@vorionsys/security 1.0.0

package/dist/audit/siem/types.js

@@ -0,0 +1,270 @@
+/**
+ * SIEM Integration Types
+ *
+ * TypeScript interfaces and Zod schemas for SIEM integration.
+ * Supports Loki (primary, free/self-hosted), Splunk, and Elastic.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+// =============================================================================
+// SIEM PROVIDER TYPES
+// =============================================================================
+export const SIEM_PROVIDERS = ['loki', 'splunk', 'elastic'];
+// =============================================================================
+// AUTHENTICATION TYPES
+// =============================================================================
+export const AUTH_TYPES = ['none', 'basic', 'bearer', 'api-key'];
+// =============================================================================
+// SIEM CONFIGURATION SCHEMA
+// =============================================================================
+export const SIEMAuthenticationSchema = z.object({
+    type: z.enum(AUTH_TYPES).default('none'),
+    username: z.string().optional(),
+    password: z.string().optional(),
+    token: z.string().optional(),
+    apiKey: z.string().optional(),
+}).refine((auth) => {
+    if (auth.type === 'basic' && (!auth.username || !auth.password)) {
+        return false;
+    }
+    if (auth.type === 'bearer' && !auth.token) {
+        return false;
+    }
+    if (auth.type === 'api-key' && !auth.apiKey) {
+        return false;
+    }
+    return true;
+}, {
+    message: 'Authentication credentials required for selected auth type',
+});
+export const SIEMConfigSchema = z.object({
+    /** Whether SIEM integration is enabled */
+    enabled: z.boolean().default(false),
+    /** SIEM provider type */
+    provider: z.enum(SIEM_PROVIDERS).default('loki'),
+    /** SIEM endpoint URL */
+    endpoint: z.string().url(),
+    /** Authentication configuration */
+    authentication: SIEMAuthenticationSchema.default({ type: 'none' }),
+    /** Number of events to batch before sending (default: 100) */
+    batchSize: z.number().int().min(1).max(10000).default(100),
+    /** Flush interval in milliseconds (default: 5000) */
+    flushIntervalMs: z.number().int().min(100).max(60000).default(5000),
+    /** Number of retry attempts on failure (default: 3) */
+    retryAttempts: z.number().int().min(0).max(10).default(3),
+    /** Retry delay in milliseconds (default: 1000) */
+    retryDelayMs: z.number().int().min(100).max(30000).default(1000),
+    /** Filter which event types to send (empty = all events) */
+    eventTypes: z.array(z.string()).default([]),
+    /** Application label for log categorization */
+    appLabel: z.string().default('vorion'),
+    /** Environment label (development, staging, production) */
+    environmentLabel: z.string().default('development'),
+    /** HTTP request timeout in milliseconds */
+    timeoutMs: z.number().int().min(1000).max(60000).default(10000),
+    /** Maximum queue size before dropping events */
+    maxQueueSize: z.number().int().min(100).max(100000).default(10000),
+    /** Enable gzip compression for payloads */
+    compression: z.boolean().default(true),
+});
+// =============================================================================
+// AUDIT EVENT CATEGORIES
+// =============================================================================
+export const SIEM_EVENT_CATEGORIES = [
+    'authentication',
+    'authorization',
+    'data-access',
+    'configuration',
+    'system',
+    'security',
+    'compliance',
+    'network',
+];
+// =============================================================================
+// AUDIT EVENT SEVERITIES
+// =============================================================================
+export const SIEM_EVENT_SEVERITIES = ['info', 'warning', 'error', 'critical'];
+// =============================================================================
+// AUDIT EVENT OUTCOMES
+// =============================================================================
+export const SIEM_EVENT_OUTCOMES = ['success', 'failure', 'unknown'];
+// =============================================================================
+// AUDIT EVENT TYPES (30+ event types)
+// =============================================================================
+export const SIEM_EVENT_TYPES = [
+    // Authentication events (8)
+    'USER_LOGIN',
+    'USER_LOGOUT',
+    'USER_LOGIN_FAILED',
+    'SESSION_CREATED',
+    'SESSION_EXPIRED',
+    'SESSION_REVOKED',
+    'TOKEN_ISSUED',
+    'TOKEN_REVOKED',
+    // MFA events (4)
+    'MFA_CHALLENGE',
+    'MFA_SUCCESS',
+    'MFA_FAILURE',
+    'MFA_BYPASS_ATTEMPTED',
+    // Password events (3)
+    'PASSWORD_CHANGE',
+    'PASSWORD_RESET_REQUESTED',
+    'PASSWORD_RESET_COMPLETED',
+    // Authorization events (4)
+    'PERMISSION_GRANTED',
+    'PERMISSION_DENIED',
+    'PERMISSION_REVOKED',
+    'ROLE_CHANGED',
+    // Resource lifecycle events (5)
+    'RESOURCE_CREATE',
+    'RESOURCE_READ',
+    'RESOURCE_UPDATE',
+    'RESOURCE_DELETE',
+    'RESOURCE_EXPORT',
+    // Configuration events (4)
+    'CONFIG_CHANGE',
+    'KEY_ROTATION',
+    'SECRET_ACCESSED',
+    'POLICY_UPDATE',
+    // Security events (6)
+    'RATE_LIMIT_EXCEEDED',
+    'INJECTION_ATTEMPT',
+    'ANOMALY_DETECTED',
+    'BRUTE_FORCE_DETECTED',
+    'IP_BLOCKED',
+    'SUSPICIOUS_ACTIVITY',
+    // System events (4)
+    'SYSTEM_STARTUP',
+    'SYSTEM_SHUTDOWN',
+    'HEALTH_CHECK_FAILED',
+    'SERVICE_DEGRADED',
+    // Compliance events (3)
+    'DATA_RETENTION_CLEANUP',
+    'GDPR_REQUEST_RECEIVED',
+    'AUDIT_LOG_EXPORTED',
+    // Trust/Governance events (3)
+    'TRUST_LEVEL_CHANGED',
+    'ESCALATION_TRIGGERED',
+    'INTENT_EVALUATED',
+];
+// =============================================================================
+// AUDIT EVENT ACTOR
+// =============================================================================
+export const AuditEventActorSchema = z.object({
+    /** User ID if authenticated */
+    userId: z.string().optional(),
+    /** Tenant ID for multi-tenant systems */
+    tenantId: z.string().optional(),
+    /** Client IP address */
+    ipAddress: z.string(),
+    /** User agent string */
+    userAgent: z.string().optional(),
+    /** Session ID if applicable */
+    sessionId: z.string().optional(),
+    /** Agent/service name if not a user */
+    agentId: z.string().optional(),
+    /** Actor type: user, agent, service, system */
+    actorType: z.enum(['user', 'agent', 'service', 'system']).default('user'),
+});
+// =============================================================================
+// AUDIT EVENT RESOURCE
+// =============================================================================
+export const AuditEventResourceSchema = z.object({
+    /** Resource type (e.g., 'user', 'intent', 'policy') */
+    type: z.string(),
+    /** Resource identifier */
+    id: z.string(),
+    /** Human-readable resource name */
+    name: z.string().optional(),
+    /** Parent resource ID if hierarchical */
+    parentId: z.string().optional(),
+    /** Additional resource attributes */
+    attributes: z.record(z.unknown()).optional(),
+});
+// =============================================================================
+// AUDIT EVENT METADATA
+// =============================================================================
+export const AuditEventMetadataSchema = z.object({
+    /** Unique request identifier */
+    requestId: z.string(),
+    /** Distributed trace ID (W3C TraceContext) */
+    traceId: z.string().optional(),
+    /** Span ID for trace correlation */
+    spanId: z.string().optional(),
+    /** Correlation ID for multi-step operations */
+    correlationId: z.string().optional(),
+    /** Source service/component name */
+    source: z.string().optional(),
+    /** Additional tags for filtering */
+    tags: z.array(z.string()).optional(),
+});
+// =============================================================================
+// MAIN AUDIT EVENT SCHEMA
+// =============================================================================
+export const AuditEventSchema = z.object({
+    /** Unique event identifier */
+    id: z.string().uuid(),
+    /** Event timestamp */
+    timestamp: z.date(),
+    /** Event type */
+    type: z.string(),
+    /** Event category */
+    category: z.enum(SIEM_EVENT_CATEGORIES),
+    /** Event severity */
+    severity: z.enum(SIEM_EVENT_SEVERITIES),
+    /** Actor information */
+    actor: AuditEventActorSchema,
+    /** Resource information */
+    resource: AuditEventResourceSchema,
+    /** Action performed */
+    action: z.string(),
+    /** Outcome of the action */
+    outcome: z.enum(SIEM_EVENT_OUTCOMES),
+    /** Additional event details */
+    details: z.record(z.unknown()).default({}),
+    /** Event metadata for correlation */
+    metadata: AuditEventMetadataSchema,
+});
+// =============================================================================
+// ERROR TYPES
+// =============================================================================
+export class SIEMConnectionError extends Error {
+    provider;
+    endpoint;
+    statusCode;
+    cause;
+    constructor(message, provider, endpoint, statusCode, cause) {
+        super(message);
+        this.provider = provider;
+        this.endpoint = endpoint;
+        this.statusCode = statusCode;
+        this.cause = cause;
+        this.name = 'SIEMConnectionError';
+    }
+}
+export class SIEMConfigurationError extends Error {
+    provider;
+    field;
+    constructor(message, provider, field) {
+        super(message);
+        this.provider = provider;
+        this.field = field;
+        this.name = 'SIEMConfigurationError';
+    }
+}
+export class SIEMBatchError extends Error {
+    provider;
+    failedCount;
+    totalCount;
+    cause;
+    constructor(message, provider, failedCount, totalCount, cause) {
+        super(message);
+        this.provider = provider;
+        this.failedCount = failedCount;
+        this.totalCount = totalCount;
+        this.cause = cause;
+        this.name = 'SIEMBatchError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/audit/siem/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/audit/siem/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAGrE,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAG1E,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC,MAAM,CACP,CAAC,IAAI,EAAE,EAAE;IACP,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,EACD;IACE,OAAO,EAAE,4DAA4D;CACtE,CACF,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,yBAAyB;IACzB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChD,wBAAwB;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,mCAAmC;IACnC,cAAc,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1D,qDAAqD;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnE,uDAAuD;IACvD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,kDAAkD;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAChE,4DAA4D;IAC5D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,+CAA+C;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACtC,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;IACnD,2CAA2C;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,gDAAgD;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClE,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACvC,CAAC,CAAC;AAIH,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,eAAe;IACf,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,SAAS;CACD,CAAC;AAIX,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAGvF,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAG9E,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,4BAA4B;IAC5B,YAAY;IACZ,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IAEf,iBAAiB;IACjB,eAAe;IACf,aAAa;IACb,aAAa;IACb,sBAAsB;IAEtB,sBAAsB;IACtB,iBAAiB;IACjB,0BAA0B;IAC1B,0BAA0B;IAE1B,2BAA2B;IAC3B,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,cAAc;IAEd,gCAAgC;IAChC,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IAEjB,2BAA2B;IAC3B,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,eAAe;IAEf,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,kBAAkB;IAClB,sBAAsB;IACtB,YAAY;IACZ,qBAAqB;IAErB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,kBAAkB;IAElB,wBAAwB;IACxB,wBAAwB;IACxB,uBAAuB;IACvB,oBAAoB;IAEpB,8BAA8B;IAC9B,qBAAqB;IACrB,sBAAsB;IACtB,kBAAkB;CACV,CAAC;AAIX,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+BAA+B;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,yCAAyC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,uCAAuC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,+CAA+C;IAC/C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC1E,CAAC,CAAC;AAIH,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,uDAAuD;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,0BAA0B;IAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,mCAAmC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,yCAAyC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,qCAAqC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,gCAAgC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,+CAA+C;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAIH,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,8BAA8B;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,sBAAsB;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,iBAAiB;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,qBAAqB;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACvC,qBAAqB;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACvC,wBAAwB;IACxB,KAAK,EAAE,qBAAqB;IAC5B,2BAA2B;IAC3B,QAAQ,EAAE,wBAAwB;IAClC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,4BAA4B;IAC5B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACpC,+BAA+B;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,qCAAqC;IACrC,QAAQ,EAAE,wBAAwB;CACnC,CAAC,CAAC;AAsJH,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAG1B;IACA;IACA;IACA;IALlB,YACE,OAAe,EACC,QAAsB,EACtB,QAAgB,EAChB,UAAmB,EACnB,KAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,aAAQ,GAAR,QAAQ,CAAc;QACtB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IACA;IAHlB,YACE,OAAe,EACC,QAAsB,EACtB,KAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,aAAQ,GAAR,QAAQ,CAAc;QACtB,UAAK,GAAL,KAAK,CAAS;QAG9B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IACA;IACA;IACA;IALlB,YACE,OAAe,EACC,QAAsB,EACtB,WAAmB,EACnB,UAAkB,EAClB,KAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,aAAQ,GAAR,QAAQ,CAAc;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,eAAU,GAAV,UAAU,CAAQ;QAClB,UAAK,GAAL,KAAK,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/audit/types.d.ts

@@ -0,0 +1,405 @@
+/**
+ * Audit Engine Type Definitions
+ *
+ * Defines audit events, records, and related types for comprehensive
+ * audit logging with chain integrity.
+ *
+ * @packageDocumentation
+ */
+import type { ID, Timestamp } from '../common/types.js';
+export declare const AUDIT_SEVERITIES: readonly ["info", "warning", "error", "critical"];
+export type AuditSeverity = (typeof AUDIT_SEVERITIES)[number];
+export declare const AUDIT_OUTCOMES: readonly ["success", "failure", "partial"];
+export type AuditOutcome = (typeof AUDIT_OUTCOMES)[number];
+export declare const AUDIT_CATEGORIES: readonly ["intent", "policy", "escalation", "authentication", "authorization", "data", "system", "admin"];
+export type AuditCategory = (typeof AUDIT_CATEGORIES)[number];
+export declare const AUDIT_EVENT_TYPES: {
+    readonly 'intent.created': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.submitted': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.evaluation.started': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.evaluation.completed': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.approved': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.denied': {
+        readonly category: "intent";
+        readonly severity: "warning";
+    };
+    readonly 'intent.escalated': {
+        readonly category: "intent";
+        readonly severity: "warning";
+    };
+    readonly 'intent.execution.started': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.completed': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.failed': {
+        readonly category: "intent";
+        readonly severity: "error";
+    };
+    readonly 'intent.cancelled': {
+        readonly category: "intent";
+        readonly severity: "warning";
+    };
+    readonly 'intent.status.changed': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.replayed': {
+        readonly category: "intent";
+        readonly severity: "info";
+    };
+    readonly 'intent.deleted': {
+        readonly category: "intent";
+        readonly severity: "warning";
+    };
+    readonly 'policy.created': {
+        readonly category: "policy";
+        readonly severity: "info";
+    };
+    readonly 'policy.updated': {
+        readonly category: "policy";
+        readonly severity: "info";
+    };
+    readonly 'policy.published': {
+        readonly category: "policy";
+        readonly severity: "info";
+    };
+    readonly 'policy.deprecated': {
+        readonly category: "policy";
+        readonly severity: "warning";
+    };
+    readonly 'policy.archived': {
+        readonly category: "policy";
+        readonly severity: "warning";
+    };
+    readonly 'policy.evaluation.started': {
+        readonly category: "policy";
+        readonly severity: "info";
+    };
+    readonly 'policy.evaluation.completed': {
+        readonly category: "policy";
+        readonly severity: "info";
+    };
+    readonly 'policy.violation': {
+        readonly category: "policy";
+        readonly severity: "warning";
+    };
+    readonly 'escalation.created': {
+        readonly category: "escalation";
+        readonly severity: "warning";
+    };
+    readonly 'escalation.acknowledged': {
+        readonly category: "escalation";
+        readonly severity: "info";
+    };
+    readonly 'escalation.approved': {
+        readonly category: "escalation";
+        readonly severity: "info";
+    };
+    readonly 'escalation.rejected': {
+        readonly category: "escalation";
+        readonly severity: "warning";
+    };
+    readonly 'escalation.timeout': {
+        readonly category: "escalation";
+        readonly severity: "error";
+    };
+    readonly 'escalation.cancelled': {
+        readonly category: "escalation";
+        readonly severity: "warning";
+    };
+    readonly 'escalation.sla.breached': {
+        readonly category: "escalation";
+        readonly severity: "critical";
+    };
+    readonly 'auth.login': {
+        readonly category: "authentication";
+        readonly severity: "info";
+    };
+    readonly 'auth.logout': {
+        readonly category: "authentication";
+        readonly severity: "info";
+    };
+    readonly 'auth.failed': {
+        readonly category: "authentication";
+        readonly severity: "warning";
+    };
+    readonly 'auth.token.issued': {
+        readonly category: "authentication";
+        readonly severity: "info";
+    };
+    readonly 'auth.token.revoked': {
+        readonly category: "authentication";
+        readonly severity: "info";
+    };
+    readonly 'auth.token.expired': {
+        readonly category: "authentication";
+        readonly severity: "info";
+    };
+    readonly 'authz.denied': {
+        readonly category: "authorization";
+        readonly severity: "warning";
+    };
+    readonly 'authz.granted': {
+        readonly category: "authorization";
+        readonly severity: "info";
+    };
+    readonly 'authz.elevated': {
+        readonly category: "authorization";
+        readonly severity: "warning";
+    };
+    readonly 'data.read': {
+        readonly category: "data";
+        readonly severity: "info";
+    };
+    readonly 'data.created': {
+        readonly category: "data";
+        readonly severity: "info";
+    };
+    readonly 'data.updated': {
+        readonly category: "data";
+        readonly severity: "info";
+    };
+    readonly 'data.deleted': {
+        readonly category: "data";
+        readonly severity: "warning";
+    };
+    readonly 'data.exported': {
+        readonly category: "data";
+        readonly severity: "warning";
+    };
+    readonly 'system.startup': {
+        readonly category: "system";
+        readonly severity: "info";
+    };
+    readonly 'system.shutdown': {
+        readonly category: "system";
+        readonly severity: "info";
+    };
+    readonly 'system.error': {
+        readonly category: "system";
+        readonly severity: "error";
+    };
+    readonly 'system.warning': {
+        readonly category: "system";
+        readonly severity: "warning";
+    };
+    readonly 'system.config.changed': {
+        readonly category: "system";
+        readonly severity: "info";
+    };
+    readonly 'admin.user.created': {
+        readonly category: "admin";
+        readonly severity: "info";
+    };
+    readonly 'admin.user.updated': {
+        readonly category: "admin";
+        readonly severity: "info";
+    };
+    readonly 'admin.user.deleted': {
+        readonly category: "admin";
+        readonly severity: "warning";
+    };
+    readonly 'admin.permission.granted': {
+        readonly category: "admin";
+        readonly severity: "info";
+    };
+    readonly 'admin.permission.revoked': {
+        readonly category: "admin";
+        readonly severity: "warning";
+    };
+    readonly 'admin.user_modified': {
+        readonly category: "admin";
+        readonly severity: "info";
+    };
+    readonly 'admin.token_revoked': {
+        readonly category: "admin";
+        readonly severity: "warning";
+    };
+    readonly 'access.denied': {
+        readonly category: "authorization";
+        readonly severity: "warning";
+    };
+    readonly 'access.granted': {
+        readonly category: "authorization";
+        readonly severity: "info";
+    };
+    readonly 'trust_score.updated': {
+        readonly category: "data";
+        readonly severity: "info";
+    };
+    readonly 'trust_score.recalculated': {
+        readonly category: "data";
+        readonly severity: "info";
+    };
+    readonly 'escalation.assigned': {
+        readonly category: "escalation";
+        readonly severity: "info";
+    };
+    readonly 'policy.deleted': {
+        readonly category: "policy";
+        readonly severity: "warning";
+    };
+};
+export type AuditEventType = keyof typeof AUDIT_EVENT_TYPES;
+export declare const ACTOR_TYPES: readonly ["user", "agent", "service", "system"];
+export type ActorType = (typeof ACTOR_TYPES)[number];
+export declare const TARGET_TYPES: readonly ["intent", "policy", "escalation", "entity", "tenant", "user", "system"];
+export type TargetType = (typeof TARGET_TYPES)[number];
+/**
+ * Actor information
+ */
+export interface AuditActor {
+    type: ActorType;
+    id: ID;
+    name?: string;
+    ip?: string;
+}
+/**
+ * Target of the audited action
+ */
+export interface AuditTarget {
+    type: TargetType;
+    id: ID;
+    name?: string;
+}
+/**
+ * State change tracking
+ */
+export interface AuditStateChange {
+    before?: Record<string, unknown>;
+    after?: Record<string, unknown>;
+    diff?: Record<string, unknown>;
+}
+/**
+ * Complete audit record as stored in database
+ */
+export interface AuditRecord {
+    id: ID;
+    tenantId: ID;
+    eventType: AuditEventType | string;
+    eventCategory: AuditCategory;
+    severity: AuditSeverity;
+    actor: AuditActor;
+    target: AuditTarget;
+    requestId: ID;
+    traceId?: string | null;
+    spanId?: string | null;
+    action: string;
+    outcome: AuditOutcome;
+    reason?: string | null;
+    stateChange?: AuditStateChange | null;
+    metadata?: Record<string, unknown> | null;
+    tags?: string[] | null;
+    sequenceNumber: number;
+    previousHash?: string | null;
+    recordHash: string;
+    eventTime: Timestamp;
+    recordedAt: Timestamp;
+    archived: boolean;
+    archivedAt?: Timestamp | null;
+}
+/**
+ * Input for creating an audit record
+ */
+export interface CreateAuditRecordInput {
+    tenantId: ID;
+    eventType: AuditEventType | string;
+    actor: AuditActor;
+    target: AuditTarget;
+    action: string;
+    outcome: AuditOutcome;
+    reason?: string;
+    stateChange?: AuditStateChange;
+    metadata?: Record<string, unknown>;
+    tags?: string[];
+    requestId?: ID;
+    traceId?: string;
+    spanId?: string;
+    eventTime?: Timestamp;
+}
+export interface AuditQueryFilters {
+    tenantId: ID;
+    eventType?: AuditEventType | string;
+    eventCategory?: AuditCategory;
+    severity?: AuditSeverity;
+    actorId?: ID;
+    actorType?: ActorType;
+    targetId?: ID;
+    targetType?: TargetType;
+    outcome?: AuditOutcome;
+    requestId?: ID;
+    traceId?: string;
+    tags?: string[];
+    startTime?: Timestamp;
+    endTime?: Timestamp;
+    limit?: number;
+    offset?: number;
+    orderBy?: 'eventTime' | 'recordedAt';
+    orderDirection?: 'asc' | 'desc';
+}
+/**
+ * Paginated audit query result
+ */
+export interface AuditQueryResult {
+    records: AuditRecord[];
+    total: number;
+    hasMore: boolean;
+}
+/**
+ * Result of chain integrity verification
+ */
+export interface ChainIntegrityResult {
+    valid: boolean;
+    recordsChecked: number;
+    firstRecord?: ID;
+    lastRecord?: ID;
+    brokenAt?: ID;
+    error?: string;
+}
+/**
+ * Result of audit archive operation
+ */
+export interface AuditArchiveResult {
+    recordsArchived: number;
+    durationMs: number;
+    oldestArchivedDate?: Timestamp;
+    newestArchivedDate?: Timestamp;
+}
+/**
+ * Result of audit purge operation
+ */
+export interface AuditPurgeResult {
+    recordsPurged: number;
+    durationMs: number;
+    oldestPurgedDate?: Timestamp;
+    newestPurgedDate?: Timestamp;
+}
+/**
+ * Combined result of audit cleanup operation
+ */
+export interface AuditCleanupResult {
+    archived: AuditArchiveResult;
+    purged: AuditPurgeResult;
+    totalDurationMs: number;
+    errors: string[];
+}
+//# sourceMappingURL=types.d.ts.map