@venturekit-pro/audit 0.0.0-dev.20260602192622

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2025 VentureKit Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,124 @@
+# @venturekit-pro/audit
+
+Strictly-scoped, append-only audit log for VentureKit applications.
+
+**The package records WHO did WHAT, TO WHAT, WHEN, and HOW IT WENT.
+Nothing else.** Domain concerns (USD cost, payment totals, token usage,
+LLM provider/model, latency) live in their own packages' tables (e.g.
+`@venturekit-pro/ai`'s `llm_cost_events`) and reference this one via
+`correlation_id` / `target_type` + `target_id`. The audit package never
+sees money, tokens, or any other domain primitive.
+
+Event kinds (`'blog.save'`, `'order.refunded'`, `'security.login'`, …) are
+free-form strings the calling app chooses and namespaces however it likes.
+
+## What it gives you
+
+- **One canonical `audit_events` table** keyed by
+  `(tenant_id, kind, target_type, target_id)`.
+- **Append-only by construction** — DB-level `REVOKE UPDATE, DELETE` on
+  `audit_events` from `PUBLIC` so a SQL bug can't silently mutate
+  compliance history. Retention pruning runs as a privileged
+  maintenance role through `pruneAuditEvents()`.
+- **Idempotent writes** via an optional `idempotency_key` — repeated
+  retries of the same operation never produce duplicate rows.
+- **Pure-audit aggregation helpers** — `countEvents()` /
+  `monthlyEventCounts()` with an optional `byKindPrefix` split for
+  per-namespace tallies.
+
+## Wire-up
+
+```ts
+// In your VentureKit project's vk.config.ts:
+import { getAuditMigrationsDir } from '@venturekit-pro/audit';
+
+export default defineVenture({
+  // ...
+  extraMigrationsDirs: [getAuditMigrationsDir()],
+});
+```
+
+`vk migrate` then runs the package's `vk_audit_*.sql` files alongside your
+project's own migrations.
+
+## Recording
+
+```ts
+import { record } from '@venturekit-pro/audit';
+import { query } from '@venturekit/data';
+
+await record(query, {
+  tenantId,
+  actor: { type: 'user', id: userSub },
+  kind: 'order.refunded',                       // free-form, app-namespaced
+  target: { type: 'order', id: order.id },
+  payload: { reason: 'duplicate' },             // free-form jsonb
+});
+
+// Threaded with a correlation id so several events link to the same op:
+await record(query, {
+  tenantId,
+  actor: { type: 'service', id: 'workflow-runner' },
+  kind: 'workflow.step.completed',
+  target: { type: 'workflow_run', id: run.id },
+  correlationId: run.id,
+  payload: { stepName: 'critique' },
+  idempotencyKey: `${run.id}/step-3/attempt-1`,
+});
+```
+
+## Listing
+
+```ts
+import { listEvents } from '@venturekit-pro/audit';
+
+await listEvents(query, { tenantId, limit: 50 });
+await listEvents(query, { tenantId, kindPrefix: 'order.' });
+await listEvents(query, { tenantId, targetType: 'order', targetId });
+await listEvents(query, { tenantId, correlationId: runId });
+await listEvents(query, { tenantId, status: 'failed' });
+await listEvents(query, { tenantId, actorType: 'cron' });
+```
+
+## Counting / activity volume
+
+```ts
+import { countEvents, monthlyEventCounts } from '@venturekit-pro/audit';
+
+// Total events in a window:
+await countEvents(query, {
+  tenantId,
+  since: new Date('2026-05-01'),
+  until: new Date('2026-06-01'),
+});
+// → { count: 1247, byKindPrefix: {} }
+
+// Split by whatever kind-prefixes the app cares about:
+await countEvents(query, {
+  tenantId,
+  byKindPrefix: ['order.', 'security.', 'workflow.'],
+});
+// → { count: 1247, byKindPrefix: { 'order.': 320, 'security.': 12, 'workflow.': 915 } }
+
+// Monthly activity buckets:
+await monthlyEventCounts(query, { tenantId, monthCount: 6, byKindPrefix: ['order.'] });
+// → [{ month: '2025-12-01', count: 245, byKindPrefix: { 'order.': 80 } }, …]
+```
+
+## Retention
+
+`pruneAuditEvents()` is the only mutating helper besides `record()`. It
+runs as a **privileged maintenance role** (the application role has
+`DELETE` revoked by the migration), is paginated to avoid long
+transactions, and never auto-fires — the consumer wires it into its own
+cron with a retention policy that fits its compliance regime.
+
+```ts
+import { pruneAuditEvents, previewPrune } from '@venturekit-pro/audit';
+
+// What WOULD be pruned (safe to call from app role):
+await previewPrune(query, { olderThanDays: 365, batchSize: 1000 });
+
+// Actually delete (requires DELETE privileges):
+await pruneAuditEvents(adminQuery, { olderThanDays: 365, batchSize: 1000 });
+```

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @venturekit-pro/audit
+ *
+ * Strictly-scoped, append-only audit log.
+ *
+ * Records WHO did WHAT, TO WHAT, WHEN, and HOW IT WENT. Nothing else.
+ * Domain rollups (cost, payment totals, token usage) live in their
+ * own packages' tables and reference this one via `correlationId` /
+ * `target`.
+ *
+ *   - `record(querier, input)`              — write one event.
+ *   - `listEvents(querier, args)`           — paginated newest-first list.
+ *   - `countEvents(querier, args)`          — count, with optional
+ *                                              byKindPrefix split.
+ *   - `monthlyEventCounts(querier, args)`   — trailing-N-months
+ *                                              activity volume.
+ *   - `pruneAuditEvents` / `previewPrune`   — retention sweep
+ *                                              (privileged role).
+ *   - `getAuditMigrationsDir()`             — path to `vk_audit_*.sql`
+ *                                              files for `vk migrate`.
+ *
+ * Documentation: https://venturekit.dev
+ */
+export type { AuditEvent, AuditEventInput, AuditActor, AuditActorType, AuditTarget, AuditStatus, EventCount, Querier, } from './types.js';
+export { record } from './record.js';
+export { listEvents, countEvents, monthlyEventCounts, } from './query.js';
+export type { ListEventsArgs, CountEventsArgs, MonthlyEventCountsArgs, MonthlyCountBucket, } from './query.js';
+export { pruneAuditEvents, previewPrune } from './retention.js';
+export type { PruneOptions } from './retention.js';
+export { getAuditMigrationsDir } from './path.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,YAAY,EACV,UAAU,EACV,eAAe,EACf,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,UAAU,EACV,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EACL,UAAU,EACV,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,28 @@
+/**
+ * @venturekit-pro/audit
+ *
+ * Strictly-scoped, append-only audit log.
+ *
+ * Records WHO did WHAT, TO WHAT, WHEN, and HOW IT WENT. Nothing else.
+ * Domain rollups (cost, payment totals, token usage) live in their
+ * own packages' tables and reference this one via `correlationId` /
+ * `target`.
+ *
+ *   - `record(querier, input)`              — write one event.
+ *   - `listEvents(querier, args)`           — paginated newest-first list.
+ *   - `countEvents(querier, args)`          — count, with optional
+ *                                              byKindPrefix split.
+ *   - `monthlyEventCounts(querier, args)`   — trailing-N-months
+ *                                              activity volume.
+ *   - `pruneAuditEvents` / `previewPrune`   — retention sweep
+ *                                              (privileged role).
+ *   - `getAuditMigrationsDir()`             — path to `vk_audit_*.sql`
+ *                                              files for `vk migrate`.
+ *
+ * Documentation: https://venturekit.dev
+ */
+export { record } from './record.js';
+export { listEvents, countEvents, monthlyEventCounts, } from './query.js';
+export { pruneAuditEvents, previewPrune } from './retention.js';
+export { getAuditMigrationsDir } from './path.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAaH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EACL,UAAU,EACV,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC"}

package/dist/migrations/vk_audit_0001_init.sql

@@ -0,0 +1,152 @@
+-- @venturekit-pro/audit — initial schema.
+--
+-- One canonical, append-only `audit_events` table. Stores WHO did
+-- WHAT, TO WHAT, WHEN, and HOW IT WENT. Nothing else.
+--
+-- **Strict scope.** The audit package does not know about LLM costs,
+-- token counts, image generation, payment amounts, or any other
+-- domain concern. Those live in their own packages / tables
+-- (e.g. `@venturekit-pro/ai`'s `llm_cost_events`); audit events
+-- merely reference them by `target_type` / `target_id` /
+-- `correlation_id`.
+--
+-- Append-only by construction:
+--   - No UPDATE / DELETE statements are issued by the package code.
+--   - DB-level REVOKE on `audit_events` from the application role
+--     at the bottom of this migration enforces it physically.
+--     Privileged maintenance (retention pruning) runs as a
+--     separate role.
+--
+-- Idempotency:
+--   - `idempotency_key` is OPTIONAL on insert. When set, the
+--     partial unique index makes a re-insert a no-op (caller
+--     catches the duplicate-key error in `record()` and returns
+--     the original row).
+
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+-- ─── Status enum ────────────────────────────────────────────────────
+--
+-- Outcome of an audited action. Mirrors the standard `job_status`
+-- shape so callers can map 1:1.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'vk_audit_status') THEN
+    CREATE TYPE vk_audit_status AS ENUM (
+      'queued',
+      'running',
+      'succeeded',
+      'failed',
+      'skipped'
+    );
+  END IF;
+END
+$$;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'vk_audit_actor_type') THEN
+    CREATE TYPE vk_audit_actor_type AS ENUM (
+      'user',      -- end-user via session token
+      'service',   -- internal service identity
+      'cron',      -- scheduled-job Lambda
+      'api_key',   -- programmatic-access key
+      'system'     -- bootstrap / migration / cross-tenant maintenance
+    );
+  END IF;
+END
+$$;
+
+-- ─── audit_events ───────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS audit_events (
+  id              uuid                PRIMARY KEY DEFAULT gen_random_uuid(),
+  -- tenant_id is nullable so we can record platform-wide events
+  -- (e.g. cron sweeps that fan out across every tenant). Per-tenant
+  -- views filter on `tenant_id = $1`; the rare cross-tenant rows
+  -- show up only when querying with `tenant_id IS NULL`.
+  tenant_id       uuid,
+  -- WHO did the thing.
+  actor_type      vk_audit_actor_type NOT NULL,
+  -- Free-form actor id. For users: their auth id (e.g. Cognito sub).
+  -- For services: service name. For api_key: key prefix. For cron:
+  -- schedule rule name. NULL only for bootstrap / system rows.
+  actor_id        text,
+  -- WHAT happened. Free-form, app-namespaced (e.g. `'blog.save'`,
+  -- `'order.refunded'`, `'security.login'`). The package never
+  -- enumerates these; the calling app owns its kind taxonomy.
+  kind            text                NOT NULL,
+  -- WHAT it was done to (optional). target_type + target_id together
+  -- identify the row this event mutated or read.
+  target_type     text,
+  target_id       text,
+  -- Secondary identifier for human-readable references (slug, label).
+  target_slug     text,
+  -- Outcome of the action. Finalized rows are NEVER UPDATE'd; long
+  -- operations write a `running` row, then a separate `succeeded` /
+  -- `failed` / `skipped` row with the same `correlation_id`.
+  status          vk_audit_status     NOT NULL DEFAULT 'succeeded',
+  -- Free-form payload. Caller's responsibility to keep this small
+  -- (~< 32KB) and PII-free. Heavy artifacts go in S3 + are
+  -- referenced by URL/key.
+  payload         jsonb               NOT NULL DEFAULT '{}'::jsonb,
+
+  -- ─── Cross-event correlation ─────────────────────────────────────
+
+  -- Threads multiple events into one logical operation (a workflow
+  -- run, an HTTP request, a saga).
+  correlation_id  text,
+  -- Optional idempotency token; supports safe retry of e.g. cron
+  -- ticks. NULL is allowed and skips the dedup check.
+  idempotency_key text,
+  -- Human-readable failure summary when `status = 'failed'`.
+  error_message   text,
+
+  created_at      timestamptz         NOT NULL DEFAULT now()
+);
+
+-- ─── Indexes ────────────────────────────────────────────────────────
+
+-- Main page query: "show me the last N events for this tenant".
+CREATE INDEX IF NOT EXISTS audit_events_tenant_created_idx
+  ON audit_events (tenant_id, created_at DESC);
+
+-- Filtered list: "show me the last N 'order.refunded' events".
+CREATE INDEX IF NOT EXISTS audit_events_tenant_kind_idx
+  ON audit_events (tenant_id, kind, created_at DESC);
+
+-- Per-entity history: "every event touching blog_post X".
+CREATE INDEX IF NOT EXISTS audit_events_target_idx
+  ON audit_events (tenant_id, target_type, target_id, created_at DESC);
+
+-- Correlation join: "every event in this workflow run".
+CREATE INDEX IF NOT EXISTS audit_events_correlation_idx
+  ON audit_events (correlation_id, created_at DESC)
+  WHERE correlation_id IS NOT NULL;
+
+-- Idempotency dedup. Partial because the vast majority of rows
+-- have idempotency_key = NULL.
+CREATE UNIQUE INDEX IF NOT EXISTS audit_events_idempotency_unique
+  ON audit_events (idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+-- ─── Append-only enforcement at the storage layer ───────────────────
+--
+-- The application role can INSERT and SELECT but never UPDATE /
+-- DELETE. A privileged maintenance role (whatever the app uses to
+-- run migrations) retains full privileges, and is what retention
+-- sweeps run as.
+--
+-- We don't know the application role's name at migration time — apps
+-- vary (`venturekit_cms_app`, `myapp_runtime`, …). The REVOKE here
+-- targets `PUBLIC` which covers the default no-role-set case AND
+-- means the application role inherits the lockdown unless explicitly
+-- granted UPDATE/DELETE. Apps that grant their runtime role
+-- `ALL PRIVILEGES` on the schema must re-revoke after this migration.
+
+REVOKE UPDATE, DELETE ON audit_events FROM PUBLIC;
+
+-- A convenience GRANT so the app role still works for inserts and
+-- reads when only PUBLIC's privileges were revoked.
+GRANT SELECT, INSERT ON audit_events TO PUBLIC;

package/dist/path.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Migrations-dir helper.
+ *
+ * The CMS wires this into `vk.config.ts:extraMigrationsDirs` so
+ * `vk migrate` picks up the package's `vk_audit_*.sql` files
+ * alongside the project's own migrations.
+ *
+ * The directory is bundled into the built package (via the
+ * `files: ["src/migrations/*.sql"]` declaration in `package.json`,
+ * mirrored into `dist/migrations/` by the build script). Apps
+ * consuming the source rather than the build (workspace symlinks)
+ * read straight from `src/migrations/`.
+ */
+/**
+ * Absolute path to the `audit_events` migration files.
+ *
+ * @example
+ * ```ts
+ * // vk.config.ts
+ * import { getAuditMigrationsDir } from '@venturekit-pro/audit';
+ *
+ * export default defineVenture({
+ *   extraMigrationsDirs: [getAuditMigrationsDir()],
+ * });
+ * ```
+ */
+export declare function getAuditMigrationsDir(): string;
+//# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAQ9C"}

package/dist/path.js

@@ -0,0 +1,40 @@
+/**
+ * Migrations-dir helper.
+ *
+ * The CMS wires this into `vk.config.ts:extraMigrationsDirs` so
+ * `vk migrate` picks up the package's `vk_audit_*.sql` files
+ * alongside the project's own migrations.
+ *
+ * The directory is bundled into the built package (via the
+ * `files: ["src/migrations/*.sql"]` declaration in `package.json`,
+ * mirrored into `dist/migrations/` by the build script). Apps
+ * consuming the source rather than the build (workspace symlinks)
+ * read straight from `src/migrations/`.
+ */
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as fs from 'node:fs';
+/**
+ * Absolute path to the `audit_events` migration files.
+ *
+ * @example
+ * ```ts
+ * // vk.config.ts
+ * import { getAuditMigrationsDir } from '@venturekit-pro/audit';
+ *
+ * export default defineVenture({
+ *   extraMigrationsDirs: [getAuditMigrationsDir()],
+ * });
+ * ```
+ */
+export function getAuditMigrationsDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    // After build: dist/path.js, migrations under dist/migrations/.
+    // From source (workspace symlink): src/path.ts, migrations under
+    // src/migrations/. Try the built layout first, fall back to source.
+    const builtDir = path.join(here, 'migrations');
+    if (fs.existsSync(builtDir))
+        return builtDir;
+    return path.join(here, 'migrations');
+}
+//# sourceMappingURL=path.js.map

package/dist/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,gEAAgE;IAChE,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AACvC,CAAC"}