@kindgi/types 0.0.0-bootstrap.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Kindgi Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,40 @@
-# @kindgi/types
+# `@kindgi/types`
 
-A placeholder. Releases come from https://github.com/kindgi/kindgi-sdk.
+Foundational TypeScript types shared across Kindgi. Almost entirely type-only: the single runtime export is `makeEnvName`, the validated constructor for `EnvName`.
+
+## Purpose
+
+Provide the canonical, branded ID types and reference shapes used across Kindgi, preventing whole classes of bugs at compile time (you cannot pass a `TenantId` where a `UserId` is expected) with no runtime cost.
+
+## Exports
+
+- **Branded IDs** — `TenantId`, `UserId`, `OrgId`, `TeamId`, `ProjectId`, `ThreadId`, `ConversationId`, `SessionId`, `RunId`, `FlowId`, `NodeId`, `EdgeId`, `AgentId`, `ToolId`, `GuardrailId`, `PolicyId`, `PackId`, `EventId`, `FactId`, `LogEntryId`, `ArtifactId`, `ProvenanceId`, `SubscriptionId`, `ApprovalId`, `ReviewerId`, `SupervisorId`, `ObservationId`, `FixProposalId`, `AuditBundleId`, `ComplianceEvidenceId`, `WaitTokenId`, `DatasetId`, `ScheduleId`, `ProviderId`, `ApiTokenId`, `WebhookId`, `WebhookEndpointId`, `WebhookEventId`, `WebhookDeliveryId`, `InstallationId`, `SigningKeyId`, `TriggerId`.
+- **Environment names** — `EnvName` (`[a-z][a-z0-9-]{0,62}`) and `makeEnvName(raw)`, which returns the branded value or `null` on a grammar violation.
+- **Brand utility** — `Brand<T, B>` for constructing pack-scoped IDs (e.g. a `MatterId` in a pack that tracks legal matters).
+- **Temporal** — `Timestamp` (ISO 8601 UTC branded string), `DurationMs`, `IsoDuration`.
+- **Hash & signature** — `ContentHash` (`sha256:<hex>`), `SignatureValue` (base64 Ed25519), `KeyId`.
+- **References** — `BlobRef` (blob provider handle), `DatasetRef`.
+- **Result** — `Result<T, E>` discriminated union with runtime `kind` tag, plus `OkOf<R>` / `ErrOf<R>` extractors.
+- **Version** — `Semver`, `SchemaMajor`, `VersionedRef<Id>`.
+- **Lists** — `Cursor` (opaque pagination cursor), `Filter<TStatus>` (shared list-filter shape), `Page<T>` (`{ items, nextCursor?, truncated? }`).
+
+## Example
+
+```ts
+import type { TenantId, Result, BlobRef, ContentHash } from '@kindgi/types';
+
+function ingest(tenantId: TenantId, ref: BlobRef): Result<void, { code: string }> {
+  if (ref.tenantId !== tenantId) {
+    return { kind: 'err', error: { code: 'cross-tenant-blob' } };
+  }
+  return { kind: 'ok', value: undefined };
+}
+
+const hash: ContentHash = 'sha256:abc123...' as ContentHash;
+```
+
+## Non-goals
+
+- **No runtime validation.** Branded types are compile-time only. Validation of wire payloads lives in `@kindgi/schema`; `makeEnvName` is the one exception.
+- **No constructors.** Construction is by `as` cast, except `makeEnvName` for `EnvName`.
+- **No business logic.** Only types that are used by two or more packages belong here. Package-scoped types stay in that package.

package/SPEC.md

@@ -0,0 +1,162 @@
+# `@kindgi/types` — Specification
+
+*Deep spec for humans. Complements the JSON Schemas in `@kindgi/specs` which are wire contracts.*
+
+## Design principles
+
+1. **Type-only, with one exception.** Every export is a `type` except `makeEnvName`, the validated `EnvName` factory. Consumers pay zero runtime cost for using branded types.
+2. **Nominal typing via brands.** Every entity ID is nominally distinct from any other. A `TenantId` and a `UserId` are both structurally `string`, but statically incompatible. Cross-boundary confusion becomes a compile error.
+3. **Correspondence to JSON Schemas.** Most entity kinds in `@kindgi/specs/*.schema.json` have a branded ID here (eval suites, for one, do not). If a schema defines a new entity kind, its ID goes here. Some IDs (e.g. `ConversationId`, `TriggerId`) name entities that have no schema.
+4. **Two or more consumers rule.** A type belongs in `@kindgi/types` only if two or more packages use it. Package-scoped types stay in that package.
+
+## Brand mechanism
+
+```ts
+type Brand<T, B extends string> = T & { readonly __brand: B };
+type TenantId = Brand<string, 'TenantId'>;
+```
+
+The `__brand` field is a phantom marker — it does not exist at runtime. TypeScript treats `TenantId` and `UserId` as incompatible because their brand strings differ, even though both are structurally `string`.
+
+### Construction
+
+A branded type is constructed by cast:
+
+```ts
+const tenant = 'abc' as TenantId;
+```
+
+There is no runtime constructor, except `makeEnvName(raw)`, which returns an `EnvName` or `null` when `raw` breaks the `[a-z][a-z0-9-]{0,62}` grammar. Other validated construction (`"abc"` matches the tenant-id pattern before it's accepted) belongs in `@kindgi/schema`.
+
+### Interop with strings
+
+Branded types are usable anywhere a `string` is, because they are structurally strings:
+
+```ts
+const t: TenantId = 'abc' as TenantId;
+t.length;        // number
+t + '-suffix';   // string (unbranded — the operation drops the brand)
+```
+
+The brand is lost by any operation that produces a new string. This is intentional — brands convey provenance, not identity, so re-branding requires re-casting.
+
+## The canonical scope hierarchy
+
+Kindgi models five scoping constructs. Every pack and every UI can rename these in its own vernacular (legal → "matter", HR → "case"), but Kindgi's code and specs always use the canonical terms.
+
+```
+Tenant            — sovereignty boundary (customer). Cross-tenant access is absolutely denied.
+├── Org (opt)     — optional structural subdivision (litigation dept, cardiology). Small tenants ignore.
+├── Team          — people-group (a working group). Users can belong to many teams.
+│                   Teams hold relations on projects; users inherit access via team membership.
+└── Project       — scoped work-context (matter/case/engagement/episode).
+    │              Collaborators are users OR teams. Project-level roles (owner, editor, viewer).
+    └── Content   — facts, artifacts, runs, blobs. Every piece of content belongs to a project.
+```
+
+Two things worth emphasizing:
+
+**Team and Project are orthogonal.** Team is people; Project is context. Same team works on many projects; same project can have many teams collaborating. Conflating them is the classic anti-pattern (Slack channels, most groupware) — separating them cleanly is what makes cross-vertical mapping trivial.
+
+**Team ≠ Org.** Org is *structural* (a firm's departments, a hospital's specialties). Team is *operational* (a specific working group formed for specific projects). A large firm has few orgs and many teams; a small firm has no orgs and a handful of teams.
+
+## Category tour
+
+### IDs (`src/ids.ts`)
+
+Entity kinds that appear in `@kindgi/specs/*.schema.json` and their branded IDs; the table lists the main ones (see `src/ids.ts` for the full set, including `ConversationId`, `ReviewerId`, `SupervisorId`, `ObservationId`, `FixProposalId`, `AuditBundleId`, `ScheduleId`, `ProviderId`, `ApiTokenId`, `WebhookId`, `WebhookEndpointId`, `WebhookEventId`, `WebhookDeliveryId`, `InstallationId`, `SigningKeyId`, `TriggerId`):
+
+| Schema entity | Type |
+|---|---|
+| Tenant (scope in `memory`, `policy`, `blob`, etc.) | `TenantId` |
+| User | `UserId` |
+| Organization (optional structural subdivision) | `OrgId` |
+| Team (people-group; holds relations, not context) | `TeamId` |
+| Project (matter/case/engagement, vertical-agnostic) | `ProjectId` |
+| Thread | `ThreadId` |
+| Session | `SessionId` |
+| Run (one execution of a flow) | `RunId` |
+| Flow | `FlowId` |
+| Flow node | `NodeId` |
+| Flow edge | `EdgeId` |
+| Agent | `AgentId` |
+| Tool | `ToolId` |
+| Guardrail | `GuardrailId` |
+| Policy document | `PolicyId` |
+| Pack manifest | `PackId` |
+| Event | `EventId` |
+| Fact | `FactId` |
+| Log entry | `LogEntryId` |
+| Artifact (agent output) | `ArtifactId` |
+| Provenance DAG | `ProvenanceId` |
+| Event subscription | `SubscriptionId` |
+| Approval request | `ApprovalId` |
+| Compliance evidence bundle | `ComplianceEvidenceId` |
+| Wait token | `WaitTokenId` |
+| Dataset | `DatasetId` |
+
+### Temporal (`src/temporal.ts`)
+
+- `Timestamp` — always an ISO 8601 UTC string with `Z` suffix. Kept as a string (not `Date`) for JSON serializability and deterministic lexicographic ordering (which matches temporal order for well-formed ISO 8601).
+- `DurationMs` — branded `number` for millisecond durations.
+- `IsoDuration` — branded string for ISO 8601 durations (e.g. `PT30S`, `P1D`). Preferred in declarative artifacts.
+
+### Hash & signature (`src/hash.ts`)
+
+- `ContentHash` — `<algo>:<hex>` format (currently `sha256:<64 hex>`). Consumers must reject unknown algorithms so future migration to sha3/blake3 is non-breaking.
+- `SignatureValue` — base64 (padded, non-URL-safe) Ed25519 signature.
+- `KeyId` — opaque, provider-qualified identifier for a signing key; interpreted by whichever key provider resolves it. Keys in a `SigningKeyBinding` (`@kindgi/crypto`) are addressed by `SigningKeyId` instead.
+
+### References (`src/refs.ts`)
+
+- `BlobRef` — handle to bytes in object storage. Contains provider + bucket + key + size + hash + content type + tenant + timestamps. Never constructed by hand; always produced by the storage layer that wrote the bytes.
+- `DatasetRef` — handle to a versioned dataset: a collection of memory Facts of one declared type (e.g. eval corpora).
+
+### Result (`src/result.ts`)
+
+Discriminated union with runtime `kind: 'ok' | 'err'` tag. The codebase's standard shape for functions that can fail expectedly (as opposed to throwing for unexpected failure).
+
+```ts
+type Result<T, E> =
+  | { readonly kind: 'ok'; readonly value: T }
+  | { readonly kind: 'err'; readonly error: E };
+```
+
+Two helper types:
+- `OkOf<R>` — extract success type from a Result.
+- `ErrOf<R>` — extract error type from a Result.
+
+### Version (`src/version.ts`)
+
+- `Semver` — branded string matching `<major>.<minor>.<patch>[-prerelease]`.
+- `SchemaMajor` — branded positive integer for use in schema `$id` paths.
+- `VersionedRef<Id>` — combines a branded ID with an exact `Semver`, used for pinning artifacts to specific versions.
+
+### Lists (`src/filter.ts`)
+
+- `Cursor` — opaque pagination cursor; pass it back verbatim.
+- `Filter<TStatus>` — shared list-filter shape: `status`, `since`, `until`, `limit`, `cursor`.
+- `Page<T>` — shared list-result envelope: `{ items, nextCursor?, truncated? }`.
+
+## Test approach
+
+Type-only tests via vitest typecheck mode (`vitest run --typecheck`):
+
+- `.test-d.ts` files under `src/` are compiled by TS in typecheck mode.
+- Use `expectTypeOf(x).toEqualTypeOf<T>()` for positive assertions.
+- Use `// @ts-expect-error` immediately above lines that MUST fail compilation.
+- No runtime assertions in this package — the one runtime export, `makeEnvName`, is exercised by the `@kindgi/env-inmemory` tests.
+
+Coverage includes:
+- ID nominal distinctness (positive + negative).
+- ID structural string behavior (length, `.toString()`).
+- Result narrowing via `kind` discriminator.
+- Result readonly semantics.
+- BlobRef required-field enforcement.
+- Brand utility composition for pack-scoped IDs.
+
+## Change discipline
+
+Adding a new branded ID or shape is non-breaking. Removing or renaming one is a semver major bump for this package — downstream consumers reference by import name, and rename would break the world.
+
+When a new entity kind lands in a `@kindgi/specs/*.schema.json`, its branded ID **must** be added here in the same PR. Enforced by review, not by tooling.

package/dist/filter.d.ts

@@ -0,0 +1,61 @@
+import type { Brand } from './ids.js';
+import type { Timestamp } from './temporal.js';
+/**
+ * Opaque pagination cursor. Producers return a `Cursor`; consumers pass
+ * it back verbatim to the next list call. The value is implementation-
+ * defined (usually a timestamp or opaque token) — callers must not
+ * parse or construct one by hand.
+ */
+export type Cursor = Brand<string, 'Cursor'>;
+/**
+ * Shared list-filter shape. List inputs extend this (e.g. the team and
+ * project bindings in `@kindgi/platform`) so resources share one
+ * facet-filter shape.
+ *
+ * `TStatus` narrows the `status` field per-resource (e.g. the
+ * `ApprovalStatus`, `FixProposalStatus` and `ObservationStatus` unions
+ * in `@kindgi/api`).
+ *
+ * All fields are optional. A caller can pass an empty `Filter` to get
+ * the default page.
+ */
+export interface Filter<TStatus extends string = string> {
+    /**
+     * Filter to one status or a set of statuses. The resource-specific
+     * input type narrows TStatus so consumers get autocomplete on the
+     * allowed values.
+     */
+    readonly status?: TStatus | readonly TStatus[];
+    /**
+     * Lower bound on the resource's canonical timestamp — typically
+     * `createdAt` or `observedAt`. Inclusive. Absent = no lower bound.
+     */
+    readonly since?: Timestamp;
+    /**
+     * Upper bound on the resource's canonical timestamp. Inclusive.
+     * Absent = no upper bound.
+     */
+    readonly until?: Timestamp;
+    /**
+     * Max items to return. Producers clamp to a resource-specific ceiling
+     * (typically 500). Default page size is producer-defined.
+     */
+    readonly limit?: number;
+    /** Opaque cursor from a prior list call's `nextCursor` field. */
+    readonly cursor?: Cursor;
+}
+/**
+ * Shared list-result envelope. List producers that use it return
+ * `{ items, nextCursor? }`. Consumers keep calling with `cursor:
+ * result.nextCursor` until it's absent.
+ *
+ * `truncated: true` explicitly signals "more items exist beyond the
+ * cursor" for aggregators that don't paginate but should still know
+ * they missed data.
+ */
+export interface Page<T> {
+    readonly items: readonly T[];
+    readonly nextCursor?: Cursor;
+    readonly truncated?: boolean;
+}
+//# sourceMappingURL=filter.d.ts.map

package/dist/filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../src/filter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM;IACrD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,OAAO,EAAE,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,IAAI,CAAC,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B"}

package/dist/filter.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=filter.js.map

package/dist/filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../src/filter.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/hash.d.ts

@@ -0,0 +1,32 @@
+import type { Brand } from './ids.js';
+/**
+ * A content-addressed hash of a payload, formatted as `<algo>:<hex>`.
+ *
+ * Current supported algorithms:
+ *   - `sha256:<64 hex chars>`
+ *
+ * Meant for content addressing: tamper-evident provenance node content,
+ * blob dedup at ingest, memory LogEntry / Fact content hashes.
+ *
+ * The prefix is significant: consumers must reject hashes without a recognized
+ * algorithm prefix, so future migration to sha3 or blake3 is non-breaking.
+ */
+export type ContentHash = Brand<string, 'ContentHash'>;
+/**
+ * An Ed25519 signature over some canonical serialization, base64-encoded.
+ *
+ * Format is padded base64 (RFC 4648 §4). No URL-safe variants — canonical form
+ * for interoperability with signing tools.
+ */
+export type SignatureValue = Brand<string, 'SignatureValue'>;
+/**
+ * Identifier for a signing key in provider-qualified form. Opaque to Kindgi;
+ * interpreted by whichever key provider resolves it. (Keys held in a
+ * `SigningKeyBinding` from `@kindgi/crypto` are addressed by `SigningKeyId`.)
+ *
+ * Convention: `<provider>:<key-name>` (e.g. `ed25519-local:tenant-abc-v1`,
+ * `hsm:pkcs11:slot-3:key-42`, `kms:aws:arn:aws:kms:...`). Consumers should
+ * treat this string as opaque and let the provider resolve it.
+ */
+export type KeyId = Brand<string, 'KeyId'>;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC"}

package/dist/hash.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}