@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/integrity/valid/unicode-and-number-event.json

@@ -0,0 +1,68 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a2b-7d40-7c19-a562-3e4f5a6b7c81",
+  "time": "2026-04-02T14:05:09.004Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Record updated with mixed-script content."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-4471"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-88213"
+  },
+  "application": {
+    "name": "records-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "9": "digit keys sort as strings",
+    "10": "digit keys sort as strings, so 10 precedes 9",
+    "zeta": "sorts last among the lower-case keys",
+    "Alpha": "upper-case sorts before lower-case in UTF-16 code unit order",
+    "alpha": "sorts after the upper-case key",
+    "äpfel": "Latin-1 supplement",
+    "日本語": "CJK key",
+    "strings": {
+      "emoji": "🔒 sealed",
+      "combining": "é is not é",
+      "escapes": "quote \" backslash \\ tab \t newline \n",
+      "controlCharacter": "\u0007"
+    },
+    "numbers": {
+      "zero": 0,
+      "negative": -17,
+      "fraction": 3.14159,
+      "small": 0.000001,
+      "verySmall": 1e-7,
+      "large": 1e21,
+      "maxSafeInteger": 9007199254740991
+    },
+    "containers": {
+      "emptyObject": {},
+      "emptyArray": [],
+      "nested": [
+        1,
+        [
+          2,
+          [
+            3,
+            {
+              "deep": null
+            }
+          ]
+        ]
+      ]
+    }
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "5447ade98a9f6ff64bd26591055c29e49adae89160425a02531dd3b3df26dc11"
+  }
+}

package/examples/invalid/README.md

@@ -0,0 +1,38 @@
+# Invalid examples
+
+**Status: Informative.**
+
+Every file in this directory MUST fail validation against the
+[OpenAuditModel Audit Event Schema](../../schemas/v0.1/audit-event.schema.json). Each file is
+otherwise a realistic, well-formed event with exactly one defect, so that a validator can be checked
+for the precise error it reports rather than only for pass or fail.
+
+The expectations below are asserted by
+[`conformance/tests/invalid-examples.test.ts`](../../conformance/tests/invalid-examples.test.ts). If
+a schema change alters any of these outcomes, the test fails and the change must be reviewed as a
+compatibility question.
+
+| File                                                               | Defect                                               | Expected error location | Failing keyword        |
+| ------------------------------------------------------------------ | ---------------------------------------------------- | ----------------------- | ---------------------- |
+| [missing-actor.json](missing-actor.json)                           | No `actor`                                           | `/actor`                | `required`             |
+| [missing-resource.json](missing-resource.json)                     | No `resource`                                        | `/resource`             | `required`             |
+| [invalid-event-name.json](invalid-event-name.json)                 | `Document.Share.Create` is not lower-case            | `/event/name`           | `pattern`              |
+| [failure-without-error.json](failure-without-error.json)           | `outcome` is `failure` but `error` is absent         | `/event/error`          | `required`             |
+| [delegation-without-subject.json](delegation-without-subject.json) | `delegation.type` is `on-behalf-of` but no `subject` | `/subject`              | `required`             |
+| [invalid-extension-name.json](invalid-extension-name.json)         | `clusterId` is not a reverse-domain key              | `/extensions/clusterId` | `propertyNames`        |
+| [unknown-core-property.json](unknown-core-property.json)           | `actor.department` is not a core property            | `/actor/department`     | `additionalProperties` |
+
+## Notes on the conditional failures
+
+`failure-without-error.json` and `delegation-without-subject.json` fail through `if`/`then`
+conditions rather than a plain `required` list. A validator reports both the conditional keyword and
+the specific missing property; the table above lists the specific property, because that is what an
+implementer needs to act on.
+
+## What these examples are not
+
+These files are not a complete negative test suite. Schema validation cannot detect a leaked secret,
+a misused event name, or a `subject` that was populated with a target resource. Those failures are
+addressed by [privacy.md](../../specification/privacy.md),
+[event-naming.md](../../semantic-conventions/event-naming.md) and
+[actor-model.md](../../specification/actor-model.md), and by review — not by the validator.

package/examples/invalid/delegation-without-subject.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c05-5e6f-7071-c283-9e0f1a2b3c45",
+  "time": "2026-03-19T07:26:37Z",
+  "event": {
+    "name": "data.export.create",
+    "category": "data-access",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-reporting-worker"
+  },
+  "delegation": {
+    "type": "on-behalf-of",
+    "reason": "Deferred execution of a previously requested export.",
+    "reference": "export-request-4471"
+  },
+  "resource": {
+    "type": "report",
+    "id": "export-4471"
+  },
+  "application": {
+    "name": "reporting-service",
+    "environment": "production"
+  }
+}

package/examples/invalid/failure-without-error.json

@@ -0,0 +1,28 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c04-4d5e-7f60-b172-8d9e0f1a2b34",
+  "time": "2026-03-19T07:19:03Z",
+  "event": {
+    "name": "authentication.login",
+    "category": "authentication",
+    "outcome": "failure",
+    "severity": "medium",
+    "summary": "Sign-in attempt rejected."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-2211"
+  },
+  "resource": {
+    "type": "session",
+    "id": "session-attempt-88f1"
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production"
+  },
+  "authentication": {
+    "method": "password",
+    "provider": "corporate-idp"
+  }
+}

package/examples/invalid/invalid-event-name.json

@@ -0,0 +1,22 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c03-3c4d-7e5f-a061-7c8d9e0f1a23",
+  "time": "2026-03-19T07:11:44Z",
+  "event": {
+    "name": "Document.Share.Create",
+    "category": "data-access",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production"
+  }
+}

package/examples/invalid/invalid-extension-name.json

@@ -0,0 +1,25 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c06-6f70-7182-d394-0f1a2b3c4d56",
+  "time": "2026-03-19T07:33:52Z",
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091"
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-retention"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production"
+  },
+  "extensions": {
+    "clusterId": "production"
+  }
+}

package/examples/invalid/missing-actor.json

@@ -0,0 +1,18 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c01-1a2b-7c3d-8e4f-5a6b7c8d9e01",
+  "time": "2026-03-19T07:00:00Z",
+  "event": {
+    "name": "document.file.download",
+    "category": "data-access",
+    "outcome": "success"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-4410"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production"
+  }
+}

package/examples/invalid/missing-resource.json

@@ -0,0 +1,18 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c02-2b3c-7d4e-9f50-6b7c8d9e0f12",
+  "time": "2026-03-19T07:05:12Z",
+  "event": {
+    "name": "identity.role.revoke",
+    "category": "identity",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821"
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production"
+  }
+}

package/examples/invalid/unknown-core-property.json

@@ -0,0 +1,23 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c07-7081-7293-e4a5-1a2b3c4d5e67",
+  "time": "2026-03-19T07:41:18Z",
+  "event": {
+    "name": "identity.user.disable",
+    "category": "identity",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "department": "finance"
+  },
+  "resource": {
+    "type": "user",
+    "id": "user-7391"
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production"
+  }
+}

package/examples/privacy/README.md

@@ -0,0 +1,101 @@
+# Privacy fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test `auditmodel lint-privacy`. The
+normative privacy requirements are [specification/privacy.md](../../specification/privacy.md); §6 of
+that document describes the linter and its limits.
+
+Every fixture here is a **schema-valid** event. The ones under `findings/` fail linting, not
+validation — that separation is the point of having two commands.
+
+```bash
+auditmodel lint-privacy examples/privacy/clean
+auditmodel lint-privacy examples/privacy/findings
+auditmodel lint-privacy examples/privacy --format json
+```
+
+## All values are synthetic and non-functional
+
+No fixture in this directory contains a real credential, a valid API key, a real JSON Web Token, a
+real private key, a real connection string or real personal data. Every value is invented for this
+repository.
+
+They are constructed to match a detector while being obviously useless:
+
+- The JSON Web Token has a real base64url header and payload, so it is structurally a token, and a
+  signature that is the base64url encoding of the words `synthetic-signature-not-valid`. Nothing can
+  verify it.
+- The private key fixture contains a PEM marker and the words `SYNTHETIC FIXTURE CONTENT, NOT A REAL
+KEY` where key material would be. There is no key.
+- Token-prefix values use runs of `S` and `0` after the published prefix.
+- Hosts use `example.com`, reserved for documentation by RFC 2606.
+- Credential values say what they are: `synthetic-fixture-value-not-a-real-password`.
+
+Contributors adding fixtures MUST follow the same rule. A fixture that works is a leaked credential
+in a public repository, and rotating it afterwards does not remove it from the history.
+
+## Clean fixtures
+
+Every file under `clean/` MUST produce zero findings. They exist to catch false positives, which are
+the failure mode that gets a linter switched off.
+
+| Fixture                                                            | Exercises                                                                     |
+| ------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| [minimal-clean-event.json](clean/minimal-clean-event.json)         | The seven required fields and nothing else                                    |
+| [hashes-and-identifiers.json](clean/hashes-and-identifiers.json)   | UUID, ULID, trace and span identifiers, SHA-256/384/512 digests, timestamps   |
+| [safe-evidence-reference.json](clean/safe-evidence-reference.json) | Evidence URLs and reference paths with no query, fragment or user information |
+| [sanitized-change.json](clean/sanitized-change.json)               | A credential rotation recorded as changed **field names**, never values       |
+| [structured-metadata.json](clean/structured-metadata.json)         | Small structured metadata, attributes and reverse-domain extensions           |
+
+`sanitized-change.json` is the one worth reading. It records rotating an API key with
+`changedFields: ["secret", "rotatedAt"]` and a `before`/`after` holding only a timestamp and a version
+number. The fact of the rotation is fully auditable; the secret appears nowhere.
+
+## Finding fixtures
+
+Each file raises its documented rule. Expectations are asserted by
+[`privacy-lint.test.ts`](../../conformance/tests/privacy-lint.test.ts).
+
+| Fixture                                                                             | Rule           | Defect                                                  |
+| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------- |
+| [password-field.json](findings/password-field.json)                                 | `OAM-PRIV-001` | A property named `password` is populated                |
+| [access-token-field.json](findings/access-token-field.json)                         | `OAM-PRIV-001` | A property named `accessToken` is populated             |
+| [bearer-token.json](findings/bearer-token.json)                                     | `OAM-PRIV-002` | A captured header value, under a harmless name          |
+| [private-key.json](findings/private-key.json)                                       | `OAM-PRIV-003` | A PEM private key marker                                |
+| [jwt-token.json](findings/jwt-token.json)                                           | `OAM-PRIV-010` | A structurally valid token                              |
+| [url-userinfo.json](findings/url-userinfo.json)                                     | `OAM-PRIV-030` | A URL with an embedded user name and password           |
+| [evidence-query-string.json](findings/evidence-query-string.json)                   | `OAM-PRIV-031` | An evidence reference carrying signed access parameters |
+| [credentialed-connection-string.json](findings/credentialed-connection-string.json) | `OAM-PRIV-040` | A database URL carrying a password                      |
+| [high-entropy-token.json](findings/high-entropy-token.json)                         | `OAM-PRIV-050` | A long random-looking value under a neutral name        |
+| [oversized-change-before.json](findings/oversized-change-before.json)               | `OAM-PRIV-060` | A `change.before` holding a whole record                |
+| [raw-response-body.json](findings/raw-response-body.json)                           | `OAM-PRIV-061` | A property named `responseBody` is populated            |
+
+### Notes on individual fixtures
+
+**`bearer-token.json` stores the header under `upstreamHeader`, not under `authorization`.** That is
+deliberate: it proves the value rule fires on shape alone, without help from the property name. A
+field actually named `authorization` would be caught by the name rule regardless of its contents.
+
+**`high-entropy-token.json` reports at low confidence.** The value could be a session handle, an
+opaque customer reference or a secret; the linter cannot tell, and says so. Compare it with
+`hashes-and-identifiers.json`, where equally random-looking values are recognised as UUIDs, digests
+and trace identifiers and produce nothing.
+
+**`oversized-change-before.json` reports minimization, not exposure.** The finding says the value is
+large enough to suggest an object was captured rather than selected. It does not claim the object
+contains personal data, because nothing here can know that.
+
+**`credentialed-connection-string.json` is reported as a connection string, not as a URL with user
+information.** Both rules would match; reporting the more specific one avoids saying the same thing
+twice. A host-only database URL is reported under a separate low-severity rule and is explicitly not
+called a credential.
+
+## What these fixtures cannot show
+
+There is no fixture for a password that is a dictionary word in a field named `note`, because nothing
+detects it. There is none for a national identification number, a home address or a medical detail,
+because the linter looks for values shaped like secrets and most personal data is not shaped like
+anything.
+
+Those are not gaps to be closed by better fixtures. They are the boundary of what deterministic
+static analysis can do, and they are stated in
+[privacy.md](../../specification/privacy.md) §6.3 and §6.9.

package/examples/privacy/clean/hashes-and-identifiers.json

@@ -0,0 +1,42 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3a02-2d31-7c51-8e62-3f4a5b6c7d81",
+  "time": "2026-05-04T09:03:18.220Z",
+  "event": {
+    "name": "data.export.create",
+    "category": "data-access",
+    "outcome": "success",
+    "summary": "Export produced for a scheduled report."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-reporting-worker"
+  },
+  "resource": {
+    "type": "report",
+    "id": "export-4471"
+  },
+  "application": {
+    "name": "reporting-service",
+    "environment": "production"
+  },
+  "request": {
+    "requestId": "request-e41b70",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "route": "/reports/{reportId}/exports"
+  },
+  "metadata": {
+    "correlationUuid": "018f1b5c-6d2a-7c3e-9a1b-4f5e6d7c8b9a",
+    "batchUlid": "01JAV3M5S4K9QF7N2W8XG6ZTQD",
+    "upstreamTraceId": "0af7651916cd43dd8448eb211c80319c",
+    "upstreamSpanId": "b7ad6b7169203331",
+    "contentSha256": "9f2a4c1d5e6b7a8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e",
+    "contentSha384": "fdbf4fdf2beca570d4ceb1a4bc6325c11ccb559e1f86c2e2d9506b8cbb1d029e1993ce4d6e857f61ae37d948170c19b5",
+    "contentSha512": "5cb695f7f51c858e8199175dbc8e7666929c7f8a1d5a0b42421eefe6131e3df639c6c0dd3f1e28656f8e147d051013937a69d727d5ca7b1ddf4330f8df2b458c",
+    "generatedAt": "2026-05-04T09:03:17.004Z",
+    "recordCount": 918273645,
+    "shortReference": "req-8841",
+    "sourceTopic": "payments.settlement.completed"
+  }
+}

package/examples/privacy/clean/minimal-clean-event.json

@@ -0,0 +1,22 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3a01-1c20-7b40-9d51-2e3f4a5b6c70",
+  "time": "2026-05-04T08:12:44.501Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-123"
+  },
+  "resource": {
+    "type": "record",
+    "id": "resource-123"
+  },
+  "application": {
+    "name": "application-service",
+    "environment": "production"
+  }
+}

package/examples/privacy/clean/safe-evidence-reference.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3a03-3e42-7d62-9f73-4a5b6c7d8e92",
+  "time": "2026-05-04T10:41:02.310Z",
+  "event": {
+    "name": "incident.case.close",
+    "category": "workflow",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-3301"
+  },
+  "resource": {
+    "type": "incident",
+    "id": "incident-2026-0418"
+  },
+  "application": {
+    "name": "incident-service",
+    "environment": "production"
+  },
+  "request": {
+    "route": "/incidents/{incidentId}/close",
+    "method": "POST",
+    "protocol": "https"
+  },
+  "reason": {
+    "code": "resolution-verified",
+    "text": "Corrective action verified in production for seven consecutive days.",
+    "reference": "rca-2026-0418"
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "https://records.example.com/evidence/rca-2026-0418",
+      "contentType": "application/pdf"
+    },
+    {
+      "type": "approval",
+      "reference": "workflow-incident-closure/approval-request-9921"
+    }
+  ]
+}

package/examples/privacy/clean/sanitized-change.json

@@ -0,0 +1,40 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3a04-4f53-7e73-8a84-5b6c7d8e9fa3",
+  "time": "2026-05-04T11:22:39.882Z",
+  "event": {
+    "name": "identity.credential.rotate",
+    "category": "identity",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Service account credential rotated on schedule."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-rotation-worker"
+  },
+  "resource": {
+    "type": "api-key",
+    "id": "api-key-4471",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["secret", "rotatedAt"],
+    "before": {
+      "rotatedAt": "2026-02-04T11:22:39Z",
+      "version": 7
+    },
+    "after": {
+      "rotatedAt": "2026-05-04T11:22:39Z",
+      "version": 8
+    },
+    "ticketId": "change-8812"
+  },
+  "controlCategories": ["authentication-logging", "privileged-access"]
+}

package/examples/privacy/clean/structured-metadata.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3a05-5a64-7f84-9b95-6c7d8e9fa0b4",
+  "time": "2026-05-04T12:05:11.470Z",
+  "event": {
+    "name": "identity.role.assign",
+    "category": "identity",
+    "type": "update",
+    "outcome": "success"
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-4821",
+    "attributes": {
+      "workstationClass": "managed",
+      "onCall": true
+    }
+  },
+  "resource": {
+    "type": "user",
+    "id": "user-7391",
+    "attributes": {
+      "accountAge": 412,
+      "directoryPartition": "eu-partition-2"
+    }
+  },
+  "application": {
+    "name": "identity-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "assignedRole": "support-agent",
+    "assignmentScope": "tenant",
+    "effectiveFrom": "2026-05-06T00:00:00Z",
+    "expiresAt": "2026-08-06T00:00:00Z",
+    "approverCount": 2
+  },
+  "extensions": {
+    "com.example.identity.directory.id": "directory-1",
+    "com.example.workflow.stage": "completed",
+    "io.vendor.product.feature.enabled": true
+  }
+}

package/examples/privacy/findings/access-token-field.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b02-1111-7222-8333-000000000002",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "integrationName": "legacy-connector",
+    "accessToken": "synthetic-fixture-value-not-a-real-token"
+  }
+}

package/examples/privacy/findings/bearer-token.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b03-1111-7222-8333-000000000003",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "upstreamHeader": "Bearer SYNTHETICFIXTUREVALUE0000000000NOTAREALTOKEN"
+  }
+}

package/examples/privacy/findings/credentialed-connection-string.json

@@ -0,0 +1,26 @@
+{
+  "specVersion": "0.1",
+  "id": "018f3b08-1111-7222-8333-000000000008",
+  "time": "2026-05-05T09:00:00.000Z",
+  "event": {
+    "name": "data.record.update",
+    "category": "data-modification",
+    "outcome": "success",
+    "summary": "Synthetic fixture for privacy linting."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-integration-worker"
+  },
+  "resource": {
+    "type": "record",
+    "id": "record-4471"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production"
+  },
+  "metadata": {
+    "dataSource": "postgresql://synthetic_user:synthetic_password@db.example.com:5432/records"
+  }
+}