@agentguard-run/spend 0.1.4 → 0.1.7

package/dist/cli/verify.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * `agentguard verify` — verify a signed decision log entry.
+ *
+ * Default target: --trace latest reads ~/.agentguard/demo/latest-receipt.json
+ * (produced by `agentguard demo`) and verifies its Ed25519 signature.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVerify = runVerify;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const decision_log_1 = require("../decision-log");
+const index_1 = require("../index");
+const colors_1 = require("./colors");
+const DEMO_RECEIPT = path.join(os.homedir(), '.agentguard', 'demo', 'latest-receipt.json');
+async function runVerify(argv) {
+    let trace = 'latest';
+    let publicKeyHex;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--trace') {
+            trace = argv[++i] ?? 'latest';
+        }
+        else if (a === '--public-key') {
+            publicKeyHex = argv[++i];
+        }
+        else if (a === '--help' || a === '-h') {
+            console.log('agentguard verify [--trace latest|<path>] [--public-key <hex>]');
+            return 0;
+        }
+    }
+    let source;
+    if (trace === 'latest') {
+        source = DEMO_RECEIPT;
+        if (!fs.existsSync(source)) {
+            console.log((0, colors_1.redBold)('error: ') + 'no demo receipt found.');
+            console.log('');
+            console.log(`  run ${(0, colors_1.greenBold)('agentguard demo')} first to produce a receipt.`);
+            return 2;
+        }
+    }
+    else {
+        source = path.resolve(trace.replace(/^~/, os.homedir()));
+        if (!fs.existsSync(source)) {
+            console.log((0, colors_1.redBold)('error: ') + `receipt file not found: ${source}`);
+            return 2;
+        }
+    }
+    const raw = JSON.parse(fs.readFileSync(source, 'utf-8'));
+    const entry = {
+        sequence: raw.sequence,
+        entryHash: raw.entryHash,
+        previousHash: raw.previousHash,
+        signature: raw.signature,
+        signerFingerprint: raw.signerFingerprint,
+        decision: raw.decision,
+    };
+    const pubHex = publicKeyHex || raw.publicKeyHex;
+    if (!pubHex) {
+        console.log((0, colors_1.redBold)('error: ') + 'no public key available for verification.');
+        return 2;
+    }
+    const publicKey = Uint8Array.from(Buffer.from(pubHex, 'hex'));
+    const ok = await (0, decision_log_1.verifyEntry)(entry, publicKey);
+    console.log('');
+    console.log('  ' + (0, colors_1.banner)(index_1.AGENTGUARD_SPEND_VERSION));
+    console.log('');
+    console.log('  ' + (0, colors_1.cyanBold)(`agentguard verify --trace ${trace}`));
+    console.log('');
+    const label = (s) => (0, colors_1.dim)(`  ${s.padEnd(14)}`);
+    console.log(label('receipt') + entry.entryHash.slice(0, 32) + (0, colors_1.dim)('...'));
+    console.log(label('signer') + entry.signerFingerprint.slice(0, 32) + (0, colors_1.dim)('...'));
+    console.log(label('sequence') + String(entry.sequence));
+    console.log(label('policy') + entry.decision.policyId);
+    console.log(label('action') + entry.decision.action);
+    console.log('');
+    if (ok) {
+        console.log('  ' + (0, colors_1.greenBold)('✓ signature valid'));
+        console.log('  ' + (0, colors_1.green)('✓ entry hash matches canonical JSON'));
+        console.log('  ' + (0, colors_1.green)('✓ chain link to previous entry intact'));
+        console.log('');
+        return 0;
+    }
+    console.log('  ' + (0, colors_1.redBold)('✗ verification FAILED'));
+    console.log('');
+    console.log((0, colors_1.dim)('  one or more of: signature mismatch, entryHash mismatch, chain broken.'));
+    console.log('');
+    return 1;
+}
+//# sourceMappingURL=verify.js.map

package/dist/cli/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/cli/verify.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaH,8BA2EC;AAtFD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,kDAA8C;AAE9C,oCAAoD;AACpD,qCAA4E;AAE5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAEpF,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,IAAI,KAAK,GAAG,QAAQ,CAAC;IACrB,IAAI,YAAgC,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;QAChC,CAAC;aAAM,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;YAChC,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,GAAG,YAAY,CAAC;QACtB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAA,gBAAO,EAAC,SAAS,CAAC,GAAG,wBAAwB,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,SAAS,IAAA,kBAAS,EAAC,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAA,gBAAO,EAAC,SAAS,CAAC,GAAG,2BAA2B,MAAM,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAA2B;QACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAA,gBAAO,EAAC,SAAS,CAAC,GAAG,2CAA2C,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAE9D,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAW,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,eAAM,EAAC,gCAAwB,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,iBAAQ,EAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,YAAG,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,YAAG,EAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,YAAG,EAAC,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,kBAAS,EAAC,mBAAmB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,cAAK,EAAC,qCAAqC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,cAAK,EAAC,uCAAuC,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,gBAAO,EAAC,uBAAuB,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,YAAG,EAAC,yEAAyE,CAAC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { canonicalJson, sha256Hex, computeEntryHash, computeSignerFingerprint, s
 export { InMemorySpendStore } from './store-memory';
 export { SpendGuard, withSpendGuard, AgentGuardBlockedError, type SpendGuardConfig, type OpenAIBindingOptions, } from './spend-guard';
 export { DEFAULT_LOCALE, SUPPORTED_LOCALES, TRANSLATIONS, type SupportedLocale, resolveLocale, t, formatBlockedTrace, type BlockedTraceArgs, } from './i18n';
-export declare const AGENTGUARD_SPEND_VERSION = "0.1.4";
+export declare const AGENTGUARD_SPEND_VERSION = "0.1.7";
 /** Patent marking. 35 U.S.C. § 287 constructive notice. */
 export declare const PATENT_NOTICE: string;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -46,7 +46,7 @@ Object.defineProperty(exports, "TRANSLATIONS", { enumerable: true, get: function
 Object.defineProperty(exports, "resolveLocale", { enumerable: true, get: function () { return i18n_1.resolveLocale; } });
 Object.defineProperty(exports, "t", { enumerable: true, get: function () { return i18n_1.t; } });
 Object.defineProperty(exports, "formatBlockedTrace", { enumerable: true, get: function () { return i18n_1.formatBlockedTrace; } });
-exports.AGENTGUARD_SPEND_VERSION = '0.1.4';
+exports.AGENTGUARD_SPEND_VERSION = '0.1.7';
 /** Patent marking. 35 U.S.C. § 287 constructive notice. */
 exports.PATENT_NOTICE = 'Protected by U.S. patent-pending technology ' +
     '(App. Nos. 63/983,615; 63/983,621; 63/983,843; 63/984,626; ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentguard-run/spend",
-  "version": "0.1.4",
+  "version": "0.1.7",
   "description": "Local-runtime spend caps and capability-gated model routing for AI agents. Prompts, API keys, and signing keys stay inside the customer runtime. Zero data plane involvement.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,8 +21,12 @@
       "default": "./dist/decision-log.js"
     }
   },
+  "bin": {
+    "agentguard": "./bin/agentguard.js"
+  },
   "files": [
     "dist",
+    "bin",
     "README.md",
     "LICENSE",
     "PATENTS.md"