@cqrs-ddd/pipeline-audit 0.5.0

package/README.md

@@ -0,0 +1,35 @@
+# @cqrs-ddd/pipeline-audit
+
+Audit records for `@cqrs-ddd/pipeline`: for each audited operation, who did what, in
+which tenant and correlation, with which outcome, and with request and response payloads
+redacted. `LogAuditSink` writes to a logger (`console` by default) and
+`PostgresAuditSink` to a table; any `AuditSink` with `write()` works.
+
+**Documentation:** [guide](https://aristoteliss.github.io/ddd-cqrs/packages/pipeline-audit/) · [API reference](https://aristoteliss.github.io/ddd-cqrs/api/cqrs-ddd/pipeline-audit/) · [all packages](https://aristoteliss.github.io/ddd-cqrs/)
+
+## Installation
+
+```bash
+pnpm add @cqrs-ddd/pipeline-audit @cqrs-ddd/pipeline
+```
+
+Requires Node.js 22.12 or later. Published as an ES module; a CommonJS application loads
+it with `require()`.
+
+## Example
+
+```ts
+const pipeline = createPipeline({
+  behaviors: [new AuditBehavior(new LogAuditSink())],
+});
+
+export const renameUser = pipeline.wrap(
+  { name: 'renameUser', kind: 'command' },
+  audit({ action: 'user.rename', severity: 'high', actor: (c) => ({ id: currentUserId(c) }) }),
+)(async (input: { id: string; name: string }) => users.rename(input));
+```
+
+## License
+
+Dual-licensed under **AGPLv3** and a **Commercial License**. See `LICENSE` and
+`COMMERCIAL_LICENSE.txt`.

package/dist/audit.behavior.d.ts

@@ -0,0 +1,102 @@
+import { type IPipelineBehavior, type IPipelineBehaviorContract, type IPipelineBehaviorOptionsResolver, type IPipelineContext, type NextDelegate, PIPELINE_BEHAVIOR_CONTRACT, type PipelineItemToken, type PipelineLogger } from '@cqrs-ddd/pipeline';
+import type { AuditBehaviorOptions } from './interfaces/audit-options.interface.js';
+import type { AuditRecord, AuditStartRecord } from './interfaces/audit-record.interface.js';
+import type { AuditSink } from './interfaces/audit-sink.interface.js';
+/**
+ * Unique symbol key used on `context.items` to store or retrieve the produced {@link AuditRecord}.
+ *
+ * @example
+ * ```ts
+ * const record = context.items.get(AUDIT_RECORD_ITEM) as AuditRecord | undefined;
+ * ```
+ */
+export declare const AUDIT_RECORD_ITEM: unique symbol;
+/**
+ * Typed token for {@link AUDIT_RECORD_ITEM}: the produced audit record. Reads and writes the same
+ * `context.items` entry through `getPipelineItem` / `requirePipelineItem`.
+ */
+export declare const AUDIT_RECORD_ITEM_TOKEN: PipelineItemToken<AuditRecord>;
+/**
+ * Typed token for the pending {@link AuditStartRecord}, set before the handler
+ * runs when a start record is written. A step inside the handler can read it,
+ * for example to store the record in its own transaction.
+ */
+export declare const AUDIT_START_RECORD_ITEM_TOKEN: PipelineItemToken<AuditStartRecord>;
+/**
+ * Pipeline behavior that writes an {@link AuditRecord} for every audited
+ * request — **on both success and failure** — to a pluggable {@link AuditSink}.
+ * Only commands are audited unless `captureKinds` lists other request kinds.
+ *
+ * For each run it times the handler, resolves the actor and action, redacts the
+ * payload (and optionally the response), then forwards the record. When the
+ * sink implements `begin`, a pending start record is written first under the
+ * same id, so a process stop during the handler leaves a pending record
+ * instead of none; with `failOpen: false`, a failed start write stops the
+ * request before its handler runs. Handler
+ * failures are recorded before propagation. With the default `failOpen: true`,
+ * sink failures are logged and the original handler result/error is preserved.
+ * With `failOpen: false`, a sink/build failure on the **success path** fails the
+ * request. If the handler already failed, the caller receives the handler's own
+ * error, unchanged, and the audit failure is logged.
+ *
+ * Sink-agnostic by design: it depends only on {@link AuditSink}, so the backend
+ * (console, Postgres, an event store, …) is a one-line swap: the sink passed
+ * to the constructor. Record-building failures are logged and ignored
+ * in fail-open mode, or propagated according to the same fail-closed semantics.
+ *
+ * **Ordering:** place this near the **outside** of the chain (e.g. global
+ * `before`) so the duration covers the whole handler, and after any auth
+ * behavior that populates `context.items` for the {@link AuditBehaviorOptions.actor}
+ * factory.
+ *
+ * @example Per-handler, with an actor read from an upstream auth behavior
+ * ```ts
+ * class DeleteUserHandler {
+ *   @pipeline.wrap({ kind: 'command' }, [AuditBehavior, {
+ *     action: 'user.delete',
+ *     severity: 'high',
+ *     actor: (c) => ({ id: c.items.get('currentUserId') }),
+ *   }])
+ *   async handle(command: DeleteUserCommand) {}
+ * }
+ * ```
+ *
+ * @example Compliance-sensitive fail-closed auditing
+ * ```ts
+ * class RefundPaymentHandler {
+ *   @pipeline.wrap({ kind: 'command' }, [AuditBehavior, {
+ *     action: 'payment.refund',
+ *     failOpen: false,
+ *     captureResponse: false,
+ *   }])
+ *   async handle(command: RefundPaymentCommand) {}
+ * }
+ * ```
+ */
+export declare class AuditBehavior implements IPipelineBehavior, IPipelineBehaviorOptionsResolver<AuditBehaviorOptions> {
+    private readonly sink;
+    static readonly [PIPELINE_BEHAVIOR_CONTRACT]: IPipelineBehaviorContract;
+    private readonly logger;
+    private readonly defaults;
+    constructor(sink: AuditSink, defaults?: AuditBehaviorOptions, logger?: PipelineLogger);
+    handle(context: IPipelineContext, next: NextDelegate): Promise<unknown>;
+    /**
+     * Build the start record, forward it to the sink's `begin`, and stash it on
+     * the context. Throws only when failing closed, before the handler runs.
+     */
+    private begin;
+    /** Build the record, forward it to the sink, and stash it on the context. */
+    private record;
+    /**
+     * Rejects a non-function factory option before request execution when
+     * `failOpen` is false, and logs it otherwise.
+     */
+    private validateFactories;
+    /** Logs an audit failure, then fails open or rethrows `error`. */
+    private reportFailure;
+    /** Diagnostic logging never changes the request outcome. */
+    private diagnose;
+    /** Shallow-merges per-handler options over the constructor defaults. */
+    resolveEffectiveOptions(options?: AuditBehaviorOptions): AuditBehaviorOptions;
+}
+//# sourceMappingURL=audit.behavior.d.ts.map

package/dist/audit.behavior.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.behavior.d.ts","sourceRoot":"","sources":["../src/audit.behavior.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,0BAA0B,EAG1B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEpB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EAEX,gBAAgB,EACjB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAAiB,CAAC,WAAW,CACM,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,iBAAiB,CAAC,gBAAgB,CACb,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,qBAAa,aACX,YACE,iBAAiB,EACjB,gCAAgC,CAAC,oBAAoB,CAAC;IAyBtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAvBvB,MAAM,CAAC,QAAQ,CAAC,CAAC,0BAA0B,CAAC,EAAE,yBAAyB,CAiBrE;IAEF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;IAEhD,YACmB,IAAI,EAAE,SAAS,EAChC,QAAQ,CAAC,EAAE,oBAAoB,EAC/B,MAAM,CAAC,EAAE,cAAc,EAUxB;IAEK,MAAM,CACV,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CA+DlB;IAED;;;OAGG;YACW,KAAK;IAkCnB,6EAA6E;YAC/D,MAAM;IAmCpB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAQzB,kEAAkE;IAClE,OAAO,CAAC,aAAa;IAarB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ;IAQhB,wEAAwE;IACxE,uBAAuB,CACrB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,oBAAoB,CAGtB;CACF"}

package/dist/audit.behavior.js

@@ -0,0 +1,262 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { createPipelineItem, PIPELINE_BEHAVIOR_CONTRACT, setPipelineItem, } from '@cqrs-ddd/pipeline';
+import { uuidv7 } from '@cqrs-ddd/uuidv7';
+import { buildAuditRecord, buildAuditStartRecord, } from './helpers/build-record.js';
+/**
+ * Unique symbol key used on `context.items` to store or retrieve the produced {@link AuditRecord}.
+ *
+ * @example
+ * ```ts
+ * const record = context.items.get(AUDIT_RECORD_ITEM) as AuditRecord | undefined;
+ * ```
+ */
+export const AUDIT_RECORD_ITEM = Symbol('AUDIT_RECORD_ITEM');
+/**
+ * Typed token for {@link AUDIT_RECORD_ITEM}: the produced audit record. Reads and writes the same
+ * `context.items` entry through `getPipelineItem` / `requirePipelineItem`.
+ */
+export const AUDIT_RECORD_ITEM_TOKEN = createPipelineItem('AUDIT_RECORD_ITEM', AUDIT_RECORD_ITEM);
+/**
+ * Typed token for the pending {@link AuditStartRecord}, set before the handler
+ * runs when a start record is written. A step inside the handler can read it,
+ * for example to store the record in its own transaction.
+ */
+export const AUDIT_START_RECORD_ITEM_TOKEN = createPipelineItem('AUDIT_START_RECORD_ITEM');
+/**
+ * Pipeline behavior that writes an {@link AuditRecord} for every audited
+ * request — **on both success and failure** — to a pluggable {@link AuditSink}.
+ * Only commands are audited unless `captureKinds` lists other request kinds.
+ *
+ * For each run it times the handler, resolves the actor and action, redacts the
+ * payload (and optionally the response), then forwards the record. When the
+ * sink implements `begin`, a pending start record is written first under the
+ * same id, so a process stop during the handler leaves a pending record
+ * instead of none; with `failOpen: false`, a failed start write stops the
+ * request before its handler runs. Handler
+ * failures are recorded before propagation. With the default `failOpen: true`,
+ * sink failures are logged and the original handler result/error is preserved.
+ * With `failOpen: false`, a sink/build failure on the **success path** fails the
+ * request. If the handler already failed, the caller receives the handler's own
+ * error, unchanged, and the audit failure is logged.
+ *
+ * Sink-agnostic by design: it depends only on {@link AuditSink}, so the backend
+ * (console, Postgres, an event store, …) is a one-line swap: the sink passed
+ * to the constructor. Record-building failures are logged and ignored
+ * in fail-open mode, or propagated according to the same fail-closed semantics.
+ *
+ * **Ordering:** place this near the **outside** of the chain (e.g. global
+ * `before`) so the duration covers the whole handler, and after any auth
+ * behavior that populates `context.items` for the {@link AuditBehaviorOptions.actor}
+ * factory.
+ *
+ * @example Per-handler, with an actor read from an upstream auth behavior
+ * ```ts
+ * class DeleteUserHandler {
+ *   @pipeline.wrap({ kind: 'command' }, [AuditBehavior, {
+ *     action: 'user.delete',
+ *     severity: 'high',
+ *     actor: (c) => ({ id: c.items.get('currentUserId') }),
+ *   }])
+ *   async handle(command: DeleteUserCommand) {}
+ * }
+ * ```
+ *
+ * @example Compliance-sensitive fail-closed auditing
+ * ```ts
+ * class RefundPaymentHandler {
+ *   @pipeline.wrap({ kind: 'command' }, [AuditBehavior, {
+ *     action: 'payment.refund',
+ *     failOpen: false,
+ *     captureResponse: false,
+ *   }])
+ *   async handle(command: RefundPaymentCommand) {}
+ * }
+ * ```
+ */
+export class AuditBehavior {
+    sink;
+    static [PIPELINE_BEHAVIOR_CONTRACT] = {
+        validate: (context) => {
+            const invalid = findInvalidFactory((context.effectiveOptions ?? {}));
+            if (!invalid)
+                return undefined;
+            return [
+                {
+                    handlerName: context.handlerName,
+                    behaviorName: AuditBehavior.name,
+                    message: invalid,
+                    fix: 'Pass functions for the actor, metadata and redact options of AuditBehavior.',
+                },
+            ];
+        },
+    };
+    logger;
+    defaults;
+    constructor(sink, defaults, logger) {
+        this.sink = sink;
+        if (typeof sink?.write !== 'function') {
+            throw new TypeError('AuditBehavior requires an audit sink with a write() method, such as new LogAuditSink().');
+        }
+        this.defaults = defaults ?? {};
+        this.logger = logger ?? console;
+    }
+    async handle(context, next) {
+        const options = this.resolveEffectiveOptions(context.getBehaviorOptions(AuditBehavior));
+        const captureKinds = options.captureKinds ?? DEFAULT_CAPTURE_KINDS;
+        if (!captureKinds.includes(context.requestKind)) {
+            return next();
+        }
+        const failOpen = options.failOpen ?? true;
+        this.validateFactories(options, failOpen);
+        const startedAt = new Date();
+        const id = uuidv7();
+        const begin = options.recordStart === false
+            ? undefined
+            : this.sink.begin?.bind(this.sink);
+        if (begin) {
+            await this.begin(begin, {
+                context,
+                options,
+                id,
+                startedAt: startedAt.toISOString(),
+            });
+        }
+        const start = performance.now();
+        let response;
+        try {
+            response = await next();
+        }
+        catch (error) {
+            try {
+                await this.record({
+                    context,
+                    options,
+                    id,
+                    error,
+                    failed: true,
+                    durationMs: performance.now() - start,
+                    startedAt: startedAt.toISOString(),
+                });
+            }
+            catch (recordError) {
+                this.diagnose('error', `Audit recording also failed after request error: ${recordError instanceof Error ? recordError.message : recordError}`);
+            }
+            throw error;
+        }
+        await this.record({
+            context,
+            options,
+            id,
+            response,
+            failed: false,
+            durationMs: performance.now() - start,
+            startedAt: startedAt.toISOString(),
+        });
+        return response;
+    }
+    /**
+     * Build the start record, forward it to the sink's `begin`, and stash it on
+     * the context. Throws only when failing closed, before the handler runs.
+     */
+    async begin(begin, input) {
+        const failOpen = input.options.failOpen ?? true;
+        let record;
+        try {
+            record = buildAuditStartRecord(input);
+        }
+        catch (buildError) {
+            const message = `Failed to build audit start record for ${input.context.requestName}: ` +
+                `${buildError instanceof Error ? buildError.message : buildError}`;
+            this.reportFailure(message, failOpen, buildError);
+            return;
+        }
+        setPipelineItem(input.context, AUDIT_START_RECORD_ITEM_TOKEN, record);
+        try {
+            await begin(record);
+        }
+        catch (sinkError) {
+            const message = `Failed to write audit start record for ${record.requestName} ` +
+                `(correlationId: ${record.correlationId}): ` +
+                `${sinkError instanceof Error ? sinkError.message : sinkError}`;
+            this.reportFailure(message, failOpen, sinkError);
+        }
+    }
+    /** Build the record, forward it to the sink, and stash it on the context. */
+    async record(input) {
+        const failOpen = input.options.failOpen ?? true;
+        let record;
+        try {
+            record = buildAuditRecord(input);
+        }
+        catch (buildError) {
+            const message = `Failed to build audit record for ${input.context.requestName}: ` +
+                `${buildError instanceof Error ? buildError.message : buildError}`;
+            this.reportFailure(message, failOpen, buildError);
+            return;
+        }
+        setPipelineItem(input.context, AUDIT_RECORD_ITEM_TOKEN, record);
+        try {
+            await this.sink.write(record);
+        }
+        catch (sinkError) {
+            const message = `Failed to write audit record for ${record.requestName} ` +
+                `(correlationId: ${record.correlationId}): ` +
+                `${sinkError instanceof Error ? sinkError.message : sinkError}`;
+            this.reportFailure(message, failOpen, sinkError);
+        }
+    }
+    /**
+     * Rejects a non-function factory option before request execution when
+     * `failOpen` is false, and logs it otherwise.
+     */
+    validateFactories(options, failOpen) {
+        const invalid = findInvalidFactory(options);
+        if (invalid)
+            this.reportFailure(invalid, failOpen, new TypeError(invalid));
+    }
+    /** Logs an audit failure, then fails open or rethrows `error`. */
+    reportFailure(message, failOpen, error) {
+        if (failOpen) {
+            this.diagnose('warn', `${message}; failing open`);
+            return;
+        }
+        this.diagnose('error', `${message}; failing closed`);
+        throw error;
+    }
+    /** Diagnostic logging never changes the request outcome. */
+    diagnose(level, message) {
+        try {
+            this.logger[level]?.(message, AuditBehavior.name);
+        }
+        catch {
+            // A failing logger must not override the fail-open/fail-closed decision.
+        }
+    }
+    /** Shallow-merges per-handler options over the constructor defaults. */
+    resolveEffectiveOptions(options) {
+        if (!options)
+            return this.defaults;
+        return { ...this.defaults, ...options };
+    }
+}
+/**
+ * Kinds audited when `captureKinds` is omitted: commands, which change state.
+ * A query changes nothing, and a domain event follows a command that is
+ * already audited.
+ */
+const DEFAULT_CAPTURE_KINDS = ['command'];
+const FACTORY_OPTIONS = [
+    ['actor', 'actor factory'],
+    ['metadata', 'metadata factory'],
+    ['redact', 'redactor'],
+];
+function findInvalidFactory(options) {
+    for (const [option, label] of FACTORY_OPTIONS) {
+        const value = options[option];
+        if (value !== undefined && typeof value !== 'function') {
+            return `Invalid audit ${label}: expected a function, received ${typeof value}`;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=audit.behavior.js.map

package/dist/audit.behavior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.behavior.js","sourceRoot":"","sources":["../src/audit.behavior.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EACL,kBAAkB,EAMlB,0BAA0B,EAK1B,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AASnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,kBAAkB,CAAc,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,kBAAkB,CAAmB,yBAAyB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,OAAO,aAAa;IA4BL,IAAI;IAvBvB,MAAM,CAAU,CAAC,0BAA0B,CAAC,GAA8B;QACxE,QAAQ,EAAE,CACR,OAA0C,EACA,EAAE;YAC5C,MAAM,OAAO,GAAG,kBAAkB,CAChC,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAyB,CACzD,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,OAAO;gBACL;oBACE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,YAAY,EAAE,aAAa,CAAC,IAAI;oBAChC,OAAO,EAAE,OAAO;oBAChB,GAAG,EAAE,6EAA6E;iBACnF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;IAEe,MAAM,CAAiB;IACvB,QAAQ,CAAuB;IAEhD,YACmB,IAAe,EAChC,QAA+B,EAC/B,MAAuB;oBAFN,IAAI;QAIrB,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAE/B,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAyB,EACzB,IAAkB;QAElB,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAC1C,OAAO,CAAC,kBAAkB,CAAuB,aAAa,CAAC,CAChE,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACnE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GACT,OAAO,CAAC,WAAW,KAAK,KAAK;YAC3B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;gBACtB,OAAO;gBACP,OAAO;gBACP,EAAE;gBACF,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC;oBAChB,OAAO;oBACP,OAAO;oBACP,EAAE;oBACF,KAAK;oBACL,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;oBACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;iBACnC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CACX,OAAO,EACP,oDAAoD,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CACvH,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,OAAO;YACP,OAAO;YACP,EAAE;YACF,QAAQ;YACR,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;YACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,KAAK,CACjB,KAAyD,EACzD,KAKC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAChD,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,OAAO,GACX,0CAA0C,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI;gBACvE,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,MAAM,OAAO,GACX,0CAA0C,MAAM,CAAC,WAAW,GAAG;gBAC/D,mBAAmB,MAAM,CAAC,aAAa,KAAK;gBAC5C,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,MAAM,CAAC,KASpB;QACC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAChD,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,OAAO,GACX,oCAAoC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI;gBACjE,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,MAAM,OAAO,GACX,oCAAoC,MAAM,CAAC,WAAW,GAAG;gBACzD,mBAAmB,MAAM,CAAC,aAAa,KAAK;gBAC5C,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,iBAAiB,CACvB,OAA6B,EAC7B,QAAiB;QAEjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO;YAAE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,kEAAkE;IAC1D,aAAa,CACnB,OAAe,EACf,QAAiB,EACjB,KAAc;QAEd,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,OAAO,gBAAgB,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,4DAA4D;IACpD,QAAQ,CAAC,KAAuB,EAAE,OAAe;QACvD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uBAAuB,CACrB,OAA8B;QAE9B,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAgC,CAAC,SAAS,CAAC,CAAC;AAEvE,MAAM,eAAe,GAAG;IACtB,CAAC,OAAO,EAAE,eAAe,CAAC;IAC1B,CAAC,UAAU,EAAE,kBAAkB,CAAC;IAChC,CAAC,QAAQ,EAAE,UAAU,CAAC;CACd,CAAC;AAEX,SAAS,kBAAkB,CAAC,OAA6B;IACvD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACvD,OAAO,iBAAiB,KAAK,mCAAmC,OAAO,KAAK,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/constants/tokens.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Relative importance levels of an audited action.
+ */
+export declare const AUDIT_SEVERITY: {
+    readonly LOW: 'low';
+    readonly MEDIUM: 'medium';
+    readonly HIGH: 'high';
+    readonly CRITICAL: 'critical';
+};
+/**
+ * Standard request kinds categorized by the pipeline.
+ */
+export declare const AUDIT_REQUEST_KINDS: {
+    readonly COMMAND: 'command';
+    readonly QUERY: 'query';
+    readonly EVENT: 'event';
+    readonly UNKNOWN: 'unknown';
+};
+/**
+ * Audit record outcomes. `PENDING` is the outcome of a start record only.
+ */
+export declare const AUDIT_OUTCOMES: {
+    readonly SUCCESS: 'success';
+    readonly FAILURE: 'failure';
+    readonly PENDING: 'pending';
+};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/constants/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/constants/tokens.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,cAAc;aACzB,GAAG,EAAE,KAAK;aACV,MAAM,EAAE,QAAQ;aAChB,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,mBAAmB;aAC9B,OAAO,EAAE,SAAS;aAClB,KAAK,EAAE,OAAO;aACd,KAAK,EAAE,OAAO;aACd,OAAO,EAAE,SAAS;CACV,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,cAAc;aACzB,OAAO,EAAE,SAAS;aAClB,OAAO,EAAE,SAAS;aAClB,OAAO,EAAE,SAAS;CACV,CAAC"}

package/dist/constants/tokens.js

@@ -0,0 +1,28 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+/**
+ * Relative importance levels of an audited action.
+ */
+export const AUDIT_SEVERITY = {
+    LOW: 'low',
+    MEDIUM: 'medium',
+    HIGH: 'high',
+    CRITICAL: 'critical',
+};
+/**
+ * Standard request kinds categorized by the pipeline.
+ */
+export const AUDIT_REQUEST_KINDS = {
+    COMMAND: 'command',
+    QUERY: 'query',
+    EVENT: 'event',
+    UNKNOWN: 'unknown',
+};
+/**
+ * Audit record outcomes. `PENDING` is the outcome of a start record only.
+ */
+export const AUDIT_OUTCOMES = {
+    SUCCESS: 'success',
+    FAILURE: 'failure',
+    PENDING: 'pending',
+};
+//# sourceMappingURL=tokens.js.map

package/dist/constants/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/constants/tokens.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;CACV,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACV,CAAC"}

package/dist/helpers/audit.intent.d.ts

@@ -0,0 +1,15 @@
+import type { PipelineBehaviorTuple } from '@cqrs-ddd/pipeline';
+import { AuditBehavior } from '../audit.behavior.js';
+import type { AuditBehaviorOptions } from '../interfaces/audit-options.interface.js';
+export type AuditIntentOptions = AuditBehaviorOptions;
+/**
+ * Returns an audit behavior entry for `pipeline.wrap()` or `createPipeline({ globalBehaviors })`.
+ * @param options Per-handler audit options; omitted fields use behavior defaults.
+ * @returns The behavior class and options tuple.
+ * @example
+ * ```ts
+ * @pipeline.wrap({ kind: 'command' }, audit({ action: 'user.delete', severity: 'high' }))
+ * ```
+ */
+export declare function audit(options?: AuditIntentOptions): PipelineBehaviorTuple<AuditBehavior, AuditBehaviorOptions>;
+//# sourceMappingURL=audit.intent.d.ts.map

package/dist/helpers/audit.intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.intent.d.ts","sourceRoot":"","sources":["../../src/helpers/audit.intent.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAErF,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CACnB,OAAO,GAAE,kBAAuB,GAC/B,qBAAqB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAE5D"}

package/dist/helpers/audit.intent.js

@@ -0,0 +1,15 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { AuditBehavior } from '../audit.behavior.js';
+/**
+ * Returns an audit behavior entry for `pipeline.wrap()` or `createPipeline({ globalBehaviors })`.
+ * @param options Per-handler audit options; omitted fields use behavior defaults.
+ * @returns The behavior class and options tuple.
+ * @example
+ * ```ts
+ * @pipeline.wrap({ kind: 'command' }, audit({ action: 'user.delete', severity: 'high' }))
+ * ```
+ */
+export function audit(options = {}) {
+    return [AuditBehavior, options];
+}
+//# sourceMappingURL=audit.intent.js.map

package/dist/helpers/audit.intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.intent.js","sourceRoot":"","sources":["../../src/helpers/audit.intent.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAGtE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKrD;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CACnB,OAAO,GAAuB,EAAE;IAEhC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/dist/helpers/build-record.d.ts

@@ -0,0 +1,42 @@
+import type { IPipelineContext } from '@cqrs-ddd/pipeline';
+import type { AuditBehaviorOptions } from '../interfaces/audit-options.interface.js';
+import type { AuditRecord, AuditStartRecord } from '../interfaces/audit-record.interface.js';
+/** Inputs describing an operation about to run. */
+export interface BuildAuditStartRecordInput {
+    /** The pipeline context of the audited request. */
+    context: IPipelineContext;
+    /** Effective, merged behavior options. */
+    options: AuditBehaviorOptions;
+    /** Record id. Default: a new UUIDv7. */
+    id?: string;
+    /** ISO-8601 start timestamp. */
+    startedAt: string;
+}
+/** Inputs describing the completed (or failed) pipeline run. */
+export interface BuildAuditRecordInput extends BuildAuditStartRecordInput {
+    /** The handler return value (used only when `captureResponse` is on). */
+    response?: unknown;
+    /** The thrown value, if the handler failed. */
+    error?: unknown;
+    /** Explicit execution state; thrown `undefined` is still a failure. */
+    failed: boolean;
+    /** Wall-clock duration in milliseconds. */
+    durationMs: number;
+}
+/**
+ * Build the pending {@link AuditStartRecord} of an operation about to run:
+ * everything known before the handler, with `outcome: 'pending'`.
+ *
+ * Pass its `id` to {@link buildAuditRecord} so the final record replaces it.
+ */
+export declare function buildAuditStartRecord(input: BuildAuditStartRecordInput): AuditStartRecord;
+/**
+ * Build an {@link AuditRecord} from a completed pipeline run.
+ *
+ * Applies redaction to the payload/response, resolves the actor, severity, and
+ * action, and normalizes non-`Error` throws to a well-formed error shape. Atomic
+ * values are retained, so captured values must still satisfy the selected
+ * sink's serialization requirements.
+ */
+export declare function buildAuditRecord(input: BuildAuditRecordInput): AuditRecord;
+//# sourceMappingURL=build-record.d.ts.map

package/dist/helpers/build-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-record.d.ts","sourceRoot":"","sources":["../../src/helpers/build-record.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,KAAK,EAEV,WAAW,EAEX,gBAAgB,EACjB,MAAM,yCAAyC,CAAC;AAGjD,mDAAmD;AACnD,MAAM,WAAW,0BAA0B;IACzC,mDAAmD;IACnD,OAAO,EAAE,gBAAgB,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gEAAgE;AAChE,MAAM,WAAW,qBAAsB,SAAQ,0BAA0B;IACvE,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uEAAuE;IACvE,MAAM,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,0BAA0B,GAChC,gBAAgB,CAElB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,WAAW,CAiB1E"}

package/dist/helpers/build-record.js

@@ -0,0 +1,85 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { uuidv7 } from '@cqrs-ddd/uuidv7';
+import { DEFAULT_REDACT_KEYS, redactValue } from './redact.js';
+/**
+ * Build the pending {@link AuditStartRecord} of an operation about to run:
+ * everything known before the handler, with `outcome: 'pending'`.
+ *
+ * Pass its `id` to {@link buildAuditRecord} so the final record replaces it.
+ */
+export function buildAuditStartRecord(input) {
+    return { ...buildCommonFields(input), outcome: 'pending' };
+}
+/**
+ * Build an {@link AuditRecord} from a completed pipeline run.
+ *
+ * Applies redaction to the payload/response, resolves the actor, severity, and
+ * action, and normalizes non-`Error` throws to a well-formed error shape. Atomic
+ * values are retained, so captured values must still satisfy the selected
+ * sink's serialization requirements.
+ */
+export function buildAuditRecord(input) {
+    const { options, response, error, failed, durationMs } = input;
+    const record = {
+        ...buildCommonFields(input),
+        outcome: failed ? 'failure' : 'success',
+        durationMs,
+    };
+    if ((options.captureResponse ?? false) && !failed) {
+        record.response = sanitize(response, options);
+    }
+    if (failed) {
+        record.error = toAuditError(error, options);
+    }
+    return record;
+}
+/** The fields a start record and a final record share. */
+function buildCommonFields(input) {
+    const { context, options, startedAt } = input;
+    const userMetadata = options.metadata?.(context);
+    return {
+        id: input.id ?? uuidv7(),
+        correlationId: context.correlationId,
+        tenantId: context.tenantId,
+        action: options.action ?? context.requestName,
+        severity: resolveSeverity(context, options),
+        actor: options.actor?.(context),
+        requestKind: context.requestKind,
+        requestName: context.requestName,
+        handlerName: context.handlerName,
+        timestamp: startedAt,
+        metadata: userMetadata || context.tenantId
+            ? {
+                ...(userMetadata ?? {}),
+                ...(context.tenantId ? { tenantId: context.tenantId } : {}),
+            }
+            : undefined,
+        ...((options.captureRequest ?? true)
+            ? { payload: sanitize(context.request, options) }
+            : {}),
+    };
+}
+/** Redact a value using a custom redactor or the default key-masking. */
+function sanitize(value, options) {
+    if (options.redact)
+        return options.redact(value);
+    const keys = options.redactKeys
+        ? [...DEFAULT_REDACT_KEYS, ...options.redactKeys]
+        : DEFAULT_REDACT_KEYS;
+    return redactValue(value, keys);
+}
+/** Default severity: explicit option, else `'low'` for queries, `'medium'` otherwise. */
+function resolveSeverity(context, options) {
+    if (options.severity)
+        return options.severity;
+    return context.requestKind === 'query' ? 'low' : 'medium';
+}
+function toAuditError(error, options) {
+    const isError = error instanceof Error;
+    return {
+        name: isError ? error.name : 'unknown',
+        message: isError ? error.message : String(error),
+        stack: options.includeStack === false || !isError ? undefined : error.stack,
+    };
+}
+//# sourceMappingURL=build-record.js.map

package/dist/helpers/build-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-record.js","sourceRoot":"","sources":["../../src/helpers/build-record.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAGtE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAQ1C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0B/D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiC;IAEjC,OAAO,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAE/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,iBAAiB,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACvC,UAAU;KACX,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0DAA0D;AAC1D,SAAS,iBAAiB,CACxB,KAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAEjD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,MAAM,EAAE;QACxB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW;QAC7C,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC;QAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,SAAS;QACpB,QAAQ,EACN,YAAY,IAAI,OAAO,CAAC,QAAQ;YAC9B,CAAC,CAAC;gBACE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACvB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;YACH,CAAC,CAAC,SAAS;QACf,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CAAC,KAAc,EAAE,OAA6B;IAC7D,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU;QAC7B,CAAC,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;QACjD,CAAC,CAAC,mBAAmB,CAAC;IACxB,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CACtB,OAAyB,EACzB,OAA6B;IAE7B,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC9C,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,OAA6B;IAE7B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACtC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAChD,KAAK,EAAE,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;KAC5E,CAAC;AACJ,CAAC"}