@tumbaland/backend-core 1.43.0 → 1.45.0

package/src/apiKeys/types.ts

@@ -1,124 +0,0 @@
-/**
- * API keys let a non-browser client — an MCP server driving Claude or ChatGPT,
- * a script, a cron job — act as a user without a Google sign-in flow.
- *
- * They are deliberately narrower than a session: a session is a person at a
- * keyboard who can see what they are doing, while a key is handed to software
- * that acts on its own. So a key carries explicit scopes, and it pins the tenant
- * it writes to rather than choosing one per request the way the UI does.
- */
-
-/** Everything a key may be granted. Read and write are separate on purpose. */
-export const API_KEY_SCOPES = [
-  'relationship:read',
-  'relationship:write',
-  'album:read',
-  'album:write',
-  'finance:read',
-  'finance:write'
-] as const;
-
-export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
-
-export const isApiKeyScope = (value: unknown): value is ApiKeyScope =>
-  typeof value === 'string' && (API_KEY_SCOPES as readonly string[]).includes(value);
-
-/**
- * A tenant a credential may act in: a group id, or the user's own data.
- *
- * Personal is a named sentinel rather than `null` so that a tenant is always a
- * plain string — storable in an array, sendable in a JWT claim, comparable
- * without a special case at every layer. It cannot collide with a real tenant:
- * group ids are 24-character hex.
- */
-export const PERSONAL_TENANT = 'personal';
-
-export type Tenant = string;
-
-/** The `groupId` a tenant corresponds to, as handlers have always read it. */
-export const groupIdOf = (tenant: Tenant): string | null =>
-  tenant === PERSONAL_TENANT ? null : tenant;
-
-/**
- * Which tenants a credential may act in, and which one it acts in by default.
- *
- * The web app picks a tenant per request from a selector; an agent has no such
- * UI. So the *set* is chosen once, by a person, and the credential cannot escape
- * it — but within that set the caller may name one per request, which is what
- * lets a single connection reach both a shared journal and a private photo
- * library without reconnecting.
- *
- * `allowed` is never empty and always contains `default`. A credential granted
- * exactly one tenant behaves precisely as a pinned one did: nothing to name,
- * nothing to get wrong.
- */
-export interface ApiKeyTenant {
-  allowed: Tenant[];
-  default: Tenant;
-}
-
-/** Just the groups, for the `req.userGroups` every handler already reads. */
-export const groupIdsOf = (tenants: Tenant[]): string[] =>
-  tenants.filter((tenant) => tenant !== PERSONAL_TENANT);
-
-/**
- * Read a stored tenant grant, tolerating one written before tenants were a set.
- *
- * Keys and grants issued under the old single-tenant model carry `groupId`
- * alone. Falling back to it here means they keep working across the deploy
- * rather than every connected assistant breaking at once.
- */
-export const readTenants = (stored: {
-  tenants?: Tenant[] | null;
-  defaultTenant?: Tenant | null;
-  groupId?: string | null;
-}): ApiKeyTenant => {
-  const allowed =
-    stored.tenants && stored.tenants.length > 0
-      ? stored.tenants
-      : [stored.groupId ?? PERSONAL_TENANT];
-
-  const fallbackDefault = allowed[0] as Tenant;
-  const preferred = stored.defaultTenant ?? fallbackDefault;
-
-  return {
-    allowed,
-    default: allowed.includes(preferred) ? preferred : fallbackDefault
-  };
-};
-
-/** A key as the API hands it back — never including the secret. */
-export interface ApiKeySummary {
-  id: string;
-  name: string;
-  /** the public half, shown in listings so a key is identifiable at a glance */
-  prefix: string;
-  scopes: ApiKeyScope[];
-  tenants: Tenant[];
-  defaultTenant: Tenant;
-  createdAt: string;
-  lastUsedAt: string | null;
-  expiresAt: string | null;
-  revokedAt: string | null;
-}
-
-/** Why a presented key was refused. Kept out of the HTTP response — see the middleware. */
-export type ApiKeyRejection =
-  | 'malformed'
-  | 'unknown'
-  | 'revoked'
-  | 'expired'
-  | 'bad-secret';
-
-export interface ApiKeyVerification {
-  ok: boolean;
-  rejection?: ApiKeyRejection;
-  userId?: string;
-  userEmail?: string;
-  userName?: string;
-  keyId?: string;
-  /** what the owner called this key, for an audit trail a person can read */
-  label?: string;
-  scopes?: ApiKeyScope[];
-  tenants?: ApiKeyTenant;
-}

package/src/app/createBaseApp.test.ts

@@ -1,109 +0,0 @@
-import request from 'supertest';
-import { createBaseApp } from './createBaseApp';
-
-jest.mock('../logging/logger', () => ({
-  __esModule: true,
-  default: { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn(), http: jest.fn() }
-}));
-
-describe('createBaseApp', () => {
-  it('parses JSON bodies and cookies by default', async () => {
-    const app = createBaseApp();
-    app.get('/echo-cookie', (req, res) => res.json({ cookies: req.cookies }));
-    app.post('/echo-body', (req, res) => res.json({ body: req.body }));
-
-    const cookieRes = await request(app).get('/echo-cookie').set('Cookie', 'foo=bar');
-    expect(cookieRes.body).toEqual({ cookies: { foo: 'bar' } });
-
-    const bodyRes = await request(app).post('/echo-body').send({ hello: 'world' });
-    expect(bodyRes.body).toEqual({ body: { hello: 'world' } });
-  });
-
-  it('applies security headers and rate limiting', async () => {
-    const app = createBaseApp();
-    app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-    const res = await request(app).get('/ping');
-    expect(res.headers['x-content-type-options']).toBe('nosniff');
-  });
-
-  it('skips JSON parsing when parseJson is false', async () => {
-    const app = createBaseApp({ parseJson: false });
-    app.post('/echo-body', (req, res) => res.json({ body: req.body ?? null }));
-
-    const res = await request(app).post('/echo-body').set('Content-Type', 'application/json').send('{"hello":"world"}');
-    expect(res.body).toEqual({ body: null });
-  });
-
-  it('skips cookie parsing when parseCookies is false', async () => {
-    const app = createBaseApp({ parseCookies: false });
-    app.get('/echo-cookie', (req, res) => res.json({ cookies: req.cookies ?? null }));
-
-    const res = await request(app).get('/echo-cookie').set('Cookie', 'foo=bar');
-    expect(res.body).toEqual({ cookies: null });
-  });
-
-  it('honors a custom rate limiter', async () => {
-    const app = createBaseApp({ rateLimiter: (await import('../middleware/security')).createRateLimiter({ windowMs: 60_000, max: 1 }) });
-    app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-    const first = await request(app).get('/ping');
-    const second = await request(app).get('/ping');
-
-    expect(first.status).toBe(200);
-    expect(second.status).toBe(429);
-  });
-
-  it('uses the plain request logger (no metrics histogram) when metrics is false', async () => {
-    const app = createBaseApp({ metrics: false });
-    app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-    const res = await request(app).get('/ping');
-
-    expect(res.status).toBe(200);
-  });
-
-  it('trusts the proxy, so X-Forwarded-For identifies the client rather than being ignored', async () => {
-    const app = createBaseApp();
-    app.get('/whoami', (req, res) => res.json({ ip: req.ip }));
-
-    const res = await request(app).get('/whoami').set('X-Forwarded-For', '203.0.113.7');
-
-    expect(res.body.ip).toBe('203.0.113.7');
-  });
-
-  it('keeps rate-limit buckets per client, not one shared bucket behind the proxy', async () => {
-    const app = createBaseApp({ rateLimiter: (await import('../middleware/security')).createRateLimiter({ windowMs: 60_000, max: 1 }) });
-    app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-    const clientA = await request(app).get('/ping').set('X-Forwarded-For', '203.0.113.7');
-    const clientB = await request(app).get('/ping').set('X-Forwarded-For', '198.51.100.4');
-    const clientAAgain = await request(app).get('/ping').set('X-Forwarded-For', '203.0.113.7');
-
-    expect(clientA.status).toBe(200);
-    expect(clientB.status).toBe(200); // a different client is unaffected by A exhausting its window
-    expect(clientAAgain.status).toBe(429);
-  });
-
-  it('ignores X-Forwarded-For when trustProxy is disabled', async () => {
-    const app = createBaseApp({ trustProxy: false });
-    app.get('/whoami', (req, res) => res.json({ ip: req.ip }));
-
-    const res = await request(app).get('/whoami').set('X-Forwarded-For', '203.0.113.7');
-
-    expect(res.body.ip).not.toBe('203.0.113.7');
-  });
-
-  it('mounts /health/live ahead of the rate limiter, so it never gets 429s a busy service would', async () => {
-    const app = createBaseApp({ rateLimiter: (await import('../middleware/security')).createRateLimiter({ windowMs: 60_000, max: 1 }) });
-    app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-    await request(app).get('/ping'); // exhaust the max: 1 budget
-    const live1 = await request(app).get('/health/live');
-    const live2 = await request(app).get('/health/live');
-
-    expect(live1.status).toBe(200);
-    expect(live1.body).toEqual({ status: 'ok' });
-    expect(live2.status).toBe(200);
-  });
-});

package/src/app/createBaseApp.ts

@@ -1,102 +0,0 @@
-import express, { Express, RequestHandler } from 'express';
-import cookieParser from 'cookie-parser';
-import { correlationMiddleware } from '../utils/correlation';
-import { tracingMiddleware } from '../tracing';
-import { requestLogger, requestLoggerWithMetrics } from '../middleware/requestLogger';
-import { createCorsMiddleware, CorsMiddlewareOptions } from '../middleware/corsMiddleware';
-import { securityHeaders, standardRateLimiter } from '../middleware/security';
-import { healthLive } from '../health/healthController';
-
-export interface CreateBaseAppOptions {
-  /** Passed through to createCorsMiddleware. */
-  corsOptions?: CorsMiddlewareOptions;
-  /**
-   * Defaults to standardRateLimiter; pass strictRateLimiter or a custom one
-   * to override. Pass `false` to skip mounting one here entirely — e.g. when
-   * a route (like a webhook) must be registered, and therefore exempted,
-   * before the limiter, and the service applies it itself afterward.
-   */
-  rateLimiter?: RequestHandler | false;
-  /** Mount express.json() here. Set false when a route needs the raw body first (e.g. a webhook) or handles its own parsing. Default true. */
-  parseJson?: boolean;
-  /** Mount cookie-parser here. Set false for services that don't use cookies. Default true. */
-  parseCookies?: boolean;
-  /** Mount tracingMiddleware. Default true. */
-  tracing?: boolean;
-  /** Use requestLoggerWithMetrics (adds Prometheus histograms) instead of the plain requestLogger. Default true. */
-  metrics?: boolean;
-  /**
-   * Value for Express's `trust proxy`. Defaults to trusting private/loopback
-   * addresses — see the note on tumbaland-proxy below. Pass `false` for a
-   * service exposed directly to clients with no proxy in front of it.
-   */
-  trustProxy?: Parameters<Express['set']>[1];
-}
-
-/**
- * Assembles the middleware stack every service was hand-rolling in its own
- * index.ts (correlation → tracing → request logging → security → rate
- * limiting → CORS → cookies → JSON body). Services still mount their own
- * routes, `/health` (DB-aware readiness), `/metrics`, and
- * `app.use(errorHandler)` last — this only owns the common prefix, not the
- * whole app lifecycle.
- *
- * `/health/live` is the one exception: it's mounted here, first, ahead of
- * every other middleware. It has zero per-service variation (it never
- * touches a dependency, just confirms the process is up), so — unlike
- * `/health` — there's nothing for a service to customize. Mounting it
- * before the rate limiter also matters operationally: a service under
- * heavy legitimate traffic shouldn't have its own liveness probe start
- * getting 429s and get killed for being "unhealthy" at the exact moment
- * it's just busy.
- *
- * Services with non-standard body parsing (a webhook needing the raw body,
- * or conditional parsing per-route) should pass `parseJson`/`parseCookies:
- * false` and mount those themselves at the exact point they need to.
- *
- * `trust proxy` is on by default because nothing here is reached directly:
- * every service sits behind tumbaland-proxy, which sets `X-Forwarded-For`.
- * Left at Express's default (`false`) that header is ignored, which
- * express-rate-limit reports as `ERR_ERL_UNEXPECTED_X_FORWARDED_FOR` — and
- * it is right to: the limiter would then key every request in the cluster on
- * the proxy's own container IP, so one busy client could exhaust the window
- * for everyone.
- *
- * The value is `loopback, linklocal, uniquelocal` (private ranges) rather
- * than a hop count, because the chain length differs per ingress path: a
- * direct hit arrives as `client` + the proxy's own socket address, while
- * traffic through the Cloudflare tunnel arrives as `client, 127.0.0.1` (the
- * local cloudflared) + that same socket address. Express walks the chain
- * right-to-left and stops at the first address it does not trust, so both
- * paths land on the real client; a fixed number would be wrong for one of
- * them. All the intermediaries are private addresses and the client is not,
- * which is exactly the split this preset encodes.
- */
-export function createBaseApp(options: CreateBaseAppOptions = {}): Express {
-  const {
-    corsOptions,
-    rateLimiter = standardRateLimiter,
-    parseJson = true,
-    parseCookies = true,
-    tracing = true,
-    metrics = true,
-    trustProxy = 'loopback, linklocal, uniquelocal'
-  } = options;
-
-  const app = express();
-
-  app.set('trust proxy', trustProxy);
-
-  app.get('/health/live', healthLive);
-
-  app.use(securityHeaders);
-  if (rateLimiter) app.use(rateLimiter);
-  app.use(correlationMiddleware);
-  if (tracing) app.use(tracingMiddleware);
-  app.use(metrics ? requestLoggerWithMetrics : requestLogger);
-  app.use(createCorsMiddleware(corsOptions));
-  if (parseCookies) app.use(cookieParser());
-  if (parseJson) app.use(express.json());
-
-  return app;
-}

package/src/app/shutdown.test.ts

@@ -1,129 +0,0 @@
-jest.mock('../logging/logger', () => ({
-  __esModule: true,
-  default: { info: jest.fn(), error: jest.fn(), warn: jest.fn(), debug: jest.fn(), http: jest.fn() }
-}));
-
-jest.mock('../database/connection', () => ({
-  __esModule: true,
-  disconnectDB: jest.fn().mockResolvedValue(undefined)
-}));
-
-import type { Server } from 'http';
-import logger from '../logging/logger';
-import { disconnectDB } from '../database/connection';
-import { registerShutdown } from './shutdown';
-
-/** Minimal fake http.Server whose close() invokes its callback. */
-function fakeServer(closeErr?: Error): Server {
-  return {
-    close: jest.fn((cb?: (err?: Error) => void) => {
-      cb?.(closeErr);
-      return undefined as unknown as Server;
-    })
-  } as unknown as Server;
-}
-
-describe('registerShutdown', () => {
-  const listeners: Record<string, (...args: unknown[]) => void> = {};
-  let processOnSpy: jest.SpyInstance;
-  let exitSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    for (const key of Object.keys(listeners)) delete listeners[key];
-
-    processOnSpy = jest
-      .spyOn(process, 'on')
-      .mockImplementation((event: string | symbol, handler: (...args: unknown[]) => void) => {
-        listeners[event as string] = handler;
-        return process;
-      });
-    exitSpy = jest.spyOn(process, 'exit').mockImplementation(((): never => undefined as never));
-  });
-
-  afterEach(() => {
-    processOnSpy.mockRestore();
-    exitSpy.mockRestore();
-  });
-
-  const flush = () => new Promise((resolve) => setImmediate(resolve));
-
-  it('registers SIGINT and SIGTERM handlers', () => {
-    registerShutdown({ serviceName: 'svc' });
-    expect(Object.keys(listeners).sort()).toEqual(['SIGINT', 'SIGTERM']);
-  });
-
-  it('closes the server, disconnects the DB, and exits 0 on SIGTERM', async () => {
-    const server = fakeServer();
-    registerShutdown({ serviceName: 'svc', server });
-
-    listeners.SIGTERM();
-    await flush();
-
-    expect(server.close).toHaveBeenCalled();
-    expect(disconnectDB).toHaveBeenCalledWith('svc');
-    expect(exitSpy).toHaveBeenCalledWith(0);
-    expect(logger.info).toHaveBeenCalledWith('Received shutdown signal, closing gracefully', {
-      service: 'svc',
-      signal: 'SIGTERM'
-    });
-  });
-
-  it('runs the onShutdown hook before closing the server', async () => {
-    const order: string[] = [];
-    const server = {
-      close: jest.fn((cb?: (err?: Error) => void) => {
-        order.push('server');
-        cb?.();
-        return undefined as unknown as Server;
-      })
-    } as unknown as Server;
-    const onShutdown = jest.fn(async () => {
-      order.push('hook');
-    });
-
-    registerShutdown({ serviceName: 'svc', server, onShutdown });
-    listeners.SIGINT();
-    await flush();
-
-    expect(order).toEqual(['hook', 'server']);
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it('skips the DB disconnect when disconnectDatabase is false', async () => {
-    registerShutdown({ serviceName: 'svc', disconnectDatabase: false });
-
-    listeners.SIGTERM();
-    await flush();
-
-    expect(disconnectDB).not.toHaveBeenCalled();
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it('is idempotent — a second signal while shutting down is ignored', async () => {
-    const server = fakeServer();
-    registerShutdown({ serviceName: 'svc', server });
-
-    listeners.SIGTERM();
-    listeners.SIGINT();
-    await flush();
-
-    expect(server.close).toHaveBeenCalledTimes(1);
-    expect(exitSpy).toHaveBeenCalledTimes(1);
-  });
-
-  it('exits 1 when the server fails to close', async () => {
-    const server = fakeServer(new Error('close boom'));
-    registerShutdown({ serviceName: 'svc', server });
-
-    listeners.SIGTERM();
-    await flush();
-
-    expect(disconnectDB).not.toHaveBeenCalled();
-    expect(exitSpy).toHaveBeenCalledWith(1);
-    expect(logger.error).toHaveBeenCalledWith('Error during graceful shutdown', {
-      service: 'svc',
-      error: 'close boom'
-    });
-  });
-});

package/src/app/shutdown.ts

@@ -1,81 +0,0 @@
-import type { Server } from 'http';
-import logger from '../logging/logger';
-import { disconnectDB } from '../database/connection';
-
-export interface RegisterShutdownOptions {
-  /** Service name, used for log context and the DB disconnect. */
-  serviceName: string;
-  /** The HTTP server returned by `app.listen(...)`, closed before the DB. */
-  server?: Server;
-  /**
-   * Whether to close the MongoDB connection on shutdown. Defaults to `true`;
-   * set `false` for services that never call `connectDB` (e.g. file, public).
-   */
-  disconnectDatabase?: boolean;
-  /** Optional extra cleanup run before the server/DB are closed. */
-  onShutdown?: () => Promise<void> | void;
-  /**
-   * Force `process.exit` after this many ms if a graceful close hangs, so a
-   * stuck connection can't block a container rollout. Defaults to 10s.
-   */
-  forceExitAfterMs?: number;
-}
-
-/**
- * Registers `SIGINT` and `SIGTERM` handlers that drain the service before the
- * process exits: run the optional cleanup hook, stop accepting new HTTP
- * connections, then close the MongoDB connection. `SIGTERM` matters most —
- * it's the signal Docker/Kubernetes send on stop and rollout, and without a
- * handler the process is force-killed with its DB connection still open.
- *
- * The handler is idempotent (a second signal while shutting down is ignored)
- * and self-arms a force-exit timer so a hung close still terminates.
- */
-export const registerShutdown = ({
-  serviceName,
-  server,
-  disconnectDatabase = true,
-  onShutdown,
-  forceExitAfterMs = 10_000
-}: RegisterShutdownOptions): void => {
-  let shuttingDown = false;
-
-  const shutdown = async (signal: string): Promise<void> => {
-    if (shuttingDown) return;
-    shuttingDown = true;
-
-    logger.info('Received shutdown signal, closing gracefully', { service: serviceName, signal });
-
-    const forceExit = setTimeout(() => {
-      logger.error('Graceful shutdown timed out, forcing exit', { service: serviceName });
-      process.exit(1);
-    }, forceExitAfterMs);
-    // Don't let the timer itself keep the event loop alive.
-    forceExit.unref?.();
-
-    try {
-      if (onShutdown) await onShutdown();
-
-      if (server) {
-        await new Promise<void>((resolve, reject) => {
-          server.close((err) => (err ? reject(err) : resolve()));
-        });
-      }
-
-      if (disconnectDatabase) await disconnectDB(serviceName);
-
-      clearTimeout(forceExit);
-      process.exit(0);
-    } catch (error) {
-      clearTimeout(forceExit);
-      logger.error('Error during graceful shutdown', {
-        service: serviceName,
-        error: (error as Error)?.message
-      });
-      process.exit(1);
-    }
-  };
-
-  process.on('SIGINT', () => void shutdown('SIGINT'));
-  process.on('SIGTERM', () => void shutdown('SIGTERM'));
-};

package/src/audit/AuditEvent.ts

@@ -1,123 +0,0 @@
-import mongoose, { Document, Schema } from 'mongoose';
-import type { ActorKind } from './actor';
-
-/**
- * One thing that happened, and who did it.
- *
- * Lives in backend-core rather than any one service because the question it
- * answers spans them: "what did Claude do yesterday" is not a relationship
- * question or an album question. Every service writes into the same collection,
- * and `service` says which one.
- */
-/**
- * What one MCP tool call cost.
- *
- * Kept beside the trail rather than in a metrics system because the question it
- * answers is the same one the trail answers — what did the assistant do — with
- * the part that turned out to matter added: how much text came back. A tool
- * result is not a page a person closes. It stays in the conversation and is
- * resent with every message after it, so a single answer of ten thousand tokens
- * is paid for again on every turn that follows. Nothing in the product made
- * that visible until a bill did.
- */
-export interface ToolCall {
-  /** the tool as the model called it — 'get_net_worth', 'log_day' */
-  name: string;
-  /** how long the handler took, end to end, including the calls it made */
-  ms: number;
-  /** characters of text handed back to the model */
-  chars: number;
-  /**
-   * Roughly what those characters cost, at four to a token.
-   *
-   * An estimate on purpose: the real count depends on a tokeniser this server
-   * has no reason to carry, and the decision it informs — which tool is the
-   * expensive one — is nowhere near close enough for the difference to matter.
-   */
-  tokens: number;
-  /** the call came back as an error, so the size is a message rather than data */
-  failed?: boolean;
-}
-
-export interface IAuditEvent extends Document {
-  at: Date;
-  /** which service handled it — 'relationship-service', 'album-service' */
-  service: string;
-  action: 'create' | 'update' | 'delete' | 'read' | 'call';
-  /** what kind of thing — 'activity', 'activity_type', 'photo' */
-  resource: string;
-  resourceId?: string;
-  actorKind: ActorKind;
-  /** the account acted for; every listing is scoped to this */
-  userId: string;
-  actorLabel: string;
-  /** a key's id or an OAuth client id; absent when a person acted directly */
-  actorCredentialId?: string;
-  /** the journal it happened in */
-  tenant: string;
-  /**
-   * What changed, field by field.
-   *
-   * Present on updates. This is the difference between an audit log and a
-   * request log: "Claude edited an entry" is barely worth storing, "Claude
-   * changed hours from 3 to 2" is the thing someone actually wants to see.
-   */
-  changes?: Record<string, { from: unknown; to: unknown }>;
-  /** what a delete removed, so it can be read back or restored by hand */
-  snapshot?: Record<string, unknown>;
-  /** how many records a read returned — the size of what left the server */
-  count?: number;
-  /** present on 'call': the tool, and what it cost */
-  tool?: ToolCall;
-  createdAt: Date;
-}
-
-const ToolCallSchema = new Schema<ToolCall>(
-  {
-    name: { type: String, required: true },
-    ms: { type: Number, required: true },
-    chars: { type: Number, required: true },
-    tokens: { type: Number, required: true },
-    failed: { type: Boolean }
-  },
-  { _id: false }
-);
-
-const AuditEventSchema = new Schema<IAuditEvent>(
-  {
-    at: { type: Date, required: true, default: Date.now },
-    service: { type: String, required: true },
-    action: { type: String, required: true, enum: ['create', 'update', 'delete', 'read', 'call'] },
-    resource: { type: String, required: true },
-    resourceId: { type: String },
-    actorKind: { type: String, required: true, enum: ['person', 'key', 'assistant'] },
-    userId: { type: String, required: true, index: true },
-    actorLabel: { type: String, required: true },
-    actorCredentialId: { type: String },
-    tenant: { type: String, required: true },
-    changes: { type: Schema.Types.Mixed },
-    snapshot: { type: Schema.Types.Mixed },
-    count: { type: Number },
-    tool: { type: ToolCallSchema }
-  },
-  { timestamps: { createdAt: true, updatedAt: false }, collection: 'audit_events' }
-);
-
-// Every listing is one account's trail, newest first.
-AuditEventSchema.index({ userId: 1, at: -1 });
-
-/**
- * Rows expire on their own.
- *
- * They carry journal content — the old value of a description, a deleted
- * entry — so keeping them indefinitely would quietly build a second copy of the
- * journal that nothing in the product ever deletes from. A year is long enough
- * to answer "what happened" and short enough that the copy does not outlive the
- * question.
- */
-const RETENTION_DAYS = 365;
-AuditEventSchema.index({ at: 1 }, { expireAfterSeconds: RETENTION_DAYS * 24 * 60 * 60 });
-
-export const AuditEvent = mongoose.models.AuditEvent
-  ? (mongoose.models.AuditEvent as mongoose.Model<IAuditEvent>)
-  : mongoose.model<IAuditEvent>('AuditEvent', AuditEventSchema);