hazo_audit 1.0.0

package/dist/nextjs/index.js

@@ -0,0 +1,229 @@
+/**
+ * hazo_audit/nextjs — Next.js route handler factory for the audit API.
+ *
+ * The factory takes an injectable `getAuth(req)` callback so apps can plug
+ * their existing auth system (typically hazo_auth's hazo_get_tenant_auth)
+ * without a hard module dep at this layer.
+ *
+ * Mounting (Next.js App Router):
+ *
+ *   // app/api/audit/events/route.ts
+ *   import { createAuditEventsRoutes } from 'hazo_audit/nextjs'
+ *   import { getHazoConnectSingleton } from 'hazo_connect/nextjs/setup'
+ *   import { hazo_get_tenant_auth } from 'hazo_auth/lib/auth/hazo_get_tenant_auth.server'
+ *
+ *   const audit = createAuditEventsRoutes({
+ *     audit_adapter: await getHazoConnectSingleton(),
+ *     getAuth: async (req) => {
+ *       const a = await hazo_get_tenant_auth(req)
+ *       if (!a.authenticated) return null
+ *       return {
+ *         user_id: a.user.id,
+ *         scope_id: a.selected_scope_id,
+ *         permissions: a.permissions,
+ *       }
+ *     },
+ *   })
+ *   export const GET = audit.GET
+ *
+ *   // app/api/audit/events/[id]/reveal/route.ts
+ *   export const POST = audit.reveal.POST
+ */
+import 'server-only';
+import { NextResponse } from 'next/server';
+import { randomUUID } from 'node:crypto';
+import { QueryBuilder, createCrudService } from 'hazo_connect/server';
+import { AUDIT_VIEW_HISTORY, AUDIT_VIEW_SENSITIVE, AUDIT_VIEW_ACROSS_SCOPES, } from '../index.js';
+function jsonError(message, status) {
+    return NextResponse.json({ error: message }, { status });
+}
+/** Parse a JSON-text column back into a JS value (no-op if already parsed). */
+function parseJsonColumn(v) {
+    if (v == null)
+        return null;
+    if (typeof v !== 'string')
+        return v;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return v;
+    }
+}
+function normaliseField(event) {
+    return {
+        ...event,
+        before_value: parseJsonColumn(event.before_value),
+        after_value: parseJsonColumn(event.after_value),
+        is_sensitive: Boolean(event.is_sensitive),
+    };
+}
+function maskField(event) {
+    if (!event.is_sensitive)
+        return event;
+    return { ...event, before_value: null, after_value: null };
+}
+async function resolveParams(ctx) {
+    if (!ctx?.params)
+        return {};
+    const p = ctx.params;
+    return p instanceof Promise ? await p : p;
+}
+export function createAuditEventsRoutes(opts) {
+    const historyPerm = opts.history_permission ?? AUDIT_VIEW_HISTORY;
+    const revealPerm = opts.reveal_permission ?? AUDIT_VIEW_SENSITIVE;
+    const crossScopePerm = opts.cross_scope_permission ?? AUDIT_VIEW_ACROSS_SCOPES;
+    const defaultLimit = opts.default_limit ?? 50;
+    const maxLimit = opts.max_limit ?? 200;
+    const GET = async (req) => {
+        const auth = await Promise.resolve(opts.getAuth(req));
+        if (!auth)
+            return jsonError('Unauthenticated', 401);
+        if (!auth.permissions.includes(historyPerm)) {
+            return jsonError('Forbidden', 403);
+        }
+        const url = new URL(req.url);
+        const subject_kind = url.searchParams.get('subject_kind');
+        const subject_id = url.searchParams.get('subject_id');
+        if (!subject_kind || !subject_id) {
+            return jsonError('subject_kind and subject_id are required', 400);
+        }
+        const field_path = url.searchParams.get('field_path');
+        const actor_user_id = url.searchParams.get('actor_user_id');
+        const since = url.searchParams.get('since');
+        const until = url.searchParams.get('until');
+        const include = url.searchParams.get('include') || '';
+        const wantIntent = include.split(',').map((s) => s.trim()).includes('intent');
+        const limit = Math.min(Number.parseInt(url.searchParams.get('limit') || '', 10) || defaultLimit, maxLimit);
+        const cursor = url.searchParams.get('cursor');
+        const canSeeSensitive = auth.permissions.includes(revealPerm);
+        const canCrossScope = auth.permissions.includes(crossScopePerm);
+        // ── Field events ─────────────────────────────────────────────────────
+        let qb = new QueryBuilder()
+            .from('hazo_audit_field')
+            .select('*')
+            .where('subject_kind', 'eq', subject_kind)
+            .where('subject_id', 'eq', subject_id)
+            .order('occurred_at', 'desc')
+            .limit(limit);
+        if (field_path)
+            qb = qb.where('field_path', 'eq', field_path);
+        if (actor_user_id)
+            qb = qb.where('actor_user_id', 'eq', actor_user_id);
+        if (since)
+            qb = qb.where('occurred_at', 'gte', since);
+        if (until)
+            qb = qb.where('occurred_at', 'lte', until);
+        if (!canCrossScope && auth.scope_id) {
+            qb = qb.where('scope_id', 'eq', auth.scope_id);
+        }
+        if (cursor)
+            qb = qb.where('occurred_at', 'lt', cursor);
+        let field_events = [];
+        try {
+            const rows = await opts.audit_adapter.query(qb, 'GET');
+            field_events = Array.isArray(rows)
+                ? rows
+                    .map(normaliseField)
+                    .map((r) => (canSeeSensitive ? r : maskField(r)))
+                : [];
+        }
+        catch (err) {
+            return jsonError(`Failed to read field events: ${err instanceof Error ? err.message : 'unknown'}`, 500);
+        }
+        let intent_events;
+        if (wantIntent) {
+            let iqb = new QueryBuilder()
+                .from('hazo_audit_intent')
+                .select('*')
+                .where('subject_kind', 'eq', subject_kind)
+                .where('subject_id', 'eq', subject_id)
+                .order('occurred_at', 'desc')
+                .limit(limit);
+            if (since)
+                iqb = iqb.where('occurred_at', 'gte', since);
+            if (until)
+                iqb = iqb.where('occurred_at', 'lte', until);
+            if (!canCrossScope && auth.scope_id) {
+                iqb = iqb.where('scope_id', 'eq', auth.scope_id);
+            }
+            try {
+                const irows = await opts.audit_adapter.query(iqb, 'GET');
+                intent_events = Array.isArray(irows) ? irows : [];
+            }
+            catch {
+                intent_events = [];
+            }
+        }
+        const next_cursor = field_events.length === limit
+            ? field_events[field_events.length - 1].occurred_at
+            : null;
+        const body = { field_events, intent_events, next_cursor };
+        return NextResponse.json(body);
+    };
+    const reveal = async (req, ctx) => {
+        const auth = await Promise.resolve(opts.getAuth(req));
+        if (!auth)
+            return jsonError('Unauthenticated', 401);
+        if (!auth.permissions.includes(historyPerm)) {
+            return jsonError('Forbidden', 403);
+        }
+        if (!auth.permissions.includes(revealPerm)) {
+            return jsonError('Forbidden — sensitive reveal not permitted', 403);
+        }
+        const params = await resolveParams(ctx);
+        const id = params.id;
+        if (!id)
+            return jsonError('Missing id param', 400);
+        // Fetch the row directly (no scope filter on reveal — caller already
+        // proved permission and we want consistent behavior with the list query).
+        const qb = new QueryBuilder()
+            .from('hazo_audit_field')
+            .select('*')
+            .where('id', 'eq', id)
+            .limit(1);
+        if (!auth.permissions.includes(crossScopePerm) &&
+            auth.scope_id) {
+            qb.where('scope_id', 'eq', auth.scope_id);
+        }
+        let row = null;
+        try {
+            const rows = await opts.audit_adapter.query(qb, 'GET');
+            row = Array.isArray(rows) && rows.length > 0
+                ? rows[0]
+                : null;
+        }
+        catch (err) {
+            return jsonError(`Failed to read field event: ${err instanceof Error ? err.message : 'unknown'}`, 500);
+        }
+        if (!row)
+            return jsonError('Not found', 404);
+        // Reveal is itself audited — write an intent row tagged 'audit_reveal'.
+        try {
+            const intentSvc = createCrudService(opts.audit_adapter, 'hazo_audit_intent', { autoId: { enabled: true, column: 'id' } });
+            await intentSvc.insert({
+                id: randomUUID(),
+                scope_id: row.scope_id,
+                correlation_id: row.correlation_id,
+                event_name: 'audit_reveal',
+                payload: JSON.stringify({ audit_field_id: id }),
+                subject_kind: row.subject_kind,
+                subject_id: row.subject_id,
+                actor_kind: 'user',
+                actor_user_id: auth.user_id,
+                actor_label: auth.user_label ?? null,
+            });
+        }
+        catch {
+            /* swallow: reveal still succeeds; log loss is acceptable here */
+        }
+        const body = {
+            id: row.id,
+            before_value: parseJsonColumn(row.before_value),
+            after_value: parseJsonColumn(row.after_value),
+        };
+        return NextResponse.json(body);
+    };
+    return { GET, reveal: { POST: reveal } };
+}
+//# sourceMappingURL=index.js.map

package/dist/nextjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GAKzB,MAAM,aAAa,CAAC;AAgCrB,SAAS,SAAS,CAAC,OAAe,EAAE,MAAc;IAChD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,OAAO;QACL,GAAG,KAAK;QACR,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/C,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAA0E;IAE1E,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAkE,CAAC;IACjF,OAAO,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,sBAAsB,IAAI,wBAAwB,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;IAEvC,MAAM,GAAG,GAAgB,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,YAAY,EACxE,QAAQ,CACT,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAEhE,wEAAwE;QACxE,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE;aACxB,IAAI,CAAC,kBAAkB,CAAC;aACxB,MAAM,CAAC,GAAG,CAAC;aACX,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,CAAC;aACzC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC;aACrC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhB,IAAI,UAAU;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,aAAa;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,IAAI,KAAK;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,MAAM;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEvD,IAAI,YAAY,GAAsB,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvD,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAChC,CAAC,CAAE,IAA0B;qBACxB,GAAG,CAAC,cAAc,CAAC;qBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CACd,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,EAChF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,aAA6C,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,GAAG,GAAG,IAAI,YAAY,EAAE;iBACzB,IAAI,CAAC,mBAAmB,CAAC;iBACzB,MAAM,CAAC,GAAG,CAAC;iBACX,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,YAAY,CAAC;iBACzC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC;iBACrC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,KAAK;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACzD,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GACf,YAAY,CAAC,MAAM,KAAK,KAAK;YAC3B,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,WAAW;YACnD,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,IAAI,GAAwB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;QAC/E,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAgB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAEnD,qEAAqE;QACrE,0EAA0E;QAC1E,MAAM,EAAE,GAAG,IAAI,YAAY,EAAE;aAC1B,IAAI,CAAC,kBAAkB,CAAC;aACxB,MAAM,CAAC,GAAG,CAAC;aACX,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;aACrB,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IACE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC1C,IAAI,CAAC,QAAQ,EACb,CAAC;YACD,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,GAAG,GAA2B,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvD,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAC1C,CAAC,CAAE,IAAI,CAAC,CAAC,CAAqB;gBAC9B,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CACd,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,EAC/E,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAE7C,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,iBAAiB,CACjC,IAAI,CAAC,aAAa,EAClB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAC5C,CAAC;YACF,MAAM,SAAS,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,UAAU,EAAE;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,UAAU,EAAE,cAAc;gBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;gBAC/C,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,MAAM;gBAClB,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QAED,MAAM,IAAI,GAAmB;YAC3B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,YAAY,EAAE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/C,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;AAC3C,CAAC"}

package/dist/server/audited_crud.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Audit-aware wrapper around hazo_connect's createCrudService. Adds an
+ * optional `{audit: {before_row, intent_event, intent_payload}}` third arg
+ * to insert/updateById/deleteById; hints are stashed on the AsyncLocalStorage
+ * context and picked up by wrapWithAudit for the duration of the call.
+ */
+import 'server-only';
+import type { HazoConnectAdapter } from 'hazo_connect';
+import { type CrudService, type CrudServiceOptions } from 'hazo_connect/server';
+import { runWithAuditContext } from './context.js';
+export interface AuditHints {
+    before_row?: Record<string, unknown> | null;
+    intent_event?: string;
+    intent_payload?: Record<string, unknown>;
+}
+export interface AuditedCrudServiceOptions extends CrudServiceOptions {
+}
+export interface AuditedCrudService<T extends Record<string, unknown> = Record<string, unknown>> extends CrudService<T> {
+    insert(data: Partial<T> | Partial<T>[], opts?: {
+        audit?: AuditHints;
+    }): Promise<T[]>;
+    updateById(id: unknown, patch: Partial<T>, opts?: {
+        audit?: AuditHints;
+    }): Promise<T[]>;
+    deleteById(id: unknown, opts?: {
+        audit?: AuditHints;
+    }): Promise<void>;
+}
+export declare function createAuditedCrudService<T extends Record<string, unknown> = Record<string, unknown>>(adapter: HazoConnectAdapter, table: string, opts?: AuditedCrudServiceOptions): AuditedCrudService<T>;
+/**
+ * Emit a standalone Layer-1 intent event (no piggyback). Writes directly to
+ * the outbox with op='update' and a null after_row so the worker treats it as
+ * a pure intent emission. R1 helper — the `withAudit` ergonomic is Phase 2.
+ */
+export declare function emitIntentEvent(adapter: HazoConnectAdapter, args: {
+    event_name: string;
+    payload?: Record<string, unknown>;
+    subject_kind?: string;
+    subject_id?: string;
+}): Promise<void>;
+export { runWithAuditContext };
+//# sourceMappingURL=audited_crud.d.ts.map

package/dist/server/audited_crud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited_crud.d.ts","sourceRoot":"","sources":["../../src/server/audited_crud.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAmC,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEpF,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;CAEpE;AAED,MAAM,WAAW,kBAAkB,CACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAC3D,SAAQ,WAAW,CAAC,CAAC,CAAC;IACtB,MAAM,CACJ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAC/B,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAA;KAAE,GAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAChB,UAAU,CACR,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EACjB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAA;KAAE,GAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAChB,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,wBAAgB,wBAAwB,CACtC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAE3D,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,yBAAyB,GAC/B,kBAAkB,CAAC,CAAC,CAAC,CAkBvB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,IAAI,CAAC,CAiBf;AAGD,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/server/audited_crud.js

@@ -0,0 +1,57 @@
+/**
+ * Audit-aware wrapper around hazo_connect's createCrudService. Adds an
+ * optional `{audit: {before_row, intent_event, intent_payload}}` third arg
+ * to insert/updateById/deleteById; hints are stashed on the AsyncLocalStorage
+ * context and picked up by wrapWithAudit for the duration of the call.
+ */
+import 'server-only';
+import { randomUUID } from 'node:crypto';
+import { createCrudService, } from 'hazo_connect/server';
+import { withAuditHints, getAuditContext, runWithAuditContext } from './context.js';
+export function createAuditedCrudService(adapter, table, opts) {
+    const base = createCrudService(adapter, table, opts);
+    return {
+        ...base,
+        async insert(data, callOpts) {
+            if (!callOpts?.audit)
+                return base.insert(data);
+            return withAuditHints(callOpts.audit, () => base.insert(data));
+        },
+        async updateById(id, patch, callOpts) {
+            if (!callOpts?.audit)
+                return base.updateById(id, patch);
+            return withAuditHints(callOpts.audit, () => base.updateById(id, patch));
+        },
+        async deleteById(id, callOpts) {
+            if (!callOpts?.audit)
+                return base.deleteById(id);
+            return withAuditHints(callOpts.audit, () => base.deleteById(id));
+        },
+    };
+}
+/**
+ * Emit a standalone Layer-1 intent event (no piggyback). Writes directly to
+ * the outbox with op='update' and a null after_row so the worker treats it as
+ * a pure intent emission. R1 helper — the `withAudit` ergonomic is Phase 2.
+ */
+export async function emitIntentEvent(adapter, args) {
+    const ctx = getAuditContext();
+    const intentSvc = createCrudService(adapter, 'hazo_audit_intent', {
+        autoId: { enabled: true, column: 'id' },
+    });
+    await intentSvc.insert({
+        id: randomUUID(),
+        scope_id: ctx?.scope_id ?? null,
+        correlation_id: ctx?.correlation_id ?? randomUUID(),
+        event_name: args.event_name,
+        payload: args.payload == null ? null : JSON.stringify(args.payload),
+        subject_kind: args.subject_kind ?? null,
+        subject_id: args.subject_id ?? null,
+        actor_kind: ctx?.actor_kind ?? 'background_job',
+        actor_user_id: ctx?.actor_user_id ?? null,
+        actor_label: ctx?.actor_label ?? null,
+    });
+}
+// Re-export the actor-context entry points for convenience.
+export { runWithAuditContext };
+//# sourceMappingURL=audited_crud.js.map

package/dist/server/audited_crud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited_crud.js","sourceRoot":"","sources":["../../src/server/audited_crud.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA2BpF,MAAM,UAAU,wBAAwB,CAGtC,OAA2B,EAC3B,KAAa,EACb,IAAgC;IAEhC,MAAM,IAAI,GAAG,iBAAiB,CAAI,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAExD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ;YACzB,IAAI,CAAC,QAAQ,EAAE,KAAK;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,OAAO,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ;YAClC,IAAI,CAAC,QAAQ,EAAE,KAAK;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ;YAC3B,IAAI,CAAC,QAAQ,EAAE,KAAK;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2B,EAC3B,IAKC;IAED,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE;QAChE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,SAAS,CAAC,MAAM,CAAC;QACrB,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;QAC/B,cAAc,EAAE,GAAG,EAAE,cAAc,IAAI,UAAU,EAAE;QACnD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QACnE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QACnC,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,gBAAgB;QAC/C,aAAa,EAAE,GAAG,EAAE,aAAa,IAAI,IAAI;QACzC,WAAW,EAAE,GAAG,EAAE,WAAW,IAAI,IAAI;KACtC,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/server/config.d.ts

@@ -0,0 +1,70 @@
+/**
+ * INI-driven capture configuration for hazo_audit.
+ *
+ * Loaded once at wrapWithAudit() / startAuditWorker() startup. The capture
+ * decision is deterministic (PRD §6.1): exclude wins, include opens, default
+ * deny. The audit pipeline tables themselves are hardcoded as never-capture.
+ */
+import 'server-only';
+export interface CaptureConfig {
+    include_table_prefixes: string[];
+    include_tables: string[];
+    exclude_table_prefixes: string[];
+    exclude_tables: string[];
+}
+export interface RetentionConfig {
+    outbox_drained_ttl_days: number;
+    outbox_failed_ttl_days: number;
+}
+export interface WorkerConfig {
+    poll_ms: number;
+    max_attempts: number;
+    backoff_initial_ms: number;
+    reaper_interval_ms: number;
+}
+export interface DefaultsConfig {
+    subject_id_column: string;
+}
+export interface TableOverride {
+    subject_kind?: string;
+    subject_id_column?: string;
+    sensitive_columns: string[];
+    jsonb_columns: string[];
+    jsonb_path_include: string[];
+    jsonb_path_exclude: string[];
+    resolver?: string;
+    fanout_bulk_writes: boolean;
+}
+export interface AuditConfig {
+    capture: CaptureConfig;
+    retention: RetentionConfig;
+    worker: WorkerConfig;
+    defaults: DefaultsConfig;
+    overrides: Record<string, TableOverride>;
+}
+/**
+ * Resolve the config file path. Search order:
+ *   1. Explicit `config_path` arg
+ *   2. HAZO_AUDIT_CONFIG env var
+ *   3. ./config/hazo_audit_config.ini (relative to cwd)
+ *   4. ./hazo_audit_config.ini (relative to cwd)
+ * Returns null if none found — caller falls back to DEFAULT_CONFIG.
+ */
+export declare function resolveConfigPath(explicit?: string): string | null;
+export declare function loadAuditConfig(explicitPath?: string): AuditConfig;
+/**
+ * Decide whether a write to `table` should be captured (PRD §6.1).
+ * Order: pipeline → exclude_tables → exclude_prefixes → include_tables →
+ * include_prefixes → default deny.
+ */
+export declare function shouldCapture(table: string, cfg: AuditConfig): boolean;
+/** Get effective per-table override (empty defaults if none configured). */
+export declare function getOverride(table: string, cfg: AuditConfig): TableOverride;
+export declare function getSubjectKind(table: string, cfg: AuditConfig): string;
+export declare function getSubjectIdColumn(table: string, cfg: AuditConfig): string;
+/**
+ * Match a JSONB leaf path against include/exclude prefix rules.
+ * Exclude wins; include narrows (if non-empty); otherwise allow.
+ */
+export declare function matchesJsonbPath(path: string, include: string[], exclude: string[]): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/server/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,aAAa,CAAC;AAYrB,MAAM,WAAW,aAAa;IAC5B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,aAAa,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAC1C;AA4DD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalE;AAED,wBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,WAAW,CAkElE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAYtE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,aAAa,CAU1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAEtE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAI1E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAMT"}

package/dist/server/config.js

@@ -0,0 +1,203 @@
+/**
+ * INI-driven capture configuration for hazo_audit.
+ *
+ * Loaded once at wrapWithAudit() / startAuditWorker() startup. The capture
+ * decision is deterministic (PRD §6.1): exclude wins, include opens, default
+ * deny. The audit pipeline tables themselves are hardcoded as never-capture.
+ */
+import 'server-only';
+import fs from 'node:fs';
+import path from 'node:path';
+import ini from 'ini';
+/** Tables that must never be captured (would create infinite loops). */
+const PIPELINE_TABLES = new Set([
+    'hazo_audit_outbox',
+    'hazo_audit_field',
+    'hazo_audit_intent',
+]);
+const DEFAULT_CONFIG = {
+    capture: {
+        include_table_prefixes: ['app_', 'hazo_'],
+        include_tables: [],
+        exclude_table_prefixes: ['_'],
+        exclude_tables: [],
+    },
+    retention: {
+        outbox_drained_ttl_days: 30,
+        outbox_failed_ttl_days: 90,
+    },
+    worker: {
+        poll_ms: 2000,
+        max_attempts: 5,
+        backoff_initial_ms: 500,
+        reaper_interval_ms: 3600000,
+    },
+    defaults: {
+        subject_id_column: 'id',
+    },
+    overrides: {},
+};
+function splitCsv(raw) {
+    if (typeof raw !== 'string')
+        return [];
+    return raw
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+function toInt(raw, fallback) {
+    if (raw == null || raw === '')
+        return fallback;
+    const n = Number.parseInt(String(raw), 10);
+    return Number.isFinite(n) ? n : fallback;
+}
+function readOverride(body) {
+    return {
+        subject_kind: body['subject_kind'] || undefined,
+        subject_id_column: body['subject_id_column'] || undefined,
+        sensitive_columns: splitCsv(body['sensitive_columns']),
+        jsonb_columns: splitCsv(body['jsonb_columns']),
+        jsonb_path_include: splitCsv(body['jsonb_path_include']),
+        jsonb_path_exclude: splitCsv(body['jsonb_path_exclude']),
+        resolver: body['resolver'] || undefined,
+        fanout_bulk_writes: toBool(body['fanout_bulk_writes'], false),
+    };
+}
+function toBool(raw, fallback) {
+    if (raw == null || raw === '')
+        return fallback;
+    const v = String(raw).trim().toLowerCase();
+    if (['true', '1', 'yes', 'on'].includes(v))
+        return true;
+    if (['false', '0', 'no', 'off'].includes(v))
+        return false;
+    return fallback;
+}
+/**
+ * Resolve the config file path. Search order:
+ *   1. Explicit `config_path` arg
+ *   2. HAZO_AUDIT_CONFIG env var
+ *   3. ./config/hazo_audit_config.ini (relative to cwd)
+ *   4. ./hazo_audit_config.ini (relative to cwd)
+ * Returns null if none found — caller falls back to DEFAULT_CONFIG.
+ */
+export function resolveConfigPath(explicit) {
+    if (explicit && fs.existsSync(explicit))
+        return path.resolve(explicit);
+    if (process.env.HAZO_AUDIT_CONFIG && fs.existsSync(process.env.HAZO_AUDIT_CONFIG)) {
+        return path.resolve(process.env.HAZO_AUDIT_CONFIG);
+    }
+    const candidates = [
+        path.resolve(process.cwd(), 'config/hazo_audit_config.ini'),
+        path.resolve(process.cwd(), 'hazo_audit_config.ini'),
+    ];
+    for (const c of candidates) {
+        if (fs.existsSync(c))
+            return c;
+    }
+    return null;
+}
+export function loadAuditConfig(explicitPath) {
+    const filePath = resolveConfigPath(explicitPath);
+    if (!filePath)
+        return DEFAULT_CONFIG;
+    const raw = fs.readFileSync(filePath, 'utf-8');
+    const parsed = ini.parse(raw);
+    const cap = parsed['capture'] ?? {};
+    const ret = parsed['retention'] ?? {};
+    const wrk = parsed['worker'] ?? {};
+    const def = parsed['defaults'] ?? {};
+    // The `ini` package nests dotted sections: [overrides.app_clients] becomes
+    // parsed.overrides.app_clients. Also accept the flat form `overrides.<table>`
+    // in case a different parser is used.
+    const overrides = {};
+    const nestedOverrides = parsed['overrides'] || {};
+    for (const [table, body] of Object.entries(nestedOverrides)) {
+        if (!body || typeof body !== 'object')
+            continue;
+        overrides[table] = readOverride(body);
+    }
+    for (const [section, body] of Object.entries(parsed)) {
+        if (!section.startsWith('overrides.'))
+            continue;
+        const table = section.slice('overrides.'.length);
+        if (!table || overrides[table])
+            continue;
+        overrides[table] = readOverride(body);
+    }
+    return {
+        capture: {
+            include_table_prefixes: splitCsv(cap['include_table_prefixes']).length > 0
+                ? splitCsv(cap['include_table_prefixes'])
+                : DEFAULT_CONFIG.capture.include_table_prefixes,
+            include_tables: splitCsv(cap['include_tables']),
+            exclude_table_prefixes: splitCsv(cap['exclude_table_prefixes']),
+            exclude_tables: splitCsv(cap['exclude_tables']),
+        },
+        retention: {
+            outbox_drained_ttl_days: toInt(ret['outbox_drained_ttl_days'], DEFAULT_CONFIG.retention.outbox_drained_ttl_days),
+            outbox_failed_ttl_days: toInt(ret['outbox_failed_ttl_days'], DEFAULT_CONFIG.retention.outbox_failed_ttl_days),
+        },
+        worker: {
+            poll_ms: toInt(wrk['poll_ms'], DEFAULT_CONFIG.worker.poll_ms),
+            max_attempts: toInt(wrk['max_attempts'], DEFAULT_CONFIG.worker.max_attempts),
+            backoff_initial_ms: toInt(wrk['backoff_initial_ms'], DEFAULT_CONFIG.worker.backoff_initial_ms),
+            reaper_interval_ms: toInt(wrk['reaper_interval_ms'], DEFAULT_CONFIG.worker.reaper_interval_ms),
+        },
+        defaults: {
+            subject_id_column: def['subject_id_column'] ||
+                DEFAULT_CONFIG.defaults.subject_id_column,
+        },
+        overrides,
+    };
+}
+/**
+ * Decide whether a write to `table` should be captured (PRD §6.1).
+ * Order: pipeline → exclude_tables → exclude_prefixes → include_tables →
+ * include_prefixes → default deny.
+ */
+export function shouldCapture(table, cfg) {
+    if (PIPELINE_TABLES.has(table))
+        return false;
+    const { capture } = cfg;
+    if (capture.exclude_tables.includes(table))
+        return false;
+    if (capture.exclude_table_prefixes.some((p) => p && table.startsWith(p))) {
+        return false;
+    }
+    if (capture.include_tables.includes(table))
+        return true;
+    if (capture.include_table_prefixes.some((p) => p && table.startsWith(p))) {
+        return true;
+    }
+    return false;
+}
+/** Get effective per-table override (empty defaults if none configured). */
+export function getOverride(table, cfg) {
+    return (cfg.overrides[table] ?? {
+        sensitive_columns: [],
+        jsonb_columns: [],
+        jsonb_path_include: [],
+        jsonb_path_exclude: [],
+        fanout_bulk_writes: false,
+    });
+}
+export function getSubjectKind(table, cfg) {
+    return cfg.overrides[table]?.subject_kind || table;
+}
+export function getSubjectIdColumn(table, cfg) {
+    return (cfg.overrides[table]?.subject_id_column ?? cfg.defaults.subject_id_column);
+}
+/**
+ * Match a JSONB leaf path against include/exclude prefix rules.
+ * Exclude wins; include narrows (if non-empty); otherwise allow.
+ */
+export function matchesJsonbPath(path, include, exclude) {
+    if (exclude.some((p) => p && (path === p || path.startsWith(p + '.')))) {
+        return false;
+    }
+    if (include.length === 0)
+        return true;
+    return include.some((p) => p && (path === p || path.startsWith(p + '.')));
+}
+//# sourceMappingURL=config.js.map

package/dist/server/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,wEAAwE;AACxE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AA4CH,MAAM,cAAc,GAAgB;IAClC,OAAO,EAAE;QACP,sBAAsB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzC,cAAc,EAAE,EAAE;QAClB,sBAAsB,EAAE,CAAC,GAAG,CAAC;QAC7B,cAAc,EAAE,EAAE;KACnB;IACD,SAAS,EAAE;QACT,uBAAuB,EAAE,EAAE;QAC3B,sBAAsB,EAAE,EAAE;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,CAAC;QACf,kBAAkB,EAAE,GAAG;QACvB,kBAAkB,EAAE,OAAS;KAC9B;IACD,QAAQ,EAAE;QACR,iBAAiB,EAAE,IAAI;KACxB;IACD,SAAS,EAAE,EAAE;CACd,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,GAAY,EAAE,QAAgB;IAC3C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,IAA6B;IACjD,OAAO;QACL,YAAY,EAAG,IAAI,CAAC,cAAc,CAAY,IAAI,SAAS;QAC3D,iBAAiB,EAAG,IAAI,CAAC,mBAAmB,CAAY,IAAI,SAAS;QACrE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACtD,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9C,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACxD,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACxD,QAAQ,EAAG,IAAI,CAAC,UAAU,CAAY,IAAI,SAAS;QACnD,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAY,EAAE,QAAiB;IAC7C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,IAAI,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,8BAA8B,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,uBAAuB,CAAC;KACrD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAqB;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,cAAc,CAAC;IAErC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;IAEzE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAErC,2EAA2E;IAC3E,8EAA8E;IAC9E,sCAAsC;IACtC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,MAAM,eAAe,GAAI,MAAM,CAAC,WAAW,CAA6C,IAAI,EAAE,CAAC;IAC/F,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,SAAS,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,SAAS,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;gBACxE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBACzC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB;YACjD,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC/C,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAC/D,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;SAChD;QACD,SAAS,EAAE;YACT,uBAAuB,EAAE,KAAK,CAC5B,GAAG,CAAC,yBAAyB,CAAC,EAC9B,cAAc,CAAC,SAAS,CAAC,uBAAuB,CACjD;YACD,sBAAsB,EAAE,KAAK,CAC3B,GAAG,CAAC,wBAAwB,CAAC,EAC7B,cAAc,CAAC,SAAS,CAAC,sBAAsB,CAChD;SACF;QACD,MAAM,EAAE;YACN,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7D,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5E,kBAAkB,EAAE,KAAK,CACvB,GAAG,CAAC,oBAAoB,CAAC,EACzB,cAAc,CAAC,MAAM,CAAC,kBAAkB,CACzC;YACD,kBAAkB,EAAE,KAAK,CACvB,GAAG,CAAC,oBAAoB,CAAC,EACzB,cAAc,CAAC,MAAM,CAAC,kBAAkB,CACzC;SACF;QACD,QAAQ,EAAE;YACR,iBAAiB,EACd,GAAG,CAAC,mBAAmB,CAAY;gBACpC,cAAc,CAAC,QAAQ,CAAC,iBAAiB;SAC5C;QACD,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAgB;IAC3D,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACxB,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,GAAgB;IACzD,OAAO,CACL,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI;QACtB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,EAAE;QACjB,kBAAkB,EAAE,EAAE;QACtB,kBAAkB,EAAE,EAAE;QACtB,kBAAkB,EAAE,KAAK;KAC1B,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,GAAgB;IAC5D,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,YAAY,IAAI,KAAK,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAgB;IAChE,OAAO,CACL,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,iBAAiB,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAiB,EACjB,OAAiB;IAEjB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC"}