@voltro/plugin-audit 0.84.0 → 0.86.0

package/dist/invocationIdentity.js

@@ -0,0 +1,11 @@
+//#region src/invocationIdentity.ts
+var e = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return null;
+	let t = e.invocationId;
+	return typeof t == "string" && t.trim().length > 0 ? t : null;
+}, t = (t) => {
+	let n = t.outcome;
+	return typeof n == "object" && n && !Array.isArray(n) && n.invocationId !== void 0 && e(n) === null ? !1 : (t.invocationId ?? null) === e(n);
+};
+//#endregion
+export { e as auditInvocationIdOf, t as hasConsistentAuditInvocationId };

package/dist/invocationQuery.js

@@ -0,0 +1,14 @@
+import { hasConsistentAuditInvocationId as e } from "./invocationIdentity.js";
+import { auditLogTable as t } from "./store.js";
+import { and as n, columnRef as r, eq as i, isNull as a, neq as o, or as s, queryFor as c } from "@voltro/database";
+//#region src/invocationQuery.ts
+var l = (e, t) => s(i(e, r(t)), n(a(e), a(t))), u = () => c(t).as("audit").leftJoin(t.tableName, "completed", n(i("completed.invocationId", r("audit.id")), s(i("completed.status", "ok"), i("completed.status", "error")), i("completed.tag", r("audit.tag")), i("completed.traceId", r("audit.traceId")), i("completed.at", r("audit.at")), l("completed.subjectId", "audit.subjectId"), l("completed.tenantId", "audit.tenantId"), l("completed.scopeKey", "audit.scopeKey"))).where(s(o("audit.status", "unknown"), a("completed.id"))), d = (t) => {
+	if (!e(t)) throw TypeError("Audit invocation lookup does not match its protected outcome");
+	let n = t.id, r = t.invocationId;
+	if (typeof n != "string") throw TypeError("Audit row identity is unavailable");
+	if (typeof r != "string") return n;
+	if (t.status === "unknown" ? n !== r : n !== r + ":outcome") throw TypeError("Audit invocation receipt identity is inconsistent");
+	return r;
+};
+//#endregion
+export { d as auditInvocationIdentity, u as auditInvocationQuery };

package/dist/redactionShape.js

@@ -0,0 +1,22 @@
+//#region src/redactionShape.ts
+var e = /^[A-Za-z_$][A-Za-z0-9_$]*$/, t = (e, t) => e === 0 || t <= 0 || e >= t ? `string(${e})` : `string(<${t})`, n = (n, r) => n.length <= 64 && e.test(n) ? n : `<key:${t(n.length, r)}>`, r = (e, i = 0, a = 16) => {
+	if (e === null) return "null";
+	if (e === void 0) return "undefined";
+	let o = typeof e;
+	if (o === "string") return t(e.length, a);
+	if (o === "number" || o === "boolean" || o === "bigint" || o === "symbol" || o === "function") return o;
+	if (e instanceof Date) return "date";
+	if (i >= 4) return Array.isArray(e) ? "array(…)" : "object(…)";
+	if (Array.isArray(e)) {
+		let t = e.slice(0, 32).map((e) => r(e, i + 1, a));
+		return e.length > 32 ? [...t, `…${e.length - 32} more`] : t;
+	}
+	if (o === "object") {
+		let t = Object.entries(e), o = {};
+		for (let [e, s] of t.slice(0, 32)) o[n(e, a)] = r(s, i + 1, a);
+		return t.length > 32 && (o["…"] = `${t.length - 32} more key(s)`), o;
+	}
+	return o;
+}, i = (e, t = 16) => ({ __redacted: r(e, 0, t) });
+//#endregion
+export { r as redactionShape, i as shapeRedaction };

package/dist/store.js

@@ -0,0 +1,183 @@
+import { AUDIT_LOG_TABLE as e } from "./tableName.js";
+import { auditInvocationIdOf as t, hasConsistentAuditInvocationId as n } from "./invocationIdentity.js";
+import { auditRowHash as r, makeAuditChain as i } from "./chain.js";
+import { Effect as a, Result as o, Semaphore as s } from "effect";
+import { and as c, eq as l, generateId as u, id as d, integer as f, json as p, resolveActorSnapshot as m, scopeKeyOf as h, table as g, text as _, timestamp as v } from "@voltro/database";
+import { isDeepStrictEqual as y } from "node:util";
+//#region src/store.ts
+var b = g(e, {
+	id: d({ prefix: "audit" }),
+	tag: _(),
+	at: v(),
+	subjectId: _().nullable(),
+	tenantId: _().nullable(),
+	traceId: _(),
+	invocationId: _().nullable(),
+	status: _(),
+	durationMs: _(),
+	subject: p(),
+	actor: p().nullable(),
+	scope: p().nullable(),
+	scopeKey: _().nullable(),
+	metadata: p().nullable(),
+	impersonation: p().nullable(),
+	input: p(),
+	outcome: p(),
+	errorTag: _().nullable(),
+	hashVersion: f().nullable(),
+	chainId: _().nullable(),
+	seq: f().nullable(),
+	prevHash: _().nullable(),
+	hash: _().nullable()
+}).index("byAuditTag", ["tag"]).index("byAuditTrace", ["traceId"]).index("byAuditInvocation", ["invocationId", "status"]).index("byAuditSubjectStatus", [
+	"subjectId",
+	"status",
+	"at"
+]).index("byAuditTenantStatus", [
+	"tenantId",
+	"status",
+	"at"
+]).index("byAuditScope", ["scopeKey", "at"]).index("byAuditChain", ["chainId", "seq"]), x = [b], S = (e) => ({
+	tag: e.tag,
+	at: new Date(e.ts),
+	subjectId: e.subject.id ?? null,
+	tenantId: e.subject.tenantId ?? null,
+	traceId: e.traceId,
+	invocationId: t(e.outcome),
+	status: e.outcome.kind,
+	durationMs: String(e.outcome.durationMs),
+	subject: e.subject,
+	actor: e.actor ?? null,
+	scope: e.scope ?? null,
+	scopeKey: h(e.scope),
+	metadata: e.metadata ?? null,
+	impersonation: e.impersonation ?? null,
+	input: e.input,
+	outcome: e.outcome,
+	errorTag: e.outcome.kind === "error" ? C(e.outcome.error) : null
+}), C = (e) => {
+	if (typeof e != "object" || !e) return null;
+	let t = e._tag;
+	return typeof t == "string" && t !== "" ? t : null;
+}, w = async (t, n) => t.query({
+	table: e,
+	predicate: l("traceId", n),
+	order: [{
+		column: "at",
+		direction: "asc"
+	}]
+}), T = async (t, n, r = {}) => {
+	let i = h(n);
+	if (i === null) return [];
+	let a = l("scopeKey", i);
+	return t.query({
+		table: e,
+		predicate: r.status === void 0 ? a : c(a, l("status", r.status)),
+		order: [{
+			column: "at",
+			direction: "desc"
+		}],
+		take: r.limit ?? 100
+	});
+}, E = async (t, n, r = {}) => {
+	let i = l("subjectId", n);
+	return t.query({
+		table: e,
+		predicate: r.status === void 0 ? i : c(i, l("status", r.status)),
+		order: [{
+			column: "at",
+			direction: "desc"
+		}],
+		take: r.limit ?? 100
+	});
+}, D = (e, t) => {
+	let i = {
+		chainId: t.chainId,
+		seq: t.seq,
+		prevHash: t.prevHash
+	}, a = {
+		...S(e),
+		actor: e.actor === void 0 ? t.actor ?? null : e.actor,
+		hashVersion: t.hashVersion ?? null,
+		id: t.id
+	};
+	if (!n(t) || typeof i.chainId != "string" || !Number.isSafeInteger(i.seq) || i.seq < 1 || typeof t.hash != "string" || r(t, i) !== t.hash || r(a, i) !== t.hash || !y(t.impersonation ?? null, a.impersonation ?? null)) throw Error("Audit receipt identity already belongs to different or tampered content");
+}, O = (t) => {
+	let c = i().chainId, d = s.makeUnsafe(1), f = {
+		seq: 0,
+		hash: null
+	}, p = typeof t.query == "function" ? t : void 0;
+	return (i, s) => a.runPromise(d.withPermits(1)(a.result(a.tryPromise({
+		try: async () => {
+			if (s !== void 0) {
+				if (typeof s != "string" || s.trim().length === 0) throw TypeError("Audit receipt identity must be a non-empty string");
+				if (p === void 0) throw TypeError("Audit receipt replay requires readable persistence");
+				let t = (await p.query({
+					table: e,
+					predicate: l("id", s),
+					order: [],
+					take: 1
+				})).find((e) => e.id === s);
+				if (t !== void 0) {
+					D(i, t);
+					return;
+				}
+			}
+			let a = i.actor !== void 0 || p === void 0 ? i : {
+				...i,
+				actor: await m(p, i.subject.id ?? null, i.subject.type)
+			};
+			if (p !== void 0) {
+				let t = (await p.query({
+					table: e,
+					predicate: l("chainId", c),
+					order: [{
+						column: "seq",
+						direction: "desc"
+					}],
+					take: 1
+				})).filter((e) => e.chainId === c).sort((e, t) => Number(t.seq) - Number(e.seq))[0];
+				if (t === void 0) f = {
+					seq: 0,
+					hash: null
+				};
+				else {
+					let e = Number(t.seq);
+					if (!Number.isSafeInteger(e) || e < 1 || typeof t.hash != "string") throw Error("Audit writer persisted chain tip is invalid");
+					f = {
+						seq: e,
+						hash: t.hash
+					};
+				}
+			}
+			let o = {
+				...S(a),
+				id: s ?? u({
+					kind: "typeid",
+					prefix: "audit"
+				}, "_voltro_audit_log"),
+				hashVersion: 2
+			};
+			if (!n(o)) throw TypeError("Audit invocation identity is invalid");
+			let d = {
+				chainId: c,
+				seq: f.seq + 1,
+				prevHash: f.hash
+			}, h = r(o, d);
+			await t.insert(e, {
+				...o,
+				...s === void 0 ? {} : { id: s },
+				...d,
+				hash: h
+			}), f = {
+				seq: d.seq,
+				hash: h
+			};
+		},
+		catch: (e) => e
+	})))).then((e) => {
+		if (o.isFailure(e)) throw e.failure;
+	});
+};
+//#endregion
+export { e as AUDIT_LOG_TABLE, D as assertAuditReceipt, T as auditByScope, E as auditBySubject, w as auditByTrace, S as auditEventToRow, b as auditLogTable, x as auditLogTables, O as dataStoreAuditSink };

package/dist/tableName.js

@@ -0,0 +1,4 @@
+//#region src/tableName.ts
+var e = "_voltro_audit_log";
+//#endregion
+export { e as AUDIT_LOG_TABLE };

package/dist/transactionalCapture.js

@@ -0,0 +1,101 @@
+import { Schema as e } from "effect";
+import { Subject as t } from "@voltro/protocol";
+//#region src/transactionalCapture.ts
+var n = e.Struct({
+	id: e.String,
+	type: e.String,
+	displayName: e.NullOr(e.String),
+	email: e.NullOr(e.String)
+}), r = {
+	ts: e.Number,
+	tag: e.String,
+	subject: t,
+	actor: e.NullOr(n),
+	traceId: e.String,
+	input: e.Unknown,
+	scope: e.optional(e.Unknown),
+	metadata: e.optional(e.Unknown),
+	impersonation: e.optional(e.Unknown)
+}, i = e.Struct({
+	version: e.Literal(1),
+	event: e.Struct({
+		...r,
+		outcome: e.Struct({
+			kind: e.Literal("ok"),
+			value: e.Unknown,
+			durationMs: e.Number
+		})
+	})
+}), a = e.Struct({
+	version: e.Literal(1),
+	event: e.Struct({
+		...r,
+		outcome: e.Struct({
+			kind: e.Literal("error"),
+			error: e.Unknown,
+			durationMs: e.Number
+		})
+	})
+}), o = e.Struct({
+	version: e.Literal(1),
+	event: e.Struct({
+		...r,
+		outcome: e.Struct({
+			kind: e.Literal("unknown"),
+			invocationId: e.String,
+			durationMs: e.Number
+		})
+	})
+}), s = e.Struct({
+	version: e.Literal(1),
+	event: e.Struct({
+		...r,
+		outcome: e.Union([e.Struct({
+			kind: e.Literal("ok"),
+			invocationId: e.String,
+			value: e.Unknown,
+			durationMs: e.Number
+		}), e.Struct({
+			kind: e.Literal("error"),
+			invocationId: e.String,
+			error: e.Unknown,
+			durationMs: e.Number
+		})])
+	})
+}), c = (e) => {
+	if (!Number.isSafeInteger(e.ts) || e.ts < 0 || !Number.isFinite(e.outcome.durationMs) || e.outcome.durationMs < 0 || e.tag.trim().length === 0) throw TypeError("Audit intent has invalid timing or procedure identity");
+	if (e.outcome.invocationId !== void 0 && e.outcome.invocationId.trim().length === 0) throw TypeError("Audit invocation identity must be non-empty");
+	if (e.outcome.kind === "unknown" && e.outcome.durationMs !== 0) throw TypeError("Unknown audit outcome has no completed duration");
+	return e;
+}, l = (t) => c(e.decodeUnknownSync(i, { onExcessProperty: "error" })(t).event), u = (t) => c(e.decodeUnknownSync(a, { onExcessProperty: "error" })(t).event), d = (t) => c(e.decodeUnknownSync(o, { onExcessProperty: "error" })(t).event), f = (t) => c(e.decodeUnknownSync(s, { onExcessProperty: "error" })(t).event), p = (e, t) => {
+	if (e == null) return null;
+	if (typeof e == "string" || typeof e == "boolean" || typeof e == "number" && Number.isFinite(e)) return e;
+	if (typeof e != "object") throw TypeError("Audit intent requires portable JSON values");
+	if (e instanceof Date) {
+		if (!Number.isFinite(e.getTime())) throw TypeError("Audit intent requires valid dates");
+		return e.toISOString();
+	}
+	if (t.has(e)) throw TypeError("Audit intent cannot contain cyclic values");
+	if (!Array.isArray(e) && Object.getPrototypeOf(e) !== Object.prototype && Object.getPrototypeOf(e) !== null) throw TypeError("Audit intent requires plain JSON objects");
+	if (Object.getOwnPropertySymbols(e).length !== 0) throw TypeError("Audit intent cannot contain symbol keys");
+	t.add(e);
+	try {
+		return Array.isArray(e) ? Array.from(e, (e) => p(e, t)) : Object.fromEntries(Object.entries(e).map(([e, n]) => [e, p(n, t)]));
+	} finally {
+		t.delete(e);
+	}
+}, m = (e, t) => {
+	let n = Object.fromEntries(Object.entries(e.subject).filter(([, e]) => e !== void 0));
+	return {
+		version: 1,
+		event: t(JSON.parse(JSON.stringify(p({
+			version: 1,
+			event: {
+				...e,
+				subject: n
+			}
+		}, /* @__PURE__ */ new Set()))))
+	};
+}, h = (e) => m(e, l), g = (e) => m(e, u), _ = (e) => m(e, d), v = (e) => m(e, f);
+//#endregion
+export { d as decodeAuditAdmissionIntent, u as decodeAuditFailureIntent, l as decodeAuditIntent, f as decodeAuditInvocationOutcomeIntent, _ as freezeAuditAdmissionIntent, g as freezeAuditFailureIntent, h as freezeAuditIntent, v as freezeAuditInvocationOutcomeIntent };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-audit",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "Audit plugin — ships the `audit()` schema mixin (createdAt/updatedAt/createdBy/updatedBy → Actor) plus an optional interceptor that records every mutation and action (queries on request) to a configurable sink (console / memory / datastore / custom function).",
   "keywords": [
     "voltro",
@@ -38,12 +38,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.84.0",
-    "@voltro/logger": "0.84.0",
-    "@voltro/protocol": "0.84.0"
+    "@voltro/database": "0.86.0",
+    "@voltro/logger": "0.86.0",
+    "@voltro/protocol": "0.86.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"