@ddd-ts-kit/audit 0.6.0 → 0.8.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gary Bourgeat
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -179,6 +179,23 @@ When the decision concerns another actor than the one of the execution context (
 sending a command on behalf of a user), the entry names the actor of the decision with type
 `unknown`: its type and tenant are not in what the hook receives.
 
+### a'. Refusals at the edge
+
+A request a guard refuses (`HasRole`, `HasScope`, `TenantMember`, a tenant the caller does not
+belong to) never reaches a use case, so the authorization middleware does not see it. The HTTP
+pipeline reports it to `onGuardRefusal`, and `auditGuardRefusals(trail, { clock, ids })` records
+it: category `authorization`, action `http:<operationId>`, outcome `denied`, the code of the
+refusal as `reason` (`FORBIDDEN`, `UNAUTHORIZED`), and the actor, session, tenant and correlation
+of the request. A caller without a credential is not recorded: it is no one to hold to account,
+the tenant it addressed is its own choice, and recording it would let unauthenticated traffic
+write to the trail (and open hash chains) without bound; those refusals belong to the access log
+and to rate limiting. A recorded refusal is in the tenant of the caller's credential. A guard
+that fails instead of refusing (a lookup that threw, not a `DomainError`) is not reported.
+
+```ts
+mountExpress(app, routes, { ...boundary, onGuardRefusal: auditGuardRefusals(trail, { clock, ids }) });
+```
+
 ### b. Commands, and the unit of work
 
 `auditMiddleware` records each command with outcome `succeeded` or `failed`, and the `code` of
@@ -535,6 +552,12 @@ kernel, which `application/` may import, and receives the store bound to it. It
 filter to the tenant of the actor (an access scope computed by the authorizer), so one tenant
 never lists another's entries.
 
+In a multi-tenant project, bind `new TenantAuditReader(store, executionScope)` to
+`AuditReader` instead of the store itself: every search is then confined to the tenant of the
+work whatever its filter says (a filter naming another tenant or another chain finds nothing),
+platform staff read across tenants only under an elevation (`acrossTenants` of the kernel, itself
+recorded), and work that names neither is refused (`NoCurrentTenantError`).
+
 ## Limits
 
 - **PostgreSQL only** for the SQL stores: row locks, row comparison for cursors, `jsonb`,

package/dist/index.d.ts

@@ -25,6 +25,8 @@ export type { MaskingSubject } from './redaction/masking-subject.js';
 export { MissingMaskerError } from './redaction/missing-masker-error.js';
 export type { AllowedReads } from './sources/allowed-reads.js';
 export { auditDecisions, type AuditDecisionsOptions } from './sources/audit-decisions.js';
+export { auditGuardRefusals } from './sources/audit-guard-refusals.js';
+export type { GuardRefusalOfARoute } from './sources/guard-refusal-of-a-route.js';
 export type { AuditFact } from './sources/audit-fact.js';
 export { auditIntegrationEvents, type AuditIntegrationEventsOptions } from './sources/audit-integration-events.js';
 export { UNEXPECTED_ERROR, auditMiddleware, type AuditMiddlewareOptions } from './sources/audit-middleware.js';
@@ -33,4 +35,5 @@ export type { AuditSource } from './sources/audit-source.js';
 export type { AuditSubscription } from './sources/audit-subscription.js';
 export type { AuditedEvents } from './sources/audited-events.js';
 export type { AuthorizationDecision } from './sources/authorization-decision.js';
+export { TenantAuditReader } from './tenancy/tenant-audit-reader.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,UAAU,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,UAAU,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,EACV,yBAAyB,EACzB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,YAAY,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -12,7 +12,9 @@ export { hmacMasker } from './redaction/hmac-masker.js';
 export { masked } from './redaction/masked.js';
 export { MissingMaskerError } from './redaction/missing-masker-error.js';
 export { auditDecisions } from './sources/audit-decisions.js';
+export { auditGuardRefusals } from './sources/audit-guard-refusals.js';
 export { auditIntegrationEvents } from './sources/audit-integration-events.js';
 export { UNEXPECTED_ERROR, auditMiddleware } from './sources/audit-middleware.js';
 export { auditRecordOf } from './sources/audit-record-of.js';
+export { TenantAuditReader } from './tenancy/tenant-audit-reader.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAmB7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAsB,MAAM,oBAAoB,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,OAAO,EAAE,WAAW,EAA2B,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAG1D,OAAO,EAAE,aAAa,EAA6B,MAAM,+BAA+B,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAA0B,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAG/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAAE,cAAc,EAA8B,MAAM,8BAA8B,CAAC;AAE1F,OAAO,EAAE,sBAAsB,EAAsC,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAA+B,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAmB7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAsB,MAAM,oBAAoB,CAAC;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,OAAO,EAAE,WAAW,EAA2B,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAG1D,OAAO,EAAE,aAAa,EAA6B,MAAM,+BAA+B,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAA0B,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAG/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAAE,cAAc,EAA8B,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAGvE,OAAO,EAAE,sBAAsB,EAAsC,MAAM,uCAAuC,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAA+B,MAAM,+BAA+B,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAK7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/sources/audit-guard-refusals.d.ts

@@ -0,0 +1,16 @@
+import { type AuditTrail } from '@ddd-ts-kit/kernel';
+import type { AuditSource } from './audit-source.js';
+import type { GuardRefusalOfARoute } from './guard-refusal-of-a-route.js';
+/**
+ * The `onGuardRefusal` hook of the HTTP pipeline: a request a guard refused at the edge
+ * (`HasRole`, `HasScope`, `TenantMember`, a tenant the caller does not belong to) is a denied
+ * authorization decision like one of the use cases, recorded with action `http:<operationId>`,
+ * the code of the refusal as reason, and who, in which session and tenant, from the request.
+ *
+ * A caller that presented no credential is not recorded: it is no one to hold to account, its
+ * tenant is whatever it addressed, and recording it would let unauthenticated traffic write to
+ * the trail without bound. Those refusals belong to the access log and to rate limiting. A
+ * recorded refusal is in the tenant of the credential of the caller, never in the one it asked.
+ */
+export declare function auditGuardRefusals(trail: AuditTrail, source: Omit<AuditSource, 'scope'>): (refusal: GuardRefusalOfARoute) => Promise<void>;
+//# sourceMappingURL=audit-guard-refusals.d.ts.map

package/dist/sources/audit-guard-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-guard-refusals.d.ts","sourceRoot":"","sources":["../../src/sources/audit-guard-refusals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAG1E;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GACjC,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAelD"}

package/dist/sources/audit-guard-refusals.js

@@ -0,0 +1,27 @@
+import { isAnonymous } from '@ddd-ts-kit/kernel';
+import { recordIn } from './record-in.js';
+/**
+ * The `onGuardRefusal` hook of the HTTP pipeline: a request a guard refused at the edge
+ * (`HasRole`, `HasScope`, `TenantMember`, a tenant the caller does not belong to) is a denied
+ * authorization decision like one of the use cases, recorded with action `http:<operationId>`,
+ * the code of the refusal as reason, and who, in which session and tenant, from the request.
+ *
+ * A caller that presented no credential is not recorded: it is no one to hold to account, its
+ * tenant is whatever it addressed, and recording it would let unauthenticated traffic write to
+ * the trail without bound. Those refusals belong to the access log and to rate limiting. A
+ * recorded refusal is in the tenant of the credential of the caller, never in the one it asked.
+ */
+export function auditGuardRefusals(trail, source) {
+    return async (refusal) => {
+        if (isAnonymous(refusal.execution.actor)) {
+            return;
+        }
+        await trail.record(recordIn(refusal.execution, source, {
+            category: 'authorization',
+            action: `http:${refusal.operationId}`,
+            outcome: 'denied',
+            reason: refusal.problem.code ?? (refusal.problem.status === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN'),
+        }));
+    };
+}
+//# sourceMappingURL=audit-guard-refusals.js.map

package/dist/sources/audit-guard-refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-guard-refusals.js","sourceRoot":"","sources":["../../src/sources/audit-guard-refusals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAGlE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,MAAkC;IAElC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,CAAC,MAAM,CAChB,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE;YAClC,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,QAAQ,OAAO,CAAC,WAAW,EAAE;YACrC,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;SAChG,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/sources/guard-refusal-of-a-route.d.ts

@@ -0,0 +1,14 @@
+import type { ExecutionContext } from '@ddd-ts-kit/kernel';
+/**
+ * What the `onGuardRefusal` hook of `@ddd-ts-kit/http` hands over, restated structurally so that
+ * this package does not depend on it. Any `GuardRefusal` fits.
+ */
+export interface GuardRefusalOfARoute {
+    readonly operationId: string;
+    readonly problem: {
+        readonly code?: string;
+        readonly status: number;
+    };
+    readonly execution: ExecutionContext;
+}
+//# sourceMappingURL=guard-refusal-of-a-route.d.ts.map

package/dist/sources/guard-refusal-of-a-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-refusal-of-a-route.d.ts","sourceRoot":"","sources":["../../src/sources/guard-refusal-of-a-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACtC"}

package/dist/sources/guard-refusal-of-a-route.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=guard-refusal-of-a-route.js.map

package/dist/sources/guard-refusal-of-a-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-refusal-of-a-route.js","sourceRoot":"","sources":["../../src/sources/guard-refusal-of-a-route.ts"],"names":[],"mappings":""}

package/dist/tenancy/tenant-audit-reader.d.ts

@@ -0,0 +1,17 @@
+import { type AuditEntry, type AuditFilter, type AuditReader, type AuditSortField, type ExecutionScope, type Page, type PageRequest } from '@ddd-ts-kit/kernel';
+/**
+ * The trail as a tenant may read it: every search is confined to the tenant of the work in
+ * progress, whatever the filter says, and a filter that names another tenant or another chain
+ * finds nothing. Platform staff read across tenants under an elevation (`acrossTenants`): over
+ * `all`, the filter as it is; over a list, a search names one tenant of the list. Work that names
+ * no tenant and no elevation is refused (`NoCurrentTenantError`).
+ */
+export declare class TenantAuditReader implements AuditReader {
+    private readonly reader;
+    private readonly scope;
+    constructor(reader: AuditReader, scope: ExecutionScope);
+    search(filter: AuditFilter, page: PageRequest<AuditSortField>): Promise<Page<AuditEntry>>;
+    /** The filter within the reach of the work, or `undefined` when it can only find another tenant's entries. */
+    private confined;
+}
+//# sourceMappingURL=tenant-audit-reader.d.ts.map

package/dist/tenancy/tenant-audit-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-audit-reader.d.ts","sourceRoot":"","sources":["../../src/tenancy/tenant-audit-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IAEjD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,cAAc,EACpC;IAEE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAI9F;IAED,8GAA8G;IAC9G,OAAO,CAAC,QAAQ;CAejB"}

package/dist/tenancy/tenant-audit-reader.js

@@ -0,0 +1,35 @@
+import { pageOf, tenantReachOf, } from '@ddd-ts-kit/kernel';
+/**
+ * The trail as a tenant may read it: every search is confined to the tenant of the work in
+ * progress, whatever the filter says, and a filter that names another tenant or another chain
+ * finds nothing. Platform staff read across tenants under an elevation (`acrossTenants`): over
+ * `all`, the filter as it is; over a list, a search names one tenant of the list. Work that names
+ * no tenant and no elevation is refused (`NoCurrentTenantError`).
+ */
+export class TenantAuditReader {
+    reader;
+    scope;
+    constructor(reader, scope) {
+        this.reader = reader;
+        this.scope = scope;
+    }
+    async search(filter, page) {
+        const confined = this.confined(filter);
+        return confined === undefined ? pageOf([], { total: 0 }) : this.reader.search(confined, page);
+    }
+    /** The filter within the reach of the work, or `undefined` when it can only find another tenant's entries. */
+    confined(filter) {
+        const reach = tenantReachOf(this.scope);
+        if (reach.kind === 'elevated') {
+            return reach.tenants === 'all' || reachesListed(filter, reach.tenants) ? filter : undefined;
+        }
+        const { tenantId } = reach;
+        const elsewhere = (filter.tenantId !== undefined && filter.tenantId !== tenantId) ||
+            (filter.chain !== undefined && filter.chain !== `tenant:${tenantId}`);
+        return elsewhere ? undefined : { ...filter, tenantId };
+    }
+}
+function reachesListed(filter, tenants) {
+    return filter.tenantId !== undefined && tenants.includes(filter.tenantId);
+}
+//# sourceMappingURL=tenant-audit-reader.js.map

package/dist/tenancy/tenant-audit-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-audit-reader.js","sourceRoot":"","sources":["../../src/tenancy/tenant-audit-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,aAAa,GAQd,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IAET,MAAM;IACN,KAAK;IAFxB,YACmB,MAAmB,EACnB,KAAqB;sBADrB,MAAM;qBACN,KAAK;IACrB,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,IAAiC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEvC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAa,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5G,CAAC;IAED,8GAA8G;IACtG,QAAQ,CAAC,MAAmB;QAClC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAE3B,MAAM,SAAS,GACb,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC/D,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,QAAQ,EAAE,CAAC,CAAC;QAExE,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,OAA0B;IACpE,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ddd-ts-kit/audit",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Tamper-evident audit trail fed from outside the use cases: authorization decisions, executed commands and integration events, as hash-chained append-only entries.",
   "license": "MIT",
   "repository": {
@@ -38,12 +38,12 @@
     "dist"
   ],
   "dependencies": {
-    "@ddd-ts-kit/kernel": "0.6.0"
+    "@ddd-ts-kit/kernel": "0.8.0"
   },
   "peerDependencies": {
     "knex": "^3.0.0",
     "drizzle-orm": ">=0.40.0",
-    "@ddd-ts-kit/testing": "0.6.0"
+    "@ddd-ts-kit/testing": "0.8.0"
   },
   "peerDependenciesMeta": {
     "knex": {
@@ -63,10 +63,10 @@
     "@types/pg": "^8.23.1",
     "@electric-sql/pglite": "0.5.9",
     "@electric-sql/pglite-socket": "0.2.12",
-    "@ddd-ts-kit/auth": "0.6.0",
-    "@ddd-ts-kit/events": "0.6.0",
-    "@ddd-ts-kit/knex": "0.6.0",
-    "@ddd-ts-kit/drizzle": "0.6.0",
-    "@ddd-ts-kit/testing": "0.6.0"
+    "@ddd-ts-kit/auth": "0.8.0",
+    "@ddd-ts-kit/events": "0.8.0",
+    "@ddd-ts-kit/knex": "0.8.0",
+    "@ddd-ts-kit/drizzle": "0.8.0",
+    "@ddd-ts-kit/testing": "0.8.0"
   }
 }