@runfile-ai/schemas 0.1.0

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may accept and charge a
+      fee for, acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend,
+      and hold each Contributor harmless for any liability incurred by,
+      or claims asserted against, such Contributor by reason of your
+      accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Runfile
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,163 @@
+# @runfile-ai/schemas
+
+The single source of truth for every data shape that crosses a service boundary in Runfile.
+
+- **Source of truth:** Zod definitions in TypeScript (`src/`)
+- **Generated downstream:** JSON Schema 2020-12, Python Pydantic v2, Go structs (`generated/`)
+- **Published to:**
+  - npm — [`@runfile-ai/schemas`](https://www.npmjs.com/package/@runfile-ai/schemas)
+  - PyPI — [`runfile-ai-schemas`](https://pypi.org/project/runfile-ai-schemas/)
+  - Go modules — [`github.com/runfile-ai/schemas`](https://pkg.go.dev/github.com/runfile-ai/schemas) (via Git tags, no registry)
+- **Versioned:** strict semver, managed by [Changesets](https://github.com/changesets/changesets). Every release PR is reviewable before it ships.
+
+See [`private/apispecs/schemas.md`](../private/apispecs/schemas.md) (internal) for the full design rationale.
+
+## What's in here
+
+| Path | Contents |
+|------|----------|
+| `src/event.ts` | `RunfileEventSchema` + sub-shapes (actor, action, subject, model_ref, decision, payload_ref) |
+| `src/ingest.ts` | `BatchSubmissionSchema`, `EventSubmissionSchema`, error/response shapes for the Ingest API |
+| `src/vault.ts` | Tokenize/Resolve/Lifecycle request and response shapes |
+| `src/evidence.ts` | Evidence bundle format (consumed by the Verifier CLI) |
+| `src/manifest.ts` | Daily Merkle manifest format |
+| `src/control-mapping.ts` | Regulatory control mapping YAML schema |
+| `src/canonical.ts` | RFC 8785 JCS canonical JSON helpers |
+| `generated/` | JSON Schema, Pydantic, Go structs — never edit by hand (except `canonical.py` / `canonical.go`) |
+| `scripts/generate.ts` | Master generator: Zod → JSON Schema → Pydantic + Go |
+| `scripts/check-drift.ts` | CI guard: fails if `generated/` is out of date w.r.t. Zod source |
+| `scripts/publish-all.ts` | Local fallback for publishing (CI is the normal path) |
+| `go.mod` | Go module declaration at repo root — module path `github.com/runfile-ai/schemas` |
+
+## Usage
+
+```bash
+pnpm install
+pnpm run generate     # regenerate downstream artifacts after editing Zod
+pnpm test             # round-trip + canonical JSON + cross-language fixtures
+pnpm run check-drift  # verify committed generated/ matches what generate would produce
+pnpm run build        # compile TypeScript to dist/
+pnpm run publish-all  # local fallback for publishing (CI is the normal path)
+```
+
+### Toolchain required for `pnpm run generate`
+
+- **Node 20+** — always
+- **Python 3.10+** with `datamodel-code-generator >= 0.57` on PATH (Step 2: Pydantic generation). Python 3.9 caps at `datamodel-code-generator 0.45`, which produces an older form that CI rejects via the drift check.
+  ```bash
+  python3.11 -m pip install --user 'datamodel-code-generator[http]>=0.57,<1.0'
+  ```
+- **quicktype** — installed as a devDependency, invoked via `pnpm exec` (Step 3: Go generation). No separate install needed.
+
+No Go toolchain is required for codegen — `quicktype` is the documented alternative to `go-jsonschema` and produces struct files that compile under any Go 1.22+ consumer.
+
+### What's hand-written vs generated
+
+Everything under `generated/` is produced by `pnpm run generate` EXCEPT:
+
+- `generated/python/runfile_schemas/canonical.py` — RFC 8785 canonical JSON helper for Python (parity with the TS leg)
+- `generated/go/pkg/canonical/canonical.go` — RFC 8785 canonical JSON helper for Go
+
+These are part of the published packages but cannot be auto-generated from Zod. They sit alongside the generated files and are preserved across regenerations.
+
+### In a TypeScript consumer
+
+```ts
+import { RunfileEventSchema, type RunfileEvent } from '@runfile-ai/schemas/event';
+import { BatchSubmissionSchema } from '@runfile-ai/schemas/ingest';
+
+const event: RunfileEvent = RunfileEventSchema.parse(unknownInput);
+```
+
+### In a Python consumer
+
+```python
+from runfile_schemas.event import RunfileEvent, Actor
+from runfile_schemas.ingest import BatchSubmission
+from runfile_schemas.canonical import canonical_sha256
+```
+
+(The PyPI distribution is `runfile-ai-schemas`; the importable package name is `runfile_schemas`.)
+
+### In a Go consumer
+
+```go
+import (
+    "github.com/runfile-ai/schemas/generated/go/pkg/event"
+    "github.com/runfile-ai/schemas/generated/go/pkg/canonical"
+)
+```
+
+The `go.mod` at the repo root declares `module github.com/runfile-ai/schemas`, so Go consumers fetch with:
+
+```bash
+go get github.com/runfile-ai/schemas@v1.0.0
+```
+
+The Git tag IS the Go module version — there's no separate registry.
+
+## Versioning
+
+Strict semver:
+- **Major** (`1.x → 2.x`): breaking. Removed fields, changed validation. Forces coordinated SDK upgrades.
+- **Minor** (`1.0 → 1.1`): additive only. New optional fields, new enum values.
+- **Patch** (`1.0.0 → 1.0.1`): documentation fixes only.
+
+The npm/Go package version stays in lockstep — `package.json#version` is the master, and `generate.ts` templates it into `generated/python/pyproject.toml` automatically. The Go consumer-visible version is whatever Git tag is pushed (`v1.1.0`).
+
+The package version may differ from the `event.schema_version` field embedded in events; in v1 they are kept in sync.
+
+## Publishing
+
+Releases are driven by [Changesets](https://github.com/changesets/changesets). Every change that should ship to consumers gets a changeset file describing the bump (`patch` / `minor` / `major`) and a one-line summary. Changesets accumulate on `main` until they're released as a batch.
+
+### Day-to-day: include a changeset with your PR
+
+```bash
+pnpm changeset
+# Pick patch/minor/major, write a 1–2 sentence summary.
+# A markdown file lands in .changeset/; commit it alongside your code.
+```
+
+If your PR doesn't change anything consumer-visible (CI tweaks, docs, internal refactor), skip this — no changeset needed.
+
+### Cutting a release
+
+You don't tag manually. The flow is:
+
+1. Merge PRs to `main` with their changesets.
+2. The `Changesets` workflow opens a `chore(release): version packages` PR. It bumps `package.json`, writes `CHANGELOG.md`, and updates `generated/python/pyproject.toml` (via `pnpm run generate`).
+3. Review that PR. When merged:
+   - The same workflow runs again, calls `changeset publish`, which:
+     - Publishes `@runfile-ai/schemas@X.Y.Z` to npm
+     - Pushes the `vX.Y.Z` git tag
+   - The tag push triggers `release.yml`, which announces the Go module path (and will publish to PyPI once the runfile-ai PyPI org is set up).
+
+You can preview what the next release will look like locally:
+
+```bash
+pnpm changeset status --verbose
+```
+
+### One-time setup before the first release
+
+| Registry | What to set up |
+|---|---|
+| **npm** | `NPM_TOKEN` repo secret (an automation token from npmjs.org with `Publish` rights on `@runfile-ai/schemas`) |
+| **PyPI** | *Deferred to GA.* A trusted publisher on [pypi.org/manage/account/publishing/](https://pypi.org/manage/account/publishing/) pointing at this repo's `release.yml` workflow and `release` GitHub environment. Until then the PyPI step in `release.yml` is commented out. |
+| **Go** | Nothing. The repo must be public (or the consumer's `GOPRIVATE` must include it) and tags must be pushed — Changesets pushes them for you. |
+
+### Manual fallback: `pnpm run publish-all`
+
+If CI is broken mid-release, you can publish from your laptop:
+
+```bash
+pnpm run publish-all              # full publish (npm + PyPI + Git tag verification)
+pnpm run publish-all -- --dry-run # print steps without publishing
+```
+
+Requires `npm login`, a `~/.pypirc` token (or `PYPI_API_TOKEN` env var), and Python's `build` + `twine` (`pip3 install --user build twine`).
+
+## License
+
+Apache 2.0. See `LICENSE`.

package/dist/canonical.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Canonical JSON serialisation per RFC 8785 (JSON Canonicalization Scheme).
+ *
+ * Every consumer — TS SDK, TS backend, Python SDK, Go Event Processor, Verifier CLI —
+ * must produce byte-identical output for the same logical value, because `event_hash`
+ * commits to the canonical serialisation. The schemas package owns the canonical form
+ * and re-exports it.
+ *
+ * Use this for any value whose hash crosses a service boundary. Do NOT use it for
+ * general API payloads (those go through plain JSON.stringify) — RFC 8785 is strictly
+ * for hash determinism.
+ */
+export declare function stringify(value: unknown): string;
+/** @deprecated Alias retained for the documented import name in schemas.md. */
+export { stringify as canonicalStringify };
+/**
+ * Computes SHA-256(stringify(value)) as the lowercase-hex form `sha256:<64 chars>`.
+ *
+ * This is the exact form that appears in `event.event_hash`, `payload_ref.sha256`,
+ * `model_version_hash`, etc.
+ */
+export declare function canonicalSha256(value: unknown): string;
+/**
+ * Computes the event_hash for a RunfileEvent.
+ *
+ * Per the canonicalisation spec: the `event_hash` field itself is excluded from
+ * canonicalisation — serialise with `event_hash` omitted, compute SHA-256, then set.
+ */
+export declare function computeEventHash<T extends {
+    event_hash?: unknown;
+}>(event: T): string;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMhD;AAED,+EAA+E;AAC/E,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAGrF"}

package/dist/canonical.js

@@ -0,0 +1,46 @@
+import canonicalize from 'canonicalize';
+import { createHash } from 'node:crypto';
+/**
+ * Canonical JSON serialisation per RFC 8785 (JSON Canonicalization Scheme).
+ *
+ * Every consumer — TS SDK, TS backend, Python SDK, Go Event Processor, Verifier CLI —
+ * must produce byte-identical output for the same logical value, because `event_hash`
+ * commits to the canonical serialisation. The schemas package owns the canonical form
+ * and re-exports it.
+ *
+ * Use this for any value whose hash crosses a service boundary. Do NOT use it for
+ * general API payloads (those go through plain JSON.stringify) — RFC 8785 is strictly
+ * for hash determinism.
+ */
+export function stringify(value) {
+    const result = canonicalize(value);
+    if (result === undefined) {
+        throw new TypeError('canonicalize returned undefined; value is not JSON-serialisable');
+    }
+    return result;
+}
+/** @deprecated Alias retained for the documented import name in schemas.md. */
+export { stringify as canonicalStringify };
+/**
+ * Computes SHA-256(stringify(value)) as the lowercase-hex form `sha256:<64 chars>`.
+ *
+ * This is the exact form that appears in `event.event_hash`, `payload_ref.sha256`,
+ * `model_version_hash`, etc.
+ */
+export function canonicalSha256(value) {
+    return `sha256:${sha256Hex(stringify(value))}`;
+}
+function sha256Hex(input) {
+    return createHash('sha256').update(input).digest('hex');
+}
+/**
+ * Computes the event_hash for a RunfileEvent.
+ *
+ * Per the canonicalisation spec: the `event_hash` field itself is excluded from
+ * canonicalisation — serialise with `event_hash` omitted, compute SHA-256, then set.
+ */
+export function computeEventHash(event) {
+    const { event_hash: _omit, ...rest } = event;
+    return canonicalSha256(rest);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,UAAU,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAqC,KAAQ;IAC3E,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/control-mapping.d.ts

@@ -0,0 +1,85 @@
+import { z } from 'zod';
+/**
+ * Control mapping — authored as signed YAML in the Control Mapping repo, but
+ * validated against this JSON Schema. Maps regulatory framework controls to the
+ * event-level predicates the Query API evaluates.
+ */
+export declare const ControlMappingSchema: z.ZodObject<{
+    mapping_version: z.ZodString;
+    framework: z.ZodString;
+    framework_version: z.ZodString;
+    published_at: z.ZodString;
+    controls: z.ZodArray<z.ZodObject<{
+        control_id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodString;
+        regulatory_tags: z.ZodArray<z.ZodString, "many">;
+        predicates: z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<["event_count", "event_exists", "event_absent", "aggregate"]>;
+            expression: z.ZodString;
+            threshold: z.ZodOptional<z.ZodNumber>;
+        }, "strict", z.ZodTypeAny, {
+            kind: "event_count" | "event_exists" | "event_absent" | "aggregate";
+            expression: string;
+            threshold?: number | undefined;
+        }, {
+            kind: "event_count" | "event_exists" | "event_absent" | "aggregate";
+            expression: string;
+            threshold?: number | undefined;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        control_id: string;
+        title: string;
+        description: string;
+        regulatory_tags: string[];
+        predicates: {
+            kind: "event_count" | "event_exists" | "event_absent" | "aggregate";
+            expression: string;
+            threshold?: number | undefined;
+        }[];
+    }, {
+        control_id: string;
+        title: string;
+        description: string;
+        regulatory_tags: string[];
+        predicates: {
+            kind: "event_count" | "event_exists" | "event_absent" | "aggregate";
+            expression: string;
+            threshold?: number | undefined;
+        }[];
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    mapping_version: string;
+    framework: string;
+    framework_version: string;
+    published_at: string;
+    controls: {
+        control_id: string;
+        title: string;
+        description: string;
+        regulatory_tags: string[];
+        predicates: {
+            kind: "event_count" | "event_exists" | "event_absent" | "aggregate";
+            expression: string;
+            threshold?: number | undefined;
+        }[];
+    }[];
+}, {
+    mapping_version: string;
+    framework: string;
+    framework_version: string;
+    published_at: string;
+    controls: {
+        control_id: string;
+        title: string;
+        description: string;
+        regulatory_tags: string[];
+        predicates: {
+            kind: "event_count" | "event_exists" | "event_absent" | "aggregate";
+            expression: string;
+            threshold?: number | undefined;
+        }[];
+    }[];
+}>;
+export type ControlMapping = z.infer<typeof ControlMappingSchema>;
+//# sourceMappingURL=control-mapping.d.ts.map

package/dist/control-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-mapping.d.ts","sourceRoot":"","sources":["../src/control-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/control-mapping.js

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+const semver = z.string().regex(/^\d+\.\d+\.\d+$/);
+/**
+ * Control mapping — authored as signed YAML in the Control Mapping repo, but
+ * validated against this JSON Schema. Maps regulatory framework controls to the
+ * event-level predicates the Query API evaluates.
+ */
+export const ControlMappingSchema = z
+    .object({
+    mapping_version: semver,
+    framework: z.string(),
+    framework_version: z.string(),
+    published_at: z.string().datetime(),
+    controls: z.array(z
+        .object({
+        control_id: z.string(),
+        title: z.string(),
+        description: z.string(),
+        regulatory_tags: z.array(z.string().regex(/^[a-z0-9_]+$/)),
+        predicates: z.array(z
+            .object({
+            kind: z.enum(['event_count', 'event_exists', 'event_absent', 'aggregate']),
+            expression: z.string(),
+            threshold: z.number().optional(),
+        })
+            .strict()),
+    })
+        .strict()),
+})
+    .strict();
+//# sourceMappingURL=control-mapping.js.map

package/dist/control-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-mapping.js","sourceRoot":"","sources":["../src/control-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,eAAe,EAAE,MAAM;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,KAAK,CACf,CAAC;SACE,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC,CAAC,KAAK,CACjB,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;YAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC,CAAC;aACD,MAAM,EAAE,CACZ;KACF,CAAC;SACD,MAAM,EAAE,CACZ;CACF,CAAC;KACD,MAAM,EAAE,CAAC"}