@e-sig/supabase 0.1.0 → 0.3.0

package/dist/audit-chain.d.ts

@@ -0,0 +1,40 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+export interface VerifyAuditChainOptions {
+    /** Tenant whose chain to verify. */
+    tenantId: string;
+    /** Table name. Default `esig_audit_log`. */
+    table?: string;
+    /** Tenant key column. Default `tenant_id`. */
+    tenantColumn?: string;
+    /** Rows fetched per request. Default 1000 (PostgREST's usual max). */
+    pageSize?: number;
+}
+export interface AuditChainFailure {
+    /** `seq` of the offending row (falls back to the row's position when seq itself is unusable). */
+    seq: number;
+    /** Row id. */
+    id: string;
+    /** Human-readable description of what broke. */
+    reason: string;
+}
+export interface VerifyAuditChainResult {
+    /** True iff every row checked out. Vacuously true for an empty chain. */
+    ok: boolean;
+    /** Number of rows fetched and checked. */
+    checkedRows: number;
+    /** seq of the first failing row, when any failed. */
+    firstBrokenSeq?: number;
+    /** One entry per detected problem, in chain order. */
+    failures: AuditChainFailure[];
+}
+/**
+ * Verify a tenant's esig_audit_log hash chain (migration 0002). Per row:
+ *   (a) seq is contiguous from 0,
+ *   (b) prev_hash equals the previous row's row_hash (linkage),
+ *   (c) row_hash = sha256(prev_hash|payload_canonical) (self-consistency),
+ *   (d) payload_canonical's scalar fields match the row's actual columns.
+ * Read access to the chain columns is required (service key, or a member
+ * session if your esig_tenant_member() grants SELECT).
+ */
+export declare function verifyAuditChain(client: SupabaseClient, opts: VerifyAuditChainOptions): Promise<VerifyAuditChainResult>;
+//# sourceMappingURL=audit-chain.d.ts.map

package/dist/audit-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain.d.ts","sourceRoot":"","sources":["../src/audit-chain.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,WAAW,uBAAuB;IACtC,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc;IACd,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,EAAE,EAAE,OAAO,CAAC;IACZ,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAkED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CA6HjC"}

package/dist/audit-chain.js

@@ -0,0 +1,210 @@
+// @e-sig/supabase — verifyAuditChain
+//
+// Client-side tamper-evidence verifier for the esig_audit_log hash chain
+// installed by migrations/0002_esig_audit_hashchain.sql. Fetches one tenant's
+// rows in seq order, re-derives the SHA-256 linkage from payload_canonical,
+// and cross-checks the canonical's scalar fields against the row's actual
+// columns — so edited columns, edited canonicals, deleted/reordered rows and
+// re-hashed suffixes all surface as failures.
+//
+// ==================================================================
+// CANONICAL PAYLOAD SPEC v1 — MUST match migrations/0002 byte-for-byte
+// ==================================================================
+//   payload_canonical =
+//        'v1'
+//     || '|' || tenant_id::text                    (lowercase uuid text)
+//     || '|' || action
+//     || '|' || coalesce(actor_user_id::text, '')  ('' when NULL)
+//     || '|' || coalesce(target_table, '')         ('' when NULL)
+//     || '|' || coalesce(target_id::text, '')      ('' when NULL)
+//     || '|' || epoch MICROseconds of created_at, as integer text
+//     || '|' || md5(metadata::text)                (32 lowercase hex)
+//
+//   row_hash  = sha256hex(utf8((prev_hash ?? "") + "|" + payload_canonical))
+//   seq       = 0-origin, contiguous per tenant
+//   prev_hash = previous row's row_hash (null at seq 0)
+//
+// jsonb normalization is PG-side: md5(metadata::text) hashes Postgres's
+// canonical jsonb rendering (its key ordering / spacing / numeric scale),
+// which JS cannot reproduce reliably. The md5 therefore travels inside
+// payload_canonical and is integrity-protected by the chain itself; this
+// verifier cross-checks the SCALAR fields column-by-column and validates
+// only the md5's shape.
+import { createHash } from "node:crypto";
+const MD5_HEX = /^[0-9a-f]{32}$/;
+function sha256Hex(input) {
+    return createHash("sha256").update(input, "utf8").digest("hex");
+}
+/**
+ * Epoch microseconds of a Postgres/PostgREST timestamptz text value — mirrors
+ * `(extract(epoch from created_at) * 1000000)::bigint`. Accepts
+ * `2026-07-03T12:34:56.789012+00:00` (PostgREST), the space-separated PG text
+ * form, `Z`, and 2-digit offsets; fractional seconds may be 0-6 digits (PG
+ * trims trailing zeros). Exact in a float64 until far beyond year 2200.
+ */
+function timestamptzToEpochMicros(value) {
+    const m = /^(\d{4}-\d{2}-\d{2})[T ](\d{2}:\d{2}:\d{2})(?:\.(\d{1,6}))?(Z|[+-]\d{2}(?::?\d{2})?)$/.exec(value);
+    if (!m)
+        throw new Error(`unparseable timestamptz "${value}"`);
+    let offset = m[4];
+    if (/^[+-]\d{2}$/.test(offset))
+        offset += ":00";
+    else if (/^[+-]\d{4}$/.test(offset))
+        offset = `${offset.slice(0, 3)}:${offset.slice(3)}`;
+    const baseMs = Date.parse(`${m[1]}T${m[2]}${offset}`);
+    if (Number.isNaN(baseMs))
+        throw new Error(`unparseable timestamptz "${value}"`);
+    return baseMs * 1000 + Number((m[3] ?? "0").padEnd(6, "0"));
+}
+const CANONICAL_FIELDS = [
+    "version",
+    "tenant_id",
+    "action",
+    "actor_user_id",
+    "target_table",
+    "target_id",
+    "created_at_epoch_us",
+    "metadata_md5",
+];
+/** Names the disagreeing fields when both strings split into the v1 shape. */
+function describeCanonicalMismatch(expected, actual) {
+    const e = expected.split("|");
+    const a = actual.split("|");
+    if (e.length === CANONICAL_FIELDS.length && a.length === CANONICAL_FIELDS.length) {
+        const diff = CANONICAL_FIELDS.filter((_, i) => e[i] !== a[i]);
+        if (diff.length > 0) {
+            return `payload_canonical disagrees with row columns on: ${diff.join(", ")}`;
+        }
+    }
+    return "payload_canonical disagrees with row columns";
+}
+/**
+ * Verify a tenant's esig_audit_log hash chain (migration 0002). Per row:
+ *   (a) seq is contiguous from 0,
+ *   (b) prev_hash equals the previous row's row_hash (linkage),
+ *   (c) row_hash = sha256(prev_hash|payload_canonical) (self-consistency),
+ *   (d) payload_canonical's scalar fields match the row's actual columns.
+ * Read access to the chain columns is required (service key, or a member
+ * session if your esig_tenant_member() grants SELECT).
+ */
+export async function verifyAuditChain(client, opts) {
+    const table = opts.table ?? "esig_audit_log";
+    const tenantColumn = opts.tenantColumn ?? "tenant_id";
+    const pageSize = opts.pageSize ?? 1000;
+    const columns = [
+        "id",
+        "seq",
+        "prev_hash",
+        "row_hash",
+        "payload_canonical",
+        "action",
+        "actor_user_id",
+        "target_table",
+        "target_id",
+        "created_at",
+        tenantColumn,
+    ].join(", ");
+    const rows = [];
+    let serverTotal = null;
+    for (let from = 0;; from += pageSize) {
+        // count:'exact' on the first page guards against a PostgREST max-rows cap
+        // below pageSize: a short page would otherwise read as end-of-chain and
+        // silently verify only a prefix.
+        const { data, error, count } = await client
+            .from(table)
+            .select(columns, from === 0 ? { count: "exact" } : undefined)
+            .eq(tenantColumn, opts.tenantId)
+            .order("seq", { ascending: true })
+            .range(from, from + pageSize - 1);
+        if (error)
+            throw new Error(`verifyAuditChain: ${error.message}`);
+        if (from === 0 && typeof count === "number")
+            serverTotal = count;
+        const page = (data ?? []);
+        rows.push(...page);
+        if (page.length < pageSize)
+            break;
+    }
+    if (serverTotal !== null && rows.length !== serverTotal) {
+        return {
+            ok: false,
+            checkedRows: rows.length,
+            failures: [
+                {
+                    seq: rows.length,
+                    id: "",
+                    reason: `fetched ${rows.length} rows but the server reports ${serverTotal} — ` +
+                        "a row cap (e.g. PostgREST max-rows) is truncating pages; lower pageSize below the cap",
+                },
+            ],
+        };
+    }
+    const failures = [];
+    let firstBrokenSeq;
+    let expectedPrev = null;
+    rows.forEach((row, i) => {
+        const seqNum = row.seq === null ? Number.NaN : Number(row.seq);
+        const reportSeq = Number.isFinite(seqNum) ? seqNum : i;
+        const fail = (reason) => {
+            failures.push({ seq: reportSeq, id: row.id, reason });
+            if (firstBrokenSeq === undefined)
+                firstBrokenSeq = reportSeq;
+        };
+        if (row.seq === null || row.row_hash === null || row.payload_canonical === null) {
+            fail("chain columns missing (row predates the 0002 backfill, or was nulled out)");
+            expectedPrev = row.row_hash;
+            return;
+        }
+        // (a) seq continuity — 0-origin, no gaps, no duplicates.
+        if (seqNum !== i)
+            fail(`seq discontinuity: expected ${i}, found ${row.seq}`);
+        // (b) linkage — stored prev_hash must equal the previous row's row_hash.
+        if ((row.prev_hash ?? null) !== expectedPrev) {
+            fail("prev_hash does not match the previous row_hash (chain broken: row deleted, reordered, or suffix re-hashed)");
+        }
+        // (c) self-consistency — row_hash must re-derive from this row's own fields.
+        const recomputed = sha256Hex(`${row.prev_hash ?? ""}|${row.payload_canonical}`);
+        if (recomputed !== row.row_hash) {
+            fail(`row_hash mismatch: stored ${row.row_hash}, recomputed ${recomputed}`);
+        }
+        // (d) scalar cross-check — rebuild the canonical from the row's columns
+        // (spec v1 above), carrying over only the PG-side metadata md5 tail.
+        const md5Start = row.payload_canonical.lastIndexOf("|") + 1;
+        const md5Part = md5Start > 0 ? row.payload_canonical.slice(md5Start) : "";
+        if (!MD5_HEX.test(md5Part)) {
+            fail("malformed payload_canonical: missing metadata md5 tail");
+        }
+        else {
+            let epochField = null;
+            try {
+                epochField = String(timestamptzToEpochMicros(row.created_at));
+            }
+            catch {
+                fail(`unparseable created_at "${row.created_at}" — cannot cross-check payload_canonical`);
+            }
+            if (epochField !== null) {
+                const expected = [
+                    "v1",
+                    String(row[tenantColumn] ?? ""),
+                    row.action,
+                    row.actor_user_id ?? "",
+                    row.target_table ?? "",
+                    row.target_id ?? "",
+                    epochField,
+                    md5Part,
+                ].join("|");
+                if (expected !== row.payload_canonical) {
+                    fail(describeCanonicalMismatch(expected, row.payload_canonical));
+                }
+            }
+        }
+        expectedPrev = row.row_hash;
+    });
+    return {
+        ok: failures.length === 0,
+        checkedRows: rows.length,
+        firstBrokenSeq,
+        failures,
+    };
+}
+//# sourceMappingURL=audit-chain.js.map

package/dist/audit-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain.js","sourceRoot":"","sources":["../src/audit-chain.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,8CAA8C;AAC9C,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,wBAAwB;AACxB,cAAc;AACd,yEAAyE;AACzE,uBAAuB;AACvB,kEAAkE;AAClE,kEAAkE;AAClE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,gDAAgD;AAChD,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgDzC,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,CAAC,GAAG,uFAAuF,CAAC,IAAI,CACpG,KAAK,CACN,CAAC;IACF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,GAAG,CAAC,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC;SAC3C,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,GAAG,CAAC,CAAC;IAChF,OAAO,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,eAAe;IACf,cAAc;IACd,WAAW;IACX,qBAAqB;IACrB,cAAc;CACN,CAAC;AAEX,8EAA8E;AAC9E,SAAS,yBAAyB,CAAC,QAAgB,EAAE,MAAc;IACjE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,oDAAoD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,8CAA8C,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB,EACtB,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,KAAK;QACL,WAAW;QACX,UAAU;QACV,mBAAmB;QACnB,QAAQ;QACR,eAAe;QACf,cAAc;QACd,WAAW;QACX,YAAY;QACZ,YAAY;KACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACtC,0EAA0E;QAC1E,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM;aACxC,IAAI,CAAC,KAAK,CAAC;aACX,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;aAC5D,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC;aAC/B,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACjC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,WAAW,GAAG,KAAK,CAAC;QACjE,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,MAAM;IACpC,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,IAAI,CAAC,MAAM;oBAChB,EAAE,EAAE,EAAE;oBACN,MAAM,EACJ,WAAW,IAAI,CAAC,MAAM,gCAAgC,WAAW,KAAK;wBACtE,uFAAuF;iBAC1F;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,cAAkC,CAAC;IACvC,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE;YAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACtD,IAAI,cAAc,KAAK,SAAS;gBAAE,cAAc,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC;QAEF,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAChF,IAAI,CAAC,2EAA2E,CAAC,CAAC;YAClF,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,+BAA+B,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAE7E,yEAAyE;QACzE,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,IAAI,CACF,4GAA4G,CAC7G,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChF,IAAI,UAAU,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,6BAA6B,GAAG,CAAC,QAAQ,gBAAgB,UAAU,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,IAAI,UAAU,GAAkB,IAAI,CAAC;YACrC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,2BAA2B,GAAG,CAAC,UAAU,0CAA0C,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG;oBACf,IAAI;oBACJ,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;oBAC/B,GAAG,CAAC,MAAM;oBACV,GAAG,CAAC,aAAa,IAAI,EAAE;oBACvB,GAAG,CAAC,YAAY,IAAI,EAAE;oBACtB,GAAG,CAAC,SAAS,IAAI,EAAE;oBACnB,UAAU;oBACV,OAAO;iBACR,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,IAAI,QAAQ,KAAK,GAAG,CAAC,iBAAiB,EAAE,CAAC;oBACvC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;QAED,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/audit-store.js

@@ -1,7 +1,7 @@
 // @e-sig/supabase — SupabaseAuditLogStore
 //
 // Append-only AuditLogStore backed by a Postgres table (default `esig_audit_log`)
-// via supabase-js. Tenant key column defaults to `tenant_id` (Opendelphi: `org_id`).
+// via supabase-js. Tenant key column defaults to `tenant_id` (override for e.g. `org_id`).
 export class SupabaseAuditLogStore {
     sb;
     table;

package/dist/audit-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-store.js","sourceRoot":"","sources":["../src/audit-store.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,kFAAkF;AAClF,qFAAqF;AAYrF,MAAM,OAAO,qBAAqB;IAGZ;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAqC,EAAE;QAA3D,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC/C,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,cAAc,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,CAAC;aACD,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAY,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAoB,CAAC,EAAE,CAAC;IACnF,CAAC;CACF"}
+{"version":3,"file":"audit-store.js","sourceRoot":"","sources":["../src/audit-store.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,kFAAkF;AAClF,2FAA2F;AAY3F,MAAM,OAAO,qBAAqB;IAGZ;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAqC,EAAE;QAA3D,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC/C,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,cAAc,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,CAAC;aACD,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAY,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAoB,CAAC,EAAE,CAAC;IACnF,CAAC;CACF"}

package/dist/cert-store.js

@@ -3,7 +3,7 @@
 // CertStore backed by a Postgres table (default `org_signing_certs`) via
 // supabase-js. Matches the schema in migrations/0001_esig_self_contained.sql.
 // The tenant key column is `tenant_id` in the bundled migration; pass
-// `tenantColumn` if yours differs (Opendelphi uses `org_id`).
+// `tenantColumn` if yours differs (e.g. an existing `org_id` column).
 function toStoredCert(r, tenantColumn) {
     // Postgres bytea comes back from PostgREST as a `\x<hex>` string. Decode to
     // bytes. Legacy rows may be JSON-Buffer-wrapped (`{"type":"Buffer",...}`) by

package/dist/cert-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"cert-store.js","sourceRoot":"","sources":["../src/cert-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,sEAAsE;AACtE,8DAA8D;AA0B9D,SAAS,YAAY,CAAC,CAAa,EAAE,YAAoB;IACvD,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,IAAI,QAAoB,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAChC,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAI,CAAC,CAAC,YAAgC,CAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,CAAC,CAAC,gBAAgB;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QACjC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGR;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAiC,EAAE;QAAvD,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC;QAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;aAC/B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;YACjC,iBAAiB,EAAE,UAAU;YAC7B,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YAC7C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE;YACnD,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE;YACjD,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;SAC1C,CAAC;aACD,MAAM,EAAE;aACR,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,YAAY,CAAC,IAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;CACF"}
+{"version":3,"file":"cert-store.js","sourceRoot":"","sources":["../src/cert-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,sEAAsE;AACtE,sEAAsE;AA0BtE,SAAS,YAAY,CAAC,CAAa,EAAE,YAAoB;IACvD,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,IAAI,QAAoB,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAChC,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAI,CAAC,CAAC,YAAgC,CAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,CAAC,CAAC,gBAAgB;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QACjC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGR;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAiC,EAAE;QAAvD,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC;QAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;aAC/B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;YACjC,iBAAiB,EAAE,UAAU;YAC7B,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YAC7C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE;YACnD,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE;YACjD,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;SAC1C,CAAC;aACD,MAAM,EAAE;aACR,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,YAAY,CAAC,IAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { SupabaseCertStore, type SupabaseCertStoreOptions, } from "./cert-store.js";
+export { SupabasePqKeyStore, type SupabasePqKeyStoreOptions, } from "./pq-key-store.js";
 export { SupabaseAuditLogStore, type SupabaseAuditLogStoreOptions, } from "./audit-store.js";
 export { SupabasePdfStorageStore, type SupabasePdfStorageStoreOptions, } from "./storage.js";
+export { verifyAuditChain, type VerifyAuditChainOptions, type VerifyAuditChainResult, type AuditChainFailure, } from "./audit-chain.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,10 +1,14 @@
 // @e-sig/supabase
 //
 // Supabase reference implementations of the @e-sig/core persistence
-// interfaces (CertStore, AuditLogStore, PdfStorageStore). Pair with the bundled
-// migration (migrations/0001_esig_self_contained.sql). Table/bucket/tenant-column
-// names are configurable so you can map onto your existing schema.
+// interfaces (CertStore, PqKeyStore, AuditLogStore, PdfStorageStore), plus the
+// verifyAuditChain() tamper-evidence checker for the audit hash chain. Pair
+// with the bundled migrations (migrations/0001_esig_self_contained.sql +
+// 0002_esig_audit_hashchain.sql + 0003_esig_pq_keys.sql). Table/bucket/
+// tenant-column names are configurable so you can map onto your existing schema.
 export { SupabaseCertStore, } from "./cert-store.js";
+export { SupabasePqKeyStore, } from "./pq-key-store.js";
 export { SupabaseAuditLogStore, } from "./audit-store.js";
 export { SupabasePdfStorageStore, } from "./storage.js";
+export { verifyAuditChain, } from "./audit-chain.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,oEAAoE;AACpE,gFAAgF;AAChF,kFAAkF;AAClF,mEAAmE;AAEnE,OAAO,EACL,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,oEAAoE;AACpE,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,iFAAiF;AAEjF,OAAO,EACL,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,GAIjB,MAAM,kBAAkB,CAAC"}

package/dist/pq-key-store.d.ts

@@ -0,0 +1,23 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { PqKeyStore, StoredPqKeys, PqPublicMaterial } from "@e-sig/core";
+export interface SupabasePqKeyStoreOptions {
+    /** Table name. Default `org_pq_keys`. */
+    table?: string;
+    /** Tenant key column. Default `tenant_id`. */
+    tenantColumn?: string;
+}
+export declare class SupabasePqKeyStore implements PqKeyStore {
+    private sb;
+    private table;
+    private tenantColumn;
+    constructor(sb: SupabaseClient, opts?: SupabasePqKeyStoreOptions);
+    findActive(tenantId: string): Promise<StoredPqKeys | null>;
+    insert(input: {
+        tenantId: string;
+        keyBundleEncrypted: Uint8Array;
+        public: PqPublicMaterial;
+        rotatedFromId?: string | null;
+    }): Promise<StoredPqKeys>;
+    deactivate(id: string): Promise<void>;
+}
+//# sourceMappingURL=pq-key-store.d.ts.map

package/dist/pq-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-key-store.d.ts","sourceRoot":"","sources":["../src/pq-key-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAgB9E,MAAM,WAAW,yBAAyB;IACxC,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA0BD,qBAAa,kBAAmB,YAAW,UAAU;IAGvC,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,YAAY,CAAS;gBACT,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE,yBAA8B;IAKtE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAW1D,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,kBAAkB,EAAE,UAAU,CAAC;QAC/B,MAAM,EAAE,gBAAgB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBnB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5C"}

package/dist/pq-key-store.js

@@ -0,0 +1,82 @@
+// @e-sig/supabase — SupabasePqKeyStore
+//
+// PqKeyStore backed by a Postgres table (default `org_pq_keys`) via supabase-js.
+// Matches migrations/0003_esig_pq_keys.sql. Drive it with ensureActivePqKeys /
+// rotatePqKeys from @e-sig/core. Mirrors SupabaseCertStore, including the bytea
+// `\x<hex>` wire-encoding workaround for the encrypted bundle.
+/** Decode a Postgres bytea (`\x<hex>` from PostgREST, or already-bytes) to a Uint8Array. */
+function decodeBytea(raw) {
+    if (raw instanceof Uint8Array)
+        return raw;
+    if (typeof raw === "string" && raw.startsWith("\\x"))
+        return Buffer.from(raw.slice(2), "hex");
+    if (typeof raw === "string")
+        return Buffer.from(raw, "base64");
+    return new Uint8Array();
+}
+function toStoredPqKeys(r, tenantColumn) {
+    const tenantId = r[tenantColumn] ?? r.tenant_id ?? r.org_id ?? "";
+    return {
+        id: r.id,
+        tenantId,
+        keyBundleEncrypted: decodeBytea(r.key_bundle_encrypted),
+        ed25519Public: r.ed25519_public,
+        mldsa65Public: r.mldsa65_public,
+        mldsa65Fpr: r.mldsa65_fpr,
+        keyId: r.key_id,
+        active: r.active,
+        rotatedFromId: r.rotated_from,
+        createdAt: new Date(r.created_at),
+    };
+}
+export class SupabasePqKeyStore {
+    sb;
+    table;
+    tenantColumn;
+    constructor(sb, opts = {}) {
+        this.sb = sb;
+        this.table = opts.table ?? "org_pq_keys";
+        this.tenantColumn = opts.tenantColumn ?? "tenant_id";
+    }
+    async findActive(tenantId) {
+        const { data, error } = await this.sb
+            .from(this.table)
+            .select("*")
+            .eq(this.tenantColumn, tenantId)
+            .eq("active", true)
+            .maybeSingle();
+        if (error)
+            throw new Error(`SupabasePqKeyStore.findActive: ${error.message}`);
+        return data ? toStoredPqKeys(data, this.tenantColumn) : null;
+    }
+    async insert(input) {
+        // bytea wire encoding: supabase-js JSON-stringifies a Uint8Array, mangling
+        // the round-trip. Pre-encode as Postgres bytea-in hex form `\x<hex>`.
+        const bytes = Buffer.isBuffer(input.keyBundleEncrypted)
+            ? input.keyBundleEncrypted
+            : Buffer.from(input.keyBundleEncrypted);
+        const hexEncoded = "\\x" + bytes.toString("hex");
+        const { data, error } = await this.sb
+            .from(this.table)
+            .insert({
+            [this.tenantColumn]: input.tenantId,
+            key_bundle_encrypted: hexEncoded,
+            ed25519_public: input.public.ed25519,
+            mldsa65_public: input.public.mldsa65,
+            mldsa65_fpr: input.public.mldsa65Fpr,
+            key_id: input.public.keyId,
+            rotated_from: input.rotatedFromId ?? null,
+        })
+            .select()
+            .single();
+        if (error || !data)
+            throw new Error(`SupabasePqKeyStore.insert: ${error?.message}`);
+        return toStoredPqKeys(data, this.tenantColumn);
+    }
+    async deactivate(id) {
+        const { error } = await this.sb.from(this.table).update({ active: false }).eq("id", id);
+        if (error)
+            throw new Error(`SupabasePqKeyStore.deactivate: ${error.message}`);
+    }
+}
+//# sourceMappingURL=pq-key-store.js.map

package/dist/pq-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-key-store.js","sourceRoot":"","sources":["../src/pq-key-store.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,+DAA+D;AA0B/D,4FAA4F;AAC5F,SAAS,WAAW,CAAC,GAAwB;IAC3C,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,CAAW,EAAE,YAAoB;IACvD,MAAM,QAAQ,GAAI,CAAC,CAAC,YAA8B,CAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAChG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ;QACR,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACvD,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,KAAK,EAAE,CAAC,CAAC,MAAM;QACf,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IAGT;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAkC,EAAE;QAAxD,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;aAC/B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,oBAAoB,EAAE,UAAU;YAChC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YACpC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YACpC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YAC1B,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;SAC1C,CAAC;aACD,MAAM,EAAE;aACR,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,OAAO,cAAc,CAAC,IAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@e-sig/supabase",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Supabase adapters (CertStore / AuditLogStore / PdfStorageStore) for @e-sig/core — self-contained PDF e-signature persistence on Supabase Postgres + Storage.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,10 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "clean": "rm -rf dist",
-    "prepublishOnly": "npm run clean && npm run build"
+    "prepublishOnly": "npm run clean && npm run build",
+    "pretest": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "engines": {
     "node": ">=20"
@@ -45,13 +48,14 @@
   "homepage": "https://github.com/vmvtech/esig-suite/tree/main/packages/esig-supabase#readme",
   "peerDependencies": {
     "@supabase/supabase-js": ">=2",
-    "@e-sig/core": "^0.4.0"
+    "@e-sig/core": "^0.4.0 || ^0.5.0 || ^0.6.0"
   },
   "devDependencies": {
     "@supabase/supabase-js": "^2.98.0",
     "@types/node": "^22.0.0",
-    "@e-sig/core": "^0.4.0",
-    "typescript": "^5.4.0"
+    "@e-sig/core": "^0.6.0",
+    "typescript": "^5.4.0",
+    "vitest": "^2.1.9"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",