@arcblock/did-connect-service 4.1.7 → 4.1.8

package/dist/store/d1-store.js

@@ -35,7 +35,9 @@ CREATE TABLE IF NOT EXISTS users (
   metadata TEXT DEFAULT '{}',
   address TEXT DEFAULT '{}',
   name TEXT,
-  createdByAppPid TEXT
+  createdByAppPid TEXT,
+  createdBy TEXT,
+  updatedBy TEXT
 );
 
 CREATE TABLE IF NOT EXISTS connected_accounts (
@@ -49,7 +51,11 @@ CREATE TABLE IF NOT EXISTS connected_accounts (
   lastLoginIp TEXT,
   userInfo TEXT,
   extra TEXT,
-  counter INTEGER DEFAULT 0
+  counter INTEGER DEFAULT 0,
+  createdAt TEXT,
+  updatedAt TEXT,
+  createdBy TEXT,
+  updatedBy TEXT
 );
 
 CREATE TABLE IF NOT EXISTS challenges (
@@ -70,7 +76,9 @@ CREATE TABLE IF NOT EXISTS invitations (
   useCount INTEGER DEFAULT 0,
   status TEXT DEFAULT 'active',
   createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
+  updatedAt TEXT DEFAULT (datetime('now')),
+  createdBy TEXT,
+  updatedBy TEXT
 );
 
 CREATE TABLE IF NOT EXISTS audit_logs (
@@ -104,7 +112,9 @@ CREATE TABLE IF NOT EXISTS access_policies (
   reverse INTEGER DEFAULT 0,
   isProtected INTEGER DEFAULT 0,
   createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
+  updatedAt TEXT DEFAULT (datetime('now')),
+  createdBy TEXT,
+  updatedBy TEXT
 );
 
 CREATE TABLE IF NOT EXISTS security_rules (
@@ -115,7 +125,9 @@ CREATE TABLE IF NOT EXISTS security_rules (
   enabled INTEGER DEFAULT 1,
   remark TEXT DEFAULT '',
   createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
+  updatedAt TEXT DEFAULT (datetime('now')),
+  createdBy TEXT,
+  updatedBy TEXT
 );
 
 CREATE INDEX IF NOT EXISTS idx_security_rules_priority ON security_rules(priority);
@@ -130,7 +142,8 @@ CREATE TABLE IF NOT EXISTS access_keys (
   expireAt TEXT,
   lastUsedAt TEXT,
   createdAt TEXT DEFAULT (datetime('now')),
-  updatedAt TEXT DEFAULT (datetime('now'))
+  updatedAt TEXT DEFAULT (datetime('now')),
+  updatedBy TEXT
 );
 
 CREATE INDEX IF NOT EXISTS idx_access_keys_createdBy ON access_keys(createdBy);
@@ -207,9 +220,9 @@ export class D1Store {
      *   forwarded to the primary (per Cloudflare D1 Sessions API).
      *
      *   `assumeMigrated` declares the schema is owned by the deploy-time
-     *   migrations (0001…0007 applied via `wrangler d1 migrations apply`) —
+     *   migrations (0001…0008 applied via `wrangler d1 migrations apply`) —
      *   {@link migrate} then becomes a no-op instead of replaying the full DDL
-     *   (CREATE batches + 8 always-failing ALTERs + seed INSERTs ≈ several
+     *   (CREATE batches + 14 always-failing ALTERs + seed INSERTs ≈ several
      *   serial D1 round-trips) on every fresh isolate's first handler build.
      *   ONLY safe on migrated databases: with it set, a missing schema fails
      *   loudly at the first real query instead of being silently created.
@@ -249,6 +262,30 @@ export class D1Store {
             this.db.prepare("ALTER TABLE audit_logs ADD COLUMN instance_did TEXT DEFAULT NULL").run(),
             this.db.prepare("ALTER TABLE access_policies ADD COLUMN instance_did TEXT DEFAULT NULL").run(),
             this.db.prepare("ALTER TABLE invitations ADD COLUMN instance_did TEXT DEFAULT NULL").run(),
+            this.db.prepare("ALTER TABLE connected_accounts ADD COLUMN createdAt TEXT").run(),
+            this.db.prepare("ALTER TABLE connected_accounts ADD COLUMN updatedAt TEXT").run(),
+            this.db.prepare("ALTER TABLE memberships ADD COLUMN created_at TEXT").run(),
+            this.db.prepare("ALTER TABLE memberships ADD COLUMN updated_at TEXT").run(),
+            this.db.prepare("ALTER TABLE settings ADD COLUMN created_at TEXT").run(),
+            this.db.prepare("ALTER TABLE instance_hosts ADD COLUMN updated_at TEXT").run(),
+            // Phase 3: createdBy/updatedBy audit columns
+            this.db.prepare("ALTER TABLE users ADD COLUMN createdBy TEXT").run(),
+            this.db.prepare("ALTER TABLE users ADD COLUMN updatedBy TEXT").run(),
+            this.db.prepare("ALTER TABLE connected_accounts ADD COLUMN createdBy TEXT").run(),
+            this.db.prepare("ALTER TABLE connected_accounts ADD COLUMN updatedBy TEXT").run(),
+            this.db.prepare("ALTER TABLE invitations ADD COLUMN createdBy TEXT").run(),
+            this.db.prepare("ALTER TABLE invitations ADD COLUMN updatedBy TEXT").run(),
+            this.db.prepare("ALTER TABLE access_policies ADD COLUMN createdBy TEXT").run(),
+            this.db.prepare("ALTER TABLE access_policies ADD COLUMN updatedBy TEXT").run(),
+            this.db.prepare("ALTER TABLE security_rules ADD COLUMN createdBy TEXT").run(),
+            this.db.prepare("ALTER TABLE security_rules ADD COLUMN updatedBy TEXT").run(),
+            this.db.prepare("ALTER TABLE access_keys ADD COLUMN updatedBy TEXT").run(),
+            this.db.prepare("ALTER TABLE memberships ADD COLUMN created_by TEXT").run(),
+            this.db.prepare("ALTER TABLE memberships ADD COLUMN updated_by TEXT").run(),
+            this.db.prepare("ALTER TABLE settings ADD COLUMN created_by TEXT").run(),
+            this.db.prepare("ALTER TABLE settings ADD COLUMN updated_by TEXT").run(),
+            this.db.prepare("ALTER TABLE instance_hosts ADD COLUMN created_by TEXT").run(),
+            this.db.prepare("ALTER TABLE instance_hosts ADD COLUMN updated_by TEXT").run(),
         ]);
         // Batch 2: additional tables + indexes (all CREATE IF NOT EXISTS, safe in one batch)
         await this.db.batch([
@@ -259,6 +296,10 @@ export class D1Store {
           role TEXT NOT NULL DEFAULT 'guest',
           invited_by TEXT,
           joined_at TEXT NOT NULL DEFAULT (datetime('now')),
+          created_at TEXT,
+          updated_at TEXT,
+          created_by TEXT,
+          updated_by TEXT,
           PRIMARY KEY (user_did, instance_did)
         )
       `),
@@ -268,6 +309,9 @@ export class D1Store {
           key TEXT NOT NULL,
           value TEXT,
           updated_at TEXT DEFAULT (datetime('now')),
+          created_at TEXT,
+          created_by TEXT,
+          updated_by TEXT,
           PRIMARY KEY (instance_did, key)
         )`),
             this.db.prepare(`CREATE TABLE IF NOT EXISTS verify_codes (
@@ -302,7 +346,10 @@ export class D1Store {
             this.db.prepare(`CREATE TABLE IF NOT EXISTS instance_hosts (
           host TEXT PRIMARY KEY,
           instance_did TEXT NOT NULL,
-          created_at TEXT DEFAULT (datetime('now'))
+          created_at TEXT DEFAULT (datetime('now')),
+          updated_at TEXT,
+          created_by TEXT,
+          updated_by TEXT
         )`),
             this.db.prepare("CREATE INDEX IF NOT EXISTS idx_instance_hosts_instance ON instance_hosts(instance_did)"),
         ]);
@@ -368,10 +415,13 @@ export class D1Store {
     // ─── User operations ──────────────────────────────────────────────────
     async createUser(params) {
         const now = new Date().toISOString();
+        // Self-serve registration: default actor = subject's own DID (plan §二);
+        // admin代建 passes createdBy = caller.did explicitly.
+        const actor = params.createdBy ?? params.did;
         await this.db
-            .prepare(`INSERT INTO users (did, pk, fullName, email, avatar, sourceProvider, emailVerified, firstLoginAt, lastLoginAt, lastLoginIp, sourceDomain, lastLoginDomain, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(params.did, params.pk, params.fullName ?? null, params.email ?? null, params.avatar ?? null, params.sourceProvider, params.emailVerified ?? 0, now, now, params.ip ?? null, params.domain ?? null, params.domain ?? null, now, now)
+            .prepare(`INSERT INTO users (did, pk, fullName, email, avatar, sourceProvider, emailVerified, firstLoginAt, lastLoginAt, lastLoginIp, sourceDomain, lastLoginDomain, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .bind(params.did, params.pk, params.fullName ?? null, params.email ?? null, params.avatar ?? null, params.sourceProvider, params.emailVerified ?? 0, now, now, params.ip ?? null, params.domain ?? null, params.domain ?? null, now, now, actor, actor)
             .run();
     }
     async getUserByDid(did) {
@@ -465,19 +515,19 @@ export class D1Store {
             .first();
         return row ?? null;
     }
-    async updateUserRole(did, role) {
+    async updateUserRole(did, role, actor) {
         await this.db
-            .prepare("UPDATE users SET role = ?, updatedAt = ? WHERE did = ?")
-            .bind(role, new Date().toISOString(), did)
+            .prepare("UPDATE users SET role = ?, updatedAt = ?, updatedBy = ? WHERE did = ?")
+            .bind(role, new Date().toISOString(), actor, did)
             .run();
     }
-    async updateUserApproval(did, approved) {
+    async updateUserApproval(did, approved, actor) {
         await this.db
-            .prepare("UPDATE users SET approved = ?, updatedAt = ? WHERE did = ?")
-            .bind(approved ? 1 : 0, new Date().toISOString(), did)
+            .prepare("UPDATE users SET approved = ?, updatedAt = ?, updatedBy = ? WHERE did = ?")
+            .bind(approved ? 1 : 0, new Date().toISOString(), actor, did)
             .run();
     }
-    async updateUserProfile(did, fields) {
+    async updateUserProfile(did, fields, actor) {
         const sets = [];
         const params = [];
         if (fields.fullName !== undefined) {
@@ -500,6 +550,8 @@ export class D1Store {
             return;
         sets.push("updatedAt = ?");
         params.push(new Date().toISOString());
+        sets.push("updatedBy = ?");
+        params.push(actor);
         params.push(did);
         await this.db
             .prepare(`UPDATE users SET ${sets.join(", ")} WHERE did = ?`)
@@ -513,25 +565,25 @@ export class D1Store {
             this.db.prepare("DELETE FROM users WHERE did = ?").bind(did),
         ]);
     }
-    async setUserInviter(did, inviterDid) {
+    async setUserInviter(did, inviterDid, actor) {
         await this.db
-            .prepare("UPDATE users SET inviter = ?, updatedAt = ? WHERE did = ? AND inviter IS NULL")
-            .bind(inviterDid, new Date().toISOString(), did)
+            .prepare("UPDATE users SET inviter = ?, updatedAt = ?, updatedBy = ? WHERE did = ? AND inviter IS NULL")
+            .bind(inviterDid, new Date().toISOString(), actor, did)
             .run();
     }
     /**
      * Atomically transfer ownership: set target to owner, caller to admin.
      * Uses D1 batch for atomicity.
      */
-    async transferOwnership(currentOwnerDid, newOwnerDid) {
+    async transferOwnership(currentOwnerDid, newOwnerDid, actor) {
         const now = new Date().toISOString();
         await this.db.batch([
             this.db
-                .prepare("UPDATE users SET role = 'owner', updatedAt = ? WHERE did = ?")
-                .bind(now, newOwnerDid),
+                .prepare("UPDATE users SET role = 'owner', updatedAt = ?, updatedBy = ? WHERE did = ?")
+                .bind(now, actor, newOwnerDid),
             this.db
-                .prepare("UPDATE users SET role = 'admin', updatedAt = ? WHERE did = ?")
-                .bind(now, currentOwnerDid),
+                .prepare("UPDATE users SET role = 'admin', updatedAt = ?, updatedBy = ? WHERE did = ?")
+                .bind(now, actor, currentOwnerDid),
         ]);
     }
     // ─── Team: Invitations ────────────────────────────────────────────────
@@ -541,10 +593,12 @@ export class D1Store {
         const expireHours = input.expireHours ?? 168; // 7 days
         const maxUses = input.maxUses ?? 1;
         const expireAt = new Date(Date.now() + expireHours * 60 * 60 * 1000).toISOString();
+        // Default actor = inviter (the invitation's creator) per plan §五A.
+        const actor = input.actor ?? input.inviterDid;
         await this.db
-            .prepare(`INSERT INTO invitations (id, teamDid, role, remark, inviterDid, expireAt, maxUses, useCount, status, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, 0, 'active', ?, ?, ?)`)
-            .bind(id, input.teamDid, input.role, input.remark ?? "", input.inviterDid, expireAt, maxUses, input.instanceDid ?? null, now, now)
+            .prepare(`INSERT INTO invitations (id, teamDid, role, remark, inviterDid, expireAt, maxUses, useCount, status, instance_did, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, ?, ?, ?, 0, 'active', ?, ?, ?, ?, ?)`)
+            .bind(id, input.teamDid, input.role, input.remark ?? "", input.inviterDid, expireAt, maxUses, input.instanceDid ?? null, now, now, actor, actor)
             .run();
         return {
             id,
@@ -559,6 +613,8 @@ export class D1Store {
             createdAt: now,
             updatedAt: now,
             instance_did: input.instanceDid ?? null,
+            createdBy: actor,
+            updatedBy: actor,
         };
     }
     async getInvitation(id) {
@@ -606,10 +662,10 @@ export class D1Store {
             .run();
         return (result.meta?.changes ?? 0) > 0;
     }
-    async updateInvitationStatus(id, status) {
+    async updateInvitationStatus(id, status, actor) {
         await this.db
-            .prepare("UPDATE invitations SET status = ?, updatedAt = ? WHERE id = ?")
-            .bind(status, new Date().toISOString(), id)
+            .prepare("UPDATE invitations SET status = ?, updatedAt = ?, updatedBy = ? WHERE id = ?")
+            .bind(status, new Date().toISOString(), actor, id)
             .run();
     }
     async deleteInvitation(id) {
@@ -703,20 +759,28 @@ export class D1Store {
     // ─── Connected accounts operations ────────────────────────────────────
     async createConnectedAccount(params) {
         const now = new Date().toISOString();
+        // Self-serve account link: default actor = the user's own DID (plan §二).
+        const actor = params.actor ?? params.userDid;
         await this.db
-            .prepare(`INSERT INTO connected_accounts (did, pk, userDid, provider, id, extra, userInfo, firstLoginAt, lastLoginAt, lastLoginIp)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(params.did, params.pk, params.userDid, params.provider, params.id, params.extra, params.userInfo, now, now, params.ip ?? null)
+            .prepare(`INSERT INTO connected_accounts (did, pk, userDid, provider, id, extra, userInfo, firstLoginAt, lastLoginAt, lastLoginIp, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .bind(params.did, params.pk, params.userDid, params.provider, params.id, params.extra, params.userInfo, now, now, params.ip ?? null, now, now, actor, actor)
             .run();
     }
     async upsertConnectedAccount(account) {
+        // Self-serve account link: default actor = the user's own DID (plan §二).
+        const now = new Date().toISOString();
+        const actor = account.actor ?? account.userDid;
         await this.db
-            .prepare(`INSERT INTO connected_accounts (did, pk, userDid, provider, id, userInfo, firstLoginAt, lastLoginAt)
-         VALUES (?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+            .prepare(
+        // Bind all timestamps as ISO `?` params (consistent with createConnectedAccount;
+        // avoids mixing `datetime('now')` literals with `?` placeholders).
+        `INSERT INTO connected_accounts (did, pk, userDid, provider, id, userInfo, firstLoginAt, lastLoginAt, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (did) DO UPDATE SET
-           pk = excluded.pk, lastLoginAt = datetime('now'),
+           pk = excluded.pk, lastLoginAt = excluded.lastLoginAt, updatedAt = excluded.updatedAt,
            userInfo = COALESCE(excluded.userInfo, connected_accounts.userInfo)`)
-            .bind(account.did, account.pk, account.userDid, account.provider, account.id, account.userInfo || null)
+            .bind(account.did, account.pk, account.userDid, account.provider, account.id, account.userInfo || null, now, now, now, now, actor, actor)
             .run();
     }
     async getConnectedAccountById(credentialId) {
@@ -732,9 +796,10 @@ export class D1Store {
             .first();
     }
     async updateCounter(did, counter) {
+        const now = new Date().toISOString();
         await this.db
-            .prepare("UPDATE connected_accounts SET counter = ?, lastLoginAt = ? WHERE did = ?")
-            .bind(counter, new Date().toISOString(), did)
+            .prepare("UPDATE connected_accounts SET counter = ?, lastLoginAt = ?, updatedAt = ? WHERE did = ?")
+            .bind(counter, now, now, did)
             .run();
     }
     async getConnectedAccountsByUserDid(userDid) {
@@ -774,10 +839,10 @@ export class D1Store {
             .bind(new Date().toISOString(), did)
             .run();
     }
-    async updateConnectedAccountName(did, name) {
+    async updateConnectedAccountName(did, name, actor) {
         await this.db
-            .prepare("UPDATE connected_accounts SET userInfo = ? WHERE did = ?")
-            .bind(JSON.stringify({ name }), did)
+            .prepare("UPDATE connected_accounts SET userInfo = ?, updatedAt = ?, updatedBy = ? WHERE did = ?")
+            .bind(JSON.stringify({ name }), new Date().toISOString(), actor, did)
             .run();
     }
     async deleteConnectedAccount(did) {
@@ -787,9 +852,9 @@ export class D1Store {
     async createAccessKey(input) {
         const now = new Date().toISOString();
         await this.db
-            .prepare(`INSERT INTO access_keys (accessKeyId, accessKeyPublic, role, remark, createdBy, expireAt, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .bind(input.accessKeyId, input.accessKeyPublic, input.role, input.remark ?? "", input.createdBy, input.expireAt ?? null, input.instanceDid ?? null, now, now)
+            .prepare(`INSERT INTO access_keys (accessKeyId, accessKeyPublic, role, remark, createdBy, expireAt, instance_did, createdAt, updatedAt, updatedBy)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .bind(input.accessKeyId, input.accessKeyPublic, input.role, input.remark ?? "", input.createdBy, input.expireAt ?? null, input.instanceDid ?? null, now, now, input.createdBy)
             .run();
         return {
             accessKeyId: input.accessKeyId,
@@ -802,6 +867,7 @@ export class D1Store {
             createdAt: now,
             updatedAt: now,
             instance_did: input.instanceDid ?? null,
+            updatedBy: input.createdBy,
         };
     }
     async getAccessKeyById(accessKeyId) {
@@ -864,7 +930,7 @@ export class D1Store {
             total,
         };
     }
-    async updateAccessKey(accessKeyId, input) {
+    async updateAccessKey(accessKeyId, input, actor) {
         const sets = [];
         const params = [];
         if (input.remark !== undefined) {
@@ -878,6 +944,8 @@ export class D1Store {
         if (sets.length > 0) {
             sets.push("updatedAt = ?");
             params.push(new Date().toISOString());
+            sets.push("updatedBy = ?");
+            params.push(actor);
             params.push(accessKeyId);
             await this.db
                 .prepare(`UPDATE access_keys SET ${sets.join(", ")} WHERE accessKeyId = ?`)
@@ -929,16 +997,16 @@ export class D1Store {
         ];
         const now = new Date().toISOString();
         await this.db.batch(policies.map((p) => this.db
-            .prepare(`INSERT OR IGNORE INTO access_policies (id, name, description, roles, reverse, isProtected, createdAt, updatedAt)
-             VALUES (?, ?, ?, ?, ?, 1, ?, ?)`)
+            .prepare(`INSERT OR IGNORE INTO access_policies (id, name, description, roles, reverse, isProtected, createdAt, updatedAt, createdBy, updatedBy)
+             VALUES (?, ?, ?, ?, ?, 1, ?, ?, 'system', 'system')`)
             .bind(p.id, p.name, p.description, p.roles, p.reverse, now, now)));
         invalidateRulesCache();
     }
     async ensureDefaultRule() {
         const now = new Date().toISOString();
         await this.db
-            .prepare(`INSERT OR IGNORE INTO security_rules (id, pathPattern, priority, accessPolicyId, enabled, remark, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+            .prepare(`INSERT OR IGNORE INTO security_rules (id, pathPattern, priority, accessPolicyId, enabled, remark, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'system', 'system')`)
             .bind("default", "*", -1, "public", 1, "Default fallback rule", now, now)
             .run();
         invalidateRulesCache();
@@ -1011,19 +1079,19 @@ export class D1Store {
             instanceDid: p.instance_did ?? null,
         };
     }
-    async createAccessPolicy(input) {
+    async createAccessPolicy(input, actor) {
         const id = crypto.randomUUID();
         const now = new Date().toISOString();
         const { roles: dbRoles, reverse } = await import("../access/access-policy.js").then((m) => m.accessTypeToDb(input.accessType, input.roles));
         await this.db
-            .prepare(`INSERT INTO access_policies (id, name, description, roles, reverse, isProtected, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, ?, 0, ?, ?, ?)`)
-            .bind(id, input.name, input.description ?? "", dbRoles, reverse, input.instanceDid ?? null, now, now)
+            .prepare(`INSERT INTO access_policies (id, name, description, roles, reverse, isProtected, instance_did, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, ?, 0, ?, ?, ?, ?, ?)`)
+            .bind(id, input.name, input.description ?? "", dbRoles, reverse, input.instanceDid ?? null, now, now, actor, actor)
             .run();
         invalidateRulesCache();
         return (await this.getAccessPolicy(id));
     }
-    async updateAccessPolicy(id, input) {
+    async updateAccessPolicy(id, input, actor) {
         const now = new Date().toISOString();
         const sets = [];
         const params = [];
@@ -1045,6 +1113,8 @@ export class D1Store {
         if (sets.length > 0) {
             sets.push("updatedAt = ?");
             params.push(now);
+            sets.push("updatedBy = ?");
+            params.push(actor);
             params.push(id);
             await this.db
                 .prepare(`UPDATE access_policies SET ${sets.join(", ")} WHERE id = ?`)
@@ -1119,18 +1189,18 @@ export class D1Store {
             instanceDid: r.instance_did ?? null,
         };
     }
-    async createSecurityRule(input) {
+    async createSecurityRule(input, actor) {
         const id = crypto.randomUUID();
         const now = new Date().toISOString();
         await this.db
-            .prepare(`INSERT INTO security_rules (id, pathPattern, priority, accessPolicyId, enabled, remark, instance_did, createdAt, updatedAt)
-         VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?)`)
-            .bind(id, input.pathPattern, input.priority ?? 0, input.accessPolicyId, input.remark ?? "", input.instanceDid ?? null, now, now)
+            .prepare(`INSERT INTO security_rules (id, pathPattern, priority, accessPolicyId, enabled, remark, instance_did, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?)`)
+            .bind(id, input.pathPattern, input.priority ?? 0, input.accessPolicyId, input.remark ?? "", input.instanceDid ?? null, now, now, actor, actor)
             .run();
         invalidateRulesCache();
         return (await this.getSecurityRule(id));
     }
-    async updateSecurityRule(id, input) {
+    async updateSecurityRule(id, input, actor) {
         const now = new Date().toISOString();
         const sets = [];
         const params = [];
@@ -1157,6 +1227,8 @@ export class D1Store {
         if (sets.length > 0) {
             sets.push("updatedAt = ?");
             params.push(now);
+            sets.push("updatedBy = ?");
+            params.push(actor);
             params.push(id);
             await this.db
                 .prepare(`UPDATE security_rules SET ${sets.join(", ")} WHERE id = ?`)
@@ -1171,10 +1243,11 @@ export class D1Store {
         invalidateRulesCache();
     }
     // ─── Membership operations ──────────────────────────────────────────────
-    async createMembership(userDid, instanceDid, role, invitedBy) {
+    async createMembership(userDid, instanceDid, role, invitedBy, actor) {
+        const now = new Date().toISOString();
         await this.db
-            .prepare(`INSERT OR IGNORE INTO memberships (user_did, instance_did, role, invited_by) VALUES (?, ?, ?, ?)`)
-            .bind(userDid, instanceDid, role, invitedBy ?? null)
+            .prepare(`INSERT OR IGNORE INTO memberships (user_did, instance_did, role, invited_by, created_at, updated_at, created_by, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+            .bind(userDid, instanceDid, role, invitedBy ?? null, now, now, actor, actor)
             .run();
         invalidateMembership(userDid, instanceDid);
     }
@@ -1249,10 +1322,10 @@ export class D1Store {
             .all();
         return rows.results ?? [];
     }
-    async updateMembershipRole(userDid, instanceDid, role) {
+    async updateMembershipRole(userDid, instanceDid, role, actor) {
         await this.db
-            .prepare("UPDATE memberships SET role = ? WHERE user_did = ? AND instance_did = ?")
-            .bind(role, userDid, instanceDid)
+            .prepare("UPDATE memberships SET role = ?, updated_at = ?, updated_by = ? WHERE user_did = ? AND instance_did = ?")
+            .bind(role, new Date().toISOString(), actor, userDid, instanceDid)
             .run();
         invalidateMembership(userDid, instanceDid);
     }
@@ -1275,13 +1348,13 @@ export class D1Store {
             .first();
         return row?.value ?? null;
     }
-    async setSetting(instanceDid, key, value) {
+    async setSetting(instanceDid, key, value, actor) {
         try {
             await this.db
-                .prepare(`INSERT INTO settings (instance_did, key, value, updated_at)
-           VALUES (?, ?, ?, datetime('now'))
-           ON CONFLICT(instance_did, key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
-                .bind(instanceDid, key, value)
+                .prepare(`INSERT INTO settings (instance_did, key, value, updated_at, created_at, created_by, updated_by)
+           VALUES (?, ?, ?, datetime('now'), datetime('now'), ?, ?)
+           ON CONFLICT(instance_did, key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at, updated_by = excluded.updated_by`)
+                .bind(instanceDid, key, value, actor, actor)
                 .run();
         }
         catch (err) {
@@ -1289,8 +1362,8 @@ export class D1Store {
             const msg = err instanceof Error ? err.message : String(err);
             if (msg.includes("UNIQUE constraint")) {
                 await this.db
-                    .prepare(`UPDATE settings SET value = ?, updated_at = datetime('now') WHERE instance_did = ? AND key = ?`)
-                    .bind(value, instanceDid, key)
+                    .prepare(`UPDATE settings SET value = ?, updated_at = datetime('now'), updated_by = ? WHERE instance_did = ? AND key = ?`)
+                    .bind(value, actor, instanceDid, key)
                     .run();
             }
             else {
@@ -1371,13 +1444,13 @@ export class D1Store {
     /** Bind a host to an instance. Idempotent; returns a conflict result if the
      *  host already belongs to a different instance. Uses a dedicated INSERT
      *  (not setSetting) so the host PK enforces one-host-one-instance. */
-    async bindInstanceHost(instanceDid, host) {
+    async bindInstanceHost(instanceDid, host, actor) {
         const h = this.normalizeHost(host);
         if (!h)
             return { ok: false, reason: "invalid" };
         const res = await this.db
-            .prepare("INSERT INTO instance_hosts (host, instance_did) VALUES (?, ?) ON CONFLICT(host) DO NOTHING")
-            .bind(h, instanceDid)
+            .prepare("INSERT INTO instance_hosts (host, instance_did, updated_at, created_by, updated_by) VALUES (?, ?, datetime('now'), ?, ?) ON CONFLICT(host) DO NOTHING")
+            .bind(h, instanceDid, actor, actor)
             .run();
         if ((res.meta?.changes ?? 0) > 0) {
             invalidateHostCache();
@@ -1524,15 +1597,15 @@ export class D1Store {
             },
         ];
         await this.db.batch(policies.map((p) => this.db
-            .prepare(`INSERT OR IGNORE INTO access_policies (id, name, description, roles, reverse, isProtected, instance_did, createdAt, updatedAt)
-             VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`)
+            .prepare(`INSERT OR IGNORE INTO access_policies (id, name, description, roles, reverse, isProtected, instance_did, createdAt, updatedAt, createdBy, updatedBy)
+             VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?, 'system', 'system')`)
             .bind(p.id, p.name, p.description, p.roles, p.reverse, instanceDid, now, now)));
         // Seed instance default rule referencing the instance-scoped public policy
         const ruleId = `default-${instanceDid}`;
         await this.db
             .prepare(`INSERT OR IGNORE INTO security_rules
-         (id, pathPattern, priority, accessPolicyId, enabled, remark, instance_did, createdAt, updatedAt)
-         VALUES (?, '*', 0, ?, 1, 'Instance default: public access', ?, ?, ?)`)
+         (id, pathPattern, priority, accessPolicyId, enabled, remark, instance_did, createdAt, updatedAt, createdBy, updatedBy)
+         VALUES (?, '*', 0, ?, 1, 'Instance default: public access', ?, ?, ?, 'system', 'system')`)
             .bind(ruleId, `public-${instanceDid}`, instanceDid, now, now)
             .run();
         invalidateRulesCache();