monora-ai 2.1.0 → 2.1.4

package/dist/templates/controls/soc2_control_catalog.json

@@ -0,0 +1,163 @@
+{
+  "catalog_id": "soc2_gap_catalog_monora",
+  "standard": "SOC2",
+  "version": "0.1.0",
+  "generated_at": "2026-02-16T00:00:00+00:00",
+  "notes": "Default SOC 2 Trust Services Criteria control catalog for workflow coverage and gap prioritization.",
+  "controls": [
+    {
+      "control_id": "CC1",
+      "clause": "CC",
+      "title": "Control Environment",
+      "requirement": "Establish integrity and ethical values.",
+      "guidance": "Document governance and accountability structure.",
+      "evidence_types": ["governance_charter", "policy_document"],
+      "frequency": "annual",
+      "owner": "Compliance Lead",
+      "system": "governance",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC2",
+      "clause": "CC",
+      "title": "Communication and Information",
+      "requirement": "Maintain internal/external communication for controls.",
+      "guidance": "Document control communication channels.",
+      "evidence_types": ["communication_plan", "review_minutes"],
+      "frequency": "quarterly",
+      "owner": "Compliance Lead",
+      "system": "governance",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "CC3",
+      "clause": "CC",
+      "title": "Risk Assessment",
+      "requirement": "Identify and analyze risks.",
+      "guidance": "Maintain risk register and periodic reviews.",
+      "evidence_types": ["risk_register", "risk_review_minutes"],
+      "frequency": "quarterly",
+      "owner": "Risk Lead",
+      "system": "risk_management",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC4",
+      "clause": "CC",
+      "title": "Monitoring Activities",
+      "requirement": "Monitor controls and remediate deficiencies.",
+      "guidance": "Track monitoring outcomes and corrective actions.",
+      "evidence_types": ["monitoring_report", "corrective_action_log"],
+      "frequency": "monthly",
+      "owner": "Internal Audit Lead",
+      "system": "monitoring",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC5",
+      "clause": "CC",
+      "title": "Control Activities",
+      "requirement": "Implement and enforce control procedures.",
+      "guidance": "Enforce policies and document exceptions.",
+      "evidence_types": ["policy_configuration", "exception_log"],
+      "frequency": "monthly",
+      "owner": "Security Lead",
+      "system": "policy_enforcement",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC6",
+      "clause": "CC",
+      "title": "Logical and Physical Access Controls",
+      "requirement": "Restrict system access to authorized users.",
+      "guidance": "Track identity controls and least-privilege access.",
+      "evidence_types": ["identity_and_mfa_report", "access_review"],
+      "frequency": "monthly",
+      "owner": "Security Lead",
+      "system": "access_control",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "critical"
+    },
+    {
+      "control_id": "CC7",
+      "clause": "CC",
+      "title": "System Operations",
+      "requirement": "Detect and respond to operational anomalies.",
+      "guidance": "Track runtime integrity and incident response.",
+      "evidence_types": ["runtime_observability_report", "incident_response_record"],
+      "frequency": "monthly",
+      "owner": "Operations Lead",
+      "system": "operations",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "CC8",
+      "clause": "CC",
+      "title": "Change Management",
+      "requirement": "Manage changes through controlled workflow.",
+      "guidance": "Document approvals and deployment controls.",
+      "evidence_types": ["change_approval_record", "deployment_approval_records"],
+      "frequency": "monthly",
+      "owner": "Engineering Lead",
+      "system": "change_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "CC9",
+      "clause": "CC",
+      "title": "Risk Mitigation",
+      "requirement": "Mitigate identified risks with documented actions.",
+      "guidance": "Track mitigation plans and completion.",
+      "evidence_types": ["risk_register", "mitigation_plan"],
+      "frequency": "quarterly",
+      "owner": "Risk Lead",
+      "system": "risk_management",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "P_SERIES",
+      "clause": "P",
+      "title": "Privacy",
+      "requirement": "Operate in accordance with privacy commitments.",
+      "guidance": "Document notices, consent, and subject rights handling.",
+      "evidence_types": ["privacy_notice", "data_subject_request_log"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "privacy_program",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "PI_SERIES",
+      "clause": "PI",
+      "title": "Processing Integrity",
+      "requirement": "Ensure complete, valid, and accurate processing.",
+      "guidance": "Track processing controls and integrity validation.",
+      "evidence_types": ["processing_integrity_report", "integrity_validation_log"],
+      "frequency": "monthly",
+      "owner": "Operations Lead",
+      "system": "processing_integrity",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    }
+  ]
+}

package/dist/templates/standards/iso42001_claims.json

@@ -0,0 +1,72 @@
+{
+  "report": {
+    "standard": "ISO42001",
+    "title": "ISO/IEC 42001 AIMS Claims Report",
+    "version": "2026-01",
+    "source": "Customer-provided report"
+  },
+  "excerpts": [],
+  "claims": [
+    {
+      "id": "ISO42001-A5",
+      "standard": "ISO42001",
+      "section": "A.5",
+      "statement": "AI risk and impact assessment workflows are enabled.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "risk_register.enabled", "equals": true },
+        { "type": "config_required", "path": "bias.enabled", "equals": true }
+      ]
+    },
+    {
+      "id": "ISO42001-A6",
+      "standard": "ISO42001",
+      "section": "A.6",
+      "statement": "Lifecycle and operational controls are tracked with immutable evidence.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "lifecycle.enabled", "equals": true },
+        { "type": "hash_chain_status", "status": "verified" },
+        { "type": "sequence_gaps_max", "max": 0 }
+      ]
+    },
+    {
+      "id": "ISO42001-A7",
+      "standard": "ISO42001",
+      "section": "A.7",
+      "statement": "Data governance controls are enabled for AI system data.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "data_governance.enabled", "equals": true },
+        { "type": "config_required", "path": "data_handling.enabled", "equals": true }
+      ]
+    },
+    {
+      "id": "ISO42001-A8",
+      "standard": "ISO42001",
+      "section": "A.8",
+      "statement": "Human oversight and policy governance are documented.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "config_required", "path": "human_oversight.enabled", "equals": true },
+        { "type": "config_required", "path": "policies.enforce", "equals": true }
+      ]
+    },
+    {
+      "id": "ISO42001-AIMS-INTEGRITY",
+      "standard": "ISO42001",
+      "section": "Clause 9/10",
+      "statement": "Governance evidence supports verifiable integrity for audit reporting.",
+      "requires_excerpts": true,
+      "evidence_excerpts": [],
+      "checks": [
+        { "type": "signatures_status", "status": "verified" },
+        { "type": "errors_max", "max": 0 }
+      ]
+    }
+  ]
+}

package/dist/traced_emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traced_emitter.d.ts","sourceRoot":"","sources":["../src/traced_emitter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,OAAO,CAAC,gBAAgB,CAAuE;IAC/F,OAAO,CAAC,gBAAgB,CAAuD;IAE/E,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWpE;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAI7E;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAatE;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWrE;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAIhF;;OAEG;IACH,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAWjD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWjF;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;CAWtF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CA8I5E"}
+{"version":3,"file":"traced_emitter.d.ts","sourceRoot":"","sources":["../src/traced_emitter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,OAAO,CAAC,gBAAgB,CAAuE;IAC/F,OAAO,CAAC,gBAAgB,CAAuD;IAE/E,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWpE;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAI7E;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAatE;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWrE;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAIhF;;OAEG;IACH,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAWjD;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;IAWjF;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,IAAI;CAWtF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAuJ5E"}

package/dist/traced_emitter.js

@@ -187,10 +187,8 @@ exports.TracedEventEmitter = TracedEventEmitter;
  */
 function wrapEmitterWithContext(emitter) {
     const originalOn = emitter.on.bind(emitter);
-    const originalOnce = emitter.once.bind(emitter);
     const originalAddListener = emitter.addListener.bind(emitter);
     const originalPrependListener = emitter.prependListener.bind(emitter);
-    const originalPrependOnceListener = emitter.prependOnceListener.bind(emitter);
     const originalRemoveListener = emitter.removeListener.bind(emitter);
     const originalOff = emitter.off ? emitter.off.bind(emitter) : undefined;
     const originalRemoveAllListeners = emitter.removeAllListeners.bind(emitter);
@@ -223,6 +221,12 @@ function wrapEmitterWithContext(emitter) {
                     return bound(...args);
                 }
                 finally {
+                    if (originalOff) {
+                        originalOff(event, wrapped);
+                    }
+                    else {
+                        originalRemoveListener(event, wrapped);
+                    }
                     untrackListener(event, listener);
                 }
             };
@@ -239,13 +243,13 @@ function wrapEmitterWithContext(emitter) {
         return originalAddListener(event, bindListener(event, listener, false));
     };
     emitter.once = function (event, listener) {
-        return originalOnce(event, bindListener(event, listener, true));
+        return originalOn(event, bindListener(event, listener, true));
     };
     emitter.prependListener = function (event, listener) {
         return originalPrependListener(event, bindListener(event, listener, false));
     };
     emitter.prependOnceListener = function (event, listener) {
-        return originalPrependOnceListener(event, bindListener(event, listener, true));
+        return originalPrependListener(event, bindListener(event, listener, true));
     };
     emitter.removeListener = function (event, listener) {
         const bound = boundListeners.get(listener);
@@ -258,12 +262,18 @@ function wrapEmitterWithContext(emitter) {
     };
     emitter.off = function (event, listener) {
         const bound = boundListeners.get(listener);
-        const target = bound || listener;
-        if (originalOff) {
-            originalOff(event, target);
+        const targets = new Set();
+        targets.add(listener);
+        if (bound) {
+            targets.add(bound);
         }
-        else {
-            originalRemoveListener(event, target);
+        for (const target of targets) {
+            if (originalOff) {
+                originalOff(event, target);
+            }
+            else {
+                originalRemoveListener(event, target);
+            }
         }
         if (bound) {
             untrackListener(event, listener);

package/dist/trust_package.d.ts

@@ -10,12 +10,31 @@ export interface TrustPackage {
     hash_chain_proof: Record<string, any>;
     config_snapshot: Record<string, any>;
     export_manifest: Record<string, any>;
+    evidence_manifest?: Record<string, any>;
+    control_coverage?: Record<string, any>;
     audit_metadata?: Record<string, any>;
     project_registration?: Record<string, any>;
     gpg_signature: string | null;
     gpg_signature_metadata?: Record<string, any>;
 }
-export declare function buildTrustPackage(traceId: string, events: Array<Record<string, any>>, config: MonoraConfig): TrustPackage;
+export interface TrustPackageBuildOptions {
+    evidenceManifest?: Record<string, any>;
+    evidenceManifestPath?: string;
+    evidenceManifestAuto?: boolean;
+    evidenceManifestStandard?: string;
+    evidenceManifestIncludeLineage?: boolean;
+    evidenceManifestIncludeHashChain?: boolean;
+    evidenceManifestIncludeWorkflowState?: boolean;
+    evidenceManifestIncludeAimsState?: boolean;
+    controlCatalog?: Record<string, any>;
+    controlCatalogPath?: string;
+    controlCatalogStandard?: string;
+    controlWorkflowState?: Record<string, any>;
+    controlWorkflowStatePath?: string;
+    controlCoverageTarget?: number;
+    controlCoveragePath?: string;
+}
+export declare function buildTrustPackage(traceId: string, events: Array<Record<string, any>>, config: MonoraConfig, options?: TrustPackageBuildOptions): TrustPackage;
 export declare function applyGpgSignature(trustPackage: TrustPackage, options?: {
     gpgKey?: string;
     gpgHome?: string;

package/dist/trust_package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust_package.d.ts","sourceRoot":"","sources":["../src/trust_package.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAMxC,MAAM,WAAW,YAAY;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9C;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,GACnB,YAAY,CA4Bd;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,YAAY,CAQd;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAOtF;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAS5B"}
+{"version":3,"file":"trust_package.d.ts","sourceRoot":"","sources":["../src/trust_package.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAQxC,MAAM,WAAW,YAAY;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,oCAAoC,CAAC,EAAE,OAAO,CAAC;IAC/C,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,wBAAwB,GACjC,YAAY,CA4Fd;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,YAAY,CAQd;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAOtF;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAS5B"}

package/dist/trust_package.js

@@ -44,13 +44,15 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const attestation_1 = require("./attestation");
 const attribution_1 = require("./attribution");
+const control_backbone_1 = require("./control_backbone");
+const evidence_store_1 = require("./evidence_store");
 const report_1 = require("./report");
 const security_report_1 = require("./security_report");
 const verify_1 = require("./verify");
 const reporting_1 = require("./reporting");
-function buildTrustPackage(traceId, events, config) {
+function buildTrustPackage(traceId, events, config, options) {
     const traceEvents = filterTraceEvents(events, traceId);
-    const complianceReport = (0, report_1.buildReport)(traceEvents, config.policies || {});
+    const complianceReport = (0, report_1.buildReport)(traceEvents, config.policies || {}, config.registry);
     const configSnapshot = (0, security_report_1.buildConfigSnapshot)(config || {});
     const hashChainProof = buildHashChainProof(traceEvents, config || {}, traceId);
     const exportManifest = buildExportManifest(traceEvents, config || {}, traceId);
@@ -72,6 +74,62 @@ function buildTrustPackage(traceId, events, config) {
     if (registration) {
         trustPackage.project_registration = { ...registration };
     }
+    let evidenceManifest = loadEvidenceManifest(options);
+    if (!evidenceManifest && options?.evidenceManifestAuto) {
+        evidenceManifest = (0, evidence_store_1.buildRuntimeEvidenceManifest)({
+            standard: options.evidenceManifestStandard || 'ISO42001',
+            includeLineage: options.evidenceManifestIncludeLineage !== false,
+            includeHashChain: options.evidenceManifestIncludeHashChain !== false,
+            includeControlWorkflowState: options.evidenceManifestIncludeWorkflowState !== false,
+            includeAimsGovernanceState: options.evidenceManifestIncludeAimsState !== false,
+            controlCatalog: options.controlCatalog || null,
+        });
+    }
+    const workflowState = loadWorkflowState(options);
+    const shouldGenerateCoverage = Boolean(options?.controlCatalog) ||
+        Boolean(options?.controlCatalogPath) ||
+        Boolean(workflowState) ||
+        Boolean(evidenceManifest) ||
+        Boolean(options?.controlCoveragePath);
+    if (shouldGenerateCoverage) {
+        let catalog = options?.controlCatalog || null;
+        if (!catalog && options?.controlCatalogPath) {
+            try {
+                catalog = JSON.parse(fs.readFileSync(options.controlCatalogPath, 'utf-8'));
+            }
+            catch {
+                catalog = null;
+            }
+        }
+        if (!catalog) {
+            try {
+                catalog = (0, control_backbone_1.loadDefaultControlCatalog)(options?.controlCatalogStandard || 'ISO42001');
+            }
+            catch (_err) {
+                catalog = null;
+            }
+        }
+        if (catalog) {
+            const coverage = (0, control_backbone_1.generateControlCoverageReport)({
+                catalog,
+                evidenceItems: evidenceManifest?.evidence_items
+                    || workflowState?.evidence_items,
+                workflows: workflowState?.workflows,
+                targetCoverage: typeof options?.controlCoverageTarget === 'number'
+                    ? options.controlCoverageTarget
+                    : 0.9,
+                standard: options?.controlCatalogStandard,
+            });
+            trustPackage.control_coverage = coverage;
+            if (options?.controlCoveragePath) {
+                fs.mkdirSync(path.dirname(options.controlCoveragePath), { recursive: true });
+                fs.writeFileSync(options.controlCoveragePath, JSON.stringify(coverage, null, 2), 'utf-8');
+            }
+        }
+    }
+    if (evidenceManifest) {
+        trustPackage.evidence_manifest = evidenceManifest;
+    }
     return trustPackage;
 }
 function applyGpgSignature(trustPackage, options) {
@@ -166,3 +224,33 @@ function attachSignature(trustPackage, signature) {
         },
     };
 }
+function loadEvidenceManifest(options) {
+    if (options?.evidenceManifest && typeof options.evidenceManifest === 'object') {
+        return options.evidenceManifest;
+    }
+    if (options?.evidenceManifestPath) {
+        try {
+            return JSON.parse(fs.readFileSync(options.evidenceManifestPath, 'utf-8'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`loadEvidenceManifest failed to parse ${options.evidenceManifestPath}: ${message}`);
+        }
+    }
+    return null;
+}
+function loadWorkflowState(options) {
+    if (options?.controlWorkflowState && typeof options.controlWorkflowState === 'object') {
+        return options.controlWorkflowState;
+    }
+    if (options?.controlWorkflowStatePath) {
+        try {
+            return JSON.parse(fs.readFileSync(options.controlWorkflowStatePath, 'utf-8'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`loadWorkflowState failed to parse ${options.controlWorkflowStatePath}: ${message}`);
+        }
+    }
+    return null;
+}

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA2DnE;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CA4C1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CAgB1B;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CA+C5B;AA0BD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAkD5B;AAgBD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,CAoBtC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAO9E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAEhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAkC1D"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CA2DnE;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CA4C1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,OAAO,EAAE,MAAM,GACd,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,CAgB1B;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CA+C5B;AA0BD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAkD5B;AAgBD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,CA6BtC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAO9E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAEhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAkC1D"}

package/dist/verify.js

@@ -288,8 +288,15 @@ function verifyChainWithProof(events) {
     };
     // Always compute Merkle root for chains with > 1 event
     if (events.length > 1) {
-        const hashes = events.map((e) => e.event_hash || '');
-        proofData.merkle_root = computeMerkleRoot(hashes);
+        const hashes = events
+            .map((event) => event.event_hash)
+            .filter((hash) => typeof hash === 'string' && hash.length > 0);
+        if (hashes.length !== events.length) {
+            throw new ChainVerificationError('Missing event_hash values; cannot compute Merkle root.');
+        }
+        if (hashes.length > 1) {
+            proofData.merkle_root = computeMerkleRoot(hashes);
+        }
     }
     return [isValid, error, proofData];
 }

package/dist/wal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wal.d.ts","sourceRoot":"","sources":["../src/wal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,EAAE,CAAuB;IACjC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,eAAe,CAAK;gBAEhB,MAAM,GAAE,SAAc;IAgBlC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IAyBzB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBzC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAazB,OAAO,CAAC,WAAW;IAcnB;;;;OAIG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IA4BrC,OAAO,CAAE,cAAc;IAgCvB;;;;OAIG;IACH,eAAe,IAAI,MAAM;IA4CzB;;OAEG;IACH,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,qBAAqB;CAkC9B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,aAAa,CAE9E"}
+{"version":3,"file":"wal.d.ts","sourceRoot":"","sources":["../src/wal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,EAAE,CAAuB;IACjC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,eAAe,CAAK;gBAEhB,MAAM,GAAE,SAAc;IAgBlC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IAyBzB;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM;IAgBzC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAazB,OAAO,CAAC,WAAW;IAcnB;;;;OAIG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IA4BrC,OAAO,CAAE,cAAc;IAgCvB;;;;OAIG;IACH,eAAe,IAAI,MAAM;IA4CzB;;OAEG;IACH,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,qBAAqB;CAkC9B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,aAAa,CAE9E"}

package/dist/wal.js

@@ -96,7 +96,8 @@ class WriteAheadLog {
         if (this.currentFilePath === null) {
             const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
             const serviceName = process.env.MONORA_SERVICE_NAME || 'monora';
-            this.currentFilePath = path.join(this.config.path, `${serviceName}_${timestamp}.wal`);
+            const uniqueSuffix = `${process.pid}_${process.hrtime.bigint().toString()}`;
+            this.currentFilePath = path.join(this.config.path, `${serviceName}_${timestamp}_${uniqueSuffix}.wal`);
         }
         return this.currentFilePath;
     }

package/package.json

@@ -1,9 +1,21 @@
 {
   "name": "monora-ai",
-  "version": "2.1.0",
+  "version": "2.1.4",
   "description": "Lightweight governance and trace SDK for AI systems",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js"
+    },
+    "./register": {
+      "types": "./dist/register.d.ts",
+      "require": "./dist/register.js",
+      "import": "./dist/register.js"
+    }
+  },
   "bin": {
     "monora": "dist/cli.js"
   },
@@ -54,6 +66,7 @@
     "ajv": "^8.12.0",
     "axios": "^1.7.9",
     "js-yaml": "^4.1.1",
+    "minimatch": "^9.0.0",
     "zod": "^3.23.0"
   }
 }