@discover-cloud/shared 1.3.0 → 1.5.0

package/dist/middleware/require-org-permission.middleware.js

@@ -18,16 +18,16 @@ const createRequireOrgPermission = (permissionCache, resolveFn) => {
     const requireOrgPermission = (permission) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No auth context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No auth context', 'UNAUTHORIZED', 401);
                 return;
             }
-            const organizationId = req.params["organizationId"] ??
-                req.params["orgId"] ??
-                req.validated?.params?.["organizationId"] ??
-                req.validated?.body?.["organizationId"];
-            if (!organizationId || typeof organizationId !== "string") {
-                (0, utils_1.failure)(res, req, "Bad Request: Missing organization context", "BAD_REQUEST", 400);
+            const organizationId = req.params['organizationId'] ??
+                req.params['orgId'] ??
+                req.validated?.params?.['organizationId'] ??
+                req.validated?.body?.['organizationId'];
+            if (!organizationId || typeof organizationId !== 'string') {
+                (0, utils_1.failure)(res, req, 'Bad Request: Missing organization context', 'BAD_REQUEST', 400);
                 return;
             }
             try {
@@ -35,7 +35,7 @@ const createRequireOrgPermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId, organizationId);
                 });
                 if (!permission_checker_1.PermissionChecker.has(perms, permission)) {
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing required organization permission: ${permission}`, "FORBIDDEN", 403);
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing required organization permission: ${permission}`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();
@@ -48,16 +48,16 @@ const createRequireOrgPermission = (permissionCache, resolveFn) => {
     const requireAnyOrgPermission = (...permissions) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No auth context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No auth context', 'UNAUTHORIZED', 401);
                 return;
             }
-            const organizationId = req.params["organizationId"] ??
-                req.params["orgId"] ??
-                req.validated?.params?.["organizationId"] ??
-                req.validated?.body?.["organizationId"];
-            if (!organizationId || typeof organizationId !== "string") {
-                (0, utils_1.failure)(res, req, "Bad Request: Missing organization context", "BAD_REQUEST", 400);
+            const organizationId = req.params['organizationId'] ??
+                req.params['orgId'] ??
+                req.validated?.params?.['organizationId'] ??
+                req.validated?.body?.['organizationId'];
+            if (!organizationId || typeof organizationId !== 'string') {
+                (0, utils_1.failure)(res, req, 'Bad Request: Missing organization context', 'BAD_REQUEST', 400);
                 return;
             }
             try {
@@ -65,7 +65,7 @@ const createRequireOrgPermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId, organizationId);
                 });
                 if (!permission_checker_1.PermissionChecker.hasAny(perms, permissions)) {
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing one of required organization permissions: [${permissions.join(", ")}]`, "FORBIDDEN", 403);
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing one of required organization permissions: [${permissions.join(', ')}]`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();
@@ -78,16 +78,16 @@ const createRequireOrgPermission = (permissionCache, resolveFn) => {
     const requireAllOrgPermissions = (...permissions) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No auth context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No auth context', 'UNAUTHORIZED', 401);
                 return;
             }
-            const organizationId = req.params["organizationId"] ??
-                req.params["orgId"] ??
-                req.validated?.params?.["organizationId"] ??
-                req.validated?.body?.["organizationId"];
-            if (!organizationId || typeof organizationId !== "string") {
-                (0, utils_1.failure)(res, req, "Bad Request: Missing organization context", "BAD_REQUEST", 400);
+            const organizationId = req.params['organizationId'] ??
+                req.params['orgId'] ??
+                req.validated?.params?.['organizationId'] ??
+                req.validated?.body?.['organizationId'];
+            if (!organizationId || typeof organizationId !== 'string') {
+                (0, utils_1.failure)(res, req, 'Bad Request: Missing organization context', 'BAD_REQUEST', 400);
                 return;
             }
             try {
@@ -95,8 +95,8 @@ const createRequireOrgPermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId, organizationId);
                 });
                 if (!permission_checker_1.PermissionChecker.hasAll(perms, permissions)) {
-                    const missing = permissions.filter(p => !permission_checker_1.PermissionChecker.has(perms, p));
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing required organization permissions: [${missing.join(", ")}]`, "FORBIDDEN", 403);
+                    const missing = permissions.filter((p) => !permission_checker_1.PermissionChecker.has(perms, p));
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing required organization permissions: [${missing.join(', ')}]`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();

package/dist/middleware/require-platform-permission.middleware.d.ts

@@ -2,9 +2,9 @@
  * @file require-platform-permission.middleware.ts
  * @description Express middleware generator to enforce platform-scoped permission checks.
  */
-import { RequestHandler } from "express";
-import { PlatformPermission } from "../enums";
-import { PermissionCacheService } from "../authorization/permission-cache.service";
+import { RequestHandler } from 'express';
+import { PlatformPermission } from '../enums';
+import { PermissionCacheService } from '../authorization/permission-cache.service';
 /**
  * Creates requirePlatformPermission middleware.
  *

package/dist/middleware/require-platform-permission.middleware.js

@@ -18,8 +18,8 @@ const createRequirePlatformPermission = (permissionCache, resolveFn) => {
     const requirePlatformPermission = (permission) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No access context', 'UNAUTHORIZED', 401);
                 return;
             }
             try {
@@ -27,7 +27,7 @@ const createRequirePlatformPermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId);
                 });
                 if (!permission_checker_1.PermissionChecker.has(perms, permission)) {
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing required platform permission: ${permission}`, "FORBIDDEN", 403);
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing required platform permission: ${permission}`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();
@@ -40,8 +40,8 @@ const createRequirePlatformPermission = (permissionCache, resolveFn) => {
     const requireAnyPlatformPermission = (...permissions) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No access context', 'UNAUTHORIZED', 401);
                 return;
             }
             try {
@@ -49,7 +49,7 @@ const createRequirePlatformPermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId);
                 });
                 if (!permission_checker_1.PermissionChecker.hasAny(perms, permissions)) {
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing one of required platform permissions: [${permissions.join(", ")}]`, "FORBIDDEN", 403);
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing one of required platform permissions: [${permissions.join(', ')}]`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();
@@ -62,8 +62,8 @@ const createRequirePlatformPermission = (permissionCache, resolveFn) => {
     const requireAllPlatformPermissions = (...permissions) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No access context', 'UNAUTHORIZED', 401);
                 return;
             }
             try {
@@ -71,8 +71,8 @@ const createRequirePlatformPermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId);
                 });
                 if (!permission_checker_1.PermissionChecker.hasAll(perms, permissions)) {
-                    const missing = permissions.filter(p => !permission_checker_1.PermissionChecker.has(perms, p));
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing required platform permissions: [${missing.join(", ")}]`, "FORBIDDEN", 403);
+                    const missing = permissions.filter((p) => !permission_checker_1.PermissionChecker.has(perms, p));
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing required platform permissions: [${missing.join(', ')}]`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();

package/dist/middleware/require-user.middleware.d.ts

@@ -2,7 +2,7 @@
  * @file require-user.middleware.ts
  * @description Express middleware to assert that the request auth context belongs to a user (not a machine).
  */
-import { Request, Response, NextFunction } from "express";
+import { Request, Response, NextFunction } from 'express';
 /**
  * Asserts that the current request has a valid user context, returning 401/403 otherwise.
  *

package/dist/middleware/require-user.middleware.js

@@ -18,11 +18,11 @@ const types_1 = require("../types");
 const requireUser = (req, res, next) => {
     const ctx = req.authContext;
     if (!ctx) {
-        (0, utils_1.failure)(res, req, "Unauthorized: No auth context", "UNAUTHORIZED", 401);
+        (0, utils_1.failure)(res, req, 'Unauthorized: No auth context', 'UNAUTHORIZED', 401);
         return;
     }
     if (!(0, types_1.isUserContext)(ctx)) {
-        (0, utils_1.failure)(res, req, "User token required", "FORBIDDEN", 401);
+        (0, utils_1.failure)(res, req, 'User token required', 'FORBIDDEN', 401);
         return;
     }
     next();

package/dist/middleware/require-workspace-permission.middleware.d.ts

@@ -2,9 +2,9 @@
  * @file require-workspace-permission.middleware.ts
  * @description Express middleware factory to enforce workspace-scoped permission checks.
  */
-import { RequestHandler } from "express";
-import { Permission } from "../enums";
-import { PermissionCacheService } from "../authorization/permission-cache.service";
+import { RequestHandler } from 'express';
+import { Permission } from '../enums';
+import { PermissionCacheService } from '../authorization/permission-cache.service';
 /**
  * Creates requireWorkspacePermission middleware factory.
  *

package/dist/middleware/require-workspace-permission.middleware.js

@@ -19,16 +19,16 @@ const createRequireWorkspacePermission = (permissionCache, resolveFn) => {
     const requireWorkspacePermission = (permission) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No access context', 'UNAUTHORIZED', 401);
                 return;
             }
             // Resolve workspaceId from request locations
-            const workspaceId = req.params["workspaceId"] ??
-                req.validated?.params?.["workspaceId"] ??
-                req.validated?.body?.["workspaceId"];
-            if (!workspaceId || typeof workspaceId !== "string") {
-                (0, utils_1.failure)(res, req, "Bad Request: Missing workspaceId", "BAD_REQUEST", 400);
+            const workspaceId = req.params['workspaceId'] ??
+                req.validated?.params?.['workspaceId'] ??
+                req.validated?.body?.['workspaceId'];
+            if (!workspaceId || typeof workspaceId !== 'string') {
+                (0, utils_1.failure)(res, req, 'Bad Request: Missing workspaceId', 'BAD_REQUEST', 400);
                 return;
             }
             try {
@@ -36,7 +36,7 @@ const createRequireWorkspacePermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId, workspaceId);
                 });
                 if (!permission_checker_1.PermissionChecker.has(perms, permission)) {
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing required workspace permission: ${permission}`, "FORBIDDEN", 403);
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing required workspace permission: ${permission}`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();
@@ -49,15 +49,15 @@ const createRequireWorkspacePermission = (permissionCache, resolveFn) => {
     const requireAnyWorkspacePermission = (...permissions) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No access context', 'UNAUTHORIZED', 401);
                 return;
             }
-            const workspaceId = req.params["workspaceId"] ??
-                req.validated?.params?.["workspaceId"] ??
-                req.validated?.body?.["workspaceId"];
-            if (!workspaceId || typeof workspaceId !== "string") {
-                (0, utils_1.failure)(res, req, "Bad Request: Missing workspaceId", "BAD_REQUEST", 400);
+            const workspaceId = req.params['workspaceId'] ??
+                req.validated?.params?.['workspaceId'] ??
+                req.validated?.body?.['workspaceId'];
+            if (!workspaceId || typeof workspaceId !== 'string') {
+                (0, utils_1.failure)(res, req, 'Bad Request: Missing workspaceId', 'BAD_REQUEST', 400);
                 return;
             }
             try {
@@ -65,7 +65,7 @@ const createRequireWorkspacePermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId, workspaceId);
                 });
                 if (!permission_checker_1.PermissionChecker.hasAny(perms, permissions)) {
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing one of required workspace permissions: [${permissions.join(", ")}]`, "FORBIDDEN", 403);
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing one of required workspace permissions: [${permissions.join(', ')}]`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();
@@ -78,15 +78,15 @@ const createRequireWorkspacePermission = (permissionCache, resolveFn) => {
     const requireAllWorkspacePermissions = (...permissions) => {
         return async (req, res, next) => {
             const ctx = req.authContext;
-            if (!ctx || ctx.type !== "user") {
-                (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
+            if (!ctx || ctx.type !== 'user') {
+                (0, utils_1.failure)(res, req, 'Unauthorized: No access context', 'UNAUTHORIZED', 401);
                 return;
             }
-            const workspaceId = req.params["workspaceId"] ??
-                req.validated?.params?.["workspaceId"] ??
-                req.validated?.body?.["workspaceId"];
-            if (!workspaceId || typeof workspaceId !== "string") {
-                (0, utils_1.failure)(res, req, "Bad Request: Missing workspaceId", "BAD_REQUEST", 400);
+            const workspaceId = req.params['workspaceId'] ??
+                req.validated?.params?.['workspaceId'] ??
+                req.validated?.body?.['workspaceId'];
+            if (!workspaceId || typeof workspaceId !== 'string') {
+                (0, utils_1.failure)(res, req, 'Bad Request: Missing workspaceId', 'BAD_REQUEST', 400);
                 return;
             }
             try {
@@ -94,8 +94,8 @@ const createRequireWorkspacePermission = (permissionCache, resolveFn) => {
                     return resolveFn(ctx.accountId, workspaceId);
                 });
                 if (!permission_checker_1.PermissionChecker.hasAll(perms, permissions)) {
-                    const missing = permissions.filter(p => !permission_checker_1.PermissionChecker.has(perms, p));
-                    (0, utils_1.failure)(res, req, `Forbidden: Missing required workspace permissions: [${missing.join(", ")}]`, "FORBIDDEN", 403);
+                    const missing = permissions.filter((p) => !permission_checker_1.PermissionChecker.has(perms, p));
+                    (0, utils_1.failure)(res, req, `Forbidden: Missing required workspace permissions: [${missing.join(', ')}]`, 'FORBIDDEN', 403);
                     return;
                 }
                 next();

package/dist/middleware/validate.middleware.d.ts

@@ -3,12 +3,12 @@
  * @description Request validation middleware leveraging Zod schema definitions.
  * Supports validating multiple request sources without overwriting previous results.
  */
-import { Request, Response, NextFunction } from "express";
-import { ZodType } from "zod";
+import { Request, Response, NextFunction } from 'express';
+import { ZodType } from 'zod';
 /**
  * Supported Express request validation sources.
  */
-type ValidationSource = "body" | "params" | "query" | "headers";
+type ValidationSource = 'body' | 'params' | 'query' | 'headers';
 /**
  * Validator utility class containing Express middleware generation methods.
  */

package/dist/middleware/validate.middleware.js

@@ -27,7 +27,7 @@ class Validator {
      * @param {ZodType<T>} schema - Zod validation schema.
      * @param {ValidationSource} source - Request source.
      */
-    static validate(schema, source = "body") {
+    static validate(schema, source = 'body') {
         return (req, _res, next) => {
             const result = schema.safeParse(req[source]);
             if (!result.success) {

package/dist/types/audit.types.d.ts

@@ -0,0 +1,39 @@
+export declare enum AuditActorType {
+    USER = "USER",
+    SERVICE = "SERVICE",
+    SYSTEM = "SYSTEM",
+    ANONYMOUS = "ANONYMOUS",
+    SUPPORT = "SUPPORT",
+    INTEGRATION = "INTEGRATION",
+    API_KEY = "API_KEY"
+}
+export declare enum AuditResourceType {
+    ACCOUNT = "ACCOUNT",
+    USER = "USER",
+    ORGANIZATION = "ORGANIZATION",
+    WORKSPACE = "WORKSPACE",
+    ROLE = "ROLE",
+    PERMISSION = "PERMISSION",
+    PLATFORM_ROLE = "PLATFORM_ROLE",
+    PLATFORM_PERMISSION = "PLATFORM_PERMISSION",
+    SESSION = "SESSION",
+    SERVICE_CLIENT = "SERVICE_CLIENT",
+    MFA = "MFA",
+    SYSTEM = "SYSTEM",// e.g. for system cron jobs
+    INVITE = "INVITE"
+}
+export declare const AUDIT_SEVERITIES: readonly ["info", "warning", "error", "critical"];
+export type AuditSeverity = (typeof AUDIT_SEVERITIES)[number];
+export interface RecordAuditActionInput {
+    actorId?: string | null;
+    actorType?: AuditActorType;
+    action: string;
+    severity?: AuditSeverity;
+    resourceType: AuditResourceType;
+    resourceId?: string | null;
+    organizationId?: string | null;
+    workspaceId?: string | null;
+    metadata?: Record<string, any>;
+    requestId?: string | null;
+    traceId?: string | null;
+}

package/dist/types/audit.types.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDIT_SEVERITIES = exports.AuditResourceType = exports.AuditActorType = void 0;
+var AuditActorType;
+(function (AuditActorType) {
+    AuditActorType["USER"] = "USER";
+    AuditActorType["SERVICE"] = "SERVICE";
+    AuditActorType["SYSTEM"] = "SYSTEM";
+    AuditActorType["ANONYMOUS"] = "ANONYMOUS";
+    AuditActorType["SUPPORT"] = "SUPPORT";
+    AuditActorType["INTEGRATION"] = "INTEGRATION";
+    AuditActorType["API_KEY"] = "API_KEY";
+})(AuditActorType || (exports.AuditActorType = AuditActorType = {}));
+var AuditResourceType;
+(function (AuditResourceType) {
+    AuditResourceType["ACCOUNT"] = "ACCOUNT";
+    AuditResourceType["USER"] = "USER";
+    AuditResourceType["ORGANIZATION"] = "ORGANIZATION";
+    AuditResourceType["WORKSPACE"] = "WORKSPACE";
+    AuditResourceType["ROLE"] = "ROLE";
+    AuditResourceType["PERMISSION"] = "PERMISSION";
+    AuditResourceType["PLATFORM_ROLE"] = "PLATFORM_ROLE";
+    AuditResourceType["PLATFORM_PERMISSION"] = "PLATFORM_PERMISSION";
+    AuditResourceType["SESSION"] = "SESSION";
+    AuditResourceType["SERVICE_CLIENT"] = "SERVICE_CLIENT";
+    AuditResourceType["MFA"] = "MFA";
+    AuditResourceType["SYSTEM"] = "SYSTEM";
+    AuditResourceType["INVITE"] = "INVITE";
+})(AuditResourceType || (exports.AuditResourceType = AuditResourceType = {}));
+exports.AUDIT_SEVERITIES = ["info", "warning", "error", "critical"];

package/dist/types/express.types.d.ts

@@ -2,7 +2,8 @@
  * @file express.types.ts
  * @description Express Request type augmentations and authentication context definitions.
  */
-import { JWTPayload } from "jose";
+import { JWTPayload } from 'jose';
+import { ResourceQueryScope } from '../contracts';
 interface BaseTokenPayload extends JWTPayload {
     jti: string;
     iss: string;
@@ -18,13 +19,15 @@ interface BaseTokenPayload extends JWTPayload {
  * Authorization is resolved dynamically using RBAC.
  */
 export interface AccessTokenPayload extends BaseTokenPayload {
-    typ: "access";
+    typ: 'access';
     /** Account identifier. */
     accountId: string;
     /** Active session identifier. */
     sessionId: string;
     /** Token/version invalidation marker. */
     ver: number;
+    /** Whether the session was generated via impersonation. */
+    impersonated?: boolean;
 }
 /**
  * Long-lived refresh token payload.
@@ -32,14 +35,14 @@ export interface AccessTokenPayload extends BaseTokenPayload {
  * Refresh tokens are only used for rotation.
  */
 export interface RefreshTokenPayload extends BaseTokenPayload {
-    typ: "refresh";
+    typ: 'refresh';
     accountId: string;
 }
 /**
  * Service-to-service authentication token.
  */
 export interface MachineTokenPayload extends BaseTokenPayload {
-    typ: "machine";
+    typ: 'machine';
     serviceId: string;
     scopes: string[];
     requestId?: string;
@@ -61,7 +64,7 @@ export interface TokenRevocationContext {
  * Created from access tokens only.
  */
 export interface UserContext {
-    type: "user";
+    type: 'user';
     accountId: string;
     sessionId: string;
 }
@@ -69,7 +72,7 @@ export interface UserContext {
  * Authenticated internal service context.
  */
 export interface MachineContext {
-    type: "machine";
+    type: 'machine';
     serviceId: string;
     scopes: string[];
 }
@@ -100,7 +103,7 @@ export interface ValidatedRequestData {
     body?: Record<string, unknown>;
     headers?: Record<string, unknown>;
 }
-declare module "express-serve-static-core" {
+declare module 'express-serve-static-core' {
     interface Request {
         /**
          * Request correlation ID.
@@ -122,6 +125,10 @@ declare module "express-serve-static-core" {
          * Runtime authenticated identity.
          */
         authContext?: AuthContext;
+        /**
+         * Resolved resource query scope for insights queries.
+         */
+        visibilityScope?: ResourceQueryScope;
     }
 }
 export {};

package/dist/types/express.types.js

@@ -14,28 +14,28 @@ exports.assertMachineToken = assertMachineToken;
    Type Guards
 --------------------------------------------------------------------------- */
 function isAccessToken(payload) {
-    return payload.typ === "access";
+    return payload.typ === 'access';
 }
 function isRefreshToken(payload) {
-    return payload.typ === "refresh";
+    return payload.typ === 'refresh';
 }
 function isMachineToken(payload) {
-    return payload.typ === "machine";
+    return payload.typ === 'machine';
 }
 function isUserContext(ctx) {
-    return ctx.type === "user";
+    return ctx.type === 'user';
 }
 function isMachineContext(ctx) {
-    return ctx.type === "machine";
+    return ctx.type === 'machine';
 }
 /**
  * Runtime assertion for service tokens.
  */
 function assertMachineToken(payload) {
-    if (payload["typ"] !== "machine" ||
-        typeof payload["serviceId"] !== "string" ||
-        typeof payload["jti"] !== "string" ||
-        !Array.isArray(payload["scopes"])) {
-        throw new Error("Invalid machine token payload");
+    if (payload['typ'] !== 'machine' ||
+        typeof payload['serviceId'] !== 'string' ||
+        typeof payload['jti'] !== 'string' ||
+        !Array.isArray(payload['scopes'])) {
+        throw new Error('Invalid machine token payload');
     }
 }

package/dist/types/index.d.ts

@@ -1 +1 @@
-export * from "./express.types";
+export * from './express.types';

package/dist/utils/env.util.js

@@ -15,5 +15,5 @@ function getEnv(name) {
 }
 function getEnvOptional(name) {
     const value = process.env[name];
-    return value === "" ? undefined : value;
+    return value === '' ? undefined : value;
 }

package/dist/utils/index.d.ts

@@ -1,5 +1,5 @@
-export * from "./response.util";
-export * from "./logger.util";
-export * from "./date.util";
-export * from "./env.util";
-export * from "./pagination.util";
+export * from './response.util';
+export * from './logger.util';
+export * from './date.util';
+export * from './env.util';
+export * from './pagination.util';

package/dist/utils/logger.util.d.ts

@@ -24,3 +24,8 @@ export declare const noopLogger: ILogger;
  * Console logger implementing the ILogger interface mapping to native console output.
  */
 export declare const consoleLogger: ILogger;
+/**
+ * Creates an ILogger adapter for a given Pino logger instance.
+ * @param pinoLogger Any Pino logger instance.
+ */
+export declare function createPinoAdapter(pinoLogger: any): ILogger;