@h-ai/audit 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/index.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { core, ok, err } from '@h-ai/core';
-import { migrateSchema, reldb, validateIdentifiers, schemaColumns, BaseReldbCrudRepository } from '@h-ai/reldb';
+import { reldb, validateIdentifiers, BaseReldbCrudRepository } from '@h-ai/reldb';
 import { createHash } from 'crypto';
 import { AsyncLocalStorage } from 'async_hooks';
 import { Buffer } from 'buffer';
@@ -50,7 +50,12 @@ var AuditInitConfigSchema = z.object({
       /** Cron 使用的 IANA 时区，例如 Asia/Shanghai；UTC 不等于北京时间。 */
       timezone: z.string().trim().min(1).max(128).default("UTC")
     }).default({ enabled: false, cron: "* * * * *", timezone: "UTC" })
-  }).default({ enabled: false, maxNotificationsPerCheck: 100, rules: [], schedule: { enabled: false, cron: "* * * * *", timezone: "UTC" } }).refine((alerts) => !alerts.enabled || alerts.rules.length > 0),
+  }).default({
+    enabled: false,
+    maxNotificationsPerCheck: 100,
+    rules: [],
+    schedule: { enabled: false, cron: "* * * * *", timezone: "UTC" }
+  }).refine((alerts) => !alerts.enabled || alerts.rules.length > 0),
   /** 可选的流式归档；自动执行由宿主现有 Scheduler 装配。 */
   backup: z.object({
     /** 是否允许手动/计划归档审计；需已初始化的私有 Storage，关闭不影响审计采集。 */
@@ -68,7 +73,12 @@ var AuditInitConfigSchema = z.object({
       /** 定时备份采用的 IANA 时区；Asia/Shanghai 为北京时间，UTC 的 02:00 对应北京时间 10:00。 */
       timezone: z.string().trim().min(1).max(128).default("UTC")
     }).default({ enabled: false, cron: "0 2 * * *", timezone: "UTC" })
-  }).default({ enabled: false, batchSize: 200, maxRecordBytes: 1024 * 1024, schedule: { enabled: false, cron: "0 2 * * *", timezone: "UTC" } }),
+  }).default({
+    enabled: false,
+    batchSize: 200,
+    maxRecordBytes: 1024 * 1024,
+    schedule: { enabled: false, cron: "0 2 * * *", timezone: "UTC" }
+  }),
   /** 框架入口自动采集；显式 audit.log 不受此开关影响。 */
   capture: z.object({
     /** 是否自动记录已接入框架入口的重要操作、失败和拒绝；关闭不阻止显式 audit.log 写入。 */
@@ -104,8 +114,17 @@ function getAuditContext() {
 function withAuditContext(context, operation) {
   const previous = getAuditContext();
   const actor = Object.hasOwn(context, "actor") ? context.actor : previous.actor;
-  const snapshot = actor ? { ...actor, ...actor.roles ? { roles: [...actor.roles] } : {} } : actor;
-  return storage.run({ ...previous, ...context, actor: snapshot }, operation);
+  const snapshot = actor ? {
+    ...actor,
+    ...actor.roles ? {
+      roles: [...actor.roles]
+    } : {}
+  } : actor;
+  return storage.run({
+    ...previous,
+    ...context,
+    actor: snapshot
+  }, operation);
 }
 
 // messages/en-US.json
@@ -273,7 +292,12 @@ function createAuditAlerts(input) {
     if (!time.success)
       return time;
     const now = time.data.getTime();
-    const report = { submitted: 0, queued: 0, failed: 0, more: false };
+    const report = {
+      submitted: 0,
+      queued: 0,
+      failed: 0,
+      more: false
+    };
     let attempted = 0;
     for (const rule of input.config.rules) {
       const duration = rule.windowSeconds * 1e3;
@@ -281,12 +305,26 @@ function createAuditAlerts(input) {
       for (const start of [current - duration, current]) {
         signal.throwIfAborted();
         const end = Math.min(start + duration, now + 1);
-        const actions = [...new Set(rule.actions)].sort();
-        const outcomes = [...new Set(rule.outcomes)].sort();
+        const actions = [
+          ...new Set(rule.actions)
+        ].sort();
+        const outcomes = [
+          ...new Set(rule.outcomes)
+        ].sort();
         const severities = levels.slice(levels.indexOf(rule.minimumSeverity));
         const date = (value) => type === "sqlite" ? value : new Date(value);
-        const conditions = ["created_at >= ?", "created_at < ?", "resource <> ?", `action IN (${actions.map(() => "?").join(",")})`];
-        const params = [date(start), date(end), "audit.alert", ...actions];
+        const conditions = [
+          "created_at >= ?",
+          "created_at < ?",
+          "resource <> ?",
+          `action IN (${actions.map(() => "?").join(",")})`
+        ];
+        const params = [
+          date(start),
+          date(end),
+          "audit.alert",
+          ...actions
+        ];
         if (outcomes.length) {
           conditions.push(`outcome IN (${outcomes.map(() => "?").join(",")})`);
           params.push(...outcomes);
@@ -309,7 +347,16 @@ function createAuditAlerts(input) {
           continue;
         for (const target of rule.targets) {
           signal.throwIfAborted();
-          const id = hash({ rule: { ...rule, actions, outcomes, targets: void 0 }, target, start });
+          const id = hash({
+            rule: {
+              ...rule,
+              actions,
+              outcomes,
+              targets: void 0
+            },
+            target,
+            start
+          });
           if (attempted >= input.config.maxNotificationsPerCheck) {
             const existing = await reldb.sql.get(`SELECT id FROM ${table} WHERE id=?`, [id]);
             if (!existing.success)
@@ -320,14 +367,36 @@ function createAuditAlerts(input) {
           }
           const selection = `SELECT ?, ?, ?, ?, 'claimed' WHERE ? <= ${clock} AND ? > ${clock}`;
           const statement = type === "mysql" ? `INSERT IGNORE INTO ${table} (id, rule_id, target_id, window_start, status) ${selection}` : `INSERT INTO ${table} (id, rule_id, target_id, window_start, status) ${selection} ON CONFLICT(id) DO NOTHING`;
-          const claimed = await reldb.sql.execute(statement, [id, rule.id, target.id, start, start, start + duration * 2]);
+          const claimed = await reldb.sql.execute(statement, [
+            id,
+            rule.id,
+            target.id,
+            start,
+            start,
+            start + duration * 2
+          ]);
           if (!claimed.success)
             return claimed;
           if (claimed.data.changes === 0)
             continue;
           attempted++;
-          const details = { ruleId: rule.id, targetId: target.id, count, windowStart: new Date(start).toISOString(), windowEnd: new Date(start + duration).toISOString(), level: rule.severity };
-          const recorded = await input.log({ action: "audit.alert.claimed", resource: "audit.alert", resourceId: id, category: "system", severity: rule.severity, outcome: "success", details });
+          const details = {
+            ruleId: rule.id,
+            targetId: target.id,
+            count,
+            windowStart: new Date(start).toISOString(),
+            windowEnd: new Date(start + duration).toISOString(),
+            level: rule.severity
+          };
+          const recorded = await input.log({
+            action: "audit.alert.claimed",
+            resource: "audit.alert",
+            resourceId: id,
+            category: "system",
+            severity: rule.severity,
+            outcome: "success",
+            details
+          });
           if (!recorded.success)
             return recorded;
           signal.throwIfAborted();
@@ -336,10 +405,23 @@ function createAuditAlerts(input) {
             return sending;
           if (sending.data.changes !== 1)
             continue;
-          const sent = await input.reach.send({ provider: target.provider, to: target.to, subject: auditM("audit_alertSubject", { params: { severity: rule.severity, rule: rule.id } }), body: JSON.stringify(details), idempotencyKey: id });
+          const sent = await input.reach.send({
+            provider: target.provider,
+            to: target.to,
+            subject: auditM("audit_alertSubject", {
+              params: { severity: rule.severity, rule: rule.id }
+            }),
+            body: JSON.stringify(details),
+            idempotencyKey: id
+          });
           const accepted = sent.success && sent.data.success;
           const status = accepted ? sent.data.deferred ? "queued" : "submitted" : "unknown";
-          const updated = await reldb.sql.execute(`UPDATE ${table} SET status=?, queue_id=?, error_code=? WHERE id=? AND status='sending'`, [status, sent.success && sent.data.deferred ? sent.data.queueId : null, sent.success ? null : sent.error.code, id]);
+          const updated = await reldb.sql.execute(`UPDATE ${table} SET status=?, queue_id=?, error_code=? WHERE id=? AND status='sending'`, [
+            status,
+            sent.success && sent.data.deferred ? sent.data.queueId : null,
+            sent.success ? null : sent.error.code,
+            id
+          ]);
           if (!updated.success || updated.data.changes !== 1)
             return err(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), updated.success ? void 0 : updated.error);
           if (status === "queued")
@@ -348,11 +430,30 @@ function createAuditAlerts(input) {
             report.submitted++;
           else
             report.failed++;
-          const outcome = await input.log({ action: "audit.alert.notification", resource: "audit.alert", resourceId: id, category: "system", severity: rule.severity, outcome: accepted ? "success" : "failure", details: { ...details, status, ...sent.success ? {} : { reasonCode: sent.error.code }, ...sent.success && sent.data.deferred ? { queueId: sent.data.queueId } : {} } });
+          const outcome = await input.log({
+            action: "audit.alert.notification",
+            resource: "audit.alert",
+            resourceId: id,
+            category: "system",
+            severity: rule.severity,
+            outcome: accepted ? "success" : "failure",
+            details: {
+              ...details,
+              status,
+              ...sent.success ? {} : { reasonCode: sent.error.code },
+              ...sent.success && sent.data.deferred ? { queueId: sent.data.queueId } : {}
+            }
+          });
           if (!outcome.success)
             return outcome;
-          if (!accepted)
-            logger.error("Audit alert notification outcome requires review", { id, ruleId: rule.id, targetId: target.id, errorCode: sent.success ? void 0 : sent.error.code });
+          if (!accepted) {
+            logger.error("Audit alert notification outcome requires review", {
+              id,
+              ruleId: rule.id,
+              targetId: target.id,
+              errorCode: sent.success ? void 0 : sent.error.code
+            });
+          }
         }
       }
     }
@@ -371,7 +472,10 @@ function createAuditAlerts(input) {
     if (options?.signal?.aborted)
       cancel();
     controllers.add(controller);
-    const operation = withAuditContext({ actor: { id: "system:audit-alerts", username: "scheduler" }, category: "system" }, () => run(controller.signal)).catch((error) => {
+    const operation = withAuditContext({
+      actor: { id: "system:audit-alerts", username: "scheduler" },
+      category: "system"
+    }, () => run(controller.signal)).catch((error) => {
       logger.error("Audit alert check failed", { error });
       return err(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), error);
     });
@@ -386,15 +490,25 @@ function createAuditAlerts(input) {
   let schedule = null;
   if (input.config.enabled && input.config.schedule.enabled) {
     schedule = {
-      tasks: [{ id: "hai-audit-alerts", name: auditM("audit_alertTaskName"), idempotent: true, cron: input.config.schedule.cron, timezone: input.config.schedule.timezone }],
-      hooks: { onTaskExecute: async ({ context, signal }) => {
-        if (context.taskId !== "hai-audit-alerts")
-          throw core.error.buildHaiErrorInst(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"));
-        const result = await check({ signal });
-        if (!result.success || result.data.failed > 0)
-          throw core.error.buildHaiErrorInst(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), result.success ? void 0 : result.error);
-        return result.data;
-      } }
+      tasks: [
+        {
+          id: "hai-audit-alerts",
+          name: auditM("audit_alertTaskName"),
+          idempotent: true,
+          cron: input.config.schedule.cron,
+          timezone: input.config.schedule.timezone
+        }
+      ],
+      hooks: {
+        onTaskExecute: async ({ context, signal }) => {
+          if (context.taskId !== "hai-audit-alerts")
+            throw core.error.buildHaiErrorInst(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"));
+          const result = await check({ signal });
+          if (!result.success || result.data.failed > 0)
+            throw core.error.buildHaiErrorInst(HaiAuditError.ALERTS_FAILED, auditM("audit_alertsFailed"), result.success ? void 0 : result.error);
+          return result.data;
+        }
+      }
     };
   }
   return {
@@ -408,7 +522,12 @@ function createAuditAlerts(input) {
   };
 }
 var logger2 = core.logger.child({ module: "audit", scope: "writer" });
-var actorSchema = z.object({ id: z.string().min(1).max(256), username: z.string().max(256).optional(), displayName: z.string().max(256).optional(), roles: z.array(z.string().max(256)).max(1e3).optional() });
+var actorSchema = z.object({
+  id: z.string().min(1).max(256),
+  username: z.string().max(256).optional(),
+  displayName: z.string().max(256).optional(),
+  roles: z.array(z.string().max(256)).max(1e3).optional()
+});
 var detailsSchema = z.record(z.string(), z.unknown());
 var inputSchema = z.object({
   userId: z.string().min(1).max(256).nullable().optional(),
@@ -436,7 +555,14 @@ var querySchema = z.object({
   category: z.enum(["system", "business"]).optional(),
   outcome: z.enum(["success", "failure", "denied"]).optional(),
   severity: z.enum(["info", "warning", "error", "critical"]).optional(),
-  sortBy: z.enum(["createdAt", "action", "resource", "category", "outcome", "severity"]).optional(),
+  sortBy: z.enum([
+    "createdAt",
+    "action",
+    "resource",
+    "category",
+    "outcome",
+    "severity"
+  ]).optional(),
   sortDirection: z.enum(["asc", "desc"]).optional(),
   startDate: z.date().optional(),
   endDate: z.date().optional()
@@ -459,8 +585,15 @@ function createAuditWriter(repository, config) {
     try {
       const parsed = inputSchema.safeParse(input);
       if (!parsed.success) {
-        logger2.error("Audit input rejected", { issues: parsed.error.issues.map((issue) => issue.path.join(".")) });
-        return err(HaiAuditError.LOG_FAILED, auditM("audit_invalidInput", { params: { field: "event", reason: auditM("audit_eventFieldsInvalid") } }));
+        logger2.error("Audit input rejected", {
+          issues: parsed.error.issues.map((issue) => issue.path.join("."))
+        });
+        return err(HaiAuditError.LOG_FAILED, auditM("audit_invalidInput", {
+          params: {
+            field: "event",
+            reason: auditM("audit_eventFieldsInvalid")
+          }
+        }));
       }
       const value = parsed.data;
       const context = getAuditContext();
@@ -468,8 +601,15 @@ function createAuditWriter(repository, config) {
       const actor = Object.hasOwn(value, "actorSnapshot") ? value.actorSnapshot : context.actor;
       const userId = value.userId !== void 0 ? value.userId : actor?.id ?? correlation.userId ?? null;
       if (value.actorSnapshot && value.actorSnapshot.id !== userId) {
-        logger2.error("Audit actor snapshot rejected", { reason: auditM("audit_identityMismatch") });
-        return err(HaiAuditError.LOG_FAILED, auditM("audit_invalidInput", { params: { field: "actorSnapshot", reason: auditM("audit_identityMismatch") } }));
+        logger2.error("Audit actor snapshot rejected", {
+          reason: auditM("audit_identityMismatch")
+        });
+        return err(HaiAuditError.LOG_FAILED, auditM("audit_invalidInput", {
+          params: {
+            field: "actorSnapshot",
+            reason: auditM("audit_identityMismatch")
+          }
+        }));
       }
       const snapshot = actor?.id === userId ? readAuditActor(actor) : userId ? await repository.captureActor(userId, tx) : null;
       const outcome = value.outcome ?? "success";
@@ -497,12 +637,22 @@ function createAuditWriter(repository, config) {
         userAgent: value.userAgent ?? context.userAgent ?? null,
         details
       }, tx);
-      if (!result.success)
-        logger2.error("Audit event persistence failed", { action: value.action, resource: value.resource, requestId: value.requestId ?? context.requestId, error: result.error });
+      if (!result.success) {
+        logger2.error("Audit event persistence failed", {
+          action: value.action,
+          resource: value.resource,
+          requestId: value.requestId ?? context.requestId,
+          error: result.error
+        });
+      }
       return result;
     } catch (error) {
       logger2.error("Audit event processing failed", { requestId: getAuditContext().requestId, error });
-      return err(HaiAuditError.LOG_FAILED, auditM("audit_logFailed", { params: { error: auditM("audit_eventProcessingFailed") } }), error);
+      return err(HaiAuditError.LOG_FAILED, auditM("audit_logFailed", {
+        params: {
+          error: auditM("audit_eventProcessingFailed")
+        }
+      }), error);
     }
   };
 }
@@ -520,8 +670,21 @@ var backupHeaderSchema = z.object({
   from: z.iso.datetime().nullable(),
   requestHash: digestSchema
 });
-var footerSchema = z.object({ type: z.literal("footer"), recordCount: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER), sha256: digestSchema });
-var entrySchema = z.object({ type: z.literal("entry"), record: z.object({ id: z.string().min(1), action: z.string().min(1), resource: z.string().min(1), createdAt: z.iso.datetime(), actorSnapshot: z.unknown().optional() }).passthrough() });
+var footerSchema = z.object({
+  type: z.literal("footer"),
+  recordCount: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  sha256: digestSchema
+});
+var entrySchema = z.object({
+  type: z.literal("entry"),
+  record: z.object({
+    id: z.string().min(1),
+    action: z.string().min(1),
+    resource: z.string().min(1),
+    createdAt: z.iso.datetime(),
+    actorSnapshot: z.unknown().optional()
+  }).passthrough()
+});
 function archiveLine(value, maxRecordBytes) {
   const encoded = Buffer.from(`${JSON.stringify(value)}
 `, "utf8");
@@ -583,17 +746,32 @@ async function verifyArchive(source, options) {
     const entry = entrySchema.parse(value);
     readAuditActor(entry.record.actorSnapshot);
     if (!Number.isSafeInteger(++count))
-      throw new Error("Audit archive record count exceeds safe range");
+      throw new TypeError("Audit archive record count exceeds safe range");
     hash2.update(line);
   }
   if (!header || !footer)
     throw new Error("Audit archive is incomplete");
-  return { info: { id: header.id, key: options.key, recordCount: footer.recordCount, sha256: footer.sha256, createdAt: new Date(header.createdAt), cutoff: new Date(header.cutoff) }, requestHash: header.requestHash };
+  return {
+    info: {
+      id: header.id,
+      key: options.key,
+      recordCount: footer.recordCount,
+      sha256: footer.sha256,
+      createdAt: new Date(header.createdAt),
+      cutoff: new Date(header.cutoff)
+    },
+    requestHash: header.requestHash
+  };
 }
 
 // src/audit-backup-functions.ts
 var logger3 = core.logger.child({ module: "audit", scope: "backup" });
-var optionsSchema = z.object({ id: backupIdSchema.optional(), from: z.date().optional(), to: z.date().optional(), signal: z.instanceof(AbortSignal).optional() });
+var optionsSchema = z.object({
+  id: backupIdSchema.optional(),
+  from: z.date().optional(),
+  to: z.date().optional(),
+  signal: z.instanceof(AbortSignal).optional()
+});
 function createAuditBackup(input) {
   let active = true;
   const controllers = /* @__PURE__ */ new Set();
@@ -658,7 +836,12 @@ function createAuditBackup(input) {
       const from = values.from ? new Date(values.from.getTime()) : void 0;
       const key = `${AUDIT_BACKUP_PREFIX}${id}.jsonl`;
       const database = reldb.config;
-      const source = database?.type === "sqlite" ? { type: database.type, database: database.database } : { type: database?.type, host: database?.host, port: database?.port, database: database?.database };
+      const source = database?.type === "sqlite" ? { type: database.type, database: database.database } : {
+        type: database?.type,
+        host: database?.host,
+        port: database?.port,
+        database: database?.database
+      };
       const requestHash = createHash("sha256").update(JSON.stringify({ source, from: from?.toISOString() ?? null, to: values.to?.toISOString() ?? null })).digest("hex");
       return track(async (signal) => {
         const time = await readAuditTime();
@@ -676,14 +859,28 @@ function createAuditBackup(input) {
         let completed;
         async function* content() {
           const hash2 = createHash("sha256");
-          const header = archiveLine({ type: "header", format: "hai-audit", version: 1, id, createdAt: createdAt.toISOString(), cutoff: cutoff.toISOString(), from: from?.toISOString() ?? null, requestHash }, input.config.maxRecordBytes);
+          const header = archiveLine({
+            type: "header",
+            format: "hai-audit",
+            version: 1,
+            id,
+            createdAt: createdAt.toISOString(),
+            cutoff: cutoff.toISOString(),
+            from: from?.toISOString() ?? null,
+            requestHash
+          }, input.config.maxRecordBytes);
           hash2.update(header);
           yield header;
           let afterId;
           let count = 0;
           while (true) {
             signal.throwIfAborted();
-            const page = await input.repository.archivePage({ afterId, from, cutoff, limit: input.config.batchSize });
+            const page = await input.repository.archivePage({
+              afterId,
+              from,
+              cutoff,
+              limit: input.config.batchSize
+            });
             if (!page.success)
               throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_FAILED, auditM("audit_backupFailed"), page.error);
             for (const record of page.data) {
@@ -692,7 +889,7 @@ function createAuditBackup(input) {
               hash2.update(line);
               yield line;
               if (!Number.isSafeInteger(++count))
-                throw new Error("Audit archive record count exceeds safe range");
+                throw new TypeError("Audit archive record count exceeds safe range");
               afterId = record.id;
             }
             if (page.data.length < input.config.batchSize)
@@ -700,12 +897,24 @@ function createAuditBackup(input) {
           }
           const sha256 = hash2.digest("hex");
           yield archiveLine({ type: "footer", recordCount: count, sha256 }, input.config.maxRecordBytes);
-          completed = { id, key, recordCount: count, sha256, createdAt, cutoff };
+          completed = {
+            id,
+            key,
+            recordCount: count,
+            sha256,
+            createdAt,
+            cutoff
+          };
         }
         const stream = content();
         let uploaded;
         try {
-          uploaded = await input.storage.file.put(key, stream, { ifNoneMatch: "*", contentType: "application/x-ndjson", cacheControl: "private, no-store", signal });
+          uploaded = await input.storage.file.put(key, stream, {
+            ifNoneMatch: "*",
+            contentType: "application/x-ndjson",
+            cacheControl: "private, no-store",
+            signal
+          });
         } finally {
           await stream.return(void 0);
         }
@@ -735,15 +944,28 @@ function createAuditBackup(input) {
   let schedule = null;
   if (input.config.enabled && input.config.schedule.enabled) {
     schedule = {
-      tasks: [{ id: "hai-audit-backup", name: auditM("audit_backupTaskName"), idempotent: true, cron: input.config.schedule.cron, timezone: input.config.schedule.timezone }],
-      hooks: { onTaskExecute: async ({ context, signal }) => {
-        if (context.taskId !== "hai-audit-backup" || !context.occurrenceId)
-          throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid"));
-        const result = await withAuditContext({ actor: { id: "system:audit-backup", username: "scheduler" }, requestId: context.occurrenceId }, () => operations.run({ id: context.occurrenceId, signal }));
-        if (!result.success)
-          throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_FAILED, result.error.message, result.error);
-        return result.data;
-      } }
+      tasks: [
+        {
+          id: "hai-audit-backup",
+          name: auditM("audit_backupTaskName"),
+          idempotent: true,
+          cron: input.config.schedule.cron,
+          timezone: input.config.schedule.timezone
+        }
+      ],
+      hooks: {
+        onTaskExecute: async ({ context, signal }) => {
+          if (context.taskId !== "hai-audit-backup" || !context.occurrenceId)
+            throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_INVALID, auditM("audit_backupInvalid"));
+          const result = await withAuditContext({
+            actor: { id: "system:audit-backup", username: "scheduler" },
+            requestId: context.occurrenceId
+          }, () => operations.run({ id: context.occurrenceId, signal }));
+          if (!result.success)
+            throw core.error.buildHaiErrorInst(HaiAuditError.BACKUP_FAILED, result.error.message, result.error);
+          return result.data;
+        }
+      }
     };
   }
   return {
@@ -766,15 +988,37 @@ function toVoid(result) {
 function createHelper(logFn) {
   return {
     async login(userId, ip, ua) {
-      const result = await logFn({ userId, category: "system", action: "login", resource: "auth", ipAddress: ip, userAgent: ua });
+      const result = await logFn({
+        userId,
+        category: "system",
+        action: "login",
+        resource: "auth",
+        ipAddress: ip,
+        userAgent: ua
+      });
       return toVoid(result);
     },
     async logout(userId, ip, ua) {
-      const result = await logFn({ userId, category: "system", action: "logout", resource: "auth", ipAddress: ip, userAgent: ua });
+      const result = await logFn({
+        userId,
+        category: "system",
+        action: "logout",
+        resource: "auth",
+        ipAddress: ip,
+        userAgent: ua
+      });
       return toVoid(result);
     },
     async register(userId, ip, ua) {
-      const result = await logFn({ userId, category: "system", action: "register", resource: "auth", resourceId: userId, ipAddress: ip, userAgent: ua });
+      const result = await logFn({
+        userId,
+        category: "system",
+        action: "register",
+        resource: "auth",
+        resourceId: userId,
+        ipAddress: ip,
+        userAgent: ua
+      });
       return toVoid(result);
     },
     async passwordResetRequest(email, ip, ua) {
@@ -789,7 +1033,14 @@ function createHelper(logFn) {
       return toVoid(result);
     },
     async passwordResetComplete(userId, ip, ua) {
-      const result = await logFn({ userId, category: "system", action: "password_reset", resource: "auth", ipAddress: ip, userAgent: ua });
+      const result = await logFn({
+        userId,
+        category: "system",
+        action: "password_reset",
+        resource: "auth",
+        ipAddress: ip,
+        userAgent: ua
+      });
       return toVoid(result);
     },
     async crud(input) {
@@ -799,129 +1050,150 @@ function createHelper(logFn) {
     }
   };
 }
-var columns = { category: "VARCHAR(16)", outcome: "VARCHAR(16)", severity: "VARCHAR(16)", request_id: "TEXT", trace_id: "TEXT", scope_id: "TEXT", actor_snapshot: "JSON" };
+var columns = {
+  category: "VARCHAR(16)",
+  outcome: "VARCHAR(16)",
+  severity: "VARCHAR(16)",
+  request_id: "TEXT",
+  trace_id: "TEXT",
+  scope_id: "TEXT",
+  actor_snapshot: "JSON"
+};
 var triggers = ["hai_audit_protect_update", "hai_audit_protect_delete", "hai_audit_protect_insert"];
 async function existingTriggers(sql) {
   const result = reldb.config?.type === "sqlite" ? await sql.query("SELECT name FROM sqlite_master WHERE type='trigger' AND tbl_name='hai_audit_logs'") : await sql.query(`SELECT trigger_name AS name FROM information_schema.triggers WHERE trigger_schema=${reldb.config?.type === "mysql" ? "DATABASE()" : "current_schema()"} AND event_object_table='hai_audit_logs'`);
   return result.success ? ok(result.data.map((row) => row.name)) : result;
 }
-var steps = [{
-  version: 1,
-  name: "event-context-and-identity",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_audit_logs", sql);
-    return found.success ? ok(found.data.length > 0 && Object.keys(columns).some((name) => !found.data.includes(name))) : found;
-  },
-  async apply(sql) {
-    const found = await schemaColumns(reldb, "hai_audit_logs", sql);
-    if (!found.success)
-      return found;
-    for (const [name, definition] of Object.entries(columns)) {
-      if (found.data.includes(name))
-        continue;
-      const added = await sql.execute(`ALTER TABLE hai_audit_logs ADD COLUMN ${name} ${definition}`);
-      if (!added.success)
-        return added;
+var steps = [
+  {
+    version: 1,
+    name: "event-context-and-identity",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_audit_logs", sql);
+      return found.success ? ok(found.data.length > 0 && Object.keys(columns).some((name) => !found.data.includes(name))) : found;
+    },
+    async apply(sql) {
+      const found = await reldb.schemaColumns("hai_audit_logs", sql);
+      if (!found.success)
+        return found;
+      for (const [name, definition] of Object.entries(columns)) {
+        if (found.data.includes(name))
+          continue;
+        const added = await sql.execute(`ALTER TABLE hai_audit_logs ADD COLUMN ${name} ${definition}`);
+        if (!added.success)
+          return added;
+      }
+      return ok(void 0);
     }
-    return ok(void 0);
-  }
-}, {
-  version: 2,
-  name: "persistent-retention-policy",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_audit_policy", sql);
-    if (!found.success || found.data.length === 0)
-      return found.success ? ok(true) : found;
-    const row = await sql.get("SELECT id FROM hai_audit_policy WHERE id=1");
-    return row.success ? ok(!row.data) : row;
   },
-  async apply(sql) {
-    const created = await sql.execute("CREATE TABLE IF NOT EXISTS hai_audit_policy (id INTEGER PRIMARY KEY, enabled INTEGER NOT NULL, min_days INTEGER NOT NULL)");
-    if (!created.success)
-      return created;
-    return sql.execute(reldb.config?.type === "mysql" ? "INSERT IGNORE INTO hai_audit_policy (id, enabled, min_days) VALUES (1, 0, 90)" : "INSERT INTO hai_audit_policy (id, enabled, min_days) VALUES (1, 0, 90) ON CONFLICT(id) DO NOTHING");
-  }
-}, {
-  version: 3,
-  name: "retention-write-guards",
-  async needed(sql) {
-    const table2 = await schemaColumns(reldb, "hai_audit_logs", sql);
-    if (!table2.success || !table2.data.length)
-      return table2.success ? ok(false) : table2;
-    const found = await existingTriggers(sql);
-    return found.success ? ok(triggers.some((name) => !found.data.includes(name))) : found;
-  },
-  async apply(sql) {
-    const found = await existingTriggers(sql);
-    if (!found.success)
-      return found;
-    const enabled = "COALESCE((SELECT enabled FROM hai_audit_policy WHERE id=1),1)=1";
-    const days = "COALESCE((SELECT min_days FROM hai_audit_policy WHERE id=1),90)";
-    const cutoff = reldb.config?.type === "sqlite" ? `CAST((julianday('now')-2440587.5)*86400000 AS INTEGER) - ${days}*86400000` : reldb.config?.type === "postgresql" ? `CURRENT_TIMESTAMP - (${days} * INTERVAL '1 day')` : `TIMESTAMPADD(DAY, -${days}, CURRENT_TIMESTAMP(3))`;
-    const existingProtected = `${enabled} AND EXISTS(SELECT 1 FROM hai_audit_logs a WHERE a.id=NEW.id AND a.created_at >= ${cutoff})`;
-    if (reldb.config?.type === "postgresql") {
-      const fn = await sql.execute(`CREATE OR REPLACE FUNCTION hai_audit_protect() RETURNS trigger AS $$ BEGIN IF TG_OP='INSERT' THEN IF ${existingProtected} THEN RAISE EXCEPTION 'Audit record is protected by retention policy'; END IF; RETURN NEW; END IF; IF ${enabled} AND OLD.created_at >= ${cutoff} THEN RAISE EXCEPTION 'Audit record is protected by retention policy'; END IF; IF TG_OP='DELETE' THEN RETURN OLD; END IF; RETURN NEW; END; $$ LANGUAGE plpgsql`);
-      if (!fn.success)
-        return fn;
-    }
-    for (const [index, operation] of ["UPDATE", "DELETE", "INSERT"].entries()) {
-      const name = triggers[index];
-      if (found.data.includes(name))
-        continue;
-      const protectedRow = operation === "INSERT" ? existingProtected : `${enabled} AND OLD.created_at >= ${cutoff}`;
-      const statement = reldb.config?.type === "sqlite" ? `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs WHEN ${protectedRow} BEGIN SELECT RAISE(ABORT, 'Audit record is protected by retention policy'); END` : reldb.config?.type === "postgresql" ? `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs FOR EACH ROW EXECUTE FUNCTION hai_audit_protect()` : `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs FOR EACH ROW BEGIN IF ${protectedRow} THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Audit record is protected by retention policy'; END IF; END`;
-      const created = reldb.config?.type === "mysql" ? await sql.query(statement) : await sql.execute(statement);
+  {
+    version: 2,
+    name: "persistent-retention-policy",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_audit_policy", sql);
+      if (!found.success || found.data.length === 0) {
+        return found.success ? ok(true) : found;
+      }
+      const row = await sql.get("SELECT id FROM hai_audit_policy WHERE id=1");
+      return row.success ? ok(!row.data) : row;
+    },
+    async apply(sql) {
+      const created = await sql.execute("CREATE TABLE IF NOT EXISTS hai_audit_policy (id INTEGER PRIMARY KEY, enabled INTEGER NOT NULL, min_days INTEGER NOT NULL)");
       if (!created.success)
         return created;
+      return sql.execute(reldb.config?.type === "mysql" ? "INSERT IGNORE INTO hai_audit_policy (id, enabled, min_days) VALUES (1, 0, 90)" : "INSERT INTO hai_audit_policy (id, enabled, min_days) VALUES (1, 0, 90) ON CONFLICT(id) DO NOTHING");
     }
-    return ok(void 0);
-  }
-}, {
-  version: 4,
-  name: "millisecond-event-time",
-  async needed(sql) {
-    if (reldb.config?.type !== "mysql")
-      return ok(false);
-    const column = await sql.get("SELECT DATETIME_PRECISION AS fractional_digits FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name=? AND column_name=?", ["hai_audit_logs", "created_at"]);
-    return column.success ? ok(Boolean(column.data && Number(column.data.fractional_digits ?? 0) < 3)) : column;
   },
-  async apply(sql) {
-    const changed = await sql.execute("ALTER TABLE hai_audit_logs MODIFY COLUMN created_at DATETIME(3)");
-    return changed.success ? ok(void 0) : changed;
-  }
-}, {
-  version: 5,
-  name: "alert-notification-claims",
-  async needed(sql) {
-    const found = await schemaColumns(reldb, "hai_audit_alert_claims", sql);
-    return found.success ? ok(found.data.length === 0) : found;
+  {
+    version: 3,
+    name: "retention-write-guards",
+    async needed(sql) {
+      const table2 = await reldb.schemaColumns("hai_audit_logs", sql);
+      if (!table2.success || !table2.data.length) {
+        return table2.success ? ok(false) : table2;
+      }
+      const found = await existingTriggers(sql);
+      return found.success ? ok(triggers.some((name) => !found.data.includes(name))) : found;
+    },
+    async apply(sql) {
+      const found = await existingTriggers(sql);
+      if (!found.success)
+        return found;
+      const enabled = "COALESCE((SELECT enabled FROM hai_audit_policy WHERE id=1),1)=1";
+      const days = "COALESCE((SELECT min_days FROM hai_audit_policy WHERE id=1),90)";
+      const cutoff = reldb.config?.type === "sqlite" ? `CAST((julianday('now')-2440587.5)*86400000 AS INTEGER) - ${days}*86400000` : reldb.config?.type === "postgresql" ? `CURRENT_TIMESTAMP - (${days} * INTERVAL '1 day')` : `TIMESTAMPADD(DAY, -${days}, CURRENT_TIMESTAMP(3))`;
+      const existingProtected = `${enabled} AND EXISTS(SELECT 1 FROM hai_audit_logs a WHERE a.id=NEW.id AND a.created_at >= ${cutoff})`;
+      if (reldb.config?.type === "postgresql") {
+        const fn = await sql.execute(`CREATE OR REPLACE FUNCTION hai_audit_protect() RETURNS trigger AS $$ BEGIN IF TG_OP='INSERT' THEN IF ${existingProtected} THEN RAISE EXCEPTION 'Audit record is protected by retention policy'; END IF; RETURN NEW; END IF; IF ${enabled} AND OLD.created_at >= ${cutoff} THEN RAISE EXCEPTION 'Audit record is protected by retention policy'; END IF; IF TG_OP='DELETE' THEN RETURN OLD; END IF; RETURN NEW; END; $$ LANGUAGE plpgsql`);
+        if (!fn.success)
+          return fn;
+      }
+      for (const [index, operation] of ["UPDATE", "DELETE", "INSERT"].entries()) {
+        const name = triggers[index];
+        if (found.data.includes(name))
+          continue;
+        const protectedRow = operation === "INSERT" ? existingProtected : `${enabled} AND OLD.created_at >= ${cutoff}`;
+        const statement = reldb.config?.type === "sqlite" ? `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs WHEN ${protectedRow} BEGIN SELECT RAISE(ABORT, 'Audit record is protected by retention policy'); END` : reldb.config?.type === "postgresql" ? `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs FOR EACH ROW EXECUTE FUNCTION hai_audit_protect()` : `CREATE TRIGGER ${name} BEFORE ${operation} ON hai_audit_logs FOR EACH ROW BEGIN IF ${protectedRow} THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Audit record is protected by retention policy'; END IF; END`;
+        const created = reldb.config?.type === "mysql" ? await sql.query(statement) : await sql.execute(statement);
+        if (!created.success)
+          return created;
+      }
+      return ok(void 0);
+    }
   },
-  async apply(sql) {
-    const created = await sql.execute("CREATE TABLE IF NOT EXISTS hai_audit_alert_claims (id VARCHAR(64) PRIMARY KEY, rule_id VARCHAR(64) NOT NULL, target_id VARCHAR(64) NOT NULL, window_start BIGINT NOT NULL, status VARCHAR(16) NOT NULL, queue_id VARCHAR(64), error_code VARCHAR(128))");
-    return created.success ? ok(void 0) : created;
-  }
-}, {
-  version: 6,
-  name: "event-time-index",
-  async needed(sql) {
-    const table2 = await schemaColumns(reldb, "hai_audit_logs", sql);
-    if (!table2.success || !table2.data.length)
-      return table2.success ? ok(false) : table2;
-    const found = reldb.config?.type === "sqlite" ? await sql.get("SELECT name FROM sqlite_master WHERE type='index' AND name='hai_audit_event_time_idx'") : reldb.config?.type === "postgresql" ? await sql.get("SELECT indexname FROM pg_indexes WHERE schemaname=current_schema() AND tablename='hai_audit_logs' AND indexname='hai_audit_event_time_idx'") : await sql.get("SELECT index_name FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='hai_audit_logs' AND index_name='hai_audit_event_time_idx' LIMIT 1");
-    return found.success ? ok(!found.data) : found;
+  {
+    version: 4,
+    name: "millisecond-event-time",
+    async needed(sql) {
+      if (reldb.config?.type !== "mysql")
+        return ok(false);
+      const column = await sql.get("SELECT DATETIME_PRECISION AS fractional_digits FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name=? AND column_name=?", ["hai_audit_logs", "created_at"]);
+      return column.success ? ok(Boolean(column.data && Number(column.data.fractional_digits ?? 0) < 3)) : column;
+    },
+    async apply(sql) {
+      const changed = await sql.execute("ALTER TABLE hai_audit_logs MODIFY COLUMN created_at DATETIME(3)");
+      return changed.success ? ok(void 0) : changed;
+    }
   },
-  async apply(sql) {
-    const created = await sql.execute("CREATE INDEX hai_audit_event_time_idx ON hai_audit_logs (created_at)");
-    return created.success ? ok(void 0) : created;
+  {
+    version: 5,
+    name: "alert-notification-claims",
+    async needed(sql) {
+      const found = await reldb.schemaColumns("hai_audit_alert_claims", sql);
+      return found.success ? ok(found.data.length === 0) : found;
+    },
+    async apply(sql) {
+      const created = await sql.execute("CREATE TABLE IF NOT EXISTS hai_audit_alert_claims (id VARCHAR(64) PRIMARY KEY, rule_id VARCHAR(64) NOT NULL, target_id VARCHAR(64) NOT NULL, window_start BIGINT NOT NULL, status VARCHAR(16) NOT NULL, queue_id VARCHAR(64), error_code VARCHAR(128))");
+      return created.success ? ok(void 0) : created;
+    }
+  },
+  {
+    version: 6,
+    name: "event-time-index",
+    async needed(sql) {
+      const table2 = await reldb.schemaColumns("hai_audit_logs", sql);
+      if (!table2.success || !table2.data.length) {
+        return table2.success ? ok(false) : table2;
+      }
+      const found = reldb.config?.type === "sqlite" ? await sql.get("SELECT name FROM sqlite_master WHERE type='index' AND name='hai_audit_event_time_idx'") : reldb.config?.type === "postgresql" ? await sql.get("SELECT indexname FROM pg_indexes WHERE schemaname=current_schema() AND tablename='hai_audit_logs' AND indexname='hai_audit_event_time_idx'") : await sql.get("SELECT index_name FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='hai_audit_logs' AND index_name='hai_audit_event_time_idx' LIMIT 1");
+      return found.success ? ok(!found.data) : found;
+    },
+    async apply(sql) {
+      const created = await sql.execute("CREATE INDEX hai_audit_event_time_idx ON hai_audit_logs (created_at)");
+      return created.success ? ok(void 0) : created;
+    }
   }
-}];
+];
 function migrateAudit(options = {}) {
-  return migrateSchema(reldb, "audit", steps, options);
+  return reldb.migrateSchema("audit", steps, options);
 }
 async function configureAuditRetention(policy) {
   if (!policy)
     return ok(void 0);
-  const result = await reldb.sql.execute("UPDATE hai_audit_policy SET enabled=?, min_days=? WHERE id=1", [Number(policy.enabled), policy.minDays]);
+  const result = await reldb.sql.execute("UPDATE hai_audit_policy SET enabled=?, min_days=? WHERE id=1", [
+    Number(policy.enabled),
+    policy.minDays
+  ]);
   return result.success && result.data.changes === 1 ? ok(void 0) : err(HaiAuditError.CONFIG_ERROR, auditM("audit_retentionPolicyFailed"), result.success ? void 0 : result.error);
 }
 async function auditRetentionDays() {
@@ -956,22 +1228,134 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       idColumn: "id",
       generateId: () => core.id.withPrefix("audit_"),
       fields: [
-        { fieldName: "id", columnName: "id", def: { type: "TEXT", primaryKey: true }, select: true, create: true, update: false },
-        { fieldName: "userId", columnName: "user_id", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "action", columnName: "action", def: { type: "TEXT", notNull: true }, select: true, create: true, update: false },
-        { fieldName: "resource", columnName: "resource", def: { type: "TEXT", notNull: true }, select: true, create: true, update: false },
-        { fieldName: "resourceId", columnName: "resource_id", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "details", columnName: "details", def: { type: "JSON" }, select: true, create: true, update: false },
-        { fieldName: "ipAddress", columnName: "ip_address", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "userAgent", columnName: "user_agent", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "category", columnName: "category", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "outcome", columnName: "outcome", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "severity", columnName: "severity", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "requestId", columnName: "request_id", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "traceId", columnName: "trace_id", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "scopeId", columnName: "scope_id", def: { type: "TEXT" }, select: true, create: true, update: false },
-        { fieldName: "actorSnapshot", columnName: "actor_snapshot", def: { type: "JSON" }, select: true, create: true, update: false },
-        { fieldName: "createdAt", columnName: "created_at", def: { type: "TIMESTAMP" }, select: true, create: true, update: false }
+        {
+          fieldName: "id",
+          columnName: "id",
+          def: { type: "TEXT", primaryKey: true },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "userId",
+          columnName: "user_id",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "action",
+          columnName: "action",
+          def: { type: "TEXT", notNull: true },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "resource",
+          columnName: "resource",
+          def: { type: "TEXT", notNull: true },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "resourceId",
+          columnName: "resource_id",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "details",
+          columnName: "details",
+          def: { type: "JSON" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "ipAddress",
+          columnName: "ip_address",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "userAgent",
+          columnName: "user_agent",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "category",
+          columnName: "category",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "outcome",
+          columnName: "outcome",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "severity",
+          columnName: "severity",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "requestId",
+          columnName: "request_id",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "traceId",
+          columnName: "trace_id",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "scopeId",
+          columnName: "scope_id",
+          def: { type: "TEXT" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "actorSnapshot",
+          columnName: "actor_snapshot",
+          def: { type: "JSON" },
+          select: true,
+          create: true,
+          update: false
+        },
+        {
+          fieldName: "createdAt",
+          columnName: "created_at",
+          def: { type: "TIMESTAMP" },
+          select: true,
+          create: true,
+          update: false
+        }
       ]
     });
     this.repoConfig = config;
@@ -1006,12 +1390,25 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       logger4.warn("Audit actor name unavailable", { userId, error: result.error });
       return { id: userId };
     }
-    return { id: userId, ...result.data?.username ? { username: result.data.username } : {} };
+    return {
+      id: userId,
+      ...result.data?.username ? { username: result.data.username } : {}
+    };
   }
   filters(options) {
     const conditions = [];
     const params = [];
-    for (const [field, column] of [["userId", "user_id"], ["action", "action"], ["resource", "resource"], ["category", "category"], ["outcome", "outcome"], ["severity", "severity"], ["scopeId", "scope_id"], ["requestId", "request_id"], ["traceId", "trace_id"]]) {
+    for (const [field, column] of [
+      ["userId", "user_id"],
+      ["action", "action"],
+      ["resource", "resource"],
+      ["category", "category"],
+      ["outcome", "outcome"],
+      ["severity", "severity"],
+      ["scopeId", "scope_id"],
+      ["requestId", "request_id"],
+      ["traceId", "trace_id"]
+    ]) {
       if (options[field] !== void 0) {
         conditions.push(`a.${column} = ?`);
         params.push(options[field]);
@@ -1047,7 +1444,15 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
     if (!time.success)
       return time;
     const now = time.data;
-    const context = { category: input.category ?? null, outcome: input.outcome ?? null, severity: input.severity ?? null, requestId: input.requestId ?? null, traceId: input.traceId ?? null, scopeId: input.scopeId ?? null, actorSnapshot: input.actorSnapshot ?? null };
+    const context = {
+      category: input.category ?? null,
+      outcome: input.outcome ?? null,
+      severity: input.severity ?? null,
+      requestId: input.requestId ?? null,
+      traceId: input.traceId ?? null,
+      scopeId: input.scopeId ?? null,
+      actorSnapshot: input.actorSnapshot ?? null
+    };
     const data = {
       ...context,
       id,
@@ -1066,7 +1471,9 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
         logger4.error("Failed to record audit log", { action: input.action, error: createResult.error.message });
         return err(
           HaiAuditError.LOG_FAILED,
-          auditM("audit_logFailed", { params: { error: createResult.error.message } }),
+          auditM("audit_logFailed", {
+            params: { error: createResult.error.message }
+          }),
           createResult.error
         );
       }
@@ -1088,7 +1495,11 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       logger4.error("Failed to record audit log", { action: input.action, error });
       return err(
         HaiAuditError.LOG_FAILED,
-        auditM("audit_logFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+        auditM("audit_logFailed", {
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }),
         error
       );
     }
@@ -1108,11 +1519,24 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
     const { userTable, userIdColumn, userNameColumn } = this.repoConfig;
     const quote = this.db.config?.type === "mysql" ? "`" : '"';
     const identifier = (name) => `${quote}${name.replaceAll(quote, quote + quote)}${quote}`;
-    const sortColumns = { createdAt: "created_at", action: "action", resource: "resource", category: "category", outcome: "outcome", severity: "severity" };
+    const sortColumns = {
+      createdAt: "created_at",
+      action: "action",
+      resource: "resource",
+      category: "category",
+      outcome: "outcome",
+      severity: "severity"
+    };
     const sortBy = options.sortBy ?? "createdAt";
     const direction = options.sortDirection ?? "desc";
-    if (!Object.hasOwn(sortColumns, sortBy) || !["asc", "desc"].includes(direction))
-      return err(HaiAuditError.QUERY_FAILED, auditM("audit_invalidInput", { params: { field: "sort", reason: auditM("audit_sortInvalid") } }));
+    if (!Object.hasOwn(sortColumns, sortBy) || !["asc", "desc"].includes(direction)) {
+      return err(HaiAuditError.QUERY_FAILED, auditM("audit_invalidInput", {
+        params: {
+          field: "sort",
+          reason: auditM("audit_sortInvalid")
+        }
+      }));
+    }
     const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
     try {
       const result = await this.sql().queryPage({
@@ -1132,16 +1556,28 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
         logger4.error("Failed to query audit logs", { error: result.error.message });
         return err(
           HaiAuditError.QUERY_FAILED,
-          auditM("audit_queryFailed", { params: { error: result.error.message } }),
+          auditM("audit_queryFailed", {
+            params: { error: result.error.message }
+          }),
           result.error
         );
       }
-      return ok({ ...result.data, items: result.data.items.map((row) => ({ ...normalizeAuditLog(row), username: readAuditActor(row.actorSnapshot)?.username ?? (row.actorSnapshot == null ? row.username ?? null : null) })) });
+      return ok({
+        ...result.data,
+        items: result.data.items.map((row) => ({
+          ...normalizeAuditLog(row),
+          username: readAuditActor(row.actorSnapshot)?.username ?? (row.actorSnapshot == null ? row.username ?? null : null)
+        }))
+      });
     } catch (error) {
       logger4.error("Failed to query audit logs", { error });
       return err(
         HaiAuditError.QUERY_FAILED,
-        auditM("audit_queryFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+        auditM("audit_queryFailed", {
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }),
         error
       );
     }
@@ -1171,7 +1607,9 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       ["actor_snapshot", "actorSnapshot"]
     ].map(([column, alias]) => `${column} AS ${quote}${alias}${quote}`).join(", ");
     const conditions = ["created_at <= ?"];
-    const params = [this.toDateParam(options.cutoff)];
+    const params = [
+      this.toDateParam(options.cutoff)
+    ];
     if (options.from) {
       conditions.push("created_at >= ?");
       params.push(this.toDateParam(options.from));
@@ -1209,7 +1647,9 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       if (!result.success) {
         return err(
           HaiAuditError.QUERY_FAILED,
-          auditM("audit_queryFailed", { params: { error: result.error.message } }),
+          auditM("audit_queryFailed", {
+            params: { error: result.error.message }
+          }),
           result.error
         );
       }
@@ -1217,7 +1657,11 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
     } catch (error) {
       return err(
         HaiAuditError.QUERY_FAILED,
-        auditM("audit_queryFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+        auditM("audit_queryFailed", {
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }),
         error
       );
     }
@@ -1242,13 +1686,17 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
     try {
       const result = await this.sql().execute(
         `DELETE FROM ${AUDIT_TABLE} WHERE created_at < ?`,
-        [this.toDateParam(cutoff)]
+        [
+          this.toDateParam(cutoff)
+        ]
       );
       if (!result.success) {
         logger4.error("Failed to cleanup audit logs", { error: result.error.message });
         return err(
           HaiAuditError.CLEANUP_FAILED,
-          auditM("audit_cleanupFailed", { params: { error: result.error.message } }),
+          auditM("audit_cleanupFailed", {
+            params: { error: result.error.message }
+          }),
           result.error
         );
       }
@@ -1262,7 +1710,11 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       logger4.error("Failed to cleanup audit logs", { error });
       return err(
         HaiAuditError.CLEANUP_FAILED,
-        auditM("audit_cleanupFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+        auditM("audit_cleanupFailed", {
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }),
         error
       );
     }
@@ -1294,11 +1746,16 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
         logger4.error("Failed to query audit statistics", { error: result.error.message });
         return err(
           HaiAuditError.STATS_FAILED,
-          auditM("audit_statsFailed", { params: { error: result.error.message } }),
+          auditM("audit_statsFailed", {
+            params: { error: result.error.message }
+          }),
           result.error
         );
       }
-      const statistics = result.data.map((item) => ({ action: item.action, count: Number(item.count) }));
+      const statistics = result.data.map((item) => ({
+        action: item.action,
+        count: Number(item.count)
+      }));
       if (statistics.some((item) => !Number.isSafeInteger(item.count) || item.count < 0))
         return err(HaiAuditError.STATS_FAILED, auditM("audit_invalidStatCount"));
       return ok(statistics);
@@ -1306,7 +1763,11 @@ var AuditLogRepository = class extends BaseReldbCrudRepository {
       logger4.error("Failed to query audit statistics", { error });
       return err(
         HaiAuditError.STATS_FAILED,
-        auditM("audit_statsFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+        auditM("audit_statsFailed", {
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }),
         error
       );
     }
@@ -1384,7 +1845,9 @@ var audit = {
         logger5.error("Audit config validation failed", { error: parseResult.error.message });
         return err(
           HaiAuditError.CONFIG_ERROR,
-          auditM("audit_configError", { params: { error: parseResult.error.message } }),
+          auditM("audit_configError", {
+            params: { error: parseResult.error.message }
+          }),
           parseResult.error
         );
       }
@@ -1400,7 +1863,9 @@ var audit = {
         logger5.error("Audit config contains invalid identifiers", { error: identifierResult.error.message });
         return err(
           HaiAuditError.CONFIG_ERROR,
-          auditM("audit_configError", { params: { error: identifierResult.error.message } }),
+          auditM("audit_configError", {
+            params: { error: identifierResult.error.message }
+          }),
           identifierResult.error
         );
       }
@@ -1414,7 +1879,9 @@ var audit = {
       });
       const ready = await candidate.ready();
       if (!ready.success) {
-        return err(HaiAuditError.CONFIG_ERROR, auditM("audit_initFailed", { params: { error: ready.error.message } }), ready.error);
+        return err(HaiAuditError.CONFIG_ERROR, auditM("audit_initFailed", {
+          params: { error: ready.error.message }
+        }), ready.error);
       }
       const protection = await migrateAudit();
       if (!protection.success)
@@ -1428,7 +1895,12 @@ var audit = {
       currentWriter = createAuditWriter(candidate, parsed);
       capturePolicy = parsed.capture;
       currentHelper = createHelper((input) => audit.log(input));
-      currentBackup = createAuditBackup({ repository: candidate, config: parsed.backup, storage: config?.storage, capture: (input, options) => audit.capture(input, options) });
+      currentBackup = createAuditBackup({
+        repository: candidate,
+        config: parsed.backup,
+        storage: config?.storage,
+        capture: (input, options) => audit.capture(input, options)
+      });
       currentAlerts = createAuditAlerts({ config: parsed.alerts, reach: config?.reach, log: currentWriter });
       logger5.info("Audit module initialized");
       return ok(void 0);
@@ -1436,7 +1908,11 @@ var audit = {
       logger5.error("Audit module initialization failed", { error });
       return err(
         HaiAuditError.CONFIG_ERROR,
-        auditM("audit_initFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+        auditM("audit_initFailed", {
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        }),
         error
       );
     } finally {
@@ -1480,12 +1956,20 @@ var audit = {
     if (!currentRepo) {
       return Promise.resolve(notInitialized.result());
     }
-    if (!validAuditQuery(options))
-      return Promise.resolve(err(HaiAuditError.QUERY_FAILED, auditM("audit_invalidInput", { params: { field: "query", reason: auditM("audit_queryInvalid") } })));
+    if (!validAuditQuery(options)) {
+      return Promise.resolve(err(HaiAuditError.QUERY_FAILED, auditM("audit_invalidInput", {
+        params: {
+          field: "query",
+          reason: auditM("audit_queryInvalid")
+        }
+      })));
+    }
     if (options?.startDate && options?.endDate && options.startDate > options.endDate) {
       return Promise.resolve(err(
         HaiAuditError.QUERY_FAILED,
-        auditM("audit_invalidInput", { params: { field: "dateRange", reason: "startDate must be before endDate" } })
+        auditM("audit_invalidInput", {
+          params: { field: "dateRange", reason: "startDate must be before endDate" }
+        })
       ));
     }
     return currentRepo.listWithUser(options);
@@ -1504,13 +1988,17 @@ var audit = {
     if (!isNonEmptyString(userId)) {
       return Promise.resolve(err(
         HaiAuditError.QUERY_FAILED,
-        auditM("audit_invalidInput", { params: { field: "userId", reason: "must be non-empty string" } })
+        auditM("audit_invalidInput", {
+          params: { field: "userId", reason: "must be non-empty string" }
+        })
       ));
     }
     if (typeof limit === "number" && (!Number.isInteger(limit) || limit <= 0)) {
       return Promise.resolve(err(
         HaiAuditError.QUERY_FAILED,
-        auditM("audit_invalidInput", { params: { field: "limit", reason: "must be a positive integer" } })
+        auditM("audit_invalidInput", {
+          params: { field: "limit", reason: "must be a positive integer" }
+        })
       ));
     }
     return currentRepo.getUserRecent(userId, limit);
@@ -1528,7 +2016,9 @@ var audit = {
     if (typeof olderThanDays === "number" && (!Number.isInteger(olderThanDays) || olderThanDays < 0)) {
       return Promise.resolve(err(
         HaiAuditError.CLEANUP_FAILED,
-        auditM("audit_invalidInput", { params: { field: "olderThanDays", reason: "must be a non-negative integer" } })
+        auditM("audit_invalidInput", {
+          params: { field: "olderThanDays", reason: "must be a non-negative integer" }
+        })
       ));
     }
     return currentRepo.cleanupOld(olderThanDays);
@@ -1543,12 +2033,20 @@ var audit = {
     if (!currentRepo) {
       return Promise.resolve(notInitialized.result());
     }
-    if (!validAuditQuery(filters))
-      return Promise.resolve(err(HaiAuditError.STATS_FAILED, auditM("audit_invalidInput", { params: { field: "query", reason: auditM("audit_queryInvalid") } })));
+    if (!validAuditQuery(filters)) {
+      return Promise.resolve(err(HaiAuditError.STATS_FAILED, auditM("audit_invalidInput", {
+        params: {
+          field: "query",
+          reason: auditM("audit_queryInvalid")
+        }
+      })));
+    }
     if (typeof days === "number" && (!Number.isInteger(days) || days < 0)) {
       return Promise.resolve(err(
         HaiAuditError.STATS_FAILED,
-        auditM("audit_invalidInput", { params: { field: "days", reason: "must be a non-negative integer" } })
+        auditM("audit_invalidInput", {
+          params: { field: "days", reason: "must be a non-negative integer" }
+        })
       ));
     }
     return currentRepo.getStats(days, filters);
@@ -1576,14 +2074,19 @@ var audit = {
     if (!backup && !alerts)
       return null;
     return {
-      tasks: [...backup?.tasks ?? [], ...alerts?.tasks ?? []].map((task) => ({ ...task })),
-      hooks: { onTaskExecute: async (input) => {
-        if (input.context.taskId === "hai-audit-backup" && backup)
-          return backup.hooks.onTaskExecute(input);
-        if (input.context.taskId === "hai-audit-alerts" && alerts)
-          return alerts.hooks.onTaskExecute(input);
-        throw core.error.buildHaiErrorInst(HaiAuditError.CONFIG_ERROR, auditM("audit_unknownTask"));
-      } }
+      tasks: [
+        ...backup?.tasks ?? [],
+        ...alerts?.tasks ?? []
+      ].map((task) => ({ ...task })),
+      hooks: {
+        onTaskExecute: async (input) => {
+          if (input.context.taskId === "hai-audit-backup" && backup)
+            return backup.hooks.onTaskExecute(input);
+          if (input.context.taskId === "hai-audit-alerts" && alerts)
+            return alerts.hooks.onTaskExecute(input);
+          throw core.error.buildHaiErrorInst(HaiAuditError.CONFIG_ERROR, auditM("audit_unknownTask"));
+        }
+      }
     };
   },
   /**