feat(security): Vercel and GCP audit events go to the audit trail, not to logs

apps/api/src/routes/internal/query-engine.http.ts

@@ -21,7 +21,6 @@ import {
 	PlanetScaleInfraTimeseriesResponse,
 	RailwayInfraRowsResponse,
 	VercelAiGatewayResponse,
-	VercelAuditLogResponse,
 	VercelInfraDependenciesResponse,
 	VercelInfraFunctionsResponse,
 	VercelInfraFunctionTimeseriesResponse,
@@ -1000,18 +999,6 @@ export const HttpQueryEngineLive = HttpApiBuilder.group(MapleInternalApi, "query
 						})
 					}),
 				)
-				.handle("vercelAuditLog", ({ payload }) =>
-					Effect.gen(function* () {
-						const tenant = yield* CurrentTenant.Context
-						const rows = yield* runQuery(Queries.vercelAuditLog, tenant, payload)
-						return new VercelAuditLogResponse({
-							events: Arr.map(rows, (row) => ({
-								...row,
-								timestamp: DateTime.formatIso(row.timestamp),
-							})),
-						})
-					}),
-				)
 				.handle("gcpInfraPresence", ({ payload }) =>
 					Effect.gen(function* () {
 						const tenant = yield* CurrentTenant.Context

apps/ingest/alchemy.run.ts

@@ -522,6 +522,9 @@ export const createMapleIngest = ({ stage, region, hostname, profile, dbLogin }:
 				...(yield* blockedIngestKeysEnv),
 				// The org Maple's own telemetry is filed under. Required, no fallback.
 				MAPLE_INTERNAL_ORG_ID: yield* requiredPlain("MAPLE_INTERNAL_ORG_ID"),
+				// On wherever a stage is deployed whole and never rolled back to an older gateway; prd
+				// turns it on in its environment once `audit_trail_events` is there.
+				...(stage.kind !== "prd" && { INGEST_AUDIT_TRAIL_ENABLED: "true" }),
 				...(yield* gatewayTuningEnv),
 				// `INGEST_COMMIT_SHA` (prd) is the image's own revision, so a deploy that leaves
 				// `apps/ingest` alone does not change the task definition and roll the hosts.

apps/ingest/alchemy/gateway-env.ts

@@ -24,6 +24,9 @@ export const gatewayTuningEnv: Config.Config<PlainEnv> = Config.all([
 	// switch rule application off in an emergency.
 	optionalPlain("INGEST_RULES_ENABLED"),
 	optionalPlain("INGEST_RULES_CACHE_TTL_SECS"),
+	// Provider audit events go to the audit trail instead of the logs. The gateway defaults to off:
+	// set "true" once `audit_trail_events` exists and every task runs a build that knows the switch.
+	optionalPlain("INGEST_AUDIT_TRAIL_ENABLED"),
 	optionalPlain("INGEST_MAX_REQUEST_BODY_BYTES"),
 	optionalPlain("INGEST_MAX_DECODED_BODY_BYTES"),
 	optionalPlain("INGEST_MAX_DECODE_HEAP_BYTES"),