@endora-commerce/mod-audit-logs 0.100.0

package/dist/backend/services/recent-activity-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recent-activity-visibility.d.ts","sourceRoot":"","sources":["../../../src/backend/services/recent-activity-visibility.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAiC1E,iDAAiD;AACjD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,gBAAgB;IAG7C;;;;;;;;;;;;;OAaG;IACG,IAAI,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC;IAiBvD;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAS1C"}

package/dist/backend/services/recent-activity-visibility.js

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+/**
+ * The operator axis of D-163.1 — feature 080, T042j.
+ *
+ * A module **declares** that its activity is eligible for the dashboard's
+ * recent-activity card (`manifest.ts`'s `recentActivity` export). The operator
+ * **chooses** whether it actually appears, and **the default is that it does**.
+ * Neither axis overwrites the other and neither is derivable from the other,
+ * which is Constitution XVII's shape applied to a narrower object.
+ *
+ * **This is a second per-module operator toggle beside activation, and that is
+ * deliberate.** They answer different questions about the same module —
+ * "does this client want stock management at all" versus "does this client want
+ * stock movements on their home screen" — so one control cannot carry both.
+ * They differ in kind too: activation is *presence*, resolved synchronously on
+ * the hot path by the kernel's registry cache and gating every seam the module
+ * owns; this is a *display* preference on one card, resolved asynchronously
+ * through `settingsReadPort` on the one request that renders it. That is why
+ * this is not built on the activation resolver: reading it there would put a
+ * dashboard preference into the presence machinery every request already
+ * consults.
+ *
+ * **Defaulting to visible has one consequence, stated so nobody meets it as a
+ * surprise** (D-163.1): a newly installed third-party module's activity reaches
+ * the shop owner's home screen without anyone choosing it. The alternative
+ * default makes every module's first useful signal depend on an operator
+ * knowing to go looking for a toggle whose existence the module cannot
+ * announce.
+ */
+const visibleSchema = z.boolean();
+export class RecentActivityVisibility {
+    catalog;
+    settings;
+    constructor(catalog, settings) {
+        this.catalog = catalog;
+        this.settings = settings;
+    }
+    /**
+     * Every eligible module with the operator's current answer.
+     *
+     * One batch read, `salesChannelId: null` — the choice is platform-wide, for
+     * the reason activation is (FR-009): a home dashboard is not per-storefront,
+     * and joining `setting_values` would reintroduce channel dependence through
+     * the back door (Constitution XII).
+     *
+     * A code the settings store does not know resolves to **visible**, not to
+     * hidden. The row is created by the boot reconcile for a shipped module and
+     * by `install` for a package, so its absence means one has not run yet — a
+     * platform mid-install, not an operator's decision — and the ruling's default
+     * is the honest answer to "nobody has chosen".
+     */
+    async list() {
+        const modules = this.catalog.eligibleModules();
+        if (modules.length === 0)
+            return [];
+        const rows = await this.settings.getMany(modules.map((entry) => entry.settingCode), null);
+        return modules.map((entry) => {
+            const row = rows.get(entry.settingCode);
+            return {
+                moduleId: entry.moduleId,
+                moduleName: entry.moduleName,
+                visible: row?.ok === true ? visibleSchema.safeParse(row.value).data ?? true : true,
+            };
+        });
+    }
+    /**
+     * The action tokens the card may query — the conjunction of the two axes.
+     *
+     * Empty when every eligible module is hidden, and the caller must not turn
+     * that into "no filter": an unfiltered query would put every audited write on
+     * the dashboard, which is the opposite of what the operator asked for.
+     */
+    async visibleActions() {
+        const visibility = new Map((await this.list()).map((entry) => [entry.moduleId, entry.visible]));
+        return this.catalog
+            .eligibleModules()
+            .filter((entry) => visibility.get(entry.moduleId) !== false)
+            .flatMap((entry) => [...entry.actions]);
+    }
+}
+//# sourceMappingURL=recent-activity-visibility.js.map

package/dist/backend/services/recent-activity-visibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recent-activity-visibility.js","sourceRoot":"","sources":["../../../src/backend/services/recent-activity-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AASlC,MAAM,OAAO,wBAAwB;IAEhB;IACA;IAFnB,YACmB,OAA8B,EAC9B,QAA0B;QAD1B,YAAO,GAAP,OAAO,CAAuB;QAC9B,aAAQ,GAAR,QAAQ,CAAkB;IAC1C,CAAC;IAEJ;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACtC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EACzC,IAAI,CACL,CAAC;QACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,OAAO;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;aACnF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CACpE,CAAC;QACF,OAAO,IAAI,CAAC,OAAO;aAChB,eAAe,EAAE;aACjB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC;aAC3D,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/manifest.d.ts

@@ -0,0 +1,191 @@
+import { type ModuleCliCommand } from '@endora-commerce/contracts';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+/**
+ * Audit Logs module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ *
+ * Feature 072 (T084) — the module owns its routes now, so it needs the two
+ * things a converted module needs: the dependency it actually resolves, and an
+ * activation control.
+ *
+ * `admin_users` is deliberately **not** a dependency. This module used to be
+ * mounted from inside that one, but the only thing it still wants from there is
+ * turning an actor id into a name, and that is an optional enrichment: the
+ * audit log degrades to raw ids rather than refusing. A `dependencies` entry
+ * would make the lifecycle refuse to disable `admin_users` while the audit log
+ * is on, which is backwards — the record has to outlive the directory.
+ */
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "uuid" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+/**
+ * The operator command this module declares — feature 080, T042b / D-160.9.
+ *
+ * It was `scripts/read.ts`, which owned its own `initOrm()`. Only the plumbing
+ * moved: the `EntityManager` comes off the composition now, and the reach is
+ * still one read of the kernel's `AuditLogEntry`. The conditions D-102 attached
+ * to this tool are unchanged and are restated at the top of `cli/read.ts`.
+ */
+export declare const cliCommands: ReadonlyArray<ModuleCliCommand<ModuleContext>>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEnB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAyBtE,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,123 @@
+import { defineModuleManifest } from '@endora-commerce/contracts';
+/**
+ * Audit Logs module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ *
+ * Feature 072 (T084) — the module owns its routes now, so it needs the two
+ * things a converted module needs: the dependency it actually resolves, and an
+ * activation control.
+ *
+ * `admin_users` is deliberately **not** a dependency. This module used to be
+ * mounted from inside that one, but the only thing it still wants from there is
+ * turning an actor id into a name, and that is an optional enrichment: the
+ * audit log degrades to raw ids rather than refusing. A `dependencies` entry
+ * would make the lifecycle refuse to disable `admin_users` while the audit log
+ * is on, which is backwards — the record has to outlive the directory.
+ */
+export const manifest = defineModuleManifest({
+    id: 'audit_logs',
+    name: 'Audit Logs',
+    description: 'Append-only audit log for sensitive admin and customer actions.',
+    version: '1.0.0',
+    // `auth` owns the `requireAdmin` port both route files are gated by.
+    dependencies: ['auth'],
+    settings: {
+        moduleCode: 'audit_logs',
+        groups: [{ code: 'audit_logs', name: 'Audit log' }],
+        // The group is kept as a reservation while the module ships no settings of
+        // its own: `audit_logs.enabled` was the only one, and it went with the
+        // control it backed (feature 074). Dropping the group as well would only
+        // turn it into an orphan the boot reconciler warns about at every start.
+        settings: [],
+    },
+    /**
+     * This module's first i18n bundle and its first command-palette action —
+     * feature 091, Phase 4, batch four.
+     *
+     * The bundle exists because the sidebar entry moved into this package with
+     * the screen and a nav declaration's `labelKey` is **module-relative** (R8):
+     * `appShell.nav.auditLog` was one of `_i18n`'s and is `nav.auditLog.label`
+     * here. It is a **flat** `{"a.b.c": "text"}` map at the **package root**, for
+     * the reason `admin_roles`' bundle records: `manifest-locations.ts` resolves
+     * a packaged module's `manifestPath` to its `package.json`, so `dirname` is
+     * the package directory, and a nested object fails
+     * `TranslationBundleEntriesSchema` while the boot reconciler only logs and
+     * skips it.
+     *
+     * The action pays one of the fifteen entries `specs/deferred-defects.md`
+     * still holds under *"Sixteen modules with an admin screen declare no
+     * command-palette action"*. Principle XVI is explicit that a sidebar entry is
+     * not enough, and the drain is what makes the debt payable: Phase 2 item 6's
+     * off-state test asserts the palette entry's absence while the module is off,
+     * and until there was one there was nothing to assert. `audit_log:read` is
+     * the code `GET /api/v1/admin/audit-log` enforces, which is what
+     * `check:action-route-permissions` holds this declaration to.
+     */
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    actions: [
+        {
+            id: 'open-audit-log',
+            labelKey: 'actions.openAuditLog.label',
+            descriptionKey: 'actions.openAuditLog.description',
+            icon: 'ListChecks',
+            targetRoute: '/audit-log',
+            requiredPermission: 'audit_log:read',
+            keywords: ['audit', 'audyt', 'dziennik', 'log', 'history', 'historia', 'trail'],
+            weight: 600,
+        },
+    ],
+    // Feature 074 (Constitution XVII), test C3 — platform primitive, and one of
+    // the escalation answers. D-32 moved the *writing* of the trail into the
+    // kernel, so what this module owns is the viewer — and sight of who did what
+    // is part of trusting the platform rather than a capability a business
+    // declines. Switching it off is a governance regression, not a business
+    // choice, so there is no independent decision underneath the control.
+    //
+    // `audit_logs.enabled` goes with it. The existing rows are removed by a core
+    // data migration (feature 074, FR-010a).
+    activation: {
+        nonDeactivatable: true,
+        reason: 'Sight of the write trail. The writing is the platform\'s own, so this module owns the ' +
+            'viewer, and hiding who did what is a governance regression.',
+    },
+});
+/**
+ * The operator command this module declares — feature 080, T042b / D-160.9.
+ *
+ * It was `scripts/read.ts`, which owned its own `initOrm()`. Only the plumbing
+ * moved: the `EntityManager` comes off the composition now, and the reach is
+ * still one read of the kernel's `AuditLogEntry`. The conditions D-102 attached
+ * to this tool are unchanged and are restated at the top of `cli/read.ts`.
+ */
+export const cliCommands = [
+    {
+        name: 'read',
+        summary: 'Read the audit trail from the host, without writing to it.',
+        // The cost is in the **first paragraph**, not a footnote, and it is declared
+        // here rather than printed from the body so the host can answer `--help`
+        // before it composes. That is D-102's condition: the credential is host
+        // access, not a working connection string, so the tool has to be able to say
+        // what it does before it can do it.
+        help: `usage: audit_logs read [--actor=<uuid>] [--action=<code>] [--object-type=<type>]
+                       [--object-id=<id>] [--limit=<n>] [--json]
+
+This tool reads the audit log without writing to it. A read performed here leaves
+no record in the trail; the credential is access to this host and its database,
+which already grants the same read through \`psql\`.
+
+Filters — the same ones the admin HTTP route takes:
+  --actor=<uuid>         the admin user who acted
+  --action=<code>        e.g. product.update, module.disabled
+  --object-type=<type>   e.g. product, module
+  --object-id=<id>       the affected row
+  --limit=<n>            1..500, default 100
+  --json                 the rows as JSON instead of a table`,
+        run: async (context) => (await import('./backend/cli/read.js')).read(context),
+    },
+];
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAyB,MAAM,4BAA4B,CAAC;AAGzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,iEAAiE;IACnE,OAAO,EAAE,OAAO;IAChB,qEAAqE;IACrE,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,QAAQ,EAAE;QACR,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnD,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,QAAQ,EAAE,EAAE;KACb;IACD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB,OAAO,EAAE;QACP;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,4BAA4B;YACtC,cAAc,EAAE,kCAAkC;YAClD,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,YAAY;YACzB,kBAAkB,EAAE,gBAAgB;YACpC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC;YAC/E,MAAM,EAAE,GAAG;SACZ;KACF;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,EAAE;IACF,6EAA6E;IAC7E,yCAAyC;IACzC,UAAU,EAAE;QACV,gBAAgB,EAAE,IAAI;QACtB,MAAM,EACJ,wFAAwF;YACxF,6DAA6D;KAChE;CACF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAmD;IACzE;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,4DAA4D;QACrE,6EAA6E;QAC7E,yEAAyE;QACzE,wEAAwE;QACxE,6EAA6E;QAC7E,oCAAoC;QACpC,IAAI,EAAE;;;;;;;;;;;;;6DAamD;QACzD,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;KAC9E;CACF,CAAC"}

package/docs/audit_logs.md

@@ -0,0 +1,47 @@
+---
+title: audit_logs
+description: Sensitive-action audit trail
+---
+
+# `audit_logs`
+
+Append-only audit trail of every sensitive action. Each row records who did
+what, when, and (during impersonation) on whose behalf.
+
+## Public surface
+
+Gated by the `audit_log:read` permission.
+
+| Verb + Path | Purpose |
+| --- | --- |
+| `GET /api/v1/admin/audit-log` | Query the append-only log. Filters: `filter[actor]`, `filter[customer]`, `filter[action]`, `filter[objectType]`, `filter[objectId]`. Default `limit=100`, capped at 500. Each row carries `stateBefore` / `stateAfter` JSON inline so the admin viewer can render side-by-side diffs without a second roundtrip. |
+
+## Recording
+
+`AuditPort.record({ ... })` is invoked from every sensitive
+mutation: catalog price change, role change, credit-limit adjust, order
+status / payment status change "on behalf", impersonation start/end, API
+key out-of-scope, and others. Adding a new sensitive mutation is a
+two-line change at the call site.
+
+The port is what a module types on and what the kernel publishes
+(`packages/platform/src/kernel/ports/audit.ts`); the container name it is
+registered under is `auditLogService` and has not changed. The
+implementation behind it, `AuditLogService`, is the platform's own and is
+reachable only by its relative path — a module that named the class would
+be depending on a writer shape uniform write auditing routes around, since
+a domain write goes through `CommandBus.run` and the bus writes the row.
+
+## Entities
+
+`AuditLogEntry` — `actorAdminUserId`, optional
+`impersonatedCustomerAccountId`, `action`, `objectType`, `objectId`,
+`stateBefore`, `stateAfter`, `ipAddress`, `userAgent`, `requestId`,
+`actedAt`.
+
+## Extension points
+
+- **External SIEM ship-out** — emit a domain event on each new audit row
+  and let an integration drain the stream into Splunk / Elastic / etc.
+- **Retention** — no automatic pruning today; retention windows belong to
+  whoever runs the platform.

package/i18n/en.json

@@ -0,0 +1,5 @@
+{
+  "nav.auditLog.label": "Audit log",
+  "actions.openAuditLog.label": "Audit log",
+  "actions.openAuditLog.description": "Who changed what, and when"
+}

package/i18n/pl.json

@@ -0,0 +1,5 @@
+{
+  "nav.auditLog.label": "Dziennik audytu",
+  "actions.openAuditLog.label": "Dziennik audytu",
+  "actions.openAuditLog.description": "Kto co zmienił i kiedy"
+}

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@endora-commerce/mod-audit-logs",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Append-only audit log for sensitive admin and customer actions.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "audit_logs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/audit_logs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "docs",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "react": "^19",
+    "react-router-dom": "^7",
+    "zod": "^4",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-router-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "fastify": "^5.12.5",
+    "react": "^19.2.5",
+    "react-router-dom": "^7.18.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "zod": "^4.2.0",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-audit-logs — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";