Feature/ak 009 retention redaction idempotency validation

[y-aithnini]

Summary

• What does this PR change?

Why

• Why is this change needed?

Checklist

• Added/updated tests (if behavior changed)
• npm run lint passes
• npm run typecheck passes
• npm test passes
• npm run build passes
• Added a changeset (npx changeset) if this affects consumers

Notes

• Anything reviewers should pay attention to?

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR expands AuditKit’s core capabilities (idempotency, PII redaction, retention, cursor pagination) and wires them through the Nest module, while also adding supporting tooling (benchmarks, mutation testing, CI matrix, formatting/line-ending normalization).

Changes:

• Add runtime options + validation for redaction/idempotency/retention/event streaming, and wire them into AuditService via Nest module/providers.
• Introduce cursor-based pagination + opaque cursor encoding, plus repository support (MongoDB + in-memory).
• Add observability/event-streaming ports with a default in-process EventEmitter publisher, plus bench/mutation tooling and CI matrix expansion.

Reviewed changes

Copilot reviewed 34 out of 36 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
vitest.config.ts	Configure Vitest bench include/exclude patterns.
tsconfig.json	Add Node types, include benchmarks, suppress TS deprecation noise.
tsconfig.eslint.json	Include benchmarks in ESLint TS program.
stryker.config.json	Add Stryker mutation testing configuration (Jest runner).
src/nest/providers.ts	Validate options, pass retention archive handler, wire runtime options + default event publisher.
src/nest/options.validation.ts	New centralized runtime validation + mapping to AuditService options.
src/nest/module.ts	Validate options on register/registerAsync wiring; pass runtime options to AuditService.
src/nest/module.spec.ts	Add tests for invalid module option configurations.
src/nest/interfaces.ts	Extend module options with redaction/idempotency/retention/observer/event streaming config.
src/infra/repositories/mongodb/mongo-audit.repository.ts	Add archive + cursor pagination; refactor query building; add idempotencyKey filter support.
src/infra/repositories/mongodb/audit-log.schema.ts	Add idempotencyKey field to schema.
src/infra/repositories/in-memory/in-memory-audit.repository.ts	Add archive + cursor pagination; add idempotencyKey filtering support.
src/infra/repositories/cursor.util.ts	New base64url cursor encode/decode helpers.
src/infra/providers/index.ts	Re-export events providers.
src/infra/providers/events/index.ts	Barrel export for default event publisher.
src/infra/providers/events/event-emitter-audit-event.publisher.ts	Default EventEmitter-based audit event publisher implementation.
src/core/types.ts	Add idempotencyKey + cursor pagination types and filter field.
src/core/ports/index.ts	Re-export new observer + event publisher ports.
src/core/ports/audit-repository.port.ts	Add optional queryWithCursor to repository contract.
src/core/ports/audit-observer.port.ts	New observer port for operation telemetry hooks.
src/core/ports/audit-event-publisher.port.ts	New event publisher port + event type constants.
src/core/index.ts	Export new cursor pagination + observer/event publisher APIs.
src/core/dtos/query-audit-logs.dto.ts	Allow filtering by idempotencyKey.
src/core/dtos/create-audit-log.dto.ts	Accept idempotencyKey on create DTO with validation constraints.
src/core/dtos/audit-log-response.dto.ts	Include idempotencyKey in response DTO.
src/core/audit.service.ts	Implement idempotency, redaction, retention hooks, observer + event publishing, cursor query.
src/core/audit.service.spec.ts	Add tests for redaction/idempotency/retention/cursor query/observer/publisher hooks.
package.json	Add bench + mutation scripts and deps (Vitest, Stryker).
package-lock.json	Lockfile updates for added tooling/dependencies.
docs/RELEASE.md	Document local “quality gates” and optional advanced checks.
docs/ARCHITECTURE.md	Update architecture doc for new ports/adapters and data flow.
benchmarks/audit-service.bench.ts	Add Vitest benchmarks for core service operations.
README.md	Replace template README with AuditKit usage and feature documentation.
.prettierrc	Enforce LF line endings via Prettier config.
.github/workflows/pr-validation.yml	Expand CI to Node 20/22 and ubuntu/windows matrix.
.gitattributes	Enforce LF line endings for text files repo-wide.

[Copilot]

archiveOlderThan() loads all matching documents into memory at once (find(...).lean().exec()), which can be unbounded and cause high memory usage / long GC pauses on large collections. Consider processing in batches (e.g., paging by _id/timestamp with a fixed batch size) or using a cursor/stream so archival can run safely on large datasets.

Suggested change

	const documents = await this.model
	.find({ timestamp: { $lt: beforeDate } })
	.lean()
	.exec();
	if (documents.length === 0) {
	return 0;
	}
	const logs = documents.map((doc) => this.toPlainObject(doc));
	await this.archiveHandler(logs);
	return logs.length;
	const BATCH_SIZE = 1000;
	let totalArchived = 0;
	let batch: AuditLog[] = [];
	const cursor = this.model
	.find({ timestamp: { $lt: beforeDate } })
	.sort({ _id: 1 })
	.lean()
	.cursor({ batchSize: BATCH_SIZE });
	// Process logs in bounded batches to avoid loading all documents into memory at once.
	for await (const doc of cursor) {
	batch.push(this.toPlainObject(doc));
	if (batch.length >= BATCH_SIZE) {
	await this.archiveHandler(batch);
	totalArchived += batch.length;
	batch = [];
	}
	}
	if (batch.length > 0) {
	await this.archiveHandler(batch);
	totalArchived += batch.length;
	}
	return totalArchived;

[Copilot]

When idempotency returns an existing log, the method exits before calling notifyObserver(). This breaks the stated guarantee that the observer is called after each operation (success/failure), and it also means idempotent hits won't be observable. Consider notifying the observer before returning (e.g., with operation: "create", success: true, and meta indicating idempotentHit: true).

[Copilot]

idempotencyKey is introduced but isn't indexed (and sparse: true alone doesn't create an index). Since idempotency checks query by this field, missing an index will hurt query performance, and without a unique/partial unique index the current check-then-insert flow is not race-safe (concurrent requests can still create duplicates). Consider adding an index (ideally a unique sparse/partial index) for idempotencyKey and handling duplicate-key errors by fetching the existing record.

Suggested change

	type: String,
	type: String,
	index: true,
	unique: true,