better-supabase 0.8.0 → 0.9.0

package/dist/blocks/audit/index.js

@@ -1,733 +1,110 @@
-import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../../errors-2M6CKMP4.js";
-import { t as temporal } from "../../temporal-required-BtynQtM-.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DEqHCMKP.js";
-import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { t as SPEC_PINS } from "../../spec-pins-DsLfUH7l.js";
-import { n as toCsv } from "../../csv-BZnHA1Py.js";
-import { i as sqlIdent } from "../../template-lPVh-EwW.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-bAKh-dGc.js";
-import { A as stringsOf, D as seconds, E as run, _ as optionalInstant, d as instantArg, i as blockCall, j as textOf, n as applyTemporal, v as optionalText, y as pageOf } from "../../block-helpers-Cy3pB96I.js";
-import { n as defineListQuery } from "../../list-query-gl808ac1.js";
-//#region src/blocks/audit/audit.ts
-const RETENTION_MANY = /* @__PURE__ */ new WeakMap();
-/**
-* Deletes audit entries past their retention and returns how many. Without
-* `retention` it is one `purge_audit_log` call (which honours an
-* `audit_retention` SQL hook); with it, each tenant is purged with its own
-* interval. Run it from a schedule until it returns 0.
-*/
-function purgeAuditLog(sql, options = {}) {
-	applyTemporal(options);
-	const olderThan = seconds(options.olderThan ?? "1 year");
-	const batch = options.batch ?? 1e4;
-	const purge = async (params, call) => {
-		const [row] = await sql.queryRaw(`select better_supabase.purge_audit_log(${call}) as n`, params);
-		return Number(row?.n ?? 0);
-	};
-	const { retention } = options;
-	if (!retention) return run(() => purge([olderThan, batch], "$1::interval, $2"));
-	return run(async () => {
-		const tenants = await sql.queryRaw("select tenant::text from better_supabase.audit_events_tenants($1::interval) as tenant", ["1 day"]);
-		const many = RETENTION_MANY.get(retention);
-		const ids = tenants.flatMap(({ tenant }) => tenant === null ? [] : [tenant]);
-		const known = many && ids.length > 0 ? await many(ids) : void 0;
-		let purged = 0;
-		for (const { tenant } of tenants) {
-			const days = known ? tenant === null ? void 0 : known.get(tenant) : await retention(tenant);
-			const keep = days === void 0 ? olderThan : `${days} days`;
-			purged += await purge([
-				keep,
-				batch,
-				tenant
-			], "$1::interval, $2, $3, true");
-		}
-		return purged;
-	});
-}
-/**
-* A `retention` callback for `purgeAuditLog` that reads each tenant's days
-* from a column (a plan's `audit_retention_days`, say). `purgeAuditLog` reads
-* every tenant's days in one query; a direct call reads one tenant.
-*/
-function setAuditRetention(sql, source) {
-	const [schema, name] = source.table.includes(".") ? source.table.split(".", 2) : ["public", source.table];
-	const key = sqlIdent(source.key ?? "id");
-	const from = `${sqlIdent(source.column)}::integer as days from ${sqlIdent(schema)}.${sqlIdent(name)}`;
-	const kept = (days) => typeof days === "number" && days > 0 ? days : void 0;
-	const retention = async (tenant) => {
-		if (tenant === null) return;
-		const [row] = await sql.queryRaw(`select ${from} where ${key}::text = $1`, [tenant]);
-		return kept(row?.days);
-	};
-	RETENTION_MANY.set(retention, async (tenants) => {
-		const rows = await sql.queryRaw(`select ${key}::text as tenant, ${from} where ${key}::text = any($1::text[])`, [tenants]);
-		const days = /* @__PURE__ */ new Map();
-		for (const row of rows) {
-			const value = kept(row.days);
-			if (value !== void 0) days.set(row.tenant, value);
-		}
-		return days;
-	});
-	return retention;
-}
-const COLUMNS = [
-	"id",
-	"occurred_at",
-	"op",
-	"table_name",
-	"record_id",
-	"changed",
-	"actor_id",
-	"actor_role",
-	"organization_id",
-	"event_type",
-	"category",
-	"outcome",
-	"source",
-	"target_type",
-	"metadata"
-];
-function entryOf$1(row) {
-	const text = (key) => optionalText(row[key]);
-	const pick = (key, value) => value === void 0 ? {} : { [key]: value };
-	const metadata = row["metadata"];
-	return {
-		id: textOf(row["id"]),
-		occurredAt: optionalInstant(row["occurred_at"]) ?? temporal().Instant.fromEpochMilliseconds(0),
-		op: textOf(row["op"]),
-		...pick("table", text("table_name")),
-		...pick("record", text("record_id")),
-		...pick("changed", row["changed"] === null || row["changed"] === void 0 ? void 0 : stringsOf(row["changed"])),
-		...pick("actor", text("actor_id")),
-		...pick("actorRole", text("actor_role")),
-		...pick("organizationId", text("organization_id")),
-		...pick("eventType", text("event_type")),
-		...pick("category", text("category")),
-		...pick("outcome", text("outcome")),
-		...pick("source", text("source")),
-		...pick("targetType", text("target_type")),
-		...pick("metadata", typeof metadata === "object" && metadata !== null && !Array.isArray(metadata) ? metadata : void 0)
-	};
-}
-const ENTITY_ACTIVITY = {
-	insert: [1, "Create"],
-	update: [3, "Update"],
-	delete: [4, "Delete"]
-};
-const API_ACTIVITY = [
-	[
-		/(^|[._])(create|created|add|added|insert|inserted)$/,
-		1,
-		"Create"
-	],
-	[
-		/(^|[._])(read|viewed|view|get|list|exported|export)$/,
-		2,
-		"Read"
-	],
-	[
-		/(^|[._])(update|updated|change|changed|rename|renamed)$/,
-		3,
-		"Update"
-	],
-	[
-		/(^|[._])(delete|deleted|remove|removed|revoke|revoked)$/,
-		4,
-		"Delete"
-	]
-];
-function status(outcome) {
-	switch (outcome) {
-		case void 0:
-		case "success":
-		case "succeeded": return {
-			status_id: 1,
-			status: "Success"
-		};
-		case "failure":
-		case "failed":
-		case "denied": return {
-			status_id: 2,
-			status: "Failure"
-		};
-		default: return {
-			status_id: 99,
-			status: outcome
-		};
-	}
-}
-/**
-* One entry as an OCSF event (`SPEC_PINS.ocsf`). Row changes are Entity
-* Management (3004); semantic events are API Activity (6003), with the
-* activity read from the event type's last segment (`deal.created` is Create).
-*/
-function toOcsf(entry, product) {
-	const metadata = {
-		version: SPEC_PINS.ocsf,
-		product,
-		uid: entry.id,
-		log_name: "audit_events",
-		...entry.organizationId ? { tenant_uid: entry.organizationId } : {}
-	};
-	const actor = { user: {
-		uid: entry.actor ?? "system",
-		...entry.actorRole ? { type: entry.actorRole } : {}
-	} };
-	const base = {
-		severity_id: 1,
-		severity: "Informational",
-		time: entry.occurredAt.epochMilliseconds,
-		...status(entry.outcome),
-		metadata,
-		actor
-	};
-	const known = ENTITY_ACTIVITY[entry.op];
-	if (entry.op !== "event" && known) {
-		const [activity, name] = known;
-		return {
-			class_uid: 3004,
-			class_name: "Entity Management",
-			category_uid: 3,
-			category_name: "Identity & Access Management",
-			activity_id: activity,
-			activity_name: name,
-			type_uid: 300400 + activity,
-			...base,
-			entity: {
-				uid: entry.record ?? "",
-				type: entry.table ?? "row"
-			},
-			...entry.changed ? { unmapped: { changed: entry.changed } } : {}
-		};
-	}
-	const operation = entry.eventType ?? entry.op;
-	const match = API_ACTIVITY.find(([pattern]) => pattern.test(operation));
-	const [activity, name] = match ? [match[1], match[2]] : [99, operation];
-	return {
-		class_uid: 6003,
-		class_name: "API Activity",
-		category_uid: 6,
-		category_name: "Application Activity",
-		activity_id: activity,
-		activity_name: name,
-		type_uid: 600300 + activity,
-		...base,
-		api: { operation },
-		src_endpoint: { name: entry.source ?? "database" },
-		...entry.record || entry.targetType ? { resources: [{
-			uid: entry.record ?? "",
-			type: entry.targetType ?? entry.table ?? "resource"
-		}] } : {},
-		...entry.metadata || entry.category ? { unmapped: {
-			...entry.category ? { category: entry.category } : {},
-			...entry.metadata ? { metadata: entry.metadata } : {}
-		} } : {}
-	};
-}
-/**
-* Streams one tenant's audit entries as newline-delimited JSON, in id
-* order, one keyset query per batch. Run it with a member's claims (the
-* `readPolicy` filters) or as the service role. It reads the managed
-* module's column names; for an adopted log, the version 3 columns or CSV,
-* use `createAuditLog().export()`, which reads `list_audit_events`.
-*/
-function exportAuditLog(sql, options) {
-	applyTemporal(options);
-	const format = options.format ?? "ndjson";
-	if (format === "ocsf" && !options.product) throw new TypeError("exportAuditLog: the ocsf format needs product");
-	const batch = options.batch ?? 1e3;
-	const [schema, name] = (options.table ?? "better_supabase.audit_events").split(".", 2);
-	const text = `select ${COLUMNS.map((column) => sqlIdent(column)).join(", ")}
-from ${sqlIdent(schema)}.${sqlIdent(name)}
-where organization_id::text = $1
-  and ($2::timestamptz is null or occurred_at >= $2)
-  and ($3::timestamptz is null or occurred_at < $3)
-  and id > $4
-order by id
-limit $5`;
-	const encoder = new TextEncoder();
-	let after = "0";
-	let done = false;
-	return new ReadableStream({ async pull(controller) {
-		if (done) return;
-		const rows = await sql.queryRaw(text, [
-			options.organizationId,
-			instantArg(options.from) ?? null,
-			instantArg(options.to) ?? null,
-			after,
-			batch
-		]);
-		const lines = rows.map((row) => {
-			const entry = entryOf$1(row);
-			return JSON.stringify(format === "ocsf" ? toOcsf(entry, options.product) : entry);
-		});
-		if (lines.length > 0) {
-			controller.enqueue(encoder.encode(`${lines.join("\n")}\n`));
-			after = textOf(rows.at(-1)["id"]);
-		}
-		if (rows.length < batch) {
-			done = true;
-			controller.close();
-		}
-	} });
-}
-const FACETS = [
-	[
-		"table",
-		"table_name",
-		"tableName"
-	],
-	[
-		"record",
-		"record_id",
-		"recordId"
-	],
-	[
-		"op",
-		"op",
-		"op"
-	],
-	[
-		"actor",
-		"actor_id",
-		"actorId"
-	],
-	[
-		"event",
-		"event_type",
-		"eventType"
-	],
-	[
-		"category",
-		"category",
-		"category"
-	],
-	[
-		"outcome",
-		"outcome",
-		"outcome"
-	],
-	[
-		"target",
-		"target_type",
-		"targetType"
-	]
-];
-/**
-* A cursor-paged list over the audit table through the Data API or
-* `ctx.sql` (generate types for the module's schema to get it in your
-* models; facets follow the managed column names). `createAuditLog().list()`
-* reads `list_audit_events` instead, with an adopted log's columns mapped.
-* Filtered by actor,
-* table, record, event type, category, outcome and target, newest first.
-* The `readPolicy` and the `restricted` table decide what a member sees.
-*/
-function auditListQuery(betterSupabase, table, options = {}) {
-	const meta = betterSupabase.meta.tables[table];
-	if (!meta) throw new TypeError(`auditListQuery: unknown table "${table}"`);
-	const camel = meta.columns["occurredAt"] !== void 0;
-	const col = (snake, camelName) => camel ? camelName : snake;
-	const facets = Object.fromEntries(FACETS.map(([key, snake, camelName]) => [key, col(snake, camelName)]).filter(([, column]) => meta.columns[column] !== void 0));
-	const occurredAt = col("occurred_at", "occurredAt");
-	const config = {
-		facets,
-		sorts: {
-			newest: [{ [occurredAt]: "desc" }, { id: "desc" }],
-			oldest: [{ [occurredAt]: "asc" }, { id: "asc" }]
-		},
-		defaultSort: "newest",
-		pagination: "cursor",
-		...options.pageSize === void 0 ? {} : { pageSize: options.pageSize },
-		...options.maxPageSize === void 0 ? {} : { maxPageSize: options.maxPageSize }
-	};
-	const list = defineListQuery(betterSupabase, table, config);
-	return Object.assign(list, { between(from, to) {
-		const range = {
-			...from ? { gte: from.toString() } : {},
-			...to ? { lt: to.toString() } : {}
-		};
-		return Object.keys(range).length === 0 ? {} : { [occurredAt]: range };
-	} });
-}
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { s as nowInstant } from "../../temporal-CB5Fpo5d.js";
+import { t as AsyncResult } from "../../result-BlgnMB0H.js";
+import { t as base64ToText } from "../../base64-BmeCBgGo.js";
+import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-G4t1umrR.js";
+import { C as optionalText, D as recordOf, I as textOf, R as toInstant, k as recordsOf, n as applyTemporal, o as blockCall } from "../../block-helpers-CfG_MvDR.js";
+import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
+import { a as exportAuditLog, c as toOcsf, i as auditListQuery, n as auditEventOf, o as purgeAuditLog, r as auditSink, s as setAuditRetention, t as createAudit } from "../../audit-log-BMMuGPdP.js";
+import { t as createAuditLogController } from "../../client-B9CqzgPO.js";
+import { t as auditSqlOptions } from "../../options-CljDnQt2.js";
+//#region src/blocks/audit/events.ts
+/** The `audit` block's event types, for its manifest and `onBlockEvent`. */
+const auditEvents = defineEvents({ "audit.revealed": event() });
 //#endregion
-//#region src/blocks/audit/csv.ts
-const DEFAULT_COLUMNS = [
-	"id",
-	"occurredAt",
-	"op",
-	"eventType",
-	"category",
-	"outcome",
-	"actorId",
-	"actorLabel",
-	"actorRole",
-	"actorKind",
-	"tenant",
-	"tenantLabel",
-	"table",
-	"record",
-	"targetType",
-	"targetLabel",
-	"summary",
-	"changed",
-	"source",
-	"requestId",
-	"correlationId",
-	"impersonatedBy",
-	"metadata"
-];
-const keyOf = (column) => typeof column === "string" ? column : column.key;
-/** Whether the columns read restricted details. */
-const revealsDetails = (columns) => (columns ?? []).some((column) => keyOf(column).startsWith("restricted."));
-function defaultRow(record, keys, details) {
-	const row = {
-		...record,
-		occurredAt: record.occurredAt.toString(),
-		changed: record.changed?.join(" ")
-	};
-	for (const key of keys) {
-		const [scope, ...rest] = key.split(".");
-		const name = rest.join(".");
-		if (scope === "columns" && name !== "") row[key] = record.columns?.[name];
-		if (scope === "restricted" && name !== "") row[key] = new Map(Object.entries(details ?? {})).get(name);
-	}
-	return row;
-}
-/** One cell per line, escaped like the rows. */
-const lines = (values) => values.map((value) => {
-	const csv = toCsv([{ value }], { columns: ["value"] });
-	return csv.slice(csv.indexOf("\r\n") + 2);
-}).join("");
-/** A page of CSV, with the preamble and header row on the first. */
-function csvPage(entries, options, details, first) {
-	const columns = options.columns ?? DEFAULT_COLUMNS;
-	const keys = columns.map(keyOf);
-	const rows = entries.map((record) => {
-		const found = details?.get(record.id);
-		const row = defaultRow(record, keys, found);
-		return options.formatRow ? options.formatRow(row, record, found) : row;
-	});
-	const csv = toCsv(rows, { columns: keys });
-	const body = csv.slice(csv.indexOf("\r\n") + 2);
-	if (!first) return body;
-	const header = toCsv([], { columns: columns.map((column) => typeof column === "string" ? column : column.label) });
-	return `${lines(options.preamble ?? [])}${header}${body}`;
-}
+//#region src/blocks/audit/manifest.ts
+/** The `audit` block's manifest (ADR 0029). */
+const auditBlock = defineBlock({
+	name: "audit",
+	sql: ["audit"],
+	options: { audit: auditSqlOptions },
+	events: auditEvents,
+	create: createAudit,
+	category: "admin",
+	recipes: ["audit-log-table"]
+});
 //#endregion
-//#region src/blocks/audit/sink.ts
-const textIn = (value) => typeof value === "string" && value !== "" ? value : void 0;
-const defaultCategory = (eventType) => eventType.startsWith("account.") || eventType.startsWith("support.") ? "security" : void 0;
-/** The impersonation fields of a `support.*` event: its session, admin and reason. */
-function supportFields(eventType, data) {
-	if (!eventType.startsWith("support.") || data === void 0) return {};
-	const sessionId = textIn(data["sessionId"]);
-	const adminId = textIn(data["adminId"]);
-	const reason = textIn(data["reason"]);
+//#region src/blocks/audit/chain.ts
+function headOf(value) {
+	const row = recordOf(value, "audit_chain_heads");
 	return {
-		...sessionId === void 0 ? {} : { supportSessionId: sessionId },
-		...adminId === void 0 ? {} : { impersonatedBy: adminId },
-		...reason === void 0 ? {} : { impersonationReason: reason }
+		organizationId: optionalText(row["tenant"]),
+		seq: Number(row["seq"]),
+		hash: textOf(row["hash"]),
+		entryId: textOf(row["entryId"])
 	};
 }
-/**
-* The audit entry for one CloudEvent: its type without the prefix, its
-* subject as the record, the tenant from the `tenant` or `partitionkey`
-* extension (or `data.organizationId`), and the data as metadata. The
-* idempotency key is the event's source and id, so a redelivery records once.
-* A `support.*` event also fills the impersonation columns from its
-* `sessionId`, `adminId` and `reason`.
-*/
-function auditEventOf(event, options = {}) {
-	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
-	const data = isRecord(event.data) ? event.data : void 0;
-	const organizationId = textIn(event["tenant"]) ?? textIn(event["partitionkey"]) ?? textIn(data?.["organizationId"]);
-	const actorId = textIn(data?.["actorId"]);
-	const metadata = data ?? (event.data === void 0 ? void 0 : { data: event.data });
-	const eventType = event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type;
-	const category = (options.category ?? defaultCategory)(eventType);
-	return {
-		eventType,
-		idempotencyKey: `${event.source}#${event.id}`,
-		...category === void 0 ? {} : { category },
-		...event.subject === void 0 ? {} : { record: event.subject },
-		...organizationId === void 0 ? {} : { organizationId },
-		...actorId === void 0 ? {} : { actorId },
-		...metadata === void 0 ? {} : { metadata },
-		...supportFields(eventType, data)
-	};
-}
-/**
-* An `EventSink` that records each CloudEvent in the audit log. `send`
-* throws when an entry fails, so an outbox relay retries the batch; the
-* idempotency key keeps the entries already written from repeating.
-*/
-function auditSink(record, options = {}) {
-	return { async send(events) {
-		let failure;
-		for (const event of events) {
-			const result = await record(auditEventOf(event, options));
-			if (!result.ok) failure ??= new DbException(result.error);
-		}
-		if (failure !== void 0) throw failure;
-	} };
-}
-//#endregion
-//#region src/blocks/audit/client.ts
-const TEXT_KEYS = [
-	"op",
-	"table",
-	"record",
-	"actorId",
-	"actorRole",
-	"actorKind",
-	"actorLabel",
-	"tenant",
-	"tenantLabel",
-	"impersonatedBy",
-	"impersonationReason",
-	"supportSession",
-	"eventType",
-	"category",
-	"outcome",
-	"source",
-	"targetType",
-	"targetLabel",
-	"summary",
-	"requestId",
-	"correlationId",
-	"scope"
-];
-function recordOfEntry(value) {
-	const row = isRecord(value) ? value : {};
-	const text = {};
-	for (const key of TEXT_KEYS) {
-		const found = optionalText(row[key]);
-		if (found !== void 0) text[key] = found;
-	}
-	const json = (key) => {
-		const found = row[key];
-		return isRecord(found) ? found : void 0;
-	};
-	const old = json("old");
-	const next = json("new");
-	const metadata = json("metadata");
-	const columns = json("columns");
+function checkpointOf(value) {
+	const row = recordOf(value, "audit_checkpoints");
 	return {
+		...headOf(row),
 		id: textOf(row["id"]),
-		occurredAt: optionalInstant(row["occurredAt"]) ?? temporal().Instant.fromEpochMilliseconds(0),
-		...text,
-		...Array.isArray(row["changed"]) ? { changed: stringsOf(row["changed"]) } : {},
-		...old === void 0 ? {} : { old },
-		...next === void 0 ? {} : { new: next },
-		...metadata === void 0 ? {} : { metadata },
-		...columns === void 0 ? {} : { columns }
+		keyId: textOf(row["keyId"]),
+		signature: textOf(row["signature"]),
+		createdAt: toInstant(textOf(row["createdAt"]))
 	};
 }
-/** The record in `exportAuditLog`'s `AuditEntry` shape, for `toOcsf`. */
-function entryOf(record) {
-	return {
-		id: record.id,
-		occurredAt: record.occurredAt,
-		op: record.op ?? "event",
-		...record.table === void 0 ? {} : { table: record.table },
-		...record.record === void 0 ? {} : { record: record.record },
-		...record.changed === void 0 ? {} : { changed: record.changed },
-		...record.actorId === void 0 ? {} : { actor: record.actorId },
-		...record.actorRole === void 0 ? {} : { actorRole: record.actorRole },
-		...record.tenant === void 0 ? {} : { organizationId: record.tenant },
-		...record.eventType === void 0 ? {} : { eventType: record.eventType },
-		...record.category === void 0 ? {} : { category: record.category },
-		...record.outcome === void 0 ? {} : { outcome: record.outcome },
-		...record.source === void 0 ? {} : { source: record.source },
-		...record.targetType === void 0 ? {} : { targetType: record.targetType },
-		...record.metadata === void 0 ? {} : { metadata: record.metadata }
-	};
-}
-const many = (value) => value === void 0 ? void 0 : typeof value === "string" ? [value] : value;
-/** `reveal_audit_entry`'s details, or one of `reveal_audit_entries`'. */
-function detailsOf(value, entryId) {
-	const row = isRecord(value) ? value : {};
-	const json = (key) => {
-		const found = row[key];
-		return isRecord(found) ? { [key]: found } : {};
-	};
-	const text = (key) => {
-		const found = optionalText(row[key]);
-		return found === void 0 ? {} : { [key]: found };
+function verdictOf(value) {
+	const row = recordOf(value, "verify_audit_chain");
+	const seq = row["seq"] === null ? void 0 : Number(row["seq"]);
+	if (row["valid"] === true) return {
+		valid: true,
+		checked: Number(row["checked"]),
+		seq,
+		hash: optionalText(row["hash"])
 	};
+	const reason = textOf(row["reason"]);
 	return {
-		entry: textOf(row["entry"] ?? entryId),
-		...json("old"),
-		...json("new"),
-		...json("metadata"),
-		...text("ip"),
-		...text("userAgent"),
-		...text("sessionId"),
-		...row["changes"] === void 0 || row["changes"] === null ? {} : { changes: row["changes"] }
+		valid: false,
+		checked: Number(row["checked"]),
+		seq: seq ?? 0,
+		brokenAt: optionalText(row["brokenAt"]),
+		reason
 	};
 }
-/**
-* The audit log over the `audit` module's functions, as the caller: the
-* read policy decides what `list` and `export` return, and column mappings
-* of an adopted log are already applied.
-*/
-function createAuditLog(options) {
+/** The `kid` of a compact JWS header, or an empty string. */
+function keyIdOf(token) {
+	const header = JSON.parse(base64ToText(token.split(".")[0] ?? ""));
+	const kid = typeof header === "object" && header !== null && "kid" in header ? header.kid : void 0;
+	return typeof kid === "string" ? kid : "";
+}
+/** The audit hash chain (`blocks.audit.options.chain`), as the service role. */
+function createAuditChain(options) {
 	applyTemporal(options);
 	const call = blockCall(options.transport, options.schema, options.mappers);
-	const list = (list = {}) => {
-		const limit = list.limit ?? 50;
-		const filters = {
-			for_tenants: many(list.organizationId),
-			for_event_types: many(list.eventType),
-			for_actors: many(list.actorId),
-			for_target_types: many(list.targetType),
-			for_records: many(list.record),
-			for_categories: many(list.category),
-			for_outcomes: many(list.outcome),
-			for_sources: many(list.source),
-			for_actor_kinds: many(list.actorKind),
-			for_correlation_ids: many(list.correlationId),
-			search: list.search,
-			since: instantArg(list.since),
-			until: instantArg(list.until)
-		};
-		const { cursor } = pageOf(list);
-		const page = call("list_audit_events", {
-			...filters,
-			cursor_at: instantArg(cursor?.occurredAt),
-			cursor_id: cursor?.id,
-			max_items: limit,
-			ascending: list.order === "asc",
-			skip: list.offset
-		}, (value) => {
-			const entries = (Array.isArray(value) ? value : []).map((entry) => recordOfEntry(entry));
-			const last = entries.at(-1);
-			return {
-				entries,
-				next: last === void 0 || entries.length < Math.min(limit, 1e3) ? void 0 : {
-					occurredAt: last.occurredAt,
-					id: last.id
-				}
-			};
-		});
-		if (list.count !== true) return page;
-		return page.andThen((data) => call("count_audit_events", filters, (value) => ({
-			...data,
-			total: Number(value)
-		})));
-	};
-	const revealPage = (entries) => call("reveal_audit_entries", { entries: entries.map((entry) => entry.id) }, (value) => new Map((Array.isArray(value) ? value : []).map((row) => {
-		const details = detailsOf(row, "");
-		return [details.entry, details];
-	})));
-	const exportStream = (exporting = {}) => {
-		const format = exporting.format ?? "ndjson";
-		const product = exporting.product;
-		if (format === "ocsf" && !product) throw new TypeError("createAuditLog().export: the ocsf format needs product");
-		const encoder = new TextEncoder();
-		let before;
-		const { offset: start, columns, preamble, formatRow, ...filters } = exporting;
-		const csv = {
-			...columns === void 0 ? {} : { columns },
-			...preamble === void 0 ? {} : { preamble },
-			...formatRow === void 0 ? {} : { formatRow }
-		};
-		const reveals = format === "csv" && revealsDetails(columns);
-		let offset = start;
-		let header = format === "csv";
-		let done = false;
-		return new ReadableStream({ async pull(controller) {
-			if (done) return;
-			const page = await list({
-				...filters,
-				...before ? { cursor: before } : {},
-				...offset === void 0 ? {} : { offset },
-				limit: exporting.batch ?? 500
-			});
-			offset = void 0;
-			if (!page.ok) {
-				done = true;
-				controller.error(new Error(page.error.message));
-				return;
-			}
-			const { entries, next } = page.data;
-			let text = "";
-			if (format === "csv") {
-				let details;
-				if (reveals && entries.length > 0) {
-					const revealed = await revealPage(entries);
-					if (!revealed.ok) {
-						done = true;
-						controller.error(new Error(revealed.error.message));
-						return;
-					}
-					details = revealed.data;
-				}
-				text = csvPage(entries, csv, details, header);
-				header = false;
-			} else if (entries.length > 0) text = `${entries.map((entry) => JSON.stringify(format === "ocsf" && product ? toOcsf(entryOf(entry), product) : entry)).join("\n")}\n`;
-			if (text.length > 0) controller.enqueue(encoder.encode(text));
-			before = next;
-			if (next === void 0) {
-				done = true;
-				controller.close();
-			}
-		} });
-	};
-	const record = (event) => call("audit_event", {
-		event_type: event.eventType,
-		category: event.category,
-		outcome: event.outcome,
-		source: event.source,
-		target_type: event.targetType,
-		record_id: event.record,
-		tenant: event.organizationId,
-		metadata: event.metadata,
-		idempotency_key: event.idempotencyKey,
-		restricted: event.restricted,
-		actor_id: event.actorId,
-		summary: event.summary,
-		target_label: event.targetLabel,
-		correlation_id: event.correlationId,
-		actor_kind: event.actorKind,
-		actor_label: event.actorLabel,
-		ip: event.ip,
-		user_agent: event.userAgent,
-		session_id: event.sessionId,
-		request_id: event.requestId,
-		scope: event.scope,
-		support_session: event.supportSessionId,
-		impersonated_by: event.impersonatedBy,
-		impersonation_reason: event.impersonationReason
-	}, textOf);
+	const heads = () => call("audit_chain_heads", {}, (value) => recordsOf(value, "audit_chain_heads").map(headOf));
+	const sign = (head, signer) => signer.signJwt({
+		...options.issuer === void 0 ? {} : { iss: options.issuer },
+		sub: head.organizationId ?? "",
+		seq: head.seq,
+		hash: head.hash,
+		entry: head.entryId,
+		iat: Math.floor(nowInstant().epochMilliseconds / 1e3)
+	}).andThen((signature) => call("record_audit_checkpoint", {
+		tenant: head.organizationId,
+		seq: head.seq,
+		hash: head.hash,
+		key_id: keyIdOf(signature),
+		signature
+	}, checkpointOf));
 	return {
-		record,
-		sink: (sinkOptions) => auditSink(record, sinkOptions),
-		list,
-		reveal: (entryId) => call("reveal_audit_entry", { entry: entryId }, (value) => detailsOf(value, entryId)),
-		export: exportStream,
-		exportToStorage: (target) => AsyncResult.from(async () => {
-			const contentType = (target.format ?? "ndjson") === "csv" ? "text/csv" : "application/x-ndjson";
-			let body;
-			try {
-				body = new Blob([await new Response(exportStream(target)).arrayBuffer()], { type: contentType });
-			} catch (cause) {
-				return err(dbError("raised", cause instanceof Error ? cause.message : String(cause), { hint: "AUDIT_EXPORT_FAILED" }));
-			}
-			const bucket = target.storage.from(target.bucket);
-			if ((await bucket.upload(target.path, body, {
-				contentType,
-				upsert: true
-			})).error) return err(dbError("raised", "The export could not be stored", { hint: "AUDIT_EXPORT_FAILED" }));
-			let url;
-			if (target.signedUrlTtl !== void 0 && bucket.createSignedUrl) url = (await bucket.createSignedUrl(target.path, target.signedUrlTtl, { download: true })).data?.signedUrl;
-			return ok({
-				path: target.path,
-				url
-			});
-		})
+		verify: (range = {}) => call("verify_audit_chain", {
+			tenant: range.organizationId,
+			from_at: range.from?.toString(),
+			to_at: range.to?.toString()
+		}, verdictOf),
+		heads,
+		checkpoint: () => {
+			const { signer } = options;
+			if (!signer) return AsyncResult.err(dbError("invalid_request", "checkpoint() needs a signer", { hint: "AUDIT_CHAIN_SIGNER" }));
+			return heads().andThen((list) => list.reduce((done, head) => done.andThen((made) => sign(head, signer).map((checkpoint) => [...made, checkpoint])), AsyncResult.ok([])));
+		},
+		checkpoints: (request = {}) => call("list_audit_checkpoints", {
+			tenant: request.organizationId,
+			max_rows: request.limit ?? 100
+		}, (value) => recordsOf(value, "list_audit_checkpoints").map(checkpointOf))
 	};
 }
 //#endregion
-export { auditEventOf, auditListQuery, auditSink, createAuditLog, dbTransport, exportAuditLog, purgeAuditLog, rpcTransport, setAuditRetention, sqlTransport, toOcsf };
+export { auditBlock, auditEventOf, auditEvents, auditListQuery, auditSink, createAudit, createAuditChain, createAuditLogController, dbTransport, exportAuditLog, purgeAuditLog, rpcTransport, setAuditRetention, sqlTransport, toOcsf };