@vibesdotdev/logging 0.0.1 → 1.0.0-rc.4

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,80 +1,115 @@
 # @vibesdotdev/logging
 
-Universal logging core for vibes. Defines the runtime kinds, the core logger,
-isomorphic sinks/formatters, and the audit kind. Environment-specific sinks
-(file, browser, OTEL) live in sibling packages.
+Structured logging for Vibes. Code logs through `getLogger(namespace, runtime)`; the Vibes runtime decides where entries go by resolving the sinks, formatters and outputs registered for the current host. The package also ships a browser sink, an OpenTelemetry log sink, server observability helpers, an audit log, the `vibes logs` CLI commands, and the portable contract (`@vibesdotdev/logging/host`) that a host package implements for file logging.
 
-## Quickstart
+The package root runs anywhere: Bun, Node, workerd and the browser. It never writes to stdout, so it is safe inside MCP stdio servers and CLIs that print machine-readable output.
 
-```ts
-import { getLogger, getDefaultLogger } from '@vibesdotdev/logging';
+## Install
 
-const logger = getLogger('myapp');
-logger.info('Started', { version: '1.0.0' });
-logger.error('Failed', { error: err.message });
+```sh
+bun add @vibesdotdev/logging @vibesdotdev/kernel
+# or
+npm install @vibesdotdev/logging @vibesdotdev/kernel
+```
 
-const child = logger.child('database');
-child.debug('Connected');
+## Log something
 
-const contextual = logger.withRequestContext({
-  requestId: 'req-123',
-  userId: 'user-456',
+```ts
+import { bootstrapVibesRuntime } from '@vibesdotdev/kernel';
+import loggingPlugin from '@vibesdotdev/logging/plugin';
+import loggingConsumerPlugin from '@vibesdotdev/logging/consumer/plugin';
+import { getLogger } from '@vibesdotdev/logging';
+
+// `environment` is your host's environment plugin (on Bun, from @vibesdotdev/host-bun).
+const runtime = await bootstrapVibesRuntime({
+  environment,
+  composition: { kind: 'literal', plugins: [async () => loggingPlugin, async () => loggingConsumerPlugin] }
 });
-contextual.info('Request handled');
+
+const log = getLogger('myapp:db', runtime);
+log.info('connected', { host: 'localhost', port: 5432 });
+
+const request = log.withRequestContext({ requestId: 'req-1' });
+request.warn('slow query', { durationMs: 850 });
+```
+
+Filter output with environment keys read through the runtime:
+
+```sh
+VIBES_LOG_LEVEL=debug VIBES_LOG='myapp:*,-myapp:noisy' bun run app.ts
 ```
 
-### Audit
+## Pick the surfaces your host needs
+
+Register each extra plugin after `@vibesdotdev/logging/plugin`. File sinks, outputs and the file-backed audit log are host code: `@vibesdotdev/host-node/logging`'s `nodeLoggingPlugin` implements `@vibesdotdev/logging/host`. The Bun host (`@vibesdotdev/host-bun`) registers it with its environment (opt out with its `logging: { files: false }` option), and so does the declared Node test host; a production Node composition registers `nodeLoggingPlugin` itself.
+
+| Plugin | Host | Adds |
+| --- | --- | --- |
+| `@vibesdotdev/logging/consumer/plugin` | Terminal consumer | Colorized console sink and pretty formatter |
+| `@vibesdotdev/logging/browser/plugin` | Browser | Styled console sink with localStorage buffering |
+| `@vibesdotdev/logging/otel/plugin` | Server | OTLP/HTTP log export |
+| `@vibesdotdev/logging/cli/plugin` | CLI | `vibes logs list \| view \| tail \| search \| rotate` and `vibes logs audit list \| cleanup` |
+
+The example composes terminal rendering explicitly. Browser and cloud bundles use
+`./plugin` without the consumer slice: JSON formatters, memory/buffer sinks,
+stdout through the runtime's stderr port, remote output and browser console
+remain universal. The optional browser slice adds persistence. Scope filtering
+does not isolate bundles; the consumer imports live in their own plugin.
+
+`@vibesdotdev/logging/plugin` also registers the `logging` `runtime/client`. Resolve it with `getVibesClient('logging', runtime)`, or peek it synchronously with `tryGetVibesClient('logging', runtime)` (both from `@vibesdotdev/kernel/client`). See [SPEC.md](SPEC.md#runtime-client) and [Composition](SPEC.md#composition).
+
+For traces and metrics on a server, call `initializeTelemetry(runtime)` from `@vibesdotdev/logging/observability` after your runtime environment is registered, and report `getTelemetryStatus(runtime)` from a health endpoint.
+
+## Buffer retention
+
+The universal `buffer` sink retains all accepted entries until drained, cleared
+or closed. Set an optional positive integer `capacity` on its registered
+`SinkDescriptor` to bound storage. At capacity it refuses the incoming entry
+before changing retained entries (`CapabilityError`: `UNAVAILABLE`,
+`buffer-capacity-exceeded`, retryable), without including entry contents in the
+failure. The logger delivers refused entries through its fallback and reports
+the failure. Drain or clear to restore capacity; `flush()` keeps entries and
+`close()` or runtime disposal clears them. This buffer is not durable storage.
+
+## Memory retention
+
+The queryable `memory` sink retains all entries by default until clear, close
+or runtime disposal. Its registered `SinkDescriptor.maxEntries` optionally
+sets a nonnegative integer bound: zero disables retention; positive bounds
+deliberately evict oldest entries. `setMaxEntries(number)` changes the bound
+and trims immediately. Invalid setter bounds refuse `INVALID_INPUT`,
+`memory-entry-limit-invalid`. Buffer capacity instead refuses incoming entries.
+Queries return independent array snapshots in emission order, with level,
+namespace, message and date filters; `limit` selects the newest matches and
+accepts zero. Invalid queries refuse `INVALID_INPUT`, `memory-query-invalid`.
+`MemorySinkQueryOptions` remains exported from `./sinks`; its schemas and
+inferred types live in `./schemas/sink` and `./schemas`.
+
+## Audit
 
 ```ts
-import { auditLog } from '@vibesdotdev/logging/audit';
+import { auditLog } from '@vibesdotdev/logging';
 
 await auditLog({
   category: 'authentication',
   severity: 'medium',
   action: 'login',
-  actor: { id: 'user-123', type: 'user' },
+  actor: { id: 'user-1', type: 'user' },
   outcome: 'success',
-});
-```
-
-### Filter via env
-
-```bash
-VIBES_LOG='vibes:pm:*,-vibes:pm:verbose' \
-VIBES_LOG_LEVEL=debug \
-bun run app
-```
-
-## CLI
-
-```bash
-vibes logs list
-vibes logs view <output>
-vibes logs tail <output>
-vibes logs search <pattern>
-vibes logs rotate <output>
+  context: { apiKey: 'redacted before it is written' }
+}, runtime);
 ```
 
-## Sinks
+`auditLog(input, runtime)` (also exported from `@vibesdotdev/logging/audit`) validates the entry, redacts credential-like context keys and writes it to the handed runtime's stderr. To persist entries, resolve a `logging/audit` implementation from the runtime (`runtime.query('logging/audit')`): wherever `nodeLoggingPlugin` is registered (the Bun host, the declared Node test host, or a Node composition that adds it) there is a file-backed one with retention by category.
 
-Core ships isomorphic sinks only:
-- `console` — colorized stderr
-- `buffer` — in-memory startup buffer
-- `memory` — testable in-memory store
-- `stdout` — raw stderr (MCP-safe)
+## Docs
 
-Environment-specific sinks load from sibling packages (apps choose what to load):
-- [`@vibesdotdev/logging-fs`](../logging-fs/) — file sink, file output, stdout-capture, file-backed audit
-- [`@vibesdotdev/logging-browser`](../logging-browser/) — browser sink
-- [`@vibesdotdev/logging-otel`](../logging-otel/) — OpenTelemetry sink
+`vibes docs show logging` covers `logging.levels`, `logging.structured`, `logging.transports`, `logging.cli` and `logging.observability`. [SPEC.md](SPEC.md) is the full contract: what the package owns, its hard rules, every entrypoint and every configuration key.
 
-## Test
+## Development
 
-```bash
-bun test
-```
+`bun run check` typechecks all source TypeScript and TSX, including tests, without emitting. `bun run test` runs the in-process suite. `bun run build` uses `tsconfig.build.json` to emit production JavaScript and declarations with rewritten relative imports; tests, test support and the Svelte surface are excluded from emission. `tsconfig.check.json` remains a compatible alias for the all-source project.
 
-## Docs
+## License
 
-- [SPEC.md](./SPEC.md) — package contract, owned surfaces, hard rules, migration debt
-- [runtime](../runtime/SPEC.md), [runtime-plugin](../runtime-plugin/SPEC.md)
+MIT. See [LICENSE](LICENSE).

package/dist/audit/audit-retention.job.descriptor.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Audit Retention Job Descriptor
+ *
+ * The scheduled enforcement of every file-backed audit logger's retention,
+ * run by Workers (RC11, D19). Declared as data so logging takes no package
+ * edge on `@vibesdotdev/workers` (Workers depends on logging); the runtime
+ * holds it until the `workers/job` kind registers.
+ */
+import * as z from 'zod/v4';
+export declare const AUDIT_RETENTION_JOB_ID = "logging.audit-retention";
+export declare const AuditRetentionJobOutputSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        deleted: z.ZodNumber;
+        archived: z.ZodNumber;
+        retentionDays: z.ZodNumber;
+    }, z.core.$strip>>;
+    failures: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        error: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AuditRetentionJobOutput = z.infer<typeof AuditRetentionJobOutputSchema>;
+export declare const auditRetentionJobDescriptor: {
+    kind: "workers/job";
+    id: string;
+    name: string;
+    description: string;
+    queue: string;
+    dispatch: "background";
+    type: "scheduled";
+    schedule: string;
+    retries: {
+        maxAttempts: number;
+        backoff: "exponential";
+        delay: number;
+    };
+    hardware: readonly ["consumer"];
+    schemas: {
+        input: z.ZodPrefault<z.ZodObject<{}, z.core.$strip>>;
+        output: z.ZodObject<{
+            success: z.ZodBoolean;
+            results: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                deleted: z.ZodNumber;
+                archived: z.ZodNumber;
+                retentionDays: z.ZodNumber;
+            }, z.core.$strip>>;
+            failures: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                error: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    tags: string[];
+    enabled: true;
+};
+export default auditRetentionJobDescriptor;
+//# sourceMappingURL=audit-retention.job.descriptor.d.ts.map

package/dist/audit/audit-retention.job.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.descriptor.d.ts","sourceRoot":"","sources":["../../src/audit/audit-retention.job.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAWxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBtC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/audit/audit-retention.job.descriptor.js

@@ -0,0 +1,42 @@
+/**
+ * Audit Retention Job Descriptor
+ *
+ * The scheduled enforcement of every file-backed audit logger's retention,
+ * run by Workers (RC11, D19). Declared as data so logging takes no package
+ * edge on `@vibesdotdev/workers` (Workers depends on logging); the runtime
+ * holds it until the `workers/job` kind registers.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const AUDIT_RETENTION_JOB_ID = 'logging.audit-retention';
+export const AuditRetentionJobOutputSchema = z.object({
+    success: z.boolean(),
+    results: z.array(z.object({
+        id: z.string(),
+        deleted: z.number(),
+        archived: z.number(),
+        retentionDays: z.number()
+    })),
+    failures: z.array(z.object({ id: z.string(), error: z.string() }))
+});
+export const auditRetentionJobDescriptor = createRuntimeAsset({
+    kind: 'workers/job',
+    id: AUDIT_RETENTION_JOB_ID,
+    name: 'Audit Retention',
+    description: 'Enforce the retention policy of every file-backed audit logger',
+    queue: 'maintenance-jobs',
+    dispatch: 'background',
+    type: 'scheduled',
+    // Daily, as the former 24-hour interval was.
+    schedule: '20 3 * * *',
+    retries: { maxAttempts: 2, backoff: 'exponential', delay: 60_000 },
+    hardware: ['consumer'],
+    schemas: {
+        input: z.object({}).prefault({}),
+        output: AuditRetentionJobOutputSchema
+    },
+    tags: ['logging', 'audit', 'retention', 'housekeeping'],
+    enabled: true
+});
+export default auditRetentionJobDescriptor;
+//# sourceMappingURL=audit-retention.job.descriptor.js.map

package/dist/audit/audit-retention.job.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.descriptor.js","sourceRoot":"","sources":["../../src/audit/audit-retention.job.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC;QACR,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC,CACF;IACD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;IAC7D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,gEAAgE;IAC7E,KAAK,EAAE,kBAAkB;IACzB,QAAQ,EAAE,YAAqB;IAC/B,IAAI,EAAE,WAAoB;IAC1B,6CAA6C;IAC7C,QAAQ,EAAE,YAAY;IACtB,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,aAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IAC3E,QAAQ,EAAE,CAAC,UAAU,CAAU;IAC/B,OAAO,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,6BAA6B;KACrC;IACD,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC;IACvD,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/audit/audit-retention.job.impl.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Audit Retention Job Implementation — runs `enforceAllAuditRetention` on the
+ * runtime the Workers consumer constructed it with. A logger that fails is
+ * reported in the output and marks the run unsuccessful; it never disappears.
+ */
+import type { AuditRetentionRuntime } from './scheduled-audit-retention.ts';
+import type { AuditRetentionJobOutput } from './audit-retention.job.descriptor.ts';
+interface JobDescriptorLike {
+    id: string;
+}
+export declare class AuditRetentionJob {
+    readonly id: string;
+    readonly descriptor: JobDescriptorLike;
+    readonly type: "scheduled";
+    readonly isolation: "inline";
+    private readonly runtime;
+    constructor(descriptor: JobDescriptorLike, context: {
+        runtime: AuditRetentionRuntime;
+    });
+    handle(): Promise<AuditRetentionJobOutput>;
+}
+export default AuditRetentionJob;
+//# sourceMappingURL=audit-retention.job.impl.d.ts.map

package/dist/audit/audit-retention.job.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.impl.d.ts","sourceRoot":"","sources":["../../src/audit/audit-retention.job.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,UAAU,iBAAiB;IAC1B,EAAE,EAAE,MAAM,CAAC;CACX;AAED,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;IACrC,QAAQ,CAAC,SAAS,EAAG,QAAQ,CAAU;IAEvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;gBAEpC,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE;QAAE,OAAO,EAAE,qBAAqB,CAAA;KAAE;IAMhF,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC;CAIhD;AAED,eAAe,iBAAiB,CAAC"}

package/dist/audit/audit-retention.job.impl.js

@@ -0,0 +1,24 @@
+/**
+ * Audit Retention Job Implementation — runs `enforceAllAuditRetention` on the
+ * runtime the Workers consumer constructed it with. A logger that fails is
+ * reported in the output and marks the run unsuccessful; it never disappears.
+ */
+import { enforceAllAuditRetention } from "./scheduled-audit-retention.js";
+export class AuditRetentionJob {
+    id;
+    descriptor;
+    type = 'scheduled';
+    isolation = 'inline';
+    runtime;
+    constructor(descriptor, context) {
+        this.id = descriptor.id;
+        this.descriptor = descriptor;
+        this.runtime = context.runtime;
+    }
+    async handle() {
+        const { results, failures } = await enforceAllAuditRetention(this.runtime);
+        return { success: failures.length === 0, results, failures };
+    }
+}
+export default AuditRetentionJob;
+//# sourceMappingURL=audit-retention.job.impl.js.map

package/dist/audit/audit-retention.job.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.impl.js","sourceRoot":"","sources":["../../src/audit/audit-retention.job.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAO1E,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAS;IACX,UAAU,CAAoB;IAC9B,IAAI,GAAG,WAAoB,CAAC;IAC5B,SAAS,GAAG,QAAiB,CAAC;IAEtB,OAAO,CAAwB;IAEhD,YAAY,UAA6B,EAAE,OAA2C;QACrF,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC;CACD;AAED,eAAe,iBAAiB,CAAC"}

package/dist/audit/audit.descriptor.d.ts

@@ -7,5 +7,11 @@ import type { AuditDescriptor } from '../schemas/audit.ts';
 export declare const defaultAuditDescriptor: AuditDescriptor;
 export declare const authenticationAuditDescriptor: AuditDescriptor;
 export declare const securityAuditDescriptor: AuditDescriptor;
+export declare const authorizationAuditDescriptor: AuditDescriptor;
+export declare const dataAccessAuditDescriptor: AuditDescriptor;
+export declare const dataModificationAuditDescriptor: AuditDescriptor;
+export declare const configurationAuditDescriptor: AuditDescriptor;
+/** Every built-in audit descriptor, one per {@link AuditCategory}. */
+export declare const ALL_AUDIT_DESCRIPTORS: AuditDescriptor[];
 export default defaultAuditDescriptor;
 //# sourceMappingURL=audit.descriptor.d.ts.map

package/dist/audit/audit.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.descriptor.d.ts","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,eAAO,MAAM,sBAAsB,EAAE,eAUpC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,eAU3C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,eAUrC,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"audit.descriptor.d.ts","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,eAAO,MAAM,sBAAsB,EAAE,eAWpC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,eAW3C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,eAWrC,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,eAW1C,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,eAWvC,CAAC;AAEF,eAAO,MAAM,+BAA+B,EAAE,eAW7C,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,eAW1C,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,EAAE,eAAe,EAQlD,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/audit/audit.descriptor.js

@@ -3,6 +3,12 @@
  *
  * Generic audit logging configuration.
  */
+/**
+ * A file audit (the host's) writes under the bound workspace. Optional, so on
+ * an unbound host it still selects and its writes refuse `workspace-unbound`
+ * typed, never skipped (C092).
+ */
+const AUDIT_OPTIONAL_CONTEXT = ['runtime/workspace-path'];
 export const defaultAuditDescriptor = {
     kind: 'logging/audit',
     id: 'default',
@@ -12,7 +18,8 @@ export const defaultAuditDescriptor = {
     category: 'system',
     severity: 'low',
     retention: '90d',
-    immutable: true
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
 };
 export const authenticationAuditDescriptor = {
     kind: 'logging/audit',
@@ -22,8 +29,9 @@ export const authenticationAuditDescriptor = {
     tags: ['auth', 'security'],
     category: 'authentication',
     severity: 'medium',
-    retention: '1y',
-    immutable: true
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
 };
 export const securityAuditDescriptor = {
     kind: 'logging/audit',
@@ -33,8 +41,67 @@ export const securityAuditDescriptor = {
     tags: ['security', 'compliance'],
     category: 'security',
     severity: 'high',
-    retention: '2y',
-    immutable: true
+    retention: '730d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const authorizationAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'authorization',
+    name: 'Authorization Audit Logger',
+    description: 'Audit logging for authorization and permission checks',
+    tags: ['auth', 'security', 'access-control'],
+    category: 'authorization',
+    severity: 'medium',
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const dataAccessAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'data_access',
+    name: 'Data Access Audit Logger',
+    description: 'Audit logging for data access events',
+    tags: ['compliance', 'privacy', 'data'],
+    category: 'data_access',
+    severity: 'low',
+    retention: '90d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const dataModificationAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'data_modification',
+    name: 'Data Modification Audit Logger',
+    description: 'Audit logging for data create/update/delete events',
+    tags: ['compliance', 'data', 'integrity'],
+    category: 'data_modification',
+    severity: 'medium',
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const configurationAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'configuration',
+    name: 'Configuration Audit Logger',
+    description: 'Audit logging for configuration changes',
+    tags: ['ops', 'compliance', 'configuration'],
+    category: 'configuration',
+    severity: 'medium',
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
 };
+/** Every built-in audit descriptor, one per {@link AuditCategory}. */
+export const ALL_AUDIT_DESCRIPTORS = [
+    defaultAuditDescriptor,
+    authenticationAuditDescriptor,
+    securityAuditDescriptor,
+    authorizationAuditDescriptor,
+    dataAccessAuditDescriptor,
+    dataModificationAuditDescriptor,
+    configurationAuditDescriptor
+];
 export default defaultAuditDescriptor;
 //# sourceMappingURL=audit.descriptor.js.map

package/dist/audit/audit.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.descriptor.js","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACtD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,0CAA0C;IACvD,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;IAChC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAoB;IAC7D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,yCAAyC;IACtD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACvD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;IAChC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;CACf,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"audit.descriptor.js","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACtD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,0CAA0C;IACvD,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;IAChC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAoB;IAC7D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,yCAAyC;IACtD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACvD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;IAChC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAoB;IAC5D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,uDAAuD;IACpE,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAoB;IACzD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,sCAAsC;IACnD,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC;IACvC,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAoB;IAC/D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,oDAAoD;IACjE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC;IACzC,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAoB;IAC5D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,yCAAyC;IACtD,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC;IAC5C,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACvD,sBAAsB;IACtB,6BAA6B;IAC7B,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,+BAA+B;IAC/B,4BAA4B;CAC5B,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/audit/audit.storage.schema.d.ts

@@ -4,9 +4,9 @@ export declare const AuditEntryStorageSchema: z.ZodObject<{
     id: z.ZodString;
     timestamp: z.ZodString;
     category: z.ZodEnum<{
+        authorization: "authorization";
         system: "system";
         authentication: "authentication";
-        authorization: "authorization";
         data_access: "data_access";
         data_modification: "data_modification";
         configuration: "configuration";
@@ -23,8 +23,8 @@ export declare const AuditEntryStorageSchema: z.ZodObject<{
         id: z.ZodString;
         type: z.ZodEnum<{
             user: "user";
-            system: "system";
             service: "service";
+            system: "system";
         }>;
         name: z.ZodOptional<z.ZodString>;
         ip: z.ZodOptional<z.ZodString>;
@@ -48,8 +48,8 @@ export declare const AuditEntryStorageSchema: z.ZodObject<{
     actorId: z.ZodString;
     actorType: z.ZodEnum<{
         user: "user";
-        system: "system";
         service: "service";
+        system: "system";
     }>;
     targetId: z.ZodOptional<z.ZodString>;
     targetType: z.ZodOptional<z.ZodString>;

package/dist/audit/index.d.ts

@@ -1,2 +1,4 @@
-export { AuditEntryStorageSchema, type AuditEntryStorage, type AuditRetentionPolicy, DEFAULT_RETENTION_POLICIES, type AuditStorageConfig, defaultAuditStorageConfig } from './audit.storage.schema';
+export { AuditEntryStorageSchema, type AuditEntryStorage, type AuditRetentionPolicy, DEFAULT_RETENTION_POLICIES, type AuditStorageConfig, defaultAuditStorageConfig } from './audit.storage.schema.ts';
+export { defaultAuditDescriptor, authenticationAuditDescriptor, securityAuditDescriptor, authorizationAuditDescriptor, dataAccessAuditDescriptor, dataModificationAuditDescriptor, configurationAuditDescriptor, ALL_AUDIT_DESCRIPTORS } from './audit.descriptor.ts';
+export { auditLog, buildAuditEntry, redactAuditContext, emitAuditEntry, type AuditLogInput } from '../kinds/audit.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/audit/index.js

@@ -1,2 +1,5 @@
-export { AuditEntryStorageSchema, DEFAULT_RETENTION_POLICIES, defaultAuditStorageConfig } from './audit.storage.schema.js';
+export { AuditEntryStorageSchema, DEFAULT_RETENTION_POLICIES, defaultAuditStorageConfig } from "./audit.storage.schema.js";
+export { defaultAuditDescriptor, authenticationAuditDescriptor, securityAuditDescriptor, authorizationAuditDescriptor, dataAccessAuditDescriptor, dataModificationAuditDescriptor, configurationAuditDescriptor, ALL_AUDIT_DESCRIPTORS } from "./audit.descriptor.js";
+// Audit emission: shape, redact and write one entry to the handed runtime's stderr.
+export { auditLog, buildAuditEntry, redactAuditContext, emitAuditEntry } from "../kinds/audit.js";
 //# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EAGvB,0BAA0B,EAE1B,yBAAyB,EACzB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EAGvB,0BAA0B,EAE1B,yBAAyB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,oFAAoF;AACpF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAsB,MAAM,mBAAmB,CAAC"}

package/dist/audit/scheduled-audit-retention.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Audit retention enforcement for file-backed audit loggers.
+ *
+ * The periodic run is a Workers job (`logging.audit-retention`,
+ * `audit-retention.job.descriptor.ts`): schedules belong to Workers (RC11,
+ * D19), so this module holds no timer. Its former env knobs moved with it:
+ * the interval is the job's declared `schedule`, and an operator switches it
+ * off through the Workers settings (`schedules['logging.audit-retention']
+ * .enabled = false`), not an environment variable.
+ */
+import type { AuditDescriptor } from '@vibesdotdev/logging/schemas/audit';
+export interface AuditRetentionRuntime {
+    hasKind(kind: string): boolean;
+    query(kind: string): {
+        descriptors(): AuditDescriptor[];
+        withId(id: string): {
+            resolve<T>(): Promise<T>;
+        };
+    };
+}
+export interface AuditRetentionResult {
+    id: string;
+    deleted: number;
+    archived: number;
+    retentionDays: number;
+}
+export interface AuditRetentionFailure {
+    id: string;
+    error: string;
+}
+/**
+ * Enforce retention on every registered audit logger that supports it. One
+ * logger's failure does not stop the others; every failure is returned, named.
+ */
+export declare function enforceAllAuditRetention(runtime: AuditRetentionRuntime): Promise<{
+    results: AuditRetentionResult[];
+    failures: AuditRetentionFailure[];
+}>;
+//# sourceMappingURL=scheduled-audit-retention.d.ts.map

package/dist/audit/scheduled-audit-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-audit-retention.d.ts","sourceRoot":"","sources":["../../src/audit/scheduled-audit-retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAI1E,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG;QACpB,WAAW,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG;YAAE,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;SAAE,CAAC;KACjD,CAAC;CACF;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CAmBjF"}

package/dist/audit/scheduled-audit-retention.js

@@ -0,0 +1,38 @@
+/**
+ * Audit retention enforcement for file-backed audit loggers.
+ *
+ * The periodic run is a Workers job (`logging.audit-retention`,
+ * `audit-retention.job.descriptor.ts`): schedules belong to Workers (RC11,
+ * D19), so this module holds no timer. Its former env knobs moved with it:
+ * the interval is the job's declared `schedule`, and an operator switches it
+ * off through the Workers settings (`schedules['logging.audit-retention']
+ * .enabled = false`), not an environment variable.
+ */
+import { attempt } from "../core/attempt.js";
+import { ThrownMessageSchema } from "../core/redact.js";
+/**
+ * Enforce retention on every registered audit logger that supports it. One
+ * logger's failure does not stop the others; every failure is returned, named.
+ */
+export async function enforceAllAuditRetention(runtime) {
+    const results = [];
+    const failures = [];
+    if (!runtime.hasKind('logging/audit'))
+        return { results, failures };
+    for (const descriptor of runtime.query('logging/audit').descriptors()) {
+        const enforced = await attempt(async () => {
+            const auditor = await runtime.query('logging/audit').withId(descriptor.id).resolve();
+            return auditor.enforceRetention ? await auditor.enforceRetention() : null;
+        });
+        if ('failure' in enforced) {
+            // The job output is serialized, so a failure is returned by its message.
+            const { cause } = enforced.failure;
+            failures.push({ id: descriptor.id, error: ThrownMessageSchema.parse(cause) });
+        }
+        else if (enforced.value) {
+            results.push({ id: descriptor.id, ...enforced.value });
+        }
+    }
+    return { results, failures };
+}
+//# sourceMappingURL=scheduled-audit-retention.js.map

package/dist/audit/scheduled-audit-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-audit-retention.js","sourceRoot":"","sources":["../../src/audit/scheduled-audit-retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAsBxD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA8B;IAE9B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAEpE,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAuB,CAAC;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC3B,yEAAyE;YACzE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}