@kindgi/compliance 0.0.0-stage → 0.1.0

package/dist/resolve-emit.d.ts

@@ -0,0 +1,75 @@
+import type { AuditEventBinding } from '@kindgi/audit-events';
+import type { Scope } from '@kindgi/platform';
+import type { EnvName, ProjectId, TenantId } from '@kindgi/types';
+/**
+ * Uniform caller-of-resolution shape. Structurally identical to
+ * `@kindgi/api.ResolveContext` (kept as a duplicate declaration here
+ * to avoid a compliance → api dep cycle — TS structural typing
+ * makes them assignable across the boundary).
+ */
+export interface ResolveContext {
+    readonly runId?: string;
+    readonly deploymentId?: string;
+    readonly nodeId?: string;
+    readonly caller: 'dispatch' | 'deploy-sync' | 'admin-cli' | 'boot-bridge';
+}
+/** Input to `emitResolveEvent`. */
+export interface EmitResolveEventInput {
+    readonly kind: 'env' | 'secret';
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly outcome: 'succeeded' | 'failed';
+    readonly resolveContext: ResolveContext;
+    readonly version?: number;
+    readonly errorCode?: string;
+    readonly auditEvents: AuditEventBinding;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+}
+/**
+ * Emit an `env-resolved` or `secret-resolved` audit event.
+ *
+ * The helper NEVER accepts nor emits the resolved value — the resolve
+ * outcome carries the plaintext to the caller; the audit event carries
+ * only the fact-of-resolution + version + scope + caller attribution.
+ *
+ * Fire-and-forget: any error is logged but swallowed. The resolve path
+ * must not fail because the audit sink is unreachable.
+ */
+export declare function emitResolveEvent(input: EmitResolveEventInput): Promise<void>;
+/**
+ * Input to `emitLifecycleEvent`. Used for env `set` / `delete` and
+ * secret `set` / `rotate` / `revoke` — the non-resolve write ops that
+ * still need audit-trail attribution.
+ */
+export interface EmitLifecycleEventInput {
+    readonly evidenceKind: string;
+    readonly bindingKind: 'env' | 'secret';
+    readonly scope: Scope;
+    readonly envName: EnvName;
+    readonly name: string;
+    readonly outcome: 'succeeded' | 'failed';
+    /**
+     * Caller-of-op attribution. Same shape as the resolve path — env
+     * `set` from an admin CLI produces `actor = 'admin'`; a
+     * deployment-sync `set` produces `actor = 'system:<deploymentId>'`.
+     */
+    readonly resolveContext?: ResolveContext;
+    readonly version?: number;
+    readonly previousVersion?: number;
+    readonly errorCode?: string;
+    readonly hard?: boolean;
+    readonly reason?: string;
+    readonly auditEvents: AuditEventBinding;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+}
+/**
+ * Emit a non-resolve lifecycle event (`env-set` / `env-deleted` /
+ * `secret-set` / `secret-rotated` / `secret-rotation-started` /
+ * `secret-rotation-failed` / `secret-revoked` / `secret-hard-revoked`).
+ * Same fire-and-forget contract as `emitResolveEvent`.
+ */
+export declare function emitLifecycleEvent(input: EmitLifecycleEventInput): Promise<void>;
+//# sourceMappingURL=resolve-emit.d.ts.map

package/dist/resolve-emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;CAC3E;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CActF"}

package/dist/resolve-emit.js

@@ -0,0 +1,181 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Shared helpers for emitting `env-*` and `secret-*` audit events.
+ * `EnvBinding` and `SecretBinding` implementations call
+ * `emitResolveEvent` from their `resolve` paths and `emitLifecycleEvent`
+ * for `set` / `delete` / `rotate` / `revoke`.
+ *
+ * Writes land on the single `AuditEventBinding`. Classification
+ * (retention / signing / export) is a lens on top, not baked into the
+ * write path.
+ *
+ * Design guardrails:
+ *   - Framework NEVER copies a secret plaintext `value` into a payload.
+ *     Payloads carry only metadata (name, version, scope,
+ *     caller, errorCode).
+ *   - Emission is fire-and-forget: failures inside the binding are
+ *     logged (via `console.warn`) but never poison the caller's op.
+ *   - The `resolveContext.caller` discriminant maps to a distinct
+ *     `actor` string.
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Emit an `env-resolved` or `secret-resolved` audit event.
+ *
+ * The helper NEVER accepts nor emits the resolved value — the resolve
+ * outcome carries the plaintext to the caller; the audit event carries
+ * only the fact-of-resolution + version + scope + caller attribution.
+ *
+ * Fire-and-forget: any error is logged but swallowed. The resolve path
+ * must not fail because the audit sink is unreachable.
+ */
+export async function emitResolveEvent(input) {
+    const kind = input.kind === 'env' ? 'env-resolved' : 'secret-resolved';
+    const payload = buildResolvePayload(input);
+    const actor = actorFromResolveContext(input.resolveContext);
+    const event = buildEvent({
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        kind,
+        outcome: input.outcome,
+        actor,
+        runId: input.resolveContext.runId,
+        payload,
+    });
+    await safeEmit(input.auditEvents, event);
+}
+/**
+ * Emit a non-resolve lifecycle event (`env-set` / `env-deleted` /
+ * `secret-set` / `secret-rotated` / `secret-rotation-started` /
+ * `secret-rotation-failed` / `secret-revoked` / `secret-hard-revoked`).
+ * Same fire-and-forget contract as `emitResolveEvent`.
+ */
+export async function emitLifecycleEvent(input) {
+    const payload = buildLifecyclePayload(input);
+    const actor = input.resolveContext !== undefined ? actorFromResolveContext(input.resolveContext) : undefined;
+    const event = buildEvent({
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        kind: input.evidenceKind,
+        outcome: input.outcome,
+        actor,
+        runId: input.resolveContext?.runId,
+        payload,
+    });
+    await safeEmit(input.auditEvents, event);
+}
+function buildEvent(input) {
+    return {
+        id: randomUUID(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        kind: input.kind,
+        timestamp: new Date().toISOString(),
+        actor: input.actor ?? 'user:system',
+        outcome: input.outcome,
+        ...(input.runId !== undefined && { runId: input.runId }),
+        payload: { v: 1, doc: input.payload },
+    };
+}
+async function safeEmit(binding, event) {
+    try {
+        const result = await binding.append([event]);
+        if (result.kind === 'err') {
+            // eslint-disable-next-line no-console -- no injected logger here
+            console.warn(`[compliance] emit ${event.kind} audit event failed: ${result.error.message}`);
+        }
+    }
+    catch (cause) {
+        // eslint-disable-next-line no-console -- no injected logger here
+        console.warn(`[compliance] emit ${event.kind} audit event threw: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+}
+/**
+ * Map the `resolveContext.caller` discriminant to a subject string.
+ * Format matches the audit-events `actor` convention
+ * (`<type>:<id>` — `agent:<runId>`, `system:<deploymentId>`, `user:admin`,
+ * `user:system`).
+ */
+function actorFromResolveContext(ctx) {
+    switch (ctx.caller) {
+        case 'dispatch':
+            return ctx.runId !== undefined ? `agent:${ctx.runId}` : 'agent:unknown';
+        case 'deploy-sync':
+            return ctx.deploymentId !== undefined ? `system:${ctx.deploymentId}` : 'system:deploy';
+        case 'admin-cli':
+            return 'user:admin';
+        case 'boot-bridge':
+            return 'user:system';
+        default:
+            return undefined;
+    }
+}
+function scopeToPayloadShape(scope) {
+    if (scope.kind === 'tenant') {
+        return { kind: 'tenant', tenantId: scope.tenantId };
+    }
+    if (scope.kind === 'org') {
+        return {
+            kind: 'org',
+            tenantId: scope.tenantId,
+            orgId: scope.orgId,
+        };
+    }
+    return {
+        kind: 'project',
+        tenantId: scope.tenantId,
+        projectId: scope.projectId,
+    };
+}
+/**
+ * Build the resolve-event payload. Structural guarantee: NO `value`
+ * key ever appears. Every field is either metadata (name,
+ * version, scope) or attribution (caller, errorCode).
+ */
+function buildResolvePayload(input) {
+    const payload = {
+        scope: scopeToPayloadShape(input.scope),
+        envName: input.envName,
+        name: input.name,
+        caller: input.resolveContext.caller,
+    };
+    if (input.version !== undefined)
+        payload.recordVersion = input.version;
+    if (input.errorCode !== undefined)
+        payload.errorCode = input.errorCode;
+    if (input.resolveContext.nodeId !== undefined)
+        payload.nodeId = input.resolveContext.nodeId;
+    if (input.resolveContext.runId !== undefined)
+        payload.runId = input.resolveContext.runId;
+    return payload;
+}
+/**
+ * Build the lifecycle-event payload. Same structural rule as
+ * `buildResolvePayload` — never carries the value.
+ */
+function buildLifecyclePayload(input) {
+    const payload = {
+        scope: scopeToPayloadShape(input.scope),
+        envName: input.envName,
+        name: input.name,
+    };
+    if (input.resolveContext !== undefined)
+        payload.caller = input.resolveContext.caller;
+    if (input.version !== undefined)
+        payload.recordVersion = input.version;
+    if (input.previousVersion !== undefined)
+        payload.previousVersion = input.previousVersion;
+    if (input.errorCode !== undefined)
+        payload.errorCode = input.errorCode;
+    if (input.hard !== undefined)
+        payload.hard = input.hard;
+    if (input.reason !== undefined)
+        payload.reason = input.reason;
+    if (input.resolveContext?.nodeId !== undefined)
+        payload.nodeId = input.resolveContext.nodeId;
+    if (input.resolveContext?.runId !== undefined)
+        payload.runId = input.resolveContext.runId;
+    return payload;
+}
+//# sourceMappingURL=resolve-emit.js.map

package/dist/resolve-emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkCzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACvE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;QACjC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AA8BD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GACT,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK;QAClC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAgBD,SAAS,UAAU,CAAC,KAAsB;IACxC,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAA0B;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAA0B,EAAE,KAAiB;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,OAAO,CAAC,IAAI,CACV,qBAAqB,KAAK,CAAC,IAAI,uBAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAmB;IAClD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1E,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACzF,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAY;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK,CAAC,QAA6B;YAC7C,KAAK,EAAE,KAAK,CAAC,KAA0B;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,QAA6B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAA8B;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAA4B;IACvD,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC5F,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9D,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC7F,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,307 @@
+import type { AgentId, ComplianceEvidenceId, FlowId, ProjectId, ProvenanceId, RunId, SigningKeyId, TenantId, Timestamp } from '@kindgi/types';
+/**
+ * The built-in (known) compliance-relevant event classes. Listed as
+ * `examples` in `@kindgi/specs/compliance-evidence.schema.json`.
+ *
+ * Not exhaustive: evidence is a classifier lens over the audit stream,
+ * whose kinds are open (pack authors add their own), and a deployment's
+ * compliance classifier can mark any kind exportable. See `EvidenceKind`.
+ */
+export declare const EVIDENCE_KINDS: readonly ["access-event", "policy-decision", "config-change", "secret-rotation", "incident-event", "guardrail-violation", "eval-run", "approval-completed", "data-retention-action", "authn-event", "authz-decision", "model-invocation", "pack-install", "pack-upgrade", "pack-uninstall", "run-outcome", "env-resolved", "env-set", "env-deleted", "secret-resolved", "secret-set", "secret-rotated", "secret-rotation-started", "secret-rotation-failed", "secret-revoked", "secret-hard-revoked", "hitl-decision"];
+/**
+ * An evidence kind: one of the built-in `EVIDENCE_KINDS`, or any other
+ * audit-event kind a deployment's classifier marks exportable. Consumers
+ * must tolerate kinds they don't know.
+ */
+export type EvidenceKind = (typeof EVIDENCE_KINDS)[number] | (string & {});
+export type ActorKind = 'user' | 'agent' | 'system' | 'admin' | 'external';
+export interface EvidenceActor {
+    readonly kind: ActorKind;
+    readonly id?: string;
+    readonly ipAddress?: string;
+    readonly userAgent?: string;
+}
+export interface EvidenceSubject {
+    readonly kind: string;
+    readonly id?: string;
+}
+export type EvidenceOutcome = 'allowed' | 'denied' | 'succeeded' | 'failed' | 'escalated';
+/**
+ * Reference back to the provenance DAG that produced this evidence.
+ * Same shape as `provenance.schema.json`'s runId + nodeId pair.
+ */
+export interface ProvenanceRef {
+    readonly runId?: RunId;
+    readonly nodeId?: string;
+    /** For records linked to a persisted provenance record by id. */
+    readonly recordId?: ProvenanceId;
+}
+/** Ed25519 signature over the canonical serialisation of the evidence. */
+export interface EvidenceSignature {
+    readonly algorithm: 'ed25519';
+    readonly keyId: string;
+    readonly value: string;
+    readonly signedAt: Timestamp;
+}
+/**
+ * The kind-specific payload lives here. `payload` always includes a
+ * `version` field, so consumers migrate older shapes to the current one
+ * on read instead of rewriting stored records.
+ */
+export interface EvidencePayload {
+    readonly version: number;
+    readonly [key: string]: unknown;
+}
+/**
+ * One evidence record. Matches `@kindgi/specs/compliance-evidence.schema.json`
+ * modulo `payload` being an in-package-typed versioned document.
+ */
+export interface Evidence {
+    readonly id: ComplianceEvidenceId;
+    readonly tenantId: TenantId;
+    /**
+     * Content-scope anchor — the project the underlying audit event
+     * belongs to. Absent for tenant-level events (e.g. authz decisions,
+     * admin actions before any project exists), mirroring the optional
+     * `AuditEvent.projectId`.
+     */
+    readonly projectId?: ProjectId;
+    readonly kind: EvidenceKind;
+    readonly timestamp: Timestamp;
+    readonly actor?: EvidenceActor;
+    readonly subject?: EvidenceSubject;
+    readonly outcome?: EvidenceOutcome;
+    readonly payload: EvidencePayload;
+    readonly provenanceRef?: ProvenanceRef;
+    readonly signature?: EvidenceSignature;
+}
+/**
+ * Alias exposing the public wire type under the framework-standard name.
+ * `ComplianceEvidence` and `Evidence` are the same type.
+ */
+export type ComplianceEvidence = Evidence;
+/**
+ * Optional signer. If a caller wires one up (typically backed by a
+ * signing key), every emitted record is signed for tamper detection.
+ * Absent signer = unsigned records, still valid but weaker audit story.
+ */
+export type EvidenceSigner = (bytes: Uint8Array, tenantId: TenantId) => Promise<EvidenceSignature>;
+/**
+ * Filter for `ComplianceProvider.list`. `tenantId` is required; the other
+ * fields are optional and compose as AND — with only `tenantId` set, it
+ * matches all evidence for the tenant.
+ */
+export interface ListEvidenceFilter {
+    readonly tenantId: TenantId;
+    readonly kind?: EvidenceKind;
+    readonly runId?: RunId;
+    readonly since?: Date;
+    readonly until?: Date;
+    readonly limit?: number;
+}
+/**
+ * Pluggable provider — adapters forward evidence to an external
+ * compliance platform or SIEM. The core `emit` API stays constant;
+ * adapters translate the wire format.
+ */
+export interface ComplianceProvider {
+    emit(evidence: EmitEvidenceInput): Promise<import('./errors.js').EmitResult>;
+    list(filter: ListEvidenceFilter): Promise<import('./errors.js').ListResult>;
+    describe(): {
+        readonly name: string;
+        readonly version: string;
+    };
+}
+/**
+ * Caller-supplied input to `emit`. The provider fills in `id` +
+ * `timestamp` + optional `signature`; everything else comes from the
+ * caller.
+ */
+export interface EmitEvidenceInput {
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+    readonly kind: EvidenceKind;
+    readonly payload: EvidencePayload;
+    readonly actor?: EvidenceActor;
+    readonly subject?: EvidenceSubject;
+    readonly outcome?: EvidenceOutcome;
+    readonly provenanceRef?: ProvenanceRef;
+    /** Override the record id (defaults to `randomUUID()`). */
+    readonly id?: ComplianceEvidenceId;
+    /** Override the timestamp (defaults to `now()`). Useful for backfills. */
+    readonly timestamp?: Timestamp;
+}
+/**
+ * One model call summary attached to a run's evidence record. Redaction-
+ * safe by construction: no raw prompt text, no raw completion — only
+ * hashes + counts + timing + outcome. Callers that need raw content pass
+ * it via `RecordFromRunOptions.rawMessages` under the explicit opt-in
+ * (`RecordFromRunOptions.allowRawMessages: true`).
+ */
+export interface ModelCallSummary {
+    readonly provider: string;
+    readonly model: string;
+    /** `<provider>/<model>@<date-or-version>` — matches provenance node convention. */
+    readonly modelVersion?: string;
+    /** SHA-256 (or similar) of the canonical prompt; caller-supplied. */
+    readonly promptHash?: string;
+    readonly inputTokens?: number;
+    readonly outputTokens?: number;
+    readonly durationMs?: number;
+    readonly outcome?: 'succeeded' | 'failed';
+}
+/**
+ * One tool invocation summary. Same redaction discipline as
+ * `ModelCallSummary` — args are hashed, not embedded.
+ */
+export interface ToolInvocationSummary {
+    readonly toolId: string;
+    /** SHA-256 (or similar) of the canonical args; caller-supplied. */
+    readonly argsHash?: string;
+    readonly outcome?: 'succeeded' | 'failed';
+    readonly durationMs?: number;
+}
+/** One guardrail check outcome captured on the run. */
+export interface GuardrailResultSummary {
+    readonly guardrailId: string;
+    readonly verdict: 'pass' | 'fail' | 'warn';
+    readonly severity?: 'low' | 'medium' | 'high' | 'critical';
+    /** Short human message; caller ensures no sensitive content. */
+    readonly message?: string;
+}
+/**
+ * Structured input to `generator.recordFromRun`. Represents the state of
+ * a terminated run that the pipeline turns into one evidence record.
+ *
+ * By construction this shape is redaction-safe: model prompts and tool
+ * args are hashes, guardrail messages are short strings without payload
+ * content.
+ */
+export interface RunEvidenceContext {
+    readonly status: 'completed' | 'failed' | 'cancelled';
+    readonly startedAt?: Timestamp;
+    readonly endedAt?: Timestamp;
+    readonly agentId?: AgentId;
+    readonly flowId?: FlowId;
+    readonly flowVersion?: string;
+    readonly modelCalls?: readonly ModelCallSummary[];
+    readonly toolInvocations?: readonly ToolInvocationSummary[];
+    readonly guardrailResults?: readonly GuardrailResultSummary[];
+    /**
+     * Failure message from the terminal run. Callers redact this before
+     * passing — the generator does not scan it for secrets.
+     */
+    readonly failureMessage?: string;
+    /**
+     * Free-form extra fields the caller wants on the evidence payload.
+     * Additive; caller is responsible for redaction. NEVER put secrets or
+     * raw user-message content here — use `RecordFromRunOptions.rawMessages`
+     * for the latter (with the opt-in flag) so the redaction seam stays
+     * explicit.
+     */
+    readonly extra?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Options for `generator.recordFromRun`. `tenantId`, `projectId`, `runId`,
+ * `kind` and `runContext` are required; everything else is optional, and
+ * the generator fills in `id` + `timestamp` when absent.
+ */
+export interface RecordFromRunOptions {
+    readonly tenantId: TenantId;
+    /**
+     * Content-scope anchor. The generator
+     * threads this into `Evidence.projectId` on the emitted record.
+     */
+    readonly projectId: ProjectId;
+    readonly runId: RunId;
+    /**
+     * Compliance-relevant event class the caller wants this record filed
+     * under. The pipeline does NOT infer kind from the run outcome — the
+     * caller knows why the record is being emitted.
+     */
+    readonly kind: EvidenceKind;
+    readonly runContext: RunEvidenceContext;
+    readonly actor?: EvidenceActor;
+    readonly subject?: EvidenceSubject;
+    readonly outcome?: EvidenceOutcome;
+    /** Override the record id (defaults to `randomUUID()`). */
+    readonly id?: ComplianceEvidenceId;
+    /** Override the timestamp (defaults to `now()`). */
+    readonly timestamp?: Timestamp;
+    /** Optional provenance DAG back-reference. */
+    readonly provenanceRef?: ProvenanceRef;
+    /**
+     * When the tenant has explicitly opted in to raw-message retention,
+     * caller passes the raw messages here. They land verbatim under
+     * `payload.rawMessages`. Without this opt-in, raw content stays out
+     * of the record entirely.
+     */
+    readonly rawMessages?: readonly Readonly<Record<string, unknown>>[];
+    /**
+     * Must be `true` for `rawMessages` to be embedded — a belt-and-braces
+     * guard so a caller can't accidentally pass raw messages without an
+     * explicit opt-in acknowledgement.
+     */
+    readonly allowRawMessages?: boolean;
+}
+/**
+ * Filter shape shared by evidence listing and signed export
+ * (`ComplianceEvidenceGenerator.exportSigned`). `ComplianceProvider.list`
+ * takes `ListEvidenceFilter` instead. Every field is optional; an empty
+ * filter is "everything in the tenant". Composition is AND — all
+ * populated fields must match.
+ */
+export interface EvidenceFilter {
+    readonly runId?: RunId;
+    readonly agentId?: AgentId;
+    readonly flowId?: FlowId;
+    readonly evidenceKind?: EvidenceKind;
+    /**
+     * Restrict to these kinds. An empty array matches nothing. Callers
+     * applying a classifier pass its exportable kinds here, so a signed
+     * bundle records exactly which kinds it covers.
+     */
+    readonly evidenceKinds?: readonly EvidenceKind[];
+    readonly from?: Timestamp;
+    readonly to?: Timestamp;
+}
+/** One page of evidence records from a cursor-paginated listing. */
+export interface EvidencePage {
+    readonly data: readonly ComplianceEvidence[];
+    /** Absent when there are no more results after this page. */
+    readonly nextCursor?: string;
+}
+/**
+ * The signed export bundle envelope. Same shape family as the provenance
+ * signed export + audit-bundle envelope, so verifiers can reuse the exact
+ * same Ed25519 verification wrapper across all three surfaces.
+ */
+export interface SignedEvidenceBundle {
+    readonly bundleSchemaVersion: '1.0.0';
+    readonly tenantId: TenantId;
+    /** Base64 of canonical JSON bytes — exactly what was signed. */
+    readonly bundle: string;
+    readonly algorithm: 'ed25519';
+    readonly signingKeyId: SigningKeyId;
+    /** Base64 of the Ed25519 signature bytes (64 bytes decoded). */
+    readonly signature: string;
+    /** PEM-encoded Ed25519 public key. */
+    readonly publicKey: string;
+    readonly canonicalization: 'sorted-key-json';
+    readonly exportedAt: Timestamp;
+}
+/**
+ * The body inside the signed bundle. Kept as a distinct exported type so
+ * downstream verifiers can type the decoded bytes without duplicating the
+ * shape.
+ */
+export interface EvidenceBundleBody {
+    readonly bundleSchemaVersion: '1.0.0';
+    readonly tenantId: TenantId;
+    readonly filter: EvidenceFilter;
+    readonly records: readonly ComplianceEvidence[];
+    readonly exportedAt: Timestamp;
+    /** Count of records in the bundle. */
+    readonly recordCount: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACpB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,wfAsCjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE1C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEnG;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,UAAU,CAAC,CAAC;IAC5E,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC9D;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;CACzB;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B"}

package/dist/types.js

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+// ============ Wire types (schema-derived) ============
+/**
+ * The built-in (known) compliance-relevant event classes. Listed as
+ * `examples` in `@kindgi/specs/compliance-evidence.schema.json`.
+ *
+ * Not exhaustive: evidence is a classifier lens over the audit stream,
+ * whose kinds are open (pack authors add their own), and a deployment's
+ * compliance classifier can mark any kind exportable. See `EvidenceKind`.
+ */
+export const EVIDENCE_KINDS = [
+    'access-event',
+    'policy-decision',
+    'config-change',
+    // `secret-rotation` is the coarse kind; emitters use the granular
+    // `secret-rotated` / `secret-rotation-started` / `secret-rotation-failed`
+    // kinds.
+    'secret-rotation',
+    'incident-event',
+    'guardrail-violation',
+    'eval-run',
+    'approval-completed',
+    'data-retention-action',
+    'authn-event',
+    'authz-decision',
+    'model-invocation',
+    'pack-install',
+    'pack-upgrade',
+    'pack-uninstall',
+    'run-outcome',
+    // Env-binding lifecycle events. Symmetric with the secret-* kinds
+    // below; `env-*` events never carry the value in their payload.
+    'env-resolved',
+    'env-set',
+    'env-deleted',
+    // Secret-binding lifecycle events. The framework NEVER copies the
+    // plaintext value into an evidence payload;
+    // payloads carry only metadata (name, version, scope, caller, errorCode).
+    'secret-resolved',
+    'secret-set',
+    'secret-rotated',
+    'secret-rotation-started',
+    'secret-rotation-failed',
+    'secret-revoked',
+    'secret-hard-revoked',
+    // Human-in-the-loop approval decisions (exportable in the shipped
+    // compliance classifier).
+    'hitl-decision',
+];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAcjC,wDAAwD;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,kEAAkE;IAClE,0EAA0E;IAC1E,SAAS;IACT,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,oBAAoB;IACpB,uBAAuB;IACvB,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,kEAAkE;IAClE,gEAAgE;IAChE,cAAc;IACd,SAAS;IACT,aAAa;IACb,kEAAkE;IAClE,4CAA4C;IAC5C,0EAA0E;IAC1E,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,yBAAyB;IACzB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,kEAAkE;IAClE,0BAA0B;IAC1B,eAAe;CACP,CAAC"}