feat(core-shared): AuditLogProtocol + ./audit subpath export

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-shared/src/di/bind-protocols.ts

@@ -1,14 +1,16 @@
 /**
  * Minimal protocol surfaces used by feature binders to interact with optional
  * cross-cutting infrastructure (event bus, realtime broadcaster, realtime
- * handler registry, metrics). Lives in `core-shared` so `BindContext` can
- * reference these unconditionally — features depend on `core-shared`, never
+ * handler registry, metrics, audit log). Lives in `core-shared` so `BindContext`
+ * can reference these unconditionally — features depend on `core-shared`, never
  * on the optional packages directly.
  *
  * The optional packages' full interfaces (`IEventBus`, `IRealtimeBroadcaster`,
- * `IRealtimeHandlerRegistry`, `IMetrics`) `extends` these — typechecks fail if
- * a refactor narrows the protocol surface in a way the full interface would lose.
+ * `IRealtimeHandlerRegistry`, `IMetrics`, `IAuditLog`) `extends` these —
+ * typechecks fail if a refactor narrows the protocol surface in a way the full
+ * interface would lose.
  */
+import type { AuditEntry } from "../audit/audit-entry";
 
 export type EventBusProtocol = {
   publish<T>(event: { name: string }, payload: T): Promise<void>;
@@ -54,3 +56,15 @@ export type MetricsProtocol = {
     attributes?: Record<string, string | number | boolean>,
   ): void;
 };
+
+/**
+ * Minimal audit-log protocol surface. `IAuditLog` (in optional `@repo/core-audit`)
+ * extends this — typechecks fail if narrowed below. Feature binders that
+ * receive `ctx.auditLog` see only this protocol type.
+ *
+ * `eraseSubject` is NOT on the protocol — it's a privileged op exposed only
+ * on the full `IAuditLog` interface in the optional package.
+ */
+export type AuditLogProtocol = {
+  record(entry: AuditEntry): Promise<void>;
+};