@flipboxlabs/aws-audit-sdk 1.1.0

package/dist/schema/audit.d.ts

@@ -0,0 +1,202 @@
+import * as z from "zod/v4";
+/**
+ * Schema for fully-hydrated audit records retrieved from storage.
+ *
+ * Extends BaseSchema with timestamp fields that are transformed
+ * from ISO strings to Date objects for easier manipulation.
+ *
+ * This schema is used when reading audit records from DynamoDB,
+ * where timestamps are stored as ISO 8601 strings.
+ *
+ * @example
+ * ```typescript
+ * const audit = AuditSchema.parse({
+ *   id: 'audit-123',
+ *   operation: 'createUser',
+ *   status: 'success',
+ *   target: { app: 'MyApp', type: 'User', id: 'user-456' },
+ *   tier: 2,
+ *   updatedAt: '2024-01-15T10:30:00.000Z',
+ *   createdAt: '2024-01-15T10:30:00.000Z',
+ * });
+ *
+ * // audit.updatedAt is now a Date object
+ * console.log(audit.updatedAt?.toISOString());
+ * ```
+ */
+export declare const AuditSchema: z.ZodObject<{
+    updatedAt: z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<Date, string | Date>>;
+    createdAt: z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<Date, string | Date>>;
+    id: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<{
+        success: "success";
+        warn: "warn";
+        fail: "fail";
+        skip: "skip";
+    }>;
+    tier: z.ZodDefault<z.ZodNumber>;
+    target: z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>;
+    source: z.ZodOptional<z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<string | number | boolean | {
+        [key: string]: string | number | boolean | /*elided*/ any;
+    }, unknown, z.core.$ZodTypeInternals<string | number | boolean | {
+        [key: string]: string | number | boolean | /*elided*/ any;
+    }, unknown>>>>;
+    operation: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+    rerunable: z.ZodOptional<z.ZodBoolean>;
+    trace: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+        "detail-type": z.ZodOptional<z.ZodString>;
+        detail: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>]>>, z.ZodTransform<string | undefined, string | Record<string, any> | undefined>>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+    attempts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        number: z.ZodNumber;
+        status: z.ZodEnum<{
+            success: "success";
+            warn: "warn";
+            fail: "fail";
+            skip: "skip";
+        }>;
+        error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+        at: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<string, string | Date>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * Input type for AuditSchema.
+ *
+ * Accepts ISO 8601 datetime strings for timestamps.
+ */
+export type AuditInput = z.input<typeof AuditSchema>;
+/**
+ * Output type from AuditSchema.
+ *
+ * Timestamps are Date objects (or undefined).
+ */
+export type Audit = z.output<typeof AuditSchema>;
+/**
+ * Schema for audit payloads in API responses.
+ *
+ * Uses the base schema without timestamp transformation,
+ * suitable for JSON serialization in API responses.
+ */
+export declare const AuditPayloadSchema: z.ZodObject<{
+    id: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<{
+        success: "success";
+        warn: "warn";
+        fail: "fail";
+        skip: "skip";
+    }>;
+    tier: z.ZodDefault<z.ZodNumber>;
+    target: z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>;
+    source: z.ZodOptional<z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<string | number | boolean | {
+        [key: string]: string | number | boolean | /*elided*/ any;
+    }, unknown, z.core.$ZodTypeInternals<string | number | boolean | {
+        [key: string]: string | number | boolean | /*elided*/ any;
+    }, unknown>>>>;
+    operation: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+    rerunable: z.ZodOptional<z.ZodBoolean>;
+    trace: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+        "detail-type": z.ZodOptional<z.ZodString>;
+        detail: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>]>>, z.ZodTransform<string | undefined, string | Record<string, any> | undefined>>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+    attempts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        number: z.ZodNumber;
+        status: z.ZodEnum<{
+            success: "success";
+            warn: "warn";
+            fail: "fail";
+            skip: "skip";
+        }>;
+        error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+        at: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<string, string | Date>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * Output type for audit payloads.
+ */
+export type AuditPayload = z.output<typeof AuditPayloadSchema>;
+/**
+ * Schema for audit list item payloads.
+ *
+ * Same as AuditPayloadSchema, used for items in list responses
+ * where a lighter payload is sufficient.
+ */
+export declare const AuditListItemPayloadSchema: z.ZodObject<{
+    id: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<{
+        success: "success";
+        warn: "warn";
+        fail: "fail";
+        skip: "skip";
+    }>;
+    tier: z.ZodDefault<z.ZodNumber>;
+    target: z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>;
+    source: z.ZodOptional<z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<string | number | boolean | {
+        [key: string]: string | number | boolean | /*elided*/ any;
+    }, unknown, z.core.$ZodTypeInternals<string | number | boolean | {
+        [key: string]: string | number | boolean | /*elided*/ any;
+    }, unknown>>>>;
+    operation: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+    rerunable: z.ZodOptional<z.ZodBoolean>;
+    trace: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+        "detail-type": z.ZodOptional<z.ZodString>;
+        detail: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>]>>, z.ZodTransform<string | undefined, string | Record<string, any> | undefined>>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+    attempts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        number: z.ZodNumber;
+        status: z.ZodEnum<{
+            success: "success";
+            warn: "warn";
+            fail: "fail";
+            skip: "skip";
+        }>;
+        error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+        at: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<string, string | Date>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * Output type for audit list item payloads.
+ */
+export type AuditAuditListItemPayload = z.output<typeof AuditListItemPayloadSchema>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/schema/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/schema/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMtB,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAa,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAa,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAC/C,OAAO,0BAA0B,CACjC,CAAC"}

package/dist/schema/audit.js

@@ -0,0 +1,48 @@
+import * as z from "zod/v4";
+import { BaseSchema, DateTimeObjectSchema } from "./common.js";
+/**
+ * Schema for fully-hydrated audit records retrieved from storage.
+ *
+ * Extends BaseSchema with timestamp fields that are transformed
+ * from ISO strings to Date objects for easier manipulation.
+ *
+ * This schema is used when reading audit records from DynamoDB,
+ * where timestamps are stored as ISO 8601 strings.
+ *
+ * @example
+ * ```typescript
+ * const audit = AuditSchema.parse({
+ *   id: 'audit-123',
+ *   operation: 'createUser',
+ *   status: 'success',
+ *   target: { app: 'MyApp', type: 'User', id: 'user-456' },
+ *   tier: 2,
+ *   updatedAt: '2024-01-15T10:30:00.000Z',
+ *   createdAt: '2024-01-15T10:30:00.000Z',
+ * });
+ *
+ * // audit.updatedAt is now a Date object
+ * console.log(audit.updatedAt?.toISOString());
+ * ```
+ */
+export const AuditSchema = z.object({
+    ...BaseSchema.shape,
+    /** Last update timestamp - ISO string transformed to Date */
+    updatedAt: DateTimeObjectSchema,
+    /** Creation timestamp - ISO string transformed to Date */
+    createdAt: DateTimeObjectSchema,
+});
+/**
+ * Schema for audit payloads in API responses.
+ *
+ * Uses the base schema without timestamp transformation,
+ * suitable for JSON serialization in API responses.
+ */
+export const AuditPayloadSchema = BaseSchema;
+/**
+ * Schema for audit list item payloads.
+ *
+ * Same as AuditPayloadSchema, used for items in list responses
+ * where a lighter payload is sufficient.
+ */
+export const AuditListItemPayloadSchema = BaseSchema;

package/dist/schema/common.d.ts

@@ -0,0 +1,128 @@
+import * as z from "zod/v4";
+/**
+ * Escalation tiers for audit visibility
+ * - INTERNAL (1): Internal system audits, not shown to end users
+ * - INFO (2): Informational audits, shown in detailed views
+ * - PUBLIC (3): Public audits, shown in summary views
+ */
+export declare const Tier: {
+    readonly INTERNAL: 1;
+    readonly INFO: 2;
+    readonly PUBLIC: 3;
+};
+export type AnyTier = (typeof Tier)[keyof typeof Tier];
+/**
+ * Schema for audit status values (success, warn, fail, skip)
+ */
+export declare const StatusSchema: z.ZodEnum<{
+    success: "success";
+    warn: "warn";
+    fail: "fail";
+    skip: "skip";
+}>;
+/**
+ * Schema for referencing a resource within an application
+ * Used to identify the target or source of an audit
+ */
+declare const ResourceReferenceSchema: z.ZodObject<{
+    app: z.ZodString;
+    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    type: z.ZodString;
+}, z.core.$strip>;
+export type ResourceReference = z.output<typeof ResourceReferenceSchema>;
+/**
+ * Schema for additional related resources
+ * Extends ResourceReferenceSchema for linking secondary resources to an audit
+ */
+declare const AdditionalResourceSchema: z.ZodObject<{
+    app: z.ZodString;
+    type: z.ZodString;
+    id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+}, z.core.$strip>;
+export type AdditionalResource = z.output<typeof AdditionalResourceSchema>;
+/**
+ * Recursive type for context values
+ * Supports strings, numbers, booleans, and nested objects
+ */
+type ContextValue = string | number | boolean | {
+    [key: string]: ContextValue;
+};
+export declare const DateTimeObjectSchema: z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<Date, string | Date>>;
+/**
+ * Schema for datetime fields that accept ISO strings or Date objects.
+ * Transforms Date objects to ISO strings for storage compatibility.
+ *
+ * @example
+ * ```typescript
+ * DateTimeSchema.parse("2024-01-01T12:00:00.000Z"); // "2024-01-01T12:00:00.000Z"
+ * DateTimeSchema.parse(new Date()); // "2024-01-15T10:30:00.000Z"
+ * ```
+ */
+export declare const DateTimeStringSchema: z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<string, string | Date>>;
+/**
+ * Schema for tracking individual retry attempts
+ * Each attempt records the outcome and timing of a single execution
+ */
+export declare const AttemptSchema: z.ZodObject<{
+    number: z.ZodNumber;
+    status: z.ZodEnum<{
+        success: "success";
+        warn: "warn";
+        fail: "fail";
+        skip: "skip";
+    }>;
+    error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+    at: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<string, string | Date>>>;
+}, z.core.$strip>;
+export type Attempt = z.output<typeof AttemptSchema>;
+/**
+ * Base schema for audit records
+ * Internal use only within the schema directory - not exported from index
+ *
+ * @internal
+ */
+export declare const BaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<{
+        success: "success";
+        warn: "warn";
+        fail: "fail";
+        skip: "skip";
+    }>;
+    tier: z.ZodDefault<z.ZodNumber>;
+    target: z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>;
+    source: z.ZodOptional<z.ZodObject<{
+        app: z.ZodString;
+        id: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        type: z.ZodString;
+    }, z.core.$strip>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<ContextValue, unknown, z.core.$ZodTypeInternals<ContextValue, unknown>>>>;
+    operation: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+    rerunable: z.ZodOptional<z.ZodBoolean>;
+    trace: z.ZodOptional<z.ZodString>;
+    event: z.ZodOptional<z.ZodObject<{
+        source: z.ZodOptional<z.ZodString>;
+        "detail-type": z.ZodOptional<z.ZodString>;
+        detail: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>]>>, z.ZodTransform<string | undefined, string | Record<string, any> | undefined>>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+    attempts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        number: z.ZodNumber;
+        status: z.ZodEnum<{
+            success: "success";
+            warn: "warn";
+            fail: "fail";
+            skip: "skip";
+        }>;
+        error: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<any, string>>, z.ZodPipe<z.ZodCustom<Error, Error>, z.ZodTransform<any, Error>>, z.ZodRecord<z.ZodAny, z.ZodAny>]>>;
+        at: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodCustom<Date, Date>]>, z.ZodTransform<string, string | Date>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export {};
+//# sourceMappingURL=common.d.ts.map

package/dist/schema/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/schema/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;CAIP,CAAC;AACX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC;AAOvD;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;EAAgC,CAAC;AAc1D;;;GAGG;AACH,QAAA,MAAM,uBAAuB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEzE;;;GAGG;AACH,QAAA,MAAM,wBAAwB;;;;iBAE5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE3E;;;GAGG;AACH,KAAK,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAwChF,eAAO,MAAM,oBAAoB,kHAEE,CAAC;AAEpC;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,oHAEoC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;iBASxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BrB,CAAC"}

package/dist/schema/common.js

@@ -0,0 +1,148 @@
+import * as z from "zod/v4";
+import { Status } from "./log.js";
+import { EventBridgeEventSchema } from "./model.js";
+/**
+ * Escalation tiers for audit visibility
+ * - INTERNAL (1): Internal system audits, not shown to end users
+ * - INFO (2): Informational audits, shown in detailed views
+ * - PUBLIC (3): Public audits, shown in summary views
+ */
+export const Tier = {
+    INTERNAL: 1,
+    INFO: 2,
+    PUBLIC: 3,
+};
+/**
+ * Schema for escalation tier values (1-3)
+ */
+const TierSchema = z.number().int().gte(1).lte(3);
+/**
+ * Schema for audit status values (success, warn, fail, skip)
+ */
+export const StatusSchema = z.enum(Object.values(Status));
+/**
+ * Schema for application identifiers.
+ * Accepts any string; use config.schemas.app for strict validation.
+ */
+const AppSchema = z.string();
+/**
+ * Schema for resource type identifiers.
+ * Accepts any string; use config.schemas.resourceType for strict validation.
+ */
+const ResourceTypeSchema = z.string();
+/**
+ * Schema for referencing a resource within an application
+ * Used to identify the target or source of an audit
+ */
+const ResourceReferenceSchema = z.object({
+    app: AppSchema,
+    id: z.union([z.string(), z.number()]).optional(),
+    type: ResourceTypeSchema,
+});
+/**
+ * Schema for additional related resources
+ * Extends ResourceReferenceSchema for linking secondary resources to an audit
+ */
+const AdditionalResourceSchema = ResourceReferenceSchema.extend({
+    id: z.union([z.string(), z.number()]).optional(),
+});
+/**
+ * Schema for recursive context values
+ * Allows nested key-value structures for storing audit metadata
+ */
+const RecursiveContextValueSchema = z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.lazy(() => z.record(z.string(), RecursiveContextValueSchema)),
+]);
+/**
+ * Schema for audit context - a key-value store for additional metadata
+ */
+const ContextSchema = z.record(z.string(), RecursiveContextValueSchema);
+/**
+ * Schema for error details in audits and attempts.
+ * Handles string errors (with optional JSON parsing), Error instances, and plain objects.
+ */
+const ErrorSchema = z
+    .union([
+    z.string().transform((error) => {
+        try {
+            return JSON.parse(error);
+        }
+        catch {
+            return error;
+        }
+    }),
+    z
+        .instanceof(Error)
+        .transform((error) => JSON.parse(JSON.stringify(error, Object.getOwnPropertyNames(error)))),
+    z.record(z.any(), z.any()),
+])
+    .optional();
+export const DateTimeObjectSchema = z
+    .union([z.iso.datetime(), z.instanceof(Date)])
+    .transform((val) => new Date(val));
+/**
+ * Schema for datetime fields that accept ISO strings or Date objects.
+ * Transforms Date objects to ISO strings for storage compatibility.
+ *
+ * @example
+ * ```typescript
+ * DateTimeSchema.parse("2024-01-01T12:00:00.000Z"); // "2024-01-01T12:00:00.000Z"
+ * DateTimeSchema.parse(new Date()); // "2024-01-15T10:30:00.000Z"
+ * ```
+ */
+export const DateTimeStringSchema = z
+    .union([z.iso.datetime(), z.instanceof(Date)])
+    .transform((val) => (val instanceof Date ? val.toISOString() : val));
+/**
+ * Schema for tracking individual retry attempts
+ * Each attempt records the outcome and timing of a single execution
+ */
+export const AttemptSchema = z.object({
+    /** Sequential attempt number (1-indexed) */
+    number: z.number().int().min(1),
+    /** Outcome of this attempt */
+    status: StatusSchema,
+    /** Error details if the attempt failed */
+    error: ErrorSchema,
+    /** ISO timestamp when this attempt occurred */
+    at: DateTimeStringSchema.default(() => new Date().toISOString()),
+});
+/**
+ * Base schema for audit records
+ * Internal use only within the schema directory - not exported from index
+ *
+ * @internal
+ */
+export const BaseSchema = z.object({
+    /** Unique identifier for the audit record */
+    id: z.string(),
+    /** Tenant identifier for multi-tenancy support (optional) */
+    tenantId: z.string().optional(),
+    /** Current status of the audited operation */
+    status: StatusSchema,
+    /** Escalation tier for visibility (defaults to INFO) */
+    tier: TierSchema.default(2),
+    /** The primary resource being audited */
+    target: ResourceReferenceSchema,
+    /** The resource that initiated the operation (optional) */
+    source: ResourceReferenceSchema.optional(),
+    /** Additional metadata as key-value pairs */
+    context: ContextSchema.optional(),
+    /** Name of the operation being audited */
+    operation: z.string(),
+    /** Human-readable description of the audit */
+    message: z.string().optional(),
+    /** Whether this audit can be re-run/retried */
+    rerunable: z.boolean().optional(),
+    /** Trace identifier for distributed tracing */
+    trace: z.string().optional(),
+    /** Original EventBridge event that triggered this audit */
+    event: EventBridgeEventSchema.optional(),
+    /** Error details if the operation failed */
+    error: ErrorSchema,
+    /** History of all execution attempts for retry tracking */
+    attempts: z.array(AttemptSchema).optional(),
+});

package/dist/schema/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Schema module barrel file.
+ *
+ * Re-exports all schema definitions, types, and validation utilities
+ * for use throughout the audit SDK.
+ *
+ * @module schema
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   AuditSchema,
+ *   createTypedLogAuditSchema,
+ *   Status,
+ *   Tier,
+ *   type Audit,
+ *   type LogAuditInput,
+ * } from '@flipboxlabs/aws-audit-sdk/schema';
+ * ```
+ */
+export * from "./audit.js";
+export { type AdditionalResource, type AnyTier, type ResourceReference, Tier, } from "./common.js";
+export { type AnyStatus, createTypedLogAuditSchema, type LogAuditInput, Status, } from "./log.js";
+export * from "./model.js";
+export * from "./service.js";
+export * from "./storage.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,GACJ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,SAAS,EACd,yBAAyB,EACzB,KAAK,aAAa,EAClB,MAAM,GACN,MAAM,UAAU,CAAC;AAClB,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/schema/index.js

@@ -0,0 +1,26 @@
+/**
+ * Schema module barrel file.
+ *
+ * Re-exports all schema definitions, types, and validation utilities
+ * for use throughout the audit SDK.
+ *
+ * @module schema
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   AuditSchema,
+ *   createTypedLogAuditSchema,
+ *   Status,
+ *   Tier,
+ *   type Audit,
+ *   type LogAuditInput,
+ * } from '@flipboxlabs/aws-audit-sdk/schema';
+ * ```
+ */
+export * from "./audit.js";
+export { Tier, } from "./common.js";
+export { createTypedLogAuditSchema, Status, } from "./log.js";
+export * from "./model.js";
+export * from "./service.js";
+export * from "./storage.js";