@openauditmodel/cli 0.1.0

package/dist/conformance/src/validate-core.js

@@ -0,0 +1,62 @@
+/**
+ * Schema validation with no filesystem dependency.
+ *
+ * This module is the boundary that lets the conformance engines run unchanged
+ * in environments that do not read the schema from disk — the MCP server in
+ * particular, where the schema is compiled in at build time.
+ *
+ * Everything here operates on a schema **object**. Locating and reading schema
+ * files lives in `validate.ts`, which imports this module.
+ */
+import { Ajv2020 } from "ajv/dist/2020.js";
+import formatsModule from "ajv-formats";
+import { toIssues } from "./format-errors.js";
+import { createValidatorFromCompiled, SCHEMA_ID, SPEC_VERSION, } from "./validator-interface.js";
+// Re-exported so that existing import sites keep working. Code that only needs
+// a precompiled validator should import ./validator-interface.js directly, which
+// keeps Ajv out of its bundle entirely.
+export { createValidatorFromCompiled, SCHEMA_ID, SPEC_VERSION };
+/** `ajv-formats` is published as CommonJS; this is its ESM-interop entry point. */
+const addFormats = formatsModule.default;
+/** Creates an Ajv instance configured the way OpenAuditModel conformance requires. */
+export function createAjv() {
+    const ajv = new Ajv2020({
+        // Reject schema authoring mistakes rather than silently ignoring them.
+        strict: true,
+        // Union types are used deliberately by the free-form JSON value definition.
+        allowUnionTypes: true,
+        // `strictRequired` is an Ajv-specific authoring lint that rejects the
+        // standard `if`/`then` + `required` idiom, which OpenAuditModel relies on
+        // for its conditional rules. The idiom is valid Draft 2020-12 and portable
+        // across validators, so this single check is disabled.
+        strictRequired: false,
+        // Report every problem in one pass so that a report is actionable.
+        allErrors: true,
+    });
+    addFormats(ajv);
+    return ajv;
+}
+/** Validates a schema document itself against the Draft 2020-12 meta-schema. */
+export function validateSchemaDocument(schema) {
+    const ajv = createAjv();
+    const valid = ajv.validateSchema(schema);
+    return valid ? [] : toIssues(ajv.errors);
+}
+/**
+ * Compiles a schema object into a reusable validator.
+ *
+ * Used directly where the schema is already in memory. Environments that forbid
+ * dynamic code generation cannot call this — Ajv compiles with `new Function` —
+ * and supply a precompiled validation function instead; see
+ * {@link createValidatorFromCompiled}.
+ */
+export function createValidatorFromSchema(schema) {
+    const ajv = createAjv();
+    const compiled = ajv.compile(schema);
+    const schemaId = typeof schema["$id"] === "string" ? schema["$id"] : SCHEMA_ID;
+    return {
+        schemaId,
+        validateEvent: (event) => (compiled(event) ? [] : toIssues(compiled.errors)),
+    };
+}
+//# sourceMappingURL=validate-core.js.map

package/dist/conformance/src/validate-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-core.js","sourceRoot":"","sources":["../../../conformance/src/validate-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,aAAa,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAwB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,YAAY,GAEb,MAAM,0BAA0B,CAAC;AAElC,+EAA+E;AAC/E,iFAAiF;AACjF,wCAAwC;AACxC,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAGhE,mFAAmF;AACnF,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC;AAEzC,sFAAsF;AACtF,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC;QACtB,uEAAuE;QACvE,MAAM,EAAE,IAAI;QACZ,4EAA4E;QAC5E,eAAe,EAAE,IAAI;QACrB,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,uDAAuD;QACvD,cAAc,EAAE,KAAK;QACrB,mEAAmE;QACnE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAC5D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAA8B,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAuB;IAC/D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAqB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/E,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAC7E,CAAC;AACJ,CAAC"}

package/dist/conformance/src/validate.d.ts

@@ -0,0 +1,34 @@
+import type { AnySchemaObject } from "ajv";
+import type { ValidationIssue } from "./format-errors.js";
+import { expandInputPaths } from "./sources.js";
+import { createAjv, SCHEMA_ID, SPEC_VERSION, validateSchemaDocument, type EventValidator } from "./validate-core.js";
+export { createAjv, SCHEMA_ID, SPEC_VERSION, validateSchemaDocument };
+export type { EventValidator };
+export declare const SCHEMA_RELATIVE_PATH: string;
+/** Outcome of validating a single file. */
+export type FileStatus = "valid" | "invalid" | "unreadable";
+export interface FileValidationResult {
+    readonly file: string;
+    readonly status: FileStatus;
+    readonly issues: readonly ValidationIssue[];
+    /** Set when the file could not be read or parsed as JSON. */
+    readonly error?: string;
+}
+export interface Validator extends EventValidator {
+    readonly schemaPath: string;
+    /** Reads, parses and validates a single JSON file. */
+    validateFile(file: string): FileValidationResult;
+}
+/**
+ * Walks upwards from a starting directory until the canonical schema is found.
+ * This keeps the CLI working when run from `dist/`, from the repository root,
+ * or from an installed package directory.
+ */
+export declare function resolveSchemaPath(startDir?: string): string;
+/** Reads the canonical schema document from disk. */
+export declare function loadSchema(schemaPath?: string): AnySchemaObject;
+/** Compiles the canonical schema and returns a reusable validator. */
+export declare function createValidator(schemaPath?: string): Validator;
+/** Re-exported so that consumers of the validator keep a single import site. */
+export { expandInputPaths };
+export type { ValidationIssue };

package/dist/conformance/src/validate.js

@@ -0,0 +1,62 @@
+/**
+ * Validation of audit events against the canonical OpenAuditModel schema, read
+ * from this repository.
+ *
+ * The filesystem-free half lives in `validate-core.ts`, which this module
+ * re-exports so that existing import sites keep working. Environments without a
+ * filesystem import that module directly.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { expandInputPaths, readJsonFile } from "./sources.js";
+import { createAjv, createValidatorFromSchema, SCHEMA_ID, SPEC_VERSION, validateSchemaDocument, } from "./validate-core.js";
+export { createAjv, SCHEMA_ID, SPEC_VERSION, validateSchemaDocument };
+export const SCHEMA_RELATIVE_PATH = path.join("schemas", `v${SPEC_VERSION}`, "audit-event.schema.json");
+/**
+ * Walks upwards from a starting directory until the canonical schema is found.
+ * This keeps the CLI working when run from `dist/`, from the repository root,
+ * or from an installed package directory.
+ */
+export function resolveSchemaPath(startDir) {
+    const from = startDir ?? path.dirname(fileURLToPath(import.meta.url));
+    let dir = path.resolve(from);
+    for (let depth = 0; depth < 10; depth += 1) {
+        const candidate = path.join(dir, SCHEMA_RELATIVE_PATH);
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    throw new Error(`Unable to locate ${SCHEMA_RELATIVE_PATH}. Searched upwards from ${path.resolve(from)}.`);
+}
+/** Reads the canonical schema document from disk. */
+export function loadSchema(schemaPath) {
+    const resolved = schemaPath ?? resolveSchemaPath();
+    const raw = readFileSync(resolved, "utf8");
+    return JSON.parse(raw);
+}
+/** Compiles the canonical schema and returns a reusable validator. */
+export function createValidator(schemaPath) {
+    const resolvedPath = schemaPath ?? resolveSchemaPath();
+    const schema = loadSchema(resolvedPath);
+    const core = createValidatorFromSchema(schema);
+    const { schemaId } = core;
+    const validateEvent = (event) => core.validateEvent(event);
+    const validateFile = (file) => {
+        const parsed = readJsonFile(file);
+        if (!parsed.ok) {
+            return { file, status: "unreadable", issues: [], error: parsed.error };
+        }
+        const issues = validateEvent(parsed.value);
+        return { file, status: issues.length === 0 ? "valid" : "invalid", issues };
+    };
+    return { schemaId, schemaPath: resolvedPath, validateEvent, validateFile };
+}
+/** Re-exported so that consumers of the validator keep a single import site. */
+export { expandInputPaths };
+//# sourceMappingURL=validate.js.map

package/dist/conformance/src/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../conformance/src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACL,SAAS,EACT,yBAAyB,EACzB,SAAS,EACT,YAAY,EACZ,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;AAGtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAC3C,SAAS,EACT,IAAI,YAAY,EAAE,EAClB,yBAAyB,CAC1B,CAAC;AAmBF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,MAAM,IAAI,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM;QACR,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oBAAoB,oBAAoB,2BAA2B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACzF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,UAAmB;IAC5C,MAAM,QAAQ,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;AAC5C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,UAAmB;IACjD,MAAM,YAAY,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,aAAa,GAAG,CAAC,KAAc,EAAqB,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAEvF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAwB,EAAE;QAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/conformance/src/validator-interface.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The validator interface, with no dependency on Ajv's runtime.
+ *
+ * This module exists so that an environment which validates with an
+ * ahead-of-time compiled function never pulls Ajv's compiler into its bundle.
+ * The MCP server validates with Ajv's standalone output, so importing the
+ * compiler there would ship a large module of dead code and put runtime code
+ * generation on a path that has no use for it.
+ *
+ * `ValidateFunction` is imported as a type only, so it is erased at build time.
+ */
+import type { ValidateFunction } from "ajv";
+import { type ValidationIssue } from "./format-errors.js";
+export declare const SPEC_VERSION = "0.1";
+/** Canonical identifier of the OpenAuditModel Audit Event Schema. */
+export declare const SCHEMA_ID = "https://openauditmodel.org/schemas/audit-event/0.1/schema.json";
+/**
+ * Validates parsed events. The smallest interface the conformance engines need,
+ * so that they work with a schema read from disk or compiled in at build time.
+ */
+export interface EventValidator {
+    readonly schemaId: string;
+    /** Validates an already parsed event and returns the issues found. */
+    validateEvent(event: unknown): ValidationIssue[];
+}
+/**
+ * Wraps an already compiled Ajv validation function.
+ *
+ * This is how the MCP server validates: Ajv's standalone code generator emits
+ * the same validation logic ahead of time, so the server's verdict is identical
+ * to the command line tool's by construction rather than by coincidence — and
+ * Ajv's compiler is not reachable from its module graph.
+ */
+export declare function createValidatorFromCompiled(compiled: ValidateFunction, schemaId?: string): EventValidator;
+export type { ValidationIssue };

package/dist/conformance/src/validator-interface.js

@@ -0,0 +1,19 @@
+import { toIssues } from "./format-errors.js";
+export const SPEC_VERSION = "0.1";
+/** Canonical identifier of the OpenAuditModel Audit Event Schema. */
+export const SCHEMA_ID = "https://openauditmodel.org/schemas/audit-event/0.1/schema.json";
+/**
+ * Wraps an already compiled Ajv validation function.
+ *
+ * This is how the MCP server validates: Ajv's standalone code generator emits
+ * the same validation logic ahead of time, so the server's verdict is identical
+ * to the command line tool's by construction rather than by coincidence — and
+ * Ajv's compiler is not reachable from its module graph.
+ */
+export function createValidatorFromCompiled(compiled, schemaId = SCHEMA_ID) {
+    return {
+        schemaId,
+        validateEvent: (event) => (compiled(event) ? [] : toIssues(compiled.errors)),
+    };
+}
+//# sourceMappingURL=validator-interface.js.map

package/dist/conformance/src/validator-interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator-interface.js","sourceRoot":"","sources":["../../../conformance/src/validator-interface.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,QAAQ,EAAwB,MAAM,oBAAoB,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAElC,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,gEAAgE,CAAC;AAY1F;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA0B,EAC1B,WAAmB,SAAS;IAE5B,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KAC7E,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@openauditmodel/cli",
+  "version": "0.1.0",
+  "description": "Conformance toolchain for OpenAuditModel: validate audit events against the canonical JSON Schema, verify tamper-evidence, lint for leaked secrets and check domain profiles. Offline and deterministic.",
+  "keywords": [
+    "audit",
+    "audit-event",
+    "audit-log",
+    "specification",
+    "json-schema",
+    "conformance",
+    "openauditmodel"
+  ],
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "bin": {
+    "auditmodel": "dist/conformance/src/cli.js",
+    "openauditmodel": "dist/conformance/src/cli.js"
+  },
+  "files": [
+    "dist/conformance/src",
+    "schemas",
+    "profiles",
+    "semantic-conventions",
+    "specification",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "node --eval \"import('node:fs').then((fs) => fs.rmSync('dist', { recursive: true, force: true }))\"",
+    "auditmodel": "node dist/conformance/src/cli.js",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "lint": "eslint .",
+    "schema:validate": "npm run build && node --test dist/conformance/tests/schema-validation.test.js",
+    "test": "npm run build && node --test \"dist/conformance/tests/*.test.js\" \"dist/mcp/tests/*.test.js\"",
+    "validate:valid": "npm run build && node dist/conformance/src/cli.js validate examples/valid",
+    "verify:integrity": "npm run build && node dist/conformance/src/cli.js verify-integrity examples/integrity/valid && node dist/conformance/src/cli.js verify-chain examples/integrity/valid/three-event-chain",
+    "lint:privacy": "npm run build && node dist/conformance/src/cli.js lint-privacy examples/valid examples/integrity/valid examples/privacy/clean examples/profiles/identity-and-access-management/valid examples/profiles/document-management/valid examples/profiles/incident-management/valid examples/profiles/message-broker-management/valid examples/profiles/deployment-and-change-management/valid examples/profiles/financial-transaction-management/valid examples/profiles/secrets-and-key-management/valid examples/profiles/customer-and-account-management/valid examples/profiles/backup-and-recovery/valid examples/profiles/api-and-integration-management/valid",
+    "check:profile": "npm run build && node dist/conformance/src/cli.js check-profile examples/profiles/identity-and-access-management/valid --profile identity-and-access-management && node dist/conformance/src/cli.js check-profile examples/profiles/document-management/valid --profile document-management && node dist/conformance/src/cli.js check-profile examples/profiles/incident-management/valid --profile incident-management && node dist/conformance/src/cli.js check-profile examples/profiles/message-broker-management/valid --profile message-broker-management && node dist/conformance/src/cli.js check-profile examples/profiles/deployment-and-change-management/valid --profile deployment-and-change-management && node dist/conformance/src/cli.js check-profile examples/profiles/financial-transaction-management/valid --profile financial-transaction-management && node dist/conformance/src/cli.js check-profile examples/profiles/secrets-and-key-management/valid --profile secrets-and-key-management && node dist/conformance/src/cli.js check-profile examples/profiles/customer-and-account-management/valid --profile customer-and-account-management && node dist/conformance/src/cli.js check-profile examples/profiles/backup-and-recovery/valid --profile backup-and-recovery && node dist/conformance/src/cli.js check-profile examples/profiles/api-and-integration-management/valid --profile api-and-integration-management",
+    "fixtures:integrity": "npm run build && node dist/conformance/tools/generate-integrity-fixtures.js && prettier --write examples/integrity",
+    "fixtures:check": "npm run build && node dist/conformance/tools/generate-integrity-fixtures.js --check",
+    "verify": "npm run format:check && npm run lint && npm run test && npm run validate:valid && npm run verify:integrity && npm run lint:privacy && npm run check:profile",
+    "mcp:generate": "npm run generate --workspace mcp",
+    "mcp:check-generated": "npm run generate:check --workspace mcp",
+    "mcp:start": "npm run build && node dist/mcp/src/index.js",
+    "prepare": "npm run build",
+    "prepack": "npm run build && node scripts/verify-package.mjs",
+    "package:verify": "node scripts/verify-package.mjs",
+    "package:smoke": "npm run build && node scripts/package-smoke-test.mjs",
+    "site:build": "node scripts/build-site.mjs",
+    "site:check": "node scripts/build-site.mjs --check"
+  },
+  "dependencies": {
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "canonicalize": "^3.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.10.2",
+    "eslint": "^10.8.0",
+    "prettier": "^3.4.2",
+    "typescript": "^5.7.2",
+    "typescript-eslint": "^8.18.1"
+  },
+  "homepage": "https://openauditmodel.org",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OpenAuditModel/OpenAuditModel.git"
+  },
+  "bugs": {
+    "url": "https://github.com/OpenAuditModel/OpenAuditModel/issues"
+  },
+  "workspaces": [
+    "mcp"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/profiles/README.md

@@ -0,0 +1,201 @@
+# Profiles
+
+**Specification version: 0.1 · Status: Experimental**
+
+A **profile** is an optional, stricter set of requirements for a specific domain, layered on top of
+the core model.
+
+```bash
+auditmodel check-profile <path...> --profile identity-and-access-management
+```
+
+## The invariant
+
+**A profile only ever adds constraints.**
+
+A profile MAY:
+
+- Require fields the core model leaves OPTIONAL, for a specific class of events.
+- Require a field to have a particular JSON type.
+- Require a field to equal a particular scalar.
+- Recommend fields, producing warnings that never fail conformance.
+
+A profile MUST NOT:
+
+- Relax, replace or reinterpret any core requirement.
+- Add a top-level property to an audit event.
+- Redefine the meaning of a core field.
+- Introduce product-specific, company-specific, country-specific or regulation-specific fields.
+
+**Every profile-conforming event is a core-conforming event.** The reverse does not hold.
+
+This is enforced structurally rather than by review. The rule vocabulary has no keyword that could
+remove a requirement — there is no `optionalPaths`, no `exemptPaths`, no `overrides` — and core
+validation runs first, so an event that fails the core schema is reported as core-invalid with its
+profile rules **not evaluated**. Both properties are covered by tests. See
+[ADR 0008](../decisions/0008-declarative-profile-conformance.md).
+
+## Status in v0.1
+
+| Profile                                                               | Status                    |
+| --------------------------------------------------------------------- | ------------------------- |
+| [identity-and-access-management](identity-and-access-management/)     | **Implemented**, 11 rules |
+| [document-management](document-management/)                           | **Implemented**, 11 rules |
+| [incident-management](incident-management/)                           | **Implemented**, 15 rules |
+| [message-broker-management](message-broker-management/)               | **Implemented**, 12 rules |
+| [deployment-and-change-management](deployment-and-change-management/) | **Implemented**, 13 rules |
+| [financial-transaction-management](financial-transaction-management/) | **Implemented**, 12 rules |
+| [secrets-and-key-management](secrets-and-key-management/)             | **Implemented**, 14 rules |
+| [customer-and-account-management](customer-and-account-management/)   | **Implemented**, 13 rules |
+| [backup-and-recovery](backup-and-recovery/)                           | **Implemented**, 13 rules |
+| [api-and-integration-management](api-and-integration-management/)     | **Implemented**, 13 rules |
+
+All ten profiles are enforceable and carry fixtures. There are no placeholder profiles left in v0.1.
+
+## Profile definition format
+
+A profile is a JSON document at `profiles/<name>/profile.json`, validated against
+[profile-definition.schema.json](profile-definition.schema.json). That schema validates **profile
+documents**; it is not part of the canonical audit event schema and never constrains an audit event.
+
+```json
+{
+  "profileVersion": "0.1",
+  "name": "identity-and-access-management",
+  "version": "0.1",
+  "status": "experimental",
+  "coreVersions": ["0.1"],
+  "title": "Identity and Access Management Profile",
+  "description": "Additional conformance requirements for identity and access management audit events.",
+  "rules": []
+}
+```
+
+`version` is the profile's own version and moves independently of the core specification.
+`coreVersions` lists the core versions the profile applies to; an event declaring any other
+`specVersion` is **not applicable** rather than in violation.
+
+### Rules
+
+Each rule has an `id` and a `description`, and MAY have a `rationale` and a `severity`.
+
+```json
+{
+  "id": "IAM-ROLE-002",
+  "description": "A privileged role change is approved and performed from a multi-factor authenticated session.",
+  "rationale": "Privileged access is the control that protects every other control.",
+  "severity": "error",
+  "events": ["identity.role.assign", "identity.role.revoke"],
+  "when": { "path": "/metadata/role/privileged", "equals": true },
+  "requiredPaths": ["/approval", "/authentication"],
+  "requiredValues": [{ "path": "/authentication/mfa", "equals": true }]
+}
+```
+
+Rule severities are `info`, `warning` and `error`. Only `error` fails conformance. These are the
+profile vocabulary and are **unrelated** to the privacy linter's severities, which describe a
+different kind of risk.
+
+### Selectors
+
+A rule MUST have at least one selector.
+
+| Selector        | Matches                                                                                                                           |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| `events`        | Exact event names                                                                                                                 |
+| `eventPrefixes` | Event names starting with the prefix. A prefix MUST end with a dot, so that `identity.role.` cannot match `identity.roles-export` |
+
+There is no regular expression selector. A profile is a published statement about which events it
+governs, and a pattern language turns "does this rule apply to my event?" into a question only a tool
+can answer.
+
+### Requirements
+
+| Keyword            | Path syntax                              | Meaning                                                  |
+| ------------------ | ---------------------------------------- | -------------------------------------------------------- |
+| `requiredPaths`    | Absolute JSON Pointer                    | The value must be **present**                            |
+| `requiredMetadata` | JSON Pointer **relative to `/metadata`** | The value must be present and of a JSON type             |
+| `requiredValues`   | Absolute JSON Pointer                    | The value must be present and strictly equal to a scalar |
+| `recommendedPaths` | Absolute JSON Pointer                    | Absence produces a warning, never a failure              |
+
+`requiredMetadata` paths are relative because every one of them starts `/metadata`; `/role/id` means
+`/metadata/role/id`. All other paths are absolute pointers into the event. Findings always report the
+**full** pointer, so a report never needs the reader to know which convention a keyword used.
+
+Supported metadata types: `string`, `number`, `integer`, `boolean`, `object`, `array`. `integer` is a
+subset of `number`. Profiles do not embed schema fragments in v0.1.
+
+### Presence
+
+A required path is satisfied only when the value:
+
+- exists, **and**
+- is not `null`, **and**
+- is not an empty string, **and**
+- is not an empty array, **and**
+- is not an empty object.
+
+`false` and `0` **are** present. They are answers, not absences: a profile that could not require
+`mfa: false` to be recorded would be unable to distinguish "not recorded" from "recorded as false".
+
+This differs deliberately from the privacy linter's notion of a populated value, which excludes
+booleans because a credential cannot be `true`.
+
+### Conditional requirements
+
+A rule MAY carry one `when` condition: one path compared for equality against one scalar.
+
+```json
+{ "when": { "path": "/metadata/role/privileged", "equals": true } }
+```
+
+That is the entire conditional mechanism. There are no boolean combinations, no nesting, no
+comparison operators other than equality, and no expression language.
+
+Comparison is strict: `1` does not equal `true`, and `"true"` does not equal `true`. **When the
+condition's path is absent, the condition does not hold** and the rule contributes nothing. The
+alternative — treating an absent flag as possibly true — would fail every event that omitted a field
+the rule was never meant to govern. Profiles requiring such a flag require it separately, through
+`requiredMetadata`.
+
+## Results
+
+| Status           | Meaning                                                           | Exit |
+| ---------------- | ----------------------------------------------------------------- | ---- |
+| `conforming`     | At least one rule matched and every requirement was satisfied     | 0    |
+| `violations`     | A rule matched and a requirement was not satisfied                | 1    |
+| `core-invalid`   | The event fails the core schema; profile rules were not evaluated | 1    |
+| `not-applicable` | No rule in the profile governs this event                         | 3    |
+
+**`not-applicable` is not conformance.** An event no rule governs is reported as out of scope, never
+as conforming, so that a pipeline cannot read "the profile said nothing" as "the profile was
+satisfied". Exit code `3` exists for the same reason.
+
+When a run mixes conforming and not-applicable events, the exit code is `0`. Exit `3` means nothing
+checked was governed at all.
+
+## What profiles are not
+
+**Profiles are not regulatory mappings.** A profile requires audit fields. It cites no regulation,
+article, control identifier or jurisdiction, and the profile definition schema gives it nowhere to put
+one. Regulations are revised on their own schedules and interpreted differently by different auditors;
+a profile that encoded one would be wrong when the regulation changed and useless everywhere it did
+not apply.
+
+**Profile conformance is not legal or regulatory compliance**, and MUST NOT be presented as evidence
+of it. It is a statement that an event carries the fields a domain agreed it should carry.
+
+**Profiles do not replace privacy linting.** A profile says which fields must be present; the privacy
+linter says which values must not. They are complementary and independent: a profile-conforming event
+can still carry a secret, and `auditmodel lint-privacy` is what looks for one. Every published
+profile fixture is required by test to pass both.
+
+**Profiles are not a policy engine.** OpenAuditModel records decisions; it does not evaluate them.
+
+## Proposing a profile
+
+Use the profile proposal issue template. A proposal must show that the domain has requirements the
+core cannot express and that those requirements are shared across independent products — not one
+product's field list wearing a domain's name. See [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+Adding a profile requires **no code**: a profile is a JSON document plus fixtures.