theway-contract 0.1.14

theway shared leaf contract — raw session persistence interfaces, persisted DAG snapshots, sidecar models, and path layout; no engine, protocol, or runtime dependencies.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

use std::collections::BTreeSet;

use serde::{Deserialize, Serialize};

use super::ExtensionPermission;

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum ExtensionAuditOperation {
    TrustChanged,
    WorkspaceRead,
    WorkspaceWrite,
    ProcessSpawn,
    NetworkConnect,
    SecretRead,
    ProviderRawRead,
    NativeNotify,
    NativeLog,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum ExtensionAuditOutcome {
    Allowed,
    Denied,
    Succeeded,
    Failed,
    Cancelled,
}

/// Redacted security audit record. Targets are bounded public identifiers;
/// secret values, request bodies, command arguments, model content, and
/// extension-private state have no fields in this contract.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct ExtensionAuditEvent {
    pub timestamp: String,
    pub extension_id: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub session_id: Option<String>,
    pub operation: ExtensionAuditOperation,
    pub outcome: ExtensionAuditOutcome,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capability: Option<ExtensionPermission>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub target: Option<String>,
    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
    pub redacted_fields: BTreeSet<String>,
}