@agentplat/audit 0.2.0-beta.2 → 0.2.0-beta.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/dist/index.d.ts +21 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +37 -0
- package/dist/index.js.map +1 -1
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -5,3 +5,7 @@ Audit contracts and redaction helpers for AgentPlat.
|
|
|
5
5
|
This package defines audit records, sinks and utility helpers for redacting sensitive details before records are stored, emitted or shared with operational systems.
|
|
6
6
|
|
|
7
7
|
`InMemoryAuditSink` recursively redacts credential-like fields before retaining records.
|
|
8
|
+
|
|
9
|
+
`createSessionAuditSink` adapts public `SessionEventRecord` values into
|
|
10
|
+
redacted append-only audit records. It is appropriate for observable ephemeral
|
|
11
|
+
sessions; use Agent Rooms when approvals and durable work lifecycle are needed.
|
package/dist/index.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { AgentPlatID, ISODateTime, JsonObject, ResourceRef, TenantScoped } from '@agentplat/core';
|
|
2
|
+
import type { SessionEventRecord, SessionEventSink } from '@agentplat/sessions';
|
|
2
3
|
export interface AuditRecord extends TenantScoped {
|
|
3
4
|
id: AgentPlatID;
|
|
4
5
|
actorId?: AgentPlatID;
|
|
@@ -13,6 +14,13 @@ export interface AuditRecord extends TenantScoped {
|
|
|
13
14
|
export interface AuditSink {
|
|
14
15
|
write(record: AuditRecord): Promise<void>;
|
|
15
16
|
}
|
|
17
|
+
/** Options for adapting an Agent Room-style audit sink to ephemeral sessions. */
|
|
18
|
+
export interface SessionAuditSinkOptions {
|
|
19
|
+
audit: AuditSink;
|
|
20
|
+
actorId?: AgentPlatID;
|
|
21
|
+
actorType?: 'human' | 'machine' | 'system';
|
|
22
|
+
actionPrefix?: string;
|
|
23
|
+
}
|
|
16
24
|
export declare function redactAuditDetails<T extends JsonObject>(details: T): T;
|
|
17
25
|
export declare class InMemoryAuditSink implements AuditSink {
|
|
18
26
|
private readonly records;
|
|
@@ -20,4 +28,17 @@ export declare class InMemoryAuditSink implements AuditSink {
|
|
|
20
28
|
list(tenantId?: AgentPlatID): AuditRecord[];
|
|
21
29
|
clear(): void;
|
|
22
30
|
}
|
|
31
|
+
/**
|
|
32
|
+
* Converts append-only session event records into redacted AuditRecords.
|
|
33
|
+
*
|
|
34
|
+
* The adapter is observational: use a session sink with `sinkFailureMode:
|
|
35
|
+
* 'required'` when a caller must fail rather than continue without a trail.
|
|
36
|
+
*/
|
|
37
|
+
export declare class SessionAuditSink implements SessionEventSink {
|
|
38
|
+
private readonly options;
|
|
39
|
+
constructor(options: SessionAuditSinkOptions);
|
|
40
|
+
append(record: SessionEventRecord): Promise<void>;
|
|
41
|
+
}
|
|
42
|
+
/** Create a redacting `SessionEventSink` from any public audit sink. */
|
|
43
|
+
export declare function createSessionAuditSink(options: SessionAuditSinkOptions): SessionAuditSink;
|
|
23
44
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,UAAU,EAEV,WAAW,EACX,YAAY,EACb,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,UAAU,EAEV,WAAW,EACX,YAAY,EACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,EAAE,EAAE,WAAW,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAQtE;AAYD,qBAAa,iBAAkB,YAAW,SAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAEvC,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE;IAM3C,KAAK,IAAI,IAAI;CAGd;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,gBAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,uBAAuB;IAEvD,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqBxD;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAElB"}
|
package/dist/index.js
CHANGED
|
@@ -32,4 +32,41 @@ export class InMemoryAuditSink {
|
|
|
32
32
|
this.records.length = 0;
|
|
33
33
|
}
|
|
34
34
|
}
|
|
35
|
+
/**
|
|
36
|
+
* Converts append-only session event records into redacted AuditRecords.
|
|
37
|
+
*
|
|
38
|
+
* The adapter is observational: use a session sink with `sinkFailureMode:
|
|
39
|
+
* 'required'` when a caller must fail rather than continue without a trail.
|
|
40
|
+
*/
|
|
41
|
+
export class SessionAuditSink {
|
|
42
|
+
options;
|
|
43
|
+
constructor(options) {
|
|
44
|
+
this.options = options;
|
|
45
|
+
}
|
|
46
|
+
async append(record) {
|
|
47
|
+
const actionPrefix = this.options.actionPrefix?.trim() || 'session';
|
|
48
|
+
await this.options.audit.write({
|
|
49
|
+
id: record.eventId,
|
|
50
|
+
tenantId: record.tenantId,
|
|
51
|
+
actorId: this.options.actorId,
|
|
52
|
+
actorType: this.options.actorType ?? 'system',
|
|
53
|
+
action: `${actionPrefix}.${record.event.type}`,
|
|
54
|
+
resource: {
|
|
55
|
+
type: 'agent_session',
|
|
56
|
+
id: record.sessionId,
|
|
57
|
+
tenantId: record.tenantId,
|
|
58
|
+
},
|
|
59
|
+
details: redactAuditDetails({
|
|
60
|
+
sequence: record.sequence,
|
|
61
|
+
occurredAt: record.occurredAt,
|
|
62
|
+
event: record.event,
|
|
63
|
+
}),
|
|
64
|
+
createdAt: record.occurredAt,
|
|
65
|
+
});
|
|
66
|
+
}
|
|
67
|
+
}
|
|
68
|
+
/** Create a redacting `SessionEventSink` from any public audit sink. */
|
|
69
|
+
export function createSessionAuditSink(options) {
|
|
70
|
+
return new SessionAuditSink(options);
|
|
71
|
+
}
|
|
35
72
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkCA,MAAM,gBAAgB,GAAG,mDAAmD,CAAC;AAE7E,MAAM,UAAU,kBAAkB,CAAuB,OAAU;IACjE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,KAAgB;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,OAAO,GAAkB,EAAE,CAAC;IAE7C,KAAK,CAAC,KAAK,CAAC,MAAmB;QAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACzE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAsB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACpE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,OAAO;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ;YAC7C,MAAM,EAAE,GAAG,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YAC9C,QAAQ,EAAE;gBACR,IAAI,EAAE,eAAe;gBACrB,EAAE,EAAE,MAAM,CAAC,SAAS;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;YACD,OAAO,EAAE,kBAAkB,CAAC;gBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAA8B;aAC7C,CAAC;YACF,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agentplat/audit",
|
|
3
|
-
"version": "0.2.0-beta.
|
|
3
|
+
"version": "0.2.0-beta.6",
|
|
4
4
|
"description": "Audit contracts, recursive redaction and an in-memory sink for AgentPlat.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -18,7 +18,8 @@
|
|
|
18
18
|
"README.md"
|
|
19
19
|
],
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@agentplat/core": "^0.2.0-beta.
|
|
21
|
+
"@agentplat/core": "^0.2.0-beta.6",
|
|
22
|
+
"@agentplat/sessions": "^0.2.0-beta.6"
|
|
22
23
|
},
|
|
23
24
|
"publishConfig": {
|
|
24
25
|
"access": "public"
|