@kindgi/compliance 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/collect.d.ts +19 -0
- package/dist/collect.d.ts.map +1 -0
- package/dist/collect.js +61 -0
- package/dist/collect.js.map +1 -0
- package/dist/generator.d.ts +7 -1
- package/dist/generator.d.ts.map +1 -1
- package/dist/generator.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +13 -0
- package/dist/types.js.map +1 -1
- package/package.json +5 -5
- package/src/collect.ts +73 -0
- package/src/generator.ts +7 -1
- package/src/index.ts +5 -0
- package/src/types.ts +13 -0
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import type { AuditEventBinding, AuditEventFilter } from '@kindgi/audit-events';
|
|
2
|
+
import type { Result, TenantId } from '@kindgi/types';
|
|
3
|
+
import type { PersistenceError } from './errors.js';
|
|
4
|
+
import type { ComplianceEvidence, EvidenceFilter } from './types.js';
|
|
5
|
+
/** The page size `collectEvidence` reads with. */
|
|
6
|
+
export declare const EVIDENCE_EXPORT_PAGE_SIZE = 500;
|
|
7
|
+
/**
|
|
8
|
+
* Every audit event an export's filter matches, as evidence records,
|
|
9
|
+
* oldest first: what a signed compliance export carries. Reads the
|
|
10
|
+
* binding page by page. An empty `evidenceKinds` matches nothing.
|
|
11
|
+
*/
|
|
12
|
+
export declare function collectEvidence(auditEvents: AuditEventBinding, tenantId: TenantId, filter: EvidenceFilter): Promise<Result<readonly ComplianceEvidence[], PersistenceError>>;
|
|
13
|
+
/**
|
|
14
|
+
* An `EvidenceFilter` (the compliance surface) as an `AuditEventFilter`
|
|
15
|
+
* (the store's): `runId`, `agentId` and `flowId` as they are,
|
|
16
|
+
* `evidenceKind`/`evidenceKinds` as `kind`/`kinds`, the time bounds 1:1.
|
|
17
|
+
*/
|
|
18
|
+
export declare function evidenceFilterToAuditFilter(filter: EvidenceFilter): AuditEventFilter;
|
|
19
|
+
//# sourceMappingURL=collect.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../src/collect.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAc,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAErE,kDAAkD;AAClD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,SAAS,kBAAkB,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAiClE;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAUpF"}
|
package/dist/collect.js
ADDED
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
+
// Copyright (C) 2026 Kindgi Inc.
|
|
3
|
+
import { auditEventToEvidence } from './generator.js';
|
|
4
|
+
/** The page size `collectEvidence` reads with. */
|
|
5
|
+
export const EVIDENCE_EXPORT_PAGE_SIZE = 500;
|
|
6
|
+
/**
|
|
7
|
+
* Every audit event an export's filter matches, as evidence records,
|
|
8
|
+
* oldest first: what a signed compliance export carries. Reads the
|
|
9
|
+
* binding page by page. An empty `evidenceKinds` matches nothing.
|
|
10
|
+
*/
|
|
11
|
+
export async function collectEvidence(auditEvents, tenantId, filter) {
|
|
12
|
+
if (filter.evidenceKinds !== undefined && filter.evidenceKinds.length === 0) {
|
|
13
|
+
return { kind: 'ok', value: [] };
|
|
14
|
+
}
|
|
15
|
+
const auditFilter = evidenceFilterToAuditFilter(filter);
|
|
16
|
+
const events = [];
|
|
17
|
+
let cursor;
|
|
18
|
+
for (;;) {
|
|
19
|
+
const page = await auditEvents.query({
|
|
20
|
+
tenantId,
|
|
21
|
+
filter: auditFilter,
|
|
22
|
+
...(cursor !== undefined && { cursor }),
|
|
23
|
+
limit: EVIDENCE_EXPORT_PAGE_SIZE,
|
|
24
|
+
});
|
|
25
|
+
if (page.kind === 'err') {
|
|
26
|
+
const err = page.error;
|
|
27
|
+
return {
|
|
28
|
+
kind: 'err',
|
|
29
|
+
error: {
|
|
30
|
+
code: 'persistence-error',
|
|
31
|
+
message: err.code === 'invalid-cursor'
|
|
32
|
+
? `pagination cursor rejected: ${err.message}`
|
|
33
|
+
: err.message,
|
|
34
|
+
cause: err.code === 'invalid-cursor' ? err : err.cause,
|
|
35
|
+
},
|
|
36
|
+
};
|
|
37
|
+
}
|
|
38
|
+
events.push(...page.value.data);
|
|
39
|
+
if (page.value.nextCursor === undefined)
|
|
40
|
+
break;
|
|
41
|
+
cursor = page.value.nextCursor;
|
|
42
|
+
}
|
|
43
|
+
return { kind: 'ok', value: events.map(auditEventToEvidence) };
|
|
44
|
+
}
|
|
45
|
+
/**
|
|
46
|
+
* An `EvidenceFilter` (the compliance surface) as an `AuditEventFilter`
|
|
47
|
+
* (the store's): `runId`, `agentId` and `flowId` as they are,
|
|
48
|
+
* `evidenceKind`/`evidenceKinds` as `kind`/`kinds`, the time bounds 1:1.
|
|
49
|
+
*/
|
|
50
|
+
export function evidenceFilterToAuditFilter(filter) {
|
|
51
|
+
return {
|
|
52
|
+
...(filter.runId !== undefined && { runId: filter.runId }),
|
|
53
|
+
...(filter.agentId !== undefined && { agentId: filter.agentId }),
|
|
54
|
+
...(filter.flowId !== undefined && { flowId: filter.flowId }),
|
|
55
|
+
...(filter.evidenceKind !== undefined && { kind: filter.evidenceKind }),
|
|
56
|
+
...(filter.evidenceKinds !== undefined && { kinds: filter.evidenceKinds }),
|
|
57
|
+
...(filter.from !== undefined && { from: filter.from }),
|
|
58
|
+
...(filter.to !== undefined && { to: filter.to }),
|
|
59
|
+
};
|
|
60
|
+
}
|
|
61
|
+
//# sourceMappingURL=collect.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"collect.js","sourceRoot":"","sources":["../src/collect.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAMjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAA8B,EAC9B,QAAkB,EAClB,MAAsB;IAEtB,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,WAAW,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,QAAQ;YACR,MAAM,EAAE,WAAW;YACnB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;YACvC,KAAK,EAAE,yBAAyB;SACjC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EACL,GAAG,CAAC,IAAI,KAAK,gBAAgB;wBAC3B,CAAC,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE;wBAC9C,CAAC,CAAC,GAAG,CAAC,OAAO;oBACjB,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM;QAC/C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAsB;IAChE,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAA0B,EAAE,CAAC;QAC/E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAA4B,EAAE,CAAC;QACrF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAA2B,EAAE,CAAC;QAClF,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAyB,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAuB,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC"}
|
package/dist/generator.d.ts
CHANGED
|
@@ -16,7 +16,13 @@ export interface ComplianceEvidenceGenerator {
|
|
|
16
16
|
recordFromRun(options: RecordFromRunOptions): Promise<Result<{
|
|
17
17
|
readonly evidenceId: ComplianceEvidenceId;
|
|
18
18
|
}, ComplianceError>>;
|
|
19
|
-
|
|
19
|
+
/**
|
|
20
|
+
* @deprecated `@kindgi/api` builds and signs a compliance export
|
|
21
|
+
* itself (`collectEvidence`, then the app's export signing key), so
|
|
22
|
+
* nothing calls this. Kept optional so an implementation that still
|
|
23
|
+
* has it compiles; it goes in a later release.
|
|
24
|
+
*/
|
|
25
|
+
exportSigned?(tenantId: TenantId, filter: EvidenceFilter, signingKeyId: SigningKeyId): Promise<Result<SignedEvidenceBundle, ComplianceError>>;
|
|
20
26
|
describe(): {
|
|
21
27
|
readonly name: string;
|
|
22
28
|
readonly version: string;
|
package/dist/generator.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,kBAAkB,EAElB,cAAc,EAGd,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CACX,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnF,YAAY,
|
|
1
|
+
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,kBAAkB,EAElB,cAAc,EAGd,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CACX,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnF;;;;;OAKG;IACH,YAAY,CAAC,CACX,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,cAAc,EACtB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;IAE1D,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAa1E"}
|
package/dist/generator.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;
|
|
1
|
+
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AA+CjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAA0B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAoB;QACrD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAA0B,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAc,EAAE,EAAE,CAAC;QACpF,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAY;IAC1D,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAA0C,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -5,6 +5,7 @@ export type { ComplianceError, EmitResult, InvalidCursorError, InvalidEvidenceEr
|
|
|
5
5
|
export type { Classification, ComplianceClassifierFile, LoadedClassifier, } from './classifier.js';
|
|
6
6
|
export type { ComplianceEvidenceGenerator } from './generator.js';
|
|
7
7
|
export { auditEventToEvidence } from './generator.js';
|
|
8
|
+
export { EVIDENCE_EXPORT_PAGE_SIZE, collectEvidence, evidenceFilterToAuditFilter, } from './collect.js';
|
|
8
9
|
export { emitLifecycleEvent, emitResolveEvent } from './resolve-emit.js';
|
|
9
10
|
export type { EmitLifecycleEventInput, EmitResolveEventInput, ResolveContext, } from './resolve-emit.js';
|
|
10
11
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
// ============ Wire types ============
|
|
4
4
|
export { EVIDENCE_KINDS } from './types.js';
|
|
5
5
|
export { auditEventToEvidence } from './generator.js';
|
|
6
|
+
export { EVIDENCE_EXPORT_PAGE_SIZE, collectEvidence, evidenceFilterToAuditFilter, } from './collect.js';
|
|
6
7
|
// ============ Resolve + lifecycle event emitters ============
|
|
7
8
|
export { emitLifecycleEvent, emitResolveEvent } from './resolve-emit.js';
|
|
8
9
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAuD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAuD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -7,7 +7,7 @@ import type { AgentId, ComplianceEvidenceId, FlowId, ProjectId, ProvenanceId, Ru
|
|
|
7
7
|
* whose kinds are open (pack authors add their own), and a deployment's
|
|
8
8
|
* compliance classifier can mark any kind exportable. See `EvidenceKind`.
|
|
9
9
|
*/
|
|
10
|
-
export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision", "agent-promotion", "agent-promotion-refused", "agent-rollback", "agent-live-unpinned", "agent-live-pin-inactive"];
|
|
10
|
+
export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision", "agent-promotion", "agent-promotion-refused", "agent-rollback", "agent-live-unpinned", "agent-live-pin-inactive", "api-key-minted", "api-key-revoked", "service-account-created", "service-account-granted", "service-account-ungranted", "service-account-unregistered", "person-added", "person-granted", "person-ungranted"];
|
|
11
11
|
/**
|
|
12
12
|
* An evidence kind: one of the built-in `EVIDENCE_KINDS`, or any other
|
|
13
13
|
* audit-event kind a deployment's classifier marks exportable. Consumers
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,wzBA4DjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEnG;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC5E,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;CACzB;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}
|
package/dist/types.js
CHANGED
|
@@ -56,5 +56,18 @@ export const EVIDENCE_KINDS = [
|
|
|
56
56
|
'agent-live-unpinned',
|
|
57
57
|
// A live pin whose version was unregistered: runs use the scope above.
|
|
58
58
|
'agent-live-pin-inactive',
|
|
59
|
+
// Who can act, and with which key: an API key minted or revoked (never
|
|
60
|
+
// its secret), a service account created, granted a role, ungranted or
|
|
61
|
+
// unregistered, a person added, and a person made tenant admin or no
|
|
62
|
+
// longer one.
|
|
63
|
+
'api-key-minted',
|
|
64
|
+
'api-key-revoked',
|
|
65
|
+
'service-account-created',
|
|
66
|
+
'service-account-granted',
|
|
67
|
+
'service-account-ungranted',
|
|
68
|
+
'service-account-unregistered',
|
|
69
|
+
'person-added',
|
|
70
|
+
'person-granted',
|
|
71
|
+
'person-ungranted',
|
|
59
72
|
];
|
|
60
73
|
//# sourceMappingURL=types.js.map
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;IACf,uEAAuE;IACvE,oDAAoD;IACpD,iBAAiB;IACjB,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB;IAChB,qBAAqB;IACrB,uEAAuE;IACvE,yBAAyB;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;IACf,uEAAuE;IACvE,oDAAoD;IACpD,iBAAiB;IACjB,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB;IAChB,qBAAqB;IACrB,uEAAuE;IACvE,yBAAyB;IACzB,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,yBAAyB;IACzB,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,cAAc;IACd,gBAAgB;IAChB,kBAAkB;CACV,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kindgi/compliance",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"description": "Kindgi™ compliance evidence contract. Types for the Evidence wire record and its sub-types (EvidenceActor, EvidenceSubject, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, ProvenanceRef, ActorKind; ComplianceEvidence alias), the ComplianceProvider seam (EmitEvidenceInput, ListEvidenceFilter, EvidenceSigner), the ComplianceEvidenceGenerator interface with its inputs (RecordFromRunOptions, RunEvidenceContext, ModelCallSummary, ToolInvocationSummary, GuardrailResultSummary), EvidenceFilter, EvidencePage, SignedEvidenceBundle and EvidenceBundleBody, the classifier file format (ComplianceClassifierFile, Classification, LoadedClassifier), and the ComplianceError union. Runtime exports: the EVIDENCE_KINDS list, the pure auditEventToEvidence transform, and emitResolveEvent / emitLifecycleEvent, which append env-* and secret-* audit events to an AuditEventBinding. The generator implementation and the classifier loader are provided by the Kindgi runtime or by the caller.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -28,12 +28,12 @@
|
|
|
28
28
|
"README.md"
|
|
29
29
|
],
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@kindgi/audit-events": "0.1.
|
|
32
|
-
"@kindgi/platform": "0.1.
|
|
33
|
-
"@kindgi/types": "0.1.
|
|
31
|
+
"@kindgi/audit-events": "0.1.5",
|
|
32
|
+
"@kindgi/platform": "0.1.5",
|
|
33
|
+
"@kindgi/types": "0.1.5"
|
|
34
34
|
},
|
|
35
35
|
"devDependencies": {
|
|
36
|
-
"@kindgi/specs": "0.1.
|
|
36
|
+
"@kindgi/specs": "0.1.5",
|
|
37
37
|
"@types/node": "^22.10.5",
|
|
38
38
|
"typescript": "^5.7.3",
|
|
39
39
|
"vitest": "^2.1.8"
|
package/src/collect.ts
ADDED
|
@@ -0,0 +1,73 @@
|
|
|
1
|
+
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
+
// Copyright (C) 2026 Kindgi Inc.
|
|
3
|
+
|
|
4
|
+
import type { AuditEvent, AuditEventBinding, AuditEventFilter } from '@kindgi/audit-events';
|
|
5
|
+
import type { Result, TenantId } from '@kindgi/types';
|
|
6
|
+
|
|
7
|
+
import type { PersistenceError } from './errors.js';
|
|
8
|
+
import { auditEventToEvidence } from './generator.js';
|
|
9
|
+
import type { ComplianceEvidence, EvidenceFilter } from './types.js';
|
|
10
|
+
|
|
11
|
+
/** The page size `collectEvidence` reads with. */
|
|
12
|
+
export const EVIDENCE_EXPORT_PAGE_SIZE = 500;
|
|
13
|
+
|
|
14
|
+
/**
|
|
15
|
+
* Every audit event an export's filter matches, as evidence records,
|
|
16
|
+
* oldest first: what a signed compliance export carries. Reads the
|
|
17
|
+
* binding page by page. An empty `evidenceKinds` matches nothing.
|
|
18
|
+
*/
|
|
19
|
+
export async function collectEvidence(
|
|
20
|
+
auditEvents: AuditEventBinding,
|
|
21
|
+
tenantId: TenantId,
|
|
22
|
+
filter: EvidenceFilter,
|
|
23
|
+
): Promise<Result<readonly ComplianceEvidence[], PersistenceError>> {
|
|
24
|
+
if (filter.evidenceKinds !== undefined && filter.evidenceKinds.length === 0) {
|
|
25
|
+
return { kind: 'ok', value: [] };
|
|
26
|
+
}
|
|
27
|
+
const auditFilter = evidenceFilterToAuditFilter(filter);
|
|
28
|
+
const events: AuditEvent[] = [];
|
|
29
|
+
let cursor: string | undefined;
|
|
30
|
+
for (;;) {
|
|
31
|
+
const page = await auditEvents.query({
|
|
32
|
+
tenantId,
|
|
33
|
+
filter: auditFilter,
|
|
34
|
+
...(cursor !== undefined && { cursor }),
|
|
35
|
+
limit: EVIDENCE_EXPORT_PAGE_SIZE,
|
|
36
|
+
});
|
|
37
|
+
if (page.kind === 'err') {
|
|
38
|
+
const err = page.error;
|
|
39
|
+
return {
|
|
40
|
+
kind: 'err',
|
|
41
|
+
error: {
|
|
42
|
+
code: 'persistence-error',
|
|
43
|
+
message:
|
|
44
|
+
err.code === 'invalid-cursor'
|
|
45
|
+
? `pagination cursor rejected: ${err.message}`
|
|
46
|
+
: err.message,
|
|
47
|
+
cause: err.code === 'invalid-cursor' ? err : err.cause,
|
|
48
|
+
},
|
|
49
|
+
};
|
|
50
|
+
}
|
|
51
|
+
events.push(...page.value.data);
|
|
52
|
+
if (page.value.nextCursor === undefined) break;
|
|
53
|
+
cursor = page.value.nextCursor;
|
|
54
|
+
}
|
|
55
|
+
return { kind: 'ok', value: events.map(auditEventToEvidence) };
|
|
56
|
+
}
|
|
57
|
+
|
|
58
|
+
/**
|
|
59
|
+
* An `EvidenceFilter` (the compliance surface) as an `AuditEventFilter`
|
|
60
|
+
* (the store's): `runId`, `agentId` and `flowId` as they are,
|
|
61
|
+
* `evidenceKind`/`evidenceKinds` as `kind`/`kinds`, the time bounds 1:1.
|
|
62
|
+
*/
|
|
63
|
+
export function evidenceFilterToAuditFilter(filter: EvidenceFilter): AuditEventFilter {
|
|
64
|
+
return {
|
|
65
|
+
...(filter.runId !== undefined && { runId: filter.runId as unknown as string }),
|
|
66
|
+
...(filter.agentId !== undefined && { agentId: filter.agentId as unknown as string }),
|
|
67
|
+
...(filter.flowId !== undefined && { flowId: filter.flowId as unknown as string }),
|
|
68
|
+
...(filter.evidenceKind !== undefined && { kind: filter.evidenceKind }),
|
|
69
|
+
...(filter.evidenceKinds !== undefined && { kinds: filter.evidenceKinds }),
|
|
70
|
+
...(filter.from !== undefined && { from: filter.from as unknown as string }),
|
|
71
|
+
...(filter.to !== undefined && { to: filter.to as unknown as string }),
|
|
72
|
+
};
|
|
73
|
+
}
|
package/src/generator.ts
CHANGED
|
@@ -31,7 +31,13 @@ export interface ComplianceEvidenceGenerator {
|
|
|
31
31
|
options: RecordFromRunOptions,
|
|
32
32
|
): Promise<Result<{ readonly evidenceId: ComplianceEvidenceId }, ComplianceError>>;
|
|
33
33
|
|
|
34
|
-
|
|
34
|
+
/**
|
|
35
|
+
* @deprecated `@kindgi/api` builds and signs a compliance export
|
|
36
|
+
* itself (`collectEvidence`, then the app's export signing key), so
|
|
37
|
+
* nothing calls this. Kept optional so an implementation that still
|
|
38
|
+
* has it compiles; it goes in a later release.
|
|
39
|
+
*/
|
|
40
|
+
exportSigned?(
|
|
35
41
|
tenantId: TenantId,
|
|
36
42
|
filter: EvidenceFilter,
|
|
37
43
|
signingKeyId: SigningKeyId,
|
package/src/index.ts
CHANGED
|
@@ -58,6 +58,11 @@ export type {
|
|
|
58
58
|
// ============ Generator interface + pure transform ============
|
|
59
59
|
export type { ComplianceEvidenceGenerator } from './generator.js';
|
|
60
60
|
export { auditEventToEvidence } from './generator.js';
|
|
61
|
+
export {
|
|
62
|
+
EVIDENCE_EXPORT_PAGE_SIZE,
|
|
63
|
+
collectEvidence,
|
|
64
|
+
evidenceFilterToAuditFilter,
|
|
65
|
+
} from './collect.js';
|
|
61
66
|
|
|
62
67
|
// ============ Resolve + lifecycle event emitters ============
|
|
63
68
|
export { emitLifecycleEvent, emitResolveEvent } from './resolve-emit.js';
|
package/src/types.ts
CHANGED
|
@@ -70,6 +70,19 @@ export const EVIDENCE_KINDS = [
|
|
|
70
70
|
'agent-live-unpinned',
|
|
71
71
|
// A live pin whose version was unregistered: runs use the scope above.
|
|
72
72
|
'agent-live-pin-inactive',
|
|
73
|
+
// Who can act, and with which key: an API key minted or revoked (never
|
|
74
|
+
// its secret), a service account created, granted a role, ungranted or
|
|
75
|
+
// unregistered, a person added, and a person made tenant admin or no
|
|
76
|
+
// longer one.
|
|
77
|
+
'api-key-minted',
|
|
78
|
+
'api-key-revoked',
|
|
79
|
+
'service-account-created',
|
|
80
|
+
'service-account-granted',
|
|
81
|
+
'service-account-ungranted',
|
|
82
|
+
'service-account-unregistered',
|
|
83
|
+
'person-added',
|
|
84
|
+
'person-granted',
|
|
85
|
+
'person-ungranted',
|
|
73
86
|
] as const;
|
|
74
87
|
|
|
75
88
|
/**
|