monora-ai 1.0.1 → 1.3.0

package/dist/attestation.js

@@ -41,6 +41,7 @@ exports.serializeReport = serializeReport;
 exports.computeSha256 = computeSha256;
 exports.signReportGpg = signReportGpg;
 exports.buildAttestationBundle = buildAttestationBundle;
+exports.extractComplianceSummary = extractComplianceSummary;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -114,19 +115,103 @@ function signReportGpg(reportBytes, options) {
         }
     }
 }
-function buildAttestationBundle(report, reportBytes, signature) {
-    return {
-        bundle_version: '1.0.0',
+/**
+ * Build attestation bundle with optional chain proof (v2.0.0 format).
+ *
+ * @param report - Compliance report
+ * @param reportBytes - Serialized report
+ * @param signature - Optional GPG signature
+ * @param options - Optional v2.0.0 fields (chainProof, eventsDigest, traceInfo, events)
+ * @returns Trust proof bundle (v2.0.0 format if chainProof provided, v1.0.0 otherwise)
+ */
+function buildAttestationBundle(report, reportBytes, signature, options) {
+    const isTrustProof = options?.chainProof != null;
+    const bundleVersion = isTrustProof ? '2.0.0' : '1.0.0';
+    const bundleType = isTrustProof ? 'trust_proof' : 'compliance_report';
+    const bundle = {
+        bundle_version: bundleVersion,
+        bundle_type: bundleType,
         generated_at: new Date().toISOString(),
-        report_sha256: computeSha256(reportBytes),
-        report_json: reportBytes.toString('utf-8'),
-        signature: {
-            type: signature.signature_type,
-            value: signature.signature,
-            key_id: signature.key_id,
-            fingerprint: signature.fingerprint,
-            signed_at: new Date().toISOString(),
-        },
+    };
+    // Add trace info (v2.0.0 only)
+    if (options?.traceInfo) {
+        bundle.trace_info = options.traceInfo;
+    }
+    // Add chain proof (v2.0.0 only)
+    if (options?.chainProof) {
+        bundle.chain_proof = options.chainProof;
+    }
+    // Add events digest (v2.0.0 only)
+    if (options?.eventsDigest) {
+        bundle.events_digest = options.eventsDigest;
+    }
+    // Embed raw events if provided (v2.0.0 only)
+    if (options?.events) {
+        bundle.events = options.events;
+    }
+    // Add compliance summary (v2.0.0 only)
+    if (isTrustProof) {
+        bundle.compliance_summary = extractComplianceSummary(report);
+    }
+    // Add report artifacts (v2.0.0 only)
+    if (isTrustProof) {
+        bundle.report_artifacts = report.artifacts || [];
+    }
+    // v1.0.0 format (backward compatibility)
+    if (!isTrustProof) {
+        bundle.report_sha256 = computeSha256(reportBytes);
+        bundle.report_json = reportBytes.toString('utf-8');
+    }
+    // Add signature if provided
+    if (signature) {
+        if (isTrustProof) {
+            // For v2.0.0, compute signature over entire bundle (excluding signature itself)
+            const payload = {};
+            for (const [key, value] of Object.entries(bundle)) {
+                if (key !== 'signature') {
+                    payload[key] = value;
+                }
+            }
+            const payloadBytes = serializeReport(payload);
+            const payloadSha = computeSha256(payloadBytes);
+            bundle.signature = {
+                type: signature.signature_type,
+                value: signature.signature,
+                key_id: signature.key_id,
+                fingerprint: signature.fingerprint,
+                signed_at: new Date().toISOString(),
+                signed_payload_sha256: payloadSha,
+            };
+        }
+        else {
+            // v1.0.0 format
+            bundle.signature = {
+                type: signature.signature_type,
+                value: signature.signature,
+                key_id: signature.key_id,
+                fingerprint: signature.fingerprint,
+                signed_at: new Date().toISOString(),
+            };
+        }
+    }
+    return bundle;
+}
+/**
+ * Extract key compliance metrics for bundle.
+ *
+ * @param report - Full compliance report
+ * @returns Compact compliance summary
+ */
+function extractComplianceSummary(report) {
+    const modelCompliance = report.model_compliance || {};
+    const violations = report.violations || [];
+    const tokenUsage = report.token_usage || {};
+    return {
+        policy_violations: Array.isArray(violations) ? violations.length : 0,
+        data_handling_issues: 0, // TODO: Extract from data handling events
+        unknown_models: modelCompliance.unknown_models_used || [],
+        forbidden_models_blocked: (modelCompliance.forbidden_models_blocked || []).length,
+        total_tokens: tokenUsage.total_tokens || 0,
     };
 }
 function findGpg() {

package/dist/cli.js

@@ -43,8 +43,10 @@ const readline = __importStar(require("readline"));
 const yaml = __importStar(require("js-yaml"));
 const config_1 = require("./config");
 const report_1 = require("./report");
+const ai_act_report_1 = require("./ai_act_report");
 const security_report_1 = require("./security_report");
 const attestation_1 = require("./attestation");
+const trust_package_1 = require("./trust_package");
 const diagnostics_1 = require("./cli/diagnostics");
 function usage() {
     console.log('Usage:');
@@ -53,6 +55,8 @@ function usage() {
     console.log('  monora doctor [--config monora.yml] [--json] [--no-network]');
     console.log('  monora report --input <events.jsonl> --output <report.json> [--format json|markdown] [--config monora.yml]');
     console.log('  monora security-review --input <events.jsonl> --output <security.json> [--config monora.yml] [--sign gpg --gpg-key <id> --bundle <bundle.json>]');
+    console.log('  monora trust-package --input <events.jsonl> --trace-id <trace_id> --output <trust.json> [--config monora.yml] [--sign gpg --gpg-key <id>]');
+    console.log('  monora ai-act-report --input <events.jsonl> --output <report.json> [--format json|markdown] [--config monora.yml]');
 }
 function parseArgs(argv) {
     const args = argv.slice(2);
@@ -319,6 +323,29 @@ function parseSecurityReviewOptions(args) {
         bundle: getFlagValue(args, '--bundle'),
     };
 }
+function parseTrustPackageOptions(args) {
+    return {
+        input: getFlagValue(args, '--input'),
+        traceId: getFlagValue(args, '--trace-id'),
+        output: getFlagValue(args, '--output'),
+        config: getFlagValue(args, '--config'),
+        sign: getFlagValue(args, '--sign') || undefined,
+        gpgKey: getFlagValue(args, '--gpg-key'),
+        gpgHome: getFlagValue(args, '--gpg-home'),
+    };
+}
+function parseAIActReportOptions(args) {
+    const input = getFlagValue(args, '--input');
+    const output = getFlagValue(args, '--output');
+    const format = getFlagValue(args, '--format') || 'json';
+    const config = getFlagValue(args, '--config');
+    return {
+        input,
+        output,
+        format: format === 'markdown' ? 'markdown' : 'json',
+        config,
+    };
+}
 async function runReport(options) {
     if (!options.input || !options.output) {
         usage();
@@ -335,6 +362,17 @@ async function runReport(options) {
     }
     console.log(`Report generated: ${options.output}`);
 }
+async function runAIActReport(options) {
+    if (!options.input || !options.output) {
+        usage();
+        process.exit(1);
+    }
+    const events = (0, report_1.loadJsonl)(options.input);
+    const config = options.config ? (0, config_1.loadConfig)({ configPath: options.config }) : (0, config_1.loadConfig)();
+    const report = (0, ai_act_report_1.buildAIActReport)(events, config);
+    (0, ai_act_report_1.writeAIActReport)(report, options.output, options.format);
+    console.log(`AI Act transparency report generated: ${options.output}`);
+}
 async function runSecurityReview(options) {
     if (!options.input || !options.output) {
         usage();
@@ -369,6 +407,34 @@ async function runSecurityReview(options) {
     }
     console.log(`Security review report generated: ${options.output}`);
 }
+async function runTrustPackage(options) {
+    if (!options.input || !options.output || !options.traceId) {
+        usage();
+        process.exit(1);
+    }
+    const events = (0, report_1.loadJsonl)(options.input);
+    const config = options.config ? (0, config_1.loadConfig)({ configPath: options.config }) : (0, config_1.loadConfig)();
+    let trustPackage = (0, trust_package_1.buildTrustPackage)(options.traceId, events, config);
+    if (options.sign) {
+        if (options.sign !== 'gpg') {
+            console.error(`Unsupported signing type: ${options.sign}`);
+            process.exit(1);
+        }
+        try {
+            trustPackage = (0, trust_package_1.applyGpgSignature)(trustPackage, {
+                gpgKey: options.gpgKey,
+                gpgHome: options.gpgHome,
+            });
+        }
+        catch (error) {
+            const message = error instanceof attestation_1.AttestationError ? error.message : String(error);
+            console.error(`Signing failed: ${message}`);
+            process.exit(1);
+        }
+    }
+    (0, trust_package_1.writeTrustPackage)(options.output, trustPackage);
+    console.log(`Trust package generated: ${options.output}`);
+}
 async function runValidate(args) {
     const configPath = getFlagValue(args, '--config') || 'monora.yml';
     const asJson = hasFlag(args, '--json');
@@ -434,6 +500,14 @@ async function main() {
         await runSecurityReview(parseSecurityReviewOptions(parsed.args));
         return;
     }
+    if (parsed.command === 'trust-package') {
+        await runTrustPackage(parseTrustPackageOptions(parsed.args));
+        return;
+    }
+    if (parsed.command === 'ai-act-report') {
+        await runAIActReport(parseAIActReportOptions(parsed.args));
+        return;
+    }
     usage();
 }
 main().catch((err) => {

package/dist/config.d.ts

@@ -17,6 +17,17 @@ export interface MonoraConfig {
         enabled?: boolean;
         scope?: 'per_trace' | 'global';
         hash_algorithm?: string;
+        verify_on_emit?: boolean;
+        verify_on_shutdown?: boolean;
+        persist_chain?: boolean;
+    };
+    attestation?: {
+        enabled?: boolean;
+        gpg?: {
+            enabled?: boolean;
+            key_id?: string;
+            gpg_home?: string;
+        };
     };
     registry?: any;
     instrumentation?: {
@@ -26,6 +37,16 @@ export interface MonoraConfig {
         data_classification?: string;
         reason?: string;
         fail_fast?: boolean;
+        log_report?: boolean;
+    };
+    reporting?: {
+        enabled?: boolean;
+        emit_trust_summary?: boolean;
+        output_dir?: string;
+        formats?: string[];
+        include_security_report?: boolean;
+        max_events_per_trace?: number;
+        redact_host?: boolean;
     };
     data_handling?: {
         enabled?: boolean;
@@ -59,6 +80,29 @@ export interface MonoraConfig {
         flush_interval_sec?: number;
         queue_full_timeout_sec?: number | null;
     };
+    wal?: {
+        enabled?: boolean;
+        path?: string;
+        sync_mode?: 'fsync' | 'async' | 'none';
+        max_file_size_mb?: number;
+        retention_hours?: number;
+        recovery_on_startup?: boolean;
+    };
+    signing?: {
+        enabled?: boolean;
+        algorithm?: 'ed25519' | 'hmac-sha256';
+        key_id?: string | null;
+        key_file?: string | null;
+        key_env?: string;
+    };
+    ai_act?: {
+        enabled?: boolean;
+        organization_name?: string | null;
+        contact_email?: string | null;
+        default_risk_category?: 'minimal' | 'limited' | 'high' | 'unacceptable';
+        generate_transparency_report?: boolean;
+        transparency_report_formats?: string[];
+    };
 }
 export declare function loadConfig(options?: {
     configPath?: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE;QACT,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC,CAAC;IACH,YAAY,CAAC,EAAE;QACb,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QAChD,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;QAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxC,CAAC;CACH;AA4ED,wBAAgB,UAAU,CAAC,OAAO,CAAC,EAAE;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,YAAY,CA0Bf"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE;QACT,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC,CAAC;IACH,YAAY,CAAC,EAAE;QACb,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,GAAG,CAAC,EAAE;YACJ,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;KACf,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QAChD,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;QAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxC,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;QACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,SAAS,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;QACtC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,qBAAqB,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,cAAc,CAAC;QACxE,4BAA4B,CAAC,EAAE,OAAO,CAAC;QACvC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC;CACH;AA4GD,wBAAgB,UAAU,CAAC,OAAO,CAAC,EAAE;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,YAAY,CA0Bf"}

package/dist/config.js

@@ -71,6 +71,15 @@ const DEFAULT_CONFIG = {
         reason: undefined,
         fail_fast: false,
     },
+    reporting: {
+        enabled: true,
+        emit_trust_summary: true,
+        output_dir: './monora_reports',
+        formats: ['json'],
+        include_security_report: false,
+        max_events_per_trace: 10000,
+        redact_host: true,
+    },
     data_handling: {
         enabled: false,
         mode: 'redact',
@@ -111,6 +120,29 @@ const DEFAULT_CONFIG = {
         flush_interval_sec: 1.0,
         queue_full_timeout_sec: null,
     },
+    wal: {
+        enabled: false,
+        path: './monora_wal',
+        sync_mode: 'fsync',
+        max_file_size_mb: 100,
+        retention_hours: 24,
+        recovery_on_startup: true,
+    },
+    signing: {
+        enabled: false,
+        algorithm: 'ed25519',
+        key_id: null,
+        key_file: null,
+        key_env: 'MONORA_SIGNING_KEY',
+    },
+    ai_act: {
+        enabled: false,
+        organization_name: null,
+        contact_email: null,
+        default_risk_category: 'limited',
+        generate_transparency_report: true,
+        transparency_report_formats: ['json'],
+    },
 };
 function loadConfig(options) {
     const { configPath, configDict, envPrefix = 'MONORA_' } = options || {};
@@ -171,9 +203,17 @@ function envKeyToPath(key) {
     if (parts.length >= 2 && parts[0] === 'ERROR' && parts[1] === 'HANDLING') {
         return ['error_handling', ...parts.slice(2).map((p) => p.toLowerCase())];
     }
-    const root = parts[0].toLowerCase();
-    const rest = parts.slice(1);
-    const path = [root];
+    const upperKey = key.toUpperCase();
+    let rest = parts.slice(1);
+    const path = [];
+    if (upperKey.startsWith('AI_ACT') ||
+        (parts.length >= 2 && parts[0] === 'AI' && parts[1] === 'ACT')) {
+        path.push('ai_act');
+        rest = parts.slice(2);
+    }
+    else {
+        path.push(parts[0].toLowerCase());
+    }
     const buffer = [];
     for (const part of rest) {
         if (/^\d+$/.test(part)) {

package/dist/context.d.ts

@@ -14,6 +14,8 @@ export interface TraceContext {
     stepCounter: number;
     eventCounter: number;
 }
+type TraceCompletionHandler = (span: Span) => void | Promise<void>;
+export declare function registerTraceCompletionHandler(handler: TraceCompletionHandler): () => void;
 export declare function getCurrentContext(): TraceContext | undefined;
 export declare function getCurrentSpan(): Span | null;
 export declare function pushSpan(span: Span): void;
@@ -29,4 +31,52 @@ export declare function traceAsync<T>(name: string, fn: (span: Span) => Promise<
 export declare function startSpan(name: string, metadata?: Record<string, any>): Span;
 export declare function nextStepNumber(): number;
 export declare function nextEventSequence(): number | null;
+/**
+ * Capture the current trace context for later use.
+ *
+ * This is useful for preserving context across async boundaries like
+ * setTimeout, setInterval, EventEmitter callbacks, or worker threads.
+ *
+ * @returns The current trace context, or undefined if no trace is active.
+ */
+export declare function captureContext(): TraceContext | undefined;
+/**
+ * Run a function within a specific trace context.
+ *
+ * This allows executing code as if it were inside a particular trace,
+ * even when called from outside that trace's async chain.
+ *
+ * @param ctx The trace context to run within (or undefined for no context).
+ * @param fn The function to execute.
+ * @returns The result of the function.
+ */
+export declare function runInContext<T>(ctx: TraceContext | undefined, fn: () => T): T;
+/**
+ * Bind a function to the current trace context.
+ *
+ * The returned function, when called, will execute within the captured
+ * trace context regardless of where it's called from. This is essential
+ * for preserving trace context through:
+ * - setTimeout/setInterval callbacks
+ * - EventEmitter handlers
+ * - process.nextTick/setImmediate callbacks
+ * - Any other async scheduling mechanism
+ *
+ * @example
+ * ```typescript
+ * trace('my-workflow', async (span) => {
+ *   const boundCallback = bindContext(() => {
+ *     // getCurrentSpan() will return the correct span here
+ *     logEvent('delayed_action', { data: 'test' });
+ *   });
+ *
+ *   setTimeout(boundCallback, 1000);
+ * });
+ * ```
+ *
+ * @param fn The function to bind to the current context.
+ * @returns A wrapped function that will execute in the captured context.
+ */
+export declare function bindContext<T extends (...args: any[]) => any>(fn: T): T;
+export {};
 //# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD,wBAAgB,iBAAiB,IAAI,YAAY,GAAG,SAAS,CAE5D;AAED,wBAAgB,cAAc,IAAI,IAAI,GAAG,IAAI,CAG5C;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAYzC;AAED,wBAAgB,OAAO,IAAI,IAAI,GAAG,IAAI,CAiBrC;AAED,wBAAgB,KAAK,CAAC,CAAC,EACrB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,EACrB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAC7D,CAAC,CAkBH;AAED,wBAAsB,UAAU,CAAC,CAAC,EAChC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAC9B,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,CAAC,CAAC,CAkBZ;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAe5E;AAED,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAOjD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD,KAAK,sBAAsB,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAGnE,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,sBAAsB,GAC9B,MAAM,IAAI,CAGZ;AAED,wBAAgB,iBAAiB,IAAI,YAAY,GAAG,SAAS,CAE5D;AAED,wBAAgB,cAAc,IAAI,IAAI,GAAG,IAAI,CAG5C;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAYzC;AAED,wBAAgB,OAAO,IAAI,IAAI,GAAG,IAAI,CAiBrC;AAED,wBAAgB,KAAK,CAAC,CAAC,EACrB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,EACrB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAC7D,CAAC,CA+BH;AAED,wBAAsB,UAAU,CAAC,CAAC,EAChC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAC9B,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAe5E;AAED,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAOjD;AA+BD;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,YAAY,GAAG,SAAS,CAEzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAK7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAQvE"}

package/dist/context.js

@@ -3,6 +3,7 @@
  * Trace context propagation using AsyncLocalStorage.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerTraceCompletionHandler = registerTraceCompletionHandler;
 exports.getCurrentContext = getCurrentContext;
 exports.getCurrentSpan = getCurrentSpan;
 exports.pushSpan = pushSpan;
@@ -12,10 +13,18 @@ exports.traceAsync = traceAsync;
 exports.startSpan = startSpan;
 exports.nextStepNumber = nextStepNumber;
 exports.nextEventSequence = nextEventSequence;
+exports.captureContext = captureContext;
+exports.runInContext = runInContext;
+exports.bindContext = bindContext;
 const async_hooks_1 = require("async_hooks");
 const ids_1 = require("./ids");
 // AsyncLocalStorage for Node.js context propagation
 const asyncLocalStorage = new async_hooks_1.AsyncLocalStorage();
+const traceCompletionHandlers = new Set();
+function registerTraceCompletionHandler(handler) {
+    traceCompletionHandlers.add(handler);
+    return () => traceCompletionHandlers.delete(handler);
+}
 function getCurrentContext() {
     return asyncLocalStorage.getStore();
 }
@@ -62,7 +71,21 @@ function trace(name, fn, options) {
         stepCounter: 0,
         eventCounter: 0,
     };
-    return asyncLocalStorage.run(ctx, () => fn(span));
+    return asyncLocalStorage.run(ctx, () => {
+        let result;
+        try {
+            result = fn(span);
+        }
+        catch (error) {
+            runTraceCompletionHandlersSync(span);
+            throw error;
+        }
+        if (isPromise(result)) {
+            return result.finally(() => runTraceCompletionHandlers(span));
+        }
+        runTraceCompletionHandlersSync(span);
+        return result;
+    });
 }
 async function traceAsync(name, fn, options) {
     const rootTraceId = options?.traceId || (0, ids_1.generateUlid)('trc');
@@ -79,7 +102,14 @@ async function traceAsync(name, fn, options) {
         stepCounter: 0,
         eventCounter: 0,
     };
-    return asyncLocalStorage.run(ctx, () => fn(span));
+    return asyncLocalStorage.run(ctx, async () => {
+        try {
+            return await fn(span);
+        }
+        finally {
+            await runTraceCompletionHandlers(span);
+        }
+    });
 }
 function startSpan(name, metadata) {
     const current = getCurrentSpan();
@@ -111,3 +141,93 @@ function nextEventSequence() {
     ctx.eventCounter += 1;
     return ctx.eventCounter;
 }
+function runTraceCompletionHandlersSync(span) {
+    for (const handler of traceCompletionHandlers) {
+        try {
+            const result = handler(span);
+            if (result && typeof result.then === 'function') {
+                result.catch((error) => {
+                    console.error(`Monora: trace completion handler failed: ${error}`);
+                });
+            }
+        }
+        catch (error) {
+            console.error(`Monora: trace completion handler failed: ${error}`);
+        }
+    }
+}
+async function runTraceCompletionHandlers(span) {
+    for (const handler of traceCompletionHandlers) {
+        try {
+            await handler(span);
+        }
+        catch (error) {
+            console.error(`Monora: trace completion handler failed: ${error}`);
+        }
+    }
+}
+function isPromise(value) {
+    return value && typeof value.then === 'function';
+}
+/**
+ * Capture the current trace context for later use.
+ *
+ * This is useful for preserving context across async boundaries like
+ * setTimeout, setInterval, EventEmitter callbacks, or worker threads.
+ *
+ * @returns The current trace context, or undefined if no trace is active.
+ */
+function captureContext() {
+    return asyncLocalStorage.getStore();
+}
+/**
+ * Run a function within a specific trace context.
+ *
+ * This allows executing code as if it were inside a particular trace,
+ * even when called from outside that trace's async chain.
+ *
+ * @param ctx The trace context to run within (or undefined for no context).
+ * @param fn The function to execute.
+ * @returns The result of the function.
+ */
+function runInContext(ctx, fn) {
+    if (!ctx) {
+        return fn();
+    }
+    return asyncLocalStorage.run(ctx, fn);
+}
+/**
+ * Bind a function to the current trace context.
+ *
+ * The returned function, when called, will execute within the captured
+ * trace context regardless of where it's called from. This is essential
+ * for preserving trace context through:
+ * - setTimeout/setInterval callbacks
+ * - EventEmitter handlers
+ * - process.nextTick/setImmediate callbacks
+ * - Any other async scheduling mechanism
+ *
+ * @example
+ * ```typescript
+ * trace('my-workflow', async (span) => {
+ *   const boundCallback = bindContext(() => {
+ *     // getCurrentSpan() will return the correct span here
+ *     logEvent('delayed_action', { data: 'test' });
+ *   });
+ *
+ *   setTimeout(boundCallback, 1000);
+ * });
+ * ```
+ *
+ * @param fn The function to bind to the current context.
+ * @returns A wrapped function that will execute in the captured context.
+ */
+function bindContext(fn) {
+    const captured = captureContext();
+    if (!captured) {
+        return fn;
+    }
+    return ((...args) => {
+        return runInContext(captured, () => fn(...args));
+    });
+}

package/dist/events.d.ts

@@ -10,6 +10,11 @@ export declare class EventBuilder {
         dataClassification?: string;
         purpose?: string;
         reason?: string;
+        parentEventId?: string;
+        inputEventIds?: string[];
+        promptId?: string;
+        templateId?: string;
+        dataSourceIds?: string[];
     }): Record<string, any>;
 }
 //# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA6ExC,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,SAAS,CAAa;gBAElB,MAAM,EAAE,YAAY;IAWhC,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,CAAC,EAAE;QACR,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GACA,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CA4BvB"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAqFxC,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,SAAS,CAAa;gBAElB,MAAM,EAAE,YAAY;IAWhC,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,CAAC,EAAE;QACR,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,GACA,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CA4CvB"}

package/dist/events.js

@@ -40,6 +40,7 @@ exports.EventBuilder = void 0;
 const os = __importStar(require("os"));
 const context_1 = require("./context");
 const ids_1 = require("./ids");
+const lineage_1 = require("./lineage");
 class TimestampEnricher {
     enrich(event) {
         event.timestamp = new Date().toISOString();
@@ -107,13 +108,25 @@ class EventBuilder {
     }
     build(eventType, body, options) {
         const span = (0, context_1.getCurrentSpan)();
+        // Auto-capture lineage from context if not explicitly provided
+        const effectiveParentEventId = options?.parentEventId ?? (0, lineage_1.getParentEventId)();
+        const effectiveInputEventIds = options?.inputEventIds ?? (0, lineage_1.getInputEvents)();
+        const effectivePromptId = options?.promptId ?? (0, lineage_1.getPromptId)();
+        const effectiveTemplateId = options?.templateId ?? (0, lineage_1.getTemplateId)();
+        const effectiveDataSourceIds = options?.dataSourceIds ?? (0, lineage_1.getDataSources)();
+        const eventId = (0, ids_1.generateUlid)('evt');
         const event = {
-            schema_version: '1.0.0',
-            event_id: (0, ids_1.generateUlid)('evt'),
+            schema_version: '1.1.0',
+            event_id: eventId,
             event_type: eventType,
             trace_id: span ? span.traceId : (0, ids_1.generateUlid)('trc'),
             span_id: span ? span.spanId : (0, ids_1.generateUlid)('spn'),
             parent_span_id: span ? span.parentSpanId : null,
+            parent_event_id: effectiveParentEventId,
+            input_event_ids: effectiveInputEventIds.length > 0 ? effectiveInputEventIds : [],
+            prompt_id: effectivePromptId,
+            template_id: effectiveTemplateId,
+            data_source_ids: effectiveDataSourceIds.length > 0 ? effectiveDataSourceIds : [],
             data_classification: options?.dataClassification || this.defaults?.data_classification || 'internal',
             purpose: options?.purpose || this.defaults?.purpose || 'general',
             reason: options?.reason || null,
@@ -126,6 +139,8 @@ class EventBuilder {
         for (const enricher of this.enrichers) {
             enricher.enrich(event);
         }
+        // Update current event for next event's parent_event_id
+        (0, lineage_1.setCurrentEvent)(eventId);
         return event;
     }
 }