strapi-cms-audit-log 1.1.0

package/dist/server/src/services/index.d.ts

@@ -0,0 +1,137 @@
+declare const _default: {
+    access: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        createMiddleware: () => (ctx: {
+            [x: string]: any;
+        }, next: () => Promise<unknown>) => Promise<void>;
+        register: () => void;
+        recordDenial: (ctx: {
+            [x: string]: any;
+        }) => Promise<void>;
+        sourceOf: (ctx: {
+            [x: string]: any;
+        }) => "admin" | "api" | "unknown";
+        isIgnoredPath: (path: string) => boolean;
+    };
+    audit: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        record: (entry: import('..').AuditEntryInput) => Promise<void>;
+        write: (entry: import('..').AuditEntryInput) => Promise<void>;
+        flush: () => Promise<void>;
+        find: (query?: import('..').AuditLogQuery) => Promise<import('..').AuditLogListResult>;
+        findOne: (id: number) => Promise<import('..').AuditLog | null>;
+        deleteOne: (id: number) => Promise<import('..').AuditLog | null>;
+        deleteOlderThan: (date: Date) => Promise<number>;
+        getFilterOptions: () => Promise<import('..').AuditFilterOptions>;
+        buildWhere: (query: import('..').AuditLogQuery) => Record<string, unknown>;
+        parseSort: (sort: string | undefined) => Record<string, "asc" | "desc">;
+    };
+    config: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        resolve: () => import('./config').ResolvedConfig;
+        isAuditedContentType: (uid: string) => boolean;
+        isAuditedAction: (action: import('..').AuditAction) => boolean;
+        isAuditedSecurityAction: (action: import('..').AuditSecurityAction) => boolean;
+        hasSecurityEvents: () => boolean;
+        enabledSecurityActions: () => import('..').AuditSecurityAction[];
+        getPublicConfig: () => import('..').AuditConfig;
+        clearCache: () => void;
+    };
+    context: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        resolve: () => import('..').AuditContext;
+        runAs: <T>(override: import('./context').SourceOverride, callback: () => T) => T;
+    };
+    diff: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        buildDiff: (before: unknown, after: unknown, options?: import('./diff').DiffOptions) => import('..').AuditChangeSet;
+    };
+    immutability: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        createMiddleware: () => (ctx: {
+            uid: string;
+            action: string;
+        }, next: () => Promise<unknown>) => Promise<unknown>;
+        register: () => void;
+    };
+    retention: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        cleanup: () => Promise<number>;
+        cutoffDate: (retentionDays: number, now?: Date) => Date;
+        register: () => void;
+        unregister: () => void;
+    };
+    security: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        register: () => void;
+        unregister: () => void;
+        record: (action: import('..').AuditSecurityAction, subject: string, fields?: {
+            contentDocumentId?: string | null;
+            contentId?: string | null;
+            user?: {
+                [x: string]: any;
+            } | null;
+            before?: Record<string, unknown> | null;
+            after?: Record<string, unknown> | null;
+            metadata?: import('..').AuditMetadata | null;
+            outcome?: import('..').AuditOutcome;
+        }) => Promise<void>;
+        identify: (entity: {
+            [x: string]: any;
+        } | null | undefined) => Record<string, unknown> | null;
+        subjectOf: (payload: {
+            [x: string]: any;
+        }) => {
+            [x: string]: any;
+        } | null;
+        sourceOf: () => "admin" | "system";
+        entityHandler: (action: import('..').AuditSecurityAction, subject: string) => (payload: {
+            [x: string]: any;
+        }) => Promise<void>;
+        handlers: Record<string, (payload: {
+            [x: string]: any;
+        }) => Promise<void>>;
+    };
+    snapshot: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        buildSnapshotQuery: (uid: string, keys: string[] | null, options: {
+            depth: number;
+            isIgnored?: (path: string) => boolean;
+        }) => import('./snapshot').SnapshotQuery;
+        buildComponentPopulate: (componentUid: string, depth: number) => Record<string, unknown> | true;
+        buildWhere: (uid: string, lookup: import('./snapshot').SnapshotLookup) => Record<string, unknown>;
+        fetchRows: (uid: string, lookup: import('./snapshot').SnapshotLookup, query: import('./snapshot').SnapshotQuery, depth: number) => Promise<{
+            [x: string]: any;
+        }[]>;
+        refineDynamicZones: (uid: string, rows: {
+            [x: string]: any;
+        }[], query: import('./snapshot').SnapshotQuery, depth: number) => Promise<{
+            [x: string]: any;
+        }[]>;
+        toSnapshot: (row: {
+            [x: string]: any;
+        } | null | undefined) => Record<string, unknown> | null;
+        hasDraftAndPublish: (uid: string) => boolean;
+        isLocalized: (uid: string) => boolean;
+    };
+    tracker: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        createMiddleware: () => (ctx: import('./tracker').DocumentMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>;
+        register: () => void;
+        changedKeys: (uid: string, params: Record<string, any>) => string[] | null;
+        resultRows: (result: unknown) => {
+            [x: string]: any;
+        }[];
+    };
+};
+export default _default;

package/dist/server/src/services/retention.d.ts

@@ -0,0 +1,22 @@
+import { Core } from '@strapi/strapi';
+/**
+ * Scheduled deletion of expired audit records.
+ *
+ * Runs on `strapi.cron`, off the request path entirely. Cleaning up inside a
+ * content operation — the obvious shortcut — would put an unbounded `DELETE`
+ * over the largest table in the project directly in front of an editor pressing
+ * Save, and would do it once per write. Here it runs once a day, by default at
+ * 03:00 server time, and a slow pass delays nothing but itself.
+ *
+ * `retentionDays: 0` disables the job entirely: no cron entry is registered, so
+ * projects that keep audit history forever pay nothing for the feature.
+ */
+declare const retentionService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    cleanup: () => Promise<number>;
+    cutoffDate: (retentionDays: number, now?: Date) => Date;
+    register: () => void;
+    unregister: () => void;
+};
+export default retentionService;

package/dist/server/src/services/security.d.ts

@@ -0,0 +1,54 @@
+import { Core } from '@strapi/strapi';
+import { AuditMetadata, AuditOutcome, AuditSecurityAction } from '../types';
+type Payload = Record<string, any>;
+/**
+ * The half of the audit trail Strapi does not route through the Document
+ * Service: who signed in, who failed to, who signed out, and every change to the
+ * admin users, roles, permissions and media that govern the rest of it.
+ *
+ * ## Why `eventHub` and not more Document Service middleware
+ *
+ * None of these operations is a document operation. `@strapi/admin` writes admin
+ * users with `strapi.db.query('admin::user')` and `@strapi/upload` writes files
+ * with `strapi.db.query(FILE_MODEL_UID)` — both sit *below* the Document
+ * Service, so the tracker in `tracker.ts` never sees them and no amount of
+ * middleware would make it. Authentication is not a write at all.
+ *
+ * What Strapi does do is emit a named event for each one, on the same
+ * `strapi.eventHub` its own webhook system runs on. Those emissions are all in
+ * **Community Edition** — `server/src/controllers/authentication.ts` and
+ * `server/src/services/{user,role,permission}.ts` in `@strapi/admin`,
+ * `server/src/services/{upload,folder}.ts` in `@strapi/upload` — so nothing here
+ * needs an Enterprise licence, and nothing here patches Strapi's own code.
+ *
+ * ## Why a listener may never throw
+ *
+ * `eventHub.emit` awaits its subscribers in sequence *inside the operation that
+ * emitted*. A listener that threw on `admin.auth.success` would turn a correct
+ * password into a failed login. Every handler is therefore wrapped: an audit
+ * failure is logged and swallowed, and `failOnAuditError` is deliberately not
+ * honoured here. That option exists so a project can refuse to serve content it
+ * cannot audit, which is a very different proposition from locking every
+ * administrator out of the panel because the audit table is unreachable.
+ */
+declare const securityService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    register: () => void;
+    unregister: () => void;
+    record: (action: AuditSecurityAction, subject: string, fields?: {
+        contentDocumentId?: string | null;
+        contentId?: string | null;
+        user?: Payload | null;
+        before?: Record<string, unknown> | null;
+        after?: Record<string, unknown> | null;
+        metadata?: AuditMetadata | null;
+        outcome?: AuditOutcome;
+    }) => Promise<void>;
+    identify: (entity: Payload | null | undefined) => Record<string, unknown> | null;
+    subjectOf: (payload: Payload) => Payload | null;
+    sourceOf: () => "admin" | "system";
+    entityHandler: (action: AuditSecurityAction, subject: string) => (payload: Payload) => Promise<void>;
+    handlers: Record<string, (payload: Payload) => Promise<void>>;
+};
+export default securityService;

package/dist/server/src/services/snapshot.d.ts

@@ -0,0 +1,46 @@
+import { Core } from '@strapi/strapi';
+type Row = Record<string, any>;
+export interface SnapshotQuery {
+    select: string[];
+    populate?: Record<string, unknown>;
+    /** Dynamic-zone attributes present in the query, for the optional refinement pass. */
+    dynamicZones: string[];
+}
+export interface SnapshotLookup {
+    documentId: string;
+    locales?: string[] | null;
+    status?: 'draft' | 'published' | 'any';
+}
+/**
+ * Builds the narrowest query that can answer "what did these fields look like?".
+ *
+ * This is the heart of the plugin's performance story. Strapi's own
+ * `getDeepPopulate` walks the *schema* and asks for every relation, component
+ * and media field a type could ever hold; on a page content type with 173
+ * registered dynamic-zone widgets that is hundreds of joins to audit a
+ * two-field edit. Here:
+ *
+ *  - the key set is the attributes the write actually touched, not the schema;
+ *  - relations and media are reduced to identifying fields, so a relation to a
+ *    50-field document costs a handful of columns rather than all of them;
+ *  - dynamic zones are populated with `true`, which makes Strapi read the join
+ *    table first and then issue one query per component type *actually present*
+ *    in the rows. Five widgets used out of 173 registered means five queries,
+ *    and the 168 unused schemas are never touched.
+ */
+declare const snapshotService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    buildSnapshotQuery: (uid: string, keys: string[] | null, options: {
+        depth: number;
+        isIgnored?: (path: string) => boolean;
+    }) => SnapshotQuery;
+    buildComponentPopulate: (componentUid: string, depth: number) => Record<string, unknown> | true;
+    buildWhere: (uid: string, lookup: SnapshotLookup) => Record<string, unknown>;
+    fetchRows: (uid: string, lookup: SnapshotLookup, query: SnapshotQuery, depth: number) => Promise<Row[]>;
+    refineDynamicZones: (uid: string, rows: Row[], query: SnapshotQuery, depth: number) => Promise<Row[]>;
+    toSnapshot: (row: Row | null | undefined) => Record<string, unknown> | null;
+    hasDraftAndPublish: (uid: string) => boolean;
+    isLocalized: (uid: string) => boolean;
+};
+export default snapshotService;

package/dist/server/src/services/tracker.d.ts

@@ -0,0 +1,39 @@
+import { Core } from '@strapi/strapi';
+type Row = Record<string, any>;
+export interface DocumentMiddlewareContext {
+    uid: string;
+    action: string;
+    contentType?: Record<string, any>;
+    params: Record<string, any>;
+}
+/**
+ * Global interception of content writes.
+ *
+ * Registered once with `strapi.documents.use()`, which is the Strapi v5
+ * replacement for per-content-type lifecycles and the reason a consuming
+ * application never writes a line of audit code. Three properties make this the
+ * right layer, and `db.lifecycles` the wrong one:
+ *
+ *  1. It sees the *semantic* action. `publish` and `unpublish` are ordinary row
+ *     inserts and deletes to the database layer; only the Document Service knows
+ *     they were a publish.
+ *  2. It runs *outside* the write's transaction (`middlewares.wrapObject` wraps
+ *     the already-transaction-wrapped repository methods), so an audit failure
+ *     can never roll back an editor's save, and an audit insert never holds a
+ *     row lock open.
+ *  3. It sees `documentId` and `locale` as first-class parameters rather than
+ *     having to reconstruct them from a row.
+ *
+ * Every operation the Content Manager, the REST/GraphQL content API and custom
+ * server code perform goes through this facade, so all three are covered by the
+ * one registration.
+ */
+declare const trackerService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    createMiddleware: () => (ctx: DocumentMiddlewareContext, next: () => Promise<unknown>) => Promise<unknown>;
+    register: () => void;
+    changedKeys: (uid: string, params: Record<string, any>) => string[] | null;
+    resultRows: (result: unknown) => Row[];
+};
+export default trackerService;

package/dist/server/src/types/index.d.ts

@@ -0,0 +1,214 @@
+/**
+ * Public type surface of the plugin.
+ *
+ * Re-exported from `strapi-plugin-audit-log/strapi-server`, so a consuming
+ * application can type its own code against the same shapes the plugin uses:
+ *
+ * ```ts
+ * import type { AuditLog, AuditConfig } from 'strapi-plugin-audit-log/strapi-server';
+ * ```
+ *
+ * The admin panel keeps its own copies of the few shared unions in
+ * `admin/src/types.ts`. That is not an oversight: the admin and server bundles
+ * are compiled by separate Vite passes whose `.d.ts` emit is rooted at
+ * `admin/src` and `server/src` respectively, so a file imported across that
+ * boundary would be emitted outside its own root. See README → Architecture.
+ */
+/** Operations the plugin can record. Extend via `AuditAction` unions downstream. */
+export type AuditAction = 'create' | 'update' | 'delete' | 'publish' | 'unpublish';
+/**
+ * Operations the plugin records that are not content writes.
+ *
+ * Produced by `strapi.eventHub` listeners and by the access middleware rather
+ * than by the Document Service. Namespaced with a dot so a reader can tell at a
+ * glance which family a row belongs to, and so a filter on `login.` prefixes
+ * groups the authentication trail without a second column.
+ */
+export type AuditSecurityAction = 'login.success' | 'login.failed' | 'logout' | 'access.denied' | 'admin.user.create' | 'admin.user.update' | 'admin.user.delete' | 'admin.role.create' | 'admin.role.update' | 'admin.role.delete' | 'admin.permission.create' | 'admin.permission.update' | 'admin.permission.delete' | 'media.create' | 'media.update' | 'media.delete' | 'media-folder.create' | 'media-folder.update' | 'media-folder.delete';
+/** Every action the plugin can write, across both families. */
+export type AuditAnyAction = AuditAction | AuditSecurityAction;
+/**
+ * Whether the recorded attempt succeeded.
+ *
+ * Every content write is a `success` — the middleware runs after the operation
+ * resolved, so a failed save produces no record at all. The value earns its
+ * column on the security side, where `login.failed` and `access.denied` are the
+ * rows a reviewer opens the log to find, and where "show me the failures" must
+ * be an indexed query rather than a scan of an action list.
+ */
+export type AuditOutcome = 'success' | 'failure';
+/**
+ * Free-form detail that only some actions have.
+ *
+ * A deliberately loose bag rather than a column each: the useful fields differ
+ * per action (`reason` and `provider` for a login, `method`/`path`/`statusCode`
+ * for a denial, `fileName` for an upload), and none of them is ever filtered or
+ * sorted on. Anything worth querying gets a real column instead.
+ */
+export interface AuditMetadata {
+    [key: string]: unknown;
+}
+/** How security events are selected. `'*'` means every one of them. */
+export type SecurityEventSelector = '*' | AuditSecurityAction[];
+/**
+ * Where the operation came from.
+ *
+ * `admin`  — an authenticated Strapi admin panel request
+ * `api`    — the REST/GraphQL content API (API token or Users & Permissions user)
+ * `cron`   — a scheduled task
+ * `migration` — a data migration or import script
+ * `system` — server-side code with no request context (bootstrap, listeners)
+ * `unknown` — a request context existed but could not be classified
+ */
+export type AuditSource = 'admin' | 'api' | 'system' | 'cron' | 'migration' | 'unknown';
+/** A single field-level change, keyed in {@link AuditChangeSet} by dotted path. */
+export interface AuditChange {
+    from: unknown;
+    to: unknown;
+}
+/**
+ * Field-level diff of an operation.
+ *
+ * Keys are dotted paths into the document, with array members addressed by
+ * index: `title`, `seo.metaTitle`, `blocks[2].heading`.
+ */
+export type AuditChangeSet = Record<string, AuditChange>;
+/** Identity of the actor, snapshotted at write time so it survives user deletion. */
+export interface AuditActor {
+    userId: string | null;
+    userEmail: string | null;
+    userName: string | null;
+}
+/** Request metadata, captured opportunistically — every field may be absent. */
+export interface AuditRequestContext {
+    ipAddress: string | null;
+    userAgent: string | null;
+    requestId: string | null;
+}
+/** Everything the audit service needs to know about who/where, resolved once per operation. */
+export interface AuditContext extends AuditActor, AuditRequestContext {
+    source: AuditSource;
+}
+/** A persisted audit record, as returned by the plugin's admin API. */
+export interface AuditLog extends AuditContext {
+    id: number;
+    /** The audit record's own Strapi v5 document id — not the audited document's. */
+    documentId: string;
+    action: AuditAnyAction | string;
+    /** UID of the audited content type, e.g. `api::page.page`. */
+    contentType: string;
+    /** Human-readable name of the audited content type at the time of the write. */
+    contentTypeDisplayName: string | null;
+    /**
+     * The audited document's Strapi v5 document id.
+     *
+     * Not called `documentId`: Strapi v5 reserves that attribute name on every
+     * content type and throws at boot if a schema declares it.
+     */
+    contentDocumentId: string | null;
+    /** The audited entry's numeric database id, as a string. */
+    contentId: string | null;
+    locale: string | null;
+    changes: AuditChangeSet | null;
+    before: Record<string, unknown> | null;
+    after: Record<string, unknown> | null;
+    /** `failure` for a rejected login or a denied request; `success` for everything else. */
+    outcome: AuditOutcome | null;
+    /** Action-specific detail — see {@link AuditMetadata}. */
+    metadata: AuditMetadata | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Selects which content types are audited. `'*'` means every content type. */
+export type ContentTypeSelector = '*' | string[];
+/** How the audit row is persisted relative to the content operation. */
+export type AuditWriteMode = 'sync' | 'async';
+/**
+ * Plugin configuration, after defaults have been resolved.
+ *
+ * See {@link AuditUserConfig} for the shape accepted in `config/plugins.ts`.
+ */
+export interface AuditConfig {
+    actions: AuditAction[];
+    contentTypes: ContentTypeSelector;
+    ignoredContentTypes: string[];
+    ignoredFields: string[];
+    additionalIgnoredFields: string[];
+    ignoredChangeFields: string[];
+    storeBefore: boolean;
+    storeAfter: boolean;
+    storeChanges: boolean;
+    retentionDays: number;
+    retentionCron: string;
+    failOnAuditError: boolean;
+    writeMode: AuditWriteMode;
+    maxPopulateDepth: number;
+    maxSnapshotBytes: number;
+    auditSystemOperations: boolean;
+    /** Which security events to record. `'*'` is all of them; `[]` disables the listeners entirely. */
+    securityEvents: SecurityEventSelector;
+    /** Mirror every record to `strapi.log` as one line of structured JSON, for a SIEM to pick up off stdout. */
+    forwardToLogger: boolean;
+    /** Level the mirrored line is written at. */
+    forwardLogLevel: AuditLogLevel;
+}
+/** Levels `strapi.log` exposes that make sense for an audit mirror. */
+export type AuditLogLevel = 'debug' | 'info' | 'warn' | 'error';
+/** Configuration as written by a consumer — every key optional. */
+export type AuditUserConfig = Partial<AuditConfig>;
+/** Payload handed to the audit service for persistence. */
+export interface AuditEntryInput extends AuditContext {
+    action: AuditAnyAction;
+    contentType: string;
+    contentTypeDisplayName: string | null;
+    contentDocumentId: string | null;
+    contentId: string | null;
+    locale: string | null;
+    changes: AuditChangeSet | null;
+    before: Record<string, unknown> | null;
+    after: Record<string, unknown> | null;
+    /** Defaults to `success` when omitted — see {@link AuditOutcome}. */
+    outcome?: AuditOutcome | null;
+    metadata?: AuditMetadata | null;
+}
+/** Filters accepted by the admin list endpoint. */
+export interface AuditLogQuery {
+    page?: number;
+    pageSize?: number;
+    sort?: string;
+    action?: string | string[];
+    contentType?: string | string[];
+    userId?: string | string[];
+    locale?: string | string[];
+    source?: string | string[];
+    outcome?: string | string[];
+    contentDocumentId?: string;
+    dateFrom?: string;
+    dateTo?: string;
+    _q?: string;
+}
+/** Shape returned by `GET /audit-log/logs`. */
+export interface AuditLogListResult {
+    results: AuditLog[];
+    pagination: {
+        page: number;
+        pageSize: number;
+        pageCount: number;
+        total: number;
+    };
+}
+/** Distinct values behind the admin list's filter dropdowns. */
+export interface AuditFilterOptions {
+    contentTypes: Array<{
+        uid: string;
+        displayName: string;
+    }>;
+    users: Array<{
+        userId: string;
+        label: string;
+    }>;
+    locales: string[];
+    actions: string[];
+    sources: string[];
+    outcomes: string[];
+}

package/dist/server/src/utils/json.d.ts

@@ -0,0 +1,17 @@
+/** Small JSON helpers shared by the diff engine and the audit service. */
+export declare const isPlainObject: (value: unknown) => value is Record<string, unknown>;
+/**
+ * Structural equality for values that came out of the database or off a request
+ * body — i.e. JSON-shaped, plus `Date`, which Strapi hands back for datetime
+ * columns while the incoming payload for the same field is an ISO string.
+ * Comparing those two with `===` would report a change on every single write.
+ */
+export declare const isEqual: (a: unknown, b: unknown) => boolean;
+/**
+ * Approximate byte size of a value once serialised.
+ *
+ * Approximate on purpose: this only ever feeds a "is this snapshot absurdly
+ * large" check, and stringifying a 50MB document twice to get an exact number
+ * would cost more than the check saves.
+ */
+export declare const approximateJsonBytes: (value: unknown) => number;

package/dist/server/src/utils/paths.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Dotted-path matching for the ignore lists.
+ *
+ * A path is written the way the diff engine writes it — `seo.metaTitle`,
+ * `blocks[2].heading` — and a pattern may be:
+ *
+ *   `password`          leaf name; matches at any depth
+ *   `seo.metaTitle`     exact path, anchored at the document root
+ *   `*token*`           substring match within one segment
+ *   `seo.*.token`       `*` on its own matches exactly one whole segment
+ *   `blocks.**.secret`  `**` matches zero or more segments
+ *
+ * Array indices are stripped before matching, so `blocks[2].secret` is matched
+ * by `blocks.secret` — someone writing an ignore list should never have to think
+ * about which element of a repeatable component they are excluding.
+ *
+ * Matching is case-insensitive. Attribute names in Strapi are camelCase while
+ * the words worth redacting (`token`, `secret`, `password`) are written
+ * lowercase, so a case-sensitive `*token*` would sail straight past
+ * `internalToken`. For a redaction list, matching too widely costs a field in an
+ * audit record; matching too narrowly costs a secret stored forever.
+ */
+/** `blocks[2].seo.title` -> `['blocks', 'seo', 'title']`, lowercased. */
+export declare const toSegments: (path: string) => string[];
+/**
+ * Compiles an ignore list into a predicate.
+ *
+ * Built once per operation rather than per field: a document with a large
+ * dynamic zone produces thousands of path tests, and re-parsing the patterns for
+ * each one is the difference between negligible and measurable.
+ */
+export declare const createPathMatcher: (patterns: string[]) => ((path: string) => boolean);
+/** Appends a key to a dotted path, using `[i]` notation for array members. */
+export declare const joinPath: (base: string, key: string | number) => string;

package/dist/server/src/utils/sanitize.d.ts

@@ -0,0 +1,16 @@
+import { createPathMatcher } from './paths';
+export type PathMatcher = (path: string) => boolean;
+/**
+ * Recursively strips every ignored path from a snapshot.
+ *
+ * Runs on `before` and `after` *before* they are handed to the diff engine, so a
+ * redacted field cannot leak into `changes` either. Values are dropped
+ * entirely rather than masked with a placeholder: a placeholder still tells a
+ * reader of the audit log that the field exists and changed, and for a password
+ * hash or an API key even that is more than an audit trail needs to say.
+ *
+ * Returns a new object; the input — which is a live row handed to us by the
+ * Document Service — is never mutated.
+ */
+export declare const sanitizeValue: <T>(value: T, isIgnored: PathMatcher, basePath?: string) => T;
+export { createPathMatcher };