Coject.Core.Logging.Contracts 3.1.0

Coject.Core.Logging.Contracts

Provider-neutral contract primitives for Coject Core Logging wire contract 3.0.

The current package minor release is 3.1.0. It adds explicit CustomProcedureEventActionPolicy, CustomProcedureContractShape, and CustomProcedureAuthenticationMode metadata without changing existing Contracts 3.0 wire values. ReturnsDataWithoutInput, ReturnsDataWithInput, and AcceptsInputWithoutData describe transport shape and are distinct from Core's existing Single/Batch item cardinality.

This package intentionally contains no ASP.NET, provider, transport, database, backend, credential, Newtonsoft.Json, or FluentValidation dependencies. The package is built for net8.0 and is consumable by later .NET runtimes, including .NET 10 applications.

The 3.0 event/action registries are closed and case-sensitive. Consumers must use the published values; aliases, misspellings, casing variants, and whitespace variants are not accepted.

CojectSensitiveFieldNames is the shared immutable built-in redaction registry. It contains the exact v1 password, secret, token, API/cloud, authorization/session, and connection names. Matching is case-insensitive after the contract's Unicode and separator normalization. Generic names such as id, key, code, username, and publicKey are intentionally not built in; applications and CSCC may add local names without removing these defaults.

The checked-in verification/Verify-ContractsPackage.ps1 gate packs the package twice, compares semantic package contents, rejects build-output leakage, and compiles package consumers targeting both .NET 8 and .NET 10. NuGet ZIP timestamps are intentionally not treated as package-content differences.

The envelope/value-object foundation accepts a caller-captured UTC DateTimeOffset for occurredAt, normalizes it to millisecond precision, and serializes it with Z. Strict reads accept Z or an explicit offset and reject offset-free timestamps. The envelope exposes only immutable read-only properties. Event-specific factories and payload mappings remain closed and are added with their sealed payload contracts. Snapshot writers expose nullable typed scalar methods only; canonical JSON encoding, redaction, changed-path derivation, and provider delivery remain later-phase responsibilities.

The typed record implementation is expressed as CojectLogRecord<TPayload> and CojectAuditRecord<TPayload> so the payload cannot degrade to an object/dynamic bag; the plan's arity-free record names refer to these generic closed compositions.

For the explicitly sensitive DataRead/Read audit, EffectiveQuerySummary.ById() is targeted and requires the canonical numeric or lowercase D-form GUID entityId. The provider-neutral All, Filtered, Count, Lookup, and Custom query summaries support entity-less audits when the required module, resource, operation, actor, and correlation context is present. Targeted reads also require the same read context; missing or malformed effective-query/result metadata is rejected with the stable semantic validation boundary. HTTP verbs, controller/procedure names, and request values do not change this decision; no synthetic entity identifier is permitted. This semantic rule does not add fields or alter the Contracts 3.0 wire shape.

The event/record constructors are intentionally internal. Their package-owned factory boundary accepts only sealed payload implementations from this contracts assembly, so a consumer cannot inject a mutable object into a generic record. Future event payloads must remain sealed immutable value objects created by package factories; no public marker interface or JSON clone is used as a mutability escape hatch.

Actor context is nested under the exact case-sensitive shape {"type","id","displayName","ipAddress"}. type is one of the closed actor values; user/system identities remain validated by the value-object factories. ipAddress is an optional trusted IP associated with the actor that caused the event. User/anonymous HTTP activity may carry a producer-trusted originating IP. System actors require a stable id and must have null ipAddress; the field is rejected when present with a non-null value. A null actor has no IP. Anonymous actors may carry an IP while retaining null id and displayName. This provider-neutral package never performs DNS, loopback, or other fallback synthesis. The 3.0 wire accepts ordinary dotted-decimal IPv4 and standard IPv6 text, serializing IPAddress.ToString() canonical text. IPv4 octets with leading zeros are rejected (the only accepted zero octet spelling is 0); ports, zones, brackets, hostnames, integer/hexadecimal forms, whitespace, empty values, legacy top-level actorIp, nested actorIp/actorType/actorId/actorDisplayName, case variants, and clientIp/originIp/request-settable ingestorIp are rejected. A null ipAddress is omitted from the nested actor JSON.