monora-ai 2.0.0 → 2.1.3

package/dist/traced_emitter.d.ts

@@ -30,6 +30,9 @@ import { EventEmitter } from 'events';
 export declare class TracedEventEmitter extends EventEmitter {
     private listenerContexts;
     private wrappedListeners;
+    private getEventMap;
+    private trackListener;
+    private untrackListener;
     /**
      * Register an event listener that preserves the current trace context.
      */

package/dist/traced_emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traced_emitter.d.ts","sourceRoot":"","sources":["../src/traced_emitter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,OAAO,CAAC,gBAAgB,CAAiD;IACzE,OAAO,CAAC,gBAAgB,CAAiC;IAEzD;;OAEG;IACH,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAYpE;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAI7E;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAetE;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAYrE;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAIhF;;OAEG;IACH,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOjD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAYjF;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;CAatF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CA2C5E"}
+{"version":3,"file":"traced_emitter.d.ts","sourceRoot":"","sources":["../src/traced_emitter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,OAAO,CAAC,gBAAgB,CAAuE;IAC/F,OAAO,CAAC,gBAAgB,CAAuD;IAE/E,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWpE;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAI7E;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAatE;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWrE;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAIhF;;OAEG;IACH,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAWjD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWjF;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;CAWtF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAuJ5E"}

package/dist/traced_emitter.js

@@ -38,6 +38,34 @@ class TracedEventEmitter extends events_1.EventEmitter {
         this.listenerContexts = new Map();
         this.wrappedListeners = new Map();
     }
+    getEventMap(map, event) {
+        let eventMap = map.get(event);
+        if (!eventMap) {
+            eventMap = new Map();
+            map.set(event, eventMap);
+        }
+        return eventMap;
+    }
+    trackListener(event, listener, ctx, wrappedListener) {
+        this.getEventMap(this.listenerContexts, event).set(listener, ctx);
+        this.getEventMap(this.wrappedListeners, event).set(listener, wrappedListener);
+    }
+    untrackListener(event, listener) {
+        const ctxMap = this.listenerContexts.get(event);
+        if (ctxMap) {
+            ctxMap.delete(listener);
+            if (ctxMap.size === 0) {
+                this.listenerContexts.delete(event);
+            }
+        }
+        const wrappedMap = this.wrappedListeners.get(event);
+        if (wrappedMap) {
+            wrappedMap.delete(listener);
+            if (wrappedMap.size === 0) {
+                this.wrappedListeners.delete(event);
+            }
+        }
+    }
     /**
      * Register an event listener that preserves the current trace context.
      */
@@ -46,8 +74,7 @@ class TracedEventEmitter extends events_1.EventEmitter {
         const wrappedListener = (...args) => {
             (0, context_1.runInContext)(ctx, () => listener(...args));
         };
-        this.listenerContexts.set(listener, ctx);
-        this.wrappedListeners.set(listener, wrappedListener);
+        this.trackListener(event, listener, ctx, wrappedListener);
         return super.on(event, wrappedListener);
     }
     /**
@@ -64,22 +91,19 @@ class TracedEventEmitter extends events_1.EventEmitter {
         const wrappedListener = (...args) => {
             (0, context_1.runInContext)(ctx, () => listener(...args));
             // Clean up mappings after one-time listener fires
-            this.listenerContexts.delete(listener);
-            this.wrappedListeners.delete(listener);
+            this.untrackListener(event, listener);
         };
-        this.listenerContexts.set(listener, ctx);
-        this.wrappedListeners.set(listener, wrappedListener);
+        this.trackListener(event, listener, ctx, wrappedListener);
         return super.once(event, wrappedListener);
     }
     /**
      * Remove an event listener.
      */
     off(event, listener) {
-        const wrappedListener = this.wrappedListeners.get(listener);
+        const wrappedListener = this.wrappedListeners.get(event)?.get(listener);
         if (wrappedListener) {
             super.off(event, wrappedListener);
-            this.listenerContexts.delete(listener);
-            this.wrappedListeners.delete(listener);
+            this.untrackListener(event, listener);
         }
         else {
             super.off(event, listener);
@@ -96,9 +120,14 @@ class TracedEventEmitter extends events_1.EventEmitter {
      * Remove all listeners for an event (or all events).
      */
     removeAllListeners(event) {
-        // Clear our tracking maps
-        this.listenerContexts.clear();
-        this.wrappedListeners.clear();
+        if (event === undefined) {
+            this.listenerContexts.clear();
+            this.wrappedListeners.clear();
+        }
+        else {
+            this.listenerContexts.delete(event);
+            this.wrappedListeners.delete(event);
+        }
         return super.removeAllListeners(event);
     }
     /**
@@ -109,8 +138,7 @@ class TracedEventEmitter extends events_1.EventEmitter {
         const wrappedListener = (...args) => {
             (0, context_1.runInContext)(ctx, () => listener(...args));
         };
-        this.listenerContexts.set(listener, ctx);
-        this.wrappedListeners.set(listener, wrappedListener);
+        this.trackListener(event, listener, ctx, wrappedListener);
         return super.prependListener(event, wrappedListener);
     }
     /**
@@ -120,11 +148,9 @@ class TracedEventEmitter extends events_1.EventEmitter {
         const ctx = (0, context_1.captureContext)();
         const wrappedListener = (...args) => {
             (0, context_1.runInContext)(ctx, () => listener(...args));
-            this.listenerContexts.delete(listener);
-            this.wrappedListeners.delete(listener);
+            this.untrackListener(event, listener);
         };
-        this.listenerContexts.set(listener, ctx);
-        this.wrappedListeners.set(listener, wrappedListener);
+        this.trackListener(event, listener, ctx, wrappedListener);
         return super.prependOnceListener(event, wrappedListener);
     }
 }
@@ -161,24 +187,115 @@ exports.TracedEventEmitter = TracedEventEmitter;
  */
 function wrapEmitterWithContext(emitter) {
     const originalOn = emitter.on.bind(emitter);
-    const originalOnce = emitter.once.bind(emitter);
     const originalAddListener = emitter.addListener.bind(emitter);
     const originalPrependListener = emitter.prependListener.bind(emitter);
-    const originalPrependOnceListener = emitter.prependOnceListener.bind(emitter);
+    const originalRemoveListener = emitter.removeListener.bind(emitter);
+    const originalOff = emitter.off ? emitter.off.bind(emitter) : undefined;
+    const originalRemoveAllListeners = emitter.removeAllListeners.bind(emitter);
+    let boundListeners = new WeakMap();
+    const eventListeners = new Map();
+    const trackListener = (event, originalListener, boundListener) => {
+        boundListeners.set(originalListener, boundListener);
+        let listeners = eventListeners.get(event);
+        if (!listeners) {
+            listeners = new Set();
+            eventListeners.set(event, listeners);
+        }
+        listeners.add(originalListener);
+    };
+    const untrackListener = (event, originalListener) => {
+        boundListeners.delete(originalListener);
+        const listeners = eventListeners.get(event);
+        if (listeners) {
+            listeners.delete(originalListener);
+            if (listeners.size === 0) {
+                eventListeners.delete(event);
+            }
+        }
+    };
+    const bindListener = (event, listener, once) => {
+        const bound = (0, context_1.bindContext)(listener);
+        if (once) {
+            const wrapped = (...args) => {
+                try {
+                    return bound(...args);
+                }
+                finally {
+                    if (originalOff) {
+                        originalOff(event, wrapped);
+                    }
+                    else {
+                        originalRemoveListener(event, wrapped);
+                    }
+                    untrackListener(event, listener);
+                }
+            };
+            trackListener(event, listener, wrapped);
+            return wrapped;
+        }
+        trackListener(event, listener, bound);
+        return bound;
+    };
     emitter.on = function (event, listener) {
-        return originalOn(event, (0, context_1.bindContext)(listener));
+        return originalOn(event, bindListener(event, listener, false));
     };
     emitter.addListener = function (event, listener) {
-        return originalAddListener(event, (0, context_1.bindContext)(listener));
+        return originalAddListener(event, bindListener(event, listener, false));
     };
     emitter.once = function (event, listener) {
-        return originalOnce(event, (0, context_1.bindContext)(listener));
+        return originalOn(event, bindListener(event, listener, true));
     };
     emitter.prependListener = function (event, listener) {
-        return originalPrependListener(event, (0, context_1.bindContext)(listener));
+        return originalPrependListener(event, bindListener(event, listener, false));
     };
     emitter.prependOnceListener = function (event, listener) {
-        return originalPrependOnceListener(event, (0, context_1.bindContext)(listener));
+        return originalPrependListener(event, bindListener(event, listener, true));
+    };
+    emitter.removeListener = function (event, listener) {
+        const bound = boundListeners.get(listener);
+        const target = bound || listener;
+        originalRemoveListener(event, target);
+        if (bound) {
+            untrackListener(event, listener);
+        }
+        return emitter;
+    };
+    emitter.off = function (event, listener) {
+        const bound = boundListeners.get(listener);
+        const targets = new Set();
+        targets.add(listener);
+        if (bound) {
+            targets.add(bound);
+        }
+        for (const target of targets) {
+            if (originalOff) {
+                originalOff(event, target);
+            }
+            else {
+                originalRemoveListener(event, target);
+            }
+        }
+        if (bound) {
+            untrackListener(event, listener);
+        }
+        return emitter;
+    };
+    emitter.removeAllListeners = function (event) {
+        if (event === undefined) {
+            boundListeners = new WeakMap();
+            eventListeners.clear();
+        }
+        else {
+            const listeners = eventListeners.get(event);
+            if (listeners) {
+                for (const originalListener of listeners) {
+                    boundListeners.delete(originalListener);
+                }
+                eventListeners.delete(event);
+            }
+        }
+        originalRemoveAllListeners(event);
+        return emitter;
     };
     return emitter;
 }

package/dist/trust_package.d.ts

@@ -10,10 +10,30 @@ export interface TrustPackage {
     hash_chain_proof: Record<string, any>;
     config_snapshot: Record<string, any>;
     export_manifest: Record<string, any>;
+    evidence_manifest?: Record<string, any>;
+    control_coverage?: Record<string, any>;
+    audit_metadata?: Record<string, any>;
+    project_registration?: Record<string, any>;
     gpg_signature: string | null;
     gpg_signature_metadata?: Record<string, any>;
 }
-export declare function buildTrustPackage(traceId: string, events: Array<Record<string, any>>, config: MonoraConfig): TrustPackage;
+export interface TrustPackageBuildOptions {
+    evidenceManifest?: Record<string, any>;
+    evidenceManifestPath?: string;
+    evidenceManifestAuto?: boolean;
+    evidenceManifestStandard?: string;
+    evidenceManifestIncludeLineage?: boolean;
+    evidenceManifestIncludeHashChain?: boolean;
+    evidenceManifestIncludeWorkflowState?: boolean;
+    evidenceManifestIncludeAimsState?: boolean;
+    controlCatalog?: Record<string, any>;
+    controlCatalogPath?: string;
+    controlWorkflowState?: Record<string, any>;
+    controlWorkflowStatePath?: string;
+    controlCoverageTarget?: number;
+    controlCoveragePath?: string;
+}
+export declare function buildTrustPackage(traceId: string, events: Array<Record<string, any>>, config: MonoraConfig, options?: TrustPackageBuildOptions): TrustPackage;
 export declare function applyGpgSignature(trustPackage: TrustPackage, options?: {
     gpgKey?: string;
     gpgHome?: string;

package/dist/trust_package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust_package.d.ts","sourceRoot":"","sources":["../src/trust_package.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAMxC,MAAM,WAAW,YAAY;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9C;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,GACnB,YAAY,CAiBd;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,YAAY,CAQd;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAOtF;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAS5B"}
+{"version":3,"file":"trust_package.d.ts","sourceRoot":"","sources":["../src/trust_package.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAQxC,MAAM,WAAW,YAAY;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,oCAAoC,CAAC,EAAE,OAAO,CAAC;IAC/C,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,wBAAwB,GACjC,YAAY,CA2Fd;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,YAAY,CAQd;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAOtF;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAS5B"}

package/dist/trust_package.js

@@ -43,17 +43,20 @@ exports.filterTraceEvents = filterTraceEvents;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const attestation_1 = require("./attestation");
+const attribution_1 = require("./attribution");
+const control_backbone_1 = require("./control_backbone");
+const evidence_store_1 = require("./evidence_store");
 const report_1 = require("./report");
 const security_report_1 = require("./security_report");
 const verify_1 = require("./verify");
 const reporting_1 = require("./reporting");
-function buildTrustPackage(traceId, events, config) {
+function buildTrustPackage(traceId, events, config, options) {
     const traceEvents = filterTraceEvents(events, traceId);
-    const complianceReport = (0, report_1.buildReport)(traceEvents, config.policies || {});
+    const complianceReport = (0, report_1.buildReport)(traceEvents, config.policies || {}, config.registry);
     const configSnapshot = (0, security_report_1.buildConfigSnapshot)(config || {});
     const hashChainProof = buildHashChainProof(traceEvents, config || {}, traceId);
     const exportManifest = buildExportManifest(traceEvents, config || {}, traceId);
-    return {
+    const trustPackage = {
         trust_package_version: '1.0.0',
         trace_id: traceId,
         generated_at: new Date().toISOString(),
@@ -63,6 +66,70 @@ function buildTrustPackage(traceId, events, config) {
         export_manifest: exportManifest,
         gpg_signature: null,
     };
+    const auditMetadata = (0, attribution_1.getAuditMetadata)();
+    if (auditMetadata) {
+        trustPackage.audit_metadata = { ...auditMetadata };
+    }
+    const registration = (0, attribution_1.getRegistration)();
+    if (registration) {
+        trustPackage.project_registration = { ...registration };
+    }
+    let evidenceManifest = loadEvidenceManifest(options);
+    if (!evidenceManifest && options?.evidenceManifestAuto) {
+        evidenceManifest = (0, evidence_store_1.buildRuntimeEvidenceManifest)({
+            standard: options.evidenceManifestStandard || 'ISO42001',
+            includeLineage: options.evidenceManifestIncludeLineage !== false,
+            includeHashChain: options.evidenceManifestIncludeHashChain !== false,
+            includeControlWorkflowState: options.evidenceManifestIncludeWorkflowState !== false,
+            includeAimsGovernanceState: options.evidenceManifestIncludeAimsState !== false,
+            controlCatalog: options.controlCatalog || null,
+        });
+    }
+    const workflowState = loadWorkflowState(options);
+    const shouldGenerateCoverage = Boolean(options?.controlCatalog) ||
+        Boolean(options?.controlCatalogPath) ||
+        Boolean(workflowState) ||
+        Boolean(evidenceManifest) ||
+        Boolean(options?.controlCoveragePath);
+    if (shouldGenerateCoverage) {
+        let catalog = options?.controlCatalog || null;
+        if (!catalog && options?.controlCatalogPath) {
+            try {
+                catalog = JSON.parse(fs.readFileSync(options.controlCatalogPath, 'utf-8'));
+            }
+            catch {
+                catalog = null;
+            }
+        }
+        if (!catalog) {
+            try {
+                catalog = (0, control_backbone_1.loadDefaultIso42001Catalog)();
+            }
+            catch (_err) {
+                catalog = null;
+            }
+        }
+        if (catalog) {
+            const coverage = (0, control_backbone_1.generateControlCoverageReport)({
+                catalog,
+                evidenceItems: evidenceManifest?.evidence_items
+                    || workflowState?.evidence_items,
+                workflows: workflowState?.workflows,
+                targetCoverage: typeof options?.controlCoverageTarget === 'number'
+                    ? options.controlCoverageTarget
+                    : 0.9,
+            });
+            trustPackage.control_coverage = coverage;
+            if (options?.controlCoveragePath) {
+                fs.mkdirSync(path.dirname(options.controlCoveragePath), { recursive: true });
+                fs.writeFileSync(options.controlCoveragePath, JSON.stringify(coverage, null, 2), 'utf-8');
+            }
+        }
+    }
+    if (evidenceManifest) {
+        trustPackage.evidence_manifest = evidenceManifest;
+    }
+    return trustPackage;
 }
 function applyGpgSignature(trustPackage, options) {
     const { gpg_signature, gpg_signature_metadata, ...payload } = trustPackage;
@@ -75,7 +142,7 @@ function applyGpgSignature(trustPackage, options) {
 }
 function writeTrustPackage(outputPath, trustPackage) {
     const dir = path.dirname(outputPath);
-    if (dir) {
+    if (dir && dir !== '.') {
         fs.mkdirSync(dir, { recursive: true });
     }
     const reportBytes = (0, attestation_1.serializeReport)(trustPackage);
@@ -156,3 +223,33 @@ function attachSignature(trustPackage, signature) {
         },
     };
 }
+function loadEvidenceManifest(options) {
+    if (options?.evidenceManifest && typeof options.evidenceManifest === 'object') {
+        return options.evidenceManifest;
+    }
+    if (options?.evidenceManifestPath) {
+        try {
+            return JSON.parse(fs.readFileSync(options.evidenceManifestPath, 'utf-8'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`loadEvidenceManifest failed to parse ${options.evidenceManifestPath}: ${message}`);
+        }
+    }
+    return null;
+}
+function loadWorkflowState(options) {
+    if (options?.controlWorkflowState && typeof options.controlWorkflowState === 'object') {
+        return options.controlWorkflowState;
+    }
+    if (options?.controlWorkflowStatePath) {
+        try {
+            return JSON.parse(fs.readFileSync(options.controlWorkflowStatePath, 'utf-8'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`loadWorkflowState failed to parse ${options.controlWorkflowStatePath}: ${message}`);
+        }
+    }
+    return null;
+}

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA2DnE;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CA4C1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CAgB1B;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CA+C5B;AA0BD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAkD5B;AAgBD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,CAoBtC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAO9E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAEhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAkC1D"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA2DnE;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CA4C1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CAgB1B;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CA+C5B;AA0BD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAkD5B;AAgBD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,CA6BtC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAO9E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAEhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAkC1D"}

package/dist/verify.js

@@ -288,8 +288,15 @@ function verifyChainWithProof(events) {
     };
     // Always compute Merkle root for chains with > 1 event
     if (events.length > 1) {
-        const hashes = events.map((e) => e.event_hash || '');
-        proofData.merkle_root = computeMerkleRoot(hashes);
+        const hashes = events
+            .map((event) => event.event_hash)
+            .filter((hash) => typeof hash === 'string' && hash.length > 0);
+        if (hashes.length !== events.length) {
+            throw new ChainVerificationError('Missing event_hash values; cannot compute Merkle root.');
+        }
+        if (hashes.length > 1) {
+            proofData.merkle_root = computeMerkleRoot(hashes);
+        }
     }
     return [isValid, error, proofData];
 }

package/dist/wal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wal.d.ts","sourceRoot":"","sources":["../src/wal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,EAAE,CAAuB;IACjC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,eAAe,CAAK;gBAEhB,MAAM,GAAE,SAAc;IAgBlC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IAyBzB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBzC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAazB,OAAO,CAAC,WAAW;IAcnB;;;;OAIG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IA4BrC,OAAO,CAAE,cAAc;IAgCvB;;;;OAIG;IACH,eAAe,IAAI,MAAM;IA4CzB;;OAEG;IACH,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,qBAAqB;CAkC9B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,aAAa,CAE9E"}
+{"version":3,"file":"wal.d.ts","sourceRoot":"","sources":["../src/wal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,EAAE,CAAuB;IACjC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,eAAe,CAAK;gBAEhB,MAAM,GAAE,SAAc;IAgBlC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IAyBzB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBzC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAazB,OAAO,CAAC,WAAW;IAcnB;;;;OAIG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IA4BrC,OAAO,CAAE,cAAc;IAgCvB;;;;OAIG;IACH,eAAe,IAAI,MAAM;IA4CzB;;OAEG;IACH,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,qBAAqB;CAkC9B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,aAAa,CAE9E"}

package/dist/wal.js

@@ -96,7 +96,8 @@ class WriteAheadLog {
         if (this.currentFilePath === null) {
             const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
             const serviceName = process.env.MONORA_SERVICE_NAME || 'monora';
-            this.currentFilePath = path.join(this.config.path, `${serviceName}_${timestamp}.wal`);
+            const uniqueSuffix = `${process.pid}_${process.hrtime.bigint().toString()}`;
+            this.currentFilePath = path.join(this.config.path, `${serviceName}_${timestamp}_${uniqueSuffix}.wal`);
         }
         return this.currentFilePath;
     }

package/package.json

@@ -1,9 +1,21 @@
 {
   "name": "monora-ai",
-  "version": "2.0.0",
+  "version": "2.1.3",
   "description": "Lightweight governance and trace SDK for AI systems",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js"
+    },
+    "./register": {
+      "types": "./dist/register.d.ts",
+      "require": "./dist/register.js",
+      "import": "./dist/register.js"
+    }
+  },
   "bin": {
     "monora": "dist/cli.js"
   },
@@ -54,6 +66,7 @@
     "ajv": "^8.12.0",
     "axios": "^1.7.9",
     "js-yaml": "^4.1.1",
+    "minimatch": "^9.0.0",
     "zod": "^3.23.0"
   }
 }