@agentplat/audit 0.2.0-beta.2 → 0.2.0-beta.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/dist/index.d.ts +35 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +58 -0
- package/dist/index.js.map +1 -1
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -5,3 +5,7 @@ Audit contracts and redaction helpers for AgentPlat.
|
|
|
5
5
|
This package defines audit records, sinks and utility helpers for redacting sensitive details before records are stored, emitted or shared with operational systems.
|
|
6
6
|
|
|
7
7
|
`InMemoryAuditSink` recursively redacts credential-like fields before retaining records.
|
|
8
|
+
|
|
9
|
+
`createSessionAuditSink` adapts public `SessionEventRecord` values into
|
|
10
|
+
redacted append-only audit records. It is appropriate for observable ephemeral
|
|
11
|
+
sessions; use Agent Rooms when approvals and durable work lifecycle are needed.
|
package/dist/index.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { AgentPlatID, ISODateTime, JsonObject, ResourceRef, TenantScoped } from '@agentplat/core';
|
|
2
|
+
import type { SessionEventRecord, SessionEventSink } from '@agentplat/sessions';
|
|
2
3
|
export interface AuditRecord extends TenantScoped {
|
|
3
4
|
id: AgentPlatID;
|
|
4
5
|
actorId?: AgentPlatID;
|
|
@@ -13,6 +14,13 @@ export interface AuditRecord extends TenantScoped {
|
|
|
13
14
|
export interface AuditSink {
|
|
14
15
|
write(record: AuditRecord): Promise<void>;
|
|
15
16
|
}
|
|
17
|
+
/** Options for adapting an Agent Room-style audit sink to ephemeral sessions. */
|
|
18
|
+
export interface SessionAuditSinkOptions {
|
|
19
|
+
audit: AuditSink;
|
|
20
|
+
actorId?: AgentPlatID;
|
|
21
|
+
actorType?: 'human' | 'machine' | 'system';
|
|
22
|
+
actionPrefix?: string;
|
|
23
|
+
}
|
|
16
24
|
export declare function redactAuditDetails<T extends JsonObject>(details: T): T;
|
|
17
25
|
export declare class InMemoryAuditSink implements AuditSink {
|
|
18
26
|
private readonly records;
|
|
@@ -20,4 +28,31 @@ export declare class InMemoryAuditSink implements AuditSink {
|
|
|
20
28
|
list(tenantId?: AgentPlatID): AuditRecord[];
|
|
21
29
|
clear(): void;
|
|
22
30
|
}
|
|
31
|
+
/** Create an inspectable, redacting audit sink for local development and tests. */
|
|
32
|
+
export declare function createMemoryAuditSink(): InMemoryAuditSink;
|
|
33
|
+
/** Minimal log surface accepted by the development console audit sink. */
|
|
34
|
+
export interface AuditLogger {
|
|
35
|
+
info(record: AuditRecord): void;
|
|
36
|
+
}
|
|
37
|
+
/** Writes already-redacted audit records to a supplied development logger. */
|
|
38
|
+
export declare class ConsoleAuditSink implements AuditSink {
|
|
39
|
+
private readonly logger;
|
|
40
|
+
constructor(logger?: AuditLogger);
|
|
41
|
+
write(record: AuditRecord): Promise<void>;
|
|
42
|
+
}
|
|
43
|
+
/** Create a redacting console sink for local development only. */
|
|
44
|
+
export declare function createConsoleAuditSink(logger?: AuditLogger): ConsoleAuditSink;
|
|
45
|
+
/**
|
|
46
|
+
* Converts append-only session event records into redacted AuditRecords.
|
|
47
|
+
*
|
|
48
|
+
* The adapter is observational: use a session sink with `sinkFailureMode:
|
|
49
|
+
* 'required'` when a caller must fail rather than continue without a trail.
|
|
50
|
+
*/
|
|
51
|
+
export declare class SessionAuditSink implements SessionEventSink {
|
|
52
|
+
private readonly options;
|
|
53
|
+
constructor(options: SessionAuditSinkOptions);
|
|
54
|
+
append(record: SessionEventRecord): Promise<void>;
|
|
55
|
+
}
|
|
56
|
+
/** Create a redacting `SessionEventSink` from any public audit sink. */
|
|
57
|
+
export declare function createSessionAuditSink(options: SessionAuditSinkOptions): SessionAuditSink;
|
|
23
58
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,UAAU,EAEV,WAAW,EACX,YAAY,EACb,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,UAAU,EAEV,WAAW,EACX,YAAY,EACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEhF,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,EAAE,EAAE,WAAW,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAQtE;AAYD,qBAAa,iBAAkB,YAAW,SAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAEvC,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE;IAM3C,KAAK,IAAI,IAAI;CAGd;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,IAAI,iBAAiB,CAEzD;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC;AAED,8EAA8E;AAC9E,qBAAa,gBAAiB,YAAW,SAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,GAAE,WAAqB;IAEpD,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhD;AAED,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAE7E;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,gBAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,uBAAuB;IAEvD,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqBxD;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAElB"}
|
package/dist/index.js
CHANGED
|
@@ -32,4 +32,62 @@ export class InMemoryAuditSink {
|
|
|
32
32
|
this.records.length = 0;
|
|
33
33
|
}
|
|
34
34
|
}
|
|
35
|
+
/** Create an inspectable, redacting audit sink for local development and tests. */
|
|
36
|
+
export function createMemoryAuditSink() {
|
|
37
|
+
return new InMemoryAuditSink();
|
|
38
|
+
}
|
|
39
|
+
/** Writes already-redacted audit records to a supplied development logger. */
|
|
40
|
+
export class ConsoleAuditSink {
|
|
41
|
+
logger;
|
|
42
|
+
constructor(logger = console) {
|
|
43
|
+
this.logger = logger;
|
|
44
|
+
}
|
|
45
|
+
async write(record) {
|
|
46
|
+
this.logger.info({
|
|
47
|
+
...record,
|
|
48
|
+
details: record.details ? redactAuditDetails(record.details) : undefined,
|
|
49
|
+
});
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
/** Create a redacting console sink for local development only. */
|
|
53
|
+
export function createConsoleAuditSink(logger) {
|
|
54
|
+
return new ConsoleAuditSink(logger);
|
|
55
|
+
}
|
|
56
|
+
/**
|
|
57
|
+
* Converts append-only session event records into redacted AuditRecords.
|
|
58
|
+
*
|
|
59
|
+
* The adapter is observational: use a session sink with `sinkFailureMode:
|
|
60
|
+
* 'required'` when a caller must fail rather than continue without a trail.
|
|
61
|
+
*/
|
|
62
|
+
export class SessionAuditSink {
|
|
63
|
+
options;
|
|
64
|
+
constructor(options) {
|
|
65
|
+
this.options = options;
|
|
66
|
+
}
|
|
67
|
+
async append(record) {
|
|
68
|
+
const actionPrefix = this.options.actionPrefix?.trim() || 'session';
|
|
69
|
+
await this.options.audit.write({
|
|
70
|
+
id: record.eventId,
|
|
71
|
+
tenantId: record.tenantId,
|
|
72
|
+
actorId: this.options.actorId,
|
|
73
|
+
actorType: this.options.actorType ?? 'system',
|
|
74
|
+
action: `${actionPrefix}.${record.event.type}`,
|
|
75
|
+
resource: {
|
|
76
|
+
type: 'agent_session',
|
|
77
|
+
id: record.sessionId,
|
|
78
|
+
tenantId: record.tenantId,
|
|
79
|
+
},
|
|
80
|
+
details: redactAuditDetails({
|
|
81
|
+
sequence: record.sequence,
|
|
82
|
+
occurredAt: record.occurredAt,
|
|
83
|
+
event: record.event,
|
|
84
|
+
}),
|
|
85
|
+
createdAt: record.occurredAt,
|
|
86
|
+
});
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
/** Create a redacting `SessionEventSink` from any public audit sink. */
|
|
90
|
+
export function createSessionAuditSink(options) {
|
|
91
|
+
return new SessionAuditSink(options);
|
|
92
|
+
}
|
|
35
93
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkCA,MAAM,gBAAgB,GAAG,mDAAmD,CAAC;AAE7E,MAAM,UAAU,kBAAkB,CAAuB,OAAU;IACjE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,KAAgB;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,OAAO,GAAkB,EAAE,CAAC;IAE7C,KAAK,CAAC,KAAK,CAAC,MAAmB;QAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACzE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAsB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC;AAOD,8EAA8E;AAC9E,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,SAAsB,OAAO;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAE9D,KAAK,CAAC,KAAK,CAAC,MAAmB;QAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACzE,CAAC,CAAC;IACL,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IAAG,CAAC;IAEjE,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACpE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,OAAO;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ;YAC7C,MAAM,EAAE,GAAG,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YAC9C,QAAQ,EAAE;gBACR,IAAI,EAAE,eAAe;gBACrB,EAAE,EAAE,MAAM,CAAC,SAAS;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;YACD,OAAO,EAAE,kBAAkB,CAAC;gBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAA8B;aAC7C,CAAC;YACF,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agentplat/audit",
|
|
3
|
-
"version": "0.2.0-beta.
|
|
3
|
+
"version": "0.2.0-beta.7",
|
|
4
4
|
"description": "Audit contracts, recursive redaction and an in-memory sink for AgentPlat.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -18,7 +18,8 @@
|
|
|
18
18
|
"README.md"
|
|
19
19
|
],
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@agentplat/core": "^0.2.0-beta.
|
|
21
|
+
"@agentplat/core": "^0.2.0-beta.7",
|
|
22
|
+
"@agentplat/sessions": "^0.2.0-beta.7"
|
|
22
23
|
},
|
|
23
24
|
"publishConfig": {
|
|
24
25
|
"access": "public"
|