hazo_audit 1.0.0

package/config/hazo_audit_config.ini.sample

@@ -0,0 +1,71 @@
+; hazo_audit configuration
+;
+; Copy to `hazo_audit_config.ini` and customise. Loaded by wrapWithAudit()
+; and startAuditWorker() at startup. INI is the primary source of truth for
+; capture rules; the only TypeScript-shaped escape hatch is the `resolvers`
+; option on wrapWithAudit().
+
+[capture]
+; Whitelist by prefix or exact name. At least one of include_* must match for
+; a write to be captured (after passing exclusions).
+include_table_prefixes = app_, hazo_
+include_tables =
+
+; Blacklist by prefix or exact name. Always wins over include rules.
+exclude_table_prefixes = _
+exclude_tables = hazo_chat_typing_indicators, hazo_worker_heartbeats
+
+; Note: the audit pipeline tables themselves
+; (hazo_audit_outbox, hazo_audit_field, hazo_audit_intent)
+; are hardcoded as never-capture regardless of this config.
+
+[retention]
+; Days to keep successfully-drained outbox rows before the reaper deletes them.
+outbox_drained_ttl_days = 30
+; Days to keep dead-lettered (failed) outbox rows before reaping.
+outbox_failed_ttl_days = 90
+
+[worker]
+poll_ms = 2000
+max_attempts = 5
+; Initial retry delay in ms; multiplied by 2 per attempt.
+backoff_initial_ms = 500
+; How often the reaper sweeps old outbox rows (ms).
+reaper_interval_ms = 3600000
+
+[defaults]
+subject_id_column = id
+
+; ============================================================================
+; Per-table overrides
+; ============================================================================
+; Each [overrides.<table>] block customises capture behavior for one table.
+;
+; Keys:
+;   subject_kind         logical kind name (default: table name)
+;   subject_id_column    primary key column (default: from [defaults])
+;   sensitive_columns    comma-separated list; values masked from /audit/events
+;                         unless caller has view_sensitive_audit permission
+;   jsonb_columns        columns to decompose into per-leaf field events
+;   jsonb_path_include   prefixes to keep (after exclude); empty = keep all
+;   jsonb_path_exclude   prefixes to drop from JSONB diff output
+;   resolver             named resolver (from `resolvers: {...}` TS option)
+;                         to canonicalise / categorise JSONB paths
+;   fanout_bulk_writes   if true, emit one outbox row per affected row on
+;                         bulk inserts / non-id updates (pre-write GET)
+;
+; Example: an `app_clients` table with masked SSN/DOB columns.
+;
+; [overrides.app_clients]
+; subject_kind = client
+; sensitive_columns = ssn, dob
+;
+; Example: a `app_client_folders` table whose `working_paper` JSONB column
+; should be diffed but with internal `__prefill_data` paths suppressed.
+; A named `wp` resolver (passed to wrapWithAudit) canonicalises paths.
+;
+; [overrides.app_client_folders]
+; subject_kind = client_folder
+; jsonb_columns = working_paper
+; jsonb_path_exclude = working_paper.__prefill_data, working_paper.__reference_data
+; resolver = wp

package/dist/client/FieldAuditIcon.d.ts

@@ -0,0 +1,11 @@
+import type { FieldAuditIconProps } from './types.js';
+/**
+ * Small clock-icon button that opens a popover with the field's audit trail.
+ *
+ * Self-positioning popover (no Radix/portal dep) — anchored to the icon with
+ * a click-outside listener. If the caller lacks `view_audit_history` the
+ * /audit/events call returns 403 and the popover renders a quiet "no
+ * permission" hint.
+ */
+export declare function FieldAuditIcon(props: FieldAuditIconProps): JSX.Element;
+//# sourceMappingURL=FieldAuditIcon.d.ts.map

package/dist/client/FieldAuditIcon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FieldAuditIcon.d.ts","sourceRoot":"","sources":["../../src/client/FieldAuditIcon.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAwEtE"}

package/dist/client/FieldAuditIcon.js

@@ -0,0 +1,46 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import * as React from 'react';
+import { cn } from './cn.js';
+import { FieldAuditTrail } from './FieldAuditTrail.js';
+/**
+ * Small clock-icon button that opens a popover with the field's audit trail.
+ *
+ * Self-positioning popover (no Radix/portal dep) — anchored to the icon with
+ * a click-outside listener. If the caller lacks `view_audit_history` the
+ * /audit/events call returns 403 and the popover renders a quiet "no
+ * permission" hint.
+ */
+export function FieldAuditIcon(props) {
+    const { subjectKind, subjectId, fieldPath, api_base, className, label } = props;
+    const [open, setOpen] = React.useState(false);
+    const rootRef = React.useRef(null);
+    React.useEffect(() => {
+        if (!open)
+            return;
+        const onDocClick = (e) => {
+            if (!rootRef.current)
+                return;
+            if (!rootRef.current.contains(e.target))
+                setOpen(false);
+        };
+        const onKey = (e) => {
+            if (e.key === 'Escape')
+                setOpen(false);
+        };
+        document.addEventListener('mousedown', onDocClick);
+        document.addEventListener('keydown', onKey);
+        return () => {
+            document.removeEventListener('mousedown', onDocClick);
+            document.removeEventListener('keydown', onKey);
+        };
+    }, [open]);
+    return (_jsxs("div", { ref: rootRef, className: "relative inline-block", children: [_jsx("button", { type: "button", "aria-label": label ?? `View audit history for ${fieldPath}`, title: label ?? 'View audit history', onClick: () => setOpen((v) => !v), className: cn('inline-flex h-6 w-6 items-center justify-center rounded-full', 'text-slate-400 transition-colors hover:bg-slate-100 hover:text-slate-700', 'focus:outline-none focus:ring-2 focus:ring-slate-400', 'dark:hover:bg-slate-800 dark:hover:text-slate-200', className), children: _jsx(ClockIcon, { className: "h-3.5 w-3.5" }) }), open && (_jsxs("div", { role: "dialog", "aria-label": "Audit history", className: cn('absolute right-0 z-50 mt-2 w-96 max-w-[calc(100vw-2rem)]', 'rounded-md border border-slate-200 bg-white p-3 shadow-lg', 'dark:border-slate-700 dark:bg-slate-900'), children: [_jsxs("div", { className: "mb-2 flex items-center justify-between", children: [_jsxs("h3", { className: "text-sm font-semibold text-slate-900 dark:text-slate-100", children: ["History \u00B7 ", fieldPath] }), _jsx("button", { type: "button", "aria-label": "Close", onClick: () => setOpen(false), className: "text-slate-400 hover:text-slate-700 dark:hover:text-slate-200", children: _jsx(CloseIcon, { className: "h-4 w-4" }) })] }), _jsx(FieldAuditTrail, { subjectKind: subjectKind, subjectId: subjectId, fieldPath: fieldPath, api_base: api_base })] }))] }));
+}
+function ClockIcon({ className }) {
+    return (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", className: className, "aria-hidden": true, children: [_jsx("circle", { cx: "12", cy: "12", r: "10" }), _jsx("polyline", { points: "12 6 12 12 16 14" })] }));
+}
+function CloseIcon({ className }) {
+    return (_jsxs("svg", { viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", className: className, "aria-hidden": true, children: [_jsx("line", { x1: "18", y1: "6", x2: "6", y2: "18" }), _jsx("line", { x1: "6", y1: "6", x2: "18", y2: "18" })] }));
+}
+//# sourceMappingURL=FieldAuditIcon.js.map

package/dist/client/FieldAuditIcon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FieldAuditIcon.js","sourceRoot":"","sources":["../../src/client/FieldAuditIcon.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAChF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAC;IAEnD,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,EAAE;YACnC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO;YAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAc,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE;YACjC,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACnD,QAAQ,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACtD,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,OAAO,CACL,eAAK,GAAG,EAAE,OAAO,EAAE,SAAS,EAAC,uBAAuB,aAClD,iBACE,IAAI,EAAC,QAAQ,gBACD,KAAK,IAAI,0BAA0B,SAAS,EAAE,EAC1D,KAAK,EAAE,KAAK,IAAI,oBAAoB,EACpC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EACjC,SAAS,EAAE,EAAE,CACX,8DAA8D,EAC9D,0EAA0E,EAC1E,sDAAsD,EACtD,mDAAmD,EACnD,SAAS,CACV,YAED,KAAC,SAAS,IAAC,SAAS,EAAC,aAAa,GAAG,GAC9B,EACR,IAAI,IAAI,CACP,eACE,IAAI,EAAC,QAAQ,gBACF,eAAe,EAC1B,SAAS,EAAE,EAAE,CACX,0DAA0D,EAC1D,2DAA2D,EAC3D,yCAAyC,CAC1C,aAED,eAAK,SAAS,EAAC,wCAAwC,aACrD,cAAI,SAAS,EAAC,0DAA0D,gCAC3D,SAAS,IACjB,EACL,iBACE,IAAI,EAAC,QAAQ,gBACF,OAAO,EAClB,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAC7B,SAAS,EAAC,+DAA+D,YAEzE,KAAC,SAAS,IAAC,SAAS,EAAC,SAAS,GAAG,GAC1B,IACL,EACN,KAAC,eAAe,IACd,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,QAAQ,GAClB,IACE,CACP,IACG,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EAAE,SAAS,EAA0B;IACtD,OAAO,CACL,eACE,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,SAAS,EAAE,SAAS,kCAGpB,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,IAAI,GAAG,EACjC,mBAAU,MAAM,EAAC,kBAAkB,GAAG,IAClC,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EAAE,SAAS,EAA0B;IACtD,OAAO,CACL,eACE,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,SAAS,EAAE,SAAS,kCAGpB,eAAM,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,IAAI,GAAG,EACtC,eAAM,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,IAAI,GAAG,IAClC,CACP,CAAC;AACJ,CAAC"}

package/dist/client/FieldAuditTrail.d.ts

@@ -0,0 +1,8 @@
+import type { FieldAuditTrailProps } from './types.js';
+/**
+ * Renders an ordered list of field audit events for a subject (optionally
+ * filtered to a single field_path). Sensitive rows show "[redacted]" with a
+ * "Reveal" button that calls /audit/events/[id]/reveal.
+ */
+export declare function FieldAuditTrail(props: FieldAuditTrailProps): JSX.Element;
+//# sourceMappingURL=FieldAuditTrail.d.ts.map

package/dist/client/FieldAuditTrail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FieldAuditTrail.d.ts","sourceRoot":"","sources":["../../src/client/FieldAuditTrail.tsx"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,GAAG,CAAC,OAAO,CA+JxE"}

package/dist/client/FieldAuditTrail.js

@@ -0,0 +1,136 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import * as React from 'react';
+import { cn } from './cn.js';
+/**
+ * Renders an ordered list of field audit events for a subject (optionally
+ * filtered to a single field_path). Sensitive rows show "[redacted]" with a
+ * "Reveal" button that calls /audit/events/[id]/reveal.
+ */
+export function FieldAuditTrail(props) {
+    const { subjectKind, subjectId, fieldPath, api_base = '/api/audit', limit = 50, className, onRevealed, } = props;
+    const [state, setState] = React.useState({ loading: true, events: [], revealed: {} });
+    React.useEffect(() => {
+        let cancelled = false;
+        setState((s) => ({ ...s, loading: true, error: undefined }));
+        const params = new URLSearchParams({
+            subject_kind: subjectKind,
+            subject_id: subjectId,
+            limit: String(limit),
+        });
+        if (fieldPath)
+            params.set('field_path', fieldPath);
+        fetch(`${api_base}/events?${params.toString()}`, { credentials: 'include' })
+            .then(async (r) => {
+            if (r.status === 403) {
+                return { _forbidden: true };
+            }
+            if (!r.ok) {
+                throw new Error(`HTTP ${r.status}`);
+            }
+            return (await r.json());
+        })
+            .then((data) => {
+            if (cancelled)
+                return;
+            if ('_forbidden' in data) {
+                setState({
+                    loading: false,
+                    events: [],
+                    revealed: {},
+                    error: 'You do not have permission to view audit history.',
+                });
+                return;
+            }
+            setState({
+                loading: false,
+                events: data.field_events ?? [],
+                revealed: {},
+            });
+        })
+            .catch((err) => {
+            if (cancelled)
+                return;
+            setState({
+                loading: false,
+                events: [],
+                revealed: {},
+                error: err.message,
+            });
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [subjectKind, subjectId, fieldPath, api_base, limit]);
+    async function handleReveal(id) {
+        try {
+            const r = await fetch(`${api_base}/events/${id}/reveal`, {
+                method: 'POST',
+                credentials: 'include',
+            });
+            if (!r.ok)
+                throw new Error(`HTTP ${r.status}`);
+            const body = (await r.json());
+            setState((s) => ({
+                ...s,
+                revealed: {
+                    ...s.revealed,
+                    [id]: { before: body.before_value, after: body.after_value },
+                },
+            }));
+            onRevealed?.(id, body.before_value, body.after_value);
+        }
+        catch (err) {
+            setState((s) => ({
+                ...s,
+                error: `Reveal failed: ${err instanceof Error ? err.message : 'unknown'}`,
+            }));
+        }
+    }
+    if (state.loading) {
+        return (_jsx("div", { className: cn('py-3 text-center text-xs text-slate-500', className), children: "Loading\u2026" }));
+    }
+    if (state.error) {
+        return (_jsx("div", { className: cn('py-3 text-center text-xs text-slate-500', className), children: state.error }));
+    }
+    if (state.events.length === 0) {
+        return (_jsx("div", { className: cn('py-3 text-center text-xs text-slate-400', className), children: "No history yet." }));
+    }
+    return (_jsx("ol", { className: cn('space-y-2 text-sm', className), children: state.events.map((ev) => (_jsxs("li", { className: "rounded border border-slate-200 p-2 dark:border-slate-700", children: [_jsxs("div", { className: "mb-1 flex items-center justify-between gap-2 text-xs text-slate-500", children: [_jsxs("span", { children: [_jsx("span", { className: cn('mr-2 inline-block rounded px-1.5 py-0.5 text-[10px] font-medium uppercase', ev.op === 'insert'
+                                        ? 'bg-emerald-100 text-emerald-700'
+                                        : ev.op === 'delete'
+                                            ? 'bg-rose-100 text-rose-700'
+                                            : 'bg-sky-100 text-sky-700'), children: ev.op }), ev.actor_label || ev.actor_user_id || ev.actor_kind] }), _jsx("time", { dateTime: ev.occurred_at, title: ev.occurred_at, className: "text-[11px] text-slate-400", children: formatDate(ev.occurred_at) })] }), !fieldPath && (_jsx("div", { className: "mb-1 font-mono text-xs text-slate-600 dark:text-slate-300", children: ev.field_path })), _jsx(ValueDiff, { event: ev, revealed: state.revealed[ev.id], onReveal: () => handleReveal(ev.id) })] }, ev.id))) }));
+}
+function ValueDiff({ event, revealed, onReveal, }) {
+    if (event.is_sensitive && !revealed) {
+        return (_jsxs("div", { className: "flex items-center justify-between gap-2", children: [_jsx("span", { className: "italic text-slate-400", children: "[redacted]" }), _jsx("button", { type: "button", onClick: onReveal, className: "rounded border border-slate-300 px-2 py-0.5 text-[11px] text-slate-700 hover:bg-slate-50 dark:border-slate-600 dark:text-slate-200 dark:hover:bg-slate-800", children: "Reveal" })] }));
+    }
+    const before = revealed?.before ?? event.before_value;
+    const after = revealed?.after ?? event.after_value;
+    return (_jsxs("div", { className: "grid grid-cols-[auto_1fr] gap-x-2 gap-y-1 text-xs", children: [_jsx("span", { className: "text-slate-400", children: "before" }), _jsx("code", { className: "break-all text-slate-600 dark:text-slate-300", children: formatValue(before) }), _jsx("span", { className: "text-slate-400", children: "after" }), _jsx("code", { className: "break-all text-slate-900 dark:text-slate-100", children: formatValue(after) })] }));
+}
+function formatValue(v) {
+    if (v == null)
+        return '—';
+    if (typeof v === 'string')
+        return v;
+    try {
+        return JSON.stringify(v);
+    }
+    catch {
+        return String(v);
+    }
+}
+function formatDate(iso) {
+    try {
+        const d = new Date(iso);
+        if (Number.isNaN(d.getTime()))
+            return iso;
+        return d.toLocaleString();
+    }
+    catch {
+        return iso;
+    }
+}
+//# sourceMappingURL=FieldAuditTrail.js.map

package/dist/client/FieldAuditTrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FieldAuditTrail.js","sourceRoot":"","sources":["../../src/client/FieldAuditTrail.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAQ7B;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,EACJ,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,GAAG,YAAY,EACvB,KAAK,GAAG,EAAE,EACV,SAAS,EACT,UAAU,GACX,GAAG,KAAK,CAAC;IAEV,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAKrC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAEhD,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACnD,KAAK,CAAC,GAAG,QAAQ,WAAW,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;aACzE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAW,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAwB,CAAC;QACjD,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;gBACzB,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,EAAE;oBACZ,KAAK,EAAE,mDAAmD;iBAC3D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,QAAQ,CAAC;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;gBAC/B,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;YACpB,IAAI,SAAS;gBAAE,OAAO;YACtB,QAAQ,CAAC;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAEzD,KAAK,UAAU,YAAY,CAAC,EAAU;QACpC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,WAAW,EAAE,SAAS,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAmB,CAAC;YAChD,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACf,GAAG,CAAC;gBACJ,QAAQ,EAAE;oBACR,GAAG,CAAC,CAAC,QAAQ;oBACb,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;iBAC7D;aACF,CAAC,CAAC,CAAC;YACJ,UAAU,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACf,GAAG,CAAC;gBACJ,KAAK,EAAE,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE;aAC1E,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CACL,cAAK,SAAS,EAAE,EAAE,CAAC,yCAAyC,EAAE,SAAS,CAAC,8BAElE,CACP,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CACL,cAAK,SAAS,EAAE,EAAE,CAAC,yCAAyC,EAAE,SAAS,CAAC,YACrE,KAAK,CAAC,KAAK,GACR,CACP,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CACL,cAAK,SAAS,EAAE,EAAE,CAAC,yCAAyC,EAAE,SAAS,CAAC,gCAElE,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,aAAI,SAAS,EAAE,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,YAC9C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CACxB,cAEE,SAAS,EAAC,2DAA2D,aAErE,eAAK,SAAS,EAAC,qEAAqE,aAClF,2BACE,eACE,SAAS,EAAE,EAAE,CACX,2EAA2E,EAC3E,EAAE,CAAC,EAAE,KAAK,QAAQ;wCAChB,CAAC,CAAC,iCAAiC;wCACnC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,QAAQ;4CACpB,CAAC,CAAC,2BAA2B;4CAC7B,CAAC,CAAC,yBAAyB,CAC9B,YAEA,EAAE,CAAC,EAAE,GACD,EACN,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,UAAU,IAC/C,EACP,eACE,QAAQ,EAAE,EAAE,CAAC,WAAW,EACxB,KAAK,EAAE,EAAE,CAAC,WAAW,EACrB,SAAS,EAAC,4BAA4B,YAErC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,GACtB,IACH,EACL,CAAC,SAAS,IAAI,CACb,cAAK,SAAS,EAAC,2DAA2D,YACvE,EAAE,CAAC,UAAU,GACV,CACP,EACD,KAAC,SAAS,IACR,KAAK,EAAE,EAAE,EACT,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,GACnC,KApCG,EAAE,CAAC,EAAE,CAqCP,CACN,CAAC,GACC,CACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EACjB,KAAK,EACL,QAAQ,EACR,QAAQ,GAKT;IACC,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,OAAO,CACL,eAAK,SAAS,EAAC,yCAAyC,aACtD,eAAM,SAAS,EAAC,uBAAuB,2BAAkB,EACzD,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,QAAQ,EACjB,SAAS,EAAC,4JAA4J,uBAG/J,IACL,CACP,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC;IACtD,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,WAAW,CAAC;IACnD,OAAO,CACL,eAAK,SAAS,EAAC,mDAAmD,aAChE,eAAM,SAAS,EAAC,gBAAgB,uBAAc,EAC9C,eAAM,SAAS,EAAC,8CAA8C,YAC3D,WAAW,CAAC,MAAM,CAAC,GACf,EACP,eAAM,SAAS,EAAC,gBAAgB,sBAAa,EAC7C,eAAM,SAAS,EAAC,8CAA8C,YAC3D,WAAW,CAAC,KAAK,CAAC,GACd,IACH,CACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1C,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/client/cn.d.ts

@@ -0,0 +1,3 @@
+import { type ClassValue } from 'clsx';
+export declare function cn(...inputs: ClassValue[]): string;
+//# sourceMappingURL=cn.d.ts.map

package/dist/client/cn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cn.d.ts","sourceRoot":"","sources":["../../src/client/cn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAG7C,wBAAgB,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAElD"}

package/dist/client/cn.js

@@ -0,0 +1,6 @@
+import { clsx } from 'clsx';
+import { twMerge } from 'tailwind-merge';
+export function cn(...inputs) {
+    return twMerge(clsx(inputs));
+}
+//# sourceMappingURL=cn.js.map

package/dist/client/cn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cn.js","sourceRoot":"","sources":["../../src/client/cn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,MAAM,UAAU,EAAE,CAAC,GAAG,MAAoB;IACxC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/B,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * hazo_audit/client — React UI primitives. Safe to import from any client
+ * component (no Node.js APIs, no hazo_connect, no hazo_auth).
+ *
+ *   import { FieldAuditIcon, FieldAuditTrail } from 'hazo_audit/client'
+ */
+export { FieldAuditIcon } from './FieldAuditIcon.js';
+export { FieldAuditTrail } from './FieldAuditTrail.js';
+export type { FieldAuditIconProps, FieldAuditTrailProps } from './types.js';
+export type { FieldAuditProps, FieldAuditEvent, IntentAuditEvent, AuditEventsResponse, RevealResponse, } from '../index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAG5E,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,9 @@
+/**
+ * hazo_audit/client — React UI primitives. Safe to import from any client
+ * component (no Node.js APIs, no hazo_connect, no hazo_auth).
+ *
+ *   import { FieldAuditIcon, FieldAuditTrail } from 'hazo_audit/client'
+ */
+export { FieldAuditIcon } from './FieldAuditIcon.js';
+export { FieldAuditTrail } from './FieldAuditTrail.js';
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/client/types.d.ts

@@ -0,0 +1,19 @@
+import type { FieldAuditProps } from '../index.js';
+export interface FieldAuditIconProps extends FieldAuditProps {
+    /** Specific field whose history to show. */
+    fieldPath: string;
+    /** Optional className applied to the trigger button. */
+    className?: string;
+    /** Optional label rendered as a tooltip / aria-label. */
+    label?: string;
+}
+export interface FieldAuditTrailProps extends FieldAuditProps {
+    /** If set, restricts the trail to one field. Otherwise shows the subject's full trail. */
+    fieldPath?: string;
+    /** Maximum events to display. */
+    limit?: number;
+    className?: string;
+    /** Callback after a successful reveal; useful for live-updating the row. */
+    onRevealed?: (id: string, before: unknown, after: unknown) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/client/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpE"}

package/dist/client/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/client/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,76 @@
+/**
+ * hazo_audit — client-safe entry point (types + permission constants).
+ *
+ * This file is safe to import from React client components. Server-only code
+ * (wrap, worker, AsyncLocalStorage, etc.) lives in `hazo_audit/server`.
+ *
+ * Multi-entry layout:
+ *   import { AUDIT_VIEW_HISTORY }   from 'hazo_audit'
+ *   import { wrapWithAudit, ... }   from 'hazo_audit/server'
+ *   import { createAuditEventsRoutes } from 'hazo_audit/nextjs'
+ *   import { FieldAuditIcon }       from 'hazo_audit/client'
+ */
+export declare const AUDIT_VIEW_HISTORY: "view_audit_history";
+export declare const AUDIT_VIEW_SENSITIVE: "view_sensitive_audit";
+export declare const AUDIT_VIEW_ACROSS_SCOPES: "view_audit_across_scopes";
+export type ActorKind = 'user' | 'system' | 'client' | 'super_admin' | 'background_job';
+export interface ActorContext {
+    actor_kind: ActorKind;
+    actor_user_id?: string | null;
+    actor_label?: string | null;
+    scope_id?: string | null;
+    correlation_id?: string;
+}
+export interface FieldAuditProps {
+    subjectKind: string;
+    subjectId: string;
+    /** Base path for audit routes. Defaults to `/api/audit`. */
+    api_base?: string;
+}
+/**
+ * Canonicalises a JSONB path (e.g., `working_paper.sections.0.name`) into a
+ * stable, human-readable identifier. Apps register these by name in
+ * `wrapWithAudit({ resolvers: { wp: myResolver } })` and reference them from
+ * `[overrides.<table>] resolver = wp` in INI.
+ */
+export type PathResolver = (path: string) => string;
+export interface FieldAuditEvent {
+    id: string;
+    scope_id: string | null;
+    correlation_id: string;
+    subject_kind: string;
+    subject_id: string;
+    field_path: string;
+    op: 'insert' | 'update' | 'delete';
+    before_value: unknown;
+    after_value: unknown;
+    is_sensitive: boolean;
+    actor_kind: ActorKind;
+    actor_user_id: string | null;
+    actor_label: string | null;
+    occurred_at: string;
+}
+export interface IntentAuditEvent {
+    id: string;
+    scope_id: string | null;
+    correlation_id: string;
+    event_name: string;
+    payload: unknown;
+    subject_kind: string | null;
+    subject_id: string | null;
+    actor_kind: ActorKind;
+    actor_user_id: string | null;
+    actor_label: string | null;
+    occurred_at: string;
+}
+export interface AuditEventsResponse {
+    field_events: FieldAuditEvent[];
+    intent_events?: IntentAuditEvent[];
+    next_cursor?: string | null;
+}
+export interface RevealResponse {
+    id: string;
+    before_value: unknown;
+    after_value: unknown;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,eAAO,MAAM,kBAAkB,EAAG,oBAA6B,CAAC;AAChE,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AACpE,eAAO,MAAM,wBAAwB,EAAG,0BAAmC,CAAC;AAM5E,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,SAAS,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;AAMpD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,SAAS,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;CACtB"}

package/dist/index.js

@@ -0,0 +1,20 @@
+/**
+ * hazo_audit — client-safe entry point (types + permission constants).
+ *
+ * This file is safe to import from React client components. Server-only code
+ * (wrap, worker, AsyncLocalStorage, etc.) lives in `hazo_audit/server`.
+ *
+ * Multi-entry layout:
+ *   import { AUDIT_VIEW_HISTORY }   from 'hazo_audit'
+ *   import { wrapWithAudit, ... }   from 'hazo_audit/server'
+ *   import { createAuditEventsRoutes } from 'hazo_audit/nextjs'
+ *   import { FieldAuditIcon }       from 'hazo_audit/client'
+ */
+// ─────────────────────────────────────────────────────────────────────────────
+// Permission constants. These are the strings checked against the caller's
+// `permissions[]` from hazo_auth. Apps can override per-route.
+// ─────────────────────────────────────────────────────────────────────────────
+export const AUDIT_VIEW_HISTORY = 'view_audit_history';
+export const AUDIT_VIEW_SENSITIVE = 'view_sensitive_audit';
+export const AUDIT_VIEW_ACROSS_SCOPES = 'view_audit_across_scopes';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,2EAA2E;AAC3E,+DAA+D;AAC/D,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAA6B,CAAC;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAA+B,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAAmC,CAAC"}

package/dist/nextjs/index.d.ts

@@ -0,0 +1,78 @@
+/**
+ * hazo_audit/nextjs — Next.js route handler factory for the audit API.
+ *
+ * The factory takes an injectable `getAuth(req)` callback so apps can plug
+ * their existing auth system (typically hazo_auth's hazo_get_tenant_auth)
+ * without a hard module dep at this layer.
+ *
+ * Mounting (Next.js App Router):
+ *
+ *   // app/api/audit/events/route.ts
+ *   import { createAuditEventsRoutes } from 'hazo_audit/nextjs'
+ *   import { getHazoConnectSingleton } from 'hazo_connect/nextjs/setup'
+ *   import { hazo_get_tenant_auth } from 'hazo_auth/lib/auth/hazo_get_tenant_auth.server'
+ *
+ *   const audit = createAuditEventsRoutes({
+ *     audit_adapter: await getHazoConnectSingleton(),
+ *     getAuth: async (req) => {
+ *       const a = await hazo_get_tenant_auth(req)
+ *       if (!a.authenticated) return null
+ *       return {
+ *         user_id: a.user.id,
+ *         scope_id: a.selected_scope_id,
+ *         permissions: a.permissions,
+ *       }
+ *     },
+ *   })
+ *   export const GET = audit.GET
+ *
+ *   // app/api/audit/events/[id]/reveal/route.ts
+ *   export const POST = audit.reveal.POST
+ */
+import 'server-only';
+import { NextResponse } from 'next/server';
+/**
+ * Structural shape of the request object the route handlers and getAuth
+ * callback receive. Using a structural type (rather than `AuditRequest`)
+ * avoids nominal type clashes when the test/consumer app has a different
+ * next version than what hazo_audit was built against.
+ */
+export interface AuditRequest extends Request {
+    cookies?: {
+        get(name: string): {
+            value: string;
+        } | undefined;
+    };
+    nextUrl?: URL;
+}
+import type { HazoConnectAdapter } from 'hazo_connect';
+export interface AuditAuth {
+    user_id: string;
+    scope_id: string | null;
+    permissions: string[];
+    /** Optional display label written to audit_reveal intent rows. */
+    user_label?: string | null;
+}
+export interface AuditEventsRoutesOptions {
+    audit_adapter: HazoConnectAdapter;
+    /** Resolve the caller's auth from the request. Return null = 401. */
+    getAuth: (req: AuditRequest) => Promise<AuditAuth | null> | AuditAuth | null;
+    history_permission?: string;
+    reveal_permission?: string;
+    cross_scope_permission?: string;
+    /** Default page size for list. Defaults to 50, capped at 200. */
+    default_limit?: number;
+    max_limit?: number;
+}
+type NextHandler = (req: AuditRequest, ctx?: {
+    params: Promise<Record<string, string>> | Record<string, string>;
+}) => Promise<NextResponse>;
+export interface AuditEventsRoutes {
+    GET: NextHandler;
+    reveal: {
+        POST: NextHandler;
+    };
+}
+export declare function createAuditEventsRoutes(opts: AuditEventsRoutesOptions): AuditEventsRoutes;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/nextjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO;IAC3C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC/D,OAAO,CAAC,EAAE,GAAG,CAAC;CACf;AACD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAYvD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,kBAAkB,CAAC;IAClC,qEAAqE;IACrE,OAAO,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,WAAW,GAAG,CACjB,GAAG,EAAE,YAAY,EACjB,GAAG,CAAC,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACvE,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC;CAC/B;AAuCD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,iBAAiB,CA4KnB"}