kcp-harness 0.1.0 → 0.4.0

package/dist/cli.js

@@ -14,6 +14,8 @@ import { dirname, join } from "node:path";
 import { loadConfig } from "./config.js";
 import { serveProxy } from "./proxy.js";
 import { generate, listAgents } from "./integrations/generate.js";
+import { exportEvidence } from "./export.js";
+import { DashboardServer } from "./dashboard/server.js";
 const USAGE = `kcp-harness — KCP Compliance Harness
 
 Usage:
@@ -22,6 +24,8 @@ Usage:
   kcp-harness check  [--config harness.yaml]   Validate configuration
   kcp-harness integrate <agent> [options]       Generate agent integration files
   kcp-harness integrate --list                  List supported agents
+  kcp-harness export   [options]               Export compliance evidence
+  kcp-harness dashboard [options]              Launch compliance dashboard
   kcp-harness --version                        Show version
   kcp-harness --help                           Show this help
 
@@ -32,7 +36,7 @@ governance for any agent. It intercepts tool calls, classifies them
 as knowledge-navigation or pass-through, and routes governed calls
 through the kcp-agent planner before execution.
 `;
-const VERSION = "0.1.0";
+const VERSION = "0.4.0";
 const TEMPLATE = `# kcp-harness configuration
 version: "1.0"
 
@@ -57,6 +61,9 @@ governance:
     #   currency: USDC
     # context_budget: 50000
     # env: prod
+    # signature_required: true
+    # trusted_keys:
+    #   - "./keys/manifest-key.pem"
 
 downstream:
   # - name: "filesystem"
@@ -161,6 +168,63 @@ async function main() {
             }
             break;
         }
+        case "export": {
+            const config = existsSync(configPath) ? loadConfig(configPath) : null;
+            const auditPath = getFlag(args, "--audit") ?? config?.audit.path ?? ".kcp-harness/audit.jsonl";
+            const outDir = getFlag(args, "--out") ?? "evidence";
+            const format = (getFlag(args, "--format") ?? "both");
+            const org = getFlag(args, "--org");
+            const from = getFlag(args, "--from");
+            const to = getFlag(args, "--to");
+            if (!existsSync(auditPath)) {
+                process.stderr.write(`[kcp-harness] audit log not found: ${auditPath}\n`);
+                process.exit(1);
+            }
+            try {
+                const result = await exportEvidence({
+                    auditPath,
+                    outputDir: outDir,
+                    format,
+                    organization: org,
+                    dateRange: from || to ? { from: from ?? "", to: to ?? "" } : undefined,
+                });
+                process.stderr.write(`[kcp-harness] exported ${result.files.length} files to ${result.outputDir}\n`);
+                process.stderr.write(`[kcp-harness]   ${result.summary.events} events, ${result.summary.sessions} sessions\n`);
+                for (const f of result.files) {
+                    process.stdout.write(`  ${f}\n`);
+                }
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                process.stderr.write(`[kcp-harness] export error: ${msg}\n`);
+                process.exit(1);
+            }
+            break;
+        }
+        case "dashboard": {
+            const config = existsSync(configPath) ? loadConfig(configPath) : null;
+            const auditPath = getFlag(args, "--audit") ?? config?.audit.path ?? ".kcp-harness/audit.jsonl";
+            const port = Number(getFlag(args, "--port") ?? "3847");
+            const host = getFlag(args, "--host") ?? "127.0.0.1";
+            if (!existsSync(auditPath)) {
+                process.stderr.write(`[kcp-harness] audit log not found: ${auditPath}\n`);
+                process.stderr.write(`[kcp-harness] the dashboard reads from the audit log — run the proxy first\n`);
+                process.exit(1);
+            }
+            const dashboard = new DashboardServer({ auditPath, port, host });
+            await dashboard.start();
+            process.stderr.write(`[kcp-harness] dashboard running at ${dashboard.getAddress()}\n`);
+            process.stderr.write(`[kcp-harness] watching ${auditPath} for live updates\n`);
+            // Keep running until SIGINT/SIGTERM
+            const shutdown = async () => {
+                process.stderr.write(`\n[kcp-harness] shutting down dashboard\n`);
+                await dashboard.stop();
+                process.exit(0);
+            };
+            process.on("SIGINT", shutdown);
+            process.on("SIGTERM", shutdown);
+            break;
+        }
         default:
             process.stderr.write(`[kcp-harness] unknown command: ${command}\n\n`);
             process.stdout.write(USAGE);

package/dist/config.d.ts

@@ -28,6 +28,10 @@ export interface GovernancePolicy {
     strict?: boolean;
     /** Environment for federation context selection (dev/test/staging/prod). */
     env?: string;
+    /** Require verified signatures on all manifests (default: false). */
+    signature_required?: boolean;
+    /** Trusted public keys for signature verification (paths, URLs, or inline). */
+    trusted_keys?: string[];
 }
 /** A downstream MCP server to proxy tool calls to. */
 export interface DownstreamConfig {

package/dist/config.js

@@ -60,6 +60,8 @@ function parsePolicy(raw) {
         max_units: p["max_units"] === undefined ? DEFAULT_POLICY.max_units : Number(p["max_units"]),
         strict: p["strict"] === true,
         env: p["env"] === undefined ? undefined : String(p["env"]),
+        signature_required: p["signature_required"] === true,
+        trusted_keys: Array.isArray(p["trusted_keys"]) ? p["trusted_keys"].map(String) : undefined,
     };
 }
 function parseBudget(raw) {

package/dist/dashboard/server.d.ts

@@ -0,0 +1,30 @@
+/** Dashboard server options. */
+export interface DashboardOptions {
+    /** Path to the audit JSONL log. */
+    auditPath: string;
+    /** HTTP port (default: 3847). */
+    port: number;
+    /** Bind host (default: 127.0.0.1 — localhost only). */
+    host: string;
+}
+/** Compliance dashboard HTTP server. */
+export declare class DashboardServer {
+    private server;
+    private tail;
+    private sseClients;
+    private readonly reader;
+    private readonly options;
+    constructor(options: DashboardOptions);
+    /** Start the dashboard server. */
+    start(): Promise<void>;
+    /** Stop the dashboard server. */
+    stop(): Promise<void>;
+    /** Get the server address. */
+    getAddress(): string;
+    private handleRequest;
+    private serveUI;
+    private serveSummary;
+    private serveSessions;
+    private serveEvents;
+    private serveSSE;
+}

package/dist/dashboard/server.js

@@ -0,0 +1,145 @@
+// Dashboard server — HTTP API + static UI over the audit log.
+//
+// Serves the compliance dashboard on localhost. No external dependencies
+// — uses Node's built-in http module. Binds to 127.0.0.1 by default
+// for security (no network exposure).
+import { createServer } from "node:http";
+import { AuditReader } from "../audit-reader.js";
+import { AuditTail } from "./tail.js";
+import { renderDashboard } from "./ui.js";
+/** Compliance dashboard HTTP server. */
+export class DashboardServer {
+    server = null;
+    tail = null;
+    sseClients = new Set();
+    reader;
+    options;
+    constructor(options) {
+        this.options = options;
+        this.reader = new AuditReader(options.auditPath);
+    }
+    /** Start the dashboard server. */
+    async start() {
+        this.server = createServer((req, res) => this.handleRequest(req, res));
+        // Start tailing for SSE
+        this.tail = new AuditTail(this.options.auditPath);
+        this.tail.on("line", (event) => {
+            const data = `data: ${JSON.stringify(event)}\n\n`;
+            for (const client of this.sseClients) {
+                try {
+                    client.write(data);
+                }
+                catch {
+                    this.sseClients.delete(client);
+                }
+            }
+        });
+        this.tail.start();
+        return new Promise((resolve) => {
+            this.server.listen(this.options.port, this.options.host, () => {
+                resolve();
+            });
+        });
+    }
+    /** Stop the dashboard server. */
+    async stop() {
+        this.tail?.stop();
+        for (const client of this.sseClients) {
+            try {
+                client.end();
+            }
+            catch { }
+        }
+        this.sseClients.clear();
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    /** Get the server address. */
+    getAddress() {
+        return `http://${this.options.host}:${this.options.port}`;
+    }
+    async handleRequest(req, res) {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        const path = url.pathname;
+        // CORS headers for localhost
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET");
+        try {
+            switch (path) {
+                case "/":
+                    return this.serveUI(res);
+                case "/api/summary":
+                    return await this.serveSummary(url, res);
+                case "/api/sessions":
+                    return await this.serveSessions(res);
+                case "/api/events":
+                    return await this.serveEvents(url, res);
+                case "/api/events/stream":
+                    return this.serveSSE(req, res);
+                default:
+                    res.writeHead(404, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "not found" }));
+            }
+        }
+        catch (e) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        }
+    }
+    serveUI(res) {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderDashboard());
+    }
+    async serveSummary(url, res) {
+        const filter = parseFilterParams(url);
+        const summary = await this.reader.summarize(filter);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(summary));
+    }
+    async serveSessions(res) {
+        const index = await this.reader.sessionIndex();
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(index));
+    }
+    async serveEvents(url, res) {
+        const filter = parseFilterParams(url);
+        const events = await this.reader.readAll(filter);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(events));
+    }
+    serveSSE(req, res) {
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive",
+        });
+        res.write("retry: 5000\n\n");
+        this.sseClients.add(res);
+        req.on("close", () => {
+            this.sseClients.delete(res);
+        });
+    }
+}
+/** Parse filter parameters from URL query string. */
+function parseFilterParams(url) {
+    const session = url.searchParams.get("session") ?? undefined;
+    const type = url.searchParams.get("type") ?? undefined;
+    const from = url.searchParams.get("from") ?? undefined;
+    const to = url.searchParams.get("to") ?? undefined;
+    const outcome = url.searchParams.get("outcome") ?? undefined;
+    if (!session && !type && !from && !to && !outcome)
+        return undefined;
+    return {
+        sessionId: session,
+        type: type,
+        from,
+        to,
+        outcome: outcome,
+    };
+}

package/dist/dashboard/tail.d.ts

@@ -0,0 +1,18 @@
+import type { AuditEvent } from "../audit.js";
+type TailHandler = (event: AuditEvent) => void;
+/** Tails an append-only JSONL audit log, emitting new events. */
+export declare class AuditTail {
+    private readonly path;
+    private handlers;
+    private offset;
+    private running;
+    constructor(path: string);
+    /** Register a handler for new events. */
+    on(_event: "line", handler: TailHandler): void;
+    /** Start tailing from the current end of file. */
+    start(): void;
+    /** Stop tailing. */
+    stop(): void;
+    private readNew;
+}
+export {};

package/dist/dashboard/tail.js

@@ -0,0 +1,77 @@
+// Audit log tail — watch for new events appended to the JSONL log.
+//
+// Uses fs.watch + readline to tail the audit log and emit parsed events.
+// Powers the SSE live-update endpoint in the dashboard.
+import { createReadStream, watchFile, unwatchFile, statSync } from "node:fs";
+import { createInterface } from "node:readline";
+/** Tails an append-only JSONL audit log, emitting new events. */
+export class AuditTail {
+    path;
+    handlers = [];
+    offset = 0;
+    running = false;
+    constructor(path) {
+        this.path = path;
+    }
+    /** Register a handler for new events. */
+    on(_event, handler) {
+        this.handlers.push(handler);
+    }
+    /** Start tailing from the current end of file. */
+    start() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            this.offset = statSync(this.path).size;
+        }
+        catch {
+            this.offset = 0;
+        }
+        watchFile(this.path, { interval: 1000 }, () => {
+            this.readNew();
+        });
+    }
+    /** Stop tailing. */
+    stop() {
+        this.running = false;
+        unwatchFile(this.path);
+    }
+    readNew() {
+        if (!this.running)
+            return;
+        let currentSize;
+        try {
+            currentSize = statSync(this.path).size;
+        }
+        catch {
+            return;
+        }
+        if (currentSize <= this.offset)
+            return;
+        const stream = createReadStream(this.path, {
+            encoding: "utf-8",
+            start: this.offset,
+        });
+        const rl = createInterface({ input: stream, crlfDelay: Infinity });
+        let newOffset = this.offset;
+        rl.on("line", (line) => {
+            newOffset += Buffer.byteLength(line, "utf-8") + 1; // +1 for newline
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            try {
+                const event = JSON.parse(trimmed);
+                for (const handler of this.handlers) {
+                    handler(event);
+                }
+            }
+            catch {
+                // Skip malformed lines
+            }
+        });
+        rl.on("close", () => {
+            this.offset = newOffset;
+        });
+    }
+}

package/dist/dashboard/ui.d.ts

@@ -0,0 +1 @@
+export declare function renderDashboard(): string;

package/dist/dashboard/ui.js

@@ -0,0 +1,193 @@
+// Dashboard UI — single-page HTML/CSS/JS served as a template string.
+//
+// No build step, no framework, no external dependencies. The dashboard
+// fetches data from the API endpoints and renders it in the browser.
+export function renderDashboard() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>KCP Harness — Compliance Dashboard</title>
+<style>
+  :root {
+    --bg: #0f1117; --surface: #1a1d27; --border: #2a2d3a;
+    --text: #e1e4ed; --muted: #8b8fa3; --accent: #e94560;
+    --green: #4ade80; --red: #f87171; --yellow: #fbbf24; --blue: #60a5fa;
+  }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); }
+  .container { max-width: 1200px; margin: 0 auto; padding: 20px; }
+  header { display: flex; align-items: center; gap: 16px; margin-bottom: 24px; border-bottom: 1px solid var(--border); padding-bottom: 16px; }
+  header h1 { font-size: 20px; font-weight: 600; }
+  header .badge { font-size: 11px; background: var(--accent); color: white; padding: 2px 8px; border-radius: 10px; }
+  .stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 12px; margin-bottom: 24px; }
+  .stat { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 16px; }
+  .stat .label { font-size: 12px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px; }
+  .stat .value { font-size: 28px; font-weight: 700; margin-top: 4px; }
+  .stat .value.green { color: var(--green); }
+  .stat .value.red { color: var(--red); }
+  .stat .value.yellow { color: var(--yellow); }
+  .stat .value.blue { color: var(--blue); }
+  .panel { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; margin-bottom: 16px; }
+  .panel-header { padding: 12px 16px; border-bottom: 1px solid var(--border); display: flex; justify-content: space-between; align-items: center; }
+  .panel-header h2 { font-size: 14px; font-weight: 600; }
+  .panel-body { padding: 0; max-height: 500px; overflow-y: auto; }
+  table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  th { text-align: left; padding: 8px 16px; color: var(--muted); font-weight: 500; font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; position: sticky; top: 0; background: var(--surface); }
+  td { padding: 8px 16px; border-top: 1px solid var(--border); }
+  .outcome { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: 11px; font-weight: 600; }
+  .outcome-approved { background: rgba(74,222,128,0.15); color: var(--green); }
+  .outcome-blocked { background: rgba(248,113,113,0.15); color: var(--red); }
+  .outcome-pass-through { background: rgba(96,165,250,0.15); color: var(--blue); }
+  .outcome-error { background: rgba(251,191,36,0.15); color: var(--yellow); }
+  .type-badge { font-size: 11px; color: var(--muted); }
+  .live-dot { width: 8px; height: 8px; border-radius: 50%; background: var(--green); display: inline-block; animation: pulse 2s infinite; }
+  @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.3; } }
+  .filters { display: flex; gap: 8px; align-items: center; }
+  .filters select, .filters input { background: var(--bg); border: 1px solid var(--border); color: var(--text); padding: 4px 8px; border-radius: 4px; font-size: 12px; }
+  .sessions-list { list-style: none; }
+  .sessions-list li { padding: 10px 16px; border-top: 1px solid var(--border); display: flex; justify-content: space-between; align-items: center; }
+  .sessions-list li:first-child { border-top: none; }
+  .session-id { font-family: monospace; font-size: 12px; color: var(--blue); cursor: pointer; }
+  .session-meta { font-size: 11px; color: var(--muted); }
+  footer { text-align: center; color: var(--muted); font-size: 11px; margin-top: 24px; padding: 16px; }
+</style>
+</head>
+<body>
+<div class="container">
+  <header>
+    <h1>KCP Harness</h1>
+    <span class="badge">Compliance Dashboard</span>
+    <span style="margin-left:auto;font-size:12px;color:var(--muted)"><span class="live-dot"></span> Live</span>
+  </header>
+
+  <div class="stats" id="stats">
+    <div class="stat"><div class="label">Sessions</div><div class="value blue" id="s-sessions">-</div></div>
+    <div class="stat"><div class="label">Events</div><div class="value" id="s-events">-</div></div>
+    <div class="stat"><div class="label">Governed</div><div class="value green" id="s-governed">-</div></div>
+    <div class="stat"><div class="label">Blocked</div><div class="value red" id="s-blocked">-</div></div>
+    <div class="stat"><div class="label">Budget Exceeded</div><div class="value yellow" id="s-budget">-</div></div>
+    <div class="stat"><div class="label">Drifts</div><div class="value yellow" id="s-drifts">-</div></div>
+    <div class="stat"><div class="label">Sig. Blocked</div><div class="value red" id="s-sig">-</div></div>
+  </div>
+
+  <div class="panel">
+    <div class="panel-header">
+      <h2>Sessions</h2>
+    </div>
+    <div class="panel-body">
+      <ul class="sessions-list" id="sessions-list"></ul>
+    </div>
+  </div>
+
+  <div class="panel">
+    <div class="panel-header">
+      <h2>Event Log</h2>
+      <div class="filters">
+        <select id="f-type"><option value="">All types</option>
+          <option value="tool_call">tool_call</option>
+          <option value="session_start">session_start</option>
+          <option value="session_end">session_end</option>
+          <option value="budget_spend">budget_spend</option>
+          <option value="budget_exceeded">budget_exceeded</option>
+          <option value="temporal_drift">temporal_drift</option>
+        </select>
+        <select id="f-outcome"><option value="">All outcomes</option>
+          <option value="approved">approved</option>
+          <option value="blocked">blocked</option>
+          <option value="pass-through">pass-through</option>
+          <option value="error">error</option>
+        </select>
+      </div>
+    </div>
+    <div class="panel-body">
+      <table>
+        <thead><tr><th>Time</th><th>Session</th><th>Type</th><th>Tool</th><th>Outcome</th><th>Reason</th></tr></thead>
+        <tbody id="events-body"></tbody>
+      </table>
+    </div>
+  </div>
+
+  <footer>kcp-harness compliance dashboard &middot; all data local &middot; no external connections</footer>
+</div>
+
+<script>
+const API = '';
+let allEvents = [];
+
+async function load() {
+  const [summary, sessions, events] = await Promise.all([
+    fetch(API + '/api/summary').then(r => r.json()),
+    fetch(API + '/api/sessions').then(r => r.json()),
+    fetch(API + '/api/events').then(r => r.json()),
+  ]);
+  updateStats(summary);
+  renderSessions(sessions.sessions || []);
+  allEvents = events;
+  renderEvents(events);
+}
+
+function updateStats(s) {
+  document.getElementById('s-sessions').textContent = s.sessions ?? 0;
+  document.getElementById('s-events').textContent = s.events ?? 0;
+  document.getElementById('s-governed').textContent = s.governed ?? 0;
+  document.getElementById('s-blocked').textContent = s.blocked ?? 0;
+  document.getElementById('s-budget').textContent = s.budgetExceeded ?? 0;
+  document.getElementById('s-drifts').textContent = s.drifts ?? 0;
+  document.getElementById('s-sig').textContent = s.signatureBlocked ?? 0;
+}
+
+function renderSessions(sessions) {
+  const ul = document.getElementById('sessions-list');
+  if (!sessions.length) { ul.innerHTML = '<li style="color:var(--muted)">No sessions yet</li>'; return; }
+  ul.innerHTML = sessions.map(s =>
+    '<li><div><span class="session-id" onclick="filterSession(\\'' + s.id + '\\')">' + s.id.slice(0,12) + '</span>' +
+    '<div class="session-meta">' + s.events + ' events, ' + s.governed + ' governed, ' + s.blocked + ' blocked</div></div>' +
+    '<div class="session-meta">' + new Date(s.startedAt).toLocaleString() + '</div></li>'
+  ).join('');
+}
+
+function renderEvents(events) {
+  const type = document.getElementById('f-type').value;
+  const outcome = document.getElementById('f-outcome').value;
+  let filtered = events;
+  if (type) filtered = filtered.filter(e => e.type === type);
+  if (outcome) filtered = filtered.filter(e => e.outcome === outcome);
+  const last200 = filtered.slice(-200);
+  const tbody = document.getElementById('events-body');
+  tbody.innerHTML = last200.map(e =>
+    '<tr><td style="font-size:11px;white-space:nowrap">' + new Date(e.timestamp).toLocaleTimeString() + '</td>' +
+    '<td style="font-family:monospace;font-size:11px">' + (e.sessionId||'').slice(0,8) + '</td>' +
+    '<td><span class="type-badge">' + e.type + '</span></td>' +
+    '<td>' + (e.toolCall?.name || '-') + '</td>' +
+    '<td><span class="outcome outcome-' + e.outcome + '">' + e.outcome + '</span></td>' +
+    '<td style="font-size:11px;max-width:300px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">' + (e.governance?.reason || e.error || e.type) + '</td></tr>'
+  ).join('');
+}
+
+function filterSession(id) {
+  const filtered = allEvents.filter(e => e.sessionId === id);
+  renderEvents(filtered);
+}
+
+document.getElementById('f-type').onchange = () => renderEvents(allEvents);
+document.getElementById('f-outcome').onchange = () => renderEvents(allEvents);
+
+// SSE live updates
+const sse = new EventSource(API + '/api/events/stream');
+sse.onmessage = (msg) => {
+  try {
+    const event = JSON.parse(msg.data);
+    allEvents.push(event);
+    renderEvents(allEvents);
+    fetch(API + '/api/summary').then(r => r.json()).then(updateStats);
+  } catch {}
+};
+sse.onerror = () => {};
+
+load();
+</script>
+</body>
+</html>`;
+}

package/dist/export.d.ts

@@ -0,0 +1,28 @@
+import { type AuditSummary } from "./audit-reader.js";
+/** Export configuration. */
+export interface ExportOptions {
+    /** Path to the audit JSONL log. */
+    auditPath: string;
+    /** Output directory for evidence bundles. */
+    outputDir: string;
+    /** Which framework(s) to export. */
+    format: "soc2" | "iso27001" | "both";
+    /** Optional date range filter. */
+    dateRange?: {
+        from: string;
+        to: string;
+    };
+    /** Organization name for the report header. */
+    organization?: string;
+}
+/** Result of an export operation. */
+export interface ExportResult {
+    /** Output directory. */
+    outputDir: string;
+    /** Files created. */
+    files: string[];
+    /** Summary statistics. */
+    summary: AuditSummary;
+}
+/** Export compliance evidence from the audit log. */
+export declare function exportEvidence(options: ExportOptions): Promise<ExportResult>;