@hacimertgokhan/next-audit 1.0.0

package/dist/config.d.ts

@@ -0,0 +1,2 @@
+import { AuditConfig } from './types';
+export declare function loadConfig(): AuditConfig;

package/dist/config.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+let cachedConfig = null;
+function loadConfig() {
+    if (cachedConfig)
+        return cachedConfig;
+    // Potential paths for audit.conf.ts or audit.conf.js
+    const configPathTs = path_1.default.resolve(process.cwd(), 'audit.conf.ts');
+    const configPathJs = path_1.default.resolve(process.cwd(), 'audit.conf.js');
+    try {
+        // Note: In a real compiled node_modules scenario, requiring a .ts file from cwd at runtime
+        // requires ts-node or similar. We will assume the user has a setup that handles this,
+        // or they compile it to .js. For this MVP, we try to require it.
+        // If it fails, we look for defaults or env vars.
+        if (fs_1.default.existsSync(configPathJs)) {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const userConfig = require(configPathJs);
+            cachedConfig = userConfig.default || userConfig;
+        }
+        else if (fs_1.default.existsSync(configPathTs)) {
+            // Only works if running via ts-node or if we invoke a transpiler on fly
+            // For now, we warn or rely on an environment that supports it.
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                require('ts-node/register'); // Try to register if possible? Risky for a lib.
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                const userConfig = require(configPathTs);
+                cachedConfig = userConfig.default || userConfig;
+            }
+            catch (e) {
+                console.warn('[Next-Audit] Found audit.conf.ts but could not load it directly (ts-node missing?). Please ensure it is compiled to js or use audit.conf.js');
+            }
+        }
+    }
+    catch (error) {
+        console.error('[Next-Audit] Error loading config:', error);
+    }
+    if (!cachedConfig) {
+        // Fallback: minimal valid config or throw
+        // For MVP we assume environment variables might also be used
+        cachedConfig = {
+            database: {
+                url: process.env.DATABASE_URL
+                // default to local if nothing found?
+            },
+            debug: true
+        };
+        if (!process.env.DATABASE_URL) {
+            console.warn('[Next-Audit] No config file found and DATABASE_URL not set. Audit might fail.');
+        }
+    }
+    return cachedConfig;
+}

package/dist/decorators/audit.d.ts

@@ -0,0 +1,4 @@
+import 'reflect-metadata';
+export declare function Audit(options?: {
+    actionType?: string;
+}): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;

package/dist/decorators/audit.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Audit = Audit;
+require("reflect-metadata");
+const config_1 = require("../config");
+const mysql_1 = require("../lib/mysql");
+function Audit(options) {
+    return function (target, propertyKey, descriptor) {
+        const originalMethod = descriptor.value;
+        descriptor.value = async function (...args) {
+            const startTime = Date.now();
+            let req;
+            let context;
+            // Try to find NextRequest in arguments
+            for (const arg of args) {
+                if (arg instanceof Request || (arg && arg.constructor && arg.constructor.name === 'NextRequest')) {
+                    req = arg;
+                    break;
+                }
+            }
+            // Capture inputs
+            const url = req?.url || '';
+            const method = req?.method || 'UNKNOWN';
+            const userAgent = req?.headers.get('user-agent') || '';
+            // TODO: Extract user ID from session/token if available in headers or args
+            let oldData = null; // For delete operations, we hope to capture this
+            let newData = null;
+            // Execute original method
+            let result;
+            let status = 200;
+            let errorOccurred = false;
+            try {
+                result = await originalMethod.apply(this, args);
+                // Analyze Result
+                if (result instanceof Response) {
+                    status = result.status;
+                    // Clone to read body without consuming the original stream if possible, 
+                    // or assume we can't read it if it's a stream already locked.
+                    // For JSON responses, we might want to peek.
+                    try {
+                        const clone = result.clone();
+                        const bodyText = await clone.text();
+                        if (bodyText) {
+                            try {
+                                const json = JSON.parse(bodyText);
+                                // If DELETE, assume result is the deleted data or confirmation
+                                if (method === 'DELETE') {
+                                    oldData = json;
+                                }
+                                else if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+                                    newData = json;
+                                }
+                            }
+                            catch (e) {
+                                // Not JSON
+                            }
+                        }
+                    }
+                    catch (e) {
+                        // Failed to read response body
+                    }
+                }
+                else {
+                    // If the function returns a plain object (not a Response), treat it as data
+                    if (method === 'DELETE') {
+                        oldData = result;
+                    }
+                    else {
+                        newData = result;
+                    }
+                }
+            }
+            catch (error) {
+                errorOccurred = true;
+                status = 500;
+                // Try to get status from error if available
+                if (error.status)
+                    status = error.status;
+                if (error.statusCode)
+                    status = error.statusCode;
+                throw error;
+            }
+            finally {
+                const duration = Date.now() - startTime;
+                const config = (0, config_1.loadConfig)();
+                if (config) {
+                    const entry = {
+                        timestamp: new Date(),
+                        method,
+                        url,
+                        action_type: options?.actionType || method,
+                        status,
+                        duration_ms: duration,
+                        user_agent: userAgent,
+                        old_value: oldData,
+                        new_value: newData,
+                        // user_id, entity, entity_id need more specific logic or config to extract
+                    };
+                    // Fire and forget audit log to not block response? 
+                    // Or await it? User might want reliability.
+                    // We'll await it for now to ensure it's logged, 
+                    // but catching errors so we don't break the app if logging fails.
+                    (0, mysql_1.saveAuditLog)(entry, config).catch(e => console.error('Audit Log Error', e));
+                }
+            }
+            return result;
+        };
+        return descriptor;
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './decorators/audit';
+export * from './types';
+export * from './config';

package/dist/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./decorators/audit"), exports);
+__exportStar(require("./types"), exports);
+__exportStar(require("./config"), exports);
+// We might not export lib/mysql directly unless user needs custom access

package/dist/lib/mysql.d.ts

@@ -0,0 +1,4 @@
+import { Pool } from 'mysql2/promise';
+import { AuditConfig, AuditLogEntry } from '../types';
+export declare function getDbConnection(config: AuditConfig): Promise<Pool>;
+export declare function saveAuditLog(entry: AuditLogEntry, config: AuditConfig): Promise<void>;

package/dist/lib/mysql.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDbConnection = getDbConnection;
+exports.saveAuditLog = saveAuditLog;
+const promise_1 = require("mysql2/promise");
+let pool = null;
+async function getDbConnection(config) {
+    if (pool)
+        return pool;
+    const dbConfig = config.database;
+    if (dbConfig.url) {
+        pool = (0, promise_1.createPool)(dbConfig.url);
+    }
+    else {
+        pool = (0, promise_1.createPool)({
+            host: dbConfig.host,
+            user: dbConfig.user,
+            password: dbConfig.password,
+            database: dbConfig.database,
+            port: dbConfig.port,
+            waitForConnections: true,
+            connectionLimit: 10,
+            queueLimit: 0,
+        });
+    }
+    return pool;
+}
+async function saveAuditLog(entry, config) {
+    try {
+        if (config.testMode) {
+            if (config.debug) {
+                console.log(`[Next-Audit] (Test Mode) Log would be saved: ${entry.method} ${entry.url}`);
+            }
+            return;
+        }
+        const db = await getDbConnection(config);
+        const tableName = config.tableName || 'audit_logs';
+        // Simple table check/creation (naive implementation for MVP)
+        // In production, migrations are preferred.
+        await db.query(`
+      CREATE TABLE IF NOT EXISTS \`${tableName}\` (
+        id INT AUTO_INCREMENT PRIMARY KEY,
+        timestamp DATETIME,
+        method VARCHAR(10),
+        url VARCHAR(255),
+        user_id VARCHAR(50),
+        entity VARCHAR(50),
+        entity_id VARCHAR(50),
+        old_value JSON,
+        new_value JSON,
+        action_type VARCHAR(50),
+        status INT,
+        duration_ms INT,
+        ip VARCHAR(45),
+        user_agent VARCHAR(255)
+      )
+    `);
+        await db.query(`INSERT INTO \`${tableName}\` 
+      (timestamp, method, url, user_id, entity, entity_id, old_value, new_value, action_type, status, duration_ms, ip, user_agent) 
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+            entry.timestamp,
+            entry.method,
+            entry.url,
+            entry.user_id,
+            entry.entity,
+            entry.entity_id,
+            JSON.stringify(entry.old_value),
+            JSON.stringify(entry.new_value),
+            entry.action_type,
+            entry.status,
+            entry.duration_ms,
+            entry.ip,
+            entry.user_agent
+        ]);
+        if (config.debug) {
+            console.log(`[Next-Audit] Log saved: ${entry.method} ${entry.url}`);
+        }
+    }
+    catch (error) {
+        console.error('[Next-Audit] Failed to save audit log:', error);
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,38 @@
+export interface AuditConfig {
+    database: {
+        url?: string;
+        host?: string;
+        port?: number;
+        user?: string;
+        password?: string;
+        database?: string;
+    };
+    /**
+     * Table name to store audit logs. Default: 'audit_logs'
+     */
+    tableName?: string;
+    /**
+     * Enable console logging for debugging
+     */
+    debug?: boolean;
+    /**
+     * If true, database writes are skipped (for testing)
+     */
+    testMode?: boolean;
+}
+export type AuditLogEntry = {
+    id?: number;
+    timestamp: Date;
+    method: string;
+    url: string;
+    user_id?: string | number | null;
+    entity?: string;
+    entity_id?: string | number | null;
+    old_value?: any;
+    new_value?: any;
+    action_type: string;
+    status: number;
+    duration_ms: number;
+    ip?: string;
+    user_agent?: string;
+};

package/dist/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@hacimertgokhan/next-audit",
+  "version": "1.0.0",
+  "description": "Next.js backend audit system with @Audit decorator",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "verify": "npm run build && npx tsc test/verify_dist.ts --experimentalDecorators --emitDecoratorMetadata --esModuleInterop --target ES2020 --module commonjs && node test/verify_dist.js",
+    "prepublishOnly": "npm run build",
+    "test": "npm run verify"
+  },
+  "keywords": [
+    "nextjs",
+    "audit",
+    "decorator",
+    "mysql"
+  ],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "mysql2": "^3.11.0",
+    "reflect-metadata": "^0.2.2"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "next": "^16.1.3",
+    "typescript": "^5.5.0"
+  }
+}

package/src/config.ts

@@ -0,0 +1,57 @@
+import path from 'path';
+import fs from 'fs';
+import { AuditConfig } from './types';
+
+let cachedConfig: AuditConfig | null = null;
+
+export function loadConfig(): AuditConfig {
+    if (cachedConfig) return cachedConfig;
+
+    // Potential paths for audit.conf.ts or audit.conf.js
+    const configPathTs = path.resolve(process.cwd(), 'audit.conf.ts');
+    const configPathJs = path.resolve(process.cwd(), 'audit.conf.js');
+
+    try {
+        // Note: In a real compiled node_modules scenario, requiring a .ts file from cwd at runtime
+        // requires ts-node or similar. We will assume the user has a setup that handles this,
+        // or they compile it to .js. For this MVP, we try to require it.
+        // If it fails, we look for defaults or env vars.
+
+        if (fs.existsSync(configPathJs)) {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const userConfig = require(configPathJs);
+            cachedConfig = userConfig.default || userConfig;
+        } else if (fs.existsSync(configPathTs)) {
+            // Only works if running via ts-node or if we invoke a transpiler on fly
+            // For now, we warn or rely on an environment that supports it.
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                require('ts-node/register'); // Try to register if possible? Risky for a lib.
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                const userConfig = require(configPathTs);
+                cachedConfig = userConfig.default || userConfig;
+            } catch (e) {
+                console.warn('[Next-Audit] Found audit.conf.ts but could not load it directly (ts-node missing?). Please ensure it is compiled to js or use audit.conf.js');
+            }
+        }
+    } catch (error) {
+        console.error('[Next-Audit] Error loading config:', error);
+    }
+
+    if (!cachedConfig) {
+        // Fallback: minimal valid config or throw
+        // For MVP we assume environment variables might also be used
+        cachedConfig = {
+            database: {
+                url: process.env.DATABASE_URL
+                // default to local if nothing found?
+            },
+            debug: true
+        };
+        if (!process.env.DATABASE_URL) {
+            console.warn('[Next-Audit] No config file found and DATABASE_URL not set. Audit might fail.');
+        }
+    }
+
+    return cachedConfig!;
+}

package/src/decorators/audit.ts

@@ -0,0 +1,117 @@
+import 'reflect-metadata';
+import { NextRequest, NextResponse } from 'next/server';
+import { loadConfig } from '../config';
+import { saveAuditLog } from '../lib/mysql';
+import { AuditLogEntry } from '../types';
+
+export function Audit(options?: { actionType?: string }) {
+    return function (
+        target: any,
+        propertyKey: string,
+        descriptor: PropertyDescriptor
+    ) {
+        const originalMethod = descriptor.value;
+
+        descriptor.value = async function (...args: any[]) {
+            const startTime = Date.now();
+            let req: NextRequest | undefined;
+            let context: any;
+
+            // Try to find NextRequest in arguments
+            for (const arg of args) {
+                if (arg instanceof Request || (arg && arg.constructor && arg.constructor.name === 'NextRequest')) {
+                    req = arg as NextRequest;
+                    break;
+                }
+            }
+
+            // Capture inputs
+            const url = req?.url || '';
+            const method = req?.method || 'UNKNOWN';
+            const userAgent = req?.headers.get('user-agent') || '';
+            // TODO: Extract user ID from session/token if available in headers or args
+
+            let oldData = null; // For delete operations, we hope to capture this
+            let newData = null;
+
+            // Execute original method
+            let result;
+            let status = 200;
+            let errorOccurred = false;
+
+            try {
+                result = await originalMethod.apply(this, args);
+
+                // Analyze Result
+                if (result instanceof Response) {
+                    status = result.status;
+                    // Clone to read body without consuming the original stream if possible, 
+                    // or assume we can't read it if it's a stream already locked.
+                    // For JSON responses, we might want to peek.
+                    try {
+                        const clone = result.clone();
+                        const bodyText = await clone.text();
+                        if (bodyText) {
+                            try {
+                                const json = JSON.parse(bodyText);
+                                // If DELETE, assume result is the deleted data or confirmation
+                                if (method === 'DELETE') {
+                                    oldData = json;
+                                } else if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+                                    newData = json;
+                                }
+                            } catch (e) {
+                                // Not JSON
+                            }
+                        }
+                    } catch (e) {
+                        // Failed to read response body
+                    }
+                } else {
+                    // If the function returns a plain object (not a Response), treat it as data
+                    if (method === 'DELETE') {
+                        oldData = result;
+                    } else {
+                        newData = result;
+                    }
+                }
+
+            } catch (error: any) {
+                errorOccurred = true;
+                status = 500;
+                // Try to get status from error if available
+                if (error.status) status = error.status;
+                if (error.statusCode) status = error.statusCode;
+                throw error;
+            } finally {
+                const duration = Date.now() - startTime;
+                const config = loadConfig();
+
+                if (config) {
+                    const entry: AuditLogEntry = {
+                        timestamp: new Date(),
+                        method,
+                        url,
+                        action_type: options?.actionType || method,
+                        status,
+                        duration_ms: duration,
+                        user_agent: userAgent,
+                        old_value: oldData,
+                        new_value: newData,
+                        // user_id, entity, entity_id need more specific logic or config to extract
+                    };
+
+                    // Fire and forget audit log to not block response? 
+                    // Or await it? User might want reliability.
+                    // We'll await it for now to ensure it's logged, 
+                    // but catching errors so we don't break the app if logging fails.
+                    saveAuditLog(entry, config).catch(e => console.error('Audit Log Error', e));
+                }
+            }
+
+            return result;
+        };
+
+        return descriptor;
+    };
+}

package/src/index.ts

@@ -0,0 +1,4 @@
+export * from './decorators/audit';
+export * from './types';
+export * from './config';
+// We might not export lib/mysql directly unless user needs custom access

package/src/lib/mysql.ts

@@ -0,0 +1,88 @@
+import { createPool, Pool } from 'mysql2/promise';
+import { AuditConfig, AuditLogEntry } from '../types';
+
+let pool: Pool | null = null;
+
+export async function getDbConnection(config: AuditConfig) {
+    if (pool) return pool;
+
+    const dbConfig = config.database;
+    if (dbConfig.url) {
+        pool = createPool(dbConfig.url);
+    } else {
+        pool = createPool({
+            host: dbConfig.host,
+            user: dbConfig.user,
+            password: dbConfig.password,
+            database: dbConfig.database,
+            port: dbConfig.port,
+            waitForConnections: true,
+            connectionLimit: 10,
+            queueLimit: 0,
+        });
+    }
+    return pool;
+}
+
+export async function saveAuditLog(entry: AuditLogEntry, config: AuditConfig) {
+    try {
+        if (config.testMode) {
+            if (config.debug) {
+                console.log(`[Next-Audit] (Test Mode) Log would be saved: ${entry.method} ${entry.url}`);
+            }
+            return;
+        }
+
+        const db = await getDbConnection(config);
+        const tableName = config.tableName || 'audit_logs';
+
+        // Simple table check/creation (naive implementation for MVP)
+        // In production, migrations are preferred.
+        await db.query(`
+      CREATE TABLE IF NOT EXISTS \`${tableName}\` (
+        id INT AUTO_INCREMENT PRIMARY KEY,
+        timestamp DATETIME,
+        method VARCHAR(10),
+        url VARCHAR(255),
+        user_id VARCHAR(50),
+        entity VARCHAR(50),
+        entity_id VARCHAR(50),
+        old_value JSON,
+        new_value JSON,
+        action_type VARCHAR(50),
+        status INT,
+        duration_ms INT,
+        ip VARCHAR(45),
+        user_agent VARCHAR(255)
+      )
+    `);
+
+        await db.query(
+            `INSERT INTO \`${tableName}\` 
+      (timestamp, method, url, user_id, entity, entity_id, old_value, new_value, action_type, status, duration_ms, ip, user_agent) 
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+            [
+                entry.timestamp,
+                entry.method,
+                entry.url,
+                entry.user_id,
+                entry.entity,
+                entry.entity_id,
+                JSON.stringify(entry.old_value),
+                JSON.stringify(entry.new_value),
+                entry.action_type,
+                entry.status,
+                entry.duration_ms,
+                entry.ip,
+                entry.user_agent
+            ]
+        );
+
+        if (config.debug) {
+            console.log(`[Next-Audit] Log saved: ${entry.method} ${entry.url}`);
+        }
+
+    } catch (error) {
+        console.error('[Next-Audit] Failed to save audit log:', error);
+    }
+}

package/src/types.ts

@@ -0,0 +1,39 @@
+export interface AuditConfig {
+    database: {
+        url?: string;
+        host?: string;
+        port?: number;
+        user?: string;
+        password?: string;
+        database?: string;
+    };
+    /**
+     * Table name to store audit logs. Default: 'audit_logs'
+     */
+    tableName?: string;
+    /**
+     * Enable console logging for debugging
+     */
+    debug?: boolean;
+    /**
+     * If true, database writes are skipped (for testing)
+     */
+    testMode?: boolean;
+}
+
+export type AuditLogEntry = {
+    id?: number;
+    timestamp: Date;
+    method: string;
+    url: string;
+    user_id?: string | number | null;
+    entity?: string;
+    entity_id?: string | number | null;
+    old_value?: any;
+    new_value?: any;
+    action_type: string;
+    status: number;
+    duration_ms: number;
+    ip?: string;
+    user_agent?: string;
+}

package/test/manual_verification_draft.ts

@@ -0,0 +1,59 @@
+import { Audit } from '../src/index';
+// Mock NextRequest and NextResponse for testing
+class MockNextRequest {
+    public url: string;
+    public method: string;
+    public headers: Map<string, string>;
+    constructor(url: string, method: string) {
+        this.url = url;
+        this.method = method;
+        this.headers = new Map();
+    }
+}
+
+// Mock Config Loading
+jest.mock('../src/config', () => ({
+    loadConfig: () => ({
+        database: {}, // Won't connect in test unless we mock db too
+        debug: true
+    })
+}));
+
+// Mock DB to avoid connection errors
+jest.mock('../src/lib/mysql', () => ({
+    saveAuditLog: async (entry: any) => {
+        console.log('MOCK DB SAVE:', JSON.stringify(entry, null, 2));
+    }
+}));
+
+
+class TestController {
+    @Audit()
+    async deleteUser(req: any) {
+        console.log('Executing deleteUser...');
+        return { success: true, deletedId: 123, name: 'John Doe' };
+    }
+
+    @Audit()
+    async createPost(req: any) {
+        return new Response(JSON.stringify({ id: 999, title: 'New Post' }), { status: 201 });
+    }
+}
+
+async function runTest() {
+    const controller = new TestController();
+
+    console.log('--- Test 1: DELETE ---');
+    const req1 = new MockNextRequest('http://localhost:3000/api/users/123', 'DELETE');
+    // @ts-ignore
+    await controller.deleteUser(req1);
+
+    console.log('\n--- Test 2: POST (Response object) ---');
+    const req2 = new MockNextRequest('http://localhost:3000/api/posts', 'POST');
+    // @ts-ignore
+    await controller.createPost(req2);
+}
+
+// runTest();
+// We can't easily run this with ts-node because we are mocking modules via jest logic which isn't present
+// We will just do a simple run script without jest mocks, but manual overrides if possible.

package/test/verify_dist.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_1 = require("../dist/index");
+// Usage of dist means we should build again before running this.
+// But technically in node we can import src if we use ts-node, but I am forcing dist usage to match real world.
+// Mock NextRequest and NextResponse for testing behavior
+class NextRequest {
+    constructor(url, method) {
+        this.url = url;
+        this.method = method;
+        this.headers = new Map();
+    }
+}
+// We need to Mock the config loader behavior because we don't have audit.conf.ts
+// effectively we can set a global or mock the module if possible.
+// Since we are running a script, we can rely on `loadConfig` behavior fallback
+// or creating a dummy audit.conf.js in cwd.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const dummyConfigPath = path_1.default.resolve(process.cwd(), 'audit.conf.js');
+class TestController {
+    async deleteUser(req) {
+        console.log('  -> Controller: deleteUser called');
+        return { success: true, deletedId: 101, name: 'Deleted User' };
+    }
+    async createPost(req) {
+        console.log('  -> Controller: createPost called');
+        // Simulate a response object
+        return { status: 201, json: () => ({ id: 202, title: 'New Post' }) };
+        // Note: Real Response object logic in decorator uses .clone(), so this mock is imperfect 
+        // but sufficient if we just want to see if it runs without crashing.
+    }
+}
+__decorate([
+    (0, index_1.Audit)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], TestController.prototype, "deleteUser", null);
+__decorate([
+    (0, index_1.Audit)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], TestController.prototype, "createPost", null);
+async function runTest() {
+    // 1. Create dummy config
+    fs_1.default.writeFileSync(dummyConfigPath, `
+        module.exports = {
+            database: { url: 'mysql://mock:3306/db' },
+            debug: true,
+            testMode: true
+        };
+    `);
+    console.log('Created dummy audit.conf.js');
+    try {
+        const controller = new TestController();
+        console.log('\n--- Test 1: DELETE ---');
+        const req1 = new NextRequest('http://api.test/users/101', 'DELETE');
+        // @ts-ignore
+        await controller.deleteUser(req1);
+        console.log('\n--- Test 2: POST ---');
+        const req2 = new NextRequest('http://api.test/posts', 'POST');
+        // @ts-ignore
+        await controller.createPost(req2);
+        console.log('\n--- Test 3: PATCH ---');
+        const req3 = new NextRequest('http://api.test/users/101', 'PATCH');
+        // @ts-ignore
+        await controller.createPost(req3); // Reuse createPost for simplicity as it returns data
+    }
+    catch (e) {
+        console.error('Test Failed:', e);
+    }
+    finally {
+        // Cleanup
+        if (fs_1.default.existsSync(dummyConfigPath)) {
+            fs_1.default.unlinkSync(dummyConfigPath);
+            console.log('Removed dummy audit.conf.js');
+        }
+    }
+}
+runTest();

package/test/verify_dist.ts

@@ -0,0 +1,86 @@
+
+import { Audit } from '../dist/index';
+// Usage of dist means we should build again before running this.
+// But technically in node we can import src if we use ts-node, but I am forcing dist usage to match real world.
+
+// Mock NextRequest and NextResponse for testing behavior
+class NextRequest {
+    public url: string;
+    public method: string;
+    public headers: Map<string, string>;
+    constructor(url: string, method: string) {
+        this.url = url;
+        this.method = method;
+        this.headers = new Map();
+    }
+}
+
+// We need to Mock the config loader behavior because we don't have audit.conf.ts
+// effectively we can set a global or mock the module if possible.
+// Since we are running a script, we can rely on `loadConfig` behavior fallback
+// or creating a dummy audit.conf.js in cwd.
+
+import fs from 'fs';
+import path from 'path';
+
+const dummyConfigPath = path.resolve(process.cwd(), 'audit.conf.js');
+
+class TestController {
+
+    @Audit()
+    async deleteUser(req: any) { // req type is any here to pass mock
+        console.log('  -> Controller: deleteUser called');
+        return { success: true, deletedId: 101, name: 'Deleted User' };
+    }
+
+    @Audit()
+    async createPost(req: any) {
+        console.log('  -> Controller: createPost called');
+        // Simulate a response object
+        return { status: 201, json: () => ({ id: 202, title: 'New Post' }) };
+        // Note: Real Response object logic in decorator uses .clone(), so this mock is imperfect 
+        // but sufficient if we just want to see if it runs without crashing.
+    }
+}
+
+async function runTest() {
+    // 1. Create dummy config
+    fs.writeFileSync(dummyConfigPath, `
+        module.exports = {
+            database: { url: 'mysql://mock:3306/db' },
+            debug: true,
+            testMode: true
+        };
+    `);
+    console.log('Created dummy audit.conf.js');
+
+    try {
+        const controller = new TestController();
+
+        console.log('\n--- Test 1: DELETE ---');
+        const req1 = new NextRequest('http://api.test/users/101', 'DELETE');
+        // @ts-ignore
+        await controller.deleteUser(req1);
+
+        console.log('\n--- Test 2: POST ---');
+        const req2 = new NextRequest('http://api.test/posts', 'POST');
+        // @ts-ignore
+        await controller.createPost(req2);
+
+        console.log('\n--- Test 3: PATCH ---');
+        const req3 = new NextRequest('http://api.test/users/101', 'PATCH');
+        // @ts-ignore
+        await controller.createPost(req3); // Reuse createPost for simplicity as it returns data
+
+    } catch (e) {
+        console.error('Test Failed:', e);
+    } finally {
+        // Cleanup
+        if (fs.existsSync(dummyConfigPath)) {
+            fs.unlinkSync(dummyConfigPath);
+            console.log('Removed dummy audit.conf.js');
+        }
+    }
+}
+
+runTest();

package/tsconfig.json

@@ -0,0 +1,21 @@
+{
+    "compilerOptions": {
+        "target": "ES2020",
+        "module": "commonjs",
+        "declaration": true,
+        "outDir": "./dist",
+        "strict": true,
+        "esModuleInterop": true,
+        "experimentalDecorators": true,
+        "emitDecoratorMetadata": true,
+        "skipLibCheck": true,
+        "forceConsistentCasingInFileNames": true
+    },
+    "include": [
+        "src/**/*"
+    ],
+    "exclude": [
+        "node_modules",
+        "dist"
+    ]
+}