@absolutejs/auth 0.65.1 → 0.65.2

package/dist/apikeys/postgresStores.d.ts

@@ -0,0 +1,359 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { AccessTokenStore, ApiClientStore, ApiKeyStore } from './types';
+export declare const accessTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_access_tokens";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        hashed_token: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        owner_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").SetDimensions<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        token_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_access_tokens", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_access_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const apiClientsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_api_clients";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_clients", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_clients", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_api_clients";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        hashed_secret: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_clients", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        name: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_clients", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        owner_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_clients", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_api_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_clients", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").SetDimensions<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "auth_api_clients";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const apiKeysTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_api_keys";
+    schema: undefined;
+    columns: {
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        hashed_key: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        key_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_used_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").PgBigInt53Builder, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        name: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        owner_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        prefix: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: import("drizzle-orm/pg-core").PgBuildColumn<"auth_api_keys", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").SetDimensions<import("drizzle-orm/pg-core").PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "auth_api_keys";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonAccessTokenStore: (databaseUrl: string) => AccessTokenStore;
+export declare const createNeonApiClientStore: (databaseUrl: string) => ApiClientStore;
+export declare const createNeonApiKeyStore: (databaseUrl: string) => ApiKeyStore;
+export declare const createPostgresAccessTokenStore: <DB extends AnyPgDatabase>(db: DB) => AccessTokenStore;
+export declare const createPostgresApiClientStore: <DB extends AnyPgDatabase>(db: DB) => ApiClientStore;
+export declare const createPostgresApiKeyStore: <DB extends AnyPgDatabase>(db: DB) => ApiKeyStore;

package/dist/apikeys/routes.d.ts

@@ -0,0 +1,83 @@
+import { Elysia } from 'elysia';
+import { type ApiKeysConfig } from './config';
+export declare const apiKeysRoutes: ({ accessTokenStore, accessTokenTtlMs, apiClientStore, tokenRoute }: ApiKeysConfig) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}> | Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                scope?: string | undefined;
+                grant_type?: string | undefined;
+                client_secret?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/apikeys/types.d.ts

@@ -0,0 +1,53 @@
+export type ApiKey = {
+    createdAt: number;
+    expiresAt?: number;
+    hashedKey: string;
+    keyId: string;
+    lastUsedAt?: number;
+    name: string;
+    ownerId?: string;
+    prefix: string;
+    scopes: string[];
+};
+export type ApiKeyStore = {
+    deleteKey: (keyId: string) => Promise<void>;
+    findByHashedKey: (hashedKey: string) => Promise<ApiKey | undefined>;
+    listKeys: (ownerId?: string) => Promise<ApiKey[]>;
+    saveKey: (key: ApiKey) => Promise<void>;
+    touchKey: (keyId: string, lastUsedAt: number) => Promise<void>;
+};
+export type ApiClient = {
+    clientId: string;
+    createdAt: number;
+    hashedSecret: string;
+    name: string;
+    ownerId?: string;
+    scopes: string[];
+};
+export type ApiClientStore = {
+    deleteClient: (clientId: string) => Promise<void>;
+    findClient: (clientId: string) => Promise<ApiClient | undefined>;
+    listClients: (ownerId?: string) => Promise<ApiClient[]>;
+    saveClient: (client: ApiClient) => Promise<void>;
+};
+export type AccessToken = {
+    clientId: string;
+    createdAt: number;
+    expiresAt: number;
+    hashedToken: string;
+    ownerId?: string;
+    scopes: string[];
+    tokenId: string;
+};
+export type AccessTokenStore = {
+    deleteExpired: (now: number) => Promise<void>;
+    deleteToken: (tokenId: string) => Promise<void>;
+    findByHashedToken: (hashedToken: string) => Promise<AccessToken | undefined>;
+    saveToken: (token: AccessToken) => Promise<void>;
+};
+export type ApiPrincipal = {
+    id: string;
+    kind: 'access_token' | 'api_key';
+    ownerId?: string;
+    scopes: string[];
+};

package/dist/audit/config.d.ts

@@ -0,0 +1,9 @@
+import type { AuditEvent, AuditSink } from './types';
+export type AuditConfig<UserType> = {
+    auditStore?: AuditSink;
+    getUserId?: (user: UserType) => string;
+    onAuditEvent?: (event: AuditEvent) => void | Promise<void>;
+    redact?: (event: AuditEvent) => AuditEvent | Promise<AuditEvent>;
+};
+export type AuditEmitter = (event: AuditEvent) => Promise<void>;
+export declare const createAuditEmitter: <UserType>({ auditStore, onAuditEvent, redact }: AuditConfig<UserType>) => (event: AuditEvent) => Promise<void>;

package/dist/audit/export.d.ts

@@ -0,0 +1,2 @@
+import type { AuditEvent } from './types';
+export declare const exportAuditCsv: (events: AuditEvent[]) => string;

package/dist/audit/inMemoryAuditStore.d.ts

@@ -0,0 +1,2 @@
+import type { AuditSink } from './types';
+export declare const createInMemoryAuditSink: () => AuditSink;

package/dist/audit/integrity.d.ts

@@ -0,0 +1,19 @@
+import type { AuditEvent, AuditSink } from './types';
+export type AuditIntegrity = {
+    hash: string;
+    previousHash: string;
+    writerId?: string;
+};
+export type AuditChainResult = {
+    brokenAt?: number;
+    ok: boolean;
+};
+export declare const createTamperEvidentSink: ({ loadWriterHead, secret, seedScanLimit, sink, writerId }: {
+    loadWriterHead?: (writerId: string) => Promise<string | undefined> | string | undefined;
+    secret?: string;
+    seedScanLimit?: number;
+    sink: AuditSink;
+    writerId?: string;
+}) => AuditSink;
+export declare const hashAuditEvent: (event: AuditEvent, previousHash: string, secret?: string) => Promise<string>;
+export declare const verifyAuditChain: (events: AuditEvent[], secret?: string) => Promise<AuditChainResult>;

package/dist/audit/postgresAuditStore.d.ts

@@ -0,0 +1,116 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import { type AuditSink } from './types';
+export declare const auditEventsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_audit_events";
+    schema: undefined;
+    columns: {
+        at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        ip: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        metadata_json: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "object json";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        type: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_audit_events";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonAuditSink: (databaseUrl: string) => AuditSink;
+export declare const createPostgresAuditSink: <DB extends AnyPgDatabase>(db: DB) => AuditSink;

package/dist/audit/siem.d.ts

@@ -0,0 +1,11 @@
+import type { AuditSink } from './types';
+export type SiemFormat = 'datadog' | 'generic' | 'splunk';
+export type SiemEndpoint = {
+    format?: SiemFormat;
+    headers?: Record<string, string>;
+    token?: string;
+    url: string;
+};
+export declare const createSiemLogStream: ({ endpoints }: {
+    endpoints: SiemEndpoint[];
+}) => AuditSink;

package/dist/audit/types.d.ts

@@ -0,0 +1,21 @@
+import type { OrganizationId } from '../tenancy';
+export type AuditEventType = 'account_deleted' | 'agent_credential_issued' | 'agent_delegated' | 'agent_registered' | 'agent_revoked' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'impersonation_ended' | 'impersonation_started' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
+export declare const AUDIT_EVENT_TYPES: readonly AuditEventType[];
+export declare const isAuditEventType: (value: string) => value is AuditEventType;
+export type AuditEvent = {
+    at: number;
+    ip?: string;
+    metadata?: Record<string, unknown>;
+    organizationId?: OrganizationId;
+    type: AuditEventType;
+    userId?: string;
+};
+export type AuditEventFilter = {
+    limit?: number;
+    userId?: string;
+};
+export type AuditSink = {
+    append: (event: AuditEvent) => Promise<void>;
+    list?: (filter?: AuditEventFilter) => Promise<AuditEvent[]>;
+    prune?: (before: number) => Promise<number>;
+};