@parmanasystems/audit-db 1.5.0 → 1.9.0

package/dist/index.d.ts

@@ -103,13 +103,9 @@ declare class AuditDb {
     ping(): Promise<void>;
     disconnect(): Promise<void>;
     migrate(): Promise<void>;
-    /** Fire-and-forget — never throws, never delays the caller. */
     recordDecision(attestation: ExecutionAttestation): void;
-    /** Fire-and-forget — never throws, never delays the caller. */
     recordVerification(executionId: string, result: VerificationResult): void;
-    /** Fire-and-forget — never throws, never delays the caller. */
     recordSecurityEvent(event: SecurityEventInput): void;
-    /** Fire-and-forget — never throws, never delays the caller. */
     recordApiAccess(access: ApiAccessInput): void;
     getDecisionTimeline(limit?: number, filter?: DecisionFilter): Promise<DecisionTimelineRow[]>;
     getStats(): Promise<AuditStats>;
@@ -118,6 +114,9 @@ declare class AuditDb {
     getSecurityDashboard(): Promise<SecurityDashboardRow[]>;
     hasExecution(executionId: string): Promise<boolean>;
     storePendingExecution(attestation: ExecutionAttestation): Promise<void>;
+    set(key: string, value: string): Promise<void>;
+    get(key: string): Promise<string | null>;
+    markExecuted(executionId: string): Promise<void>;
     close(): Promise<void>;
 }
 

package/dist/index.js

@@ -124,10 +124,14 @@ async function runMigrations(client) {
 var AuditDb = class {
   pool;
   constructor(connectionString) {
-    this.pool = new Pool({ connectionString });
+    this.pool = new Pool({
+      connectionString
+    });
   }
   async ping() {
-    await this.pool.query("SELECT 1");
+    await this.pool.query(
+      "SELECT 1"
+    );
   }
   async disconnect() {
     await this.pool.end();
@@ -135,19 +139,34 @@ var AuditDb = class {
   async migrate() {
     const client = await this.pool.connect();
     try {
-      await runMigrations(client);
+      await runMigrations(
+        client
+      );
     } finally {
       client.release();
     }
   }
-  /** Fire-and-forget — never throws, never delays the caller. */
+  // ----------------------------------
+  // Decision recording
+  // ----------------------------------
   recordDecision(attestation) {
     this.pool.query(
-      `INSERT INTO audit_decisions
-          (execution_id, decision, execution_state,
-           runtime_hash, signature, attestation, executed_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7)
-         ON CONFLICT (execution_id) DO NOTHING`,
+      `
+        INSERT INTO audit_decisions
+          (
+            execution_id,
+            decision,
+            execution_state,
+            runtime_hash,
+            signature,
+            attestation,
+            executed_at
+          )
+        VALUES ($1,$2,$3,$4,$5,$6,$7)
+
+        ON CONFLICT (execution_id)
+        DO NOTHING
+        `,
       [
         attestation.execution_id,
         attestation.decision,
@@ -159,12 +178,22 @@ var AuditDb = class {
       ]
     ).catch(() => void 0);
   }
-  /** Fire-and-forget — never throws, never delays the caller. */
+  // ----------------------------------
+  // Verification recording
+  // ----------------------------------
   recordVerification(executionId, result) {
     this.pool.query(
-      `INSERT INTO audit_verifications
-          (execution_id, valid, signature_verified, runtime_verified, schema_compatible)
-         VALUES ($1,$2,$3,$4,$5)`,
+      `
+        INSERT INTO audit_verifications
+          (
+            execution_id,
+            valid,
+            signature_verified,
+            runtime_verified,
+            schema_compatible
+          )
+        VALUES ($1,$2,$3,$4,$5)
+        `,
       [
         executionId,
         result.valid,
@@ -174,12 +203,24 @@ var AuditDb = class {
       ]
     ).catch(() => void 0);
   }
-  /** Fire-and-forget — never throws, never delays the caller. */
+  // ----------------------------------
+  // Security event recording
+  // ----------------------------------
   recordSecurityEvent(event) {
     this.pool.query(
-      `INSERT INTO audit_security_events
-          (event_type, severity, ip_address, path, method, user_agent, details)
-         VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+      `
+        INSERT INTO audit_security_events
+          (
+            event_type,
+            severity,
+            ip_address,
+            path,
+            method,
+            user_agent,
+            details
+          )
+        VALUES ($1,$2,$3,$4,$5,$6,$7)
+        `,
       [
         event.event_type,
         event.severity,
@@ -191,12 +232,24 @@ var AuditDb = class {
       ]
     ).catch(() => void 0);
   }
-  /** Fire-and-forget — never throws, never delays the caller. */
+  // ----------------------------------
+  // API access recording
+  // ----------------------------------
   recordApiAccess(access) {
     this.pool.query(
-      `INSERT INTO audit_api_access
-          (method, path, status_code, response_time_ms, ip_address, user_agent, execution_id)
-         VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+      `
+        INSERT INTO audit_api_access
+          (
+            method,
+            path,
+            status_code,
+            response_time_ms,
+            ip_address,
+            user_agent,
+            execution_id
+          )
+        VALUES ($1,$2,$3,$4,$5,$6,$7)
+        `,
       [
         access.method,
         access.path,
@@ -208,98 +261,196 @@ var AuditDb = class {
       ]
     ).catch(() => void 0);
   }
+  // ----------------------------------
+  // Decision timeline
+  // ----------------------------------
   async getDecisionTimeline(limit = 100, filter) {
     const conditions = [];
     const values = [];
     if (filter?.policy_id) {
-      values.push(filter.policy_id);
-      conditions.push(`policy_id = $${values.length}`);
+      values.push(
+        filter.policy_id
+      );
+      conditions.push(
+        `policy_id = $${values.length}`
+      );
     }
     if (filter?.decision) {
-      values.push(filter.decision);
-      conditions.push(`decision = $${values.length}`);
+      values.push(
+        filter.decision
+      );
+      conditions.push(
+        `decision = $${values.length}`
+      );
     }
     if (filter?.from_date) {
-      values.push(filter.from_date);
-      conditions.push(`executed_at >= $${values.length}`);
+      values.push(
+        filter.from_date
+      );
+      conditions.push(
+        `executed_at >= $${values.length}`
+      );
     }
     if (filter?.to_date) {
-      values.push(filter.to_date);
-      conditions.push(`executed_at <= $${values.length}`);
+      values.push(
+        filter.to_date
+      );
+      conditions.push(
+        `executed_at <= $${values.length}`
+      );
     }
     values.push(limit);
     const limitParam = `$${values.length}`;
     const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
     const { rows } = await this.pool.query(
-      `SELECT * FROM view_decision_timeline ${where} ORDER BY executed_at DESC LIMIT ${limitParam}`,
+      `
+        SELECT *
+        FROM view_decision_timeline
+
+        ${where}
+
+        ORDER BY executed_at DESC
+
+        LIMIT ${limitParam}
+        `,
       values
     );
     return rows;
   }
+  // ----------------------------------
+  // Stats
+  // ----------------------------------
   async getStats() {
-    const { rows } = await this.pool.query(`
-      SELECT
-        (SELECT COUNT(*) FROM audit_decisions)::text AS total_decisions,
-        (SELECT COUNT(*) FROM audit_decisions WHERE executed_at >= CURRENT_DATE)::text AS decisions_today,
-        (SELECT COUNT(*) FROM audit_verifications)::text AS total_verifications,
-        (SELECT COUNT(*) FROM audit_verifications WHERE valid = true)::text AS valid_verifications,
-        (SELECT COUNT(*) FROM audit_verifications WHERE valid = false)::text AS invalid_verifications,
-        (SELECT COUNT(*) FROM audit_security_events)::text AS total_security_events,
-        (SELECT COUNT(*) FROM audit_api_access)::text AS total_api_calls
-    `);
+    const { rows } = await this.pool.query(
+      `
+        SELECT
+
+          (
+            SELECT COUNT(*)
+            FROM audit_decisions
+          )::text AS total_decisions,
+
+          (
+            SELECT COUNT(*)
+            FROM audit_decisions
+            WHERE executed_at >= CURRENT_DATE
+          )::text AS decisions_today,
+
+          (
+            SELECT COUNT(*)
+            FROM audit_verifications
+          )::text AS total_verifications,
+
+          (
+            SELECT COUNT(*)
+            FROM audit_verifications
+            WHERE valid = true
+          )::text AS valid_verifications,
+
+          (
+            SELECT COUNT(*)
+            FROM audit_verifications
+            WHERE valid = false
+          )::text AS invalid_verifications,
+
+          (
+            SELECT COUNT(*)
+            FROM audit_security_events
+          )::text AS total_security_events,
+
+          (
+            SELECT COUNT(*)
+            FROM audit_api_access
+          )::text AS total_api_calls
+        `
+    );
     return rows[0];
   }
+  // ----------------------------------
+  // Decision lookup
+  // ----------------------------------
   async getDecisionById(executionId) {
     const { rows } = await this.pool.query(
-      `SELECT * FROM audit_decisions WHERE execution_id = $1`,
+      `
+        SELECT *
+        FROM audit_decisions
+        WHERE execution_id = $1
+        `,
       [executionId]
     );
     return rows[0] ?? null;
   }
+  // ----------------------------------
+  // Verification lookup
+  // ----------------------------------
   async getVerificationsByExecution(executionId) {
     const { rows } = await this.pool.query(
-      `SELECT * FROM audit_verifications
-       WHERE execution_id = $1
-       ORDER BY verified_at DESC`,
+      `
+        SELECT *
+        FROM audit_verifications
+
+        WHERE execution_id = $1
+
+        ORDER BY verified_at DESC
+        `,
       [executionId]
     );
     return rows;
   }
+  // ----------------------------------
+  // Security dashboard
+  // ----------------------------------
   async getSecurityDashboard() {
     const { rows } = await this.pool.query(
-      `SELECT * FROM view_security_dashboard ORDER BY event_count DESC`
+      `
+        SELECT *
+        FROM view_security_dashboard
+
+        ORDER BY event_count DESC
+        `
     );
     return rows;
   }
+  // ----------------------------------
+  // Replay protection
+  // ----------------------------------
   async hasExecution(executionId) {
     const { rows } = await this.pool.query(
       `
-      SELECT execution_id
-      FROM audit_decisions
-      WHERE execution_id = $1
-      LIMIT 1
-      `,
+        SELECT execution_id
+
+        FROM audit_decisions
+
+        WHERE execution_id = $1
+
+        LIMIT 1
+        `,
       [executionId]
     );
     return rows.length > 0;
   }
+  // ----------------------------------
+  // Pending override storage
+  // ----------------------------------
   async storePendingExecution(attestation) {
     await this.pool.query(
       `
-    INSERT INTO audit_decisions
-      (
-        execution_id,
-        decision,
-        execution_state,
-        runtime_hash,
-        signature,
-        attestation,
-        executed_at
-      )
-    VALUES ($1,$2,$3,$4,$5,$6,$7)
-    ON CONFLICT (execution_id)
-    DO NOTHING
-    `,
+      INSERT INTO audit_decisions
+        (
+          execution_id,
+          decision,
+          execution_state,
+          runtime_hash,
+          signature,
+          attestation,
+          executed_at
+        )
+
+      VALUES ($1,$2,$3,$4,$5,$6,$7)
+
+      ON CONFLICT (execution_id)
+      DO NOTHING
+      `,
       [
         attestation.execution_id,
         attestation.decision,
@@ -311,6 +462,82 @@ var AuditDb = class {
       ]
     );
   }
+  // ----------------------------------
+  // Redis-compatible KV set
+  // ----------------------------------
+  async set(key, value) {
+    const executionId = key.replace(
+      "pending:",
+      ""
+    );
+    await this.pool.query(
+      `
+      INSERT INTO audit_decisions
+        (
+          execution_id,
+          decision,
+          execution_state,
+          attestation,
+          executed_at
+        )
+
+      VALUES ($1,$2,$3,$4,$5)
+
+      ON CONFLICT (execution_id)
+      DO NOTHING
+      `,
+      [
+        executionId,
+        {},
+        "pending_override",
+        value,
+        (/* @__PURE__ */ new Date()).toISOString()
+      ]
+    );
+  }
+  // ----------------------------------
+  // Redis-compatible KV get
+  // ----------------------------------
+  async get(key) {
+    const executionId = key.replace(
+      "pending:",
+      ""
+    );
+    const { rows } = await this.pool.query(
+      `
+        SELECT attestation
+
+        FROM audit_decisions
+
+        WHERE execution_id = $1
+
+        LIMIT 1
+        `,
+      [executionId]
+    );
+    if (rows.length === 0) {
+      return null;
+    }
+    return rows[0].attestation;
+  }
+  // ----------------------------------
+  // Completed execution marking
+  // ----------------------------------
+  async markExecuted(executionId) {
+    await this.pool.query(
+      `
+      UPDATE audit_decisions
+
+      SET execution_state = 'completed'
+
+      WHERE execution_id = $1
+      `,
+      [executionId]
+    );
+  }
+  // ----------------------------------
+  // Cleanup
+  // ----------------------------------
   async close() {
     await this.pool.end();
   }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/migrations.ts"],"sourcesContent":["import { Pool } from \"pg\";\r\nimport type { PoolClient } from \"pg\";\r\n\r\nimport type { ExecutionAttestation } from \"@parmanasystems/execution\";\r\nimport type { VerificationResult } from \"@parmanasystems/verifier\";\r\n\r\nimport type {\r\n  AuditDecision,\r\n  AuditVerification,\r\n  SecurityEventInput,\r\n  ApiAccessInput,\r\n  DecisionTimelineRow,\r\n  DecisionFilter,\r\n  SecurityDashboardRow,\r\n  AuditStats,\r\n} from \"./types.js\";\r\nimport { runMigrations } from \"./migrations.js\";\r\n\r\nexport class AuditDb {\r\n  private readonly pool: InstanceType<typeof Pool>;\r\n\r\n  constructor(connectionString: string) {\r\n    this.pool = new Pool({ connectionString });\r\n  }\r\n\r\n  async ping(): Promise<void> {\r\n    await this.pool.query(\"SELECT 1\");\r\n  }\r\n\r\n  async disconnect(): Promise<void> {\r\n    await this.pool.end();\r\n  }\r\n\r\n  async migrate(): Promise<void> {\r\n    const client: PoolClient = await this.pool.connect();\r\n    try {\r\n      await runMigrations(client);\r\n    } finally {\r\n      client.release();\r\n    }\r\n  }\r\n\r\n  /** Fire-and-forget — never throws, never delays the caller. */\r\n  recordDecision(attestation: ExecutionAttestation): void {\r\n    this.pool\r\n      .query(\r\n        `INSERT INTO audit_decisions\r\n          (execution_id, decision, execution_state,\r\n           runtime_hash, signature, attestation, executed_at)\r\n         VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n         ON CONFLICT (execution_id) DO NOTHING`,\r\n        [\r\n          attestation.execution_id,\r\n          attestation.decision,\r\n          attestation.execution_state,\r\n          attestation.runtime_hash,\r\n          attestation.signature,\r\n          JSON.stringify(attestation),\r\n          new Date().toISOString(),\r\n        ],\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  /** Fire-and-forget — never throws, never delays the caller. */\r\n  recordVerification(executionId: string, result: VerificationResult): void {\r\n    this.pool\r\n      .query(\r\n        `INSERT INTO audit_verifications\r\n          (execution_id, valid, signature_verified, runtime_verified, schema_compatible)\r\n         VALUES ($1,$2,$3,$4,$5)`,\r\n        [\r\n          executionId,\r\n          result.valid,\r\n          result.checks.signature_verified,\r\n          result.checks.runtime_verified,\r\n          result.checks.schema_compatible,\r\n        ],\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  /** Fire-and-forget — never throws, never delays the caller. */\r\n  recordSecurityEvent(event: SecurityEventInput): void {\r\n    this.pool\r\n      .query(\r\n        `INSERT INTO audit_security_events\r\n          (event_type, severity, ip_address, path, method, user_agent, details)\r\n         VALUES ($1,$2,$3,$4,$5,$6,$7)`,\r\n        [\r\n          event.event_type,\r\n          event.severity,\r\n          event.ip_address ?? null,\r\n          event.path ?? null,\r\n          event.method ?? null,\r\n          event.user_agent ?? null,\r\n          event.details != null ? JSON.stringify(event.details) : null,\r\n        ],\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  /** Fire-and-forget — never throws, never delays the caller. */\r\n  recordApiAccess(access: ApiAccessInput): void {\r\n    this.pool\r\n      .query(\r\n        `INSERT INTO audit_api_access\r\n          (method, path, status_code, response_time_ms, ip_address, user_agent, execution_id)\r\n         VALUES ($1,$2,$3,$4,$5,$6,$7)`,\r\n        [\r\n          access.method,\r\n          access.path,\r\n          access.status_code,\r\n          access.response_time_ms ?? null,\r\n          access.ip_address ?? null,\r\n          access.user_agent ?? null,\r\n          access.execution_id ?? null,\r\n        ],\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  async getDecisionTimeline(limit = 100, filter?: DecisionFilter): Promise<DecisionTimelineRow[]> {\r\n    const conditions: string[] = [];\r\n    const values: unknown[] = [];\r\n\r\n    if (filter?.policy_id) {\r\n      values.push(filter.policy_id);\r\n      conditions.push(`policy_id = $${values.length}`);\r\n    }\r\n    if (filter?.decision) {\r\n      values.push(filter.decision);\r\n      conditions.push(`decision = $${values.length}`);\r\n    }\r\n    if (filter?.from_date) {\r\n      values.push(filter.from_date);\r\n      conditions.push(`executed_at >= $${values.length}`);\r\n    }\r\n    if (filter?.to_date) {\r\n      values.push(filter.to_date);\r\n      conditions.push(`executed_at <= $${values.length}`);\r\n    }\r\n\r\n    values.push(limit);\r\n    const limitParam = `$${values.length}`;\r\n    const where = conditions.length ? `WHERE ${conditions.join(\" AND \")}` : \"\";\r\n\r\n    const { rows } = await this.pool.query<DecisionTimelineRow>(\r\n      `SELECT * FROM view_decision_timeline ${where} ORDER BY executed_at DESC LIMIT ${limitParam}`,\r\n      values,\r\n    );\r\n    return rows;\r\n  }\r\n\r\n  async getStats(): Promise<AuditStats> {\r\n    const { rows } = await this.pool.query<AuditStats>(`\r\n      SELECT\r\n        (SELECT COUNT(*) FROM audit_decisions)::text AS total_decisions,\r\n        (SELECT COUNT(*) FROM audit_decisions WHERE executed_at >= CURRENT_DATE)::text AS decisions_today,\r\n        (SELECT COUNT(*) FROM audit_verifications)::text AS total_verifications,\r\n        (SELECT COUNT(*) FROM audit_verifications WHERE valid = true)::text AS valid_verifications,\r\n        (SELECT COUNT(*) FROM audit_verifications WHERE valid = false)::text AS invalid_verifications,\r\n        (SELECT COUNT(*) FROM audit_security_events)::text AS total_security_events,\r\n        (SELECT COUNT(*) FROM audit_api_access)::text AS total_api_calls\r\n    `);\r\n    return rows[0]!;\r\n  }\r\n\r\n  async getDecisionById(executionId: string): Promise<AuditDecision | null> {\r\n    const { rows } = await this.pool.query<AuditDecision>(\r\n      `SELECT * FROM audit_decisions WHERE execution_id = $1`,\r\n      [executionId],\r\n    );\r\n    return rows[0] ?? null;\r\n  }\r\n\r\n  async getVerificationsByExecution(executionId: string): Promise<AuditVerification[]> {\r\n    const { rows } = await this.pool.query<AuditVerification>(\r\n      `SELECT * FROM audit_verifications\r\n       WHERE execution_id = $1\r\n       ORDER BY verified_at DESC`,\r\n      [executionId],\r\n    );\r\n    return rows;\r\n  }\r\n\r\n  async getSecurityDashboard(): Promise<SecurityDashboardRow[]> {\r\n    const { rows } = await this.pool.query<SecurityDashboardRow>(\r\n      `SELECT * FROM view_security_dashboard ORDER BY event_count DESC`,\r\n    );\r\n    return rows;\r\n  }\r\n  async hasExecution(\r\n  executionId: string\r\n): Promise<boolean> {\r\n\r\n  const { rows } =\r\n    await this.pool.query(\r\n      `\r\n      SELECT execution_id\r\n      FROM audit_decisions\r\n      WHERE execution_id = $1\r\n      LIMIT 1\r\n      `,\r\n      [executionId]\r\n    );\r\n\r\n  return rows.length > 0;\r\n}\r\n\r\nasync storePendingExecution(\r\n  attestation: ExecutionAttestation\r\n): Promise<void> {\r\n\r\n  await this.pool.query(\r\n    `\r\n    INSERT INTO audit_decisions\r\n      (\r\n        execution_id,\r\n        decision,\r\n        execution_state,\r\n        runtime_hash,\r\n        signature,\r\n        attestation,\r\n        executed_at\r\n      )\r\n    VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n    ON CONFLICT (execution_id)\r\n    DO NOTHING\r\n    `,\r\n    [\r\n      attestation.execution_id,\r\n      attestation.decision,\r\n      \"pending_override\",\r\n      attestation.runtime_hash,\r\n      attestation.signature,\r\n      JSON.stringify(attestation),\r\n      new Date().toISOString()\r\n    ]\r\n  );\r\n}\r\n  async close(): Promise<void> {\r\n    await this.pool.end();\r\n  }\r\n}\r\n","import type { PoolClient } from \"pg\";\r\n\r\n// Inlined so the bundle has no runtime fs dependency.\r\n// The canonical reference lives in schema.sql alongside this file.\r\nconst SCHEMA_SQL = `\r\nCREATE TABLE IF NOT EXISTS audit_decisions (\r\n  id              BIGSERIAL    PRIMARY KEY,\r\n  execution_id    UUID         NOT NULL UNIQUE,\r\n  policy_id       TEXT         NOT NULL,\r\n  policy_version  TEXT         NOT NULL,\r\n  schema_version  TEXT         NOT NULL,\r\n  runtime_version TEXT         NOT NULL,\r\n  runtime_hash    TEXT         NOT NULL,\r\n  decision        TEXT         NOT NULL,\r\n  signals_hash    TEXT         NOT NULL,\r\n  signature       TEXT         NOT NULL,\r\n  attestation     JSONB        NOT NULL,\r\n  executed_at     TIMESTAMPTZ  NOT NULL,\r\n  recorded_at     TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_policy_id\r\n  ON audit_decisions (policy_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_executed_at\r\n  ON audit_decisions (executed_at DESC);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_decision\r\n  ON audit_decisions (decision);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_verifications (\r\n  id                   BIGSERIAL    PRIMARY KEY,\r\n  execution_id         UUID         NOT NULL,\r\n  valid                BOOLEAN      NOT NULL,\r\n  signature_verified   BOOLEAN      NOT NULL,\r\n  runtime_verified     BOOLEAN      NOT NULL,\r\n  schema_compatible    BOOLEAN      NOT NULL,\r\n  verified_at          TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_execution_id\r\n  ON audit_verifications (execution_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_valid\r\n  ON audit_verifications (valid);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_verified_at\r\n  ON audit_verifications (verified_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_security_events (\r\n  id           BIGSERIAL    PRIMARY KEY,\r\n  event_type   TEXT         NOT NULL,\r\n  severity     TEXT         NOT NULL CHECK (severity IN ('low','medium','high','critical')),\r\n  ip_address   TEXT,\r\n  path         TEXT,\r\n  method       TEXT,\r\n  user_agent   TEXT,\r\n  details      JSONB,\r\n  occurred_at  TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_event_type\r\n  ON audit_security_events (event_type);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_severity\r\n  ON audit_security_events (severity);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_occurred_at\r\n  ON audit_security_events (occurred_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_api_access (\r\n  id               BIGSERIAL    PRIMARY KEY,\r\n  method           TEXT         NOT NULL,\r\n  path             TEXT         NOT NULL,\r\n  status_code      INTEGER      NOT NULL,\r\n  response_time_ms INTEGER,\r\n  ip_address       TEXT,\r\n  user_agent       TEXT,\r\n  execution_id     UUID,\r\n  accessed_at      TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_path\r\n  ON audit_api_access (path);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_status_code\r\n  ON audit_api_access (status_code);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_accessed_at\r\n  ON audit_api_access (accessed_at DESC);\r\n\r\nCREATE OR REPLACE VIEW view_decision_timeline AS\r\nSELECT\r\n  d.execution_id,\r\n  d.policy_id,\r\n  d.policy_version,\r\n  d.decision,\r\n  d.runtime_version,\r\n  d.runtime_hash,\r\n  d.executed_at,\r\n  d.recorded_at,\r\n  v.valid              AS verification_valid,\r\n  v.signature_verified,\r\n  v.runtime_verified,\r\n  v.schema_compatible,\r\n  v.verified_at\r\nFROM  audit_decisions d\r\nLEFT  JOIN audit_verifications v ON d.execution_id = v.execution_id;\r\n\r\nCREATE OR REPLACE VIEW view_security_dashboard AS\r\nSELECT\r\n  event_type,\r\n  severity,\r\n  COUNT(*)         AS event_count,\r\n  MAX(occurred_at) AS last_occurrence,\r\n  MIN(occurred_at) AS first_occurrence\r\nFROM  audit_security_events\r\nGROUP BY event_type, severity;\r\n`;\r\n\r\nexport async function runMigrations(client: PoolClient): Promise<void> {\r\n  await client.query(\"BEGIN\");\r\n  try {\r\n    await client.query(SCHEMA_SQL);\r\n    await client.query(\"COMMIT\");\r\n  } catch (err) {\r\n    await client.query(\"ROLLBACK\");\r\n    throw err;\r\n  }\r\n}\r\n"],"mappings":";AAAA,SAAS,YAAY;;;ACIrB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4GnB,eAAsB,cAAc,QAAmC;AACrE,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM,OAAO,MAAM,QAAQ;AAAA,EAC7B,SAAS,KAAK;AACZ,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM;AAAA,EACR;AACF;;;ADvGO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EAEjB,YAAY,kBAA0B;AACpC,SAAK,OAAO,IAAI,KAAK,EAAE,iBAAiB,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,KAAK,KAAK,MAAM,UAAU;AAAA,EAClC;AAAA,EAEA,MAAM,aAA4B;AAChC,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AAAA,EAEA,MAAM,UAAyB;AAC7B,UAAM,SAAqB,MAAM,KAAK,KAAK,QAAQ;AACnD,QAAI;AACF,YAAM,cAAc,MAAM;AAAA,IAC5B,UAAE;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,eAAe,aAAyC;AACtD,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,mBAAmB,aAAqB,QAAkC;AACxE,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,OAAO;AAAA,QACP,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,MAChB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,oBAAoB,OAAiC;AACnD,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd,MAAM,UAAU;AAAA,QAChB,MAAM,cAAc;AAAA,QACpB,MAAM,WAAW,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI;AAAA,MAC1D;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,gBAAgB,QAA8B;AAC5C,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO,oBAAoB;AAAA,QAC3B,OAAO,cAAc;AAAA,QACrB,OAAO,cAAc;AAAA,QACrB,OAAO,gBAAgB;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA,EAEA,MAAM,oBAAoB,QAAQ,KAAK,QAAyD;AAC9F,UAAM,aAAuB,CAAC;AAC9B,UAAM,SAAoB,CAAC;AAE3B,QAAI,QAAQ,WAAW;AACrB,aAAO,KAAK,OAAO,SAAS;AAC5B,iBAAW,KAAK,gBAAgB,OAAO,MAAM,EAAE;AAAA,IACjD;AACA,QAAI,QAAQ,UAAU;AACpB,aAAO,KAAK,OAAO,QAAQ;AAC3B,iBAAW,KAAK,eAAe,OAAO,MAAM,EAAE;AAAA,IAChD;AACA,QAAI,QAAQ,WAAW;AACrB,aAAO,KAAK,OAAO,SAAS;AAC5B,iBAAW,KAAK,mBAAmB,OAAO,MAAM,EAAE;AAAA,IACpD;AACA,QAAI,QAAQ,SAAS;AACnB,aAAO,KAAK,OAAO,OAAO;AAC1B,iBAAW,KAAK,mBAAmB,OAAO,MAAM,EAAE;AAAA,IACpD;AAEA,WAAO,KAAK,KAAK;AACjB,UAAM,aAAa,IAAI,OAAO,MAAM;AACpC,UAAM,QAAQ,WAAW,SAAS,SAAS,WAAW,KAAK,OAAO,CAAC,KAAK;AAExE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B,wCAAwC,KAAK,oCAAoC,UAAU;AAAA,MAC3F;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAgC;AACpC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KASlD;AACD,WAAO,KAAK,CAAC;AAAA,EACf;AAAA,EAEA,MAAM,gBAAgB,aAAoD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,KAAK,CAAC,KAAK;AAAA,EACpB;AAAA,EAEA,MAAM,4BAA4B,aAAmD;AACnF,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAwD;AAC5D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,aACN,aACkB;AAElB,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,WAAW;AAAA,IACd;AAEF,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,MAAM,sBACJ,aACe;AAEf,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA,EACE,MAAM,QAAuB;AAC3B,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACF;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/migrations.ts"],"sourcesContent":["import { Pool } from \"pg\";\r\nimport type { PoolClient } from \"pg\";\r\n\r\nimport type { ExecutionAttestation } from \"@parmanasystems/execution\";\r\nimport type { VerificationResult } from \"@parmanasystems/verifier\";\r\n\r\nimport type {\r\n  AuditDecision,\r\n  AuditVerification,\r\n  SecurityEventInput,\r\n  ApiAccessInput,\r\n  DecisionTimelineRow,\r\n  DecisionFilter,\r\n  SecurityDashboardRow,\r\n  AuditStats,\r\n} from \"./types.js\";\r\n\r\nimport { runMigrations } from \"./migrations.js\";\r\n\r\nexport class AuditDb {\r\n\r\n  private readonly pool:\r\n    InstanceType<typeof Pool>;\r\n\r\n  constructor(\r\n    connectionString: string\r\n  ) {\r\n\r\n    this.pool =\r\n      new Pool({\r\n        connectionString\r\n      });\r\n  }\r\n\r\n  async ping(): Promise<void> {\r\n\r\n    await this.pool.query(\r\n      \"SELECT 1\"\r\n    );\r\n  }\r\n\r\n  async disconnect(): Promise<void> {\r\n\r\n    await this.pool.end();\r\n  }\r\n\r\n  async migrate(): Promise<void> {\r\n\r\n    const client:\r\n      PoolClient =\r\n        await this.pool.connect();\r\n\r\n    try {\r\n\r\n      await runMigrations(\r\n        client\r\n      );\r\n\r\n    } finally {\r\n\r\n      client.release();\r\n    }\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Decision recording\r\n  // ----------------------------------\r\n\r\n  recordDecision(\r\n    attestation: ExecutionAttestation\r\n  ): void {\r\n\r\n    this.pool\r\n      .query(\r\n        `\r\n        INSERT INTO audit_decisions\r\n          (\r\n            execution_id,\r\n            decision,\r\n            execution_state,\r\n            runtime_hash,\r\n            signature,\r\n            attestation,\r\n            executed_at\r\n          )\r\n        VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n\r\n        ON CONFLICT (execution_id)\r\n        DO NOTHING\r\n        `,\r\n        [\r\n          attestation.execution_id,\r\n          attestation.decision,\r\n          attestation.execution_state,\r\n          attestation.runtime_hash,\r\n          attestation.signature,\r\n          JSON.stringify(attestation),\r\n          new Date().toISOString()\r\n        ]\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Verification recording\r\n  // ----------------------------------\r\n\r\n  recordVerification(\r\n    executionId: string,\r\n    result: VerificationResult\r\n  ): void {\r\n\r\n    this.pool\r\n      .query(\r\n        `\r\n        INSERT INTO audit_verifications\r\n          (\r\n            execution_id,\r\n            valid,\r\n            signature_verified,\r\n            runtime_verified,\r\n            schema_compatible\r\n          )\r\n        VALUES ($1,$2,$3,$4,$5)\r\n        `,\r\n        [\r\n          executionId,\r\n          result.valid,\r\n          result.checks.signature_verified,\r\n          result.checks.runtime_verified,\r\n          result.checks.schema_compatible\r\n        ]\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Security event recording\r\n  // ----------------------------------\r\n\r\n  recordSecurityEvent(\r\n    event: SecurityEventInput\r\n  ): void {\r\n\r\n    this.pool\r\n      .query(\r\n        `\r\n        INSERT INTO audit_security_events\r\n          (\r\n            event_type,\r\n            severity,\r\n            ip_address,\r\n            path,\r\n            method,\r\n            user_agent,\r\n            details\r\n          )\r\n        VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n        `,\r\n        [\r\n          event.event_type,\r\n          event.severity,\r\n          event.ip_address ?? null,\r\n          event.path ?? null,\r\n          event.method ?? null,\r\n          event.user_agent ?? null,\r\n\r\n          event.details != null\r\n            ? JSON.stringify(event.details)\r\n            : null\r\n        ]\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  // ----------------------------------\r\n  // API access recording\r\n  // ----------------------------------\r\n\r\n  recordApiAccess(\r\n    access: ApiAccessInput\r\n  ): void {\r\n\r\n    this.pool\r\n      .query(\r\n        `\r\n        INSERT INTO audit_api_access\r\n          (\r\n            method,\r\n            path,\r\n            status_code,\r\n            response_time_ms,\r\n            ip_address,\r\n            user_agent,\r\n            execution_id\r\n          )\r\n        VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n        `,\r\n        [\r\n          access.method,\r\n          access.path,\r\n          access.status_code,\r\n          access.response_time_ms ?? null,\r\n          access.ip_address ?? null,\r\n          access.user_agent ?? null,\r\n          access.execution_id ?? null\r\n        ]\r\n      )\r\n      .catch(() => undefined);\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Decision timeline\r\n  // ----------------------------------\r\n\r\n  async getDecisionTimeline(\r\n    limit = 100,\r\n    filter?: DecisionFilter\r\n  ): Promise<DecisionTimelineRow[]> {\r\n\r\n    const conditions: string[] = [];\r\n\r\n    const values: unknown[] = [];\r\n\r\n    if (filter?.policy_id) {\r\n\r\n      values.push(\r\n        filter.policy_id\r\n      );\r\n\r\n      conditions.push(\r\n        `policy_id = $${values.length}`\r\n      );\r\n    }\r\n\r\n    if (filter?.decision) {\r\n\r\n      values.push(\r\n        filter.decision\r\n      );\r\n\r\n      conditions.push(\r\n        `decision = $${values.length}`\r\n      );\r\n    }\r\n\r\n    if (filter?.from_date) {\r\n\r\n      values.push(\r\n        filter.from_date\r\n      );\r\n\r\n      conditions.push(\r\n        `executed_at >= $${values.length}`\r\n      );\r\n    }\r\n\r\n    if (filter?.to_date) {\r\n\r\n      values.push(\r\n        filter.to_date\r\n      );\r\n\r\n      conditions.push(\r\n        `executed_at <= $${values.length}`\r\n      );\r\n    }\r\n\r\n    values.push(limit);\r\n\r\n    const limitParam =\r\n      `$${values.length}`;\r\n\r\n    const where =\r\n      conditions.length\r\n        ? `WHERE ${conditions.join(\" AND \")}`\r\n        : \"\";\r\n\r\n    const { rows } =\r\n      await this.pool.query<DecisionTimelineRow>(\r\n        `\r\n        SELECT *\r\n        FROM view_decision_timeline\r\n\r\n        ${where}\r\n\r\n        ORDER BY executed_at DESC\r\n\r\n        LIMIT ${limitParam}\r\n        `,\r\n        values\r\n      );\r\n\r\n    return rows;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Stats\r\n  // ----------------------------------\r\n\r\n  async getStats(): Promise<AuditStats> {\r\n\r\n    const { rows } =\r\n      await this.pool.query<AuditStats>(\r\n        `\r\n        SELECT\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_decisions\r\n          )::text AS total_decisions,\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_decisions\r\n            WHERE executed_at >= CURRENT_DATE\r\n          )::text AS decisions_today,\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_verifications\r\n          )::text AS total_verifications,\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_verifications\r\n            WHERE valid = true\r\n          )::text AS valid_verifications,\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_verifications\r\n            WHERE valid = false\r\n          )::text AS invalid_verifications,\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_security_events\r\n          )::text AS total_security_events,\r\n\r\n          (\r\n            SELECT COUNT(*)\r\n            FROM audit_api_access\r\n          )::text AS total_api_calls\r\n        `\r\n      );\r\n\r\n    return rows[0]!;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Decision lookup\r\n  // ----------------------------------\r\n\r\n  async getDecisionById(\r\n    executionId: string\r\n  ): Promise<AuditDecision | null> {\r\n\r\n    const { rows } =\r\n      await this.pool.query<AuditDecision>(\r\n        `\r\n        SELECT *\r\n        FROM audit_decisions\r\n        WHERE execution_id = $1\r\n        `,\r\n        [executionId]\r\n      );\r\n\r\n    return rows[0] ?? null;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Verification lookup\r\n  // ----------------------------------\r\n\r\n  async getVerificationsByExecution(\r\n    executionId: string\r\n  ): Promise<AuditVerification[]> {\r\n\r\n    const { rows } =\r\n      await this.pool.query<AuditVerification>(\r\n        `\r\n        SELECT *\r\n        FROM audit_verifications\r\n\r\n        WHERE execution_id = $1\r\n\r\n        ORDER BY verified_at DESC\r\n        `,\r\n        [executionId]\r\n      );\r\n\r\n    return rows;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Security dashboard\r\n  // ----------------------------------\r\n\r\n  async getSecurityDashboard():\r\n    Promise<SecurityDashboardRow[]> {\r\n\r\n    const { rows } =\r\n      await this.pool.query<SecurityDashboardRow>(\r\n        `\r\n        SELECT *\r\n        FROM view_security_dashboard\r\n\r\n        ORDER BY event_count DESC\r\n        `\r\n      );\r\n\r\n    return rows;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Replay protection\r\n  // ----------------------------------\r\n\r\n  async hasExecution(\r\n    executionId: string\r\n  ): Promise<boolean> {\r\n\r\n    const { rows } =\r\n      await this.pool.query(\r\n        `\r\n        SELECT execution_id\r\n\r\n        FROM audit_decisions\r\n\r\n        WHERE execution_id = $1\r\n\r\n        LIMIT 1\r\n        `,\r\n        [executionId]\r\n      );\r\n\r\n    return rows.length > 0;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Pending override storage\r\n  // ----------------------------------\r\n\r\n  async storePendingExecution(\r\n    attestation: ExecutionAttestation\r\n  ): Promise<void> {\r\n\r\n    await this.pool.query(\r\n      `\r\n      INSERT INTO audit_decisions\r\n        (\r\n          execution_id,\r\n          decision,\r\n          execution_state,\r\n          runtime_hash,\r\n          signature,\r\n          attestation,\r\n          executed_at\r\n        )\r\n\r\n      VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n\r\n      ON CONFLICT (execution_id)\r\n      DO NOTHING\r\n      `,\r\n      [\r\n        attestation.execution_id,\r\n        attestation.decision,\r\n        \"pending_override\",\r\n        attestation.runtime_hash,\r\n        attestation.signature,\r\n        JSON.stringify(attestation),\r\n        new Date().toISOString()\r\n      ]\r\n    );\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Redis-compatible KV set\r\n  // ----------------------------------\r\n\r\n  async set(\r\n    key: string,\r\n    value: string\r\n  ): Promise<void> {\r\n\r\n    const executionId =\r\n      key.replace(\r\n        \"pending:\",\r\n        \"\"\r\n      );\r\n\r\n    await this.pool.query(\r\n      `\r\n      INSERT INTO audit_decisions\r\n        (\r\n          execution_id,\r\n          decision,\r\n          execution_state,\r\n          attestation,\r\n          executed_at\r\n        )\r\n\r\n      VALUES ($1,$2,$3,$4,$5)\r\n\r\n      ON CONFLICT (execution_id)\r\n      DO NOTHING\r\n      `,\r\n      [\r\n        executionId,\r\n        {},\r\n        \"pending_override\",\r\n        value,\r\n        new Date().toISOString()\r\n      ]\r\n    );\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Redis-compatible KV get\r\n  // ----------------------------------\r\n\r\n  async get(\r\n    key: string\r\n  ): Promise<string | null> {\r\n\r\n    const executionId =\r\n      key.replace(\r\n        \"pending:\",\r\n        \"\"\r\n      );\r\n\r\n    const { rows } =\r\n      await this.pool.query(\r\n        `\r\n        SELECT attestation\r\n\r\n        FROM audit_decisions\r\n\r\n        WHERE execution_id = $1\r\n\r\n        LIMIT 1\r\n        `,\r\n        [executionId]\r\n      );\r\n\r\n    if (rows.length === 0) {\r\n      return null;\r\n    }\r\n\r\n    return rows[0].attestation;\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Completed execution marking\r\n  // ----------------------------------\r\n\r\n  async markExecuted(\r\n    executionId: string\r\n  ): Promise<void> {\r\n\r\n    await this.pool.query(\r\n      `\r\n      UPDATE audit_decisions\r\n\r\n      SET execution_state = 'completed'\r\n\r\n      WHERE execution_id = $1\r\n      `,\r\n      [executionId]\r\n    );\r\n  }\r\n\r\n  // ----------------------------------\r\n  // Cleanup\r\n  // ----------------------------------\r\n\r\n  async close(): Promise<void> {\r\n\r\n    await this.pool.end();\r\n  }\r\n}","import type { PoolClient } from \"pg\";\r\n\r\n// Inlined so the bundle has no runtime fs dependency.\r\n// The canonical reference lives in schema.sql alongside this file.\r\nconst SCHEMA_SQL = `\r\nCREATE TABLE IF NOT EXISTS audit_decisions (\r\n  id              BIGSERIAL    PRIMARY KEY,\r\n  execution_id    UUID         NOT NULL UNIQUE,\r\n  policy_id       TEXT         NOT NULL,\r\n  policy_version  TEXT         NOT NULL,\r\n  schema_version  TEXT         NOT NULL,\r\n  runtime_version TEXT         NOT NULL,\r\n  runtime_hash    TEXT         NOT NULL,\r\n  decision        TEXT         NOT NULL,\r\n  signals_hash    TEXT         NOT NULL,\r\n  signature       TEXT         NOT NULL,\r\n  attestation     JSONB        NOT NULL,\r\n  executed_at     TIMESTAMPTZ  NOT NULL,\r\n  recorded_at     TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_policy_id\r\n  ON audit_decisions (policy_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_executed_at\r\n  ON audit_decisions (executed_at DESC);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_decision\r\n  ON audit_decisions (decision);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_verifications (\r\n  id                   BIGSERIAL    PRIMARY KEY,\r\n  execution_id         UUID         NOT NULL,\r\n  valid                BOOLEAN      NOT NULL,\r\n  signature_verified   BOOLEAN      NOT NULL,\r\n  runtime_verified     BOOLEAN      NOT NULL,\r\n  schema_compatible    BOOLEAN      NOT NULL,\r\n  verified_at          TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_execution_id\r\n  ON audit_verifications (execution_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_valid\r\n  ON audit_verifications (valid);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_verified_at\r\n  ON audit_verifications (verified_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_security_events (\r\n  id           BIGSERIAL    PRIMARY KEY,\r\n  event_type   TEXT         NOT NULL,\r\n  severity     TEXT         NOT NULL CHECK (severity IN ('low','medium','high','critical')),\r\n  ip_address   TEXT,\r\n  path         TEXT,\r\n  method       TEXT,\r\n  user_agent   TEXT,\r\n  details      JSONB,\r\n  occurred_at  TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_event_type\r\n  ON audit_security_events (event_type);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_severity\r\n  ON audit_security_events (severity);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_occurred_at\r\n  ON audit_security_events (occurred_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_api_access (\r\n  id               BIGSERIAL    PRIMARY KEY,\r\n  method           TEXT         NOT NULL,\r\n  path             TEXT         NOT NULL,\r\n  status_code      INTEGER      NOT NULL,\r\n  response_time_ms INTEGER,\r\n  ip_address       TEXT,\r\n  user_agent       TEXT,\r\n  execution_id     UUID,\r\n  accessed_at      TIMESTAMPTZ  NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_path\r\n  ON audit_api_access (path);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_status_code\r\n  ON audit_api_access (status_code);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_accessed_at\r\n  ON audit_api_access (accessed_at DESC);\r\n\r\nCREATE OR REPLACE VIEW view_decision_timeline AS\r\nSELECT\r\n  d.execution_id,\r\n  d.policy_id,\r\n  d.policy_version,\r\n  d.decision,\r\n  d.runtime_version,\r\n  d.runtime_hash,\r\n  d.executed_at,\r\n  d.recorded_at,\r\n  v.valid              AS verification_valid,\r\n  v.signature_verified,\r\n  v.runtime_verified,\r\n  v.schema_compatible,\r\n  v.verified_at\r\nFROM  audit_decisions d\r\nLEFT  JOIN audit_verifications v ON d.execution_id = v.execution_id;\r\n\r\nCREATE OR REPLACE VIEW view_security_dashboard AS\r\nSELECT\r\n  event_type,\r\n  severity,\r\n  COUNT(*)         AS event_count,\r\n  MAX(occurred_at) AS last_occurrence,\r\n  MIN(occurred_at) AS first_occurrence\r\nFROM  audit_security_events\r\nGROUP BY event_type, severity;\r\n`;\r\n\r\nexport async function runMigrations(client: PoolClient): Promise<void> {\r\n  await client.query(\"BEGIN\");\r\n  try {\r\n    await client.query(SCHEMA_SQL);\r\n    await client.query(\"COMMIT\");\r\n  } catch (err) {\r\n    await client.query(\"ROLLBACK\");\r\n    throw err;\r\n  }\r\n}\r\n"],"mappings":";AAAA,SAAS,YAAY;;;ACIrB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4GnB,eAAsB,cAAc,QAAmC;AACrE,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM,OAAO,MAAM,QAAQ;AAAA,EAC7B,SAAS,KAAK;AACZ,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM;AAAA,EACR;AACF;;;ADtGO,IAAM,UAAN,MAAc;AAAA,EAEF;AAAA,EAGjB,YACE,kBACA;AAEA,SAAK,OACH,IAAI,KAAK;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACL;AAAA,EAEA,MAAM,OAAsB;AAE1B,UAAM,KAAK,KAAK;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAA4B;AAEhC,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AAAA,EAEA,MAAM,UAAyB;AAE7B,UAAM,SAEF,MAAM,KAAK,KAAK,QAAQ;AAE5B,QAAI;AAEF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IAEF,UAAE;AAEA,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,eACE,aACM;AAEN,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAgBA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAMA,mBACE,aACA,QACM;AAEN,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWA;AAAA,QACE;AAAA,QACA,OAAO;AAAA,QACP,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,MAChB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAMA,oBACE,OACM;AAEN,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd,MAAM,UAAU;AAAA,QAChB,MAAM,cAAc;AAAA,QAEpB,MAAM,WAAW,OACb,KAAK,UAAU,MAAM,OAAO,IAC5B;AAAA,MACN;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAMA,gBACE,QACM;AAEN,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA;AAAA,QACE,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO,oBAAoB;AAAA,QAC3B,OAAO,cAAc;AAAA,QACrB,OAAO,cAAc;AAAA,QACrB,OAAO,gBAAgB;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBACJ,QAAQ,KACR,QACgC;AAEhC,UAAM,aAAuB,CAAC;AAE9B,UAAM,SAAoB,CAAC;AAE3B,QAAI,QAAQ,WAAW;AAErB,aAAO;AAAA,QACL,OAAO;AAAA,MACT;AAEA,iBAAW;AAAA,QACT,gBAAgB,OAAO,MAAM;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI,QAAQ,UAAU;AAEpB,aAAO;AAAA,QACL,OAAO;AAAA,MACT;AAEA,iBAAW;AAAA,QACT,eAAe,OAAO,MAAM;AAAA,MAC9B;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW;AAErB,aAAO;AAAA,QACL,OAAO;AAAA,MACT;AAEA,iBAAW;AAAA,QACT,mBAAmB,OAAO,MAAM;AAAA,MAClC;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS;AAEnB,aAAO;AAAA,QACL,OAAO;AAAA,MACT;AAEA,iBAAW;AAAA,QACT,mBAAmB,OAAO,MAAM;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,KAAK,KAAK;AAEjB,UAAM,aACJ,IAAI,OAAO,MAAM;AAEnB,UAAM,QACJ,WAAW,SACP,SAAS,WAAW,KAAK,OAAO,CAAC,KACjC;AAEN,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA,UAIE,KAAK;AAAA;AAAA;AAAA;AAAA,gBAIC,UAAU;AAAA;AAAA,MAElB;AAAA,IACF;AAEF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAgC;AAEpC,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAyCF;AAEF,WAAO,KAAK,CAAC;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBACJ,aAC+B;AAE/B,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,WAAW;AAAA,IACd;AAEF,WAAO,KAAK,CAAC,KAAK;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,4BACJ,aAC8B;AAE9B,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,CAAC,WAAW;AAAA,IACd;AAEF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,uBAC4B;AAEhC,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMF;AAEF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aACJ,aACkB;AAElB,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,CAAC,WAAW;AAAA,IACd;AAEF,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,sBACJ,aACe;AAEf,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAiBA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IACJ,KACA,OACe;AAEf,UAAM,cACJ,IAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAEF,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeA;AAAA,QACE;AAAA,QACA,CAAC;AAAA,QACD;AAAA,QACA;AAAA,SACA,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IACJ,KACwB;AAExB,UAAM,cACJ,IAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAEF,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,CAAC,WAAW;AAAA,IACd;AAEF,QAAI,KAAK,WAAW,GAAG;AACrB,aAAO;AAAA,IACT;AAEA,WAAO,KAAK,CAAC,EAAE;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aACJ,aACe;AAEf,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,CAAC,WAAW;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAuB;AAE3B,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parmanasystems/audit-db",
-  "version": "1.5.0",
+  "version": "1.9.0",
   "private": false,
   "type": "module",
   "description": "PostgreSQL audit database client for parmanasystems governance decisions, verifications, and security events.",
@@ -19,8 +19,8 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@parmanasystems/execution": "^1.5.0",
-    "@parmanasystems/verifier": "^1.5.0",
+    "@parmanasystems/execution": "^1.9.0",
+    "@parmanasystems/verifier": "^1.9.0",
     "pg": "^8.13.3"
   },
   "devDependencies": {