@de-otio/trellis 0.7.1 → 0.10.0

package/dist/lib/audit/csv-export.js

@@ -1,17 +1,10 @@
-"use strict";
 /**
  * CSV Export for Audit Events (RFC 4180)
  *
  * Fields that contain commas, double-quotes, or newlines are enclosed in
  * double-quotes. Inner double-quotes are doubled per RFC 4180 §2.7.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CSV_HEADERS = void 0;
-exports.escapeCsvField = escapeCsvField;
-exports.renderCsvRow = renderCsvRow;
-exports.renderCsvHeader = renderCsvHeader;
-exports.renderCsv = renderCsv;
-exports.CSV_HEADERS = [
+export const CSV_HEADERS = [
     "eventId",
     "type",
     "tenantId",
@@ -21,22 +14,22 @@ exports.CSV_HEADERS = [
     "payload",
 ];
 /** Escape a single CSV field per RFC 4180. */
-function escapeCsvField(value) {
+export function escapeCsvField(value) {
     if (value.includes(",") || value.includes('"') || value.includes("\n") || value.includes("\r")) {
         return `"${value.replace(/"/g, '""')}"`;
     }
     return value;
 }
 /** Render one CSV row from an array of string values. */
-function renderCsvRow(fields) {
+export function renderCsvRow(fields) {
     return fields.map(escapeCsvField).join(",");
 }
 /** Render the header row. */
-function renderCsvHeader() {
-    return renderCsvRow([...exports.CSV_HEADERS]);
+export function renderCsvHeader() {
+    return renderCsvRow([...CSV_HEADERS]);
 }
 /** Render a complete CSV document (header + rows) from an array of row objects. */
-function renderCsv(rows) {
+export function renderCsv(rows) {
     const lines = [renderCsvHeader()];
     for (const row of rows) {
         lines.push(renderCsvRow([

package/dist/lib/audit/csv-export.js.map

@@ -1 +1 @@
-{"version":3,"file":"csv-export.js","sourceRoot":"","sources":["../../../src/lib/audit/csv-export.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAuBH,wCAKC;AAGD,oCAEC;AAGD,0CAEC;AAGD,8BAgBC;AAvDY,QAAA,WAAW,GAAG;IACzB,SAAS;IACT,MAAM;IACN,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;CACD,CAAC;AAYX,8CAA8C;AAC9C,SAAgB,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAgB,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,6BAA6B;AAC7B,SAAgB,eAAe;IAC7B,OAAO,YAAY,CAAC,CAAC,GAAG,mBAAW,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,mFAAmF;AACnF,SAAgB,SAAS,CAAC,IAAc;IACtC,MAAM,KAAK,GAAa,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,YAAY,CAAC;YACX,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;SACZ,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"csv-export.js","sourceRoot":"","sources":["../../../src/lib/audit/csv-export.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS;IACT,MAAM;IACN,UAAU;IACV,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;CACD,CAAC;AAYX,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,KAAK,GAAa,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,YAAY,CAAC;YACX,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;SACZ,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/lib/audit/pii-filter.d.ts

@@ -5,6 +5,15 @@
  * with the literal string "<redacted>" and a drop counter is incremented.
  * Claim *names* are fine to store; claim *values* must never appear.
  */
+/**
+ * Per-key allowlist for audit metadata. Anything outside this set is
+ * replaced with "<redacted>". Migrated here from the now-deleted
+ * `event-types.ts` (phase 1.C.2) so the allowlist lives next to the
+ * filter that consumes it.
+ *
+ * Claim *names* are fine to store; claim *values* must never appear.
+ */
+export declare const PII_ALLOWED_FIELDS: Set<string>;
 export interface FilterResult {
     filtered: Record<string, unknown>;
     droppedCount: number;

package/dist/lib/audit/pii-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pii-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/pii-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAiB9C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,GAAG,CAAC,MAAM,CAAsB,GAC9C,YAAY,CAcd"}
+{"version":3,"file":"pii-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/audit/pii-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,aA8C7B,CAAC;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAiB9C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,GAAE,GAAG,CAAC,MAAM,CAAsB,GAC9C,YAAY,CAcd"}

package/dist/lib/audit/pii-filter.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * PII Filter for Audit Payloads
  *
@@ -6,15 +5,66 @@
  * with the literal string "<redacted>" and a drop counter is incremented.
  * Claim *names* are fine to store; claim *values* must never appear.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.anonymizeIp = anonymizeIp;
-exports.filterPayload = filterPayload;
-const event_types_1 = require("./event-types");
+/**
+ * Per-key allowlist for audit metadata. Anything outside this set is
+ * replaced with "<redacted>". Migrated here from the now-deleted
+ * `event-types.ts` (phase 1.C.2) so the allowlist lives next to the
+ * filter that consumes it.
+ *
+ * Claim *names* are fine to store; claim *values* must never appear.
+ */
+export const PII_ALLOWED_FIELDS = new Set([
+    "tenantId",
+    "actorUserId",
+    "targetUserId",
+    "targetType",
+    "oldRole",
+    "newRole",
+    "domain",
+    "idpStatus",
+    "idpKind",
+    "issuer",
+    "idpGroup",
+    "role",
+    "source",
+    "reason",
+    "verificationMethod",
+    "changedAttributes",
+    "sourceIp",
+    "agentSessionId",
+    "slug",
+    "displayName",
+    "type",
+    "agentLabel",
+    "userAgent",
+    // G4 MEDIUM-6/N2: `deviceCodeHash` was previously written into
+    // AUTH_AGENT_SESSION_APPROVED audit payloads and could act as a
+    // confirmation oracle if a raw device_code ever leaked elsewhere.
+    // Kept OFF the allow-list so a future regression that re-adds the
+    // field would fail the audit-emit allow-list check.
+    "refreshJti",
+    "cognitoUserId",
+    // Region codes are NOT PII (US/EU/CN); they are data-residency
+    // compliance signals carried by the data-lifecycle audit events.
+    // Added in phase 1.C.2 so the data-router region context survives
+    // the allowlist instead of being redacted away. See migration note.
+    "region",
+    "dataRegion",
+    "requestedRegion",
+    "actualDataRegion",
+    // Feature-toggle audit fields (feature_toggle.changed events).
+    // key is a system identifier (no PII); oldEnabled/newEnabled are booleans;
+    // changedBy carries the admin's USER ID (never email — see convention doc).
+    "key",
+    "oldEnabled",
+    "newEnabled",
+    "changedBy",
+]);
 /**
  * Redact IPv4 to /24 and IPv6 to /64 for GDPR-compliant storage.
  * "1.2.3.4" → "1.2.3.0/24", "2001:db8::1" → "2001:db8::/64"
  */
-function anonymizeIp(ip) {
+export function anonymizeIp(ip) {
     if (!ip || ip === "unknown")
         return ip;
     if (ip.includes(".")) {
@@ -34,7 +84,7 @@ function anonymizeIp(ip) {
  * Filter a raw payload object against the PII allowlist.
  * Returns the cleaned object and the number of dropped fields.
  */
-function filterPayload(payload, allowedFields = event_types_1.PII_ALLOWED_FIELDS) {
+export function filterPayload(payload, allowedFields = PII_ALLOWED_FIELDS) {
     const filtered = {};
     let droppedCount = 0;
     for (const [key, value] of Object.entries(payload)) {

package/dist/lib/audit/pii-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii-filter.js","sourceRoot":"","sources":["../../../src/lib/audit/pii-filter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAaH,kCAiBC;AAMD,sCAiBC;AAnDD,+CAAmD;AAOnD;;;GAGG;AACH,SAAgB,WAAW,CAAC,EAAU;IACpC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEvC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,GAAG,MAAM,OAAO,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAC3B,OAAgC,EAChC,gBAA6B,gCAAkB;IAE/C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"pii-filter.js","sourceRoot":"","sources":["../../../src/lib/audit/pii-filter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IAChD,UAAU;IACV,aAAa;IACb,cAAc;IACd,YAAY;IACZ,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,oBAAoB;IACpB,mBAAmB;IACnB,UAAU;IACV,gBAAgB;IAChB,MAAM;IACN,aAAa;IACb,MAAM;IACN,YAAY;IACZ,WAAW;IACX,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,kEAAkE;IAClE,oDAAoD;IACpD,YAAY;IACZ,eAAe;IACf,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,QAAQ;IACR,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,+DAA+D;IAC/D,2EAA2E;IAC3E,4EAA4E;IAC5E,KAAK;IACL,YAAY;IACZ,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAOH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEvC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,GAAG,MAAM,OAAO,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgC,EAChC,gBAA6B,kBAAkB;IAE/C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/lib/audit-actions.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Trellis audit-action constants (phase 1.C.2).
+ *
+ * These are the canonical `action` strings trellis writes to the
+ * foundation audit log. `AuditAction` is an OPEN string union (frozen
+ * type) — well-known foundation values get autocomplete; consumers
+ * extend with their own dotted names without an API bump. We therefore
+ * declare these as `AuditAction`-typed constants (NOT an enum) so the
+ * call sites read symbolically while the values stay plain strings.
+ *
+ * Naming follows foundation's dotted convention. Two families:
+ *   - data lifecycle  (data.*, auth.*, system.region_change)
+ *   - tenant / IdP     (tenant.*, auth.agent_session.*, auth.refresh_replay)
+ *
+ * The tenant/IdP set is the migration of the old
+ * `lib/audit/event-types.ts` `AuditEventType` catalog; the string
+ * VALUES are preserved exactly so existing rows / dashboards keep
+ * matching.
+ */
+import type { AuditAction } from "@de-otio/saas-foundation/audit";
+export declare const DATA_READ: AuditAction;
+export declare const DATA_CREATE: AuditAction;
+export declare const DATA_UPDATE: AuditAction;
+export declare const DATA_DELETE: AuditAction;
+export declare const AUTH_LOGIN: AuditAction;
+export declare const AUTH_LOGOUT: AuditAction;
+export declare const AUTHZ_DENIED: AuditAction;
+export declare const AUTHZ_GRANTED: AuditAction;
+export declare const SYSTEM_REGION_CHANGE: AuditAction;
+export declare const TENANT_CREATED: AuditAction;
+export declare const TENANT_UPDATED: AuditAction;
+export declare const TENANT_OWNERSHIP_TRANSFERRED: AuditAction;
+export declare const TENANT_MEMBER_INVITED: AuditAction;
+export declare const TENANT_MEMBER_JOINED: AuditAction;
+export declare const TENANT_MEMBER_ROLE_CHANGED: AuditAction;
+export declare const TENANT_MEMBER_REMOVED: AuditAction;
+export declare const TENANT_DOMAIN_ADDED: AuditAction;
+export declare const TENANT_DOMAIN_VERIFIED: AuditAction;
+export declare const TENANT_DOMAIN_REMOVED: AuditAction;
+export declare const TENANT_IDP_CONNECTED: AuditAction;
+export declare const TENANT_IDP_MODIFIED: AuditAction;
+export declare const TENANT_IDP_DISABLED: AuditAction;
+export declare const TENANT_IDP_DELETED: AuditAction;
+export declare const TENANT_ROLE_MAPPING_ADDED: AuditAction;
+export declare const TENANT_ROLE_MAPPING_REMOVED: AuditAction;
+export declare const TENANT_FEDERATED_LOGIN_SUCCESS: AuditAction;
+export declare const TENANT_FEDERATED_LOGIN_DENIED: AuditAction;
+export declare const TENANT_ROLE_REFRESHED_JIT: AuditAction;
+export declare const AUTH_AGENT_SESSION_APPROVED: AuditAction;
+export declare const AUTH_AGENT_SESSION_REVOKED: AuditAction;
+export declare const AUTH_REFRESH_REPLAY: AuditAction;
+export declare const RESEARCH_QUERY: AuditAction;
+export declare const RESEARCH_EXTRACT: AuditAction;
+export declare const EXPERIMENT_ASSIGN: AuditAction;
+export declare const FEATURE_TOGGLE_CHANGED: AuditAction;
+export declare const CONSENT_CHANGED: AuditAction;
+/**
+ * Old tenant/IdP `AuditEventType` string -> `AuditAction` constant.
+ * The values are identical (preserved verbatim), so this is an identity
+ * map at runtime; it exists so the four `AuditEventEmitter` consumers
+ * (idp-handler, tenant-handler, agent-authorize, agent-sessions) can
+ * keep referencing `AuditEventType.TENANT_*` symbolically via a single
+ * re-exported object.
+ */
+export declare const AuditEventType: {
+    readonly TENANT_CREATED: string & {};
+    readonly TENANT_UPDATED: string & {};
+    readonly TENANT_OWNERSHIP_TRANSFERRED: string & {};
+    readonly TENANT_MEMBER_INVITED: string & {};
+    readonly TENANT_MEMBER_JOINED: string & {};
+    readonly TENANT_MEMBER_ROLE_CHANGED: string & {};
+    readonly TENANT_MEMBER_REMOVED: string & {};
+    readonly TENANT_DOMAIN_ADDED: string & {};
+    readonly TENANT_DOMAIN_VERIFIED: string & {};
+    readonly TENANT_DOMAIN_REMOVED: string & {};
+    readonly TENANT_IDP_CONNECTED: string & {};
+    readonly TENANT_IDP_MODIFIED: string & {};
+    readonly TENANT_IDP_DISABLED: string & {};
+    readonly TENANT_IDP_DELETED: string & {};
+    readonly TENANT_ROLE_MAPPING_ADDED: string & {};
+    readonly TENANT_ROLE_MAPPING_REMOVED: string & {};
+    readonly TENANT_FEDERATED_LOGIN_SUCCESS: string & {};
+    readonly TENANT_FEDERATED_LOGIN_DENIED: string & {};
+    readonly TENANT_ROLE_REFRESHED_JIT: string & {};
+    readonly AUTH_AGENT_SESSION_APPROVED: string & {};
+    readonly AUTH_AGENT_SESSION_REVOKED: string & {};
+    readonly AUTH_REFRESH_REPLAY: string & {};
+    readonly RESEARCH_QUERY: string & {};
+    readonly RESEARCH_EXTRACT: string & {};
+    readonly EXPERIMENT_ASSIGN: string & {};
+    readonly FEATURE_TOGGLE_CHANGED: string & {};
+    readonly CONSENT_CHANGED: string & {};
+};
+//# sourceMappingURL=audit-actions.d.ts.map

package/dist/lib/audit-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-actions.d.ts","sourceRoot":"","sources":["../../src/lib/audit-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAGlE,eAAO,MAAM,SAAS,EAAE,WAAyB,CAAC;AAClD,eAAO,MAAM,WAAW,EAAE,WAA2B,CAAC;AACtD,eAAO,MAAM,WAAW,EAAE,WAA2B,CAAC;AACtD,eAAO,MAAM,WAAW,EAAE,WAA2B,CAAC;AAEtD,eAAO,MAAM,UAAU,EAAE,WAA0B,CAAC;AACpD,eAAO,MAAM,WAAW,EAAE,WAA2B,CAAC;AACtD,eAAO,MAAM,YAAY,EAAE,WAA4B,CAAC;AACxD,eAAO,MAAM,aAAa,EAAE,WAA6B,CAAC;AAE1D,eAAO,MAAM,oBAAoB,EAAE,WAAoC,CAAC;AAIxE,eAAO,MAAM,cAAc,EAAE,WAA8B,CAAC;AAC5D,eAAO,MAAM,cAAc,EAAE,WAA8B,CAAC;AAC5D,eAAO,MAAM,4BAA4B,EAAE,WAA4C,CAAC;AACxF,eAAO,MAAM,qBAAqB,EAAE,WAAqC,CAAC;AAC1E,eAAO,MAAM,oBAAoB,EAAE,WAAoC,CAAC;AACxE,eAAO,MAAM,0BAA0B,EAAE,WAA0C,CAAC;AACpF,eAAO,MAAM,qBAAqB,EAAE,WAAqC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,EAAE,WAAmC,CAAC;AACtE,eAAO,MAAM,sBAAsB,EAAE,WAAsC,CAAC;AAC5E,eAAO,MAAM,qBAAqB,EAAE,WAAqC,CAAC;AAC1E,eAAO,MAAM,oBAAoB,EAAE,WAAoC,CAAC;AACxE,eAAO,MAAM,mBAAmB,EAAE,WAAmC,CAAC;AACtE,eAAO,MAAM,mBAAmB,EAAE,WAAmC,CAAC;AACtE,eAAO,MAAM,kBAAkB,EAAE,WAAkC,CAAC;AACpE,eAAO,MAAM,yBAAyB,EAAE,WAAyC,CAAC;AAClF,eAAO,MAAM,2BAA2B,EAAE,WAA2C,CAAC;AACtF,eAAO,MAAM,8BAA8B,EAAE,WAA8C,CAAC;AAC5F,eAAO,MAAM,6BAA6B,EAAE,WAA6C,CAAC;AAC1F,eAAO,MAAM,yBAAyB,EAAE,WAAyC,CAAC;AAElF,eAAO,MAAM,2BAA2B,EAAE,WAA2C,CAAC;AACtF,eAAO,MAAM,0BAA0B,EAAE,WAA0C,CAAC;AACpF,eAAO,MAAM,mBAAmB,EAAE,WAAmC,CAAC;AAOtE,eAAO,MAAM,cAAc,EAAE,WAA8B,CAAC;AAC5D,eAAO,MAAM,gBAAgB,EAAE,WAAgC,CAAC;AAChE,eAAO,MAAM,iBAAiB,EAAE,WAAiC,CAAC;AAKlE,eAAO,MAAM,sBAAsB,EAAE,WAAsC,CAAC;AAI5E,eAAO,MAAM,eAAe,EAAE,WAA+B,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BjB,CAAC"}

package/dist/lib/audit-actions.js

@@ -0,0 +1,107 @@
+/**
+ * Trellis audit-action constants (phase 1.C.2).
+ *
+ * These are the canonical `action` strings trellis writes to the
+ * foundation audit log. `AuditAction` is an OPEN string union (frozen
+ * type) — well-known foundation values get autocomplete; consumers
+ * extend with their own dotted names without an API bump. We therefore
+ * declare these as `AuditAction`-typed constants (NOT an enum) so the
+ * call sites read symbolically while the values stay plain strings.
+ *
+ * Naming follows foundation's dotted convention. Two families:
+ *   - data lifecycle  (data.*, auth.*, system.region_change)
+ *   - tenant / IdP     (tenant.*, auth.agent_session.*, auth.refresh_replay)
+ *
+ * The tenant/IdP set is the migration of the old
+ * `lib/audit/event-types.ts` `AuditEventType` catalog; the string
+ * VALUES are preserved exactly so existing rows / dashboards keep
+ * matching.
+ */
+// ── Data-lifecycle actions ───────────────────────────────────────────
+export const DATA_READ = "data.read";
+export const DATA_CREATE = "data.create";
+export const DATA_UPDATE = "data.update";
+export const DATA_DELETE = "data.delete";
+export const AUTH_LOGIN = "auth.login";
+export const AUTH_LOGOUT = "auth.logout";
+export const AUTHZ_DENIED = "authz.denied";
+export const AUTHZ_GRANTED = "authz.granted";
+export const SYSTEM_REGION_CHANGE = "system.region_change";
+// ── Tenant / IdP actions (migrated from lib/audit/event-types.ts) ─────
+// VALUES preserved verbatim from the old `AuditEventType` catalog.
+export const TENANT_CREATED = "tenant.created";
+export const TENANT_UPDATED = "tenant.updated";
+export const TENANT_OWNERSHIP_TRANSFERRED = "tenant.ownership_transferred";
+export const TENANT_MEMBER_INVITED = "tenant.member.invited";
+export const TENANT_MEMBER_JOINED = "tenant.member.joined";
+export const TENANT_MEMBER_ROLE_CHANGED = "tenant.member.role_changed";
+export const TENANT_MEMBER_REMOVED = "tenant.member.removed";
+export const TENANT_DOMAIN_ADDED = "tenant.domain.added";
+export const TENANT_DOMAIN_VERIFIED = "tenant.domain.verified";
+export const TENANT_DOMAIN_REMOVED = "tenant.domain.removed";
+export const TENANT_IDP_CONNECTED = "tenant.idp.connected";
+export const TENANT_IDP_MODIFIED = "tenant.idp.modified";
+export const TENANT_IDP_DISABLED = "tenant.idp.disabled";
+export const TENANT_IDP_DELETED = "tenant.idp.deleted";
+export const TENANT_ROLE_MAPPING_ADDED = "tenant.role_mapping.added";
+export const TENANT_ROLE_MAPPING_REMOVED = "tenant.role_mapping.removed";
+export const TENANT_FEDERATED_LOGIN_SUCCESS = "tenant.federated_login.success";
+export const TENANT_FEDERATED_LOGIN_DENIED = "tenant.federated_login.denied";
+export const TENANT_ROLE_REFRESHED_JIT = "tenant.role.refreshed_jit";
+export const AUTH_AGENT_SESSION_APPROVED = "auth.agent_session.approved";
+export const AUTH_AGENT_SESSION_REVOKED = "auth.agent_session.revoked";
+export const AUTH_REFRESH_REPLAY = "auth.refresh_replay";
+// ── Research / Experiment / Platform-control actions ─────────────────
+//
+// CONVENTION — research.query events MUST NEVER store raw query text in
+// metadata; query text may contain PII. Store a hash or template string
+// with parameters redacted. See doc/02-technical/development/audit-and-toggle-conventions.md.
+export const RESEARCH_QUERY = "research.query";
+export const RESEARCH_EXTRACT = "research.extract";
+export const EXPERIMENT_ASSIGN = "experiment.assign";
+// FEATURE_TOGGLE_CHANGED: emitted by FeatureToggleService.setToggle on
+// every toggle write. Metadata: { key, oldEnabled, newEnabled, changedBy }
+// where changedBy is the admin's USER ID (not email).
+export const FEATURE_TOGGLE_CHANGED = "feature_toggle.changed";
+// CONSENT_CHANGED: canonical action for user consent mutations emitted
+// by the consent-management layer (another agent owns the emit sites).
+export const CONSENT_CHANGED = "consent.changed";
+/**
+ * Old tenant/IdP `AuditEventType` string -> `AuditAction` constant.
+ * The values are identical (preserved verbatim), so this is an identity
+ * map at runtime; it exists so the four `AuditEventEmitter` consumers
+ * (idp-handler, tenant-handler, agent-authorize, agent-sessions) can
+ * keep referencing `AuditEventType.TENANT_*` symbolically via a single
+ * re-exported object.
+ */
+export const AuditEventType = {
+    TENANT_CREATED,
+    TENANT_UPDATED,
+    TENANT_OWNERSHIP_TRANSFERRED,
+    TENANT_MEMBER_INVITED,
+    TENANT_MEMBER_JOINED,
+    TENANT_MEMBER_ROLE_CHANGED,
+    TENANT_MEMBER_REMOVED,
+    TENANT_DOMAIN_ADDED,
+    TENANT_DOMAIN_VERIFIED,
+    TENANT_DOMAIN_REMOVED,
+    TENANT_IDP_CONNECTED,
+    TENANT_IDP_MODIFIED,
+    TENANT_IDP_DISABLED,
+    TENANT_IDP_DELETED,
+    TENANT_ROLE_MAPPING_ADDED,
+    TENANT_ROLE_MAPPING_REMOVED,
+    TENANT_FEDERATED_LOGIN_SUCCESS,
+    TENANT_FEDERATED_LOGIN_DENIED,
+    TENANT_ROLE_REFRESHED_JIT,
+    AUTH_AGENT_SESSION_APPROVED,
+    AUTH_AGENT_SESSION_REVOKED,
+    AUTH_REFRESH_REPLAY,
+    // Research / Experiment / Platform-control
+    RESEARCH_QUERY,
+    RESEARCH_EXTRACT,
+    EXPERIMENT_ASSIGN,
+    FEATURE_TOGGLE_CHANGED,
+    CONSENT_CHANGED,
+};
+//# sourceMappingURL=audit-actions.js.map

package/dist/lib/audit-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-actions.js","sourceRoot":"","sources":["../../src/lib/audit-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAgB,WAAW,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAgB,aAAa,CAAC;AACtD,MAAM,CAAC,MAAM,WAAW,GAAgB,aAAa,CAAC;AACtD,MAAM,CAAC,MAAM,WAAW,GAAgB,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,UAAU,GAAgB,YAAY,CAAC;AACpD,MAAM,CAAC,MAAM,WAAW,GAAgB,aAAa,CAAC;AACtD,MAAM,CAAC,MAAM,YAAY,GAAgB,cAAc,CAAC;AACxD,MAAM,CAAC,MAAM,aAAa,GAAgB,eAAe,CAAC;AAE1D,MAAM,CAAC,MAAM,oBAAoB,GAAgB,sBAAsB,CAAC;AAExE,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAgB,gBAAgB,CAAC;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAgB,gBAAgB,CAAC;AAC5D,MAAM,CAAC,MAAM,4BAA4B,GAAgB,8BAA8B,CAAC;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAgB,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAgB,sBAAsB,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAgB,4BAA4B,CAAC;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAgB,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAgB,qBAAqB,CAAC;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAgB,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAgB,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAgB,sBAAsB,CAAC;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAgB,qBAAqB,CAAC;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAgB,qBAAqB,CAAC;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAgB,oBAAoB,CAAC;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAgB,2BAA2B,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAgB,6BAA6B,CAAC;AACtF,MAAM,CAAC,MAAM,8BAA8B,GAAgB,gCAAgC,CAAC;AAC5F,MAAM,CAAC,MAAM,6BAA6B,GAAgB,+BAA+B,CAAC;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAgB,2BAA2B,CAAC;AAElF,MAAM,CAAC,MAAM,2BAA2B,GAAgB,6BAA6B,CAAC;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAgB,4BAA4B,CAAC;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAgB,qBAAqB,CAAC;AAEtE,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAgB,gBAAgB,CAAC;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAgB,kBAAkB,CAAC;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAgB,mBAAmB,CAAC;AAElE,uEAAuE;AACvE,2EAA2E;AAC3E,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAgB,wBAAwB,CAAC;AAE5E,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAgB,iBAAiB,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,cAAc;IACd,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,yBAAyB;IACzB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,2CAA2C;IAC3C,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,eAAe;CACP,CAAC"}

package/dist/lib/audit-composer.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Audit composer (phase 1.C.2).
+ *
+ * Trellis-side facade over `@de-otio/saas-foundation/audit`. Replaces
+ * the old `AuditLogger` (data lifecycle) and `AuditEventEmitter`
+ * (tenant / IdP) with a single composition point that:
+ *
+ *   1. Applies trellis's default-DENY allowlist (`filterPayload`) +
+ *      IP anonymisation (`anonymizeIp`) to event metadata BEFORE the
+ *      event reaches foundation. (LOCKED: keep the allowlist.)
+ *   2. Hands the scrubbed event to foundation's `AuditLog`, which is
+ *      configured with foundation's `PiiFilter` (denylist) as a
+ *      SECOND, additive layer. (LOCKED: denylist is additive, not a
+ *      replacement.)
+ *   3. Persists via `PostgresAuditStore` over a region-resolved Prisma
+ *      client. Retention tiers: info=30, warning=90, error=365 days.
+ *      (LOCKED.)
+ *
+ * Frozen-type crossing: this module is the first trellis consumer of
+ * the frozen `AuditEvent` / `AuditAction` vocabulary. Future changes to
+ * the emitted shape go through the frozen-type RFC process.
+ *
+ * Severity collapse (trellis 4-tier -> foundation 3-tier):
+ *   low + medium -> info     (30d)
+ *   high         -> warning  (90d)
+ *   critical     -> error    (365d)
+ *
+ * ── SECURITY-SENSITIVE READ CONVENTION ───────────────────────────────
+ *
+ * Any BULK, CROSS-USER, or EXPORT read of user data MUST emit an audit
+ * event. An audit trail cannot be backfilled — if the read is not
+ * recorded at the time it occurs, it is permanently invisible to
+ * compliance reviews.
+ *
+ * Worked example — admin bulk-export of user records:
+ *
+ *   await auditLogger.logDataAccess({
+ *     action: DATA_READ,
+ *     resource:    "user",
+ *     resourceId:  `bulk:${requestedCount}`,
+ *     userId:      session.userId,          // the requesting admin's ID
+ *     region:      detectedRegion,
+ *     success:     true,
+ *     metadata: {
+ *       targetType: "user_export",
+ *       reason:     "compliance_request",
+ *     },
+ *   }, env);
+ *
+ * Scope of the rule:
+ *   - Covered NOW:  mutations (data.create / update / delete), auth,
+ *     feature_toggle.changed, tenant / IdP events.
+ *   - Deferred:     individual single-user reads (low priority).
+ *   - IN SCOPE for the research platform: any research.query,
+ *     research.extract, experiment.assign operation.
+ *
+ * See doc/02-technical/development/audit-and-toggle-conventions.md for
+ * naming conventions, prefix rules, and the research.query PII rule.
+ */
+import type { AuditAction, AuditEvent } from "@de-otio/saas-foundation/audit";
+import { type EnvWithDb } from "../db.js";
+import { type Region } from "./region-detection.js";
+export type TrellisSeverity = "low" | "medium" | "high" | "critical";
+/**
+ * Anything with an `auditEvent.create` method. The real Prisma client
+ * (`ManagedPrismaClient`), the structural `PrismaAuditClient`, and test
+ * mocks all satisfy this. Foundation's `PostgresAuditStore` requires the
+ * narrower `PrismaAuditClient`; Prisma's generated `create` is more
+ * generic than (and so not structurally assignable to) foundation's
+ * narrow shape, so we accept the broad type at the boundary and cast
+ * once inside `getAuditLog`. The cast is runtime-safe — the column
+ * names foundation writes match the generated `AuditEvent` model.
+ */
+export type AuditPrismaClientLike = {
+    readonly auditEvent: {
+        create: (...args: never[]) => unknown;
+    };
+};
+export type TrellisAuditEventType = "data_access" | "data_create" | "data_update" | "data_delete" | "user_action" | "authentication" | "authorization" | "region_change";
+export interface TrellisAuditEvent {
+    type?: TrellisAuditEventType;
+    action: string;
+    resource: string;
+    resourceId?: string;
+    userId?: string;
+    region: Region;
+    dataRegion?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    metadata?: Record<string, unknown>;
+    severity?: TrellisSeverity;
+    success: boolean;
+}
+export interface TrellisAuditLoggerEnv extends EnvWithDb {
+    DEFAULT_REGION?: string;
+}
+/**
+ * `TrellisAuditLogger` — drop-in for the old `AuditLogger`. Region-aware
+ * (resolves a Prisma client per region), best-effort (never throws into
+ * the caller), and validates region before emitting (invalid-region
+ * events are dropped, as before).
+ */
+export declare class TrellisAuditLogger {
+    private readonly requestId?;
+    constructor(_env?: TrellisAuditLoggerEnv, requestId?: string | undefined);
+    withRequestId(requestId: string): TrellisAuditLogger;
+    logDataAccess(event: Omit<TrellisAuditEvent, "type" | "severity"> & {
+        type?: TrellisAuditEventType;
+        severity?: TrellisSeverity;
+    }, env: TrellisAuditLoggerEnv): Promise<void>;
+    logUserAction(event: Omit<TrellisAuditEvent, "type" | "severity"> & {
+        type?: TrellisAuditEventType;
+        severity?: TrellisSeverity;
+    }, env: TrellisAuditLoggerEnv): Promise<void>;
+    logAuthentication(event: Omit<TrellisAuditEvent, "type" | "severity"> & {
+        type?: TrellisAuditEventType;
+        severity?: TrellisSeverity;
+    }, env: TrellisAuditLoggerEnv): Promise<void>;
+    logAuthorization(event: Omit<TrellisAuditEvent, "type" | "severity"> & {
+        type?: TrellisAuditEventType;
+        severity?: TrellisSeverity;
+    }, env: TrellisAuditLoggerEnv): Promise<void>;
+    /** Generic entry point — accepts a full trellis event. */
+    log(event: Omit<TrellisAuditEvent, "severity"> & {
+        severity?: TrellisSeverity;
+    }, env: TrellisAuditLoggerEnv): Promise<void>;
+    /**
+     * Emit a system-level event where the `action` string is passed directly
+     * to the foundation audit log (bypassing the coarse `actionFor()` mapping).
+     *
+     * Use for platform-control actions like `feature_toggle.changed`,
+     * `consent.changed`, `experiment.assign` that have their own dedicated
+     * action constant and should not be collapsed to a coarse `data.*` label.
+     *
+     * The `action` parameter MUST be a known `AuditAction` constant from
+     * `audit-actions.ts`; do not pass free-form strings.
+     *
+     * Best-effort — never throws into the caller.
+     */
+    logSystemAction(action: AuditAction, event: Omit<TrellisAuditEvent, "type" | "action" | "severity"> & {
+        severity?: TrellisSeverity;
+    }, env: TrellisAuditLoggerEnv): Promise<void>;
+    private emitDirect;
+    private emit;
+}
+/** Factory — drop-in for the old `createAuditLogger`. */
+export declare function createAuditLogger(env?: TrellisAuditLoggerEnv, requestId?: string): TrellisAuditLogger;
+/** Input shape preserved from the old `AuditEventEmitter.emit`. */
+export interface TenantAuditEmitInput {
+    type: AuditAction;
+    tenantId: string;
+    actorUserId: string;
+    payload: Record<string, unknown>;
+    /** Source IP — anonymised to /24 (v4) or /64 (v6) before storage. */
+    sourceIp?: string;
+    /** Present when made through an agent session. */
+    agentSessionId?: string;
+}
+/**
+ * `TenantAuditEmitter` — replaces the CloudWatch+Postgres
+ * `AuditEventEmitter`. CloudWatch is dropped (foundation owns the sink);
+ * the Postgres write now goes through foundation's `AuditLog` /
+ * `PostgresAuditStore`. Signature `emit(input, prismaClient)` is
+ * preserved so the four consumers change only their import.
+ *
+ * Tenant/IdP events are tenant-scoped (`actor.kind = "user"`,
+ * `tenantId` set) and default to `info` severity (matching the old
+ * "medium" -> info collapse).
+ */
+export declare class TenantAuditEmitter {
+    emit(input: TenantAuditEmitInput, prisma: AuditPrismaClientLike): Promise<void>;
+}
+export type { AuditEvent };
+//# sourceMappingURL=audit-composer.d.ts.map

package/dist/lib/audit-composer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-composer.d.ts","sourceRoot":"","sources":["../../src/lib/audit-composer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAK9E,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEjE,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAcnE,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAuDrE;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE;QAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAA;KAAE,CAAC;CAChE,CAAC;AAqBF,MAAM,MAAM,qBAAqB,GAC7B,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,eAAe,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAsB,SAAQ,SAAS;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA4BD;;;;;GAKG;AACH,qBAAa,kBAAkB;IAM3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAD3B,IAAI,CAAC,EAAE,qBAAqB,EACX,SAAS,CAAC,EAAE,MAAM,YAAA;IAG9B,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB;IAI9C,aAAa,CACxB,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QACpD,IAAI,CAAC,EAAE,qBAAqB,CAAC;QAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,EACD,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,IAAI,CAAC;IAOH,aAAa,CACxB,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QACpD,IAAI,CAAC,EAAE,qBAAqB,CAAC;QAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,EACD,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,IAAI,CAAC;IAOH,iBAAiB,CAC5B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QACpD,IAAI,CAAC,EAAE,qBAAqB,CAAC;QAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,EACD,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,IAAI,CAAC;IAYH,gBAAgB,CAC3B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QACpD,IAAI,CAAC,EAAE,qBAAqB,CAAC;QAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,EACD,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,IAAI,CAAC;IAWhB,0DAA0D;IAC7C,GAAG,CACd,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,eAAe,CAAA;KAAE,EAC3E,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,IAAI,CAAC;IAahB;;;;;;;;;;;;OAYG;IACU,eAAe,CAC1B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC,GAAG;QAC/D,QAAQ,CAAC,EAAE,eAAe,CAAC;KAC5B,EACD,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,IAAI,CAAC;YAIF,UAAU;YAuEV,IAAI;CA6FnB;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,qBAAqB,EAC3B,SAAS,CAAC,EAAE,MAAM,GACjB,kBAAkB,CAEpB;AAID,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IAChB,IAAI,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CAyC7F;AAED,YAAY,EAAE,UAAU,EAAE,CAAC"}