@revealui/security 0.2.3 → 0.2.5

package/README.md

@@ -0,0 +1,96 @@
+# @revealui/security
+
+Security infrastructure for RevealUI. Provides HTTP security headers, CORS management, RBAC/ABAC authorization, field-level encryption, audit logging, and GDPR compliance tooling.
+
+## When to Use This
+
+- You need security headers (CSP, HSTS, CORS) on HTTP responses
+- You're implementing role-based or attribute-based access control
+- You need audit logging for compliance (SOC2, HIPAA)
+- You need GDPR tooling: consent management, data export, breach reporting, anonymization
+- You need field-level encryption or key rotation
+
+If you only need session auth (login/logout/password reset), use `@revealui/auth` instead.
+
+## Installation
+
+```bash
+pnpm add @revealui/security
+```
+
+Dependencies: `@revealui/contracts`, `@revealui/utils`
+
+## API Reference
+
+### Security Headers & CORS
+
+| Export | Type | Purpose |
+|--------|------|---------|
+| `SecurityHeaders` | Class | Generate CSP, HSTS, Permissions-Policy, X-Frame-Options headers |
+| `SecurityPresets` | Object | Pre-built header configs (strict, moderate, development) |
+| `CORSManager` | Class | CORS origin/method/header management |
+| `CORSPresets` | Object | Pre-built CORS configs (restrictive, public API, development) |
+| `createSecurityMiddleware` | Function | Hono middleware applying all security headers |
+| `setRateLimitHeaders` | Function | Add X-RateLimit-* headers to responses |
+
+### Authorization (RBAC + ABAC)
+
+| Export | Type | Purpose |
+|--------|------|---------|
+| `AuthorizationSystem` | Class | Combined RBAC + ABAC policy engine |
+| `CommonRoles` | Object | Pre-defined roles (admin, editor, viewer, superAdmin) |
+| `PolicyBuilder` | Class | Fluent API for building ABAC policies |
+| `PermissionBuilder` | Class | Fluent API for building RBAC permissions |
+| `PermissionCache` | Class | LRU cache for permission lookups |
+| `canAccessResource` | Function | Check if user can perform action on resource |
+| `checkAttributeAccess` | Function | Evaluate ABAC policy conditions |
+| `createAuthorizationMiddleware` | Function | Hono middleware for route-level authorization |
+| `RequirePermission` | Decorator | Enforce permission on class methods |
+| `RequireRole` | Decorator | Enforce role on class methods |
+
+### Encryption
+
+| Export | Type | Purpose |
+|--------|------|---------|
+| `EncryptionSystem` | Class | AES-256 encryption with key management |
+| `EnvelopeEncryption` | Class | Envelope encryption (data key + master key) |
+| `FieldEncryption` | Class | Encrypt/decrypt individual database fields |
+| `KeyRotationManager` | Class | Scheduled key rotation with re-encryption |
+| `DataMasking` | Class | Mask sensitive data for display (email, phone, SSN) |
+| `TokenGenerator` | Class | Secure random token generation |
+
+### Audit Logging
+
+| Export | Type | Purpose |
+|--------|------|---------|
+| `AuditSystem` | Class | Structured audit event recording |
+| `AuditTrail` | Class | Query and filter audit history |
+| `AuditReportGenerator` | Class | Generate compliance reports from audit data |
+| `createAuditMiddleware` | Function | Hono middleware for automatic request auditing |
+| `InMemoryAuditStorage` | Class | In-memory storage for testing |
+
+### GDPR Compliance
+
+| Export | Type | Purpose |
+|--------|------|---------|
+| `ConsentManager` | Class | Record and query user consent |
+| `CookieConsentManager` | Class | Browser cookie consent banner state |
+| `DataDeletionSystem` | Class | Right-to-erasure request processing |
+| `DataExportSystem` | Class | Right-to-portability data export |
+| `DataAnonymization` | Class | Anonymize user data while preserving analytics |
+| `DataBreachManager` | Class | Breach detection, notification, and reporting |
+| `PrivacyPolicyManager` | Class | Version and publish privacy policies |
+| `InMemoryGDPRStorage` | Class | In-memory GDPR storage for testing |
+| `InMemoryBreachStorage` | Class | In-memory breach storage for testing |
+
+## JOSHUA Alignment
+
+- **Hermetic**: Security boundaries are sealed — auth checks happen at middleware, never inside business logic
+- **Sovereign**: All security infrastructure runs in your deployment, no external auth service required
+- **Justifiable**: Every security header and policy has a documented reason (CSP prevents XSS, HSTS forces HTTPS, etc.)
+
+## Related Packages
+
+- `@revealui/auth` — Session-based authentication (login, password reset, OAuth)
+- `@revealui/core` — Applies security middleware to CMS routes
+- `@revealui/contracts` — Shared types for roles, permissions, consent records

package/dist/audit-UF7PIYBU.js

@@ -0,0 +1,21 @@
+import {
+  AuditReportGenerator,
+  AuditSystem,
+  AuditTrail,
+  InMemoryAuditStorage,
+  audit,
+  createAuditMiddleware,
+  signAuditEntry,
+  verifyAuditEntry
+} from "./chunk-Q5KAPSST.js";
+export {
+  AuditReportGenerator,
+  AuditSystem,
+  AuditTrail,
+  InMemoryAuditStorage,
+  audit,
+  createAuditMiddleware,
+  signAuditEntry,
+  verifyAuditEntry
+};
+//# sourceMappingURL=audit-UF7PIYBU.js.map

package/dist/audit-UF7PIYBU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-Q5KAPSST.js

@@ -0,0 +1,429 @@
+// src/audit.ts
+var AuditSystem = class {
+  storage;
+  filters = [];
+  constructor(storage) {
+    this.storage = storage;
+  }
+  /**
+   * Replace the backing storage (e.g. swap InMemory for Postgres at startup).
+   * Events already written to the old storage are NOT migrated.
+   */
+  setStorage(storage) {
+    this.storage = storage;
+  }
+  /**
+   * Log audit event
+   */
+  async log(event) {
+    const fullEvent = {
+      ...event,
+      id: crypto.randomUUID(),
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const shouldLog = this.filters.every((filter) => filter(fullEvent));
+    if (!shouldLog) {
+      return;
+    }
+    await this.storage.write(fullEvent);
+  }
+  /**
+   * Log authentication event
+   */
+  async logAuth(type, actorId, result, metadata) {
+    await this.log({
+      type,
+      severity: result === "failure" ? "medium" : "low",
+      actor: {
+        id: actorId,
+        type: "user"
+      },
+      action: type.replace("auth.", ""),
+      result,
+      metadata
+    });
+  }
+  /**
+   * Log data access event
+   */
+  async logDataAccess(action, actorId, resourceType, resourceId, result, changes) {
+    await this.log({
+      type: `data.${action}`,
+      severity: action === "delete" ? "high" : "medium",
+      actor: {
+        id: actorId,
+        type: "user"
+      },
+      resource: {
+        type: resourceType,
+        id: resourceId
+      },
+      action,
+      result,
+      changes
+    });
+  }
+  /**
+   * Log permission change
+   */
+  async logPermissionChange(action, actorId, targetUserId, permission, result) {
+    await this.log({
+      type: `permission.${action}`,
+      severity: "high",
+      actor: {
+        id: actorId,
+        type: "user"
+      },
+      resource: {
+        type: "user",
+        id: targetUserId
+      },
+      action,
+      result,
+      metadata: {
+        permission
+      }
+    });
+  }
+  /**
+   * Log security event
+   */
+  async logSecurityEvent(type, severity, actorId, message, metadata) {
+    await this.log({
+      type: `security.${type}`,
+      severity,
+      actor: {
+        id: actorId,
+        type: "user"
+      },
+      action: type,
+      result: "failure",
+      message,
+      metadata
+    });
+  }
+  /**
+   * Log GDPR event
+   */
+  async logGDPREvent(type, actorId, result, metadata) {
+    await this.log({
+      type: `gdpr.${type}`,
+      severity: "high",
+      actor: {
+        id: actorId,
+        type: "user"
+      },
+      action: type,
+      result,
+      metadata
+    });
+  }
+  /**
+   * Query audit logs
+   */
+  async query(query) {
+    return this.storage.query(query);
+  }
+  /**
+   * Count audit logs
+   */
+  async count(query) {
+    return this.storage.count(query);
+  }
+  /**
+   * Add filter
+   */
+  addFilter(filter) {
+    this.filters.push(filter);
+  }
+  /**
+   * Remove filter
+   */
+  removeFilter(filter) {
+    const index = this.filters.indexOf(filter);
+    if (index > -1) {
+      this.filters.splice(index, 1);
+    }
+  }
+};
+var InMemoryAuditStorage = class {
+  events = [];
+  maxEvents;
+  constructor(maxEvents = 1e4) {
+    this.maxEvents = maxEvents;
+  }
+  async write(event) {
+    this.events.push(event);
+    if (this.events.length > this.maxEvents) {
+      this.events.shift();
+    }
+  }
+  async query(query) {
+    let results = [...this.events];
+    if (query.types && query.types.length > 0) {
+      results = results.filter((e) => query.types?.includes(e.type));
+    }
+    if (query.actorId) {
+      results = results.filter((e) => e.actor.id === query.actorId);
+    }
+    if (query.resourceType) {
+      results = results.filter((e) => e.resource?.type === query.resourceType);
+    }
+    if (query.resourceId) {
+      results = results.filter((e) => e.resource?.id === query.resourceId);
+    }
+    if (query.startDate) {
+      const startDate = query.startDate;
+      results = results.filter((e) => new Date(e.timestamp) >= startDate);
+    }
+    if (query.endDate) {
+      const endDate = query.endDate;
+      results = results.filter((e) => new Date(e.timestamp) <= endDate);
+    }
+    if (query.severity && query.severity.length > 0) {
+      results = results.filter((e) => query.severity?.includes(e.severity));
+    }
+    if (query.result && query.result.length > 0) {
+      results = results.filter((e) => query.result?.includes(e.result));
+    }
+    results.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
+    const offset = query.offset || 0;
+    const limit = query.limit || 100;
+    return results.slice(offset, offset + limit);
+  }
+  async count(query) {
+    const results = await this.query({ ...query, limit: void 0, offset: void 0 });
+    return results.length;
+  }
+  /**
+   * Clear all events
+   */
+  clear() {
+    this.events = [];
+  }
+  /**
+   * Get all events
+   */
+  getAll() {
+    return [...this.events];
+  }
+};
+function AuditTrail(type, action, options) {
+  return (_target, _propertyKey, descriptor) => {
+    const originalMethod = descriptor.value;
+    descriptor.value = async function(...args) {
+      const actorId = this.user?.id || "system";
+      const before = options?.captureChanges ? args[0] : void 0;
+      let result = "success";
+      let error;
+      try {
+        const returnValue = await originalMethod.apply(this, args);
+        if (this.audit) {
+          await this.audit.log({
+            type,
+            severity: options?.severity || "medium",
+            actor: {
+              id: actorId,
+              type: "user"
+            },
+            resource: options?.resourceType ? {
+              type: options.resourceType,
+              id: args[0]?.id || "unknown"
+            } : void 0,
+            action,
+            result,
+            changes: options?.captureChanges ? {
+              before,
+              after: returnValue
+            } : void 0
+          });
+        }
+        return returnValue;
+      } catch (err) {
+        result = "failure";
+        error = err;
+        if (this.audit) {
+          await this.audit.log({
+            type,
+            severity: "high",
+            actor: {
+              id: actorId,
+              type: "user"
+            },
+            resource: options?.resourceType ? {
+              type: options.resourceType,
+              id: args[0]?.id || "unknown"
+            } : void 0,
+            action,
+            result,
+            message: error.message
+          });
+        }
+        throw error;
+      }
+    };
+    return descriptor;
+  };
+}
+function createAuditMiddleware(audit2, getUser) {
+  return async (request, next) => {
+    const user = getUser(request);
+    const startTime = Date.now();
+    try {
+      const response = await next();
+      await audit2.log({
+        type: "data.read",
+        severity: "low",
+        actor: {
+          id: user.id,
+          type: "user",
+          ip: user.ip,
+          userAgent: user.userAgent
+        },
+        action: request.method,
+        result: "success",
+        metadata: {
+          path: request.url,
+          duration: Date.now() - startTime,
+          status: response.status
+        }
+      });
+      return response;
+    } catch (error) {
+      await audit2.log({
+        type: "data.read",
+        severity: "medium",
+        actor: {
+          id: user.id,
+          type: "user",
+          ip: user.ip,
+          userAgent: user.userAgent
+        },
+        action: request.method,
+        result: "failure",
+        message: error instanceof Error ? error.message : "Unknown error",
+        metadata: {
+          path: request.url,
+          duration: Date.now() - startTime
+        }
+      });
+      throw error;
+    }
+  };
+}
+var AuditReportGenerator = class {
+  constructor(audit2) {
+    this.audit = audit2;
+  }
+  /**
+   * Generate security report
+   */
+  async generateSecurityReport(startDate, endDate) {
+    const allEvents = await this.audit.query({
+      startDate,
+      endDate
+    });
+    const securityViolations = allEvents.filter((e) => e.type.startsWith("security.")).length;
+    const failedLogins = allEvents.filter((e) => e.type === "auth.failed_login").length;
+    const permissionChanges = allEvents.filter((e) => e.type.startsWith("permission.")).length;
+    const dataExports = allEvents.filter((e) => e.type === "data.export").length;
+    const criticalEvents = allEvents.filter((e) => e.severity === "critical");
+    return {
+      totalEvents: allEvents.length,
+      securityViolations,
+      failedLogins,
+      permissionChanges,
+      dataExports,
+      criticalEvents
+    };
+  }
+  /**
+   * Generate user activity report
+   */
+  async generateUserActivityReport(userId, startDate, endDate) {
+    const events = await this.audit.query({
+      actorId: userId,
+      startDate,
+      endDate
+    });
+    const actionsByType = events.reduce(
+      (acc, event) => {
+        acc[event.type] = (acc[event.type] || 0) + 1;
+        return acc;
+      },
+      {}
+    );
+    const failedActions = events.filter((e) => e.result === "failure").length;
+    return {
+      totalActions: events.length,
+      actionsByType,
+      failedActions,
+      recentActions: events.slice(0, 10)
+    };
+  }
+  /**
+   * Generate compliance report
+   */
+  async generateComplianceReport(startDate, endDate) {
+    const events = await this.audit.query({
+      startDate,
+      endDate
+    });
+    const dataAccesses = events.filter((e) => e.type === "data.read").length;
+    const dataModifications = events.filter(
+      (e) => e.type === "data.update" || e.type === "data.create"
+    ).length;
+    const dataDeletions = events.filter((e) => e.type === "data.delete").length;
+    const gdprRequests = events.filter((e) => e.type.startsWith("gdpr.")).length;
+    const auditTrailComplete = this.checkAuditTrailContinuity(events);
+    return {
+      dataAccesses,
+      dataModifications,
+      dataDeletions,
+      gdprRequests,
+      auditTrailComplete
+    };
+  }
+  /**
+   * Check audit trail continuity
+   */
+  checkAuditTrailContinuity(events) {
+    if (events.length === 0) return true;
+    const sorted = events.sort(
+      (a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+    );
+    return sorted.length > 0;
+  }
+};
+async function signAuditEntry(entry, secret) {
+  const { createHmac } = await import("crypto");
+  const canonical = JSON.stringify({
+    timestamp: entry.timestamp,
+    eventType: entry.eventType,
+    severity: entry.severity,
+    agentId: entry.agentId,
+    payload: entry.payload
+  });
+  return createHmac("sha256", secret).update(canonical).digest("hex");
+}
+async function verifyAuditEntry(entry, signature, secret) {
+  const { timingSafeEqual } = await import("crypto");
+  const expected = await signAuditEntry(entry, secret);
+  if (expected.length !== signature.length) {
+    return false;
+  }
+  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+}
+var audit = new AuditSystem(new InMemoryAuditStorage());
+
+export {
+  AuditSystem,
+  InMemoryAuditStorage,
+  AuditTrail,
+  createAuditMiddleware,
+  AuditReportGenerator,
+  signAuditEntry,
+  verifyAuditEntry,
+  audit
+};
+//# sourceMappingURL=chunk-Q5KAPSST.js.map

package/dist/chunk-Q5KAPSST.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audit.ts"],"sourcesContent":["/**\n * Audit Logging System\n *\n * Track security-relevant events and user actions for compliance\n */\n\nexport type AuditEventType =\n  | 'auth.login'\n  | 'auth.logout'\n  | 'auth.failed_login'\n  | 'auth.password_change'\n  | 'auth.password_reset'\n  | 'auth.mfa_enabled'\n  | 'auth.mfa_disabled'\n  | 'user.create'\n  | 'user.update'\n  | 'user.delete'\n  | 'user.view'\n  | 'data.create'\n  | 'data.read'\n  | 'data.update'\n  | 'data.delete'\n  | 'data.export'\n  | 'permission.grant'\n  | 'permission.revoke'\n  | 'role.assign'\n  | 'role.remove'\n  | 'config.change'\n  | 'security.violation'\n  | 'security.alert'\n  | 'gdpr.consent'\n  | 'gdpr.data_request'\n  | 'gdpr.data_deletion'\n  | `data.${string}`\n  | `permission.${string}`\n  | `security.${string}`\n  | `gdpr.${string}`;\n\nexport type AuditSeverity = 'low' | 'medium' | 'high' | 'critical';\n\nexport interface AuditEvent {\n  id: string;\n  timestamp: string;\n  type: AuditEventType;\n  severity: AuditSeverity;\n  actor: {\n    id: string;\n    type: 'user' | 'system' | 'api';\n    ip?: string;\n    userAgent?: string;\n  };\n  resource?: {\n    type: string;\n    id: string;\n    name?: string;\n  };\n  action: string;\n  result: 'success' | 'failure' | 'partial';\n  changes?: {\n    before?: Record<string, unknown>;\n    after?: Record<string, unknown>;\n  };\n  metadata?: Record<string, unknown>;\n  message?: string;\n}\n\nexport interface AuditQuery {\n  types?: AuditEventType[];\n  actorId?: string;\n  resourceType?: string;\n  resourceId?: string;\n  startDate?: Date;\n  endDate?: Date;\n  severity?: AuditSeverity[];\n  result?: ('success' | 'failure' | 'partial')[];\n  limit?: number;\n  offset?: number;\n}\n\nexport interface AuditStorage {\n  write(event: AuditEvent): Promise<void>;\n  query(query: AuditQuery): Promise<AuditEvent[]>;\n  count(query: AuditQuery): Promise<number>;\n}\n\n/**\n * Audit logging system\n */\nexport class AuditSystem {\n  private storage: AuditStorage;\n  private filters: Array<(event: AuditEvent) => boolean> = [];\n\n  constructor(storage: AuditStorage) {\n    this.storage = storage;\n  }\n\n  /**\n   * Replace the backing storage (e.g. swap InMemory for Postgres at startup).\n   * Events already written to the old storage are NOT migrated.\n   */\n  setStorage(storage: AuditStorage): void {\n    this.storage = storage;\n  }\n\n  /**\n   * Log audit event\n   */\n  async log(event: Omit<AuditEvent, 'id' | 'timestamp'>): Promise<void> {\n    const fullEvent: AuditEvent = {\n      ...event,\n      id: crypto.randomUUID(),\n      timestamp: new Date().toISOString(),\n    };\n\n    // Apply filters\n    const shouldLog = this.filters.every((filter) => filter(fullEvent));\n\n    if (!shouldLog) {\n      return;\n    }\n\n    await this.storage.write(fullEvent);\n  }\n\n  /**\n   * Log authentication event\n   */\n  async logAuth(\n    type: Extract<\n      AuditEventType,\n      'auth.login' | 'auth.logout' | 'auth.failed_login' | 'auth.password_change'\n    >,\n    actorId: string,\n    result: 'success' | 'failure',\n    metadata?: Record<string, unknown>,\n  ): Promise<void> {\n    await this.log({\n      type,\n      severity: result === 'failure' ? 'medium' : 'low',\n      actor: {\n        id: actorId,\n        type: 'user',\n      },\n      action: (type as string).replace('auth.', ''),\n      result,\n      metadata,\n    });\n  }\n\n  /**\n   * Log data access event\n   */\n  async logDataAccess(\n    action: 'create' | 'read' | 'update' | 'delete',\n    actorId: string,\n    resourceType: string,\n    resourceId: string,\n    result: 'success' | 'failure',\n    changes?: { before?: Record<string, unknown>; after?: Record<string, unknown> },\n  ): Promise<void> {\n    await this.log({\n      type: `data.${action}` as AuditEventType,\n      severity: action === 'delete' ? 'high' : 'medium',\n      actor: {\n        id: actorId,\n        type: 'user',\n      },\n      resource: {\n        type: resourceType,\n        id: resourceId,\n      },\n      action,\n      result,\n      changes,\n    });\n  }\n\n  /**\n   * Log permission change\n   */\n  async logPermissionChange(\n    action: 'grant' | 'revoke',\n    actorId: string,\n    targetUserId: string,\n    permission: string,\n    result: 'success' | 'failure',\n  ): Promise<void> {\n    await this.log({\n      type: `permission.${action}` as AuditEventType,\n      severity: 'high',\n      actor: {\n        id: actorId,\n        type: 'user',\n      },\n      resource: {\n        type: 'user',\n        id: targetUserId,\n      },\n      action,\n      result,\n      metadata: {\n        permission,\n      },\n    });\n  }\n\n  /**\n   * Log security event\n   */\n  async logSecurityEvent(\n    type: 'violation' | 'alert',\n    severity: AuditSeverity,\n    actorId: string,\n    message: string,\n    metadata?: Record<string, unknown>,\n  ): Promise<void> {\n    await this.log({\n      type: `security.${type}` as AuditEventType,\n      severity,\n      actor: {\n        id: actorId,\n        type: 'user',\n      },\n      action: type,\n      result: 'failure',\n      message,\n      metadata,\n    });\n  }\n\n  /**\n   * Log GDPR event\n   */\n  async logGDPREvent(\n    type: 'consent' | 'data_request' | 'data_deletion',\n    actorId: string,\n    result: 'success' | 'failure',\n    metadata?: Record<string, unknown>,\n  ): Promise<void> {\n    await this.log({\n      type: `gdpr.${type}` as AuditEventType,\n      severity: 'high',\n      actor: {\n        id: actorId,\n        type: 'user',\n      },\n      action: type,\n      result,\n      metadata,\n    });\n  }\n\n  /**\n   * Query audit logs\n   */\n  async query(query: AuditQuery): Promise<AuditEvent[]> {\n    return this.storage.query(query);\n  }\n\n  /**\n   * Count audit logs\n   */\n  async count(query: AuditQuery): Promise<number> {\n    return this.storage.count(query);\n  }\n\n  /**\n   * Add filter\n   */\n  addFilter(filter: (event: AuditEvent) => boolean): void {\n    this.filters.push(filter);\n  }\n\n  /**\n   * Remove filter\n   */\n  removeFilter(filter: (event: AuditEvent) => boolean): void {\n    const index = this.filters.indexOf(filter);\n    if (index > -1) {\n      this.filters.splice(index, 1);\n    }\n  }\n}\n\n/**\n * In-memory audit storage (for development)\n */\nexport class InMemoryAuditStorage implements AuditStorage {\n  private events: AuditEvent[] = [];\n  private maxEvents: number;\n\n  constructor(maxEvents: number = 10000) {\n    this.maxEvents = maxEvents;\n  }\n\n  async write(event: AuditEvent): Promise<void> {\n    this.events.push(event);\n\n    // Trim old events\n    if (this.events.length > this.maxEvents) {\n      this.events.shift();\n    }\n  }\n\n  async query(query: AuditQuery): Promise<AuditEvent[]> {\n    let results = [...this.events];\n\n    // Filter by type\n    if (query.types && query.types.length > 0) {\n      results = results.filter((e) => query.types?.includes(e.type));\n    }\n\n    // Filter by actor\n    if (query.actorId) {\n      results = results.filter((e) => e.actor.id === query.actorId);\n    }\n\n    // Filter by resource\n    if (query.resourceType) {\n      results = results.filter((e) => e.resource?.type === query.resourceType);\n    }\n\n    if (query.resourceId) {\n      results = results.filter((e) => e.resource?.id === query.resourceId);\n    }\n\n    // Filter by date range\n    if (query.startDate) {\n      const startDate = query.startDate;\n      results = results.filter((e) => new Date(e.timestamp) >= startDate);\n    }\n\n    if (query.endDate) {\n      const endDate = query.endDate;\n      results = results.filter((e) => new Date(e.timestamp) <= endDate);\n    }\n\n    // Filter by severity\n    if (query.severity && query.severity.length > 0) {\n      results = results.filter((e) => query.severity?.includes(e.severity));\n    }\n\n    // Filter by result\n    if (query.result && query.result.length > 0) {\n      results = results.filter((e) => query.result?.includes(e.result));\n    }\n\n    // Sort by timestamp (newest first)\n    results.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());\n\n    // Apply pagination\n    const offset = query.offset || 0;\n    const limit = query.limit || 100;\n\n    return results.slice(offset, offset + limit);\n  }\n\n  async count(query: AuditQuery): Promise<number> {\n    const results = await this.query({ ...query, limit: undefined, offset: undefined });\n    return results.length;\n  }\n\n  /**\n   * Clear all events\n   */\n  clear(): void {\n    this.events = [];\n  }\n\n  /**\n   * Get all events\n   */\n  getAll(): AuditEvent[] {\n    return [...this.events];\n  }\n}\n\n/**\n * Audit trail decorator\n */\nexport function AuditTrail(\n  type: AuditEventType,\n  action: string,\n  options?: {\n    severity?: AuditSeverity;\n    captureChanges?: boolean;\n    resourceType?: string;\n  },\n) {\n  return (_target: object, _propertyKey: string, descriptor: PropertyDescriptor) => {\n    const originalMethod = descriptor.value;\n\n    descriptor.value = async function (\n      this: { user?: { id?: string }; audit?: AuditSystem },\n      ...args: unknown[]\n    ) {\n      const actorId = this.user?.id || 'system';\n      const before = options?.captureChanges ? args[0] : undefined;\n\n      let result: 'success' | 'failure' | 'partial' = 'success';\n      let error: Error | undefined;\n\n      try {\n        const returnValue = await originalMethod.apply(this, args);\n\n        // Log audit event\n        if (this.audit) {\n          await this.audit.log({\n            type,\n            severity: options?.severity || 'medium',\n            actor: {\n              id: actorId,\n              type: 'user',\n            },\n            resource: options?.resourceType\n              ? {\n                  type: options.resourceType,\n                  id: (args[0] as { id?: string })?.id || 'unknown',\n                }\n              : undefined,\n            action,\n            result,\n            changes: options?.captureChanges\n              ? {\n                  before: before as Record<string, unknown> | undefined,\n                  after: returnValue as Record<string, unknown> | undefined,\n                }\n              : undefined,\n          });\n        }\n\n        return returnValue;\n      } catch (err) {\n        result = 'failure';\n        error = err as Error;\n\n        // Log failure\n        if (this.audit) {\n          await this.audit.log({\n            type,\n            severity: 'high',\n            actor: {\n              id: actorId,\n              type: 'user',\n            },\n            resource: options?.resourceType\n              ? {\n                  type: options.resourceType,\n                  id: (args[0] as { id?: string })?.id || 'unknown',\n                }\n              : undefined,\n            action,\n            result,\n            message: error.message,\n          });\n        }\n\n        throw error;\n      }\n    };\n\n    return descriptor;\n  };\n}\n\n/**\n * Audit middleware\n */\nexport function createAuditMiddleware<TRequest = unknown, TResponse = unknown>(\n  audit: AuditSystem,\n  getUser: (request: TRequest) => { id: string; ip?: string; userAgent?: string },\n) {\n  return async (\n    request: TRequest & { method: string; url: string },\n    next: () => Promise<TResponse & { status?: number }>,\n  ) => {\n    const user = getUser(request);\n    const startTime = Date.now();\n\n    try {\n      const response = await next();\n\n      // Log successful request\n      await audit.log({\n        type: 'data.read',\n        severity: 'low',\n        actor: {\n          id: user.id,\n          type: 'user',\n          ip: user.ip,\n          userAgent: user.userAgent,\n        },\n        action: request.method,\n        result: 'success',\n        metadata: {\n          path: request.url,\n          duration: Date.now() - startTime,\n          status: response.status,\n        },\n      });\n\n      return response;\n    } catch (error) {\n      // Log failed request\n      await audit.log({\n        type: 'data.read',\n        severity: 'medium',\n        actor: {\n          id: user.id,\n          type: 'user',\n          ip: user.ip,\n          userAgent: user.userAgent,\n        },\n        action: request.method,\n        result: 'failure',\n        message: error instanceof Error ? error.message : 'Unknown error',\n        metadata: {\n          path: request.url,\n          duration: Date.now() - startTime,\n        },\n      });\n\n      throw error;\n    }\n  };\n}\n\n/**\n * Audit report generator\n */\nexport class AuditReportGenerator {\n  constructor(private audit: AuditSystem) {}\n\n  /**\n   * Generate security report\n   */\n  async generateSecurityReport(\n    startDate: Date,\n    endDate: Date,\n  ): Promise<{\n    totalEvents: number;\n    securityViolations: number;\n    failedLogins: number;\n    permissionChanges: number;\n    dataExports: number;\n    criticalEvents: AuditEvent[];\n  }> {\n    const allEvents = await this.audit.query({\n      startDate,\n      endDate,\n    });\n\n    const securityViolations = allEvents.filter((e) => e.type.startsWith('security.')).length;\n\n    const failedLogins = allEvents.filter((e) => e.type === 'auth.failed_login').length;\n\n    const permissionChanges = allEvents.filter((e) => e.type.startsWith('permission.')).length;\n\n    const dataExports = allEvents.filter((e) => e.type === 'data.export').length;\n\n    const criticalEvents = allEvents.filter((e) => e.severity === 'critical');\n\n    return {\n      totalEvents: allEvents.length,\n      securityViolations,\n      failedLogins,\n      permissionChanges,\n      dataExports,\n      criticalEvents,\n    };\n  }\n\n  /**\n   * Generate user activity report\n   */\n  async generateUserActivityReport(\n    userId: string,\n    startDate: Date,\n    endDate: Date,\n  ): Promise<{\n    totalActions: number;\n    actionsByType: Record<string, number>;\n    failedActions: number;\n    recentActions: AuditEvent[];\n  }> {\n    const events = await this.audit.query({\n      actorId: userId,\n      startDate,\n      endDate,\n    });\n\n    const actionsByType = events.reduce(\n      (acc, event) => {\n        acc[event.type] = (acc[event.type] || 0) + 1;\n        return acc;\n      },\n      {} as Record<string, number>,\n    );\n\n    const failedActions = events.filter((e) => e.result === 'failure').length;\n\n    return {\n      totalActions: events.length,\n      actionsByType,\n      failedActions,\n      recentActions: events.slice(0, 10),\n    };\n  }\n\n  /**\n   * Generate compliance report\n   */\n  async generateComplianceReport(\n    startDate: Date,\n    endDate: Date,\n  ): Promise<{\n    dataAccesses: number;\n    dataModifications: number;\n    dataDeletions: number;\n    gdprRequests: number;\n    auditTrailComplete: boolean;\n  }> {\n    const events = await this.audit.query({\n      startDate,\n      endDate,\n    });\n\n    const dataAccesses = events.filter((e) => e.type === 'data.read').length;\n\n    const dataModifications = events.filter(\n      (e) => e.type === 'data.update' || e.type === 'data.create',\n    ).length;\n\n    const dataDeletions = events.filter((e) => e.type === 'data.delete').length;\n\n    const gdprRequests = events.filter((e) => e.type.startsWith('gdpr.')).length;\n\n    // Check if audit trail is complete (no gaps)\n    const auditTrailComplete = this.checkAuditTrailContinuity(events);\n\n    return {\n      dataAccesses,\n      dataModifications,\n      dataDeletions,\n      gdprRequests,\n      auditTrailComplete,\n    };\n  }\n\n  /**\n   * Check audit trail continuity\n   */\n  private checkAuditTrailContinuity(events: AuditEvent[]): boolean {\n    if (events.length === 0) return true;\n\n    // Sort by timestamp\n    const sorted = events.sort(\n      (a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime(),\n    );\n\n    // Check for gaps (simplified - just check if we have events)\n    return sorted.length > 0;\n  }\n}\n\n// =============================================================================\n// Audit Log Integrity — HMAC-SHA256 Signing\n// =============================================================================\n\n/** Fields included in the HMAC signature for tamper detection. */\ninterface SignableFields {\n  timestamp: string;\n  eventType: string;\n  severity: string;\n  agentId: string;\n  payload: unknown;\n}\n\n/**\n * Compute an HMAC-SHA256 signature over the canonical fields of an audit entry.\n *\n * The signature covers `timestamp`, `eventType`, `severity`, `agentId`, and\n * `payload` — the immutable core of every audit record. Changing any of\n * these fields after signing will cause verification to fail.\n *\n * @param entry - The audit entry fields to sign\n * @param secret - The HMAC secret key\n * @returns Hex-encoded HMAC-SHA256 signature\n */\nexport async function signAuditEntry(entry: SignableFields, secret: string): Promise<string> {\n  const { createHmac } = await import('node:crypto');\n  const canonical = JSON.stringify({\n    timestamp: entry.timestamp,\n    eventType: entry.eventType,\n    severity: entry.severity,\n    agentId: entry.agentId,\n    payload: entry.payload,\n  });\n  return createHmac('sha256', secret).update(canonical).digest('hex');\n}\n\n/**\n * Verify an HMAC-SHA256 signature against the canonical fields of an audit entry.\n *\n * Uses timing-safe comparison to prevent timing attacks.\n *\n * @param entry - The audit entry fields to verify\n * @param signature - The hex-encoded HMAC-SHA256 signature to verify\n * @param secret - The HMAC secret key\n * @returns True if the signature is valid\n */\nexport async function verifyAuditEntry(\n  entry: SignableFields,\n  signature: string,\n  secret: string,\n): Promise<boolean> {\n  const { timingSafeEqual } = await import('node:crypto');\n  const expected = await signAuditEntry(entry, secret);\n\n  // Lengths must match for timingSafeEqual\n  if (expected.length !== signature.length) {\n    return false;\n  }\n\n  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));\n}\n\n/**\n * Global audit system\n */\nexport const audit = new AuditSystem(new InMemoryAuditStorage());\n"],"mappings":";AAwFO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA,UAAiD,CAAC;AAAA,EAE1D,YAAY,SAAuB;AACjC,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,SAA6B;AACtC,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,OAA4D;AACpE,UAAM,YAAwB;AAAA,MAC5B,GAAG;AAAA,MACH,IAAI,OAAO,WAAW;AAAA,MACtB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAGA,UAAM,YAAY,KAAK,QAAQ,MAAM,CAAC,WAAW,OAAO,SAAS,CAAC;AAElE,QAAI,CAAC,WAAW;AACd;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,MAAM,SAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QACJ,MAIA,SACA,QACA,UACe;AACf,UAAM,KAAK,IAAI;AAAA,MACb;AAAA,MACA,UAAU,WAAW,YAAY,WAAW;AAAA,MAC5C,OAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,MACA,QAAS,KAAgB,QAAQ,SAAS,EAAE;AAAA,MAC5C;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACJ,QACA,SACA,cACA,YACA,QACA,SACe;AACf,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,QAAQ,MAAM;AAAA,MACpB,UAAU,WAAW,WAAW,SAAS;AAAA,MACzC,OAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,MACA,UAAU;AAAA,QACR,MAAM;AAAA,QACN,IAAI;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,oBACJ,QACA,SACA,cACA,YACA,QACe;AACf,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,cAAc,MAAM;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,MACA,UAAU;AAAA,QACR,MAAM;AAAA,QACN,IAAI;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU;AAAA,QACR;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBACJ,MACA,UACA,SACA,SACA,UACe;AACf,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,YAAY,IAAI;AAAA,MACtB;AAAA,MACA,OAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aACJ,MACA,SACA,QACA,UACe;AACf,UAAM,KAAK,IAAI;AAAA,MACb,MAAM,QAAQ,IAAI;AAAA,MAClB,UAAU;AAAA,MACV,OAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,OAA0C;AACpD,WAAO,KAAK,QAAQ,MAAM,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,OAAoC;AAC9C,WAAO,KAAK,QAAQ,MAAM,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,UAAU,QAA8C;AACtD,SAAK,QAAQ,KAAK,MAAM;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAA8C;AACzD,UAAM,QAAQ,KAAK,QAAQ,QAAQ,MAAM;AACzC,QAAI,QAAQ,IAAI;AACd,WAAK,QAAQ,OAAO,OAAO,CAAC;AAAA,IAC9B;AAAA,EACF;AACF;AAKO,IAAM,uBAAN,MAAmD;AAAA,EAChD,SAAuB,CAAC;AAAA,EACxB;AAAA,EAER,YAAY,YAAoB,KAAO;AACrC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAM,MAAM,OAAkC;AAC5C,SAAK,OAAO,KAAK,KAAK;AAGtB,QAAI,KAAK,OAAO,SAAS,KAAK,WAAW;AACvC,WAAK,OAAO,MAAM;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,OAA0C;AACpD,QAAI,UAAU,CAAC,GAAG,KAAK,MAAM;AAG7B,QAAI,MAAM,SAAS,MAAM,MAAM,SAAS,GAAG;AACzC,gBAAU,QAAQ,OAAO,CAAC,MAAM,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC;AAAA,IAC/D;AAGA,QAAI,MAAM,SAAS;AACjB,gBAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,MAAM,OAAO,MAAM,OAAO;AAAA,IAC9D;AAGA,QAAI,MAAM,cAAc;AACtB,gBAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,SAAS,MAAM,YAAY;AAAA,IACzE;AAEA,QAAI,MAAM,YAAY;AACpB,gBAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO,MAAM,UAAU;AAAA,IACrE;AAGA,QAAI,MAAM,WAAW;AACnB,YAAM,YAAY,MAAM;AACxB,gBAAU,QAAQ,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS;AAAA,IACpE;AAEA,QAAI,MAAM,SAAS;AACjB,YAAM,UAAU,MAAM;AACtB,gBAAU,QAAQ,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,SAAS,KAAK,OAAO;AAAA,IAClE;AAGA,QAAI,MAAM,YAAY,MAAM,SAAS,SAAS,GAAG;AAC/C,gBAAU,QAAQ,OAAO,CAAC,MAAM,MAAM,UAAU,SAAS,EAAE,QAAQ,CAAC;AAAA,IACtE;AAGA,QAAI,MAAM,UAAU,MAAM,OAAO,SAAS,GAAG;AAC3C,gBAAU,QAAQ,OAAO,CAAC,MAAM,MAAM,QAAQ,SAAS,EAAE,MAAM,CAAC;AAAA,IAClE;AAGA,YAAQ,KAAK,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC;AAGxF,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,QAAQ,MAAM,SAAS;AAE7B,WAAO,QAAQ,MAAM,QAAQ,SAAS,KAAK;AAAA,EAC7C;AAAA,EAEA,MAAM,MAAM,OAAoC;AAC9C,UAAM,UAAU,MAAM,KAAK,MAAM,EAAE,GAAG,OAAO,OAAO,QAAW,QAAQ,OAAU,CAAC;AAClF,WAAO,QAAQ;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,SAAK,SAAS,CAAC;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,SAAuB;AACrB,WAAO,CAAC,GAAG,KAAK,MAAM;AAAA,EACxB;AACF;AAKO,SAAS,WACd,MACA,QACA,SAKA;AACA,SAAO,CAAC,SAAiB,cAAsB,eAAmC;AAChF,UAAM,iBAAiB,WAAW;AAElC,eAAW,QAAQ,kBAEd,MACH;AACA,YAAM,UAAU,KAAK,MAAM,MAAM;AACjC,YAAM,SAAS,SAAS,iBAAiB,KAAK,CAAC,IAAI;AAEnD,UAAI,SAA4C;AAChD,UAAI;AAEJ,UAAI;AACF,cAAM,cAAc,MAAM,eAAe,MAAM,MAAM,IAAI;AAGzD,YAAI,KAAK,OAAO;AACd,gBAAM,KAAK,MAAM,IAAI;AAAA,YACnB;AAAA,YACA,UAAU,SAAS,YAAY;AAAA,YAC/B,OAAO;AAAA,cACL,IAAI;AAAA,cACJ,MAAM;AAAA,YACR;AAAA,YACA,UAAU,SAAS,eACf;AAAA,cACE,MAAM,QAAQ;AAAA,cACd,IAAK,KAAK,CAAC,GAAuB,MAAM;AAAA,YAC1C,IACA;AAAA,YACJ;AAAA,YACA;AAAA,YACA,SAAS,SAAS,iBACd;AAAA,cACE;AAAA,cACA,OAAO;AAAA,YACT,IACA;AAAA,UACN,CAAC;AAAA,QACH;AAEA,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,iBAAS;AACT,gBAAQ;AAGR,YAAI,KAAK,OAAO;AACd,gBAAM,KAAK,MAAM,IAAI;AAAA,YACnB;AAAA,YACA,UAAU;AAAA,YACV,OAAO;AAAA,cACL,IAAI;AAAA,cACJ,MAAM;AAAA,YACR;AAAA,YACA,UAAU,SAAS,eACf;AAAA,cACE,MAAM,QAAQ;AAAA,cACd,IAAK,KAAK,CAAC,GAAuB,MAAM;AAAA,YAC1C,IACA;AAAA,YACJ;AAAA,YACA;AAAA,YACA,SAAS,MAAM;AAAA,UACjB,CAAC;AAAA,QACH;AAEA,cAAM;AAAA,MACR;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAKO,SAAS,sBACdA,QACA,SACA;AACA,SAAO,OACL,SACA,SACG;AACH,UAAM,OAAO,QAAQ,OAAO;AAC5B,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI;AACF,YAAM,WAAW,MAAM,KAAK;AAG5B,YAAMA,OAAM,IAAI;AAAA,QACd,MAAM;AAAA,QACN,UAAU;AAAA,QACV,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,MAAM;AAAA,UACN,IAAI,KAAK;AAAA,UACT,WAAW,KAAK;AAAA,QAClB;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,UAAU;AAAA,UACR,MAAM,QAAQ;AAAA,UACd,UAAU,KAAK,IAAI,IAAI;AAAA,UACvB,QAAQ,SAAS;AAAA,QACnB;AAAA,MACF,CAAC;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AAEd,YAAMA,OAAM,IAAI;AAAA,QACd,MAAM;AAAA,QACN,UAAU;AAAA,QACV,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,MAAM;AAAA,UACN,IAAI,KAAK;AAAA,UACT,WAAW,KAAK;AAAA,QAClB;AAAA,QACA,QAAQ,QAAQ;AAAA,QAChB,QAAQ;AAAA,QACR,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,QAClD,UAAU;AAAA,UACR,MAAM,QAAQ;AAAA,UACd,UAAU,KAAK,IAAI,IAAI;AAAA,QACzB;AAAA,MACF,CAAC;AAED,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAKO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAAoBA,QAAoB;AAApB,iBAAAA;AAAA,EAAqB;AAAA;AAAA;AAAA;AAAA,EAKzC,MAAM,uBACJ,WACA,SAQC;AACD,UAAM,YAAY,MAAM,KAAK,MAAM,MAAM;AAAA,MACvC;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,qBAAqB,UAAU,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,WAAW,CAAC,EAAE;AAEnF,UAAM,eAAe,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE;AAE7E,UAAM,oBAAoB,UAAU,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,aAAa,CAAC,EAAE;AAEpF,UAAM,cAAc,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE;AAEtE,UAAM,iBAAiB,UAAU,OAAO,CAAC,MAAM,EAAE,aAAa,UAAU;AAExE,WAAO;AAAA,MACL,aAAa,UAAU;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,2BACJ,QACA,WACA,SAMC;AACD,UAAM,SAAS,MAAM,KAAK,MAAM,MAAM;AAAA,MACpC,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,gBAAgB,OAAO;AAAA,MAC3B,CAAC,KAAK,UAAU;AACd,YAAI,MAAM,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,KAAK;AAC3C,eAAO;AAAA,MACT;AAAA,MACA,CAAC;AAAA,IACH;AAEA,UAAM,gBAAgB,OAAO,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAEnE,WAAO;AAAA,MACL,cAAc,OAAO;AAAA,MACrB;AAAA,MACA;AAAA,MACA,eAAe,OAAO,MAAM,GAAG,EAAE;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,yBACJ,WACA,SAOC;AACD,UAAM,SAAS,MAAM,KAAK,MAAM,MAAM;AAAA,MACpC;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE;AAElE,UAAM,oBAAoB,OAAO;AAAA,MAC/B,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,SAAS;AAAA,IAChD,EAAE;AAEF,UAAM,gBAAgB,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE;AAErE,UAAM,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,OAAO,CAAC,EAAE;AAGtE,UAAM,qBAAqB,KAAK,0BAA0B,MAAM;AAEhE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,0BAA0B,QAA+B;AAC/D,QAAI,OAAO,WAAW,EAAG,QAAO;AAGhC,UAAM,SAAS,OAAO;AAAA,MACpB,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAAA,IAC5E;AAGA,WAAO,OAAO,SAAS;AAAA,EACzB;AACF;AA0BA,eAAsB,eAAe,OAAuB,QAAiC;AAC3F,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,QAAa;AACjD,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,SAAS,MAAM;AAAA,IACf,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AACpE;AAYA,eAAsB,iBACpB,OACA,WACA,QACkB;AAClB,QAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,QAAa;AACtD,QAAM,WAAW,MAAM,eAAe,OAAO,MAAM;AAGnD,MAAI,SAAS,WAAW,UAAU,QAAQ;AACxC,WAAO;AAAA,EACT;AAEA,SAAO,gBAAgB,OAAO,KAAK,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC;AACtE;AAKO,IAAM,QAAQ,IAAI,YAAY,IAAI,qBAAqB,CAAC;","names":["audit"]}