@managemint-solutions/sdk 0.51.0 → 0.53.0

package/dist/index.js

@@ -7,9 +7,9 @@
 // their classes are not exported: a consumer never constructs one, and every export is a contract
 // to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = void 0;
-exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = void 0;
+exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.withAuditBatch = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
+exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UpdatePermissionsDto = void 0;
+exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
@@ -32,6 +32,7 @@ Object.defineProperty(exports, "EmptyToNull", { enumerable: true, get: function
 Object.defineProperty(exports, "IsNullable", { enumerable: true, get: function () { return validators_1.IsNullable; } });
 var audit_1 = require("./audit");
 Object.defineProperty(exports, "GetAuditTrailDto", { enumerable: true, get: function () { return audit_1.GetAuditTrailDto; } });
+Object.defineProperty(exports, "withAuditBatch", { enumerable: true, get: function () { return audit_1.withAuditBatch; } });
 var billing_1 = require("./billing");
 Object.defineProperty(exports, "CancelSubscriptionDto", { enumerable: true, get: function () { return billing_1.CancelSubscriptionDto; } });
 Object.defineProperty(exports, "GetPaymentsQueryDto", { enumerable: true, get: function () { return billing_1.GetPaymentsQueryDto; } });

package/dist/leads/index.d.ts

@@ -3,7 +3,7 @@ import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeadEntity, LeadSummary } from '@managemint-solutions/entities/leads';
 import type { AuthContext } from '../auth';
 import type { AdditionalDetailsResource } from '../additional-details';
-import { type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { ClientsResource } from '../clients';
 import type { TypedSupabaseClient } from '../client';
 import type { ConvertLeadDto, CreateLeadDto, GetLeadsDto, UpdateLeadDto } from './dto';
@@ -11,9 +11,10 @@ export * from './dto';
 export declare class LeadsResource {
     private readonly supabase;
     private readonly auth;
-    private readonly audit;
     private readonly additionalDetails;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource, additionalDetails: AdditionalDetailsResource);
     list(query: GetLeadsDto): Promise<MmsList<LeadSummary>>;
     getById(leadId: string): Promise<LeadEntity>;

package/dist/leads/index.js

@@ -106,18 +106,19 @@ const refuse = (status, message) => new errors_1.SupabaseClientError({ status, e
 class LeadsResource {
     supabase;
     auth;
-    audit;
     additionalDetails;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit, additionalDetails) {
         this.supabase = supabase;
         this.auth = auth;
-        this.audit = audit;
         this.additionalDetails = additionalDetails;
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
             table: 'leads',
             entityType: enum_6.AuditTrailEntityType.LEADS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_6.AuditTrailEntityType.LEADS);
     }
     async list(query) {
         const page = query.page;

package/dist/leave/leave-adjustments.js

@@ -27,6 +27,7 @@ class LeaveAdjustmentsResource {
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
             table: 'leave_adjustments',
             entityType: enum_1.AuditTrailEntityType.LEAVE_ADJUSTMENTS,
+            related: { entityType: enum_1.AuditTrailEntityType.LEAVE_ENTITLEMENTS, column: 'leave_entitlement_id' },
         });
     }
     /** The adjustments of the given entitlements, oldest first. */

package/dist/leave/leave-entitlements.d.ts

@@ -1,7 +1,7 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeaveEntitlementEntity, LeavePeriod } from '@managemint-solutions/entities/leave';
 import { LeaveGrantMethod } from '@managemint-solutions/entities/leave/enum';
-import { type AuditActor, type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditActor, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetLeaveEntitlementsDto, UpdateLeaveEntitlementDto } from './dto';
 /** The create input after the api has resolved the defaults and copied the type's policy on. */
@@ -21,6 +21,8 @@ export declare class LeaveEntitlementsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     list(query: GetLeaveEntitlementsDto): Promise<MmsList<LeaveEntitlementEntity>>;
     getById(leaveEntitlementId: string): Promise<LeaveEntitlementEntity>;

package/dist/leave/leave-entitlements.js

@@ -38,6 +38,8 @@ class LeaveEntitlementsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -45,6 +47,7 @@ class LeaveEntitlementsResource {
             table: 'leave_entitlements',
             entityType: enum_1.AuditTrailEntityType.LEAVE_ENTITLEMENTS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.LEAVE_ENTITLEMENTS);
     }
     async list(query) {
         const page = query.page;

package/dist/leave/leave-requests.d.ts

@@ -1,7 +1,7 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeaveCalendarEntry, LeaveRequestEntity } from '@managemint-solutions/entities/leave';
 import { LeaveRequestStatus, LeaveReviewDecision } from '@managemint-solutions/entities/leave/enum';
-import { type AuditActor, type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditActor, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetLeaveCalendarDto, GetLeaveRequestsDto } from './dto';
 /** A request as the api inserts it: the caller's own, with the days already counted. */
@@ -39,6 +39,8 @@ export declare class LeaveRequestsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     list(query: GetLeaveRequestsDto, options?: ListOptions): Promise<MmsList<LeaveRequestEntity>>;
     getById(leaveRequestId: string): Promise<LeaveRequestEntity>;

package/dist/leave/leave-requests.js

@@ -49,6 +49,8 @@ class LeaveRequestsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -56,6 +58,7 @@ class LeaveRequestsResource {
             table: 'leave_requests',
             entityType: enum_1.AuditTrailEntityType.LEAVE_REQUESTS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.LEAVE_REQUESTS);
     }
     async list(query, options = {}) {
         const page = query.page;

package/dist/organization-payment-methods/index.d.ts

@@ -1,4 +1,4 @@
-import { type AuditActor, type AuditResource } from '../audit';
+import type { AuditActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 /**
  * Everything Paystack knows an organization by, plus the two secrets the billing service acts
@@ -31,15 +31,14 @@ export type PaymentMethodLookupColumn = 'paystack_customer_code' | 'paystack_sub
  * policy. Only the service role can reach it.
  *
  * Service-role only, like the invites - this lives on the organization scope of the service
- * client and never on a caller's client. Writes are audited against the organization (the row
- * has no identity of its own), and the audit diff redacts every `paystack_*` column, so the trail
- * records that a value changed and never what it changed to.
+ * client and never on a caller's client. Writes are not audited: every column is provider
+ * machinery, and an organization's subscription history is the billing ledger, not its audit
+ * trail (`untracked` on the organizations table, docs/11-audit-trail.md).
  */
 export declare class OrganizationPaymentMethodsResource {
     private readonly supabase;
     private readonly actor;
-    private readonly audit;
-    constructor(supabase: TypedSupabaseClient, actor: AuditActor, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, actor: AuditActor);
     /** The actor organization's payment method; every column null when nothing has been stored yet. */
     get(): Promise<OrganizationPaymentMethod>;
     /**

package/dist/organization-payment-methods/index.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OrganizationPaymentMethodsResource = exports.PAYMENT_METHOD_COLUMNS = void 0;
-const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
-const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 exports.PAYMENT_METHOD_COLUMNS = [
     'paystack_customer_code',
@@ -33,18 +31,16 @@ const EMPTY = {
  * policy. Only the service role can reach it.
  *
  * Service-role only, like the invites - this lives on the organization scope of the service
- * client and never on a caller's client. Writes are audited against the organization (the row
- * has no identity of its own), and the audit diff redacts every `paystack_*` column, so the trail
- * records that a value changed and never what it changed to.
+ * client and never on a caller's client. Writes are not audited: every column is provider
+ * machinery, and an organization's subscription history is the billing ledger, not its audit
+ * trail (`untracked` on the organizations table, docs/11-audit-trail.md).
  */
 class OrganizationPaymentMethodsResource {
     supabase;
     actor;
-    audit;
-    constructor(supabase, actor, audit) {
+    constructor(supabase, actor) {
         this.supabase = supabase;
         this.actor = actor;
-        this.audit = audit;
     }
     /** The actor organization's payment method; every column null when nothing has been stored yet. */
     async get() {
@@ -73,15 +69,6 @@ class OrganizationPaymentMethodsResource {
         }, { onConflict: 'organization_id' });
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
-        const changes = (0, audit_1.diffChanges)(before, after);
-        if (Object.keys(changes).length === 0)
-            return;
-        await this.audit.record({
-            action: enum_1.AuditTrailAction.UPDATE,
-            entityType: enum_1.AuditTrailEntityType.ORGANIZATION,
-            entityId: this.actor.organization_id,
-            changes,
-        });
     }
 }
 exports.OrganizationPaymentMethodsResource = OrganizationPaymentMethodsResource;

package/dist/organizations/index.d.ts

@@ -1,5 +1,5 @@
 import type { SeatReservation } from '@managemint-solutions/entities/billing';
-import { type AuditActor, type AuditResource, type AuditRow } from '../audit';
+import { type AuditActor, type AuditResource, type AuditRow, EntityAuditTrail } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
 /** The organizations row as `ORGANIZATION_SELECT` produces it, before the api shapes it. */
@@ -18,6 +18,8 @@ export declare class OrganizationsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     getById(organizationId: string): Promise<OrganizationRow>;
     /** The caller's own organization, from the auth context. */

package/dist/organizations/index.js

@@ -20,12 +20,34 @@ const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
+// The subscription machinery on the row - what the billing flows and the Paystack webhooks
+// move. Its history is the billing ledger (billing_transactions, invoices, billing_events);
+// the organization's audit trail is its profile, so these are never recorded there.
+const SUBSCRIPTION_COLUMNS = [
+    'billing_status',
+    'billing_status_updated_at',
+    'billing_cycle_locked',
+    'payment_frequency',
+    'payment_override',
+    'last_payment_date',
+    'next_payment_date',
+    'access_expires_at',
+    'active_seat_count',
+    'paid_seat_count',
+    'modules',
+    'pricebook_id',
+    'card_brand',
+    'card_description',
+    'card_expiry_date',
+    'card_expiring_soon',
+];
 // The organizations row *is* the organization: it has no organization_id column, hence
 // `scopeByOrganization: false` wherever it is audited.
 const ORGANIZATIONS_TABLE = {
     table: 'organizations',
     entityType: enum_1.AuditTrailEntityType.ORGANIZATION,
     scopeByOrganization: false,
+    untracked: SUBSCRIPTION_COLUMNS,
 };
 // The api maps this row into OrganizationEntity: the module keys stored here are priced
 // against the organization's pricebook, and the flat address columns are nested. That is
@@ -81,10 +103,13 @@ class OrganizationsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, ORGANIZATIONS_TABLE);
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.ORGANIZATION);
     }
     async getById(organizationId) {
         const { data, error } = await this.supabase
@@ -203,11 +228,14 @@ class OrganizationSignupResource {
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         const row = data;
+        const changes = (0, audit_1.snapshotChanges)(row, 'new');
+        for (const column of SUBSCRIPTION_COLUMNS)
+            delete changes[column];
         await this.auditFor(row.mms_id).record({
             action: enum_1.AuditTrailAction.INSERT,
             entityType: enum_1.AuditTrailEntityType.ORGANIZATION,
             entityId: row.mms_id,
-            changes: (0, audit_1.snapshotChanges)(row, 'new'),
+            changes,
         });
         return (0, audit_1.withoutInternalId)(row);
     }

package/dist/permissions/index.js

@@ -22,6 +22,8 @@ __exportStar(require("./dto"), exports);
 const PERMISSIONS_TABLE = {
     table: 'permissions',
     entityType: enum_1.AuditTrailEntityType.PERMISSION,
+    // A permissions change shows in the history of the user it belongs to.
+    related: { entityType: enum_1.AuditTrailEntityType.USER, column: 'user_id' },
 };
 /**
  * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted

package/dist/projects/index.d.ts

@@ -1,7 +1,7 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { ProjectEntity, ProjectSummary } from '@managemint-solutions/entities/projects';
 import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { CreateProjectDto, GetProjectsDto, UpdateProjectDto } from './dto';
 export * from './dto';
@@ -9,6 +9,8 @@ export declare class ProjectsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     list(query: GetProjectsDto): Promise<MmsList<ProjectSummary>>;
     getById(projectId: string): Promise<ProjectEntity>;

package/dist/projects/index.js

@@ -79,6 +79,8 @@ class ProjectsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -86,6 +88,7 @@ class ProjectsResource {
             table: 'projects',
             entityType: enum_1.AuditTrailEntityType.PROJECTS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.PROJECTS);
     }
     async list(query) {
         const page = query.page;

package/dist/service-client/index.d.ts

@@ -119,6 +119,13 @@ export declare class SupabaseServiceClient {
         user_id: string;
         organization_id: string;
     } | null>;
+    /**
+     * Deletes every audit row written before `cutoff` and says how many went - the daily
+     * retention cron. Every tenant at once: the period is the same for all of them. Batched by
+     * the internal identity, oldest first, so no single statement holds a long lock, and each
+     * delete is a range rather than a list of ids.
+     */
+    purgeAuditLogsBefore(cutoff: string): Promise<number>;
     /**
      * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
      * transaction id in its metadata, and the row is what says which tenant it belongs to.

package/dist/service-client/index.js

@@ -49,7 +49,7 @@ class SupabaseOrganizationScope {
         this.leaveEntitlements = new leave_1.LeaveEntitlementsResource(supabase, actor, this.audit);
         this.leaveRequests = new leave_1.LeaveRequestsResource(supabase, actor, this.audit);
         this.organizations = new organizations_1.OrganizationsResource(supabase, actor, this.audit);
-        this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor, this.audit);
+        this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor);
         this.permissions = new permissions_1.PermissionsResource(supabase, actor, this.audit);
         this.users = new users_1.UsersResource(supabase, actor, this.audit);
     }
@@ -209,6 +209,40 @@ class SupabaseServiceClient {
             throw (0, errors_1.mapPostgrestError)(error);
         return (data ?? null);
     }
+    /**
+     * Deletes every audit row written before `cutoff` and says how many went - the daily
+     * retention cron. Every tenant at once: the period is the same for all of them. Batched by
+     * the internal identity, oldest first, so no single statement holds a long lock, and each
+     * delete is a range rather than a list of ids.
+     */
+    async purgeAuditLogsBefore(cutoff) {
+        // Supabase's default `max_rows`: a larger limit would come back short and end the loop early.
+        const batchSize = 1000;
+        let deleted = 0;
+        for (;;) {
+            const { data, error } = await this.supabase
+                .from('audit_logs')
+                .select('id')
+                .lt('created_at', cutoff)
+                .order('id', { ascending: true })
+                .limit(batchSize);
+            if (error)
+                throw (0, errors_1.mapPostgrestError)(error);
+            const batch = (data ?? []);
+            if (batch.length === 0)
+                return deleted;
+            const { error: deleteError } = await this.supabase
+                .from('audit_logs')
+                .delete()
+                .lt('created_at', cutoff)
+                .lte('id', batch[batch.length - 1].id);
+            if (deleteError)
+                throw (0, errors_1.mapPostgrestError)(deleteError);
+            deleted += batch.length;
+            if (batch.length < batchSize)
+                return deleted;
+        }
+    }
     /**
      * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
      * transaction id in its metadata, and the row is what says which tenant it belongs to.

package/dist/supporting-files/index.d.ts

@@ -11,6 +11,11 @@ export declare class SupportingFilesResource {
     private readonly table;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     getPresignedUrl(supportingFileId: string): Promise<SupportingFilePresignedUrl>;
+    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    getParent(supportingFileId: string): Promise<{
+        entity_type: SupportingFilesEntityTypes;
+        entity_id: string;
+    }>;
     list(entity: SupportingFilesEntityTypes, entityId: string): Promise<SupportingFileEntity[]>;
     /**
      * Where the caller puts each file: one signed upload URL per name, in request order, valid

package/dist/supporting-files/index.js

@@ -76,6 +76,18 @@ class SupportingFilesResource {
             throw (0, errors_1.mapStorageError)(signedError);
         return { url: signed.signedUrl, ttl: SIGNED_URL_TTL_SECONDS };
     }
+    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    async getParent(supportingFileId) {
+        const { data, error } = await this.supabase
+            .from('supporting_files')
+            .select('entity_type, entity_id')
+            .eq('mms_id', supportingFileId)
+            .eq('organization_id', this.auth.organization_id)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
     async list(entity, entityId) {
         const { data, error } = await this.supabase
             .from('supporting_files')

package/dist/tasks/index.d.ts

@@ -1,16 +1,18 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { TaskEntity, TaskSummary } from '@managemint-solutions/entities/tasks';
 import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { AddTaskLinkDto, CreateTaskDto, GetTasksDto, UpdateTaskDto } from './dto';
 export * from './dto';
 export declare class TasksResource {
     private readonly supabase;
     private readonly auth;
-    private readonly audit;
+    private readonly auditLog;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
+    constructor(supabase: TypedSupabaseClient, auth: AuthContext, auditLog: AuditResource);
     list(query: GetTasksDto): Promise<MmsList<TaskSummary>>;
     getById(taskId: string): Promise<TaskEntity>;
     create(input: CreateTaskDto): Promise<TaskEntity>;
@@ -43,11 +45,12 @@ export declare class TasksResource {
     private checkLabels;
     /**
      * Makes `labelIds` the task's whole label set. The join rows carry no audit of their own: the
-     * change is one UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
-     * only when the set actually moved - on a new task that entry is the record of the initial
-     * pinning. Only the difference is written, the new labels inserted before the dropped ones are
-     * deleted, so should the trigger still refuse one (a label deleted after `checkLabels`) the
-     * task's existing labels are untouched, and a label kept across an edit keeps its place.
+     * change is an UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
+     * only when the set actually moved - inside a request's audit batch it folds into the task's
+     * own entry for that save (`withAuditBatch`). Only the difference is written, the new labels
+     * inserted before the dropped ones are deleted, so should the trigger still refuse one (a label
+     * deleted after `checkLabels`) the task's existing labels are untouched, and a label kept
+     * across an edit keeps its place.
      */
     private setLabels;
 }

package/dist/tasks/index.js

@@ -124,16 +124,19 @@ const linkedTasks = (rows, linkType) => rows
 class TasksResource {
     supabase;
     auth;
-    audit;
+    auditLog;
     table;
-    constructor(supabase, auth, audit) {
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
+    constructor(supabase, auth, auditLog) {
         this.supabase = supabase;
         this.auth = auth;
-        this.audit = audit;
-        this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
+        this.auditLog = auditLog;
+        this.table = (0, audit_1.auditedTable)(supabase, auth, auditLog, {
             table: 'tasks',
             entityType: enum_3.AuditTrailEntityType.TASKS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_3.AuditTrailEntityType.TASKS);
     }
     async list(query) {
         const page = query.page;
@@ -356,7 +359,7 @@ class TasksResource {
             throw (0, errors_1.mapPostgrestError)(error);
         }
         const role = input.link_type === enum_1.TaskLinkType.CHILD ? 'subtask' : 'related';
-        await this.audit.record({
+        await this.auditLog.record({
             action: enum_3.AuditTrailAction.UPDATE,
             entityType: enum_3.AuditTrailEntityType.TASKS,
             entityId: taskId,
@@ -384,7 +387,7 @@ class TasksResource {
         }
         const madeHere = row.task_id === taskId;
         const role = row.link_type === enum_1.TaskLinkType.RELATED ? 'related' : madeHere ? 'subtask' : 'parent';
-        await this.audit.record({
+        await this.auditLog.record({
             action: enum_3.AuditTrailAction.UPDATE,
             entityType: enum_3.AuditTrailEntityType.TASKS,
             entityId: taskId,
@@ -421,11 +424,12 @@ class TasksResource {
     }
     /**
      * Makes `labelIds` the task's whole label set. The join rows carry no audit of their own: the
-     * change is one UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
-     * only when the set actually moved - on a new task that entry is the record of the initial
-     * pinning. Only the difference is written, the new labels inserted before the dropped ones are
-     * deleted, so should the trigger still refuse one (a label deleted after `checkLabels`) the
-     * task's existing labels are untouched, and a label kept across an edit keeps its place.
+     * change is an UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
+     * only when the set actually moved - inside a request's audit batch it folds into the task's
+     * own entry for that save (`withAuditBatch`). Only the difference is written, the new labels
+     * inserted before the dropped ones are deleted, so should the trigger still refuse one (a label
+     * deleted after `checkLabels`) the task's existing labels are untouched, and a label kept
+     * across an edit keeps its place.
      */
     async setLabels(taskId, labelIds) {
         const { data: current, error: readError } = await this.supabase
@@ -467,7 +471,7 @@ class TasksResource {
             if (error)
                 throw (0, errors_1.mapPostgrestError)(error);
         }
-        await this.audit.record({
+        await this.auditLog.record({
             action: enum_3.AuditTrailAction.UPDATE,
             entityType: enum_3.AuditTrailEntityType.TASKS,
             entityId: taskId,

package/dist/timesheets/timesheet-entries.js

@@ -59,6 +59,7 @@ class TimesheetEntriesResource {
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
             table: 'timesheet_entries',
             entityType: enum_1.AuditTrailEntityType.TIMESHEET_ENTRIES,
+            related: { entityType: enum_1.AuditTrailEntityType.TIMESHEETS, column: 'timesheet_id' },
         });
     }
     async getById(timesheetEntryId) {

package/dist/timesheets/timesheets.d.ts

@@ -2,7 +2,7 @@ import type { MmsList } from '@managemint-solutions/entities/common';
 import type { TimesheetEntity, TimesheetSummary } from '@managemint-solutions/entities/timesheets';
 import { TimesheetReviewDecision, TimesheetStatus } from '@managemint-solutions/entities/timesheets/enum';
 import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetTimesheetsDto } from './dto';
 /** What the entry path needs of the week an entry falls in: its id and whether it is still open. */
@@ -29,6 +29,8 @@ export declare class TimesheetsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     list(query: GetTimesheetsDto, options?: ListOptions): Promise<MmsList<TimesheetSummary>>;
     /** The week with its entries, by date then start time. */

package/dist/timesheets/timesheets.js

@@ -27,6 +27,8 @@ class TimesheetsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -34,6 +36,7 @@ class TimesheetsResource {
             table: 'timesheets',
             entityType: enum_1.AuditTrailEntityType.TIMESHEETS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.TIMESHEETS);
     }
     async list(query, options = {}) {
         const page = query.page;

package/dist/users/index.d.ts

@@ -1,6 +1,6 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { UserIdentity, UserSummary } from '@managemint-solutions/entities/users';
-import { type AuditActor, type AuditResource, type AuditRow } from '../audit';
+import { type AuditActor, type AuditResource, type AuditRow, EntityAuditTrail } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetUsersQueryDto } from './dto';
 export * from './dto';
@@ -24,6 +24,8 @@ export declare class UsersResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     list(query: GetUsersQueryDto): Promise<MmsList<UserSummary>>;
     getRow(userId: string): Promise<UserRow>;