@openora/core 0.4.0

package/dist/audit/schema/index.d.ts

@@ -0,0 +1,287 @@
+export declare const actorTypeEnum: import("drizzle-orm/pg-core").PgEnum<["player", "admin", "system"]>;
+export declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "audit_log";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actorId";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actorType";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "system" | "admin" | "player";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["player", "admin", "system"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        action: import("drizzle-orm/pg-core").PgColumn<{
+            name: "action";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resourceType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resourceType";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resourceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resourceId";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        before: import("drizzle-orm/pg-core").PgColumn<{
+            name: "before";
+            tableName: "audit_log";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        after: import("drizzle-orm/pg-core").PgColumn<{
+            name: "after";
+            tableName: "audit_log";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        ip: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ip";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userAgent: import("drizzle-orm/pg-core").PgColumn<{
+            name: "userAgent";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        correlationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "correlationId";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        result: import("drizzle-orm/pg-core").PgColumn<{
+            name: "result";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        seq: import("drizzle-orm/pg-core").PgColumn<{
+            name: "seq";
+            tableName: "audit_log";
+            dataType: "number";
+            columnType: "PgBigSerial53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        prevHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "prevHash";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hash";
+            tableName: "audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "audit_log";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type AuditLog = typeof auditLog.$inferSelect;
+export type AuditLogInsert = typeof auditLog.$inferInsert;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/schema/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,aAAa,qEAA0C,CAAC;AAGrE,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BpB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC"}

package/dist/audit/schema/index.js

@@ -0,0 +1,31 @@
+import { pgTable, uuid, pgEnum, text, timestamp, jsonb, index, bigserial, } from 'drizzle-orm/pg-core';
+import { ACTOR_TYPES } from '../contract/index.js';
+// Derives from the contract tuple so the Zod schema and DB enum can never drift.
+export const actorTypeEnum = pgEnum('audit_actor_type', ACTOR_TYPES);
+// Append-only hash-chained audit log. Do NOT expose update/delete routes.
+export const auditLog = pgTable('audit_log', {
+    id: uuid().primaryKey().defaultRandom(),
+    actorId: text(),
+    actorType: actorTypeEnum().notNull(),
+    action: text().notNull(),
+    resourceType: text().notNull(),
+    resourceId: text(),
+    before: jsonb().$type(),
+    after: jsonb().$type(),
+    ip: text(),
+    userAgent: text(),
+    correlationId: text(),
+    result: text(),
+    seq: bigserial({ mode: 'number' }).notNull(),
+    prevHash: text(),
+    hash: text().notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    index('audit_log_actor_id_idx').on(t.actorId),
+    index('audit_log_resource_id_idx').on(t.resourceId),
+    index('audit_log_action_idx').on(t.action),
+    index('audit_log_resource_type_idx').on(t.resourceType),
+    index('audit_log_created_at_idx').on(t.createdAt),
+    index('audit_log_seq_idx').on(t.seq),
+]);
+//# sourceMappingURL=index.js.map

package/dist/audit/schema/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,SAAS,EACT,KAAK,EACL,KAAK,EACL,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;AAErE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAC7B,WAAW,EACX;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,OAAO,EAAE,IAAI,EAAE;IACf,SAAS,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE;IACpC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,YAAY,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC9B,UAAU,EAAE,IAAI,EAAE;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAA2B;IAChD,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,EAA2B;IAC/C,EAAE,EAAE,IAAI,EAAE;IACV,SAAS,EAAE,IAAI,EAAE;IACjB,aAAa,EAAE,IAAI,EAAE;IACrB,MAAM,EAAE,IAAI,EAAE;IACd,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,IAAI,EAAE;IAChB,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7C,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACnD,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACvD,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;CACrC,CACF,CAAC"}

package/dist/audit/server.d.ts

@@ -0,0 +1,3 @@
+export { AuditService } from './service/audit.service.js';
+export { default } from './plugin.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/audit/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/audit/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/audit/server.js

@@ -0,0 +1,3 @@
+export { AuditService } from './service/audit.service.js';
+export { default } from './plugin.js';
+//# sourceMappingURL=server.js.map

package/dist/audit/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/audit/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/audit/service/audit.service.d.ts

@@ -0,0 +1,68 @@
+import { DrizzleService, type EventBus } from '@openora/core/server';
+import type { AuditWritePort } from '@openora/core/contracts';
+import { type AuditLog } from '../schema/index.js';
+import type { AuditListFilters, AuditExportFilters } from '../contract/index.js';
+type CanonicalHashInput = Pick<AuditLog, 'id' | 'actorId' | 'actorType' | 'action' | 'resourceType' | 'resourceId' | 'before' | 'after' | 'result' | 'seq' | 'prevHash'> & {
+    createdAt: string;
+};
+export declare function computeHash(fields: CanonicalHashInput): string;
+export type RecordInput = Parameters<AuditWritePort['record']>[0] & {
+    result?: string | null;
+};
+export declare class AuditService {
+    private readonly drizzle;
+    private readonly events;
+    constructor(drizzle: DrizzleService, events: EventBus);
+    record(input: RecordInput): Promise<import("@openora/core/server").SerializedRow<{
+        id: string;
+        createdAt: Date;
+        actorId: string | null;
+        ip: string | null;
+        userAgent: string | null;
+        action: string;
+        before: Record<string, unknown> | null;
+        after: Record<string, unknown> | null;
+        result: string | null;
+        actorType: "system" | "admin" | "player";
+        resourceType: string;
+        resourceId: string | null;
+        correlationId: string | null;
+        seq: number;
+        prevHash: string | null;
+        hash: string;
+    }, "createdAt">>;
+    list(filters: AuditListFilters): Promise<{
+        items: import("@openora/core/server").SerializedRow<{
+            id: string;
+            createdAt: Date;
+            actorId: string | null;
+            ip: string | null;
+            userAgent: string | null;
+            action: string;
+            before: Record<string, unknown> | null;
+            after: Record<string, unknown> | null;
+            result: string | null;
+            actorType: "system" | "admin" | "player";
+            resourceType: string;
+            resourceId: string | null;
+            correlationId: string | null;
+            seq: number;
+            prevHash: string | null;
+            hash: string;
+        }, "createdAt">[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    static readonly EXPORT_MAX_ROWS = 50000;
+    exportCsv(filters: AuditExportFilters): Promise<string>;
+    verifyChain(): Promise<{
+        valid: true;
+    } | {
+        valid: false;
+        firstBrokenSeq: number;
+        rowId: string;
+    }>;
+}
+export {};
+//# sourceMappingURL=audit.service.d.ts.map

package/dist/audit/service/audit.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.d.ts","sourceRoot":"","sources":["../../../src/audit/service/audit.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EAId,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAKjF,KAAK,kBAAkB,GAAG,IAAI,CAC5B,QAAQ,EACN,IAAI,GACJ,SAAS,GACT,WAAW,GACX,QAAQ,GACR,cAAc,GACd,YAAY,GACZ,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,KAAK,GACL,UAAU,CACb,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB1B,wBAAgB,WAAW,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAE9D;AAmCD,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ;IAM7B,MAAM,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;IA6CzB,IAAI,CAAC,OAAO,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;IA+BpC,MAAM,CAAC,QAAQ,CAAC,eAAe,SAAU;IAEnC,SAAS,CAAC,OAAO,EAAE,kBAAkB;IAoCrC,WAAW,IAAI,OAAO,CAC1B;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAC1E;CAkCF"}

package/dist/audit/service/audit.service.js

@@ -0,0 +1,164 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { pageToOffset, serializeRow, withAdvisoryXactLock, } from '@openora/core/server';
+import { eq, and, or, gte, lte, like, desc, sql } from 'drizzle-orm';
+import { auditLog } from '../schema/index.js';
+function canonicalHashInput(fields) {
+    return JSON.stringify({
+        id: fields.id,
+        actorId: fields.actorId,
+        actorType: fields.actorType,
+        action: fields.action,
+        resourceType: fields.resourceType,
+        resourceId: fields.resourceId,
+        before: fields.before ?? null,
+        after: fields.after ?? null,
+        result: fields.result ?? null,
+        seq: fields.seq,
+        createdAt: fields.createdAt,
+        prevHash: fields.prevHash ?? '',
+    });
+}
+export function computeHash(fields) {
+    return createHash('sha256').update(canonicalHashInput(fields)).digest('hex');
+}
+// Escape LIKE wildcards so a caller-supplied prefix ('rg.') matches literally and a
+// stray % or _ can't widen the match. Backslash is the default PG escape char.
+function likePrefix(prefix) {
+    return `${prefix.replace(/[\\%_]/g, '\\$&')}%`;
+}
+function buildWhere(filters) {
+    const { actorId, actorType, action, actionPrefix, resourceType, resourceId, q, fromDate, toDate, } = filters;
+    return and(actorId ? eq(auditLog.actorId, actorId) : undefined, actorType ? eq(auditLog.actorType, actorType) : undefined, action ? eq(auditLog.action, action) : undefined, actionPrefix ? like(auditLog.action, likePrefix(actionPrefix)) : undefined, resourceType ? eq(auditLog.resourceType, resourceType) : undefined, resourceId ? eq(auditLog.resourceId, resourceId) : undefined, q ? or(eq(auditLog.actorId, q), eq(auditLog.resourceId, q)) : undefined, fromDate ? gte(auditLog.createdAt, new Date(fromDate)) : undefined, toDate ? lte(auditLog.createdAt, new Date(toDate)) : undefined);
+}
+const toDto = (row) => serializeRow(row, { dateFields: ['createdAt'] });
+export class AuditService {
+    drizzle;
+    events;
+    constructor(drizzle, events) {
+        this.drizzle = drizzle;
+        this.events = events;
+    }
+    // Hash computed and inserted in a single statement - no read-back UPDATE, so a
+    // crash can never leave a 'pending' hash. Serialized via pg advisory lock so
+    // concurrent record() calls cannot fork the chain. Append-only.
+    async record(input) {
+        const row = await this.drizzle.db.transaction((tx) => withAdvisoryXactLock(tx, 'audit_log', async () => {
+            const [latest] = await tx
+                .select({ hash: auditLog.hash })
+                .from(auditLog)
+                .orderBy(desc(auditLog.seq))
+                .limit(1);
+            const prevHash = latest?.hash ?? null;
+            const seqResult = await tx.execute(sql `SELECT nextval(pg_get_serial_sequence('audit_log', 'seq')) AS seq`);
+            const seq = +(seqResult.rows.at(0)?.seq ?? 0);
+            const id = randomUUID();
+            const createdAt = new Date();
+            const hash = computeHash({
+                id,
+                actorId: input.actorId ?? null,
+                actorType: input.actorType,
+                action: input.action,
+                resourceType: input.resourceType,
+                resourceId: input.resourceId ?? null,
+                before: input.before ?? null,
+                after: input.after ?? null,
+                result: input.result ?? null,
+                seq,
+                createdAt: createdAt.toISOString(),
+                prevHash,
+            });
+            const [inserted] = await tx
+                .insert(auditLog)
+                .values({ ...input, id, seq, prevHash, createdAt, hash })
+                .returning();
+            return inserted;
+        }));
+        return toDto(row);
+    }
+    async list(filters) {
+        const db = this.drizzle.db;
+        const { page, limit } = filters;
+        const offset = pageToOffset(page, limit);
+        const where = buildWhere(filters);
+        const [rows, countResult] = await Promise.all([
+            db
+                .select()
+                .from(auditLog)
+                .where(where)
+                .orderBy(desc(auditLog.seq))
+                .limit(limit)
+                .offset(offset),
+            db
+                .select({ count: sql `count(*)::int` })
+                .from(auditLog)
+                .where(where),
+        ]);
+        return {
+            items: rows.map(toDto),
+            total: countResult[0]?.count ?? 0,
+            page,
+            limit,
+        };
+    }
+    // Hard cap to prevent unbounded bulk extraction / OOM; exports exceeding it are
+    // truncated to the latest rows. Use verifyChain for full-chain integrity.
+    static EXPORT_MAX_ROWS = 50_000;
+    async exportCsv(filters) {
+        const db = this.drizzle.db;
+        const where = buildWhere(filters);
+        const rows = await db
+            .select()
+            .from(auditLog)
+            .where(where)
+            .orderBy(auditLog.seq)
+            .limit(AuditService.EXPORT_MAX_ROWS);
+        const header = 'id,actorId,actorType,action,resourceType,resourceId,ip,correlationId,result,seq,prevHash,hash,createdAt';
+        const lines = rows.map((r) => [
+            r.id,
+            r.actorId ?? '',
+            r.actorType,
+            r.action,
+            r.resourceType,
+            r.resourceId ?? '',
+            r.ip ?? '',
+            r.correlationId ?? '',
+            r.result ?? '',
+            r.seq,
+            r.prevHash ?? '',
+            r.hash,
+            r.createdAt.toISOString(),
+        ]
+            .map((v) => `"${String(v).replace(/"/g, '""')}"`)
+            .join(','));
+        return [header, ...lines].join('\n');
+    }
+    async verifyChain() {
+        const rows = await this.drizzle.db.select().from(auditLog).orderBy(auditLog.seq);
+        let expectedPrevHash = null;
+        for (const row of rows) {
+            if (row.prevHash !== expectedPrevHash) {
+                return { valid: false, firstBrokenSeq: row.seq, rowId: row.id };
+            }
+            const expected = computeHash({
+                id: row.id,
+                actorId: row.actorId ?? null,
+                actorType: row.actorType,
+                action: row.action,
+                resourceType: row.resourceType,
+                resourceId: row.resourceId ?? null,
+                before: row.before ?? null,
+                after: row.after ?? null,
+                result: row.result ?? null,
+                seq: row.seq,
+                createdAt: row.createdAt.toISOString(),
+                prevHash: row.prevHash ?? null,
+            });
+            if (row.hash !== expected) {
+                return { valid: false, firstBrokenSeq: row.seq, rowId: row.id };
+            }
+            expectedPrevHash = row.hash;
+        }
+        return { valid: true };
+    }
+}
+//# sourceMappingURL=audit.service.js.map

package/dist/audit/service/audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../../src/audit/service/audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAEL,YAAY,EACZ,YAAY,EACZ,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,QAAQ,EAAiB,MAAM,oBAAoB,CAAC;AAqB7D,SAAS,kBAAkB,CAAC,MAA0B;IACpD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC7B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,oFAAoF;AACpF,+EAA+E;AAC/E,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2B;IAC7C,MAAM,EACJ,OAAO,EACP,SAAS,EACT,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,CAAC,EACD,QAAQ,EACR,MAAM,GACP,GAAG,OAAO,CAAC;IACZ,OAAO,GAAG,CACR,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EACnD,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAkC,CAAC,CAAC,CAAC,CAAC,SAAS,EAClF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAChD,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAC1E,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,EAClE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAC5D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EACvE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAClE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/D,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAMlF,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,OAAuB,EACvB,MAAgB;QADhB,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAU;IAChC,CAAC;IAEJ,+EAA+E;IAC/E,6EAA6E;IAC7E,gEAAgE;IAChE,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CACnD,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;iBAC/B,IAAI,CAAC,QAAQ,CAAC;iBACd,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;YAEtC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAChC,GAAG,CAAA,mEAAmE,CACvE,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YAE9C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAE7B,MAAM,IAAI,GAAG,WAAW,CAAC;gBACvB,EAAE;gBACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAC5B,GAAG;gBACH,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBACxD,SAAS,EAAE,CAAC;YAEf,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAyB;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,EAAE;iBACC,MAAM,EAAE;iBACR,IAAI,CAAC,QAAQ,CAAC;iBACd,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBAC3B,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,MAAM,CAAC;YACjB,EAAE;iBACC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC;iBAC7C,IAAI,CAAC,QAAQ,CAAC;iBACd,KAAK,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACtB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;YACjC,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,0EAA0E;IAC1E,MAAM,CAAU,eAAe,GAAG,MAAM,CAAC;IAEzC,KAAK,CAAC,SAAS,CAAC,OAA2B;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,KAAK,CAAC;aACZ,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;aACrB,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;QAEvC,MAAM,MAAM,GACV,yGAAyG,CAAC;QAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3B;YACE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,OAAO,IAAI,EAAE;YACf,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,UAAU,IAAI,EAAE;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE;YACV,CAAC,CAAC,aAAa,IAAI,EAAE;YACrB,CAAC,CAAC,MAAM,IAAI,EAAE;YACd,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,QAAQ,IAAI,EAAE;YAChB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;SAC1B;aACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAChD,IAAI,CAAC,GAAG,CAAC,CACb,CAAC;QAEF,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QAGf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEjF,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YAClE,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC;gBAC3B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;gBAClC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;gBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;gBAC1B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;gBACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;aAC/B,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YAClE,CAAC;YAED,gBAAgB,GAAG,GAAG,CAAC,IAAI,CAAC;QAC9B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC"}

package/dist/casino/contracts.d.ts

@@ -0,0 +1,3 @@
+export * as gaming from './gaming/contract/index.js';
+export * as lobby from './lobby/contract/index.js';
+//# sourceMappingURL=contracts.d.ts.map

package/dist/casino/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/casino/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC"}

package/dist/casino/contracts.js

@@ -0,0 +1,3 @@
+export * as gaming from './gaming/contract/index.js';
+export * as lobby from './lobby/contract/index.js';
+//# sourceMappingURL=contracts.js.map

package/dist/casino/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/casino/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC"}

package/dist/casino/gaming/__tests__/gaming.service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gaming.service.test.d.ts.map

package/dist/casino/gaming/__tests__/gaming.service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gaming.service.test.d.ts","sourceRoot":"","sources":["../../../../src/casino/gaming/__tests__/gaming.service.test.ts"],"names":[],"mappings":""}