@ddd-ts-kit/audit 0.0.0-stage → 0.1.1

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+export { AuditReader, AuditTrail } from '@ddd-ts-kit/kernel';
+export type { AuditActor, AuditCategory, AuditChange, AuditChanges, AuditEntry, AuditEntryExtensionValues, AuditEntryExtensions, AuditFilter, AuditJson, AuditOutcome, AuditRecord, AuditResource, AuditScalar, AuditSortField, MaskedValue, } from '@ddd-ts-kit/kernel';
+export type { AuditCheckpoint } from './chain/audit-checkpoint.js';
+export { canonicalize } from './chain/canonicalize.js';
+export { GLOBAL_CHAIN, chainOfTenant } from './chain/chain-of-tenant.js';
+export { GENESIS_HASH } from './chain/genesis-hash.js';
+export { hashOf, type UnsealedEntry } from './chain/hash-of.js';
+export type { SealingOptions } from './chain/sealing-options.js';
+export type { AuditTrailOptions } from './trail/audit-trail-options.js';
+export { InMemoryAuditTrail } from './trail/in-memory-audit-trail.js';
+export type { ChainBreak } from './verify/chain-break.js';
+export type { ChainBreakKind } from './verify/chain-break-kind.js';
+export type { ChainVerification } from './verify/chain-verification.js';
+export { verifyChain, type VerifyChainOptions } from './verify/verify-chain.js';
+export { AuditMasker } from './redaction/audit-masker.js';
+export type { AuditProjection } from './redaction/audit-projection.js';
+export type { AuditedField } from './redaction/audited-field.js';
+export { auditedFields, type AuditedFieldsOptions } from './redaction/audited-fields.js';
+export type { AuditedMessage } from './redaction/audited-message.js';
+export { auditedProjection } from './redaction/audited-projection.js';
+export { hmacMasker, type HmacMaskerOptions } from './redaction/hmac-masker.js';
+export { masked } from './redaction/masked.js';
+export type { MaskedField } from './redaction/masked-field.js';
+export type { MaskingSubject } from './redaction/masking-subject.js';
+export { MissingMaskerError } from './redaction/missing-masker-error.js';
+export type { AllowedReads } from './sources/allowed-reads.js';
+export { auditDecisions, type AuditDecisionsOptions } from './sources/audit-decisions.js';
+export type { AuditFact } from './sources/audit-fact.js';
+export { auditIntegrationEvents, type AuditIntegrationEventsOptions } from './sources/audit-integration-events.js';
+export { UNEXPECTED_ERROR, auditMiddleware, type AuditMiddlewareOptions } from './sources/audit-middleware.js';
+export { auditRecordOf } from './sources/audit-record-of.js';
+export type { AuditSource } from './sources/audit-source.js';
+export type { AuditSubscription } from './sources/audit-subscription.js';
+export type { AuditedEvents } from './sources/audited-events.js';
+export type { AuthorizationDecision } from './sources/authorization-decision.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,UAAU,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+export { AuditReader, AuditTrail } from '@ddd-ts-kit/kernel';
+export { canonicalize } from './chain/canonicalize.js';
+export { GLOBAL_CHAIN, chainOfTenant } from './chain/chain-of-tenant.js';
+export { GENESIS_HASH } from './chain/genesis-hash.js';
+export { hashOf } from './chain/hash-of.js';
+export { InMemoryAuditTrail } from './trail/in-memory-audit-trail.js';
+export { verifyChain } from './verify/verify-chain.js';
+export { AuditMasker } from './redaction/audit-masker.js';
+export { auditedFields } from './redaction/audited-fields.js';
+export { auditedProjection } from './redaction/audited-projection.js';
+export { hmacMasker } from './redaction/hmac-masker.js';
+export { masked } from './redaction/masked.js';
+export { MissingMaskerError } from './redaction/missing-masker-error.js';
+export { auditDecisions } from './sources/audit-decisions.js';
+export { auditIntegrationEvents } from './sources/audit-integration-events.js';
+export { UNEXPECTED_ERROR, auditMiddleware } from './sources/audit-middleware.js';
+export { auditRecordOf } from './sources/audit-record-of.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAmB7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAsB,MAAM,oBAAoB,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,OAAO,EAAE,WAAW,EAA2B,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAG1D,OAAO,EAAE,aAAa,EAA6B,MAAM,+BAA+B,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAA0B,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAG/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAAE,cAAc,EAA8B,MAAM,8BAA8B,CAAC;AAE1F,OAAO,EAAE,sBAAsB,EAAsC,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAA+B,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/knex/create-audit-tables.d.ts

@@ -0,0 +1,9 @@
+import type { Knex } from 'knex';
+import type { AuditTablesOptions } from '../sql/audit-tables-options.js';
+/**
+ * Creates the tables of the trail and the triggers that keep `audit_entries` append-only.
+ * Call it from a migration of the consuming project, which then owns the tables:
+ * `export const up = (knex) => createAuditTables(knex, { schema: 'audit' })`.
+ */
+export declare function createAuditTables(knex: Knex, options?: AuditTablesOptions): Promise<void>;
+//# sourceMappingURL=create-audit-tables.d.ts.map

package/dist/knex/create-audit-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-audit-tables.d.ts","sourceRoot":"","sources":["../../src/knex/create-audit-tables.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAGzE;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAInG"}

package/dist/knex/create-audit-tables.js

@@ -0,0 +1,12 @@
+import { auditTablesSql } from '../sql/audit-tables-sql.js';
+/**
+ * Creates the tables of the trail and the triggers that keep `audit_entries` append-only.
+ * Call it from a migration of the consuming project, which then owns the tables:
+ * `export const up = (knex) => createAuditTables(knex, { schema: 'audit' })`.
+ */
+export async function createAuditTables(knex, options = {}) {
+    for (const statement of auditTablesSql(options)) {
+        await knex.raw(statement);
+    }
+}
+//# sourceMappingURL=create-audit-tables.js.map

package/dist/knex/create-audit-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-audit-tables.js","sourceRoot":"","sources":["../../src/knex/create-audit-tables.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,OAAO,GAAuB,EAAE;IAClF,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/knex/drop-audit-tables.d.ts

@@ -0,0 +1,5 @@
+import type { Knex } from 'knex';
+import type { AuditTablesOptions } from '../sql/audit-tables-options.js';
+/** The `down` of `createAuditTables`: the trail is gone with it. The schema is left in place. */
+export declare function dropAuditTables(knex: Knex, options?: AuditTablesOptions): Promise<void>;
+//# sourceMappingURL=drop-audit-tables.d.ts.map

package/dist/knex/drop-audit-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-audit-tables.d.ts","sourceRoot":"","sources":["../../src/knex/drop-audit-tables.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAGzE,iGAAiG;AACjG,wBAAsB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjG"}

package/dist/knex/drop-audit-tables.js

@@ -0,0 +1,8 @@
+import { dropAuditTablesSql } from '../sql/drop-audit-tables-sql.js';
+/** The `down` of `createAuditTables`: the trail is gone with it. The schema is left in place. */
+export async function dropAuditTables(knex, options = {}) {
+    for (const statement of dropAuditTablesSql(options)) {
+        await knex.raw(statement);
+    }
+}
+//# sourceMappingURL=drop-audit-tables.js.map

package/dist/knex/drop-audit-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-audit-tables.js","sourceRoot":"","sources":["../../src/knex/drop-audit-tables.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAU,EAAE,OAAO,GAAuB,EAAE;IAChF,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/knex/knex-audit-context.d.ts

@@ -0,0 +1,6 @@
+import type { Knex } from 'knex';
+/** The `KnexContext` of `@ddd-ts-kit/knex`, restated structurally: any unit of work of that package fits. */
+export interface KnexAuditContext {
+    executor(): Knex;
+}
+//# sourceMappingURL=knex-audit-context.d.ts.map

package/dist/knex/knex-audit-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex-audit-context.d.ts","sourceRoot":"","sources":["../../src/knex/knex-audit-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,6GAA6G;AAC7G,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,IAAI,IAAI,CAAC;CAClB"}

package/dist/knex/knex-audit-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=knex-audit-context.js.map

package/dist/knex/knex-audit-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex-audit-context.js","sourceRoot":"","sources":["../../src/knex/knex-audit-context.ts"],"names":[],"mappings":""}

package/dist/knex/knex-audit-trail.d.ts

@@ -0,0 +1,14 @@
+import type { AuditTablesOptions } from '../sql/audit-tables-options.js';
+import { PostgresAuditTrail } from '../sql/postgres-audit-trail.js';
+import type { AuditTrailOptions } from '../trail/audit-trail-options.js';
+import type { KnexAuditContext } from './knex-audit-context.js';
+export interface KnexAuditTrailOptions extends AuditTrailOptions, AuditTablesOptions {
+}
+/**
+ * The audit trail on PostgreSQL through knex. It writes on the executor of the context: inside
+ * a unit of work the entry commits or rolls back with it, outside it is written at once.
+ */
+export declare class KnexAuditTrail extends PostgresAuditTrail {
+    constructor(context: KnexAuditContext, options?: KnexAuditTrailOptions);
+}
+//# sourceMappingURL=knex-audit-trail.d.ts.map

package/dist/knex/knex-audit-trail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex-audit-trail.d.ts","sourceRoot":"","sources":["../../src/knex/knex-audit-trail.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB,EAAE,kBAAkB;CAAG;AAEvF;;;GAGG;AACH,qBAAa,cAAe,SAAQ,kBAAkB;IACpD,YAAY,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,qBAA0B,EAEzE;CACF"}

package/dist/knex/knex-audit-trail.js

@@ -0,0 +1,22 @@
+import { auditTables } from '../sql/audit-tables.js';
+import { PostgresAuditTrail } from '../sql/postgres-audit-trail.js';
+import { rowsOf } from '../sql/rows-of.js';
+/**
+ * The audit trail on PostgreSQL through knex. It writes on the executor of the context: inside
+ * a unit of work the entry commits or rolls back with it, outside it is written at once.
+ */
+export class KnexAuditTrail extends PostgresAuditTrail {
+    constructor(context, options = {}) {
+        super(() => sessionOn(context.executor()), auditTables(options), options);
+    }
+}
+function sessionOn(knex) {
+    return {
+        query: async (statement) => rowsOf(await knex.raw(statement.strings.join('?'), bindingsOf(statement))),
+        transaction: (work) => knex.transaction((transaction) => work(sessionOn(transaction))),
+    };
+}
+function bindingsOf(statement) {
+    return statement.values.map((value) => (typeof value === 'number' || typeof value === 'string' ? value : null));
+}
+//# sourceMappingURL=knex-audit-trail.js.map

package/dist/knex/knex-audit-trail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex-audit-trail.js","sourceRoot":"","sources":["../../src/knex/knex-audit-trail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAQ3C;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,kBAAkB;IACpD,YAAY,OAAyB,EAAE,OAAO,GAA0B,EAAE;QACxE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACtG,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,SAAc;IAChC,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClH,CAAC"}

package/dist/knex.d.ts

@@ -0,0 +1,6 @@
+export type { AuditTablesOptions } from './sql/audit-tables-options.js';
+export { createAuditTables } from './knex/create-audit-tables.js';
+export { dropAuditTables } from './knex/drop-audit-tables.js';
+export type { KnexAuditContext } from './knex/knex-audit-context.js';
+export { KnexAuditTrail, type KnexAuditTrailOptions } from './knex/knex-audit-trail.js';
+//# sourceMappingURL=knex.d.ts.map

package/dist/knex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex.d.ts","sourceRoot":"","sources":["../src/knex.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/knex.js

@@ -0,0 +1,4 @@
+export { createAuditTables } from './knex/create-audit-tables.js';
+export { dropAuditTables } from './knex/drop-audit-tables.js';
+export { KnexAuditTrail } from './knex/knex-audit-trail.js';
+//# sourceMappingURL=knex.js.map

package/dist/knex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex.js","sourceRoot":"","sources":["../src/knex.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,cAAc,EAA8B,MAAM,4BAA4B,CAAC"}

package/dist/redaction/audit-masker.d.ts

@@ -0,0 +1,8 @@
+import type { AuditScalar } from '@ddd-ts-kit/kernel';
+import type { MaskingSubject } from './masking-subject.js';
+/** Turns a value into a token that is equal for equal values and says nothing else. */
+export declare abstract class AuditMasker {
+    static readonly tokenKey = "audit.AuditMasker";
+    abstract mask(value: AuditScalar, subject: MaskingSubject): string | Promise<string>;
+}
+//# sourceMappingURL=audit-masker.d.ts.map

package/dist/redaction/audit-masker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-masker.d.ts","sourceRoot":"","sources":["../../src/redaction/audit-masker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,uFAAuF;AACvF,8BAAsB,WAAW;IAC/B,MAAM,CAAC,QAAQ,CAAC,QAAQ,uBAAuB;IAE/C,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtF"}

package/dist/redaction/audit-masker.js

@@ -0,0 +1,5 @@
+/** Turns a value into a token that is equal for equal values and says nothing else. */
+export class AuditMasker {
+    static tokenKey = 'audit.AuditMasker';
+}
+//# sourceMappingURL=audit-masker.js.map

package/dist/redaction/audit-masker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-masker.js","sourceRoot":"","sources":["../../src/redaction/audit-masker.ts"],"names":[],"mappings":"AAGA,uFAAuF;AACvF,MAAM,OAAgB,WAAW;IAC/B,MAAM,CAAU,QAAQ,GAAG,mBAAmB,CAAC;CAGhD"}

package/dist/redaction/audit-projection.d.ts

@@ -0,0 +1,13 @@
+import type { AuditResource } from '@ddd-ts-kit/kernel';
+/**
+ * What a projector chooses to keep of its subject: values in the clear, values to mask, and
+ * nothing else. A value that is not a string, a number, a boolean, `null`, a bigint or a date
+ * is left out: an object is never stored whole.
+ */
+export interface AuditProjection {
+    readonly plain?: Readonly<Record<string, unknown>>;
+    readonly masked?: Readonly<Record<string, unknown>>;
+    readonly resource?: AuditResource;
+    readonly context?: string;
+}
+//# sourceMappingURL=audit-projection.d.ts.map

package/dist/redaction/audit-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-projection.d.ts","sourceRoot":"","sources":["../../src/redaction/audit-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/redaction/audit-projection.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-projection.js.map

package/dist/redaction/audit-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-projection.js","sourceRoot":"","sources":["../../src/redaction/audit-projection.ts"],"names":[],"mappings":""}

package/dist/redaction/audited-field.d.ts

@@ -0,0 +1,3 @@
+import type { MaskedField } from './masked-field.js';
+export type AuditedField<Name extends string = string> = Name | MaskedField<Name>;
+//# sourceMappingURL=audited-field.d.ts.map

package/dist/redaction/audited-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-field.d.ts","sourceRoot":"","sources":["../../src/redaction/audited-field.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,MAAM,YAAY,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,IAAI,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC"}

package/dist/redaction/audited-field.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audited-field.js.map

package/dist/redaction/audited-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-field.js","sourceRoot":"","sources":["../../src/redaction/audited-field.ts"],"names":[],"mappings":""}

package/dist/redaction/audited-fields.d.ts

@@ -0,0 +1,16 @@
+import type { AuditResource, Message, MessageType } from '@ddd-ts-kit/kernel';
+import type { AuditedField } from './audited-field.js';
+import type { AuditedMessage } from './audited-message.js';
+export interface AuditedFieldsOptions<M> {
+    /** The element the message is about. */
+    readonly resource?: (message: M) => AuditResource;
+    /** Name of the bounded context the message belongs to. */
+    readonly context?: string;
+}
+/**
+ * Declares, next to the use case and without touching it, which fields of a command or query
+ * go into its audit entry: `auditedFields(RescheduleCommand, ['status', masked('patientEmail')])`.
+ * A field that is not listed is never recorded.
+ */
+export declare function auditedFields<M extends Message>(type: MessageType<M>, fields: readonly AuditedField<keyof M & string>[], options?: AuditedFieldsOptions<M>): AuditedMessage;
+//# sourceMappingURL=audited-fields.d.ts.map

package/dist/redaction/audited-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-fields.d.ts","sourceRoot":"","sources":["../../src/redaction/audited-fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACrC,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,aAAa,CAAC;IAElD,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAC7C,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EACpB,MAAM,EAAE,SAAS,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,EACjD,OAAO,GAAE,oBAAoB,CAAC,CAAC,CAAM,GACpC,cAAc,CAShB"}

package/dist/redaction/audited-fields.js

@@ -0,0 +1,24 @@
+/**
+ * Declares, next to the use case and without touching it, which fields of a command or query
+ * go into its audit entry: `auditedFields(RescheduleCommand, ['status', masked('patientEmail')])`.
+ * A field that is not listed is never recorded.
+ */
+export function auditedFields(type, fields, options = {}) {
+    const plain = fields.filter((field) => typeof field === 'string');
+    const toMask = fields.filter((field) => typeof field !== 'string').map(({ field }) => field);
+    return {
+        type,
+        masks: toMask.length > 0,
+        project: (message) => (message instanceof type ? projectionOf(message, { plain, toMask }, options) : {}),
+    };
+}
+function projectionOf(message, fields, options) {
+    const resource = options.resource?.(message);
+    return {
+        plain: Object.fromEntries(fields.plain.map((field) => [field, message[field]])),
+        masked: Object.fromEntries(fields.toMask.map((field) => [field, message[field]])),
+        ...(resource === undefined ? {} : { resource }),
+        ...(options.context === undefined ? {} : { context: options.context }),
+    };
+}
+//# sourceMappingURL=audited-fields.js.map

package/dist/redaction/audited-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-fields.js","sourceRoot":"","sources":["../../src/redaction/audited-fields.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAoB,EACpB,MAAiD,EACjD,OAAO,GAA4B,EAAE;IAErC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAE7F,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzG,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAI,OAAU,EAAE,MAAyB,EAAE,OAAgC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC"}

package/dist/redaction/audited-message.d.ts

@@ -0,0 +1,9 @@
+import type { Message, MessageType } from '@ddd-ts-kit/kernel';
+import type { AuditProjection } from './audit-projection.js';
+/** The declaration of one command or query, read by `auditMiddleware`. */
+export interface AuditedMessage {
+    readonly type: MessageType<Message>;
+    readonly masks: boolean;
+    project(message: Message): AuditProjection;
+}
+//# sourceMappingURL=audited-message.d.ts.map

package/dist/redaction/audited-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-message.d.ts","sourceRoot":"","sources":["../../src/redaction/audited-message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAExB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAAC;CAC5C"}

package/dist/redaction/audited-message.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audited-message.js.map

package/dist/redaction/audited-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-message.js","sourceRoot":"","sources":["../../src/redaction/audited-message.ts"],"names":[],"mappings":""}

package/dist/redaction/audited-projection.d.ts

@@ -0,0 +1,10 @@
+import type { Message, MessageType } from '@ddd-ts-kit/kernel';
+import type { AuditProjection } from './audit-projection.js';
+import type { AuditedMessage } from './audited-message.js';
+/**
+ * The same declaration for a message whose audited values are not its own fields: the
+ * projector picks them, and names the ones to mask.
+ * `auditedProjection(ExportCommand, (command) => ({ plain: { format: command.options.format } }))`.
+ */
+export declare function auditedProjection<M extends Message>(type: MessageType<M>, project: (message: M) => AuditProjection): AuditedMessage;
+//# sourceMappingURL=audited-projection.d.ts.map

package/dist/redaction/audited-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-projection.d.ts","sourceRoot":"","sources":["../../src/redaction/audited-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EACjD,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EACpB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,eAAe,GACvC,cAAc,CAEhB"}

package/dist/redaction/audited-projection.js

@@ -0,0 +1,9 @@
+/**
+ * The same declaration for a message whose audited values are not its own fields: the
+ * projector picks them, and names the ones to mask.
+ * `auditedProjection(ExportCommand, (command) => ({ plain: { format: command.options.format } }))`.
+ */
+export function auditedProjection(type, project) {
+    return { type, masks: false, project: (message) => (message instanceof type ? project(message) : {}) };
+}
+//# sourceMappingURL=audited-projection.js.map

package/dist/redaction/audited-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-projection.js","sourceRoot":"","sources":["../../src/redaction/audited-projection.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAoB,EACpB,OAAwC;IAExC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC"}

package/dist/redaction/changes-of.d.ts

@@ -0,0 +1,11 @@
+import type { AuditChanges } from '@ddd-ts-kit/kernel';
+import type { AuditMasker } from './audit-masker.js';
+import type { AuditProjection } from './audit-projection.js';
+import type { MaskingSubject } from './masking-subject.js';
+export interface Redaction {
+    readonly masker?: AuditMasker;
+    readonly subject: Omit<MaskingSubject, 'field'>;
+}
+/** The `changes` of an entry, or `undefined` when the projection kept nothing. */
+export declare function changesOf(projection: AuditProjection, redaction: Redaction): Promise<AuditChanges | undefined>;
+//# sourceMappingURL=changes-of.d.ts.map

package/dist/redaction/changes-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-of.d.ts","sourceRoot":"","sources":["../../src/redaction/changes-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,YAAY,EAAe,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;CACjD;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAoBpH"}

package/dist/redaction/changes-of.js

@@ -0,0 +1,37 @@
+import { MissingMaskerError } from './missing-masker-error.js';
+/** The `changes` of an entry, or `undefined` when the projection kept nothing. */
+export async function changesOf(projection, redaction) {
+    const changes = {};
+    for (const [field, value] of Object.entries(projection.plain ?? {})) {
+        const scalar = scalarOf(value);
+        if (scalar !== undefined) {
+            changes[field] = scalar;
+        }
+    }
+    for (const [field, value] of Object.entries(projection.masked ?? {})) {
+        const scalar = scalarOf(value);
+        if (scalar !== undefined) {
+            changes[field] = await maskOf(scalar, field, redaction);
+        }
+    }
+    return Object.keys(changes).length === 0 ? undefined : changes;
+}
+function scalarOf(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean') {
+        return value;
+    }
+    if (typeof value === 'number') {
+        return Number.isFinite(value) ? value : undefined;
+    }
+    if (typeof value === 'bigint') {
+        return value.toString();
+    }
+    return value instanceof Date ? value.toISOString() : undefined;
+}
+async function maskOf(value, field, { masker, subject }) {
+    if (masker === undefined) {
+        throw new MissingMaskerError(field);
+    }
+    return { masked: await masker.mask(value, { ...subject, field }) };
+}
+//# sourceMappingURL=changes-of.js.map

package/dist/redaction/changes-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-of.js","sourceRoot":"","sources":["../../src/redaction/changes-of.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAO/D,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA2B,EAAE,SAAoB;IAC/E,MAAM,OAAO,GAAgC,EAAE,CAAC;IAEhD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAkB,EAAE,KAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAa;IACrF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC"}

package/dist/redaction/hmac-masker.d.ts

@@ -0,0 +1,12 @@
+import type { AuditMasker } from './audit-masker.js';
+export interface HmacMaskerOptions {
+    /** Written before the hash (`<keyId>:<hex>`), so that a rotated key can be told apart. */
+    readonly keyId?: string;
+}
+/**
+ * HMAC-SHA-256 of the canonical form of the value, under one secret. Without the secret a
+ * mask cannot be computed again, so a guess cannot be checked: destroying the secret makes
+ * every mask it produced meaningless.
+ */
+export declare function hmacMasker(secret: string | Uint8Array, options?: HmacMaskerOptions): AuditMasker;
+//# sourceMappingURL=hmac-masker.d.ts.map

package/dist/redaction/hmac-masker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac-masker.d.ts","sourceRoot":"","sources":["../../src/redaction/hmac-masker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,GAAE,iBAAsB,GAAG,WAAW,CAMpG"}

package/dist/redaction/hmac-masker.js

@@ -0,0 +1,14 @@
+import { createHmac } from 'node:crypto';
+import { canonicalize } from '../chain/canonicalize.js';
+/**
+ * HMAC-SHA-256 of the canonical form of the value, under one secret. Without the secret a
+ * mask cannot be computed again, so a guess cannot be checked: destroying the secret makes
+ * every mask it produced meaningless.
+ */
+export function hmacMasker(secret, options = {}) {
+    const prefix = options.keyId === undefined ? '' : `${options.keyId}:`;
+    return {
+        mask: (value) => `${prefix}${createHmac('sha256', secret).update(canonicalize(value), 'utf8').digest('hex')}`,
+    };
+}
+//# sourceMappingURL=hmac-masker.js.map

package/dist/redaction/hmac-masker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac-masker.js","sourceRoot":"","sources":["../../src/redaction/hmac-masker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAQxD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAE,OAAO,GAAsB,EAAE;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;IAEtE,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;KAC9G,CAAC;AACJ,CAAC"}

package/dist/redaction/masked-field.d.ts

@@ -0,0 +1,6 @@
+/** A declared field whose value is stored as a keyed hash: for personal data. */
+export interface MaskedField<Name extends string = string> {
+    readonly field: Name;
+    readonly masked: true;
+}
+//# sourceMappingURL=masked-field.d.ts.map

package/dist/redaction/masked-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"masked-field.d.ts","sourceRoot":"","sources":["../../src/redaction/masked-field.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACvD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB"}

package/dist/redaction/masked-field.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=masked-field.js.map

package/dist/redaction/masked-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masked-field.js","sourceRoot":"","sources":["../../src/redaction/masked-field.ts"],"names":[],"mappings":""}

package/dist/redaction/masked.d.ts

@@ -0,0 +1,3 @@
+import type { MaskedField } from './masked-field.js';
+export declare function masked<Name extends string>(field: Name): MaskedField<Name>;
+//# sourceMappingURL=masked.d.ts.map

package/dist/redaction/masked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"masked.d.ts","sourceRoot":"","sources":["../../src/redaction/masked.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,MAAM,CAAC,IAAI,SAAS,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAE1E"}

package/dist/redaction/masked.js

@@ -0,0 +1,4 @@
+export function masked(field) {
+    return { field, masked: true };
+}
+//# sourceMappingURL=masked.js.map

package/dist/redaction/masked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masked.js","sourceRoot":"","sources":["../../src/redaction/masked.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,MAAM,CAAsB,KAAW;IACrD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/redaction/masking-subject.d.ts

@@ -0,0 +1,9 @@
+import type { AuditResource } from '@ddd-ts-kit/kernel';
+/** What a masker may read to choose its key: identifiers of the entry being written. */
+export interface MaskingSubject {
+    readonly field: string;
+    readonly actorId: string;
+    readonly tenantId?: string;
+    readonly resource?: AuditResource;
+}
+//# sourceMappingURL=masking-subject.d.ts.map

package/dist/redaction/masking-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"masking-subject.d.ts","sourceRoot":"","sources":["../../src/redaction/masking-subject.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;CACnC"}

package/dist/redaction/masking-subject.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=masking-subject.js.map

package/dist/redaction/masking-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"masking-subject.js","sourceRoot":"","sources":["../../src/redaction/masking-subject.ts"],"names":[],"mappings":""}

package/dist/redaction/missing-masker-error.d.ts

@@ -0,0 +1,5 @@
+/** A projection asks for a mask and no masker was given: a wiring mistake. */
+export declare class MissingMaskerError extends Error {
+    constructor(field: string);
+}
+//# sourceMappingURL=missing-masker-error.d.ts.map

package/dist/redaction/missing-masker-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-masker-error.d.ts","sourceRoot":"","sources":["../../src/redaction/missing-masker-error.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,KAAK,EAAE,MAAM,EAGxB;CACF"}

package/dist/redaction/missing-masker-error.js

@@ -0,0 +1,8 @@
+/** A projection asks for a mask and no masker was given: a wiring mistake. */
+export class MissingMaskerError extends Error {
+    constructor(field) {
+        super(`The audited field "${field}" is declared masked and no masker was given`);
+        this.name = 'MissingMaskerError';
+    }
+}
+//# sourceMappingURL=missing-masker-error.js.map

package/dist/redaction/missing-masker-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-masker-error.js","sourceRoot":"","sources":["../../src/redaction/missing-masker-error.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,KAAa;QACvB,KAAK,CAAC,sBAAsB,KAAK,8CAA8C,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/search/comparing.d.ts

@@ -0,0 +1,8 @@
+import type { CursorPosition } from './cursor-position.js';
+import type { SearchOrder } from './search-order.js';
+/**
+ * The comparison of an order, between two entries or between an entry and the position a
+ * cursor names: negative when `left` comes first in that order.
+ */
+export declare function comparing(order: SearchOrder): (left: CursorPosition, right: CursorPosition) => number;
+//# sourceMappingURL=comparing.d.ts.map

package/dist/search/comparing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comparing.d.ts","sourceRoot":"","sources":["../../src/search/comparing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,MAAM,CAIrG"}