@kindgi/compliance 0.1.5 → 0.1.6

package/README.md

@@ -13,13 +13,14 @@ Evidence is a classification lens over the audit-event stream from [`@kindgi/aud
   - **`EvidenceKind`** — one of **`EVIDENCE_KINDS`** (the built-in kinds, e.g. `'authz-decision'`, `'run-outcome'`, `'secret-rotated'`, `'hitl-decision'`) or any other string. Consumers must tolerate unknown kinds.
   - **`EvidenceActor`** (with **`ActorKind`**), **`EvidenceSubject`**, **`EvidenceOutcome`**, **`EvidencePayload`** (always carries a numeric `version`), **`EvidenceSignature`** (Ed25519), **`ProvenanceRef`**.
 - **Generator**
-  - **`ComplianceEvidenceGenerator`** — `recordFromRun(options)`, `exportSigned(tenantId, filter, signingKeyId)`, `describe()`.
+  - **`ComplianceEvidenceGenerator`** — `recordFromRun(options)`, `describe()`. A signed export of the records is `@kindgi/api`'s `POST /v1/compliance/evidence/export`, which collects them and signs with the app's export signing key.
   - **`RecordFromRunOptions`** — `tenantId`, `projectId`, `runId`, `kind`, `runContext`, optional actor/subject/outcome/id/timestamp/`provenanceRef`, and `rawMessages` (embedded only when `allowRawMessages: true`).
   - **`RunEvidenceContext`** — `status`, timing, agent/flow ids, and lists of **`ModelCallSummary`**, **`ToolInvocationSummary`**, **`GuardrailResultSummary`**; plus caller-redacted `failureMessage` and `extra`.
   - **`EvidenceFilter`** (AND-composed; `evidenceKinds: []` matches nothing), **`EvidencePage`**, **`SignedEvidenceBundle`** (base64 canonical `bundle`, `signature`, PEM `publicKey`, `signingKeyId`, `canonicalization: 'sorted-key-json'`), **`EvidenceBundleBody`** (the decoded `bundle`).
 - **Provider seam** — **`ComplianceProvider`** (`emit`, `list`, `describe`) for adapters that forward evidence to an external system, with **`EmitEvidenceInput`**, **`ListEvidenceFilter`**, and **`EvidenceSigner`** (`(bytes, tenantId) => Promise<EvidenceSignature>`).
 - **Classifier**
-  - **`ComplianceClassifierFile`** — `{ version: 1, default, byKind }`, the file format.
+  - **`ComplianceClassifierSource`** — `{ version: 1, default, byKind }`, the file format: a kind's entry is its classification, or the name of another kind whose classification it takes (`"secret-rotated": "secret-set"`), resolved at load; a name that names another name, or no kind, is refused.
+  - **`ComplianceClassifierFile`** — the same, resolved: every kind with its own classification (what `LoadedClassifier.file` holds).
   - **`Classification`** — `retention` (`days`, `onDenyDays?`, `legalHold?`), `signed`, `exportable`.
   - **`LoadedClassifier`** — `file` plus `resolve(kind)`, which returns the per-kind entry or the default.
 - **`auditEventToEvidence(event)`** — pure transform from an `AuditEvent` to an `Evidence` record (unwraps the `{ v, doc }` payload envelope).
@@ -29,15 +30,11 @@ Evidence is a classification lens over the audit-event stream from [`@kindgi/aud
 ## Example
 
 ```ts
-import type {
-  ComplianceEvidenceGenerator,
-  EvidenceBundleBody,
-  RunEvidenceContext,
-} from '@kindgi/compliance';
+import type { ComplianceEvidenceGenerator, RunEvidenceContext } from '@kindgi/compliance';
 
-// tenantId, projectId, runId, signingKeyId, startedAt, endedAt, promptHash and
-// argsHash come from the finished run and the deployment's configuration.
-async function recordAndExport(generator: ComplianceEvidenceGenerator): Promise<void> {
+// tenantId, projectId, runId, startedAt, endedAt, promptHash and argsHash
+// come from the finished run.
+async function record(generator: ComplianceEvidenceGenerator): Promise<void> {
   // Redaction-safe run summary: hashes and counts, no prompt or argument text.
   const runContext: RunEvidenceContext = {
     status: 'completed',
@@ -58,19 +55,9 @@ async function recordAndExport(generator: ComplianceEvidenceGenerator): Promise<
     runContext,
   });
   if (recorded.kind === 'err') throw new Error(`${recorded.error.code}: ${recorded.error.message}`);
-
-  const exported = await generator.exportSigned(
-    tenantId,
-    { runId, evidenceKinds: ['run-outcome', 'authz-decision'] },
-    signingKeyId,
-  );
-  if (exported.kind === 'err') throw new Error(`${exported.error.code}: ${exported.error.message}`);
-
-  // `bundle` is base64 of the exact canonical JSON bytes that were signed.
-  const body = JSON.parse(
-    Buffer.from(exported.value.bundle, 'base64').toString('utf8'),
-  ) as EvidenceBundleBody;
-  console.log(body.recordCount, exported.value.signingKeyId, exported.value.algorithm);
+  // A signed export of these records: `POST /v1/compliance/evidence/export`
+  // with `{ filter: { runId, evidenceKind: 'run-outcome' } }`, on a runtime
+  // with an export signing key.
 }
 ```
 

package/dist/classifier.d.ts

@@ -40,7 +40,11 @@ export interface Classification {
      */
     readonly exportable: boolean;
 }
-/** Wire schema for the classifier JSON file. Versioned envelope. */
+/**
+ * A classifier, every kind with its own classification: what a loader
+ * makes of the file (`ComplianceClassifierSource`), and what
+ * `LoadedClassifier.file` holds.
+ */
 export interface ComplianceClassifierFile {
     readonly version: 1;
     /** Default classification for kinds not explicitly listed. */
@@ -48,6 +52,19 @@ export interface ComplianceClassifierFile {
     /** Per-kind overrides. Missing kind → `default`. */
     readonly byKind: Readonly<Record<string, Classification>>;
 }
+/**
+ * The classifier JSON file as written. A kind's entry is its
+ * classification, or the name of another kind whose classification it
+ * takes (`"secret-rotated": "secret-set"`), so related kinds can't drift
+ * apart. A loader resolves the names into a `ComplianceClassifierFile`; a
+ * name must be a kind listed with a classification of its own (not another
+ * name, nor `default`), or the file is refused.
+ */
+export interface ComplianceClassifierSource {
+    readonly version: 1;
+    readonly default: Classification;
+    readonly byKind: Readonly<Record<string, Classification | string>>;
+}
 /**
  * Loaded classifier — same shape as the file, but the `resolve` helper
  * returns the correct classification (per-kind or default) in one call.

package/dist/classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE;QAClB;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;WAMG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,oEAAoE;AACpE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,0DAA0D;IAC1D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CACvC"}
+{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../src/classifier.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE;QAClB;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;WAMG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC3D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC;CACpE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,0DAA0D;IAC1D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CACvC"}

package/dist/errors.d.ts

@@ -30,8 +30,7 @@ export interface PersistenceError {
 /**
  * A caller-plugged `EvidenceSigner` function threw. Distinct from
  * `SigningFailureError` (which is specific to the generator's own
- * Ed25519 signing path, e.g. `exportSigned`) so callers can distinguish
- * the two signing paths.
+ * Ed25519 signing path) so callers can distinguish the two signing paths.
  */
 export interface SignerFailureError {
     readonly code: 'signer-failure';

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAC"}

package/dist/generator.d.ts

@@ -1,7 +1,7 @@
 import type { AuditEvent } from '@kindgi/audit-events';
-import type { ComplianceEvidenceId, Result, SigningKeyId, TenantId } from '@kindgi/types';
+import type { ComplianceEvidenceId, Result } from '@kindgi/types';
 import type { ComplianceError } from './errors.js';
-import type { ComplianceEvidence, EvidenceFilter, RecordFromRunOptions, SignedEvidenceBundle } from './types.js';
+import type { ComplianceEvidence, RecordFromRunOptions } from './types.js';
 /**
  * The runtime service that turns terminated runs into audit-event
  * records and produces signed export bundles.
@@ -16,13 +16,6 @@ export interface ComplianceEvidenceGenerator {
     recordFromRun(options: RecordFromRunOptions): Promise<Result<{
         readonly evidenceId: ComplianceEvidenceId;
     }, ComplianceError>>;
-    /**
-     * @deprecated `@kindgi/api` builds and signs a compliance export
-     * itself (`collectEvidence`, then the app's export signing key), so
-     * nothing calls this. Kept optional so an implementation that still
-     * has it compiles; it goes in a later release.
-     */
-    exportSigned?(tenantId: TenantId, filter: EvidenceFilter, signingKeyId: SigningKeyId): Promise<Result<SignedEvidenceBundle, ComplianceError>>;
     describe(): {
         readonly name: string;
         readonly version: string;

package/dist/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,kBAAkB,EAElB,cAAc,EAGd,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CACX,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnF;;;;;OAKG;IACH,YAAY,CAAC,CACX,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,cAAc,EACtB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;IAE1D,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAa1E"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAS,MAAM,eAAe,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,kBAAkB,EAIlB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CACX,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEnF,QAAQ,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAa1E"}

package/dist/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AA+CjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAA0B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAoB;QACrD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAA0B,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAc,EAAE,EAAE,CAAC;QACpF,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAY;IAC1D,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAA0C,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../src/generator.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAiCjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAA0B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAoB;QACrD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAA0B,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAc,EAAE,EAAE,CAAC;QACpF,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAY;IAC1D,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAA0C,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { EVIDENCE_KINDS } from './types.js';
 export type { ActorKind, ComplianceEvidence, ComplianceProvider, EmitEvidenceInput, Evidence, EvidenceActor, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, EvidenceSigner, EvidenceSubject, ListEvidenceFilter, ProvenanceRef, } from './types.js';
 export type { EvidenceBundleBody, EvidenceFilter, EvidencePage, GuardrailResultSummary, ModelCallSummary, RecordFromRunOptions, RunEvidenceContext, SignedEvidenceBundle, ToolInvocationSummary, } from './types.js';
 export type { ComplianceError, EmitResult, InvalidCursorError, InvalidEvidenceError, ListResult, PersistenceError, ProjectNotFoundError, SignerFailureError, SigningFailureError, SigningKeyMissingError, UnsupportedVersionError, } from './errors.js';
-export type { Classification, ComplianceClassifierFile, LoadedClassifier, } from './classifier.js';
+export type { Classification, ComplianceClassifierFile, ComplianceClassifierSource, LoadedClassifier, } from './classifier.js';
 export type { ComplianceEvidenceGenerator } from './generator.js';
 export { auditEventToEvidence } from './generator.js';
 export { EVIDENCE_EXPORT_PAGE_SIZE, collectEvidence, evidenceFilterToAuditFilter, } from './collect.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAuD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,uCAAuC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwD5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAEtB,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/resolve-emit.d.ts

@@ -61,9 +61,28 @@ export interface EmitLifecycleEventInput {
     readonly errorCode?: string;
     readonly hard?: boolean;
     readonly reason?: string;
+    /** A secret set's mode: a new secret, or a new version of one. */
+    readonly writeMode?: 'create-new' | 'add-version';
+    /** An asynchronous rotation's id (`secret-rotation-started`). */
+    readonly rotationId?: string;
+    /**
+     * The backend dropped a revoked secret's stored values to set it again
+     * (a provider that keeps them for a recovery window): the record says
+     * their retention ended here.
+     */
+    readonly revokedValuesPurged?: true;
+    /**
+     * Who did it, as the API names its caller (`user:<id>`,
+     * `service_account:<id>`, `session:<id>`, `token:<hash>`). Absent: from
+     * `resolveContext`, as a binding emits.
+     */
+    readonly actor?: string;
+    /** The request it came from (the API's `requestId`). */
+    readonly correlationId?: string;
     readonly auditEvents: AuditEventBinding;
     readonly tenantId: TenantId;
-    readonly projectId: ProjectId;
+    /** The project, for a project-scoped value; absent for a tenant- or org-scoped one. */
+    readonly projectId?: ProjectId;
 }
 /**
  * Emit a non-resolve lifecycle event (`env-set` / `env-deleted` /

package/dist/resolve-emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;CAC3E;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CActF"}
+{"version":3,"file":"resolve-emit.d.ts","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;CAC3E;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAclF;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,aAAa,CAAC;IAClD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBtF"}

package/dist/resolve-emit.js

@@ -53,14 +53,18 @@ export async function emitResolveEvent(input) {
  */
 export async function emitLifecycleEvent(input) {
     const payload = buildLifecyclePayload(input);
-    const actor = input.resolveContext !== undefined ? actorFromResolveContext(input.resolveContext) : undefined;
+    const actor = input.actor ??
+        (input.resolveContext !== undefined
+            ? actorFromResolveContext(input.resolveContext)
+            : undefined);
     const event = buildEvent({
         tenantId: input.tenantId,
-        projectId: input.projectId,
+        ...(input.projectId !== undefined && { projectId: input.projectId }),
         kind: input.evidenceKind,
         outcome: input.outcome,
         actor,
         runId: input.resolveContext?.runId,
+        ...(input.correlationId !== undefined && { correlationId: input.correlationId }),
         payload,
     });
     await safeEmit(input.auditEvents, event);
@@ -69,12 +73,13 @@ function buildEvent(input) {
     return {
         id: randomUUID(),
         tenantId: input.tenantId,
-        projectId: input.projectId,
+        ...(input.projectId !== undefined && { projectId: input.projectId }),
         kind: input.kind,
         timestamp: new Date().toISOString(),
         actor: input.actor ?? 'user:system',
         outcome: input.outcome,
         ...(input.runId !== undefined && { runId: input.runId }),
+        ...(input.correlationId !== undefined && { correlationId: input.correlationId }),
         payload: { v: 1, doc: input.payload },
     };
 }
@@ -172,6 +177,12 @@ function buildLifecyclePayload(input) {
         payload.hard = input.hard;
     if (input.reason !== undefined)
         payload.reason = input.reason;
+    if (input.writeMode !== undefined)
+        payload.writeMode = input.writeMode;
+    if (input.rotationId !== undefined)
+        payload.rotationId = input.rotationId;
+    if (input.revokedValuesPurged === true)
+        payload.revokedValuesPurged = true;
     if (input.resolveContext?.nodeId !== undefined)
         payload.nodeId = input.resolveContext.nodeId;
     if (input.resolveContext?.runId !== undefined)

package/dist/resolve-emit.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkCzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACvE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;QACjC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AA8BD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GACT,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK;QAClC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAgBD,SAAS,UAAU,CAAC,KAAsB;IACxC,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAA0B;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAA0B,EAAE,KAAiB;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,OAAO,CAAC,IAAI,CACV,qBAAqB,KAAK,CAAC,IAAI,uBAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAmB;IAClD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1E,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACzF,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAY;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK,CAAC,QAA6B;YAC7C,KAAK,EAAE,KAAK,CAAC,KAA0B;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,QAA6B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAA8B;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAA4B;IACvD,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC5F,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9D,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC7F,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"resolve-emit.js","sourceRoot":"","sources":["../src/resolve-emit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkCzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA4B;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACvE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;QACjC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAiDD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GACT,KAAK,CAAC,KAAK;QACX,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;YACjC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK;QAClC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAiBD,SAAS,UAAU,CAAC,KAAsB;IACxC,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAA0B;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,aAAa;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAA0B,EAAE,KAAiB;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,OAAO,CAAC,IAAI,CACV,qBAAqB,KAAK,CAAC,IAAI,uBAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAmB;IAClD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1E,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QACzF,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAY;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,KAAK,CAAC,QAA6B;YAC7C,KAAK,EAAE,KAAK,CAAC,KAA0B;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,KAAK,CAAC,QAA6B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAA8B;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAA4B;IACvD,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC5F,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC3D,MAAM,OAAO,GAA4B;QACvC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,KAAK,CAAC,OAA4B;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACvE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1E,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC3E,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC7F,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/types.d.ts

@@ -245,8 +245,8 @@ export interface RecordFromRunOptions {
     readonly allowRawMessages?: boolean;
 }
 /**
- * Filter shape shared by evidence listing and signed export
- * (`ComplianceEvidenceGenerator.exportSigned`). `ComplianceProvider.list`
+ * Filter shape shared by evidence listing and the signed compliance
+ * export (`@kindgi/api` collects, then signs). `ComplianceProvider.list`
  * takes `ListEvidenceFilter` instead. Every field is optional; an empty
  * filter is "everything in the tenant". Composition is AND — all
  * populated fields must match.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/compliance",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Kindgi™ compliance evidence contract. Types for the Evidence wire record and its sub-types (EvidenceActor, EvidenceSubject, EvidenceKind, EvidenceOutcome, EvidencePayload, EvidenceSignature, ProvenanceRef, ActorKind; ComplianceEvidence alias), the ComplianceProvider seam (EmitEvidenceInput, ListEvidenceFilter, EvidenceSigner), the ComplianceEvidenceGenerator interface with its inputs (RecordFromRunOptions, RunEvidenceContext, ModelCallSummary, ToolInvocationSummary, GuardrailResultSummary), EvidenceFilter, EvidencePage, SignedEvidenceBundle and EvidenceBundleBody, the classifier file format (ComplianceClassifierFile, Classification, LoadedClassifier), and the ComplianceError union. Runtime exports: the EVIDENCE_KINDS list, the pure auditEventToEvidence transform, and emitResolveEvent / emitLifecycleEvent, which append env-* and secret-* audit events to an AuditEventBinding. The generator implementation and the classifier loader are provided by the Kindgi runtime or by the caller.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,12 +28,12 @@
     "README.md"
   ],
   "dependencies": {
-    "@kindgi/audit-events": "0.1.5",
-    "@kindgi/platform": "0.1.5",
-    "@kindgi/types": "0.1.5"
+    "@kindgi/audit-events": "0.1.6",
+    "@kindgi/platform": "0.1.6",
+    "@kindgi/types": "0.1.6"
   },
   "devDependencies": {
-    "@kindgi/specs": "0.1.5",
+    "@kindgi/specs": "0.1.6",
     "@types/node": "^22.10.5",
     "typescript": "^5.7.3",
     "vitest": "^2.1.8"

package/src/classifier.ts

@@ -44,7 +44,11 @@ export interface Classification {
   readonly exportable: boolean;
 }
 
-/** Wire schema for the classifier JSON file. Versioned envelope. */
+/**
+ * A classifier, every kind with its own classification: what a loader
+ * makes of the file (`ComplianceClassifierSource`), and what
+ * `LoadedClassifier.file` holds.
+ */
 export interface ComplianceClassifierFile {
   readonly version: 1;
   /** Default classification for kinds not explicitly listed. */
@@ -53,6 +57,20 @@ export interface ComplianceClassifierFile {
   readonly byKind: Readonly<Record<string, Classification>>;
 }
 
+/**
+ * The classifier JSON file as written. A kind's entry is its
+ * classification, or the name of another kind whose classification it
+ * takes (`"secret-rotated": "secret-set"`), so related kinds can't drift
+ * apart. A loader resolves the names into a `ComplianceClassifierFile`; a
+ * name must be a kind listed with a classification of its own (not another
+ * name, nor `default`), or the file is refused.
+ */
+export interface ComplianceClassifierSource {
+  readonly version: 1;
+  readonly default: Classification;
+  readonly byKind: Readonly<Record<string, Classification | string>>;
+}
+
 /**
  * Loaded classifier — same shape as the file, but the `resolve` helper
  * returns the correct classification (per-kind or default) in one call.

package/src/errors.ts

@@ -43,8 +43,7 @@ export interface PersistenceError {
 /**
  * A caller-plugged `EvidenceSigner` function threw. Distinct from
  * `SigningFailureError` (which is specific to the generator's own
- * Ed25519 signing path, e.g. `exportSigned`) so callers can distinguish
- * the two signing paths.
+ * Ed25519 signing path) so callers can distinguish the two signing paths.
  */
 export interface SignerFailureError {
   readonly code: 'signer-failure';

package/src/generator.ts

@@ -2,18 +2,16 @@
 // Copyright (C) 2026 Kindgi Inc.
 
 import type { AuditEvent } from '@kindgi/audit-events';
-import type { ComplianceEvidenceId, Result, RunId, SigningKeyId, TenantId } from '@kindgi/types';
+import type { ComplianceEvidenceId, Result, RunId } from '@kindgi/types';
 
 import type { ComplianceError } from './errors.js';
 import type {
   ActorKind,
   ComplianceEvidence,
   EvidenceActor,
-  EvidenceFilter,
   EvidenceOutcome,
   EvidencePayload,
   RecordFromRunOptions,
-  SignedEvidenceBundle,
 } from './types.js';
 
 /**
@@ -31,18 +29,6 @@ export interface ComplianceEvidenceGenerator {
     options: RecordFromRunOptions,
   ): Promise<Result<{ readonly evidenceId: ComplianceEvidenceId }, ComplianceError>>;
 
-  /**
-   * @deprecated `@kindgi/api` builds and signs a compliance export
-   * itself (`collectEvidence`, then the app's export signing key), so
-   * nothing calls this. Kept optional so an implementation that still
-   * has it compiles; it goes in a later release.
-   */
-  exportSigned?(
-    tenantId: TenantId,
-    filter: EvidenceFilter,
-    signingKeyId: SigningKeyId,
-  ): Promise<Result<SignedEvidenceBundle, ComplianceError>>;
-
   describe(): { readonly name: string; readonly version: string };
 }
 

package/src/index.ts

@@ -52,6 +52,7 @@ export type {
 export type {
   Classification,
   ComplianceClassifierFile,
+  ComplianceClassifierSource,
   LoadedClassifier,
 } from './classifier.js';
 

package/src/resolve-emit.ts

@@ -104,9 +104,28 @@ export interface EmitLifecycleEventInput {
   readonly errorCode?: string;
   readonly hard?: boolean;
   readonly reason?: string;
+  /** A secret set's mode: a new secret, or a new version of one. */
+  readonly writeMode?: 'create-new' | 'add-version';
+  /** An asynchronous rotation's id (`secret-rotation-started`). */
+  readonly rotationId?: string;
+  /**
+   * The backend dropped a revoked secret's stored values to set it again
+   * (a provider that keeps them for a recovery window): the record says
+   * their retention ended here.
+   */
+  readonly revokedValuesPurged?: true;
+  /**
+   * Who did it, as the API names its caller (`user:<id>`,
+   * `service_account:<id>`, `session:<id>`, `token:<hash>`). Absent: from
+   * `resolveContext`, as a binding emits.
+   */
+  readonly actor?: string;
+  /** The request it came from (the API's `requestId`). */
+  readonly correlationId?: string;
   readonly auditEvents: AuditEventBinding;
   readonly tenantId: TenantId;
-  readonly projectId: ProjectId;
+  /** The project, for a project-scoped value; absent for a tenant- or org-scoped one. */
+  readonly projectId?: ProjectId;
 }
 
 /**
@@ -118,14 +137,18 @@ export interface EmitLifecycleEventInput {
 export async function emitLifecycleEvent(input: EmitLifecycleEventInput): Promise<void> {
   const payload = buildLifecyclePayload(input);
   const actor =
-    input.resolveContext !== undefined ? actorFromResolveContext(input.resolveContext) : undefined;
+    input.actor ??
+    (input.resolveContext !== undefined
+      ? actorFromResolveContext(input.resolveContext)
+      : undefined);
   const event = buildEvent({
     tenantId: input.tenantId,
-    projectId: input.projectId,
+    ...(input.projectId !== undefined && { projectId: input.projectId }),
     kind: input.evidenceKind,
     outcome: input.outcome,
     actor,
     runId: input.resolveContext?.runId,
+    ...(input.correlationId !== undefined && { correlationId: input.correlationId }),
     payload,
   });
   await safeEmit(input.auditEvents, event);
@@ -137,11 +160,12 @@ export async function emitLifecycleEvent(input: EmitLifecycleEventInput): Promis
 
 interface BuildEventInput {
   readonly tenantId: TenantId;
-  readonly projectId: ProjectId;
+  readonly projectId?: ProjectId;
   readonly kind: string;
   readonly outcome: string;
   readonly actor: string | undefined;
   readonly runId: string | undefined;
+  readonly correlationId?: string;
   readonly payload: Readonly<Record<string, unknown>>;
 }
 
@@ -149,12 +173,13 @@ function buildEvent(input: BuildEventInput): AuditEvent {
   return {
     id: randomUUID(),
     tenantId: input.tenantId,
-    projectId: input.projectId,
+    ...(input.projectId !== undefined && { projectId: input.projectId }),
     kind: input.kind,
     timestamp: new Date().toISOString() as unknown as Timestamp,
     actor: input.actor ?? 'user:system',
     outcome: input.outcome,
     ...(input.runId !== undefined && { runId: input.runId }),
+    ...(input.correlationId !== undefined && { correlationId: input.correlationId }),
     payload: { v: 1, doc: input.payload },
   };
 }
@@ -250,6 +275,9 @@ function buildLifecyclePayload(input: EmitLifecycleEventInput): Readonly<Record<
   if (input.errorCode !== undefined) payload.errorCode = input.errorCode;
   if (input.hard !== undefined) payload.hard = input.hard;
   if (input.reason !== undefined) payload.reason = input.reason;
+  if (input.writeMode !== undefined) payload.writeMode = input.writeMode;
+  if (input.rotationId !== undefined) payload.rotationId = input.rotationId;
+  if (input.revokedValuesPurged === true) payload.revokedValuesPurged = true;
   if (input.resolveContext?.nodeId !== undefined) payload.nodeId = input.resolveContext.nodeId;
   if (input.resolveContext?.runId !== undefined) payload.runId = input.resolveContext.runId;
   return payload;

package/src/types.ts

@@ -340,8 +340,8 @@ export interface RecordFromRunOptions {
 }
 
 /**
- * Filter shape shared by evidence listing and signed export
- * (`ComplianceEvidenceGenerator.exportSigned`). `ComplianceProvider.list`
+ * Filter shape shared by evidence listing and the signed compliance
+ * export (`@kindgi/api` collects, then signs). `ComplianceProvider.list`
  * takes `ListEvidenceFilter` instead. Every field is optional; an empty
  * filter is "everything in the tenant". Composition is AND — all
  * populated fields must match.