/**
 * AuditLogger — append-only operational audit trail for the secrets store.
 *
 * Hot-path resolves (get) are NOT audited — that would create N×requests
 * log volume. We audit writes, deletes, rotations, tests, metadata reads
 * from UI/API, master-key rotations, and AEAD decrypt failures (security
 * signal).
 *
 * The schema captures both user and system actors via a discriminated
 * (`actor_type`, `actor_user_id`, `actor_system_id`) triple.
 *
 * After the scope-collapse refactor, audit rows no longer carry a scope
 * dimension. Legacy migration code may still pass `scope` / `scope_id`
 * fields on the AuditEvent for backward compatibility while it
 * decrypts pre-migration rows — those fields are simply ignored.
 */
export class AuditLogger {
    insert;
    constructor(db) {
        db.exec(`
      CREATE TABLE IF NOT EXISTS audit_log (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        ts INTEGER NOT NULL,
        actor_type TEXT NOT NULL CHECK (actor_type IN ('user','system')),
        actor_user_id TEXT,
        actor_system_id TEXT,
        action TEXT NOT NULL,
        key TEXT,
        success INTEGER NOT NULL,
        ip TEXT,
        user_agent TEXT,
        detail_json TEXT
      );
      CREATE INDEX IF NOT EXISTS idx_audit_ts ON audit_log(ts DESC);
      CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log(actor_user_id, ts DESC);
    `);
        this.insert = db.prepare(`
      INSERT INTO audit_log
        (ts, actor_type, actor_user_id, actor_system_id, action, key, success, ip, user_agent, detail_json)
      VALUES
        (@ts, @actor_type, @actor_user_id, @actor_system_id, @action, @key, @success, @ip, @user_agent, @detail_json)
    `);
    }
    write(event) {
        const a = event.actor;
        this.insert.run({
            ts: Date.now(),
            actor_type: a.type,
            actor_user_id: a.type === 'user' ? (a.userId ?? null) : null,
            actor_system_id: a.type === 'system' ? (a.systemId ?? null) : null,
            action: event.action,
            key: event.key ?? null,
            success: event.success ? 1 : 0,
            ip: a.ip ?? null,
            user_agent: a.userAgent ?? null,
            detail_json: event.detail ? JSON.stringify(event.detail) : null,
        });
    }
}
//# sourceMappingURL=audit.js.map