@de-otio/trellis 0.6.1 → 0.7.0

package/dist/lib/age-tier-transition.js.map

@@ -1 +1 @@
-{"version":3,"file":"age-tier-transition.js","sourceRoot":"","sources":["../../src/lib/age-tier-transition.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUH,wCAKC;AAiDD,0DAyGC;AArKD,qCAAkC;AAClC,yDAA8E;AAE9E;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAiB,EAAE,MAAY,IAAI,IAAI,EAAE;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,WAAiB,EAAE,GAAS;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC1D,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,eAAgC,EAChC,WAA4B;IAE5B,MAAM,eAAe,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAEzD,OAAO;QACL,2GAA2G;QAC3G,WAAW,EAAE,eAAe,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW;QACnE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB;QAClF,mBAAmB,EAAE,eAAe,CAAC,mBAAmB,IAAI,WAAW,CAAC,mBAAmB;QAC3F,YAAY,EAAE,eAAe,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QACtE,uBAAuB,EAAE,eAAe,CAAC,uBAAuB,IAAI,WAAW,CAAC,uBAAuB;QACvG,2CAA2C;QAC3C,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,CAAC;QACxH,eAAe,EAAE,eAAe,CAAC,eAAe,IAAI,WAAW,CAAC,eAAe;QAC/E,4CAA4C;QAC5C,iBAAiB,EACf,eAAe,CAAC,eAAe,CAAC,iBAAiB,CAAC,IAAI,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAClG,CAAC,CAAC,eAAe,CAAC,iBAAiB;YACnC,CAAC,CAAC,WAAW,CAAC,iBAAiB;QACnC,oCAAoC;QACpC,QAAQ,EACN,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,eAAe,CAAC,QAAQ;YAC1B,CAAC,CAAC,WAAW,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAQ;IAIpD,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,OAAO,GAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;gBACtB,mBAAmB,EAAE,IAAI;gBACzB,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,IAAI;gBAC7B,0BAA0B,EAAE,IAAI;gBAChC,eAAe,EAAE,IAAI;gBACrB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAEhC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAC3D,IAAI,YAAY,KAAK,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,qCAAkB,EAAC,YAAY,CAAC,CAAC;gBAErD,MAAM,eAAe,GAAoB;oBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;oBAC3D,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;gBAEF,qEAAqE;gBACrE,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;gBAElE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;oBACtB,IAAI,EAAE;wBACJ,OAAO,EAAE,YAAY;wBACrB,GAAG,MAAM;qBACV;iBACF,CAAC,CAAC;gBAEH,iCAAiC;gBACjC,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE;wBACJ,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,kBAAkB;wBACzB,IAAI,EAAE,sCAAsC,OAAO,OAAO,YAAY,uCAAuC;wBAC7G,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;qBACzC;iBACF,CAAC,CAAC;gBAEH,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACnD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;iBAC9C,CAAC,CAAC;gBAEH,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;oBACjC,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC3B,IAAI,EAAE;4BACJ,MAAM,EAAE,IAAI,CAAC,UAAU;4BACvB,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,wBAAwB;4BAC/B,IAAI,EAAE,mDAAmD,OAAO,OAAO,YAAY,GAAG;4BACtF,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;yBAC3D;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,YAAY,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,sBAAsB,OAAO,OAAO,YAAY,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC;IACX,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"age-tier-transition.js","sourceRoot":"","sources":["../../src/lib/age-tier-transition.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUH,wCAKC;AAiDD,0DAiHC;AA7KD,qCAAkC;AAClC,yDAA8E;AAE9E;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAiB,EAAE,MAAY,IAAI,IAAI,EAAE;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,WAAiB,EAAE,GAAS;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC1D,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,eAAgC,EAChC,WAA4B;IAE5B,MAAM,eAAe,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAEzD,OAAO;QACL,2GAA2G;QAC3G,WAAW,EAAE,eAAe,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW;QACnE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB;QAClF,mBAAmB,EAAE,eAAe,CAAC,mBAAmB,IAAI,WAAW,CAAC,mBAAmB;QAC3F,YAAY,EAAE,eAAe,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QACtE,uBAAuB,EAAE,eAAe,CAAC,uBAAuB,IAAI,WAAW,CAAC,uBAAuB;QACvG,2CAA2C;QAC3C,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,CAAC;QACxH,eAAe,EAAE,eAAe,CAAC,eAAe,IAAI,WAAW,CAAC,eAAe;QAC/E,4CAA4C;QAC5C,iBAAiB,EACf,eAAe,CAAC,eAAe,CAAC,iBAAiB,CAAC,IAAI,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAClG,CAAC,CAAC,eAAe,CAAC,iBAAiB;YACnC,CAAC,CAAC,WAAW,CAAC,iBAAiB;QACnC,oCAAoC;QACpC,QAAQ,EACN,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,eAAe,CAAC,QAAQ;YAC1B,CAAC,CAAC,WAAW,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAQ;IAIpD,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,OAAO,GAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,IAAI;gBACtB,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;gBACtB,mBAAmB,EAAE,IAAI;gBACzB,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,IAAI;gBAC7B,0BAA0B,EAAE,IAAI;gBAChC,eAAe,EAAE,IAAI;gBACrB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAEhC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAC3D,IAAI,YAAY,KAAK,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,qCAAkB,EAAC,YAAY,CAAC,CAAC;gBAErD,MAAM,eAAe,GAAoB;oBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;oBAC3D,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;gBAEF,qEAAqE;gBACrE,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;gBAElE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;oBACtB,IAAI,EAAE;wBACJ,OAAO,EAAE,YAAY;wBACrB,GAAG,MAAM;qBACV;iBACF,CAAC,CAAC;gBAEH,2DAA2D;gBAC3D,4DAA4D;gBAC5D,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC1B,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC3B,IAAI,EAAE;4BACJ,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,kBAAkB;4BACzB,IAAI,EAAE,sCAAsC,OAAO,OAAO,YAAY,uCAAuC;4BAC7G,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;4BACxC,QAAQ,EAAE,IAAI,CAAC,gBAAgB;yBAChC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACnD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;oBAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;iBAC9D,CAAC,CAAC;gBAEH,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;oBACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB;wBAAE,SAAS;oBAC9C,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC3B,IAAI,EAAE;4BACJ,MAAM,EAAE,IAAI,CAAC,UAAU;4BACvB,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,wBAAwB;4BAC/B,IAAI,EAAE,mDAAmD,OAAO,OAAO,YAAY,GAAG;4BACtF,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;4BAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;yBACzC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,YAAY,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,sBAAsB,OAAO,OAAO,YAAY,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC;IACX,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/audit/csv-export.d.ts

@@ -0,0 +1,25 @@
+/**
+ * CSV Export for Audit Events (RFC 4180)
+ *
+ * Fields that contain commas, double-quotes, or newlines are enclosed in
+ * double-quotes. Inner double-quotes are doubled per RFC 4180 §2.7.
+ */
+export declare const CSV_HEADERS: readonly ["eventId", "type", "tenantId", "actorUserId", "createdAt", "sourceIp", "payload"];
+export type CsvRow = {
+    eventId: string;
+    type: string;
+    tenantId: string;
+    actorUserId: string;
+    createdAt: string;
+    sourceIp: string;
+    payload: string;
+};
+/** Escape a single CSV field per RFC 4180. */
+export declare function escapeCsvField(value: string): string;
+/** Render one CSV row from an array of string values. */
+export declare function renderCsvRow(fields: string[]): string;
+/** Render the header row. */
+export declare function renderCsvHeader(): string;
+/** Render a complete CSV document (header + rows) from an array of row objects. */
+export declare function renderCsv(rows: CsvRow[]): string;
+//# sourceMappingURL=csv-export.d.ts.map

package/dist/lib/audit/csv-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv-export.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/csv-export.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,WAAW,6FAQd,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAErD;AAED,6BAA6B;AAC7B,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBhD"}

package/dist/lib/audit/csv-export.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * CSV Export for Audit Events (RFC 4180)
+ *
+ * Fields that contain commas, double-quotes, or newlines are enclosed in
+ * double-quotes. Inner double-quotes are doubled per RFC 4180 §2.7.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CSV_HEADERS = void 0;
+exports.escapeCsvField = escapeCsvField;
+exports.renderCsvRow = renderCsvRow;
+exports.renderCsvHeader = renderCsvHeader;
+exports.renderCsv = renderCsv;
+exports.CSV_HEADERS = [
+    "eventId",
+    "type",
+    "tenantId",
+    "actorUserId",
+    "createdAt",
+    "sourceIp",
+    "payload",
+];
+/** Escape a single CSV field per RFC 4180. */
+function escapeCsvField(value) {
+    if (value.includes(",") || value.includes('"') || value.includes("\n") || value.includes("\r")) {
+        return `"${value.replace(/"/g, '""')}"`;
+    }
+    return value;
+}
+/** Render one CSV row from an array of string values. */
+function renderCsvRow(fields) {
+    return fields.map(escapeCsvField).join(",");
+}
+/** Render the header row. */
+function renderCsvHeader() {
+    return renderCsvRow([...exports.CSV_HEADERS]);
+}
+/** Render a complete CSV document (header + rows) from an array of row objects. */
+function renderCsv(rows) {
+    const lines = [renderCsvHeader()];
+    for (const row of rows) {
+        lines.push(renderCsvRow([
+            row.eventId,
+            row.type,
+            row.tenantId,
+            row.actorUserId,
+            row.createdAt,
+            row.sourceIp,
+            row.payload,
+        ]));
+    }
+    return lines.join("\r\n");
+}
+//# sourceMappingURL=csv-export.js.map

package/dist/lib/audit/csv-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv-export.js","sourceRoot":"","sources":["../../../src/lib/audit/csv-export.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAuBH,wCAKC;AAGD,oCAEC;AAGD,0CAEC;AAGD,8BAgBC;AAvDY,QAAA,WAAW,GAAG;IACzB,SAAS;IACT,MAAM;IACN,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;CACD,CAAC;AAYX,8CAA8C;AAC9C,SAAgB,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAgB,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,6BAA6B;AAC7B,SAAgB,eAAe;IAC7B,OAAO,YAAY,CAAC,CAAC,GAAG,mBAAW,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,mFAAmF;AACnF,SAAgB,SAAS,CAAC,IAAc;IACtC,MAAM,KAAK,GAAa,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,YAAY,CAAC;YACX,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;SACZ,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/lib/audit/emit.d.ts

@@ -0,0 +1,56 @@
+/**
+ * AuditEventEmitter
+ *
+ * Writes structured audit events to CloudWatch Logs and Postgres security_events.
+ * Emission is non-blocking — callers do `void emitter.emit(...)`.
+ * CloudWatch failures fall back to a console.error "audit-fallback" line that
+ * ops can grep from the log stream.
+ */
+import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
+import type { AuditEventType } from "./event-types";
+export interface AuditEmitInput {
+    type: AuditEventType;
+    tenantId: string;
+    actorUserId: string;
+    payload: Record<string, unknown>;
+    /** Source IP — will be anonymised to /24 before storage. */
+    sourceIp?: string;
+    /** Present when the request was made through an agent session (T9b). */
+    agentSessionId?: string;
+}
+export interface AuditRecord {
+    eventId: string;
+    type: AuditEventType;
+    tenantId: string;
+    actorUserId: string;
+    payload: Record<string, unknown>;
+    sourceIp: string;
+    agentSessionId: string | null;
+    createdAt: Date;
+}
+export declare class AuditEventEmitter {
+    private readonly cwClient;
+    constructor(cwClient?: CloudWatchLogsClient);
+    /**
+     * Emit an audit event. Returns a promise but callers should fire-and-forget
+     * via `void emitter.emit(...)` — the handler must not await this.
+     */
+    emit(input: AuditEmitInput, dbClient: {
+        securityEvent: {
+            create: (args: {
+                data: {
+                    type: string;
+                    severity: string;
+                    tenantId: string;
+                    userId: string;
+                    ipAddress: string;
+                    details: string;
+                    retentionUntil: Date;
+                };
+            }) => Promise<unknown>;
+        };
+    }): Promise<void>;
+    private _writeToCloudWatch;
+    private _writeToPostgres;
+}
+//# sourceMappingURL=emit.d.ts.map

package/dist/lib/audit/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,EAErB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;CACjB;AAOD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;gBAEpC,QAAQ,CAAC,EAAE,oBAAoB;IAQ3C;;;OAGG;IACG,IAAI,CACR,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE;QACR,aAAa,EAAE;YACb,MAAM,EAAE,CAAC,IAAI,EAAE;gBACb,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC;oBACb,QAAQ,EAAE,MAAM,CAAC;oBACjB,QAAQ,EAAE,MAAM,CAAC;oBACjB,MAAM,EAAE,MAAM,CAAC;oBACf,SAAS,EAAE,MAAM,CAAC;oBAClB,OAAO,EAAE,MAAM,CAAC;oBAChB,cAAc,EAAE,IAAI,CAAC;iBACtB,CAAC;aACH,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;SACxB,CAAC;KACH,GACA,OAAO,CAAC,IAAI,CAAC;YA0CF,kBAAkB;YAmClB,gBAAgB;CA4C/B"}

package/dist/lib/audit/emit.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * AuditEventEmitter
+ *
+ * Writes structured audit events to CloudWatch Logs and Postgres security_events.
+ * Emission is non-blocking — callers do `void emitter.emit(...)`.
+ * CloudWatch failures fall back to a console.error "audit-fallback" line that
+ * ops can grep from the log stream.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditEventEmitter = void 0;
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const crypto_1 = require("crypto");
+const pii_filter_1 = require("./pii-filter");
+function getLogGroup() {
+    const stage = process.env.STAGE ?? "dev";
+    return process.env.AUDIT_LOG_GROUP ?? `/skybber/${stage}/audit-events`;
+}
+class AuditEventEmitter {
+    cwClient;
+    constructor(cwClient) {
+        this.cwClient =
+            cwClient ??
+                new client_cloudwatch_logs_1.CloudWatchLogsClient({
+                    region: process.env.AWS_REGION ?? "eu-central-1",
+                });
+    }
+    /**
+     * Emit an audit event. Returns a promise but callers should fire-and-forget
+     * via `void emitter.emit(...)` — the handler must not await this.
+     */
+    async emit(input, dbClient) {
+        const eventId = (0, crypto_1.randomUUID)();
+        const createdAt = new Date();
+        const anonymisedIp = input.sourceIp ? (0, pii_filter_1.anonymizeIp)(input.sourceIp) : "unknown";
+        const { filtered, droppedCount } = (0, pii_filter_1.filterPayload)({
+            ...input.payload,
+            tenantId: input.tenantId,
+            actorUserId: input.actorUserId,
+            sourceIp: anonymisedIp,
+            ...(input.agentSessionId ? { agentSessionId: input.agentSessionId } : {}),
+        });
+        if (droppedCount > 0) {
+            console.error(JSON.stringify({
+                level: "warn",
+                tag: "audit-pii-filter",
+                eventId,
+                type: input.type,
+                droppedCount,
+            }));
+        }
+        const record = {
+            eventId,
+            type: input.type,
+            tenantId: input.tenantId,
+            actorUserId: input.actorUserId,
+            payload: filtered,
+            sourceIp: anonymisedIp,
+            agentSessionId: input.agentSessionId ?? null,
+            createdAt,
+        };
+        await Promise.all([
+            this._writeToCloudWatch(record),
+            this._writeToPostgres(record, dbClient),
+        ]);
+    }
+    async _writeToCloudWatch(record) {
+        const logGroup = getLogGroup();
+        const logStream = `audit-${record.tenantId}`;
+        const message = JSON.stringify(record);
+        try {
+            await this.cwClient.send(new client_cloudwatch_logs_1.PutLogEventsCommand({
+                logGroupName: logGroup,
+                logStreamName: logStream,
+                logEvents: [
+                    {
+                        timestamp: record.createdAt.getTime(),
+                        message,
+                    },
+                ],
+            }));
+        }
+        catch (err) {
+            console.error(JSON.stringify({
+                level: "error",
+                tag: "audit-fallback",
+                eventId: record.eventId,
+                type: record.type,
+                tenantId: record.tenantId,
+                actorUserId: record.actorUserId,
+                createdAt: record.createdAt.toISOString(),
+                payload: record.payload,
+                cwError: err instanceof Error ? err.message : String(err),
+            }));
+        }
+    }
+    async _writeToPostgres(record, db) {
+        const retentionUntil = new Date(record.createdAt);
+        retentionUntil.setDate(retentionUntil.getDate() + 30);
+        try {
+            await db.securityEvent.create({
+                data: {
+                    type: record.type,
+                    severity: "medium",
+                    tenantId: record.tenantId,
+                    userId: record.actorUserId,
+                    ipAddress: record.sourceIp,
+                    details: JSON.stringify({ ...record.payload, eventId: record.eventId }),
+                    retentionUntil,
+                },
+            });
+        }
+        catch (err) {
+            console.error(JSON.stringify({
+                level: "error",
+                tag: "audit-fallback",
+                eventId: record.eventId,
+                pgError: err instanceof Error ? err.message : String(err),
+            }));
+        }
+    }
+}
+exports.AuditEventEmitter = AuditEventEmitter;
+//# sourceMappingURL=emit.js.map

package/dist/lib/audit/emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../../src/lib/audit/emit.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,4EAGyC;AACzC,mCAAoC;AAEpC,6CAA0D;AAwB1D,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,YAAY,KAAK,eAAe,CAAC;AACzE,CAAC;AAED,MAAa,iBAAiB;IACX,QAAQ,CAAuB;IAEhD,YAAY,QAA+B;QACzC,IAAI,CAAC,QAAQ;YACX,QAAQ;gBACR,IAAI,6CAAoB,CAAC;oBACvB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,cAAc;iBACjD,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CACR,KAAqB,EACrB,QAcC;QAED,MAAM,OAAO,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAa,EAAC;YAC/C,GAAG,KAAK,CAAC,OAAO;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,YAAY;YACtB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,GAAG,EAAE,kBAAkB;gBACvB,OAAO;gBACP,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY;aACb,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,YAAY;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,SAAS;SACV,CAAC;QAEF,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,MAAmB;QAClD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,SAAS,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACtB,IAAI,4CAAmB,CAAC;gBACtB,YAAY,EAAE,QAAQ;gBACtB,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE;oBACT;wBACE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;wBACrC,OAAO;qBACR;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,OAAO;gBACd,GAAG,EAAE,gBAAgB;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,MAAmB,EACnB,EAcC;QAED,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC5B,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,WAAW;oBAC1B,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;oBACvE,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,OAAO;gBACd,GAAG,EAAE,gBAAgB;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAzJD,8CAyJC"}

package/dist/lib/audit/event-types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Audit Event Types
+ *
+ * Canonical catalog of all identity-federation audit events.
+ * Every AuditEventType emitted by a handler must appear here.
+ */
+export declare const AuditEventType: {
+    readonly TENANT_CREATED: "tenant.created";
+    readonly TENANT_MEMBER_INVITED: "tenant.member.invited";
+    readonly TENANT_MEMBER_JOINED: "tenant.member.joined";
+    readonly TENANT_MEMBER_ROLE_CHANGED: "tenant.member.role_changed";
+    readonly TENANT_MEMBER_REMOVED: "tenant.member.removed";
+    readonly TENANT_DOMAIN_ADDED: "tenant.domain.added";
+    readonly TENANT_DOMAIN_VERIFIED: "tenant.domain.verified";
+    readonly TENANT_IDP_CONNECTED: "tenant.idp.connected";
+    readonly TENANT_IDP_MODIFIED: "tenant.idp.modified";
+    readonly TENANT_IDP_DISABLED: "tenant.idp.disabled";
+    readonly TENANT_IDP_DELETED: "tenant.idp.deleted";
+    readonly TENANT_ROLE_MAPPING_ADDED: "tenant.role_mapping.added";
+    readonly TENANT_ROLE_MAPPING_REMOVED: "tenant.role_mapping.removed";
+    readonly TENANT_FEDERATED_LOGIN_SUCCESS: "tenant.federated_login.success";
+    readonly TENANT_FEDERATED_LOGIN_DENIED: "tenant.federated_login.denied";
+    readonly TENANT_ROLE_REFRESHED_JIT: "tenant.role.refreshed_jit";
+    readonly TENANT_OWNERSHIP_TRANSFERRED: "tenant.ownership_transferred";
+    readonly TENANT_UPDATED: "tenant.updated";
+    readonly AUTH_AGENT_SESSION_APPROVED: "auth.agent_session.approved";
+    readonly AUTH_AGENT_SESSION_REVOKED: "auth.agent_session.revoked";
+    readonly AUTH_REFRESH_REPLAY: "auth.refresh_replay";
+};
+export type AuditEventType = (typeof AuditEventType)[keyof typeof AuditEventType];
+/**
+ * Per-type allowed payload field names (allowlist).
+ * Populated by the PII filter — anything outside this set is redacted.
+ */
+export declare const PII_ALLOWED_FIELDS: Set<string>;
+//# sourceMappingURL=event-types.d.ts.map

package/dist/lib/audit/event-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-types.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/event-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;CAsBjB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aA+B7B,CAAC"}

package/dist/lib/audit/event-types.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Audit Event Types
+ *
+ * Canonical catalog of all identity-federation audit events.
+ * Every AuditEventType emitted by a handler must appear here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PII_ALLOWED_FIELDS = exports.AuditEventType = void 0;
+exports.AuditEventType = {
+    TENANT_CREATED: "tenant.created",
+    TENANT_MEMBER_INVITED: "tenant.member.invited",
+    TENANT_MEMBER_JOINED: "tenant.member.joined",
+    TENANT_MEMBER_ROLE_CHANGED: "tenant.member.role_changed",
+    TENANT_MEMBER_REMOVED: "tenant.member.removed",
+    TENANT_DOMAIN_ADDED: "tenant.domain.added",
+    TENANT_DOMAIN_VERIFIED: "tenant.domain.verified",
+    TENANT_IDP_CONNECTED: "tenant.idp.connected",
+    TENANT_IDP_MODIFIED: "tenant.idp.modified",
+    TENANT_IDP_DISABLED: "tenant.idp.disabled",
+    TENANT_IDP_DELETED: "tenant.idp.deleted",
+    TENANT_ROLE_MAPPING_ADDED: "tenant.role_mapping.added",
+    TENANT_ROLE_MAPPING_REMOVED: "tenant.role_mapping.removed",
+    TENANT_FEDERATED_LOGIN_SUCCESS: "tenant.federated_login.success",
+    TENANT_FEDERATED_LOGIN_DENIED: "tenant.federated_login.denied",
+    TENANT_ROLE_REFRESHED_JIT: "tenant.role.refreshed_jit",
+    TENANT_OWNERSHIP_TRANSFERRED: "tenant.ownership_transferred",
+    TENANT_UPDATED: "tenant.updated",
+    AUTH_AGENT_SESSION_APPROVED: "auth.agent_session.approved",
+    AUTH_AGENT_SESSION_REVOKED: "auth.agent_session.revoked",
+    AUTH_REFRESH_REPLAY: "auth.refresh_replay",
+};
+/**
+ * Per-type allowed payload field names (allowlist).
+ * Populated by the PII filter — anything outside this set is redacted.
+ */
+exports.PII_ALLOWED_FIELDS = new Set([
+    "tenantId",
+    "actorUserId",
+    "targetUserId",
+    "targetType",
+    "oldRole",
+    "newRole",
+    "domain",
+    "idpStatus",
+    "idpKind",
+    "issuer",
+    "idpGroup",
+    "role",
+    "source",
+    "reason",
+    "verificationMethod",
+    "changedAttributes",
+    "sourceIp",
+    "agentSessionId",
+    "slug",
+    "displayName",
+    "type",
+    "agentLabel",
+    "userAgent",
+    // G4 MEDIUM-6/N2: `deviceCodeHash` was previously written into
+    // AUTH_AGENT_SESSION_APPROVED audit payloads and could act as a
+    // confirmation oracle if a raw device_code ever leaked elsewhere.
+    // Removed from the allow-list so a future regression that re-adds
+    // the field would fail the audit-emit allow-list check.
+    "refreshJti",
+    "cognitoUserId",
+]);
+//# sourceMappingURL=event-types.js.map

package/dist/lib/audit/event-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-types.js","sourceRoot":"","sources":["../../../src/lib/audit/event-types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEU,QAAA,cAAc,GAAG;IAC5B,cAAc,EAAE,gBAAgB;IAChC,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,0BAA0B,EAAE,4BAA4B;IACxD,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,sBAAsB,EAAE,wBAAwB;IAChD,oBAAoB,EAAE,sBAAsB;IAC5C,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,yBAAyB,EAAE,2BAA2B;IACtD,2BAA2B,EAAE,6BAA6B;IAC1D,8BAA8B,EAAE,gCAAgC;IAChE,6BAA6B,EAAE,+BAA+B;IAC9D,yBAAyB,EAAE,2BAA2B;IACtD,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,2BAA2B,EAAE,6BAA6B;IAC1D,0BAA0B,EAAE,4BAA4B;IACxD,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAIX;;;GAGG;AACU,QAAA,kBAAkB,GAAG,IAAI,GAAG,CAAS;IAChD,UAAU;IACV,aAAa;IACb,cAAc;IACd,YAAY;IACZ,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,oBAAoB;IACpB,mBAAmB;IACnB,UAAU;IACV,gBAAgB;IAChB,MAAM;IACN,aAAa;IACb,MAAM;IACN,YAAY;IACZ,WAAW;IACX,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,kEAAkE;IAClE,wDAAwD;IACxD,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC"}

package/dist/lib/audit/pii-filter.d.ts

@@ -0,0 +1,22 @@
+/**
+ * PII Filter for Audit Payloads
+ *
+ * Allowlist-based field filter. Any key not on the allowlist is replaced
+ * with the literal string "<redacted>" and a drop counter is incremented.
+ * Claim *names* are fine to store; claim *values* must never appear.
+ */
+export interface FilterResult {
+    filtered: Record<string, unknown>;
+    droppedCount: number;
+}
+/**
+ * Redact IPv4 to /24 and IPv6 to /64 for GDPR-compliant storage.
+ * "1.2.3.4" → "1.2.3.0/24", "2001:db8::1" → "2001:db8::/64"
+ */
+export declare function anonymizeIp(ip: string): string;
+/**
+ * Filter a raw payload object against the PII allowlist.
+ * Returns the cleaned object and the number of dropped fields.
+ */
+export declare function filterPayload(payload: Record<string, unknown>, allowedFields?: Set<string>): FilterResult;
+//# sourceMappingURL=pii-filter.d.ts.map

package/dist/lib/audit/pii-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/pii-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAiB9C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,GAAG,CAAC,MAAM,CAAsB,GAC9C,YAAY,CAcd"}

package/dist/lib/audit/pii-filter.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * PII Filter for Audit Payloads
+ *
+ * Allowlist-based field filter. Any key not on the allowlist is replaced
+ * with the literal string "<redacted>" and a drop counter is incremented.
+ * Claim *names* are fine to store; claim *values* must never appear.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.anonymizeIp = anonymizeIp;
+exports.filterPayload = filterPayload;
+const event_types_1 = require("./event-types");
+/**
+ * Redact IPv4 to /24 and IPv6 to /64 for GDPR-compliant storage.
+ * "1.2.3.4" → "1.2.3.0/24", "2001:db8::1" → "2001:db8::/64"
+ */
+function anonymizeIp(ip) {
+    if (!ip || ip === "unknown")
+        return ip;
+    if (ip.includes(".")) {
+        const parts = ip.split(".");
+        if (parts.length === 4) {
+            return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;
+        }
+    }
+    if (ip.includes(":")) {
+        const parts = ip.split(":");
+        const prefix = parts.slice(0, 4).join(":");
+        return `${prefix}::/64`;
+    }
+    return ip;
+}
+/**
+ * Filter a raw payload object against the PII allowlist.
+ * Returns the cleaned object and the number of dropped fields.
+ */
+function filterPayload(payload, allowedFields = event_types_1.PII_ALLOWED_FIELDS) {
+    const filtered = {};
+    let droppedCount = 0;
+    for (const [key, value] of Object.entries(payload)) {
+        if (allowedFields.has(key)) {
+            filtered[key] = value;
+        }
+        else {
+            filtered[key] = "<redacted>";
+            droppedCount++;
+        }
+    }
+    return { filtered, droppedCount };
+}
+//# sourceMappingURL=pii-filter.js.map

package/dist/lib/audit/pii-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-filter.js","sourceRoot":"","sources":["../../../src/lib/audit/pii-filter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAaH,kCAiBC;AAMD,sCAiBC;AAnDD,+CAAmD;AAOnD;;;GAGG;AACH,SAAgB,WAAW,CAAC,EAAU;IACpC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEvC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,GAAG,MAAM,OAAO,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAC3B,OAAgC,EAChC,gBAA6B,gCAAkB;IAE/C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/lib/audit-logger.js

@@ -230,7 +230,7 @@ class AuditLogger {
                             type: `audit_${event.type}`, // Prefix with 'audit_' to distinguish from security events
                             severity: severity,
                             userId: event.userId || null,
-                            partnerId: null, // partnerId (not used for audit events)
+                            tenantId: null, // T7 will populate this with the tenant context. (renamed from partnerId in T1)
                             ipAddress: event.ipAddress || null,
                             userAgent: event.userAgent || null,
                             details: details,

package/dist/lib/audit-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/lib/audit-logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqYH,8CAKC;AAxYD,qCAAqE;AAErE,yDAAgE;AA8ChE;;;;GAIG;AACH,MAAa,WAAW;IACd,MAAM,CAAS;IACf,SAAS,CAAU;IAE3B,YAAY,GAAe,EAAE,SAAkB;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,WAAW,CACpB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAe,EACrD,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,6CAA6C;YACnF,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,+BAA+B;YAC7F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,gCAAgC;YAC9F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,KAAuE,EACvE,GAAmB;QAEnB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC;QAE9C,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,gBAAgB;gBACnB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM;YACR,KAAK,eAAe;gBAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxC,MAAM;YACR;gBACE,2CAA2C;gBAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,KAAiB,EACjB,GAAmB;QAEnB,IAAI,CAAC;YACH,2CAA2C;YAC3C,IAAI,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,OAAO,CAAC,2BAA2B;YACrC,CAAC;YAED,6CAA6C;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CACjD,KAAK,CAAC,QAAQ,IAAI,KAAK,CACxB,CAAC;YAEF,4CAA4C;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,KAAK,CAAC,QAAQ;aAClB,CAAC,CAAC;YAEH,4FAA4F;YAC5F,yEAAyE;YACzE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,+BAA+B,EAAE,GAAG,wDAC1C,+BAA+B,GAChC,CAAC;gBACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GAAG,wDACxD,mBAAmB,GACpB,CAAC;gBAEF,MAAM,wBAAwB,CAC5B,+BAA+B,EAC/B,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,KAAK,EAAE,EAAE,EAAE,EAAE;oBACX,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;wBACnC,IAAI,EAAE;4BACJ,IAAI,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,EAAE,2DAA2D;4BACxF,QAAQ,EAAE,QAAQ;4BAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;4BAC5B,SAAS,EAAE,IAAI,EAAE,wCAAwC;4BACzD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,OAAO,EAAE,OAAO;4BAChB,cAAc,EAAE,cAAc;yBAC/B;qBACF,CAAC,CAAC;gBACL,CAAC,EACD;oBACE,GAAG,mBAAmB,CAAC,UAAU,EAAE,wCAAwC;oBAC3E,UAAU,EAAE,CAAC;oBACb,WAAW,EAAE,GAAG;oBAChB,OAAO,EAAE;wBACP,SAAS,EAAE,WAAW;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;iBACF,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,qDAAqD;gBACrD,0CAA0C;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+EAA+E,EAC/E,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzC,CAAC;YACJ,CAAC;YAED,uDAAuD;YACvD,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAE9M,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,mCAAmC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC3D,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,QAA4B;QAC1D,MAAM,aAAa,GAAuC;YACxD,QAAQ,EAAE,GAAG,EAAE,kCAAkC;YACjD,IAAI,EAAE,EAAE,EAAE,iCAAiC;YAC3C,MAAM,EAAE,EAAE,EAAE,0BAA0B;YACtC,GAAG,EAAE,CAAC,EAAE,sBAAsB;SAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArUD,kCAqUC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,GAAe,EACf,SAAkB;IAElB,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/lib/audit-logger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqYH,8CAKC;AAxYD,qCAAqE;AAErE,yDAAgE;AA8ChE;;;;GAIG;AACH,MAAa,WAAW;IACd,MAAM,CAAS;IACf,SAAS,CAAU;IAE3B,YAAY,GAAe,EAAE,SAAkB;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,OAAO,IAAI,WAAW,CACpB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAe,EACrD,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,6CAA6C;YACnF,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,+BAA+B;YAC7F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,KAGC,EACD,GAAmB;QAEnB,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,gCAAgC;YAC9F,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,KAAuE,EACvE,GAAmB;QAEnB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,aAAa,CAAC;QAE9C,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,aAAa;gBAChB,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACrC,MAAM;YACR,KAAK,gBAAgB;gBACnB,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACzC,MAAM;YACR,KAAK,eAAe;gBAClB,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxC,MAAM;YACR;gBACE,2CAA2C;gBAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,KAAiB,EACjB,GAAmB;QAEnB,IAAI,CAAC;YACH,2CAA2C;YAC3C,IAAI,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,OAAO,CAAC,2BAA2B;YACrC,CAAC;YAED,6CAA6C;YAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,uBAAuB,CACjD,KAAK,CAAC,QAAQ,IAAI,KAAK,CACxB,CAAC;YAEF,4CAA4C;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,KAAK,CAAC,QAAQ;aAClB,CAAC,CAAC;YAEH,4FAA4F;YAC5F,yEAAyE;YACzE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,+BAA+B,EAAE,GAAG,wDAC1C,+BAA+B,GAChC,CAAC;gBACF,MAAM,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,GAAG,wDACxD,mBAAmB,GACpB,CAAC;gBAEF,MAAM,wBAAwB,CAC5B,+BAA+B,EAC/B,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,KAAK,EAAE,EAAE,EAAE,EAAE;oBACX,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;wBACnC,IAAI,EAAE;4BACJ,IAAI,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,EAAE,2DAA2D;4BACxF,QAAQ,EAAE,QAAQ;4BAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;4BAC5B,QAAQ,EAAE,IAAI,EAAE,gFAAgF;4BAChG,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;4BAClC,OAAO,EAAE,OAAO;4BAChB,cAAc,EAAE,cAAc;yBAC/B;qBACF,CAAC,CAAC;gBACL,CAAC,EACD;oBACE,GAAG,mBAAmB,CAAC,UAAU,EAAE,wCAAwC;oBAC3E,UAAU,EAAE,CAAC;oBACb,WAAW,EAAE,GAAG;oBAChB,OAAO,EAAE;wBACP,SAAS,EAAE,WAAW;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;iBACF,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,qDAAqD;gBACrD,0CAA0C;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+EAA+E,EAC/E,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzC,CAAC;YACJ,CAAC;YAED,uDAAuD;YACvD,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAE9M,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;oBAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,mCAAmC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC3D,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,uBAAuB,CAAC,QAA4B;QAC1D,MAAM,aAAa,GAAuC;YACxD,QAAQ,EAAE,GAAG,EAAE,kCAAkC;YACjD,IAAI,EAAE,EAAE,EAAE,iCAAiC;YAC3C,MAAM,EAAE,EAAE,EAAE,0BAA0B;YACtC,GAAG,EAAE,CAAC,EAAE,sBAAsB;SAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArUD,kCAqUC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,GAAe,EACf,SAAkB;IAElB,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/auth/auth-context.d.ts

@@ -0,0 +1,34 @@
+/**
+ * AuthContext — the resolved identity for one authenticated request.
+ *
+ * Built by authMiddleware from verified Cognito JWT claims. Every route
+ * handler that needs auth information receives this rather than the raw
+ * token payload.
+ */
+import type { TenantRole, UserRole, TenantMember, Tenant } from "@prisma/client";
+/** The data carried from a Cognito JWT into each request. */
+export interface AuthContext {
+    /** Cognito user pool sub (UUID). Stable identifier used for cache keys. */
+    cognitoSub: string;
+    /** Skybber `User.id` (cuid). */
+    userId: string;
+    /** Platform-wide role from `users.role`. */
+    globalRole: UserRole;
+    /** The tenant the user is currently acting as (`custom:activeTenantId`). */
+    activeTenantId: string;
+    /** Human-readable slug of the active tenant. */
+    tenantSlug: string;
+    /** Role within the active tenant. */
+    tenantRole: TenantRole;
+    /** ActivityPub-style handle. */
+    handle: string;
+    /**
+     * Lazy loader for all of the user's tenant memberships.
+     * Fetched at most once per request; stored on the context so callers
+     * (e.g. tenant-switcher UI) don't duplicate the DB query.
+     */
+    membershipsLoader: () => Promise<(TenantMember & {
+        tenant: Tenant;
+    })[]>;
+}
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/lib/auth/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEjF,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,UAAU,EAAE,QAAQ,CAAC;IACrB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,UAAU,EAAE,UAAU,CAAC;IACvB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC,CAAC;CACzE"}

package/dist/lib/auth/auth-context.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * AuthContext — the resolved identity for one authenticated request.
+ *
+ * Built by authMiddleware from verified Cognito JWT claims. Every route
+ * handler that needs auth information receives this rather than the raw
+ * token payload.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=auth-context.js.map

package/dist/lib/auth/auth-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-context.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG"}