@every-app/sdk 0.3.0-rc.2 → 0.3.0-rc.3

package/dist/internal/audit.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The audit log's shared reading of an event row: who did it, what it was
+ * about, and what the type means in plain words. Admin → Activity → Audit,
+ * `everyapp workspace audit` and `everyapp_workspace_audit` all show the
+ * same columns, so the three derive them here, from the stored `actor`
+ * and `data` (the catalogue's builders decide what those hold; the
+ * gateway's `summarize` writes the one-line summary from the same data).
+ * Nothing here reads a secret, a tool's arguments or result, or a mail
+ * body: the rows never hold one.
+ */
+import { type EventGroup, type EventTypeInfo } from "./events.js";
+/** Who caused an audit event, as every surface shows it. */
+export interface AuditActor {
+    /** `user`, `agent`, `app`, `operator`, `gateway`, or what the row says. */
+    kind: string;
+    /** The user id, the credential id (an agent), the app id, the operator's id; null for the gateway. */
+    id: string | null;
+    email: string | null;
+    /** A member's name, or the AI app's name for an agent. */
+    name: string | null;
+}
+/** What an audit event is about, picked from its `data` by the keys the catalogue uses. */
+export interface AuditSubject {
+    app?: {
+        id: string;
+        name: string | null;
+    };
+    user?: {
+        id: string;
+        email: string | null;
+        name: string | null;
+    };
+    group?: {
+        id: string;
+        name: string | null;
+    };
+    provider?: {
+        id: string;
+        name: string | null;
+    };
+    mcpApp?: {
+        id: string;
+        name: string | null;
+    };
+    subscription?: {
+        id: string;
+        name: string | null;
+    };
+    /** `member.invited`: whom. */
+    invitation?: {
+        email: string;
+        role: string | null;
+    };
+    /** Setting names an event lists (never a value): unmet, changed, added, removed. */
+    settings?: string[];
+    tool?: string;
+    /** The AI app of a connection or a blocked call. */
+    client?: string;
+    /** A personal access token's name. */
+    token?: string;
+}
+/** The stored `actor` (a JSON string or the parsed object) as the surfaces show it. */
+export declare function auditActorOf(actor: unknown): AuditActor;
+/**
+ * The Who cell: a person by name or email, "agent · Claude" for an AI
+ * client, "CLI · <operator>" for the operator's command line, "app · crm"
+ * for an app's own event, "Gateway" for what the gateway did by itself.
+ */
+export declare function auditActorLabel(actor: AuditActor): string;
+/** The plain-words label for a type: the catalogue's description, or "App event" for an app's own. */
+export declare function auditTypeLabel(type: string): string;
+/** What the event is about, from its stored `data`. */
+export declare function auditSubjectOf(type: string, data: unknown): AuditSubject;
+/** The Subject cell: the first thing the event is about, by name, then what else it names. */
+export declare function auditSubjectLabel(subject: AuditSubject): string;
+/**
+ * What the audit log leaves out unless asked for by type: `ping` (a test)
+ * and `tool.*` (the tool-calls view lists every call, blocked or not).
+ */
+export declare const AUDIT_DEFAULT_EXCLUDED: readonly string[];
+/**
+ * Whether an event of `type` is in the audit log's default view, or
+ * matches the type filter given (an exact type, or a prefix like
+ * `member.*`; `*` is everything, the excluded included).
+ */
+export declare function auditTypeMatches(type: string, filter: string | undefined): boolean;
+/** The SQL the filter translates to: `type = ?` or `type LIKE 'prefix.%'`; null for `*`. */
+export declare function auditTypeCondition(filter: string): {
+    op: "eq";
+    value: string;
+} | {
+    op: "prefix";
+    value: string;
+} | null;
+/** A type-filter value someone typed, cleaned, or null for none. */
+export declare function auditTypeFilterOf(value: unknown): string | undefined;
+export interface AuditTypeGroup {
+    group: EventGroup;
+    label: string;
+    /** `member.*` */
+    pattern: string;
+    types: EventTypeInfo[];
+}
+/** The groups' plain-words headings, as the Add-subscription dialog names them. */
+export declare const AUDIT_GROUP_LABELS: Partial<Record<EventGroup, string>>;
+/** The catalogue grouped for a type filter, in catalogue order, `ping` left out. */
+export declare function auditTypeGroups(types?: readonly EventTypeInfo[]): AuditTypeGroup[];
+//# sourceMappingURL=audit.d.ts.map

package/dist/internal/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/internal/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAML,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1C,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACjE,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/C,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7C,YAAY,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACnD,8BAA8B;IAC9B,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAoBD,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAgBvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAezD;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnD;AAUD,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,YAAY,CA6CxE;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAoB/D;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAuB,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAQT;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,GACb;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKtE;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAQD,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAWlE,CAAC;AAEF,oFAAoF;AACpF,wBAAgB,eAAe,CAC7B,KAAK,GAAE,SAAS,aAAa,EAAgB,GAC5C,cAAc,EAAE,CAgBlB"}

package/dist/internal/audit.js

@@ -0,0 +1,235 @@
+/**
+ * The audit log's shared reading of an event row: who did it, what it was
+ * about, and what the type means in plain words. Admin → Activity → Audit,
+ * `everyapp workspace audit` and `everyapp_workspace_audit` all show the
+ * same columns, so the three derive them here, from the stored `actor`
+ * and `data` (the catalogue's builders decide what those hold; the
+ * gateway's `summarize` writes the one-line summary from the same data).
+ * Nothing here reads a secret, a tool's arguments or result, or a mail
+ * body: the rows never hold one.
+ */
+import { APP_EVENT_PREFIX, EVENT_TYPES, eventPatternMatches, eventTypeInfo, isAppOwnEventType, } from "./events.js";
+function obj(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function str(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+function strings(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string")
+        : [];
+}
+/** The stored `actor` (a JSON string or the parsed object) as the surfaces show it. */
+export function auditActorOf(actor) {
+    let parsed = actor;
+    if (typeof actor === "string") {
+        try {
+            parsed = JSON.parse(actor);
+        }
+        catch {
+            parsed = {};
+        }
+    }
+    const who = obj(parsed);
+    return {
+        kind: str(who.kind) ?? "gateway",
+        id: str(who.id),
+        email: str(who.email),
+        name: str(who.name),
+    };
+}
+/**
+ * The Who cell: a person by name or email, "agent · Claude" for an AI
+ * client, "CLI · <operator>" for the operator's command line, "app · crm"
+ * for an app's own event, "Gateway" for what the gateway did by itself.
+ */
+export function auditActorLabel(actor) {
+    switch (actor.kind) {
+        case "user":
+            return actor.name ?? actor.email ?? actor.id ?? "a member";
+        case "agent":
+            return `agent · ${actor.name ?? actor.id ?? "AI app"}`;
+        case "operator":
+            return `CLI · ${actor.email ?? actor.id ?? "operator"}`;
+        case "app":
+            return `app · ${actor.id ?? "app"}`;
+        case "gateway":
+            return "Gateway";
+        default:
+            return actor.name ?? actor.email ?? actor.id ?? actor.kind;
+    }
+}
+/** The plain-words label for a type: the catalogue's description, or "App event" for an app's own. */
+export function auditTypeLabel(type) {
+    const info = eventTypeInfo(type);
+    if (info)
+        return info.description;
+    if (isAppOwnEventType(type)) {
+        const rest = type.slice(APP_EVENT_PREFIX.length);
+        return `App event: ${rest.slice(rest.indexOf(".") + 1)}`;
+    }
+    return type;
+}
+function named(value) {
+    const subject = obj(value);
+    const id = str(subject.id) ?? str(subject.rowId);
+    return id ? { id, name: str(subject.name) } : undefined;
+}
+/** What the event is about, from its stored `data`. */
+export function auditSubjectOf(type, data) {
+    const d = obj(data);
+    const subject = {};
+    const app = named(d.app);
+    if (app) {
+        if (type.startsWith("mcp_app."))
+            subject.mcpApp = app;
+        else
+            subject.app = app;
+    }
+    else if (isAppOwnEventType(type)) {
+        const rest = type.slice(APP_EVENT_PREFIX.length);
+        subject.app = { id: rest.slice(0, rest.indexOf(".")), name: null };
+    }
+    const user = obj(d.user);
+    if (str(user.id)) {
+        subject.user = {
+            id: str(user.id),
+            email: str(user.email),
+            name: str(user.name),
+        };
+    }
+    const group = named(d.group);
+    if (group)
+        subject.group = group;
+    const provider = named(d.provider);
+    if (provider)
+        subject.provider = provider;
+    const subscription = named(d.subscription);
+    if (subscription)
+        subject.subscription = subscription;
+    const invitation = obj(d.invitation);
+    if (str(invitation.email)) {
+        subject.invitation = {
+            email: str(invitation.email),
+            role: str(invitation.role),
+        };
+    }
+    const settings = [
+        ...strings(d.settings),
+        ...strings(d.unmet),
+        ...strings(d.changed),
+        ...strings(d.names),
+    ];
+    if (settings.length > 0)
+        subject.settings = [...new Set(settings)];
+    const tool = str(d.tool);
+    if (tool)
+        subject.tool = tool;
+    const client = str(obj(d.client).name) ?? str(obj(d.connection).clientName);
+    if (client)
+        subject.client = client;
+    if (type.startsWith("token.") && str(d.name))
+        subject.token = str(d.name);
+    return subject;
+}
+/** The Subject cell: the first thing the event is about, by name, then what else it names. */
+export function auditSubjectLabel(subject) {
+    const parts = [];
+    const app = subject.app ?? subject.mcpApp;
+    if (app)
+        parts.push(app.name ?? app.id);
+    if (subject.user) {
+        parts.push(subject.user.name ?? subject.user.email ?? subject.user.id);
+    }
+    if (subject.invitation)
+        parts.push(subject.invitation.email);
+    if (subject.group)
+        parts.push(subject.group.name ?? subject.group.id);
+    if (subject.provider) {
+        parts.push(subject.provider.name ?? subject.provider.id);
+    }
+    if (subject.subscription) {
+        parts.push(subject.subscription.name ?? subject.subscription.id);
+    }
+    if (subject.token)
+        parts.push(subject.token);
+    if (subject.tool)
+        parts.push(subject.tool);
+    if (subject.client)
+        parts.push(subject.client);
+    if (subject.settings)
+        parts.push(subject.settings.join(", "));
+    return parts.join(" · ");
+}
+/**
+ * What the audit log leaves out unless asked for by type: `ping` (a test)
+ * and `tool.*` (the tool-calls view lists every call, blocked or not).
+ */
+export const AUDIT_DEFAULT_EXCLUDED = ["ping", "tool.*"];
+/**
+ * Whether an event of `type` is in the audit log's default view, or
+ * matches the type filter given (an exact type, or a prefix like
+ * `member.*`; `*` is everything, the excluded included).
+ */
+export function auditTypeMatches(type, filter) {
+    if (filter === undefined) {
+        return !AUDIT_DEFAULT_EXCLUDED.some((pattern) => eventPatternMatches(pattern, type));
+    }
+    if (filter === "*")
+        return true;
+    return eventPatternMatches(filter, type);
+}
+/** The SQL the filter translates to: `type = ?` or `type LIKE 'prefix.%'`; null for `*`. */
+export function auditTypeCondition(filter) {
+    if (filter === "*")
+        return null;
+    if (filter.endsWith(".*"))
+        return { op: "prefix", value: filter.slice(0, -1) };
+    return { op: "eq", value: filter };
+}
+/** A type-filter value someone typed, cleaned, or null for none. */
+export function auditTypeFilterOf(value) {
+    const text = typeof value === "string" ? value.trim() : "";
+    return text.length > 0 ? text : undefined;
+}
+/** A group with no heading here reads as its name ("organization" → "Organization"). */
+function groupHeading(group) {
+    const words = group.replace(/_/g, " ");
+    return words.charAt(0).toUpperCase() + words.slice(1);
+}
+/** The groups' plain-words headings, as the Add-subscription dialog names them. */
+export const AUDIT_GROUP_LABELS = {
+    member: "Members",
+    app: "Apps",
+    cap: "Monthly caps",
+    tool: "Agent tool calls",
+    connection: "AI connections",
+    token: "Tokens",
+    access: "Cloudflare Access",
+    mcp_app: "MCP apps",
+    provider: "API providers",
+    ping: "Test",
+};
+/** The catalogue grouped for a type filter, in catalogue order, `ping` left out. */
+export function auditTypeGroups(types = EVENT_TYPES) {
+    const groups = new Map();
+    for (const info of types) {
+        if (info.group === "ping")
+            continue;
+        const existing = groups.get(info.group);
+        if (existing)
+            existing.types.push(info);
+        else {
+            groups.set(info.group, {
+                group: info.group,
+                label: AUDIT_GROUP_LABELS[info.group] ?? groupHeading(info.group),
+                pattern: `${info.group}.*`,
+                types: [info],
+            });
+        }
+    }
+    return [...groups.values()];
+}