hazo_audit 2.0.2 → 2.1.0

package/CHANGE_LOG.md

@@ -1,5 +1,68 @@
 # Change log
 
+## 2.1.0 — 2026-05-29
+
+### Workspace v2 migration (Wave 2)
+
+Standardisation onto the workspace foundation packages — adopt `hazo_core`,
+align logging / errors / correlation IDs / config / UUIDs with the rest of
+the ecosystem. No public API removed; the previous response shapes for
+`/audit/events`, `reveal`, and `viewer` are preserved.
+
+### Added
+
+- **`hazo_core` peer dependency (`^1.0.0`).** Required; supplies
+  `HazoError`, `withContext`, `generateRequestId`, `createLogger`,
+  `loadConfig`.
+- **`hazo_ui` peer dependency (`^3.0.1`, optional).** Client components now
+  import `cn` from `hazo_ui` — consumers that use `<FieldAuditIcon>` etc.
+  must install it. Server-only consumers can skip it.
+- **Workspace-standard logger** at `src/utils/logger.ts` — `get_logger()` /
+  `set_logger()` default to `createLogger('hazo_audit')`. Worker + Next.js
+  routes emit structured event names (`worker.started`,
+  `outbox.row_drained`, `outbox.row_failed`, `events.reveal.served`, etc.).
+- **`withContext` wrapping** around every drained outbox row in the worker
+  and every Next.js handler — correlation IDs from the producing write flow
+  through every nested DB call and `fetchWithRequestId`.
+- **`HazoError` subclasses** — `RecordNotFoundError` now extends
+  `HazoNotFoundError` (`HAZO_AUDIT_RECORD_NOT_FOUND`, httpStatus 404). Route
+  handlers use a `handleError(logger, event, error)` helper that maps
+  `HazoError.is(err)` to the right HTTP status + log level.
+- **`src/lib/config/hazo_audit_config.ts`** — workspace-standard INI
+  loader via `hazo_core.loadConfig` for `[general]` / `[log.overrides]` /
+  `[retention]` / `[worker]` sections. Coexists with
+  `src/server/config.ts::loadAuditConfig()`, which keeps owning the
+  package-specific `[capture]` and `[overrides.*]` rules.
+- **`config/hazo_audit_config.ini.sample`** now documents the
+  `[general]` and `[log.overrides]` sections and `HAZO_AUDIT_<SECTION>_<KEY>`
+  env-var overrides.
+- **Root `db_setup_postgres.sql` + `db_setup_sqlite.sql`** — idempotent,
+  consumer-facing schema setup (S6). The historical `migrations/001_init.sql`
+  is preserved.
+- **`AGENTS.md`** at root + `src/`, and `design/feature_requests/INDEX.md`
+  skeleton (S13 + S16).
+- **`/autotest` route** in the test-app powered by
+  `hazo_ui/test-harness` — workspace-standard browser scenarios
+  (`cn` re-export, `generateRequestId`, `HazoError` subclasses,
+  `withContext` / `getCorrelationId`).
+
+### Changed
+
+- **`crypto.randomUUID()` removed** from all server modules in favour of
+  `src/utils/uuid.ts::generateUUID()` (wraps
+  `generateRequestId().slice(4)` from `hazo_core`).
+- **`src/client/cn.ts` deleted** — components now import `cn` from
+  `hazo_ui`. The local `clsx + tailwind-merge` duplicate is gone.
+- **Worker logger interface** narrowed to the workspace `Logger` type and
+  defaults to `get_logger()` when the consumer doesn't pass one.
+- **test-app/package.json** uses `"*"` for workspace-local resolution of
+  `hazo_audit`, `hazo_connect`, `hazo_core`, `hazo_ui` (previously
+  `file:..`). `next.config.js` adds `hazo_core`, `hazo_logs`, `hazo_ui` to
+  `transpilePackages`.
+- **`engines` block removed** from package.json (workspace standard).
+- **Workspace registration** — `hazo_audit/test-app` is now listed in the
+  root `package.json` `workspaces` array.
+
 ## 2.0.2 — 2026-05-27
 
 ### Added

package/config/hazo_audit_config.ini.sample

@@ -4,7 +4,35 @@
 ; and startAuditWorker() at startup. INI is the primary source of truth for
 ; capture rules; the only TypeScript-shaped escape hatch is the `resolvers`
 ; option on wrapWithAudit().
+;
+; Per hazo workspace standard S7, values may also be overridden via env vars:
+;   HAZO_AUDIT_<SECTION>_<KEY>=value
+; e.g. HAZO_AUDIT_WORKER_POLL_MS=500
+;
+; Per D-019, a per-environment overlay file at
+;   config/hazo_audit_config.<HAZO_ENV>.ini
+; is layered on top of this base file when HAZO_ENV is set.
+
+; ============================================================================
+; [general] - Workspace-standard general configuration
+; ============================================================================
+[general]
+
+; Deployment environment label. Falls back to NODE_ENV, then 'development'.
+; env = production
 
+; ============================================================================
+; [log.overrides] - Per-namespace log level overrides (workspace standard)
+; Format: <namespace> = trace|debug|info|warn|error
+; ============================================================================
+[log.overrides]
+
+; hazo_audit = info
+; hazo_audit/worker = warn
+
+; ============================================================================
+; [capture] - Which tables to audit
+; ============================================================================
 [capture]
 ; Whitelist by prefix or exact name. At least one of include_* must match for
 ; a write to be captured (after passing exclusions).

package/db_setup_postgres.sql

@@ -0,0 +1,76 @@
+-- hazo_audit PostgreSQL schema setup (idempotent)
+--
+-- Three tables:
+--   hazo_audit_outbox  : queue produced by wrapWithAudit, drained by the worker
+--   hazo_audit_field   : per-leaf field events the UI reads from
+--   hazo_audit_intent  : Layer-1 named events (e.g., 'audit_reveal')
+
+CREATE TABLE IF NOT EXISTS hazo_audit_outbox (
+  id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id        UUID,
+  correlation_id  UUID NOT NULL,
+  table_name      TEXT NOT NULL,
+  subject_kind    TEXT NOT NULL,
+  subject_id      TEXT NOT NULL,
+  op              TEXT NOT NULL CHECK (op IN ('insert','update','delete')),
+  before_row      JSONB,
+  after_row       JSONB,
+  actor_kind      TEXT NOT NULL,
+  actor_user_id   UUID,
+  actor_label     TEXT,
+  intent_event    TEXT,
+  intent_payload  JSONB,
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  drained_at      TIMESTAMPTZ,
+  attempt_count   INTEGER NOT NULL DEFAULT 0,
+  last_attempt_at TIMESTAMPTZ,
+  failed_at       TIMESTAMPTZ,
+  failure_reason  TEXT
+);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_outbox_drain
+  ON hazo_audit_outbox (drained_at, failed_at, attempt_count, last_attempt_at)
+  WHERE drained_at IS NULL AND failed_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_outbox_chain
+  ON hazo_audit_outbox (subject_kind, subject_id, created_at DESC)
+  WHERE drained_at IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS hazo_audit_field (
+  id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id        UUID,
+  correlation_id  UUID NOT NULL,
+  subject_kind    TEXT NOT NULL,
+  subject_id      TEXT NOT NULL,
+  field_path      TEXT NOT NULL,
+  op              TEXT NOT NULL CHECK (op IN ('insert','update','delete')),
+  before_value    JSONB,
+  after_value     JSONB,
+  is_sensitive    BOOLEAN NOT NULL DEFAULT FALSE,
+  actor_kind      TEXT NOT NULL,
+  actor_user_id   UUID,
+  actor_label     TEXT,
+  occurred_at     TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_field_subject
+  ON hazo_audit_field (subject_kind, subject_id, field_path, occurred_at DESC);
+
+CREATE TABLE IF NOT EXISTS hazo_audit_intent (
+  id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  scope_id        UUID,
+  correlation_id  UUID NOT NULL,
+  event_name      TEXT NOT NULL,
+  payload         JSONB,
+  subject_kind    TEXT,
+  subject_id      TEXT,
+  actor_kind      TEXT NOT NULL,
+  actor_user_id   UUID,
+  actor_label     TEXT,
+  occurred_at     TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_intent_event
+  ON hazo_audit_intent (event_name, occurred_at DESC);
+
+NOTIFY pgrst, 'reload schema';

package/db_setup_sqlite.sql

@@ -0,0 +1,72 @@
+-- hazo_audit SQLite schema setup (idempotent)
+--
+-- Three tables:
+--   hazo_audit_outbox  : queue produced by wrapWithAudit, drained by the worker
+--   hazo_audit_field   : per-leaf field events the UI reads from
+--   hazo_audit_intent  : Layer-1 named events (e.g., 'audit_reveal')
+
+CREATE TABLE IF NOT EXISTS hazo_audit_outbox (
+  id              TEXT PRIMARY KEY,
+  scope_id        TEXT,
+  correlation_id  TEXT NOT NULL,
+  table_name      TEXT NOT NULL,
+  subject_kind    TEXT NOT NULL,
+  subject_id      TEXT NOT NULL,
+  op              TEXT NOT NULL CHECK (op IN ('insert','update','delete')),
+  before_row      TEXT,
+  after_row       TEXT,
+  actor_kind      TEXT NOT NULL,
+  actor_user_id   TEXT,
+  actor_label     TEXT,
+  intent_event    TEXT,
+  intent_payload  TEXT,
+  created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  drained_at      TEXT,
+  attempt_count   INTEGER NOT NULL DEFAULT 0,
+  last_attempt_at TEXT,
+  failed_at       TEXT,
+  failure_reason  TEXT
+);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_outbox_drain
+  ON hazo_audit_outbox (drained_at, failed_at, attempt_count, last_attempt_at);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_outbox_chain
+  ON hazo_audit_outbox (subject_kind, subject_id, created_at);
+
+CREATE TABLE IF NOT EXISTS hazo_audit_field (
+  id              TEXT PRIMARY KEY,
+  scope_id        TEXT,
+  correlation_id  TEXT NOT NULL,
+  subject_kind    TEXT NOT NULL,
+  subject_id      TEXT NOT NULL,
+  field_path      TEXT NOT NULL,
+  op              TEXT NOT NULL CHECK (op IN ('insert','update','delete')),
+  before_value    TEXT,
+  after_value     TEXT,
+  is_sensitive    INTEGER NOT NULL DEFAULT 0,
+  actor_kind      TEXT NOT NULL,
+  actor_user_id   TEXT,
+  actor_label     TEXT,
+  occurred_at     TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_field_subject
+  ON hazo_audit_field (subject_kind, subject_id, field_path, occurred_at);
+
+CREATE TABLE IF NOT EXISTS hazo_audit_intent (
+  id              TEXT PRIMARY KEY,
+  scope_id        TEXT,
+  correlation_id  TEXT NOT NULL,
+  event_name      TEXT NOT NULL,
+  payload         TEXT,
+  subject_kind    TEXT,
+  subject_id      TEXT,
+  actor_kind      TEXT NOT NULL,
+  actor_user_id   TEXT,
+  actor_label     TEXT,
+  occurred_at     TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS ix_hazo_audit_intent_event
+  ON hazo_audit_intent (event_name, occurred_at);

package/dist/client/AuditViewer.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useState } from 'react';
-import { cn } from './cn.js';
+import { cn } from 'hazo_ui';
 export function AuditViewer({ api_base = '/api/audit', initialFilters = {}, className, }) {
     const [filters, setFilters] = useState(initialFilters);
     const [events, setEvents] = useState([]);

package/dist/client/FieldAuditIcon.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import * as React from 'react';
-import { cn } from './cn.js';
+import { cn } from 'hazo_ui';
 import { FieldAuditTrail } from './FieldAuditTrail.js';
 /**
  * Small clock-icon button that opens a popover with the field's audit trail.

package/dist/client/FieldAuditTrail.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import * as React from 'react';
-import { cn } from './cn.js';
+import { cn } from 'hazo_ui';
 import { DEFAULT_OP_LABELS } from '../index.js';
 /**
  * Renders an ordered list of field audit events for a subject (optionally

package/dist/client/RevertConfirmDialog.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from 'react';
-import { cn } from './cn.js';
+import { cn } from 'hazo_ui';
 export function RevertConfirmDialog({ open, table, recordId, toTimestamp, onConfirm, onClose, className, }) {
     const [reason, setReason] = useState('');
     const [working, setWorking] = useState(false);

package/dist/lib/config/hazo_audit_config.d.ts

@@ -0,0 +1,99 @@
+/**
+ * hazo_audit standard workspace-configuration schema + loader.
+ *
+ * Wraps hazo_core's `loadConfig` with a Zod schema that mirrors the
+ * `[general]` and `[log.overrides]` sections of `config/hazo_audit_config.ini`.
+ *
+ * Capture / retention / worker / overrides sections continue to be loaded
+ * by `src/server/config.ts::loadAuditConfig()` — that's the package-specific
+ * runtime config layer and is kept separate so the workspace-standard loader
+ * stays a thin Zod wrapper.
+ *
+ * Resolution order (per hazo_core/loadConfig):
+ *   1. <pkg>_config.ini at process.cwd()/config/ or package root
+ *   2. <pkg>_config.<HAZO_ENV>.ini overlay
+ *   3. HAZO_AUDIT_<SECTION>_<KEY> env-var overrides
+ */
+import { z } from 'zod';
+declare const schema: z.ZodNullable<z.ZodObject<{
+    general: z.ZodOptional<z.ZodObject<{
+        env: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        env?: string | undefined;
+    }, {
+        env?: string | undefined;
+    }>>;
+    log: z.ZodOptional<z.ZodObject<{
+        overrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        overrides?: Record<string, string> | undefined;
+    }, {
+        overrides?: Record<string, string> | undefined;
+    }>>;
+    retention: z.ZodOptional<z.ZodObject<{
+        outbox_drained_ttl_days: z.ZodOptional<z.ZodString>;
+        outbox_failed_ttl_days: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        outbox_drained_ttl_days?: string | undefined;
+        outbox_failed_ttl_days?: string | undefined;
+    }, {
+        outbox_drained_ttl_days?: string | undefined;
+        outbox_failed_ttl_days?: string | undefined;
+    }>>;
+    worker: z.ZodOptional<z.ZodObject<{
+        poll_ms: z.ZodOptional<z.ZodString>;
+        max_attempts: z.ZodOptional<z.ZodString>;
+        backoff_initial_ms: z.ZodOptional<z.ZodString>;
+        reaper_interval_ms: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        poll_ms?: string | undefined;
+        max_attempts?: string | undefined;
+        backoff_initial_ms?: string | undefined;
+        reaper_interval_ms?: string | undefined;
+    }, {
+        poll_ms?: string | undefined;
+        max_attempts?: string | undefined;
+        backoff_initial_ms?: string | undefined;
+        reaper_interval_ms?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    log?: {
+        overrides?: Record<string, string> | undefined;
+    } | undefined;
+    general?: {
+        env?: string | undefined;
+    } | undefined;
+    retention?: {
+        outbox_drained_ttl_days?: string | undefined;
+        outbox_failed_ttl_days?: string | undefined;
+    } | undefined;
+    worker?: {
+        poll_ms?: string | undefined;
+        max_attempts?: string | undefined;
+        backoff_initial_ms?: string | undefined;
+        reaper_interval_ms?: string | undefined;
+    } | undefined;
+}, {
+    log?: {
+        overrides?: Record<string, string> | undefined;
+    } | undefined;
+    general?: {
+        env?: string | undefined;
+    } | undefined;
+    retention?: {
+        outbox_drained_ttl_days?: string | undefined;
+        outbox_failed_ttl_days?: string | undefined;
+    } | undefined;
+    worker?: {
+        poll_ms?: string | undefined;
+        max_attempts?: string | undefined;
+        backoff_initial_ms?: string | undefined;
+        reaper_interval_ms?: string | undefined;
+    } | undefined;
+}>>;
+export type AuditStandardConfig = NonNullable<z.infer<typeof schema>>;
+export declare function getAuditConfig(): AuditStandardConfig;
+/** Reset the in-memory cache. Mainly for tests. */
+export declare function resetAuditConfigCache(): void;
+export {};
+//# sourceMappingURL=hazo_audit_config.d.ts.map

package/dist/lib/config/hazo_audit_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hazo_audit_config.d.ts","sourceRoot":"","sources":["../../../src/lib/config/hazo_audit_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BC,CAAC;AAEd,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC;AAItE,wBAAgB,cAAc,IAAI,mBAAmB,CAYpD;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/lib/config/hazo_audit_config.js

@@ -0,0 +1,67 @@
+/**
+ * hazo_audit standard workspace-configuration schema + loader.
+ *
+ * Wraps hazo_core's `loadConfig` with a Zod schema that mirrors the
+ * `[general]` and `[log.overrides]` sections of `config/hazo_audit_config.ini`.
+ *
+ * Capture / retention / worker / overrides sections continue to be loaded
+ * by `src/server/config.ts::loadAuditConfig()` — that's the package-specific
+ * runtime config layer and is kept separate so the workspace-standard loader
+ * stays a thin Zod wrapper.
+ *
+ * Resolution order (per hazo_core/loadConfig):
+ *   1. <pkg>_config.ini at process.cwd()/config/ or package root
+ *   2. <pkg>_config.<HAZO_ENV>.ini overlay
+ *   3. HAZO_AUDIT_<SECTION>_<KEY> env-var overrides
+ */
+import { loadConfig } from 'hazo_core';
+import { z } from 'zod';
+const schema = z
+    .object({
+    general: z
+        .object({
+        env: z.string().optional(),
+    })
+        .optional(),
+    log: z
+        .object({
+        overrides: z.record(z.string(), z.string()).optional(),
+    })
+        .optional(),
+    retention: z
+        .object({
+        outbox_drained_ttl_days: z.string().optional(),
+        outbox_failed_ttl_days: z.string().optional(),
+    })
+        .optional(),
+    worker: z
+        .object({
+        poll_ms: z.string().optional(),
+        max_attempts: z.string().optional(),
+        backoff_initial_ms: z.string().optional(),
+        reaper_interval_ms: z.string().optional(),
+    })
+        .optional(),
+})
+    .nullable();
+let _cached = null;
+export function getAuditConfig() {
+    if (_cached !== null)
+        return _cached;
+    try {
+        _cached =
+            loadConfig({
+                pkg: 'hazo_audit',
+                schema: schema,
+            }) ?? {};
+    }
+    catch {
+        _cached = {};
+    }
+    return _cached;
+}
+/** Reset the in-memory cache. Mainly for tests. */
+export function resetAuditConfigCache() {
+    _cached = null;
+}
+//# sourceMappingURL=hazo_audit_config.js.map

package/dist/lib/config/hazo_audit_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hazo_audit_config.js","sourceRoot":"","sources":["../../../src/lib/config/hazo_audit_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;SACD,QAAQ,EAAE;IACb,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9C,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,QAAQ,EAAE,CAAC;AAId,IAAI,OAAO,GAA+B,IAAI,CAAC;AAE/C,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,CAAC;QACH,OAAO;YACL,UAAU,CAAsB;gBAC9B,GAAG,EAAE,YAAY;gBACjB,MAAM,EAAE,MAAe;aACxB,CAAC,IAAI,EAAE,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC"}

package/dist/nextjs/index.d.ts

@@ -5,6 +5,12 @@
  * their existing auth system (typically hazo_auth's hazo_get_tenant_auth)
  * without a hard module dep at this layer.
  *
+ * Every handler wraps its body with hazo_core's `withContext` so the
+ * correlation ID flows through every nested log call and downstream
+ * `fetchWithRequestId` outbound request. Errors are routed through
+ * `handleError()` which is HazoError-aware: 5xx → logger.error, 4xx →
+ * logger.warn.
+ *
  * Mounting (Next.js App Router):
  *
  *   // app/api/audit/events/route.ts
@@ -46,6 +52,7 @@ export interface AuditRequest extends Request {
     nextUrl?: URL;
 }
 import type { HazoConnectAdapter } from 'hazo_connect';
+import { type Logger } from '../utils/logger.js';
 export interface AuditAuth {
     user_id: string;
     scope_id: string | null;
@@ -65,6 +72,11 @@ export interface AuditEventsRoutesOptions {
     /** Default page size for list. Defaults to 50, capped at 200. */
     default_limit?: number;
     max_limit?: number;
+    /**
+     * Optional logger override. Defaults to `get_logger()` (hazo_core's
+     * `createLogger('hazo_audit')`).
+     */
+    logger?: Logger;
 }
 type NextHandler = (req: AuditRequest, ctx?: {
     params: Promise<Record<string, string>> | Record<string, string>;

package/dist/nextjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO;IAC3C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC/D,OAAO,CAAC,EAAE,GAAG,CAAC;CACf;AACD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAYvD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,kBAAkB,CAAC;IAClC,qEAAqE;IACrE,OAAO,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,WAAW,GAAG,CACjB,GAAG,EAAE,YAAY,EACjB,GAAG,CAAC,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACvE,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC;IAC9B,MAAM,EAAE;QAAE,GAAG,EAAE,WAAW,CAAA;KAAE,CAAC;CAC9B;AAuCD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,iBAAiB,CA4PnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO;IAC3C,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC/D,OAAO,CAAC,EAAE,GAAG,CAAC;CACf;AACD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAWvD,OAAO,EAA0B,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,kBAAkB,CAAC;IAClC,qEAAqE;IACrE,OAAO,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,WAAW,GAAG,CACjB,GAAG,EAAE,YAAY,EACjB,GAAG,CAAC,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACvE,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC;IAC9B,MAAM,EAAE;QAAE,GAAG,EAAE,WAAW,CAAA;KAAE,CAAC;CAC9B;AAqED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,iBAAiB,CA4TnB"}