@voltro/plugin-audit 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,434 +1,266 @@
-import { audit as e } from "./mixin.js";
-import { Cause as t, Effect as n } from "effect";
-import { anonymousSubject as r, definePlugin as i, pluginInstanceName as a, rawImpersonationMark as o } from "@voltro/protocol";
-import { createLogger as s } from "@voltro/logger";
-import { and as c, column as l, eq as u, gt as d, id as f, integer as p, isNotNull as m, isNull as h, json as g, lte as _, or as v, registerRetention as ee, resolveActorSnapshot as y, retentionTtlMsFromEnv as b, scopeKeyOf as x, table as S, text as C, timestamp as w } from "@voltro/database";
-import { createHash as T, createHmac as E, randomBytes as D } from "node:crypto";
-//#region src/redactionShape.ts
-var O = 4, k = 32, A = 64, te = /^[A-Za-z_$][A-Za-z0-9_$]*$/, j = (e, t) => e === 0 || t <= 0 || e >= t ? `string(${e})` : `string(<${t})`, M = (e, t) => e.length <= A && te.test(e) ? e : `<key:${j(e.length, t)}>`, N = (e, t = 0, n = 16) => {
-	if (e === null) return "null";
-	if (e === void 0) return "undefined";
-	let r = typeof e;
-	if (r === "string") return j(e.length, n);
-	if (r === "number" || r === "boolean" || r === "bigint" || r === "symbol" || r === "function") return r;
-	if (e instanceof Date) return "date";
-	if (t >= O) return Array.isArray(e) ? "array(…)" : "object(…)";
-	if (Array.isArray(e)) {
-		let r = e.slice(0, k).map((e) => N(e, t + 1, n));
-		return e.length > k ? [...r, `…${e.length - k} more`] : r;
-	}
-	if (r === "object") {
-		let r = Object.entries(e), i = {};
-		for (let [e, a] of r.slice(0, k)) i[M(e, n)] = N(a, t + 1, n);
-		return r.length > k && (i["…"] = `${r.length - k} more key(s)`), i;
-	}
-	return r;
-}, P = (e, t = 16) => ({ __redacted: N(e, 0, t) }), F = "_voltro_audit_log", I = [
-	"tag",
-	"at",
-	"subjectId",
-	"tenantId",
-	"traceId",
-	"status",
-	"durationMs",
-	"subject",
-	"actor",
-	"scope",
-	"metadata",
-	"input",
-	"outcome",
-	"errorTag"
-], L = (e) => {
-	if (e == null) return "null";
-	if (e instanceof Date) return JSON.stringify(e.toISOString());
-	let t = typeof e;
-	return t === "number" || t === "boolean" || t === "string" ? JSON.stringify(e) : t === "bigint" ? JSON.stringify(String(e)) : Array.isArray(e) ? `[${e.map(L).join(",")}]` : t === "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${L(t)}`).join(",")}}` : JSON.stringify(String(e));
-}, ne = (e) => e instanceof Date ? e.toISOString() : e, re = (e) => L(Object.fromEntries(I.map((t) => [t, ne(e[t] ?? null)]))), ie = (e) => {
-	let t = process.env.VOLTRO_AUDIT_CHAIN_SECRET;
-	return t ? E("sha256", t).update(e, "utf8").digest("hex") : T("sha256").update(e, "utf8").digest("hex");
-}, R = (e, t) => ie(JSON.stringify([
-	t.chainId,
-	t.seq,
-	t.prevHash,
-	re(e)
-])), z = (e = D(12).toString("base64url")) => {
-	let t = 0, n = null;
-	return {
-		chainId: e,
-		link: (r) => {
-			t += 1;
-			let i = R(r, {
-				chainId: e,
-				seq: t,
-				prevHash: n
-			}), a = {
-				...r,
-				chainId: e,
-				seq: t,
-				prevHash: n,
-				hash: i
-			};
-			return n = i, a;
-		}
-	};
-};
-async function* B(e, t) {
-	let n = t.chainId === void 0 ? void 0 : u("chainId", t.chainId), r = (e, t, n) => ({
-		table: F,
-		predicate: e,
-		order: n,
-		take: t,
-		skip: void 0,
-		projection: void 0
-	});
-	if (t.limit !== void 0) {
-		yield* await e.query(r(n, t.limit, [{
-			column: "chainId",
-			direction: "asc"
-		}, {
-			column: "seq",
-			direction: "asc"
-		}]));
-		return;
-	}
-	let i = [...await e.query({
-		...r(n, void 0, [{
-			column: "chainId",
-			direction: "asc"
-		}]),
-		groupBy: ["chainId"],
-		aggregations: [
-			l("chainId"),
-			{
-				op: "max",
-				column: "seq",
-				alias: "lastSeq"
-			},
-			{
-				op: "max",
-				column: "id",
-				alias: "lastId"
-			}
-		]
-	})].sort((e, t) => String(e.chainId) < String(t.chainId) ? -1 : +(String(e.chainId) > String(t.chainId)));
-	for (let t of i) {
-		let n = t.chainId, i = n == null ? h("chainId") : u("chainId", n), a = n == null ? [!1] : [!1, !0];
-		for (let o of a) {
-			if (o && t.lastSeq == null) continue;
-			let a = [i, _("id", t.lastId)];
-			n != null && a.push(o ? c(m("seq"), _("seq", t.lastSeq)) : h("seq"));
-			let s;
-			for (;;) {
-				let t = s === void 0 ? void 0 : o ? v(d("seq", s.seq), c(u("seq", s.seq), d("id", s.id))) : d("id", s.id), n = await e.query(r(c(...a, ...t ? [t] : []), 1e3, [...o ? [{
-					column: "seq",
-					direction: "asc"
-				}] : [], {
-					column: "id",
-					direction: "asc"
-				}]));
-				if (yield* n, n.length < 1e3) break;
-				let i = n[n.length - 1];
-				if (i.id === void 0 || i.id === s?.id) throw Error("audit verification cursor did not advance");
-				s = i;
-			}
-		}
-	}
-}
-var V = async (e, t = {}) => {
-	let n = [], r = [], i = 0, a = 0, o = null, s = () => {
-		o &&= (r.push({
-			chainId: o.chainId,
-			from: o.from,
-			to: o.last,
-			tip: o.tip,
-			prunedPrefix: o.from > 1
-		}), null);
-	};
-	for await (let r of B(e, t)) {
-		let e = r.chainId, t = r.hash, c = r.seq;
-		if (typeof e != "string" || typeof t != "string" || c == null) {
-			i += 1;
-			continue;
-		}
-		let l = Number(c), u = typeof r.prevHash == "string" ? r.prevHash : null, d = typeof r.id == "string" ? r.id : void 0;
-		a += 1, !o || o.chainId !== e ? (s(), o = {
-			chainId: e,
-			from: l,
-			last: l,
-			tip: t
-		}) : (l === o.last + 1 ? u !== o.tip && n.push({
-			kind: "broken-link",
-			chainId: e,
-			seq: l,
-			...d ? { rowId: d } : {},
-			detail: `prevHash does not match the hash of seq ${o.last}`
-		}) : n.push({
-			kind: "gap",
-			chainId: e,
-			seq: o.last + 1,
-			detail: `chain jumps from seq ${o.last} to ${l} — ${l - o.last - 1} row(s) missing`
-		}), o.last = l, o.tip = t), R(r, {
-			chainId: e,
-			seq: l,
-			prevHash: u
-		}) !== t && n.push({
-			kind: "tampered",
-			chainId: e,
-			seq: l,
-			...d ? { rowId: d } : {},
-			detail: "the row content does not hash to its stored hash — a column was altered"
-		});
-	}
-	return s(), {
-		ok: n.length === 0,
-		rowsChecked: a,
-		unchainedRows: i,
-		chains: r,
-		issues: n,
-		keyed: !!process.env.VOLTRO_AUDIT_CHAIN_SECRET
-	};
-}, H = S(F, {
-	id: f({ prefix: "audit" }),
-	tag: C(),
-	at: w(),
-	subjectId: C().nullable(),
-	tenantId: C().nullable(),
-	traceId: C(),
-	status: C(),
-	durationMs: C(),
-	subject: g(),
-	actor: g().nullable(),
-	scope: g().nullable(),
-	scopeKey: C().nullable(),
-	metadata: g().nullable(),
-	impersonation: g().nullable(),
-	input: g(),
-	outcome: g(),
-	errorTag: C().nullable(),
-	chainId: C().nullable(),
-	seq: p().nullable(),
-	prevHash: C().nullable(),
-	hash: C().nullable()
-}).index("byAuditTag", ["tag"]).index("byAuditTrace", ["traceId"]).index("byAuditSubjectStatus", [
-	"subjectId",
-	"status",
-	"at"
-]).index("byAuditTenantStatus", [
-	"tenantId",
-	"status",
-	"at"
-]).index("byAuditScope", ["scopeKey", "at"]).index("byAuditChain", ["chainId", "seq"]), U = [H], W = (e) => ({
-	tag: e.tag,
-	at: new Date(e.ts),
-	subjectId: e.subject.id ?? null,
-	tenantId: e.subject.tenantId ?? null,
-	traceId: e.traceId,
-	status: e.outcome.kind,
-	durationMs: String(e.outcome.durationMs),
-	subject: e.subject,
-	actor: e.actor ?? null,
-	scope: e.scope ?? null,
-	scopeKey: x(e.scope),
-	metadata: e.metadata ?? null,
-	impersonation: e.impersonation ?? null,
-	input: e.input,
-	outcome: e.outcome,
-	errorTag: e.outcome.kind === "error" ? G(e.outcome.error) : null
-}), G = (e) => {
-	if (typeof e != "object" || !e) return null;
-	let t = e._tag;
-	return typeof t == "string" && t !== "" ? t : null;
-}, K = async (e, t) => e.query({
-	table: F,
-	predicate: u("traceId", t),
-	order: [{
-		column: "at",
-		direction: "asc"
-	}]
-}), q = async (e, t, n = {}) => {
-	let r = x(t);
-	if (r === null) return [];
-	let i = u("scopeKey", r);
-	return e.query({
-		table: F,
-		predicate: n.status === void 0 ? i : c(i, u("status", n.status)),
-		order: [{
-			column: "at",
-			direction: "desc"
-		}],
-		take: n.limit ?? 100
-	});
-}, J = async (e, t, n = {}) => {
-	let r = u("subjectId", t);
-	return e.query({
-		table: F,
-		predicate: n.status === void 0 ? r : c(r, u("status", n.status)),
-		order: [{
-			column: "at",
-			direction: "desc"
-		}],
-		take: n.limit ?? 100
-	});
-}, Y = (e) => {
-	let t = z();
-	return async (n) => {
-		let r = n.actor !== void 0 || typeof e.query != "function" ? n : {
-			...n,
-			actor: await y(e, n.subject.id ?? null, n.subject.type)
-		};
-		await e.insert(F, t.link(W(r)));
-	};
-}, X = s({ scope: "@voltro/plugin-audit" }), Z = 1e3, Q = [], ae = () => [...Q], oe = () => {
-	Q.length = 0;
-}, se = (e) => {
-	Q.push(e), Q.length > Z && Q.splice(0, Q.length - Z);
-}, ce = (e) => {
-	let t = e.subject.id ? `${e.subject.type}:${e.subject.id}` : e.subject.type, n = e.outcome.kind === "ok" ? "ok" : "error", r = {
+import { shapeRedaction as e } from "./redactionShape.js";
+import { AUDIT_LOG_TABLE as t } from "./tableName.js";
+import { auditRowHash as n, makeAuditChain as r, verifyAuditChain as i } from "./chain.js";
+import { assertAuditReceipt as a, auditByScope as o, auditBySubject as s, auditByTrace as c, auditEventToRow as l, auditLogTable as u, auditLogTables as d, dataStoreAuditSink as f } from "./store.js";
+import { decodeAuditAdmissionIntent as ee, decodeAuditFailureIntent as te, decodeAuditIntent as p, decodeAuditInvocationOutcomeIntent as m, freezeAuditAdmissionIntent as h, freezeAuditFailureIntent as ne, freezeAuditIntent as g, freezeAuditInvocationOutcomeIntent as _ } from "./transactionalCapture.js";
+import { audit as v } from "./mixin.js";
+import { auditInvocationIdentity as y, auditInvocationQuery as b } from "./invocationQuery.js";
+import { Cause as x, Effect as S } from "effect";
+import { anonymousSubject as C, definePlugin as w, pluginInstanceName as re, rawImpersonationMark as ie } from "@voltro/protocol";
+import { createLogger as T } from "@voltro/logger";
+import { eq as ae, generateId as E, registerRetention as D, resolveActorSnapshot as oe, retentionTtlMsFromEnv as O } from "@voltro/database";
+//#region src/index.ts
+var k = T({ scope: "@voltro/plugin-audit" }), A = 1e3, j = [], M = () => [...j], N = () => {
+	j.length = 0;
+}, P = (e) => {
+	j.push(e), j.length > A && j.splice(0, j.length - A);
+}, F = (e) => {
+	let t = e.subject.id ? `${e.subject.type}:${e.subject.id}` : e.subject.type, n = e.outcome.kind, r = {
 		subject: t,
 		tenant: e.subject.tenantId ?? null,
 		status: n,
 		durationMs: e.outcome.durationMs,
 		traceId: e.traceId
 	};
-	n === "error" ? X.warn(e.tag, r) : X.info(e.tag, r);
-}, le = (e, t) => typeof e == "function" ? (t) => n.suspend(() => {
-	let r = e(t);
-	return r === void 0 ? n.void : n.isEffect(r) ? r : n.tryPromise({
-		try: () => Promise.resolve(r),
+	n === "error" ? k.warn(e.tag, r) : k.info(e.tag, r);
+}, I = (e, t) => typeof e == "function" ? (t) => S.suspend(() => {
+	let n = e(t);
+	return n === void 0 ? S.void : S.isEffect(n) ? n : S.tryPromise({
+		try: () => Promise.resolve(n),
 		catch: (e) => e
 	});
-}) : e === "datastore" ? (e) => n.suspend(() => {
-	let r = t();
-	return r ? n.tryPromise({
-		try: () => r(e),
+}) : e === "datastore" ? (e) => S.suspend(() => {
+	let n = t();
+	return n ? S.tryPromise({
+		try: () => n(e),
 		catch: (e) => e
-	}) : n.void;
-}) : e === "memory" ? (e) => n.sync(() => se(e)) : (e) => n.sync(() => ce(e)), ue = (e) => {
-	let n = e.reasons.filter(t.isFailReason).map((e) => e.error), r = e.reasons.filter(t.isDieReason).map((e) => e.defect);
-	return n[0] ?? r[0] ?? e;
-}, $ = "@voltro/plugin-audit", de = (e = {}) => {
-	let t = e.sink === "datastore";
-	t && ee({
+	}) : S.void;
+}) : e === "memory" ? (e) => S.sync(() => P(e)) : (e) => S.sync(() => F(e)), L = (e) => {
+	let t = e.reasons.filter(x.isFailReason).map((e) => e.error), n = e.reasons.filter(x.isDieReason).map((e) => e.defect);
+	return t[0] ?? n[0] ?? e;
+}, R = "@voltro/plugin-audit", z = (n = {}) => {
+	let r = n.sink === "datastore", i = n.mutationCapture === "transactional-outbox", o = n.failureCapture === "outbox", s = n.successCapture === "outbox", c = n.invocationCapture === "required", l = i || o || s;
+	if (o && !r) throw TypeError("Outbox failure capture requires datastore sink");
+	if (s && !r) throw TypeError("Outbox success capture requires datastore sink");
+	if (i && !r) throw TypeError("Transactional audit capture requires the datastore sink");
+	if (c && (!r || !s || !o || n.record !== void 0 && n.record !== "all")) throw TypeError("Required invocation capture needs datastore sink, success/failure outbox capture and record: all");
+	let u = re({
+		base: R,
+		alias: n.alias
+	}), v = u + "/append", y = u + "/append-failure", b = u + "/append-invocation-outcome";
+	r && D({
 		source: "plugin",
-		table: F,
+		table: t,
 		timeColumn: "at",
-		ttlMs: b(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 8760)
+		ttlMs: O(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 8760)
 	});
-	let s, c = le(e.sink, () => s), l = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), u = l(e.exclude), d = l(e.include), f = (e) => !(u?.test(e) || d && !d.test(e)), p = (t) => {
-		let n = e.record ?? "all";
-		return n === "all" ? !0 : n === "errors" ? t.outcome.kind === "error" : n(t);
-	}, m = { __redacted: "all" }, h = e.redactionLengthFloor ?? 16, g = (t) => {
-		let n = e.redactInput ?? "all";
-		return n === "none" ? t : n === "all" ? {
+	let T, A, j = I(n.sink, () => T), M = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), N = M(n.exclude), P = M(n.include), F = (e) => !(N?.test(e) || P && !P.test(e)), z = (e) => {
+		let t = n.record ?? "all";
+		return t === "all" ? !0 : t === "errors" ? e.outcome.kind === "error" : t(e);
+	}, B = { __redacted: "all" }, V = n.redactionLengthFloor ?? 16, H = (t) => {
+		let r = n.redactInput ?? "all";
+		return r === "none" ? t : r === "all" ? {
 			...t,
-			input: m
-		} : n === "shape" ? {
+			input: B
+		} : r === "shape" ? {
 			...t,
-			input: P(t.input, h)
+			input: e(t.input, V)
 		} : {
 			...t,
-			input: n(t)
+			input: r(t)
 		};
-	}, _ = (t) => {
-		let n = e.redactOutcome ?? "all";
-		if (n === "none") return t;
-		let r = t.outcome, i = n === "all" ? m : n === "shape" ? ((e) => P(e, h))(r.kind === "ok" ? r.value : r.error) : n(t);
-		if (r.kind === "ok") return {
+	}, U = (t) => {
+		if (t.outcome.kind === "unknown") return t;
+		let r = n.redactOutcome ?? "all";
+		if (r === "none") return t;
+		let i = { ...t.outcome }, a = r === "all" ? B : r === "shape" ? ((t) => e(t, V))(i.kind === "ok" ? i.value : i.error) : r(t);
+		if (i.kind === "ok") return {
 			...t,
 			outcome: {
-				...r,
-				value: i
+				...i,
+				value: a
 			}
 		};
-		let a = r.error, o = typeof a == "object" && a ? a._tag : void 0;
+		let o = i.error, s = typeof o == "object" && o ? o._tag : void 0;
 		return {
 			...t,
 			outcome: {
-				...r,
-				error: o === void 0 ? i : {
-					_tag: o,
-					...i
+				...i,
+				error: s === void 0 ? a : {
+					_tag: s,
+					...a
 				}
 			}
 		};
-	}, v = (t) => {
-		let n = e.redactSubject ?? "metadata";
-		if (n === "none") return t;
-		if (typeof n == "function") return {
+	}, W = (t) => {
+		let r = n.redactSubject ?? "metadata";
+		if (r === "none") return t;
+		if (typeof r == "function") return {
 			...t,
-			subject: n(t.subject)
+			subject: r(t.subject)
 		};
-		let r = t.subject;
-		if (r.metadata === void 0) return t;
-		let { metadata: i, ...a } = r, o = n === "metadata-shape" ? P(i, h) : m;
+		let i = t.subject;
+		if (i.metadata === void 0) return t;
+		let { metadata: a, ...o } = i, s = r === "metadata-shape" ? e(a, V) : B;
 		return {
 			...t,
 			subject: {
-				...a,
-				metadata: o
+				...o,
+				metadata: s
 			}
 		};
-	}, y = (e) => {
-		let t = o(e.subject);
+	}, G = (e) => {
+		let t = ie(e.subject);
 		return t === null ? e : {
 			...e,
 			impersonation: t
 		};
-	}, x = (e) => p(e) ? c(_(v(g(y(e))))) : n.void, S = (t) => {
-		if (e.resolveScope !== void 0) try {
-			return e.resolveScope(t);
+	}, K = (e) => U(W(H(G(e)))), se = (e) => {
+		if (e == null) return null;
+		if (n.redactActor === void 0) return e;
+		let { id: t, type: r } = e, i = n.redactActor(Object.freeze({ ...e }));
+		if (typeof i != "object" || !i) throw TypeError("Actor redaction must return displayName and email labels");
+		let { displayName: a, email: o } = i;
+		if (a !== null && typeof a != "string" || o !== null && typeof o != "string") throw TypeError("Actor redaction labels must be strings or null");
+		return {
+			id: t,
+			type: r,
+			displayName: a,
+			email: o
+		};
+	}, q = async (e, t) => {
+		let n = e.actor === void 0 ? t === void 0 ? null : await oe(t, e.subject.id, e.subject.type) : e.actor;
+		return {
+			...K(e),
+			actor: se(n)
+		};
+	}, J = (e) => z(e) ? n.redactActor === void 0 ? j(K(e)) : S.tryPromise({
+		try: () => q(e, A),
+		catch: (e) => e
+	}).pipe(S.flatMap(j)) : S.void, Y = (e) => {
+		if (n.resolveScope !== void 0) try {
+			return n.resolveScope(e);
 		} catch {
 			return;
 		}
-	}, C = (t, r) => e.metadata === void 0 ? n.succeed(void 0) : n.tryPromise(async () => e.metadata({
-		tag: t.tag,
-		subject: t.subject,
-		input: t.input,
-		outcome: r
-	})).pipe(n.catchCause(() => n.succeed(void 0))), w = (e, t) => f(t.tag) ? n.suspend(() => {
-		let r = Date.now(), i = S(t);
-		return e.pipe(n.tap((e) => C(t, {
-			kind: "ok",
-			value: e
-		}).pipe(n.flatMap((n) => x({
-			ts: r,
-			tag: t.tag,
-			subject: t.subject,
-			...i === void 0 ? {} : { scope: i },
-			...n === void 0 ? {} : { metadata: n },
-			traceId: t.traceId,
-			input: t.input,
-			outcome: {
-				kind: "ok",
-				value: e,
-				durationMs: Date.now() - r
-			}
-		}))).pipe(n.catchCause(() => n.void))), n.tapCause((e) => {
-			let a = ue(e);
-			return C(t, {
-				kind: "error",
-				error: a
-			}).pipe(n.flatMap((e) => x({
+	}, X = (e, t) => n.metadata === void 0 ? S.succeed(void 0) : S.tryPromise(async () => n.metadata({
+		tag: e.tag,
+		subject: e.subject,
+		input: e.input,
+		outcome: t
+	})).pipe(S.catchCause(() => S.succeed(void 0))), Z = (e, t, r, i) => S.tryPromise({
+		try: async () => {
+			let a = i === void 0 ? n.resolveScope?.(e) : i.scope, o = {
+				...r,
+				durationMs: Date.now() - t,
+				...i === void 0 ? {} : { invocationId: i.outcome.invocationId }
+			}, s = await n.metadata?.({
+				...e,
+				outcome: { ...o }
+			}), c = {
+				ts: t,
+				tag: e.tag,
+				subject: e.subject,
+				traceId: e.traceId,
+				input: e.input,
+				outcome: o,
+				...a === void 0 ? {} : { scope: a },
+				...s === void 0 ? {} : { metadata: s }
+			};
+			if (!z(c)) return;
+			if (e.enqueueOutcome === void 0 || A === void 0) throw TypeError("Required audit outcome capture is unavailable");
+			let l = i === void 0 ? await q(c, A) : U({
+				...i,
+				outcome: o,
+				...s === void 0 ? {} : { metadata: s }
+			}), u = i === void 0 ? r.kind === "error" ? ne(l) : g(l) : _(l);
+			await e.enqueueOutcome(i === void 0 ? r.kind === "error" ? y : v : b, u);
+		},
+		catch: (e) => e
+	}), ce = (e, r) => S.tryPromise({
+		try: async () => {
+			if (e.enqueueOutcome === void 0 || A === void 0 || T === void 0) throw TypeError("Required audit invocation capture is unavailable");
+			let i = E({
+				kind: "typeid",
+				prefix: "audit"
+			}, t);
+			if (i === null) throw TypeError("Audit invocation identity is unavailable");
+			let a = n.resolveScope?.(e), o = await q({
 				ts: r,
-				tag: t.tag,
-				subject: t.subject,
-				...i === void 0 ? {} : { scope: i },
-				...e === void 0 ? {} : { metadata: e },
-				traceId: t.traceId,
-				input: t.input,
-				outcome: {
+				tag: e.tag,
+				subject: e.subject,
+				traceId: e.traceId,
+				input: e.input,
+				...a === void 0 ? {} : { scope: a },
+				outcome: Object.freeze({
+					kind: "unknown",
+					invocationId: i,
+					durationMs: 0
+				})
+			}, A), s = ee(h(o));
+			return await T(s, i), s;
+		},
+		catch: (e) => e
+	}), Q = (e, t) => {
+		if (!F(t.tag)) return e;
+		let n = i && t.kind === "mutation", r = o && t.kind !== "query", a = s && (t.kind === "action" || t.kind === "workflow"), l = c && (t.kind === "action" || t.kind === "workflow");
+		return S.suspend(() => {
+			let i = Date.now(), o = n || r || a ? void 0 : Y(t), s = (s) => e.pipe(S.tap((e) => n ? S.void : a ? Z(t, i, {
+				kind: "ok",
+				value: e
+			}, s).pipe(S.catchCause(() => (k.warn("Audit success capture could not be queued", { tag: t.tag }), S.void))) : S.suspend(() => {
+				let n = r ? Y(t) : o;
+				return X(t, {
+					kind: "ok",
+					value: e
+				}).pipe(S.flatMap((r) => J({
+					ts: i,
+					tag: t.tag,
+					subject: t.subject,
+					...n === void 0 ? {} : { scope: n },
+					...r === void 0 ? {} : { metadata: r },
+					traceId: t.traceId,
+					input: t.input,
+					outcome: {
+						kind: "ok",
+						value: e,
+						durationMs: Date.now() - i
+					}
+				}))).pipe(S.catchCause(() => S.void));
+			})), S.tapCause((e) => {
+				if (s !== void 0 && x.hasInterrupts(e)) return S.void;
+				let c = L(e);
+				if (r) return Z(t, i, {
 					kind: "error",
-					error: a,
-					durationMs: Date.now() - r
-				}
-			}))).pipe(n.catchCause(() => n.void));
-		}));
-	}) : e, T = (e) => {
+					error: c
+				}, s).pipe(S.catchCause(() => (k.warn("Audit failure capture could not be queued", { tag: t.tag }), S.void)));
+				let l = n || a ? Y(t) : o;
+				return X(t, {
+					kind: "error",
+					error: c
+				}).pipe(S.flatMap((e) => J({
+					ts: i,
+					tag: t.tag,
+					subject: t.subject,
+					...l === void 0 ? {} : { scope: l },
+					...e === void 0 ? {} : { metadata: e },
+					traceId: t.traceId,
+					input: t.input,
+					outcome: {
+						kind: "error",
+						error: c,
+						durationMs: Date.now() - i
+					}
+				}))).pipe(S.catchCause(() => S.void));
+			}));
+			return l ? ce(t, i).pipe(S.flatMap(s)) : s();
+		});
+	}, le = (e) => {
 		let t = `http.${e.method.toUpperCase()} ${e.path}`;
-		f(t) && n.runPromise(x({
+		F(t) && S.runPromise(J({
 			ts: Date.now() - e.durationMs,
 			tag: t,
-			subject: r(null),
+			subject: C(null),
 			traceId: e.traceId,
 			input: {
 				method: e.method,
@@ -451,35 +283,98 @@ var V = async (e, t = {}) => {
 				value: { status: e.status },
 				durationMs: e.durationMs
 			}
-		}).pipe(n.catchCause(() => n.void)));
-	}, E = w, D = w, O = w, k = w;
-	return i({
-		name: a({
-			base: $,
-			alias: e.alias
-		}),
-		baseName: $,
+		}).pipe(S.catchCause(() => S.void)));
+	}, ue = Q, de = Q, fe = Q, pe = Q, me = (e) => S.tryPromise({
+		try: async () => {
+			if (!F(e.tag)) return;
+			if (e.outbox === void 0) throw TypeError("Required audit transaction outbox is unavailable");
+			if (e.startedAt === void 0 || e.durationMs === void 0) throw TypeError("Required audit execution timing is unavailable");
+			let t = n.resolveScope?.(e), r = {
+				kind: "ok",
+				value: e.output,
+				durationMs: e.durationMs
+			}, i = await n.metadata?.({
+				...e,
+				outcome: r
+			}), a = {
+				ts: e.startedAt,
+				tag: e.tag,
+				subject: e.subject,
+				traceId: e.traceId,
+				input: e.input,
+				outcome: r,
+				...t === void 0 ? {} : { scope: t },
+				...i === void 0 ? {} : { metadata: i }
+			};
+			if (!z(a)) return;
+			let o = await q(a, e.store), s = g(o);
+			await e.outbox.enqueue(v, s);
+		},
+		catch: (e) => e
+	}), $ = (e, n) => ({
+		effect: e,
+		handler: (r) => S.tryPromise({
+			try: async () => {
+				let i = n(r.payload);
+				if (r.subjectId !== i.subject.id || r.tenantId !== i.subject.tenantId || r.traceId !== i.traceId) throw TypeError("Audit intent does not match its captured delivery authority");
+				if (T === void 0) throw TypeError("Required audit datastore is not bound");
+				if (e === b) {
+					let e = i.outcome.invocationId;
+					if (e === void 0 || A === void 0) throw TypeError("Audit invocation admission is unavailable");
+					let n = (await A.query({
+						table: t,
+						predicate: ae("id", e),
+						order: [],
+						take: 1
+					})).find((t) => t.id === e);
+					if (n === void 0) throw TypeError("Audit invocation admission is missing");
+					a({
+						...i,
+						metadata: void 0,
+						outcome: {
+							kind: "unknown",
+							invocationId: e,
+							durationMs: 0
+						}
+					}, n), await T(i, e + ":outcome");
+				} else await T(i, r.outboxId);
+			},
+			catch: (e) => e
+		})
+	});
+	return w({
+		name: u,
+		baseName: R,
 		description: "Records every mutation invocation; ships an audit() schema mixin for row-level metadata.",
 		permissions: [
 			"rpc:intercept:mutation",
 			"rpc:intercept:action",
 			"rpc:intercept:workflow",
 			"http:intercept",
-			...t ? ["store:write"] : [],
-			...e.recordQueries === !0 ? ["rpc:intercept:query"] : []
+			...r ? ["store:write"] : [],
+			...l ? ["outbox:handle"] : [],
+			...n.recordQueries === !0 ? ["rpc:intercept:query"] : []
 		],
-		...t ? {
-			...e.tables === !1 ? {} : { extendSchema: { tables: U } },
+		...r ? {
+			...n.tables === !1 ? {} : { extendSchema: { tables: d } },
 			bindDataStore: (e) => {
-				s = Y(e);
+				if (o && (typeof e != "object" || !e || !("query" in e) || typeof e.query != "function")) throw TypeError("Audit failure capture requires readable persistence");
+				if (s && (typeof e != "object" || !e || !("query" in e) || typeof e.query != "function")) throw TypeError("Audit success capture requires readable persistence");
+				T = f(e), typeof e == "object" && e && "query" in e && typeof e.query == "function" && (A = e);
 			}
 		} : {},
-		interceptMutation: E,
-		interceptAction: D,
-		interceptWorkflow: O,
-		onHttpRoute: T,
-		...e.recordQueries === !0 ? { interceptQuery: k } : {}
+		...i ? { beforeMutationCommit: me } : {},
+		...l ? { outboxHandlers: [
+			...i || s ? [$(v, p)] : [],
+			...o ? [$(y, te)] : [],
+			...c ? [$(b, m)] : []
+		] } : {},
+		interceptMutation: ue,
+		interceptAction: de,
+		interceptWorkflow: fe,
+		onHttpRoute: le,
+		...n.recordQueries === !0 ? { interceptQuery: pe } : {}
 	});
 };
 //#endregion
-export { F as AUDIT_LOG_TABLE, e as audit, q as auditByScope, J as auditBySubject, K as auditByTrace, W as auditEventToRow, H as auditLogTable, U as auditLogTables, de as auditPlugin, R as auditRowHash, oe as clearAuditBuffer, Y as dataStoreAuditSink, z as makeAuditChain, ae as readAuditBuffer, V as verifyAuditChain };
+export { t as AUDIT_LOG_TABLE, v as audit, o as auditByScope, s as auditBySubject, c as auditByTrace, l as auditEventToRow, y as auditInvocationIdentity, b as auditInvocationQuery, u as auditLogTable, d as auditLogTables, z as auditPlugin, n as auditRowHash, N as clearAuditBuffer, f as dataStoreAuditSink, r as makeAuditChain, M as readAuditBuffer, i as verifyAuditChain };