@tumbaland/backend-core 1.49.0 → 1.51.0

package/dist/activity/UserDay.d.ts

@@ -0,0 +1,42 @@
+import { Document, Model } from 'mongoose';
+import type { ActivityModule, ActivityPlatform } from './modules';
+/**
+ * One person's use of the app on one UTC day.
+ *
+ * A counter, not a log: a visit is one `$inc` on a document that already
+ * exists, so the collection grows by one small row per active person per day
+ * and never by the number of clicks. That is what makes keeping it forever
+ * reasonable — there is no TTL, unlike `audit_events`, because it holds no
+ * content, only which days someone came and which pages they opened.
+ *
+ * Days are UTC, like the usage meters, so "today" means the same thing in every
+ * service and does not depend on where the server happens to run.
+ */
+export interface IUserDay extends Document {
+    userId: string;
+    /** `YYYY-MM-DD`, UTC. */
+    day: string;
+    /** Times the app was opened or came back after a long absence (see shell-front's activity hook). */
+    visits: number;
+    /** Opens per page, keyed by `ActivityModule`. */
+    modules: Partial<Record<ActivityModule, number>>;
+    /** Visits per kind of device. */
+    platform: Partial<Record<ActivityPlatform, number>>;
+    /** Cloudflare's CF-IPCountry at the last visit that day. */
+    country?: string;
+    firstAt: Date;
+    lastAt: Date;
+    /**
+     * Written by the one-off backfill from the audit trail, not by a visit.
+     * Such a day knows only that the person wrote something, so it undercounts,
+     * and the admin screens say so wherever they show one.
+     */
+    backfilled?: boolean;
+}
+/**
+ * Registered through `models` first: several services import this module into
+ * the same mongoose singleton during tests, and a second `model()` call with
+ * the same name throws `OverwriteModelError`.
+ */
+export declare const UserDay: Model<IUserDay>;
+//# sourceMappingURL=UserDay.d.ts.map

package/dist/activity/UserDay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDay.d.ts","sourceRoot":"","sources":["../../src/activity/UserDay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,QAAQ,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAS,SAAQ,QAAQ;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,iCAAiC;IACjC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,IAAI,CAAC;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA0BD;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ,CAC8C,CAAC"}

package/dist/activity/UserDay.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDay = void 0;
+const mongoose_1 = require("mongoose");
+const UserDaySchema = new mongoose_1.Schema({
+    userId: { type: String, required: true },
+    day: { type: String, required: true },
+    visits: { type: Number, default: 0 },
+    modules: { type: mongoose_1.Schema.Types.Mixed, default: undefined },
+    platform: {
+        web: { type: Number },
+        pwa: { type: Number },
+        ios: { type: Number },
+        android: { type: Number }
+    },
+    country: { type: String, maxlength: 2 },
+    firstAt: { type: Date, required: true },
+    lastAt: { type: Date, required: true },
+    backfilled: { type: Boolean }
+}, { collection: 'user_days', minimize: true });
+// A person's days, and one day across everybody ("who was here on the 3rd").
+UserDaySchema.index({ userId: 1, day: 1 }, { unique: true });
+UserDaySchema.index({ day: 1 });
+/**
+ * Registered through `models` first: several services import this module into
+ * the same mongoose singleton during tests, and a second `model()` call with
+ * the same name throws `OverwriteModelError`.
+ */
+exports.UserDay = mongoose_1.models.UserDay || (0, mongoose_1.model)('UserDay', UserDaySchema);
+//# sourceMappingURL=UserDay.js.map

package/dist/activity/UserDay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserDay.js","sourceRoot":"","sources":["../../src/activity/UserDay.ts"],"names":[],"mappings":";;;AAAA,uCAAkE;AAqClE,MAAM,aAAa,GAAG,IAAI,iBAAM,CAC9B;IACE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;IACpC,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE;IACzD,QAAQ,EAAE;QACR,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACrB,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACrB,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACrB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KAC1B;IACD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE;IACvC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CAC9B,EACD,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAC5C,CAAC;AAEF,6EAA6E;AAC7E,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7D,aAAa,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEhC;;;;GAIG;AACU,QAAA,OAAO,GACjB,iBAAM,CAAC,OAA2B,IAAI,IAAA,gBAAK,EAAW,SAAS,EAAE,aAAa,CAAC,CAAC"}

package/dist/activity/index.d.ts

@@ -0,0 +1,7 @@
+export { ACTIVITY_MODULES, ACTIVITY_PLATFORMS, isActivityModule } from './modules';
+export type { ActivityModule, ActivityPlatform } from './modules';
+export { UserDay } from './UserDay';
+export type { IUserDay } from './UserDay';
+export { recordActivity, dayOf } from './recordActivity';
+export type { ActivityInput } from './recordActivity';
+//# sourceMappingURL=index.d.ts.map

package/dist/activity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/activity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnF,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/activity/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dayOf = exports.recordActivity = exports.UserDay = exports.isActivityModule = exports.ACTIVITY_PLATFORMS = exports.ACTIVITY_MODULES = void 0;
+var modules_1 = require("./modules");
+Object.defineProperty(exports, "ACTIVITY_MODULES", { enumerable: true, get: function () { return modules_1.ACTIVITY_MODULES; } });
+Object.defineProperty(exports, "ACTIVITY_PLATFORMS", { enumerable: true, get: function () { return modules_1.ACTIVITY_PLATFORMS; } });
+Object.defineProperty(exports, "isActivityModule", { enumerable: true, get: function () { return modules_1.isActivityModule; } });
+var UserDay_1 = require("./UserDay");
+Object.defineProperty(exports, "UserDay", { enumerable: true, get: function () { return UserDay_1.UserDay; } });
+var recordActivity_1 = require("./recordActivity");
+Object.defineProperty(exports, "recordActivity", { enumerable: true, get: function () { return recordActivity_1.recordActivity; } });
+Object.defineProperty(exports, "dayOf", { enumerable: true, get: function () { return recordActivity_1.dayOf; } });
+//# sourceMappingURL=index.js.map

package/dist/activity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/activity/index.ts"],"names":[],"mappings":";;;AAAA,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAE/D,qCAAoC;AAA3B,kGAAA,OAAO,OAAA;AAEhB,mDAAyD;AAAhD,gHAAA,cAAc,OAAA;AAAE,uGAAA,KAAK,OAAA"}

package/dist/activity/modules.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The pages whose opening is counted, named by the route segment shell-front
+ * mounts them at (`/relationship` is the Journal, `/finance` is Money).
+ *
+ * The route, not the display name, because routes are what stay put: the
+ * Journal has been called "relationship" in every URL and service since before
+ * it was renamed, and a counter keyed by a label would split in two the day a
+ * label changed. The admin screens translate these back to names.
+ *
+ * A fixed list rather than any string a client sends, so a bug or a hostile
+ * browser cannot grow a day's document one invented key at a time.
+ */
+export declare const ACTIVITY_MODULES: readonly ["home", "relationship", "album", "finance", "chat", "account", "groups", "payments", "admin"];
+export type ActivityModule = (typeof ACTIVITY_MODULES)[number];
+/** Where the app was running: a browser tab, an installed PWA, or a native wrapper (see shell-front's platform.ts). */
+export declare const ACTIVITY_PLATFORMS: readonly ["web", "pwa", "ios", "android"];
+export type ActivityPlatform = (typeof ACTIVITY_PLATFORMS)[number];
+export declare const isActivityModule: (value: unknown) => value is ActivityModule;
+//# sourceMappingURL=modules.d.ts.map

package/dist/activity/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/activity/modules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,yGAUnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,uHAAuH;AACvH,eAAO,MAAM,kBAAkB,2CAA4C,CAAC;AAE5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,cAC2B,CAAC"}

package/dist/activity/modules.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isActivityModule = exports.ACTIVITY_PLATFORMS = exports.ACTIVITY_MODULES = void 0;
+/**
+ * The pages whose opening is counted, named by the route segment shell-front
+ * mounts them at (`/relationship` is the Journal, `/finance` is Money).
+ *
+ * The route, not the display name, because routes are what stay put: the
+ * Journal has been called "relationship" in every URL and service since before
+ * it was renamed, and a counter keyed by a label would split in two the day a
+ * label changed. The admin screens translate these back to names.
+ *
+ * A fixed list rather than any string a client sends, so a bug or a hostile
+ * browser cannot grow a day's document one invented key at a time.
+ */
+exports.ACTIVITY_MODULES = [
+    'home',
+    'relationship',
+    'album',
+    'finance',
+    'chat',
+    'account',
+    'groups',
+    'payments',
+    'admin'
+];
+/** Where the app was running: a browser tab, an installed PWA, or a native wrapper (see shell-front's platform.ts). */
+exports.ACTIVITY_PLATFORMS = ['web', 'pwa', 'ios', 'android'];
+const isActivityModule = (value) => typeof value === 'string' && exports.ACTIVITY_MODULES.includes(value);
+exports.isActivityModule = isActivityModule;
+//# sourceMappingURL=modules.js.map

package/dist/activity/modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../../src/activity/modules.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACU,QAAA,gBAAgB,GAAG;IAC9B,MAAM;IACN,cAAc;IACd,OAAO;IACP,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,UAAU;IACV,OAAO;CACC,CAAC;AAIX,uHAAuH;AAC1G,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAU,CAAC;AAIrE,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAA2B,EAAE,CAC1E,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAD1E,QAAA,gBAAgB,oBAC0D"}

package/dist/activity/recordActivity.d.ts

@@ -0,0 +1,28 @@
+import { type ActivityModule, type ActivityPlatform } from './modules';
+export interface ActivityInput {
+    userId: string;
+    /** `visit`: the app was opened, or came back after a long absence. `open`: a page was opened. */
+    kind: 'visit' | 'open';
+    /** Required for `open`. */
+    module?: ActivityModule;
+    platform: ActivityPlatform;
+    country?: string;
+    /** For tests. */
+    now?: Date;
+}
+/** The UTC day a moment falls on, as it is stored. */
+export declare const dayOf: (at: Date) => string;
+/**
+ * Counts one visit or one page open against the person's day.
+ *
+ * A single upsert, so the first event of a day creates it and every later one
+ * only increments, with no read in between for two tabs to race on.
+ *
+ * Never throws, for the reason the audit writes never do: a counter that can
+ * fail the request it describes is worse than no counter. A failure is logged
+ * and the day is simply undercounted.
+ *
+ * Returns whether it was recorded, which only the endpoint's tests care about.
+ */
+export declare function recordActivity(input: ActivityInput): Promise<boolean>;
+//# sourceMappingURL=recordActivity.d.ts.map

package/dist/activity/recordActivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordActivity.d.ts","sourceRoot":"","sources":["../../src/activity/recordActivity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEzF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,sDAAsD;AACtD,eAAO,MAAM,KAAK,GAAI,IAAI,IAAI,KAAG,MAAuC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CA4B3E"}

package/dist/activity/recordActivity.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dayOf = void 0;
+exports.recordActivity = recordActivity;
+const logger_1 = __importDefault(require("../logging/logger"));
+const UserDay_1 = require("./UserDay");
+const modules_1 = require("./modules");
+/** The UTC day a moment falls on, as it is stored. */
+const dayOf = (at) => at.toISOString().slice(0, 10);
+exports.dayOf = dayOf;
+/**
+ * Counts one visit or one page open against the person's day.
+ *
+ * A single upsert, so the first event of a day creates it and every later one
+ * only increments, with no read in between for two tabs to race on.
+ *
+ * Never throws, for the reason the audit writes never do: a counter that can
+ * fail the request it describes is worse than no counter. A failure is logged
+ * and the day is simply undercounted.
+ *
+ * Returns whether it was recorded, which only the endpoint's tests care about.
+ */
+async function recordActivity(input) {
+    try {
+        if (!input.userId)
+            return false;
+        if (input.kind === 'open' && !(0, modules_1.isActivityModule)(input.module))
+            return false;
+        const now = input.now ?? new Date();
+        // A page open is not another device, so only a visit adds to the platform split.
+        const inc = input.kind === 'visit' ? { visits: 1, [`platform.${input.platform}`]: 1 } : { [`modules.${input.module}`]: 1 };
+        await UserDay_1.UserDay.updateOne({ userId: input.userId, day: (0, exports.dayOf)(now) }, {
+            $inc: inc,
+            $min: { firstAt: now },
+            $max: { lastAt: now },
+            ...(input.country ? { $set: { country: input.country } } : {}),
+            // A day the backfill wrote is a guess; once someone is seen that day it
+            // is a counted one, and should no longer be drawn as an undercount.
+            ...(input.kind === 'visit' ? { $unset: { backfilled: '' } } : {})
+        }, { upsert: true });
+        return true;
+    }
+    catch (error) {
+        logger_1.default.warn('Could not record activity', { error: error?.message, kind: input.kind });
+        return false;
+    }
+}
+//# sourceMappingURL=recordActivity.js.map

package/dist/activity/recordActivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordActivity.js","sourceRoot":"","sources":["../../src/activity/recordActivity.ts"],"names":[],"mappings":";;;;;;AA+BA,wCA4BC;AA3DD,+DAAuC;AACvC,uCAAoC;AACpC,uCAAyF;AAczF,sDAAsD;AAC/C,MAAM,KAAK,GAAG,CAAC,EAAQ,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAA5D,QAAA,KAAK,SAAuD;AAEzE;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,cAAc,CAAC,KAAoB;IACvD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAA,0BAAgB,EAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAE3E,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,iFAAiF;QACjF,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAEjH,MAAM,iBAAO,CAAC,SAAS,CACrB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAA,aAAK,EAAC,GAAG,CAAC,EAAE,EACzC;YACE,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,wEAAwE;YACxE,oEAAoE;YACpE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,EACD,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAG,KAAe,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/audit/AuditEvent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuditEvent.d.ts","sourceRoot":"","sources":["../../src/audit/AuditEvent.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,EAAE,EAAE,QAAQ,EAAU,MAAM,UAAU,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;GAOG;AACH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,EAAE,EAAE,IAAI,CAAC;IACT,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACzD,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzD,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAgDD,eAAO,MAAM,UAAU;;;;;;;;;;EAEwC,CAAC"}
+{"version":3,"file":"AuditEvent.d.ts","sourceRoot":"","sources":["../../src/audit/AuditEvent.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,EAAE,EAAE,QAAQ,EAAU,MAAM,UAAU,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;GAOG;AACH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC3C,EAAE,EAAE,IAAI,CAAC;IACT,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACzD,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzD,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAoDD,eAAO,MAAM,UAAU;;;;;;;;;;EAEwC,CAAC"}

package/dist/audit/AuditEvent.js

@@ -60,6 +60,9 @@ const AuditEventSchema = new mongoose_1.Schema({
 }, { timestamps: { createdAt: true, updatedAt: false }, collection: 'audit_events' });
 // Every listing is one account's trail, newest first.
 AuditEventSchema.index({ userId: 1, at: -1 });
+// The admin screens ask across every account — "all assistant calls this month" —
+// which the per-user index above cannot serve.
+AuditEventSchema.index({ action: 1, at: -1 });
 /**
  * Rows expire on their own.
  *

package/dist/audit/AuditEvent.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuditEvent.js","sourceRoot":"","sources":["../../src/audit/AuditEvent.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAsD;AA0EtD,MAAM,cAAc,GAAG,IAAI,iBAAM,CAC/B;IACE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CAC1B,EACD,EAAE,GAAG,EAAE,KAAK,EAAE,CACf,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,iBAAM,CACjC;IACE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;IACrD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACzC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IAC9F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE;IACjF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACnC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,KAAK,EAAE;IACrC,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,KAAK,EAAE;IACtC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACvB,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;CAC/B,EACD,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAClF,CAAC;AAEF,sDAAsD;AACtD,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AAE5E,QAAA,UAAU,GAAG,kBAAQ,CAAC,MAAM,CAAC,UAAU;IAClD,CAAC,CAAE,kBAAQ,CAAC,MAAM,CAAC,UAA0C;IAC7D,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAc,YAAY,EAAE,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"AuditEvent.js","sourceRoot":"","sources":["../../src/audit/AuditEvent.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAsD;AA0EtD,MAAM,cAAc,GAAG,IAAI,iBAAM,CAC/B;IACE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CAC1B,EACD,EAAE,GAAG,EAAE,KAAK,EAAE,CACf,CAAC;AAEF,MAAM,gBAAgB,GAAG,IAAI,iBAAM,CACjC;IACE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;IACrD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACzC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IAC9F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE;IACjF,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACnC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,KAAK,EAAE;IACrC,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAM,CAAC,KAAK,CAAC,KAAK,EAAE;IACtC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACvB,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;CAC/B,EACD,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAClF,CAAC;AAEF,sDAAsD;AACtD,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAE9C,kFAAkF;AAClF,+CAA+C;AAC/C,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AAE5E,QAAA,UAAU,GAAG,kBAAQ,CAAC,MAAM,CAAC,UAAU;IAClD,CAAC,CAAE,kBAAQ,CAAC,MAAM,CAAC,UAA0C;IAC7D,CAAC,CAAC,kBAAQ,CAAC,KAAK,CAAc,YAAY,EAAE,gBAAgB,CAAC,CAAC"}

package/dist/groups/access.d.ts

@@ -0,0 +1,13 @@
+/** Whether `groupId` is one of the groups the person belongs to. */
+export declare const isMemberOf: (groupId: string, userGroups: readonly string[] | null | undefined) => boolean;
+/**
+ * The one rule that keeps a group's data inside the group: a `groupId` that
+ * arrives in a request is never trusted, it must be one of the caller's own.
+ *
+ * No group named means the caller's personal data, which is always theirs, so
+ * `undefined` and `null` pass. A group they are not in throws a 403, never
+ * falls back to personal: reading someone else's group as "personal" would
+ * quietly show them nothing, and writing to it would not.
+ */
+export declare function assertMemberOf(groupId: string | null | undefined, userGroups: readonly string[] | null | undefined, message?: string): void;
+//# sourceMappingURL=access.d.ts.map

package/dist/groups/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/groups/access.ts"],"names":[],"mappings":"AAEA,oEAAoE;AACpE,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,YAAY,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,KAAG,OACvD,CAAC;AAEzC;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,SAAkB,GACxB,IAAI,CAEN"}

package/dist/groups/access.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isMemberOf = void 0;
+exports.assertMemberOf = assertMemberOf;
+const HttpError_1 = require("../errors/HttpError");
+/** Whether `groupId` is one of the groups the person belongs to. */
+const isMemberOf = (groupId, userGroups) => Boolean(userGroups?.includes(groupId));
+exports.isMemberOf = isMemberOf;
+/**
+ * The one rule that keeps a group's data inside the group: a `groupId` that
+ * arrives in a request is never trusted, it must be one of the caller's own.
+ *
+ * No group named means the caller's personal data, which is always theirs, so
+ * `undefined` and `null` pass. A group they are not in throws a 403, never
+ * falls back to personal: reading someone else's group as "personal" would
+ * quietly show them nothing, and writing to it would not.
+ */
+function assertMemberOf(groupId, userGroups, message = 'Access denied') {
+    if (groupId && !(0, exports.isMemberOf)(groupId, userGroups))
+        throw new HttpError_1.ForbiddenError(message);
+}
+//# sourceMappingURL=access.js.map

package/dist/groups/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/groups/access.ts"],"names":[],"mappings":";;;AAeA,wCAMC;AArBD,mDAAqD;AAErD,oEAAoE;AAC7D,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,UAAgD,EAAW,EAAE,CACvG,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAD5B,QAAA,UAAU,cACkB;AAEzC;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAC5B,OAAkC,EAClC,UAAgD,EAChD,OAAO,GAAG,eAAe;IAEzB,IAAI,OAAO,IAAI,CAAC,IAAA,kBAAU,EAAC,OAAO,EAAE,UAAU,CAAC;QAAE,MAAM,IAAI,0BAAc,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC"}

package/dist/groups/index.d.ts

@@ -3,4 +3,5 @@ export type { GroupOwner } from './client';
 export { groupOwnerSubject } from './subject';
 export type { GroupIdResolver } from './subject';
 export { getUserGroupIds, currentGroupsOf, clearMembershipCache } from './membership';
+export { assertMemberOf, isMemberOf } from './access';
 //# sourceMappingURL=index.d.ts.map

package/dist/groups/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC"}

package/dist/groups/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearMembershipCache = exports.currentGroupsOf = exports.getUserGroupIds = exports.groupOwnerSubject = exports.clearGroupOwnerCache = exports.invalidateGroupOwner = exports.getGroupOwner = void 0;
+exports.isMemberOf = exports.assertMemberOf = exports.clearMembershipCache = exports.currentGroupsOf = exports.getUserGroupIds = exports.groupOwnerSubject = exports.clearGroupOwnerCache = exports.invalidateGroupOwner = exports.getGroupOwner = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "getGroupOwner", { enumerable: true, get: function () { return client_1.getGroupOwner; } });
 Object.defineProperty(exports, "invalidateGroupOwner", { enumerable: true, get: function () { return client_1.invalidateGroupOwner; } });
@@ -11,4 +11,7 @@ var membership_1 = require("./membership");
 Object.defineProperty(exports, "getUserGroupIds", { enumerable: true, get: function () { return membership_1.getUserGroupIds; } });
 Object.defineProperty(exports, "currentGroupsOf", { enumerable: true, get: function () { return membership_1.currentGroupsOf; } });
 Object.defineProperty(exports, "clearMembershipCache", { enumerable: true, get: function () { return membership_1.clearMembershipCache; } });
+var access_1 = require("./access");
+Object.defineProperty(exports, "assertMemberOf", { enumerable: true, get: function () { return access_1.assertMemberOf; } });
+Object.defineProperty(exports, "isMemberOf", { enumerable: true, get: function () { return access_1.isMemberOf; } });
 //# sourceMappingURL=index.js.map

package/dist/groups/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":";;;AAAA,mCAAqF;AAA5E,uGAAA,aAAa,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAGlE,qCAA8C;AAArC,4GAAA,iBAAiB,OAAA;AAG1B,2CAAsF;AAA7E,6GAAA,eAAe,OAAA;AAAE,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/groups/index.ts"],"names":[],"mappings":";;;AAAA,mCAAqF;AAA5E,uGAAA,aAAa,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAAE,8GAAA,oBAAoB,OAAA;AAGlE,qCAA8C;AAArC,4GAAA,iBAAiB,OAAA;AAG1B,2CAAsF;AAA7E,6GAAA,eAAe,OAAA;AAAE,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAC/D,mCAAsD;AAA7C,wGAAA,cAAc,OAAA;AAAE,oGAAA,UAAU,OAAA"}

package/dist/index.d.ts

@@ -17,7 +17,9 @@ export * from './fileService';
 export * from './oauth';
 export * from './audit';
 export * from './sse';
+export * from './activity';
 export { authenticateToken, optionalAuth } from './middleware/authMiddleware';
+export { requireAdmin } from './middleware/requireAdmin';
 export { USER_SESSIONS_COLLECTION, isCurrentSession } from './auth/session';
 export { requireInternalServiceToken, internalServiceTokenBypass, allowUserOrInternalService, verifyInternalToken, INTERNAL_TOKEN_HEADER, SERVICE_ID_HEADER } from './middleware/internalServiceAuth';
 export { createCorsMiddleware } from './middleware/corsMiddleware';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC7K,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGjE,cAAc,gBAAgB,CAAC;AAG/B,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,eAAe,CAAC;AAG9B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AAGxB,cAAc,OAAO,CAAC;AAGtB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACT,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,YAAY,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC7K,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAGjE,cAAc,gBAAgB,CAAC;AAG/B,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,eAAe,CAAC;AAG9B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AAGxB,cAAc,OAAO,CAAC;AAGtB,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACT,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,UAAU,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -18,8 +18,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.databaseQueryDuration = exports.httpRequestsTotal = exports.httpRequestDuration = exports.metricsMiddleware = exports.escapeRegex = exports.canAccessResource = exports.buildAccessQuery = exports.sendError = exports.sendSuccess = exports.createApiResponse = exports.correlationMiddleware = exports.generateCorrelationId = exports.validate = exports.strictRateLimiter = exports.standardRateLimiter = exports.createRateLimiter = exports.securityHeaders = exports.simpleRequestLogger = exports.requestLoggerWithMetrics = exports.requestLogger = exports.errorHandler = exports.createCorsMiddleware = exports.SERVICE_ID_HEADER = exports.INTERNAL_TOKEN_HEADER = exports.verifyInternalToken = exports.allowUserOrInternalService = exports.internalServiceTokenBypass = exports.requireInternalServiceToken = exports.isCurrentSession = exports.USER_SESSIONS_COLLECTION = exports.optionalAuth = exports.authenticateToken = exports.PaymentRequiredError = exports.TooManyRequestsError = exports.ConflictError = exports.NotFoundError = exports.ForbiddenError = exports.UnauthorizedError = exports.BadRequestError = exports.HttpError = exports.requireEnv = exports.disconnectDB = exports.connectDB = exports.createHealthCheck = exports.metricsHandler = exports.healthLive = exports.healthCheck = exports.logger = exports.registerShutdown = exports.createBaseApp = void 0;
-exports.extractSpanContext = exports.injectHeaders = exports.setSpanTag = exports.logToSpan = exports.createChildSpan = exports.tracingMiddleware = exports.startSpan = exports.getTracer = exports.initTracer = exports.register = exports.businessMetrics = exports.databaseQueriesTotal = void 0;
+exports.httpRequestsTotal = exports.httpRequestDuration = exports.metricsMiddleware = exports.escapeRegex = exports.canAccessResource = exports.buildAccessQuery = exports.sendError = exports.sendSuccess = exports.createApiResponse = exports.correlationMiddleware = exports.generateCorrelationId = exports.validate = exports.strictRateLimiter = exports.standardRateLimiter = exports.createRateLimiter = exports.securityHeaders = exports.simpleRequestLogger = exports.requestLoggerWithMetrics = exports.requestLogger = exports.errorHandler = exports.createCorsMiddleware = exports.SERVICE_ID_HEADER = exports.INTERNAL_TOKEN_HEADER = exports.verifyInternalToken = exports.allowUserOrInternalService = exports.internalServiceTokenBypass = exports.requireInternalServiceToken = exports.isCurrentSession = exports.USER_SESSIONS_COLLECTION = exports.requireAdmin = exports.optionalAuth = exports.authenticateToken = exports.PaymentRequiredError = exports.TooManyRequestsError = exports.ConflictError = exports.NotFoundError = exports.ForbiddenError = exports.UnauthorizedError = exports.BadRequestError = exports.HttpError = exports.requireEnv = exports.disconnectDB = exports.connectDB = exports.createHealthCheck = exports.metricsHandler = exports.healthLive = exports.healthCheck = exports.logger = exports.registerShutdown = exports.createBaseApp = void 0;
+exports.extractSpanContext = exports.injectHeaders = exports.setSpanTag = exports.logToSpan = exports.createChildSpan = exports.tracingMiddleware = exports.startSpan = exports.getTracer = exports.initTracer = exports.register = exports.businessMetrics = exports.databaseQueriesTotal = exports.databaseQueryDuration = void 0;
 // App bootstrap
 var createBaseApp_1 = require("./app/createBaseApp");
 Object.defineProperty(exports, "createBaseApp", { enumerable: true, get: function () { return createBaseApp_1.createBaseApp; } });
@@ -65,10 +65,14 @@ __exportStar(require("./oauth"), exports);
 __exportStar(require("./audit"), exports);
 // Server-Sent Events streams (headers, heartbeat, lifetime, shutdown)
 __exportStar(require("./sse"), exports);
+// Visit counts (user_days), for the admin screens
+__exportStar(require("./activity"), exports);
 // Middleware
 var authMiddleware_1 = require("./middleware/authMiddleware");
 Object.defineProperty(exports, "authenticateToken", { enumerable: true, get: function () { return authMiddleware_1.authenticateToken; } });
 Object.defineProperty(exports, "optionalAuth", { enumerable: true, get: function () { return authMiddleware_1.optionalAuth; } });
+var requireAdmin_1 = require("./middleware/requireAdmin");
+Object.defineProperty(exports, "requireAdmin", { enumerable: true, get: function () { return requireAdmin_1.requireAdmin; } });
 var session_1 = require("./auth/session");
 Object.defineProperty(exports, "USER_SESSIONS_COLLECTION", { enumerable: true, get: function () { return session_1.USER_SESSIONS_COLLECTION; } });
 Object.defineProperty(exports, "isCurrentSession", { enumerable: true, get: function () { return session_1.isCurrentSession; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;;;;;;;;;;;;;;;;;;;AAErF,gBAAgB;AAChB,qDAAoD;AAA3C,8GAAA,aAAa,OAAA;AAEtB,2CAAkD;AAAzC,4GAAA,gBAAgB,OAAA;AAGzB,UAAU;AACV,2CAAqD;AAA5C,iHAAA,OAAO,OAAU;AAE1B,gBAAgB;AAChB,8DAAoF;AAA3E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,kHAAA,cAAc,OAAA;AAChD,gEAA+D;AAAtD,sHAAA,iBAAiB,OAAA;AAG1B,WAAW;AACX,oDAAgE;AAAvD,uGAAA,SAAS,OAAA;AAAE,0GAAA,YAAY,OAAA;AAEhC,SAAS;AACT,oCAA0C;AAAjC,iGAAA,UAAU,OAAA;AAEnB,SAAS;AACT,gDAA6K;AAApK,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAGhJ,wDAAwD;AACxD,iDAA+B;AAE/B,0DAA0D;AAC1D,2CAAyB;AAEzB,+DAA+D;AAC/D,4CAA0B;AAE1B,+EAA+E;AAC/E,gDAA8B;AAE9B,qEAAqE;AACrE,0CAAwB;AACxB,0CAAwB;AAExB,sEAAsE;AACtE,wCAAsB;AAEtB,aAAa;AACb,8DAA8E;AAArE,mHAAA,iBAAiB,OAAA;AAAE,8GAAA,YAAY,OAAA;AACxC,0CAA4E;AAAnE,mHAAA,wBAAwB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AACnD,wEAO0C;AANxC,kIAAA,2BAA2B,OAAA;AAC3B,iIAAA,0BAA0B,OAAA;AAC1B,iIAAA,0BAA0B,OAAA;AAC1B,0HAAA,mBAAmB,OAAA;AACnB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAEnB,8DAAmE;AAA1D,sHAAA,oBAAoB,OAAA;AAC7B,0DAAyD;AAAhD,4GAAA,YAAY,OAAA;AACrB,4DAA0G;AAAjG,8GAAA,aAAa,OAAA;AAAE,yHAAA,wBAAwB,OAAA;AAAE,oHAAA,mBAAmB,OAAA;AACrE,kDAAmH;AAA1G,2GAAA,eAAe,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACnF,kDAAiD;AAAxC,oGAAA,QAAQ,OAAA;AAKjB,QAAQ;AACR,mDAAmF;AAA1E,oHAAA,qBAAqB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACrD,6CAA6E;AAApE,6GAAA,iBAAiB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,qGAAA,SAAS,OAAA;AAElD,2DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAC5C,mDAAkD;AAAzC,0GAAA,WAAW,OAAA;AAEpB,UAAU;AACV,qCAQmB;AAPjB,4GAAA,iBAAiB,OAAA;AACjB,8GAAA,mBAAmB,OAAA;AACnB,4GAAA,iBAAiB,OAAA;AACjB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,0GAAA,eAAe,OAAA;AACf,mGAAA,QAAQ,OAAA;AAGV,UAAU;AACV,qCAUmB;AATjB,qGAAA,UAAU,OAAA;AACV,oGAAA,SAAS,OAAA;AACT,oGAAA,SAAS,OAAA;AACT,4GAAA,iBAAiB,OAAA;AACjB,0GAAA,eAAe,OAAA;AACf,oGAAA,SAAS,OAAA;AACT,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;;;;;;;;;;;;;;;;;;;AAErF,gBAAgB;AAChB,qDAAoD;AAA3C,8GAAA,aAAa,OAAA;AAEtB,2CAAkD;AAAzC,4GAAA,gBAAgB,OAAA;AAGzB,UAAU;AACV,2CAAqD;AAA5C,iHAAA,OAAO,OAAU;AAE1B,gBAAgB;AAChB,8DAAoF;AAA3E,+GAAA,WAAW,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,kHAAA,cAAc,OAAA;AAChD,gEAA+D;AAAtD,sHAAA,iBAAiB,OAAA;AAG1B,WAAW;AACX,oDAAgE;AAAvD,uGAAA,SAAS,OAAA;AAAE,0GAAA,YAAY,OAAA;AAEhC,SAAS;AACT,oCAA0C;AAAjC,iGAAA,UAAU,OAAA;AAEnB,SAAS;AACT,gDAA6K;AAApK,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAGhJ,wDAAwD;AACxD,iDAA+B;AAE/B,0DAA0D;AAC1D,2CAAyB;AAEzB,+DAA+D;AAC/D,4CAA0B;AAE1B,+EAA+E;AAC/E,gDAA8B;AAE9B,qEAAqE;AACrE,0CAAwB;AACxB,0CAAwB;AAExB,sEAAsE;AACtE,wCAAsB;AAEtB,kDAAkD;AAClD,6CAA2B;AAE3B,aAAa;AACb,8DAA8E;AAArE,mHAAA,iBAAiB,OAAA;AAAE,8GAAA,YAAY,OAAA;AACxC,0DAAyD;AAAhD,4GAAA,YAAY,OAAA;AACrB,0CAA4E;AAAnE,mHAAA,wBAAwB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AACnD,wEAO0C;AANxC,kIAAA,2BAA2B,OAAA;AAC3B,iIAAA,0BAA0B,OAAA;AAC1B,iIAAA,0BAA0B,OAAA;AAC1B,0HAAA,mBAAmB,OAAA;AACnB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAEnB,8DAAmE;AAA1D,sHAAA,oBAAoB,OAAA;AAC7B,0DAAyD;AAAhD,4GAAA,YAAY,OAAA;AACrB,4DAA0G;AAAjG,8GAAA,aAAa,OAAA;AAAE,yHAAA,wBAAwB,OAAA;AAAE,oHAAA,mBAAmB,OAAA;AACrE,kDAAmH;AAA1G,2GAAA,eAAe,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACnF,kDAAiD;AAAxC,oGAAA,QAAQ,OAAA;AAKjB,QAAQ;AACR,mDAAmF;AAA1E,oHAAA,qBAAqB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACrD,6CAA6E;AAApE,6GAAA,iBAAiB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,qGAAA,SAAS,OAAA;AAElD,2DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,oHAAA,iBAAiB,OAAA;AAC5C,mDAAkD;AAAzC,0GAAA,WAAW,OAAA;AAEpB,UAAU;AACV,qCAQmB;AAPjB,4GAAA,iBAAiB,OAAA;AACjB,8GAAA,mBAAmB,OAAA;AACnB,4GAAA,iBAAiB,OAAA;AACjB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,0GAAA,eAAe,OAAA;AACf,mGAAA,QAAQ,OAAA;AAGV,UAAU;AACV,qCAUmB;AATjB,qGAAA,UAAU,OAAA;AACV,oGAAA,SAAS,OAAA;AACT,oGAAA,SAAS,OAAA;AACT,4GAAA,iBAAiB,OAAA;AACjB,0GAAA,eAAe,OAAA;AACf,oGAAA,SAAS,OAAA;AACT,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA"}

package/dist/middleware/requireAdmin.d.ts

@@ -0,0 +1,16 @@
+import { Request, Response, NextFunction } from 'express';
+/**
+ * Lets only an administrator through, after authentication.
+ *
+ * Reads the role off the session token, which is re-signed with fresh roles at
+ * every renewal, so a role granted or taken away applies within minutes rather
+ * than at the next sign-in. Routes that change an account (as opposed to
+ * reading it) should additionally check the role against the database, which
+ * is what auth-service's `requireRole` does.
+ *
+ * A key or a connected assistant is refused even if the account behind it is an
+ * administrator: software acting for the owner is exactly what a trail of what
+ * the owner did should be able to tell apart from the owner.
+ */
+export declare const requireAdmin: (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=requireAdmin.d.ts.map

package/dist/middleware/requireAdmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAdmin.d.ts","sourceRoot":"","sources":["../../src/middleware/requireAdmin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAM9E,CAAC"}

package/dist/middleware/requireAdmin.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAdmin = void 0;
+/**
+ * Lets only an administrator through, after authentication.
+ *
+ * Reads the role off the session token, which is re-signed with fresh roles at
+ * every renewal, so a role granted or taken away applies within minutes rather
+ * than at the next sign-in. Routes that change an account (as opposed to
+ * reading it) should additionally check the role against the database, which
+ * is what auth-service's `requireRole` does.
+ *
+ * A key or a connected assistant is refused even if the account behind it is an
+ * administrator: software acting for the owner is exactly what a trail of what
+ * the owner did should be able to tell apart from the owner.
+ */
+const requireAdmin = (req, res, next) => {
+    if (req.apiKey || !req.user?.roles?.includes('admin')) {
+        res.status(403).json({ success: false, message: 'admin required' });
+        return;
+    }
+    next();
+};
+exports.requireAdmin = requireAdmin;
+//# sourceMappingURL=requireAdmin.js.map

package/dist/middleware/requireAdmin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAdmin.js","sourceRoot":"","sources":["../../src/middleware/requireAdmin.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;GAYG;AACI,MAAM,YAAY,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;IACpF,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AANW,QAAA,YAAY,gBAMvB"}

package/dist/testing/openapi.d.ts

@@ -0,0 +1,34 @@
+import { type Application } from 'express';
+/** Makes every `use()` remember its path on the layers it adds. Idempotent. */
+export declare function recordMountPaths(): void;
+export interface Endpoint {
+    method: string;
+    /** In OpenAPI form: `/api/things/{id}`. */
+    path: string;
+}
+/** Every method and path the app answers, as OpenAPI would write them. */
+export declare function listRoutes(app: Application): Endpoint[];
+/**
+ * Every method and path a spec documents. A path item may live in a file of its
+ * own (`$ref: 'paths/thing.yml'`), as file-service's source spec does, so a
+ * relative `$ref` is followed.
+ */
+export declare function listDocumented(specFile: string): Endpoint[];
+/**
+ * Served by backend-core in every service, for the platform rather than for API
+ * callers: Kubernetes-style liveness and Prometheus. Not expected in each spec.
+ */
+export declare const PLATFORM_ROUTES: string[];
+export interface OpenApiDrift {
+    /** Routes the app serves that the spec does not mention. */
+    undocumented: string[];
+    /** Operations the spec describes that the app does not serve. */
+    stale: string[];
+}
+/**
+ * What the spec and the app disagree on. `ignore` takes routes that are
+ * deliberately left out of the docs (`'GET /docs'`, or a pattern), on top of
+ * the platform routes.
+ */
+export declare function openApiDrift(app: Application, specFile: string, ignore?: Array<string | RegExp>): OpenApiDrift;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/testing/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/testing/openapi.ts"],"names":[],"mappings":"AAEA,OAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAyBpD,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,IAAI,CAavC;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd;AAYD,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,EAAE,CAsBvD;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,CAY3D;AAMD;;;GAGG;AACH,eAAO,MAAM,eAAe,UAAuC,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAM,GAAG,YAAY,CAalH"}

package/dist/testing/openapi.js

@@ -0,0 +1,110 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_ROUTES = void 0;
+exports.recordMountPaths = recordMountPaths;
+exports.listRoutes = listRoutes;
+exports.listDocumented = listDocumented;
+exports.openApiDrift = openApiDrift;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const express_1 = __importDefault(require("express"));
+const yaml_1 = require("yaml");
+let recording = false;
+/** Makes every `use()` remember its path on the layers it adds. Idempotent. */
+function recordMountPaths() {
+    if (recording)
+        return;
+    recording = true;
+    const proto = express_1.default.Router.prototype;
+    const use = proto.use;
+    proto.use = function (...args) {
+        const before = this.stack.length;
+        const result = use.apply(this, args);
+        const first = args[0];
+        const mountPath = typeof first === 'string' || Array.isArray(first) ? first : '/';
+        for (const layer of this.stack.slice(before))
+            layer.mountPath = mountPath;
+        return result;
+    };
+}
+const METHODS = ['get', 'post', 'put', 'patch', 'delete'];
+const join = (prefix, path) => {
+    const joined = `${prefix}/${path}`.replace(/\/+/g, '/');
+    return joined.length > 1 ? joined.replace(/\/$/, '') : joined;
+};
+/** `/:id` and Express 5's `/*fileId` as OpenAPI writes them: `/{id}`, `/{fileId}`. */
+const toOpenApiPath = (path) => path.replace(/[:*](\w+)/g, '{$1}');
+/** Every method and path the app answers, as OpenAPI would write them. */
+function listRoutes(app) {
+    const router = app.router ?? app._router;
+    if (!router)
+        throw new Error('The app has no router yet: build it before listing its routes');
+    const found = [];
+    const walk = (stack, prefix) => {
+        for (const layer of stack) {
+            if (layer.route) {
+                const paths = Array.isArray(layer.route.path) ? layer.route.path : [layer.route.path];
+                for (const path of paths) {
+                    for (const method of Object.keys(layer.route.methods).filter((m) => METHODS.includes(m))) {
+                        found.push({ method, path: toOpenApiPath(join(prefix, path)) });
+                    }
+                }
+            }
+            else if (layer.handle?.stack) {
+                const mounts = layer.mountPath === undefined ? ['/'] : [].concat(layer.mountPath);
+                for (const mount of mounts)
+                    walk(layer.handle.stack, join(prefix, mount));
+            }
+        }
+    };
+    walk(router.stack, '/');
+    return found;
+}
+const readYaml = (file) => (0, yaml_1.parse)(fs_1.default.readFileSync(file, 'utf8'));
+/**
+ * Every method and path a spec documents. A path item may live in a file of its
+ * own (`$ref: 'paths/thing.yml'`), as file-service's source spec does, so a
+ * relative `$ref` is followed.
+ */
+function listDocumented(specFile) {
+    const spec = readYaml(specFile);
+    return Object.entries(spec.paths ?? {}).flatMap(([path, item]) => {
+        const ref = item?.$ref;
+        const operations = typeof ref === 'string' && !ref.startsWith('#')
+            ? readYaml(path_1.default.resolve(path_1.default.dirname(specFile), ref))
+            : item;
+        return Object.keys(operations ?? {})
+            .filter((method) => METHODS.includes(method))
+            .map((method) => ({ method, path }));
+    });
+}
+/** A route's identity regardless of what its parameters are called: `{id}` and `{conversationId}` match. */
+const key = ({ method, path }) => `${method.toUpperCase()} ${path.replace(/\{[^}]+\}/g, '{}')}`;
+const label = ({ method, path }) => `${method.toUpperCase()} ${path}`;
+/**
+ * Served by backend-core in every service, for the platform rather than for API
+ * callers: Kubernetes-style liveness and Prometheus. Not expected in each spec.
+ */
+exports.PLATFORM_ROUTES = ['GET /health/live', 'GET /metrics'];
+/**
+ * What the spec and the app disagree on. `ignore` takes routes that are
+ * deliberately left out of the docs (`'GET /docs'`, or a pattern), on top of
+ * the platform routes.
+ */
+function openApiDrift(app, specFile, ignore = []) {
+    const rules = [...exports.PLATFORM_ROUTES, ...ignore];
+    const skipped = (endpoint) => rules.some((rule) => (typeof rule === 'string' ? rule === label(endpoint) : rule.test(label(endpoint))));
+    const routes = listRoutes(app).filter((endpoint) => !skipped(endpoint));
+    const documented = listDocumented(specFile).filter((endpoint) => !skipped(endpoint));
+    const routeKeys = new Set(routes.map(key));
+    const documentedKeys = new Set(documented.map(key));
+    const unique = (labels) => [...new Set(labels)].sort();
+    return {
+        undocumented: unique(routes.filter((endpoint) => !documentedKeys.has(key(endpoint))).map(label)),
+        stale: unique(documented.filter((endpoint) => !routeKeys.has(key(endpoint))).map(label))
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/testing/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/testing/openapi.ts"],"names":[],"mappings":";;;;;;AA4BA,4CAaC;AAmBD,gCAsBC;AASD,wCAYC;AAwBD,oCAaC;AA5ID,4CAAoB;AACpB,gDAA4B;AAC5B,sDAAoD;AACpD,+BAA6B;AAsB7B,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,+EAA+E;AAC/E,SAAgB,gBAAgB;IAC9B,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IACjB,MAAM,KAAK,GAAI,iBAAO,CAAC,MAA6E,CAAC,SAAS,CAAC;IAC/G,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,KAAK,CAAC,GAAG,GAAG,UAAyB,GAAG,IAAe;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA2B,CAAC,CAAC,CAAC,GAAG,CAAC;QACzG,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC1E,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAQD,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAE1D,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACpD,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAEnF,0EAA0E;AAC1E,SAAgB,UAAU,CAAC,GAAgB;IACzC,MAAM,MAAM,GAAI,GAA0D,CAAC,MAAM,IAAK,GAAuC,CAAC,OAAO,CAAC;IACtI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,MAAc,EAAE,EAAE;QAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzF,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,EAAe,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChG,KAAK,MAAM,KAAK,IAAI,MAAM;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAA,YAAK,EAAC,YAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjF;;;;GAIG;AACH,SAAgB,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAwD,CAAC;IACvF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC;QACvB,MAAM,UAAU,GACd,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAC7C,CAAC,CAAE,QAAQ,CAAC,cAAQ,CAAC,OAAO,CAAC,cAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAA6B;YAC1F,CAAC,CAAC,IAAI,CAAC;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4GAA4G;AAC5G,MAAM,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAY,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1G,MAAM,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAY,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;AAEhF;;;GAGG;AACU,QAAA,eAAe,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AASpE;;;;GAIG;AACH,SAAgB,YAAY,CAAC,GAAgB,EAAE,QAAgB,EAAE,SAAiC,EAAE;IAClG,MAAM,KAAK,GAAG,CAAC,GAAG,uBAAe,EAAE,GAAG,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,QAAkB,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChG,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACzF,CAAC;AACJ,CAAC"}

package/dist/testing/serviceTestSetup.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const session_1 = require("../auth/session");
 const membership_1 = require("../groups/membership");
+const openapi_1 = require("./openapi");
 /**
  * Jest setup for service test suites: they sign session tokens without a
  * session and run with no database or group-service, so every token's session
@@ -15,4 +16,6 @@ const membership_1 = require("../groups/membership");
 // No group-service either: a test token's own `groups` claim is taken as the
 // person's membership. The live lookup is tested in groups/membership.test.ts.
 (0, membership_1.overrideMembershipLookupForTests)(async (user) => user.groups ?? []);
+// Before any app is built, so the OpenAPI drift check can see where routers are mounted.
+(0, openapi_1.recordMountPaths)();
 //# sourceMappingURL=serviceTestSetup.js.map

package/dist/testing/serviceTestSetup.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceTestSetup.js","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAC/D,qDAAwE;AAExE;;;;;;;;GAQG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,+EAA+E;AAC/E,IAAA,6CAAgC,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC"}
+{"version":3,"file":"serviceTestSetup.js","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAC/D,qDAAwE;AACxE,uCAA6C;AAE7C;;;;;;;;GAQG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,+EAA+E;AAC/E,IAAA,6CAAgC,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAEpE,yFAAyF;AACzF,IAAA,0BAAgB,GAAE,CAAC"}

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@tumbaland/backend-core",
-  "version": "1.49.0",
+  "version": "1.51.0",
   "description": "Core shared functionality for Tumbaland backend services",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
-    "testing.js"
+    "testing.js",
+    "testing.d.ts"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
@@ -60,6 +61,7 @@
     "prom-client": "^15.1.3",
     "uuid": "^14.0.3",
     "winston": "^3.19.0",
+    "yaml": "^2.9.1",
     "zod": "^4.6.7"
   },
   "peerDependencies": {

package/testing.d.ts

@@ -0,0 +1 @@
+export * from './dist/testing/openapi';

package/testing.js

@@ -8,3 +8,6 @@
  * The session check itself is tested in backend-core (src/auth/session.test.ts).
  */
 require('./dist/testing/serviceTestSetup');
+
+// The OpenAPI drift check, for a service's docs test.
+module.exports = require('./dist/testing/openapi');