@managemint-solutions/sdk 0.17.0 → 0.18.0

package/dist/audit/index.d.ts

@@ -14,6 +14,12 @@ export type AuditActor = {
 };
 /** A flat database row — always `select('*')`, never an entity shape with embedded joins. */
 export type AuditRow = Record<string, unknown>;
+/**
+ * Drops the internal `id bigint` from a row on its way out of the SDK. Every table has one
+ * alongside its public `mms_id uuid`, and only the database is meant to see it — a caller that
+ * never learns the sequence cannot come to depend on it, or leak how many rows there are.
+ */
+export declare const withoutInternalId: <T extends Record<string, unknown>>(row: T) => Omit<T, "id">;
 export type AuditChanges = Record<string, {
     old: unknown;
     new: unknown;
@@ -34,15 +40,30 @@ export type AuditErrorHandler = (error: unknown, entries: AuditEntry[]) => void;
  * pair, which becomes `related_entity_*` on the audit row instead.
  */
 export declare const AUDIT_EXCLUDED_COLUMNS: ReadonlySet<string>;
+/**
+ * Columns whose *value* never reaches the trail. `audit_logs` is readable by any member with
+ * `read_logs`, so a value copied into `changes` is a value published to the whole organization —
+ * and these are either provider credentials and identifiers (the `paystack_*` customer and
+ * subscription codes, card metadata, tokens, an idempotency key that would let a replay be
+ * forged) or content the base table deliberately withholds (`authenticated` has no grant on
+ * `notifications.rendered_content`, so the rendered email must not arrive by the back door).
+ * The column still shows up in the trail — that it changed is the point — with both sides
+ * replaced by `'[redacted]'`.
+ */
+export declare const AUDIT_REDACTED_COLUMNS: ReadonlySet<string>;
+/** True for a named redacted column, and for every provider-issued `paystack_*` identifier. */
+export declare const isRedactedColumn: (name: string) => boolean;
 /**
  * The fields that differ between two flat rows, as `{ field: { old, new } }`. Values stay real
  * JSON (booleans stay booleans, jsonb stays an object) and are compared by serialized value, so
- * arrays and objects are equal when their contents are.
+ * arrays and objects are equal when their contents are. A redacted column is compared on its
+ * real values and only then redacted, so it is reported when — and only when — it truly moved.
  */
 export declare const diffChanges: (before: AuditRow, after: AuditRow) => AuditChanges;
 /**
  * A whole row as a change set — `'new'` for an insert, `'old'` for a hard delete — so the trail
- * stays self-contained once the row is gone. Columns that hold nothing are left out.
+ * stays self-contained once the row is gone. Columns that hold nothing are left out; a redacted
+ * column that holds something is present, as `'[redacted]'`.
  */
 export declare const snapshotChanges: (row: AuditRow, side: "new" | "old") => AuditChanges;
 /**

package/dist/audit/index.js

@@ -14,10 +14,21 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.auditedTable = exports.AuditResource = exports.snapshotChanges = exports.diffChanges = exports.AUDIT_EXCLUDED_COLUMNS = void 0;
+exports.auditedTable = exports.AuditResource = exports.snapshotChanges = exports.diffChanges = exports.isRedactedColumn = exports.AUDIT_REDACTED_COLUMNS = exports.AUDIT_EXCLUDED_COLUMNS = exports.withoutInternalId = void 0;
 const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
 const errors_1 = require("../errors");
+const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
+/**
+ * Drops the internal `id bigint` from a row on its way out of the SDK. Every table has one
+ * alongside its public `mms_id uuid`, and only the database is meant to see it — a caller that
+ * never learns the sequence cannot come to depend on it, or leak how many rows there are.
+ */
+const withoutInternalId = (row) => {
+    const { id: _id, ...rest } = row;
+    return rest;
+};
+exports.withoutInternalId = withoutInternalId;
 /**
  * Bookkeeping columns a diff never reports: identity, tenancy and the who/when stamps of the
  * transition itself (the action already says what happened), plus the `entity_type`/`entity_id`
@@ -43,12 +54,40 @@ exports.AUDIT_EXCLUDED_COLUMNS = new Set([
     'entity_type',
     'entity_id',
 ]);
+/**
+ * Columns whose *value* never reaches the trail. `audit_logs` is readable by any member with
+ * `read_logs`, so a value copied into `changes` is a value published to the whole organization —
+ * and these are either provider credentials and identifiers (the `paystack_*` customer and
+ * subscription codes, card metadata, tokens, an idempotency key that would let a replay be
+ * forged) or content the base table deliberately withholds (`authenticated` has no grant on
+ * `notifications.rendered_content`, so the rendered email must not arrive by the back door).
+ * The column still shows up in the trail — that it changed is the point — with both sides
+ * replaced by `'[redacted]'`.
+ */
+exports.AUDIT_REDACTED_COLUMNS = new Set([
+    'rendered_content',
+    'template_variables',
+    'idempotency_key',
+    'provider_message_id',
+    'card_expiry_date',
+    'card_description',
+    'card_brand',
+    'access_token',
+    'refresh_token',
+    'password',
+]);
+/** True for a named redacted column, and for every provider-issued `paystack_*` identifier. */
+const isRedactedColumn = (name) => exports.AUDIT_REDACTED_COLUMNS.has(name) || name.startsWith('paystack_');
+exports.isRedactedColumn = isRedactedColumn;
+/** What a redacted column shows instead of its value. */
+const REDACTED = '[redacted]';
 /** `undefined` and `null` are the same absent value as far as a row diff is concerned. */
 const normalize = (value) => value ?? null;
 /**
  * The fields that differ between two flat rows, as `{ field: { old, new } }`. Values stay real
  * JSON (booleans stay booleans, jsonb stays an object) and are compared by serialized value, so
- * arrays and objects are equal when their contents are.
+ * arrays and objects are equal when their contents are. A redacted column is compared on its
+ * real values and only then redacted, so it is reported when — and only when — it truly moved.
  */
 const diffChanges = (before, after) => {
     const changes = {};
@@ -59,21 +98,25 @@ const diffChanges = (before, after) => {
         const newValue = normalize(after[key]);
         if (JSON.stringify(oldValue) === JSON.stringify(newValue))
             continue;
-        changes[key] = { old: oldValue, new: newValue };
+        changes[key] = (0, exports.isRedactedColumn)(key)
+            ? { old: REDACTED, new: REDACTED }
+            : { old: oldValue, new: newValue };
     }
     return changes;
 };
 exports.diffChanges = diffChanges;
 /**
  * A whole row as a change set — `'new'` for an insert, `'old'` for a hard delete — so the trail
- * stays self-contained once the row is gone. Columns that hold nothing are left out.
+ * stays self-contained once the row is gone. Columns that hold nothing are left out; a redacted
+ * column that holds something is present, as `'[redacted]'`.
  */
 const snapshotChanges = (row, side) => {
     const changes = {};
     for (const [key, value] of Object.entries(row)) {
         if (exports.AUDIT_EXCLUDED_COLUMNS.has(key) || value === null || value === undefined)
             continue;
-        changes[key] = side === 'new' ? { old: null, new: value } : { old: value, new: null };
+        const recorded = (0, exports.isRedactedColumn)(key) ? REDACTED : value;
+        changes[key] = side === 'new' ? { old: null, new: recorded } : { old: recorded, new: null };
     }
     return changes;
 };
@@ -163,17 +206,7 @@ class AuditResource {
         const { data, error, count } = await auditTrailQuery;
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
-        const totalEstimated = count ?? 0;
-        const totalPages = totalEstimated > 0 ? Math.ceil(totalEstimated / pageSize) : 0;
-        return {
-            results: (data ?? []),
-            page,
-            per_page: pageSize,
-            count: totalEstimated,
-            total_pages: totalPages,
-            has_next_page: page < totalPages,
-            has_previous_page: page > 1,
-        };
+        return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
 }
 exports.AuditResource = AuditResource;
@@ -224,7 +257,9 @@ const auditedTable = (supabase, actor, audit, options) => {
             throw (0, errors_1.mapPostgrestError)(error);
         const after = data;
         await recordWrite(id, action, before, after);
-        return after;
+        // `before` stays whole — it is internal to the diff — but what the caller gets does not
+        // carry the internal `id`.
+        return (0, exports.withoutInternalId)(after);
     };
     const writeWhere = async (id, guard, payload) => {
         const before = await read(id);
@@ -239,7 +274,7 @@ const auditedTable = (supabase, actor, audit, options) => {
             return null;
         const after = data;
         await recordWrite(id, enum_1.AuditTrailAction.UPDATE, before, after);
-        return after;
+        return (0, exports.withoutInternalId)(after);
     };
     return {
         async insert(payload) {
@@ -258,7 +293,7 @@ const auditedTable = (supabase, actor, audit, options) => {
                 changes: (0, exports.snapshotChanges)(row, 'new'),
                 ...relatedOf(row),
             });
-            return row;
+            return (0, exports.withoutInternalId)(row);
         },
         async insertMany(payloads) {
             if (payloads.length === 0)
@@ -274,7 +309,7 @@ const auditedTable = (supabase, actor, audit, options) => {
                 changes: (0, exports.snapshotChanges)(row, 'new'),
                 ...relatedOf(row),
             })));
-            return rows;
+            return rows.map(exports.withoutInternalId);
         },
         update(id, payload) {
             return write(id, enum_1.AuditTrailAction.UPDATE, payload);
@@ -300,7 +335,7 @@ const auditedTable = (supabase, actor, audit, options) => {
                 changes: (0, exports.snapshotChanges)(before, 'old'),
                 ...relatedOf(before),
             });
-            return before;
+            return (0, exports.withoutInternalId)(before);
         },
     };
 };

package/dist/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAEA,0EAGyD;AAEzD,sCAA8C;AAG9C,wCAAsB;AAyBtB;;;;GAIG;AACU,QAAA,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,IAAI;IACJ,QAAQ;IACR,iBAAiB;IACjB,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAE7D;;;;GAIG;AACI,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAE,KAAe,EAAgB,EAAE;IAC7E,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,8BAAsB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE9C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAdW,QAAA,WAAW,eActB;AAEF;;;GAGG;AACI,MAAM,eAAe,GAAG,CAAC,GAAa,EAAE,IAAmB,EAAgB,EAAE;IAClF,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,8BAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACvF,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxF,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;;OAUX,CAAC;AAEjB;;;GAGG;AACH,MAAa,aAAa;IAEL;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,KAAiB,EACjB,OAA2B;QAF3B,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,KAAgC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;gBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,UAAU;gBAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;gBACnD,iBAAiB,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;gBAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC,CACJ,CAAC;YACF,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAe,EAAE,MAAoB,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAuB;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;QAErC,2FAA2F;QAC3F,0DAA0D;QAC1D,IAAI,eAAe,GAAG,IAAI,CAAC,QAAQ;aAChC,IAAI,CAAC,YAAY,CAAC;aAClB,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAClD,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aACzC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;QAExC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC;QACrD,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,cAAc,GAAG,KAAK,IAAI,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,OAAO;YACL,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE,CAAkC;YACtD,IAAI;YACJ,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,IAAI,GAAG,UAAU;YAChC,iBAAiB,EAAE,IAAI,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC;CACF;AA3FD,sCA2FC;AAeD,qFAAqF;AACrF,MAAM,WAAW,GAAG,CAClB,QAA0B,EAC1B,KAAa,EACb,EAAU,EACV,OAAiB,EACjB,cAA6B,EAC7B,EAAE;IACF,4FAA4F;IAC5F,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,cAAc,KAAK,IAAI;QAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AA2BF;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAC1B,QAA0B,EAC1B,KAAiB,EACjB,KAAoB,EACpB,OAA4B,EACd,EAAE;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC;IAErD,8FAA8F;IAC9F,sFAAsF;IACtF,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,CAAC;QACpC,iBAAiB,EAAG,GAAG,CAAC,WAAyC,IAAI,IAAI;QACzE,eAAe,EAAG,GAAG,CAAC,SAAuC,IAAI,IAAI;KACtE,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAqB,EAAE;QACnD,4FAA4F;QAC5F,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM;YAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAEvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,IAAgB,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,MAAgB,EAAE,OAAuB,EAAE,EAAE,CACzE,WAAW,CACT,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,EAAE,EACF,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EACzD,kBAAkB,CACnB,CAAC;IAEJ,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,MAAwB,EAAE,MAAgB,EAAE,KAAe,EAAE,EAAE,CAC9F,KAAK,CAAC,MAAM,CAAC;QACX,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAA,mBAAW,EAAC,MAAM,EAAE,KAAK,CAAC;QACnC,GAAG,SAAS,CAAC,MAAM,CAAC;KACrB,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,KAAK,EACjB,EAAU,EACV,MAAwB,EACxB,OAAuB,EACJ,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAgB,CAAC;QAE/B,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE7C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EACtB,EAAU,EACV,KAAiB,EACjB,OAAuB,EACG,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,0FAA0F;QAC1F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aAC/D,MAAM,CAAC,GAAG,CAAC;aACX,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,gFAAgF;QAChF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAgB,CAAC;QAE/B,MAAM,WAAW,CAAC,EAAE,EAAE,uBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE9D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;iBACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnB,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAgB,CAAC;YAE7B,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,GAAG,CAAC,MAAgB;gBAC9B,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,GAAG,SAAS,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxF,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAe,CAAC;YAExC,MAAM,KAAK,CAAC,MAAM,CAChB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,GAAG,CAAC,MAAgB;gBAC9B,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,GAAG,SAAS,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC,CACJ,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,EAAE,EAAE,OAAO;YAChB,OAAO,KAAK,CAAC,EAAE,EAAE,uBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO;YAC5B,OAAO,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO;YAC5B,OAAO,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;YAE9B,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM;gBAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YAEvE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC;YAC9B,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAE1C,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,IAAA,uBAAe,EAAC,MAAM,EAAE,KAAK,CAAC;gBACvC,GAAG,SAAS,CAAC,MAAM,CAAC;aACrB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA3JW,QAAA,YAAY,gBA2JvB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAEA,0EAGyD;AAEzD,sCAA8C;AAC9C,8CAA0C;AAG1C,wCAAsB;AAWtB;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,CAAoC,GAAM,EAAiB,EAAE;IAC5F,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAHW,QAAA,iBAAiB,qBAG5B;AAgBF;;;;GAIG;AACU,QAAA,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,IAAI;IACJ,QAAQ;IACR,iBAAiB;IACjB,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH,+FAA+F;AACxF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE,CACxD,8BAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AADtD,QAAA,gBAAgB,oBACsC;AAEnE,yDAAyD;AACzD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,0FAA0F;AAC1F,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAE7D;;;;;GAKG;AACI,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAE,KAAe,EAAgB,EAAE;IAC7E,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,8BAAsB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE9C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAA,wBAAgB,EAAC,GAAG,CAAC;YAClC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;YAClC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAhBW,QAAA,WAAW,eAgBtB;AAEF;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAAC,GAAa,EAAE,IAAmB,EAAgB,EAAE;IAClF,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,8BAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACvF,MAAM,QAAQ,GAAG,IAAA,wBAAgB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAVW,QAAA,eAAe,mBAU1B;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;;OAUX,CAAC;AAEjB;;;GAGG;AACH,MAAa,aAAa;IAEL;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,KAAiB,EACjB,OAA2B;QAF3B,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,KAAgC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;gBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,UAAU;gBAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;gBACnD,iBAAiB,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;gBAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC,CACJ,CAAC;YACF,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAe,EAAE,MAAoB,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAuB;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;QAErC,2FAA2F;QAC3F,0DAA0D;QAC1D,IAAI,eAAe,GAAG,IAAI,CAAC,QAAQ;aAChC,IAAI,CAAC,YAAY,CAAC;aAClB,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAClD,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aACzC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;QAExC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC;QACrD,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAA,sBAAS,EAAmB,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;CACF;AAhFD,sCAgFC;AAeD,qFAAqF;AACrF,MAAM,WAAW,GAAG,CAClB,QAA0B,EAC1B,KAAa,EACb,EAAU,EACV,OAAiB,EACjB,cAA6B,EAC7B,EAAE;IACF,4FAA4F;IAC5F,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,cAAc,KAAK,IAAI;QAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AA2BF;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAC1B,QAA0B,EAC1B,KAAiB,EACjB,KAAoB,EACpB,OAA4B,EACd,EAAE;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC;IAErD,8FAA8F;IAC9F,sFAAsF;IACtF,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,CAAC;QACpC,iBAAiB,EAAG,GAAG,CAAC,WAAyC,IAAI,IAAI;QACzE,eAAe,EAAG,GAAG,CAAC,SAAuC,IAAI,IAAI;KACtE,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAqB,EAAE;QACnD,4FAA4F;QAC5F,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM;YAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAEvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,IAAgB,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,MAAgB,EAAE,OAAuB,EAAE,EAAE,CACzE,WAAW,CACT,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,EAAE,EACF,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EACzD,kBAAkB,CACnB,CAAC;IAEJ,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,MAAwB,EAAE,MAAgB,EAAE,KAAe,EAAE,EAAE,CAC9F,KAAK,CAAC,MAAM,CAAC;QACX,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAA,mBAAW,EAAC,MAAM,EAAE,KAAK,CAAC;QACnC,GAAG,SAAS,CAAC,MAAM,CAAC;KACrB,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,KAAK,EACjB,EAAU,EACV,MAAwB,EACxB,OAAuB,EACJ,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAgB,CAAC;QAE/B,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE7C,wFAAwF;QACxF,2BAA2B;QAC3B,OAAO,IAAA,yBAAiB,EAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EACtB,EAAU,EACV,KAAiB,EACjB,OAAuB,EACG,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,0FAA0F;QAC1F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aAC/D,MAAM,CAAC,GAAG,CAAC;aACX,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,gFAAgF;QAChF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAgB,CAAC;QAE/B,MAAM,WAAW,CAAC,EAAE,EAAE,uBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE9D,OAAO,IAAA,yBAAiB,EAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;iBACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnB,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAgB,CAAC;YAE7B,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,GAAG,CAAC,MAAgB;gBAC9B,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,GAAG,SAAS,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;YAEH,OAAO,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxF,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAe,CAAC;YAExC,MAAM,KAAK,CAAC,MAAM,CAChB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,GAAG,CAAC,MAAgB;gBAC9B,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,GAAG,SAAS,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC,CACJ,CAAC;YAEF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAiB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,CAAC,EAAE,EAAE,OAAO;YAChB,OAAO,KAAK,CAAC,EAAE,EAAE,uBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO;YAC5B,OAAO,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO;YAC5B,OAAO,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;YAE9B,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM;gBAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YAEvE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC;YAC9B,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAE1C,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,IAAA,uBAAe,EAAC,MAAM,EAAE,KAAK,CAAC;gBACvC,GAAG,SAAS,CAAC,MAAM,CAAC;aACrB,CAAC,CAAC;YAEH,OAAO,IAAA,yBAAiB,EAAC,MAAM,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA7JW,QAAA,YAAY,gBA6JvB"}

package/dist/auth-client/index.d.ts

@@ -1,4 +1,4 @@
-import { type SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
+import type { SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
 import type { ExchangeTokenResponse, LoginResponse } from '@managemint-solutions/entities/auth';
 import type { ExchangeRefreshTokenDto, ExchangeTokenHashDto, loginDto, ResetPasswordDto, SendPasswordResetEmailDto } from '@managemint-solutions/entities/auth/dto';
 import { PricebooksResource } from '../pricebooks';
@@ -20,11 +20,6 @@ export declare class SupabaseAuthClient {
     constructor(config: SupabaseAuthClientConfig);
     signIn(input: loginDto): Promise<LoginResponse>;
     refreshSession(input: ExchangeRefreshTokenDto): Promise<ExchangeTokenResponse>;
-    /**
-     * Parity with the api: this client never holds a session (`persistSession` is off), so
-     * server-side there is nothing to revoke and the call is a no-op. Kept as the api had it.
-     */
-    signOut(): Promise<void>;
     /** `redirectTo` is passed in — the SDK reads no environment variables. */
     sendPasswordResetEmail(input: SendPasswordResetEmailDto, redirectTo: string): Promise<void>;
     exchangeRecoveryToken(input: ExchangeTokenHashDto): Promise<ExchangeTokenResponse>;

package/dist/auth-client/index.js

@@ -15,7 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSupabaseAuthClient = exports.SupabaseAuthClient = void 0;
-const supabase_js_1 = require("@supabase/supabase-js");
+const auth_1 = require("../auth");
 const errors_1 = require("../errors");
 const pricebooks_1 = require("../pricebooks");
 __exportStar(require("./dto"), exports);
@@ -37,10 +37,7 @@ class SupabaseAuthClient {
     pricebooks;
     constructor(config) {
         this.config = config;
-        this.supabase = (0, supabase_js_1.createClient)(config.url, config.key, {
-            // Server-side and stateless: nothing is stored, refreshed or read out of a URL.
-            auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
-        });
+        this.supabase = (0, auth_1.createRawClient)(config.url, config.key);
         this.pricebooks = new pricebooks_1.PricebooksResource(this.supabase);
     }
     async signIn(input) {
@@ -66,15 +63,6 @@ class SupabaseAuthClient {
             throw noSession('Token exchange failed: No session data returned');
         return toTokens(data.session);
     }
-    /**
-     * Parity with the api: this client never holds a session (`persistSession` is off), so
-     * server-side there is nothing to revoke and the call is a no-op. Kept as the api had it.
-     */
-    async signOut() {
-        const { error } = await this.supabase.auth.signOut();
-        if (error)
-            throw (0, errors_1.mapAuthError)(error);
-    }
     /** `redirectTo` is passed in — the SDK reads no environment variables. */
     async sendPasswordResetEmail(input, redirectTo) {
         const { error } = await this.supabase.auth.resetPasswordForEmail(input.email, { redirectTo });
@@ -123,10 +111,7 @@ class SupabaseAuthClient {
      * ignored, a failed stamp must not fail the login.
      */
     async stampLastLoggedIn(accessToken, userId) {
-        const asUser = (0, supabase_js_1.createClient)(this.config.url, this.config.key, {
-            global: { headers: { Authorization: `Bearer ${accessToken}` } },
-            auth: { persistSession: false, autoRefreshToken: false },
-        });
+        const asUser = (0, auth_1.createRawClient)(this.config.url, this.config.key, accessToken);
         await asUser
             .from('users')
             .update({ last_logged_in: new Date().toISOString() })

package/dist/auth-client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth-client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,uDAA8F;AAY9F,sCAA8D;AAC9D,8CAAmD;AAEnD,wCAAsB;AAOtB,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAuB,EAAE,CACzD,IAAI,4BAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,OAGjB,EAAyB,EAAE,CAAC,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,aAAa,EAAE,OAAO,CAAC,aAAa;CACrC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAa,kBAAkB;IAIA;IAHpB,QAAQ,CAAmB,CAAC,iDAAiD;IAC7E,UAAU,CAAqB;IAExC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,QAAQ,GAAG,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;YACnD,gFAAgF;YAChF,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,+BAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAe;QAC1B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAClE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtE,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA8B;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,sBAAsB,CAC1B,KAAgC,EAChC,UAAkB;QAElB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAA2B;QACrD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAA2B;QACpD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAuB;QACzC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,MAAM,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;QAEnD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,WAAW;YAAE,MAAM,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,MAAc;QACjE,MAAM,MAAM,GAAG,IAAA,0BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC5D,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YAC/D,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,MAAM;aACT,IAAI,CAAC,OAAO,CAAC;aACb,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACpD,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;CACF;AA1GD,gDA0GC;AAEM,MAAM,wBAAwB,GAAG,CAAC,MAAgC,EAAsB,EAAE,CAC/F,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AADpB,QAAA,wBAAwB,4BACJ"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth-client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAYA,kCAA0C;AAC1C,sCAA8D;AAC9D,8CAAmD;AAEnD,wCAAsB;AAOtB,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAuB,EAAE,CACzD,IAAI,4BAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnF,MAAM,QAAQ,GAAG,CAAC,OAGjB,EAAyB,EAAE,CAAC,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,aAAa,EAAE,OAAO,CAAC,aAAa;CACrC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAa,kBAAkB;IAIA;IAHpB,QAAQ,CAAmB,CAAC,iDAAiD;IAC7E,UAAU,CAAqB;IAExC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,QAAQ,GAAG,IAAA,sBAAe,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,+BAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAe;QAC1B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAClE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtE,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA8B;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,sBAAsB,CAC1B,KAAgC,EAChC,UAAkB;QAElB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAA2B;QACrD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAA2B;QACpD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YACzD,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAuB;QACzC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,MAAM,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;QAEnD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,WAAW;YAAE,MAAM,IAAA,qBAAY,EAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,MAAc;QACjE,MAAM,MAAM,GAAG,IAAA,sBAAe,EAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC9E,MAAM,MAAM;aACT,IAAI,CAAC,OAAO,CAAC;aACb,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;aACpD,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;CACF;AA3FD,gDA2FC;AAEM,MAAM,wBAAwB,GAAG,CAAC,MAAgC,EAAsB,EAAE,CAC/F,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AADpB,QAAA,wBAAwB,4BACJ"}

package/dist/auth.d.ts

@@ -1,5 +1,40 @@
+import { type SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
+/**
+ * A raw supabase-js client, built the one way the SDK ever needs one: server-side and stateless —
+ * nothing is stored, refreshed or read out of a URL — carrying the caller's bearer token when
+ * there is one, so RLS sees them.
+ */
+export declare const createRawClient: (url: string, key: string, accessToken?: string) => SupabaseJsClient;
+/** Who a request is running as: the GoTrue subject and the tenant its `users` row belongs to. */
 export type AuthContext = {
     mms_id: string;
     organization_id: string;
 };
-export declare const decodeAuthContext: (accessToken: string) => AuthContext;
+/** What a verified bearer token resolves to: the GoTrue subject plus the caller's `users` row. */
+export type VerifiedAuth = AuthContext & {
+    email: string | null;
+    name: string | null;
+    surname: string | null;
+};
+export type VerifyAccessTokenConfig = {
+    url: string;
+    key: string;
+    accessToken: string;
+    /**
+     * A raw client already built for this url/key/token, so a caller that goes on to build a
+     * `SupabaseClient` from the same token has one supabase-js client rather than two. Defaults to
+     * building its own.
+     */
+    client?: SupabaseJsClient;
+};
+/**
+ * Establishes who the caller is, from a token whose signature is actually checked.
+ *
+ * Identity comes from the verified JWT and tenancy comes from `public.users` — never from
+ * `user_metadata`, which the end user can rewrite through GoTrue. The profile read runs under the
+ * caller's own RLS (a user may read their own row), so the `organization_id` returned here is the
+ * same one `current_user_organization_id()` gives every policy.
+ *
+ * The token itself is never logged: a failure says only that it was rejected.
+ */
+export declare const verifyAccessToken: ({ url, key, accessToken, client, }: VerifyAccessTokenConfig) => Promise<VerifiedAuth>;

package/dist/auth.js

@@ -1,30 +1,60 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeAuthContext = void 0;
+exports.verifyAccessToken = exports.createRawClient = void 0;
+const supabase_js_1 = require("@supabase/supabase-js");
 const errors_1 = require("./errors");
+/**
+ * A raw supabase-js client, built the one way the SDK ever needs one: server-side and stateless —
+ * nothing is stored, refreshed or read out of a URL — carrying the caller's bearer token when
+ * there is one, so RLS sees them.
+ */
+const createRawClient = (url, key, accessToken) => (0, supabase_js_1.createClient)(url, key, {
+    ...(accessToken ? { global: { headers: { Authorization: `Bearer ${accessToken}` } } } : {}),
+    auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
+});
+exports.createRawClient = createRawClient;
 const authError = (message) => new errors_1.SupabaseClientError({ status: 401, error: 'Authentication Error', message });
-const decodeBase64Url = (segment) => typeof Buffer !== 'undefined'
-    ? Buffer.from(segment, 'base64url').toString('utf8')
-    : atob(segment.replace(/-/g, '+').replace(/_/g, '/')); // browser (portal later)
-const decodeAuthContext = (accessToken) => {
-    const parts = accessToken.split('.');
-    if (parts.length !== 3)
-        throw authError('Malformed JWT');
-    let payload;
-    try {
-        payload = JSON.parse(decodeBase64Url(parts[1]));
+/**
+ * Establishes who the caller is, from a token whose signature is actually checked.
+ *
+ * Identity comes from the verified JWT and tenancy comes from `public.users` — never from
+ * `user_metadata`, which the end user can rewrite through GoTrue. The profile read runs under the
+ * caller's own RLS (a user may read their own row), so the `organization_id` returned here is the
+ * same one `current_user_organization_id()` gives every policy.
+ *
+ * The token itself is never logged: a failure says only that it was rejected.
+ */
+const verifyAccessToken = async ({ url, key, accessToken, client = (0, exports.createRawClient)(url, key, accessToken), }) => {
+    // Verifies the signature locally against the project's JWKS for asymmetric keys, and against
+    // the auth server for HS256 projects. Either way the token is checked, not merely decoded.
+    const { data, error } = await client.auth.getClaims(accessToken);
+    const mms_id = data?.claims?.sub;
+    if (error || typeof mms_id !== 'string' || mms_id === '') {
+        throw authError('Invalid or expired token');
     }
-    catch {
-        throw authError('Invalid JWT payload');
+    const { data: profile, error: profileError } = await client
+        .from('users')
+        .select('organization_id, active, email, name, surname')
+        .eq('mms_id', mms_id)
+        .maybeSingle();
+    if (profileError)
+        throw (0, errors_1.mapPostgrestError)(profileError);
+    if (!profile)
+        throw authError('No user profile exists for this account');
+    if (profile.active === false) {
+        throw new errors_1.SupabaseClientError({
+            status: 403,
+            error: 'Authentication Error',
+            message: 'Your account has been deactivated',
+        });
     }
-    const mms_id = payload.sub;
-    const organization_id = payload.user_metadata?.organization_id;
-    if (typeof mms_id !== 'string' ||
-        typeof organization_id !== 'string' ||
-        organization_id.trim() === '') {
-        throw authError('JWT is missing mms_id/organization_id claims');
-    }
-    return { mms_id, organization_id };
+    return {
+        mms_id,
+        organization_id: profile.organization_id,
+        email: profile.email ?? null,
+        name: profile.name ?? null,
+        surname: profile.surname ?? null,
+    };
 };
-exports.decodeAuthContext = decodeAuthContext;
+exports.verifyAccessToken = verifyAccessToken;
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";;;AAAA,qCAA+C;AAI/C,MAAM,SAAS,GAAG,CAAC,OAAe,EAAuB,EAAE,CACzD,IAAI,4BAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnF,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAClD,OAAO,MAAM,KAAK,WAAW;IAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB;AAE7E,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAe,EAAE;IACpE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC;IAEzD,IAAI,OAAyE,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC;IAC/D,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,eAAe,KAAK,QAAQ;QACnC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,EAC7B,CAAC;QACD,MAAM,SAAS,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACrC,CAAC,CAAC;AAtBW,QAAA,iBAAiB,qBAsB5B"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";;;AAAA,uDAA8F;AAC9F,qCAAkE;AAElE;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAC7B,GAAW,EACX,GAAW,EACX,WAAoB,EACF,EAAE,CACpB,IAAA,0BAAY,EAAC,GAAG,EAAE,GAAG,EAAE;IACrB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE;CACpF,CAAC,CAAC;AARQ,QAAA,eAAe,mBAQvB;AAwBL,MAAM,SAAS,GAAG,CAAC,OAAe,EAAuB,EAAE,CACzD,IAAI,4BAAmB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AAEnF;;;;;;;;;GASG;AACI,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,GAAG,EACH,GAAG,EACH,WAAW,EACX,MAAM,GAAG,IAAA,uBAAe,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,GACvB,EAAyB,EAAE;IACnD,6FAA6F;IAC7F,2FAA2F;IAC3F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;IACjC,IAAI,KAAK,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM;SACxD,IAAI,CAAC,OAAO,CAAC;SACb,MAAM,CAAC,+CAA+C,CAAC;SACvD,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;SACpB,WAAW,EAAE,CAAC;IACjB,IAAI,YAAY;QAAE,MAAM,IAAA,0BAAiB,EAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,4BAAmB,CAAC;YAC5B,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM;QACN,eAAe,EAAE,OAAO,CAAC,eAAyB;QAClD,KAAK,EAAG,OAAO,CAAC,KAAuB,IAAI,IAAI;QAC/C,IAAI,EAAG,OAAO,CAAC,IAAsB,IAAI,IAAI;QAC7C,OAAO,EAAG,OAAO,CAAC,OAAyB,IAAI,IAAI;KACpD,CAAC;AACJ,CAAC,CAAC;AApCW,QAAA,iBAAiB,qBAoC5B"}

package/dist/billing/index.d.ts

@@ -12,7 +12,6 @@ export declare class BillingReadsResource {
     protected readonly supabase: TypedSupabaseClient;
     protected readonly actor: AuditActor;
     constructor(supabase: TypedSupabaseClient, actor: AuditActor);
-    getTransaction(transactionId: string): Promise<BillingTransactionRow | null>;
     /** The one open transaction, if the organization has one. */
     openTransaction(openStatuses: string[]): Promise<BillingTransactionRow | null>;
     /** The replay lookup: the same key must never raise a second charge. */

package/dist/billing/index.js

@@ -37,16 +37,6 @@ class BillingReadsResource {
         this.supabase = supabase;
         this.actor = actor;
     }
-    async getTransaction(transactionId) {
-        const { data, error } = await this.supabase
-            .from('billing_transactions')
-            .select('*')
-            .eq('mms_id', transactionId)
-            .maybeSingle();
-        if (error)
-            throw (0, errors_1.mapPostgrestError)(error);
-        return (data ?? null);
-    }
     /** The one open transaction, if the organization has one. */
     async openTransaction(openStatuses) {
         const { data, error } = await this.supabase
@@ -57,7 +47,7 @@ class BillingReadsResource {
             .maybeSingle();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
-        return (data ?? null);
+        return data ? (0, audit_1.withoutInternalId)(data) : null;
     }
     /** The replay lookup: the same key must never raise a second charge. */
     async transactionByIdempotencyKey(idempotencyKey) {
@@ -69,7 +59,7 @@ class BillingReadsResource {
             .maybeSingle();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
-        return (data ?? null);
+        return data ? (0, audit_1.withoutInternalId)(data) : null;
     }
     /** Whether a catalog module is still on sale. The catalog is public, not tenant-scoped. */
     async isModuleActive(moduleId) {

package/dist/billing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/billing/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAAuF;AAEvF,sEAAuF;AACvF,oCAMkB;AAElB,sCAA8C;AAE9C,wCAAsB;AAEtB,MAAM,0BAA0B,GAAG;IACjC,KAAK,EAAE,sBAAsB;IAC7B,UAAU,EAAE,2BAAoB,CAAC,oBAAoB;CAC7C,CAAC;AAEX;;;;;GAKG;AACH,MAAa,oBAAoB;IAEV;IACA;IAFrB,YACqB,QAA6B,EAC7B,KAAiB;QADjB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,UAAK,GAAL,KAAK,CAAY;IACnC,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,aAAqB;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;aAC3B,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAiC,CAAC;IACxD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,eAAe,CAAC,YAAsB;QAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;aACtC,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAiC,CAAC;IACxD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,2BAA2B,CAC/B,cAAsB;QAEtB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;aACrC,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAiC,CAAC;IACxD,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,iBAAiB,CAAC;aACvB,MAAM,CAAC,QAAQ,CAAC;aAChB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACtB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAQ,IAAmC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,CAAC;CACF;AAxDD,oDAwDC;AAED;;;;;GAKG;AACH,MAAa,eAAgB,SAAQ,oBAAoB;IACtC,YAAY,CAAe;IAE5C,YAAY,QAA6B,EAAE,KAAiB,EAAE,KAAoB;QAChF,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,IAAA,oBAAY,EAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAiB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO,GAAuC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,aAAqB,EAAE,KAAe;QAC5D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE;YAC7C,GAAG,KAAK;YACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,aAAqB,EACrB,KAAe;QAEf,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,+BAAwB,CAAC,IAAI,CAAC,EACzE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACnD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF;AA7CD,0CA6CC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/billing/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAAuF;AAEvF,sEAAuF;AACvF,oCAOkB;AAElB,sCAA8C;AAE9C,wCAAsB;AAEtB,MAAM,0BAA0B,GAAG;IACjC,KAAK,EAAE,sBAAsB;IAC7B,UAAU,EAAE,2BAAoB,CAAC,oBAAoB;CAC7C,CAAC;AAEX;;;;;GAKG;AACH,MAAa,oBAAoB;IAEV;IACA;IAFrB,YACqB,QAA6B,EAC7B,KAAiB;QADjB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,UAAK,GAAL,KAAK,CAAY;IACnC,CAAC;IAEJ,6DAA6D;IAC7D,KAAK,CAAC,eAAe,CAAC,YAAsB;QAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;aACtC,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,CAAC,CAAE,IAAA,yBAAiB,EAAC,IAAgB,CAAsC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,2BAA2B,CAC/B,cAAsB;QAEtB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;aACrC,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,CAAC,CAAE,IAAA,yBAAiB,EAAC,IAAgB,CAAsC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,iBAAiB,CAAC;aACvB,MAAM,CAAC,QAAQ,CAAC;aAChB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACtB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAQ,IAAmC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,CAAC;CACF;AA7CD,oDA6CC;AAED;;;;;GAKG;AACH,MAAa,eAAgB,SAAQ,oBAAoB;IACtC,YAAY,CAAe;IAE5C,YAAY,QAA6B,EAAE,KAAiB,EAAE,KAAoB;QAChF,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,IAAA,oBAAY,EAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAiB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO,GAAuC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,aAAqB,EAAE,KAAe;QAC5D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE;YAC7C,GAAG,KAAK;YACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,aAAqB,EACrB,KAAe;QAEf,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,+BAAwB,CAAC,IAAI,CAAC,EACzE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACnD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF;AA7CD,0CA6CC"}

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { type SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
+import type { SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
 import { type AuthContext } from './auth';
 import { AuditResource, type AuditErrorHandler } from './audit';
 import { AdditionalDetailsResource } from './additional-details';
@@ -18,9 +18,24 @@ export type SupabaseClientConfig = {
     url: string;
     key: string;
     accessToken: string;
+    /**
+     * Who the request runs as. The caller must already have **verified** the token this came from
+     * (`verifyAccessToken`) — the client trusts this outright and scopes every query to it.
+     */
+    auth: AuthContext;
     /** Where a failed audit insert is reported. Defaults to `console.error`. */
     onAuditError?: AuditErrorHandler;
+    /**
+     * A raw client already built for this url/key/token — what `verifyAccessToken` was handed, so
+     * one request builds one supabase-js client. Defaults to building its own.
+     */
+    client?: TypedSupabaseClient;
 };
+/**
+ * The caller's data client: every query carries their bearer token, so RLS decides what they
+ * may see. It performs no authentication of its own — build it from a `VerifiedAuth`, never from
+ * a token you have only decoded.
+ */
 export declare class SupabaseClient {
     readonly supabase: TypedSupabaseClient;
     readonly auth: AuthContext;

package/dist/client.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSupabaseClient = exports.SupabaseClient = void 0;
-const supabase_js_1 = require("@supabase/supabase-js");
 const auth_1 = require("./auth");
 const audit_1 = require("./audit");
 const additional_details_1 = require("./additional-details");
@@ -16,6 +15,11 @@ const statuses_1 = require("./statuses");
 const supporting_files_1 = require("./supporting-files");
 const tasks_1 = require("./tasks");
 const users_1 = require("./users");
+/**
+ * The caller's data client: every query carries their bearer token, so RLS decides what they
+ * may see. It performs no authentication of its own — build it from a `VerifiedAuth`, never from
+ * a token you have only decoded.
+ */
 class SupabaseClient {
     supabase; // escape hatch for not-yet-migrated queries
     auth;
@@ -33,11 +37,9 @@ class SupabaseClient {
     projects;
     tasks;
     constructor(config) {
-        this.auth = (0, auth_1.decodeAuthContext)(config.accessToken);
-        this.supabase = (0, supabase_js_1.createClient)(config.url, config.key, {
-            global: { headers: { Authorization: `Bearer ${config.accessToken}` } },
-            auth: { persistSession: false, autoRefreshToken: false },
-        });
+        this.auth = config.auth;
+        this.supabase =
+            config.client ?? (0, auth_1.createRawClient)(config.url, config.key, config.accessToken);
         // Built before the resources: every write they make goes through it.
         this.audit = new audit_1.AuditResource(this.supabase, this.auth, config.onAuditError);
         this.statuses = new statuses_1.StatusesResource(this.supabase, this.auth, this.audit);

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,uDAA8F;AAC9F,iCAA6D;AAC7D,mCAAgE;AAChE,6DAAiE;AACjE,uCAA4C;AAC5C,mCAAwC;AACxC,mDAAwD;AACxD,uCAAiD;AACjD,mDAAwD;AACxD,+CAAoD;AACpD,yCAA8C;AAC9C,yCAA8C;AAC9C,yDAA6D;AAC7D,mCAAwC;AACxC,mCAAwC;AAexC,MAAa,cAAc;IAChB,QAAQ,CAAsB,CAAC,4CAA4C;IAC3E,IAAI,CAAc;IAClB,KAAK,CAAgB;IACrB,QAAQ,CAAmB;IAC3B,iBAAiB,CAA4B;IAC7C,KAAK,CAAgB;IACrB,aAAa,CAAwB;IACrC,OAAO,CAAuB;IAC9B,aAAa,CAAwB;IACrC,WAAW,CAAsB;IACjC,KAAK,CAAgB;IACrB,eAAe,CAA0B;IACzC,OAAO,CAAkB;IACzB,QAAQ,CAAmB;IAC3B,KAAK,CAAgB;IAE9B,YAAY,MAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,IAAA,wBAAiB,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE;YACtE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACzD,CAAC,CAAC;QACH,qEAAqE;QACrE,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,iBAAiB,GAAG,IAAI,8CAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,qCAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,GAAG,IAAI,8BAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,IAAI,qCAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,WAAW,GAAG,IAAI,iCAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,GAAG,IAAI,0CAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;CACF;AAtCD,wCAsCC;AAEM,MAAM,oBAAoB,GAAG,CAAC,MAA4B,EAAkB,EAAE,CACnF,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AADhB,QAAA,oBAAoB,wBACJ"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AACA,iCAA2D;AAC3D,mCAAgE;AAChE,6DAAiE;AACjE,uCAA4C;AAC5C,mCAAwC;AACxC,mDAAwD;AACxD,uCAAiD;AACjD,mDAAwD;AACxD,+CAAoD;AACpD,yCAA8C;AAC9C,yCAA8C;AAC9C,yDAA6D;AAC7D,mCAAwC;AACxC,mCAAwC;AAyBxC;;;;GAIG;AACH,MAAa,cAAc;IAChB,QAAQ,CAAsB,CAAC,4CAA4C;IAC3E,IAAI,CAAc;IAClB,KAAK,CAAgB;IACrB,QAAQ,CAAmB;IAC3B,iBAAiB,CAA4B;IAC7C,KAAK,CAAgB;IACrB,aAAa,CAAwB;IACrC,OAAO,CAAuB;IAC9B,aAAa,CAAwB;IACrC,WAAW,CAAsB;IACjC,KAAK,CAAgB;IACrB,eAAe,CAA0B;IACzC,OAAO,CAAkB;IACzB,QAAQ,CAAmB;IAC3B,KAAK,CAAgB;IAE9B,YAAY,MAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ;YACX,MAAM,CAAC,MAAM,IAAI,IAAA,sBAAe,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/E,qEAAqE;QACrE,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,iBAAiB,GAAG,IAAI,8CAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,qCAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,GAAG,IAAI,8BAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,IAAI,qCAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,WAAW,GAAG,IAAI,iCAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,GAAG,IAAI,0CAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,IAAI,2BAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;CACF;AApCD,wCAoCC;AAEM,MAAM,oBAAoB,GAAG,CAAC,MAA4B,EAAkB,EAAE,CACnF,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AADhB,QAAA,oBAAoB,wBACJ"}