@agentlair/audit-logger 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -168,6 +168,36 @@ const { observations } = await lair.observations.read({
168
168
 
169
169
  ---
170
170
 
171
+ ## Denied call flow
172
+
173
+ When a tool call is blocked by policy before execution, record the denial using `phase: 'denied'`. The terminal receipt participates in the hash chain just like any executed receipt.
174
+
175
+ ```typescript
176
+ // beginAction records the pre-action with the policy decision
177
+ const preAction = await logger.beginAction({
178
+ toolName: 'delete_file',
179
+ toolCallId: 'call-004',
180
+ input: { path: '/important.txt' },
181
+ approvalDecision: 'denied',
182
+ decidedBy: 'policy-engine',
183
+ });
184
+
185
+ // endAction records the denial in the terminal receipt
186
+ const terminal = await logger.endAction({
187
+ preAction,
188
+ phase: 'denied',
189
+ terminalReason: 'Policy: production files protected',
190
+ });
191
+
192
+ // terminal.phase === 'denied'
193
+ // terminal.terminalAt === ISO timestamp
194
+ // No executionStartedAt, executionEndedAt, resultDigest, errorClass
195
+ ```
196
+
197
+ Attempting to call `endAction` with `phase: 'executed'` on a denied pre-action will throw at sign time.
198
+
199
+ ---
200
+
171
201
  ## License
172
202
 
173
203
  MIT © [AgentLair](https://agentlair.dev)
package/dist/index.d.ts CHANGED
@@ -21,6 +21,8 @@
21
21
  *
22
22
  * @see https://agentlair.dev/docs/audit-logger
23
23
  */
24
- export { AuditLogger, auditLog, configureLogger } from './logger.js';
25
- export type { AuditLogEntry, ResolvedAuditEntry, AuditSink, AuditLoggerOptions, } from './types.js';
24
+ export { AuditLogger, auditLog, configureLogger, verifyChain, computeDigest } from './logger.js';
25
+ export type { AuditLogEntry, ResolvedAuditEntry, AuditSink, AuditLoggerOptions, AARSignature, AARPreAction, AARTerminalPhase, AARTerminalReceipt,
26
+ /** @deprecated Use AARTerminalReceipt */
27
+ AARPostAction, ChainVerificationResult, } from './types.js';
26
28
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrE,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,SAAS,EACT,kBAAkB,GACnB,MAAM,YAAY,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjG,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB;AAClB,yCAAyC;AACzC,aAAa,EACb,uBAAuB,GACxB,MAAM,YAAY,CAAC"}
package/dist/index.js CHANGED
@@ -21,5 +21,5 @@
21
21
  *
22
22
  * @see https://agentlair.dev/docs/audit-logger
23
23
  */
24
- export { AuditLogger, auditLog, configureLogger } from './logger.js';
24
+ export { AuditLogger, auditLog, configureLogger, verifyChain, computeDigest } from './logger.js';
25
25
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
package/dist/logger.d.ts CHANGED
@@ -1,10 +1,13 @@
1
- import type { AuditLogEntry, AuditLoggerOptions, ResolvedAuditEntry } from './types.js';
1
+ import type { AuditLogEntry, AuditLoggerOptions, ResolvedAuditEntry, AARPreAction, AARPostAction, AARTerminalReceipt, AARTerminalPhase, ChainVerificationResult } from './types.js';
2
2
  export declare class AuditLogger {
3
3
  private readonly apiKey;
4
4
  private readonly baseUrl;
5
5
  private readonly sinks;
6
6
  private readonly useConsole;
7
7
  private readonly silent;
8
+ private lastReceiptHash;
9
+ private readonly hmacSecret;
10
+ private readonly actorId;
8
11
  constructor(options?: AuditLoggerOptions);
9
12
  /**
10
13
  * Log a single agent action.
@@ -15,9 +18,50 @@ export declare class AuditLogger {
15
18
  log(entry: AuditLogEntry): Promise<ResolvedAuditEntry>;
16
19
  /** Convenience: log multiple entries in sequence */
17
20
  logAll(entries: AuditLogEntry[]): Promise<ResolvedAuditEntry[]>;
21
+ /**
22
+ * Call BEFORE tool execution begins.
23
+ * Signs and chains the pre-action authority record.
24
+ * Returns the pre-action record — pass it to endAction().
25
+ */
26
+ beginAction(opts: {
27
+ toolName: string;
28
+ toolCallId: string;
29
+ input: unknown;
30
+ policyRef?: string;
31
+ approvalDecision?: 'approved' | 'denied' | 'conditional';
32
+ decidedBy?: string;
33
+ sessionId?: string;
34
+ }): Promise<AARPreAction>;
35
+ /**
36
+ * Call AFTER tool execution completes (or is denied, cancelled, expired, etc.).
37
+ * Signs and chains the terminal receipt.
38
+ */
39
+ endAction(opts: {
40
+ preAction: AARPreAction;
41
+ phase?: AARTerminalPhase;
42
+ startedAt?: Date;
43
+ endedAt?: Date;
44
+ output?: unknown;
45
+ error?: Error;
46
+ terminalReason?: string;
47
+ }): Promise<AARTerminalReceipt>;
48
+ private hmacSignPayload;
49
+ private shipReceiptToAgentLair;
18
50
  private writeConsole;
19
51
  private shipToAgentLair;
20
52
  }
53
+ /**
54
+ * Verify the integrity of an AAR receipt chain.
55
+ * Each receipt's previousReceiptHash must match sha256 of the prior receipt (without signature).
56
+ * First receipt must have previousReceiptHash = undefined.
57
+ * Also checks that every AARPreAction has at least one corresponding AARTerminalReceipt.
58
+ */
59
+ export declare function verifyChain(receipts: Array<AARPreAction | AARTerminalReceipt | AARPostAction>): Promise<ChainVerificationResult>;
60
+ /**
61
+ * Compute the sha256 digest of a value (canonical JSON).
62
+ * Useful for verifying inputDigest independently.
63
+ */
64
+ export declare function computeDigest(value: unknown): Promise<string>;
21
65
  /**
22
66
  * Log an agent action using the default logger.
23
67
  * Reads AGENTLAIR_API_KEY from environment automatically.
@@ -1 +1 @@
1
- {"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAa,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEnG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;gBAErB,OAAO,GAAE,kBAAuB;IAW5C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA6B5D,oDAAoD;IAC9C,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAQrE,OAAO,CAAC,YAAY;YAMN,eAAe;CAsB9B;AAcD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEhF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAEjE"}
1
+ {"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAa,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAgB,uBAAuB,EAAE,MAAM,YAAY,CAAC;AA8B7M,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,eAAe,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,GAAE,kBAAuB;IAa5C;;;;;OAKG;IACG,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA6B5D,oDAAoD;IAC9C,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAQrE;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;QACzD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,YAAY,CAAC;IAkCzB;;;OAGG;IACG,SAAS,CAAC,IAAI,EAAE;QACpB,SAAS,EAAE,YAAY,CAAC;QACxB,KAAK,CAAC,EAAE,gBAAgB,CAAC;QACzB,SAAS,CAAC,EAAE,IAAI,CAAC;QACjB,OAAO,CAAC,EAAE,IAAI,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAsEjB,eAAe;YAiBf,sBAAsB;IAmBpC,OAAO,CAAC,YAAY;YAMN,eAAe;CAsB9B;AAID;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,KAAK,CAAC,YAAY,GAAG,kBAAkB,GAAG,aAAa,CAAC,GACjE,OAAO,CAAC,uBAAuB,CAAC,CAkElC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAcD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEhF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAEjE"}
package/dist/logger.js CHANGED
@@ -5,12 +5,40 @@
5
5
  // import { AuditLogger } from '@agentlair/audit-logger';
6
6
  // const logger = new AuditLogger(); // reads AGENTLAIR_API_KEY automatically
7
7
  // await logger.log({ agent: 'my-agent', action: 'tool_call', tool: 'search', input: query, output: results });
8
+ // ─── Crypto helpers ───────────────────────────────────────────────────────────
9
+ function canonicalJson(value) {
10
+ if (value === null || value === undefined)
11
+ return 'null';
12
+ if (typeof value !== 'object')
13
+ return JSON.stringify(value);
14
+ if (Array.isArray(value)) {
15
+ return '[' + value.map(canonicalJson).join(',') + ']';
16
+ }
17
+ const keys = Object.keys(value).sort();
18
+ return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalJson(value[k])).join(',') + '}';
19
+ }
20
+ async function sha256Hex(input) {
21
+ const bytes = new TextEncoder().encode(input);
22
+ const hashBuffer = await crypto.subtle.digest('SHA-256', bytes);
23
+ return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
24
+ }
25
+ async function hashPayload(payload) {
26
+ return 'sha256:' + await sha256Hex(canonicalJson(payload));
27
+ }
28
+ function generateId(length = 20) {
29
+ const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
30
+ const bytes = crypto.getRandomValues(new Uint8Array(length));
31
+ return Array.from(bytes).map(b => chars[b % chars.length]).join('');
32
+ }
8
33
  export class AuditLogger {
9
34
  apiKey;
10
35
  baseUrl;
11
36
  sinks;
12
37
  useConsole;
13
38
  silent;
39
+ lastReceiptHash = undefined;
40
+ hmacSecret;
41
+ actorId;
14
42
  constructor(options = {}) {
15
43
  // Resolve API key from options or env
16
44
  this.apiKey = options.apiKey ?? (typeof process !== 'undefined' ? process.env.AGENTLAIR_API_KEY : undefined);
@@ -18,6 +46,8 @@ export class AuditLogger {
18
46
  this.sinks = options.sinks ?? [];
19
47
  this.useConsole = options.console !== false;
20
48
  this.silent = options.silent ?? false;
49
+ this.hmacSecret = options.hmacSecret;
50
+ this.actorId = options.actorId ?? 'unknown';
21
51
  }
22
52
  /**
23
53
  * Log a single agent action.
@@ -57,6 +87,132 @@ export class AuditLogger {
57
87
  }
58
88
  return results;
59
89
  }
90
+ /**
91
+ * Call BEFORE tool execution begins.
92
+ * Signs and chains the pre-action authority record.
93
+ * Returns the pre-action record — pass it to endAction().
94
+ */
95
+ async beginAction(opts) {
96
+ const preActionBase = {
97
+ id: generateId(),
98
+ version: 'aar-v1',
99
+ phase: 'pre-action',
100
+ toolName: opts.toolName,
101
+ toolCallId: opts.toolCallId,
102
+ inputDigest: 'sha256:' + await sha256Hex(canonicalJson(opts.input)),
103
+ actorId: this.actorId,
104
+ issuedAt: new Date().toISOString(),
105
+ ...(opts.sessionId !== undefined && { sessionId: opts.sessionId }),
106
+ ...(opts.policyRef !== undefined && { policyRef: opts.policyRef }),
107
+ ...(opts.approvalDecision !== undefined && { approvalDecision: opts.approvalDecision }),
108
+ ...(opts.decidedBy !== undefined && { decidedBy: opts.decidedBy }),
109
+ ...(this.lastReceiptHash !== undefined && { previousReceiptHash: this.lastReceiptHash }),
110
+ };
111
+ // Update chain state BEFORE signing (signature excluded from hash)
112
+ this.lastReceiptHash = await hashPayload(preActionBase);
113
+ const preAction = { ...preActionBase };
114
+ if (this.hmacSecret) {
115
+ preAction.signature = await this.hmacSignPayload(preActionBase);
116
+ }
117
+ if (this.apiKey && !this.silent) {
118
+ this.shipReceiptToAgentLair(preAction).catch((err) => {
119
+ console.warn('[audit-logger] AgentLair receipt upload failed:', err.message);
120
+ });
121
+ }
122
+ return preAction;
123
+ }
124
+ /**
125
+ * Call AFTER tool execution completes (or is denied, cancelled, expired, etc.).
126
+ * Signs and chains the terminal receipt.
127
+ */
128
+ async endAction(opts) {
129
+ const { preAction, startedAt, endedAt, output, error, terminalReason } = opts;
130
+ // Phase resolution
131
+ let phase;
132
+ if (error !== undefined) {
133
+ phase = 'failed';
134
+ }
135
+ else if (opts.phase !== undefined) {
136
+ phase = opts.phase;
137
+ }
138
+ else {
139
+ phase = 'executed';
140
+ }
141
+ // Sign-time invariant: executed phase is not allowed for denied pre-actions
142
+ if (phase === 'executed' && preAction.approvalDecision === 'denied') {
143
+ throw new Error(`Cannot record 'executed' terminal for a denied pre-action (preActionId: ${preAction.id})`);
144
+ }
145
+ const now = new Date();
146
+ const terminalAt = endedAt?.toISOString() ?? now.toISOString();
147
+ // Hash the preAction without signature to create the chain link
148
+ const { signature: _sig, ...preActionWithoutSig } = preAction;
149
+ const preActionHash = await hashPayload(preActionWithoutSig);
150
+ const receiptBase = {
151
+ id: generateId(),
152
+ version: 'aar-v1',
153
+ phase,
154
+ preActionId: preAction.id,
155
+ toolCallId: preAction.toolCallId,
156
+ terminalAt,
157
+ previousReceiptHash: preActionHash,
158
+ ...(terminalReason !== undefined && { terminalReason }),
159
+ // Execution fields only for executed/failed phases
160
+ ...((phase === 'executed' || phase === 'failed') && startedAt !== undefined && {
161
+ executionStartedAt: startedAt.toISOString(),
162
+ }),
163
+ ...((phase === 'executed' || phase === 'failed') && endedAt !== undefined && {
164
+ executionEndedAt: endedAt.toISOString(),
165
+ }),
166
+ // Result digest only for executed phase
167
+ ...(phase === 'executed' && output !== undefined && {
168
+ resultDigest: 'sha256:' + await sha256Hex(canonicalJson(output)),
169
+ }),
170
+ // Error class only for failed phase
171
+ ...(phase === 'failed' && error !== undefined && {
172
+ errorClass: error.constructor.name,
173
+ }),
174
+ };
175
+ // Update chain state
176
+ this.lastReceiptHash = await hashPayload(receiptBase);
177
+ const receipt = { ...receiptBase };
178
+ if (this.hmacSecret) {
179
+ receipt.signature = await this.hmacSignPayload(receiptBase);
180
+ }
181
+ if (this.apiKey && !this.silent) {
182
+ this.shipReceiptToAgentLair(receipt).catch((err) => {
183
+ console.warn('[audit-logger] AgentLair receipt upload failed:', err.message);
184
+ });
185
+ }
186
+ return receipt;
187
+ }
188
+ async hmacSignPayload(payload) {
189
+ const canon = canonicalJson(payload);
190
+ const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(this.hmacSecret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
191
+ const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(canon));
192
+ return {
193
+ alg: 'HMAC-SHA256',
194
+ kid: 'hmac-sha256',
195
+ sig: Array.from(new Uint8Array(sig)).map(b => b.toString(16).padStart(2, '0')).join(''),
196
+ };
197
+ }
198
+ async shipReceiptToAgentLair(receipt) {
199
+ const payload = {
200
+ topic: 'aar-receipt',
201
+ content: JSON.stringify(receipt),
202
+ };
203
+ const res = await fetch(`${this.baseUrl}/v1/observations`, {
204
+ method: 'POST',
205
+ headers: {
206
+ 'Content-Type': 'application/json',
207
+ Authorization: `Bearer ${this.apiKey}`,
208
+ },
209
+ body: JSON.stringify(payload),
210
+ });
211
+ if (!res.ok) {
212
+ const text = await res.text().catch(() => '');
213
+ throw new Error(`AgentLair ${res.status}: ${text}`);
214
+ }
215
+ }
60
216
  writeConsole(entry) {
61
217
  const tool = entry.tool ? ` [${entry.tool}]` : '';
62
218
  const ts = entry.timestamp.slice(11, 19); // HH:MM:SS
@@ -83,6 +239,79 @@ export class AuditLogger {
83
239
  }
84
240
  }
85
241
  }
242
+ // ─── Chain verification ───────────────────────────────────────────────────────
243
+ /**
244
+ * Verify the integrity of an AAR receipt chain.
245
+ * Each receipt's previousReceiptHash must match sha256 of the prior receipt (without signature).
246
+ * First receipt must have previousReceiptHash = undefined.
247
+ * Also checks that every AARPreAction has at least one corresponding AARTerminalReceipt.
248
+ */
249
+ export async function verifyChain(receipts) {
250
+ if (receipts.length === 0) {
251
+ return { intact: true, chainIntegrity: 'complete', breaks: [] };
252
+ }
253
+ const breaks = [];
254
+ // First receipt should have no previousReceiptHash
255
+ const first = receipts[0];
256
+ if (first.previousReceiptHash !== undefined) {
257
+ return {
258
+ intact: false,
259
+ chainIntegrity: 'incomplete',
260
+ breaks: [{ id: first.id, expected: undefined, actual: first.previousReceiptHash }],
261
+ };
262
+ }
263
+ for (let i = 1; i < receipts.length; i++) {
264
+ const prev = receipts[i - 1];
265
+ const curr = receipts[i];
266
+ // Hash prev without signature
267
+ const { signature: _sig, ...prevWithoutSig } = prev;
268
+ const expectedHash = await hashPayload(prevWithoutSig);
269
+ const actualHash = curr.previousReceiptHash;
270
+ if (actualHash !== expectedHash) {
271
+ breaks.push({ id: curr.id, expected: expectedHash, actual: actualHash });
272
+ }
273
+ }
274
+ // Check that every pre-action has at least one terminal receipt
275
+ const terminalPreActionIds = new Set();
276
+ for (const receipt of receipts) {
277
+ if (receipt.phase !== 'pre-action') {
278
+ // It's a terminal receipt (AARTerminalReceipt); grab its preActionId
279
+ terminalPreActionIds.add(receipt.preActionId);
280
+ }
281
+ }
282
+ for (const receipt of receipts) {
283
+ if (receipt.phase === 'pre-action') {
284
+ const preAction = receipt;
285
+ if (!terminalPreActionIds.has(preAction.id)) {
286
+ breaks.push({ id: preAction.id, expected: 'terminal-receipt', actual: 'missing' });
287
+ }
288
+ }
289
+ }
290
+ const hasHashBreaks = breaks.some(b => b.expected !== 'terminal-receipt');
291
+ const hasMissingTerminals = breaks.some(b => b.expected === 'terminal-receipt');
292
+ let chainIntegrity;
293
+ if (hasHashBreaks) {
294
+ chainIntegrity = 'broken';
295
+ }
296
+ else if (hasMissingTerminals) {
297
+ chainIntegrity = 'incomplete';
298
+ }
299
+ else {
300
+ chainIntegrity = 'complete';
301
+ }
302
+ return {
303
+ intact: breaks.length === 0,
304
+ chainIntegrity,
305
+ breaks,
306
+ };
307
+ }
308
+ /**
309
+ * Compute the sha256 digest of a value (canonical JSON).
310
+ * Useful for verifying inputDigest independently.
311
+ */
312
+ export async function computeDigest(value) {
313
+ return 'sha256:' + await sha256Hex(canonicalJson(value));
314
+ }
86
315
  // ─── Module-level convenience API ────────────────────────────────────────────
87
316
  // Uses a default logger instance (lazy-initialized on first call).
88
317
  let _defaultLogger = null;
@@ -1 +1 @@
1
- {"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,EAAE;AACF,SAAS;AACT,2DAA2D;AAC3D,+EAA+E;AAC/E,iHAAiH;AAIjH,MAAM,OAAO,WAAW;IACL,MAAM,CAAqB;IAC3B,OAAO,CAAS;IAChB,KAAK,CAAc;IACnB,UAAU,CAAU;IACpB,MAAM,CAAU;IAEjC,YAAY,UAA8B,EAAE;QAC1C,sCAAsC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAC9B,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAC,KAAoB;QAC5B,MAAM,QAAQ,GAAuB;YACnC,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,iBAAiB;YACjB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;YAED,eAAe;YACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;YAED,oDAAoD;YACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC3C,0CAA0C;oBAC1C,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;gBAClF,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY,CAAC,KAAyB;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;QACrD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAyB;QACrD,wDAAwD;QACxD,+CAA+C;QAC/C,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC/B,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,mEAAmE;AAEnE,IAAI,cAAc,GAAuB,IAAI,CAAC;AAE9C,SAAS,gBAAgB;IACvB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAoB;IACjD,OAAO,gBAAgB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA2B;IACzD,cAAc,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}
1
+ {"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,EAAE;AACF,SAAS;AACT,2DAA2D;AAC3D,+EAA+E;AAC/E,iHAAiH;AAIjH,iFAAiF;AAEjF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAI,KAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC7H,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,OAAO,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,MAAM,GAAG,EAAE;IAC7B,MAAM,KAAK,GAAG,gEAAgE,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,WAAW;IACL,MAAM,CAAqB;IAC3B,OAAO,CAAS;IAChB,KAAK,CAAc;IACnB,UAAU,CAAU;IACpB,MAAM,CAAU;IACzB,eAAe,GAAuB,SAAS,CAAC;IACvC,UAAU,CAAqB;IAC/B,OAAO,CAAS;IAEjC,YAAY,UAA8B,EAAE;QAC1C,sCAAsC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAC9B,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAC,KAAoB;QAC5B,MAAM,QAAQ,GAAuB;YACnC,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,iBAAiB;YACjB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;YAED,eAAe;YACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;YAED,oDAAoD;YACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC3C,0CAA0C;oBAC1C,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;gBAClF,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,IAQjB;QACC,MAAM,aAAa,GAAoC;YACrD,EAAE,EAAE,UAAU,EAAE;YAChB,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;SACzF,CAAC;QAEF,mEAAmE;QACnE,IAAI,CAAC,eAAe,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;QAExD,MAAM,SAAS,GAAiB,EAAE,GAAG,aAAa,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,SAAS,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnD,OAAO,CAAC,IAAI,CAAC,iDAAiD,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,IAQf;QACC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QAE9E,mBAAmB;QACnB,IAAI,KAAuB,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,UAAU,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,IAAI,KAAK,KAAK,UAAU,IAAI,SAAS,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,2EAA2E,SAAS,CAAC,EAAE,GAAG,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAE/D,gEAAgE;QAChE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,mBAAmB,EAAE,GAAG,SAAS,CAAC;QAC9D,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAE7D,MAAM,WAAW,GAA0C;YACzD,EAAE,EAAE,UAAU,EAAE;YAChB,OAAO,EAAE,QAAQ;YACjB,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU;YACV,mBAAmB,EAAE,aAAa;YAClC,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;YACvD,mDAAmD;YACnD,GAAG,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,SAAS,KAAK,SAAS,IAAI;gBAC7E,kBAAkB,EAAE,SAAS,CAAC,WAAW,EAAE;aAC5C,CAAC;YACF,GAAG,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAK,SAAS,IAAI;gBAC3E,gBAAgB,EAAE,OAAO,CAAC,WAAW,EAAE;aACxC,CAAC;YACF,wCAAwC;YACxC,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS,IAAI;gBAClD,YAAY,EAAE,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;aACjE,CAAC;YACF,oCAAoC;YACpC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI;gBAC/C,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;aACnC,CAAC;SACH,CAAC;QAEF,qBAAqB;QACrB,IAAI,CAAC,eAAe,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAuB,EAAE,GAAG,WAAW,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjD,OAAO,CAAC,IAAI,CAAC,iDAAiD,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,OAAe;QAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAW,CAAC,EAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,OAAO;YACL,GAAG,EAAE,aAAa;YAClB,GAAG,EAAE,aAAa;YAClB,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA0C;QAC7E,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SACjC,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAyB;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;QACrD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAyB;QACrD,wDAAwD;QACxD,+CAA+C;QAC/C,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC/B,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAkE;IAElE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAsC,EAAE,CAAC;IAErD,mDAAmD;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,KAAK;YACb,cAAc,EAAE,YAAY;YAC5B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEzB,8BAA8B;QAC9B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,GAAG,IAAoB,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAE5C,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACnC,qEAAqE;YACrE,oBAAoB,CAAC,GAAG,CAAE,OAA8B,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,OAAuB,CAAC;YAC1C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAC;IAC1E,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAC;IAEhF,IAAI,cAAoD,CAAC;IACzD,IAAI,aAAa,EAAE,CAAC;QAClB,cAAc,GAAG,QAAQ,CAAC;IAC5B,CAAC;SAAM,IAAI,mBAAmB,EAAE,CAAC;QAC/B,cAAc,GAAG,YAAY,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,cAAc,GAAG,UAAU,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,cAAc;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,OAAO,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,mEAAmE;AAEnE,IAAI,cAAc,GAAuB,IAAI,CAAC;AAE9C,SAAS,gBAAgB;IACvB,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAoB;IACjD,OAAO,gBAAgB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA2B;IACzD,cAAc,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}
package/dist/types.d.ts CHANGED
@@ -41,5 +41,57 @@ export interface AuditLoggerOptions {
41
41
  console?: boolean;
42
42
  /** If true, suppress all output (useful in tests) */
43
43
  silent?: boolean;
44
+ /** HMAC secret for signing AAR receipts */
45
+ hmacSecret?: string;
46
+ /** Actor identity for pre-action records */
47
+ actorId?: string;
48
+ }
49
+ export interface AARSignature {
50
+ alg: 'EdDSA' | 'HMAC-SHA256';
51
+ kid: string;
52
+ sig: string;
53
+ }
54
+ export interface AARPreAction {
55
+ id: string;
56
+ version: 'aar-v1';
57
+ phase: 'pre-action';
58
+ toolName: string;
59
+ toolCallId: string;
60
+ inputDigest: string;
61
+ actorId: string;
62
+ sessionId?: string;
63
+ policyRef?: string;
64
+ approvalDecision?: 'approved' | 'denied' | 'conditional';
65
+ decidedBy?: string;
66
+ issuedAt: string;
67
+ previousReceiptHash?: string;
68
+ signature?: AARSignature;
69
+ }
70
+ export type AARTerminalPhase = 'executed' | 'failed' | 'denied' | 'expired' | 'cancelled';
71
+ export interface AARTerminalReceipt {
72
+ id: string;
73
+ version: 'aar-v1';
74
+ phase: AARTerminalPhase;
75
+ preActionId: string;
76
+ toolCallId: string;
77
+ terminalAt: string;
78
+ terminalReason?: string;
79
+ executionStartedAt?: string;
80
+ executionEndedAt?: string;
81
+ resultDigest?: string;
82
+ errorClass?: string;
83
+ previousReceiptHash: string;
84
+ signature?: AARSignature;
85
+ }
86
+ /** @deprecated Use AARTerminalReceipt instead */
87
+ export type AARPostAction = AARTerminalReceipt;
88
+ export interface ChainVerificationResult {
89
+ intact: boolean;
90
+ chainIntegrity: 'complete' | 'incomplete' | 'broken';
91
+ breaks: Array<{
92
+ id: string;
93
+ expected: string | undefined;
94
+ actual: string | undefined;
95
+ }>;
44
96
  }
45
97
  //# sourceMappingURL=types.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,sCAAsC;AACtC,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,mCAAmC;AACnC,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,sCAAsC;AACtC,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,OAAO,GAAG,aAAa,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE1F,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAE/C,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC;IACrD,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;CACzF"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@agentlair/audit-logger",
3
- "version": "0.1.0",
3
+ "version": "0.3.0",
4
4
  "description": "Framework-agnostic agent action logger. Logs locally by default. Connect to AgentLair for persistent, queryable audit trails.",
5
5
  "keywords": [
6
6
  "ai-agent",