@managemint-solutions/sdk 0.8.0 → 0.16.0

package/dist/audit/index.js

@@ -0,0 +1,308 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditedTable = exports.AuditResource = exports.snapshotChanges = exports.diffChanges = exports.AUDIT_EXCLUDED_COLUMNS = void 0;
+const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+/**
+ * Bookkeeping columns a diff never reports: identity, tenancy and the who/when stamps of the
+ * transition itself (the action already says what happened), plus the `entity_type`/`entity_id`
+ * pair, which becomes `related_entity_*` on the audit row instead.
+ */
+exports.AUDIT_EXCLUDED_COLUMNS = new Set([
+    'id',
+    'mms_id',
+    'organization_id',
+    'created_at',
+    'created_by',
+    'user_id',
+    'updated_at',
+    'last_updated_by',
+    'archived_at',
+    'archived_by',
+    'unarchived_at',
+    'unarchived_by',
+    'deleted_at',
+    'deleted_by',
+    'restored_at',
+    'restored_by',
+    'entity_type',
+    'entity_id',
+]);
+/** `undefined` and `null` are the same absent value as far as a row diff is concerned. */
+const normalize = (value) => value ?? null;
+/**
+ * The fields that differ between two flat rows, as `{ field: { old, new } }`. Values stay real
+ * JSON (booleans stay booleans, jsonb stays an object) and are compared by serialized value, so
+ * arrays and objects are equal when their contents are.
+ */
+const diffChanges = (before, after) => {
+    const changes = {};
+    for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+        if (exports.AUDIT_EXCLUDED_COLUMNS.has(key))
+            continue;
+        const oldValue = normalize(before[key]);
+        const newValue = normalize(after[key]);
+        if (JSON.stringify(oldValue) === JSON.stringify(newValue))
+            continue;
+        changes[key] = { old: oldValue, new: newValue };
+    }
+    return changes;
+};
+exports.diffChanges = diffChanges;
+/**
+ * A whole row as a change set — `'new'` for an insert, `'old'` for a hard delete — so the trail
+ * stays self-contained once the row is gone. Columns that hold nothing are left out.
+ */
+const snapshotChanges = (row, side) => {
+    const changes = {};
+    for (const [key, value] of Object.entries(row)) {
+        if (exports.AUDIT_EXCLUDED_COLUMNS.has(key) || value === null || value === undefined)
+            continue;
+        changes[key] = side === 'new' ? { old: null, new: value } : { old: value, new: null };
+    }
+    return changes;
+};
+exports.snapshotChanges = snapshotChanges;
+const AUDIT_TRAIL_SELECT = `
+        mms_id,
+        created_at,
+        action,
+        entity_type,
+        entity_id,
+        created_by:user_profiles!created_by (*),
+        related_entity_type,
+        related_entity_id,
+        changes
+      `;
+/**
+ * The `audit_logs` table. Reads are the audit trail endpoint; writes go through `record`, which
+ * every audited write calls for itself — no feature ever writes an audit line by hand.
+ */
+class AuditResource {
+    supabase;
+    actor;
+    onError;
+    constructor(supabase, actor, onError) {
+        this.supabase = supabase;
+        this.actor = actor;
+        this.onError = onError;
+    }
+    /**
+     * Writes the audit row(s) — one insert, however many entries. **Never throws**: a logging
+     * problem must not fail the business write, so a failure goes to `onAuditError`
+     * (default `console.error`) instead.
+     */
+    async record(entry) {
+        const entries = Array.isArray(entry) ? entry : [entry];
+        if (entries.length === 0)
+            return;
+        try {
+            const { error } = await this.supabase.from('audit_logs').insert(entries.map((item) => ({
+                created_by: this.actor.mms_id,
+                organization_id: this.actor.organization_id,
+                action: item.action,
+                entity_type: item.entityType,
+                entity_id: item.entityId,
+                related_entity_type: item.relatedEntityType ?? null,
+                related_entity_id: item.relatedEntityId ?? null,
+                changes: item.changes,
+            })));
+            if (error)
+                throw (0, errors_1.mapPostgrestError)(error);
+        }
+        catch (error) {
+            const handle = this.onError ?? ((thrown, failed) => console.error(thrown, failed));
+            handle(error, entries);
+        }
+    }
+    async list(query) {
+        const page = query.page;
+        const pageSize = query.page_size;
+        const offset = (page - 1) * pageSize;
+        // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
+        // filters below can be reassigned onto it without a cast.
+        let auditTrailQuery = this.supabase
+            .from('audit_logs')
+            .select(AUDIT_TRAIL_SELECT, { count: 'estimated' })
+            .eq('organization_id', this.actor.organization_id)
+            .order('created_at', { ascending: false })
+            .range(offset, offset + pageSize - 1);
+        if (query.created_after) {
+            auditTrailQuery = auditTrailQuery.gte('created_at', query.created_after);
+        }
+        if (query.created_before) {
+            auditTrailQuery = auditTrailQuery.lte('created_at', query.created_before);
+        }
+        if (query.created_by) {
+            auditTrailQuery = auditTrailQuery.eq('created_by', query.created_by);
+        }
+        if (query.action) {
+            auditTrailQuery = auditTrailQuery.eq('action', query.action);
+        }
+        if (query.entity_type) {
+            auditTrailQuery = auditTrailQuery.eq('entity_type', query.entity_type);
+        }
+        if (query.entity_id) {
+            auditTrailQuery = auditTrailQuery.eq('entity_id', query.entity_id);
+        }
+        const { data, error, count } = await auditTrailQuery;
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const totalEstimated = count ?? 0;
+        const totalPages = totalEstimated > 0 ? Math.ceil(totalEstimated / pageSize) : 0;
+        return {
+            results: (data ?? []),
+            page,
+            per_page: pageSize,
+            count: totalEstimated,
+            total_pages: totalPages,
+            has_next_page: page < totalPages,
+            has_previous_page: page > 1,
+        };
+    }
+}
+exports.AuditResource = AuditResource;
+/** The keyed update every audited write builds, before any caller-supplied guard. */
+const buildUpdate = (supabase, table, id, payload, organizationId) => {
+    // `eq` returns `this`, so the org filter can be reassigned onto the builder without a cast.
+    let query = supabase.from(table).update(payload).eq('mms_id', id);
+    if (organizationId !== null)
+        query = query.eq('organization_id', organizationId);
+    return query;
+};
+/**
+ * The audited write helper every resource writes through: it does the pre-read, the write, the
+ * diff and the `audit_logs` insert itself, so no feature carries audit code. The write fails
+ * loudly (`SupabaseClientError`); only the audit insert is swallowed.
+ */
+const auditedTable = (supabase, actor, audit, options) => {
+    const scoped = options.scopeByOrganization !== false;
+    // Tables that hang off another entity (notes, additional details, supporting files) carry the
+    // owner in `entity_type`/`entity_id`; the audit row records it as the related entity.
+    const relatedOf = (row) => ({
+        relatedEntityType: row.entity_type ?? null,
+        relatedEntityId: row.entity_id ?? null,
+    });
+    const read = async (id) => {
+        // `eq` returns `this`, so the org filter can be reassigned onto the builder without a cast.
+        let query = supabase.from(options.table).select('*').eq('mms_id', id);
+        if (scoped)
+            query = query.eq('organization_id', actor.organization_id);
+        const { data, error } = await query.single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    };
+    const organizationFilter = scoped ? actor.organization_id : null;
+    const updateOf = (id, before, payload) => buildUpdate(supabase, options.table, id, typeof payload === 'function' ? payload(before) : payload, organizationFilter);
+    const recordWrite = (id, action, before, after) => audit.record({
+        action,
+        entityType: options.entityType,
+        entityId: id,
+        changes: (0, exports.diffChanges)(before, after),
+        ...relatedOf(before),
+    });
+    const write = async (id, action, payload) => {
+        const before = await read(id);
+        const { data, error } = await updateOf(id, before, payload).select('*').single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const after = data;
+        await recordWrite(id, action, before, after);
+        return after;
+    };
+    const writeWhere = async (id, guard, payload) => {
+        const before = await read(id);
+        // `maybeSingle`, not `single`: matching nothing is the guard doing its job, not an error.
+        const { data, error } = await guard(updateOf(id, before, payload))
+            .select('*')
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        // The guard lost the race — the row is untouched, so there is nothing to audit.
+        if (!data)
+            return null;
+        const after = data;
+        await recordWrite(id, enum_1.AuditTrailAction.UPDATE, before, after);
+        return after;
+    };
+    return {
+        async insert(payload) {
+            const { data, error } = await supabase
+                .from(options.table)
+                .insert(payload)
+                .select('*')
+                .single();
+            if (error)
+                throw (0, errors_1.mapPostgrestError)(error);
+            const row = data;
+            await audit.record({
+                action: enum_1.AuditTrailAction.INSERT,
+                entityType: options.entityType,
+                entityId: row.mms_id,
+                changes: (0, exports.snapshotChanges)(row, 'new'),
+                ...relatedOf(row),
+            });
+            return row;
+        },
+        async insertMany(payloads) {
+            if (payloads.length === 0)
+                return [];
+            const { data, error } = await supabase.from(options.table).insert(payloads).select('*');
+            if (error)
+                throw (0, errors_1.mapPostgrestError)(error);
+            const rows = (data ?? []);
+            await audit.record(rows.map((row) => ({
+                action: enum_1.AuditTrailAction.INSERT,
+                entityType: options.entityType,
+                entityId: row.mms_id,
+                changes: (0, exports.snapshotChanges)(row, 'new'),
+                ...relatedOf(row),
+            })));
+            return rows;
+        },
+        update(id, payload) {
+            return write(id, enum_1.AuditTrailAction.UPDATE, payload);
+        },
+        updateWhere(id, guard, payload) {
+            return writeWhere(id, guard, payload);
+        },
+        transition(id, action, payload) {
+            return write(id, action, payload);
+        },
+        async remove(id) {
+            const before = await read(id);
+            let query = supabase.from(options.table).delete().eq('mms_id', id);
+            if (scoped)
+                query = query.eq('organization_id', actor.organization_id);
+            const { error } = await query;
+            if (error)
+                throw (0, errors_1.mapPostgrestError)(error);
+            await audit.record({
+                action: enum_1.AuditTrailAction.DELETE,
+                entityType: options.entityType,
+                entityId: id,
+                changes: (0, exports.snapshotChanges)(before, 'old'),
+                ...relatedOf(before),
+            });
+            return before;
+        },
+    };
+};
+exports.auditedTable = auditedTable;
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAEA,0EAGyD;AAEzD,sCAA8C;AAG9C,wCAAsB;AAyBtB;;;;GAIG;AACU,QAAA,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,IAAI;IACJ,QAAQ;IACR,iBAAiB;IACjB,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAE7D;;;;GAIG;AACI,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAE,KAAe,EAAgB,EAAE;IAC7E,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,8BAAsB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAE9C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAdW,QAAA,WAAW,eActB;AAEF;;;GAGG;AACI,MAAM,eAAe,GAAG,CAAC,GAAa,EAAE,IAAmB,EAAgB,EAAE;IAClF,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,8BAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACvF,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxF,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;;OAUX,CAAC;AAEjB;;;GAGG;AACH,MAAa,aAAa;IAEL;IACA;IACA;IAHnB,YACmB,QAA0B,EAC1B,KAAiB,EACjB,OAA2B;QAF3B,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,UAAK,GAAL,KAAK,CAAY;QACjB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,KAAgC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;gBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,UAAU;gBAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;gBACnD,iBAAiB,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;gBAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC,CACJ,CAAC;YACF,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAe,EAAE,MAAoB,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAuB;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;QAErC,2FAA2F;QAC3F,0DAA0D;QAC1D,IAAI,eAAe,GAAG,IAAI,CAAC,QAAQ;aAChC,IAAI,CAAC,YAAY,CAAC;aAClB,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAClD,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;aACzC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;QAExC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,eAAe,GAAG,eAAe,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC;QACrD,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,cAAc,GAAG,KAAK,IAAI,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,OAAO;YACL,OAAO,EAAE,CAAC,IAAI,IAAI,EAAE,CAAkC;YACtD,IAAI;YACJ,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,IAAI,GAAG,UAAU;YAChC,iBAAiB,EAAE,IAAI,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC;CACF;AA3FD,sCA2FC;AAeD,qFAAqF;AACrF,MAAM,WAAW,GAAG,CAClB,QAA0B,EAC1B,KAAa,EACb,EAAU,EACV,OAAiB,EACjB,cAA6B,EAC7B,EAAE;IACF,4FAA4F;IAC5F,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,cAAc,KAAK,IAAI;QAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AA2BF;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAC1B,QAA0B,EAC1B,KAAiB,EACjB,KAAoB,EACpB,OAA4B,EACd,EAAE;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC;IAErD,8FAA8F;IAC9F,sFAAsF;IACtF,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,CAAC;QACpC,iBAAiB,EAAG,GAAG,CAAC,WAAyC,IAAI,IAAI;QACzE,eAAe,EAAG,GAAG,CAAC,SAAuC,IAAI,IAAI;KACtE,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAqB,EAAE;QACnD,4FAA4F;QAC5F,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM;YAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAEvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,IAAgB,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,MAAgB,EAAE,OAAuB,EAAE,EAAE,CACzE,WAAW,CACT,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,EAAE,EACF,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EACzD,kBAAkB,CACnB,CAAC;IAEJ,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,MAAwB,EAAE,MAAgB,EAAE,KAAe,EAAE,EAAE,CAC9F,KAAK,CAAC,MAAM,CAAC;QACX,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAA,mBAAW,EAAC,MAAM,EAAE,KAAK,CAAC;QACnC,GAAG,SAAS,CAAC,MAAM,CAAC;KACrB,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,KAAK,EACjB,EAAU,EACV,MAAwB,EACxB,OAAuB,EACJ,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACjF,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAgB,CAAC;QAE/B,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE7C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EACtB,EAAU,EACV,KAAiB,EACjB,OAAuB,EACG,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAE9B,0FAA0F;QAC1F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aAC/D,MAAM,CAAC,GAAG,CAAC;aACX,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAC1C,gFAAgF;QAChF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAgB,CAAC;QAE/B,MAAM,WAAW,CAAC,EAAE,EAAE,uBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE9D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;iBACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnB,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAgB,CAAC;YAE7B,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,GAAG,CAAC,MAAgB;gBAC9B,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,GAAG,SAAS,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxF,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAe,CAAC;YAExC,MAAM,KAAK,CAAC,MAAM,CAChB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,GAAG,CAAC,MAAgB;gBAC9B,OAAO,EAAE,IAAA,uBAAe,EAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,GAAG,SAAS,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC,CACJ,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,EAAE,EAAE,OAAO;YAChB,OAAO,KAAK,CAAC,EAAE,EAAE,uBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO;YAC5B,OAAO,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO;YAC5B,OAAO,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;YAE9B,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM;gBAAE,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YAEvE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC;YAC9B,IAAI,KAAK;gBAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;YAE1C,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,uBAAgB,CAAC,MAAM;gBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,IAAA,uBAAe,EAAC,MAAM,EAAE,KAAK,CAAC;gBACvC,GAAG,SAAS,CAAC,MAAM,CAAC;aACrB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA3JW,QAAA,YAAY,gBA2JvB"}

package/dist/billing/dto.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The client supplies the idempotency key for every money operation
+ * (docs/billing/00-overview.md principle 1). A uuid v4 keeps it unique per
+ * (organization, key) without the API having to hand one out first.
+ */
+export declare class InitialPaymentDto {
+    readonly idempotency_key: string;
+}
+/**
+ * Cancellation moves no money, but it is a subscription-level operation and
+ * carries a key like every other one, so a client retry after a dropped
+ * connection replays the original answer (docs/billing/09-cancellation.md).
+ */
+export declare class CancelSubscriptionDto {
+    readonly idempotency_key: string;
+}
+/**
+ * A reinstatement may or may not move money - the caller cannot know which
+ * branch it will get - so the key is always required
+ * (docs/billing/10-reinstatement.md).
+ */
+export declare class ReinstateSubscriptionDto {
+    readonly idempotency_key: string;
+}
+/**
+ * A purchase names the module by *id*, which is checked against the active
+ * pricebook - never a module key from a hardcoded enum
+ * (docs/billing/07-modules-and-pricebooks.md section 2).
+ */
+export declare class PurchaseModuleDto {
+    readonly module_id: string;
+    readonly idempotency_key: string;
+}

package/dist/billing/dto.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PurchaseModuleDto = exports.ReinstateSubscriptionDto = exports.CancelSubscriptionDto = exports.InitialPaymentDto = void 0;
+const class_validator_1 = require("class-validator");
+/**
+ * The client supplies the idempotency key for every money operation
+ * (docs/billing/00-overview.md principle 1). A uuid v4 keeps it unique per
+ * (organization, key) without the API having to hand one out first.
+ */
+class InitialPaymentDto {
+    idempotency_key;
+}
+exports.InitialPaymentDto = InitialPaymentDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'An idempotency key is required and must be a v4 uuid' }),
+    __metadata("design:type", String)
+], InitialPaymentDto.prototype, "idempotency_key", void 0);
+/**
+ * Cancellation moves no money, but it is a subscription-level operation and
+ * carries a key like every other one, so a client retry after a dropped
+ * connection replays the original answer (docs/billing/09-cancellation.md).
+ */
+class CancelSubscriptionDto {
+    idempotency_key;
+}
+exports.CancelSubscriptionDto = CancelSubscriptionDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'An idempotency key is required and must be a v4 uuid' }),
+    __metadata("design:type", String)
+], CancelSubscriptionDto.prototype, "idempotency_key", void 0);
+/**
+ * A reinstatement may or may not move money - the caller cannot know which
+ * branch it will get - so the key is always required
+ * (docs/billing/10-reinstatement.md).
+ */
+class ReinstateSubscriptionDto {
+    idempotency_key;
+}
+exports.ReinstateSubscriptionDto = ReinstateSubscriptionDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'An idempotency key is required and must be a v4 uuid' }),
+    __metadata("design:type", String)
+], ReinstateSubscriptionDto.prototype, "idempotency_key", void 0);
+/**
+ * A purchase names the module by *id*, which is checked against the active
+ * pricebook - never a module key from a hardcoded enum
+ * (docs/billing/07-modules-and-pricebooks.md section 2).
+ */
+class PurchaseModuleDto {
+    module_id;
+    idempotency_key;
+}
+exports.PurchaseModuleDto = PurchaseModuleDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'A module id is required and must be a v4 uuid' }),
+    __metadata("design:type", String)
+], PurchaseModuleDto.prototype, "module_id", void 0);
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'An idempotency key is required and must be a v4 uuid' }),
+    __metadata("design:type", String)
+], PurchaseModuleDto.prototype, "idempotency_key", void 0);
+//# sourceMappingURL=dto.js.map

package/dist/billing/dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.js","sourceRoot":"","sources":["../../src/billing/dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAyC;AAEzC;;;;GAIG;AACH,MAAa,iBAAiB;IAEnB,eAAe,CAAU;CACnC;AAHD,8CAGC;AADU;IADR,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;;0DAC/C;AAGpC;;;;GAIG;AACH,MAAa,qBAAqB;IAEvB,eAAe,CAAU;CACnC;AAHD,sDAGC;AADU;IADR,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;;8DAC/C;AAGpC;;;;GAIG;AACH,MAAa,wBAAwB;IAE1B,eAAe,CAAU;CACnC;AAHD,4DAGC;AADU;IADR,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;;iEAC/C;AAGpC;;;;GAIG;AACH,MAAa,iBAAiB;IAEnB,SAAS,CAAU;IAGnB,eAAe,CAAU;CACnC;AAND,8CAMC;AAJU;IADR,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;;oDAC9C;AAGnB;IADR,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;;0DAC/C"}

package/dist/billing/index.d.ts

@@ -0,0 +1,35 @@
+import type { BillingTransactionRow, CreateBillingEventDto } from '@managemint-solutions/entities/billing';
+import { type AuditActor, type AuditResource, type AuditRow } from '../audit';
+import type { TypedSupabaseClient } from '../client';
+export * from './dto';
+/**
+ * The ledger and its narrative log. Every policy here is `false` for `authenticated` except
+ * READ, so this only ever runs on the service client — the ledger is written by the billing
+ * service and by webhooks, never by a caller.
+ */
+export declare class BillingResource {
+    private readonly supabase;
+    private readonly actor;
+    private readonly transactions;
+    constructor(supabase: TypedSupabaseClient, actor: AuditActor, audit: AuditResource);
+    createTransaction(payload: AuditRow): Promise<BillingTransactionRow>;
+    updateTransaction(transactionId: string, patch: AuditRow): Promise<AuditRow>;
+    /**
+     * Claims a transaction for processing, but only while it is not already paid. This is the
+     * send-exactly-once gate on the webhook path: a redelivered `charge.success` must not settle
+     * the same row twice. Resolves to null when the guard finds it already settled.
+     */
+    claimTransactionForProcessing(transactionId: string, patch: AuditRow): Promise<AuditRow | null>;
+    getTransaction(transactionId: string): Promise<BillingTransactionRow | null>;
+    /** The one open transaction, if the organization has one. */
+    openTransaction(openStatuses: string[]): Promise<BillingTransactionRow | null>;
+    /** The replay lookup: the same key must never raise a second charge. */
+    transactionByIdempotencyKey(idempotencyKey: string): Promise<BillingTransactionRow | null>;
+    /**
+     * Appends to `billing_events`. Deliberately unaudited: the table *is* an append-only
+     * narrative of the billing state machine, so an audit row per event would log the log.
+     */
+    recordEvent(event: CreateBillingEventDto): Promise<void>;
+    /** Whether a catalog module is still on sale. */
+    isModuleActive(moduleId: string): Promise<boolean>;
+}

package/dist/billing/index.js

@@ -0,0 +1,115 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BillingResource = void 0;
+const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
+const enum_2 = require("@managemint-solutions/entities/billing/enum");
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+const BILLING_TRANSACTIONS_TABLE = {
+    table: 'billing_transactions',
+    entityType: enum_1.AuditTrailEntityType.BILLING_TRANSACTIONS,
+};
+/**
+ * The ledger and its narrative log. Every policy here is `false` for `authenticated` except
+ * READ, so this only ever runs on the service client — the ledger is written by the billing
+ * service and by webhooks, never by a caller.
+ */
+class BillingResource {
+    supabase;
+    actor;
+    transactions;
+    constructor(supabase, actor, audit) {
+        this.supabase = supabase;
+        this.actor = actor;
+        this.transactions = (0, audit_1.auditedTable)(supabase, actor, audit, BILLING_TRANSACTIONS_TABLE);
+    }
+    async createTransaction(payload) {
+        const row = await this.transactions.insert(payload);
+        return row;
+    }
+    async updateTransaction(transactionId, patch) {
+        return this.transactions.update(transactionId, {
+            ...patch,
+            updated_at: new Date().toISOString(),
+        });
+    }
+    /**
+     * Claims a transaction for processing, but only while it is not already paid. This is the
+     * send-exactly-once gate on the webhook path: a redelivered `charge.success` must not settle
+     * the same row twice. Resolves to null when the guard finds it already settled.
+     */
+    async claimTransactionForProcessing(transactionId, patch) {
+        return this.transactions.updateWhere(transactionId, (query) => query.neq('transaction_status', enum_2.BillingTransactionStatus.PAID), { ...patch, updated_at: new Date().toISOString() });
+    }
+    async getTransaction(transactionId) {
+        const { data, error } = await this.supabase
+            .from('billing_transactions')
+            .select('*')
+            .eq('mms_id', transactionId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /** The one open transaction, if the organization has one. */
+    async openTransaction(openStatuses) {
+        const { data, error } = await this.supabase
+            .from('billing_transactions')
+            .select('*')
+            .eq('organization_id', this.actor.organization_id)
+            .in('transaction_status', openStatuses)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /** The replay lookup: the same key must never raise a second charge. */
+    async transactionByIdempotencyKey(idempotencyKey) {
+        const { data, error } = await this.supabase
+            .from('billing_transactions')
+            .select('*')
+            .eq('organization_id', this.actor.organization_id)
+            .eq('idempotency_key', idempotencyKey)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /**
+     * Appends to `billing_events`. Deliberately unaudited: the table *is* an append-only
+     * narrative of the billing state machine, so an audit row per event would log the log.
+     */
+    async recordEvent(event) {
+        const { error } = await this.supabase.from('billing_events').insert(event);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+    /** Whether a catalog module is still on sale. */
+    async isModuleActive(moduleId) {
+        const { data, error } = await this.supabase
+            .from('billing_modules')
+            .select('active')
+            .eq('mms_id', moduleId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data?.active === true;
+    }
+}
+exports.BillingResource = BillingResource;
+//# sourceMappingURL=index.js.map

package/dist/billing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/billing/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0EAAuF;AAEvF,sEAAuF;AACvF,oCAMkB;AAElB,sCAA8C;AAE9C,wCAAsB;AAEtB,MAAM,0BAA0B,GAAG;IACjC,KAAK,EAAE,sBAAsB;IAC7B,UAAU,EAAE,2BAAoB,CAAC,oBAAoB;CAC7C,CAAC;AAEX;;;;GAIG;AACH,MAAa,eAAe;IAIP;IACA;IAJF,YAAY,CAAe;IAE5C,YACmB,QAA6B,EAC7B,KAAiB,EAClC,KAAoB;QAFH,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,UAAK,GAAL,KAAK,CAAY;QAGlC,IAAI,CAAC,YAAY,GAAG,IAAA,oBAAY,EAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAiB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO,GAAuC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,aAAqB,EAAE,KAAe;QAC5D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE;YAC7C,GAAG,KAAK;YACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,aAAqB,EACrB,KAAe;QAEf,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,+BAAwB,CAAC,IAAI,CAAC,EACzE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,aAAqB;QACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;aAC3B,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAiC,CAAC;IACxD,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,eAAe,CAAC,YAAsB;QAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;aACtC,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAiC,CAAC;IACxD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,2BAA2B,CAC/B,cAAsB;QAEtB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,sBAAsB,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;aACjD,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;aACrC,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,IAAI,IAAI,IAAI,CAAiC,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ;aACxC,IAAI,CAAC,iBAAiB,CAAC;aACvB,MAAM,CAAC,QAAQ,CAAC;aAChB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;aACtB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;QAE1C,OAAQ,IAAmC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,CAAC;CACF;AAnGD,0CAmGC"}

package/dist/client.d.ts

@@ -1,24 +1,36 @@
 import { type SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
 import { type AuthContext } from './auth';
+import { AuditResource, type AuditErrorHandler } from './audit';
 import { AdditionalDetailsResource } from './additional-details';
 import { ClientsResource } from './clients';
 import { NotesResource } from './notes';
+import { NotificationsResource } from './notifications';
+import { OrganizationsResource } from './organizations';
+import { PermissionsResource } from './permissions';
 import { ProjectsResource } from './projects';
 import { StatusesResource } from './statuses';
 import { SupportingFilesResource } from './supporting-files';
 import { TasksResource } from './tasks';
+import { UsersResource } from './users';
 export type TypedSupabaseClient = SupabaseJsClient;
 export type SupabaseClientConfig = {
     url: string;
     key: string;
     accessToken: string;
+    /** Where a failed audit insert is reported. Defaults to `console.error`. */
+    onAuditError?: AuditErrorHandler;
 };
 export declare class SupabaseClient {
     readonly supabase: TypedSupabaseClient;
     readonly auth: AuthContext;
+    readonly audit: AuditResource;
     readonly statuses: StatusesResource;
     readonly additionalDetails: AdditionalDetailsResource;
     readonly notes: NotesResource;
+    readonly notifications: NotificationsResource;
+    readonly organizations: OrganizationsResource;
+    readonly permissions: PermissionsResource;
+    readonly users: UsersResource;
     readonly supportingFiles: SupportingFilesResource;
     readonly clients: ClientsResource;
     readonly projects: ProjectsResource;