@voltro/plugin-audit 0.84.0 → 0.86.0

package/dist/index.js

@@ -1,403 +1,266 @@
-import { audit as e } from "./mixin.js";
-import { Effect as t } from "effect";
-import { anonymousSubject as n, definePlugin as r, pluginInstanceName as i, rawImpersonationMark as a } from "@voltro/protocol";
-import { createLogger as o } from "@voltro/logger";
-import { and as s, eq as c, id as l, integer as u, json as d, registerRetention as ee, resolveActorSnapshot as f, retentionTtlMsFromEnv as p, scopeKeyOf as m, table as h, text as g, timestamp as _ } from "@voltro/database";
-import { createHash as v, createHmac as y, randomBytes as b } from "node:crypto";
-//#region src/redactionShape.ts
-var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e === 0 || t <= 0 || e >= t ? `string(${e})` : `string(<${t})`, E = (e, t) => e.length <= C && w.test(e) ? e : `<key:${T(e.length, t)}>`, D = (e, t = 0, n = 16) => {
-	if (e === null) return "null";
-	if (e === void 0) return "undefined";
-	let r = typeof e;
-	if (r === "string") return T(e.length, n);
-	if (r === "number" || r === "boolean" || r === "bigint" || r === "symbol" || r === "function") return r;
-	if (e instanceof Date) return "date";
-	if (t >= x) return Array.isArray(e) ? "array(…)" : "object(…)";
-	if (Array.isArray(e)) {
-		let r = e.slice(0, S).map((e) => D(e, t + 1, n));
-		return e.length > S ? [...r, `…${e.length - S} more`] : r;
-	}
-	if (r === "object") {
-		let r = Object.entries(e), i = {};
-		for (let [e, a] of r.slice(0, S)) i[E(e, n)] = D(a, t + 1, n);
-		return r.length > S && (i["…"] = `${r.length - S} more key(s)`), i;
-	}
-	return r;
-}, O = (e, t = 16) => ({ __redacted: D(e, 0, t) }), k = "_voltro_audit_log", A = [
-	"tag",
-	"at",
-	"subjectId",
-	"tenantId",
-	"traceId",
-	"status",
-	"durationMs",
-	"subject",
-	"actor",
-	"scope",
-	"metadata",
-	"input",
-	"outcome",
-	"errorTag"
-], j = (e) => {
-	if (e == null) return "null";
-	if (e instanceof Date) return JSON.stringify(e.toISOString());
-	let t = typeof e;
-	return t === "number" || t === "boolean" || t === "string" ? JSON.stringify(e) : t === "bigint" ? JSON.stringify(String(e)) : Array.isArray(e) ? `[${e.map(j).join(",")}]` : t === "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${j(t)}`).join(",")}}` : JSON.stringify(String(e));
-}, M = (e) => e instanceof Date ? e.toISOString() : e, N = (e) => j(Object.fromEntries(A.map((t) => [t, M(e[t] ?? null)]))), P = (e) => {
-	let t = process.env.VOLTRO_AUDIT_CHAIN_SECRET;
-	return t ? y("sha256", t).update(e, "utf8").digest("hex") : v("sha256").update(e, "utf8").digest("hex");
-}, F = (e, t) => P(JSON.stringify([
-	t.chainId,
-	t.seq,
-	t.prevHash,
-	N(e)
-])), I = (e = b(12).toString("base64url")) => {
-	let t = 0, n = null;
-	return {
-		chainId: e,
-		link: (r) => {
-			t += 1;
-			let i = F(r, {
-				chainId: e,
-				seq: t,
-				prevHash: n
-			}), a = {
-				...r,
-				chainId: e,
-				seq: t,
-				prevHash: n,
-				hash: i
-			};
-			return n = i, a;
-		}
-	};
-}, L = async (e, t = {}) => {
-	let n = t.chainId === void 0 ? void 0 : c("chainId", t.chainId), r = await e.query({
-		table: k,
-		...n ? { predicate: n } : {},
-		order: [{
-			column: "chainId",
-			direction: "asc"
-		}, {
-			column: "seq",
-			direction: "asc"
-		}],
-		...t.limit === void 0 ? {} : { take: t.limit }
-	}), i = [], a = [], o = 0, s = 0, l = null, u = () => {
-		l &&= (a.push({
-			chainId: l.chainId,
-			from: l.from,
-			to: l.last,
-			tip: l.tip,
-			prunedPrefix: l.from > 1
-		}), null);
-	};
-	for (let e of r) {
-		let t = e.chainId, n = e.hash, r = e.seq;
-		if (typeof t != "string" || typeof n != "string" || r == null) {
-			o += 1;
-			continue;
-		}
-		let a = Number(r), c = typeof e.prevHash == "string" ? e.prevHash : null, d = typeof e.id == "string" ? e.id : void 0;
-		s += 1, !l || l.chainId !== t ? (u(), l = {
-			chainId: t,
-			from: a,
-			last: a,
-			tip: n
-		}) : (a === l.last + 1 ? c !== l.tip && i.push({
-			kind: "broken-link",
-			chainId: t,
-			seq: a,
-			...d ? { rowId: d } : {},
-			detail: `prevHash does not match the hash of seq ${l.last}`
-		}) : i.push({
-			kind: "gap",
-			chainId: t,
-			seq: l.last + 1,
-			detail: `chain jumps from seq ${l.last} to ${a} — ${a - l.last - 1} row(s) missing`
-		}), l.last = a, l.tip = n), F(e, {
-			chainId: t,
-			seq: a,
-			prevHash: c
-		}) !== n && i.push({
-			kind: "tampered",
-			chainId: t,
-			seq: a,
-			...d ? { rowId: d } : {},
-			detail: "the row content does not hash to its stored hash — a column was altered"
-		});
-	}
-	return u(), {
-		ok: i.length === 0,
-		rowsChecked: s,
-		unchainedRows: o,
-		chains: a,
-		issues: i,
-		keyed: !!process.env.VOLTRO_AUDIT_CHAIN_SECRET
-	};
-}, R = h(k, {
-	id: l({ prefix: "audit" }),
-	tag: g(),
-	at: _(),
-	subjectId: g().nullable(),
-	tenantId: g().nullable(),
-	traceId: g(),
-	status: g(),
-	durationMs: g(),
-	subject: d(),
-	actor: d().nullable(),
-	scope: d().nullable(),
-	scopeKey: g().nullable(),
-	metadata: d().nullable(),
-	impersonation: d().nullable(),
-	input: d(),
-	outcome: d(),
-	errorTag: g().nullable(),
-	chainId: g().nullable(),
-	seq: u().nullable(),
-	prevHash: g().nullable(),
-	hash: g().nullable()
-}).index("byAuditTag", ["tag"]).index("byAuditTrace", ["traceId"]).index("byAuditSubjectStatus", [
-	"subjectId",
-	"status",
-	"at"
-]).index("byAuditTenantStatus", [
-	"tenantId",
-	"status",
-	"at"
-]).index("byAuditScope", ["scopeKey", "at"]).index("byAuditChain", ["chainId", "seq"]), z = [R], B = (e) => ({
-	tag: e.tag,
-	at: new Date(e.ts),
-	subjectId: e.subject.id ?? null,
-	tenantId: e.subject.tenantId ?? null,
-	traceId: e.traceId,
-	status: e.outcome.kind,
-	durationMs: String(e.outcome.durationMs),
-	subject: e.subject,
-	actor: e.actor ?? null,
-	scope: e.scope ?? null,
-	scopeKey: m(e.scope),
-	metadata: e.metadata ?? null,
-	impersonation: e.impersonation ?? null,
-	input: e.input,
-	outcome: e.outcome,
-	errorTag: e.outcome.kind === "error" ? V(e.outcome.error) : null
-}), V = (e) => {
-	if (typeof e != "object" || !e) return null;
-	let t = e._tag;
-	return typeof t == "string" && t !== "" ? t : null;
-}, H = async (e, t) => e.query({
-	table: k,
-	predicate: c("traceId", t),
-	order: [{
-		column: "at",
-		direction: "asc"
-	}]
-}), U = async (e, t, n = {}) => {
-	let r = m(t);
-	if (r === null) return [];
-	let i = c("scopeKey", r);
-	return e.query({
-		table: k,
-		predicate: n.status === void 0 ? i : s(i, c("status", n.status)),
-		order: [{
-			column: "at",
-			direction: "desc"
-		}],
-		take: n.limit ?? 100
-	});
-}, W = async (e, t, n = {}) => {
-	let r = c("subjectId", t);
-	return e.query({
-		table: k,
-		predicate: n.status === void 0 ? r : s(r, c("status", n.status)),
-		order: [{
-			column: "at",
-			direction: "desc"
-		}],
-		take: n.limit ?? 100
-	});
-}, G = (e) => {
-	let t = I();
-	return async (n) => {
-		let r = n.actor !== void 0 || typeof e.query != "function" ? n : {
-			...n,
-			actor: await f(e, n.subject.id ?? null, n.subject.type)
-		};
-		await e.insert(k, t.link(B(r)));
-	};
-}, K = o({ scope: "@voltro/plugin-audit" }), q = 1e3, J = [], Y = () => [...J], X = () => {
-	J.length = 0;
-}, Z = (e) => {
-	J.push(e), J.length > q && J.splice(0, J.length - q);
-}, Q = (e) => {
-	let t = e.subject.id ? `${e.subject.type}:${e.subject.id}` : e.subject.type, n = e.outcome.kind === "ok" ? "ok" : "error", r = {
+import { shapeRedaction as e } from "./redactionShape.js";
+import { AUDIT_LOG_TABLE as t } from "./tableName.js";
+import { auditRowHash as n, makeAuditChain as r, verifyAuditChain as i } from "./chain.js";
+import { assertAuditReceipt as a, auditByScope as o, auditBySubject as s, auditByTrace as c, auditEventToRow as l, auditLogTable as u, auditLogTables as d, dataStoreAuditSink as f } from "./store.js";
+import { decodeAuditAdmissionIntent as ee, decodeAuditFailureIntent as te, decodeAuditIntent as p, decodeAuditInvocationOutcomeIntent as m, freezeAuditAdmissionIntent as h, freezeAuditFailureIntent as ne, freezeAuditIntent as g, freezeAuditInvocationOutcomeIntent as _ } from "./transactionalCapture.js";
+import { audit as v } from "./mixin.js";
+import { auditInvocationIdentity as y, auditInvocationQuery as b } from "./invocationQuery.js";
+import { Cause as x, Effect as S } from "effect";
+import { anonymousSubject as C, definePlugin as w, pluginInstanceName as re, rawImpersonationMark as ie } from "@voltro/protocol";
+import { createLogger as T } from "@voltro/logger";
+import { eq as ae, generateId as E, registerRetention as D, resolveActorSnapshot as oe, retentionTtlMsFromEnv as O } from "@voltro/database";
+//#region src/index.ts
+var k = T({ scope: "@voltro/plugin-audit" }), A = 1e3, j = [], M = () => [...j], N = () => {
+	j.length = 0;
+}, P = (e) => {
+	j.push(e), j.length > A && j.splice(0, j.length - A);
+}, F = (e) => {
+	let t = e.subject.id ? `${e.subject.type}:${e.subject.id}` : e.subject.type, n = e.outcome.kind, r = {
 		subject: t,
 		tenant: e.subject.tenantId ?? null,
 		status: n,
 		durationMs: e.outcome.durationMs,
 		traceId: e.traceId
 	};
-	n === "error" ? K.warn(e.tag, r) : K.info(e.tag, r);
-}, te = (e, n) => typeof e == "function" ? (n) => t.suspend(() => {
-	let r = e(n);
-	return r === void 0 ? t.void : t.isEffect(r) ? r : t.tryPromise({
-		try: () => Promise.resolve(r),
+	n === "error" ? k.warn(e.tag, r) : k.info(e.tag, r);
+}, I = (e, t) => typeof e == "function" ? (t) => S.suspend(() => {
+	let n = e(t);
+	return n === void 0 ? S.void : S.isEffect(n) ? n : S.tryPromise({
+		try: () => Promise.resolve(n),
 		catch: (e) => e
 	});
-}) : e === "datastore" ? (e) => t.suspend(() => {
-	let r = n();
-	return r ? t.tryPromise({
-		try: () => r(e),
+}) : e === "datastore" ? (e) => S.suspend(() => {
+	let n = t();
+	return n ? S.tryPromise({
+		try: () => n(e),
 		catch: (e) => e
-	}) : t.void;
-}) : e === "memory" ? (e) => t.sync(() => Z(e)) : (e) => t.sync(() => Q(e)), ne = (e) => {
-	let t = [], n = [], r = (e) => {
-		if (e._tag !== "Empty") {
-			if (e._tag === "Fail") {
-				t.push(e.error);
-				return;
-			}
-			if (e._tag === "Die") {
-				n.push(e.defect);
-				return;
-			}
-			if (e._tag !== "Interrupt") {
-				if (e._tag === "Sequential") {
-					r(e.left), r(e.right);
-					return;
-				}
-				if (e._tag === "Parallel") {
-					r(e.left), r(e.right);
-					return;
-				}
-			}
-		}
-	};
-	return r(e), t[0] ?? n[0] ?? e;
-}, $ = "@voltro/plugin-audit", re = (e = {}) => {
-	let o = e.sink === "datastore";
-	o && ee({
+	}) : S.void;
+}) : e === "memory" ? (e) => S.sync(() => P(e)) : (e) => S.sync(() => F(e)), L = (e) => {
+	let t = e.reasons.filter(x.isFailReason).map((e) => e.error), n = e.reasons.filter(x.isDieReason).map((e) => e.defect);
+	return t[0] ?? n[0] ?? e;
+}, R = "@voltro/plugin-audit", z = (n = {}) => {
+	let r = n.sink === "datastore", i = n.mutationCapture === "transactional-outbox", o = n.failureCapture === "outbox", s = n.successCapture === "outbox", c = n.invocationCapture === "required", l = i || o || s;
+	if (o && !r) throw TypeError("Outbox failure capture requires datastore sink");
+	if (s && !r) throw TypeError("Outbox success capture requires datastore sink");
+	if (i && !r) throw TypeError("Transactional audit capture requires the datastore sink");
+	if (c && (!r || !s || !o || n.record !== void 0 && n.record !== "all")) throw TypeError("Required invocation capture needs datastore sink, success/failure outbox capture and record: all");
+	let u = re({
+		base: R,
+		alias: n.alias
+	}), v = u + "/append", y = u + "/append-failure", b = u + "/append-invocation-outcome";
+	r && D({
 		source: "plugin",
-		table: k,
+		table: t,
 		timeColumn: "at",
-		ttlMs: p(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 8760)
+		ttlMs: O(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 8760)
 	});
-	let s, c = te(e.sink, () => s), l = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), u = l(e.exclude), d = l(e.include), f = (e) => !(u?.test(e) || d && !d.test(e)), m = (t) => {
-		let n = e.record ?? "all";
-		return n === "all" ? !0 : n === "errors" ? t.outcome.kind === "error" : n(t);
-	}, h = { __redacted: "all" }, g = e.redactionLengthFloor ?? 16, _ = (t) => {
-		let n = e.redactInput ?? "all";
-		return n === "none" ? t : n === "all" ? {
+	let T, A, j = I(n.sink, () => T), M = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), N = M(n.exclude), P = M(n.include), F = (e) => !(N?.test(e) || P && !P.test(e)), z = (e) => {
+		let t = n.record ?? "all";
+		return t === "all" ? !0 : t === "errors" ? e.outcome.kind === "error" : t(e);
+	}, B = { __redacted: "all" }, V = n.redactionLengthFloor ?? 16, H = (t) => {
+		let r = n.redactInput ?? "all";
+		return r === "none" ? t : r === "all" ? {
 			...t,
-			input: h
-		} : n === "shape" ? {
+			input: B
+		} : r === "shape" ? {
 			...t,
-			input: O(t.input, g)
+			input: e(t.input, V)
 		} : {
 			...t,
-			input: n(t)
+			input: r(t)
 		};
-	}, v = (t) => {
-		let n = e.redactOutcome ?? "all";
-		if (n === "none") return t;
-		let r = t.outcome, i = n === "all" ? h : n === "shape" ? ((e) => O(e, g))(r.kind === "ok" ? r.value : r.error) : n(t);
-		if (r.kind === "ok") return {
+	}, U = (t) => {
+		if (t.outcome.kind === "unknown") return t;
+		let r = n.redactOutcome ?? "all";
+		if (r === "none") return t;
+		let i = { ...t.outcome }, a = r === "all" ? B : r === "shape" ? ((t) => e(t, V))(i.kind === "ok" ? i.value : i.error) : r(t);
+		if (i.kind === "ok") return {
 			...t,
 			outcome: {
-				...r,
-				value: i
+				...i,
+				value: a
 			}
 		};
-		let a = r.error, o = typeof a == "object" && a ? a._tag : void 0;
+		let o = i.error, s = typeof o == "object" && o ? o._tag : void 0;
 		return {
 			...t,
 			outcome: {
-				...r,
-				error: o === void 0 ? i : {
-					_tag: o,
-					...i
+				...i,
+				error: s === void 0 ? a : {
+					_tag: s,
+					...a
 				}
 			}
 		};
-	}, y = (t) => {
-		let n = e.redactSubject ?? "metadata";
-		if (n === "none") return t;
-		if (typeof n == "function") return {
+	}, W = (t) => {
+		let r = n.redactSubject ?? "metadata";
+		if (r === "none") return t;
+		if (typeof r == "function") return {
 			...t,
-			subject: n(t.subject)
+			subject: r(t.subject)
 		};
-		let r = t.subject;
-		if (r.metadata === void 0) return t;
-		let { metadata: i, ...a } = r, o = n === "metadata-shape" ? O(i, g) : h;
+		let i = t.subject;
+		if (i.metadata === void 0) return t;
+		let { metadata: a, ...o } = i, s = r === "metadata-shape" ? e(a, V) : B;
 		return {
 			...t,
 			subject: {
-				...a,
-				metadata: o
+				...o,
+				metadata: s
 			}
 		};
-	}, b = (e) => {
-		let t = a(e.subject);
+	}, G = (e) => {
+		let t = ie(e.subject);
 		return t === null ? e : {
 			...e,
 			impersonation: t
 		};
-	}, x = (e) => m(e) ? c(v(y(_(b(e))))) : t.void, S = (t) => {
-		if (e.resolveScope !== void 0) try {
-			return e.resolveScope(t);
+	}, K = (e) => U(W(H(G(e)))), se = (e) => {
+		if (e == null) return null;
+		if (n.redactActor === void 0) return e;
+		let { id: t, type: r } = e, i = n.redactActor(Object.freeze({ ...e }));
+		if (typeof i != "object" || !i) throw TypeError("Actor redaction must return displayName and email labels");
+		let { displayName: a, email: o } = i;
+		if (a !== null && typeof a != "string" || o !== null && typeof o != "string") throw TypeError("Actor redaction labels must be strings or null");
+		return {
+			id: t,
+			type: r,
+			displayName: a,
+			email: o
+		};
+	}, q = async (e, t) => {
+		let n = e.actor === void 0 ? t === void 0 ? null : await oe(t, e.subject.id, e.subject.type) : e.actor;
+		return {
+			...K(e),
+			actor: se(n)
+		};
+	}, J = (e) => z(e) ? n.redactActor === void 0 ? j(K(e)) : S.tryPromise({
+		try: () => q(e, A),
+		catch: (e) => e
+	}).pipe(S.flatMap(j)) : S.void, Y = (e) => {
+		if (n.resolveScope !== void 0) try {
+			return n.resolveScope(e);
 		} catch {
 			return;
 		}
-	}, C = (n, r) => e.metadata === void 0 ? t.succeed(void 0) : t.tryPromise(async () => e.metadata({
-		tag: n.tag,
-		subject: n.subject,
-		input: n.input,
-		outcome: r
-	})).pipe(t.catchAllCause(() => t.succeed(void 0))), w = (e, n) => f(n.tag) ? t.suspend(() => {
-		let r = Date.now(), i = S(n);
-		return e.pipe(t.tap((e) => C(n, {
-			kind: "ok",
-			value: e
-		}).pipe(t.flatMap((t) => x({
-			ts: r,
-			tag: n.tag,
-			subject: n.subject,
-			...i === void 0 ? {} : { scope: i },
-			...t === void 0 ? {} : { metadata: t },
-			traceId: n.traceId,
-			input: n.input,
-			outcome: {
-				kind: "ok",
-				value: e,
-				durationMs: Date.now() - r
-			}
-		}))).pipe(t.catchAllCause(() => t.void))), t.tapErrorCause((e) => {
-			let a = ne(e);
-			return C(n, {
-				kind: "error",
-				error: a
-			}).pipe(t.flatMap((e) => x({
+	}, X = (e, t) => n.metadata === void 0 ? S.succeed(void 0) : S.tryPromise(async () => n.metadata({
+		tag: e.tag,
+		subject: e.subject,
+		input: e.input,
+		outcome: t
+	})).pipe(S.catchCause(() => S.succeed(void 0))), Z = (e, t, r, i) => S.tryPromise({
+		try: async () => {
+			let a = i === void 0 ? n.resolveScope?.(e) : i.scope, o = {
+				...r,
+				durationMs: Date.now() - t,
+				...i === void 0 ? {} : { invocationId: i.outcome.invocationId }
+			}, s = await n.metadata?.({
+				...e,
+				outcome: { ...o }
+			}), c = {
+				ts: t,
+				tag: e.tag,
+				subject: e.subject,
+				traceId: e.traceId,
+				input: e.input,
+				outcome: o,
+				...a === void 0 ? {} : { scope: a },
+				...s === void 0 ? {} : { metadata: s }
+			};
+			if (!z(c)) return;
+			if (e.enqueueOutcome === void 0 || A === void 0) throw TypeError("Required audit outcome capture is unavailable");
+			let l = i === void 0 ? await q(c, A) : U({
+				...i,
+				outcome: o,
+				...s === void 0 ? {} : { metadata: s }
+			}), u = i === void 0 ? r.kind === "error" ? ne(l) : g(l) : _(l);
+			await e.enqueueOutcome(i === void 0 ? r.kind === "error" ? y : v : b, u);
+		},
+		catch: (e) => e
+	}), ce = (e, r) => S.tryPromise({
+		try: async () => {
+			if (e.enqueueOutcome === void 0 || A === void 0 || T === void 0) throw TypeError("Required audit invocation capture is unavailable");
+			let i = E({
+				kind: "typeid",
+				prefix: "audit"
+			}, t);
+			if (i === null) throw TypeError("Audit invocation identity is unavailable");
+			let a = n.resolveScope?.(e), o = await q({
 				ts: r,
-				tag: n.tag,
-				subject: n.subject,
-				...i === void 0 ? {} : { scope: i },
-				...e === void 0 ? {} : { metadata: e },
-				traceId: n.traceId,
-				input: n.input,
-				outcome: {
+				tag: e.tag,
+				subject: e.subject,
+				traceId: e.traceId,
+				input: e.input,
+				...a === void 0 ? {} : { scope: a },
+				outcome: Object.freeze({
+					kind: "unknown",
+					invocationId: i,
+					durationMs: 0
+				})
+			}, A), s = ee(h(o));
+			return await T(s, i), s;
+		},
+		catch: (e) => e
+	}), Q = (e, t) => {
+		if (!F(t.tag)) return e;
+		let n = i && t.kind === "mutation", r = o && t.kind !== "query", a = s && (t.kind === "action" || t.kind === "workflow"), l = c && (t.kind === "action" || t.kind === "workflow");
+		return S.suspend(() => {
+			let i = Date.now(), o = n || r || a ? void 0 : Y(t), s = (s) => e.pipe(S.tap((e) => n ? S.void : a ? Z(t, i, {
+				kind: "ok",
+				value: e
+			}, s).pipe(S.catchCause(() => (k.warn("Audit success capture could not be queued", { tag: t.tag }), S.void))) : S.suspend(() => {
+				let n = r ? Y(t) : o;
+				return X(t, {
+					kind: "ok",
+					value: e
+				}).pipe(S.flatMap((r) => J({
+					ts: i,
+					tag: t.tag,
+					subject: t.subject,
+					...n === void 0 ? {} : { scope: n },
+					...r === void 0 ? {} : { metadata: r },
+					traceId: t.traceId,
+					input: t.input,
+					outcome: {
+						kind: "ok",
+						value: e,
+						durationMs: Date.now() - i
+					}
+				}))).pipe(S.catchCause(() => S.void));
+			})), S.tapCause((e) => {
+				if (s !== void 0 && x.hasInterrupts(e)) return S.void;
+				let c = L(e);
+				if (r) return Z(t, i, {
 					kind: "error",
-					error: a,
-					durationMs: Date.now() - r
-				}
-			}))).pipe(t.catchAllCause(() => t.void));
-		}));
-	}) : e, T = (e) => {
-		let r = `http.${e.method.toUpperCase()} ${e.path}`;
-		f(r) && t.runPromise(x({
+					error: c
+				}, s).pipe(S.catchCause(() => (k.warn("Audit failure capture could not be queued", { tag: t.tag }), S.void)));
+				let l = n || a ? Y(t) : o;
+				return X(t, {
+					kind: "error",
+					error: c
+				}).pipe(S.flatMap((e) => J({
+					ts: i,
+					tag: t.tag,
+					subject: t.subject,
+					...l === void 0 ? {} : { scope: l },
+					...e === void 0 ? {} : { metadata: e },
+					traceId: t.traceId,
+					input: t.input,
+					outcome: {
+						kind: "error",
+						error: c,
+						durationMs: Date.now() - i
+					}
+				}))).pipe(S.catchCause(() => S.void));
+			}));
+			return l ? ce(t, i).pipe(S.flatMap(s)) : s();
+		});
+	}, le = (e) => {
+		let t = `http.${e.method.toUpperCase()} ${e.path}`;
+		F(t) && S.runPromise(J({
 			ts: Date.now() - e.durationMs,
-			tag: r,
-			subject: n(null),
+			tag: t,
+			subject: C(null),
 			traceId: e.traceId,
 			input: {
 				method: e.method,
@@ -420,35 +283,98 @@ var x = 4, S = 32, C = 64, w = /^[A-Za-z_$][A-Za-z0-9_$]*$/, T = (e, t) => e ===
 				value: { status: e.status },
 				durationMs: e.durationMs
 			}
-		}).pipe(t.catchAllCause(() => t.void)));
-	}, E = w, D = w, A = w, j = w;
-	return r({
-		name: i({
-			base: $,
-			alias: e.alias
-		}),
-		baseName: $,
+		}).pipe(S.catchCause(() => S.void)));
+	}, ue = Q, de = Q, fe = Q, pe = Q, me = (e) => S.tryPromise({
+		try: async () => {
+			if (!F(e.tag)) return;
+			if (e.outbox === void 0) throw TypeError("Required audit transaction outbox is unavailable");
+			if (e.startedAt === void 0 || e.durationMs === void 0) throw TypeError("Required audit execution timing is unavailable");
+			let t = n.resolveScope?.(e), r = {
+				kind: "ok",
+				value: e.output,
+				durationMs: e.durationMs
+			}, i = await n.metadata?.({
+				...e,
+				outcome: r
+			}), a = {
+				ts: e.startedAt,
+				tag: e.tag,
+				subject: e.subject,
+				traceId: e.traceId,
+				input: e.input,
+				outcome: r,
+				...t === void 0 ? {} : { scope: t },
+				...i === void 0 ? {} : { metadata: i }
+			};
+			if (!z(a)) return;
+			let o = await q(a, e.store), s = g(o);
+			await e.outbox.enqueue(v, s);
+		},
+		catch: (e) => e
+	}), $ = (e, n) => ({
+		effect: e,
+		handler: (r) => S.tryPromise({
+			try: async () => {
+				let i = n(r.payload);
+				if (r.subjectId !== i.subject.id || r.tenantId !== i.subject.tenantId || r.traceId !== i.traceId) throw TypeError("Audit intent does not match its captured delivery authority");
+				if (T === void 0) throw TypeError("Required audit datastore is not bound");
+				if (e === b) {
+					let e = i.outcome.invocationId;
+					if (e === void 0 || A === void 0) throw TypeError("Audit invocation admission is unavailable");
+					let n = (await A.query({
+						table: t,
+						predicate: ae("id", e),
+						order: [],
+						take: 1
+					})).find((t) => t.id === e);
+					if (n === void 0) throw TypeError("Audit invocation admission is missing");
+					a({
+						...i,
+						metadata: void 0,
+						outcome: {
+							kind: "unknown",
+							invocationId: e,
+							durationMs: 0
+						}
+					}, n), await T(i, e + ":outcome");
+				} else await T(i, r.outboxId);
+			},
+			catch: (e) => e
+		})
+	});
+	return w({
+		name: u,
+		baseName: R,
 		description: "Records every mutation invocation; ships an audit() schema mixin for row-level metadata.",
 		permissions: [
 			"rpc:intercept:mutation",
 			"rpc:intercept:action",
 			"rpc:intercept:workflow",
 			"http:intercept",
-			...o ? ["store:write"] : [],
-			...e.recordQueries === !0 ? ["rpc:intercept:query"] : []
+			...r ? ["store:write"] : [],
+			...l ? ["outbox:handle"] : [],
+			...n.recordQueries === !0 ? ["rpc:intercept:query"] : []
 		],
-		...o ? {
-			...e.tables === !1 ? {} : { extendSchema: { tables: z } },
+		...r ? {
+			...n.tables === !1 ? {} : { extendSchema: { tables: d } },
 			bindDataStore: (e) => {
-				s = G(e);
+				if (o && (typeof e != "object" || !e || !("query" in e) || typeof e.query != "function")) throw TypeError("Audit failure capture requires readable persistence");
+				if (s && (typeof e != "object" || !e || !("query" in e) || typeof e.query != "function")) throw TypeError("Audit success capture requires readable persistence");
+				T = f(e), typeof e == "object" && e && "query" in e && typeof e.query == "function" && (A = e);
 			}
 		} : {},
-		interceptMutation: E,
-		interceptAction: D,
-		interceptWorkflow: A,
-		onHttpRoute: T,
-		...e.recordQueries === !0 ? { interceptQuery: j } : {}
+		...i ? { beforeMutationCommit: me } : {},
+		...l ? { outboxHandlers: [
+			...i || s ? [$(v, p)] : [],
+			...o ? [$(y, te)] : [],
+			...c ? [$(b, m)] : []
+		] } : {},
+		interceptMutation: ue,
+		interceptAction: de,
+		interceptWorkflow: fe,
+		onHttpRoute: le,
+		...n.recordQueries === !0 ? { interceptQuery: pe } : {}
 	});
 };
 //#endregion
-export { k as AUDIT_LOG_TABLE, e as audit, U as auditByScope, W as auditBySubject, H as auditByTrace, B as auditEventToRow, R as auditLogTable, z as auditLogTables, re as auditPlugin, F as auditRowHash, X as clearAuditBuffer, G as dataStoreAuditSink, I as makeAuditChain, Y as readAuditBuffer, L as verifyAuditChain };
+export { t as AUDIT_LOG_TABLE, v as audit, o as auditByScope, s as auditBySubject, c as auditByTrace, l as auditEventToRow, y as auditInvocationIdentity, b as auditInvocationQuery, u as auditLogTable, d as auditLogTables, z as auditPlugin, n as auditRowHash, N as clearAuditBuffer, f as dataStoreAuditSink, r as makeAuditChain, M as readAuditBuffer, i as verifyAuditChain };