@raybase/core 0.0.1 → 0.3.3

package/dist/subject-domains.js

@@ -0,0 +1,38 @@
+/**
+ * Persisted subject-bearing columns owned by the shared runtime. Settings is
+ * intentionally qualified because one physical column stores app constants,
+ * scoped IDs, and identity subjects according to its explicit `scope` value.
+ */
+export const raybaseSubjectDomainManifest = [
+    { table: "_auth_users", column: "id", domain: "identity" },
+    { table: "_auth_sessions", column: "userId", domain: "identity" },
+    { table: "_auth_accounts", column: "userId", domain: "identity" },
+    { table: "_auth_passkeys", column: "userId", domain: "identity" },
+    { table: "_settings", column: "subjectId", domain: "identity", qualifier: "scope=user" },
+    { table: "_audit", column: "actorId", domain: "policy" },
+    { table: "_audit", column: "runAsId", domain: "policy" },
+    { table: "_changes", column: "actorId", domain: "policy" },
+    { table: "_files", column: "createdBy", domain: "policy" },
+    { table: "_notifications", column: "createdBy", domain: "policy" },
+    { table: "_notification_recipients", column: "recipientSubjectId", domain: "policy" },
+    { table: "_notification_subscriptions", column: "subjectId", domain: "policy" },
+    { table: "_notification_throttle_windows", column: "recipientSubjectId", domain: "policy" },
+    { table: "_agent_instances", column: "userId", domain: "policy" },
+    { table: "_agent_requests", column: "authorUserId", domain: "policy" },
+    { table: "_agent_room_members", column: "userId", domain: "policy" },
+    { table: "_agent_memories", column: "userId", domain: "policy" },
+    { table: "_agent_follow_ups", column: "ownerId", domain: "policy" },
+    { table: "_job_runs", column: "actorId", domain: "policy" },
+    { table: "_job_runs", column: "runAsId", domain: "policy" },
+    { table: "_job_batches", column: "actorId", domain: "policy" }
+];
+export function validateRaybaseSubjectDomainManifest(manifest = raybaseSubjectDomainManifest) {
+    const seen = new Set();
+    for (const entry of manifest) {
+        const key = `${entry.table}.${entry.column}:${entry.qualifier ?? "*"}`;
+        if (seen.has(key))
+            throw new Error(`Persisted subject ${key} is assigned more than once`);
+        seen.add(key);
+    }
+}
+//# sourceMappingURL=subject-domains.js.map

package/dist/subject-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-domains.js","sourceRoot":"","sources":["../src/subject-domains.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAuC;IAC9E,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE;IAC1D,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE;IACjE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE;IACjE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE;IACjE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE;IACxF,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACxD,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACxD,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC1D,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC1D,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;IAClE,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACrF,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/E,EAAE,KAAK,EAAE,gCAAgC,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3F,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IACtE,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IACpE,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IAChE,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACnE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3D,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3D,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;CACtD,CAAC;AAEX,MAAM,UAAU,oCAAoC,CAClD,WAA+C,4BAA4B;IAE3E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,6BAA6B,CAAC,CAAC;QAC1F,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/support.d.ts

@@ -0,0 +1,132 @@
+import { z } from "zod";
+import { type RaybaseAction, type RaybaseActionContext } from "./actions.js";
+import type { RaybaseAuditContextEvent } from "./audit.js";
+import type { SqlExecutor } from "./db.js";
+import { type RaybaseModule } from "./modules.js";
+import { type RaybaseNotificationsRuntime } from "./notifications.js";
+import { type RaybasePrincipal } from "./principal.js";
+import { type RaybaseSystemTable } from "./schema.js";
+export declare const raybaseSupportRequestsTableName = "_support_requests";
+export declare const supportRequestCreatedNotificationKind = "support.request.created";
+export declare const raybaseSupportSystemTables: RaybaseSystemTable[];
+declare const createSupportRequestInput: z.ZodObject<{
+    sourceKind: z.ZodOptional<z.ZodString>;
+    sourceId: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    agentName: z.ZodOptional<z.ZodString>;
+    agentInstanceId: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    toolCallId: z.ZodOptional<z.ZodString>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+    surface: z.ZodOptional<z.ZodString>;
+    route: z.ZodOptional<z.ZodString>;
+    subject: z.ZodOptional<z.ZodString>;
+    body: z.ZodString;
+    transcriptSummary: z.ZodOptional<z.ZodString>;
+    transcriptEvidence: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodNumber>;
+    docsConsulted: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    sources: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    escalationReason: z.ZodOptional<z.ZodString>;
+    suggestedHumanReply: z.ZodOptional<z.ZodString>;
+    createdMessageId: z.ZodOptional<z.ZodString>;
+    contactEmail: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>;
+declare const supportRequestActionOutput: z.ZodObject<{
+    supportRequestId: z.ZodString;
+    status: z.ZodString;
+    subject: z.ZodString;
+    createdAt: z.ZodString;
+    conversationId: z.ZodNullable<z.ZodString>;
+    route: z.ZodNullable<z.ZodString>;
+    surface: z.ZodNullable<z.ZodString>;
+    contactEmail: z.ZodNullable<z.ZodString>;
+    created: z.ZodBoolean;
+}, z.core.$strict>;
+export type CreateSupportRequestInput = z.infer<typeof createSupportRequestInput>;
+export type CreateSupportRequestResult = z.infer<typeof supportRequestActionOutput>;
+export type RaybaseSupportModuleOptions = {
+    enabled?: boolean;
+};
+export type SupportRequestRow = {
+    id: string;
+    sourceKind: string;
+    sourceId: string | null;
+    conversationId: string | null;
+    agentName: string | null;
+    agentInstanceId: string | null;
+    runId: string | null;
+    requestId: string | null;
+    toolCallId: string | null;
+    idempotencyKey: string | null;
+    userId: string | null;
+    organizationId: string | null;
+    principalKind: string | null;
+    publicIdentity: string | null;
+    surface: string | null;
+    route: string | null;
+    subject: string;
+    body: string;
+    transcriptSummary: string | null;
+    transcriptEvidence: string | null;
+    category: string | null;
+    confidence: number | null;
+    docsConsultedJson: string | null;
+    sourcesJson: string | null;
+    escalationReason: string | null;
+    suggestedHumanReply: string | null;
+    createdMessageId: string | null;
+    contactEmail: string | null;
+    metadataJson: string | null;
+    status: string;
+    createdAt: string;
+    updatedAt: string;
+};
+export type ListSupportRequestsOptions = {
+    organizationId?: string | null;
+    status?: string | null;
+    sourceKind?: string | null;
+    search?: string | null;
+    limit?: number;
+    offset?: number;
+};
+export type ListSupportRequestsResult = {
+    supportRequests: SupportRequestRow[];
+    total: number;
+    appliedFilters: {
+        organizationId: string | null;
+        status: string | null;
+        sourceKind: string | null;
+        search: string | null;
+        limit: number;
+        offset: number;
+    };
+};
+type SupportRequestContext<Env = unknown> = {
+    control: SqlExecutor;
+    notifications?: RaybaseNotificationsRuntime<Env>;
+    principal?: RaybasePrincipal;
+    user?: {
+        id: string;
+        email?: string | null;
+    } | null;
+    organizationId?: string | null;
+    agentName?: string;
+    agentInstanceId?: string;
+    conversationId?: string;
+    runId?: string;
+    requestId?: string;
+    toolCallId?: string;
+    route?: string;
+    surface?: string;
+    audit?: (event: RaybaseAuditContextEvent) => Promise<void>;
+};
+export declare function createSupportRequestAction<Env = unknown>(): RaybaseAction<CreateSupportRequestInput, CreateSupportRequestResult, Env>;
+export declare function supportModule<Env = unknown>(options?: RaybaseSupportModuleOptions): RaybaseModule<Env>;
+export declare function listSupportRequests(control: SqlExecutor, options?: ListSupportRequestsOptions): Promise<ListSupportRequestsResult>;
+export declare function createSupportRequest<Env>(ctx: SupportRequestContext<Env> | RaybaseActionContext<Env>, input: CreateSupportRequestInput): Promise<CreateSupportRequestResult>;
+export {};
+//# sourceMappingURL=support.d.ts.map

package/dist/support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../src/support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAmC,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC9G,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAKL,KAAK,2BAA2B,EAEjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAmD,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGvG,eAAO,MAAM,+BAA+B,sBAAsB,CAAC;AACnE,eAAO,MAAM,qCAAqC,4BAA4B,CAAC;AAE/E,eAAO,MAAM,0BAA0B,EAAE,kBAAkB,EAkD1D,CAAC;AAEF,QAAA,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBpB,CAAC;AAEZ,QAAA,MAAM,0BAA0B;;;;;;;;;;kBAUrB,CAAC;AAEZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAClF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACpF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE;QACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,KAAK,qBAAqB,CAAC,GAAG,GAAG,OAAO,IAAI;IAC1C,OAAO,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,GAAG,GAAG,OAAO,KAAK,aAAa,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAgBrI;AAED,wBAAgB,aAAa,CAAC,GAAG,GAAG,OAAO,EAAE,OAAO,GAAE,2BAAgC,GAAG,aAAa,CAAC,GAAG,CAAC,CAuG1G;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAuDpC;AAED,wBAAsB,oBAAoB,CAAC,GAAG,EAC5C,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,EAC3D,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CAqErC"}

package/dist/support.js

@@ -0,0 +1,483 @@
+import { z } from "zod";
+import { defineAction, mcpToolFromAction } from "./actions.js";
+import { sha256Hex, stableJson } from "./internal.js";
+import { defineRaybaseModule } from "./modules.js";
+import { getNotificationSubscription, listNotificationSubscribers, raybaseNotificationSubscriptionsTableName, setNotificationSubscription } from "./notifications.js";
+import { allowAll } from "./policies.js";
+import { principalOnBehalfOf } from "./principal.js";
+import { id, integer, longText, raybaseSystemTable, text } from "./schema.js";
+import { nowIso, q, randomId } from "./sql.js";
+export const raybaseSupportRequestsTableName = "_support_requests";
+export const supportRequestCreatedNotificationKind = "support.request.created";
+export const raybaseSupportSystemTables = [
+    raybaseSystemTable(raybaseSupportRequestsTableName, {
+        id: id(),
+        sourceKind: text({ required: true }),
+        sourceId: text(),
+        conversationId: text(),
+        agentName: text(),
+        agentInstanceId: text(),
+        runId: text(),
+        requestId: text(),
+        toolCallId: text(),
+        idempotencyKey: text({ unique: true }),
+        userId: text(),
+        organizationId: text(),
+        principalKind: text(),
+        publicIdentity: text(),
+        surface: text(),
+        route: text(),
+        subject: text({ required: true }),
+        body: longText({ required: true }),
+        transcriptSummary: longText(),
+        transcriptEvidence: longText(),
+        category: text(),
+        confidence: integer(),
+        docsConsultedJson: longText(),
+        sourcesJson: longText(),
+        escalationReason: longText(),
+        suggestedHumanReply: longText(),
+        createdMessageId: text(),
+        contactEmail: text(),
+        metadataJson: longText(),
+        status: text({ required: true }),
+        createdAt: text({ required: true }),
+        updatedAt: text({ required: true })
+    }, {
+        label: "Support requests",
+        indexes: [
+            ["status", "updatedAt"],
+            ["sourceKind", "updatedAt"],
+            ["userId", "updatedAt"],
+            ["surface", "updatedAt"],
+            ["conversationId", "updatedAt"],
+            ["runId", "updatedAt"],
+            ["idempotencyKey"]
+        ]
+    })
+];
+const createSupportRequestInput = z.object({
+    sourceKind: z.string().min(1).max(80).optional(),
+    sourceId: z.string().max(200).optional(),
+    conversationId: z.string().max(200).optional(),
+    agentName: z.string().max(120).optional(),
+    agentInstanceId: z.string().max(200).optional(),
+    runId: z.string().max(200).optional(),
+    requestId: z.string().max(200).optional(),
+    toolCallId: z.string().max(200).optional(),
+    idempotencyKey: z.string().max(240).optional(),
+    surface: z.string().max(120).optional(),
+    route: z.string().max(500).optional(),
+    subject: z.string().min(1).max(200).optional(),
+    body: z.string().min(1).max(12000),
+    transcriptSummary: z.string().max(4000).optional(),
+    transcriptEvidence: z.string().max(12000).optional(),
+    category: z.string().max(120).optional(),
+    confidence: z.number().int().min(0).max(100).optional(),
+    docsConsulted: z.array(z.unknown()).max(50).optional(),
+    sources: z.array(z.unknown()).max(50).optional(),
+    escalationReason: z.string().max(2000).optional(),
+    suggestedHumanReply: z.string().max(4000).optional(),
+    createdMessageId: z.string().max(200).optional(),
+    contactEmail: z.string().email().max(320).optional(),
+    metadata: z.unknown().optional()
+}).strict();
+const supportRequestActionOutput = z.object({
+    supportRequestId: z.string(),
+    status: z.string(),
+    subject: z.string(),
+    createdAt: z.string(),
+    conversationId: z.string().nullable(),
+    route: z.string().nullable(),
+    surface: z.string().nullable(),
+    contactEmail: z.string().nullable(),
+    created: z.boolean()
+}).strict();
+export function createSupportRequestAction() {
+    return defineAction({
+        name: "create_support_request",
+        description: "Create a support request for a user who needs human help. Use this for app support escalation, not for general data entry.",
+        input: createSupportRequestInput,
+        output: supportRequestActionOutput,
+        audience: ["signed-in", "public"],
+        policy: allowAll,
+        annotations: {
+            title: "Create support request",
+            idempotentHint: true
+        },
+        requiresInternalControl: true,
+        idempotencyKey: (input) => input.idempotencyKey,
+        handler: async (ctx, input) => createSupportRequest(ctx, input)
+    });
+}
+export function supportModule(options = {}) {
+    return defineRaybaseModule({
+        id: "support",
+        packageName: "@raybase/core",
+        runtime: () => {
+            const enabled = options.enabled !== false;
+            if (!enabled) {
+                return {
+                    manifest: {
+                        id: "support",
+                        packageName: "@raybase/core"
+                    }
+                };
+            }
+            const createAction = createSupportRequestAction();
+            return {
+                systemTables: raybaseSupportSystemTables,
+                actions: { [createAction.name]: createAction },
+                mcpTools: [
+                    mcpToolFromAction(createAction, {
+                        allowInternalControl: true,
+                        context: (ctx) => ({
+                            control: ctx.control,
+                            notifications: ctx.notifications
+                        })
+                    })
+                ],
+                adminRoutes: [
+                    {
+                        method: "GET",
+                        path: "/api/admin/support/requests",
+                        handle: async (routeCtx) => {
+                            routeCtx.requireAdmin();
+                            const url = new URL(routeCtx.request.url);
+                            const result = await listSupportRequests(routeCtx.control, {
+                                organizationId: routeCtx.organizationId ?? null,
+                                status: url.searchParams.get("status"),
+                                sourceKind: url.searchParams.get("sourceKind"),
+                                search: url.searchParams.get("search"),
+                                limit: numberParam(url.searchParams.get("limit"), 50, 1, 100),
+                                offset: numberParam(url.searchParams.get("offset"), 0, 0, 100000)
+                            });
+                            return routeCtx.json(result);
+                        }
+                    },
+                    {
+                        method: "GET",
+                        path: "/api/admin/support/notification-subscription",
+                        handle: async (routeCtx) => {
+                            const user = routeCtx.requireAdmin();
+                            if (!routeCtx.notifications.enabled)
+                                return routeCtx.json({ error: "Notifications are not enabled" }, 404);
+                            const subscription = await getNotificationSubscription(routeCtx.control, {
+                                organizationId: routeCtx.organizationId ?? undefined,
+                                userId: user.id,
+                                kind: supportRequestCreatedNotificationKind
+                            });
+                            return routeCtx.json({
+                                kind: supportRequestCreatedNotificationKind,
+                                organizationId: routeCtx.organizationId ?? null,
+                                enabled: subscription?.enabled ?? false,
+                                channels: subscription?.channels ?? ["feed"],
+                                subscription
+                            });
+                        }
+                    },
+                    {
+                        method: "PUT",
+                        path: "/api/admin/support/notification-subscription",
+                        handle: async (routeCtx) => {
+                            const user = routeCtx.requireAdmin();
+                            if (!routeCtx.notifications.enabled)
+                                return routeCtx.json({ error: "Notifications are not enabled" }, 404);
+                            const body = await routeCtx.request.json().catch(() => ({}));
+                            const channels = Array.isArray(body.channels)
+                                ? body.channels.filter((channel) => typeof channel === "string")
+                                : ["feed"];
+                            const subscription = await setNotificationSubscription(routeCtx.control, {
+                                organizationId: routeCtx.organizationId ?? undefined,
+                                userId: user.id,
+                                kind: supportRequestCreatedNotificationKind,
+                                enabled: body.enabled === true,
+                                channels
+                            });
+                            await routeCtx.audit({
+                                action: "support.notification_subscription.update",
+                                target: { type: raybaseNotificationSubscriptionsTableName, id: subscription.id },
+                                metadata: {
+                                    kind: supportRequestCreatedNotificationKind,
+                                    organizationId: subscription.organizationId,
+                                    enabled: subscription.enabled,
+                                    channels: subscription.channels
+                                }
+                            });
+                            return routeCtx.json({ subscription });
+                        }
+                    }
+                ],
+                manifest: {
+                    id: "support",
+                    packageName: "@raybase/core"
+                }
+            };
+        }
+    });
+}
+export async function listSupportRequests(control, options = {}) {
+    const limit = clampInteger(options.limit ?? 50, 1, 500);
+    const offset = clampInteger(options.offset ?? 0, 0, 100000);
+    const organizationId = clean(options.organizationId) ?? null;
+    const status = clean(options.status) ?? null;
+    const sourceKind = clean(options.sourceKind) ?? null;
+    const search = clean(options.search) ?? null;
+    const where = [];
+    const params = [];
+    if (organizationId) {
+        where.push(`"organizationId" = ?`);
+        params.push(organizationId);
+    }
+    if (status) {
+        where.push(`"status" = ?`);
+        params.push(status);
+    }
+    if (sourceKind) {
+        where.push(`"sourceKind" = ?`);
+        params.push(sourceKind);
+    }
+    if (search) {
+        const pattern = `%${escapeLike(search)}%`;
+        where.push(`("subject" LIKE ? ESCAPE '\\' OR "body" LIKE ? ESCAPE '\\' OR "contactEmail" LIKE ? ESCAPE '\\' OR "route" LIKE ? ESCAPE '\\')`);
+        params.push(pattern, pattern, pattern, pattern);
+    }
+    const whereSql = where.length ? `WHERE ${where.join(" AND ")}` : "";
+    const [supportRequests, countRow] = await Promise.all([
+        control.all(`SELECT *
+       FROM ${q(raybaseSupportRequestsTableName)}
+       ${whereSql}
+       ORDER BY "updatedAt" DESC, "createdAt" DESC
+       LIMIT ? OFFSET ?`, [...params, limit, offset]),
+        control.first(`SELECT COUNT(*) as "count"
+       FROM ${q(raybaseSupportRequestsTableName)}
+       ${whereSql}`, params)
+    ]);
+    return {
+        supportRequests,
+        total: Number(countRow?.count ?? supportRequests.length),
+        appliedFilters: {
+            organizationId,
+            status,
+            sourceKind,
+            search,
+            limit,
+            offset
+        }
+    };
+}
+export async function createSupportRequest(ctx, input) {
+    const control = ctx.control;
+    if (!control)
+        throw new Error("Support request storage is unavailable");
+    const body = input.body.trim();
+    if (!body)
+        throw new Error("Support request body is required");
+    const sourceKind = clean(input.sourceKind) ?? defaultSourceKind(ctx);
+    const organizationId = clean(ctx.organizationId) ?? null;
+    const idempotencyKey = clean(input.idempotencyKey) ?? await defaultSupportIdempotencyKey(ctx, input, sourceKind, organizationId);
+    const existing = await loadSupportRequestByIdempotencyKey(control, idempotencyKey);
+    if (existing)
+        return supportRequestResult(existing, false);
+    const principal = ctx.principal;
+    // A support request raised through an agent belongs to the person the agent
+    // ran for; the agent itself is recorded in agentName.
+    const authority = principal ? principalOnBehalfOf(principal) : undefined;
+    const now = nowIso();
+    const row = {
+        id: randomId("support"),
+        sourceKind,
+        sourceId: clean(input.sourceId) ?? null,
+        conversationId: clean(input.conversationId) ?? clean(ctx.conversationId) ?? null,
+        agentName: clean(input.agentName) ?? clean(ctx.agentName) ?? null,
+        agentInstanceId: clean(input.agentInstanceId) ?? clean(ctx.agentInstanceId) ?? null,
+        runId: clean(input.runId) ?? clean(ctx.runId) ?? null,
+        requestId: clean(input.requestId) ?? clean(ctx.requestId) ?? null,
+        toolCallId: clean(input.toolCallId) ?? clean(ctx.toolCallId) ?? null,
+        idempotencyKey,
+        userId: userIdFromPrincipal(principal, ctx.user),
+        organizationId,
+        principalKind: authority?.kind ?? (ctx.user ? "user" : null),
+        publicIdentity: authority?.kind === "public" ? authority.id : null,
+        surface: clean(input.surface) ?? clean(ctx.surface) ?? null,
+        route: clean(input.route) ?? clean(ctx.route) ?? null,
+        subject: clean(input.subject)?.slice(0, 200) ?? (body.slice(0, 120) || "Support request"),
+        body,
+        transcriptSummary: clean(input.transcriptSummary) ?? null,
+        transcriptEvidence: clean(input.transcriptEvidence) ?? null,
+        category: clean(input.category) ?? "support",
+        confidence: input.confidence ?? null,
+        docsConsultedJson: input.docsConsulted ? stableJson(input.docsConsulted) : null,
+        sourcesJson: input.sources ? stableJson(input.sources) : null,
+        escalationReason: clean(input.escalationReason) ?? null,
+        suggestedHumanReply: clean(input.suggestedHumanReply) ?? null,
+        createdMessageId: clean(input.createdMessageId) ?? null,
+        contactEmail: clean(input.contactEmail) ?? clean(ctx.user?.email) ?? null,
+        metadataJson: input.metadata === undefined ? null : stableJson(input.metadata),
+        status: "open",
+        createdAt: now,
+        updatedAt: now
+    };
+    await insertSupportRequest(control, row);
+    await ctx.audit?.({
+        action: "support.request.create",
+        target: { type: raybaseSupportRequestsTableName, id: row.id },
+        metadata: {
+            sourceKind: row.sourceKind,
+            sourceId: row.sourceId,
+            organizationId: row.organizationId,
+            conversationId: row.conversationId,
+            runId: row.runId,
+            toolCallId: row.toolCallId,
+            route: row.route,
+            surface: row.surface
+        }
+    });
+    await notifySupportRequestCreated(ctx, row).catch(() => undefined);
+    return supportRequestResult(row, true);
+}
+async function insertSupportRequest(control, row) {
+    await control.run(`INSERT INTO ${q(raybaseSupportRequestsTableName)}
+     ("id", "sourceKind", "sourceId", "conversationId", "agentName", "agentInstanceId", "runId", "requestId", "toolCallId", "idempotencyKey",
+      "userId", "organizationId", "principalKind", "publicIdentity", "surface", "route", "subject", "body", "transcriptSummary",
+      "transcriptEvidence", "category", "confidence", "docsConsultedJson", "sourcesJson", "escalationReason",
+      "suggestedHumanReply", "createdMessageId", "contactEmail", "metadataJson", "status", "createdAt", "updatedAt")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+        row.id,
+        row.sourceKind,
+        row.sourceId,
+        row.conversationId,
+        row.agentName,
+        row.agentInstanceId,
+        row.runId,
+        row.requestId,
+        row.toolCallId,
+        row.idempotencyKey,
+        row.userId,
+        row.organizationId,
+        row.principalKind,
+        row.publicIdentity,
+        row.surface,
+        row.route,
+        row.subject,
+        row.body,
+        row.transcriptSummary,
+        row.transcriptEvidence,
+        row.category,
+        row.confidence,
+        row.docsConsultedJson,
+        row.sourcesJson,
+        row.escalationReason,
+        row.suggestedHumanReply,
+        row.createdMessageId,
+        row.contactEmail,
+        row.metadataJson,
+        row.status,
+        row.createdAt,
+        row.updatedAt
+    ]);
+}
+async function loadSupportRequestByIdempotencyKey(control, idempotencyKey) {
+    return control.first(`SELECT *
+     FROM ${q(raybaseSupportRequestsTableName)}
+     WHERE "idempotencyKey" = ? LIMIT 1`, [idempotencyKey]);
+}
+async function defaultSupportIdempotencyKey(ctx, input, sourceKind, organizationId) {
+    const digest = await sha256Hex(stableJson({
+        organizationId,
+        sourceKind,
+        sourceId: clean(input.sourceId),
+        conversationId: clean(input.conversationId) ?? clean(ctx.conversationId),
+        runId: clean(input.runId) ?? clean(ctx.runId),
+        toolCallId: clean(input.toolCallId) ?? clean(ctx.toolCallId),
+        subject: clean(input.subject),
+        body: input.body.trim()
+    }));
+    return `support:${digest.slice(0, 48)}`;
+}
+async function notifySupportRequestCreated(ctx, row) {
+    if (!ctx.notifications?.enabled)
+        return;
+    const subscribers = await listNotificationSubscribers(ctx.control, supportRequestCreatedNotificationKind, {
+        organizationId: row.organizationId ?? undefined
+    });
+    if (!subscribers.length)
+        return;
+    const groups = new Map();
+    for (const subscriber of subscribers) {
+        const channels = subscriber.channels.length ? subscriber.channels : ["feed"];
+        const key = stableJson(channels);
+        const group = groups.get(key) ?? { channels, recipients: [] };
+        group.recipients.push({ kind: "user", userId: subscriber.userId });
+        groups.set(key, group);
+    }
+    for (const [key, group] of groups) {
+        await ctx.notifications.send({
+            to: group.recipients,
+            kind: supportRequestCreatedNotificationKind,
+            severity: "info",
+            title: "New support request",
+            body: row.subject,
+            target: {
+                href: `/admin/data/system/${encodeURIComponent(raybaseSupportRequestsTableName)}`,
+                entity: { type: "support_request", id: row.id }
+            },
+            channels: group.channels,
+            dedupeKey: `${supportRequestCreatedNotificationKind}:${row.id}:${key}`,
+            metadata: {
+                supportRequestId: row.id,
+                organizationId: row.organizationId,
+                sourceKind: row.sourceKind,
+                sourceId: row.sourceId,
+                route: row.route,
+                surface: row.surface,
+                contactEmail: row.contactEmail
+            }
+        });
+    }
+}
+function supportRequestResult(row, created) {
+    return {
+        supportRequestId: row.id,
+        status: row.status,
+        subject: row.subject,
+        createdAt: row.createdAt,
+        conversationId: row.conversationId,
+        route: row.route,
+        surface: row.surface,
+        contactEmail: row.contactEmail,
+        created
+    };
+}
+function clean(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function numberParam(value, fallback, min, max) {
+    if (!value)
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return clampInteger(parsed, min, max);
+}
+function clampInteger(value, min, max) {
+    return Math.min(max, Math.max(min, Math.trunc(value)));
+}
+function escapeLike(value) {
+    return value.replace(/[\\%_]/g, (match) => `\\${match}`);
+}
+function defaultSourceKind(ctx) {
+    if (ctx.surface === "mcp")
+        return "mcp";
+    if (ctx.surface === "guide")
+        return "guide";
+    return "api";
+}
+function userIdFromPrincipal(principal, user) {
+    const authority = principal ? principalOnBehalfOf(principal) : undefined;
+    if (authority?.kind === "user" || authority?.kind === "operator")
+        return authority.user.id;
+    return user?.id ?? null;
+}
+//# sourceMappingURL=support.js.map