@keynv/core 0.1.0-rc.23

package/dist/audit/payload-schemas.d.ts

@@ -0,0 +1,343 @@
+/**
+ * Per-event-type payload schemas. The audit pipeline validates every
+ * payload against the schema for its event_type before hashing — this
+ * closes audit finding H2 (no schema → non-JSON values could hash
+ * deterministically without round-tripping through JSON.parse).
+ *
+ * Every schema is `.strict()` so unknown keys are rejected at compile
+ * time, not silently dropped or hashed. Adding a new event type
+ * requires extending this map; the type system enforces it.
+ */
+import { z } from 'zod';
+import type { AuditEventType } from './types.js';
+export declare const PAYLOAD_SCHEMAS: {
+    readonly 'auth.register': z.ZodObject<{
+        email: z.ZodString;
+        org_id: z.ZodString;
+        org_name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        email: string;
+        org_id: string;
+        org_name: string;
+    }, {
+        email: string;
+        org_id: string;
+        org_name: string;
+    }>;
+    readonly 'auth.login.allowed': z.ZodObject<{
+        email: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        email: string;
+    }, {
+        email: string;
+    }>;
+    readonly 'auth.login.denied': z.ZodObject<{
+        email: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        email: string;
+    }, {
+        email: string;
+    }>;
+    readonly 'auth.logout': z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+    readonly 'auth.refresh': z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+    readonly 'auth.password_change.allowed': z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+    readonly 'auth.password_change.denied': z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+    readonly 'cli_token.created': z.ZodObject<{
+        token_id: z.ZodString;
+        name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        token_id: string;
+        name: string;
+    }, {
+        token_id: string;
+        name: string;
+    }>;
+    readonly 'cli_token.revoked': z.ZodObject<{
+        token_id: z.ZodString;
+        name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        token_id: string;
+        name: string;
+    }, {
+        token_id: string;
+        name: string;
+    }>;
+    readonly 'user.invited': z.ZodObject<{
+        target_user_id: z.ZodString;
+        email: z.ZodString;
+        org_role: z.ZodEnum<["owner", "admin", "developer", "reader"]>;
+        org_id: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        email: string;
+        org_id: string;
+        target_user_id: string;
+        org_role: "developer" | "reader" | "owner" | "admin";
+    }, {
+        email: string;
+        org_id: string;
+        target_user_id: string;
+        org_role: "developer" | "reader" | "owner" | "admin";
+    }>;
+    readonly 'user.removed': z.ZodObject<{
+        target_user_id: z.ZodString;
+        email: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        email: string;
+        target_user_id: string;
+    }, {
+        email: string;
+        target_user_id: string;
+    }>;
+    readonly 'user.role_changed': z.ZodObject<{
+        target_user_id: z.ZodString;
+        org_role: z.ZodEnum<["owner", "admin", "developer", "reader"]>;
+    }, "strict", z.ZodTypeAny, {
+        target_user_id: string;
+        org_role: "developer" | "reader" | "owner" | "admin";
+    }, {
+        target_user_id: string;
+        org_role: "developer" | "reader" | "owner" | "admin";
+    }>;
+    readonly 'project.created': z.ZodObject<{
+        project_id: z.ZodString;
+        name: z.ZodString;
+        environments: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        project_id: string;
+        environments: string[];
+    }, {
+        name: string;
+        project_id: string;
+        environments: string[];
+    }>;
+    readonly 'project.deleted': z.ZodObject<{
+        project_id: z.ZodString;
+        name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        project_id: string;
+    }, {
+        name: string;
+        project_id: string;
+    }>;
+    readonly 'project.dek_rotated': z.ZodObject<{
+        project_id: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        project_id: string;
+    }, {
+        project_id: string;
+    }>;
+    readonly 'environment.created': z.ZodObject<{
+        project_id: z.ZodString;
+        environment: z.ZodString;
+        tier: z.ZodEnum<["production", "non-production"]>;
+        require_approval: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        environment: string;
+        project_id: string;
+        tier: "production" | "non-production";
+        require_approval: boolean;
+    }, {
+        environment: string;
+        project_id: string;
+        tier: "production" | "non-production";
+        require_approval: boolean;
+    }>;
+    readonly 'member.added': z.ZodObject<{
+        project_id: z.ZodString;
+        target_user_id: z.ZodString;
+        role: z.ZodEnum<["lead", "developer", "reader"]>;
+    }, "strict", z.ZodTypeAny, {
+        target_user_id: string;
+        project_id: string;
+        role: "lead" | "developer" | "reader";
+    }, {
+        target_user_id: string;
+        project_id: string;
+        role: "lead" | "developer" | "reader";
+    }>;
+    readonly 'member.removed': z.ZodObject<{
+        project_id: z.ZodString;
+        target_user_id: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        target_user_id: string;
+        project_id: string;
+    }, {
+        target_user_id: string;
+        project_id: string;
+    }>;
+    readonly 'member.role_changed': z.ZodObject<{
+        project_id: z.ZodString;
+        target_user_id: z.ZodString;
+        role: z.ZodEnum<["lead", "developer", "reader"]>;
+    }, "strict", z.ZodTypeAny, {
+        target_user_id: string;
+        project_id: string;
+        role: "lead" | "developer" | "reader";
+    }, {
+        target_user_id: string;
+        project_id: string;
+        role: "lead" | "developer" | "reader";
+    }>;
+    readonly 'secret.created': z.ZodObject<{
+        project_id: z.ZodString;
+        env: z.ZodString;
+        key: z.ZodString;
+        version: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        key: string;
+        project_id: string;
+        env: string;
+        version: number;
+    }, {
+        key: string;
+        project_id: string;
+        env: string;
+        version: number;
+    }>;
+    readonly 'secret.read.allowed': z.ZodObject<{
+        alias: z.ZodString;
+        version: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        version: number;
+        alias: string;
+    }, {
+        version: number;
+        alias: string;
+    }>;
+    readonly 'secret.read.denied': z.ZodObject<{
+        alias: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        alias: string;
+    }, {
+        alias: string;
+    }>;
+    readonly 'secret.rotated': z.ZodObject<{
+        project_id: z.ZodString;
+        env: z.ZodString;
+        key: z.ZodString;
+        from_version: z.ZodNumber;
+        to_version: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        key: string;
+        project_id: string;
+        env: string;
+        from_version: number;
+        to_version: number;
+    }, {
+        key: string;
+        project_id: string;
+        env: string;
+        from_version: number;
+        to_version: number;
+    }>;
+    readonly 'secret.deleted': z.ZodObject<{
+        project_id: z.ZodString;
+        env: z.ZodString;
+        key: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        key: string;
+        project_id: string;
+        env: string;
+    }, {
+        key: string;
+        project_id: string;
+        env: string;
+    }>;
+    readonly 'secret.test.invoked': z.ZodObject<{
+        alias: z.ZodString;
+        tester: z.ZodString;
+        ok: z.ZodBoolean;
+        latency_ms: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        alias: string;
+        tester: string;
+        ok: boolean;
+        latency_ms: number;
+    }, {
+        alias: string;
+        tester: string;
+        ok: boolean;
+        latency_ms: number;
+    }>;
+    readonly 'secret.test.denied': z.ZodObject<{
+        alias: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        alias: string;
+    }, {
+        alias: string;
+    }>;
+    readonly 'rotation.policy_changed': z.ZodObject<{
+        project_id: z.ZodString;
+        env: z.ZodString;
+        key: z.ZodString;
+        interval_days: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        key: string;
+        project_id: string;
+        env: string;
+        interval_days?: number | undefined;
+    }, {
+        key: string;
+        project_id: string;
+        env: string;
+        interval_days?: number | undefined;
+    }>;
+    readonly 'approval.requested': z.ZodObject<{
+        alias: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        alias: string;
+    }, {
+        alias: string;
+    }>;
+    readonly 'approval.granted': z.ZodObject<{
+        alias: z.ZodString;
+        granted_by: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        alias: string;
+        granted_by: string;
+    }, {
+        alias: string;
+        granted_by: string;
+    }>;
+    readonly 'approval.denied': z.ZodObject<{
+        alias: z.ZodString;
+        denied_by: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        alias: string;
+        denied_by: string;
+    }, {
+        alias: string;
+        denied_by: string;
+    }>;
+    readonly 'org.created': z.ZodObject<{
+        org_id: z.ZodString;
+        name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        org_id: string;
+        name: string;
+    }, {
+        org_id: string;
+        name: string;
+    }>;
+    readonly 'org.updated': z.ZodObject<{
+        org_id: z.ZodString;
+        name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        org_id: string;
+        name: string;
+    }, {
+        org_id: string;
+        name: string;
+    }>;
+};
+/**
+ * Validates a payload for the given event type. Returns the parsed
+ * (typed) value on success; throws on mismatch — invalid audit
+ * payloads are programmer errors and should fail loudly so the
+ * triggering route returns 500 rather than recording a malformed
+ * chain entry.
+ */
+export declare function validateAuditPayload(eventType: AuditEventType, payload: unknown): Record<string, unknown>;
+//# sourceMappingURL=payload-schemas.d.ts.map

package/dist/audit/payload-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-schemas.d.ts","sourceRoot":"","sources":["../../src/audit/payload-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAejD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuEmD,CAAC;AAEhF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB"}

package/dist/audit/payload-schemas.js

@@ -0,0 +1,112 @@
+/**
+ * Per-event-type payload schemas. The audit pipeline validates every
+ * payload against the schema for its event_type before hashing — this
+ * closes audit finding H2 (no schema → non-JSON values could hash
+ * deterministically without round-tripping through JSON.parse).
+ *
+ * Every schema is `.strict()` so unknown keys are rejected at compile
+ * time, not silently dropped or hashed. Adding a new event type
+ * requires extending this map; the type system enforces it.
+ */
+import { z } from 'zod';
+const projectId = z.string().min(1);
+const userId = z.string().min(1);
+const alias = z.string().min(1);
+const env = z.string().min(1);
+const key = z.string().min(1);
+const role = z.enum(['lead', 'developer', 'reader']);
+const orgRole = z.enum(['owner', 'admin', 'developer', 'reader']);
+const email = z.string().email();
+const version = z.coerce.number().int().positive();
+const empty = z.object({}).strict();
+const orgId = z.string().min(1);
+export const PAYLOAD_SCHEMAS = {
+    'auth.register': z
+        .object({
+        email,
+        org_id: orgId,
+        org_name: z.string().min(1),
+    })
+        .strict(),
+    'auth.login.allowed': z.object({ email }).strict(),
+    'auth.login.denied': z.object({ email }).strict(),
+    'auth.logout': empty,
+    'auth.refresh': empty,
+    'auth.password_change.allowed': empty,
+    'auth.password_change.denied': empty,
+    'cli_token.created': z.object({ token_id: z.string().min(1), name: z.string().min(1) }).strict(),
+    'cli_token.revoked': z.object({ token_id: z.string().min(1), name: z.string().min(1) }).strict(),
+    'user.invited': z
+        .object({ target_user_id: userId, email, org_role: orgRole, org_id: orgId })
+        .strict(),
+    'user.removed': z.object({ target_user_id: userId, email }).strict(),
+    'user.role_changed': z.object({ target_user_id: userId, org_role: orgRole }).strict(),
+    'project.created': z
+        .object({
+        project_id: projectId,
+        name: z.string().min(1),
+        environments: z.array(z.string().min(1)),
+    })
+        .strict(),
+    'project.deleted': z.object({ project_id: projectId, name: z.string() }).strict(),
+    'project.dek_rotated': z.object({ project_id: projectId }).strict(),
+    'environment.created': z
+        .object({
+        project_id: projectId,
+        environment: z.string().min(1),
+        tier: z.enum(['production', 'non-production']),
+        require_approval: z.boolean(),
+    })
+        .strict(),
+    'member.added': z.object({ project_id: projectId, target_user_id: userId, role }).strict(),
+    'member.removed': z.object({ project_id: projectId, target_user_id: userId }).strict(),
+    'member.role_changed': z.object({ project_id: projectId, target_user_id: userId, role }).strict(),
+    'secret.created': z.object({ project_id: projectId, env, key, version }).strict(),
+    'secret.read.allowed': z.object({ alias, version }).strict(),
+    'secret.read.denied': z.object({ alias }).strict(),
+    'secret.rotated': z
+        .object({
+        project_id: projectId,
+        env,
+        key,
+        from_version: version,
+        to_version: version,
+    })
+        .strict(),
+    'secret.deleted': z.object({ project_id: projectId, env, key }).strict(),
+    'secret.test.invoked': z
+        .object({ alias, tester: z.string(), ok: z.boolean(), latency_ms: z.number() })
+        .strict(),
+    'secret.test.denied': z.object({ alias }).strict(),
+    'rotation.policy_changed': z
+        .object({
+        project_id: projectId,
+        env,
+        key,
+        interval_days: z.number().optional(),
+    })
+        .strict(),
+    'approval.requested': z.object({ alias }).strict(),
+    'approval.granted': z.object({ alias, granted_by: userId }).strict(),
+    'approval.denied': z.object({ alias, denied_by: userId }).strict(),
+    'org.created': z.object({ org_id: orgId, name: z.string().min(1) }).strict(),
+    'org.updated': z.object({ org_id: orgId, name: z.string().min(1) }).strict(),
+};
+/**
+ * Validates a payload for the given event type. Returns the parsed
+ * (typed) value on success; throws on mismatch — invalid audit
+ * payloads are programmer errors and should fail loudly so the
+ * triggering route returns 500 rather than recording a malformed
+ * chain entry.
+ */
+export function validateAuditPayload(eventType, payload) {
+    const schema = PAYLOAD_SCHEMAS[eventType];
+    const result = schema.safeParse(payload);
+    if (!result.success) {
+        throw new Error(`audit payload validation failed for '${eventType}': ${result.error.issues
+            .map((i) => `${i.path.join('.') || '<root>'}: ${i.message}`)
+            .join('; ')}`);
+    }
+    return result.data;
+}
+//# sourceMappingURL=payload-schemas.js.map

package/dist/audit/payload-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-schemas.js","sourceRoot":"","sources":["../../src/audit/payload-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;AACjC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEnD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACpC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,KAAK;QACL,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC;SACD,MAAM,EAAE;IACX,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjD,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE,KAAK;IACrB,8BAA8B,EAAE,KAAK;IACrC,6BAA6B,EAAE,KAAK;IACpC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAChG,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAChG,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SAC3E,MAAM,EAAE;IACX,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACpE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACrF,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,MAAM,EAAE;IACX,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACjF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACnE,qBAAqB,EAAE,CAAC;SACrB,MAAM,CAAC;QACN,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAC9C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;KAC9B,CAAC;SACD,MAAM,EAAE;IACX,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1F,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IACtF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IACjG,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACjF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5D,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAClD,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,UAAU,EAAE,SAAS;QACrB,GAAG;QACH,GAAG;QACH,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,OAAO;KACpB,CAAC;SACD,MAAM,EAAE;IACX,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACxE,qBAAqB,EAAE,CAAC;SACrB,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SAC9E,MAAM,EAAE;IACX,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAClD,yBAAyB,EAAE,CAAC;SACzB,MAAM,CAAC;QACN,UAAU,EAAE,SAAS;QACrB,GAAG;QACH,GAAG;QACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;SACD,MAAM,EAAE;IACX,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IACpE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACC,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAyB,EACzB,OAAgB;IAEhB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,wCAAwC,SAAS,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAA+B,CAAC;AAChD,CAAC"}

package/dist/audit/payload-schemas.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=payload-schemas.test.d.ts.map

package/dist/audit/payload-schemas.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-schemas.test.d.ts","sourceRoot":"","sources":["../../src/audit/payload-schemas.test.ts"],"names":[],"mappings":""}

package/dist/audit/payload-schemas.test.js

@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest';
+import { PAYLOAD_SCHEMAS, validateAuditPayload } from './payload-schemas.js';
+describe('PAYLOAD_SCHEMAS', () => {
+    it('has a schema for every documented event type', () => {
+        const expected = [
+            'auth.login.allowed',
+            'auth.login.denied',
+            'auth.logout',
+            'auth.refresh',
+            'auth.password_change.allowed',
+            'auth.password_change.denied',
+            'cli_token.created',
+            'cli_token.revoked',
+            'user.invited',
+            'user.removed',
+            'user.role_changed',
+            'project.created',
+            'project.deleted',
+            'project.dek_rotated',
+            'environment.created',
+            'member.added',
+            'member.removed',
+            'member.role_changed',
+            'secret.created',
+            'secret.read.allowed',
+            'secret.read.denied',
+            'secret.rotated',
+            'secret.deleted',
+            'secret.test.invoked',
+            'secret.test.denied',
+            'approval.requested',
+            'approval.granted',
+            'approval.denied',
+        ];
+        for (const t of expected) {
+            expect(PAYLOAD_SCHEMAS, `missing schema for ${t}`).toHaveProperty(t);
+        }
+    });
+});
+describe('validateAuditPayload — happy paths', () => {
+    it.each([
+        ['auth.login.allowed', { email: 'a@b.com' }],
+        ['auth.logout', {}],
+        ['project.created', { project_id: 'p_1', name: 'demo', environments: ['dev', 'prod'] }],
+        ['project.deleted', { project_id: 'p_1', name: 'demo' }],
+        ['member.added', { project_id: 'p_1', target_user_id: 'u_1', role: 'developer' }],
+        ['secret.created', { project_id: 'p_1', env: 'dev', key: 'db_pass', version: 1 }],
+        ['secret.read.allowed', { alias: '@p.dev.k', version: 3 }],
+        [
+            'secret.rotated',
+            { project_id: 'p_1', env: 'dev', key: 'db_pass', from_version: 1, to_version: 2 },
+        ],
+        ['approval.requested', { alias: '@p.prod.db' }],
+        [
+            'user.invited',
+            {
+                target_user_id: 'u_1',
+                email: 'invitee@team.test',
+                org_role: 'developer',
+                org_id: 'o_1',
+            },
+        ],
+    ])('accepts %s with %j', (eventType, payload) => {
+        expect(() => validateAuditPayload(eventType, payload)).not.toThrow();
+        expect(validateAuditPayload(eventType, payload)).toEqual(payload);
+    });
+});
+describe('validateAuditPayload — rejections', () => {
+    it('rejects unknown fields (strict)', () => {
+        expect(() => validateAuditPayload('auth.login.allowed', { email: 'a@b.com', unexpected: 'x' })).toThrow(/audit payload validation failed/);
+    });
+    it('rejects missing required fields', () => {
+        expect(() => validateAuditPayload('secret.created', { project_id: 'p_1' })).toThrow();
+    });
+    it('rejects non-JSON values (object cannot be coerced to number)', () => {
+        expect(() => validateAuditPayload('secret.read.allowed', {
+            alias: '@p.dev.k',
+            version: { not: 'a number' },
+        })).toThrow();
+    });
+    it('rejects wrong-type fields', () => {
+        expect(() => validateAuditPayload('secret.created', {
+            project_id: 'p_1',
+            env: 'dev',
+            key: 'k',
+            version: 'one',
+        })).toThrow();
+    });
+    it('rejects event_type / payload mismatch', () => {
+        expect(() => validateAuditPayload('auth.logout', { email: 'a@b.com' })).toThrow();
+    });
+});
+//# sourceMappingURL=payload-schemas.test.js.map

package/dist/audit/payload-schemas.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-schemas.test.js","sourceRoot":"","sources":["../../src/audit/payload-schemas.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG7E,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAqB;YACjC,oBAAoB;YACpB,mBAAmB;YACnB,aAAa;YACb,cAAc;YACd,8BAA8B;YAC9B,6BAA6B;YAC7B,mBAAmB;YACnB,mBAAmB;YACnB,cAAc;YACd,cAAc;YACd,mBAAmB;YACnB,iBAAiB;YACjB,iBAAiB;YACjB,qBAAqB;YACrB,qBAAqB;YACrB,cAAc;YACd,gBAAgB;YAChB,qBAAqB;YACrB,gBAAgB;YAChB,qBAAqB;YACrB,oBAAoB;YACpB,gBAAgB;YAChB,gBAAgB;YAChB,qBAAqB;YACrB,oBAAoB;YACpB,oBAAoB;YACpB,kBAAkB;YAClB,iBAAiB;SAClB,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,iBAAiB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACvF,CAAC,iBAAiB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACxD,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACjF,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC1D;YACE,gBAAgB;YAChB,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;SAClF;QACD,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC/C;YACE,cAAc;YACd;gBACE,cAAc,EAAE,KAAK;gBACrB,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,KAAK;aACd;SACF;KACkD,CAAC,CACpD,oBAAoB,EACpB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACrE,MAAM,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAClF,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,qBAAqB,EAAE;YAC1C,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAuB;SAClD,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,gBAAgB,EAAE;YACrC,UAAU,EAAE,KAAK;YACjB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,KAAK;SACf,CAAC,CACH,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,EAA6B,CAAC,CACrF,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/audit/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Canonical event types emitted into the audit chain.
+ *
+ * Server code must use these constants — string literals risk drift.
+ * Adding a new event type is a deliberate decision: extend the union
+ * here, then update both the server emitter and the audit-list filter.
+ */
+export type AuditEventType = 'auth.register' | 'auth.login.allowed' | 'auth.login.denied' | 'auth.logout' | 'auth.refresh' | 'auth.password_change.allowed' | 'auth.password_change.denied' | 'cli_token.created' | 'cli_token.revoked' | 'user.invited' | 'user.removed' | 'user.role_changed' | 'project.created' | 'project.deleted' | 'project.dek_rotated' | 'environment.created' | 'member.added' | 'member.removed' | 'member.role_changed' | 'secret.created' | 'secret.read.allowed' | 'secret.read.denied' | 'secret.rotated' | 'secret.deleted' | 'secret.test.invoked' | 'secret.test.denied' | 'approval.requested' | 'approval.granted' | 'approval.denied' | 'rotation.policy_changed' | 'org.created' | 'org.updated';
+/**
+ * The pieces of an audit entry that are *input*. The server fills in
+ * the chain bookkeeping (id, prev_hash, hash) using `appendEntry`.
+ */
+export interface AuditInput {
+    readonly ts: string;
+    readonly actor_user_id: string | null;
+    readonly actor_agent: string;
+    readonly event_type: AuditEventType;
+    /** JSON-serializable payload. Must NEVER contain a secret value. */
+    readonly payload: Record<string, unknown>;
+}
+/**
+ * A persisted audit row.
+ */
+export interface AuditEntry extends AuditInput {
+    readonly id: number;
+    readonly prev_hash: string;
+    readonly hash: string;
+}
+/**
+ * The all-zeros 32-byte hex hash used as `prev_hash` of the first
+ * entry. Matches the convention documented in 05-encryption-design.md.
+ */
+export declare const GENESIS_HASH: string;
+//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB,eAAe,GACf,oBAAoB,GACpB,mBAAmB,GACnB,aAAa,GACb,cAAc,GACd,8BAA8B,GAC9B,6BAA6B,GAC7B,mBAAmB,GACnB,mBAAmB,GACnB,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,cAAc,GACd,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,iBAAiB,GACjB,yBAAyB,GACzB,aAAa,GACb,aAAa,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAiB,CAAC"}

package/dist/audit/types.js

@@ -0,0 +1,6 @@
+/**
+ * The all-zeros 32-byte hex hash used as `prev_hash` of the first
+ * entry. Matches the convention documented in 05-encryption-design.md.
+ */
+export const GENESIS_HASH = '0'.repeat(64);
+//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AA+DA;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC"}