chore: sync deixic-node from Mono

.repository-projection.json

@@ -3,11 +3,11 @@
   "projection": "deixic-node",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "0135ea0655c81b1b2a8e7fb5e4fb00d827607b35",
+  "sourceSha": "7f322bbd03a590ed5a478b12303369ea8d48c00a",
   "destinationRepository": "dx-corp/deixic-node",
-  "priorProjectedBase": "814b96ca0a16ea04f7d94544389238725fdfdddb",
+  "priorProjectedBase": "b9802c8dca99bfd256d5f9fc1e21f728af26d27a",
   "definitionDigest": "6c8bda5a9e80c50ccdc2d79d85f61b7f2373eb695dcc86f51f6240901cdf3c28",
-  "toolDigest": "f58d71f023a4f0a27d77cb96dcc5348a40816d0b",
-  "contentDigest": "1efaa60d2594ebac6aec18f14a42f5f40be871b97b20f84dbca8addea2333b29",
+  "toolDigest": "898e8657d9153a2a51d7c283bf83bb3350b5d1e6",
+  "contentDigest": "1959422422c9ca7d87cb6bff7771da6a23e6effa8acea4977dd8e7bb32579316",
   "publicationEligible": true
 }

sdk/deixic/typescript/README.md

@@ -65,8 +65,10 @@ the internal `DEX-ACTION-ASSURANCE` control; mapping that control to an
 external framework requires a separately reviewed mapping. Denied actions are `NOT_APPLICABLE`;
 executions without a confirmed succeeded state are `INDETERMINATE`. It includes a
 digest of the exact Tool Execution returned by the owner and declares coverage
-of one requested record. This is a live read; store the result in your own
-system if you need to retain that observation. The current profile reports
+of one requested record. This is a live read. To retain a server-owned
+snapshot, call `deixic.compliance.record()` with the same subject and an
+`idempotencyKey`, then retrieve its `record.id` with `deixic.compliance.get()`.
+Repeating the key returns the first accepted snapshot. The current profile reports
 the independent Audit receipt as indeterminate because Tool Executor has no
 general Audit sink. Do not treat the result as proof of an external state
 change or of every action in a time window.

sdk/deixic/typescript/src/index.ts

@@ -135,6 +135,8 @@ export type {
 export type {
   MaestroGetReceiptInput as GetReceiptInput,
   MaestroAssessComplianceInput as AssessComplianceInput,
+  MaestroRecordComplianceInput as RecordComplianceInput,
+  MaestroGetComplianceInput as GetComplianceInput,
   MaestroGetThreadInput as GetThreadInput,
   MaestroInterruptThreadInput as InterruptThreadInput,
   MaestroListThreadEventsInput as ListThreadEventsInput,
@@ -157,8 +159,11 @@ export {
 
 export type {
   AssessComplianceSubjectResponse,
+  ComplianceAssessmentRecord,
   ComplianceSubjectAssessment,
   ComplianceRequirementFinding,
+  GetComplianceAssessmentResponse,
+  RecordComplianceAssessmentResponse,
   GetOperatingReceiptResponse,
   GetOperatingThreadResponse,
   InterruptOperatingThreadResponse,

sdk/deixic/typescript/test/client.test.mjs

@@ -4,6 +4,8 @@ import test from "node:test";
 import { create } from "@bufbuild/protobuf";
 import {
   AssessComplianceSubjectResponseSchema,
+  GetComplianceAssessmentResponseSchema,
+  RecordComplianceAssessmentResponseSchema,
   GetOperatingThreadResponseSchema,
   SubmitOperatingMessageResponseSchema,
 } from "../dist/gen/ts/console/v1/console_pb.js";
@@ -60,6 +62,29 @@ test("compliance assessments use the fixed tenant and a typed Deixic RPC", async
   assert.equal(transport.calls[0].input.subjectId, "execution-1");
 });
 
+test("compliance records bind tenant and replay key through typed RPCs", async () => {
+  const transport = new RecordingTransport(({ method }) => create(
+    method.name === "RecordComplianceAssessment"
+      ? RecordComplianceAssessmentResponseSchema : GetComplianceAssessmentResponseSchema,
+    { record: { id: "ca_1" } },
+  ));
+  const deixic = createDeixicClient({
+    organizationId: "org-a", workspaceId: "workspace-a", apiKey: "sdk-test-key", transport,
+  });
+  await deixic.compliance.record({
+    profileId: "dex-production-action-assurance/v1", subjectKind: "tool_execution",
+    subjectId: "execution-1", idempotencyKey: "snapshot-1",
+  });
+  await deixic.compliance.get({ recordId: "ca_1" });
+  assert.deepEqual(transport.calls.map(({ method }) => method.name), [
+    "RecordComplianceAssessment", "GetComplianceAssessment",
+  ]);
+  assert.equal(transport.calls[0].input.organizationId, "org-a");
+  assert.equal(transport.calls[0].input.workspaceId, "workspace-a");
+  assert.equal(transport.calls[0].input.idempotencyKey, "snapshot-1");
+  assert.equal(transport.calls[1].input.recordId, "ca_1");
+});
+
 test("public client fixes tenant scope and sends an API key as a bearer", async () => {
   const transport = new RecordingTransport(() => create(SubmitOperatingMessageResponseSchema, {
     replayCursor: 8n,

sdk/maestro/typescript/src/client.ts

@@ -9,6 +9,8 @@ import { createClient, type Transport } from "@connectrpc/connect";
 import { createConnectTransport } from "@connectrpc/connect-web";
 import {
   AssessComplianceSubjectRequestSchema,
+  GetComplianceAssessmentRequestSchema,
+  RecordComplianceAssessmentRequestSchema,
   CodingAcceptanceContractSchema,
   ConsoleQuerySchema,
   GetOperatingReceiptRequestSchema,
@@ -33,6 +35,8 @@ import {
   WatchOperatingThreadResponseSchema,
   type GetOperatingReceiptResponse,
   type AssessComplianceSubjectResponse,
+  type GetComplianceAssessmentResponse,
+  type RecordComplianceAssessmentResponse,
   type GetOperatingThreadResponse,
   type InterruptOperatingThreadResponse,
   type ListOperatingThreadEventsResponse,
@@ -178,6 +182,15 @@ export interface MaestroAssessComplianceInput {
   signal?: AbortSignal;
 }
 
+export interface MaestroRecordComplianceInput extends MaestroAssessComplianceInput {
+  idempotencyKey: string;
+}
+
+export interface MaestroGetComplianceInput {
+  recordId: string;
+  signal?: AbortSignal;
+}
+
 export interface MaestroResolveReceiptInput {
   receiptId: string;
   /** Exact action object returned in receipt.allowedActions. */
@@ -194,6 +207,8 @@ export interface MaestroProductClient {
   readonly scope: Readonly<MaestroProductScope>;
   compliance: {
     assess(input: MaestroAssessComplianceInput): Promise<AssessComplianceSubjectResponse>;
+    record(input: MaestroRecordComplianceInput): Promise<RecordComplianceAssessmentResponse>;
+    get(input: MaestroGetComplianceInput): Promise<GetComplianceAssessmentResponse>;
   };
   threads: {
     get(input: MaestroGetThreadInput): Promise<GetOperatingThreadResponse>;
@@ -398,6 +413,31 @@ export function createMaestroProductClient(options: MaestroProductClientOptions)
           signal: input.signal,
         }));
       },
+      record(input) {
+        const request = snapshotRequest(RecordComplianceAssessmentRequestSchema, {
+          organizationId: scope.organizationId,
+          workspaceId: scope.workspaceId,
+          profileId: input.profileId,
+          subjectKind: input.subjectKind,
+          subjectId: required(input.subjectId, "subjectId"),
+          idempotencyKey: required(input.idempotencyKey, "idempotencyKey"),
+        });
+        return unary((requestHeaders) => client.recordComplianceAssessment(request, {
+          headers: requestHeaders,
+          signal: input.signal,
+        }));
+      },
+      get(input) {
+        const request = snapshotRequest(GetComplianceAssessmentRequestSchema, {
+          organizationId: scope.organizationId,
+          workspaceId: scope.workspaceId,
+          recordId: required(input.recordId, "recordId"),
+        });
+        return unary((requestHeaders) => client.getComplianceAssessment(request, {
+          headers: requestHeaders,
+          signal: input.signal,
+        }));
+      },
     },
     threads: {
       get(input) {