@ddd-ts-kit/audit 0.0.0-stage → 0.1.0

package/dist/sources/audit-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-source.d.ts","sourceRoot":"","sources":["../../src/sources/audit-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE7E,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;CAC3B"}

package/dist/sources/audit-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-source.js.map

package/dist/sources/audit-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-source.js","sourceRoot":"","sources":["../../src/sources/audit-source.ts"],"names":[],"mappings":""}

package/dist/sources/audit-subscription.d.ts

@@ -0,0 +1,7 @@
+import type { IntegrationEventCallback } from '@ddd-ts-kit/kernel';
+/** What `subscribeAll` of `@ddd-ts-kit/events` takes. */
+export interface AuditSubscription {
+    readonly type: string;
+    readonly handler: IntegrationEventCallback;
+}
+//# sourceMappingURL=audit-subscription.d.ts.map

package/dist/sources/audit-subscription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-subscription.d.ts","sourceRoot":"","sources":["../../src/sources/audit-subscription.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;CAC5C"}

package/dist/sources/audit-subscription.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-subscription.js.map

package/dist/sources/audit-subscription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-subscription.js","sourceRoot":"","sources":["../../src/sources/audit-subscription.ts"],"names":[],"mappings":""}

package/dist/sources/audited-events.d.ts

@@ -0,0 +1,7 @@
+/** The registry of `@ddd-ts-kit/events`, restated structurally. Any `EventRegistry` fits. */
+export interface AuditedEvents {
+    all(): readonly {
+        readonly type: string;
+    }[];
+}
+//# sourceMappingURL=audited-events.d.ts.map

package/dist/sources/audited-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-events.d.ts","sourceRoot":"","sources":["../../src/sources/audited-events.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,GAAG,IAAI,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7C"}

package/dist/sources/audited-events.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audited-events.js.map

package/dist/sources/audited-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audited-events.js","sourceRoot":"","sources":["../../src/sources/audited-events.ts"],"names":[],"mappings":""}

package/dist/sources/authorization-decision.d.ts

@@ -0,0 +1,21 @@
+import type { AuditResource } from '@ddd-ts-kit/kernel';
+/**
+ * What the `onDecision` hook of `@ddd-ts-kit/auth` hands over, restated structurally so that
+ * this package does not depend on it. Any `DecisionRecord` fits.
+ */
+export interface AuthorizationDecision {
+    readonly actorId: string;
+    readonly permissionId: string;
+    readonly resource?: AuditResource;
+    readonly decision: {
+        readonly allowed: true;
+    } | {
+        readonly allowed: false;
+        readonly reason: string;
+    };
+    /** The command or query the decision was taken for. */
+    readonly useCase?: string;
+    /** Whether that use case is a command or a query; absent for a decision taken outside a bus. */
+    readonly kind?: 'command' | 'query';
+}
+//# sourceMappingURL=authorization-decision.d.ts.map

package/dist/sources/authorization-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-decision.d.ts","sourceRoot":"","sources":["../../src/sources/authorization-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAErG,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CACrC"}

package/dist/sources/authorization-decision.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorization-decision.js.map

package/dist/sources/authorization-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-decision.js","sourceRoot":"","sources":["../../src/sources/authorization-decision.ts"],"names":[],"mappings":""}

package/dist/sources/record-in.d.ts

@@ -0,0 +1,5 @@
+import type { AuditRecord, ExecutionContext } from '@ddd-ts-kit/kernel';
+import type { AuditFact } from './audit-fact.js';
+import type { AuditSource } from './audit-source.js';
+export declare function recordIn(context: ExecutionContext, source: Omit<AuditSource, 'scope'>, fact: AuditFact): AuditRecord;
+//# sourceMappingURL=record-in.d.ts.map

package/dist/sources/record-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-in.d.ts","sourceRoot":"","sources":["../../src/sources/record-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,CAepH"}

package/dist/sources/record-in.js

@@ -0,0 +1,19 @@
+export function recordIn(context, source, fact) {
+    const session = context.session;
+    return {
+        id: source.ids.next(),
+        occurredAt: source.clock.now(),
+        ...fact,
+        actor: auditActorOf(context),
+        ...(context.tenantId === undefined ? {} : { tenantId: context.tenantId }),
+        ...(session?.impersonatedBy === undefined ? {} : { impersonatedBy: session.impersonatedBy }),
+        ...(session === undefined ? {} : { sessionId: session.id }),
+        correlationId: context.correlationId,
+        ...(context.causationId === undefined ? {} : { causationId: context.causationId }),
+        origin: context.origin,
+    };
+}
+function auditActorOf({ actor }) {
+    return { id: actor.id, type: actor.type, ...(actor.tenantId === undefined ? {} : { tenantId: actor.tenantId }) };
+}
+//# sourceMappingURL=record-in.js.map

package/dist/sources/record-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-in.js","sourceRoot":"","sources":["../../src/sources/record-in.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,QAAQ,CAAC,OAAyB,EAAE,MAAkC,EAAE,IAAe;IACrG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;QACrB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;QAC9B,GAAG,IAAI;QACP,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5F,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAC3D,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,KAAK,EAAoB;IAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;AACnH,CAAC"}

package/dist/sql/audit-chains-table-name.d.ts

@@ -0,0 +1,2 @@
+export declare const AUDIT_CHAINS_TABLE = "audit_chains";
+//# sourceMappingURL=audit-chains-table-name.d.ts.map

package/dist/sql/audit-chains-table-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chains-table-name.d.ts","sourceRoot":"","sources":["../../src/sql/audit-chains-table-name.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,iBAAiB,CAAC"}

package/dist/sql/audit-chains-table-name.js

@@ -0,0 +1,2 @@
+export const AUDIT_CHAINS_TABLE = 'audit_chains';
+//# sourceMappingURL=audit-chains-table-name.js.map

package/dist/sql/audit-chains-table-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chains-table-name.js","sourceRoot":"","sources":["../../src/sql/audit-chains-table-name.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC"}

package/dist/sql/audit-entries-table-name.d.ts

@@ -0,0 +1,2 @@
+export declare const AUDIT_ENTRIES_TABLE = "audit_entries";
+//# sourceMappingURL=audit-entries-table-name.d.ts.map

package/dist/sql/audit-entries-table-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-entries-table-name.d.ts","sourceRoot":"","sources":["../../src/sql/audit-entries-table-name.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,kBAAkB,CAAC"}

package/dist/sql/audit-entries-table-name.js

@@ -0,0 +1,2 @@
+export const AUDIT_ENTRIES_TABLE = 'audit_entries';
+//# sourceMappingURL=audit-entries-table-name.js.map

package/dist/sql/audit-entries-table-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-entries-table-name.js","sourceRoot":"","sources":["../../src/sql/audit-entries-table-name.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC"}

package/dist/sql/audit-guard-sql.d.ts

@@ -0,0 +1,8 @@
+import type { AuditTablesOptions } from './audit-tables-options.js';
+/**
+ * The guard of `audit_entries`: triggers that refuse UPDATE, DELETE and TRUNCATE, whoever
+ * asks. A role that owns the table can still drop them: see the README for the privileges to
+ * revoke and for anchoring.
+ */
+export declare function auditGuardSql(options?: AuditTablesOptions): string[];
+//# sourceMappingURL=audit-guard-sql.d.ts.map

package/dist/sql/audit-guard-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-guard-sql.d.ts","sourceRoot":"","sources":["../../src/sql/audit-guard-sql.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,kBAAuB,GAAG,MAAM,EAAE,CASxE"}

package/dist/sql/audit-guard-sql.js

@@ -0,0 +1,17 @@
+import { AUDIT_ENTRIES_TABLE } from './audit-entries-table-name.js';
+import { named } from './named.js';
+/**
+ * The guard of `audit_entries`: triggers that refuse UPDATE, DELETE and TRUNCATE, whoever
+ * asks. A role that owns the table can still drop them: see the README for the privileges to
+ * revoke and for anchoring.
+ */
+export function auditGuardSql(options = {}) {
+    const entries = named(options.schema, AUDIT_ENTRIES_TABLE);
+    const guard = named(options.schema, 'audit_entries_append_only');
+    return [
+        `create function ${guard}() returns trigger language plpgsql as $guard$ begin raise exception 'audit entries are append-only: % refused', tg_op using errcode = 'restrict_violation'; end $guard$`,
+        `create trigger "audit_entries_no_rewrite" before update or delete on ${entries} for each row execute function ${guard}()`,
+        `create trigger "audit_entries_no_truncate" before truncate on ${entries} for each statement execute function ${guard}()`,
+    ];
+}
+//# sourceMappingURL=audit-guard-sql.js.map

package/dist/sql/audit-guard-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-guard-sql.js","sourceRoot":"","sources":["../../src/sql/audit-guard-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAO,GAAuB,EAAE;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAEjE,OAAO;QACL,mBAAmB,KAAK,0KAA0K;QAClM,wEAAwE,OAAO,kCAAkC,KAAK,IAAI;QAC1H,iEAAiE,OAAO,wCAAwC,KAAK,IAAI;KAC1H,CAAC;AACJ,CAAC"}

package/dist/sql/audit-tables-options.d.ts

@@ -0,0 +1,5 @@
+export interface AuditTablesOptions {
+    /** The schema holding the tables. Without it they live in the default schema of the connection. */
+    readonly schema?: string;
+}
+//# sourceMappingURL=audit-tables-options.d.ts.map

package/dist/sql/audit-tables-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tables-options.d.ts","sourceRoot":"","sources":["../../src/sql/audit-tables-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,mGAAmG;IACnG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/sql/audit-tables-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-tables-options.js.map

package/dist/sql/audit-tables-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tables-options.js","sourceRoot":"","sources":["../../src/sql/audit-tables-options.ts"],"names":[],"mappings":""}

package/dist/sql/audit-tables-sql.d.ts

@@ -0,0 +1,7 @@
+import type { AuditTablesOptions } from './audit-tables-options.js';
+/**
+ * The tables of the trail on PostgreSQL, one statement per element: `audit_entries`, the
+ * chain heads that serialize the appends, the indexes of the reader, then the guard.
+ */
+export declare function auditTablesSql(options?: AuditTablesOptions): string[];
+//# sourceMappingURL=audit-tables-sql.d.ts.map

package/dist/sql/audit-tables-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tables-sql.d.ts","sourceRoot":"","sources":["../../src/sql/audit-tables-sql.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA8BpE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,kBAAuB,GAAG,MAAM,EAAE,CAazE"}

package/dist/sql/audit-tables-sql.js

@@ -0,0 +1,48 @@
+import { AUDIT_CHAINS_TABLE } from './audit-chains-table-name.js';
+import { AUDIT_ENTRIES_TABLE } from './audit-entries-table-name.js';
+import { auditGuardSql } from './audit-guard-sql.js';
+import { named } from './named.js';
+const ENTRY_COLUMNS = [
+    '"id" text not null unique',
+    '"chain" text not null',
+    '"sequence" bigint not null',
+    '"occurred_at" timestamptz(3) not null',
+    '"category" text not null',
+    '"action" text not null',
+    '"outcome" text not null',
+    '"reason" text',
+    '"actor_id" text not null',
+    '"actor_type" text not null',
+    '"actor_tenant_id" text',
+    '"tenant_id" text',
+    '"impersonated_by" text',
+    '"session_id" text',
+    '"resource_type" text',
+    '"resource_id" text',
+    '"context" text',
+    '"correlation_id" text not null',
+    '"causation_id" text',
+    '"origin" text not null',
+    '"changes" jsonb',
+    `"extensions" jsonb not null default '{}'::jsonb`,
+    '"previous_hash" text not null',
+    '"hash" text not null',
+];
+/**
+ * The tables of the trail on PostgreSQL, one statement per element: `audit_entries`, the
+ * chain heads that serialize the appends, the indexes of the reader, then the guard.
+ */
+export function auditTablesSql(options = {}) {
+    const entries = named(options.schema, AUDIT_ENTRIES_TABLE);
+    return [
+        ...(options.schema === undefined ? [] : [`create schema if not exists ${named(undefined, options.schema)}`]),
+        `create table ${named(options.schema, AUDIT_CHAINS_TABLE)} ("chain" text primary key, "sequence" bigint not null, "hash" text not null)`,
+        `create table ${entries} (${ENTRY_COLUMNS.join(', ')}, primary key ("chain", "sequence"))`,
+        `create index "audit_entries_occurred_idx" on ${entries} ("occurred_at", "chain", "sequence")`,
+        `create index "audit_entries_actor_idx" on ${entries} ("actor_id", "occurred_at")`,
+        `create index "audit_entries_resource_idx" on ${entries} ("resource_type", "resource_id")`,
+        `create index "audit_entries_correlation_idx" on ${entries} ("correlation_id")`,
+        ...auditGuardSql(options),
+    ];
+}
+//# sourceMappingURL=audit-tables-sql.js.map

package/dist/sql/audit-tables-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tables-sql.js","sourceRoot":"","sources":["../../src/sql/audit-tables-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,2BAA2B;IAC3B,uBAAuB;IACvB,4BAA4B;IAC5B,uCAAuC;IACvC,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,eAAe;IACf,0BAA0B;IAC1B,4BAA4B;IAC5B,wBAAwB;IACxB,kBAAkB;IAClB,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,gCAAgC;IAChC,qBAAqB;IACrB,wBAAwB;IACxB,iBAAiB;IACjB,iDAAiD;IACjD,+BAA+B;IAC/B,sBAAsB;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAO,GAAuB,EAAE;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE3D,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,+BAA+B,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5G,gBAAgB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,+EAA+E;QACxI,gBAAgB,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;QAC1F,gDAAgD,OAAO,uCAAuC;QAC9F,6CAA6C,OAAO,8BAA8B;QAClF,gDAAgD,OAAO,mCAAmC;QAC1F,mDAAmD,OAAO,qBAAqB;QAC/E,GAAG,aAAa,CAAC,OAAO,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/sql/audit-tables.d.ts

@@ -0,0 +1,8 @@
+import type { AuditTablesOptions } from './audit-tables-options.js';
+import type { Sql } from './sql.js';
+export interface AuditTables {
+    readonly entries: Sql;
+    readonly chains: Sql;
+}
+export declare function auditTables({ schema }?: AuditTablesOptions): AuditTables;
+//# sourceMappingURL=audit-tables.d.ts.map

package/dist/sql/audit-tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tables.d.ts","sourceRoot":"","sources":["../../src/sql/audit-tables.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;CACtB;AAED,wBAAgB,WAAW,CAAC,EAAE,MAAM,EAAE,GAAE,kBAAuB,GAAG,WAAW,CAE5E"}

package/dist/sql/audit-tables.js

@@ -0,0 +1,7 @@
+import { AUDIT_CHAINS_TABLE } from './audit-chains-table-name.js';
+import { AUDIT_ENTRIES_TABLE } from './audit-entries-table-name.js';
+import { qualified } from './qualified.js';
+export function auditTables({ schema } = {}) {
+    return { entries: qualified(schema, AUDIT_ENTRIES_TABLE), chains: qualified(schema, AUDIT_CHAINS_TABLE) };
+}
+//# sourceMappingURL=audit-tables.js.map

package/dist/sql/audit-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tables.js","sourceRoot":"","sources":["../../src/sql/audit-tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAQ3C,MAAM,UAAU,WAAW,CAAC,EAAE,MAAM,EAAE,GAAuB,EAAE;IAC7D,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC;AAC5G,CAAC"}

package/dist/sql/drop-audit-tables-sql.d.ts

@@ -0,0 +1,4 @@
+import type { AuditTablesOptions } from './audit-tables-options.js';
+/** The `down` of `auditTablesSql`. The schema itself is left in place. */
+export declare function dropAuditTablesSql(options?: AuditTablesOptions): string[];
+//# sourceMappingURL=drop-audit-tables-sql.d.ts.map

package/dist/sql/drop-audit-tables-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-audit-tables-sql.d.ts","sourceRoot":"","sources":["../../src/sql/drop-audit-tables-sql.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,kBAAuB,GAAG,MAAM,EAAE,CAM7E"}

package/dist/sql/drop-audit-tables-sql.js

@@ -0,0 +1,12 @@
+import { AUDIT_CHAINS_TABLE } from './audit-chains-table-name.js';
+import { AUDIT_ENTRIES_TABLE } from './audit-entries-table-name.js';
+import { named } from './named.js';
+/** The `down` of `auditTablesSql`. The schema itself is left in place. */
+export function dropAuditTablesSql(options = {}) {
+    return [
+        `drop table if exists ${named(options.schema, AUDIT_ENTRIES_TABLE)}`,
+        `drop table if exists ${named(options.schema, AUDIT_CHAINS_TABLE)}`,
+        `drop function if exists ${named(options.schema, 'audit_entries_append_only')}()`,
+    ];
+}
+//# sourceMappingURL=drop-audit-tables-sql.js.map

package/dist/sql/drop-audit-tables-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drop-audit-tables-sql.js","sourceRoot":"","sources":["../../src/sql/drop-audit-tables-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,OAAO,GAAuB,EAAE;IACjE,OAAO;QACL,wBAAwB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE;QACpE,wBAAwB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE;QACnE,2BAA2B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,CAAC,IAAI;KAClF,CAAC;AACJ,CAAC"}

package/dist/sql/entry-of.d.ts

@@ -0,0 +1,5 @@
+import type { AuditEntry } from '@ddd-ts-kit/kernel';
+import type { SqlRow } from './sql-row.js';
+/** The mapper: a row comes back as the driver gives it, and leaves as an entry or not at all. */
+export declare function entryOf(row: SqlRow): AuditEntry;
+//# sourceMappingURL=entry-of.d.ts.map

package/dist/sql/entry-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-of.d.ts","sourceRoot":"","sources":["../../src/sql/entry-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAKV,UAAU,EAIX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,iGAAiG;AACjG,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA2B/C"}

package/dist/sql/entry-of.js

@@ -0,0 +1,109 @@
+/** The mapper: a row comes back as the driver gives it, and leaves as an entry or not at all. */
+export function entryOf(row) {
+    const resource = resourceOf(row);
+    const changes = changesOf(json(row['changes']));
+    return {
+        id: text(row, 'id'),
+        chain: text(row, 'chain'),
+        sequence: Number(row['sequence']),
+        occurredAt: instant(row['occurred_at']),
+        category: text(row, 'category'),
+        action: text(row, 'action'),
+        outcome: outcomeOf(text(row, 'outcome')),
+        ...optional('reason', row['reason']),
+        actor: actorOf(row),
+        ...optional('tenantId', row['tenant_id']),
+        ...optional('impersonatedBy', row['impersonated_by']),
+        ...optional('sessionId', row['session_id']),
+        ...(resource === undefined ? {} : { resource }),
+        ...optional('context', row['context']),
+        correlationId: text(row, 'correlation_id'),
+        ...optional('causationId', row['causation_id']),
+        origin: text(row, 'origin'),
+        ...(changes === undefined ? {} : { changes }),
+        extensions: extensionsOf(json(row['extensions'])),
+        previousHash: text(row, 'previous_hash'),
+        hash: text(row, 'hash'),
+    };
+}
+function text(row, column) {
+    const value = row[column];
+    if (typeof value !== 'string') {
+        throw new TypeError(`Column ${column} of an audit entry is not a text`);
+    }
+    return value;
+}
+function optional(key, value) {
+    const present = {};
+    if (typeof value === 'string') {
+        present[key] = value;
+    }
+    return present;
+}
+function instant(value) {
+    if (value instanceof Date) {
+        return value;
+    }
+    if (typeof value === 'string' || typeof value === 'number') {
+        return new Date(value);
+    }
+    throw new TypeError('Column occurred_at of an audit entry is not an instant');
+}
+/** node-postgres parses jsonb; a driver that does not hands the text over. */
+function json(value) {
+    return typeof value === 'string' ? JSON.parse(value) : value;
+}
+const OUTCOMES = ['allowed', 'denied', 'succeeded', 'failed'];
+function outcomeOf(value) {
+    if (isOutcome(value)) {
+        return value;
+    }
+    throw new TypeError(`"${value}" is not an audit outcome`);
+}
+function isOutcome(value) {
+    return OUTCOMES.includes(value);
+}
+const ACTOR_TYPES = [
+    'user',
+    'service',
+    'system',
+    'anonymous',
+    'unknown',
+];
+function actorOf(row) {
+    const type = text(row, 'actor_type');
+    if (!isActorType(type)) {
+        throw new TypeError(`"${type}" is not an actor type`);
+    }
+    return { id: text(row, 'actor_id'), type, ...optional('tenantId', row['actor_tenant_id']) };
+}
+function isActorType(value) {
+    return ACTOR_TYPES.includes(value);
+}
+function resourceOf(row) {
+    const type = row['resource_type'];
+    const id = row['resource_id'];
+    return typeof type === 'string' && typeof id === 'string' ? { type, id } : undefined;
+}
+function changesOf(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const changes = {};
+    for (const [field, change] of Object.entries(value)) {
+        if (isChange(change)) {
+            changes[field] = change;
+        }
+    }
+    return changes;
+}
+function isChange(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+        return true;
+    }
+    return typeof value === 'object' && 'masked' in value && typeof value.masked === 'string';
+}
+function extensionsOf(value) {
+    return typeof value === 'object' && value !== null ? value : {};
+}
+//# sourceMappingURL=entry-of.js.map

package/dist/sql/entry-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-of.js","sourceRoot":"","sources":["../../src/sql/entry-of.ts"],"names":[],"mappings":"AAYA,iGAAiG;AACjG,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;QACnB,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3B,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;QACnB,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACrD,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAC1C,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACjD,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;QACxC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,MAAc;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,UAAU,MAAM,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAqB,GAAQ,EAAE,KAAc;IAC5D,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,MAAM,QAAQ,GAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAmC,CAAC;AAEnH,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,2BAA2B,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,WAAW,GAAsB;IACrC,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;CAC8B,CAAC;AAE1C,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAErC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,IAAI,IAAI,wBAAwB,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAE9B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAgC,EAAE,CAAC;IAEhD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC5F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC"}

package/dist/sql/insert-of.d.ts

@@ -0,0 +1,4 @@
+import type { AuditEntry } from '@ddd-ts-kit/kernel';
+import { type Sql } from './sql.js';
+export declare function insertOf(entries: Sql, entry: AuditEntry): Sql;
+//# sourceMappingURL=insert-of.d.ts.map

package/dist/sql/insert-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insert-of.d.ts","sourceRoot":"","sources":["../../src/sql/insert-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAA2B,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AA6B7D,wBAAgB,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,GAAG,GAAG,CAO7D"}

package/dist/sql/insert-of.js

@@ -0,0 +1,51 @@
+import { identifier, joined, sql } from './sql.js';
+const COLUMNS = [
+    'id',
+    'chain',
+    'sequence',
+    'occurred_at',
+    'category',
+    'action',
+    'outcome',
+    'reason',
+    'actor_id',
+    'actor_type',
+    'actor_tenant_id',
+    'tenant_id',
+    'impersonated_by',
+    'session_id',
+    'resource_type',
+    'resource_id',
+    'context',
+    'correlation_id',
+    'causation_id',
+    'origin',
+    'changes',
+    'extensions',
+    'previous_hash',
+    'hash',
+];
+export function insertOf(entries, entry) {
+    const columns = joined(COLUMNS.map((column) => identifier(column)), ', ');
+    return sql `insert into ${entries} (${columns}) values (${joined(valuesOf(entry), ', ')})`;
+}
+function valuesOf(entry) {
+    const { actor, resource } = entry;
+    return [
+        sql `${entry.id}, ${entry.chain}, ${entry.sequence}, ${entry.occurredAt.toISOString()}::timestamptz`,
+        sql `${entry.category}, ${entry.action}, ${entry.outcome}, ${orNull(entry.reason)}`,
+        sql `${actor.id}, ${actor.type}, ${orNull(actor.tenantId)}, ${orNull(entry.tenantId)}`,
+        sql `${orNull(entry.impersonatedBy)}, ${orNull(entry.sessionId)}`,
+        sql `${orNull(resource?.type)}, ${orNull(resource?.id)}, ${orNull(entry.context)}`,
+        sql `${entry.correlationId}, ${orNull(entry.causationId)}, ${entry.origin}`,
+        sql `${jsonOrNull(entry.changes)}::jsonb, ${JSON.stringify(entry.extensions)}::jsonb`,
+        sql `${entry.previousHash}, ${entry.hash}`,
+    ];
+}
+function orNull(value) {
+    return value ?? null;
+}
+function jsonOrNull(value) {
+    return value === undefined ? null : JSON.stringify(value);
+}
+//# sourceMappingURL=insert-of.js.map

package/dist/sql/insert-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insert-of.js","sourceRoot":"","sources":["../../src/sql/insert-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAY,MAAM,UAAU,CAAC;AAE7D,MAAM,OAAO,GAAG;IACd,IAAI;IACJ,OAAO;IACP,UAAU;IACV,aAAa;IACb,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,iBAAiB;IACjB,WAAW;IACX,iBAAiB;IACjB,YAAY;IACZ,eAAe;IACf,aAAa;IACb,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,eAAe;IACf,MAAM;CACE,CAAC;AAEX,MAAM,UAAU,QAAQ,CAAC,OAAY,EAAE,KAAiB;IACtD,MAAM,OAAO,GAAG,MAAM,CACpB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAC3C,IAAI,CACL,CAAC;IAEF,OAAO,GAAG,CAAA,eAAe,OAAO,KAAK,OAAO,aAAa,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC;AAC5F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB;IACjC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAElC,OAAO;QACL,GAAG,CAAA,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,eAAe;QACnG,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAClF,GAAG,CAAA,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QACrF,GAAG,CAAA,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QAChE,GAAG,CAAA,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QACjF,GAAG,CAAA,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE;QAC1E,GAAG,CAAA,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS;QACpF,GAAG,CAAA,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAyB;IACvC,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC"}

package/dist/sql/named.d.ts

@@ -0,0 +1,3 @@
+/** The quoted, qualified name as text, for a statement of a migration, which takes no parameter. */
+export declare function named(schema: string | undefined, name: string): string;
+//# sourceMappingURL=named.d.ts.map

package/dist/sql/named.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"named.d.ts","sourceRoot":"","sources":["../../src/sql/named.ts"],"names":[],"mappings":"AAEA,oGAAoG;AACpG,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtE"}

package/dist/sql/named.js

@@ -0,0 +1,6 @@
+import { qualified } from './qualified.js';
+/** The quoted, qualified name as text, for a statement of a migration, which takes no parameter. */
+export function named(schema, name) {
+    return qualified(schema, name).strings.join('');
+}
+//# sourceMappingURL=named.js.map

package/dist/sql/named.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named.js","sourceRoot":"","sources":["../../src/sql/named.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,oGAAoG;AACpG,MAAM,UAAU,KAAK,CAAC,MAA0B,EAAE,IAAY;IAC5D,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/sql/postgres-audit-trail.d.ts

@@ -0,0 +1,25 @@
+import { type AuditEntry, type AuditFilter, type AuditReader, type AuditRecord, type AuditSortField, type AuditTrail, type Page, type PageRequest } from '@ddd-ts-kit/kernel';
+import type { AuditTrailOptions } from '../trail/audit-trail-options.js';
+import type { AuditTables } from './audit-tables.js';
+import type { SqlSession } from './sql-session.js';
+/**
+ * The trail in PostgreSQL, whatever the query builder: the adapters give it a session, which
+ * is the transaction of the unit of work in progress when there is one.
+ *
+ * An append locks the head row of its chain (`SELECT ... FOR UPDATE`) until its transaction
+ * ends, so two appends to one chain never read the same head and the chain cannot fork. Under
+ * REPEATABLE READ or SERIALIZABLE the second one fails with a serialization error instead of
+ * waiting: the caller retries its unit of work, as for any other statement.
+ */
+export declare class PostgresAuditTrail implements AuditTrail, AuditReader {
+    private readonly session;
+    private readonly tables;
+    private readonly options;
+    constructor(session: () => SqlSession, tables: AuditTables, options?: AuditTrailOptions);
+    record(record: AuditRecord): Promise<void>;
+    search(filter: AuditFilter, page: PageRequest<AuditSortField>): Promise<Page<AuditEntry>>;
+    private lockHead;
+    private select;
+    private count;
+}
+//# sourceMappingURL=postgres-audit-trail.d.ts.map

package/dist/sql/postgres-audit-trail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-audit-trail.d.ts","sourceRoot":"","sources":["../../src/sql/postgres-audit-trail.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,UAAU,EAAE,WAAW;IAE9D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,YACmB,OAAO,EAAE,MAAM,UAAU,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,iBAAsB,EAC9C;IAEE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/C;IAEK,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAgB9F;YAEa,QAAQ;YAoBR,MAAM;YAMN,KAAK;CAOpB"}