@tumbaland/backend-core 1.38.0 → 1.40.0

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjD,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC5F,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAuditEvents = exports.resourceOf = exports.countRead = exports.auditReads = exports.auditPlugin = exports.withAuditContext = exports.currentAuditContext = exports.beginAudit = exports.auditContext = exports.AuditEvent = exports.describeActor = exports.actorOf = void 0;
+var actor_1 = require("./actor");
+Object.defineProperty(exports, "actorOf", { enumerable: true, get: function () { return actor_1.actorOf; } });
+Object.defineProperty(exports, "describeActor", { enumerable: true, get: function () { return actor_1.describeActor; } });
+var AuditEvent_1 = require("./AuditEvent");
+Object.defineProperty(exports, "AuditEvent", { enumerable: true, get: function () { return AuditEvent_1.AuditEvent; } });
+var context_1 = require("./context");
+Object.defineProperty(exports, "auditContext", { enumerable: true, get: function () { return context_1.auditContext; } });
+Object.defineProperty(exports, "beginAudit", { enumerable: true, get: function () { return context_1.beginAudit; } });
+Object.defineProperty(exports, "currentAuditContext", { enumerable: true, get: function () { return context_1.currentAuditContext; } });
+Object.defineProperty(exports, "withAuditContext", { enumerable: true, get: function () { return context_1.withAuditContext; } });
+var plugin_1 = require("./plugin");
+Object.defineProperty(exports, "auditPlugin", { enumerable: true, get: function () { return plugin_1.auditPlugin; } });
+var reads_1 = require("./reads");
+Object.defineProperty(exports, "auditReads", { enumerable: true, get: function () { return reads_1.auditReads; } });
+Object.defineProperty(exports, "countRead", { enumerable: true, get: function () { return reads_1.countRead; } });
+Object.defineProperty(exports, "resourceOf", { enumerable: true, get: function () { return reads_1.resourceOf; } });
+var service_1 = require("./service");
+Object.defineProperty(exports, "listAuditEvents", { enumerable: true, get: function () { return service_1.listAuditEvents; } });
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":";;;AAAA,iCAAiD;AAAxC,gGAAA,OAAO,OAAA;AAAE,sGAAA,aAAa,OAAA;AAE/B,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAEnB,qCAA4F;AAAnF,uGAAA,YAAY,OAAA;AAAE,qGAAA,UAAU,OAAA;AAAE,8GAAA,mBAAmB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAExE,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AAEpB,iCAA4D;AAAnD,mGAAA,UAAU,OAAA;AAAE,kGAAA,SAAS,OAAA;AAAE,mGAAA,UAAU,OAAA;AAC1C,qCAA4C;AAAnC,0GAAA,eAAe,OAAA"}

package/dist/audit/plugin.d.ts

@@ -0,0 +1,23 @@
+import type { Schema } from 'mongoose';
+export interface AuditPluginOptions {
+    /** what these documents are called in a trail — 'activity', 'photo' */
+    resource: string;
+    /** fields never worth recording the content of */
+    redact?: string[];
+}
+/**
+ * Attribute and record every write to a collection.
+ *
+ * Applied to a model rather than called from its controllers, for two reasons.
+ * The data layer is the only place that knows which fields actually changed —
+ * a controller sees the patch that was requested, not the difference it made,
+ * and those differ whenever a field was already the value being set. And a
+ * plugin cannot be forgotten: a new endpoint that writes through the model is
+ * audited without anyone remembering to add a line.
+ *
+ * Writes made outside a request — a migration, a backfill script — find no
+ * actor and are recorded as nothing, which is honest. A row claiming a script
+ * was a person would be worse than no row.
+ */
+export declare function auditPlugin(schema: Schema, options: AuditPluginOptions): void;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/audit/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/audit/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAS,MAAM,EAAE,MAAM,UAAU,CAAC;AA6D9C,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CA2K7E"}

package/dist/audit/plugin.js

@@ -0,0 +1,226 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditPlugin = auditPlugin;
+const logger_1 = __importDefault(require("../logging/logger"));
+const AuditEvent_1 = require("./AuditEvent");
+const context_1 = require("./context");
+/** Bookkeeping fields nobody wants to read in a change list. */
+const NOISE = new Set(['updatedAt', 'createdAt', '__v', 'createdBy', 'updatedBy']);
+/**
+ * Where a hook stashes what it read before the write.
+ *
+ * A symbol on the query object, not `query.set()` — that method writes into the
+ * *update payload*, so stashing there would persist the before-image into the
+ * document it was taken of. Per-query, so concurrent writes cannot read each
+ * other's.
+ */
+const BEFORE = Symbol('auditBefore');
+/** Comparable form, so a Date and an ObjectId do not read as changed every time. */
+const plain = (value) => {
+    if (value === null || value === undefined)
+        return value;
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === 'object' && 'toHexString' in value)
+        return String(value);
+    return value;
+};
+const changesBetween = (before, after, fields) => {
+    const changes = {};
+    for (const field of fields) {
+        if (NOISE.has(field))
+            continue;
+        const from = plain(before?.[field]);
+        const to = plain(after?.[field]);
+        if (JSON.stringify(from) !== JSON.stringify(to))
+            changes[field] = { from, to };
+    }
+    return Object.keys(changes).length > 0 ? changes : undefined;
+};
+/**
+ * Never let recording a thing fail the thing.
+ *
+ * An audit trail is worth having and is not worth refusing a write over: a
+ * failure here means someone loses a row of history, and throwing would mean
+ * they lose the entry they were logging. So it is fire-and-forget with the
+ * failure written to the ordinary log, where an operator sees it.
+ */
+const record = (event) => {
+    void AuditEvent_1.AuditEvent.create(event).catch((error) => {
+        logger_1.default.warn('Could not record an audit event', {
+            error: error?.message,
+            action: event.action,
+            resource: event.resource
+        });
+    });
+};
+/**
+ * Attribute and record every write to a collection.
+ *
+ * Applied to a model rather than called from its controllers, for two reasons.
+ * The data layer is the only place that knows which fields actually changed —
+ * a controller sees the patch that was requested, not the difference it made,
+ * and those differ whenever a field was already the value being set. And a
+ * plugin cannot be forgotten: a new endpoint that writes through the model is
+ * audited without anyone remembering to add a line.
+ *
+ * Writes made outside a request — a migration, a backfill script — find no
+ * actor and are recorded as nothing, which is honest. A row claiming a script
+ * was a person would be worse than no row.
+ */
+function auditPlugin(schema, options) {
+    const { resource, redact = [] } = options;
+    const hide = new Set(redact);
+    const visible = (doc) => Object.fromEntries(Object.entries(doc)
+        .filter(([key]) => !NOISE.has(key) && !hide.has(key))
+        .map(([key, value]) => [key, plain(value)]));
+    // Who last touched this, on the record itself. Denormalized on purpose: a day
+    // view showing "logged by Claude" should not have to query a second
+    // collection for every row it renders.
+    schema.add({
+        createdBy: { type: String },
+        updatedBy: { type: String }
+    });
+    schema.pre('save', async function () {
+        const context = (0, context_1.currentAuditContext)();
+        if (!context)
+            return;
+        const label = context.actor.label;
+        if (this.isNew)
+            this.set('createdBy', label);
+        this.set('updatedBy', label);
+        // `isNew` is false by the time the post hook runs, so it is carried here.
+        // Recording every save as a create was the original mistake: any code that
+        // loads a document, changes a field and saves it — revoking an API key,
+        // counting a reveal — would appear in the trail as the thing being created
+        // again, with a fresh snapshot and no sign of what actually changed.
+        this.$locals.auditWasNew = this.isNew;
+        if (this.isNew)
+            return;
+        this.$locals.auditPaths = this.modifiedPaths().filter((path) => !NOISE.has(path));
+        this.$locals.auditBefore = await this.constructor
+            .findById(this._id)
+            .lean();
+    });
+    schema.post('save', function (doc) {
+        const context = (0, context_1.currentAuditContext)();
+        if (!context)
+            return;
+        const common = {
+            at: new Date(),
+            service: context.service,
+            resource,
+            resourceId: String(doc._id),
+            actorKind: context.actor.kind,
+            userId: context.actor.userId,
+            actorLabel: context.actor.label,
+            actorCredentialId: context.actor.credentialId,
+            tenant: context.actor.tenant
+        };
+        if (doc.$locals.auditWasNew) {
+            record({ ...common, action: 'create', snapshot: visible(doc.toObject()) });
+            return;
+        }
+        const before = (doc.$locals.auditBefore ?? {});
+        const paths = (doc.$locals.auditPaths ?? []);
+        const changes = changesBetween(before, doc.toObject(), paths);
+        if (!changes)
+            return;
+        record({ ...common, action: 'update', changes });
+    });
+    // The document as it stood, fetched before the write so there is something to
+    // compare against. Held on the query, which is per-operation, so concurrent
+    // updates cannot read each other's.
+    schema.pre('findOneAndUpdate', async function () {
+        const context = (0, context_1.currentAuditContext)();
+        if (!context)
+            return;
+        this[BEFORE] = await this.model
+            .findOne(this.getQuery())
+            .lean();
+        // This one genuinely belongs in the update: it is a field on the document.
+        this.set('updatedBy', context.actor.label);
+    });
+    schema.post('findOneAndUpdate', function (doc) {
+        const context = (0, context_1.currentAuditContext)();
+        if (!context || !doc)
+            return;
+        const before = (this[BEFORE] ?? {});
+        const after = doc.toObject ? doc.toObject() : doc;
+        // Only the fields the update touched: comparing everything would report a
+        // change on any field a concurrent write happened to move.
+        const update = (this.getUpdate() ?? {});
+        const touched = Object.keys(update.$set ?? update);
+        const changes = changesBetween(before, after, touched);
+        if (!changes)
+            return;
+        record({
+            at: new Date(),
+            service: context.service,
+            action: 'update',
+            resource,
+            resourceId: String(doc._id),
+            actorKind: context.actor.kind,
+            userId: context.actor.userId,
+            actorLabel: context.actor.label,
+            actorCredentialId: context.actor.credentialId,
+            tenant: context.actor.tenant,
+            changes
+        });
+    });
+    schema.post('findOneAndDelete', function (doc) {
+        const context = (0, context_1.currentAuditContext)();
+        if (!context || !doc)
+            return;
+        record({
+            at: new Date(),
+            service: context.service,
+            action: 'delete',
+            resource,
+            resourceId: String(doc._id),
+            actorKind: context.actor.kind,
+            userId: context.actor.userId,
+            actorLabel: context.actor.label,
+            actorCredentialId: context.actor.credentialId,
+            tenant: context.actor.tenant,
+            // The whole document, because a delete is the one action whose record is
+            // the only remaining copy of what was there.
+            snapshot: visible(doc.toObject ? doc.toObject() : doc)
+        });
+    });
+    // Bulk deletes are read back first, one row each. A day's save deletes the
+    // entries it is replacing, and "the day editor removed three things" is
+    // exactly the change someone would come here to find.
+    schema.pre('deleteMany', async function () {
+        if (!(0, context_1.currentAuditContext)())
+            return;
+        this[BEFORE] = await this.model
+            .find(this.getQuery())
+            .lean();
+    });
+    schema.post('deleteMany', function () {
+        const context = (0, context_1.currentAuditContext)();
+        if (!context)
+            return;
+        const doomed = (this[BEFORE] ?? []);
+        for (const doc of doomed) {
+            record({
+                at: new Date(),
+                service: context.service,
+                action: 'delete',
+                resource,
+                resourceId: String(doc._id),
+                actorKind: context.actor.kind,
+                userId: context.actor.userId,
+                actorLabel: context.actor.label,
+                actorCredentialId: context.actor.credentialId,
+                tenant: context.actor.tenant,
+                snapshot: visible(doc)
+            });
+        }
+    });
+}
+//# sourceMappingURL=plugin.js.map

package/dist/audit/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/audit/plugin.ts"],"names":[],"mappings":";;;;;AAkFA,kCA2KC;AA5PD,+DAAuC;AACvC,6CAA0C;AAC1C,uCAAgD;AAEhD,gEAAgE;AAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AAErC,oFAAoF;AACpF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAW,EAAE;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,IAAK,KAAgB;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,MAA+B,EAC/B,KAA8B,EAC9B,MAAgB,EAC4C,EAAE;IAC9D,MAAM,OAAO,GAAmD,EAAE,CAAC;IAEnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,CAAC,KAA8B,EAAQ,EAAE;IACtD,KAAK,uBAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,gBAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC7C,KAAK,EAAG,KAAe,EAAE,OAAO;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AASF;;;;;;;;;;;;;GAaG;AACH,SAAgB,WAAW,CAAC,MAAc,EAAE,OAA2B;IACrE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7B,MAAM,OAAO,GAAG,CAAC,GAA4B,EAA2B,EAAE,CACxE,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAC9C,CAAC;IAEJ,8EAA8E;IAC9E,oEAAoE;IACpE,uCAAuC;IACvC,MAAM,CAAC,GAAG,CAAC;QACT,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KAC5B,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK;QACtB,MAAM,OAAO,GAAG,IAAA,6BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAE7B,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAEvB,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,MAAO,IAAI,CAAC,WAA8B;aAClE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;aAClB,IAAI,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG;QAC/B,MAAM,OAAO,GAAG,IAAA,6BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAC3B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;YAC/B,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;SAC7B,CAAC;QAEF,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;QAC1E,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAa,CAAC;QACzD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK;QAClC,MAAM,OAAO,GAAG,IAAA,6BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO;QAEpB,IAA2C,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK;aACpE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;aACxB,IAAI,EAAE,CAAC;QAEV,2EAA2E;QAC3E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG;QAC3C,MAAM,OAAO,GAAG,IAAA,6BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;YAAE,OAAO;QAE7B,MAAM,MAAM,GAAG,CAAE,IAA2C,CAAC,MAAM,CAAC,IAAI,EAAE,CAGzE,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAE,GAA+B,CAAC;QAC/E,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAA4B,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAE,MAAM,CAAC,IAAe,IAAI,MAAM,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,CAAC;YACL,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,UAAU,EAAE,MAAM,CAAE,GAAwB,CAAC,GAAG,CAAC;YACjD,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;YAC/B,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG;QAC3C,MAAM,OAAO,GAAG,IAAA,6BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;YAAE,OAAO;QAE7B,MAAM,CAAC;YACL,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,UAAU,EAAE,MAAM,CAAE,GAAwB,CAAC,GAAG,CAAC;YACjD,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;YAC/B,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,yEAAyE;YACzE,6CAA6C;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAE,GAA+B,CAAC;SACpF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK;QAC5B,IAAI,CAAC,IAAA,6BAAmB,GAAE;YAAE,OAAO;QAClC,IAA2C,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK;aACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;aACrB,IAAI,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;QACxB,MAAM,OAAO,GAAG,IAAA,6BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,MAAM,GAAG,CAAE,IAA2C,CAAC,MAAM,CAAC,IAAI,EAAE,CAGvE,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC;gBACL,EAAE,EAAE,IAAI,IAAI,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,QAAQ;gBAChB,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAC3B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC5B,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;gBAC/B,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;gBAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC5B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/audit/reads.d.ts

@@ -0,0 +1,47 @@
+import type { Request, RequestHandler, Response } from 'express';
+import { type Actor } from './actor';
+/**
+ * Record what software read, and only what software read.
+ *
+ * A person browsing their own journal generates nothing here. That is not a
+ * shortcut: one dashboard load hits half a dozen endpoints, so logging it would
+ * bury the interesting rows under thousands of uninteresting ones and put a
+ * database write behind every page view.
+ *
+ * What an assistant read is the part worth keeping, because it is the part that
+ * left the server. A created entry leaves a record behind either way; a read
+ * leaves nothing at all, and it is exactly what the privacy page warns about —
+ * ask an assistant what you did last month and those entries go to whoever runs
+ * it. This is the only place that becomes visible.
+ */
+/**
+ * Arm the read trail for one request, if it is one worth recording.
+ *
+ * Nothing is written here — the listener fires when the response finishes, so a
+ * refused request is not recorded as a read and the count reflects what was
+ * actually sent.
+ */
+export declare function recordRead(req: Request, res: Response, actor: Actor, service: string): void;
+/**
+ * The same thing as standalone middleware, for anything that authenticates its
+ * own way rather than through `authenticateAgent`.
+ */
+export declare const auditReads: (service: string) => RequestHandler;
+/**
+ * What a path was asking for, in one word.
+ *
+ * The first path segment, which is the collection on every route here —
+ * `/api/activities/68d6…` is about activities. Deliberately crude: a trail
+ * naming the resource is readable, and one naming the full path with ids in it
+ * is a request log wearing an audit log's clothes.
+ */
+export declare function resourceOf(path: string): string;
+/**
+ * How many records a response carried.
+ *
+ * Set by a handler that knows; absent otherwise. The size of what left the
+ * server is most of what makes a read worth recording — "read the journal" and
+ * "read four hundred entries of the journal" are different events.
+ */
+export declare const countRead: (res: Response, count: number) => void;
+//# sourceMappingURL=reads.d.ts.map

package/dist/audit/reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.d.ts","sourceRoot":"","sources":["../../src/audit/reads.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/E,OAAO,EAAW,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAqB3F;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,GACpB,SAAS,MAAM,KAAG,cAKlB,CAAC;AAEJ;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GAAI,KAAK,QAAQ,EAAE,OAAO,MAAM,KAAG,IAMxD,CAAC"}

package/dist/audit/reads.js

@@ -0,0 +1,94 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.countRead = exports.auditReads = void 0;
+exports.recordRead = recordRead;
+exports.resourceOf = resourceOf;
+const AuditEvent_1 = require("./AuditEvent");
+const actor_1 = require("./actor");
+const logger_1 = __importDefault(require("../logging/logger"));
+/**
+ * Record what software read, and only what software read.
+ *
+ * A person browsing their own journal generates nothing here. That is not a
+ * shortcut: one dashboard load hits half a dozen endpoints, so logging it would
+ * bury the interesting rows under thousands of uninteresting ones and put a
+ * database write behind every page view.
+ *
+ * What an assistant read is the part worth keeping, because it is the part that
+ * left the server. A created entry leaves a record behind either way; a read
+ * leaves nothing at all, and it is exactly what the privacy page warns about —
+ * ask an assistant what you did last month and those entries go to whoever runs
+ * it. This is the only place that becomes visible.
+ */
+/**
+ * Arm the read trail for one request, if it is one worth recording.
+ *
+ * Nothing is written here — the listener fires when the response finishes, so a
+ * refused request is not recorded as a read and the count reflects what was
+ * actually sent.
+ */
+function recordRead(req, res, actor, service) {
+    if (req.method !== 'GET' || actor.kind === 'person')
+        return;
+    res.on('finish', () => {
+        if (res.statusCode >= 400)
+            return;
+        void AuditEvent_1.AuditEvent.create({
+            at: new Date(),
+            service,
+            action: 'read',
+            resource: resourceOf(req.baseUrl + req.path),
+            actorKind: actor.kind,
+            userId: actor.userId,
+            actorLabel: actor.label,
+            actorCredentialId: actor.credentialId,
+            tenant: actor.tenant,
+            count: res.locals.auditCount
+        }).catch((error) => {
+            logger_1.default.warn('Could not record a read', { error: error?.message });
+        });
+    });
+}
+/**
+ * The same thing as standalone middleware, for anything that authenticates its
+ * own way rather than through `authenticateAgent`.
+ */
+const auditReads = (service) => (req, res, next) => {
+    const actor = (0, actor_1.actorOf)(req);
+    if (actor)
+        recordRead(req, res, actor, service);
+    next();
+};
+exports.auditReads = auditReads;
+/**
+ * What a path was asking for, in one word.
+ *
+ * The first path segment, which is the collection on every route here —
+ * `/api/activities/68d6…` is about activities. Deliberately crude: a trail
+ * naming the resource is readable, and one naming the full path with ids in it
+ * is a request log wearing an audit log's clothes.
+ */
+function resourceOf(path) {
+    const segments = path.split('/').filter((segment) => segment && segment !== 'api');
+    return segments[0]?.replace(/-/g, '_') ?? 'unknown';
+}
+/**
+ * How many records a response carried.
+ *
+ * Set by a handler that knows; absent otherwise. The size of what left the
+ * server is most of what makes a read worth recording — "read the journal" and
+ * "read four hundred entries of the journal" are different events.
+ */
+const countRead = (res, count) => {
+    // Guarded for the same reason recording is fire-and-forget: instrumentation
+    // must not be able to fail the thing it instruments. Express always provides
+    // `locals`, but a handler called directly does not have to.
+    if (!res?.locals)
+        return;
+    res.locals.auditCount = count;
+};
+exports.countRead = countRead;
+//# sourceMappingURL=reads.js.map

package/dist/audit/reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reads.js","sourceRoot":"","sources":["../../src/audit/reads.ts"],"names":[],"mappings":";;;;;;AA0BA,gCAqBC;AAsBD,gCAGC;AAvED,6CAA0C;AAC1C,mCAA8C;AAC9C,+DAAuC;AAEvC;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,GAAY,EAAE,GAAa,EAAE,KAAY,EAAE,OAAe;IACnF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IAE5D,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACpB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,OAAO;QAElC,KAAK,uBAAU,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,OAAO;YACP,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,iBAAiB,EAAE,KAAK,CAAC,YAAY;YACrC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAgC;SACnD,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACjB,gBAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAG,KAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,MAAM,UAAU,GACrB,CAAC,OAAe,EAAkB,EAAE,CACpC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;IACxD,MAAM,KAAK,GAAG,IAAA,eAAO,EAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK;QAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AANS,QAAA,UAAU,cAMnB;AAEJ;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC;IACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACI,MAAM,SAAS,GAAG,CAAC,GAAa,EAAE,KAAa,EAAQ,EAAE;IAC9D,4EAA4E;IAC5E,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO;IACzB,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;AAChC,CAAC,CAAC;AANW,QAAA,SAAS,aAMpB"}

package/dist/audit/service.d.ts

@@ -0,0 +1,51 @@
+import { type IAuditEvent, type ToolCall } from './AuditEvent';
+import type { ActorKind } from './actor';
+export interface AuditQuery {
+    userId: string;
+    /** narrow to one actor — a key's id or an OAuth client id */
+    credentialId?: string;
+    actorKind?: ActorKind;
+    action?: IAuditEvent['action'];
+    resource?: string;
+    /** narrow to one area — 'relationship-service', 'album-service' */
+    service?: string;
+    from?: Date;
+    to?: Date;
+    limit?: number;
+    page?: number;
+}
+export interface AuditEntry {
+    id: string;
+    at: string;
+    service: string;
+    action: IAuditEvent['action'];
+    resource: string;
+    resourceId?: string;
+    actorKind: ActorKind;
+    actorLabel: string;
+    actorCredentialId?: string;
+    tenant: string;
+    changes?: Record<string, {
+        from: unknown;
+        to: unknown;
+    }>;
+    snapshot?: Record<string, unknown>;
+    count?: number;
+    /** present on 'call': which tool ran, how long it took, and what it cost */
+    tool?: ToolCall;
+}
+/**
+ * One account's trail, newest first.
+ *
+ * Always scoped to `userId` by the query rather than filtered afterwards, so
+ * there is no path where a wider read is one forgotten condition away. The trail
+ * carries old values of journal entries, which makes it as sensitive as the
+ * journal itself.
+ */
+export declare const listAuditEvents: (query: AuditQuery) => Promise<{
+    events: AuditEntry[];
+    total: number;
+    page: number;
+    totalPages: number;
+}>;
+//# sourceMappingURL=service.d.ts.map

package/dist/audit/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,EAAE,CAAC,EAAE,IAAI,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAmBD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,UAAU,KAChB,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA+BnF,CAAC"}

package/dist/audit/service.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAuditEvents = void 0;
+const AuditEvent_1 = require("./AuditEvent");
+const toEntry = (event) => ({
+    id: String(event._id),
+    at: event.at.toISOString(),
+    service: event.service,
+    action: event.action,
+    resource: event.resource,
+    resourceId: event.resourceId,
+    actorKind: event.actorKind,
+    actorLabel: event.actorLabel,
+    actorCredentialId: event.actorCredentialId,
+    tenant: event.tenant,
+    changes: event.changes,
+    snapshot: event.snapshot,
+    count: event.count,
+    tool: event.tool
+});
+/**
+ * One account's trail, newest first.
+ *
+ * Always scoped to `userId` by the query rather than filtered afterwards, so
+ * there is no path where a wider read is one forgotten condition away. The trail
+ * carries old values of journal entries, which makes it as sensitive as the
+ * journal itself.
+ */
+const listAuditEvents = async (query) => {
+    const limit = Math.min(query.limit ?? 50, 200);
+    const page = Math.max(query.page ?? 1, 1);
+    const filter = { userId: query.userId };
+    if (query.credentialId)
+        filter.actorCredentialId = query.credentialId;
+    if (query.actorKind)
+        filter.actorKind = query.actorKind;
+    if (query.action)
+        filter.action = query.action;
+    if (query.resource)
+        filter.resource = query.resource;
+    if (query.service)
+        filter.service = query.service;
+    if (query.from || query.to) {
+        const at = {};
+        if (query.from)
+            at.$gte = query.from;
+        if (query.to)
+            at.$lte = query.to;
+        filter.at = at;
+    }
+    const [events, total] = await Promise.all([
+        AuditEvent_1.AuditEvent.find(filter)
+            .sort({ at: -1 })
+            .skip((page - 1) * limit)
+            .limit(limit),
+        AuditEvent_1.AuditEvent.countDocuments(filter)
+    ]);
+    return {
+        events: events.map(toEntry),
+        total,
+        page,
+        totalPages: Math.ceil(total / limit)
+    };
+};
+exports.listAuditEvents = listAuditEvents;
+//# sourceMappingURL=service.js.map

package/dist/audit/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":";;;AAAA,6CAA2E;AAoC3E,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAc,EAAE,CAAC,CAAC;IACnD,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IACrB,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE;IAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;IAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,KAAiB,EACmE,EAAE;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1C,MAAM,MAAM,GAA4B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,YAAY;QAAE,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,YAAY,CAAC;IACtE,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAyB,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI;YAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,EAAE;YAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,uBAAU,CAAC,IAAI,CAAC,MAAM,CAAC;aACpB,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;aAChB,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC;QACf,uBAAU,CAAC,cAAc,CAAC,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3B,KAAK;QACL,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;KACrC,CAAC;AACJ,CAAC,CAAC;AAjCW,QAAA,eAAe,mBAiC1B"}

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export * from './entitlements';
 export * from './groups';
 export * from './apiKeys';
 export * from './oauth';
+export * from './audit';
 export { authenticateToken, optionalAuth } from './middleware/authMiddleware';
 export { requireInternalServiceToken, internalServiceTokenBypass, allowUserOrInternalService, verifyInternalToken, INTERNAL_TOKEN_HEADER, SERVICE_ID_HEADER } from './middleware/internalServiceAuth';
 export { createCorsMiddleware } from './middleware/corsMiddleware';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC7K,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGjE,cAAc,gBAAgB,CAAC;AAG/B,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG9E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACT,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC7K,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGjE,cAAc,gBAAgB,CAAC;AAG/B,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG9E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACT,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -60,6 +60,7 @@ __exportStar(require("./groups"), exports);
 __exportStar(require("./apiKeys"), exports);
 // OAuth 2.1 authorization server, for assistants connecting over MCP
 __exportStar(require("./oauth"), exports);
+__exportStar(require("./audit"), exports);
 // Middleware
 var authMiddleware_1 = require("./middleware/authMiddleware");
 Object.defineProperty(exports, "authenticateToken", { enumerable: true, get: function () { return authMiddleware_1.authenticateToken; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;;;;;;;;;;;;;;;;;;;AAErF,gBAAgB;AAChB,qDAAoD;AAA3C,8GAAA,aAAa,OAAA;AAEtB,2CAAkD;AAAzC,4GAAA,gBAAgB,OAAA;AAGzB,UAAU;AACV,2CAAqD;AAA5C,iHAAA,OAAO,OAAU;AAE1B,gBAAgB;AAChB,8DAAoF;AAA3E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,kHAAA,cAAc,OAAA;AAChD,gEAA+D;AAAtD,sHAAA,iBAAiB,OAAA;AAG1B,WAAW;AACX,oDAAgE;AAAvD,uGAAA,SAAS,OAAA;AAAE,0GAAA,YAAY,OAAA;AAEhC,SAAS;AACT,oCAA0C;AAAjC,iGAAA,UAAU,OAAA;AAEnB,SAAS;AACT,gDAA6K;AAApK,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAGhJ,wDAAwD;AACxD,iDAA+B;AAE/B,0DAA0D;AAC1D,2CAAyB;AAEzB,+DAA+D;AAC/D,4CAA0B;AAE1B,qEAAqE;AACrE,0CAAwB;AAExB,aAAa;AACb,8DAA8E;AAArE,mHAAA,iBAAiB,OAAA;AAAE,8GAAA,YAAY,OAAA;AACxC,wEAO0C;AANxC,kIAAA,2BAA2B,OAAA;AAC3B,iIAAA,0BAA0B,OAAA;AAC1B,iIAAA,0BAA0B,OAAA;AAC1B,0HAAA,mBAAmB,OAAA;AACnB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAEnB,8DAAmE;AAA1D,sHAAA,oBAAoB,OAAA;AAC7B,0DAAyD;AAAhD,4GAAA,YAAY,OAAA;AACrB,4DAA0G;AAAjG,8GAAA,aAAa,OAAA;AAAE,yHAAA,wBAAwB,OAAA;AAAE,oHAAA,mBAAmB,OAAA;AACrE,kDAAmH;AAA1G,2GAAA,eAAe,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACnF,kDAAiD;AAAxC,oGAAA,QAAQ,OAAA;AAKjB,QAAQ;AACR,mDAAmF;AAA1E,oHAAA,qBAAqB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACrD,6CAA6E;AAApE,6GAAA,iBAAiB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,qGAAA,SAAS,OAAA;AAElD,2DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAE5C,UAAU;AACV,qCAQmB;AAPjB,4GAAA,iBAAiB,OAAA;AACjB,8GAAA,mBAAmB,OAAA;AACnB,4GAAA,iBAAiB,OAAA;AACjB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,0GAAA,eAAe,OAAA;AACf,mGAAA,QAAQ,OAAA;AAGV,UAAU;AACV,qCAUmB;AATjB,qGAAA,UAAU,OAAA;AACV,oGAAA,SAAS,OAAA;AACT,oGAAA,SAAS,OAAA;AACT,4GAAA,iBAAiB,OAAA;AACjB,0GAAA,eAAe,OAAA;AACf,oGAAA,SAAS,OAAA;AACT,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;;;;;;;;;;;;;;;;;;;AAErF,gBAAgB;AAChB,qDAAoD;AAA3C,8GAAA,aAAa,OAAA;AAEtB,2CAAkD;AAAzC,4GAAA,gBAAgB,OAAA;AAGzB,UAAU;AACV,2CAAqD;AAA5C,iHAAA,OAAO,OAAU;AAE1B,gBAAgB;AAChB,8DAAoF;AAA3E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,kHAAA,cAAc,OAAA;AAChD,gEAA+D;AAAtD,sHAAA,iBAAiB,OAAA;AAG1B,WAAW;AACX,oDAAgE;AAAvD,uGAAA,SAAS,OAAA;AAAE,0GAAA,YAAY,OAAA;AAEhC,SAAS;AACT,oCAA0C;AAAjC,iGAAA,UAAU,OAAA;AAEnB,SAAS;AACT,gDAA6K;AAApK,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAGhJ,wDAAwD;AACxD,iDAA+B;AAE/B,0DAA0D;AAC1D,2CAAyB;AAEzB,+DAA+D;AAC/D,4CAA0B;AAE1B,qEAAqE;AACrE,0CAAwB;AACxB,0CAAwB;AAExB,aAAa;AACb,8DAA8E;AAArE,mHAAA,iBAAiB,OAAA;AAAE,8GAAA,YAAY,OAAA;AACxC,wEAO0C;AANxC,kIAAA,2BAA2B,OAAA;AAC3B,iIAAA,0BAA0B,OAAA;AAC1B,iIAAA,0BAA0B,OAAA;AAC1B,0HAAA,mBAAmB,OAAA;AACnB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAEnB,8DAAmE;AAA1D,sHAAA,oBAAoB,OAAA;AAC7B,0DAAyD;AAAhD,4GAAA,YAAY,OAAA;AACrB,4DAA0G;AAAjG,8GAAA,aAAa,OAAA;AAAE,yHAAA,wBAAwB,OAAA;AAAE,oHAAA,mBAAmB,OAAA;AACrE,kDAAmH;AAA1G,2GAAA,eAAe,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACnF,kDAAiD;AAAxC,oGAAA,QAAQ,OAAA;AAKjB,QAAQ;AACR,mDAAmF;AAA1E,oHAAA,qBAAqB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACrD,6CAA6E;AAApE,6GAAA,iBAAiB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,qGAAA,SAAS,OAAA;AAElD,2DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAE5C,UAAU;AACV,qCAQmB;AAPjB,4GAAA,iBAAiB,OAAA;AACjB,8GAAA,mBAAmB,OAAA;AACnB,4GAAA,iBAAiB,OAAA;AACjB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,0GAAA,eAAe,OAAA;AACf,mGAAA,QAAQ,OAAA;AAGV,UAAU;AACV,qCAUmB;AATjB,qGAAA,UAAU,OAAA;AACV,oGAAA,SAAS,OAAA;AACT,oGAAA,SAAS,OAAA;AACT,4GAAA,iBAAiB,OAAA;AACjB,0GAAA,eAAe,OAAA;AACf,oGAAA,SAAS,OAAA;AACT,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA"}

package/dist/oauth/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/oauth/models.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,EAAE,EAAE,QAAQ,EAAU,MAAM,UAAU,CAAC;AACtD,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAWD,eAAO,MAAM,WAAW;;;;;;qBAE0C,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,QAAQ;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AA4BD,eAAO,MAAM,iBAAiB;;;;;;2BAEsD,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAuBD,eAAO,MAAM,YAAY;;;;;;sBAE4C,CAAC"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/oauth/models.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,EAAE,EAAE,QAAQ,EAAU,MAAM,UAAU,CAAC;AAEtD,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAWD,eAAO,MAAM,WAAW;;;;;;qBAE0C,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,QAAQ;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AA4BD,eAAO,MAAM,iBAAiB;;;;;;2BAEsD,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAiCD,eAAO,MAAM,YAAY;;;;;;sBAE4C,CAAC"}