@urateam/core 0.1.4 → 0.1.8

package/dist/__tests__/audit/audit-e2e.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-e2e.test.d.ts.map

package/dist/__tests__/audit/audit-e2e.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-e2e.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/audit-e2e.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit/audit-e2e.test.js

@@ -0,0 +1,56 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { createDb } from "../../db/client.js";
+import { pipelineRuns } from "../../db/schema.js";
+import { logAuditEvent } from "../../audit/writer.js";
+import { pmPromotedEvent } from "../../audit/events.js";
+import { listAuditEvents } from "../../audit/reader.js";
+import { installTestProLicense, restoreLicense } from "../helpers/license.js";
+let db;
+beforeEach(async () => {
+    await installTestProLicense("enterprise");
+    db = await createDb({ connectionString: ":memory:" });
+});
+afterEach(async () => {
+    await restoreLicense();
+});
+describe("audit log end-to-end", () => {
+    it("surfaces projected pipeline_runs events and native audit_events through listAuditEvents", async () => {
+        // Seed completed pipeline run with autoMerged=true
+        await db.insert(pipelineRuns).values({
+            id: "run_int_1",
+            issueId: "BEC-INT",
+            issueTitle: "integration test issue",
+            pipelineKey: "auto-implement",
+            repoUrl: "https://example.com/org/repo",
+            status: "completed",
+            startedAt: new Date("2026-04-01T10:00:00Z"),
+            completedAt: new Date("2026-04-01T10:05:00Z"),
+            totalInputTokens: 1000,
+            totalOutputTokens: 500,
+            runType: "standard",
+            linearTeamId: "T-int",
+            autoMerged: true,
+            autoMergeReason: "trivial diff",
+        });
+        // Seed native audit event with team scope
+        const promoted = pmPromotedEvent({
+            issueId: "BEC-INT",
+            fromState: "Backlog",
+            toState: "Todo",
+        });
+        promoted.scope = "team:T-int";
+        await logAuditEvent(db, promoted);
+        const { events } = await listAuditEvents(db, { limit: 100 });
+        const types = events.map(e => e.eventType);
+        expect(types).toContain("run.started");
+        expect(types).toContain("run.completed");
+        expect(types).toContain("run.auto_merged");
+        expect(types).toContain("pm.issue_promoted");
+        const { events: byRun } = await listAuditEvents(db, { runId: "run_int_1", limit: 100 });
+        expect(byRun.length).toBeGreaterThan(0);
+        for (const e of byRun) {
+            expect(e.runId).toBe("run_int_1");
+        }
+    });
+});
+//# sourceMappingURL=audit-e2e.test.js.map

package/dist/__tests__/audit/audit-e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-e2e.test.js","sourceRoot":"","sources":["../../../src/__tests__/audit/audit-e2e.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE9E,IAAI,EAAO,CAAC;AAEZ,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1C,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,cAAc,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,mDAAmD;QACnD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACnC,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,wBAAwB;YACpC,WAAW,EAAE,gBAAgB;YAC7B,OAAO,EAAE,8BAA8B;YACvC,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;YAC3C,WAAW,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;YAC7C,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,GAAG;YACtB,OAAO,EAAE,UAAU;YACnB,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,cAAc;SAChC,CAAC,CAAC;QAEH,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC;QAC9B,MAAM,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAElC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAE7C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit/csv.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=csv.test.d.ts.map

package/dist/__tests__/audit/csv.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/csv.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit/csv.test.js

@@ -0,0 +1,134 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { createDb } from "../../db/client.js";
+import { logAuditEvent } from "../../audit/writer.js";
+import { pmPromotedEvent, budgetRefusedEvent } from "../../audit/events.js";
+import { streamAuditCsv } from "../../audit/csv.js";
+import { installTestProLicense, restoreLicense } from "../helpers/license.js";
+let db;
+beforeEach(async () => {
+    await installTestProLicense("enterprise");
+    db = await createDb({ connectionString: ":memory:" });
+});
+afterEach(async () => {
+    await restoreLicense();
+});
+async function collect(gen) {
+    const out = [];
+    for await (const row of gen)
+        out.push(row);
+    return out;
+}
+describe("streamAuditCsv", () => {
+    it("yields header row first", async () => {
+        const rows = await collect(streamAuditCsv(db, {}));
+        expect(rows[0]).toBe("timestamp_utc,event_type,actor,actor_type,scope,run_id,issue_id,input_tokens,output_tokens,payload_json");
+    });
+    it("streams data rows after header", async () => {
+        await logAuditEvent(db, pmPromotedEvent({ issueId: "BEC-1", fromState: "Backlog", toState: "Todo" }));
+        await logAuditEvent(db, budgetRefusedEvent({
+            scope: "team:T1",
+            scopeType: "team",
+            tokensUsed: 100,
+            limit: 100,
+            utilization: 100,
+        }));
+        const rows = await collect(streamAuditCsv(db, {}));
+        expect(rows.length).toBeGreaterThanOrEqual(3);
+        expect(rows[0]).toMatch(/^timestamp_utc,/);
+        // data rows should have 10 fields (allowing embedded escaped quotes)
+        const dataRow = rows[1];
+        expect(dataRow).toContain(",");
+    });
+    it("escapes fields containing commas, quotes, and newlines", async () => {
+        // scope is written as-is (not JSON-stringified), so a raw
+        // `has "quotes", commas` value must be CSV-escaped: wrap in quotes,
+        // double internal quotes → `"has ""quotes"", commas"`.
+        await logAuditEvent(db, {
+            id: "evt_csv_1",
+            timestamp: new Date(),
+            eventType: "pm.issue_promoted",
+            actor: "pm-agent",
+            actorType: "system",
+            scope: 'has "quotes", commas',
+            runId: null,
+            issueId: "BEC-1",
+            inputTokens: 0,
+            outputTokens: 0,
+            payload: {},
+        });
+        const rows = await collect(streamAuditCsv(db, {}));
+        const dataRow = rows.find((r) => r.includes("pm.issue_promoted"));
+        expect(dataRow).toBeDefined();
+        // scope field should have escaped doubled quotes around "quotes"
+        expect(dataRow).toContain('""quotes""');
+        // and the scope cell should be wrapped in quotes
+        expect(dataRow).toContain('"has ""quotes"", commas"');
+    });
+    it("escapes fields containing newlines", async () => {
+        await logAuditEvent(db, {
+            id: "evt_csv_2",
+            timestamp: new Date(),
+            eventType: "pm.issue_promoted",
+            actor: "pm-agent",
+            actorType: "system",
+            scope: "line1\nline2",
+            runId: null,
+            issueId: "BEC-1",
+            inputTokens: 0,
+            outputTokens: 0,
+            payload: {},
+        });
+        const rows = await collect(streamAuditCsv(db, {}));
+        const dataRow = rows.find((r) => r.includes("pm.issue_promoted"));
+        expect(dataRow).toContain('"line1\nline2"');
+    });
+    it("neutralizes formula-injection prefixes in user-controlled fields", async () => {
+        // Excel/Sheets interpret cells starting with =, +, -, @, or \t as formulas.
+        // RFC 4180 quoting alone does NOT defeat this — we must prefix with a single quote.
+        for (const [id, actor] of [
+            ["evt_eq", '=HYPERLINK("http://evil.com","Click")'],
+            ["evt_plus", "+1+2"],
+            ["evt_minus", "-2+3"],
+            ["evt_at", "@SUM(A1:A2)"],
+            ["evt_tab", "\tinjected"],
+        ]) {
+            await logAuditEvent(db, {
+                id,
+                timestamp: new Date(),
+                eventType: "dashboard.manual_action",
+                actor,
+                actorType: "dashboard-user",
+                scope: null,
+                runId: null,
+                issueId: null,
+                inputTokens: 0,
+                outputTokens: 0,
+                payload: {},
+            });
+        }
+        const rows = await collect(streamAuditCsv(db, {}));
+        const dataRows = rows.filter((r) => r.includes("dash"));
+        // Every row's actor field must begin with a literal single quote AFTER any wrapping quotes.
+        // For RFC-4180-quoted cells: `"'=HYPERLINK..."`; for unquoted: `'+1+2`.
+        for (const row of dataRows) {
+            // The actor cell is field index 2 (timestamp,event_type,actor,...). Find the third comma-separated field.
+            // Easier assertion: the row must contain the literal escape prefix.
+            expect(row.includes(",'=") ||
+                row.includes(",'+") ||
+                row.includes(",'-") ||
+                row.includes(",'@") ||
+                row.includes(",'\t") ||
+                row.includes(',"\'=')).toBe(true);
+        }
+    });
+    it("pages through events via pageSize", async () => {
+        for (let i = 0; i < 6; i++) {
+            await logAuditEvent(db, pmPromotedEvent({ issueId: `BEC-${i}`, fromState: "Backlog", toState: "Todo" }));
+        }
+        const rows = await collect(streamAuditCsv(db, {}, 3));
+        // 1 header + 6 data rows across 2 pages
+        expect(rows.length).toBe(7);
+        expect(rows[0]).toMatch(/^timestamp_utc,/);
+    });
+});
+//# sourceMappingURL=csv.test.js.map

package/dist/__tests__/audit/csv.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.test.js","sourceRoot":"","sources":["../../../src/__tests__/audit/csv.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE9E,IAAI,EAAO,CAAC;AAEZ,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1C,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,cAAc,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,OAAO,CAAC,GAA0B;IAC/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAClB,yGAAyG,CAC1G,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,aAAa,CACjB,EAAE,EACF,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAC7E,CAAC;QACF,MAAM,aAAa,CACjB,EAAE,EACF,kBAAkB,CAAC;YACjB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,GAAG;YACV,WAAW,EAAE,GAAG;SACjB,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,qEAAqE;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,0DAA0D;QAC1D,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,aAAa,CAAC,EAAE,EAAE;YACtB,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,sBAAsB;YAC7B,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,iEAAiE;QACjE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACxC,iDAAiD;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,aAAa,CAAC,EAAE,EAAE;YACtB,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,4EAA4E;QAC5E,oFAAoF;QACpF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI;YACxB,CAAC,QAAQ,EAAE,uCAAuC,CAAC;YACnD,CAAC,UAAU,EAAE,MAAM,CAAC;YACpB,CAAC,WAAW,EAAE,MAAM,CAAC;YACrB,CAAC,QAAQ,EAAE,aAAa,CAAC;YACzB,CAAC,SAAS,EAAE,YAAY,CAAC;SACjB,EAAE,CAAC;YACX,MAAM,aAAa,CAAC,EAAE,EAAE;gBACtB,EAAE;gBACF,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,yBAAyB;gBACpC,KAAK;gBACL,SAAS,EAAE,gBAAgB;gBAC3B,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,CAAC;gBACd,YAAY,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,4FAA4F;QAC5F,wEAAwE;QACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,0GAA0G;YAC1G,oEAAoE;YACpE,MAAM,CACJ,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACjB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACpB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,aAAa,CACjB,EAAE,EACF,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,wCAAwC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit/events.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=events.test.d.ts.map

package/dist/__tests__/audit/events.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/events.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit/events.test.js

@@ -0,0 +1,45 @@
+import { describe, it, expect } from "vitest";
+import { pmPromotedEvent, pmCancelledEvent, budgetRefusedEvent, licenseValidationFailedEvent, configLoadedEvent, } from "../../audit/events.js";
+import { AuditEventSchema } from "../../types.js";
+describe("audit event builders", () => {
+    it("pmPromotedEvent produces a valid event", () => {
+        const evt = pmPromotedEvent({
+            issueId: "BEC-1", fromState: "Backlog", toState: "Todo",
+            priority: 2, reason: "top-of-queue",
+        });
+        const parsed = AuditEventSchema.parse(evt);
+        expect(parsed.eventType).toBe("pm.issue_promoted");
+        expect(parsed.actor).toBe("pm-agent");
+        expect(parsed.actorType).toBe("pm-agent");
+        expect(parsed.issueId).toBe("BEC-1");
+        expect(parsed.payload).toMatchObject({ fromState: "Backlog", toState: "Todo" });
+    });
+    it("budgetRefusedEvent includes scope breakdown", () => {
+        const evt = budgetRefusedEvent({
+            scope: "team:T1", scopeType: "team",
+            tokensUsed: 100000, limit: 100000, utilization: 100,
+        });
+        const parsed = AuditEventSchema.parse(evt);
+        expect(parsed.eventType).toBe("budget.run_refused");
+        expect(parsed.scope).toBe("team:T1");
+        expect(parsed.payload).toMatchObject({ tokensUsed: 100000, limit: 100000 });
+    });
+    it("licenseValidationFailedEvent sets actor=system", () => {
+        const evt = licenseValidationFailedEvent({ invalidReason: "expired" });
+        expect(evt.actor).toBe("system");
+        expect(evt.actorType).toBe("system");
+        expect(evt.eventType).toBe("license.validation_failed");
+    });
+    it("configLoadedEvent includes path + sha256 + tier", () => {
+        const evt = configLoadedEvent({ path: "/tmp/ura.yaml", sha256: "abc123", tier: "enterprise" });
+        expect(evt.eventType).toBe("config.loaded");
+        expect(evt.payload).toMatchObject({ path: "/tmp/ura.yaml", sha256: "abc123", tier: "enterprise" });
+    });
+    it("all builders return new ids and recent timestamps", () => {
+        const a = pmCancelledEvent({ issueId: "BEC-1", approvalId: "a1", reason: "stale" });
+        const b = pmCancelledEvent({ issueId: "BEC-2", approvalId: "a2", reason: "dup" });
+        expect(a.id).not.toBe(b.id);
+        expect(Date.now() - a.timestamp.getTime()).toBeLessThan(1000);
+    });
+});
+//# sourceMappingURL=events.test.js.map

package/dist/__tests__/audit/events.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.test.js","sourceRoot":"","sources":["../../../src/__tests__/audit/events.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EAAwB,gBAAgB,EACvD,kBAAkB,EAAE,4BAA4B,EAAE,iBAAiB,GACpE,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;YACvD,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM;YACnC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG;SACpD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,4BAA4B,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit/policy-events.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-events.test.d.ts.map

package/dist/__tests__/audit/policy-events.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-events.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/policy-events.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit/policy-events.test.js

@@ -0,0 +1,49 @@
+import { describe, it, expect } from "vitest";
+import { policyPathBlockedEvent, policyCostExceededEvent, policyOverrideUsedEvent, policyReviewersRequestedEvent, } from "../../audit/events.js";
+import { AuditEventSchema } from "../../types.js";
+describe("policy audit event builders", () => {
+    it("policyPathBlockedEvent", () => {
+        const evt = policyPathBlockedEvent({
+            runId: "r_1",
+            path: "infra/main.tf",
+            pattern: "infra/**",
+            hadOverride: false,
+        });
+        const p = AuditEventSchema.parse(evt);
+        expect(p.eventType).toBe("policy.path_blocked");
+        expect(p.runId).toBe("r_1");
+        expect(p.payload).toMatchObject({ path: "infra/main.tf", pattern: "infra/**" });
+    });
+    it("policyCostExceededEvent", () => {
+        const evt = policyCostExceededEvent({
+            runId: "r_1",
+            tokensUsed: 600000,
+            limit: 500000,
+            stage: "implement",
+            hadOverride: false,
+        });
+        expect(evt.eventType).toBe("policy.cost_exceeded");
+        expect(evt.payload).toMatchObject({ tokensUsed: 600000, limit: 500000, stage: "implement" });
+    });
+    it("policyOverrideUsedEvent", () => {
+        const evt = policyOverrideUsedEvent({
+            runId: "r_1",
+            issueId: "BEC-1",
+            gateType: "path",
+            label: "policy-override",
+        });
+        expect(evt.eventType).toBe("policy.override_used");
+        expect(evt.payload).toMatchObject({ gateType: "path", label: "policy-override" });
+    });
+    it("policyReviewersRequestedEvent", () => {
+        const evt = policyReviewersRequestedEvent({
+            runId: "r_1",
+            prUrl: "https://github.com/x/y/pull/1",
+            users: ["alice"],
+            teams: ["security"],
+        });
+        expect(evt.eventType).toBe("policy.reviewers_requested");
+        expect(evt.payload).toMatchObject({ users: ["alice"], teams: ["security"] });
+    });
+});
+//# sourceMappingURL=policy-events.test.js.map

package/dist/__tests__/audit/policy-events.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-events.test.js","sourceRoot":"","sources":["../../../src/__tests__/audit/policy-events.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,6BAA6B,CAAC;YACxC,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,+BAA+B;YACtC,KAAK,EAAE,CAAC,OAAO,CAAC;YAChB,KAAK,EAAE,CAAC,UAAU,CAAC;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit/projection.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=projection.test.d.ts.map

package/dist/__tests__/audit/projection.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/projection.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit/projection.test.js

@@ -0,0 +1,76 @@
+import { describe, it, expect } from "vitest";
+import { projectPipelineRun, projectPmApproval, projectBudgetAlert, } from "../../audit/projection.js";
+describe("projection", () => {
+    it("projects a completed run into started + completed events", () => {
+        const startedAt = new Date("2026-04-01T10:00:00Z");
+        const completedAt = new Date("2026-04-01T10:05:00Z");
+        const events = projectPipelineRun({
+            id: "run_1", issueId: "BEC-1", pipelineKey: "auto-implement",
+            status: "completed", startedAt, completedAt,
+            totalInputTokens: 500, totalOutputTokens: 200,
+            runType: "standard", parentRunId: null, linearTeamId: "T1",
+            repoUrl: "https://github.com/x/y", autoMerged: null, autoMergeReason: null,
+            errorMessage: null,
+        });
+        expect(events.map(e => e.eventType)).toEqual(["run.started", "run.completed"]);
+        expect(events[0].timestamp).toEqual(startedAt);
+        expect(events[1].timestamp).toEqual(completedAt);
+        expect(events[1].inputTokens).toBe(500);
+        expect(events[1].outputTokens).toBe(200);
+        expect(events[0].scope).toBe("team:T1");
+    });
+    it("projects a failed run into started + failed", () => {
+        const events = projectPipelineRun({
+            id: "run_2", issueId: "BEC-2", status: "failed",
+            startedAt: new Date(), completedAt: new Date(),
+            totalInputTokens: 0, totalOutputTokens: 0,
+            runType: "standard", parentRunId: null, linearTeamId: null,
+            repoUrl: "https://github.com/x/y", autoMerged: null, autoMergeReason: null,
+            errorMessage: "boom",
+        });
+        expect(events.map(e => e.eventType)).toEqual(["run.started", "run.failed"]);
+        expect(events[1].payload.errorMessage).toBe("boom");
+    });
+    it("adds run.auto_merged when autoMerged=true", () => {
+        const events = projectPipelineRun({
+            id: "run_3", issueId: "BEC-3", status: "completed",
+            startedAt: new Date(), completedAt: new Date(),
+            totalInputTokens: 0, totalOutputTokens: 0,
+            runType: "standard", parentRunId: null, linearTeamId: null,
+            repoUrl: "x", autoMerged: true, autoMergeReason: "PR auto-merged",
+            errorMessage: null,
+        });
+        expect(events.map(e => e.eventType)).toContain("run.auto_merged");
+    });
+    it("adds run.auto_merge_skipped when autoMerged=false with reason", () => {
+        const events = projectPipelineRun({
+            id: "run_4", issueId: "BEC-4", status: "completed",
+            startedAt: new Date(), completedAt: new Date(),
+            totalInputTokens: 0, totalOutputTokens: 0,
+            runType: "standard", parentRunId: null, linearTeamId: null,
+            repoUrl: "x", autoMerged: false, autoMergeReason: "diff too large",
+            errorMessage: null,
+        });
+        expect(events.map(e => e.eventType)).toContain("run.auto_merge_skipped");
+    });
+    it("projects a pm approval into requested + resolved when resolvedAt set", () => {
+        const events = projectPmApproval({
+            id: "a1", issueId: "BEC-9", action: "cancel",
+            reason: "stale", slackMessageTs: "ts", status: "approved",
+            createdAt: new Date("2026-04-01"), resolvedAt: new Date("2026-04-02"),
+        });
+        expect(events.map(e => e.eventType)).toEqual([
+            "pm.approval_requested", "pm.approval_resolved",
+        ]);
+    });
+    it("projects a budget alert", () => {
+        const ev = projectBudgetAlert({
+            id: "ba1", date: "2026-04-01", scope: "team:T1", threshold: 80,
+            firedAt: new Date("2026-04-01T10:00:00Z"),
+        });
+        expect(ev.eventType).toBe("budget.alert_fired");
+        expect(ev.scope).toBe("team:T1");
+        expect(ev.payload).toMatchObject({ threshold: 80, date: "2026-04-01" });
+    });
+});
+//# sourceMappingURL=projection.test.js.map

package/dist/__tests__/audit/projection.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.test.js","sourceRoot":"","sources":["../../../src/__tests__/audit/projection.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,GAC1D,MAAM,2BAA2B,CAAC;AAEnC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB;YAC5D,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW;YAC3C,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG;YAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;YAC1D,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI;YAC1E,YAAY,EAAE,IAAI;SACZ,CAAC,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;YAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE;YAC9C,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;YAC1D,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI;YAC1E,YAAY,EAAE,MAAM;SACd,CAAC,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW;YAClD,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE;YAC9C,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;YAC1D,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,gBAAgB;YACjE,YAAY,EAAE,IAAI;SACZ,CAAC,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW;YAClD,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE;YAC9C,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;YAC1D,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB;YAClE,YAAY,EAAE,IAAI;SACZ,CAAC,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;YAC5C,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU;YACzD,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;SAC/D,CAAC,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,uBAAuB,EAAE,sBAAsB;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,EAAE,GAAG,kBAAkB,CAAC;YAC5B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;YAC9D,OAAO,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;SACnC,CAAC,CAAC;QACV,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit/rbac-events.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rbac-events.test.d.ts.map

package/dist/__tests__/audit/rbac-events.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-events.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/rbac-events.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/audit/rbac-events.test.js

@@ -0,0 +1,56 @@
+import { describe, it, expect } from "vitest";
+import { dashboardGrantRoleEvent, dashboardRevokeRoleEvent, dashboardBootstrapAdminEvent, dashboardRetryRunEvent, } from "../../audit/events.js";
+import { AuditEventSchema } from "../../types.js";
+describe("rbac audit event builders", () => {
+    it("dashboardGrantRoleEvent", () => {
+        const evt = dashboardGrantRoleEvent({
+            targetUserId: "u_1",
+            targetEmail: "a@b.com",
+            oldRole: "viewer",
+            newRole: "operator",
+            actorUserId: "u_admin",
+            actorEmail: "admin@b.com",
+        });
+        const p = AuditEventSchema.parse(evt);
+        expect(p.eventType).toBe("dashboard.manual_action");
+        expect(p.actor).toBe("dashboard:admin@b.com");
+        expect(p.payload.action).toBe("grant_role");
+        expect(p.payload.oldRole).toBe("viewer");
+        expect(p.payload.newRole).toBe("operator");
+    });
+    it("dashboardRevokeRoleEvent", () => {
+        const evt = dashboardRevokeRoleEvent({
+            targetUserId: "u_1",
+            targetEmail: "a@b.com",
+            oldRole: "operator",
+            newRole: "viewer",
+            actorUserId: "u_admin",
+            actorEmail: "admin@b.com",
+        });
+        expect(evt.payload.action).toBe("revoke_role");
+    });
+    it("dashboardBootstrapAdminEvent", () => {
+        const evt = dashboardBootstrapAdminEvent({
+            targetUserId: "u_1",
+            targetEmail: "alice@acme.com",
+        });
+        expect(evt.eventType).toBe("dashboard.manual_action");
+        expect(evt.actor).toBe("system");
+        expect(evt.actorType).toBe("system");
+        expect(evt.payload.action).toBe("bootstrap_admin");
+    });
+    it("dashboardRetryRunEvent", () => {
+        const evt = dashboardRetryRunEvent({
+            runId: "run_1",
+            issueId: "BEC-42",
+            previousStatus: "failed",
+            actorUserId: "u_op",
+            actorEmail: "op@b.com",
+        });
+        expect(evt.payload.action).toBe("retry_run");
+        expect(evt.runId).toBe("run_1");
+        expect(evt.issueId).toBe("BEC-42");
+        expect(evt.actor).toBe("dashboard:op@b.com");
+    });
+});
+//# sourceMappingURL=rbac-events.test.js.map

package/dist/__tests__/audit/rbac-events.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-events.test.js","sourceRoot":"","sources":["../../../src/__tests__/audit/rbac-events.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC9C,MAAM,CAAE,CAAC,CAAC,OAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,CAAE,CAAC,CAAC,OAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAE,CAAC,CAAC,OAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,GAAG,GAAG,wBAAwB,CAAC;YACnC,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;QACH,MAAM,CAAE,GAAG,CAAC,OAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,GAAG,GAAG,4BAA4B,CAAC;YACvC,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAE,GAAG,CAAC,OAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,QAAQ;YACxB,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,CAAE,GAAG,CAAC,OAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/audit/reader.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reader.test.d.ts.map

package/dist/__tests__/audit/reader.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/audit/reader.test.ts"],"names":[],"mappings":""}