Coject.Core.Logging.Contracts 3.0.0

Coject.Core.Logging.Contracts

Provider-neutral contract primitives for Coject Core Logging wire contract 3.0.

This package intentionally contains no ASP.NET, provider, transport, database, backend, credential, Newtonsoft.Json, or FluentValidation dependencies. The package is built for net8.0 and is consumable by later .NET runtimes, including .NET 10 applications.

The 3.0 event/action registries are closed and case-sensitive. Consumers must use the published values; aliases, misspellings, casing variants, and whitespace variants are not accepted.

CojectSensitiveFieldNames is the shared immutable built-in redaction registry. It contains the exact v1 password, secret, token, API/cloud, authorization/session, and connection names. Matching is case-insensitive after the contract's Unicode and separator normalization. Generic names such as id, key, code, username, and publicKey are intentionally not built in; applications and CSCC may add local names without removing these defaults.

The checked-in verification/Verify-ContractsPackage.ps1 gate packs the package twice, compares semantic package contents, rejects build-output leakage, and compiles package consumers targeting both .NET 8 and .NET 10. NuGet ZIP timestamps are intentionally not treated as package-content differences.

The envelope/value-object foundation accepts a caller-captured UTC DateTimeOffset for occurredAt, normalizes it to millisecond precision, and serializes it with Z. Strict reads accept Z or an explicit offset and reject offset-free timestamps. The envelope exposes only immutable read-only properties. Event-specific factories and payload mappings remain closed and are added with their sealed payload contracts. Snapshot writers expose nullable typed scalar methods only; canonical JSON encoding, redaction, changed-path derivation, and provider delivery remain later-phase responsibilities.

The typed record implementation is expressed as CojectLogRecord<TPayload> and CojectAuditRecord<TPayload> so the payload cannot degrade to an object/dynamic bag; the plan's arity-free record names refer to these generic closed compositions.

The event/record constructors are intentionally internal. Their package-owned factory boundary accepts only sealed payload implementations from this contracts assembly, so a consumer cannot inject a mutable object into a generic record. Future event payloads must remain sealed immutable value objects created by package factories; no public marker interface or JSON clone is used as a mutability escape hatch.

Actor context is nested under the exact case-sensitive shape {"type","id","displayName","ipAddress"}. type is one of the closed actor values; user/system identities remain validated by the value-object factories. ipAddress is an optional trusted IP associated with the actor that caused the event. User/anonymous HTTP activity may carry a producer-trusted originating IP. System actors require a stable id and must have null ipAddress; the field is rejected when present with a non-null value. A null actor has no IP. Anonymous actors may carry an IP while retaining null id and displayName. This provider-neutral package never performs DNS, loopback, or other fallback synthesis. The 3.0 wire accepts ordinary dotted-decimal IPv4 and standard IPv6 text, serializing IPAddress.ToString() canonical text. IPv4 octets with leading zeros are rejected (the only accepted zero octet spelling is 0); ports, zones, brackets, hostnames, integer/hexadecimal forms, whitespace, empty values, legacy top-level actorIp, nested actorIp/actorType/actorId/actorDisplayName, case variants, and clientIp/originIp/request-settable ingestorIp are rejected. A null ipAddress is omitted from the nested actor JSON.