@ddd-ts-kit/audit 0.0.0-stage → 0.1.1

package/dist/testing/records/in-tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-tenant.js","sourceRoot":"","sources":["../../../src/testing/records/in-tenant.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,UAAU,QAAQ,CAAC,EAAU,EAAE,QAAgB;IACnD,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;AACpF,CAAC"}

package/dist/testing/records/journal.d.ts

@@ -0,0 +1,4 @@
+import type { AuditRecord } from '@ddd-ts-kit/kernel';
+/** Four records over two tenants, a second apart: what the filters and the pages of the contract read. */
+export declare const JOURNAL: readonly AuditRecord[];
+//# sourceMappingURL=journal.d.ts.map

package/dist/testing/records/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../../src/testing/records/journal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,0GAA0G;AAC1G,eAAO,MAAM,OAAO,EAAE,SAAS,WAAW,EA2BzC,CAAC"}

package/dist/testing/records/journal.js

@@ -0,0 +1,32 @@
+import { inTenant } from './in-tenant.js';
+import { later } from './later.js';
+/** Four records over two tenants, a second apart: what the filters and the pages of the contract read. */
+export const JOURNAL = [
+    { ...inTenant('e-1', 'alpha'), occurredAt: later(0), resource: { type: 'appointment', id: 'apt-1' } },
+    {
+        ...inTenant('e-2', 'alpha'),
+        occurredAt: later(1),
+        actor: { id: 'grace', type: 'user', tenantId: 'alpha' },
+        category: 'authorization',
+        action: 'scheduling:appointment.read',
+        outcome: 'allowed',
+    },
+    {
+        ...inTenant('e-3', 'alpha'),
+        occurredAt: later(2),
+        category: 'authorization',
+        action: 'scheduling:appointment.cancel',
+        outcome: 'denied',
+        reason: 'NO_MATCHING_ROLE',
+        resource: { type: 'appointment', id: 'apt-2' },
+        correlationId: 'correlation-2',
+    },
+    {
+        ...inTenant('e-4', 'beta'),
+        occurredAt: later(3),
+        actor: { id: 'grace', type: 'user', tenantId: 'beta' },
+        resource: { type: 'appointment', id: 'apt-1' },
+        correlationId: 'correlation-2',
+    },
+];
+//# sourceMappingURL=journal.js.map

package/dist/testing/records/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../../src/testing/records/journal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,OAAO,GAA2B;IAC7C,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;IACrG;QACE,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QACpB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;QACvD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,6BAA6B;QACrC,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAC3B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QACpB,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,+BAA+B;QACvC,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE;QAC9C,aAAa,EAAE,eAAe;KAC/B;IACD;QACE,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QACpB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;QACtD,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE;QAC9C,aAAa,EAAE,eAAe;KAC/B;CACF,CAAC"}

package/dist/testing/records/later.d.ts

@@ -0,0 +1,4 @@
+/** The instant the records of the contract occurred at, unless they say otherwise. */
+export declare const NOW: Date;
+export declare function later(seconds: number): Date;
+//# sourceMappingURL=later.d.ts.map

package/dist/testing/records/later.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"later.d.ts","sourceRoot":"","sources":["../../../src/testing/records/later.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,eAAO,MAAM,GAAG,MAAuC,CAAC;AAExD,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3C"}

package/dist/testing/records/later.js

@@ -0,0 +1,6 @@
+/** The instant the records of the contract occurred at, unless they say otherwise. */
+export const NOW = new Date('2026-03-01T10:00:00.000Z');
+export function later(seconds) {
+    return new Date(NOW.getTime() + seconds * 1000);
+}
+//# sourceMappingURL=later.js.map

package/dist/testing/records/later.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"later.js","sourceRoot":"","sources":["../../../src/testing/records/later.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAExD,MAAM,UAAU,KAAK,CAAC,OAAe;IACnC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,3 @@
+export { auditTrailContract, type AuditTrailContractOptions } from './testing/audit-trail-contract.js';
+export type { AuditTrailUnderContract } from './testing/audit-trail-under-contract.js';
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACvG,YAAY,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/testing.js

@@ -0,0 +1,2 @@
+export { auditTrailContract } from './testing/audit-trail-contract.js';
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAkC,MAAM,mCAAmC,CAAC"}

package/dist/trail/audit-trail-options.d.ts

@@ -0,0 +1,8 @@
+import type { AuditRecord } from '@ddd-ts-kit/kernel';
+import type { SealingOptions } from '../chain/sealing-options.js';
+export interface AuditTrailOptions {
+    /** The chain an entry is appended to. Default `chainOfTenant`. */
+    readonly chainOf?: (record: AuditRecord) => string;
+    readonly sealing?: SealingOptions;
+}
+//# sourceMappingURL=audit-trail-options.d.ts.map

package/dist/trail/audit-trail-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail-options.d.ts","sourceRoot":"","sources":["../../src/trail/audit-trail-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,MAAM,CAAC;IAEnD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CACnC"}

package/dist/trail/audit-trail-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-trail-options.js.map

package/dist/trail/audit-trail-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail-options.js","sourceRoot":"","sources":["../../src/trail/audit-trail-options.ts"],"names":[],"mappings":""}

package/dist/trail/in-memory-audit-trail.d.ts

@@ -0,0 +1,16 @@
+import { type AuditEntry, type AuditFilter, type AuditReader, type AuditRecord, type AuditSortField, type AuditTrail, type Page, type PageRequest } from '@ddd-ts-kit/kernel';
+import type { AuditTrailOptions } from './audit-trail-options.js';
+/**
+ * The trail in the memory of the process: the fake of both ports, and enough for an
+ * application without a database. `entries` is the store itself, in the order of arrival: a
+ * test asserts it, and tampers with it to see a verification fail.
+ */
+export declare class InMemoryAuditTrail implements AuditTrail, AuditReader {
+    readonly entries: AuditEntry[];
+    private readonly heads;
+    private readonly options;
+    constructor(options?: AuditTrailOptions);
+    record(record: AuditRecord): Promise<void>;
+    search(filter: AuditFilter, page: PageRequest<AuditSortField>): Promise<Page<AuditEntry>>;
+}
+//# sourceMappingURL=in-memory-audit-trail.d.ts.map

package/dist/trail/in-memory-audit-trail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-audit-trail.d.ts","sourceRoot":"","sources":["../../src/trail/in-memory-audit-trail.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,UAAU,EAAE,WAAW;IAChE,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C,YAAY,OAAO,GAAE,iBAAsB,EAE1C;IAEK,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/C;IAEK,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAa9F;CACF"}

package/dist/trail/in-memory-audit-trail.js

@@ -0,0 +1,48 @@
+import { pageOf, } from '@ddd-ts-kit/kernel';
+import { chainOfTenant } from '../chain/chain-of-tenant.js';
+import { emptyChain } from '../chain/empty-chain.js';
+import { headAfter } from '../chain/head-after.js';
+import { seal } from '../chain/seal.js';
+import { sealCheckpoint } from '../chain/seal-checkpoint.js';
+import { comparing } from '../search/comparing.js';
+import { decodeCursor } from '../search/decode-cursor.js';
+import { encodeCursor } from '../search/encode-cursor.js';
+import { matches } from '../search/matches.js';
+import { orderOf } from '../search/order-of.js';
+/**
+ * The trail in the memory of the process: the fake of both ports, and enough for an
+ * application without a database. `entries` is the store itself, in the order of arrival: a
+ * test asserts it, and tampers with it to see a verification fail.
+ */
+export class InMemoryAuditTrail {
+    entries = [];
+    heads = new Map();
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async record(record) {
+        const chain = (this.options.chainOf ?? chainOfTenant)(record);
+        const entry = seal(record, this.heads.get(chain) ?? emptyChain(chain));
+        this.heads.set(chain, headAfter(entry));
+        this.entries.push(entry);
+        await sealCheckpoint(entry, this.options.sealing);
+    }
+    async search(filter, page) {
+        const order = orderOf(page);
+        const found = this.entries.filter(matches(filter)).sort(comparing(order));
+        if (page.kind === 'offset') {
+            return pageOf(found.slice(page.offset, page.offset + page.limit), { total: found.length });
+        }
+        const rest = page.cursor === undefined ? found : found.filter(after(page.cursor, order));
+        const items = rest.slice(0, page.limit);
+        const last = items.at(-1);
+        return pageOf(items, rest.length > items.length && last !== undefined ? { nextCursor: encodeCursor(last) } : {});
+    }
+}
+function after(cursor, order) {
+    const position = decodeCursor(cursor);
+    const compare = comparing(order);
+    return (entry) => compare(entry, position) > 0;
+}
+//# sourceMappingURL=in-memory-audit-trail.js.map

package/dist/trail/in-memory-audit-trail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-audit-trail.js","sourceRoot":"","sources":["../../src/trail/in-memory-audit-trail.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,GASP,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGhD;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACpB,OAAO,GAAiB,EAAE,CAAC;IAEnB,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAErC,OAAO,CAAoB;IAE5C,YAAY,OAAO,GAAsB,EAAE;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB;QAC9B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAEvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,IAAiC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1B,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;CACF;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,KAAkB;IAC/C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEjC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/verify/chain-break-kind.d.ts

@@ -0,0 +1,8 @@
+/**
+ * - `altered-content`: the entry does not hash to its `hash`, does not link to the entry
+ *   before it, or disagrees with a checkpoint: something was rewritten.
+ * - `missing-entry`: the expected position is nowhere in what was examined.
+ * - `reordered`: the expected position exists, elsewhere, or a position appears twice.
+ */
+export type ChainBreakKind = 'altered-content' | 'missing-entry' | 'reordered';
+//# sourceMappingURL=chain-break-kind.d.ts.map

package/dist/verify/chain-break-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-break-kind.d.ts","sourceRoot":"","sources":["../../src/verify/chain-break-kind.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,eAAe,GAAG,WAAW,CAAC"}

package/dist/verify/chain-break-kind.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chain-break-kind.js.map

package/dist/verify/chain-break-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-break-kind.js","sourceRoot":"","sources":["../../src/verify/chain-break-kind.ts"],"names":[],"mappings":""}

package/dist/verify/chain-break.d.ts

@@ -0,0 +1,12 @@
+import type { ChainBreakKind } from './chain-break-kind.js';
+export interface ChainBreak {
+    readonly kind: ChainBreakKind;
+    readonly chain: string;
+    /** Index, among the examined entries of the chain, where the chain stops holding. */
+    readonly position: number;
+    /** The sequence expected at that position. */
+    readonly sequence: number;
+    /** The entry found there, when there is one. */
+    readonly entryId?: string;
+}
+//# sourceMappingURL=chain-break.d.ts.map

package/dist/verify/chain-break.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-break.d.ts","sourceRoot":"","sources":["../../src/verify/chain-break.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/verify/chain-break.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chain-break.js.map

package/dist/verify/chain-break.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-break.js","sourceRoot":"","sources":["../../src/verify/chain-break.ts"],"names":[],"mappings":""}

package/dist/verify/chain-verification.d.ts

@@ -0,0 +1,10 @@
+import type { ChainBreak } from './chain-break.js';
+export type ChainVerification = {
+    readonly valid: true;
+    readonly checked: number;
+} | {
+    readonly valid: false;
+    readonly checked: number;
+    readonly break: ChainBreak;
+};
+//# sourceMappingURL=chain-verification.d.ts.map

package/dist/verify/chain-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-verification.d.ts","sourceRoot":"","sources":["../../src/verify/chain-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC"}

package/dist/verify/chain-verification.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chain-verification.js.map

package/dist/verify/chain-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-verification.js","sourceRoot":"","sources":["../../src/verify/chain-verification.ts"],"names":[],"mappings":""}

package/dist/verify/verify-chain.d.ts

@@ -0,0 +1,20 @@
+import { type AuditEntry, type AuditReader } from '@ddd-ts-kit/kernel';
+import type { AuditCheckpoint } from '../chain/audit-checkpoint.js';
+import type { ChainVerification } from './chain-verification.js';
+export interface VerifyChainOptions {
+    /** Required with a reader. With entries: the one chain to verify, every chain found otherwise. */
+    readonly chain?: string;
+    /** First and last sequence to examine, both included. Default: from 1, to the last entry given. */
+    readonly from?: number;
+    readonly to?: number;
+    /** Checkpoints published elsewhere: an entry at one of these positions must have that hash. */
+    readonly checkpoints?: readonly AuditCheckpoint[];
+}
+/**
+ * Walks one chain, or each chain found in the entries, in the order given, and reports the
+ * first place where it does not hold. Entries are examined as they come, never sorted: an
+ * export that was shuffled is reported as such. Starting at `from` above 1 trusts the entry
+ * before it; a chain rewritten as a whole is self-consistent and only a checkpoint shows it.
+ */
+export declare function verifyChain(source: readonly AuditEntry[] | AuditReader, options?: VerifyChainOptions): Promise<ChainVerification>;
+//# sourceMappingURL=verify-chain.d.ts.map

package/dist/verify/verify-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-chain.d.ts","sourceRoot":"","sources":["../../src/verify/verify-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,WAAW,EAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAErB,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,WAAW,EAC3C,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAe5B"}

package/dist/verify/verify-chain.js

@@ -0,0 +1,110 @@
+import { DEFAULT_PAGE_LIMITS, cursorPage, } from '@ddd-ts-kit/kernel';
+import { GENESIS_HASH } from '../chain/genesis-hash.js';
+import { hashOf } from '../chain/hash-of.js';
+/**
+ * Walks one chain, or each chain found in the entries, in the order given, and reports the
+ * first place where it does not hold. Entries are examined as they come, never sorted: an
+ * export that was shuffled is reported as such. Starting at `from` above 1 trusts the entry
+ * before it; a chain rewritten as a whole is self-consistent and only a checkpoint shows it.
+ */
+export async function verifyChain(source, options = {}) {
+    const entries = isReader(source) ? await readChain(source, options) : source;
+    let checked = 0;
+    for (const chain of chainsOf(entries, options)) {
+        const outcome = verifyOne(inRange(entries, chain, options), { ...options, chain });
+        checked += outcome.checked;
+        if (!outcome.valid) {
+            return { ...outcome, checked };
+        }
+    }
+    return { valid: true, checked };
+}
+function isReader(source) {
+    return 'search' in source && typeof source.search === 'function';
+}
+async function readChain(reader, options) {
+    if (options.chain === undefined) {
+        throw new TypeError('verifyChain needs the chain to read from a reader');
+    }
+    const filter = {
+        chain: options.chain,
+        ...(options.from === undefined ? {} : { fromSequence: options.from }),
+        ...(options.to === undefined ? {} : { toSequence: options.to }),
+    };
+    const sort = [{ field: 'sequence', direction: 'asc' }];
+    const entries = [];
+    let cursor;
+    do {
+        const request = cursorPage({
+            limit: DEFAULT_PAGE_LIMITS.maxSize,
+            sort,
+            ...(cursor === undefined ? {} : { cursor }),
+        });
+        const page = await reader.search(filter, request);
+        entries.push(...page.items);
+        cursor = page.nextCursor;
+    } while (cursor !== undefined);
+    return entries;
+}
+function chainsOf(entries, options) {
+    return options.chain === undefined ? [...new Set(entries.map((entry) => entry.chain))] : [options.chain];
+}
+function inRange(entries, chain, { from, to }) {
+    return entries.filter((entry) => entry.chain === chain &&
+        (from === undefined || entry.sequence >= from) &&
+        (to === undefined || entry.sequence <= to));
+}
+function verifyOne(entries, options) {
+    const first = options.from ?? 1;
+    for (const [position, entry] of entries.entries()) {
+        const kind = breakAt(entries, position, options);
+        if (kind === undefined) {
+            continue;
+        }
+        return {
+            valid: false,
+            checked: position,
+            break: { kind, chain: options.chain, position, sequence: first + position, entryId: entry.id },
+        };
+    }
+    const expected = first + entries.length;
+    if (options.to === undefined || expected > options.to) {
+        return { valid: true, checked: entries.length };
+    }
+    const missing = {
+        kind: 'missing-entry',
+        chain: options.chain,
+        position: entries.length,
+        sequence: expected,
+    };
+    return { valid: false, checked: entries.length, break: missing };
+}
+function breakAt(entries, position, options) {
+    const entry = entries[position];
+    if (entry === undefined) {
+        return undefined;
+    }
+    const expected = (options.from ?? 1) + position;
+    if (entry.sequence !== expected) {
+        return misplacement(entries.slice(position + 1), entry.sequence, expected);
+    }
+    if (hashOf(entry) !== entry.hash || !linksTo(entry, entries[position - 1])) {
+        return 'altered-content';
+    }
+    return agreesWith(entry, options.checkpoints ?? []) ? undefined : 'altered-content';
+}
+function misplacement(rest, found, expected) {
+    return found < expected || rest.some((entry) => entry.sequence === expected) ? 'reordered' : 'missing-entry';
+}
+function linksTo(entry, previous) {
+    if (previous !== undefined) {
+        return entry.previousHash === previous.hash;
+    }
+    return entry.sequence !== 1 || entry.previousHash === GENESIS_HASH;
+}
+function agreesWith(entry, checkpoints) {
+    return checkpoints
+        .filter((checkpoint) => checkpoint.chain === entry.chain && checkpoint.sequence === entry.sequence)
+        .every((checkpoint) => checkpoint.hash === entry.hash);
+}
+//# sourceMappingURL=verify-chain.js.map

package/dist/verify/verify-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-chain.js","sourceRoot":"","sources":["../../src/verify/verify-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,UAAU,GAIX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAiB7C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAA2C,EAC3C,OAAO,GAAuB,EAAE;IAEhC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;QAE3B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,MAA2C;IAC3D,OAAO,QAAQ,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAmB,EAAE,OAA2B;IACvE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;KAChE,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,CAAC;IAChE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,MAA0B,CAAC;IAE/B,GAAG,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAiB;YACzC,KAAK,EAAE,mBAAmB,CAAC,OAAO;YAClC,IAAI;YACJ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAE/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,OAA8B,EAAE,OAA2B;IAC3E,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,OAAO,CAAC,OAA8B,EAAE,KAAa,EAAE,EAAE,IAAI,EAAE,EAAE,EAAsB;IAC9F,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,KAAK,KAAK;QACrB,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC9C,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAC7C,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,OAA8B,EAAE,OAAiB;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAEhC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE;SAC/F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAExC,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,QAAQ,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,QAAQ,EAAE,QAAQ;KACV,CAAC;IAEX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,OAA8B,EAAE,QAAgB,EAAE,OAAiB;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC;IAEhD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,IAA2B,EAAE,KAAa,EAAE,QAAgB;IAChF,OAAO,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;AAC/G,CAAC;AAED,SAAS,OAAO,CAAC,KAAiB,EAAE,QAAgC;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,OAAO,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,WAAuC;IAC5E,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;SAClG,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@ddd-ts-kit/audit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Tamper-evident audit trail fed from outside the use cases: authorization decisions, executed commands and integration events, as hash-chained append-only entries.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gbourgeat/ddd-ts-kit.git",
+    "directory": "packages/audit"
+  },
+  "homepage": "https://github.com/gbourgeat/ddd-ts-kit/tree/main/packages/audit#readme",
+  "bugs": "https://github.com/gbourgeat/ddd-ts-kit/issues",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./knex": {
+      "types": "./dist/knex.d.ts",
+      "default": "./dist/knex.js"
+    },
+    "./drizzle": {
+      "types": "./dist/drizzle.d.ts",
+      "default": "./dist/drizzle.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@ddd-ts-kit/kernel": "0.1.1"
+  },
+  "peerDependencies": {
+    "knex": "^3.0.0",
+    "drizzle-orm": ">=0.40.0",
+    "@ddd-ts-kit/testing": "0.1.1"
+  },
+  "peerDependenciesMeta": {
+    "knex": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "@ddd-ts-kit/testing": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "knex": "^3.3.0",
+    "drizzle-orm": "^0.45.4",
+    "pg": "^8.23.1",
+    "@types/pg": "^8.23.1",
+    "@electric-sql/pglite": "^0.5.8",
+    "@electric-sql/pglite-socket": "^0.2.11",
+    "@ddd-ts-kit/auth": "0.1.1",
+    "@ddd-ts-kit/events": "0.1.1",
+    "@ddd-ts-kit/knex": "0.1.1",
+    "@ddd-ts-kit/drizzle": "0.1.1",
+    "@ddd-ts-kit/testing": "0.1.1"
+  }
+}