feat: add verifiable audit evidence bundles

webui/src/api/audit.ts

@@ -45,6 +45,30 @@ export type AuditAdminDeltaResponse = AuditAdminListResponse & {
   full: boolean;
 };
 
+export type EvidenceBundleExportRequest = {
+  scope: "tenant" | "system" | "all";
+  tenant_id?: string | null;
+  record_ids?: string[];
+  max_records?: number;
+  sign?: boolean;
+};
+
+export type EvidenceBundleResponse = {
+  id: string;
+  scope: "tenant" | "system" | "all";
+  tenant_id?: string | null;
+  status: "pending" | "ready" | "failed";
+  bundle_sha256?: string | null;
+  record_count: number;
+  reference_count: number;
+  generated_at?: string | null;
+  download_url?: string | null;
+};
+
+export type EvidenceBundleDownloadResponse = {
+  bundle: Record<string, unknown>;
+};
+
 function auditQuery(options: AuditQueryOptions & { since?: string | null } = {}): string {
   const params = new URLSearchParams();
   if (options.tenantId) params.set("tenant_id", options.tenantId);
@@ -72,3 +96,20 @@ export function fetchAdminAudit(settings: ApiSettings, options: AuditQueryOption
 export function fetchAdminAuditDelta(settings: ApiSettings, options: AuditQueryOptions & { since?: string | null } = {}): Promise<AuditAdminDeltaResponse> {
   return apiFetch(settings, `/api/v1/admin/audit/delta${auditQuery(options)}`);
 }
+
+export function exportAuditEvidenceBundle(
+  settings: ApiSettings,
+  payload: EvidenceBundleExportRequest
+): Promise<EvidenceBundleResponse> {
+  return apiFetch(settings, "/api/v1/admin/audit/evidence-bundles", {
+    method: "POST",
+    body: JSON.stringify(payload)
+  });
+}
+
+export function downloadAuditEvidenceBundle(
+  settings: ApiSettings,
+  bundleId: string
+): Promise<EvidenceBundleDownloadResponse> {
+  return apiFetch(settings, `/api/v1/admin/audit/evidence-bundles/${bundleId}/download`);
+}