enigma-memory 0.1.8 → 0.1.10

package/docs/developer-ecosystem.md

@@ -60,7 +60,7 @@ The example app prints ids, counts, roots, and verification status only. It does
 
 ## CLI and CI loop
 
-The CI example installs Node 24, installs the published `enigma-memory@0.1.8` package, runs:
+The CI example installs Node 24, installs the published `enigma-memory@0.1.10` package, runs:
 
 ```sh
 npx --yes --package enigma-memory enigma setup --overwrite

package/docs/hosted-cloud-product.md

@@ -10,13 +10,17 @@ The source package now has pure contract builders and validators in `packages/ho
 - tenant records;
 - hosted vault records;
 - API key metadata records;
+- API key lifecycle packets for issue/rotate/revoke/audit readiness;
 - usage billing records;
 - dashboard summaries;
 - backup drill records;
-- incident and SLA reference records.
+- incident and SLA reference records;
+- customer lifecycle packets that aggregate those surfaces for launch-readiness evidence.
 
 These functions are contract and validation code only. They do not call an auth provider, billing provider, cloud deployment, KMS, backup target, support desk, status page, SIEM, or model provider. They are safe to import as package code because they do not start servers, read user files, mutate deployment state, publish packages, or contact external accounts.
 
+The lifecycle packet public APIs are `buildCustomerLifecyclePacket(input)` / `validateCustomerLifecyclePacket(packet)` and `buildApiKeyLifecyclePacket(input)` / `validateApiKeyLifecyclePacket(packet)` under `enigma-memory/hosted-cloud`; the script commands below emit the same schemas for release evidence.
+
 The validators enforce hosted-cloud boundaries:
 
 - contract artifacts must include `operator_evidence_refs` for auth provider, billing provider, legal docs, data processing terms, support ownership, and external security review;
@@ -24,10 +28,11 @@ The validators enforce hosted-cloud boundaries:
 - raw memory, plaintext prompts, provider responses, transcripts, credential-looking values, token values, private keys, and API key secret material are rejected;
 - financial outcome claims, token ROI/profit claims, provider-side deletion claims, and model-forgetting claims are rejected;
 - API key contracts store identifiers, fingerprints, scopes, rotation refs, and timestamps only, not key material;
+- API key lifecycle packets store issue/rotate/revoke/audit evidence refs, event refs, fingerprints, opaque subjects, readiness status, and operator approval refs only; they reject raw key material, provider payloads, customer memory, plaintext prompts, credentials, ROI claims, provider-deletion claims, and model-forgetting claims;
 - hosted vault contracts are opaque-record and plaintext-minimized contracts only;
 - billing records remain contract records until an external billing provider invoice flow is wired.
 
-Every builder emits `readiness.contract_ready: true` and `readiness.integration_kind: "contract_validator_only"`. It also emits `readiness.hosted_cloud_sellable: false` because contract readiness is not provider wiring, legal approval, security review, or operator go-live approval.
+Individual surface builders emit `readiness.contract_ready: true`, `readiness.integration_kind: "contract_validator_only"`, and `readiness.hosted_cloud_sellable: false` because contract readiness is not provider wiring, legal approval, security review, or operator go-live approval. A customer lifecycle packet may only mark `hosted_cloud_sellable: true` when every lifecycle surface has a provided evidence ref and an explicit operator go-live approval ref is supplied; the packet remains evidence validation, not live hosted SaaS or provider wiring. An API key lifecycle packet keeps `customer_api_keys_live:false` by default and can become live-ready only when every required issue/rotate/revoke/audit evidence ref is provided and an operator approval ref is supplied. That live-ready state is still evidence validation only: it does not issue a customer API key, create a secret, call an auth provider, rotate/revoke a provider credential, or prove provider-side deletion.
 
 ## Externally blocked before hosted cloud can be sold
 
@@ -44,6 +49,20 @@ Hosted cloud remains blocked until an operator wires and records evidence for al
 
 A `provided` operator evidence ref means the contract can point to external evidence. It still does not by itself make hosted cloud sellable; an operator must complete the release checklist and issue go-live approval. A `blocked_external_dependency` ref is an explicit blocker, not fake evidence.
 
+## Customer lifecycle packet
+
+`npm run production:hosted-customer -- --tenant <id> --domain <domain> --environment <env> --out <file>` builds `enigma.hosted_cloud.customer_lifecycle_packet.v1` readiness evidence for a tenant launch packet. Operators may pass repeatable `--evidence-ref <key=status:ref>` values and `--operator-go-live-ref <ref>` when real external evidence exists. The command writes public-safe validation evidence only: it creates no hosted account, tenant, vault, API key, invoice, support ticket, backup, Cloudflare resource, provider resource, secret, or deployment.
+
+The lifecycle packet records lifecycle phases, required surfaces, external blockers, missing evidence refs, no-secret/no-plaintext guarantees, and the sellability gate. Missing surfaces, blocked evidence refs, or absent operator go-live approval keep `hosted_cloud_sellable:false`.
+
+## API key lifecycle packet
+
+`npm run production:hosted-api-key -- --tenant <id> --subject <opaque-subject-ref> --operation <issue|rotate|revoke|audit> --out <file>` builds `enigma.hosted_cloud.api_key_lifecycle_packet.v1` readiness evidence for one customer API key lifecycle operation. Operators may pass repeatable `--evidence-ref <phase=status:ref>` values for the phases required by that operation, plus `--operator-approval-ref <ref>` when a reviewed operator approval exists.
+
+The command writes public-safe validation evidence only. It must not receive or print raw API keys, bearer tokens, credentials, provider response bodies, plaintext prompts, raw memory, customer content, financial ROI claims, provider deletion claims, or model forgetting claims. It creates no hosted account, customer API key, provider secret, KMS key, rotation job, revocation job, audit export, invoice, support ticket, Cloudflare resource, provider resource, or deployment.
+
+The packet records lifecycle events, required evidence refs, missing evidence refs, malformed operation blockers, the operator approval ref, readiness status, `customer_api_keys_live`, and no-secret/no-plaintext guarantees. Missing evidence refs, blocked evidence refs, malformed operation surfaces, or absent operator approval keep `customer_api_keys_live:false`.
+
 ## Non-claims
 
 Hosted cloud collateral must not say or imply:

package/docs/sdk-api.md

@@ -1,6 +1,6 @@
 # SDK and API guide
 
-This guide covers the public package imports for `enigma-memory@0.1.8`. The SDK runs locally by default: vaults, passports, context packs, receipts, relay/gateway demo state, storage contracts, metering artifacts, and settlement artifacts are package-level developer surfaces. They are not evidence of hosted Enigma cloud, provider-side deletion, provider model forgetting, token ROI, invoice savings, compliance certification, or benchmark leadership.
+This guide covers the public package imports for `enigma-memory@0.1.10`. The SDK runs locally by default: vaults, passports, context packs, receipts, relay/gateway demo state, storage contracts, metering artifacts, settlement artifacts, and hosted-cloud contract packets are package-level developer surfaces. They are not evidence of hosted Enigma cloud, live customer API key issuance, provider-side deletion, provider model forgetting, token ROI, invoice savings, compliance certification, or benchmark leadership.
 
 ## Install and import style
 
@@ -157,6 +157,27 @@ const job = createPermissionlessMemoryJob({
 });
 ```
 
+### `enigma-memory/hosted-cloud`
+
+The hosted-cloud module emits public-safe contract/readiness evidence only. Customer API key lifecycle packets model issue, rotate, revoke, and audit readiness with evidence refs, opaque subject refs, fingerprints, missing-evidence refs, readiness status, and operator approval refs. They never contain raw key material, provider payloads, plaintext prompts, raw memory, credentials, ROI claims, provider deletion claims, or model forgetting claims.
+
+```js
+import {
+  buildApiKeyLifecyclePacket,
+  validateApiKeyLifecyclePacket,
+} from 'enigma-memory/hosted-cloud';
+
+const packet = buildApiKeyLifecyclePacket({
+  tenant_id: 'tenant-alpha',
+  subject_ref: 'subject-ref-alpha',
+  environment: 'production',
+  operation: 'audit',
+});
+const valid = validateApiKeyLifecyclePacket(packet);
+```
+
+`customer_api_keys_live` stays `false` unless the issue/rotate/revoke/audit evidence refs are complete and an operator approval ref is supplied. Even then, the packet is readiness evidence validation only; it does not issue a key, create a secret, call KMS or auth providers, rotate or revoke a provider credential, or prove provider-side deletion.
+
 ## Verifying exported proof
 
 Package consumers should verify exported bundles through the CLI or MCP verifier rather than importing source-only verifier internals. Treat full bundles as private unless you have reviewed and removed local import key material before sharing:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-memory",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "description": "Provider-agnostic AI memory passport and offline-verifiable proof layer.",
   "license": "Apache-2.0",
@@ -84,6 +84,8 @@
     "scripts/monitor-live-endpoints.mjs",
     "scripts/collect-hosted-backend-live-evidence.mjs",
     "scripts/build-hosted-probe-worker.mjs",
+    "scripts/build-hosted-customer-lifecycle.mjs",
+    "scripts/build-hosted-api-key-lifecycle.mjs",
     "scripts/build-edge-backend-workers.mjs",
     "scripts/validate-cloudflare-worker-inspect.mjs",
     "scripts/validate-production-manifests.mjs",
@@ -175,6 +177,8 @@
     "production:edge-deploy": "node scripts/deploy-edge-backend-workers.mjs",
     "production:edge-live": "node scripts/collect-edge-backend-bootstrap-evidence.mjs",
     "production:ref-draft": "node scripts/build-hosted-ref-draft.mjs",
+    "production:hosted-customer": "node scripts/build-hosted-customer-lifecycle.mjs",
+    "production:hosted-api-key": "node scripts/build-hosted-api-key-lifecycle.mjs",
     "production:storage-bootstrap": "node scripts/cloudflare-storage-bootstrap.mjs",
     "production:worker-inspect": "node scripts/validate-cloudflare-worker-inspect.mjs",
     "production:cloudflare-credentials": "node scripts/validate-cloudflare-credentials.mjs",