@endora-commerce/platform 0.100.0

package/dist/http/request-actor.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=request-actor.js.map

package/dist/http/request-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-actor.js","sourceRoot":"","sources":["../../src/http/request-actor.ts"],"names":[],"mappings":""}

package/dist/http/server.d.ts

@@ -0,0 +1,60 @@
+import { type FastifyInstance } from 'fastify';
+import { type OpenApiMetadata } from './openapi.js';
+import type { ErrorEnvelopeOptions } from './error-envelope.js';
+import { type TrustedProxy } from './trusted-proxy.js';
+import { type ApiInterceptorRegistry } from './interceptors/index.js';
+/**
+ * Module registration hook — each backend module exposes a plugin that takes
+ * the composed Fastify app and wires its own routes. Modules receive the
+ * composition root's dependency container via a separate mechanism (services
+ * are constructed once at boot and passed in explicitly). This keeps the
+ * server.ts bootstrap decoupled from any specific module.
+ */
+export type ModulePlugin = (app: FastifyInstance) => Promise<void> | void;
+/**
+ * Fastify bootstrap — the single entry point used by `src/index.ts` (production) and by
+ * test/helpers/test-server.ts (contract tests). All cross-cutting concerns (helmet, cookie
+ * parsing, rate limiting, Zod validation, error envelope, request id, OpenAPI) are wired
+ * here so individual module routes only deal with domain logic.
+ */
+export interface BuildServerOptions {
+    /** Secret used to sign session cookies (required in production). */
+    sessionCookieSecret: string;
+    /** Visible in the generated OpenAPI document. */
+    openApi: OpenApiMetadata;
+    /** Test overrides — bypass rate limits so contract tests are not flaky. */
+    disableRateLimit?: boolean;
+    /**
+     * Optional per-IP request budget (requests per minute). When omitted, the
+     * default is 1000/min — high enough that local SSR dev (which can fire
+     * 10+ backend calls per page render across layout hooks, cart, /me,
+     * upsells, etc.) does not trip the limiter on every navigation.
+     * Production composition can pass a tighter ceiling via env.
+     */
+    rateLimitMax?: number;
+    /** Business-module route registrations, invoked after cross-cutting hooks are installed. */
+    modules?: ModulePlugin[];
+    /** Optional i18n bridge for translating standardized error envelopes. */
+    errorEnvelope?: ErrorEnvelopeOptions;
+    /**
+     * Feature 060 — API interceptor registry. When present, buildServer installs
+     * the pre/post dispatch hooks and seals the registry (after fail-closed
+     * target validation) in an onReady hook. When absent, the server is
+     * byte-for-byte identical to the pre-060 behavior.
+     */
+    apiInterceptors?: ApiInterceptorRegistry;
+    /**
+     * Issue #220 — which upstream proxy may be believed about the client address.
+     * Omitted (the default) means none: `request.ip` is the socket's peer, which
+     * behind a reverse proxy is the proxy. A deployment that terminates TLS on a
+     * host nginx passes the hop count or the proxy's address, and gets the real
+     * client on rate-limit buckets and audit rows.
+     *
+     * The composition root reads the environment and parses it with
+     * `parseTrustedProxy`; this platform root reads no configuration itself
+     * (D-52/D-53), and the type has no `true` to pass.
+     */
+    trustedProxy?: TrustedProxy;
+}
+export declare function buildServer(options: BuildServerOptions): Promise<FastifyInstance>;
+//# sourceMappingURL=server.d.ts.map

package/dist/http/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAaxD,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE1E;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,OAAO,EAAE,eAAe,CAAC;IACzB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,yEAAyE;IACzE,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA8GvF"}

package/dist/http/server.js

@@ -0,0 +1,117 @@
+import Fastify, {} from 'fastify';
+import helmet from '@fastify/helmet';
+import cookie from '@fastify/cookie';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+import { serializerCompiler, validatorCompiler, } from '@fastify/type-provider-zod';
+import { attachPlatformLogger } from '../kernel/logging.js';
+import { registerErrorEnvelope } from './error-envelope.js';
+import { attachOpenApiAutoRegistration, registerOpenApiRoutes, } from './openapi.js';
+import { toFastifyTrustProxy } from './trusted-proxy.js';
+import { makePostDispatchPreSerialization, makePreDispatchOnRoute, RouteTable, validateRegistrations, } from './interceptors/index.js';
+export async function buildServer(options) {
+    // Fastify configures pino internally from these options. We don't pass a pre-built
+    // Logger instance because pino 10's `msgPrefix: string | undefined` conflicts with
+    // Fastify's stricter `FastifyBaseLogger` under exactOptionalPropertyTypes.
+    const isDev = process.env['NODE_ENV'] !== 'production';
+    const app = Fastify({
+        logger: {
+            level: process.env['LOG_LEVEL'] ?? 'info',
+            redact: {
+                paths: ['req.headers.authorization', 'req.headers.cookie', '*.password', '*.passwordHash', '*.secret'],
+                censor: '[REDACTED]',
+            },
+            ...(isDev
+                ? {
+                    transport: {
+                        target: 'pino-pretty',
+                        options: { colorize: true, translateTime: 'SYS:HH:MM:ss.l', ignore: 'pid,hostname' },
+                    },
+                }
+                : {}),
+        },
+        genReqId: () => `req_${randomHex(16)}`,
+        requestIdHeader: 'x-request-id',
+        // See BuildServerOptions.trustedProxy — `false` unless a deployment names
+        // the hop it trusts.
+        trustProxy: options.trustedProxy === undefined ? false : toFastifyTrustProxy(options.trustedProxy),
+        disableRequestLogging: false,
+    });
+    // Issue #269 — this is the moment the log the platform actually collects
+    // comes into existence, so it is where every module's `ctx.log` is pointed at
+    // it. Doing it here rather than in a composition root is what stops the two
+    // roots from drifting on it (they already had: `composition.ts` passed the
+    // global `console` and the harness passed a no-op) and covers all four entry
+    // points with one call — `index.ts`, `worker.ts`, the test harness and the
+    // overlay runtime all reach the platform's logger through `buildServer`.
+    //
+    // Detached on close, and the detach is a no-op once a later server has
+    // attached, so a suite that closes an earlier app does not silence the
+    // current one. See `kernel/logging.ts` for what a line emitted while nothing
+    // is attached does instead.
+    const detachPlatformLogger = attachPlatformLogger(app.log);
+    app.addHook('onClose', () => {
+        detachPlatformLogger();
+    });
+    app.setValidatorCompiler(validatorCompiler);
+    app.setSerializerCompiler(serializerCompiler);
+    await app.register(helmet, { contentSecurityPolicy: false });
+    // Allow the storefront (Next.js) and admin panel (Vite) to call the API
+    // cross-origin in dev. CORS_ALLOWED_ORIGINS is a comma-separated allow-list;
+    // the default covers the local dev ports for both apps. `credentials: true`
+    // pairs with the api-client's `credentials: 'include'` so b2b_session
+    // cookies survive the round-trip.
+    const corsOrigins = (process.env['CORS_ALLOWED_ORIGINS'] ?? 'http://localhost:3000,http://localhost:3002')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    await app.register(cors, {
+        origin: corsOrigins,
+        credentials: true,
+        methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+        allowedHeaders: ['Content-Type', 'Accept', 'Authorization', 'X-Sales-Channel', 'Accept-Language', 'If-Match', 'X-Request-Id'],
+        // `Content-Language` carries the language the error envelope answered in
+        // (feature 083, D-139 § 8.2). Without it here, a cross-origin storefront or
+        // admin build cannot read the header at all, which is the whole point of
+        // echoing it.
+        exposedHeaders: ['X-Request-Id', 'ETag', 'Content-Language'],
+    });
+    await app.register(cookie, { secret: options.sessionCookieSecret });
+    if (options.disableRateLimit !== true) {
+        await app.register(rateLimit, {
+            max: options.rateLimitMax ?? 1000,
+            timeWindow: '1 minute',
+        });
+    }
+    // Stamp X-Request-Id on every response so clients and the audit log can correlate.
+    app.addHook('onSend', async (request, reply) => {
+        reply.header('x-request-id', request.id);
+    });
+    // Feature 060 — API interceptors. Installed BEFORE the module loop so the
+    // onRoute hooks observe every route (including those mounted in encapsulated
+    // defineModuleRoutes child contexts, which inherit onRoute).
+    if (options.apiInterceptors) {
+        const registry = options.apiInterceptors;
+        const routeTable = new RouteTable();
+        app.addHook('onRoute', routeTable.onRouteListener);
+        app.addHook('onRoute', makePreDispatchOnRoute(registry));
+        app.addHook('preSerialization', makePostDispatchPreSerialization(registry));
+        app.addHook('onReady', async () => {
+            validateRegistrations(registry, routeTable);
+            registry.seal();
+        });
+    }
+    registerErrorEnvelope(app, options.errorEnvelope);
+    attachOpenApiAutoRegistration(app);
+    registerOpenApiRoutes(app, options.openApi);
+    for (const modulePlugin of options.modules ?? []) {
+        await modulePlugin(app);
+    }
+    return app.withTypeProvider();
+}
+function randomHex(len) {
+    const bytes = new Uint8Array(len);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+//# sourceMappingURL=server.js.map

package/dist/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAwB,MAAM,SAAS,CAAC;AACxD,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAqB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,gCAAgC,EAChC,sBAAsB,EACtB,UAAU,EACV,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AA0DjC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,mFAAmF;IACnF,mFAAmF;IACnF,2EAA2E;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM;YACzC,MAAM,EAAE;gBACN,KAAK,EAAE,CAAC,2BAA2B,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC;gBACtG,MAAM,EAAE,YAAY;aACrB;YACD,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC;oBACE,SAAS,EAAE;wBACT,MAAM,EAAE,aAAa;wBACrB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE;qBACrF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,SAAS,CAAC,EAAE,CAAC,EAAE;QACtC,eAAe,EAAE,cAAc;QAC/B,0EAA0E;QAC1E,qBAAqB;QACrB,UAAU,EAAE,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC;QAClG,qBAAqB,EAAE,KAAK;KAC7B,CAAC,CAAC;IAEH,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,uEAAuE;IACvE,uEAAuE;IACvE,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,oBAAoB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAC5C,GAAG,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAE9C,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,WAAW,GAAG,CAClB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,6CAA6C,CACrF;SACE,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7D,cAAc,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,CAAC;QAC7H,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,cAAc;QACd,cAAc,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,kBAAkB,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEpE,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC5B,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;YACjC,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7C,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAChC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5C,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACnC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5C,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,GAAG,CAAC,gBAAgB,EAAmB,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/http/storefront-revalidator.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Triggers on-demand revalidation of the storefront's tagged fetch caches
+ * (feature 049; promoted to shared HTTP infrastructure in feature 066). It has
+ * no module-specific content — it POSTs cache tags to the storefront's
+ * revalidate endpoint — and four modules need it, so it lives here rather than
+ * inside one of them (Principle I).
+ *
+ * Best-effort: a failed call is logged and swallowed so a config/custom-event
+ * write never fails because the storefront is unreachable. Disabled (no-op)
+ * when the base URL or secret is not configured.
+ */
+export interface StorefrontRevalidatorOptions {
+    baseUrl: string | undefined;
+    secret: string | undefined;
+    fetchFn?: typeof fetch;
+    logger?: {
+        warn: (obj: unknown, msg: string) => void;
+    };
+}
+export declare class StorefrontRevalidator {
+    private readonly options;
+    private logger;
+    constructor(options: StorefrontRevalidatorOptions);
+    /** Attach a logger once the Fastify app (and its `log`) exists. */
+    setLogger(logger: NonNullable<StorefrontRevalidatorOptions['logger']>): void;
+    get enabled(): boolean;
+    revalidate(tags: string[]): Promise<void>;
+}
+//# sourceMappingURL=storefront-revalidator.d.ts.map

package/dist/http/storefront-revalidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-revalidator.d.ts","sourceRoot":"","sources":["../../src/http/storefront-revalidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACxD;AAED,qBAAa,qBAAqB;IAGpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,MAAM,CAAyC;gBAE1B,OAAO,EAAE,4BAA4B;IAIlE,mEAAmE;IACnE,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI;IAI5E,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBhD"}

package/dist/http/storefront-revalidator.js

@@ -0,0 +1,34 @@
+export class StorefrontRevalidator {
+    options;
+    logger;
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger;
+    }
+    /** Attach a logger once the Fastify app (and its `log`) exists. */
+    setLogger(logger) {
+        this.logger = logger;
+    }
+    get enabled() {
+        return !!this.options.baseUrl && !!this.options.secret;
+    }
+    async revalidate(tags) {
+        if (!this.enabled || tags.length === 0)
+            return;
+        const fetchFn = this.options.fetchFn ?? globalThis.fetch;
+        try {
+            await fetchFn(`${this.options.baseUrl}/api/revalidate`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-revalidate-secret': this.options.secret,
+                },
+                body: JSON.stringify({ tags }),
+            });
+        }
+        catch (err) {
+            this.logger?.warn({ err }, '[storefront-revalidate] failed');
+        }
+    }
+}
+//# sourceMappingURL=storefront-revalidator.js.map

package/dist/http/storefront-revalidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-revalidator.js","sourceRoot":"","sources":["../../src/http/storefront-revalidator.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,qBAAqB;IAGH;IAFrB,MAAM,CAAyC;IAEvD,YAA6B,OAAqC;QAArC,YAAO,GAAP,OAAO,CAA8B;QAChE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,mEAAmE;IACnE,SAAS,CAAC,MAA2D;QACnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAc;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,iBAAiB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,MAAgB;iBACrD;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF"}

package/dist/http/test-actor-carrier.d.ts

@@ -0,0 +1,28 @@
+import type { FastifyRequest } from 'fastify';
+/**
+ * Local narrowing for the test harness's `request.testActor` decoration.
+ *
+ * `test/helpers/test-actors.ts` declares a global `fastify` module augmentation
+ * adding `testActor` to `FastifyRequest`. That file lives under `test/`, which
+ * `tsconfig.build.json` excludes — so production code that reads the field
+ * through the *global* augmentation typechecks under `tsconfig.json` (which
+ * includes tests) but fails `pnpm run build`.
+ *
+ * Production route handlers therefore narrow the field locally through this
+ * carrier type instead. It intentionally mirrors only the admin shape actually
+ * consumed by `src/` — the full `TestActor` union stays test-only, and no
+ * test-only type is added to the production `FastifyRequest` surface.
+ */
+export interface TestActorCarrier {
+    testActor?: {
+        kind: string;
+        adminUserId: string;
+    };
+}
+/**
+ * Returns the harness-supplied admin user id, or `undefined` when the request
+ * carries no admin `testActor`. Production requests resolve their actor through
+ * the auth plugin (`request.actor`) and always get `undefined` here.
+ */
+export declare function testAdminUserId(request: FastifyRequest): string | undefined;
+//# sourceMappingURL=test-actor-carrier.d.ts.map

package/dist/http/test-actor-carrier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-actor-carrier.d.ts","sourceRoot":"","sources":["../../src/http/test-actor-carrier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAG3E"}

package/dist/http/test-actor-carrier.js

@@ -0,0 +1,10 @@
+/**
+ * Returns the harness-supplied admin user id, or `undefined` when the request
+ * carries no admin `testActor`. Production requests resolve their actor through
+ * the auth plugin (`request.actor`) and always get `undefined` here.
+ */
+export function testAdminUserId(request) {
+    const testActor = request.testActor;
+    return testActor?.kind === 'admin' ? testActor.adminUserId : undefined;
+}
+//# sourceMappingURL=test-actor-carrier.js.map

package/dist/http/test-actor-carrier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-actor-carrier.js","sourceRoot":"","sources":["../../src/http/test-actor-carrier.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB;IACrD,MAAM,SAAS,GAAI,OAA6C,CAAC,SAAS,CAAC;IAC3E,OAAO,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC"}

package/dist/http/trusted-proxy.d.ts

@@ -0,0 +1,48 @@
+/**
+ * What `buildServer` passes to Fastify's `trustProxy`. A hop count, or a list
+ * of trusted proxy addresses/CIDRs/named ranges. Deliberately not `boolean`:
+ * `true` means "believe every client's X-Forwarded-For".
+ */
+export type TrustedProxy = number | string[];
+/** Raw values, as the composition root read them from the environment. */
+export interface TrustedProxyEnv {
+    /** `TRUSTED_PROXY_HOPS` — how many proxies sit in front of the backend. */
+    hops?: string | undefined;
+    /** `TRUSTED_PROXY_ADDRESSES` — comma-separated proxy addresses/CIDRs. */
+    addresses?: string | undefined;
+}
+/** A configuration value the parser refuses. The composition root fails the boot on it. */
+export declare class TrustedProxyConfigError extends Error {
+    constructor(message: string);
+}
+/** Fastify's `trustProxy` function form: `hop` 0 is the socket's own peer. */
+export type TrustProxyFunction = (address: string, hop: number) => boolean;
+/**
+ * What `buildServer` hands Fastify for a {@link TrustedProxy}.
+ *
+ * Fastify 5.12.1 (GHSA-3m5p-2c4r-xxw2) removed the numeric `trustProxy`: a
+ * number now fails closed at runtime, so `TRUSTED_PROXY_HOPS=1` would silently
+ * go back to reporting the proxy as the client. A hop count is therefore
+ * translated into the function form, and the function is exactly what Fastify
+ * compiled a number into before 5.12.1 — `@fastify/proxy-addr` walks the chain
+ * from the socket peer (hop 0) through `X-Forwarded-For` right to left, and
+ * trusts hop `i` while `i < hops`. The address list is passed through
+ * unchanged; Fastify compiles it itself.
+ *
+ * Like the numeric form it replaces, a hop count does not look at the
+ * connecting address, so it is only as safe as the network that guarantees the
+ * backend is reachable through its proxies alone. `TRUSTED_PROXY_ADDRESSES`
+ * is the form that does not depend on that.
+ */
+export declare function toFastifyTrustProxy(trusted: TrustedProxy): TrustProxyFunction | string[];
+/**
+ * Turns the two environment variables into the value `buildServer` takes.
+ * Returns `undefined` when neither is set — the server then trusts no proxy,
+ * which is what it has always done.
+ *
+ * Throws `TrustedProxyConfigError` on anything it cannot make sense of, rather
+ * than falling back to the default: an operator who mistyped the variable would
+ * otherwise get the broken behaviour they were trying to fix, silently.
+ */
+export declare function parseTrustedProxy(env: TrustedProxyEnv): TrustedProxy | undefined;
+//# sourceMappingURL=trusted-proxy.d.ts.map

package/dist/http/trusted-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-proxy.d.ts","sourceRoot":"","sources":["../../src/http/trusted-proxy.ts"],"names":[],"mappings":"AAsBA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,2FAA2F;AAC3F,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAiFD,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAE3E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,kBAAkB,GAAG,MAAM,EAAE,CAIxF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,YAAY,GAAG,SAAS,CAahF"}

package/dist/http/trusted-proxy.js

@@ -0,0 +1,136 @@
+// Trusted-proxy configuration for the HTTP server (issue #220).
+//
+// Behind a reverse proxy the TCP peer is the proxy, so `request.ip` is the
+// proxy's address for every request unless Fastify is told which hop to trust.
+// That address is what the per-IP rate limiter buckets on and what the MFA,
+// impersonation and prompt-action audit rows record, so an unconfigured
+// deployment behind nginx has one shared rate-limit bucket for the whole
+// internet and a security audit trail that names its own proxy.
+//
+// Trusting the header unconditionally is the other failure, not the fix: with
+// `trustProxy: true` Fastify believes any `X-Forwarded-For` a client sends, and
+// a client can send whatever it likes. So this module parses the *narrow*
+// forms — a hop count, or the addresses the deployment's own proxies use — and
+// has no spelling at all for "trust everything". The unsafe answer is not hard
+// to write here; it is unwritable.
+//
+// This file reads no environment variable. `src/http` is a platform root
+// (D-52/D-53): the composition root reads the variables and injects the parsed
+// value, exactly as it does for the rate-limit ceiling.
+import { isIP } from 'node:net';
+/** A configuration value the parser refuses. The composition root fails the boot on it. */
+export class TrustedProxyConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TrustedProxyConfigError';
+    }
+}
+/**
+ * Sanity ceiling on the hop count. Real deployments have one or two proxies
+ * (host nginx, optionally a CDN in front of it); a larger number is a typo, and
+ * a large enough one is `true` written in a way that looks careful.
+ */
+const MAX_HOPS = 10;
+/** Address ranges `@fastify/proxy-addr` knows by name. */
+const NAMED_RANGES = new Set(['loopback', 'linklocal', 'uniquelocal']);
+const HOPS_VAR = 'TRUSTED_PROXY_HOPS';
+const ADDRESSES_VAR = 'TRUSTED_PROXY_ADDRESSES';
+function blank(value) {
+    return value === undefined || value.trim() === '';
+}
+function parseHops(raw) {
+    const trimmed = raw.trim();
+    if (!/^[0-9]+$/.test(trimmed)) {
+        throw new TrustedProxyConfigError(`${HOPS_VAR}="${raw}" is not a whole number. Set it to the number of proxies in front of ` +
+            `the backend (a single host nginx is 1), or use ${ADDRESSES_VAR} instead.`);
+    }
+    const hops = Number(trimmed);
+    if (hops < 1 || hops > MAX_HOPS) {
+        throw new TrustedProxyConfigError(`${HOPS_VAR}=${trimmed} is out of range — it must be between 1 and ${MAX_HOPS}. ` +
+            `0 does not mean "trust nothing" (leave ${HOPS_VAR} unset for that); it makes the ` +
+            `socket's own peer the client.`);
+    }
+    return hops;
+}
+function assertUsableAddress(entry) {
+    if (NAMED_RANGES.has(entry))
+        return;
+    const slash = entry.indexOf('/');
+    const address = slash === -1 ? entry : entry.slice(0, slash);
+    const family = isIP(address);
+    if (family === 0) {
+        throw new TrustedProxyConfigError(`${ADDRESSES_VAR} entry "${entry}" is not an IP address, a CIDR range or one of ` +
+            `${[...NAMED_RANGES].join(', ')}. Host names are not resolved — the match is made ` +
+            `against the connecting address, so a name would silently match nothing.`);
+    }
+    if (slash === -1)
+        return;
+    const prefix = entry.slice(slash + 1);
+    const maxPrefix = family === 4 ? 32 : 128;
+    if (!/^[0-9]+$/.test(prefix) || Number(prefix) > maxPrefix) {
+        throw new TrustedProxyConfigError(`${ADDRESSES_VAR} entry "${entry}" has an invalid prefix length — expected 1..${maxPrefix}.`);
+    }
+    if (Number(prefix) === 0) {
+        throw new TrustedProxyConfigError(`${ADDRESSES_VAR} entry "${entry}" trusts every address, which is the same as believing ` +
+            `any client's X-Forwarded-For header. List the deployment's own proxy addresses, or ` +
+            `set ${HOPS_VAR} to the number of proxies in front of the backend.`);
+    }
+}
+function parseAddresses(raw) {
+    const entries = raw
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== '');
+    if (entries.length === 0) {
+        throw new TrustedProxyConfigError(`${ADDRESSES_VAR}="${raw}" lists no address.`);
+    }
+    for (const entry of entries)
+        assertUsableAddress(entry);
+    return entries;
+}
+/**
+ * What `buildServer` hands Fastify for a {@link TrustedProxy}.
+ *
+ * Fastify 5.12.1 (GHSA-3m5p-2c4r-xxw2) removed the numeric `trustProxy`: a
+ * number now fails closed at runtime, so `TRUSTED_PROXY_HOPS=1` would silently
+ * go back to reporting the proxy as the client. A hop count is therefore
+ * translated into the function form, and the function is exactly what Fastify
+ * compiled a number into before 5.12.1 — `@fastify/proxy-addr` walks the chain
+ * from the socket peer (hop 0) through `X-Forwarded-For` right to left, and
+ * trusts hop `i` while `i < hops`. The address list is passed through
+ * unchanged; Fastify compiles it itself.
+ *
+ * Like the numeric form it replaces, a hop count does not look at the
+ * connecting address, so it is only as safe as the network that guarantees the
+ * backend is reachable through its proxies alone. `TRUSTED_PROXY_ADDRESSES`
+ * is the form that does not depend on that.
+ */
+export function toFastifyTrustProxy(trusted) {
+    if (Array.isArray(trusted))
+        return trusted;
+    const hops = trusted;
+    return (_address, hop) => hop < hops;
+}
+/**
+ * Turns the two environment variables into the value `buildServer` takes.
+ * Returns `undefined` when neither is set — the server then trusts no proxy,
+ * which is what it has always done.
+ *
+ * Throws `TrustedProxyConfigError` on anything it cannot make sense of, rather
+ * than falling back to the default: an operator who mistyped the variable would
+ * otherwise get the broken behaviour they were trying to fix, silently.
+ */
+export function parseTrustedProxy(env) {
+    const hopsSet = !blank(env.hops);
+    const addressesSet = !blank(env.addresses);
+    if (hopsSet && addressesSet) {
+        throw new TrustedProxyConfigError(`${HOPS_VAR} and ${ADDRESSES_VAR} are both set. They are two ways of saying the same ` +
+            `thing and Fastify takes one — set exactly one of them.`);
+    }
+    if (hopsSet)
+        return parseHops(env.hops);
+    if (addressesSet)
+        return parseAddresses(env.addresses);
+    return undefined;
+}
+//# sourceMappingURL=trusted-proxy.js.map

package/dist/http/trusted-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-proxy.js","sourceRoot":"","sources":["../../src/http/trusted-proxy.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,yEAAyE;AACzE,gEAAgE;AAChE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,wDAAwD;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAiBhC,2FAA2F;AAC3F,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,0DAA0D;AAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAEvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACtC,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD,SAAS,KAAK,CAAC,KAAyB;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,QAAQ,KAAK,GAAG,uEAAuE;YACxF,kDAAkD,aAAa,WAAW,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAC/B,GAAG,QAAQ,IAAI,OAAO,+CAA+C,QAAQ,IAAI;YAC/E,0CAA0C,QAAQ,iCAAiC;YACnF,+BAA+B,CAClC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,aAAa,WAAW,KAAK,iDAAiD;YAC/E,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;YACnF,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO;IAEzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,GAAG,aAAa,WAAW,KAAK,gDAAgD,SAAS,GAAG,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,GAAG,aAAa,WAAW,KAAK,yDAAyD;YACvF,qFAAqF;YACrF,OAAO,QAAQ,oDAAoD,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,GAAG,aAAa,KAAK,GAAG,qBAAqB,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE3C,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,QAAQ,QAAQ,aAAa,sDAAsD;YACpF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC;IAClD,IAAI,YAAY;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/kernel/audit/audit-log-entry.entity.d.ts

@@ -0,0 +1,33 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * Row in the audit log of sensitive operations (FR-084, R-12).
+ * Never soft-deleted — accounting + audit retention ≥ 5 years per spec assumptions.
+ */
+export declare class AuditLogEntry {
+    [OptionalProps]?: 'id' | 'actedAt';
+    id: string;
+    /** The Admin User who performed the action. Null for system-initiated entries. */
+    actorAdminUserId?: string | null;
+    /**
+     * The Customer Account being acted upon by the Admin User during Impersonation (R-12).
+     * Non-null entries describe operations performed on behalf of the Customer.
+     */
+    impersonatedCustomerAccountId?: string | null;
+    actedAt: Date;
+    /**
+     * Screaming-snake-case action identifier, e.g. `price.update`, `permission.change`,
+     * `credit_limit.adjust`, `impersonation.start`, `impersonation.end`.
+     */
+    action: string;
+    /** Polymorphic pointer to the affected entity. */
+    objectType: string;
+    objectId: string;
+    /** Diff-friendly snapshot of the affected fields before the mutation. */
+    stateBefore?: Record<string, unknown> | null;
+    stateAfter?: Record<string, unknown> | null;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    /** Correlation id from the inbound request (X-Request-Id). */
+    requestId?: string | null;
+}
+//# sourceMappingURL=audit-log-entry.entity.d.ts.map

package/dist/kernel/audit/audit-log-entry.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log-entry.entity.d.ts","sourceRoot":"","sources":["../../../src/kernel/audit/audit-log-entry.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,aAAa,EAAwB,MAAM,iBAAiB,CAAC;AAIrF;;;GAGG;AACH,qBAEa,aAAa;IACxB,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAGnC,EAAE,EAAE,MAAM,CAAgB;IAE1B,kFAAkF;IAGlF,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;;OAGG;IAGH,6BAA6B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAI9C,OAAO,EAAE,IAAI,CAAc;IAE3B;;;OAGG;IAGH,MAAM,EAAG,MAAM,CAAC;IAEhB,kDAAkD;IAElD,UAAU,EAAG,MAAM,CAAC;IAIpB,QAAQ,EAAG,MAAM,CAAC;IAElB,yEAAyE;IAEzE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAG7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAG5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,8DAA8D;IAE9D,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B"}