@kindgi/compliance 0.1.8 → 0.1.9-rc.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/resolve-emit.d.ts +54 -4
- package/dist/resolve-emit.d.ts.map +1 -1
- package/dist/resolve-emit.js +54 -18
- package/dist/resolve-emit.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +12 -0
- package/dist/types.js.map +1 -1
- package/package.json +6 -5
- package/src/index.ts +8 -1
- package/src/resolve-emit.ts +109 -23
- package/src/types.ts +12 -0
package/README.md
CHANGED
|
@@ -24,7 +24,7 @@ Evidence is a classification lens over the audit-event stream from [`@kindgi/aud
|
|
|
24
24
|
- **`Classification`** — `retention` (`days`, `onDenyDays?`, `legalHold?`), `signed`, `exportable`.
|
|
25
25
|
- **`LoadedClassifier`** — `file` plus `resolve(kind)`, which returns the per-kind entry or the default.
|
|
26
26
|
- **`auditEventToEvidence(event)`** — pure transform from an `AuditEvent` to an `Evidence` record (unwraps the `{ v, doc }` payload envelope).
|
|
27
|
-
- **`emitResolveEvent(input)`** / **`emitLifecycleEvent(input)`** — append `env-resolved` / `secret-resolved` and `env-set` / `secret-rotated` / … audit events to an `AuditEventBinding`. Payloads carry metadata only (scope, name, version, caller), never the value.
|
|
27
|
+
- **`emitResolveEvent(input)`** / **`emitLifecycleEvent(input)`** — append `env-resolved` / `secret-resolved` and `env-set` / `secret-rotated` / … audit events to an `AuditEventBinding`. Payloads carry metadata only (scope, name, version, caller), never the value. An append that fails or throws is never thrown: it's logged at `warn` through the input's `log` (a `@kindgi/log` `Logger`), and without one it isn't logged anywhere. Inputs: **`EmitResolveEventInput`**, **`EmitLifecycleEventInput`**, **`ResolveContext`**.
|
|
28
28
|
- **Errors** — **`ComplianceError`** union of `InvalidEvidenceError`, `PersistenceError`, `SignerFailureError`, `SigningKeyMissingError`, `SigningFailureError`, `InvalidCursorError`, `ProjectNotFoundError`, `UnsupportedVersionError`, each with a `code`. **`EmitResult`** and **`ListResult`** are the `ComplianceProvider` return types.
|
|
29
29
|
|
|
30
30
|
## Example
|
package/dist/index.d.ts
CHANGED
|
@@ -6,6 +6,6 @@ export type { Classification, ComplianceClassifierFile, ComplianceClassifierSour
|
|
|
6
6
|
export type { ComplianceEvidenceGenerator } from './generator.js';
|
|
7
7
|
export { auditEventToEvidence } from './generator.js';
|
|
8
8
|
export { EVIDENCE_EXPORT_PAGE_SIZE, collectEvidence, evidenceFilterToAuditFilter, } from './collect.js';
|
|
9
|
-
export { emitLifecycleEvent, emitResolveEvent } from './resolve-emit.js';
|
|
10
|
-
export type { EmitLifecycleEventInput, EmitResolveEventInput, ResolveContext, } from './resolve-emit.js';
|
|
9
|
+
export { emitAuditEvent, emitLifecycleEvent, emitResolveEvent, resolveEvent, } from './resolve-emit.js';
|
|
10
|
+
export type { EmitAuditEventInput, EmitLifecycleEventInput, EmitResolveEventInput, ResolveContext, ResolveEventInput, } from './resolve-emit.js';
|
|
11
11
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -5,5 +5,5 @@ export { EVIDENCE_KINDS } from './types.js';
|
|
|
5
5
|
export { auditEventToEvidence } from './generator.js';
|
|
6
6
|
export { EVIDENCE_EXPORT_PAGE_SIZE, collectEvidence, evidenceFilterToAuditFilter, } from './collect.js';
|
|
7
7
|
// ============ Resolve + lifecycle event emitters ============
|
|
8
|
-
export { emitLifecycleEvent, emitResolveEvent } from './resolve-emit.js';
|
|
8
|
+
export { emitAuditEvent, emitLifecycleEvent, emitResolveEvent, resolveEvent, } from './resolve-emit.js';
|
|
9
9
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,+DAA+D;AAC/D,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,+DAA+D;AAC/D,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,GACb,MAAM,mBAAmB,CAAC"}
|
package/dist/resolve-emit.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import type { AuditEventBinding } from '@kindgi/audit-events';
|
|
1
|
+
import type { AuditEvent, AuditEventBinding } from '@kindgi/audit-events';
|
|
2
|
+
import type { Logger } from '@kindgi/log';
|
|
2
3
|
import type { Scope } from '@kindgi/platform';
|
|
3
4
|
import type { EnvName, ProjectId, TenantId } from '@kindgi/types';
|
|
4
5
|
/**
|
|
@@ -11,7 +12,7 @@ export interface ResolveContext {
|
|
|
11
12
|
readonly runId?: string;
|
|
12
13
|
readonly deploymentId?: string;
|
|
13
14
|
readonly nodeId?: string;
|
|
14
|
-
readonly caller: 'dispatch' | 'deploy-sync' | 'admin-cli' | 'boot-bridge' | 'webhook-receiver';
|
|
15
|
+
readonly caller: 'dispatch' | 'deploy-sync' | 'admin-cli' | 'boot-bridge' | 'webhook-receiver' | 'pack-env';
|
|
15
16
|
}
|
|
16
17
|
/** Input to `emitResolveEvent`. */
|
|
17
18
|
export interface EmitResolveEventInput {
|
|
@@ -22,12 +23,22 @@ export interface EmitResolveEventInput {
|
|
|
22
23
|
readonly outcome: 'succeeded' | 'failed';
|
|
23
24
|
readonly resolveContext: ResolveContext;
|
|
24
25
|
readonly version?: number;
|
|
26
|
+
/** The revision a value was given out under (a pack env secret's, `ps1-…`), never the value. */
|
|
27
|
+
readonly revision?: string;
|
|
25
28
|
readonly errorCode?: string;
|
|
29
|
+
/** The request it came from (the API's `requestId`). */
|
|
30
|
+
readonly correlationId?: string;
|
|
31
|
+
/** The system key that was given the value, by its id (never its token): a pack env secret's. */
|
|
32
|
+
readonly systemKeyId?: string;
|
|
26
33
|
readonly auditEvents: AuditEventBinding;
|
|
27
34
|
readonly tenantId: TenantId;
|
|
28
35
|
/** The project the event belongs to; absent for one that's the tenant's or an org's. */
|
|
29
36
|
readonly projectId?: ProjectId;
|
|
37
|
+
/** Where an append that fails or throws is logged, at `warn`. Absent: it isn't logged. */
|
|
38
|
+
readonly log?: Logger;
|
|
30
39
|
}
|
|
40
|
+
/** What `resolveEvent` builds an event from: `emitResolveEvent`'s input, without where it goes. */
|
|
41
|
+
export type ResolveEventInput = Omit<EmitResolveEventInput, 'auditEvents' | 'log'>;
|
|
31
42
|
/**
|
|
32
43
|
* Emit an `env-resolved` or `secret-resolved` audit event.
|
|
33
44
|
*
|
|
@@ -35,10 +46,17 @@ export interface EmitResolveEventInput {
|
|
|
35
46
|
* outcome carries the plaintext to the caller; the audit event carries
|
|
36
47
|
* only the fact-of-resolution + version + scope + caller attribution.
|
|
37
48
|
*
|
|
38
|
-
* Fire-and-forget:
|
|
39
|
-
*
|
|
49
|
+
* Fire-and-forget: an append that fails or throws is logged through
|
|
50
|
+
* `log` (when given) and swallowed. The resolve path must not fail
|
|
51
|
+
* because the audit sink is unreachable.
|
|
40
52
|
*/
|
|
41
53
|
export declare function emitResolveEvent(input: EmitResolveEventInput): Promise<void>;
|
|
54
|
+
/**
|
|
55
|
+
* The `env-resolved` or `secret-resolved` event `emitResolveEvent` emits,
|
|
56
|
+
* for a caller that appends it itself: one whose read mustn't go on when
|
|
57
|
+
* its row can't be written. It never carries the value.
|
|
58
|
+
*/
|
|
59
|
+
export declare function resolveEvent(input: ResolveEventInput): AuditEvent;
|
|
42
60
|
/**
|
|
43
61
|
* Input to `emitLifecycleEvent`. Used for env `set` / `delete` and
|
|
44
62
|
* secret `set` / `rotate` / `revoke` — the non-resolve write ops that
|
|
@@ -84,6 +102,8 @@ export interface EmitLifecycleEventInput {
|
|
|
84
102
|
readonly tenantId: TenantId;
|
|
85
103
|
/** The project, for a project-scoped value; absent for a tenant- or org-scoped one. */
|
|
86
104
|
readonly projectId?: ProjectId;
|
|
105
|
+
/** Where an append that fails or throws is logged, at `warn`. Absent: it isn't logged. */
|
|
106
|
+
readonly log?: Logger;
|
|
87
107
|
}
|
|
88
108
|
/**
|
|
89
109
|
* Emit a non-resolve lifecycle event (`env-set` / `env-deleted` /
|
|
@@ -92,4 +112,34 @@ export interface EmitLifecycleEventInput {
|
|
|
92
112
|
* Same fire-and-forget contract as `emitResolveEvent`.
|
|
93
113
|
*/
|
|
94
114
|
export declare function emitLifecycleEvent(input: EmitLifecycleEventInput): Promise<void>;
|
|
115
|
+
/** Input to {@link emitAuditEvent}: a lifecycle event outside the env / secret paths. */
|
|
116
|
+
export interface EmitAuditEventInput {
|
|
117
|
+
/** Where the event lands; absent (no audit binding) → nothing is recorded. */
|
|
118
|
+
readonly auditEvents: AuditEventBinding | undefined;
|
|
119
|
+
readonly tenantId: TenantId;
|
|
120
|
+
/** The event's project, when it has one (query scoping). */
|
|
121
|
+
readonly projectId?: ProjectId;
|
|
122
|
+
/** The event kind — a built-in `EvidenceKind` or a pack's own. */
|
|
123
|
+
readonly kind: string;
|
|
124
|
+
/** Who did it, as the API names its caller (`user:<id>` / `service_account:<id>`). */
|
|
125
|
+
readonly actor?: string;
|
|
126
|
+
/** The outcome, when the event has one; defaults to `succeeded`. */
|
|
127
|
+
readonly outcome?: string;
|
|
128
|
+
/** The request it came from (the API's `requestId`). */
|
|
129
|
+
readonly correlationId?: string;
|
|
130
|
+
/** The kernel run it was emitted in, when any. */
|
|
131
|
+
readonly runId?: string;
|
|
132
|
+
/** The kind-specific body, wrapped as the versioned `{ v: 1, doc }` envelope. */
|
|
133
|
+
readonly doc: Readonly<Record<string, unknown>>;
|
|
134
|
+
/** Where an append that fails or throws is logged, at `warn`. Absent: it isn't logged. */
|
|
135
|
+
readonly log?: Logger;
|
|
136
|
+
}
|
|
137
|
+
/**
|
|
138
|
+
* Emit a lifecycle audit event the env / secret and resolve paths don't
|
|
139
|
+
* cover — a route-layer event such as a trigger's owner change. Builds the
|
|
140
|
+
* canonical event (its id, timestamp and `{ v: 1, doc }` payload envelope)
|
|
141
|
+
* and appends it, fire-and-forget on the same contract as the others: an
|
|
142
|
+
* append that fails or throws is logged at `warn`, never raised.
|
|
143
|
+
*/
|
|
144
|
+
export declare function emitAuditEvent(input: EmitAuditEventInput): Promise<void>;
|
|
95
145
|
//# sourceMappingURL=resolve-emit.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EACX,UAAU,GACV,aAAa,GACb,WAAW,GACX,aAAa,GACb,kBAAkB,GAClB,UAAU,CAAC;CAChB;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,mGAAmG;AACnG,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,KAAK,CAAC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,UAAU,CAWjE;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,aAAa,CAAC;IAClD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBtF;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9E"}
|
package/dist/resolve-emit.js
CHANGED
|
@@ -14,8 +14,10 @@
|
|
|
14
14
|
* - Framework NEVER copies a secret plaintext `value` into a payload.
|
|
15
15
|
* Payloads carry only metadata (name, version, scope,
|
|
16
16
|
* caller, errorCode).
|
|
17
|
-
* - Emission is fire-and-forget:
|
|
18
|
-
*
|
|
17
|
+
* - Emission is fire-and-forget: an append that fails or throws
|
|
18
|
+
* never poisons the caller's op. It's logged at `warn` through the
|
|
19
|
+
* caller's `log`, when the caller passes one; without one it isn't
|
|
20
|
+
* logged anywhere.
|
|
19
21
|
* - The `resolveContext.caller` discriminant maps to a distinct
|
|
20
22
|
* `actor` string.
|
|
21
23
|
*/
|
|
@@ -27,23 +29,29 @@ import { randomUUID } from 'node:crypto';
|
|
|
27
29
|
* outcome carries the plaintext to the caller; the audit event carries
|
|
28
30
|
* only the fact-of-resolution + version + scope + caller attribution.
|
|
29
31
|
*
|
|
30
|
-
* Fire-and-forget:
|
|
31
|
-
*
|
|
32
|
+
* Fire-and-forget: an append that fails or throws is logged through
|
|
33
|
+
* `log` (when given) and swallowed. The resolve path must not fail
|
|
34
|
+
* because the audit sink is unreachable.
|
|
32
35
|
*/
|
|
33
36
|
export async function emitResolveEvent(input) {
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
37
|
+
await safeEmit(input.auditEvents, resolveEvent(input), input.log);
|
|
38
|
+
}
|
|
39
|
+
/**
|
|
40
|
+
* The `env-resolved` or `secret-resolved` event `emitResolveEvent` emits,
|
|
41
|
+
* for a caller that appends it itself: one whose read mustn't go on when
|
|
42
|
+
* its row can't be written. It never carries the value.
|
|
43
|
+
*/
|
|
44
|
+
export function resolveEvent(input) {
|
|
45
|
+
return buildEvent({
|
|
38
46
|
tenantId: input.tenantId,
|
|
39
47
|
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
40
|
-
kind,
|
|
48
|
+
kind: input.kind === 'env' ? 'env-resolved' : 'secret-resolved',
|
|
41
49
|
outcome: input.outcome,
|
|
42
|
-
actor,
|
|
50
|
+
actor: actorFromResolveContext(input.resolveContext),
|
|
43
51
|
runId: input.resolveContext.runId,
|
|
44
|
-
|
|
52
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
53
|
+
payload: buildResolvePayload(input),
|
|
45
54
|
});
|
|
46
|
-
await safeEmit(input.auditEvents, event);
|
|
47
55
|
}
|
|
48
56
|
/**
|
|
49
57
|
* Emit a non-resolve lifecycle event (`env-set` / `env-deleted` /
|
|
@@ -67,7 +75,29 @@ export async function emitLifecycleEvent(input) {
|
|
|
67
75
|
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
68
76
|
payload,
|
|
69
77
|
});
|
|
70
|
-
await safeEmit(input.auditEvents, event);
|
|
78
|
+
await safeEmit(input.auditEvents, event, input.log);
|
|
79
|
+
}
|
|
80
|
+
/**
|
|
81
|
+
* Emit a lifecycle audit event the env / secret and resolve paths don't
|
|
82
|
+
* cover — a route-layer event such as a trigger's owner change. Builds the
|
|
83
|
+
* canonical event (its id, timestamp and `{ v: 1, doc }` payload envelope)
|
|
84
|
+
* and appends it, fire-and-forget on the same contract as the others: an
|
|
85
|
+
* append that fails or throws is logged at `warn`, never raised.
|
|
86
|
+
*/
|
|
87
|
+
export async function emitAuditEvent(input) {
|
|
88
|
+
if (input.auditEvents === undefined)
|
|
89
|
+
return;
|
|
90
|
+
const event = buildEvent({
|
|
91
|
+
tenantId: input.tenantId,
|
|
92
|
+
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
93
|
+
kind: input.kind,
|
|
94
|
+
outcome: input.outcome ?? 'succeeded',
|
|
95
|
+
actor: input.actor,
|
|
96
|
+
runId: input.runId,
|
|
97
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
98
|
+
payload: input.doc,
|
|
99
|
+
});
|
|
100
|
+
await safeEmit(input.auditEvents, event, input.log);
|
|
71
101
|
}
|
|
72
102
|
function buildEvent(input) {
|
|
73
103
|
return {
|
|
@@ -83,17 +113,15 @@ function buildEvent(input) {
|
|
|
83
113
|
payload: { v: 1, doc: input.payload },
|
|
84
114
|
};
|
|
85
115
|
}
|
|
86
|
-
async function safeEmit(binding, event) {
|
|
116
|
+
async function safeEmit(binding, event, log) {
|
|
87
117
|
try {
|
|
88
118
|
const result = await binding.append([event]);
|
|
89
119
|
if (result.kind === 'err') {
|
|
90
|
-
|
|
91
|
-
console.warn(`[compliance] emit ${event.kind} audit event failed: ${result.error.message}`);
|
|
120
|
+
log?.warn(`${event.kind} audit event failed: ${result.error.message}`, { tenantId: event.tenantId, kind: event.kind, code: result.error.code }, { inMessage: ['kind'] });
|
|
92
121
|
}
|
|
93
122
|
}
|
|
94
123
|
catch (cause) {
|
|
95
|
-
|
|
96
|
-
console.warn(`[compliance] emit ${event.kind} audit event threw: ${cause instanceof Error ? cause.message : String(cause)}`);
|
|
124
|
+
log?.warn(`${event.kind} audit event failed`, { tenantId: event.tenantId, kind: event.kind, err: cause }, { inMessage: ['kind'] });
|
|
97
125
|
}
|
|
98
126
|
}
|
|
99
127
|
/**
|
|
@@ -107,6 +135,7 @@ function actorFromResolveContext(ctx) {
|
|
|
107
135
|
case 'dispatch':
|
|
108
136
|
return ctx.runId !== undefined ? `agent:${ctx.runId}` : 'agent:unknown';
|
|
109
137
|
case 'deploy-sync':
|
|
138
|
+
case 'pack-env':
|
|
110
139
|
return ctx.deploymentId !== undefined ? `system:${ctx.deploymentId}` : 'system:deploy';
|
|
111
140
|
case 'admin-cli':
|
|
112
141
|
return 'user:admin';
|
|
@@ -147,8 +176,15 @@ function buildResolvePayload(input) {
|
|
|
147
176
|
};
|
|
148
177
|
if (input.version !== undefined)
|
|
149
178
|
payload.recordVersion = input.version;
|
|
179
|
+
if (input.revision !== undefined)
|
|
180
|
+
payload.revision = input.revision;
|
|
181
|
+
if (input.resolveContext.deploymentId !== undefined) {
|
|
182
|
+
payload.deploymentId = input.resolveContext.deploymentId;
|
|
183
|
+
}
|
|
150
184
|
if (input.errorCode !== undefined)
|
|
151
185
|
payload.errorCode = input.errorCode;
|
|
186
|
+
if (input.systemKeyId !== undefined)
|
|
187
|
+
payload.systemKeyId = input.systemKeyId;
|
|
152
188
|
if (input.resolveContext.nodeId !== undefined)
|
|
153
189
|
payload.nodeId = input.resolveContext.nodeId;
|
|
154
190
|
if (input.resolveContext.runId !== undefined)
|
package/dist/resolve-emit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC
|
|
1
|
+
{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqDzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB;QAC/D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;QACjC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC;KACpC,CAAC,CAAC;AACL,CAAC;AAmDD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GACT,KAAK,CAAC,KAAK;QACX,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;YACjC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK;QAClC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAyBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA0B;IAC7D,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,WAAW;QACrC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO,EAAE,KAAK,CAAC,GAAG;KACnB,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAiBD,SAAS,UAAU,CAAC,KAAsB;IACxC,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAA0B;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAA0B,EAC1B,KAAiB,EACjB,GAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,GAAG,EAAE,IAAI,CACP,GAAG,KAAK,CAAC,IAAI,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAC3D,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EACvE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,IAAI,CACP,GAAG,KAAK,CAAC,IAAI,qBAAqB,EAClC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAC1D,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAmB;IAClD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1E,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACzF,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAY;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK,CAAC,QAA6B;YAC7C,KAAK,EAAE,KAAK,CAAC,KAA0B;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,QAA6B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAA8B;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAwB;IACnD,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACpE,IAAI,KAAK,CAAC,cAAc,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC7E,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC5F,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1E,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC3E,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC7F,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -7,7 +7,7 @@ import type { AgentId, ComplianceEvidenceId, FlowId, ProjectId, ProvenanceId, Ru
|
|
|
7
7
|
* whose kinds are open (pack authors add their own), and a deployment's
|
|
8
8
|
* compliance classifier can mark any kind exportable. See `EvidenceKind`.
|
|
9
9
|
*/
|
|
10
|
-
export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision", "agent-promotion", "agent-promotion-refused", "agent-rollback", "agent-live-unpinned", "agent-live-pin-inactive", "api-key-minted", "api-key-revoked", "service-account-created", "service-account-granted", "service-account-ungranted", "service-account-unregistered", "person-added", "person-granted", "person-ungranted"];
|
|
10
|
+
export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision", "agent-promotion", "agent-promotion-refused", "agent-rollback", "agent-live-unpinned", "agent-live-pin-inactive", "api-key-minted", "api-key-revoked", "service-account-created", "service-account-granted", "service-account-ungranted", "service-account-unregistered", "person-added", "person-granted", "person-ungranted", "trigger-owner-set", "environment-order-set", "deployment-promoted"];
|
|
11
11
|
/**
|
|
12
12
|
* An evidence kind: one of the built-in `EVIDENCE_KINDS`, or any other
|
|
13
13
|
* audit-event kind a deployment's classifier marks exportable. Consumers
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,63BAwEjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEnG;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC5E,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;CACzB;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}
|
package/dist/types.js
CHANGED
|
@@ -69,5 +69,17 @@ export const EVIDENCE_KINDS = [
|
|
|
69
69
|
'person-added',
|
|
70
70
|
'person-granted',
|
|
71
71
|
'person-ungranted',
|
|
72
|
+
// A trigger's owner (the principal its runs act as) set at registration
|
|
73
|
+
// or changed on take-over — a delegation when it names a service account.
|
|
74
|
+
'trigger-owner-set',
|
|
75
|
+
// The order a tenant (or one of its orgs) runs a project through to live
|
|
76
|
+
// was set, changed or cleared. The payload carries the order before and
|
|
77
|
+
// after, each a list of project ids — never anything a project holds.
|
|
78
|
+
'environment-order-set',
|
|
79
|
+
// A deployment was promoted into the next environment of its order: a new
|
|
80
|
+
// deployment there, or versions carried onto the one it had. The payload
|
|
81
|
+
// names both deployments, both projects, the image digest and the
|
|
82
|
+
// versions carried — never anything a project holds.
|
|
83
|
+
'deployment-promoted',
|
|
72
84
|
];
|
|
73
85
|
//# sourceMappingURL=types.js.map
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;IACf,uEAAuE;IACvE,oDAAoD;IACpD,iBAAiB;IACjB,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB;IAChB,qBAAqB;IACrB,uEAAuE;IACvE,yBAAyB;IACzB,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,yBAAyB;IACzB,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,cAAc;IACd,gBAAgB;IAChB,kBAAkB;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;IACf,uEAAuE;IACvE,oDAAoD;IACpD,iBAAiB;IACjB,+EAA+E;IAC/E,yBAAyB;IACzB,gBAAgB;IAChB,qBAAqB;IACrB,uEAAuE;IACvE,yBAAyB;IACzB,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,yBAAyB;IACzB,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,wEAAwE;IACxE,0EAA0E;IAC1E,mBAAmB;IACnB,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uBAAuB;IACvB,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,qDAAqD;IACrD,qBAAqB;CACb,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kindgi/compliance",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.9-rc.0",
|
|
4
4
|
"description": "Kindgi™ compliance evidence contract. Types for the Evidence wire record and its sub-types (EvidenceActor, EvidenceSubject, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, ProvenanceRef, ActorKind; ComplianceEvidence alias), the ComplianceProvider seam (EmitEvidenceInput, ListEvidenceFilter, EvidenceSigner), the ComplianceEvidenceGenerator interface with its inputs (RecordFromRunOptions, RunEvidenceContext, ModelCallSummary, ToolInvocationSummary, GuardrailResultSummary), EvidenceFilter, EvidencePage, SignedEvidenceBundle and EvidenceBundleBody, the classifier file format (ComplianceClassifierFile, Classification, LoadedClassifier), and the ComplianceError union. Runtime exports: the EVIDENCE_KINDS list, the pure auditEventToEvidence transform, and emitResolveEvent / emitLifecycleEvent, which append env-* and secret-* audit events to an AuditEventBinding. The generator implementation and the classifier loader are provided by the Kindgi runtime or by the caller.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -28,12 +28,13 @@
|
|
|
28
28
|
"README.md"
|
|
29
29
|
],
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@kindgi/audit-events": "0.1.
|
|
32
|
-
"@kindgi/
|
|
33
|
-
"@kindgi/
|
|
31
|
+
"@kindgi/audit-events": "0.1.9-rc.0",
|
|
32
|
+
"@kindgi/log": "0.1.9-rc.0",
|
|
33
|
+
"@kindgi/platform": "0.1.9-rc.0",
|
|
34
|
+
"@kindgi/types": "0.1.9-rc.0"
|
|
34
35
|
},
|
|
35
36
|
"devDependencies": {
|
|
36
|
-
"@kindgi/specs": "0.1.
|
|
37
|
+
"@kindgi/specs": "0.1.9-rc.0",
|
|
37
38
|
"@types/node": "^22.10.5",
|
|
38
39
|
"typescript": "^5.7.3",
|
|
39
40
|
"vitest": "^2.1.8"
|
package/src/index.ts
CHANGED
|
@@ -66,9 +66,16 @@ export {
|
|
|
66
66
|
} from './collect.js';
|
|
67
67
|
|
|
68
68
|
// ============ Resolve + lifecycle event emitters ============
|
|
69
|
-
export {
|
|
69
|
+
export {
|
|
70
|
+
emitAuditEvent,
|
|
71
|
+
emitLifecycleEvent,
|
|
72
|
+
emitResolveEvent,
|
|
73
|
+
resolveEvent,
|
|
74
|
+
} from './resolve-emit.js';
|
|
70
75
|
export type {
|
|
76
|
+
EmitAuditEventInput,
|
|
71
77
|
EmitLifecycleEventInput,
|
|
72
78
|
EmitResolveEventInput,
|
|
73
79
|
ResolveContext,
|
|
80
|
+
ResolveEventInput,
|
|
74
81
|
} from './resolve-emit.js';
|
package/src/resolve-emit.ts
CHANGED
|
@@ -15,8 +15,10 @@
|
|
|
15
15
|
* - Framework NEVER copies a secret plaintext `value` into a payload.
|
|
16
16
|
* Payloads carry only metadata (name, version, scope,
|
|
17
17
|
* caller, errorCode).
|
|
18
|
-
* - Emission is fire-and-forget:
|
|
19
|
-
*
|
|
18
|
+
* - Emission is fire-and-forget: an append that fails or throws
|
|
19
|
+
* never poisons the caller's op. It's logged at `warn` through the
|
|
20
|
+
* caller's `log`, when the caller passes one; without one it isn't
|
|
21
|
+
* logged anywhere.
|
|
20
22
|
* - The `resolveContext.caller` discriminant maps to a distinct
|
|
21
23
|
* `actor` string.
|
|
22
24
|
*/
|
|
@@ -24,6 +26,7 @@
|
|
|
24
26
|
import { randomUUID } from 'node:crypto';
|
|
25
27
|
|
|
26
28
|
import type { AuditEvent, AuditEventBinding } from '@kindgi/audit-events';
|
|
29
|
+
import type { Logger } from '@kindgi/log';
|
|
27
30
|
import type { Scope } from '@kindgi/platform';
|
|
28
31
|
import type { EnvName, ProjectId, TenantId, Timestamp } from '@kindgi/types';
|
|
29
32
|
|
|
@@ -37,7 +40,13 @@ export interface ResolveContext {
|
|
|
37
40
|
readonly runId?: string;
|
|
38
41
|
readonly deploymentId?: string;
|
|
39
42
|
readonly nodeId?: string;
|
|
40
|
-
readonly caller:
|
|
43
|
+
readonly caller:
|
|
44
|
+
| 'dispatch'
|
|
45
|
+
| 'deploy-sync'
|
|
46
|
+
| 'admin-cli'
|
|
47
|
+
| 'boot-bridge'
|
|
48
|
+
| 'webhook-receiver'
|
|
49
|
+
| 'pack-env';
|
|
41
50
|
}
|
|
42
51
|
|
|
43
52
|
/** Input to `emitResolveEvent`. */
|
|
@@ -49,13 +58,24 @@ export interface EmitResolveEventInput {
|
|
|
49
58
|
readonly outcome: 'succeeded' | 'failed';
|
|
50
59
|
readonly resolveContext: ResolveContext;
|
|
51
60
|
readonly version?: number;
|
|
61
|
+
/** The revision a value was given out under (a pack env secret's, `ps1-…`), never the value. */
|
|
62
|
+
readonly revision?: string;
|
|
52
63
|
readonly errorCode?: string;
|
|
64
|
+
/** The request it came from (the API's `requestId`). */
|
|
65
|
+
readonly correlationId?: string;
|
|
66
|
+
/** The system key that was given the value, by its id (never its token): a pack env secret's. */
|
|
67
|
+
readonly systemKeyId?: string;
|
|
53
68
|
readonly auditEvents: AuditEventBinding;
|
|
54
69
|
readonly tenantId: TenantId;
|
|
55
70
|
/** The project the event belongs to; absent for one that's the tenant's or an org's. */
|
|
56
71
|
readonly projectId?: ProjectId;
|
|
72
|
+
/** Where an append that fails or throws is logged, at `warn`. Absent: it isn't logged. */
|
|
73
|
+
readonly log?: Logger;
|
|
57
74
|
}
|
|
58
75
|
|
|
76
|
+
/** What `resolveEvent` builds an event from: `emitResolveEvent`'s input, without where it goes. */
|
|
77
|
+
export type ResolveEventInput = Omit<EmitResolveEventInput, 'auditEvents' | 'log'>;
|
|
78
|
+
|
|
59
79
|
/**
|
|
60
80
|
* Emit an `env-resolved` or `secret-resolved` audit event.
|
|
61
81
|
*
|
|
@@ -63,23 +83,30 @@ export interface EmitResolveEventInput {
|
|
|
63
83
|
* outcome carries the plaintext to the caller; the audit event carries
|
|
64
84
|
* only the fact-of-resolution + version + scope + caller attribution.
|
|
65
85
|
*
|
|
66
|
-
* Fire-and-forget:
|
|
67
|
-
*
|
|
86
|
+
* Fire-and-forget: an append that fails or throws is logged through
|
|
87
|
+
* `log` (when given) and swallowed. The resolve path must not fail
|
|
88
|
+
* because the audit sink is unreachable.
|
|
68
89
|
*/
|
|
69
90
|
export async function emitResolveEvent(input: EmitResolveEventInput): Promise<void> {
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
91
|
+
await safeEmit(input.auditEvents, resolveEvent(input), input.log);
|
|
92
|
+
}
|
|
93
|
+
|
|
94
|
+
/**
|
|
95
|
+
* The `env-resolved` or `secret-resolved` event `emitResolveEvent` emits,
|
|
96
|
+
* for a caller that appends it itself: one whose read mustn't go on when
|
|
97
|
+
* its row can't be written. It never carries the value.
|
|
98
|
+
*/
|
|
99
|
+
export function resolveEvent(input: ResolveEventInput): AuditEvent {
|
|
100
|
+
return buildEvent({
|
|
74
101
|
tenantId: input.tenantId,
|
|
75
102
|
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
76
|
-
kind,
|
|
103
|
+
kind: input.kind === 'env' ? 'env-resolved' : 'secret-resolved',
|
|
77
104
|
outcome: input.outcome,
|
|
78
|
-
actor,
|
|
105
|
+
actor: actorFromResolveContext(input.resolveContext),
|
|
79
106
|
runId: input.resolveContext.runId,
|
|
80
|
-
|
|
107
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
108
|
+
payload: buildResolvePayload(input),
|
|
81
109
|
});
|
|
82
|
-
await safeEmit(input.auditEvents, event);
|
|
83
110
|
}
|
|
84
111
|
|
|
85
112
|
/**
|
|
@@ -127,6 +154,8 @@ export interface EmitLifecycleEventInput {
|
|
|
127
154
|
readonly tenantId: TenantId;
|
|
128
155
|
/** The project, for a project-scoped value; absent for a tenant- or org-scoped one. */
|
|
129
156
|
readonly projectId?: ProjectId;
|
|
157
|
+
/** Where an append that fails or throws is logged, at `warn`. Absent: it isn't logged. */
|
|
158
|
+
readonly log?: Logger;
|
|
130
159
|
}
|
|
131
160
|
|
|
132
161
|
/**
|
|
@@ -152,7 +181,52 @@ export async function emitLifecycleEvent(input: EmitLifecycleEventInput): Promis
|
|
|
152
181
|
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
153
182
|
payload,
|
|
154
183
|
});
|
|
155
|
-
await safeEmit(input.auditEvents, event);
|
|
184
|
+
await safeEmit(input.auditEvents, event, input.log);
|
|
185
|
+
}
|
|
186
|
+
|
|
187
|
+
/** Input to {@link emitAuditEvent}: a lifecycle event outside the env / secret paths. */
|
|
188
|
+
export interface EmitAuditEventInput {
|
|
189
|
+
/** Where the event lands; absent (no audit binding) → nothing is recorded. */
|
|
190
|
+
readonly auditEvents: AuditEventBinding | undefined;
|
|
191
|
+
readonly tenantId: TenantId;
|
|
192
|
+
/** The event's project, when it has one (query scoping). */
|
|
193
|
+
readonly projectId?: ProjectId;
|
|
194
|
+
/** The event kind — a built-in `EvidenceKind` or a pack's own. */
|
|
195
|
+
readonly kind: string;
|
|
196
|
+
/** Who did it, as the API names its caller (`user:<id>` / `service_account:<id>`). */
|
|
197
|
+
readonly actor?: string;
|
|
198
|
+
/** The outcome, when the event has one; defaults to `succeeded`. */
|
|
199
|
+
readonly outcome?: string;
|
|
200
|
+
/** The request it came from (the API's `requestId`). */
|
|
201
|
+
readonly correlationId?: string;
|
|
202
|
+
/** The kernel run it was emitted in, when any. */
|
|
203
|
+
readonly runId?: string;
|
|
204
|
+
/** The kind-specific body, wrapped as the versioned `{ v: 1, doc }` envelope. */
|
|
205
|
+
readonly doc: Readonly<Record<string, unknown>>;
|
|
206
|
+
/** Where an append that fails or throws is logged, at `warn`. Absent: it isn't logged. */
|
|
207
|
+
readonly log?: Logger;
|
|
208
|
+
}
|
|
209
|
+
|
|
210
|
+
/**
|
|
211
|
+
* Emit a lifecycle audit event the env / secret and resolve paths don't
|
|
212
|
+
* cover — a route-layer event such as a trigger's owner change. Builds the
|
|
213
|
+
* canonical event (its id, timestamp and `{ v: 1, doc }` payload envelope)
|
|
214
|
+
* and appends it, fire-and-forget on the same contract as the others: an
|
|
215
|
+
* append that fails or throws is logged at `warn`, never raised.
|
|
216
|
+
*/
|
|
217
|
+
export async function emitAuditEvent(input: EmitAuditEventInput): Promise<void> {
|
|
218
|
+
if (input.auditEvents === undefined) return;
|
|
219
|
+
const event = buildEvent({
|
|
220
|
+
tenantId: input.tenantId,
|
|
221
|
+
...(input.projectId !== undefined && { projectId: input.projectId }),
|
|
222
|
+
kind: input.kind,
|
|
223
|
+
outcome: input.outcome ?? 'succeeded',
|
|
224
|
+
actor: input.actor,
|
|
225
|
+
runId: input.runId,
|
|
226
|
+
...(input.correlationId !== undefined && { correlationId: input.correlationId }),
|
|
227
|
+
payload: input.doc,
|
|
228
|
+
});
|
|
229
|
+
await safeEmit(input.auditEvents, event, input.log);
|
|
156
230
|
}
|
|
157
231
|
|
|
158
232
|
// -----------------------------------------------------------------------------
|
|
@@ -185,19 +259,25 @@ function buildEvent(input: BuildEventInput): AuditEvent {
|
|
|
185
259
|
};
|
|
186
260
|
}
|
|
187
261
|
|
|
188
|
-
async function safeEmit(
|
|
262
|
+
async function safeEmit(
|
|
263
|
+
binding: AuditEventBinding,
|
|
264
|
+
event: AuditEvent,
|
|
265
|
+
log: Logger | undefined,
|
|
266
|
+
): Promise<void> {
|
|
189
267
|
try {
|
|
190
268
|
const result = await binding.append([event]);
|
|
191
269
|
if (result.kind === 'err') {
|
|
192
|
-
|
|
193
|
-
|
|
270
|
+
log?.warn(
|
|
271
|
+
`${event.kind} audit event failed: ${result.error.message}`,
|
|
272
|
+
{ tenantId: event.tenantId, kind: event.kind, code: result.error.code },
|
|
273
|
+
{ inMessage: ['kind'] },
|
|
274
|
+
);
|
|
194
275
|
}
|
|
195
276
|
} catch (cause) {
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
}`,
|
|
277
|
+
log?.warn(
|
|
278
|
+
`${event.kind} audit event failed`,
|
|
279
|
+
{ tenantId: event.tenantId, kind: event.kind, err: cause },
|
|
280
|
+
{ inMessage: ['kind'] },
|
|
201
281
|
);
|
|
202
282
|
}
|
|
203
283
|
}
|
|
@@ -213,6 +293,7 @@ function actorFromResolveContext(ctx: ResolveContext): string | undefined {
|
|
|
213
293
|
case 'dispatch':
|
|
214
294
|
return ctx.runId !== undefined ? `agent:${ctx.runId}` : 'agent:unknown';
|
|
215
295
|
case 'deploy-sync':
|
|
296
|
+
case 'pack-env':
|
|
216
297
|
return ctx.deploymentId !== undefined ? `system:${ctx.deploymentId}` : 'system:deploy';
|
|
217
298
|
case 'admin-cli':
|
|
218
299
|
return 'user:admin';
|
|
@@ -246,7 +327,7 @@ function scopeToPayloadShape(scope: Scope): Readonly<Record<string, unknown>> {
|
|
|
246
327
|
* key ever appears. Every field is either metadata (name,
|
|
247
328
|
* version, scope) or attribution (caller, errorCode).
|
|
248
329
|
*/
|
|
249
|
-
function buildResolvePayload(input:
|
|
330
|
+
function buildResolvePayload(input: ResolveEventInput): Readonly<Record<string, unknown>> {
|
|
250
331
|
const payload: Record<string, unknown> = {
|
|
251
332
|
scope: scopeToPayloadShape(input.scope),
|
|
252
333
|
envName: input.envName as unknown as string,
|
|
@@ -254,7 +335,12 @@ function buildResolvePayload(input: EmitResolveEventInput): Readonly<Record<stri
|
|
|
254
335
|
caller: input.resolveContext.caller,
|
|
255
336
|
};
|
|
256
337
|
if (input.version !== undefined) payload.recordVersion = input.version;
|
|
338
|
+
if (input.revision !== undefined) payload.revision = input.revision;
|
|
339
|
+
if (input.resolveContext.deploymentId !== undefined) {
|
|
340
|
+
payload.deploymentId = input.resolveContext.deploymentId;
|
|
341
|
+
}
|
|
257
342
|
if (input.errorCode !== undefined) payload.errorCode = input.errorCode;
|
|
343
|
+
if (input.systemKeyId !== undefined) payload.systemKeyId = input.systemKeyId;
|
|
258
344
|
if (input.resolveContext.nodeId !== undefined) payload.nodeId = input.resolveContext.nodeId;
|
|
259
345
|
if (input.resolveContext.runId !== undefined) payload.runId = input.resolveContext.runId;
|
|
260
346
|
return payload;
|
package/src/types.ts
CHANGED
|
@@ -83,6 +83,18 @@ export const EVIDENCE_KINDS = [
|
|
|
83
83
|
'person-added',
|
|
84
84
|
'person-granted',
|
|
85
85
|
'person-ungranted',
|
|
86
|
+
// A trigger's owner (the principal its runs act as) set at registration
|
|
87
|
+
// or changed on take-over — a delegation when it names a service account.
|
|
88
|
+
'trigger-owner-set',
|
|
89
|
+
// The order a tenant (or one of its orgs) runs a project through to live
|
|
90
|
+
// was set, changed or cleared. The payload carries the order before and
|
|
91
|
+
// after, each a list of project ids — never anything a project holds.
|
|
92
|
+
'environment-order-set',
|
|
93
|
+
// A deployment was promoted into the next environment of its order: a new
|
|
94
|
+
// deployment there, or versions carried onto the one it had. The payload
|
|
95
|
+
// names both deployments, both projects, the image digest and the
|
|
96
|
+
// versions carried — never anything a project holds.
|
|
97
|
+
'deployment-promoted',
|
|
86
98
|
] as const;
|
|
87
99
|
|
|
88
100
|
/**
|