@kindgi/compliance 0.1.4-rc.0 → 0.1.4-rc.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/generator.d.ts.map +1 -1
- package/dist/generator.js +21 -0
- package/dist/generator.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +9 -0
- package/dist/types.js.map +1 -1
- package/package.json +5 -5
- package/src/generator.ts +24 -0
- package/src/types.ts +9 -0
package/dist/generator.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,kBAAkB,EAElB,cAAc,EAGd,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CACX,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnF,YAAY,CACV,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,cAAc,EACtB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;IAE1D,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAa1E"}
|
package/dist/generator.js
CHANGED
|
@@ -19,8 +19,29 @@ export function auditEventToEvidence(event) {
|
|
|
19
19
|
payload: extractDoc(event.payload),
|
|
20
20
|
...(event.outcome !== undefined && { outcome: event.outcome }),
|
|
21
21
|
...(event.runId !== undefined && { provenanceRef: { runId: event.runId } }),
|
|
22
|
+
...actorOf(event.actor),
|
|
22
23
|
};
|
|
23
24
|
}
|
|
25
|
+
const ACTOR_KINDS = new Set([
|
|
26
|
+
'user',
|
|
27
|
+
'agent',
|
|
28
|
+
'system',
|
|
29
|
+
'admin',
|
|
30
|
+
'external',
|
|
31
|
+
]);
|
|
32
|
+
/**
|
|
33
|
+
* The event's actor, as evidence names one: `<kind>:<id>` (or a bare
|
|
34
|
+
* `<kind>`, as the evidence generator writes it) is `{ kind, id }`. An
|
|
35
|
+
* actor of a kind evidence can't name is left out.
|
|
36
|
+
*/
|
|
37
|
+
function actorOf(actor) {
|
|
38
|
+
const colon = actor.indexOf(':');
|
|
39
|
+
const kind = colon === -1 ? actor : actor.slice(0, colon);
|
|
40
|
+
if (!ACTOR_KINDS.has(kind))
|
|
41
|
+
return {};
|
|
42
|
+
const id = colon === -1 ? '' : actor.slice(colon + 1);
|
|
43
|
+
return { actor: { kind: kind, ...(id.length > 0 && { id }) } };
|
|
44
|
+
}
|
|
24
45
|
function extractDoc(payload) {
|
|
25
46
|
const inner = payload.doc;
|
|
26
47
|
if (inner !== null && typeof inner === 'object' && !Array.isArray(inner)) {
|
package/dist/generator.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;
|
|
1
|
+
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAyCjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAA0B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAoB;QACrD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAA0B,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAc,EAAE,EAAE,CAAC;QACpF,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAY;IAC1D,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAA0C,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -7,7 +7,7 @@ import type { AgentId, ComplianceEvidenceId, FlowId, ProjectId, ProvenanceId, Ru
|
|
|
7
7
|
* whose kinds are open (pack authors add their own), and a deployment's
|
|
8
8
|
* compliance classifier can mark any kind exportable. See `EvidenceKind`.
|
|
9
9
|
*/
|
|
10
|
-
export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision"];
|
|
10
|
+
export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision", "agent-promotion", "agent-promotion-refused", "agent-rollback", "agent-live-unpinned", "agent-live-pin-inactive"];
|
|
11
11
|
/**
|
|
12
12
|
* An evidence kind: one of the built-in `EVIDENCE_KINDS`, or any other
|
|
13
13
|
* audit-event kind a deployment's classifier marks exportable. Consumers
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,0mBA+CjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEnG;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC5E,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;CACzB;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}
|
package/dist/types.js
CHANGED
|
@@ -47,5 +47,14 @@ export const EVIDENCE_KINDS = [
|
|
|
47
47
|
// Human-in-the-loop approval decisions (exportable in the shipped
|
|
48
48
|
// compliance classifier).
|
|
49
49
|
'hitl-decision',
|
|
50
|
+
// Which agent version is live for a scope: a promotion, a rollback, or
|
|
51
|
+
// an unpin (the scope falls back to the one above).
|
|
52
|
+
'agent-promotion',
|
|
53
|
+
// A promotion its gate policy refused (evals step 4b): the checks that failed.
|
|
54
|
+
'agent-promotion-refused',
|
|
55
|
+
'agent-rollback',
|
|
56
|
+
'agent-live-unpinned',
|
|
57
|
+
// A live pin whose version was unregistered: runs use the scope above.
|
|
58
|
+
'agent-live-pin-inactive',
|
|
50
59
|
];
|
|
51
60
|
//# sourceMappingURL=types.js.map
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;IACf,uEAAuE;IACvE,oDAAoD;IACpD,iBAAiB;IACjB,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB;IAChB,qBAAqB;IACrB,uEAAuE;IACvE,yBAAyB;CACjB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kindgi/compliance",
|
|
3
|
-
"version": "0.1.4-rc.
|
|
3
|
+
"version": "0.1.4-rc.2",
|
|
4
4
|
"description": "Kindgi™ compliance evidence contract. Types for the Evidence wire record and its sub-types (EvidenceActor, EvidenceSubject, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, ProvenanceRef, ActorKind; ComplianceEvidence alias), the ComplianceProvider seam (EmitEvidenceInput, ListEvidenceFilter, EvidenceSigner), the ComplianceEvidenceGenerator interface with its inputs (RecordFromRunOptions, RunEvidenceContext, ModelCallSummary, ToolInvocationSummary, GuardrailResultSummary), EvidenceFilter, EvidencePage, SignedEvidenceBundle and EvidenceBundleBody, the classifier file format (ComplianceClassifierFile, Classification, LoadedClassifier), and the ComplianceError union. Runtime exports: the EVIDENCE_KINDS list, the pure auditEventToEvidence transform, and emitResolveEvent / emitLifecycleEvent, which append env-* and secret-* audit events to an AuditEventBinding. The generator implementation and the classifier loader are provided by the Kindgi runtime or by the caller.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -28,12 +28,12 @@
|
|
|
28
28
|
"README.md"
|
|
29
29
|
],
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@kindgi/audit-events": "0.1.4-rc.
|
|
32
|
-
"@kindgi/platform": "0.1.4-rc.
|
|
33
|
-
"@kindgi/types": "0.1.4-rc.
|
|
31
|
+
"@kindgi/audit-events": "0.1.4-rc.2",
|
|
32
|
+
"@kindgi/platform": "0.1.4-rc.2",
|
|
33
|
+
"@kindgi/types": "0.1.4-rc.2"
|
|
34
34
|
},
|
|
35
35
|
"devDependencies": {
|
|
36
|
-
"@kindgi/specs": "0.1.4-rc.
|
|
36
|
+
"@kindgi/specs": "0.1.4-rc.2",
|
|
37
37
|
"@types/node": "^22.10.5",
|
|
38
38
|
"typescript": "^5.7.3",
|
|
39
39
|
"vitest": "^2.1.8"
|
package/src/generator.ts
CHANGED
|
@@ -6,7 +6,9 @@ import type { ComplianceEvidenceId, Result, RunId, SigningKeyId, TenantId } from
|
|
|
6
6
|
|
|
7
7
|
import type { ComplianceError } from './errors.js';
|
|
8
8
|
import type {
|
|
9
|
+
ActorKind,
|
|
9
10
|
ComplianceEvidence,
|
|
11
|
+
EvidenceActor,
|
|
10
12
|
EvidenceFilter,
|
|
11
13
|
EvidenceOutcome,
|
|
12
14
|
EvidencePayload,
|
|
@@ -57,9 +59,31 @@ export function auditEventToEvidence(event: AuditEvent): ComplianceEvidence {
|
|
|
57
59
|
payload: extractDoc(event.payload) as EvidencePayload,
|
|
58
60
|
...(event.outcome !== undefined && { outcome: event.outcome as EvidenceOutcome }),
|
|
59
61
|
...(event.runId !== undefined && { provenanceRef: { runId: event.runId as RunId } }),
|
|
62
|
+
...actorOf(event.actor),
|
|
60
63
|
};
|
|
61
64
|
}
|
|
62
65
|
|
|
66
|
+
const ACTOR_KINDS: ReadonlySet<string> = new Set<ActorKind>([
|
|
67
|
+
'user',
|
|
68
|
+
'agent',
|
|
69
|
+
'system',
|
|
70
|
+
'admin',
|
|
71
|
+
'external',
|
|
72
|
+
]);
|
|
73
|
+
|
|
74
|
+
/**
|
|
75
|
+
* The event's actor, as evidence names one: `<kind>:<id>` (or a bare
|
|
76
|
+
* `<kind>`, as the evidence generator writes it) is `{ kind, id }`. An
|
|
77
|
+
* actor of a kind evidence can't name is left out.
|
|
78
|
+
*/
|
|
79
|
+
function actorOf(actor: string): { readonly actor?: EvidenceActor } {
|
|
80
|
+
const colon = actor.indexOf(':');
|
|
81
|
+
const kind = colon === -1 ? actor : actor.slice(0, colon);
|
|
82
|
+
if (!ACTOR_KINDS.has(kind)) return {};
|
|
83
|
+
const id = colon === -1 ? '' : actor.slice(colon + 1);
|
|
84
|
+
return { actor: { kind: kind as ActorKind, ...(id.length > 0 && { id }) } };
|
|
85
|
+
}
|
|
86
|
+
|
|
63
87
|
function extractDoc(payload: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>> {
|
|
64
88
|
const inner = payload.doc;
|
|
65
89
|
if (inner !== null && typeof inner === 'object' && !Array.isArray(inner)) {
|
package/src/types.ts
CHANGED
|
@@ -61,6 +61,15 @@ export const EVIDENCE_KINDS = [
|
|
|
61
61
|
// Human-in-the-loop approval decisions (exportable in the shipped
|
|
62
62
|
// compliance classifier).
|
|
63
63
|
'hitl-decision',
|
|
64
|
+
// Which agent version is live for a scope: a promotion, a rollback, or
|
|
65
|
+
// an unpin (the scope falls back to the one above).
|
|
66
|
+
'agent-promotion',
|
|
67
|
+
// A promotion its gate policy refused (evals step 4b): the checks that failed.
|
|
68
|
+
'agent-promotion-refused',
|
|
69
|
+
'agent-rollback',
|
|
70
|
+
'agent-live-unpinned',
|
|
71
|
+
// A live pin whose version was unregistered: runs use the scope above.
|
|
72
|
+
'agent-live-pin-inactive',
|
|
64
73
|
] as const;
|
|
65
74
|
|
|
66
75
|
/**
|