@atensec/pulumi-thoth 0.1.0 → 0.1.1

package/browser/policy.ts

@@ -45,7 +45,7 @@ export class Policy extends pulumi.CustomResource {
      */
     declare public /*out*/ readonly createdAt: pulumi.Output<string>;
     /**
-     * Override createdBy audit value.
+     * Override<span pulumi-lang-nodejs=" createdBy " pulumi-lang-dotnet=" CreatedBy " pulumi-lang-go=" createdBy " pulumi-lang-python=" created_by " pulumi-lang-yaml=" createdBy " pulumi-lang-java=" createdBy "> createdBy </span>audit value.
      */
     declare public readonly createdBy: pulumi.Output<string | undefined>;
     /**
@@ -81,7 +81,7 @@ export class Policy extends pulumi.CustomResource {
      */
     declare public /*out*/ readonly updatedAt: pulumi.Output<string>;
     /**
-     * Override updatedBy audit value.
+     * Override<span pulumi-lang-nodejs=" updatedBy " pulumi-lang-dotnet=" UpdatedBy " pulumi-lang-go=" updatedBy " pulumi-lang-python=" updated_by " pulumi-lang-yaml=" updatedBy " pulumi-lang-java=" updatedBy "> updatedBy </span>audit value.
      */
     declare public readonly updatedBy: pulumi.Output<string | undefined>;
     /**
@@ -164,7 +164,7 @@ export interface PolicyState {
      */
     createdAt?: pulumi.Input<string | undefined>;
     /**
-     * Override createdBy audit value.
+     * Override<span pulumi-lang-nodejs=" createdBy " pulumi-lang-dotnet=" CreatedBy " pulumi-lang-go=" createdBy " pulumi-lang-python=" created_by " pulumi-lang-yaml=" createdBy " pulumi-lang-java=" createdBy "> createdBy </span>audit value.
      */
     createdBy?: pulumi.Input<string | undefined>;
     /**
@@ -200,7 +200,7 @@ export interface PolicyState {
      */
     updatedAt?: pulumi.Input<string | undefined>;
     /**
-     * Override updatedBy audit value.
+     * Override<span pulumi-lang-nodejs=" updatedBy " pulumi-lang-dotnet=" UpdatedBy " pulumi-lang-go=" updatedBy " pulumi-lang-python=" updated_by " pulumi-lang-yaml=" updatedBy " pulumi-lang-java=" updatedBy "> updatedBy </span>audit value.
      */
     updatedBy?: pulumi.Input<string | undefined>;
     /**
@@ -218,7 +218,7 @@ export interface PolicyArgs {
      */
     active?: pulumi.Input<boolean | undefined>;
     /**
-     * Override createdBy audit value.
+     * Override<span pulumi-lang-nodejs=" createdBy " pulumi-lang-dotnet=" CreatedBy " pulumi-lang-go=" createdBy " pulumi-lang-python=" created_by " pulumi-lang-yaml=" createdBy " pulumi-lang-java=" createdBy "> createdBy </span>audit value.
      */
     createdBy?: pulumi.Input<string | undefined>;
     /**
@@ -246,7 +246,7 @@ export interface PolicyArgs {
      */
     providerName: pulumi.Input<string>;
     /**
-     * Override updatedBy audit value.
+     * Override<span pulumi-lang-nodejs=" updatedBy " pulumi-lang-dotnet=" UpdatedBy " pulumi-lang-go=" updatedBy " pulumi-lang-python=" updated_by " pulumi-lang-yaml=" updatedBy " pulumi-lang-java=" updatedBy "> updatedBy </span>audit value.
      */
     updatedBy?: pulumi.Input<string | undefined>;
     /**

package/config/vars.ts

@@ -30,7 +30,7 @@ Object.defineProperty(exports, "adminBearerTokenFile", {
 });
 
 /**
- * Apex domain used to derive GovAPI host when apiBaseUrl is omitted. Defaults to atensecurity.com.
+ * Apex domain used to derive GovAPI host when<span pulumi-lang-nodejs=" apiBaseUrl " pulumi-lang-dotnet=" ApiBaseUrl " pulumi-lang-go=" apiBaseUrl " pulumi-lang-python=" api_base_url " pulumi-lang-yaml=" apiBaseUrl " pulumi-lang-java=" apiBaseUrl "> apiBaseUrl </span>is omitted. Defaults to atensecurity.com.
  */
 export declare const apexDomain: string | undefined;
 Object.defineProperty(exports, "apexDomain", {

package/governance/decisionFieldBackfill.ts

@@ -0,0 +1,277 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class DecisionFieldBackfill extends pulumi.CustomResource {
+    /**
+     * Get an existing DecisionFieldBackfill resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: DecisionFieldBackfillState, opts?: pulumi.CustomResourceOptions): DecisionFieldBackfill {
+        return new DecisionFieldBackfill(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/decisionFieldBackfill:DecisionFieldBackfill';
+
+    /**
+     * Returns true if the given object is an instance of DecisionFieldBackfill.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is DecisionFieldBackfill {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === DecisionFieldBackfill.__pulumiType;
+    }
+
+    /**
+     * Rows eligible for decision-field patching.
+     */
+    declare public /*out*/ readonly candidates: pulumi.Output<number>;
+    /**
+     * Preview candidate patches without persisting updates.
+     */
+    declare public readonly dryRun: pulumi.Output<boolean | undefined>;
+    /**
+     * Rows scanned by the backfill operation.
+     */
+    declare public /*out*/ readonly examined: pulumi.Output<number>;
+    /**
+     * Timestamp when backfill execution completed.
+     */
+    declare public /*out*/ readonly executedAt: pulumi.Output<string>;
+    /**
+     * Include blocked events in candidate selection.
+     */
+    declare public readonly includeBlockedEvents: pulumi.Output<boolean | undefined>;
+    /**
+     * Maximum number of candidate rows to evaluate (1-5000).
+     */
+    declare public readonly limit: pulumi.Output<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" authorizationDecision " pulumi-lang-dotnet=" AuthorizationDecision " pulumi-lang-go=" authorizationDecision " pulumi-lang-python=" authorization_decision " pulumi-lang-yaml=" authorizationDecision " pulumi-lang-java=" authorizationDecision "> authorizationDecision </span>was patched.
+     */
+    declare public /*out*/ readonly patchedAuthorizationDecision: pulumi.Output<number>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" decisionEvidence " pulumi-lang-dotnet=" DecisionEvidence " pulumi-lang-go=" decisionEvidence " pulumi-lang-python=" decision_evidence " pulumi-lang-yaml=" decisionEvidence " pulumi-lang-java=" decisionEvidence "> decisionEvidence </span>was patched.
+     */
+    declare public /*out*/ readonly patchedDecisionEvidence: pulumi.Output<number>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" decisionReasonCode " pulumi-lang-dotnet=" DecisionReasonCode " pulumi-lang-go=" decisionReasonCode " pulumi-lang-python=" decision_reason_code " pulumi-lang-yaml=" decisionReasonCode " pulumi-lang-java=" decisionReasonCode "> decisionReasonCode </span>was patched.
+     */
+    declare public /*out*/ readonly patchedDecisionReasonCode: pulumi.Output<number>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" deepllmEnrichment " pulumi-lang-dotnet=" DeepllmEnrichment " pulumi-lang-go=" deepllmEnrichment " pulumi-lang-python=" deepllm_enrichment " pulumi-lang-yaml=" deepllmEnrichment " pulumi-lang-java=" deepllmEnrichment "> deepllmEnrichment </span>was patched.
+     */
+    declare public /*out*/ readonly patchedDeepllmEnrichment: pulumi.Output<number>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" enforcementTraceId " pulumi-lang-dotnet=" EnforcementTraceId " pulumi-lang-go=" enforcementTraceId " pulumi-lang-python=" enforcement_trace_id " pulumi-lang-yaml=" enforcementTraceId " pulumi-lang-java=" enforcementTraceId "> enforcementTraceId </span>was patched.
+     */
+    declare public /*out*/ readonly patchedEnforcementTraceId: pulumi.Output<number>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" violationId " pulumi-lang-dotnet=" ViolationId " pulumi-lang-go=" violationId " pulumi-lang-python=" violation_id " pulumi-lang-yaml=" violationId " pulumi-lang-java=" violationId "> violationId </span>was patched.
+     */
+    declare public /*out*/ readonly patchedViolationId: pulumi.Output<number>;
+    /**
+     * Candidate row IDs as a JSON array.
+     */
+    declare public /*out*/ readonly rowIdsJson: pulumi.Output<string>;
+    /**
+     * Eligible rows skipped because no field changes were required.
+     */
+    declare public /*out*/ readonly skippedNoChange: pulumi.Output<number>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Change this value to force a re-run.
+     */
+    declare public readonly trigger: pulumi.Output<string | undefined>;
+    /**
+     * Rows updated when dry_run=false.
+     */
+    declare public /*out*/ readonly updated: pulumi.Output<number>;
+    /**
+     * Trailing lookback window in hours (1-2880).
+     */
+    declare public readonly windowHours: pulumi.Output<number | undefined>;
+    /**
+     * Rows that would be updated when dry_run=true.
+     */
+    declare public /*out*/ readonly wouldUpdate: pulumi.Output<number>;
+
+    /**
+     * Create a DecisionFieldBackfill resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: DecisionFieldBackfillArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: DecisionFieldBackfillArgs | DecisionFieldBackfillState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as DecisionFieldBackfillState | undefined;
+            resourceInputs["candidates"] = state?.candidates;
+            resourceInputs["dryRun"] = state?.dryRun;
+            resourceInputs["examined"] = state?.examined;
+            resourceInputs["executedAt"] = state?.executedAt;
+            resourceInputs["includeBlockedEvents"] = state?.includeBlockedEvents;
+            resourceInputs["limit"] = state?.limit;
+            resourceInputs["patchedAuthorizationDecision"] = state?.patchedAuthorizationDecision;
+            resourceInputs["patchedDecisionEvidence"] = state?.patchedDecisionEvidence;
+            resourceInputs["patchedDecisionReasonCode"] = state?.patchedDecisionReasonCode;
+            resourceInputs["patchedDeepllmEnrichment"] = state?.patchedDeepllmEnrichment;
+            resourceInputs["patchedEnforcementTraceId"] = state?.patchedEnforcementTraceId;
+            resourceInputs["patchedViolationId"] = state?.patchedViolationId;
+            resourceInputs["rowIdsJson"] = state?.rowIdsJson;
+            resourceInputs["skippedNoChange"] = state?.skippedNoChange;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["trigger"] = state?.trigger;
+            resourceInputs["updated"] = state?.updated;
+            resourceInputs["windowHours"] = state?.windowHours;
+            resourceInputs["wouldUpdate"] = state?.wouldUpdate;
+        } else {
+            const args = argsOrState as DecisionFieldBackfillArgs | undefined;
+            resourceInputs["dryRun"] = args?.dryRun;
+            resourceInputs["includeBlockedEvents"] = args?.includeBlockedEvents;
+            resourceInputs["limit"] = args?.limit;
+            resourceInputs["trigger"] = args?.trigger;
+            resourceInputs["windowHours"] = args?.windowHours;
+            resourceInputs["candidates"] = undefined /*out*/;
+            resourceInputs["examined"] = undefined /*out*/;
+            resourceInputs["executedAt"] = undefined /*out*/;
+            resourceInputs["patchedAuthorizationDecision"] = undefined /*out*/;
+            resourceInputs["patchedDecisionEvidence"] = undefined /*out*/;
+            resourceInputs["patchedDecisionReasonCode"] = undefined /*out*/;
+            resourceInputs["patchedDeepllmEnrichment"] = undefined /*out*/;
+            resourceInputs["patchedEnforcementTraceId"] = undefined /*out*/;
+            resourceInputs["patchedViolationId"] = undefined /*out*/;
+            resourceInputs["rowIdsJson"] = undefined /*out*/;
+            resourceInputs["skippedNoChange"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["updated"] = undefined /*out*/;
+            resourceInputs["wouldUpdate"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(DecisionFieldBackfill.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering DecisionFieldBackfill resources.
+ */
+export interface DecisionFieldBackfillState {
+    /**
+     * Rows eligible for decision-field patching.
+     */
+    candidates?: pulumi.Input<number | undefined>;
+    /**
+     * Preview candidate patches without persisting updates.
+     */
+    dryRun?: pulumi.Input<boolean | undefined>;
+    /**
+     * Rows scanned by the backfill operation.
+     */
+    examined?: pulumi.Input<number | undefined>;
+    /**
+     * Timestamp when backfill execution completed.
+     */
+    executedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Include blocked events in candidate selection.
+     */
+    includeBlockedEvents?: pulumi.Input<boolean | undefined>;
+    /**
+     * Maximum number of candidate rows to evaluate (1-5000).
+     */
+    limit?: pulumi.Input<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" authorizationDecision " pulumi-lang-dotnet=" AuthorizationDecision " pulumi-lang-go=" authorizationDecision " pulumi-lang-python=" authorization_decision " pulumi-lang-yaml=" authorizationDecision " pulumi-lang-java=" authorizationDecision "> authorizationDecision </span>was patched.
+     */
+    patchedAuthorizationDecision?: pulumi.Input<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" decisionEvidence " pulumi-lang-dotnet=" DecisionEvidence " pulumi-lang-go=" decisionEvidence " pulumi-lang-python=" decision_evidence " pulumi-lang-yaml=" decisionEvidence " pulumi-lang-java=" decisionEvidence "> decisionEvidence </span>was patched.
+     */
+    patchedDecisionEvidence?: pulumi.Input<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" decisionReasonCode " pulumi-lang-dotnet=" DecisionReasonCode " pulumi-lang-go=" decisionReasonCode " pulumi-lang-python=" decision_reason_code " pulumi-lang-yaml=" decisionReasonCode " pulumi-lang-java=" decisionReasonCode "> decisionReasonCode </span>was patched.
+     */
+    patchedDecisionReasonCode?: pulumi.Input<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" deepllmEnrichment " pulumi-lang-dotnet=" DeepllmEnrichment " pulumi-lang-go=" deepllmEnrichment " pulumi-lang-python=" deepllm_enrichment " pulumi-lang-yaml=" deepllmEnrichment " pulumi-lang-java=" deepllmEnrichment "> deepllmEnrichment </span>was patched.
+     */
+    patchedDeepllmEnrichment?: pulumi.Input<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" enforcementTraceId " pulumi-lang-dotnet=" EnforcementTraceId " pulumi-lang-go=" enforcementTraceId " pulumi-lang-python=" enforcement_trace_id " pulumi-lang-yaml=" enforcementTraceId " pulumi-lang-java=" enforcementTraceId "> enforcementTraceId </span>was patched.
+     */
+    patchedEnforcementTraceId?: pulumi.Input<number | undefined>;
+    /**
+     * Rows where<span pulumi-lang-nodejs=" violationId " pulumi-lang-dotnet=" ViolationId " pulumi-lang-go=" violationId " pulumi-lang-python=" violation_id " pulumi-lang-yaml=" violationId " pulumi-lang-java=" violationId "> violationId </span>was patched.
+     */
+    patchedViolationId?: pulumi.Input<number | undefined>;
+    /**
+     * Candidate row IDs as a JSON array.
+     */
+    rowIdsJson?: pulumi.Input<string | undefined>;
+    /**
+     * Eligible rows skipped because no field changes were required.
+     */
+    skippedNoChange?: pulumi.Input<number | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Change this value to force a re-run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Rows updated when dry_run=false.
+     */
+    updated?: pulumi.Input<number | undefined>;
+    /**
+     * Trailing lookback window in hours (1-2880).
+     */
+    windowHours?: pulumi.Input<number | undefined>;
+    /**
+     * Rows that would be updated when dry_run=true.
+     */
+    wouldUpdate?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a DecisionFieldBackfill resource.
+ */
+export interface DecisionFieldBackfillArgs {
+    /**
+     * Preview candidate patches without persisting updates.
+     */
+    dryRun?: pulumi.Input<boolean | undefined>;
+    /**
+     * Include blocked events in candidate selection.
+     */
+    includeBlockedEvents?: pulumi.Input<boolean | undefined>;
+    /**
+     * Maximum number of candidate rows to evaluate (1-5000).
+     */
+    limit?: pulumi.Input<number | undefined>;
+    /**
+     * Change this value to force a re-run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Trailing lookback window in hours (1-2880).
+     */
+    windowHours?: pulumi.Input<number | undefined>;
+}

package/governance/evidenceBackfill.ts

@@ -0,0 +1,227 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class EvidenceBackfill extends pulumi.CustomResource {
+    /**
+     * Get an existing EvidenceBackfill resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: EvidenceBackfillState, opts?: pulumi.CustomResourceOptions): EvidenceBackfill {
+        return new EvidenceBackfill(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/evidenceBackfill:EvidenceBackfill';
+
+    /**
+     * Returns true if the given object is an instance of EvidenceBackfill.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is EvidenceBackfill {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === EvidenceBackfill.__pulumiType;
+    }
+
+    /**
+     * Number of events that qualified for backfill.
+     */
+    declare public /*out*/ readonly candidates: pulumi.Output<number>;
+    /**
+     * Number of new evidence records created.
+     */
+    declare public /*out*/ readonly created: pulumi.Output<number>;
+    /**
+     * When true, preview records without persisting evidence.
+     */
+    declare public readonly dryRun: pulumi.Output<boolean | undefined>;
+    /**
+     * Created or candidate evidence IDs as JSON array.
+     */
+    declare public /*out*/ readonly evidenceIdsJson: pulumi.Output<string>;
+    /**
+     * Number of source events examined.
+     */
+    declare public /*out*/ readonly examined: pulumi.Output<number>;
+    /**
+     * Timestamp when backfill was executed.
+     */
+    declare public /*out*/ readonly executedAt: pulumi.Output<string>;
+    /**
+     * Include blocked decisions in addition to explicit violations.
+     */
+    declare public readonly includeBlockedEvents: pulumi.Output<boolean | undefined>;
+    /**
+     * Optional integration ID stamped on created evidence records.
+     */
+    declare public readonly integrationId: pulumi.Output<string | undefined>;
+    /**
+     * Maximum number of candidate events to evaluate (1-1000).
+     */
+    declare public readonly limit: pulumi.Output<number | undefined>;
+    /**
+     * Number of candidates skipped due to existing evidence.
+     */
+    declare public /*out*/ readonly skippedExisting: pulumi.Output<number>;
+    /**
+     * Source collection used by the backfill endpoint.
+     */
+    declare public /*out*/ readonly sourceCollection: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Change this value to force a re-run.
+     */
+    declare public readonly trigger: pulumi.Output<string | undefined>;
+    /**
+     * Number of records that would be created in dry-run mode.
+     */
+    declare public /*out*/ readonly wouldCreate: pulumi.Output<number>;
+
+    /**
+     * Create a EvidenceBackfill resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: EvidenceBackfillArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: EvidenceBackfillArgs | EvidenceBackfillState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as EvidenceBackfillState | undefined;
+            resourceInputs["candidates"] = state?.candidates;
+            resourceInputs["created"] = state?.created;
+            resourceInputs["dryRun"] = state?.dryRun;
+            resourceInputs["evidenceIdsJson"] = state?.evidenceIdsJson;
+            resourceInputs["examined"] = state?.examined;
+            resourceInputs["executedAt"] = state?.executedAt;
+            resourceInputs["includeBlockedEvents"] = state?.includeBlockedEvents;
+            resourceInputs["integrationId"] = state?.integrationId;
+            resourceInputs["limit"] = state?.limit;
+            resourceInputs["skippedExisting"] = state?.skippedExisting;
+            resourceInputs["sourceCollection"] = state?.sourceCollection;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["trigger"] = state?.trigger;
+            resourceInputs["wouldCreate"] = state?.wouldCreate;
+        } else {
+            const args = argsOrState as EvidenceBackfillArgs | undefined;
+            resourceInputs["dryRun"] = args?.dryRun;
+            resourceInputs["includeBlockedEvents"] = args?.includeBlockedEvents;
+            resourceInputs["integrationId"] = args?.integrationId;
+            resourceInputs["limit"] = args?.limit;
+            resourceInputs["trigger"] = args?.trigger;
+            resourceInputs["candidates"] = undefined /*out*/;
+            resourceInputs["created"] = undefined /*out*/;
+            resourceInputs["evidenceIdsJson"] = undefined /*out*/;
+            resourceInputs["examined"] = undefined /*out*/;
+            resourceInputs["executedAt"] = undefined /*out*/;
+            resourceInputs["skippedExisting"] = undefined /*out*/;
+            resourceInputs["sourceCollection"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["wouldCreate"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(EvidenceBackfill.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering EvidenceBackfill resources.
+ */
+export interface EvidenceBackfillState {
+    /**
+     * Number of events that qualified for backfill.
+     */
+    candidates?: pulumi.Input<number | undefined>;
+    /**
+     * Number of new evidence records created.
+     */
+    created?: pulumi.Input<number | undefined>;
+    /**
+     * When true, preview records without persisting evidence.
+     */
+    dryRun?: pulumi.Input<boolean | undefined>;
+    /**
+     * Created or candidate evidence IDs as JSON array.
+     */
+    evidenceIdsJson?: pulumi.Input<string | undefined>;
+    /**
+     * Number of source events examined.
+     */
+    examined?: pulumi.Input<number | undefined>;
+    /**
+     * Timestamp when backfill was executed.
+     */
+    executedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Include blocked decisions in addition to explicit violations.
+     */
+    includeBlockedEvents?: pulumi.Input<boolean | undefined>;
+    /**
+     * Optional integration ID stamped on created evidence records.
+     */
+    integrationId?: pulumi.Input<string | undefined>;
+    /**
+     * Maximum number of candidate events to evaluate (1-1000).
+     */
+    limit?: pulumi.Input<number | undefined>;
+    /**
+     * Number of candidates skipped due to existing evidence.
+     */
+    skippedExisting?: pulumi.Input<number | undefined>;
+    /**
+     * Source collection used by the backfill endpoint.
+     */
+    sourceCollection?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Change this value to force a re-run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+    /**
+     * Number of records that would be created in dry-run mode.
+     */
+    wouldCreate?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a EvidenceBackfill resource.
+ */
+export interface EvidenceBackfillArgs {
+    /**
+     * When true, preview records without persisting evidence.
+     */
+    dryRun?: pulumi.Input<boolean | undefined>;
+    /**
+     * Include blocked decisions in addition to explicit violations.
+     */
+    includeBlockedEvents?: pulumi.Input<boolean | undefined>;
+    /**
+     * Optional integration ID stamped on created evidence records.
+     */
+    integrationId?: pulumi.Input<string | undefined>;
+    /**
+     * Maximum number of candidate events to evaluate (1-1000).
+     */
+    limit?: pulumi.Input<number | undefined>;
+    /**
+     * Change this value to force a re-run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+}

package/governance/getEvidenceSlos.ts

@@ -0,0 +1,64 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export function getEvidenceSlos(args?: GetEvidenceSlosArgs, opts?: pulumi.InvokeOptions): Promise<GetEvidenceSlosResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("thoth:governance/getEvidenceSlos:getEvidenceSlos", {
+        "scanLimit": args.scanLimit,
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceSlos.
+ */
+export interface GetEvidenceSlosArgs {
+    scanLimit?: number;
+    windowHours?: number;
+}
+
+/**
+ * A collection of values returned by getEvidenceSlos.
+ */
+export interface GetEvidenceSlosResult {
+    readonly decisionReasonCodeCoverage: number;
+    readonly decisionToApiVisibilityLatencyP95Seconds: number;
+    readonly deepllmEnrichmentJoinRate: number;
+    readonly evidenceChainVerificationSuccess: number;
+    readonly failuresJson: string;
+    readonly generatedAt: string;
+    /**
+     * The provider-assigned unique ID for this managed resource.
+     */
+    readonly id: string;
+    readonly metricsJson: string;
+    readonly passed: boolean;
+    readonly policyReferenceCoverageNonAllow: number;
+    readonly rowsScanned: number;
+    readonly scanLimit?: number;
+    readonly tenantId: string;
+    readonly thresholdsJson: string;
+    readonly violationIdPresenceRate: number;
+    readonly violationRelevantRows: number;
+    readonly windowHours?: number;
+}
+export function getEvidenceSlosOutput(args?: GetEvidenceSlosOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetEvidenceSlosResult> {
+    args = args || {};
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("thoth:governance/getEvidenceSlos:getEvidenceSlos", {
+        "scanLimit": args.scanLimit,
+        "windowHours": args.windowHours,
+    }, opts);
+}
+
+/**
+ * A collection of arguments for invoking getEvidenceSlos.
+ */
+export interface GetEvidenceSlosOutputArgs {
+    scanLimit?: pulumi.Input<number | undefined>;
+    windowHours?: pulumi.Input<number | undefined>;
+}

package/governance/index.ts

@@ -10,6 +10,21 @@ export type ApprovalDecision = import("./approvalDecision").ApprovalDecision;
 export const ApprovalDecision: typeof import("./approvalDecision").ApprovalDecision = null as any;
 utilities.lazyLoad(exports, ["ApprovalDecision"], () => require("./approvalDecision"));
 
+export { DecisionFieldBackfillArgs, DecisionFieldBackfillState } from "./decisionFieldBackfill";
+export type DecisionFieldBackfill = import("./decisionFieldBackfill").DecisionFieldBackfill;
+export const DecisionFieldBackfill: typeof import("./decisionFieldBackfill").DecisionFieldBackfill = null as any;
+utilities.lazyLoad(exports, ["DecisionFieldBackfill"], () => require("./decisionFieldBackfill"));
+
+export { EvidenceBackfillArgs, EvidenceBackfillState } from "./evidenceBackfill";
+export type EvidenceBackfill = import("./evidenceBackfill").EvidenceBackfill;
+export const EvidenceBackfill: typeof import("./evidenceBackfill").EvidenceBackfill = null as any;
+utilities.lazyLoad(exports, ["EvidenceBackfill"], () => require("./evidenceBackfill"));
+
+export { GetEvidenceSlosArgs, GetEvidenceSlosResult, GetEvidenceSlosOutputArgs } from "./getEvidenceSlos";
+export const getEvidenceSlos: typeof import("./getEvidenceSlos").getEvidenceSlos = null as any;
+export const getEvidenceSlosOutput: typeof import("./getEvidenceSlos").getEvidenceSlosOutput = null as any;
+utilities.lazyLoad(exports, ["getEvidenceSlos","getEvidenceSlosOutput"], () => require("./getEvidenceSlos"));
+
 export { GetFeedArgs, GetFeedResult, GetFeedOutputArgs } from "./getFeed";
 export const getFeed: typeof import("./getFeed").getFeed = null as any;
 export const getFeedOutput: typeof import("./getFeed").getFeedOutput = null as any;
@@ -30,6 +45,11 @@ export type PackAssignment = import("./packAssignment").PackAssignment;
 export const PackAssignment: typeof import("./packAssignment").PackAssignment = null as any;
 utilities.lazyLoad(exports, ["PackAssignment"], () => require("./packAssignment"));
 
+export { PackAssignmentBulkArgs, PackAssignmentBulkState } from "./packAssignmentBulk";
+export type PackAssignmentBulk = import("./packAssignmentBulk").PackAssignmentBulk;
+export const PackAssignmentBulk: typeof import("./packAssignmentBulk").PackAssignmentBulk = null as any;
+utilities.lazyLoad(exports, ["PackAssignmentBulk"], () => require("./packAssignmentBulk"));
+
 export { PolicySyncArgs, PolicySyncState } from "./policySync";
 export type PolicySync = import("./policySync").PolicySync;
 export const PolicySync: typeof import("./policySync").PolicySync = null as any;
@@ -52,8 +72,14 @@ const _module = {
         switch (type) {
             case "thoth:governance/approvalDecision:ApprovalDecision":
                 return new ApprovalDecision(name, <any>undefined, { urn })
+            case "thoth:governance/decisionFieldBackfill:DecisionFieldBackfill":
+                return new DecisionFieldBackfill(name, <any>undefined, { urn })
+            case "thoth:governance/evidenceBackfill:EvidenceBackfill":
+                return new EvidenceBackfill(name, <any>undefined, { urn })
             case "thoth:governance/packAssignment:PackAssignment":
                 return new PackAssignment(name, <any>undefined, { urn })
+            case "thoth:governance/packAssignmentBulk:PackAssignmentBulk":
+                return new PackAssignmentBulk(name, <any>undefined, { urn })
             case "thoth:governance/policySync:PolicySync":
                 return new PolicySync(name, <any>undefined, { urn })
             case "thoth:governance/tenantSettings:TenantSettings":
@@ -66,7 +92,10 @@ const _module = {
     },
 };
 pulumi.runtime.registerResourceModule("thoth", "governance/approvalDecision", _module)
+pulumi.runtime.registerResourceModule("thoth", "governance/decisionFieldBackfill", _module)
+pulumi.runtime.registerResourceModule("thoth", "governance/evidenceBackfill", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/packAssignment", _module)
+pulumi.runtime.registerResourceModule("thoth", "governance/packAssignmentBulk", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/policySync", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/tenantSettings", _module)
 pulumi.runtime.registerResourceModule("thoth", "governance/webhookTest", _module)

package/governance/packAssignmentBulk.ts

@@ -0,0 +1,266 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class PackAssignmentBulk extends pulumi.CustomResource {
+    /**
+     * Get an existing PackAssignmentBulk resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: PackAssignmentBulkState, opts?: pulumi.CustomResourceOptions): PackAssignmentBulk {
+        return new PackAssignmentBulk(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:governance/packAssignmentBulk:PackAssignmentBulk';
+
+    /**
+     * Returns true if the given object is an instance of PackAssignmentBulk.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is PackAssignmentBulk {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === PackAssignmentBulk.__pulumiType;
+    }
+
+    /**
+     * Specific agent IDs to target.
+     */
+    declare public readonly agentIds: pulumi.Output<string[] | undefined>;
+    /**
+     * Apply to all known agents for the tenant.
+     */
+    declare public readonly allAgents: pulumi.Output<boolean | undefined>;
+    /**
+     * Successful apply operations.
+     */
+    declare public /*out*/ readonly appliedCount: pulumi.Output<number>;
+    /**
+     * Approval policy ID for pack application (defaults to 'default').
+     */
+    declare public readonly approvalPolicyId: pulumi.Output<string | undefined>;
+    /**
+     * Endpoint IDs whose agents should receive the selected packs.
+     */
+    declare public readonly endpointIds: pulumi.Output<string[] | undefined>;
+    /**
+     * Environment: dev or prod.
+     */
+    declare public readonly environment: pulumi.Output<string | undefined>;
+    /**
+     * Failed apply operations.
+     */
+    declare public /*out*/ readonly failedCount: pulumi.Output<number>;
+    /**
+     * Fleet IDs whose agents should receive the selected packs.
+     */
+    declare public readonly fleetIds: pulumi.Output<string[] | undefined>;
+    /**
+     * Timestamp of the most recent apply operation.
+     */
+    declare public /*out*/ readonly lastAppliedAt: pulumi.Output<string>;
+    /**
+     * JSON map keyed by<span pulumi-lang-nodejs=" packId " pulumi-lang-dotnet=" PackId " pulumi-lang-go=" packId " pulumi-lang-python=" pack_id " pulumi-lang-yaml=" packId " pulumi-lang-java=" packId "> packId </span>with per-pack overrides.
+     */
+    declare public readonly overridesByPackJson: pulumi.Output<string | undefined>;
+    /**
+     * Pack IDs to apply in one bulk operation.
+     */
+    declare public readonly packIds: pulumi.Output<string[]>;
+    /**
+     * Raw apply results as JSON array.
+     */
+    declare public /*out*/ readonly resultsJson: pulumi.Output<string>;
+    /**
+     * Resolved target agent IDs as JSON array.
+     */
+    declare public /*out*/ readonly targetAgentIdsJson: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * Total attempted apply operations.
+     */
+    declare public /*out*/ readonly totalOps: pulumi.Output<number>;
+    /**
+     * Change this value to force a fresh apply run.
+     */
+    declare public readonly trigger: pulumi.Output<string | undefined>;
+
+    /**
+     * Create a PackAssignmentBulk resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: PackAssignmentBulkArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: PackAssignmentBulkArgs | PackAssignmentBulkState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as PackAssignmentBulkState | undefined;
+            resourceInputs["agentIds"] = state?.agentIds;
+            resourceInputs["allAgents"] = state?.allAgents;
+            resourceInputs["appliedCount"] = state?.appliedCount;
+            resourceInputs["approvalPolicyId"] = state?.approvalPolicyId;
+            resourceInputs["endpointIds"] = state?.endpointIds;
+            resourceInputs["environment"] = state?.environment;
+            resourceInputs["failedCount"] = state?.failedCount;
+            resourceInputs["fleetIds"] = state?.fleetIds;
+            resourceInputs["lastAppliedAt"] = state?.lastAppliedAt;
+            resourceInputs["overridesByPackJson"] = state?.overridesByPackJson;
+            resourceInputs["packIds"] = state?.packIds;
+            resourceInputs["resultsJson"] = state?.resultsJson;
+            resourceInputs["targetAgentIdsJson"] = state?.targetAgentIdsJson;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["totalOps"] = state?.totalOps;
+            resourceInputs["trigger"] = state?.trigger;
+        } else {
+            const args = argsOrState as PackAssignmentBulkArgs | undefined;
+            if (args?.packIds === undefined && !opts.urn) {
+                throw new Error("Missing required property 'packIds'");
+            }
+            resourceInputs["agentIds"] = args?.agentIds;
+            resourceInputs["allAgents"] = args?.allAgents;
+            resourceInputs["approvalPolicyId"] = args?.approvalPolicyId;
+            resourceInputs["endpointIds"] = args?.endpointIds;
+            resourceInputs["environment"] = args?.environment;
+            resourceInputs["fleetIds"] = args?.fleetIds;
+            resourceInputs["overridesByPackJson"] = args?.overridesByPackJson;
+            resourceInputs["packIds"] = args?.packIds;
+            resourceInputs["trigger"] = args?.trigger;
+            resourceInputs["appliedCount"] = undefined /*out*/;
+            resourceInputs["failedCount"] = undefined /*out*/;
+            resourceInputs["lastAppliedAt"] = undefined /*out*/;
+            resourceInputs["resultsJson"] = undefined /*out*/;
+            resourceInputs["targetAgentIdsJson"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+            resourceInputs["totalOps"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        super(PackAssignmentBulk.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering PackAssignmentBulk resources.
+ */
+export interface PackAssignmentBulkState {
+    /**
+     * Specific agent IDs to target.
+     */
+    agentIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Apply to all known agents for the tenant.
+     */
+    allAgents?: pulumi.Input<boolean | undefined>;
+    /**
+     * Successful apply operations.
+     */
+    appliedCount?: pulumi.Input<number | undefined>;
+    /**
+     * Approval policy ID for pack application (defaults to 'default').
+     */
+    approvalPolicyId?: pulumi.Input<string | undefined>;
+    /**
+     * Endpoint IDs whose agents should receive the selected packs.
+     */
+    endpointIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Environment: dev or prod.
+     */
+    environment?: pulumi.Input<string | undefined>;
+    /**
+     * Failed apply operations.
+     */
+    failedCount?: pulumi.Input<number | undefined>;
+    /**
+     * Fleet IDs whose agents should receive the selected packs.
+     */
+    fleetIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Timestamp of the most recent apply operation.
+     */
+    lastAppliedAt?: pulumi.Input<string | undefined>;
+    /**
+     * JSON map keyed by<span pulumi-lang-nodejs=" packId " pulumi-lang-dotnet=" PackId " pulumi-lang-go=" packId " pulumi-lang-python=" pack_id " pulumi-lang-yaml=" packId " pulumi-lang-java=" packId "> packId </span>with per-pack overrides.
+     */
+    overridesByPackJson?: pulumi.Input<string | undefined>;
+    /**
+     * Pack IDs to apply in one bulk operation.
+     */
+    packIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Raw apply results as JSON array.
+     */
+    resultsJson?: pulumi.Input<string | undefined>;
+    /**
+     * Resolved target agent IDs as JSON array.
+     */
+    targetAgentIdsJson?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * Total attempted apply operations.
+     */
+    totalOps?: pulumi.Input<number | undefined>;
+    /**
+     * Change this value to force a fresh apply run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a PackAssignmentBulk resource.
+ */
+export interface PackAssignmentBulkArgs {
+    /**
+     * Specific agent IDs to target.
+     */
+    agentIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Apply to all known agents for the tenant.
+     */
+    allAgents?: pulumi.Input<boolean | undefined>;
+    /**
+     * Approval policy ID for pack application (defaults to 'default').
+     */
+    approvalPolicyId?: pulumi.Input<string | undefined>;
+    /**
+     * Endpoint IDs whose agents should receive the selected packs.
+     */
+    endpointIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Environment: dev or prod.
+     */
+    environment?: pulumi.Input<string | undefined>;
+    /**
+     * Fleet IDs whose agents should receive the selected packs.
+     */
+    fleetIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * JSON map keyed by<span pulumi-lang-nodejs=" packId " pulumi-lang-dotnet=" PackId " pulumi-lang-go=" packId " pulumi-lang-python=" pack_id " pulumi-lang-yaml=" packId " pulumi-lang-java=" packId "> packId </span>with per-pack overrides.
+     */
+    overridesByPackJson?: pulumi.Input<string | undefined>;
+    /**
+     * Pack IDs to apply in one bulk operation.
+     */
+    packIds: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Change this value to force a fresh apply run.
+     */
+    trigger?: pulumi.Input<string | undefined>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atensec/pulumi-thoth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Pulumi provider for Aten Security Thoth AI governance control plane.",
   "keywords": [
     "pulumi",

package/provider.ts

@@ -34,7 +34,7 @@ export class Provider extends pulumi.ProviderResource {
      */
     declare public readonly adminBearerTokenFile: pulumi.Output<string | undefined>;
     /**
-     * Apex domain used to derive GovAPI host when apiBaseUrl is omitted. Defaults to atensecurity.com.
+     * Apex domain used to derive GovAPI host when<span pulumi-lang-nodejs=" apiBaseUrl " pulumi-lang-dotnet=" ApiBaseUrl " pulumi-lang-go=" apiBaseUrl " pulumi-lang-python=" api_base_url " pulumi-lang-yaml=" apiBaseUrl " pulumi-lang-java=" apiBaseUrl "> apiBaseUrl </span>is omitted. Defaults to atensecurity.com.
      */
     declare public readonly apexDomain: pulumi.Output<string | undefined>;
     /**
@@ -100,7 +100,7 @@ export interface ProviderArgs {
      */
     adminBearerTokenFile?: pulumi.Input<string | undefined>;
     /**
-     * Apex domain used to derive GovAPI host when apiBaseUrl is omitted. Defaults to atensecurity.com.
+     * Apex domain used to derive GovAPI host when<span pulumi-lang-nodejs=" apiBaseUrl " pulumi-lang-dotnet=" ApiBaseUrl " pulumi-lang-go=" apiBaseUrl " pulumi-lang-python=" api_base_url " pulumi-lang-yaml=" apiBaseUrl " pulumi-lang-java=" apiBaseUrl "> apiBaseUrl </span>is omitted. Defaults to atensecurity.com.
      */
     apexDomain?: pulumi.Input<string | undefined>;
     /**

package/tsconfig.json

@@ -29,11 +29,15 @@
         "config/index.ts",
         "config/vars.ts",
         "governance/approvalDecision.ts",
+        "governance/decisionFieldBackfill.ts",
+        "governance/evidenceBackfill.ts",
+        "governance/getEvidenceSlos.ts",
         "governance/getFeed.ts",
         "governance/getTenantSettings.ts",
         "governance/getTools.ts",
         "governance/index.ts",
         "governance/packAssignment.ts",
+        "governance/packAssignmentBulk.ts",
         "governance/policySync.ts",
         "governance/tenantSettings.ts",
         "governance/webhookTest.ts",