@kindgi/compliance 0.1.5-rc.0 → 0.1.6-rc.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -23
- package/dist/classifier.d.ts +18 -1
- package/dist/classifier.d.ts.map +1 -1
- package/dist/errors.d.ts +1 -2
- package/dist/errors.d.ts.map +1 -1
- package/dist/generator.d.ts +2 -9
- package/dist/generator.d.ts.map +1 -1
- package/dist/generator.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js.map +1 -1
- package/dist/resolve-emit.d.ts +20 -1
- package/dist/resolve-emit.d.ts.map +1 -1
- package/dist/resolve-emit.js +14 -3
- package/dist/resolve-emit.js.map +1 -1
- package/dist/types.d.ts +2 -2
- package/package.json +5 -5
- package/src/classifier.ts +19 -1
- package/src/errors.ts +1 -2
- package/src/generator.ts +1 -15
- package/src/index.ts +1 -0
- package/src/resolve-emit.ts +33 -5
- package/src/types.ts +2 -2
package/README.md
CHANGED
|
@@ -13,13 +13,14 @@ Evidence is a classification lens over the audit-event stream from [`@kindgi/aud
|
|
|
13
13
|
- **`EvidenceKind`** — one of **`EVIDENCE_KINDS`** (the built-in kinds, e.g. `'authz-decision'`, `'run-outcome'`, `'secret-rotated'`, `'hitl-decision'`) or any other string. Consumers must tolerate unknown kinds.
|
|
14
14
|
- **`EvidenceActor`** (with **`ActorKind`**), **`EvidenceSubject`**, **`EvidenceOutcome`**, **`EvidencePayload`** (always carries a numeric `version`), **`EvidenceSignature`** (Ed25519), **`ProvenanceRef`**.
|
|
15
15
|
- **Generator**
|
|
16
|
-
- **`ComplianceEvidenceGenerator`** — `recordFromRun(options)`, `
|
|
16
|
+
- **`ComplianceEvidenceGenerator`** — `recordFromRun(options)`, `describe()`. A signed export of the records is `@kindgi/api`'s `POST /v1/compliance/evidence/export`, which collects them and signs with the app's export signing key.
|
|
17
17
|
- **`RecordFromRunOptions`** — `tenantId`, `projectId`, `runId`, `kind`, `runContext`, optional actor/subject/outcome/id/timestamp/`provenanceRef`, and `rawMessages` (embedded only when `allowRawMessages: true`).
|
|
18
18
|
- **`RunEvidenceContext`** — `status`, timing, agent/flow ids, and lists of **`ModelCallSummary`**, **`ToolInvocationSummary`**, **`GuardrailResultSummary`**; plus caller-redacted `failureMessage` and `extra`.
|
|
19
19
|
- **`EvidenceFilter`** (AND-composed; `evidenceKinds: []` matches nothing), **`EvidencePage`**, **`SignedEvidenceBundle`** (base64 canonical `bundle`, `signature`, PEM `publicKey`, `signingKeyId`, `canonicalization: 'sorted-key-json'`), **`EvidenceBundleBody`** (the decoded `bundle`).
|
|
20
20
|
- **Provider seam** — **`ComplianceProvider`** (`emit`, `list`, `describe`) for adapters that forward evidence to an external system, with **`EmitEvidenceInput`**, **`ListEvidenceFilter`**, and **`EvidenceSigner`** (`(bytes, tenantId) => Promise<EvidenceSignature>`).
|
|
21
21
|
- **Classifier**
|
|
22
|
-
- **`
|
|
22
|
+
- **`ComplianceClassifierSource`** — `{ version: 1, default, byKind }`, the file format: a kind's entry is its classification, or the name of another kind whose classification it takes (`"secret-rotated": "secret-set"`), resolved at load; a name that names another name, or no kind, is refused.
|
|
23
|
+
- **`ComplianceClassifierFile`** — the same, resolved: every kind with its own classification (what `LoadedClassifier.file` holds).
|
|
23
24
|
- **`Classification`** — `retention` (`days`, `onDenyDays?`, `legalHold?`), `signed`, `exportable`.
|
|
24
25
|
- **`LoadedClassifier`** — `file` plus `resolve(kind)`, which returns the per-kind entry or the default.
|
|
25
26
|
- **`auditEventToEvidence(event)`** — pure transform from an `AuditEvent` to an `Evidence` record (unwraps the `{ v, doc }` payload envelope).
|
|
@@ -29,15 +30,11 @@ Evidence is a classification lens over the audit-event stream from [`@kindgi/aud
|
|
|
29
30
|
## Example
|
|
30
31
|
|
|
31
32
|
```ts
|
|
32
|
-
import type {
|
|
33
|
-
ComplianceEvidenceGenerator,
|
|
34
|
-
EvidenceBundleBody,
|
|
35
|
-
RunEvidenceContext,
|
|
36
|
-
} from '@kindgi/compliance';
|
|
33
|
+
import type { ComplianceEvidenceGenerator, RunEvidenceContext } from '@kindgi/compliance';
|
|
37
34
|
|
|
38
|
-
// tenantId, projectId, runId,
|
|
39
|
-
//
|
|
40
|
-
async function
|
|
35
|
+
// tenantId, projectId, runId, startedAt, endedAt, promptHash and argsHash
|
|
36
|
+
// come from the finished run.
|
|
37
|
+
async function record(generator: ComplianceEvidenceGenerator): Promise<void> {
|
|
41
38
|
// Redaction-safe run summary: hashes and counts, no prompt or argument text.
|
|
42
39
|
const runContext: RunEvidenceContext = {
|
|
43
40
|
status: 'completed',
|
|
@@ -58,19 +55,9 @@ async function recordAndExport(generator: ComplianceEvidenceGenerator): Promise<
|
|
|
58
55
|
runContext,
|
|
59
56
|
});
|
|
60
57
|
if (recorded.kind === 'err') throw new Error(`${recorded.error.code}: ${recorded.error.message}`);
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
{ runId, evidenceKinds: ['run-outcome', 'authz-decision'] },
|
|
65
|
-
signingKeyId,
|
|
66
|
-
);
|
|
67
|
-
if (exported.kind === 'err') throw new Error(`${exported.error.code}: ${exported.error.message}`);
|
|
68
|
-
|
|
69
|
-
// `bundle` is base64 of the exact canonical JSON bytes that were signed.
|
|
70
|
-
const body = JSON.parse(
|
|
71
|
-
Buffer.from(exported.value.bundle, 'base64').toString('utf8'),
|
|
72
|
-
) as EvidenceBundleBody;
|
|
73
|
-
console.log(body.recordCount, exported.value.signingKeyId, exported.value.algorithm);
|
|
58
|
+
// A signed export of these records: `POST /v1/compliance/evidence/export`
|
|
59
|
+
// with `{ filter: { runId, evidenceKind: 'run-outcome' } }`, on a runtime
|
|
60
|
+
// with an export signing key.
|
|
74
61
|
}
|
|
75
62
|
```
|
|
76
63
|
|
package/dist/classifier.d.ts
CHANGED
|
@@ -40,7 +40,11 @@ export interface Classification {
|
|
|
40
40
|
*/
|
|
41
41
|
readonly exportable: boolean;
|
|
42
42
|
}
|
|
43
|
-
/**
|
|
43
|
+
/**
|
|
44
|
+
* A classifier, every kind with its own classification: what a loader
|
|
45
|
+
* makes of the file (`ComplianceClassifierSource`), and what
|
|
46
|
+
* `LoadedClassifier.file` holds.
|
|
47
|
+
*/
|
|
44
48
|
export interface ComplianceClassifierFile {
|
|
45
49
|
readonly version: 1;
|
|
46
50
|
/** Default classification for kinds not explicitly listed. */
|
|
@@ -48,6 +52,19 @@ export interface ComplianceClassifierFile {
|
|
|
48
52
|
/** Per-kind overrides. Missing kind → `default`. */
|
|
49
53
|
readonly byKind: Readonly<Record<string, Classification>>;
|
|
50
54
|
}
|
|
55
|
+
/**
|
|
56
|
+
* The classifier JSON file as written. A kind's entry is its
|
|
57
|
+
* classification, or the name of another kind whose classification it
|
|
58
|
+
* takes (`"secret-rotated": "secret-set"`), so related kinds can't drift
|
|
59
|
+
* apart. A loader resolves the names into a `ComplianceClassifierFile`; a
|
|
60
|
+
* name must be a kind listed with a classification of its own (not another
|
|
61
|
+
* name, nor `default`), or the file is refused.
|
|
62
|
+
*/
|
|
63
|
+
export interface ComplianceClassifierSource {
|
|
64
|
+
readonly version: 1;
|
|
65
|
+
readonly default: Classification;
|
|
66
|
+
readonly byKind: Readonly<Record<string, Classification | string>>;
|
|
67
|
+
}
|
|
51
68
|
/**
|
|
52
69
|
* Loaded classifier — same shape as the file, but the `resolve` helper
|
|
53
70
|
* returns the correct classification (per-kind or default) in one call.
|
package/dist/classifier.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE;QAClB;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;WAMG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED
|
|
1
|
+
{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE;QAClB;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;WAMG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC3D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC;CACpE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,0DAA0D;IAC1D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CACvC"}
|
package/dist/errors.d.ts
CHANGED
|
@@ -30,8 +30,7 @@ export interface PersistenceError {
|
|
|
30
30
|
/**
|
|
31
31
|
* A caller-plugged `EvidenceSigner` function threw. Distinct from
|
|
32
32
|
* `SigningFailureError` (which is specific to the generator's own
|
|
33
|
-
* Ed25519 signing path
|
|
34
|
-
* the two signing paths.
|
|
33
|
+
* Ed25519 signing path) so callers can distinguish the two signing paths.
|
|
35
34
|
*/
|
|
36
35
|
export interface SignerFailureError {
|
|
37
36
|
readonly code: 'signer-failure';
|
package/dist/errors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAC"}
|
package/dist/generator.d.ts
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import type { AuditEvent } from '@kindgi/audit-events';
|
|
2
|
-
import type { ComplianceEvidenceId, Result
|
|
2
|
+
import type { ComplianceEvidenceId, Result } from '@kindgi/types';
|
|
3
3
|
import type { ComplianceError } from './errors.js';
|
|
4
|
-
import type { ComplianceEvidence,
|
|
4
|
+
import type { ComplianceEvidence, RecordFromRunOptions } from './types.js';
|
|
5
5
|
/**
|
|
6
6
|
* The runtime service that turns terminated runs into audit-event
|
|
7
7
|
* records and produces signed export bundles.
|
|
@@ -16,13 +16,6 @@ export interface ComplianceEvidenceGenerator {
|
|
|
16
16
|
recordFromRun(options: RecordFromRunOptions): Promise<Result<{
|
|
17
17
|
readonly evidenceId: ComplianceEvidenceId;
|
|
18
18
|
}, ComplianceError>>;
|
|
19
|
-
/**
|
|
20
|
-
* @deprecated `@kindgi/api` builds and signs a compliance export
|
|
21
|
-
* itself (`collectEvidence`, then the app's export signing key), so
|
|
22
|
-
* nothing calls this. Kept optional so an implementation that still
|
|
23
|
-
* has it compiles; it goes in a later release.
|
|
24
|
-
*/
|
|
25
|
-
exportSigned?(tenantId: TenantId, filter: EvidenceFilter, signingKeyId: SigningKeyId): Promise<Result<SignedEvidenceBundle, ComplianceError>>;
|
|
26
19
|
describe(): {
|
|
27
20
|
readonly name: string;
|
|
28
21
|
readonly version: string;
|
package/dist/generator.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,
|
|
1
|
+
{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,MAAM,eAAe,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,kBAAkB,EAIlB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CACX,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnF,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAa1E"}
|
package/dist/generator.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;
|
|
1
|
+
{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAiCjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAA0B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAoB;QACrD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAA0B,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAc,EAAE,EAAE,CAAC;QACpF,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAY;IAC1D,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAA0C,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ export { EVIDENCE_KINDS } from './types.js';
|
|
|
2
2
|
export type { ActorKind, ComplianceEvidence, ComplianceProvider, EmitEvidenceInput, Evidence, EvidenceActor, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, EvidenceSigner, EvidenceSubject, ListEvidenceFilter, ProvenanceRef, } from './types.js';
|
|
3
3
|
export type { EvidenceBundleBody, EvidenceFilter, EvidencePage, GuardrailResultSummary, ModelCallSummary, RecordFromRunOptions, RunEvidenceContext, SignedEvidenceBundle, ToolInvocationSummary, } from './types.js';
|
|
4
4
|
export type { ComplianceError, EmitResult, InvalidCursorError, InvalidEvidenceError, ListResult, PersistenceError, ProjectNotFoundError, SignerFailureError, SigningFailureError, SigningKeyMissingError, UnsupportedVersionError, } from './errors.js';
|
|
5
|
-
export type { Classification, ComplianceClassifierFile, LoadedClassifier, } from './classifier.js';
|
|
5
|
+
export type { Classification, ComplianceClassifierFile, ComplianceClassifierSource, LoadedClassifier, } from './classifier.js';
|
|
6
6
|
export type { ComplianceEvidenceGenerator } from './generator.js';
|
|
7
7
|
export { auditEventToEvidence } from './generator.js';
|
|
8
8
|
export { EVIDENCE_EXPORT_PAGE_SIZE, collectEvidence, evidenceFilterToAuditFilter, } from './collect.js';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC"}
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}
|
package/dist/resolve-emit.d.ts
CHANGED
|
@@ -61,9 +61,28 @@ export interface EmitLifecycleEventInput {
|
|
|
61
61
|
readonly errorCode?: string;
|
|
62
62
|
readonly hard?: boolean;
|
|
63
63
|
readonly reason?: string;
|
|
64
|
+
/** A secret set's mode: a new secret, or a new version of one. */
|
|
65
|
+
readonly writeMode?: 'create-new' | 'add-version';
|
|
66
|
+
/** An asynchronous rotation's id (`secret-rotation-started`). */
|
|
67
|
+
readonly rotationId?: string;
|
|
68
|
+
/**
|
|
69
|
+
* The backend dropped a revoked secret's stored values to set it again
|
|
70
|
+
* (a provider that keeps them for a recovery window): the record says
|
|
71
|
+
* their retention ended here.
|
|
72
|
+
*/
|
|
73
|
+
readonly revokedValuesPurged?: true;
|
|
74
|
+
/**
|
|
75
|
+
* Who did it, as the API names its caller (`user:<id>`,
|
|
76
|
+
* `service_account:<id>`, `session:<id>`, `token:<hash>`). Absent: from
|
|
77
|
+
* `resolveContext`, as a binding emits.
|
|
78
|
+
*/
|
|
79
|
+
readonly actor?: string;
|
|
80
|
+
/** The request it came from (the API's `requestId`). */
|
|
81
|
+
readonly correlationId?: string;
|
|
64
82
|
readonly auditEvents: AuditEventBinding;
|
|
65
83
|
readonly tenantId: TenantId;
|
|
66
|
-
|
|
84
|
+
/** The project, for a project-scoped value; absent for a tenant- or org-scoped one. */
|
|
85
|
+
readonly projectId?: ProjectId;
|
|
67
86
|
}
|
|
68
87
|
/**
|
|
69
88
|
* Emit a non-resolve lifecycle event (`env-set` / `env-deleted` /
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;CAC3E;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;CAC3E;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,aAAa,CAAC;IAClD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBtF"}
|
package/dist/resolve-emit.js
CHANGED
|
@@ -53,14 +53,18 @@ export async function emitResolveEvent(input) {
|
|
|
53
53
|
*/
|
|
54
54
|
export async function emitLifecycleEvent(input) {
|
|
55
55
|
const payload = buildLifecyclePayload(input);
|
|
56
|
-
const actor = input.
|
|
56
|
+
const actor = input.actor ??
|
|
57
|
+
(input.resolveContext !== undefined
|
|
58
|
+
? actorFromResolveContext(input.resolveContext)
|
|
59
|
+
: undefined);
|
|
57
60
|
const event = buildEvent({
|
|
58
61
|
tenantId: input.tenantId,
|
|
59
|
-
projectId: input.projectId,
|
|
62
|
+
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
60
63
|
kind: input.evidenceKind,
|
|
61
64
|
outcome: input.outcome,
|
|
62
65
|
actor,
|
|
63
66
|
runId: input.resolveContext?.runId,
|
|
67
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
64
68
|
payload,
|
|
65
69
|
});
|
|
66
70
|
await safeEmit(input.auditEvents, event);
|
|
@@ -69,12 +73,13 @@ function buildEvent(input) {
|
|
|
69
73
|
return {
|
|
70
74
|
id: randomUUID(),
|
|
71
75
|
tenantId: input.tenantId,
|
|
72
|
-
projectId: input.projectId,
|
|
76
|
+
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
73
77
|
kind: input.kind,
|
|
74
78
|
timestamp: new Date().toISOString(),
|
|
75
79
|
actor: input.actor ?? 'user:system',
|
|
76
80
|
outcome: input.outcome,
|
|
77
81
|
...(input.runId !== undefined && { runId: input.runId }),
|
|
82
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
78
83
|
payload: { v: 1, doc: input.payload },
|
|
79
84
|
};
|
|
80
85
|
}
|
|
@@ -172,6 +177,12 @@ function buildLifecyclePayload(input) {
|
|
|
172
177
|
payload.hard = input.hard;
|
|
173
178
|
if (input.reason !== undefined)
|
|
174
179
|
payload.reason = input.reason;
|
|
180
|
+
if (input.writeMode !== undefined)
|
|
181
|
+
payload.writeMode = input.writeMode;
|
|
182
|
+
if (input.rotationId !== undefined)
|
|
183
|
+
payload.rotationId = input.rotationId;
|
|
184
|
+
if (input.revokedValuesPurged === true)
|
|
185
|
+
payload.revokedValuesPurged = true;
|
|
175
186
|
if (input.resolveContext?.nodeId !== undefined)
|
|
176
187
|
payload.nodeId = input.resolveContext.nodeId;
|
|
177
188
|
if (input.resolveContext?.runId !== undefined)
|
package/dist/resolve-emit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkCzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACvE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;QACjC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;
|
|
1
|
+
{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkCzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACvE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;QACjC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAiDD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GACT,KAAK,CAAC,KAAK;QACX,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;YACjC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK;QAClC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAiBD,SAAS,UAAU,CAAC,KAAsB;IACxC,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAA0B;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAA0B,EAAE,KAAiB;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,OAAO,CAAC,IAAI,CACV,qBAAqB,KAAK,CAAC,IAAI,uBAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAmB;IAClD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1E,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACzF,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAY;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK,CAAC,QAA6B;YAC7C,KAAK,EAAE,KAAK,CAAC,KAA0B;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,QAA6B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAA8B;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAA4B;IACvD,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC5F,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1E,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC3E,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC7F,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -245,8 +245,8 @@ export interface RecordFromRunOptions {
|
|
|
245
245
|
readonly allowRawMessages?: boolean;
|
|
246
246
|
}
|
|
247
247
|
/**
|
|
248
|
-
* Filter shape shared by evidence listing and signed
|
|
249
|
-
* (`
|
|
248
|
+
* Filter shape shared by evidence listing and the signed compliance
|
|
249
|
+
* export (`@kindgi/api` collects, then signs). `ComplianceProvider.list`
|
|
250
250
|
* takes `ListEvidenceFilter` instead. Every field is optional; an empty
|
|
251
251
|
* filter is "everything in the tenant". Composition is AND — all
|
|
252
252
|
* populated fields must match.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kindgi/compliance",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.6-rc.0",
|
|
4
4
|
"description": "Kindgi™ compliance evidence contract. Types for the Evidence wire record and its sub-types (EvidenceActor, EvidenceSubject, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, ProvenanceRef, ActorKind; ComplianceEvidence alias), the ComplianceProvider seam (EmitEvidenceInput, ListEvidenceFilter, EvidenceSigner), the ComplianceEvidenceGenerator interface with its inputs (RecordFromRunOptions, RunEvidenceContext, ModelCallSummary, ToolInvocationSummary, GuardrailResultSummary), EvidenceFilter, EvidencePage, SignedEvidenceBundle and EvidenceBundleBody, the classifier file format (ComplianceClassifierFile, Classification, LoadedClassifier), and the ComplianceError union. Runtime exports: the EVIDENCE_KINDS list, the pure auditEventToEvidence transform, and emitResolveEvent / emitLifecycleEvent, which append env-* and secret-* audit events to an AuditEventBinding. The generator implementation and the classifier loader are provided by the Kindgi runtime or by the caller.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -28,12 +28,12 @@
|
|
|
28
28
|
"README.md"
|
|
29
29
|
],
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@kindgi/audit-events": "0.1.
|
|
32
|
-
"@kindgi/platform": "0.1.
|
|
33
|
-
"@kindgi/types": "0.1.
|
|
31
|
+
"@kindgi/audit-events": "0.1.6-rc.0",
|
|
32
|
+
"@kindgi/platform": "0.1.6-rc.0",
|
|
33
|
+
"@kindgi/types": "0.1.6-rc.0"
|
|
34
34
|
},
|
|
35
35
|
"devDependencies": {
|
|
36
|
-
"@kindgi/specs": "0.1.
|
|
36
|
+
"@kindgi/specs": "0.1.6-rc.0",
|
|
37
37
|
"@types/node": "^22.10.5",
|
|
38
38
|
"typescript": "^5.7.3",
|
|
39
39
|
"vitest": "^2.1.8"
|
package/src/classifier.ts
CHANGED
|
@@ -44,7 +44,11 @@ export interface Classification {
|
|
|
44
44
|
readonly exportable: boolean;
|
|
45
45
|
}
|
|
46
46
|
|
|
47
|
-
/**
|
|
47
|
+
/**
|
|
48
|
+
* A classifier, every kind with its own classification: what a loader
|
|
49
|
+
* makes of the file (`ComplianceClassifierSource`), and what
|
|
50
|
+
* `LoadedClassifier.file` holds.
|
|
51
|
+
*/
|
|
48
52
|
export interface ComplianceClassifierFile {
|
|
49
53
|
readonly version: 1;
|
|
50
54
|
/** Default classification for kinds not explicitly listed. */
|
|
@@ -53,6 +57,20 @@ export interface ComplianceClassifierFile {
|
|
|
53
57
|
readonly byKind: Readonly<Record<string, Classification>>;
|
|
54
58
|
}
|
|
55
59
|
|
|
60
|
+
/**
|
|
61
|
+
* The classifier JSON file as written. A kind's entry is its
|
|
62
|
+
* classification, or the name of another kind whose classification it
|
|
63
|
+
* takes (`"secret-rotated": "secret-set"`), so related kinds can't drift
|
|
64
|
+
* apart. A loader resolves the names into a `ComplianceClassifierFile`; a
|
|
65
|
+
* name must be a kind listed with a classification of its own (not another
|
|
66
|
+
* name, nor `default`), or the file is refused.
|
|
67
|
+
*/
|
|
68
|
+
export interface ComplianceClassifierSource {
|
|
69
|
+
readonly version: 1;
|
|
70
|
+
readonly default: Classification;
|
|
71
|
+
readonly byKind: Readonly<Record<string, Classification | string>>;
|
|
72
|
+
}
|
|
73
|
+
|
|
56
74
|
/**
|
|
57
75
|
* Loaded classifier — same shape as the file, but the `resolve` helper
|
|
58
76
|
* returns the correct classification (per-kind or default) in one call.
|
package/src/errors.ts
CHANGED
|
@@ -43,8 +43,7 @@ export interface PersistenceError {
|
|
|
43
43
|
/**
|
|
44
44
|
* A caller-plugged `EvidenceSigner` function threw. Distinct from
|
|
45
45
|
* `SigningFailureError` (which is specific to the generator's own
|
|
46
|
-
* Ed25519 signing path
|
|
47
|
-
* the two signing paths.
|
|
46
|
+
* Ed25519 signing path) so callers can distinguish the two signing paths.
|
|
48
47
|
*/
|
|
49
48
|
export interface SignerFailureError {
|
|
50
49
|
readonly code: 'signer-failure';
|
package/src/generator.ts
CHANGED
|
@@ -2,18 +2,16 @@
|
|
|
2
2
|
// Copyright (C) 2026 Kindgi Inc.
|
|
3
3
|
|
|
4
4
|
import type { AuditEvent } from '@kindgi/audit-events';
|
|
5
|
-
import type { ComplianceEvidenceId, Result, RunId
|
|
5
|
+
import type { ComplianceEvidenceId, Result, RunId } from '@kindgi/types';
|
|
6
6
|
|
|
7
7
|
import type { ComplianceError } from './errors.js';
|
|
8
8
|
import type {
|
|
9
9
|
ActorKind,
|
|
10
10
|
ComplianceEvidence,
|
|
11
11
|
EvidenceActor,
|
|
12
|
-
EvidenceFilter,
|
|
13
12
|
EvidenceOutcome,
|
|
14
13
|
EvidencePayload,
|
|
15
14
|
RecordFromRunOptions,
|
|
16
|
-
SignedEvidenceBundle,
|
|
17
15
|
} from './types.js';
|
|
18
16
|
|
|
19
17
|
/**
|
|
@@ -31,18 +29,6 @@ export interface ComplianceEvidenceGenerator {
|
|
|
31
29
|
options: RecordFromRunOptions,
|
|
32
30
|
): Promise<Result<{ readonly evidenceId: ComplianceEvidenceId }, ComplianceError>>;
|
|
33
31
|
|
|
34
|
-
/**
|
|
35
|
-
* @deprecated `@kindgi/api` builds and signs a compliance export
|
|
36
|
-
* itself (`collectEvidence`, then the app's export signing key), so
|
|
37
|
-
* nothing calls this. Kept optional so an implementation that still
|
|
38
|
-
* has it compiles; it goes in a later release.
|
|
39
|
-
*/
|
|
40
|
-
exportSigned?(
|
|
41
|
-
tenantId: TenantId,
|
|
42
|
-
filter: EvidenceFilter,
|
|
43
|
-
signingKeyId: SigningKeyId,
|
|
44
|
-
): Promise<Result<SignedEvidenceBundle, ComplianceError>>;
|
|
45
|
-
|
|
46
32
|
describe(): { readonly name: string; readonly version: string };
|
|
47
33
|
}
|
|
48
34
|
|
package/src/index.ts
CHANGED
package/src/resolve-emit.ts
CHANGED
|
@@ -104,9 +104,28 @@ export interface EmitLifecycleEventInput {
|
|
|
104
104
|
readonly errorCode?: string;
|
|
105
105
|
readonly hard?: boolean;
|
|
106
106
|
readonly reason?: string;
|
|
107
|
+
/** A secret set's mode: a new secret, or a new version of one. */
|
|
108
|
+
readonly writeMode?: 'create-new' | 'add-version';
|
|
109
|
+
/** An asynchronous rotation's id (`secret-rotation-started`). */
|
|
110
|
+
readonly rotationId?: string;
|
|
111
|
+
/**
|
|
112
|
+
* The backend dropped a revoked secret's stored values to set it again
|
|
113
|
+
* (a provider that keeps them for a recovery window): the record says
|
|
114
|
+
* their retention ended here.
|
|
115
|
+
*/
|
|
116
|
+
readonly revokedValuesPurged?: true;
|
|
117
|
+
/**
|
|
118
|
+
* Who did it, as the API names its caller (`user:<id>`,
|
|
119
|
+
* `service_account:<id>`, `session:<id>`, `token:<hash>`). Absent: from
|
|
120
|
+
* `resolveContext`, as a binding emits.
|
|
121
|
+
*/
|
|
122
|
+
readonly actor?: string;
|
|
123
|
+
/** The request it came from (the API's `requestId`). */
|
|
124
|
+
readonly correlationId?: string;
|
|
107
125
|
readonly auditEvents: AuditEventBinding;
|
|
108
126
|
readonly tenantId: TenantId;
|
|
109
|
-
|
|
127
|
+
/** The project, for a project-scoped value; absent for a tenant- or org-scoped one. */
|
|
128
|
+
readonly projectId?: ProjectId;
|
|
110
129
|
}
|
|
111
130
|
|
|
112
131
|
/**
|
|
@@ -118,14 +137,18 @@ export interface EmitLifecycleEventInput {
|
|
|
118
137
|
export async function emitLifecycleEvent(input: EmitLifecycleEventInput): Promise<void> {
|
|
119
138
|
const payload = buildLifecyclePayload(input);
|
|
120
139
|
const actor =
|
|
121
|
-
input.
|
|
140
|
+
input.actor ??
|
|
141
|
+
(input.resolveContext !== undefined
|
|
142
|
+
? actorFromResolveContext(input.resolveContext)
|
|
143
|
+
: undefined);
|
|
122
144
|
const event = buildEvent({
|
|
123
145
|
tenantId: input.tenantId,
|
|
124
|
-
projectId: input.projectId,
|
|
146
|
+
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
125
147
|
kind: input.evidenceKind,
|
|
126
148
|
outcome: input.outcome,
|
|
127
149
|
actor,
|
|
128
150
|
runId: input.resolveContext?.runId,
|
|
151
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
129
152
|
payload,
|
|
130
153
|
});
|
|
131
154
|
await safeEmit(input.auditEvents, event);
|
|
@@ -137,11 +160,12 @@ export async function emitLifecycleEvent(input: EmitLifecycleEventInput): Promis
|
|
|
137
160
|
|
|
138
161
|
interface BuildEventInput {
|
|
139
162
|
readonly tenantId: TenantId;
|
|
140
|
-
readonly projectId
|
|
163
|
+
readonly projectId?: ProjectId;
|
|
141
164
|
readonly kind: string;
|
|
142
165
|
readonly outcome: string;
|
|
143
166
|
readonly actor: string | undefined;
|
|
144
167
|
readonly runId: string | undefined;
|
|
168
|
+
readonly correlationId?: string;
|
|
145
169
|
readonly payload: Readonly<Record<string, unknown>>;
|
|
146
170
|
}
|
|
147
171
|
|
|
@@ -149,12 +173,13 @@ function buildEvent(input: BuildEventInput): AuditEvent {
|
|
|
149
173
|
return {
|
|
150
174
|
id: randomUUID(),
|
|
151
175
|
tenantId: input.tenantId,
|
|
152
|
-
projectId: input.projectId,
|
|
176
|
+
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
153
177
|
kind: input.kind,
|
|
154
178
|
timestamp: new Date().toISOString() as unknown as Timestamp,
|
|
155
179
|
actor: input.actor ?? 'user:system',
|
|
156
180
|
outcome: input.outcome,
|
|
157
181
|
...(input.runId !== undefined && { runId: input.runId }),
|
|
182
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
158
183
|
payload: { v: 1, doc: input.payload },
|
|
159
184
|
};
|
|
160
185
|
}
|
|
@@ -250,6 +275,9 @@ function buildLifecyclePayload(input: EmitLifecycleEventInput): Readonly<Record<
|
|
|
250
275
|
if (input.errorCode !== undefined) payload.errorCode = input.errorCode;
|
|
251
276
|
if (input.hard !== undefined) payload.hard = input.hard;
|
|
252
277
|
if (input.reason !== undefined) payload.reason = input.reason;
|
|
278
|
+
if (input.writeMode !== undefined) payload.writeMode = input.writeMode;
|
|
279
|
+
if (input.rotationId !== undefined) payload.rotationId = input.rotationId;
|
|
280
|
+
if (input.revokedValuesPurged === true) payload.revokedValuesPurged = true;
|
|
253
281
|
if (input.resolveContext?.nodeId !== undefined) payload.nodeId = input.resolveContext.nodeId;
|
|
254
282
|
if (input.resolveContext?.runId !== undefined) payload.runId = input.resolveContext.runId;
|
|
255
283
|
return payload;
|
package/src/types.ts
CHANGED
|
@@ -340,8 +340,8 @@ export interface RecordFromRunOptions {
|
|
|
340
340
|
}
|
|
341
341
|
|
|
342
342
|
/**
|
|
343
|
-
* Filter shape shared by evidence listing and signed
|
|
344
|
-
* (`
|
|
343
|
+
* Filter shape shared by evidence listing and the signed compliance
|
|
344
|
+
* export (`@kindgi/api` collects, then signs). `ComplianceProvider.list`
|
|
345
345
|
* takes `ListEvidenceFilter` instead. Every field is optional; an empty
|
|
346
346
|
* filter is "everything in the tenant". Composition is AND — all
|
|
347
347
|
* populated fields must match.
|