@emilia-protocol/gate 0.10.0 → 0.13.0

package/dist/reports/underwriter.js

@@ -0,0 +1,348 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — underwriter control attestation (AI-liability loss-run analogue).
+ *
+ * The artifact an AI-liability underwriter prices premium credit against — the
+ * MFA-for-cyber analogue: evidence that a deny-by-default authorization control
+ * was IN FORCE and OPERATING over the policy period, computed from the gate's
+ * tamper-evident evidence log. Pure function: same entries + same options in,
+ * identical JSON out (pin `now` for a byte-stable artifact).
+ *
+ * HONESTY BOUNDARY (carried inside the artifact): this attests CONTROL
+ * OPERATION only. It does not attest the business correctness of any authorized
+ * action, and it is not an insurance document until adopted by the carrier.
+ * Near-miss / remediation narrative belongs to the broker — the builder emits
+ * those fields as null and NEVER fabricates prose.
+ *
+ * Fail closed: a missing insured or an invalid period is an error, not a guess.
+ * Entries that cannot be verified as log records (unparseable time, missing
+ * hash, unknown kind, decision without an allow verdict) are EXCLUDED from every
+ * attested count and surfaced as integrity_warnings — the attestation never
+ * counts what it cannot account for. A zero-activity period is a valid (boring)
+ * attestation, not an error.
+ */
+export const UNDERWRITER_ATTESTATION_VERSION = 'EP-GATE-UNDERWRITER-ATTESTATION-v1';
+// The gate's assurance vocabulary. `software` is the single-approver baseline;
+// the distribution always carries all three so an underwriter can see zeros.
+const KNOWN_TIERS = ['class_a', 'quorum', 'software'];
+function toMs(t) {
+    if (t == null)
+        return null;
+    const ms = typeof t === 'number' ? t : Date.parse(t);
+    return Number.isFinite(ms) ? ms : null;
+}
+/** Deterministic object from a Map: keys sorted, never insertion-ordered. */
+function sortedObject(map) {
+    const out = {};
+    for (const k of [...map.keys()].sort())
+        out[k] = map.get(k);
+    return out;
+}
+function countBy(items, keyFn) {
+    const m = new Map();
+    for (const it of items) {
+        const k = keyFn(it);
+        m.set(k, (m.get(k) || 0) + 1);
+    }
+    return m;
+}
+/** Tier histogram seeded with the known tiers so zeros are explicit. */
+function tierDistribution(values) {
+    const m = new Map(KNOWN_TIERS.map((t) => [t, 0]));
+    for (const v of values) {
+        const k = typeof v === 'string' && v.length ? v : 'unspecified';
+        m.set(k, (m.get(k) || 0) + 1);
+    }
+    return sortedObject(m);
+}
+/** Action family = the namespace segment ('payment.release' -> 'payment'). */
+function actionFamily(action) {
+    if (typeof action !== 'string' || action.length === 0)
+        return 'unknown';
+    const dot = action.indexOf('.');
+    return dot > 0 ? action.slice(0, dot) : action;
+}
+/**
+ * Build the underwriter attestation over a slice of the evidence log.
+ * @param {Array<object>} entries  evidence.all() (or a durable export of it)
+ * @param {object} [o]
+ * @param {string} [o.insured]           named insured (required)
+ * @param {string|null} [o.policyRef]  carrier policy/submission reference (null until bound)
+ * @param {string|number} [o.periodStart]  inclusive period start (ISO or epoch ms)
+ * @param {string|number} [o.periodEnd]    inclusive period end (ISO or epoch ms)
+ * @param {number|Function} [o.now]    clock for generated_at (pin for determinism)
+ * @returns {object} EP-GATE-UNDERWRITER-ATTESTATION-v1 document
+ */
+export function buildUnderwriterAttestation(entries = [], { insured, policyRef = null, periodStart, periodEnd, now = Date.now, } = {}) {
+    if (!insured || typeof insured !== 'string') {
+        throw new Error('underwriter attestation: insured (named insured) is required');
+    }
+    const startMs = toMs(periodStart);
+    const endMs = toMs(periodEnd);
+    if (startMs == null || endMs == null) {
+        throw new Error('underwriter attestation: periodStart and periodEnd must be valid ISO strings or epoch ms');
+    }
+    if (startMs > endMs) {
+        throw new Error('underwriter attestation: periodStart must not be after periodEnd');
+    }
+    if (!Array.isArray(entries)) {
+        throw new Error('underwriter attestation: entries must be an array (evidence.all())');
+    }
+    // Scope + integrity pass. Out-of-window records are simply out of scope;
+    // records we cannot verify as log entries are warned AND excluded — never
+    // attested over. Exclusion is the conservative direction for premium credit.
+    const warnings = [];
+    const inScope = [];
+    entries.forEach((e, index) => {
+        const ref = { index, seq: e && typeof e === 'object' && Number.isInteger(e.seq) ? e.seq : null };
+        if (!e || typeof e !== 'object') {
+            warnings.push({ ...ref, reason: 'not_an_object' });
+            return;
+        }
+        const t = toMs(e.at);
+        if (t == null) {
+            warnings.push({ ...ref, reason: 'unparseable_at' });
+            return;
+        }
+        if (t < startMs || t > endMs)
+            return;
+        if (typeof e.hash !== 'string' || e.hash.length === 0) {
+            warnings.push({ ...ref, reason: 'missing_hash' });
+            return;
+        }
+        if (e.kind !== 'decision' && e.kind !== 'execution') {
+            warnings.push({ ...ref, reason: 'unknown_kind' });
+            return;
+        }
+        if (e.kind === 'decision' && typeof e.allow !== 'boolean') {
+            warnings.push({ ...ref, reason: 'decision_missing_allow' });
+            return;
+        }
+        inScope.push({ entry: e, t });
+    });
+    const decisions = inScope.filter((x) => x.entry.kind === 'decision');
+    const executions = inScope.filter((x) => x.entry.kind === 'execution').map((x) => x.entry);
+    // 'not_guarded' pass-throughs ran WITHOUT the control — they are the
+    // uncontrolled surface, reported separately from protected-action volume.
+    const uncontrolled = decisions.filter((x) => x.entry.reason === 'not_guarded').map((x) => x.entry);
+    const guarded = decisions.filter((x) => x.entry.reason !== 'not_guarded');
+    const guardedAllows = guarded.filter((x) => x.entry.allow === true).map((x) => x.entry);
+    const denies = guarded.filter((x) => x.entry.allow === false).map((x) => x.entry);
+    const families = new Map();
+    for (const { entry: d } of guarded) {
+        const fam = actionFamily(d.action);
+        const f = families.get(fam) || { decisions: 0, allowed: 0, denied: 0 };
+        f.decisions += 1;
+        if (d.allow)
+            f.allowed += 1;
+        else
+            f.denied += 1;
+        families.set(fam, f);
+    }
+    const reasons = sortedObject(countBy(denies, (d) => String(d.reason ?? 'unspecified')));
+    const replayBlocked = denies.filter((d) => d.reason === 'replay_refused').length;
+    // Hard actions = quorum required by the manifest, per the recorded decision.
+    const hard = guarded.filter((x) => x.entry.required_tier === 'quorum');
+    const hardAllowed = hard.filter((x) => x.entry.allow === true).length;
+    // Replay defense bypassed = the gate authorized with consumptionMode 'none'
+    // (one-time consumption explicitly skipped). An underwriter must see this.
+    const replayBypassed = guardedAllows.filter((a) => a.consumption_mode === 'none').length;
+    let firstAt = null;
+    let lastAt = null;
+    for (const { entry: d, t } of decisions) {
+        if (firstAt === null || t < firstAt.t)
+            firstAt = { t, at: d.at };
+        if (lastAt === null || t > lastAt.t)
+            lastAt = { t, at: d.at };
+    }
+    const nowMs = typeof now === 'function' ? now() : now;
+    return {
+        '@version': UNDERWRITER_ATTESTATION_VERSION,
+        product: 'EMILIA Gate',
+        generated_at: new Date(nowMs).toISOString(),
+        insured,
+        policy_ref: policyRef ?? null,
+        period: { start: new Date(startMs).toISOString(), end: new Date(endMs).toISOString() },
+        honesty: {
+            attests: 'Operation of a deny-by-default authorization control (EMILIA Gate) over the stated period, computed from the gate\'s tamper-evident evidence log.',
+            does_not_attest: [
+                'The business correctness or wisdom of any authorized action.',
+                'Identity proofing, authority enrollment, or issuer/approver key custody, which remain external trust roots.',
+                'Any period, system, or enforcement point outside the supplied evidence log.',
+            ],
+            status: 'Not an insurance document. This attestation carries no coverage effect until adopted by the carrier.',
+        },
+        control_in_force: {
+            control: 'EMILIA Gate — Consequence Firewall',
+            mode: 'deny_by_default',
+            statement: 'Guarded actions execute only with a valid, in-scope, sufficiently-assured, fresh, one-time authorization receipt; absent or insufficient proof is refused, and every decision is appended to a hash-chained evidence log.',
+            guarded_decisions: guarded.length,
+            first_decision_at: firstAt?.at ?? null,
+            last_decision_at: lastAt?.at ?? null,
+        },
+        volume: {
+            guarded_decisions: guarded.length,
+            allowed: guardedAllows.length,
+            denied: denies.length,
+            by_action_family: sortedObject(families),
+        },
+        denials: {
+            total: denies.length,
+            // 0/0 is 'no guarded activity', not a 0% denial rate — represent as null.
+            rate: guarded.length === 0 ? null : denies.length / guarded.length,
+            reasons,
+        },
+        replay: { attempts_blocked: replayBlocked },
+        assurance: {
+            required_tier_distribution: tierDistribution(guarded.map((x) => x.entry.required_tier)),
+            credited_tier_distribution_on_allow: tierDistribution(guardedAllows.map((a) => a.have_tier)),
+        },
+        quorum_usage: {
+            hard_action_decisions: hard.length,
+            allowed: hardAllowed,
+            denied: hard.length - hardAllowed,
+        },
+        exceptions: {
+            uncontrolled_passthroughs: uncontrolled.length,
+            uncontrolled_actions: [...new Set(uncontrolled.map((d) => (typeof d.action === 'string' && d.action) || 'unknown'))].sort(),
+            replay_defense_bypassed: replayBypassed,
+        },
+        executions: {
+            recorded: executions.length,
+            executed: executions.filter((x) => x.outcome === 'executed').length,
+            failed: executions.filter((x) => x.outcome === 'failed').length,
+        },
+        // Broker fields. NEVER machine-generated — the builder only ever emits null.
+        narrative: { near_misses: null, remediation: null, completed_by: 'broker' },
+        evidence: {
+            log_entries_supplied: entries.length,
+            in_scope: inScope.length,
+            first_hash: inScope[0]?.entry.hash ?? null,
+            last_hash: inScope[inScope.length - 1]?.entry.hash ?? null,
+            integrity_warnings: warnings,
+        },
+    };
+}
+/* ------------------------------- markdown ------------------------------- */
+/**
+ * Table cells must not break the table; the source strings are log-derived.
+ * Backslash is escaped FIRST: escaping only the pipe turns a log-derived
+ * `a\|b` into `a\\|b`, where the `\\` renders as a literal backslash and
+ * leaves the pipe live as a cell delimiter, letting an action or refusal
+ * reason split its cell and shift every column after it.
+ */
+function cell(v) {
+    return String(v ?? '—')
+        .replace(/\\/g, '\\\\')
+        .replace(/\|/g, '\\|')
+        .replace(/\r?\n/g, ' ');
+}
+function pct(rate) {
+    return rate == null ? 'n/a' : `${(rate * 100).toFixed(2)}%`;
+}
+function countTable(header, obj) {
+    const keys = Object.keys(obj);
+    if (keys.length === 0)
+        return ['_None in period._'];
+    return [
+        `| ${header} | Count |`,
+        '|---|---:|',
+        ...keys.map((k) => `| ${cell(k)} | ${obj[k]} |`),
+    ];
+}
+const BROKER_PLACEHOLDER = '_(left to the broker — not machine-generated)_';
+/**
+ * Render the attestation for a submission packet. Refuses any document that is
+ * not an EP-GATE-UNDERWRITER-ATTESTATION-v1 — never renders what it cannot
+ * vouch the shape of. Narrative fields render exactly as present in the pack
+ * (the broker fills them into the JSON); null renders as a placeholder.
+ */
+export function renderMarkdown(pack) {
+    if (!pack || typeof pack !== 'object' || pack['@version'] !== UNDERWRITER_ATTESTATION_VERSION) {
+        throw new Error(`renderMarkdown requires an ${UNDERWRITER_ATTESTATION_VERSION} document`);
+    }
+    const fams = pack.volume.by_action_family;
+    const famKeys = Object.keys(fams);
+    const req = pack.assurance.required_tier_distribution;
+    const cred = pack.assurance.credited_tier_distribution_on_allow;
+    const tierKeys = [...new Set([...Object.keys(req), ...Object.keys(cred)])].sort();
+    const warnings = pack.evidence.integrity_warnings;
+    const lines = [
+        '# Underwriter Control Attestation — EMILIA Gate',
+        '',
+        `\`${UNDERWRITER_ATTESTATION_VERSION}\` · generated ${pack.generated_at}`,
+        '',
+        `**Insured:** ${cell(pack.insured)} · **Policy:** ${cell(pack.policy_ref)} · **Period:** ${pack.period.start} → ${pack.period.end}`,
+        '',
+        `> **Attests:** ${pack.honesty.attests}`,
+        `> **Does not attest:** ${pack.honesty.does_not_attest.join(' ')}`,
+        `> **Status:** ${pack.honesty.status}`,
+        '',
+        '## Control in force',
+        '',
+        `- Control: ${pack.control_in_force.control} (${pack.control_in_force.mode})`,
+        `- ${pack.control_in_force.statement}`,
+        `- Guarded decisions in period: ${pack.control_in_force.guarded_decisions}`
+            + (pack.control_in_force.first_decision_at
+                ? ` (first ${pack.control_in_force.first_decision_at}, last ${pack.control_in_force.last_decision_at})`
+                : ''),
+        '',
+        '## Protected-action volume',
+        '',
+        ...(famKeys.length === 0
+            ? ['_No guarded decisions in the period._']
+            : [
+                '| Action family | Decisions | Allowed | Denied |',
+                '|---|---:|---:|---:|',
+                ...famKeys.map((k) => `| ${cell(k)} | ${fams[k].decisions} | ${fams[k].allowed} | ${fams[k].denied} |`),
+            ]),
+        '',
+        '## Denials',
+        '',
+        `- Denials: ${pack.denials.total} of ${pack.volume.guarded_decisions} guarded decisions (${pct(pack.denials.rate)})`,
+        '',
+        ...countTable('Denial reason', pack.denials.reasons),
+        '',
+        '## Replay defense',
+        '',
+        `- Replay attempts blocked: ${pack.replay.attempts_blocked}`,
+        '',
+        '## Assurance tiers',
+        '',
+        '| Tier | Required (guarded) | Credited (allowed) |',
+        '|---|---:|---:|',
+        ...tierKeys.map((t) => `| ${cell(t)} | ${req[t] ?? 0} | ${cred[t] ?? 0} |`),
+        '',
+        '## Quorum usage on hard actions',
+        '',
+        `- Decisions requiring quorum: ${pack.quorum_usage.hard_action_decisions} (allowed ${pack.quorum_usage.allowed}, denied ${pack.quorum_usage.denied})`,
+        '',
+        '## Exceptions / uncontrolled actions',
+        '',
+        `- Uncontrolled pass-throughs (not guarded by manifest): ${pack.exceptions.uncontrolled_passthroughs}`,
+        `- Uncontrolled actions: ${pack.exceptions.uncontrolled_actions.length ? pack.exceptions.uncontrolled_actions.map(cell).join(', ') : '—'}`,
+        `- Replay defense bypassed (consumption mode "none"): ${pack.exceptions.replay_defense_bypassed}`,
+        '',
+        '## Executions',
+        '',
+        `- Recorded: ${pack.executions.recorded} (executed ${pack.executions.executed}, failed ${pack.executions.failed})`,
+        '',
+        '## Near-miss narrative (broker)',
+        '',
+        `- Near misses: ${pack.narrative.near_misses == null ? BROKER_PLACEHOLDER : cell(pack.narrative.near_misses)}`,
+        `- Remediation: ${pack.narrative.remediation == null ? BROKER_PLACEHOLDER : cell(pack.narrative.remediation)}`,
+        '',
+        '## Evidence basis',
+        '',
+        `- Log entries supplied: ${pack.evidence.log_entries_supplied} · in scope: ${pack.evidence.in_scope}`,
+        `- First hash: ${cell(pack.evidence.first_hash)} · Last hash: ${cell(pack.evidence.last_hash)}`,
+        `- Integrity warnings: ${warnings.length}`,
+        ...(warnings.length
+            ? warnings.map((w) => `  - index ${w.index}${w.seq != null ? ` (seq ${w.seq})` : ''}: ${cell(w.reason)}`)
+            : []),
+        '',
+    ];
+    return lines.join('\n');
+}
+export default { UNDERWRITER_ATTESTATION_VERSION, buildUnderwriterAttestation, renderMarkdown };
+//# sourceMappingURL=underwriter.js.map

package/dist/reports/underwriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"underwriter.js","sourceRoot":"","sources":["../../src/reports/underwriter.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AAEpF,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAEtD,SAAS,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAI,GAAmB;IAC1C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAM,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,KAAK,EAAE,KAAK;IAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,MAAM;IAC9B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,MAAM;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAiB,EAAE,EAAE,EAC/D,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,MAO/D,EAAE;IACJ,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAA4D,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjG,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAChG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/E,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK;YAAE,OAAO;QACrC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACrH,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnH,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnI,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE3F,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,KAAK;YAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;;YAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,MAAM,CAAC;IAEjF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAEtE,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEzF,IAAI,OAAO,GAAkC,IAAI,CAAC;IAClD,IAAI,MAAM,GAAkC,IAAI,CAAC;IACjD,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YAAE,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE,+BAA+B;QAC3C,OAAO,EAAE,aAAa;QACtB,YAAY,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QAC3C,OAAO;QACP,UAAU,EAAE,SAAS,IAAI,IAAI;QAC7B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;QACtF,OAAO,EAAE;YACP,OAAO,EAAE,mJAAmJ;YAC5J,eAAe,EAAE;gBACf,8DAA8D;gBAC9D,6GAA6G;gBAC7G,6EAA6E;aAC9E;YACD,MAAM,EAAE,sGAAsG;SAC/G;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,2NAA2N;YACtO,iBAAiB,EAAE,OAAO,CAAC,MAAM;YACjC,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI;YACtC,gBAAgB,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI;SACrC;QACD,MAAM,EAAE;YACN,iBAAiB,EAAE,OAAO,CAAC,MAAM;YACjC,OAAO,EAAE,aAAa,CAAC,MAAM;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC;SACzC;QACD,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,0EAA0E;YAC1E,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;YAClE,OAAO;SACR;QACD,MAAM,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,0BAA0B,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACvF,mCAAmC,EAAE,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;SAC7F;QACD,YAAY,EAAE;YACZ,qBAAqB,EAAE,IAAI,CAAC,MAAM;YAClC,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,WAAW;SAClC;QACD,UAAU,EAAE;YACV,yBAAyB,EAAE,YAAY,CAAC,MAAM;YAC9C,oBAAoB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAC3H,uBAAuB,EAAE,cAAc;SACxC;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,UAAU,CAAC,MAAM;YAC3B,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,MAAM;YACnE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM;SAChE;QACD,6EAA6E;QAC7E,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC3E,QAAQ,EAAE;YACR,oBAAoB,EAAE,OAAO,CAAC,MAAM;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YAC1C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YAC1D,kBAAkB,EAAE,QAAQ;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,CAAC;IACb,OAAO,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,GAAG,CAAC,IAAI;IACf,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAM,EAAE,GAAG;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,MAAM,YAAY;QACvB,YAAY;QACZ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,gDAAgD,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAI;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,+BAA+B,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,8BAA8B,+BAA+B,WAAW,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,mCAAmC,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAElD,MAAM,KAAK,GAAG;QACZ,iDAAiD;QACjD,EAAE;QACF,KAAK,+BAA+B,kBAAkB,IAAI,CAAC,YAAY,EAAE;QACzE,EAAE;QACF,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;QACnI,EAAE;QACF,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;QACxC,0BAA0B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAClE,iBAAiB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;QACtC,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,cAAc,IAAI,CAAC,gBAAgB,CAAC,OAAO,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG;QAC7E,KAAK,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE;QACtC,kCAAkC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE;cACvE,CAAC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB;gBACxC,CAAC,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,UAAU,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,GAAG;gBACvG,CAAC,CAAC,EAAE,CAAC;QACT,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC3C,CAAC,CAAC;gBACA,kDAAkD;gBAClD,sBAAsB;gBACtB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC;aACxG,CAAC;QACJ,EAAE;QACF,YAAY;QACZ,EAAE;QACF,cAAc,IAAI,CAAC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,uBAAuB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;QACpH,EAAE;QACF,GAAG,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACpD,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,8BAA8B,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;QAC5D,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,oDAAoD;QACpD,iBAAiB;QACjB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3E,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,iCAAiC,IAAI,CAAC,YAAY,CAAC,qBAAqB,aAAa,IAAI,CAAC,YAAY,CAAC,OAAO,YAAY,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG;QACrJ,EAAE;QACF,sCAAsC;QACtC,EAAE;QACF,2DAA2D,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE;QACtG,2BAA2B,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QAC1I,wDAAwD,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE;QACjG,EAAE;QACF,eAAe;QACf,EAAE;QACF,eAAe,IAAI,CAAC,UAAU,CAAC,QAAQ,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,YAAY,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG;QAClH,EAAE;QACF,iCAAiC;QACjC,EAAE;QACF,kBAAkB,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;QAC9G,kBAAkB,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;QAC9G,EAAE;QACF,mBAAmB;QACnB,EAAE;QACF,2BAA2B,IAAI,CAAC,QAAQ,CAAC,oBAAoB,gBAAgB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;QACrG,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAC/F,yBAAyB,QAAQ,CAAC,MAAM,EAAE;QAC1C,GAAG,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACzG,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,eAAe,EAAE,+BAA+B,EAAE,2BAA2B,EAAE,cAAc,EAAE,CAAC"}

package/dist/retention.d.ts

@@ -0,0 +1,88 @@
+/**
+ * EMILIA Gate — evidence retention policy (production audit custody).
+ *
+ * The evidence log is the compliance/insurance artifact. Production custody adds
+ * a retention POLICY over it: classify each decision/execution record as HOT
+ * (recent, fast access), COLD (older, archival), or EXPIRED (past the retention
+ * horizon, eligible for deletion) — and honor a LEGAL HOLD that pins records so
+ * they are never expired. `EP_AUDIT_HOT_DAYS` / `EP_AUDIT_COLD_DAYS` set the
+ * horizons; legal hold is a set of evidence hashes.
+ *
+ * Pure functions over the evidence entries (each has `.at` ISO and `.hash`); the
+ * gate never deletes anything itself — it tells the operator what is eligible.
+ */
+type EvidenceEntry = {
+    at: string;
+    hash?: string;
+    kind?: string;
+};
+type TaggedEntry = {
+    hash: string | null;
+    at: string | null;
+    kind: string | null;
+};
+type RetentionOptions = {
+    hotDays?: number;
+    coldDays?: number;
+    now?: number;
+    legalHold?: Set<string> | string[];
+};
+/**
+ * Classify evidence entries into retention buckets.
+ * @param {Array<{at:string, hash?:string, kind?:string}>} entries  evidence.all()
+ * @param {object} o
+ * @param {number} [o.hotDays=365]
+ * @param {number} [o.coldDays=2190]   (6y)
+ * @param {number} [o.now=Date.now()]
+ * @param {Set<string>|string[]} [o.legalHold]  hashes pinned indefinitely
+ * @returns {{hot:object[], cold:object[], expired:object[], legal_hold:object[], unknown:object[], summary:object}}
+ */
+export declare function classifyRetention(entries?: EvidenceEntry[], { hotDays, coldDays, now, legalHold, }?: RetentionOptions): {
+    summary: {
+        total: number;
+        hot: number;
+        cold: number;
+        expired: number;
+        legal_hold: number;
+        unknown: number;
+        hot_days: number;
+        cold_days: number;
+    };
+    hot: TaggedEntry[];
+    cold: TaggedEntry[];
+    expired: TaggedEntry[];
+    legal_hold: TaggedEntry[];
+    unknown: TaggedEntry[];
+};
+/**
+ * Build an export manifest (the artifact handed to an auditor / SIEM). Includes
+ * the evidence head so the export is verifiably tied to a chain state.
+ */
+export declare function buildRetentionExport(entries?: EvidenceEntry[], opts?: RetentionOptions): {
+    '@version': string;
+    generated_at: string;
+    hot_days: number;
+    cold_days: number;
+    evidence_head: string | null;
+    counts: {
+        total: number;
+        hot: number;
+        cold: number;
+        expired: number;
+        legal_hold: number;
+        unknown: number;
+    };
+    entries: {
+        hash: string | null;
+        at: string;
+        kind: string | null;
+    }[];
+};
+export declare const RETENTION_EXPORT_VERSION = "EP-GATE-RETENTION-EXPORT-v1";
+declare const _default: {
+    classifyRetention: typeof classifyRetention;
+    buildRetentionExport: typeof buildRetentionExport;
+    RETENTION_EXPORT_VERSION: string;
+};
+export default _default;
+//# sourceMappingURL=retention.d.ts.map

package/dist/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;GAYG;AAIH,KAAK,aAAa,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAClE,KAAK,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AACnF,KAAK,gBAAgB,GAAG;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;CACpC,CAAC;AAQF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,aAAa,EAAO,EAAE,EAC/D,OAAa,EAAE,QAAe,EAAE,GAAgB,EAAE,SAAS,GAC5D,GAAE,gBAAqB;;;;;;;;;;;SAGf,WAAW,EAAE;UACZ,WAAW,EAAE;aACV,WAAW,EAAE;gBACV,WAAW,EAAE;aAChB,WAAW,EAAE;EAwBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,aAAa,EAAO,EAAE,IAAI,GAAE,gBAAqB;;;;;;;;;;;;;;;;;;;EAe9F;AAED,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;;;;;;AACtE,wBAAqF"}

package/dist/retention.js

@@ -0,0 +1,90 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — evidence retention policy (production audit custody).
+ *
+ * The evidence log is the compliance/insurance artifact. Production custody adds
+ * a retention POLICY over it: classify each decision/execution record as HOT
+ * (recent, fast access), COLD (older, archival), or EXPIRED (past the retention
+ * horizon, eligible for deletion) — and honor a LEGAL HOLD that pins records so
+ * they are never expired. `EP_AUDIT_HOT_DAYS` / `EP_AUDIT_COLD_DAYS` set the
+ * horizons; legal hold is a set of evidence hashes.
+ *
+ * Pure functions over the evidence entries (each has `.at` ISO and `.hash`); the
+ * gate never deletes anything itself — it tells the operator what is eligible.
+ */
+const DAY_MS = 24 * 60 * 60 * 1000;
+function ageDays(atISO, nowMs) {
+    const t = Date.parse(atISO);
+    if (!Number.isFinite(t))
+        return null;
+    return (nowMs - t) / DAY_MS;
+}
+/**
+ * Classify evidence entries into retention buckets.
+ * @param {Array<{at:string, hash?:string, kind?:string}>} entries  evidence.all()
+ * @param {object} o
+ * @param {number} [o.hotDays=365]
+ * @param {number} [o.coldDays=2190]   (6y)
+ * @param {number} [o.now=Date.now()]
+ * @param {Set<string>|string[]} [o.legalHold]  hashes pinned indefinitely
+ * @returns {{hot:object[], cold:object[], expired:object[], legal_hold:object[], unknown:object[], summary:object}}
+ */
+export function classifyRetention(entries = [], { hotDays = 365, coldDays = 2190, now = Date.now(), legalHold, } = {}) {
+    const held = legalHold instanceof Set ? legalHold : new Set(legalHold || []);
+    const buckets = { hot: [], cold: [], expired: [], legal_hold: [], unknown: [] };
+    for (const e of entries) {
+        const tagged = { hash: e.hash ?? null, at: e.at ?? null, kind: e.kind ?? null };
+        if (e.hash && held.has(e.hash)) {
+            buckets.legal_hold.push(tagged);
+            continue;
+        }
+        const age = ageDays(e.at, now);
+        if (age == null) {
+            buckets.unknown.push(tagged);
+            continue;
+        }
+        if (age <= hotDays)
+            buckets.hot.push(tagged);
+        else if (age <= coldDays)
+            buckets.cold.push(tagged);
+        else
+            buckets.expired.push(tagged);
+    }
+    return {
+        ...buckets,
+        summary: {
+            total: entries.length,
+            hot: buckets.hot.length,
+            cold: buckets.cold.length,
+            expired: buckets.expired.length,
+            legal_hold: buckets.legal_hold.length,
+            unknown: buckets.unknown.length,
+            hot_days: hotDays,
+            cold_days: coldDays,
+        },
+    };
+}
+/**
+ * Build an export manifest (the artifact handed to an auditor / SIEM). Includes
+ * the evidence head so the export is verifiably tied to a chain state.
+ */
+export function buildRetentionExport(entries = [], opts = {}) {
+    const cls = classifyRetention(entries, opts);
+    const last = entries[entries.length - 1] || null;
+    return {
+        '@version': 'EP-GATE-RETENTION-EXPORT-v1',
+        generated_at: new Date(opts.now || Date.now()).toISOString(),
+        hot_days: cls.summary.hot_days,
+        cold_days: cls.summary.cold_days,
+        evidence_head: last?.hash ?? null,
+        counts: {
+            total: cls.summary.total, hot: cls.summary.hot, cold: cls.summary.cold,
+            expired: cls.summary.expired, legal_hold: cls.summary.legal_hold, unknown: cls.summary.unknown,
+        },
+        entries: entries.map((e) => ({ hash: e.hash ?? null, at: e.at ?? null, kind: e.kind ?? null })),
+    };
+}
+export const RETENTION_EXPORT_VERSION = 'EP-GATE-RETENTION-EXPORT-v1';
+export default { classifyRetention, buildRetentionExport, RETENTION_EXPORT_VERSION };
+//# sourceMappingURL=retention.js.map

package/dist/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWnC,SAAS,OAAO,CAAC,KAAK,EAAE,KAAK;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA2B,EAAE,EAAE,EAC/D,OAAO,GAAG,GAAG,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,MACvC,EAAE;IACtB,MAAM,IAAI,GAAG,SAAS,YAAY,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAMT,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IAAI,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;aACxC,IAAI,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE;YACP,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YACvB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;YAC/B,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;YAC/B,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,QAAQ;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA2B,EAAE,EAAE,OAAyB,EAAE;IAC7F,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IACjD,OAAO;QACL,UAAU,EAAE,6BAA6B;QACzC,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;QAC5D,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;QAC9B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;QAChC,aAAa,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QACjC,MAAM,EAAE;YACN,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;SAC/F;QACD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AACtE,eAAe,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,CAAC"}