@flowdular/sdk 0.2.4 → 0.3.0

package/modules/audit/migrations/0002_audit_sweep_routing_role.up.sql

@@ -0,0 +1,21 @@
+-- The retention sweep must find the classes that are due across every
+-- workspace before it knows whose they are. It is granted exactly the routing
+-- and policy columns of audit_data_classes: the human label and the owning
+-- module id stay invisible to it, and every class it picks is read again under
+-- the workspace the routing row named before a single row is removed.
+--
+-- The retention columns are part of the routing set on purpose. Without them
+-- the cross-tenant read cannot tell a class that is kept for ever from one that
+-- is due, and the loop would re-read the same never-due classes every interval.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY audit_data_classes_background_policy ON audit_data_classes
+  FOR SELECT TO coreloom_background
+  USING (true);
+REVOKE SELECT ON audit_data_classes FROM coreloom_background;
+GRANT SELECT (tenant_id, class_id, sweepable, retention_mode, retention_days, default_retention_days, last_swept_at) ON audit_data_classes TO coreloom_background;

package/modules/audit/migrations/0003_audit_export_request.down.sql

@@ -0,0 +1,12 @@
+REVOKE SELECT (tenant_id, id, status, started_at) ON audit_export_runs FROM coreloom_background;
+DROP POLICY IF EXISTS audit_export_runs_background_policy ON audit_export_runs;
+DROP INDEX IF EXISTS audit_export_runs_pending_idx;
+ALTER TABLE audit_export_runs DROP CONSTRAINT IF EXISTS audit_export_runs_dry_run_check;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS claimed_at;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS summary_json;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS reason;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS archive_path;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS workspace_name;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS workspace_slug;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS dry_run;
+ALTER TABLE audit_export_runs DROP COLUMN IF EXISTS output_directory;

package/modules/audit/migrations/0003_audit_export_request.up.sql

@@ -0,0 +1,40 @@
+-- An export is a request the running platform answers. The operator command
+-- records the row and waits; the platform process, the only one holding the
+-- sealed data class registry with every owner port, performs the export and
+-- records what it wrote. The request columns are what the operator asked for,
+-- the result columns what the platform produced, and claimed_at is the lease
+-- that keeps two platform processes from writing one archive twice.
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS output_directory TEXT;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS dry_run SMALLINT NOT NULL DEFAULT 0;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS workspace_slug TEXT;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS workspace_name TEXT;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS archive_path TEXT;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS reason TEXT;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS summary_json TEXT;
+ALTER TABLE audit_export_runs ADD COLUMN IF NOT EXISTS claimed_at BIGINT;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'audit_export_runs_dry_run_check') THEN
+    ALTER TABLE audit_export_runs
+      ADD CONSTRAINT audit_export_runs_dry_run_check CHECK (dry_run IN (0, 1));
+  END IF;
+END
+$$;
+-- The platform loop finds requested runs across workspaces before it knows
+-- whose they are, so it reads the routing columns alone on the background
+-- role; every run it picks is read again under the workspace the routing row
+-- named before a single byte is written.
+CREATE INDEX IF NOT EXISTS audit_export_runs_pending_idx
+  ON audit_export_runs (status, started_at, tenant_id, id);
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY audit_export_runs_background_policy ON audit_export_runs
+  FOR SELECT TO coreloom_background
+  USING (true);
+REVOKE SELECT ON audit_export_runs FROM coreloom_background;
+GRANT SELECT (tenant_id, id, status, started_at) ON audit_export_runs TO coreloom_background;

package/modules/audit/migrations/0004_audit_hold_seal_erasure.down.sql

@@ -0,0 +1,17 @@
+REVOKE SELECT (tenant_id, id, status, started_at) ON audit_erasure_runs FROM coreloom_background;
+DROP POLICY IF EXISTS audit_erasure_runs_background_policy ON audit_erasure_runs;
+REVOKE SELECT (tenant_id, id, key_id) ON audit_anchors FROM coreloom_background;
+DROP POLICY IF EXISTS audit_anchors_background_policy ON audit_anchors;
+ALTER TABLE audit_sweep_runs DROP CONSTRAINT IF EXISTS audit_sweep_runs_held_back_check;
+ALTER TABLE audit_events DROP CONSTRAINT IF EXISTS audit_events_sealed_check;
+ALTER TABLE audit_events DROP CONSTRAINT IF EXISTS audit_events_subject_type_check;
+ALTER TABLE audit_events
+  ADD CONSTRAINT audit_events_subject_type_check
+  CHECK (subject_type IN ('data-class', 'sweep-run', 'export-run'));
+ALTER TABLE audit_sweep_runs DROP COLUMN IF EXISTS held_back;
+ALTER TABLE audit_events DROP COLUMN IF EXISTS sealed_payload;
+ALTER TABLE audit_events DROP COLUMN IF EXISTS subject_key_id;
+DROP TABLE IF EXISTS audit_erasure_runs;
+DROP TABLE IF EXISTS audit_subject_keys;
+DROP TABLE IF EXISTS audit_legal_holds;
+DROP TABLE IF EXISTS audit_anchors;

package/modules/audit/migrations/0004_audit_hold_seal_erasure.up.sql

@@ -0,0 +1,192 @@
+-- Sealing, legal hold and erasure on request. Three tables and four columns.
+--
+-- audit_anchors closes segments of the per-workspace event chain. An anchor
+-- seals the sequence range, the row count, the time range, the hash chain over
+-- the segment continuing from the anchor before it, and the hash of that anchor
+-- itself; the signature is HMAC-SHA256 over the anchor hash, so re-signing
+-- under a rotated key changes the signature and the key id alone and every
+-- segment file already written still verifies.
+CREATE TABLE IF NOT EXISTS audit_anchors (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  anchor_sequence BIGINT NOT NULL CHECK (anchor_sequence > 0),
+  from_sequence BIGINT NOT NULL CHECK (from_sequence > 0),
+  to_sequence BIGINT NOT NULL,
+  row_count BIGINT NOT NULL CHECK (row_count > 0),
+  first_occurred_at BIGINT NOT NULL,
+  last_occurred_at BIGINT NOT NULL,
+  segment_hash TEXT NOT NULL,
+  previous_anchor_hash TEXT,
+  anchor_hash TEXT NOT NULL,
+  signature TEXT NOT NULL,
+  key_id TEXT NOT NULL,
+  segment_file TEXT NOT NULL,
+  sealed_by TEXT NOT NULL,
+  sealed_at BIGINT NOT NULL,
+  CHECK (to_sequence >= from_sequence),
+  UNIQUE (tenant_id, anchor_sequence),
+  UNIQUE (tenant_id, to_sequence),
+  UNIQUE (tenant_id, anchor_hash)
+);
+-- The newest anchor of a workspace is read before every seal and before every
+-- sweep of the event class, so it is the one lookup that has to stay O(1).
+CREATE INDEX IF NOT EXISTS audit_anchors_tenant_sequence_idx
+  ON audit_anchors (tenant_id, anchor_sequence DESC);
+ALTER TABLE audit_anchors ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_anchors FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_anchors_tenant_policy ON audit_anchors
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- A hold is a standing instruction not to remove what it covers. scope_kind
+-- names the dimension it was placed on and the nullable columns narrow it
+-- further, so an account hold limited to one class and one date range is one
+-- row rather than three. A lifted hold is kept: who lifted it and why is the
+-- evidence that the data became removable again.
+CREATE TABLE IF NOT EXISTS audit_legal_holds (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  scope_kind TEXT NOT NULL CHECK (scope_kind IN ('account', 'workspace', 'data-class', 'date-range')),
+  account_id TEXT,
+  class_id TEXT,
+  from_at BIGINT,
+  to_at BIGINT,
+  reason TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('active', 'lifted')),
+  placed_by TEXT NOT NULL,
+  placed_at BIGINT NOT NULL,
+  lifted_by TEXT,
+  lift_reason TEXT,
+  lifted_at BIGINT,
+  CHECK (scope_kind <> 'account' OR account_id IS NOT NULL),
+  CHECK (scope_kind <> 'data-class' OR class_id IS NOT NULL),
+  CHECK (scope_kind <> 'date-range' OR (from_at IS NOT NULL AND to_at IS NOT NULL)),
+  CHECK (scope_kind <> 'workspace' OR (account_id IS NULL AND class_id IS NULL
+         AND from_at IS NULL AND to_at IS NULL)),
+  CHECK (from_at IS NULL OR to_at IS NULL OR to_at >= from_at),
+  CHECK ((status = 'lifted') = (lifted_at IS NOT NULL))
+);
+-- The sweep and every erasure ask for the active holds of one workspace before
+-- they touch a row, so that read walks an index instead of the table.
+CREATE INDEX IF NOT EXISTS audit_legal_holds_tenant_status_idx
+  ON audit_legal_holds (tenant_id, status, placed_at DESC, id);
+ALTER TABLE audit_legal_holds ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_legal_holds FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_legal_holds_tenant_policy ON audit_legal_holds
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- One data key per subject. Audit events are excluded from erasure because they
+-- are the evidence the lifecycle happened, so the subject-identifying fields of
+-- a new event are sealed under this key instead: destroying the key blanks the
+-- material and the account it belonged to, and what is left is a tombstone that
+-- proves an event existed and can never be read again. The row stays so the
+-- events that point at it keep a target, and the chain hash covers the sealed
+-- bytes rather than the plaintext, so destruction never breaks verification.
+CREATE TABLE IF NOT EXISTS audit_subject_keys (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  subject TEXT,
+  material TEXT,
+  sealed_at BIGINT NOT NULL,
+  destroyed_at BIGINT,
+  CHECK ((subject IS NULL) = (material IS NULL)),
+  CHECK ((destroyed_at IS NULL) = (material IS NOT NULL))
+);
+-- Partial, because every destroyed key carries a null subject and two of them
+-- would collide under a total unique index.
+CREATE UNIQUE INDEX IF NOT EXISTS audit_subject_keys_tenant_subject_idx
+  ON audit_subject_keys (tenant_id, subject)
+  WHERE subject IS NOT NULL;
+ALTER TABLE audit_subject_keys ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_subject_keys FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_subject_keys_tenant_policy ON audit_subject_keys
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- An erasure is a request the running platform answers, for the same reason an
+-- export is: only the platform process holds the registrations every owning
+-- module made, so only it can reach an erase operation. The operator command
+-- records the row and waits. The subject is kept while the run needs it and
+-- blanked when it finishes, so the history proves an erasure happened without
+-- naming the person it erased; subject_marker is the same hash the certificate
+-- file is named after, which is what ties the two together.
+CREATE TABLE IF NOT EXISTS audit_erasure_runs (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  subject TEXT,
+  subject_marker TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('requested', 'completed', 'failed')),
+  dry_run SMALLINT NOT NULL CHECK (dry_run IN (0, 1)),
+  destroy_key SMALLINT NOT NULL CHECK (destroy_key IN (0, 1)),
+  requested_by TEXT NOT NULL,
+  output_directory TEXT,
+  workspace_slug TEXT,
+  workspace_name TEXT,
+  classes BIGINT NOT NULL CHECK (classes >= 0),
+  row_count BIGINT NOT NULL CHECK (row_count >= 0),
+  certificate_path TEXT,
+  outcome_json TEXT,
+  reason TEXT,
+  claimed_at BIGINT,
+  started_at BIGINT NOT NULL,
+  completed_at BIGINT
+);
+CREATE INDEX IF NOT EXISTS audit_erasure_runs_tenant_time_idx
+  ON audit_erasure_runs (tenant_id, started_at DESC, id);
+CREATE INDEX IF NOT EXISTS audit_erasure_runs_pending_idx
+  ON audit_erasure_runs (status, started_at, tenant_id, id);
+ALTER TABLE audit_erasure_runs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_erasure_runs FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_erasure_runs_tenant_policy ON audit_erasure_runs
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- A sealed event keeps its actor and subject columns at a fixed marker and
+-- carries the envelope beside them. The event hash reads the envelope in the
+-- place the metadata used to sit, so the hash of a sealed row is a function of
+-- the stored bytes alone and stays verifiable after the key is destroyed.
+ALTER TABLE audit_events ADD COLUMN IF NOT EXISTS subject_key_id TEXT;
+ALTER TABLE audit_events ADD COLUMN IF NOT EXISTS sealed_payload TEXT;
+ALTER TABLE audit_sweep_runs ADD COLUMN IF NOT EXISTS held_back BIGINT;
+ALTER TABLE audit_events DROP CONSTRAINT IF EXISTS audit_events_subject_type_check;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'audit_events_subject_type_check') THEN
+    ALTER TABLE audit_events
+      ADD CONSTRAINT audit_events_subject_type_check
+      CHECK (subject_type IN ('data-class', 'sweep-run', 'export-run', 'legal-hold', 'erasure', 'chain-anchor'));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'audit_events_sealed_check') THEN
+    ALTER TABLE audit_events
+      ADD CONSTRAINT audit_events_sealed_check
+      CHECK ((subject_key_id IS NULL) = (sealed_payload IS NULL));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'audit_sweep_runs_held_back_check') THEN
+    ALTER TABLE audit_sweep_runs
+      ADD CONSTRAINT audit_sweep_runs_held_back_check
+      CHECK (held_back IS NULL OR held_back >= 0);
+  END IF;
+END
+$$;
+-- The anchor rotation counts anchors per key across every workspace before it
+-- knows whose they are, so it reads the routing columns alone on the background
+-- role; every anchor it names is read and re-signed under the workspace the
+-- routing row named. The hashes stay invisible to it.
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coreloom_background') THEN
+    RAISE EXCEPTION 'The coreloom_background role must exist before this migration.';
+  END IF;
+END
+$$;
+CREATE POLICY audit_anchors_background_policy ON audit_anchors
+  FOR SELECT TO coreloom_background
+  USING (true);
+REVOKE SELECT ON audit_anchors FROM coreloom_background;
+GRANT SELECT (tenant_id, id, key_id) ON audit_anchors TO coreloom_background;
+CREATE POLICY audit_erasure_runs_background_policy ON audit_erasure_runs
+  FOR SELECT TO coreloom_background
+  USING (true);
+REVOKE SELECT ON audit_erasure_runs FROM coreloom_background;
+GRANT SELECT (tenant_id, id, status, started_at) ON audit_erasure_runs TO coreloom_background;

package/modules/audit/migrations/0005_audit_event_format.down.sql

@@ -0,0 +1,17 @@
+CREATE INDEX IF NOT EXISTS audit_data_classes_due_idx
+  ON audit_data_classes (sweepable, last_swept_at, tenant_id, class_id);
+DROP INDEX IF EXISTS audit_data_classes_due_nulls_first_idx;
+DROP INDEX IF EXISTS audit_anchors_key_id_idx;
+DROP INDEX IF EXISTS audit_export_runs_tenant_id_idx;
+DROP INDEX IF EXISTS audit_sweep_runs_tenant_id_idx;
+DROP INDEX IF EXISTS audit_events_tenant_id_idx;
+ALTER TABLE audit_subject_keys DROP CONSTRAINT IF EXISTS audit_subject_keys_marker_check;
+ALTER TABLE audit_erasure_runs DROP CONSTRAINT IF EXISTS audit_erasure_runs_status_check;
+-- A run recorded partial has no place in the constraint this restores, so the
+-- reverse fails while one exists rather than rewriting the ledger.
+ALTER TABLE audit_erasure_runs
+  ADD CONSTRAINT audit_erasure_runs_status_check
+  CHECK (status IN ('requested', 'completed', 'failed'));
+DROP INDEX IF EXISTS audit_subject_keys_tenant_marker_idx;
+ALTER TABLE audit_subject_keys DROP COLUMN IF EXISTS subject_marker;
+ALTER TABLE audit_events DROP COLUMN IF EXISTS seal_format;

package/modules/audit/migrations/0005_audit_event_format.up.sql

@@ -0,0 +1,60 @@
+-- The event format marker, the subject marker, a partial erasure run and the
+-- indexes the ledger walks need.
+--
+-- seal_format names the writer of a row. A row without it was written before
+-- audit.core recorded a format at all, which is exactly the set verify reports
+-- as plaintext; a row that carries the marker and no sealed payload is an event
+-- about nobody, not an unsealed person. Deriving that from sealed_payload alone
+-- reported every platform event as pre-0.2.0.
+ALTER TABLE audit_events ADD COLUMN IF NOT EXISTS seal_format TEXT;
+
+-- The name a subject keeps once its key is gone. Destruction removes the
+-- account the key belonged to, so without this column a destroyed key cannot be
+-- found again and the next event naming that subject would create a new key and
+-- put the account back in the clear. Active rows are named from the same hash
+-- the certificate file already uses.
+ALTER TABLE audit_subject_keys ADD COLUMN IF NOT EXISTS subject_marker TEXT;
+UPDATE audit_subject_keys
+  SET subject_marker = substr(encode(sha256((tenant_id || ':' || subject)::bytea), 'hex'), 1, 12)
+  WHERE subject IS NOT NULL AND subject_marker IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS audit_subject_keys_tenant_marker_idx
+  ON audit_subject_keys (tenant_id, subject_marker)
+  WHERE subject_marker IS NOT NULL;
+
+-- A run whose class was truncated or whose owner failed erased some of the
+-- subject and not all of it. Recording that as completed would tell an operator
+-- the subject is gone when a class still holds rows.
+ALTER TABLE audit_erasure_runs DROP CONSTRAINT IF EXISTS audit_erasure_runs_status_check;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'audit_erasure_runs_status_check') THEN
+    ALTER TABLE audit_erasure_runs
+      ADD CONSTRAINT audit_erasure_runs_status_check
+      CHECK (status IN ('requested', 'completed', 'partial', 'failed'));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'audit_subject_keys_marker_check') THEN
+    ALTER TABLE audit_subject_keys
+      ADD CONSTRAINT audit_subject_keys_marker_check
+      CHECK (subject_marker IS NULL OR length(subject_marker) <= 32);
+  END IF;
+END
+$$;
+
+-- The keyset walks the export takes over the three ledgers order by the primary
+-- key inside one workspace, and the anchor rotation counts and pages anchors by
+-- key. Without these each walk was a scan of every row of the table.
+CREATE INDEX IF NOT EXISTS audit_events_tenant_id_idx
+  ON audit_events (tenant_id, id);
+CREATE INDEX IF NOT EXISTS audit_sweep_runs_tenant_id_idx
+  ON audit_sweep_runs (tenant_id, id);
+CREATE INDEX IF NOT EXISTS audit_export_runs_tenant_id_idx
+  ON audit_export_runs (tenant_id, id);
+CREATE INDEX IF NOT EXISTS audit_anchors_key_id_idx
+  ON audit_anchors (key_id, id);
+
+-- The routing read starts at the classes waiting longest, so it orders by
+-- last_swept_at NULLS FIRST. The index migration 0001 created sorts nulls last,
+-- which is the opposite end, so the walk sorted every due class on every pass.
+CREATE INDEX IF NOT EXISTS audit_data_classes_due_nulls_first_idx
+  ON audit_data_classes (sweepable, last_swept_at NULLS FIRST, tenant_id, class_id);
+DROP INDEX IF EXISTS audit_data_classes_due_idx;

package/modules/audit/migrations/0006_audit_own_class_walks.down.sql

@@ -0,0 +1,3 @@
+DROP INDEX IF EXISTS audit_legal_holds_tenant_account_idx;
+DROP INDEX IF EXISTS audit_erasure_runs_tenant_id_idx;
+DROP INDEX IF EXISTS audit_legal_holds_tenant_id_idx;

package/modules/audit/migrations/0006_audit_own_class_walks.up.sql

@@ -0,0 +1,14 @@
+-- audit.core declares the rest of its own tenant tables as data classes, so the
+-- legal holds and the erasure history are exported through the same keyset walk
+-- as the chain and the two ledgers, and an erasure plan counts the holds that
+-- name the subject. Each of those reads orders inside one workspace by the
+-- primary key or filters by the account a hold covers; without these indexes
+-- every page would be a pass over the workspace's rows.
+CREATE INDEX IF NOT EXISTS audit_legal_holds_tenant_id_idx
+  ON audit_legal_holds (tenant_id, id);
+CREATE INDEX IF NOT EXISTS audit_erasure_runs_tenant_id_idx
+  ON audit_erasure_runs (tenant_id, id);
+-- Partial, because a hold that names no account is never counted for a subject.
+CREATE INDEX IF NOT EXISTS audit_legal_holds_tenant_account_idx
+  ON audit_legal_holds (tenant_id, account_id)
+  WHERE account_id IS NOT NULL;

package/modules/audit/migrations/README.md

@@ -0,0 +1,3 @@
+# Migrations
+
+Migrations in this directory are append-only after release.

package/modules/audit/module.json

@@ -0,0 +1,32 @@
+{
+	"$schema": "../../packages/contracts/schemas/module.schema.json",
+	"schemaVersion": 1,
+	"id": "audit.core",
+	"package": "@flowdular/module-audit",
+	"version": "0.2.8",
+	"platformApi": "^0.1.0",
+	"profile": "full",
+	"capabilities": ["api", "database", "client", "translations", "cli"],
+	"platform": {
+		"server": true,
+		"client": true
+	},
+	"dependencies": [
+		{
+			"id": "system.core",
+			"range": "^0.7.0"
+		},
+		{
+			"id": "auth.core",
+			"range": "^0.13.0"
+		}
+	],
+	"provides": ["audit.erasure.v1"],
+	"tenancy": "required",
+	"locales": ["en", "pl"],
+	"stability": "experimental",
+	"cli": {
+		"catalog": "src/cli/commands.json",
+		"entry": "src/cli/index.ts"
+	}
+}

package/modules/audit/package.json

@@ -0,0 +1,49 @@
+{
+	"name": "@flowdular/module-audit",
+	"version": "0.2.8",
+	"private": true,
+	"type": "module",
+	"exports": {
+		".": "./src/index.ts",
+		"./client": "./src/client/index.ts",
+		"./server": "./src/server/index.ts",
+		"./platform": "./src/platform.ts",
+		"./module.json": "./module.json"
+	},
+	"files": [
+		"src",
+		"schemas",
+		"dist",
+		"bin",
+		"public",
+		"module.json",
+		"migrations",
+		"translations",
+		"spec",
+		"README.md",
+		"LICENSE"
+	],
+	"scripts": {
+		"typecheck": "tsrx-tsc --noEmit -p tsconfig.json",
+		"test": "vitest run"
+	},
+	"dependencies": {
+		"@flowdular/cli-protocol": "workspace:*",
+		"@flowdular/client": "workspace:*",
+		"@flowdular/contracts": "workspace:*",
+		"@flowdular/database": "workspace:*",
+		"@flowdular/kernel": "workspace:*",
+		"@flowdular/module-auth": "workspace:*",
+		"@flowdular/server": "workspace:*",
+		"@flowdular/ui": "workspace:*",
+		"octane": "0.1.51",
+		"segment-state": "0.2.1"
+	},
+	"devDependencies": {
+		"@flowdular/database-testing": "workspace:*",
+		"@tsrx/typescript-plugin": "0.3.120",
+		"@types/node": "24.13.3",
+		"typescript": "5.9.3",
+		"vitest": "4.1.11"
+	}
+}