@antasphere/chassis-server 1.0.0

package/dist/audit/filters.js

@@ -0,0 +1,97 @@
+import { and, eq, gte, ilike, inArray, isNull, like, lte, or } from 'drizzle-orm';
+import { AUDIT_ACTOR_SYSTEM } from '@antasphere/chassis-contract';
+import { auditLog, user as userTable } from '@antasphere/chassis-db';
+/**
+ * The audit list's WHERE, from the validated query. Every value arrives as
+ * a bound parameter (drizzle's `eq`/`like`/`ilike` never interpolate), and
+ * the free-text ones are escaped as LIKE patterns first, so a `%` or `_` in
+ * what the admin typed matches itself rather than anything.
+ */
+/** A LIKE pattern for "contains this text", the wildcards of the text itself escaped. */
+export function escapeLike(value) {
+    return value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+}
+/**
+ * The `action` list, split and de-duplicated: an item ending in `.` is a
+ * family (a prefix), any other item is one action. The contract has already
+ * bounded the count and the alphabet; empty items are dropped here.
+ */
+export function parseActionList(value) {
+    const exact = new Set();
+    const families = new Set();
+    for (const raw of value.split(',')) {
+        const item = raw.trim();
+        if (!item)
+            continue;
+        if (item.endsWith('.'))
+            families.add(item);
+        else
+            exact.add(item);
+    }
+    return { exact: [...exact], families: [...families] };
+}
+/** The `actorVia` list, split and de-duplicated (the contract pinned the alphabet). */
+export function parseViaList(value) {
+    return [...new Set(value.split(',').map((v) => v.trim()))].filter((v) => ['session', 'api_key', 'oauth', 'system'].includes(v));
+}
+/**
+ * The cursor, or null when absent, malformed or out of range. Malformed
+ * cursors serve page 1; out-of-range ones are refused the same way, since
+ * Number('99999999999999999999') is finite but past bigint precision, and
+ * sending it to the `lt(id, …)` comparison overflows in Postgres.
+ * Safe-integer is the honest bound for a JS-roundtripped bigserial id.
+ */
+export function cursorId(cursor) {
+    const parsed = cursor ? Number(cursor) : null;
+    return parsed !== null && Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+}
+/**
+ * The filter conditions (the workspace scope and the cursor are the
+ * caller's): one AND-ed list, each member a parameterised comparison.
+ * Returns an empty list when nothing filters.
+ */
+export function auditFilterConditions(query) {
+    const conditions = [];
+    if (query.q) {
+        const pattern = `%${escapeLike(query.q)}%`;
+        const either = or(ilike(userTable.email, pattern), ilike(auditLog.action, pattern));
+        if (either)
+            conditions.push(either);
+    }
+    if (query.action) {
+        const { exact, families } = parseActionList(query.action);
+        const alternatives = [];
+        if (exact.length)
+            alternatives.push(inArray(auditLog.action, exact));
+        for (const family of families)
+            alternatives.push(like(auditLog.action, `${escapeLike(family)}%`));
+        const anyOf = alternatives.length ? or(...alternatives) : undefined;
+        if (anyOf)
+            conditions.push(anyOf);
+    }
+    if (query.actorVia) {
+        const vias = parseViaList(query.actorVia);
+        if (vias.length)
+            conditions.push(inArray(auditLog.actorVia, vias));
+    }
+    if (query.actor) {
+        conditions.push(query.actor === AUDIT_ACTOR_SYSTEM
+            ? isNull(auditLog.actorUserId)
+            : eq(auditLog.actorUserId, query.actor));
+    }
+    if (query.resourceType)
+        conditions.push(eq(auditLog.resourceType, query.resourceType));
+    if (query.resourceId)
+        conditions.push(eq(auditLog.resourceId, query.resourceId));
+    if (query.from)
+        conditions.push(gte(auditLog.createdAt, new Date(query.from)));
+    if (query.to)
+        conditions.push(lte(auditLog.createdAt, new Date(query.to)));
+    return conditions;
+}
+/** The whole WHERE: the scope, the filters, and the keyset cursor when there is one. */
+export function auditWhere(scope, filters, cursor) {
+    const all = [scope, ...filters, ...(cursor ? [cursor] : [])];
+    return and(...all) ?? scope;
+}
+//# sourceMappingURL=filters.js.map

package/dist/audit/filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filters.js","sourceRoot":"","sources":["../../src/audit/filters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAY,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAsC,MAAM,8BAA8B,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAErE;;;;;GAKG;AAEH,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;YACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CACrF,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,MAA0B;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,MAAM,UAAU,GAAU,EAAE,CAAC;IAE7B,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM;YAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,MAAM,IAAI,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CACb,KAAK,CAAC,KAAK,KAAK,kBAAkB;YAChC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9B,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,YAAY;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,UAAU;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3E,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,KAAU,EAAE,OAAc,EAAE,MAAkB;IACvE,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC;AAC9B,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,3 @@
+export { auditFilterConditions, auditWhere, cursorId, escapeLike, parseActionList, parseViaList } from './filters.js';
+export { AuditService, type AuditWrite, auditMiddleware } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,3 @@
+export { auditFilterConditions, auditWhere, cursorId, escapeLike, parseActionList, parseViaList } from './filters.js';
+export { AuditService, auditMiddleware } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAmB,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/audit/service.d.ts

@@ -0,0 +1,65 @@
+import { type Db } from '@antasphere/chassis-db';
+import type { Principal } from '@antasphere/chassis-contract';
+import type { Context, MiddlewareHandler } from 'hono';
+import type { Logger } from '../logger.js';
+declare module 'hono' {
+    interface ContextVariableMap {
+        /** Set by domain handlers to give the audit entry real semantics. */
+        audit?: {
+            action: string;
+            resourceType: string;
+            resourceId?: string;
+            metadata?: Record<string, unknown>;
+        };
+    }
+}
+/**
+ * The attributed actor of an audit row — the subset of Principal the log
+ * records. A full Principal satisfies it structurally; surfaces whose actor
+ * holds no workspace-scoped principal (break-glass) build it directly.
+ */
+export interface AuditActor {
+    userId: string;
+    via: Principal['via'];
+    apiKeyId?: string | undefined;
+}
+export interface AuditWrite {
+    /** null = INSTANCE-attributed: the event belongs to no workspace (ADR 014). */
+    workspaceId: string | null;
+    principal: AuditActor | null;
+    action: string;
+    resourceType: string;
+    resourceId?: string | undefined;
+    requestId?: string | undefined;
+    ip?: string | undefined;
+    metadata?: Record<string, unknown> | undefined;
+}
+export declare class AuditService {
+    private readonly db;
+    private readonly logger;
+    constructor(db: Db, logger: Logger);
+    /**
+     * Awaited on privileged mutations — durability over latency when healthy.
+     * Best-effort by contract: the handler's mutation has already committed by
+     * the time this runs, so a failed insert must never turn into a 500 (a
+     * retried non-idempotent POST would double-create). Failure = logged loss.
+     */
+    write(entry: AuditWrite): Promise<void>;
+}
+export interface AuditMiddlewareOptions {
+    /** Extra paths the TOOL exempts from the generic audit row, beside the chassis ones. */
+    exempt?: (path: string) => boolean;
+}
+/**
+ * One write point for the audit trail, after the handler:
+ *  - every authenticated MUTATION lands one row (awaited — durability is
+ *    part of the mutation);
+ *  - every MACHINE-principal request lands one row, reads included
+ *    (exit criterion 4: a curl with an API key must appear in the log with
+ *    the key's identity — keys mostly read, so read auditing is what makes
+ *    that true). Session reads stay unaudited (noise).
+ * Handlers add semantics via c.set('audit', ...); without it the row records
+ * method + path.
+ */
+export declare function auditMiddleware(audit: AuditService, clientIp: (c: Context) => string, options?: AuditMiddlewareOptions): MiddlewareHandler;
+//# sourceMappingURL=service.d.ts.map

package/dist/audit/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,qEAAqE;QACrE,KAAK,CAAC,EAAE;YACN,MAAM,EAAE,MAAM,CAAC;YACf,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACpC,CAAC;KACH;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM;IAGjC;;;;;OAKG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAqB9C;AAED,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,EAChC,OAAO,GAAE,sBAA2B,GACnC,iBAAiB,CA6BnB"}

package/dist/audit/service.js

@@ -0,0 +1,103 @@
+import { auditLog } from '@antasphere/chassis-db';
+export class AuditService {
+    db;
+    logger;
+    constructor(db, logger) {
+        this.db = db;
+        this.logger = logger;
+    }
+    /**
+     * Awaited on privileged mutations — durability over latency when healthy.
+     * Best-effort by contract: the handler's mutation has already committed by
+     * the time this runs, so a failed insert must never turn into a 500 (a
+     * retried non-idempotent POST would double-create). Failure = logged loss.
+     */
+    async write(entry) {
+        try {
+            await this.db.insert(auditLog).values({
+                workspaceId: entry.workspaceId,
+                actorUserId: entry.principal?.userId ?? null,
+                actorVia: entry.principal?.via ?? 'system',
+                apiKeyId: entry.principal?.apiKeyId ?? null,
+                action: entry.action,
+                resourceType: entry.resourceType,
+                resourceId: entry.resourceId ?? null,
+                requestId: entry.requestId ?? null,
+                ip: entry.ip ?? null,
+                metadata: entry.metadata ?? null
+            });
+        }
+        catch (err) {
+            this.logger.error({ err, action: entry.action, requestId: entry.requestId }, 'audit write failed — the audited mutation was NOT rolled back');
+        }
+    }
+}
+const MUTATING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** Paths whose mutations are not audited here (they audit themselves or are credential machinery). */
+function isAuditExempt(path, extraExempt) {
+    return (path.startsWith('/api/v1/auth/') ||
+        path === '/api/v1/setup' ||
+        path === '/api/v1/invitations/accept' ||
+        // Workspace creation self-audits into the NEW workspace's own trail
+        // (api/workspaces.ts). The generic row would land in the workspace the
+        // person happened to be in — and a workspace never learns what its
+        // members do elsewhere.
+        path === '/api/v1/workspaces' ||
+        // The person's default workspace (api/workspaces.ts, PRDCT-2815) is a
+        // setting of the PERSON: the generic row would land in the trail of
+        // whichever workspace the request resolved to, for its admins to read.
+        // The one machine-reachable exemption: the handler logs the change (the
+        // person, the credential kind) on the server log instead.
+        path === '/api/v1/me/default-workspace' ||
+        // The tool's own exemptions (AuditMiddlewareOptions.exempt), evaluated
+        // at the place they have always had in this chain.
+        extraExempt(path) ||
+        // Break-glass self-audits with before/after detail — and its callers may
+        // hold a session WITHOUT a membership (principal null), which this
+        // middleware could not attribute anyway.
+        path.startsWith('/api/v1/admin/break-glass/'));
+}
+/**
+ * One write point for the audit trail, after the handler:
+ *  - every authenticated MUTATION lands one row (awaited — durability is
+ *    part of the mutation);
+ *  - every MACHINE-principal request lands one row, reads included
+ *    (exit criterion 4: a curl with an API key must appear in the log with
+ *    the key's identity — keys mostly read, so read auditing is what makes
+ *    that true). Session reads stay unaudited (noise).
+ * Handlers add semantics via c.set('audit', ...); without it the row records
+ * method + path.
+ */
+export function auditMiddleware(audit, clientIp, options = {}) {
+    const extraExempt = options.exempt ?? (() => false);
+    return async (c, next) => {
+        await next();
+        if (isAuditExempt(c.req.path, extraExempt))
+            return;
+        const principal = c.get('principal');
+        if (!principal)
+            return;
+        if (c.res.status >= 400)
+            return;
+        const isMutation = MUTATING.has(c.req.method);
+        const isMachine = principal.via !== 'session';
+        if (!isMutation && !isMachine)
+            return;
+        const info = c.get('audit');
+        // Demo sign-in: set by the credential resolver when the session was
+        // opened by a demo pass, so the trail tells what was done through a demo
+        // link from what the person did themselves.
+        const demoPassId = c.get('demoPassId');
+        await audit.write({
+            workspaceId: principal.workspaceId,
+            principal,
+            action: info?.action ?? `${c.req.method.toLowerCase()} ${c.req.path}`,
+            resourceType: info?.resourceType ?? 'http',
+            resourceId: info?.resourceId,
+            requestId: c.get('requestId'),
+            ip: clientIp(c),
+            metadata: demoPassId ? { ...info?.metadata, demoPassId } : info?.metadata
+        });
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/audit/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAW,MAAM,wBAAwB,CAAC;AAwC3D,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,EAAM,EACN,MAAc;QADd,OAAE,GAAF,EAAE,CAAI;QACN,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI;gBAC5C,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,QAAQ;gBAC1C,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,IAAI;gBAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EACzD,+DAA+D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAOD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7D,sGAAsG;AACtG,SAAS,aAAa,CAAC,IAAY,EAAE,WAAsC;IACzE,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAChC,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,4BAA4B;QACrC,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,wBAAwB;QACxB,IAAI,KAAK,oBAAoB;QAC7B,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,KAAK,8BAA8B;QACvC,uEAAuE;QACvE,mDAAmD;QACnD,WAAW,CAAC,IAAI,CAAC;QACjB,yEAAyE;QACzE,mEAAmE;QACnE,yCAAyC;QACzC,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAmB,EACnB,QAAgC,EAChC,UAAkC,EAAE;IAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO;QACnD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAEhC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC;QAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO;QAEtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,oEAAoE;QACpE,yEAAyE;QACzE,4CAA4C;QAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,KAAK,CAAC;YAChB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;YACrE,YAAY,EAAE,IAAI,EAAE,YAAY,IAAI,MAAM;YAC1C,UAAU,EAAE,IAAI,EAAE,UAAU;YAC5B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YACf,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/boot.d.ts

@@ -0,0 +1,8 @@
+import type { z } from 'zod';
+import { type BootOverrides, type BootResult, type ToolDefinition } from './tool-definition.js';
+/**
+ * The boot sequence, in its locked order: env → logger → db probe → secret →
+ * migrations under advisory lock → app assembly → ready.
+ */
+export declare function bootPlatform<TEnvShape extends z.ZodRawShape, TDomain, TBuckets extends string, TEvents, TToolOverrides>(tool: ToolDefinition<TEnvShape, TDomain, TBuckets, TEvents, TToolOverrides>, source?: NodeJS.ProcessEnv, overrides?: BootOverrides<TToolOverrides>): Promise<BootResult<TEnvShape, TDomain, TEvents>>;
+//# sourceMappingURL=boot.d.ts.map

package/dist/boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.d.ts","sourceRoot":"","sources":["../src/boot.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwD7B,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,UAAU,EAGf,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAE9B;;;GAGG;AACH,wBAAsB,YAAY,CAChC,SAAS,SAAS,CAAC,CAAC,WAAW,EAC/B,OAAO,EACP,QAAQ,SAAS,MAAM,EACvB,OAAO,EACP,cAAc,EAEd,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,EAC3E,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,SAAS,GAAE,aAAa,CAAC,cAAc,CAAM,GAC5C,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAo2BlD"}