hazo_audit 1.0.0

package/dist/server/context.d.ts

@@ -0,0 +1,28 @@
+import type { ActorContext } from '../index.js';
+interface StoredContext extends ActorContext {
+    /** Audit hints stashed by createAuditedCrudService for the wrap to pick up. */
+    hints?: {
+        before_row?: Record<string, unknown> | null;
+        intent_event?: string;
+        intent_payload?: Record<string, unknown>;
+    };
+}
+/**
+ * Run a callback inside an audit actor context. The wrap reads this via
+ * getAuditContext() to stamp who/what caused each captured write.
+ *
+ * Missing context (e.g., scheduled jobs that forgot to wrap) is fine — the
+ * wrap defaults `actor_kind` to 'background_job'.
+ */
+export declare function runWithAuditContext<T>(ctx: ActorContext, fn: () => Promise<T> | T): Promise<T>;
+export declare function getAuditContext(): ActorContext | undefined;
+/**
+ * Internal — stash audit hints onto the current context for one operation.
+ * Used by createAuditedCrudService. Throws if no context is active so callers
+ * don't accidentally drop hints.
+ */
+export declare function withAuditHints<T>(hints: NonNullable<StoredContext['hints']>, fn: () => Promise<T>): Promise<T>;
+/** Internal — read and clear hints (one-shot, consumed by the wrap). */
+export declare function takeAuditHints(): StoredContext['hints'] | undefined;
+export {};
+//# sourceMappingURL=context.d.ts.map

package/dist/server/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,UAAU,aAAc,SAAQ,YAAY;IAC1C,+EAA+E;IAC/E,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC1C,CAAC;CACH;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,GAAG,EAAE,YAAY,EACjB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GACvB,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAgB,eAAe,IAAI,YAAY,GAAG,SAAS,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAC1C,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAaZ;AAED,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS,CAMnE"}

package/dist/server/context.js

@@ -0,0 +1,49 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
+const storage = new AsyncLocalStorage();
+/**
+ * Run a callback inside an audit actor context. The wrap reads this via
+ * getAuditContext() to stamp who/what caused each captured write.
+ *
+ * Missing context (e.g., scheduled jobs that forgot to wrap) is fine — the
+ * wrap defaults `actor_kind` to 'background_job'.
+ */
+export function runWithAuditContext(ctx, fn) {
+    const stored = {
+        ...ctx,
+        correlation_id: ctx.correlation_id ?? randomUUID(),
+    };
+    return Promise.resolve(storage.run(stored, fn));
+}
+export function getAuditContext() {
+    return storage.getStore();
+}
+/**
+ * Internal — stash audit hints onto the current context for one operation.
+ * Used by createAuditedCrudService. Throws if no context is active so callers
+ * don't accidentally drop hints.
+ */
+export function withAuditHints(hints, fn) {
+    const current = storage.getStore();
+    const next = current
+        ? { ...current, hints }
+        : {
+            actor_kind: 'background_job',
+            actor_user_id: null,
+            actor_label: null,
+            scope_id: null,
+            correlation_id: randomUUID(),
+            hints,
+        };
+    return storage.run(next, fn);
+}
+/** Internal — read and clear hints (one-shot, consumed by the wrap). */
+export function takeAuditHints() {
+    const current = storage.getStore();
+    if (!current?.hints)
+        return undefined;
+    const hints = current.hints;
+    current.hints = undefined;
+    return hints;
+}
+//# sourceMappingURL=context.js.map

package/dist/server/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYzC,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAiB,EACjB,EAAwB;IAExB,MAAM,MAAM,GAAkB;QAC5B,GAAG,GAAG;QACN,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,UAAU,EAAE;KACnD,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAA0C,EAC1C,EAAoB;IAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAkB,OAAO;QACjC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE;QACvB,CAAC,CAAC;YACE,UAAU,EAAE,gBAAgB;YAC5B,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,UAAU,EAAE;YAC5B,KAAK;SACN,CAAC;IACN,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/diff.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Field-level diff helper. Produces one record per changed leaf, suitable
+ * for inserting into hazo_audit_field. Uses microdiff for JSONB and a plain
+ * key-by-key comparison for top-level scalar columns.
+ */
+import 'server-only';
+import type { TableOverride } from './config.js';
+import type { PathResolver } from '../index.js';
+export interface FieldChange {
+    field_path: string;
+    op: 'insert' | 'update' | 'delete';
+    before_value: unknown;
+    after_value: unknown;
+    is_sensitive: boolean;
+}
+/**
+ * Diff two rows into per-field FieldChange records.
+ *
+ * - JSONB columns (override.jsonb_columns) are decomposed via microdiff and
+ *   filtered by include/exclude prefix rules, then optionally canonicalised
+ *   by the named resolver.
+ * - Other columns are treated as scalars: one event per column whose value
+ *   actually changed.
+ */
+export declare function diffRows(args: {
+    before: Record<string, unknown> | null;
+    after: Record<string, unknown> | null;
+    op: 'insert' | 'update' | 'delete';
+    override: TableOverride;
+    resolver?: PathResolver;
+}): FieldChange[];
+//# sourceMappingURL=diff.d.ts.map

package/dist/server/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/server/diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;CACvB;AAYD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB,GAAG,WAAW,EAAE,CAgFhB"}

package/dist/server/diff.js

@@ -0,0 +1,152 @@
+/**
+ * Field-level diff helper. Produces one record per changed leaf, suitable
+ * for inserting into hazo_audit_field. Uses microdiff for JSONB and a plain
+ * key-by-key comparison for top-level scalar columns.
+ */
+import 'server-only';
+import microdiff from 'microdiff';
+import { matchesJsonbPath } from './config.js';
+/** True for primitives + null. JSON-stringifiable scalars only. */
+function isScalar(v) {
+    return (v === null ||
+        typeof v === 'string' ||
+        typeof v === 'number' ||
+        typeof v === 'boolean');
+}
+/**
+ * Diff two rows into per-field FieldChange records.
+ *
+ * - JSONB columns (override.jsonb_columns) are decomposed via microdiff and
+ *   filtered by include/exclude prefix rules, then optionally canonicalised
+ *   by the named resolver.
+ * - Other columns are treated as scalars: one event per column whose value
+ *   actually changed.
+ */
+export function diffRows(args) {
+    const { before, after, op, override, resolver } = args;
+    const sensitiveSet = new Set(override.sensitive_columns);
+    const jsonbSet = new Set(override.jsonb_columns);
+    const out = [];
+    // ── DELETE: emit one event per column from `before` (or after_row=null)
+    if (op === 'delete') {
+        const src = before ?? {};
+        for (const [col, val] of Object.entries(src)) {
+            if (jsonbSet.has(col))
+                continue; // delete summaries omit JSONB leaves
+            out.push({
+                field_path: col,
+                op,
+                before_value: val,
+                after_value: null,
+                is_sensitive: sensitiveSet.has(col),
+            });
+        }
+        return out;
+    }
+    // ── INSERT: every column in `after` is a new value.
+    if (op === 'insert') {
+        const src = after ?? {};
+        for (const [col, val] of Object.entries(src)) {
+            if (jsonbSet.has(col)) {
+                // Decompose JSONB column into per-leaf events vs empty baseline.
+                const leaves = diffJsonb(col, undefined, val, override, resolver);
+                out.push(...leaves.map((l) => ({ ...l, op })));
+                continue;
+            }
+            out.push({
+                field_path: col,
+                op,
+                before_value: null,
+                after_value: val,
+                is_sensitive: sensitiveSet.has(col),
+            });
+        }
+        return out;
+    }
+    // ── UPDATE: compare before/after; emit only changed fields.
+    const beforeMap = before ?? {};
+    const afterMap = after ?? {};
+    const keys = new Set([...Object.keys(beforeMap), ...Object.keys(afterMap)]);
+    for (const col of keys) {
+        const bv = beforeMap[col];
+        const av = afterMap[col];
+        if (jsonbSet.has(col)) {
+            const leaves = diffJsonb(col, bv, av, override, resolver);
+            out.push(...leaves.map((l) => ({ ...l, op })));
+            continue;
+        }
+        // Only emit for actual change. Use JSON-equality for non-scalars; deep
+        // compare via JSON stringify is fine for the small rows we expect here.
+        if (isScalar(bv) && isScalar(av)) {
+            if (bv !== av) {
+                out.push({
+                    field_path: col,
+                    op,
+                    before_value: bv ?? null,
+                    after_value: av ?? null,
+                    is_sensitive: sensitiveSet.has(col),
+                });
+            }
+            continue;
+        }
+        if (JSON.stringify(bv) !== JSON.stringify(av)) {
+            out.push({
+                field_path: col,
+                op,
+                before_value: bv ?? null,
+                after_value: av ?? null,
+                is_sensitive: sensitiveSet.has(col),
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Decompose JSONB column changes into per-leaf events using microdiff.
+ * `column` is the SQL column; produced paths look like `column.foo.bar.0`.
+ */
+function diffJsonb(column, before, after, override, resolver) {
+    const sensitiveSet = new Set(override.sensitive_columns);
+    const isColumnSensitive = sensitiveSet.has(column);
+    // microdiff requires objects; wrap to give a stable root.
+    const beforeRoot = before == null ? {} : { [column]: before };
+    const afterRoot = after == null ? {} : { [column]: after };
+    const diffs = microdiff(beforeRoot, afterRoot, { cyclesFix: false });
+    const out = [];
+    for (const d of diffs) {
+        const path = d.path.map((p) => String(p)).join('.');
+        const canon = resolver ? resolver(path) : path;
+        if (!matchesJsonbPath(canon, override.jsonb_path_include, override.jsonb_path_exclude)) {
+            continue;
+        }
+        if (d.type === 'CREATE') {
+            out.push({
+                field_path: canon,
+                op: 'update',
+                before_value: null,
+                after_value: d.value,
+                is_sensitive: isColumnSensitive,
+            });
+        }
+        else if (d.type === 'REMOVE') {
+            out.push({
+                field_path: canon,
+                op: 'update',
+                before_value: d.oldValue,
+                after_value: null,
+                is_sensitive: isColumnSensitive,
+            });
+        }
+        else if (d.type === 'CHANGE') {
+            out.push({
+                field_path: canon,
+                op: 'update',
+                before_value: d.oldValue,
+                after_value: d.value,
+                is_sensitive: isColumnSensitive,
+            });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=diff.js.map

package/dist/server/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/server/diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,SAAS,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAW/C,mEAAmE;AACnE,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CACL,CAAC,KAAK,IAAI;QACV,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAO,CAAC,KAAK,QAAQ;QACrB,OAAO,CAAC,KAAK,SAAS,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,IAMxB;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAE9B,yEAAyE;IACzE,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,qCAAqC;YACtE,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,GAAG;gBACf,EAAE;gBACF,YAAY,EAAE,GAAG;gBACjB,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,qDAAqD;IACrD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,iEAAiE;gBACjE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,GAAG;gBACf,EAAE;gBACF,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,GAAG;gBAChB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,6DAA6D;IAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC;oBACP,UAAU,EAAE,GAAG;oBACf,EAAE;oBACF,YAAY,EAAE,EAAE,IAAI,IAAI;oBACxB,WAAW,EAAE,EAAE,IAAI,IAAI;oBACvB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,GAAG;gBACf,EAAE;gBACF,YAAY,EAAE,EAAE,IAAI,IAAI;gBACxB,WAAW,EAAE,EAAE,IAAI,IAAI;gBACvB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAChB,MAAc,EACd,MAAe,EACf,KAAc,EACd,QAAuB,EACvB,QAAuB;IAEvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEnD,0DAA0D;IAC1D,MAAM,UAAU,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAErE,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,IACE,CAAC,gBAAgB,CACf,KAAK,EACL,QAAQ,CAAC,kBAAkB,EAC3B,QAAQ,CAAC,kBAAkB,CAC5B,EACD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,KAAK;gBACjB,EAAE,EAAE,QAAQ;gBACZ,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,YAAY,EAAE,iBAAiB;aAChC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,KAAK;gBACjB,EAAE,EAAE,QAAQ;gBACZ,YAAY,EAAE,CAAC,CAAC,QAAQ;gBACxB,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,iBAAiB;aAChC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,KAAK;gBACjB,EAAE,EAAE,QAAQ;gBACZ,YAAY,EAAE,CAAC,CAAC,QAAQ;gBACxB,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,YAAY,EAAE,iBAAiB;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * hazo_audit/server — all server-only exports.
+ *
+ * Import with:
+ *   import { wrapWithAudit, startAuditWorker, runWithAuditContext } from 'hazo_audit/server'
+ *
+ * Client code must never import this entry. Node.js APIs (AsyncLocalStorage,
+ * fs for INI loading) make it incompatible with browser bundles.
+ */
+import 'server-only';
+export * from '../index.js';
+export { wrapWithAudit } from './wrap.js';
+export type { WrapWithAuditOptions } from './wrap.js';
+export { startAuditWorker } from './worker.js';
+export type { WorkerOptions, WorkerHandle } from './worker.js';
+export { runWithAuditContext, getAuditContext, } from './context.js';
+export { createAuditedCrudService, emitIntentEvent, } from './audited_crud.js';
+export type { AuditHints, AuditedCrudService, AuditedCrudServiceOptions, } from './audited_crud.js';
+export { loadAuditConfig, shouldCapture, getSubjectKind, getSubjectIdColumn, getOverride, matchesJsonbPath, } from './config.js';
+export type { AuditConfig, CaptureConfig, RetentionConfig, WorkerConfig, DefaultsConfig, TableOverride, } from './config.js';
+export { diffRows } from './diff.js';
+export type { FieldChange } from './diff.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,aAAa,CAAC;AAIrB,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,YAAY,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,wBAAwB,EACxB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,WAAW,EACX,aAAa,EACb,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,26 @@
+/**
+ * hazo_audit/server — all server-only exports.
+ *
+ * Import with:
+ *   import { wrapWithAudit, startAuditWorker, runWithAuditContext } from 'hazo_audit/server'
+ *
+ * Client code must never import this entry. Node.js APIs (AsyncLocalStorage,
+ * fs for INI loading) make it incompatible with browser bundles.
+ */
+import 'server-only';
+// Re-export the client-safe types & permission constants so server code only
+// needs one import.
+export * from '../index.js';
+// Wrap (producer)
+export { wrapWithAudit } from './wrap.js';
+// Worker (consumer)
+export { startAuditWorker } from './worker.js';
+// Actor context
+export { runWithAuditContext, getAuditContext, } from './context.js';
+// Audited CRUD + intent
+export { createAuditedCrudService, emitIntentEvent, } from './audited_crud.js';
+// Config (exposed for advanced users / tests)
+export { loadAuditConfig, shouldCapture, getSubjectKind, getSubjectIdColumn, getOverride, matchesJsonbPath, } from './config.js';
+// Diff helper (exposed for testing/inspection)
+export { diffRows } from './diff.js';
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,aAAa,CAAC;AAErB,6EAA6E;AAC7E,oBAAoB;AACpB,cAAc,aAAa,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,oBAAoB;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,gBAAgB;AAChB,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,wBAAwB;AACxB,OAAO,EACL,wBAAwB,EACxB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAO3B,8CAA8C;AAC9C,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAUrB,+CAA+C;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}

package/dist/server/outbox.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Outbox enqueue helper. Best-effort: any failure here logs + reports via
+ * onAuditFailure but NEVER throws into the user write path.
+ */
+import 'server-only';
+import type { HazoConnectAdapter } from 'hazo_connect';
+import type { ActorContext } from '../index.js';
+export interface OutboxRow {
+    id?: string;
+    scope_id?: string | null;
+    correlation_id: string;
+    table_name: string;
+    subject_kind: string;
+    subject_id: string;
+    op: 'insert' | 'update' | 'delete';
+    before_row?: Record<string, unknown> | null;
+    after_row?: Record<string, unknown> | null;
+    actor_kind: ActorContext['actor_kind'];
+    actor_user_id?: string | null;
+    actor_label?: string | null;
+    intent_event?: string | null;
+    intent_payload?: Record<string, unknown> | null;
+}
+export type OutboxFailureHandler = (err: Error, ctx: {
+    table: string;
+    op: string;
+}) => void;
+export declare function enqueueOutbox(adapter: HazoConnectAdapter, row: OutboxRow, onFailure?: OutboxFailureHandler): Promise<void>;
+//# sourceMappingURL=outbox.d.ts.map

package/dist/server/outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../src/server/outbox.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,SAAS;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjD;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,KAAK,EACV,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,KAC/B,IAAI,CAAC;AAiBV,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,SAAS,EACd,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/server/outbox.js

@@ -0,0 +1,53 @@
+/**
+ * Outbox enqueue helper. Best-effort: any failure here logs + reports via
+ * onAuditFailure but NEVER throws into the user write path.
+ */
+import 'server-only';
+import { randomUUID } from 'node:crypto';
+import { createCrudService } from 'hazo_connect/server';
+/**
+ * Serialize a JSONB-shaped value to a JSON string when adapters can't bind
+ * objects directly (e.g., sql.js). Postgres JSONB also accepts strings so
+ * this is safe across adapters.
+ */
+function toJsonText(v) {
+    if (v == null)
+        return null;
+    if (typeof v === 'string')
+        return v;
+    try {
+        return JSON.stringify(v);
+    }
+    catch {
+        return null;
+    }
+}
+export async function enqueueOutbox(adapter, row, onFailure) {
+    try {
+        const svc = createCrudService(adapter, 'hazo_audit_outbox', {
+            autoId: { enabled: true, column: 'id' },
+        });
+        await svc.insert({
+            id: row.id ?? randomUUID(),
+            scope_id: row.scope_id ?? null,
+            correlation_id: row.correlation_id,
+            table_name: row.table_name,
+            subject_kind: row.subject_kind,
+            subject_id: row.subject_id,
+            op: row.op,
+            before_row: toJsonText(row.before_row),
+            after_row: toJsonText(row.after_row),
+            actor_kind: row.actor_kind,
+            actor_user_id: row.actor_user_id ?? null,
+            actor_label: row.actor_label ?? null,
+            intent_event: row.intent_event ?? null,
+            intent_payload: toJsonText(row.intent_payload),
+        });
+    }
+    catch (err) {
+        const e = err instanceof Error ? err : new Error(String(err));
+        if (onFailure)
+            onFailure(e, { table: row.table_name, op: row.op });
+    }
+}
+//# sourceMappingURL=outbox.js.map

package/dist/server/outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../src/server/outbox.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAyBxD;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA2B,EAC3B,GAAc,EACd,SAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE;YAC1D,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC;YACf,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,UAAU,EAAE;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;YACtC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YACpC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;YACxC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;YACpC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACtC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,IAAI,SAAS;YAAE,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/server/worker.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Audit worker: drains hazo_audit_outbox into hazo_audit_field /
+ * hazo_audit_intent. Uses hazo_connect's claimRows() primitive for
+ * concurrency-safe row claiming with attempt-count + backoff.
+ */
+import 'server-only';
+import type { HazoConnectAdapter } from 'hazo_connect';
+import { type AuditConfig } from './config.js';
+import type { PathResolver } from '../index.js';
+export interface WorkerOptions {
+    /** Adapter that owns hazo_audit_outbox (claimed via claimRows). */
+    app_adapter: HazoConnectAdapter;
+    /** Adapter that owns hazo_audit_field + hazo_audit_intent. Defaults to app_adapter. */
+    audit_adapter?: HazoConnectAdapter;
+    /** Worker poll interval in ms. Falls back to INI. */
+    poll_ms?: number;
+    /** Max attempts before dead-letter. Falls back to INI. */
+    max_attempts?: number;
+    /** Named JSONB path resolvers (same shape as wrapWithAudit). */
+    resolvers?: Record<string, PathResolver>;
+    /** Pre-loaded config (escape hatch for tests). Bypasses file IO. */
+    config?: AuditConfig;
+    /** Optional INI path override. */
+    config_path?: string;
+    /** Fired on any worker exception; never re-thrown. */
+    onWorkerError?: (err: Error, row?: unknown) => void;
+    /** Optional logger. */
+    logger?: {
+        debug?: (msg: string, data?: Record<string, unknown>) => void;
+        info?: (msg: string, data?: Record<string, unknown>) => void;
+        warn?: (msg: string, data?: Record<string, unknown>) => void;
+        error?: (msg: string, data?: Record<string, unknown>) => void;
+    };
+}
+export interface WorkerHandle {
+    stop(): Promise<void>;
+    drainOnce(): Promise<{
+        processed: number;
+        failed: number;
+    }>;
+}
+export declare function startAuditWorker(opts: WorkerOptions): WorkerHandle;
+//# sourceMappingURL=worker.d.ts.map

package/dist/server/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/server/worker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,WAAW,EAAE,kBAAkB,CAAC;IAChC,uFAAuF;IACvF,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD,uBAAuB;IACvB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC9D,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC7D,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KAC/D,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAqND,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAoFlE"}