\n        claimed = true;\n        // Park the next poll at expiry so a concurrent claim loses until the\n        // claimer either touches the session forward or deletes it.\n        return { next_poll_at: row.expires_at };\n      },\n    );\n    return claimed && updated ? toSessionRow(updated) : undefined;\n  }\n\n  /** Update a pending flow's serialized state and/or next allowed poll time. */\n  async touchLoginSession(\n    sessionId: string,\n    updates: { pending?: Record<string, unknown>; nextPollAt?: Date | null },\n  ): Promise<void> {\n    const set: Record<string, unknown> = {};\n    if (updates.pending !== undefined) set.pending = updates.pending;\n    if (updates.nextPollAt !== undefined) set.next_poll_at = updates.nextPollAt;\n    if (Object.keys(set).length === 0) return;\n    await this.#db.updateMany('oauth_login_sessions', { session_id: sessionId }, set);\n  }\n\n  /** Remove a pending login flow (completed, cancelled, or failed). */\n  async deleteLoginSession(sessionId: string): Promise<void> {\n    await this.#db.deleteMany('oauth_login_sessions', { session_id: sessionId });\n  }\n}\n"],"mappings":";;;;AA2FA,SAAgB,yBAAyB,YAA6B,MAAM,KAAK,IAAI,GAAY;CAC/F,OAAO,OAAO,WAAW;AAC3B;AAEA,MAAa,2BAA6C;CACxD,MAAM;CACN,SAAS;EACP,IAAI,EAAE,MAAM,UAAU;EACtB,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS;GAAE,MAAM;GAAQ,UAAU;EAAK;EACxC,UAAU,EAAE,MAAM,OAAO;EACzB,MAAM,EAAE,MAAM,OAAO;EACrB,MAAM,EAAE,MAAM,OAAO;EACrB,YAAY,EAAE,MAAM,YAAY;EAChC,YAAY,EAAE,MAAM,YAAY;CAClC;CACA,eAAe,CAGb;EACE,MAAM;EACN,SAAS;GAAC;GAAU;GAAW;EAAU;EACzC,cAAc;CAChB,GACA;EAAE,MAAM;EAAyC,SAAS,CAAC,UAAU,UAAU;EAAG,WAAW;CAAU,CACzG;AACF;AAEA,MAAa,8BAAgD;CAC3D,MAAM;CACN,SAAS;EACP,YAAY;GAAE,MAAM;GAAQ,YAAY;EAAK;EAC7C,QAAQ,EAAE,MAAM,OAAO;EACvB,SAAS,EAAE,MAAM,OAAO;EACxB,UAAU,EAAE,MAAM,OAAO;EACzB,MAAM,EAAE,MAAM,OAAO;EACrB,kBAAkB;GAAE,MAAM;GAAQ,UAAU;EAAK;EACjD,SAAS,EAAE,MAAM,OAAO;EACxB,YAAY,EAAE,MAAM,YAAY;EAChC,cAAc;GAAE,MAAM;GAAa,UAAU;EAAK;EAClD,YAAY,EAAE,MAAM,YAAY;CAClC;AACF;AAyBA,SAAS,aAAa,IAAwC;CAC5D,OAAO;EACL,WAAW,GAAG;EACd,OAAO,GAAG;EACV,QAAQ,GAAG;EACX,UAAU,GAAG;EACb,MAAM,GAAG;EACT,GAAI,GAAG,mBAAmB,EAAE,iBAAiB,GAAG,iBAAiB,IAAI,CAAC;EACtE,SAAS,GAAG;EACZ,WAAW,GAAG;EACd,YAAY,GAAG;EACf,WAAW,GAAG;CAChB;AACF;;AAGA,SAAS,YAAY,QAA0B,UAAmC;CAChF,OAAO;EAAE,QAAQ,OAAO;EAAO;EAAU,SAAS,OAAO,UAAU;CAAK;AAC1E;;;;;;;AAQA,IAAa,0BAAb,cAA6C,qBAAqB;CACnC;CAA7B,YAAY,aAAuD,uCAAuC,GAAG;EAC3G,MAAM,mBAAmB;EADE,KAAA,aAAA;CAE7B;CAEA,MAAM,OAAsB;EAC1B,MAAM,KAAK,kBAAkB,CAAC,0BAA0B,2BAA2B,CAAC;EACpF,MAAM,OAAO,MAAM,KAAK,IAAI,SAA0B,8BAA8B,CAAC,CAAC;EACtF,MAAM,QAAQ,IAAI,KAAK,KAAI,QAAO,KAAKA,mBAAmB,IAAI,EAAE,CAAC,CAAC;CACpE;CAEA,MAAM,sBAAqC;EACzC,MAAM,KAAK,IAAI,WAAW,wBAAwB,CAAC,CAAC;EACpD,MAAM,KAAK,IAAI,WAAW,8BAA8B,CAAC,CAAC;CAC5D;CAEA,IAAIC,MAAyB;EAC3B,OAAO,KAAK;CACd;CAEA,MAAMC,mBAAmB,OAAyC;EAChE,QAAQ,MAAM,KAAK,WAAW,QAAwB,KAAK,EAAA,CAAG;CAChE;CAEA,MAAMF,mBAAmB,IAA2B;EAClD,MAAM,KAAKC,IAAI,aAA8B,8BAA8B,EAAE,GAAG,GAAG,OAAM,QAAO;GAC9F,MAAM,YAAY,MAAM,KAAK,WAAW,QAAwB,IAAI,IAAI;GACxE,IAAI,CAAC,UAAU,mBAAmB,OAAO;GACzC,OAAO,EAAE,MAAM,MAAM,KAAK,WAAW,QAAQ,UAAU,KAAK,EAAE;EAChE,CAAC;CACH;;CAGA,MAAM,cAAc,QAA0B,UAAuD;EACnG,MAAM,MAAM,MAAM,KAAKA,IAAI,QAAyB,8BAA8B,YAAY,QAAQ,QAAQ,CAAC;EAC/G,OAAO,MAAM,KAAKC,mBAAmB,IAAI,IAAI,IAAI,KAAA;CACnD;;CAGA,MAAM,cAAc,QAA0B,UAAkB,YAA2C;EACzG,MAAM,QAAQ,YAAY,QAAQ,QAAQ;EAC1C,MAAM,YAAY,MAAM,KAAK,WAAW,QAAQ,UAAU;EAC1D,MAAM,SAAS,YACb,KAAKD,IAAI,WAAW,8BAA8B,OAAO;GACvD,MAAM,WAAW;GACjB,MAAM;GACN,4BAAY,IAAI,KAAK;EACvB,CAAC;EAEH,IAAI;EACJ,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;GAC5C,IAAK,MAAM,OAAO,IAAK,GAAG;GAE1B,MAAM,sBAAM,IAAI,KAAK;GACrB,IAAI;IACF,MAAM,KAAKA,IAAI,UAA2B,8BAA8B;KACtE,QAAQ,OAAO;KACf,SAAS,OAAO,UAAU;KAC1B;KACA,MAAM,WAAW;KACjB,MAAM;KACN,YAAY;KACZ,YAAY;IACd,CAAC;IACD;GACF,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;IACpD,YAAY;GACd;EACF;EACA,MAAM;CACR;;CAGA,MAAM,iBAAiB,QAA0B,UAAoC;EAEnF,OAAO,MADe,KAAKA,IAAI,WAAW,8BAA8B,YAAY,QAAQ,QAAQ,CAAC,IACpF;CACnB;;CAGA,MAAM,gBAAgB,OAAe,QAA6C;EAEhF,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,KAAKA,IAAI,SAA0B,8BAA8B;GAAE,QAAQ;GAAO,SAAS;EAAO,CAAC,GACnG,KAAKA,IAAI,SAA0B,8BAA8B;GAAE,QAAQ;GAAO,SAAS;EAAK,CAAC,CACnG,CAAC;EACD,OAAO,QAAQ,IAAI,CACjB,GAAG,SAAS,IAAI,OAAM,SAAQ;GAC5B,UAAU,IAAI;GACd,OAAO;GACP,YAAY,MAAM,KAAKC,mBAAmB,IAAI,IAAI;GAClD,WAAW,IAAI;EACjB,EAAE,GACF,GAAG,QAAQ,IAAI,OAAM,SAAQ;GAC3B,UAAU,IAAI;GACd,OAAO;GACP,YAAY,MAAM,KAAKA,mBAAmB,IAAI,IAAI;GAClD,WAAW,IAAI;EACjB,EAAE,CACJ,CAAC;CACH;;CAGA,MAAM,kBACJ,OACA,QACA,UACA,OACyC;EACzC,MAAM,WAAW,YAAqD;GACpE,MAAM,MAAM,MAAM,KAAKD,IAAI,QAAyB,8BAA8B;IAChF,QAAQ;IACR;IACA,SAAS;GACX,CAAC;GACD,OAAO,MACH;IAAE,UAAU,IAAI;IAAU,OAAO;IAAQ,YAAY,MAAM,KAAKC,mBAAmB,IAAI,IAAI;GAAE,IAC7F,KAAA;EACN;EACA,MAAM,UAAU,YAAqD;GACnE,MAAM,MAAM,MAAM,KAAKD,IAAI,QAAyB,8BAA8B;IAChF,QAAQ;IACR;IACA,SAAS;GACX,CAAC;GACD,OAAO,MACH;IAAE,UAAU,IAAI;IAAU,OAAO;IAAO,YAAY,MAAM,KAAKC,mBAAmB,IAAI,IAAI;GAAE,IAC5F,KAAA;EACN;EACA,OAAO,UAAU,QAAQ,QAAQ,IAAI,SAAS;CAChD;;;;;;;;;CAUA,MAAM,aACJ,QACA,UACA,WACsC;EACtC,IAAI;EACJ,MAAM,KAAKD,IAAI,aACb,8BACA,YAAY,QAAQ,QAAQ,GAC5B,OAAM,QAAO;GACX,MAAM,YAAY,MAAM,KAAK,WAAW,QAAwB,IAAI,IAAI;GACxE,IAAI,UAAU,MAAM,SAAS,SAAS,OAAO;GAC7C,MAAM,UAAU,UAAU;GAE1B,IAAI,CAAC,yBAAyB,OAAO,GAAG;IACtC,SAAS;IACT,OAAO,UAAU,oBAAoB,EAAE,MAAM,MAAM,KAAK,WAAW,QAAQ,OAAO,EAAE,IAAI;GAC1F;GACA,MAAM,OAAO,MAAM,UAAU,OAAO;GACpC,SAAS;GACT,OAAO;IAAE,MAAM,MAAM,KAAK,WAAW,QAAQ,IAAI;IAAG,4BAAY,IAAI,KAAK;GAAE;EAC7E,CACF;EACA,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAA0D;EAajF,OAAO,aAAa,MAZG,KAAKA,IAAI,UAA6B,wBAAwB;GACnF,YAAY,MAAM;GAClB,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,UAAU,MAAM;GAChB,MAAM,MAAM;GACZ,kBAAkB,MAAM,mBAAmB;GAC3C,SAAS,MAAM;GACf,YAAY,MAAM;GAClB,cAAc,MAAM,cAAc;GAClC,4BAAY,IAAI,KAAK;EACvB,CAAC,CAC2B;CAC9B;;;;;CAMA,MAAM,gBAAgB,WAAyD;EAC7E,MAAM,MAAM,MAAM,KAAKA,IAAI,QAA2B,wBAAwB,EAAE,YAAY,UAAU,CAAC;EACvG,IAAI,CAAC,KAAK,OAAO,KAAA;EACjB,IAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,IAAI,GAAG;GAC1C,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;GAC3E;EACF;EACA,OAAO,aAAa,GAAG;CACzB;;;;;;CAOA,MAAM,kBACJ,WACA,OACsC;EACtC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,UAAU;EACd,MAAM,UAAU,MAAM,KAAKA,IAAI,aAC7B,wBACA,EAAE,YAAY,UAAU,IACxB,QAAO;GACL,IACE,IAAI,WAAW,MAAM,SACrB,IAAI,YAAY,MAAM,UACtB,IAAI,aAAa,MAAM,YACvB,IAAI,SAAS,MAAM,MAEnB,OAAO;GAET,IAAI,IAAI,WAAW,QAAQ,KAAK,KAAK,OAAO;GAC5C,IAAI,IAAI,gBAAgB,IAAI,aAAa,QAAQ,IAAI,KAAK,OAAO;GACjE,UAAU;GAGV,OAAO,EAAE,cAAc,IAAI,WAAW;EACxC,CACF;EACA,OAAO,WAAW,UAAU,aAAa,OAAO,IAAI,KAAA;CACtD;;CAGA,MAAM,kBACJ,WACA,SACe;EACf,MAAM,MAA+B,CAAC;EACtC,IAAI,QAAQ,YAAY,KAAA,GAAW,IAAI,UAAU,QAAQ;EACzD,IAAI,QAAQ,eAAe,KAAA,GAAW,IAAI,eAAe,QAAQ;EACjE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,WAAW,GAAG;EACnC,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,GAAG,GAAG;CAClF;;CAGA,MAAM,mBAAmB,WAAkC;EACzD,MAAM,KAAKA,IAAI,WAAW,wBAAwB,EAAE,YAAY,UAAU,CAAC;CAC7E;AACF"}

package/dist/storage/domains/work-items/base.d.ts

@@ -703,6 +703,7 @@ export declare class WorkItemsStorage extends FactoryStorageDomain {
         threadId: string;
         resourceId: string;
         sessionId: string;
+        rejectAmbiguous?: boolean;
     }): Promise<FactoryRunBindingRecord | null>;
     /**
      * The active binding a Factory session is serving, keyed by the session

package/dist/storage/domains/work-items/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/work-items/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAmB,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGjG,OAAO,KAAK,EAAE,iBAAiB,EAAkB,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAc1E,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAanC,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAE7E;AAaD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAChF,eAAO,MAAM,uCAAuC,qCAAqC,CAAC;AAE1F,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG5D;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE;QAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACrC,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,kGAAkG;GAChG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAExB,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;IACjC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,UAAU,GACV,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,CAAC;AAEb,QAAA,MAAM,8BAA8B,0fAoB1B,CAAC;AAKX,QAAA,MAAM,qCAAqC,0iBAGjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AACzF,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,qCAAqC,CAAC,CAAC,MAAM,CAAC,CAAC;AAMtG,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,6BAA6B,EAAE,CAAC;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gCAAgC,GAAG,IAAI,CAAC;IACrD,kFAAkF;IAClF,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB,qBAAqB,GACrB,SAAS,GACT,UAAU,GACV,oBAAoB,GACpB,eAAe,CAAC;AACpB,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AACD,MAAM,MAAM,6BAA6B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,4BAA4B,CAAC;IACpC,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAMxD,CAAC;AAEH,UAAU,wBAAwB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,wBAAwB,CAAC;IACnC,MAAM,EAAE,6BAA6B,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,wBAAwB,CAE1B;AAED,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAE7F;AAcD,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAE3F;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAEjH;AAED,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,wBAAwB,CAE1B;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAErH;AAED,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,GAAG,MAAM,CAExG;AAED,MAAM,WAAW,+BAA+B;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,kCAAkC;IACjD,wFAAwF;IACxF,SAAS,EAAE,IAAI,CAAC;IAChB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,wCAAwC;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gCAAgC,GAAG,IAAI,CAAC;IACrD,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,IAAI,CAAC;IACV,cAAc,EAAE,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iCAAkC,SAAQ,sBAAsB;IAC/E,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;CACjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,GAAG,EAAE,IAAI,CAAC;IACV,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,0BAA0B,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,UAAU,EACN;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,GAC7D;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,yGAAyG;IACzG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAClF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1B,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,uBAAuB,CAAC;IACjC,YAAY,EAAE,yBAAyB,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAElE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,cAAc,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,6DAA6D;IAC7D,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,uHAAuH;IACvH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,eAAO,MAAM,iBAAiB,EAAE,gBAuD/B,CAAC;AA4BF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIlG;AAyDD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,gCAAgC;CAC9C;AAED,2EAA2E;AAC3E,qBAAa,0BAA2B,SAAQ,KAAK;IAGvC,QAAQ,CAAC,QAAQ,EAAE,WAAW;IAF1C,QAAQ,CAAC,IAAI,8BAA8B;gBAEtB,QAAQ,EAAE,WAAW;CAG3C;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IAGxC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU;IAFjD,QAAQ,CAAC,IAAI,+BAA+B;gBAEvB,MAAM,EAAE,OAAO,GAAG,UAAU;CAGlD;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,WAAW,EAAE,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAC9B,IAAI,CAiBN;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,kBAAkB,EAAE,EAC7B,SAAS,EAAE,aAAa,EAAE,EAC1B,SAAS,EAAE,aAAa,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,IAAI,GACR,kBAAkB,EAAE,CAkBtB;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,gBAAgB,CAE1G;AAgbD,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAMD,qBAAa,gBAAiB,SAAQ,oBAAoB;;;IAYxD;;;;OAIG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI;IAI1E;;;;OAIG;IACH,yBAAyB,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,GAAG,IAAI;IA2BrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAcrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAW1C,cAAuB,GAAG,IAAI,iBAAiB,CAG9C;IAmBK,sBAAsB,CAAC,KAAK,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,OAAO,CAAC,IAAI,CAAC;IA2DX,yBAAyB,CAAC,KAAK,EAAE;QACrC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,EAAE;YAAE,UAAU,EAAE,IAAI,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAgBnE,2BAA2B,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA6KtG;;;;OAIG;IACG,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAoBtG,SAAS,CAAC,EACd,KAAK,EACL,gBAAgB,EAChB,GAAG,GACJ,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAU1B;;;;OAIG;IACG,sBAAsB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBnG,kBAAkB,CAAC,EACvB,KAAK,EACL,gBAAgB,EAChB,MAAM,GACP,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IASzB,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAKpF;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK9E;;;;;OAKG;IACG,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAQhH,0DAA0D;IACpD,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK1G;;;;OAIG;IACG,aAAa,CAAC,EAClB,KAAK,EACL,EAAE,EACF,QAAQ,GACT,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsBzB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS/F,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IASpC,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAuK7F,oBAAoB,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,iCAAiC,CAAC;IA6IzG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAkB1C,uBAAuB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;IAa7E,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAerC,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAW3C,+EAA+E;IACzE,wBAAwB,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoB7G,8FAA8F;IACxF,wBAAwB,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoBrG,gCAAgC,CAAC,EACrC,KAAK,EACL,gBAAgB,EAChB,QAAQ,GACT,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,qBAAqB,EAAE,CAAC;KACnC,GAAG,OAAO,CAAC,MAAM,CAAC;IAQb,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAS1C,qBAAqB,CAAC,EAC1B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,GACX,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,wBAAwB,EAAE,CAAC;KACxC,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAyBtC,sBAAsB,CAAC,EAC3B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,IAAI,EACJ,KAAK,GACN,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,oBAAoB,CAAC;QAC3B,KAAK,CAAC,EAAE,4BAA4B,CAAC;KACtC,GAAG,OAAO,CAAC,MAAM,CAAC;IAUb,uBAAuB,CAAC,EAC5B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,GACX,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,6FAA6F;QAC7F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,wBAAwB,EAAE,CAAC;KACxC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBX,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IA6InG,yBAAyB,CAAC,EAC9B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,GAAG,GACJ,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,wBAAwB,EAAE,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBX,sBAAsB,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAM1G,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,cAAc,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlG,wBAAwB,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAKhD,iHAAiH;IAC3G,uBAAuB,CAC3B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAK1C,oBAAoB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAS7G,6FAA6F;IACvF,uBAAuB,CAC3B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAwBhD;;;;;OAKG;IACG,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,EACT,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAiChD,yFAAyF;IACnF,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAOhD;;;OAGG;IACG,6BAA6B,CAAC,KAAK,EAAE;QACzC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,IAAI,CAAC;KACpB,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;IA8FtC,qCAAqC,CAAC,KAAK,EAAE;QACjD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIX,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IA4DjD,0GAA0G;IACpG,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAuChD,qFAAqF;IAC/E,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAYtG;;;;OAIG;IACG,4BAA4B,CAAC,KAAK,EAAE;QACxC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAa3C;;;;;OAKG;IACG,8BAA8B,CAAC,KAAK,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAW3C,6GAA6G;IACvG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAgBhH,8CAA8C;IACxC,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAcpG;;;;OAIG;IACG,4BAA4B,CAAC,KAAK,EAAE,wCAAwC,GAAG,OAAO,CAAC,MAAM,CAAC;IAapG;;;;;OAKG;IACG,sBAAsB,CAAC,KAAK,EAAE,kCAAkC,GAAG,OAAO,CAAC,MAAM,CAAC;IAiCxF,yEAAyE;IACnE,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAIjE,kEAAkE;IAC5D,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAc/B,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAUhG,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAIvF,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,cAAc,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9F,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAK1G,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAK/F,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAiM1F,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,QAAQ,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAS5C;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;QACzB,KAAK,EAAE,mBAAmB,CAAC;QAC3B,SAAS,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;KACjD,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgI3B,0BAA0B,CAAC,EAC/B,KAAK,EACL,EAAE,EACF,MAAM,EACN,gBAAgB,GACjB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAkBzB,MAAM,CAAC,EACX,KAAK,EACL,EAAE,EACF,MAAM,EACN,KAAK,EACL,gBAAgB,EAChB,aAAa,GACd,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,mBAAmB,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI,CAAC;IAkHjE,MAAM,CAAC,EACX,KAAK,EACL,EAAE,EACF,cAAqB,GACtB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA2BhC"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/storage/domains/work-items/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAmB,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGjG,OAAO,KAAK,EAAE,iBAAiB,EAAkB,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAc1E,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAanC,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAE7E;AAaD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAChF,eAAO,MAAM,uCAAuC,qCAAqC,CAAC;AAE1F,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG5D;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE;QAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACrC,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,kGAAkG;GAChG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAExB,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,UAAU,GAAG,UAAU,CAAC;IACjC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,UAAU,GACV,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,CAAC;AAEb,QAAA,MAAM,8BAA8B,0fAoB1B,CAAC;AAKX,QAAA,MAAM,qCAAqC,0iBAGjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AACzF,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,qCAAqC,CAAC,CAAC,MAAM,CAAC,CAAC;AAMtG,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,6BAA6B,EAAE,CAAC;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gCAAgC,GAAG,IAAI,CAAC;IACrD,kFAAkF;IAClF,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB,qBAAqB,GACrB,SAAS,GACT,UAAU,GACV,oBAAoB,GACpB,eAAe,CAAC;AACpB,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AACD,MAAM,MAAM,6BAA6B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,4BAA4B,CAAC;IACpC,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAMxD,CAAC;AAEH,UAAU,wBAAwB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,wBAAwB,CAAC;IACnC,MAAM,EAAE,6BAA6B,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,GACxB,wBAAwB,CAE1B;AAED,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAE7F;AAcD,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,CAE3F;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAEjH;AAED,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,wBAAwB,CAE1B;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAErH;AAED,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,GAAG,MAAM,CAExG;AAED,MAAM,WAAW,+BAA+B;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,kCAAkC;IACjD,wFAAwF;IACxF,SAAS,EAAE,IAAI,CAAC;IAChB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,wCAAwC;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gCAAgC,GAAG,IAAI,CAAC;IACrD,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,IAAI,CAAC;IACV,cAAc,EAAE,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iCAAkC,SAAQ,sBAAsB;IAC/E,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;CACjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,GAAG,EAAE,IAAI,CAAC;IACV,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,0BAA0B,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,UAAU,EACN;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,GAC7D;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,yGAAyG;IACzG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAClF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1B,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,uBAAuB,CAAC;IACjC,YAAY,EAAE,yBAAyB,CAAC;IACxC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAElE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,cAAc,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,6DAA6D;IAC7D,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,uHAAuH;IACvH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,eAAO,MAAM,iBAAiB,EAAE,gBAuD/B,CAAC;AA4BF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIlG;AAyDD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,gCAAgC;CAC9C;AAED,2EAA2E;AAC3E,qBAAa,0BAA2B,SAAQ,KAAK;IAGvC,QAAQ,CAAC,QAAQ,EAAE,WAAW;IAF1C,QAAQ,CAAC,IAAI,8BAA8B;gBAEtB,QAAQ,EAAE,WAAW;CAG3C;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IAGxC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU;IAFjD,QAAQ,CAAC,IAAI,+BAA+B;gBAEvB,MAAM,EAAE,OAAO,GAAG,UAAU;CAGlD;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,WAAW,EAAE,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAC9B,IAAI,CAiBN;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,kBAAkB,EAAE,EAC7B,SAAS,EAAE,aAAa,EAAE,EAC1B,SAAS,EAAE,aAAa,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,IAAI,GACR,kBAAkB,EAAE,CAkBtB;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,gBAAgB,CAE1G;AAgbD,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAMD,qBAAa,gBAAiB,SAAQ,oBAAoB;;;IAYxD;;;;OAIG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI;IAI1E;;;;OAIG;IACH,yBAAyB,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,GAAG,IAAI;IA2BrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAcrB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAW1C,cAAuB,GAAG,IAAI,iBAAiB,CAG9C;IAmBK,sBAAsB,CAAC,KAAK,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,OAAO,CAAC,IAAI,CAAC;IA2DX,yBAAyB,CAAC,KAAK,EAAE;QACrC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,CAAC,EAAE;YAAE,UAAU,EAAE,IAAI,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAgBnE,2BAA2B,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA6KtG;;;;OAIG;IACG,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAoBtG,SAAS,CAAC,EACd,KAAK,EACL,gBAAgB,EAChB,GAAG,GACJ,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAU1B;;;;OAIG;IACG,sBAAsB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBnG,kBAAkB,CAAC,EACvB,KAAK,EACL,gBAAgB,EAChB,MAAM,GACP,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,sBAAsB,CAAC;KAChC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IASzB,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAKpF;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK9E;;;;;OAKG;IACG,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAQhH,0DAA0D;IACpD,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK1G;;;;OAIG;IACG,aAAa,CAAC,EAClB,KAAK,EACL,EAAE,EACF,QAAQ,GACT,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsBzB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAS/F,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IASpC,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAuK7F,oBAAoB,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,iCAAiC,CAAC;IA6IzG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAkB1C,uBAAuB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;IAa7E,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAerC,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAW3C,+EAA+E;IACzE,wBAAwB,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoB7G,8FAA8F;IACxF,wBAAwB,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAoBrG,gCAAgC,CAAC,EACrC,KAAK,EACL,gBAAgB,EAChB,QAAQ,GACT,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,qBAAqB,EAAE,CAAC;KACnC,GAAG,OAAO,CAAC,MAAM,CAAC;IAQb,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAS1C,qBAAqB,CAAC,EAC1B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,GACX,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,wBAAwB,EAAE,CAAC;KACxC,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAyBtC,sBAAsB,CAAC,EAC3B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,IAAI,EACJ,KAAK,GACN,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,oBAAoB,CAAC;QAC3B,KAAK,CAAC,EAAE,4BAA4B,CAAC;KACtC,GAAG,OAAO,CAAC,MAAM,CAAC;IAUb,uBAAuB,CAAC,EAC5B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,GACX,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,6FAA6F;QAC7F,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,wBAAwB,EAAE,CAAC;KACxC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBX,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IA6InG,yBAAyB,CAAC,EAC9B,KAAK,EACL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,GAAG,GACJ,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,wBAAwB,EAAE,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC;KACX,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBX,sBAAsB,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;IAM1G,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,cAAc,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlG,wBAAwB,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAKhD,iHAAiH;IAC3G,uBAAuB,CAC3B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAK1C,oBAAoB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAS7G,6FAA6F;IACvF,uBAAuB,CAC3B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAwBhD;;;;;OAKG;IACG,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,EACT,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAiChD,yFAAyF;IACnF,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAOhD;;;OAGG;IACG,6BAA6B,CAAC,KAAK,EAAE;QACzC,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,IAAI,CAAC;KACpB,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC;IA8FtC,qCAAqC,CAAC,KAAK,EAAE;QACjD,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIX,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IA4DjD,0GAA0G;IACpG,qBAAqB,CACzB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAuChD,qFAAqF;IAC/E,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAYtG;;;;OAIG;IACG,4BAA4B,CAAC,KAAK,EAAE;QACxC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAgB3C;;;;;OAKG;IACG,8BAA8B,CAAC,KAAK,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAW3C,6GAA6G;IACvG,uBAAuB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAgBhH,8CAA8C;IACxC,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAcpG;;;;OAIG;IACG,4BAA4B,CAAC,KAAK,EAAE,wCAAwC,GAAG,OAAO,CAAC,MAAM,CAAC;IAapG;;;;;OAKG;IACG,sBAAsB,CAAC,KAAK,EAAE,kCAAkC,GAAG,OAAO,CAAC,MAAM,CAAC;IAiCxF,yEAAyE;IACnE,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAIjE,kEAAkE;IAC5D,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,EACxB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAc/B,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAUhG,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAIvF,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,cAAc,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9F,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAK1G,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAK/F,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAiM1F,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,QAAQ,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAS5C;;;;;;;OAOG;IACG,MAAM,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;QACzB,KAAK,EAAE,mBAAmB,CAAC;QAC3B,SAAS,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;KACjD,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgI3B,0BAA0B,CAAC,EAC/B,KAAK,EACL,EAAE,EACF,MAAM,EACN,gBAAgB,GACjB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAkBzB,MAAM,CAAC,EACX,KAAK,EACL,EAAE,EACF,MAAM,EACN,KAAK,EACL,gBAAgB,EAChB,aAAa,GACd,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,mBAAmB,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI,CAAC;IAkHjE,MAAM,CAAC,EACX,KAAK,EACL,EAAE,EACF,cAAqB,GACtB,EAAE;QACD,KAAK,EAAE,MAAM,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA2BhC"}

package/dist/storage/domains/work-items/base.js

@@ -2138,7 +2138,9 @@ var WorkItemsStorage = class extends FactoryStorageDomain {
 			session_id: input.sessionId,
 			status: "active"
 		});
-		if (new Set(rows.map((row) => row.factory_project_id)).size !== 1) return null;
+		const projectCount = new Set(rows.map((row) => row.factory_project_id)).size;
+		if (projectCount > 1 && input.rejectAmbiguous) throw new Error("Factory session has ambiguous active run bindings.");
+		if (projectCount !== 1) return null;
 		const row = rows.sort((left, right) => right.created_at.getTime() - left.created_at.getTime())[0];
 		return row ? toBinding(row) : null;
 	}