@vibesdotdev/logging 0.0.2 → 1.0.0-rc.5

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,22 +1,115 @@
 # @vibesdotdev/logging
 
-Structured logging contracts, levels, formatters, and runtime descriptors for Vibes packages.
+Structured logging for Vibes. Code logs through `getLogger(namespace, runtime)`; the Vibes runtime decides where entries go by resolving the sinks, formatters and outputs registered for the current host. The package also ships a browser sink, an OpenTelemetry log sink, server observability helpers, an audit log, the `vibes logs` CLI commands, and the portable contract (`@vibesdotdev/logging/host`) that a host package implements for file logging.
 
-This package is part of the public Vibes framework package set. The source repository is private while the public repository split is being prepared, so package documentation is published on the Vibes docs site.
+The package root runs anywhere: Bun, Node, workerd and the browser. It never writes to stdout, so it is safe inside MCP stdio servers and CLIs that print machine-readable output.
 
 ## Install
 
 ```sh
-bun add @vibesdotdev/logging
+bun add @vibesdotdev/logging @vibesdotdev/kernel
 # or
-npm install @vibesdotdev/logging
+npm install @vibesdotdev/logging @vibesdotdev/kernel
 ```
 
-## Documentation
+## Log something
 
-- Package guide: https://docs.vibes.dev/packages/logging
-- Vibes docs: https://docs.vibes.dev
+```ts
+import { bootstrapVibesRuntime } from '@vibesdotdev/kernel';
+import loggingPlugin from '@vibesdotdev/logging/plugin';
+import loggingConsumerPlugin from '@vibesdotdev/logging/consumer/plugin';
+import { getLogger } from '@vibesdotdev/logging';
+
+// `environment` is your host's environment plugin (on Bun, from @vibesdotdev/host-bun).
+const runtime = await bootstrapVibesRuntime({
+  environment,
+  composition: { kind: 'literal', plugins: [async () => loggingPlugin, async () => loggingConsumerPlugin] }
+});
+
+const log = getLogger('myapp:db', runtime);
+log.info('connected', { host: 'localhost', port: 5432 });
+
+const request = log.withRequestContext({ requestId: 'req-1' });
+request.warn('slow query', { durationMs: 850 });
+```
+
+Filter output with environment keys read through the runtime:
+
+```sh
+VIBES_LOG_LEVEL=debug VIBES_LOG='myapp:*,-myapp:noisy' bun run app.ts
+```
+
+## Pick the surfaces your host needs
+
+Register each extra plugin after `@vibesdotdev/logging/plugin`. File sinks, outputs and the file-backed audit log are host code: `@vibesdotdev/host-node/logging`'s `nodeLoggingPlugin` implements `@vibesdotdev/logging/host`. The Bun host (`@vibesdotdev/host-bun`) registers it with its environment (opt out with its `logging: { files: false }` option), and so does the declared Node test host; a production Node composition registers `nodeLoggingPlugin` itself.
+
+| Plugin | Host | Adds |
+| --- | --- | --- |
+| `@vibesdotdev/logging/consumer/plugin` | Terminal consumer | Colorized console sink and pretty formatter |
+| `@vibesdotdev/logging/browser/plugin` | Browser | Styled console sink with localStorage buffering |
+| `@vibesdotdev/logging/otel/plugin` | Server | OTLP/HTTP log export |
+| `@vibesdotdev/logging/cli/plugin` | CLI | `vibes logs list \| view \| tail \| search \| rotate` and `vibes logs audit list \| cleanup` |
+
+The example composes terminal rendering explicitly. Browser and cloud bundles use
+`./plugin` without the consumer slice: JSON formatters, memory/buffer sinks,
+stdout through the runtime's stderr port, remote output and browser console
+remain universal. The optional browser slice adds persistence. Scope filtering
+does not isolate bundles; the consumer imports live in their own plugin.
+
+`@vibesdotdev/logging/plugin` also registers the `logging` `runtime/client`. Resolve it with `getVibesClient('logging', runtime)`, or peek it synchronously with `tryGetVibesClient('logging', runtime)` (both from `@vibesdotdev/kernel/client`). See [SPEC.md](SPEC.md#runtime-client) and [Composition](SPEC.md#composition).
+
+For traces and metrics on a server, call `initializeTelemetry(runtime)` from `@vibesdotdev/logging/observability` after your runtime environment is registered, and report `getTelemetryStatus(runtime)` from a health endpoint.
+
+## Buffer retention
+
+The universal `buffer` sink retains all accepted entries until drained, cleared
+or closed. Set an optional positive integer `capacity` on its registered
+`SinkDescriptor` to bound storage. At capacity it refuses the incoming entry
+before changing retained entries (`CapabilityError`: `UNAVAILABLE`,
+`buffer-capacity-exceeded`, retryable), without including entry contents in the
+failure. The logger delivers refused entries through its fallback and reports
+the failure. Drain or clear to restore capacity; `flush()` keeps entries and
+`close()` or runtime disposal clears them. This buffer is not durable storage.
+
+## Memory retention
+
+The queryable `memory` sink retains all entries by default until clear, close
+or runtime disposal. Its registered `SinkDescriptor.maxEntries` optionally
+sets a nonnegative integer bound: zero disables retention; positive bounds
+deliberately evict oldest entries. `setMaxEntries(number)` changes the bound
+and trims immediately. Invalid setter bounds refuse `INVALID_INPUT`,
+`memory-entry-limit-invalid`. Buffer capacity instead refuses incoming entries.
+Queries return independent array snapshots in emission order, with level,
+namespace, message and date filters; `limit` selects the newest matches and
+accepts zero. Invalid queries refuse `INVALID_INPUT`, `memory-query-invalid`.
+`MemorySinkQueryOptions` remains exported from `./sinks`; its schemas and
+inferred types live in `./schemas/sink` and `./schemas`.
+
+## Audit
+
+```ts
+import { auditLog } from '@vibesdotdev/logging';
+
+await auditLog({
+  category: 'authentication',
+  severity: 'medium',
+  action: 'login',
+  actor: { id: 'user-1', type: 'user' },
+  outcome: 'success',
+  context: { apiKey: 'redacted before it is written' }
+}, runtime);
+```
+
+`auditLog(input, runtime)` (also exported from `@vibesdotdev/logging/audit`) validates the entry, redacts credential-like context keys and writes it to the handed runtime's stderr. To persist entries, resolve a `logging/audit` implementation from the runtime (`runtime.query('logging/audit')`): wherever `nodeLoggingPlugin` is registered (the Bun host, the declared Node test host, or a Node composition that adds it) there is a file-backed one with retention by category.
+
+## Docs
+
+`vibes docs show logging` covers `logging.levels`, `logging.structured`, `logging.transports`, `logging.cli` and `logging.observability`. [SPEC.md](SPEC.md) is the full contract: what the package owns, its hard rules, every entrypoint and every configuration key.
+
+## Development
+
+`bun run check` typechecks all source TypeScript and TSX, including tests, without emitting. `bun run test` runs the in-process suite. `bun run build` uses `tsconfig.build.json` to emit production JavaScript and declarations with rewritten relative imports; tests, test support and the Svelte surface are excluded from emission. `tsconfig.check.json` remains a compatible alias for the all-source project.
 
 ## License
 
-MIT
+MIT. See [LICENSE](LICENSE).

package/dist/audit/audit-retention.job.descriptor.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Audit Retention Job Descriptor
+ *
+ * The scheduled enforcement of every file-backed audit logger's retention,
+ * run by Workers (RC11, D19). Declared as data so logging takes no package
+ * edge on `@vibesdotdev/workers` (Workers depends on logging); the runtime
+ * holds it until the `workers/job` kind registers.
+ */
+import * as z from 'zod/v4';
+export declare const AUDIT_RETENTION_JOB_ID = "logging.audit-retention";
+export declare const AuditRetentionJobOutputSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        deleted: z.ZodNumber;
+        archived: z.ZodNumber;
+        retentionDays: z.ZodNumber;
+    }, z.core.$strip>>;
+    failures: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        error: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AuditRetentionJobOutput = z.infer<typeof AuditRetentionJobOutputSchema>;
+export declare const auditRetentionJobDescriptor: {
+    kind: "workers/job";
+    id: string;
+    name: string;
+    description: string;
+    queue: string;
+    dispatch: "background";
+    type: "scheduled";
+    schedule: string;
+    retries: {
+        maxAttempts: number;
+        backoff: "exponential";
+        delay: number;
+    };
+    hardware: readonly ["consumer"];
+    schemas: {
+        input: z.ZodPrefault<z.ZodObject<{}, z.core.$strip>>;
+        output: z.ZodObject<{
+            success: z.ZodBoolean;
+            results: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                deleted: z.ZodNumber;
+                archived: z.ZodNumber;
+                retentionDays: z.ZodNumber;
+            }, z.core.$strip>>;
+            failures: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                error: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    tags: string[];
+    enabled: true;
+};
+export default auditRetentionJobDescriptor;
+//# sourceMappingURL=audit-retention.job.descriptor.d.ts.map

package/dist/audit/audit-retention.job.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.descriptor.d.ts","sourceRoot":"","sources":["../../src/audit/audit-retention.job.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAWxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBtC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/audit/audit-retention.job.descriptor.js

@@ -0,0 +1,42 @@
+/**
+ * Audit Retention Job Descriptor
+ *
+ * The scheduled enforcement of every file-backed audit logger's retention,
+ * run by Workers (RC11, D19). Declared as data so logging takes no package
+ * edge on `@vibesdotdev/workers` (Workers depends on logging); the runtime
+ * holds it until the `workers/job` kind registers.
+ */
+import * as z from 'zod/v4';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const AUDIT_RETENTION_JOB_ID = 'logging.audit-retention';
+export const AuditRetentionJobOutputSchema = z.object({
+    success: z.boolean(),
+    results: z.array(z.object({
+        id: z.string(),
+        deleted: z.number(),
+        archived: z.number(),
+        retentionDays: z.number()
+    })),
+    failures: z.array(z.object({ id: z.string(), error: z.string() }))
+});
+export const auditRetentionJobDescriptor = createRuntimeAsset({
+    kind: 'workers/job',
+    id: AUDIT_RETENTION_JOB_ID,
+    name: 'Audit Retention',
+    description: 'Enforce the retention policy of every file-backed audit logger',
+    queue: 'maintenance-jobs',
+    dispatch: 'background',
+    type: 'scheduled',
+    // Daily, as the former 24-hour interval was.
+    schedule: '20 3 * * *',
+    retries: { maxAttempts: 2, backoff: 'exponential', delay: 60_000 },
+    hardware: ['consumer'],
+    schemas: {
+        input: z.object({}).prefault({}),
+        output: AuditRetentionJobOutputSchema
+    },
+    tags: ['logging', 'audit', 'retention', 'housekeeping'],
+    enabled: true
+});
+export default auditRetentionJobDescriptor;
+//# sourceMappingURL=audit-retention.job.descriptor.js.map

package/dist/audit/audit-retention.job.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.descriptor.js","sourceRoot":"","sources":["../../src/audit/audit-retention.job.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC;QACR,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;KACzB,CAAC,CACF;IACD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;IAC7D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,gEAAgE;IAC7E,KAAK,EAAE,kBAAkB;IACzB,QAAQ,EAAE,YAAqB;IAC/B,IAAI,EAAE,WAAoB;IAC1B,6CAA6C;IAC7C,QAAQ,EAAE,YAAY;IACtB,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,aAAsB,EAAE,KAAK,EAAE,MAAM,EAAE;IAC3E,QAAQ,EAAE,CAAC,UAAU,CAAU;IAC/B,OAAO,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,6BAA6B;KACrC;IACD,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC;IACvD,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,eAAe,2BAA2B,CAAC"}

package/dist/audit/audit-retention.job.impl.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Audit Retention Job Implementation — runs `enforceAllAuditRetention` on the
+ * runtime the Workers consumer constructed it with. A logger that fails is
+ * reported in the output and marks the run unsuccessful; it never disappears.
+ */
+import type { AuditRetentionRuntime } from './scheduled-audit-retention.ts';
+import type { AuditRetentionJobOutput } from './audit-retention.job.descriptor.ts';
+interface JobDescriptorLike {
+    id: string;
+}
+export declare class AuditRetentionJob {
+    readonly id: string;
+    readonly descriptor: JobDescriptorLike;
+    readonly type: "scheduled";
+    readonly isolation: "inline";
+    private readonly runtime;
+    constructor(descriptor: JobDescriptorLike, context: {
+        runtime: AuditRetentionRuntime;
+    });
+    handle(): Promise<AuditRetentionJobOutput>;
+}
+export default AuditRetentionJob;
+//# sourceMappingURL=audit-retention.job.impl.d.ts.map

package/dist/audit/audit-retention.job.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.impl.d.ts","sourceRoot":"","sources":["../../src/audit/audit-retention.job.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,UAAU,iBAAiB;IAC1B,EAAE,EAAE,MAAM,CAAC;CACX;AAED,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;IACrC,QAAQ,CAAC,SAAS,EAAG,QAAQ,CAAU;IAEvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;gBAEpC,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE;QAAE,OAAO,EAAE,qBAAqB,CAAA;KAAE;IAMhF,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC;CAIhD;AAED,eAAe,iBAAiB,CAAC"}

package/dist/audit/audit-retention.job.impl.js

@@ -0,0 +1,24 @@
+/**
+ * Audit Retention Job Implementation — runs `enforceAllAuditRetention` on the
+ * runtime the Workers consumer constructed it with. A logger that fails is
+ * reported in the output and marks the run unsuccessful; it never disappears.
+ */
+import { enforceAllAuditRetention } from "./scheduled-audit-retention.js";
+export class AuditRetentionJob {
+    id;
+    descriptor;
+    type = 'scheduled';
+    isolation = 'inline';
+    runtime;
+    constructor(descriptor, context) {
+        this.id = descriptor.id;
+        this.descriptor = descriptor;
+        this.runtime = context.runtime;
+    }
+    async handle() {
+        const { results, failures } = await enforceAllAuditRetention(this.runtime);
+        return { success: failures.length === 0, results, failures };
+    }
+}
+export default AuditRetentionJob;
+//# sourceMappingURL=audit-retention.job.impl.js.map

package/dist/audit/audit-retention.job.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-retention.job.impl.js","sourceRoot":"","sources":["../../src/audit/audit-retention.job.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAO1E,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAS;IACX,UAAU,CAAoB;IAC9B,IAAI,GAAG,WAAoB,CAAC;IAC5B,SAAS,GAAG,QAAiB,CAAC;IAEtB,OAAO,CAAwB;IAEhD,YAAY,UAA6B,EAAE,OAA2C;QACrF,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC;CACD;AAED,eAAe,iBAAiB,CAAC"}

package/dist/audit/audit.descriptor.d.ts

@@ -7,5 +7,11 @@ import type { AuditDescriptor } from '../schemas/audit.ts';
 export declare const defaultAuditDescriptor: AuditDescriptor;
 export declare const authenticationAuditDescriptor: AuditDescriptor;
 export declare const securityAuditDescriptor: AuditDescriptor;
+export declare const authorizationAuditDescriptor: AuditDescriptor;
+export declare const dataAccessAuditDescriptor: AuditDescriptor;
+export declare const dataModificationAuditDescriptor: AuditDescriptor;
+export declare const configurationAuditDescriptor: AuditDescriptor;
+/** Every built-in audit descriptor, one per {@link AuditCategory}. */
+export declare const ALL_AUDIT_DESCRIPTORS: AuditDescriptor[];
 export default defaultAuditDescriptor;
 //# sourceMappingURL=audit.descriptor.d.ts.map

package/dist/audit/audit.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.descriptor.d.ts","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,eAAO,MAAM,sBAAsB,EAAE,eAUpC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,eAU3C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,eAUrC,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"audit.descriptor.d.ts","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,eAAO,MAAM,sBAAsB,EAAE,eAWpC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,eAW3C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,eAWrC,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,eAW1C,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,eAWvC,CAAC;AAEF,eAAO,MAAM,+BAA+B,EAAE,eAW7C,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,eAW1C,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,EAAE,eAAe,EAQlD,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/audit/audit.descriptor.js

@@ -3,6 +3,12 @@
  *
  * Generic audit logging configuration.
  */
+/**
+ * A file audit (the host's) writes under the bound workspace. Optional, so on
+ * an unbound host it still selects and its writes refuse `workspace-unbound`
+ * typed, never skipped (C092).
+ */
+const AUDIT_OPTIONAL_CONTEXT = ['runtime/workspace-path'];
 export const defaultAuditDescriptor = {
     kind: 'logging/audit',
     id: 'default',
@@ -12,7 +18,8 @@ export const defaultAuditDescriptor = {
     category: 'system',
     severity: 'low',
     retention: '90d',
-    immutable: true
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
 };
 export const authenticationAuditDescriptor = {
     kind: 'logging/audit',
@@ -22,8 +29,9 @@ export const authenticationAuditDescriptor = {
     tags: ['auth', 'security'],
     category: 'authentication',
     severity: 'medium',
-    retention: '1y',
-    immutable: true
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
 };
 export const securityAuditDescriptor = {
     kind: 'logging/audit',
@@ -33,8 +41,67 @@ export const securityAuditDescriptor = {
     tags: ['security', 'compliance'],
     category: 'security',
     severity: 'high',
-    retention: '2y',
-    immutable: true
+    retention: '730d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const authorizationAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'authorization',
+    name: 'Authorization Audit Logger',
+    description: 'Audit logging for authorization and permission checks',
+    tags: ['auth', 'security', 'access-control'],
+    category: 'authorization',
+    severity: 'medium',
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const dataAccessAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'data_access',
+    name: 'Data Access Audit Logger',
+    description: 'Audit logging for data access events',
+    tags: ['compliance', 'privacy', 'data'],
+    category: 'data_access',
+    severity: 'low',
+    retention: '90d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const dataModificationAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'data_modification',
+    name: 'Data Modification Audit Logger',
+    description: 'Audit logging for data create/update/delete events',
+    tags: ['compliance', 'data', 'integrity'],
+    category: 'data_modification',
+    severity: 'medium',
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
+};
+export const configurationAuditDescriptor = {
+    kind: 'logging/audit',
+    id: 'configuration',
+    name: 'Configuration Audit Logger',
+    description: 'Audit logging for configuration changes',
+    tags: ['ops', 'compliance', 'configuration'],
+    category: 'configuration',
+    severity: 'medium',
+    retention: '365d',
+    immutable: true,
+    optionalContext: AUDIT_OPTIONAL_CONTEXT
 };
+/** Every built-in audit descriptor, one per {@link AuditCategory}. */
+export const ALL_AUDIT_DESCRIPTORS = [
+    defaultAuditDescriptor,
+    authenticationAuditDescriptor,
+    securityAuditDescriptor,
+    authorizationAuditDescriptor,
+    dataAccessAuditDescriptor,
+    dataModificationAuditDescriptor,
+    configurationAuditDescriptor
+];
 export default defaultAuditDescriptor;
 //# sourceMappingURL=audit.descriptor.js.map

package/dist/audit/audit.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.descriptor.js","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACtD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,0CAA0C;IACvD,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;IAChC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAoB;IAC7D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,yCAAyC;IACtD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACvD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;IAChC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;CACf,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"audit.descriptor.js","sourceRoot":"","sources":["../../src/audit/audit.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACtD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,0CAA0C;IACvD,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;IAChC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAoB;IAC7D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,yCAAyC;IACtD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACvD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;IAChC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAoB;IAC5D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,uDAAuD;IACpE,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAoB;IACzD,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,sCAAsC;IACnD,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC;IACvC,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAoB;IAC/D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,oDAAoD;IACjE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC;IACzC,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAoB;IAC5D,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,yCAAyC;IACtD,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,CAAC;IAC5C,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,sBAAsB;CACvC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACvD,sBAAsB;IACtB,6BAA6B;IAC7B,uBAAuB;IACvB,4BAA4B;IAC5B,yBAAyB;IACzB,+BAA+B;IAC/B,4BAA4B;CAC5B,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/audit/audit.storage.schema.d.ts

@@ -4,9 +4,9 @@ export declare const AuditEntryStorageSchema: z.ZodObject<{
     id: z.ZodString;
     timestamp: z.ZodString;
     category: z.ZodEnum<{
+        authorization: "authorization";
         system: "system";
         authentication: "authentication";
-        authorization: "authorization";
         data_access: "data_access";
         data_modification: "data_modification";
         configuration: "configuration";
@@ -23,8 +23,8 @@ export declare const AuditEntryStorageSchema: z.ZodObject<{
         id: z.ZodString;
         type: z.ZodEnum<{
             user: "user";
-            system: "system";
             service: "service";
+            system: "system";
         }>;
         name: z.ZodOptional<z.ZodString>;
         ip: z.ZodOptional<z.ZodString>;
@@ -48,8 +48,8 @@ export declare const AuditEntryStorageSchema: z.ZodObject<{
     actorId: z.ZodString;
     actorType: z.ZodEnum<{
         user: "user";
-        system: "system";
         service: "service";
+        system: "system";
     }>;
     targetId: z.ZodOptional<z.ZodString>;
     targetType: z.ZodOptional<z.ZodString>;

package/dist/audit/index.d.ts

@@ -1,2 +1,4 @@
-export { AuditEntryStorageSchema, type AuditEntryStorage, type AuditRetentionPolicy, DEFAULT_RETENTION_POLICIES, type AuditStorageConfig, defaultAuditStorageConfig } from './audit.storage.schema';
+export { AuditEntryStorageSchema, type AuditEntryStorage, type AuditRetentionPolicy, DEFAULT_RETENTION_POLICIES, type AuditStorageConfig, defaultAuditStorageConfig } from './audit.storage.schema.ts';
+export { defaultAuditDescriptor, authenticationAuditDescriptor, securityAuditDescriptor, authorizationAuditDescriptor, dataAccessAuditDescriptor, dataModificationAuditDescriptor, configurationAuditDescriptor, ALL_AUDIT_DESCRIPTORS } from './audit.descriptor.ts';
+export { auditLog, buildAuditEntry, redactAuditContext, emitAuditEntry, type AuditLogInput } from '../kinds/audit.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/audit/index.js

@@ -1,2 +1,5 @@
-export { AuditEntryStorageSchema, DEFAULT_RETENTION_POLICIES, defaultAuditStorageConfig } from './audit.storage.schema.js';
+export { AuditEntryStorageSchema, DEFAULT_RETENTION_POLICIES, defaultAuditStorageConfig } from "./audit.storage.schema.js";
+export { defaultAuditDescriptor, authenticationAuditDescriptor, securityAuditDescriptor, authorizationAuditDescriptor, dataAccessAuditDescriptor, dataModificationAuditDescriptor, configurationAuditDescriptor, ALL_AUDIT_DESCRIPTORS } from "./audit.descriptor.js";
+// Audit emission: shape, redact and write one entry to the handed runtime's stderr.
+export { auditLog, buildAuditEntry, redactAuditContext, emitAuditEntry } from "../kinds/audit.js";
 //# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EAGvB,0BAA0B,EAE1B,yBAAyB,EACzB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EAGvB,0BAA0B,EAE1B,yBAAyB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,oFAAoF;AACpF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAsB,MAAM,mBAAmB,CAAC"}

package/dist/audit/scheduled-audit-retention.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Audit retention enforcement for file-backed audit loggers.
+ *
+ * The periodic run is a Workers job (`logging.audit-retention`,
+ * `audit-retention.job.descriptor.ts`): schedules belong to Workers (RC11,
+ * D19), so this module holds no timer. Its former env knobs moved with it:
+ * the interval is the job's declared `schedule`, and an operator switches it
+ * off through the Workers settings (`schedules['logging.audit-retention']
+ * .enabled = false`), not an environment variable.
+ */
+import type { AuditDescriptor } from '@vibesdotdev/logging/schemas/audit';
+export interface AuditRetentionRuntime {
+    hasKind(kind: string): boolean;
+    query(kind: string): {
+        descriptors(): AuditDescriptor[];
+        withId(id: string): {
+            resolve<T>(): Promise<T>;
+        };
+    };
+}
+export interface AuditRetentionResult {
+    id: string;
+    deleted: number;
+    archived: number;
+    retentionDays: number;
+}
+export interface AuditRetentionFailure {
+    id: string;
+    error: string;
+}
+/**
+ * Enforce retention on every registered audit logger that supports it. One
+ * logger's failure does not stop the others; every failure is returned, named.
+ */
+export declare function enforceAllAuditRetention(runtime: AuditRetentionRuntime): Promise<{
+    results: AuditRetentionResult[];
+    failures: AuditRetentionFailure[];
+}>;
+//# sourceMappingURL=scheduled-audit-retention.d.ts.map

package/dist/audit/scheduled-audit-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-audit-retention.d.ts","sourceRoot":"","sources":["../../src/audit/scheduled-audit-retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAI1E,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG;QACpB,WAAW,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG;YAAE,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;SAAE,CAAC;KACjD,CAAC;CACF;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CAmBjF"}

package/dist/audit/scheduled-audit-retention.js

@@ -0,0 +1,38 @@
+/**
+ * Audit retention enforcement for file-backed audit loggers.
+ *
+ * The periodic run is a Workers job (`logging.audit-retention`,
+ * `audit-retention.job.descriptor.ts`): schedules belong to Workers (RC11,
+ * D19), so this module holds no timer. Its former env knobs moved with it:
+ * the interval is the job's declared `schedule`, and an operator switches it
+ * off through the Workers settings (`schedules['logging.audit-retention']
+ * .enabled = false`), not an environment variable.
+ */
+import { attempt } from "../core/attempt.js";
+import { ThrownMessageSchema } from "../core/redact.js";
+/**
+ * Enforce retention on every registered audit logger that supports it. One
+ * logger's failure does not stop the others; every failure is returned, named.
+ */
+export async function enforceAllAuditRetention(runtime) {
+    const results = [];
+    const failures = [];
+    if (!runtime.hasKind('logging/audit'))
+        return { results, failures };
+    for (const descriptor of runtime.query('logging/audit').descriptors()) {
+        const enforced = await attempt(async () => {
+            const auditor = await runtime.query('logging/audit').withId(descriptor.id).resolve();
+            return auditor.enforceRetention ? await auditor.enforceRetention() : null;
+        });
+        if ('failure' in enforced) {
+            // The job output is serialized, so a failure is returned by its message.
+            const { cause } = enforced.failure;
+            failures.push({ id: descriptor.id, error: ThrownMessageSchema.parse(cause) });
+        }
+        else if (enforced.value) {
+            results.push({ id: descriptor.id, ...enforced.value });
+        }
+    }
+    return { results, failures };
+}
+//# sourceMappingURL=scheduled-audit-retention.js.map

package/dist/audit/scheduled-audit-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-audit-retention.js","sourceRoot":"","sources":["../../src/audit/scheduled-audit-retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAsBxD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA8B;IAE9B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAEpE,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAuB,CAAC;YAC1G,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC3B,yEAAyE;YACzE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}