@voltro/plugin-audit 0.83.1 → 0.85.0

package/dist/index.js

@@ -1,29 +1,29 @@
 import { audit as e } from "./mixin.js";
-import { Effect as t } from "effect";
-import { anonymousSubject as n, definePlugin as r, pluginInstanceName as i, rawImpersonationMark as a } from "@voltro/protocol";
-import { createLogger as o } from "@voltro/logger";
-import { and as s, eq as c, id as l, integer as u, json as d, registerRetention as ee, resolveActorSnapshot as f, retentionTtlMsFromEnv as p, scopeKeyOf as m, table as h, text as g, timestamp as _ } from "@voltro/database";
-import { createHash as v, createHmac as y, randomBytes as b } from "node:crypto";
+import { Cause as t, Effect as n } from "effect";
+import { anonymousSubject as r, definePlugin as i, pluginInstanceName as a, rawImpersonationMark as o } from "@voltro/protocol";
+import { createLogger as s } from "@voltro/logger";
+import { and as c, column as l, eq as u, gt as d, id as f, integer as p, isNotNull as m, isNull as h, json as g, lte as _, or as v, registerRetention as ee, resolveActorSnapshot as y, retentionTtlMsFromEnv as b, scopeKeyOf as x, table as S, text as C, timestamp as w } from "@voltro/database";
+import { createHash as T, createHmac as E, randomBytes as D } from "node:crypto";
 //#region src/redactionShape.ts
-var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e === 0 || t <= 0 || e >= t ? `string(${e})` : `string(<${t})`, E = (e, t) => e.length <= C && w.test(e) ? e : `<key:${T(e.length, t)}>`, D = (e, t = 0, n = 16) => {
+var O = 4, k = 32, A = 64, te = /^[A-Za-z_$][A-Za-z0-9_$]*$/, j = (e, t) => e === 0 || t <= 0 || e >= t ? `string(${e})` : `string(<${t})`, M = (e, t) => e.length <= A && te.test(e) ? e : `<key:${j(e.length, t)}>`, N = (e, t = 0, n = 16) => {
 	if (e === null) return "null";
 	if (e === void 0) return "undefined";
 	let r = typeof e;
-	if (r === "string") return T(e.length, n);
+	if (r === "string") return j(e.length, n);
 	if (r === "number" || r === "boolean" || r === "bigint" || r === "symbol" || r === "function") return r;
 	if (e instanceof Date) return "date";
-	if (t >= x) return Array.isArray(e) ? "array(…)" : "object(…)";
+	if (t >= O) return Array.isArray(e) ? "array(…)" : "object(…)";
 	if (Array.isArray(e)) {
-		let r = e.slice(0, S).map((e) => D(e, t + 1, n));
-		return e.length > S ? [...r, `…${e.length - S} more`] : r;
+		let r = e.slice(0, k).map((e) => N(e, t + 1, n));
+		return e.length > k ? [...r, `…${e.length - k} more`] : r;
 	}
 	if (r === "object") {
 		let r = Object.entries(e), i = {};
-		for (let [e, a] of r.slice(0, S)) i[E(e, n)] = D(a, t + 1, n);
-		return r.length > S && (i["…"] = `${r.length - S} more key(s)`), i;
+		for (let [e, a] of r.slice(0, k)) i[M(e, n)] = N(a, t + 1, n);
+		return r.length > k && (i["…"] = `${r.length - k} more key(s)`), i;
 	}
 	return r;
-}, O = (e, t = 16) => ({ __redacted: D(e, 0, t) }), k = "_voltro_audit_log", A = [
+}, P = (e, t = 16) => ({ __redacted: N(e, 0, t) }), F = "_voltro_audit_log", I = [
 	"tag",
 	"at",
 	"subjectId",
@@ -38,26 +38,26 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 	"input",
 	"outcome",
 	"errorTag"
-], j = (e) => {
+], L = (e) => {
 	if (e == null) return "null";
 	if (e instanceof Date) return JSON.stringify(e.toISOString());
 	let t = typeof e;
-	return t === "number" || t === "boolean" || t === "string" ? JSON.stringify(e) : t === "bigint" ? JSON.stringify(String(e)) : Array.isArray(e) ? `[${e.map(j).join(",")}]` : t === "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${j(t)}`).join(",")}}` : JSON.stringify(String(e));
-}, M = (e) => e instanceof Date ? e.toISOString() : e, N = (e) => j(Object.fromEntries(A.map((t) => [t, M(e[t] ?? null)]))), P = (e) => {
+	return t === "number" || t === "boolean" || t === "string" ? JSON.stringify(e) : t === "bigint" ? JSON.stringify(String(e)) : Array.isArray(e) ? `[${e.map(L).join(",")}]` : t === "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${L(t)}`).join(",")}}` : JSON.stringify(String(e));
+}, ne = (e) => e instanceof Date ? e.toISOString() : e, re = (e) => L(Object.fromEntries(I.map((t) => [t, ne(e[t] ?? null)]))), ie = (e) => {
 	let t = process.env.VOLTRO_AUDIT_CHAIN_SECRET;
-	return t ? y("sha256", t).update(e, "utf8").digest("hex") : v("sha256").update(e, "utf8").digest("hex");
-}, F = (e, t) => P(JSON.stringify([
+	return t ? E("sha256", t).update(e, "utf8").digest("hex") : T("sha256").update(e, "utf8").digest("hex");
+}, R = (e, t) => ie(JSON.stringify([
 	t.chainId,
 	t.seq,
 	t.prevHash,
-	N(e)
-])), I = (e = b(12).toString("base64url")) => {
+	re(e)
+])), z = (e = D(12).toString("base64url")) => {
 	let t = 0, n = null;
 	return {
 		chainId: e,
 		link: (r) => {
 			t += 1;
-			let i = F(r, {
+			let i = R(r, {
 				chainId: e,
 				seq: t,
 				prevHash: n
@@ -71,92 +71,144 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 			return n = i, a;
 		}
 	};
-}, L = async (e, t = {}) => {
-	let n = t.chainId === void 0 ? void 0 : c("chainId", t.chainId), r = await e.query({
-		table: k,
-		...n ? { predicate: n } : {},
-		order: [{
+};
+async function* B(e, t) {
+	let n = t.chainId === void 0 ? void 0 : u("chainId", t.chainId), r = (e, t, n) => ({
+		table: F,
+		predicate: e,
+		order: n,
+		take: t,
+		skip: void 0,
+		projection: void 0
+	});
+	if (t.limit !== void 0) {
+		yield* await e.query(r(n, t.limit, [{
 			column: "chainId",
 			direction: "asc"
 		}, {
 			column: "seq",
 			direction: "asc"
-		}],
-		...t.limit === void 0 ? {} : { take: t.limit }
-	}), i = [], a = [], o = 0, s = 0, l = null, u = () => {
-		l &&= (a.push({
-			chainId: l.chainId,
-			from: l.from,
-			to: l.last,
-			tip: l.tip,
-			prunedPrefix: l.from > 1
+		}]));
+		return;
+	}
+	let i = [...await e.query({
+		...r(n, void 0, [{
+			column: "chainId",
+			direction: "asc"
+		}]),
+		groupBy: ["chainId"],
+		aggregations: [
+			l("chainId"),
+			{
+				op: "max",
+				column: "seq",
+				alias: "lastSeq"
+			},
+			{
+				op: "max",
+				column: "id",
+				alias: "lastId"
+			}
+		]
+	})].sort((e, t) => String(e.chainId) < String(t.chainId) ? -1 : +(String(e.chainId) > String(t.chainId)));
+	for (let t of i) {
+		let n = t.chainId, i = n == null ? h("chainId") : u("chainId", n), a = n == null ? [!1] : [!1, !0];
+		for (let o of a) {
+			if (o && t.lastSeq == null) continue;
+			let a = [i, _("id", t.lastId)];
+			n != null && a.push(o ? c(m("seq"), _("seq", t.lastSeq)) : h("seq"));
+			let s;
+			for (;;) {
+				let t = s === void 0 ? void 0 : o ? v(d("seq", s.seq), c(u("seq", s.seq), d("id", s.id))) : d("id", s.id), n = await e.query(r(c(...a, ...t ? [t] : []), 1e3, [...o ? [{
+					column: "seq",
+					direction: "asc"
+				}] : [], {
+					column: "id",
+					direction: "asc"
+				}]));
+				if (yield* n, n.length < 1e3) break;
+				let i = n[n.length - 1];
+				if (i.id === void 0 || i.id === s?.id) throw Error("audit verification cursor did not advance");
+				s = i;
+			}
+		}
+	}
+}
+var V = async (e, t = {}) => {
+	let n = [], r = [], i = 0, a = 0, o = null, s = () => {
+		o &&= (r.push({
+			chainId: o.chainId,
+			from: o.from,
+			to: o.last,
+			tip: o.tip,
+			prunedPrefix: o.from > 1
 		}), null);
 	};
-	for (let e of r) {
-		let t = e.chainId, n = e.hash, r = e.seq;
-		if (typeof t != "string" || typeof n != "string" || r == null) {
-			o += 1;
+	for await (let r of B(e, t)) {
+		let e = r.chainId, t = r.hash, c = r.seq;
+		if (typeof e != "string" || typeof t != "string" || c == null) {
+			i += 1;
 			continue;
 		}
-		let a = Number(r), c = typeof e.prevHash == "string" ? e.prevHash : null, d = typeof e.id == "string" ? e.id : void 0;
-		s += 1, !l || l.chainId !== t ? (u(), l = {
-			chainId: t,
-			from: a,
-			last: a,
-			tip: n
-		}) : (a === l.last + 1 ? c !== l.tip && i.push({
+		let l = Number(c), u = typeof r.prevHash == "string" ? r.prevHash : null, d = typeof r.id == "string" ? r.id : void 0;
+		a += 1, !o || o.chainId !== e ? (s(), o = {
+			chainId: e,
+			from: l,
+			last: l,
+			tip: t
+		}) : (l === o.last + 1 ? u !== o.tip && n.push({
 			kind: "broken-link",
-			chainId: t,
-			seq: a,
+			chainId: e,
+			seq: l,
 			...d ? { rowId: d } : {},
-			detail: `prevHash does not match the hash of seq ${l.last}`
-		}) : i.push({
+			detail: `prevHash does not match the hash of seq ${o.last}`
+		}) : n.push({
 			kind: "gap",
-			chainId: t,
-			seq: l.last + 1,
-			detail: `chain jumps from seq ${l.last} to ${a} — ${a - l.last - 1} row(s) missing`
-		}), l.last = a, l.tip = n), F(e, {
-			chainId: t,
-			seq: a,
-			prevHash: c
-		}) !== n && i.push({
+			chainId: e,
+			seq: o.last + 1,
+			detail: `chain jumps from seq ${o.last} to ${l} — ${l - o.last - 1} row(s) missing`
+		}), o.last = l, o.tip = t), R(r, {
+			chainId: e,
+			seq: l,
+			prevHash: u
+		}) !== t && n.push({
 			kind: "tampered",
-			chainId: t,
-			seq: a,
+			chainId: e,
+			seq: l,
 			...d ? { rowId: d } : {},
 			detail: "the row content does not hash to its stored hash — a column was altered"
 		});
 	}
-	return u(), {
-		ok: i.length === 0,
-		rowsChecked: s,
-		unchainedRows: o,
-		chains: a,
-		issues: i,
+	return s(), {
+		ok: n.length === 0,
+		rowsChecked: a,
+		unchainedRows: i,
+		chains: r,
+		issues: n,
 		keyed: !!process.env.VOLTRO_AUDIT_CHAIN_SECRET
 	};
-}, R = h(k, {
-	id: l({ prefix: "audit" }),
-	tag: g(),
-	at: _(),
-	subjectId: g().nullable(),
-	tenantId: g().nullable(),
-	traceId: g(),
-	status: g(),
-	durationMs: g(),
-	subject: d(),
-	actor: d().nullable(),
-	scope: d().nullable(),
-	scopeKey: g().nullable(),
-	metadata: d().nullable(),
-	impersonation: d().nullable(),
-	input: d(),
-	outcome: d(),
-	errorTag: g().nullable(),
-	chainId: g().nullable(),
-	seq: u().nullable(),
-	prevHash: g().nullable(),
-	hash: g().nullable()
+}, H = S(F, {
+	id: f({ prefix: "audit" }),
+	tag: C(),
+	at: w(),
+	subjectId: C().nullable(),
+	tenantId: C().nullable(),
+	traceId: C(),
+	status: C(),
+	durationMs: C(),
+	subject: g(),
+	actor: g().nullable(),
+	scope: g().nullable(),
+	scopeKey: C().nullable(),
+	metadata: g().nullable(),
+	impersonation: g().nullable(),
+	input: g(),
+	outcome: g(),
+	errorTag: C().nullable(),
+	chainId: C().nullable(),
+	seq: p().nullable(),
+	prevHash: C().nullable(),
+	hash: C().nullable()
 }).index("byAuditTag", ["tag"]).index("byAuditTrace", ["traceId"]).index("byAuditSubjectStatus", [
 	"subjectId",
 	"status",
@@ -165,7 +217,7 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 	"tenantId",
 	"status",
 	"at"
-]).index("byAuditScope", ["scopeKey", "at"]).index("byAuditChain", ["chainId", "seq"]), z = [R], B = (e) => ({
+]).index("byAuditScope", ["scopeKey", "at"]).index("byAuditChain", ["chainId", "seq"]), U = [H], W = (e) => ({
 	tag: e.tag,
 	at: new Date(e.ts),
 	subjectId: e.subject.id ?? null,
@@ -176,61 +228,61 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 	subject: e.subject,
 	actor: e.actor ?? null,
 	scope: e.scope ?? null,
-	scopeKey: m(e.scope),
+	scopeKey: x(e.scope),
 	metadata: e.metadata ?? null,
 	impersonation: e.impersonation ?? null,
 	input: e.input,
 	outcome: e.outcome,
-	errorTag: e.outcome.kind === "error" ? V(e.outcome.error) : null
-}), V = (e) => {
+	errorTag: e.outcome.kind === "error" ? G(e.outcome.error) : null
+}), G = (e) => {
 	if (typeof e != "object" || !e) return null;
 	let t = e._tag;
 	return typeof t == "string" && t !== "" ? t : null;
-}, H = async (e, t) => e.query({
-	table: k,
-	predicate: c("traceId", t),
+}, K = async (e, t) => e.query({
+	table: F,
+	predicate: u("traceId", t),
 	order: [{
 		column: "at",
 		direction: "asc"
 	}]
-}), U = async (e, t, n = {}) => {
-	let r = m(t);
+}), q = async (e, t, n = {}) => {
+	let r = x(t);
 	if (r === null) return [];
-	let i = c("scopeKey", r);
+	let i = u("scopeKey", r);
 	return e.query({
-		table: k,
-		predicate: n.status === void 0 ? i : s(i, c("status", n.status)),
+		table: F,
+		predicate: n.status === void 0 ? i : c(i, u("status", n.status)),
 		order: [{
 			column: "at",
 			direction: "desc"
 		}],
 		take: n.limit ?? 100
 	});
-}, W = async (e, t, n = {}) => {
-	let r = c("subjectId", t);
+}, J = async (e, t, n = {}) => {
+	let r = u("subjectId", t);
 	return e.query({
-		table: k,
-		predicate: n.status === void 0 ? r : s(r, c("status", n.status)),
+		table: F,
+		predicate: n.status === void 0 ? r : c(r, u("status", n.status)),
 		order: [{
 			column: "at",
 			direction: "desc"
 		}],
 		take: n.limit ?? 100
 	});
-}, G = (e) => {
-	let t = I();
+}, Y = (e) => {
+	let t = z();
 	return async (n) => {
 		let r = n.actor !== void 0 || typeof e.query != "function" ? n : {
 			...n,
-			actor: await f(e, n.subject.id ?? null, n.subject.type)
+			actor: await y(e, n.subject.id ?? null, n.subject.type)
 		};
-		await e.insert(k, t.link(B(r)));
+		await e.insert(F, t.link(W(r)));
 	};
-}, K = o({ scope: "@voltro/plugin-audit" }), q = 1e3, J = [], Y = () => [...J], X = () => {
-	J.length = 0;
-}, Z = (e) => {
-	J.push(e), J.length > q && J.splice(0, J.length - q);
-}, Q = (e) => {
+}, X = s({ scope: "@voltro/plugin-audit" }), Z = 1e3, Q = [], ae = () => [...Q], oe = () => {
+	Q.length = 0;
+}, se = (e) => {
+	Q.push(e), Q.length > Z && Q.splice(0, Q.length - Z);
+}, ce = (e) => {
 	let t = e.subject.id ? `${e.subject.type}:${e.subject.id}` : e.subject.type, n = e.outcome.kind === "ok" ? "ok" : "error", r = {
 		subject: t,
 		tenant: e.subject.tenantId ?? null,
@@ -238,70 +290,49 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 		durationMs: e.outcome.durationMs,
 		traceId: e.traceId
 	};
-	n === "error" ? K.warn(e.tag, r) : K.info(e.tag, r);
-}, te = (e, n) => typeof e == "function" ? (n) => t.suspend(() => {
-	let r = e(n);
-	return r === void 0 ? t.void : t.isEffect(r) ? r : t.tryPromise({
+	n === "error" ? X.warn(e.tag, r) : X.info(e.tag, r);
+}, le = (e, t) => typeof e == "function" ? (t) => n.suspend(() => {
+	let r = e(t);
+	return r === void 0 ? n.void : n.isEffect(r) ? r : n.tryPromise({
 		try: () => Promise.resolve(r),
 		catch: (e) => e
 	});
-}) : e === "datastore" ? (e) => t.suspend(() => {
-	let r = n();
-	return r ? t.tryPromise({
+}) : e === "datastore" ? (e) => n.suspend(() => {
+	let r = t();
+	return r ? n.tryPromise({
 		try: () => r(e),
 		catch: (e) => e
-	}) : t.void;
-}) : e === "memory" ? (e) => t.sync(() => Z(e)) : (e) => t.sync(() => Q(e)), ne = (e) => {
-	let t = [], n = [], r = (e) => {
-		if (e._tag !== "Empty") {
-			if (e._tag === "Fail") {
-				t.push(e.error);
-				return;
-			}
-			if (e._tag === "Die") {
-				n.push(e.defect);
-				return;
-			}
-			if (e._tag !== "Interrupt") {
-				if (e._tag === "Sequential") {
-					r(e.left), r(e.right);
-					return;
-				}
-				if (e._tag === "Parallel") {
-					r(e.left), r(e.right);
-					return;
-				}
-			}
-		}
-	};
-	return r(e), t[0] ?? n[0] ?? e;
-}, $ = "@voltro/plugin-audit", re = (e = {}) => {
-	let o = e.sink === "datastore";
-	o && ee({
+	}) : n.void;
+}) : e === "memory" ? (e) => n.sync(() => se(e)) : (e) => n.sync(() => ce(e)), ue = (e) => {
+	let n = e.reasons.filter(t.isFailReason).map((e) => e.error), r = e.reasons.filter(t.isDieReason).map((e) => e.defect);
+	return n[0] ?? r[0] ?? e;
+}, $ = "@voltro/plugin-audit", de = (e = {}) => {
+	let t = e.sink === "datastore";
+	t && ee({
 		source: "plugin",
-		table: k,
+		table: F,
 		timeColumn: "at",
-		ttlMs: p(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 8760)
+		ttlMs: b(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 8760)
 	});
-	let s, c = te(e.sink, () => s), l = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), u = l(e.exclude), d = l(e.include), f = (e) => !(u?.test(e) || d && !d.test(e)), m = (t) => {
+	let s, c = le(e.sink, () => s), l = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), u = l(e.exclude), d = l(e.include), f = (e) => !(u?.test(e) || d && !d.test(e)), p = (t) => {
 		let n = e.record ?? "all";
 		return n === "all" ? !0 : n === "errors" ? t.outcome.kind === "error" : n(t);
-	}, h = { __redacted: "all" }, g = e.redactionLengthFloor ?? 16, _ = (t) => {
+	}, m = { __redacted: "all" }, h = e.redactionLengthFloor ?? 16, g = (t) => {
 		let n = e.redactInput ?? "all";
 		return n === "none" ? t : n === "all" ? {
 			...t,
-			input: h
+			input: m
 		} : n === "shape" ? {
 			...t,
-			input: O(t.input, g)
+			input: P(t.input, h)
 		} : {
 			...t,
 			input: n(t)
 		};
-	}, v = (t) => {
+	}, _ = (t) => {
 		let n = e.redactOutcome ?? "all";
 		if (n === "none") return t;
-		let r = t.outcome, i = n === "all" ? h : n === "shape" ? ((e) => O(e, g))(r.kind === "ok" ? r.value : r.error) : n(t);
+		let r = t.outcome, i = n === "all" ? m : n === "shape" ? ((e) => P(e, h))(r.kind === "ok" ? r.value : r.error) : n(t);
 		if (r.kind === "ok") return {
 			...t,
 			outcome: {
@@ -320,7 +351,7 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 				}
 			}
 		};
-	}, y = (t) => {
+	}, v = (t) => {
 		let n = e.redactSubject ?? "metadata";
 		if (n === "none") return t;
 		if (typeof n == "function") return {
@@ -329,7 +360,7 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 		};
 		let r = t.subject;
 		if (r.metadata === void 0) return t;
-		let { metadata: i, ...a } = r, o = n === "metadata-shape" ? O(i, g) : h;
+		let { metadata: i, ...a } = r, o = n === "metadata-shape" ? P(i, h) : m;
 		return {
 			...t,
 			subject: {
@@ -337,67 +368,67 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 				metadata: o
 			}
 		};
-	}, b = (e) => {
-		let t = a(e.subject);
+	}, y = (e) => {
+		let t = o(e.subject);
 		return t === null ? e : {
 			...e,
 			impersonation: t
 		};
-	}, x = (e) => m(e) ? c(v(y(_(b(e))))) : t.void, S = (t) => {
+	}, x = (e) => p(e) ? c(_(v(g(y(e))))) : n.void, S = (t) => {
 		if (e.resolveScope !== void 0) try {
 			return e.resolveScope(t);
 		} catch {
 			return;
 		}
-	}, C = (n, r) => e.metadata === void 0 ? t.succeed(void 0) : t.tryPromise(async () => e.metadata({
-		tag: n.tag,
-		subject: n.subject,
-		input: n.input,
+	}, C = (t, r) => e.metadata === void 0 ? n.succeed(void 0) : n.tryPromise(async () => e.metadata({
+		tag: t.tag,
+		subject: t.subject,
+		input: t.input,
 		outcome: r
-	})).pipe(t.catchAllCause(() => t.succeed(void 0))), w = (e, n) => f(n.tag) ? t.suspend(() => {
-		let r = Date.now(), i = S(n);
-		return e.pipe(t.tap((e) => C(n, {
+	})).pipe(n.catchCause(() => n.succeed(void 0))), w = (e, t) => f(t.tag) ? n.suspend(() => {
+		let r = Date.now(), i = S(t);
+		return e.pipe(n.tap((e) => C(t, {
 			kind: "ok",
 			value: e
-		}).pipe(t.flatMap((t) => x({
+		}).pipe(n.flatMap((n) => x({
 			ts: r,
-			tag: n.tag,
-			subject: n.subject,
+			tag: t.tag,
+			subject: t.subject,
 			...i === void 0 ? {} : { scope: i },
-			...t === void 0 ? {} : { metadata: t },
-			traceId: n.traceId,
-			input: n.input,
+			...n === void 0 ? {} : { metadata: n },
+			traceId: t.traceId,
+			input: t.input,
 			outcome: {
 				kind: "ok",
 				value: e,
 				durationMs: Date.now() - r
 			}
-		}))).pipe(t.catchAllCause(() => t.void))), t.tapErrorCause((e) => {
-			let a = ne(e);
-			return C(n, {
+		}))).pipe(n.catchCause(() => n.void))), n.tapCause((e) => {
+			let a = ue(e);
+			return C(t, {
 				kind: "error",
 				error: a
-			}).pipe(t.flatMap((e) => x({
+			}).pipe(n.flatMap((e) => x({
 				ts: r,
-				tag: n.tag,
-				subject: n.subject,
+				tag: t.tag,
+				subject: t.subject,
 				...i === void 0 ? {} : { scope: i },
 				...e === void 0 ? {} : { metadata: e },
-				traceId: n.traceId,
-				input: n.input,
+				traceId: t.traceId,
+				input: t.input,
 				outcome: {
 					kind: "error",
 					error: a,
 					durationMs: Date.now() - r
 				}
-			}))).pipe(t.catchAllCause(() => t.void));
+			}))).pipe(n.catchCause(() => n.void));
 		}));
 	}) : e, T = (e) => {
-		let r = `http.${e.method.toUpperCase()} ${e.path}`;
-		f(r) && t.runPromise(x({
+		let t = `http.${e.method.toUpperCase()} ${e.path}`;
+		f(t) && n.runPromise(x({
 			ts: Date.now() - e.durationMs,
-			tag: r,
-			subject: n(null),
+			tag: t,
+			subject: r(null),
 			traceId: e.traceId,
 			input: {
 				method: e.method,
@@ -420,10 +451,10 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 				value: { status: e.status },
 				durationMs: e.durationMs
 			}
-		}).pipe(t.catchAllCause(() => t.void)));
-	}, E = w, D = w, A = w, j = w;
-	return r({
-		name: i({
+		}).pipe(n.catchCause(() => n.void)));
+	}, E = w, D = w, O = w, k = w;
+	return i({
+		name: a({
 			base: $,
 			alias: e.alias
 		}),
@@ -434,21 +465,21 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 			"rpc:intercept:action",
 			"rpc:intercept:workflow",
 			"http:intercept",
-			...o ? ["store:write"] : [],
+			...t ? ["store:write"] : [],
 			...e.recordQueries === !0 ? ["rpc:intercept:query"] : []
 		],
-		...o ? {
-			...e.tables === !1 ? {} : { extendSchema: { tables: z } },
+		...t ? {
+			...e.tables === !1 ? {} : { extendSchema: { tables: U } },
 			bindDataStore: (e) => {
-				s = G(e);
+				s = Y(e);
 			}
 		} : {},
 		interceptMutation: E,
 		interceptAction: D,
-		interceptWorkflow: A,
+		interceptWorkflow: O,
 		onHttpRoute: T,
-		...e.recordQueries === !0 ? { interceptQuery: j } : {}
+		...e.recordQueries === !0 ? { interceptQuery: k } : {}
 	});
 };
 //#endregion
-export { k as AUDIT_LOG_TABLE, e as audit, U as auditByScope, W as auditBySubject, H as auditByTrace, B as auditEventToRow, R as auditLogTable, z as auditLogTables, re as auditPlugin, F as auditRowHash, X as clearAuditBuffer, G as dataStoreAuditSink, I as makeAuditChain, Y as readAuditBuffer, L as verifyAuditChain };
+export { F as AUDIT_LOG_TABLE, e as audit, q as auditByScope, J as auditBySubject, K as auditByTrace, W as auditEventToRow, H as auditLogTable, U as auditLogTables, de as auditPlugin, R as auditRowHash, oe as clearAuditBuffer, Y as dataStoreAuditSink, z as makeAuditChain, ae as readAuditBuffer, V as verifyAuditChain };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-audit",
-  "version": "0.83.1",
+  "version": "0.85.0",
   "description": "Audit plugin — ships the `audit()` schema mixin (createdAt/updatedAt/createdBy/updatedBy → Actor) plus an optional interceptor that records every mutation and action (queries on request) to a configurable sink (console / memory / datastore / custom function).",
   "keywords": [
     "voltro",
@@ -38,12 +38,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.83.1",
-    "@voltro/logger": "0.83.1",
-    "@voltro/protocol": "0.83.1"
+    "@voltro/database": "0.85.0",
+    "@voltro/logger": "0.85.0",
+    "@voltro/protocol": "0.85.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"