@de-otio/trellis 0.7.0 → 0.9.0

package/src/lambda/pre-token-generation.ts

@@ -23,33 +23,40 @@ import type {
   PreTokenGenerationV2TriggerEvent,
   PreTokenGenerationV2TriggerHandler,
 } from "aws-lambda";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient, type TenantRole } from "@prisma/client";
 import {
   ClaimsCache,
   createClaimsCacheFromEnv,
   DEFAULT_CACHE_TTL_SECONDS,
   type CachedClaims,
-} from "../lib/auth/claims-cache";
-import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role";
+} from "../lib/auth/claims-cache.js";
+import { resolveTenantRole, type RoleMappingInput } from "../lib/tenant/resolve-role.js";
 
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
+const logger = new Logger({ serviceName: "pre-token-generation" });
 let prisma: PrismaClient | null = null;
 let cache: ClaimsCache | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(
-    new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }),
-  );
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: {
-      db: {
-        url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
-      },
-    },
+  const { username, password, host, port, dbname } = (await getSecret(
+    process.env.DB_SECRET_ARN!,
+    { transform: "json" },
+  )) as unknown as {
+    username: string;
+    password: string;
+    host: string;
+    port: string | number;
+    dbname: string;
+  };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -213,18 +220,15 @@ export const handler: PreTokenGenerationV2TriggerHandler = async (event) => {
     try {
       preferredTenantId = await claimsCache.getActiveTenantPreference(cognitoSub);
     } catch (err) {
-      console.warn(
-        JSON.stringify({
-          event: "pretoken.preference_lookup_failed",
-          cognitoSub,
-          error: (err as { code?: string })?.code ?? "unknown",
-        }),
-      );
+      logger.warn("pretoken.preference_lookup_failed", {
+        cognitoSub,
+        error: (err as { code?: string })?.code ?? "unknown",
+      });
     }
     const loaded = await loadFromRds(db, cognitoSub, federated, preferredTenantId);
 
     if (!loaded.user) {
-      console.warn(JSON.stringify({ event: "pretoken.drift", cognitoSub }));
+      logger.warn("pretoken.drift", { cognitoSub });
       claims = { ...DRIFT_CLAIMS };
       writeAccessTokenClaims(event, claims);
       return event;
@@ -235,7 +239,7 @@ export const handler: PreTokenGenerationV2TriggerHandler = async (event) => {
     // value when present). Treat either signal as suspension. Defense-in-depth:
     // even if a writer forgets one column, the other still blocks issuance.
     if (loaded.user.suspended || loaded.user.suspendedAt !== null) {
-      console.warn(JSON.stringify({ event: "pretoken.suspended", cognitoSub }));
+      logger.warn("pretoken.suspended", { cognitoSub });
       claims = { ...DRIFT_CLAIMS };
       writeAccessTokenClaims(event, claims);
       return event;
@@ -274,34 +278,25 @@ export const handler: PreTokenGenerationV2TriggerHandler = async (event) => {
           });
           persisted = true;
         } catch (err) {
-          console.warn(
-            JSON.stringify({
-              event: "pretoken.role_refresh_persist_failed",
-              cognitoSub,
-              error: (err as { code?: string })?.code ?? "unknown",
-            }),
-          );
+          logger.warn("pretoken.role_refresh_persist_failed", {
+            cognitoSub,
+            error: (err as { code?: string })?.code ?? "unknown",
+          });
         }
         if (persisted) {
           claims = { ...claims, tenantRole: refreshed };
           cacheHit = false;
-          console.log(
-            JSON.stringify({
-              event: "pretoken.role_refreshed",
-              cognitoSub,
-              tenantId: claims.activeTenantId,
-            }),
-          );
+          logger.info("pretoken.role_refreshed", {
+            cognitoSub,
+            tenantId: claims.activeTenantId,
+          });
         }
       }
     } catch (err) {
-      console.warn(
-        JSON.stringify({
-          event: "pretoken.role_refresh_failed",
-          cognitoSub,
-          error: (err as { code?: string }).code ?? "unknown",
-        }),
-      );
+      logger.warn("pretoken.role_refresh_failed", {
+        cognitoSub,
+        error: (err as { code?: string }).code ?? "unknown",
+      });
     }
   }
 

package/src/lambda/verify-auth-challenge.ts

@@ -1,5 +1,8 @@
 import { timingSafeEqual, createHash } from "node:crypto";
 import { DynamoDBClient, DeleteItemCommand } from "@aws-sdk/client-dynamodb";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "verify-auth-challenge" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
 const TABLE = process.env.DYNAMODB_TABLE!;
@@ -29,7 +32,7 @@ export const handler = async (event: any) => {
         },
       }));
     } catch (err) {
-      console.error("Failed to delete magic link token", err);
+      logger.error("Failed to delete magic link token", { error: err });
     }
   }
 

package/dist/lib/audit/emit.d.ts

@@ -1,56 +0,0 @@
-/**
- * AuditEventEmitter
- *
- * Writes structured audit events to CloudWatch Logs and Postgres security_events.
- * Emission is non-blocking — callers do `void emitter.emit(...)`.
- * CloudWatch failures fall back to a console.error "audit-fallback" line that
- * ops can grep from the log stream.
- */
-import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
-import type { AuditEventType } from "./event-types";
-export interface AuditEmitInput {
-    type: AuditEventType;
-    tenantId: string;
-    actorUserId: string;
-    payload: Record<string, unknown>;
-    /** Source IP — will be anonymised to /24 before storage. */
-    sourceIp?: string;
-    /** Present when the request was made through an agent session (T9b). */
-    agentSessionId?: string;
-}
-export interface AuditRecord {
-    eventId: string;
-    type: AuditEventType;
-    tenantId: string;
-    actorUserId: string;
-    payload: Record<string, unknown>;
-    sourceIp: string;
-    agentSessionId: string | null;
-    createdAt: Date;
-}
-export declare class AuditEventEmitter {
-    private readonly cwClient;
-    constructor(cwClient?: CloudWatchLogsClient);
-    /**
-     * Emit an audit event. Returns a promise but callers should fire-and-forget
-     * via `void emitter.emit(...)` — the handler must not await this.
-     */
-    emit(input: AuditEmitInput, dbClient: {
-        securityEvent: {
-            create: (args: {
-                data: {
-                    type: string;
-                    severity: string;
-                    tenantId: string;
-                    userId: string;
-                    ipAddress: string;
-                    details: string;
-                    retentionUntil: Date;
-                };
-            }) => Promise<unknown>;
-        };
-    }): Promise<void>;
-    private _writeToCloudWatch;
-    private _writeToPostgres;
-}
-//# sourceMappingURL=emit.d.ts.map

package/dist/lib/audit/emit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,EAErB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;CACjB;AAOD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;gBAEpC,QAAQ,CAAC,EAAE,oBAAoB;IAQ3C;;;OAGG;IACG,IAAI,CACR,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE;QACR,aAAa,EAAE;YACb,MAAM,EAAE,CAAC,IAAI,EAAE;gBACb,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC;oBACb,QAAQ,EAAE,MAAM,CAAC;oBACjB,QAAQ,EAAE,MAAM,CAAC;oBACjB,MAAM,EAAE,MAAM,CAAC;oBACf,SAAS,EAAE,MAAM,CAAC;oBAClB,OAAO,EAAE,MAAM,CAAC;oBAChB,cAAc,EAAE,IAAI,CAAC;iBACtB,CAAC;aACH,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;SACxB,CAAC;KACH,GACA,OAAO,CAAC,IAAI,CAAC;YA0CF,kBAAkB;YAmClB,gBAAgB;CA4C/B"}

package/dist/lib/audit/emit.js

@@ -1,124 +0,0 @@
-"use strict";
-/**
- * AuditEventEmitter
- *
- * Writes structured audit events to CloudWatch Logs and Postgres security_events.
- * Emission is non-blocking — callers do `void emitter.emit(...)`.
- * CloudWatch failures fall back to a console.error "audit-fallback" line that
- * ops can grep from the log stream.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuditEventEmitter = void 0;
-const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
-const crypto_1 = require("crypto");
-const pii_filter_1 = require("./pii-filter");
-function getLogGroup() {
-    const stage = process.env.STAGE ?? "dev";
-    return process.env.AUDIT_LOG_GROUP ?? `/skybber/${stage}/audit-events`;
-}
-class AuditEventEmitter {
-    cwClient;
-    constructor(cwClient) {
-        this.cwClient =
-            cwClient ??
-                new client_cloudwatch_logs_1.CloudWatchLogsClient({
-                    region: process.env.AWS_REGION ?? "eu-central-1",
-                });
-    }
-    /**
-     * Emit an audit event. Returns a promise but callers should fire-and-forget
-     * via `void emitter.emit(...)` — the handler must not await this.
-     */
-    async emit(input, dbClient) {
-        const eventId = (0, crypto_1.randomUUID)();
-        const createdAt = new Date();
-        const anonymisedIp = input.sourceIp ? (0, pii_filter_1.anonymizeIp)(input.sourceIp) : "unknown";
-        const { filtered, droppedCount } = (0, pii_filter_1.filterPayload)({
-            ...input.payload,
-            tenantId: input.tenantId,
-            actorUserId: input.actorUserId,
-            sourceIp: anonymisedIp,
-            ...(input.agentSessionId ? { agentSessionId: input.agentSessionId } : {}),
-        });
-        if (droppedCount > 0) {
-            console.error(JSON.stringify({
-                level: "warn",
-                tag: "audit-pii-filter",
-                eventId,
-                type: input.type,
-                droppedCount,
-            }));
-        }
-        const record = {
-            eventId,
-            type: input.type,
-            tenantId: input.tenantId,
-            actorUserId: input.actorUserId,
-            payload: filtered,
-            sourceIp: anonymisedIp,
-            agentSessionId: input.agentSessionId ?? null,
-            createdAt,
-        };
-        await Promise.all([
-            this._writeToCloudWatch(record),
-            this._writeToPostgres(record, dbClient),
-        ]);
-    }
-    async _writeToCloudWatch(record) {
-        const logGroup = getLogGroup();
-        const logStream = `audit-${record.tenantId}`;
-        const message = JSON.stringify(record);
-        try {
-            await this.cwClient.send(new client_cloudwatch_logs_1.PutLogEventsCommand({
-                logGroupName: logGroup,
-                logStreamName: logStream,
-                logEvents: [
-                    {
-                        timestamp: record.createdAt.getTime(),
-                        message,
-                    },
-                ],
-            }));
-        }
-        catch (err) {
-            console.error(JSON.stringify({
-                level: "error",
-                tag: "audit-fallback",
-                eventId: record.eventId,
-                type: record.type,
-                tenantId: record.tenantId,
-                actorUserId: record.actorUserId,
-                createdAt: record.createdAt.toISOString(),
-                payload: record.payload,
-                cwError: err instanceof Error ? err.message : String(err),
-            }));
-        }
-    }
-    async _writeToPostgres(record, db) {
-        const retentionUntil = new Date(record.createdAt);
-        retentionUntil.setDate(retentionUntil.getDate() + 30);
-        try {
-            await db.securityEvent.create({
-                data: {
-                    type: record.type,
-                    severity: "medium",
-                    tenantId: record.tenantId,
-                    userId: record.actorUserId,
-                    ipAddress: record.sourceIp,
-                    details: JSON.stringify({ ...record.payload, eventId: record.eventId }),
-                    retentionUntil,
-                },
-            });
-        }
-        catch (err) {
-            console.error(JSON.stringify({
-                level: "error",
-                tag: "audit-fallback",
-                eventId: record.eventId,
-                pgError: err instanceof Error ? err.message : String(err),
-            }));
-        }
-    }
-}
-exports.AuditEventEmitter = AuditEventEmitter;
-//# sourceMappingURL=emit.js.map

package/dist/lib/audit/emit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../../src/lib/audit/emit.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,4EAGyC;AACzC,mCAAoC;AAEpC,6CAA0D;AAwB1D,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,YAAY,KAAK,eAAe,CAAC;AACzE,CAAC;AAED,MAAa,iBAAiB;IACX,QAAQ,CAAuB;IAEhD,YAAY,QAA+B;QACzC,IAAI,CAAC,QAAQ;YACX,QAAQ;gBACR,IAAI,6CAAoB,CAAC;oBACvB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,cAAc;iBACjD,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CACR,KAAqB,EACrB,QAcC;QAED,MAAM,OAAO,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAa,EAAC;YAC/C,GAAG,KAAK,CAAC,OAAO;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,YAAY;YACtB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,MAAM;gBACb,GAAG,EAAE,kBAAkB;gBACvB,OAAO;gBACP,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY;aACb,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,YAAY;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,SAAS;SACV,CAAC;QAEF,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,MAAmB;QAClD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,SAAS,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CACtB,IAAI,4CAAmB,CAAC;gBACtB,YAAY,EAAE,QAAQ;gBACtB,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE;oBACT;wBACE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;wBACrC,OAAO;qBACR;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,OAAO;gBACd,GAAG,EAAE,gBAAgB;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,MAAmB,EACnB,EAcC;QAED,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;gBAC5B,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,WAAW;oBAC1B,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;oBACvE,cAAc;iBACf;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,OAAO;gBACd,GAAG,EAAE,gBAAgB;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAzJD,8CAyJC"}

package/dist/lib/audit/event-types.d.ts

@@ -1,36 +0,0 @@
-/**
- * Audit Event Types
- *
- * Canonical catalog of all identity-federation audit events.
- * Every AuditEventType emitted by a handler must appear here.
- */
-export declare const AuditEventType: {
-    readonly TENANT_CREATED: "tenant.created";
-    readonly TENANT_MEMBER_INVITED: "tenant.member.invited";
-    readonly TENANT_MEMBER_JOINED: "tenant.member.joined";
-    readonly TENANT_MEMBER_ROLE_CHANGED: "tenant.member.role_changed";
-    readonly TENANT_MEMBER_REMOVED: "tenant.member.removed";
-    readonly TENANT_DOMAIN_ADDED: "tenant.domain.added";
-    readonly TENANT_DOMAIN_VERIFIED: "tenant.domain.verified";
-    readonly TENANT_IDP_CONNECTED: "tenant.idp.connected";
-    readonly TENANT_IDP_MODIFIED: "tenant.idp.modified";
-    readonly TENANT_IDP_DISABLED: "tenant.idp.disabled";
-    readonly TENANT_IDP_DELETED: "tenant.idp.deleted";
-    readonly TENANT_ROLE_MAPPING_ADDED: "tenant.role_mapping.added";
-    readonly TENANT_ROLE_MAPPING_REMOVED: "tenant.role_mapping.removed";
-    readonly TENANT_FEDERATED_LOGIN_SUCCESS: "tenant.federated_login.success";
-    readonly TENANT_FEDERATED_LOGIN_DENIED: "tenant.federated_login.denied";
-    readonly TENANT_ROLE_REFRESHED_JIT: "tenant.role.refreshed_jit";
-    readonly TENANT_OWNERSHIP_TRANSFERRED: "tenant.ownership_transferred";
-    readonly TENANT_UPDATED: "tenant.updated";
-    readonly AUTH_AGENT_SESSION_APPROVED: "auth.agent_session.approved";
-    readonly AUTH_AGENT_SESSION_REVOKED: "auth.agent_session.revoked";
-    readonly AUTH_REFRESH_REPLAY: "auth.refresh_replay";
-};
-export type AuditEventType = (typeof AuditEventType)[keyof typeof AuditEventType];
-/**
- * Per-type allowed payload field names (allowlist).
- * Populated by the PII filter — anything outside this set is redacted.
- */
-export declare const PII_ALLOWED_FIELDS: Set<string>;
-//# sourceMappingURL=event-types.d.ts.map

package/dist/lib/audit/event-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-types.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/event-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;CAsBjB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aA+B7B,CAAC"}

package/dist/lib/audit/event-types.js

@@ -1,69 +0,0 @@
-"use strict";
-/**
- * Audit Event Types
- *
- * Canonical catalog of all identity-federation audit events.
- * Every AuditEventType emitted by a handler must appear here.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PII_ALLOWED_FIELDS = exports.AuditEventType = void 0;
-exports.AuditEventType = {
-    TENANT_CREATED: "tenant.created",
-    TENANT_MEMBER_INVITED: "tenant.member.invited",
-    TENANT_MEMBER_JOINED: "tenant.member.joined",
-    TENANT_MEMBER_ROLE_CHANGED: "tenant.member.role_changed",
-    TENANT_MEMBER_REMOVED: "tenant.member.removed",
-    TENANT_DOMAIN_ADDED: "tenant.domain.added",
-    TENANT_DOMAIN_VERIFIED: "tenant.domain.verified",
-    TENANT_IDP_CONNECTED: "tenant.idp.connected",
-    TENANT_IDP_MODIFIED: "tenant.idp.modified",
-    TENANT_IDP_DISABLED: "tenant.idp.disabled",
-    TENANT_IDP_DELETED: "tenant.idp.deleted",
-    TENANT_ROLE_MAPPING_ADDED: "tenant.role_mapping.added",
-    TENANT_ROLE_MAPPING_REMOVED: "tenant.role_mapping.removed",
-    TENANT_FEDERATED_LOGIN_SUCCESS: "tenant.federated_login.success",
-    TENANT_FEDERATED_LOGIN_DENIED: "tenant.federated_login.denied",
-    TENANT_ROLE_REFRESHED_JIT: "tenant.role.refreshed_jit",
-    TENANT_OWNERSHIP_TRANSFERRED: "tenant.ownership_transferred",
-    TENANT_UPDATED: "tenant.updated",
-    AUTH_AGENT_SESSION_APPROVED: "auth.agent_session.approved",
-    AUTH_AGENT_SESSION_REVOKED: "auth.agent_session.revoked",
-    AUTH_REFRESH_REPLAY: "auth.refresh_replay",
-};
-/**
- * Per-type allowed payload field names (allowlist).
- * Populated by the PII filter — anything outside this set is redacted.
- */
-exports.PII_ALLOWED_FIELDS = new Set([
-    "tenantId",
-    "actorUserId",
-    "targetUserId",
-    "targetType",
-    "oldRole",
-    "newRole",
-    "domain",
-    "idpStatus",
-    "idpKind",
-    "issuer",
-    "idpGroup",
-    "role",
-    "source",
-    "reason",
-    "verificationMethod",
-    "changedAttributes",
-    "sourceIp",
-    "agentSessionId",
-    "slug",
-    "displayName",
-    "type",
-    "agentLabel",
-    "userAgent",
-    // G4 MEDIUM-6/N2: `deviceCodeHash` was previously written into
-    // AUTH_AGENT_SESSION_APPROVED audit payloads and could act as a
-    // confirmation oracle if a raw device_code ever leaked elsewhere.
-    // Removed from the allow-list so a future regression that re-adds
-    // the field would fail the audit-emit allow-list check.
-    "refreshJti",
-    "cognitoUserId",
-]);
-//# sourceMappingURL=event-types.js.map

package/dist/lib/audit/event-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-types.js","sourceRoot":"","sources":["../../../src/lib/audit/event-types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEU,QAAA,cAAc,GAAG;IAC5B,cAAc,EAAE,gBAAgB;IAChC,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,0BAA0B,EAAE,4BAA4B;IACxD,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,sBAAsB,EAAE,wBAAwB;IAChD,oBAAoB,EAAE,sBAAsB;IAC5C,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,yBAAyB,EAAE,2BAA2B;IACtD,2BAA2B,EAAE,6BAA6B;IAC1D,8BAA8B,EAAE,gCAAgC;IAChE,6BAA6B,EAAE,+BAA+B;IAC9D,yBAAyB,EAAE,2BAA2B;IACtD,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,2BAA2B,EAAE,6BAA6B;IAC1D,0BAA0B,EAAE,4BAA4B;IACxD,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAIX;;;GAGG;AACU,QAAA,kBAAkB,GAAG,IAAI,GAAG,CAAS;IAChD,UAAU;IACV,aAAa;IACb,cAAc;IACd,YAAY;IACZ,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,oBAAoB;IACpB,mBAAmB;IACnB,UAAU;IACV,gBAAgB;IAChB,MAAM;IACN,aAAa;IACb,MAAM;IACN,YAAY;IACZ,WAAW;IACX,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,kEAAkE;IAClE,wDAAwD;IACxD,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC"}

package/dist/lib/audit-logger.d.ts

@@ -1,142 +0,0 @@
-/**
- * Audit Logger Module
- *
- * Provides audit logging for data access and user actions with region tracking.
- *
- * Security: All audit events are stored in database with region/dataRegion tracking
- * for compliance and data residency verification.
- *
- * Uses existing Logger for application logging and SecurityEvent table for persistence.
- */
-import { type LoggerEnv } from "./logger";
-import { type EnvWithDb } from "../db";
-import { type Region } from "./region-detection";
-/**
- * Environment interface for audit logger
- */
-export interface AuditLoggerEnv extends EnvWithDb, LoggerEnv {
-    DEFAULT_REGION?: string;
-}
-/**
- * Audit event types
- */
-export type AuditEventType = "data_access" | "data_create" | "data_update" | "data_delete" | "user_action" | "authentication" | "authorization" | "region_change";
-/**
- * Audit event severity
- */
-export type AuditEventSeverity = "low" | "medium" | "high" | "critical";
-/**
- * Audit event interface
- */
-export interface AuditEvent {
-    type: AuditEventType;
-    action: string;
-    resource: string;
-    resourceId?: string;
-    userId?: string;
-    region: Region;
-    dataRegion?: string;
-    ipAddress?: string;
-    userAgent?: string;
-    metadata?: Record<string, unknown>;
-    severity?: AuditEventSeverity;
-    success: boolean;
-}
-/**
- * Audit Logger class
- *
- * Provides audit logging with region tracking for compliance.
- */
-export declare class AuditLogger {
-    private logger;
-    private requestId?;
-    constructor(env?: LoggerEnv, requestId?: string);
-    /**
-     * Create audit logger with request ID for correlation
-     */
-    withRequestId(requestId: string): AuditLogger;
-    /**
-     * Log data access event
-     *
-     * Use this for read operations (GET, SELECT).
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    logDataAccess(event: Omit<AuditEvent, "type" | "severity"> & {
-        type?: AuditEventType;
-        severity?: AuditEventSeverity;
-    }, env: AuditLoggerEnv): Promise<void>;
-    /**
-     * Log user action event
-     *
-     * Use this for user-initiated actions (create, update, delete).
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    logUserAction(event: Omit<AuditEvent, "type" | "severity"> & {
-        type?: AuditEventType;
-        severity?: AuditEventSeverity;
-    }, env: AuditLoggerEnv): Promise<void>;
-    /**
-     * Log authentication event
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    logAuthentication(event: Omit<AuditEvent, "type" | "severity"> & {
-        type?: AuditEventType;
-        severity?: AuditEventSeverity;
-    }, env: AuditLoggerEnv): Promise<void>;
-    /**
-     * Log authorization event
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    logAuthorization(event: Omit<AuditEvent, "type" | "severity"> & {
-        type?: AuditEventType;
-        severity?: AuditEventSeverity;
-    }, env: AuditLoggerEnv): Promise<void>;
-    /**
-     * Generic log method that routes to the appropriate specific log method
-     *
-     * @param event - Audit event details
-     * @param env - Environment variables
-     */
-    log(event: Omit<AuditEvent, "severity"> & {
-        severity?: AuditEventSeverity;
-    }, env: AuditLoggerEnv): Promise<void>;
-    /**
-     * Log audit event to database and application logs
-     *
-     * Security: All audit events are stored in database with region/dataRegion tracking.
-     *
-     * @param event - Audit event to log
-     * @param env - Environment variables
-     */
-    private logAuditEvent;
-    /**
-     * Calculate retention date based on severity
-     *
-     * Retention periods:
-     * - critical: 365 days (1 year)
-     * - high: 90 days
-     * - medium: 30 days
-     * - low: 7 days
-     *
-     * @param severity - Event severity level
-     * @returns Date when the event should be deleted, or null if retention is disabled
-     */
-    private calculateRetentionUntil;
-}
-/**
- * Create an audit logger instance
- *
- * @param env - Environment variables
- * @param requestId - Optional request ID for correlation
- * @returns AuditLogger instance
- */
-export declare function createAuditLogger(env?: LoggerEnv, requestId?: string): AuditLogger;
-//# sourceMappingURL=audit-logger.d.ts.map

package/dist/lib/audit-logger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/lib/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,SAAS,EAAE,SAAS;IAE1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM;IAK/C;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW;IAO7C;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,iBAAiB,CACrB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,gBAAgB,CACpB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,GAAG,CACP,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,kBAAkB,CAAA;KAAE,EACvE,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;OAOG;YACW,aAAa;IAkH3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;CAahC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,SAAS,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,WAAW,CAEb"}