@catp-protocol/cli 0.7.3 → 0.7.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit/durable.d.ts +68 -0
- package/dist/audit/durable.d.ts.map +1 -0
- package/dist/audit/durable.js +214 -0
- package/dist/audit/durable.js.map +1 -0
- package/dist/audit/logger.d.ts +51 -5
- package/dist/audit/logger.d.ts.map +1 -1
- package/dist/audit/logger.js +99 -20
- package/dist/audit/logger.js.map +1 -1
- package/dist/audit/paths.d.ts +11 -0
- package/dist/audit/paths.d.ts.map +1 -1
- package/dist/audit/paths.js +19 -0
- package/dist/audit/paths.js.map +1 -1
- package/dist/audit/verifier.d.ts +9 -0
- package/dist/audit/verifier.d.ts.map +1 -1
- package/dist/audit/verifier.js +70 -18
- package/dist/audit/verifier.js.map +1 -1
- package/dist/cli.js +11 -11
- package/dist/cli.js.map +1 -1
- package/dist/commands/authorization.js +6 -0
- package/dist/commands/authorization.js.map +1 -1
- package/dist/commands/log.d.ts +41 -1
- package/dist/commands/log.d.ts.map +1 -1
- package/dist/commands/log.js +82 -22
- package/dist/commands/log.js.map +1 -1
- package/dist/commands/receipt.d.ts +71 -1
- package/dist/commands/receipt.d.ts.map +1 -1
- package/dist/commands/receipt.js +344 -72
- package/dist/commands/receipt.js.map +1 -1
- package/dist/enforcement/core.d.ts +10 -4
- package/dist/enforcement/core.d.ts.map +1 -1
- package/dist/enforcement/core.js +40 -4
- package/dist/enforcement/core.js.map +1 -1
- package/dist/evidence/canonical.d.ts +22 -0
- package/dist/evidence/canonical.d.ts.map +1 -0
- package/dist/evidence/canonical.js +45 -0
- package/dist/evidence/canonical.js.map +1 -0
- package/dist/evidence/commitments.d.ts +46 -0
- package/dist/evidence/commitments.d.ts.map +1 -0
- package/dist/evidence/commitments.js +52 -0
- package/dist/evidence/commitments.js.map +1 -0
- package/dist/hook/post.d.ts +6 -0
- package/dist/hook/post.d.ts.map +1 -1
- package/dist/hook/post.js +1 -1
- package/dist/hook/post.js.map +1 -1
- package/dist/hook/pre.d.ts +6 -0
- package/dist/hook/pre.d.ts.map +1 -1
- package/dist/hook/pre.js +4 -1
- package/dist/hook/pre.js.map +1 -1
- package/dist/policy/types.d.ts +25 -2
- package/dist/policy/types.d.ts.map +1 -1
- package/package.json +1 -1
package/dist/commands/log.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAanD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAO1B;IACC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,eAAe,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;YACxC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,MAAM,0BAA0B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,CAAC;YAChD,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAwB;IAChD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA0B;IACnD,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B,EAAE,IAAoD;IAC1G,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAa,EAAE,IAA+B;IAC5E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,4BAA4B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC9G,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEpD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,WAAW,CAAC,WAAW,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe,EAAE,IAA2F;IAC9I,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACpC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkB;IAClE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB;QACrC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAe,CAAC;gBACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,YAAY,IAAI,CAAC,IAAI,oBAAoB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,mBAAmB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,MAAM,GAAG,CAAC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
1
|
+
{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAA8B,MAAM,4BAA4B,CAAC;AAGjG,iFAAiF;AACjF,gFAAgF;AAChF,4EAA4E;AAC5E,OAAO,EAAE,eAAe,EAAE,CAAC;AAY3B,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AA0BxD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAO1B;IACC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,eAAe,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;YACxC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,MAAM,0BAA0B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,CAAC;YAChD,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAwB;IAChD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA0B;IACnD,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B,EAAE,IAAoD;IAC1G,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAa,EAAE,IAA+B;IAC5E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,4BAA4B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC9G,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEpD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,UAAU,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,CAAC,aAAa,IAAI,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe,EAAE,IAA2F;IAC9I,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACpC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkB;IAClE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB;QACrC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,UAAkB;IACpE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7B,IAAI,QAAQ,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAe,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,SAAS,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0B,CAAC;IAClF,IAAI,uBAAuB,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAsB;QAC9B,cAAc,EAAE,sBAAsB;QACtC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,cAAc,EAAE,KAAK,CAAC,KAAK;QAC3B,OAAO;QACP,MAAM;KACP,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,OAAO,SAAS,CAAC,sBAAsB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,UAA6B;IACtE,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAe,CAAC;gBACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,YAAY,IAAI,CAAC,IAAI,oBAAoB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,mBAAmB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { type AuditExport } from "./log.js";
|
|
1
|
+
import { type AuditExport, type AuditExportV2 } from "./log.js";
|
|
2
2
|
import type { CatpPolicy } from "../policy/types.js";
|
|
3
3
|
export interface AuthorizationReceiptPayload {
|
|
4
4
|
receiptVersion: "catp_authorization_receipt_v1";
|
|
@@ -17,13 +17,47 @@ export interface AuthorizationReceiptPayload {
|
|
|
17
17
|
export interface AuthorizationReceipt extends AuthorizationReceiptPayload {
|
|
18
18
|
signature: string;
|
|
19
19
|
}
|
|
20
|
+
/**
|
|
21
|
+
* Version-2 authorization receipt body. Every security-relevant binding is
|
|
22
|
+
* COPIED from the enforcement-time v4 audit entry: `policy_commitment` and
|
|
23
|
+
* `action_commitment` are never re-derived from the current policy file. The
|
|
24
|
+
* body also pins the exact self-contained v2 audit export via
|
|
25
|
+
* `audit_export_sha256`, and identifies the issuer by `issuer_key_id`
|
|
26
|
+
* (SHA-256 of the public key's DER SubjectPublicKeyInfo).
|
|
27
|
+
*/
|
|
28
|
+
export interface AuthorizationReceiptV2Body {
|
|
29
|
+
receipt_version: "catp_authorization_receipt_v2";
|
|
30
|
+
audit_commitment: string;
|
|
31
|
+
policy_commitment: string;
|
|
32
|
+
action_commitment: string;
|
|
33
|
+
audit_export_sha256: string;
|
|
34
|
+
agent_id: string;
|
|
35
|
+
tool: string;
|
|
36
|
+
decision: "allow" | "deny";
|
|
37
|
+
phase: "pre";
|
|
38
|
+
rule_matched: string | null;
|
|
39
|
+
reason: string;
|
|
40
|
+
timestamp: string;
|
|
41
|
+
signed_at: string;
|
|
42
|
+
issuer_key_id: string;
|
|
43
|
+
signature_algorithm: "Ed25519";
|
|
44
|
+
}
|
|
45
|
+
export interface AuthorizationReceiptV2 extends AuthorizationReceiptV2Body {
|
|
46
|
+
signature: string;
|
|
47
|
+
receipt_sha256: string;
|
|
48
|
+
}
|
|
49
|
+
/** SHA-256 of the public key's DER SubjectPublicKeyInfo bytes. */
|
|
50
|
+
export declare function computeIssuerKeyId(publicKeyPem: string): string;
|
|
20
51
|
export interface ReceiptVerificationSummary {
|
|
21
52
|
authorizationReceipt: "valid";
|
|
53
|
+
receiptVersion: "catp_authorization_receipt_v1" | "catp_authorization_receipt_v2";
|
|
54
|
+
assurance: "legacy" | "enforcement-time-bound";
|
|
22
55
|
auditExport: "matched" | null;
|
|
23
56
|
policy: "matched" | null;
|
|
24
57
|
auditCommitment: string;
|
|
25
58
|
auditExportHash: string;
|
|
26
59
|
policyCommitment: string | null;
|
|
60
|
+
actionCommitment: string | null;
|
|
27
61
|
agentId: string;
|
|
28
62
|
tool: string;
|
|
29
63
|
decision: "allow" | "deny";
|
|
@@ -66,4 +100,40 @@ export declare function verifyAuthorizationReceipt(receipt: AuthorizationReceipt
|
|
|
66
100
|
export declare function verifyReceiptAuditExport(receipt: AuthorizationReceipt, auditExport: AuditExport): void;
|
|
67
101
|
export declare function verifyReceiptPolicy(receipt: AuthorizationReceipt, policy: CatpPolicy): void;
|
|
68
102
|
export declare function computePolicyCommitment(policy: CatpPolicy): string;
|
|
103
|
+
/**
|
|
104
|
+
* Structural + cryptographic validation of a self-contained v2 audit export.
|
|
105
|
+
* Recomputes `export_sha256` over the body, requires the prefix length to match
|
|
106
|
+
* `selected_index + 1`, requires a commitment-version-4 selected entry, and
|
|
107
|
+
* requires the bundled complete action to reproduce that entry's
|
|
108
|
+
* `action_commitment`.
|
|
109
|
+
*/
|
|
110
|
+
export declare function validateAuditExportV2(value: unknown): asserts value is AuditExportV2;
|
|
111
|
+
/**
|
|
112
|
+
* Sign a v2 receipt. `policy_commitment` and `action_commitment` are copied
|
|
113
|
+
* verbatim from the enforcement-time entry — never re-derived from any current
|
|
114
|
+
* policy file.
|
|
115
|
+
*/
|
|
116
|
+
export declare function signAuthorizationReceiptV2(auditExport: AuditExportV2, privateKeyPem: string, opts?: {
|
|
117
|
+
signedAt?: string;
|
|
118
|
+
}): AuthorizationReceiptV2;
|
|
119
|
+
export declare function validateReceiptV2(value: unknown): asserts value is AuthorizationReceiptV2;
|
|
120
|
+
/**
|
|
121
|
+
* Offline-verify a v2 receipt against an INDEPENDENTLY supplied trusted public
|
|
122
|
+
* key. Recomputes `issuer_key_id` from that key and requires an exact match
|
|
123
|
+
* before accepting the signature, then checks `receipt_sha256` and the Ed25519
|
|
124
|
+
* signature over the domain-separated body.
|
|
125
|
+
*/
|
|
126
|
+
export declare function verifyAuthorizationReceiptV2(receipt: AuthorizationReceiptV2, trustedPublicKeyPem: string): void;
|
|
127
|
+
/**
|
|
128
|
+
* Cross-check a v2 receipt against its self-contained audit export: export hash,
|
|
129
|
+
* selected-entry equality for all three bindings, and the complete-action hash.
|
|
130
|
+
* Offline chain integrity over the prefix is enforced by `validateAuditExportV2`.
|
|
131
|
+
*/
|
|
132
|
+
export declare function verifyReceiptAuditExportV2(receipt: AuthorizationReceiptV2, auditExport: AuditExportV2): void;
|
|
133
|
+
/**
|
|
134
|
+
* Optional policy-file check. The supplied file is verification evidence only:
|
|
135
|
+
* it is hashed with the SAME domained enforcement-time scheme and compared with
|
|
136
|
+
* the recorded commitment. A mismatch (e.g. a swapped policy) is rejected.
|
|
137
|
+
*/
|
|
138
|
+
export declare function verifyReceiptPolicyV2(receipt: AuthorizationReceiptV2, policy: CatpPolicy): void;
|
|
69
139
|
//# sourceMappingURL=receipt.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/commands/receipt.ts"],"names":[],"mappings":"AAEA,OAAO,
|
|
1
|
+
{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/commands/receipt.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,WAAW,EAChB,KAAK,aAAa,EAEnB,MAAM,UAAU,CAAC;AAIlB,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,SAAS,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,2BAA2B;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,eAAe,EAAE,+BAA+B,CAAC;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,sBAAuB,SAAQ,0BAA0B;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,+BAA+B,GAAG,+BAA+B,CAAC;IAClF,SAAS,EAAE,QAAQ,GAAG,wBAAwB,CAAC;IAC/C,WAAW,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYxF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkBrH;AA4BD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAsED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA6C1I;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACjE,oBAAoB,CAqBtB;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,GAAE,MAA6B,GAAG,IAAI,CAO3H;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAyBtG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAS3F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAElE;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CA6CpF;AAqBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,aAAa,EAC1B,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,sBAAsB,CA4BxB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAqCzF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAe/G;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAsB5G;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAM/F"}
|
package/dist/commands/receipt.js
CHANGED
|
@@ -1,8 +1,19 @@
|
|
|
1
1
|
import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
|
|
2
2
|
import { readFileSync, writeFileSync } from "node:fs";
|
|
3
|
-
import { auditLogFiles,
|
|
4
|
-
import { verifyChain } from "../audit/verifier.js";
|
|
3
|
+
import { auditLogFiles, buildAuditExportV2, computeAuditExportV2Sha256, latestAuditCommitment, selectedAuditExportV2Entry, stableStringify, } from "./log.js";
|
|
4
|
+
import { verifyChain, verifyEntryChain } from "../audit/verifier.js";
|
|
5
|
+
import { computeActionCommitment, computePolicyCommitment as computeEnforcementPolicyCommitment } from "../evidence/commitments.js";
|
|
5
6
|
import { findPolicyFile, loadPolicy } from "../policy/loader.js";
|
|
7
|
+
// Domain separators for version-2 receipts. The signature covers the receipt
|
|
8
|
+
// body; receipt_sha256 covers the body-plus-signature. Neither includes
|
|
9
|
+
// receipt_sha256 itself, so the hash is a stable external fingerprint.
|
|
10
|
+
const RECEIPT_SIGNATURE_V2_DOMAIN = "catp:receipt-signature:v2\n";
|
|
11
|
+
const RECEIPT_V2_DOMAIN = "catp:receipt:v2\n";
|
|
12
|
+
/** SHA-256 of the public key's DER SubjectPublicKeyInfo bytes. */
|
|
13
|
+
export function computeIssuerKeyId(publicKeyPem) {
|
|
14
|
+
const der = createPublicKey(publicKeyPem).export({ type: "spki", format: "der" });
|
|
15
|
+
return createHash("sha256").update(der).digest("hex");
|
|
16
|
+
}
|
|
6
17
|
export function cmdReceiptKeygen(opts) {
|
|
7
18
|
const privateKeyPath = opts.privateKey ?? "catp-receipt-private.pem";
|
|
8
19
|
const publicKeyPath = opts.publicKey ?? "catp-receipt-public.pem";
|
|
@@ -22,23 +33,33 @@ export function cmdReceiptSign(opts) {
|
|
|
22
33
|
if (!opts.privateKey) {
|
|
23
34
|
throw new Error("missing --private-key <path>");
|
|
24
35
|
}
|
|
25
|
-
const auditExport =
|
|
26
|
-
|
|
36
|
+
const auditExport = readAuditExportV2(opts.auditExport);
|
|
37
|
+
const selected = selectedPreEnforcementV4Entry(auditExport);
|
|
38
|
+
// --file is verification evidence, never the binding source: it must
|
|
39
|
+
// reproduce the enforcement-time policy_commitment copied from the entry.
|
|
40
|
+
if (opts.file) {
|
|
41
|
+
assertPolicyMatchesEnforcementCommitment(loadPolicy(opts.file), selected.policy_commitment);
|
|
42
|
+
}
|
|
27
43
|
const privateKeyPem = readFileSync(opts.privateKey, "utf8");
|
|
28
|
-
const
|
|
29
|
-
|
|
30
|
-
|
|
44
|
+
const receipt = signAuthorizationReceiptV2(auditExport, privateKeyPem);
|
|
45
|
+
writeReceiptV2Output(receipt, selected, opts.out);
|
|
46
|
+
}
|
|
47
|
+
function writeReceiptV2Output(receipt, selected, out, auditExportOut) {
|
|
31
48
|
const json = stableStringify(receipt, 2) + "\n";
|
|
32
|
-
if (
|
|
33
|
-
writeFileSync(
|
|
34
|
-
process.stdout.write(`Wrote authorization receipt to ${
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
process.stdout.write(`
|
|
39
|
-
process.stdout.write(`
|
|
40
|
-
process.stdout.write(`
|
|
41
|
-
process.stdout.write(`
|
|
49
|
+
if (out) {
|
|
50
|
+
writeFileSync(out, json, "utf8");
|
|
51
|
+
process.stdout.write(`Wrote authorization receipt to ${out}\n`);
|
|
52
|
+
if (auditExportOut) {
|
|
53
|
+
process.stdout.write(`Wrote audit export to ${auditExportOut}\n`);
|
|
54
|
+
}
|
|
55
|
+
process.stdout.write(`auditCommitment=${receipt.audit_commitment}\n`);
|
|
56
|
+
process.stdout.write(`auditExportSha256=${receipt.audit_export_sha256}\n`);
|
|
57
|
+
process.stdout.write(`policyCommitment=${receipt.policy_commitment}\n`);
|
|
58
|
+
process.stdout.write(`actionCommitment=${receipt.action_commitment}\n`);
|
|
59
|
+
process.stdout.write(`selectedTool=${selected.tool}\n`);
|
|
60
|
+
process.stdout.write(`selectedDecision=${selected.decision}\n`);
|
|
61
|
+
process.stdout.write(`selectedTimestamp=${selected.ts}\n`);
|
|
62
|
+
process.stdout.write(`selectedInputSummary=${selected.input_summary}\n`);
|
|
42
63
|
return;
|
|
43
64
|
}
|
|
44
65
|
process.stdout.write(json);
|
|
@@ -71,33 +92,22 @@ async function issueReceipt(opts) {
|
|
|
71
92
|
}
|
|
72
93
|
await verifyAuditLogIntegrity(agentId);
|
|
73
94
|
const commitment = resolveIssueCommitment(agentId, opts);
|
|
74
|
-
|
|
75
|
-
|
|
95
|
+
// Build the self-contained v2 bundle and require a pre-enforcement v4 entry.
|
|
96
|
+
// The receipt's policy/action commitments are copied from that entry, never
|
|
97
|
+
// re-derived from the current policy file.
|
|
98
|
+
const auditExport = buildAuditExportV2(agentId, commitment);
|
|
99
|
+
const selected = selectedPreEnforcementV4Entry(auditExport);
|
|
100
|
+
// An explicit --file is verification evidence only: it must reproduce the
|
|
101
|
+
// enforcement-time policy_commitment already recorded in the entry.
|
|
102
|
+
if (opts.file) {
|
|
103
|
+
assertPolicyMatchesEnforcementCommitment(loadPolicy(opts.file), selected.policy_commitment);
|
|
104
|
+
}
|
|
76
105
|
const privateKeyPem = readFileSync(opts.privateKey, "utf8");
|
|
77
|
-
const
|
|
78
|
-
const receipt = signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, {
|
|
79
|
-
policyCommitment: policy ? computePolicyCommitment(policy) : null,
|
|
80
|
-
});
|
|
106
|
+
const receipt = signAuthorizationReceiptV2(auditExport, privateKeyPem);
|
|
81
107
|
if (opts.auditExportOut) {
|
|
82
108
|
writeFileSync(opts.auditExportOut, stableStringify(auditExport, 2) + "\n", "utf8");
|
|
83
109
|
}
|
|
84
|
-
|
|
85
|
-
if (opts.out) {
|
|
86
|
-
writeFileSync(opts.out, json, "utf8");
|
|
87
|
-
process.stdout.write(`Wrote authorization receipt to ${opts.out}\n`);
|
|
88
|
-
if (opts.auditExportOut) {
|
|
89
|
-
process.stdout.write(`Wrote audit export to ${opts.auditExportOut}\n`);
|
|
90
|
-
}
|
|
91
|
-
process.stdout.write(`auditCommitment=${receipt.auditCommitment}\n`);
|
|
92
|
-
process.stdout.write(`auditExportHash=${receipt.auditExportHash}\n`);
|
|
93
|
-
process.stdout.write(`policyCommitment=${receipt.policyCommitment ?? "none"}\n`);
|
|
94
|
-
process.stdout.write(`selectedTool=${auditExport.entry.tool}\n`);
|
|
95
|
-
process.stdout.write(`selectedDecision=${auditExport.entry.decision}\n`);
|
|
96
|
-
process.stdout.write(`selectedTimestamp=${auditExport.entry.ts}\n`);
|
|
97
|
-
process.stdout.write(`selectedInputSummary=${auditExport.entry.input_summary}\n`);
|
|
98
|
-
return;
|
|
99
|
-
}
|
|
100
|
-
process.stdout.write(json);
|
|
110
|
+
writeReceiptV2Output(receipt, selected, opts.out, opts.auditExportOut);
|
|
101
111
|
}
|
|
102
112
|
function resolveIssueCommitment(agentId, opts) {
|
|
103
113
|
if (opts.commitment) {
|
|
@@ -116,34 +126,36 @@ export function cmdReceiptVerify(opts) {
|
|
|
116
126
|
if (!opts.publicKey) {
|
|
117
127
|
throw new Error("missing --public-key <path>; receipt verification requires a trusted external public key");
|
|
118
128
|
}
|
|
119
|
-
|
|
129
|
+
// The trusted public key is supplied independently of the receipt; it is never
|
|
130
|
+
// taken from the receipt itself.
|
|
120
131
|
const publicKeyPem = readFileSync(opts.publicKey, "utf8");
|
|
132
|
+
const receipt = readAuthorizationReceiptAny(opts.receipt);
|
|
133
|
+
if (isReceiptV2(receipt)) {
|
|
134
|
+
verifyAuthorizationReceiptV2(receipt, publicKeyPem);
|
|
135
|
+
if (opts.auditExport) {
|
|
136
|
+
verifyReceiptAuditExportV2(receipt, readAuditExportV2(opts.auditExport));
|
|
137
|
+
}
|
|
138
|
+
if (opts.file) {
|
|
139
|
+
verifyReceiptPolicyV2(receipt, loadPolicy(opts.file));
|
|
140
|
+
}
|
|
141
|
+
emitVerificationSummary(receiptVerificationSummaryV2(receipt, {
|
|
142
|
+
auditExportMatched: Boolean(opts.auditExport),
|
|
143
|
+
policyMatched: Boolean(opts.file),
|
|
144
|
+
}), opts);
|
|
145
|
+
return;
|
|
146
|
+
}
|
|
147
|
+
// Legacy version-1 receipts keep their historical semantics and assurance.
|
|
121
148
|
verifyAuthorizationReceipt(receipt, publicKeyPem);
|
|
122
149
|
if (opts.auditExport) {
|
|
123
|
-
|
|
124
|
-
verifyReceiptAuditExport(receipt, auditExport);
|
|
150
|
+
verifyReceiptAuditExport(receipt, readAuditExport(opts.auditExport));
|
|
125
151
|
}
|
|
126
152
|
if (opts.file) {
|
|
127
153
|
verifyReceiptPolicy(receipt, loadPolicy(opts.file));
|
|
128
154
|
}
|
|
129
|
-
|
|
155
|
+
emitVerificationSummary(receiptVerificationSummary(receipt, {
|
|
130
156
|
auditExportMatched: Boolean(opts.auditExport),
|
|
131
157
|
policyMatched: Boolean(opts.file),
|
|
132
|
-
});
|
|
133
|
-
if (opts.json) {
|
|
134
|
-
process.stdout.write(stableStringify(summary, 2) + "\n");
|
|
135
|
-
return;
|
|
136
|
-
}
|
|
137
|
-
process.stdout.write("authorizationReceipt=valid\n");
|
|
138
|
-
if (opts.auditExport) {
|
|
139
|
-
process.stdout.write("auditExport=matched\n");
|
|
140
|
-
}
|
|
141
|
-
if (opts.file) {
|
|
142
|
-
process.stdout.write("policy=matched\n");
|
|
143
|
-
}
|
|
144
|
-
process.stdout.write(`auditCommitment=${summary.auditCommitment}\n`);
|
|
145
|
-
process.stdout.write(`auditExportHash=${summary.auditExportHash}\n`);
|
|
146
|
-
process.stdout.write(`policyCommitment=${summary.policyCommitment ?? "none"}\n`);
|
|
158
|
+
}), opts);
|
|
147
159
|
}
|
|
148
160
|
export function signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, opts = {}) {
|
|
149
161
|
validateAuditExport(auditExport);
|
|
@@ -214,14 +226,233 @@ export function verifyReceiptPolicy(receipt, policy) {
|
|
|
214
226
|
export function computePolicyCommitment(policy) {
|
|
215
227
|
return sha256Hex(stableStringify(policy));
|
|
216
228
|
}
|
|
229
|
+
// ---------------------------------------------------------------------------
|
|
230
|
+
// Version-2 receipts: issued only from recorded enforcement-time bindings.
|
|
231
|
+
// ---------------------------------------------------------------------------
|
|
232
|
+
/**
|
|
233
|
+
* Structural + cryptographic validation of a self-contained v2 audit export.
|
|
234
|
+
* Recomputes `export_sha256` over the body, requires the prefix length to match
|
|
235
|
+
* `selected_index + 1`, requires a commitment-version-4 selected entry, and
|
|
236
|
+
* requires the bundled complete action to reproduce that entry's
|
|
237
|
+
* `action_commitment`.
|
|
238
|
+
*/
|
|
239
|
+
export function validateAuditExportV2(value) {
|
|
240
|
+
if (!value || typeof value !== "object") {
|
|
241
|
+
throw new Error("audit export must be an object");
|
|
242
|
+
}
|
|
243
|
+
const exp = value;
|
|
244
|
+
if (exp.export_version !== "catp_audit_export_v2") {
|
|
245
|
+
throw new Error("audit export version must be catp_audit_export_v2");
|
|
246
|
+
}
|
|
247
|
+
if (typeof exp.agent_id !== "string" || exp.agent_id === "") {
|
|
248
|
+
throw new Error("audit export agent_id must be a non-empty string");
|
|
249
|
+
}
|
|
250
|
+
if (typeof exp.log_date !== "string" || exp.log_date === "") {
|
|
251
|
+
throw new Error("audit export log_date must be a non-empty string");
|
|
252
|
+
}
|
|
253
|
+
if (!Number.isInteger(exp.selected_index) || exp.selected_index < 0) {
|
|
254
|
+
throw new Error("audit export selected_index must be a non-negative integer");
|
|
255
|
+
}
|
|
256
|
+
if (!Array.isArray(exp.entries) || exp.entries.length !== exp.selected_index + 1) {
|
|
257
|
+
throw new Error("audit export entries must be the daily prefix through selected_index");
|
|
258
|
+
}
|
|
259
|
+
if (!exp.action || typeof exp.action !== "object") {
|
|
260
|
+
throw new Error("audit export action must be an object");
|
|
261
|
+
}
|
|
262
|
+
assertHex(exp.export_sha256, "audit export export_sha256");
|
|
263
|
+
const { export_sha256, ...body } = exp;
|
|
264
|
+
if (computeAuditExportV2Sha256(body) !== export_sha256) {
|
|
265
|
+
throw new Error("audit export v2 export_sha256 does not match body");
|
|
266
|
+
}
|
|
267
|
+
const selected = selectedAuditExportV2Entry(exp);
|
|
268
|
+
if (!selected || typeof selected !== "object") {
|
|
269
|
+
throw new Error("audit export selected entry must be an object");
|
|
270
|
+
}
|
|
271
|
+
if (selected.commitment_version !== 4) {
|
|
272
|
+
throw new Error("audit export v2 selected entry must be commitment version 4");
|
|
273
|
+
}
|
|
274
|
+
if (computeActionCommitment(exp.action) !== selected.action_commitment) {
|
|
275
|
+
throw new Error("audit export action does not match the selected entry action_commitment");
|
|
276
|
+
}
|
|
277
|
+
// Enforce the same offline chain integrity here that buildAuditExportV2 and
|
|
278
|
+
// verifyReceiptAuditExportV2 enforce, so `receipt sign` can never sign over a
|
|
279
|
+
// bundle whose recorded prefix was tampered with.
|
|
280
|
+
const chain = verifyEntryChain(exp.entries);
|
|
281
|
+
if (!chain.ok) {
|
|
282
|
+
throw new Error(`audit export chain is broken at entry ${chain.broken_at}: ${chain.message}`);
|
|
283
|
+
}
|
|
284
|
+
}
|
|
285
|
+
function readAuditExportV2(path) {
|
|
286
|
+
const parsed = JSON.parse(readFileSync(path, "utf8"));
|
|
287
|
+
validateAuditExportV2(parsed);
|
|
288
|
+
return parsed;
|
|
289
|
+
}
|
|
290
|
+
// The selected entry must be a pre-enforcement v4 record; post-action and
|
|
291
|
+
// legacy entries can never authorize.
|
|
292
|
+
function selectedPreEnforcementV4Entry(exp) {
|
|
293
|
+
const selected = selectedAuditExportV2Entry(exp);
|
|
294
|
+
if (!selected || selected.commitment_version !== 4) {
|
|
295
|
+
throw new Error("authorization receipts require a commitment version 4 audit entry");
|
|
296
|
+
}
|
|
297
|
+
if (selected.phase !== "pre") {
|
|
298
|
+
throw new Error("authorization receipts require a pre-enforcement audit entry");
|
|
299
|
+
}
|
|
300
|
+
return selected;
|
|
301
|
+
}
|
|
302
|
+
/**
|
|
303
|
+
* Sign a v2 receipt. `policy_commitment` and `action_commitment` are copied
|
|
304
|
+
* verbatim from the enforcement-time entry — never re-derived from any current
|
|
305
|
+
* policy file.
|
|
306
|
+
*/
|
|
307
|
+
export function signAuthorizationReceiptV2(auditExport, privateKeyPem, opts = {}) {
|
|
308
|
+
validateAuditExportV2(auditExport);
|
|
309
|
+
const selected = selectedPreEnforcementV4Entry(auditExport);
|
|
310
|
+
const publicKeyPem = derivePublicKeyPem(privateKeyPem);
|
|
311
|
+
const body = {
|
|
312
|
+
receipt_version: "catp_authorization_receipt_v2",
|
|
313
|
+
audit_commitment: selected.commitment,
|
|
314
|
+
policy_commitment: selected.policy_commitment,
|
|
315
|
+
action_commitment: selected.action_commitment,
|
|
316
|
+
audit_export_sha256: auditExport.export_sha256,
|
|
317
|
+
agent_id: auditExport.agent_id,
|
|
318
|
+
tool: selected.tool,
|
|
319
|
+
decision: selected.decision,
|
|
320
|
+
phase: "pre",
|
|
321
|
+
rule_matched: selected.rule_matched,
|
|
322
|
+
reason: selected.reason,
|
|
323
|
+
timestamp: selected.ts,
|
|
324
|
+
signed_at: opts.signedAt ?? new Date().toISOString(),
|
|
325
|
+
issuer_key_id: computeIssuerKeyId(publicKeyPem),
|
|
326
|
+
signature_algorithm: "Ed25519",
|
|
327
|
+
};
|
|
328
|
+
const signature = sign(null, Buffer.from(RECEIPT_SIGNATURE_V2_DOMAIN + stableStringify(body)), privateKeyPem).toString("base64");
|
|
329
|
+
const receipt_sha256 = sha256Hex(RECEIPT_V2_DOMAIN + stableStringify({ ...body, signature }));
|
|
330
|
+
const receipt = { ...body, signature, receipt_sha256 };
|
|
331
|
+
// Fail closed at signing time rather than emitting a receipt that offline
|
|
332
|
+
// verification would later reject.
|
|
333
|
+
validateReceiptV2(receipt);
|
|
334
|
+
return receipt;
|
|
335
|
+
}
|
|
336
|
+
export function validateReceiptV2(value) {
|
|
337
|
+
if (!value || typeof value !== "object") {
|
|
338
|
+
throw new Error("authorization receipt must be an object");
|
|
339
|
+
}
|
|
340
|
+
const receipt = value;
|
|
341
|
+
if (receipt.receipt_version !== "catp_authorization_receipt_v2") {
|
|
342
|
+
throw new Error("receipt_version must be catp_authorization_receipt_v2");
|
|
343
|
+
}
|
|
344
|
+
if (receipt.signature_algorithm !== "Ed25519") {
|
|
345
|
+
throw new Error("signature_algorithm must be Ed25519");
|
|
346
|
+
}
|
|
347
|
+
if (receipt.phase !== "pre") {
|
|
348
|
+
throw new Error("phase must be pre");
|
|
349
|
+
}
|
|
350
|
+
if (receipt.decision !== "allow" && receipt.decision !== "deny") {
|
|
351
|
+
throw new Error("decision must be allow or deny");
|
|
352
|
+
}
|
|
353
|
+
if (receipt.rule_matched !== null && typeof receipt.rule_matched !== "string") {
|
|
354
|
+
throw new Error("rule_matched must be a string or null");
|
|
355
|
+
}
|
|
356
|
+
assertHex(receipt.audit_commitment, "audit_commitment");
|
|
357
|
+
assertHex(receipt.policy_commitment, "policy_commitment");
|
|
358
|
+
assertHex(receipt.action_commitment, "action_commitment");
|
|
359
|
+
assertHex(receipt.audit_export_sha256, "audit_export_sha256");
|
|
360
|
+
assertHex(receipt.issuer_key_id, "issuer_key_id");
|
|
361
|
+
assertHex(receipt.receipt_sha256, "receipt_sha256");
|
|
362
|
+
// `reason` is explanatory metadata copied verbatim from the v4 entry; match
|
|
363
|
+
// that contract (a string, possibly empty) rather than imposing a stricter
|
|
364
|
+
// non-empty rule the recorded entry does not guarantee.
|
|
365
|
+
if (typeof receipt.reason !== "string") {
|
|
366
|
+
throw new Error("reason must be a string");
|
|
367
|
+
}
|
|
368
|
+
for (const field of ["agent_id", "tool", "timestamp", "signed_at", "signature"]) {
|
|
369
|
+
if (typeof receipt[field] !== "string" || receipt[field] === "") {
|
|
370
|
+
throw new Error(`${field} must be a non-empty string`);
|
|
371
|
+
}
|
|
372
|
+
}
|
|
373
|
+
}
|
|
374
|
+
/**
|
|
375
|
+
* Offline-verify a v2 receipt against an INDEPENDENTLY supplied trusted public
|
|
376
|
+
* key. Recomputes `issuer_key_id` from that key and requires an exact match
|
|
377
|
+
* before accepting the signature, then checks `receipt_sha256` and the Ed25519
|
|
378
|
+
* signature over the domain-separated body.
|
|
379
|
+
*/
|
|
380
|
+
export function verifyAuthorizationReceiptV2(receipt, trustedPublicKeyPem) {
|
|
381
|
+
validateReceiptV2(receipt);
|
|
382
|
+
const expectedKeyId = computeIssuerKeyId(trustedPublicKeyPem);
|
|
383
|
+
if (receipt.issuer_key_id !== expectedKeyId) {
|
|
384
|
+
throw new Error("receipt issuer_key_id does not match the trusted public key");
|
|
385
|
+
}
|
|
386
|
+
const { receipt_sha256, signature, ...body } = receipt;
|
|
387
|
+
const expectedReceiptSha256 = sha256Hex(RECEIPT_V2_DOMAIN + stableStringify({ ...body, signature }));
|
|
388
|
+
if (receipt_sha256 !== expectedReceiptSha256) {
|
|
389
|
+
throw new Error("receipt_sha256 does not match the signed receipt body");
|
|
390
|
+
}
|
|
391
|
+
const ok = verify(null, Buffer.from(RECEIPT_SIGNATURE_V2_DOMAIN + stableStringify(body)), trustedPublicKeyPem, Buffer.from(signature, "base64"));
|
|
392
|
+
if (!ok) {
|
|
393
|
+
throw new Error("authorization receipt signature is invalid");
|
|
394
|
+
}
|
|
395
|
+
}
|
|
396
|
+
/**
|
|
397
|
+
* Cross-check a v2 receipt against its self-contained audit export: export hash,
|
|
398
|
+
* selected-entry equality for all three bindings, and the complete-action hash.
|
|
399
|
+
* Offline chain integrity over the prefix is enforced by `validateAuditExportV2`.
|
|
400
|
+
*/
|
|
401
|
+
export function verifyReceiptAuditExportV2(receipt, auditExport) {
|
|
402
|
+
validateReceiptV2(receipt);
|
|
403
|
+
validateAuditExportV2(auditExport);
|
|
404
|
+
if (receipt.audit_export_sha256 !== auditExport.export_sha256) {
|
|
405
|
+
throw new Error("receipt audit_export_sha256 does not match audit export");
|
|
406
|
+
}
|
|
407
|
+
if (auditExport.agent_id !== receipt.agent_id) {
|
|
408
|
+
throw new Error("receipt agent_id does not match audit export");
|
|
409
|
+
}
|
|
410
|
+
const selected = selectedPreEnforcementV4Entry(auditExport);
|
|
411
|
+
if (selected.commitment !== receipt.audit_commitment) {
|
|
412
|
+
throw new Error("receipt audit_commitment does not match the selected audit entry");
|
|
413
|
+
}
|
|
414
|
+
if (selected.policy_commitment !== receipt.policy_commitment) {
|
|
415
|
+
throw new Error("receipt policy_commitment does not match the selected audit entry");
|
|
416
|
+
}
|
|
417
|
+
if (selected.action_commitment !== receipt.action_commitment) {
|
|
418
|
+
throw new Error("receipt action_commitment does not match the selected audit entry");
|
|
419
|
+
}
|
|
420
|
+
if (computeActionCommitment(auditExport.action) !== receipt.action_commitment) {
|
|
421
|
+
throw new Error("receipt action_commitment does not match the bundled complete action");
|
|
422
|
+
}
|
|
423
|
+
}
|
|
424
|
+
/**
|
|
425
|
+
* Optional policy-file check. The supplied file is verification evidence only:
|
|
426
|
+
* it is hashed with the SAME domained enforcement-time scheme and compared with
|
|
427
|
+
* the recorded commitment. A mismatch (e.g. a swapped policy) is rejected.
|
|
428
|
+
*/
|
|
429
|
+
export function verifyReceiptPolicyV2(receipt, policy) {
|
|
430
|
+
validateReceiptV2(receipt);
|
|
431
|
+
const policyCommitment = computeEnforcementPolicyCommitment(policy);
|
|
432
|
+
if (receipt.policy_commitment !== policyCommitment) {
|
|
433
|
+
throw new Error("receipt policy_commitment does not match policy");
|
|
434
|
+
}
|
|
435
|
+
}
|
|
436
|
+
// The supplied --file policy is evidence, never the source of the binding: it
|
|
437
|
+
// must reproduce the enforcement-time policy_commitment copied from the entry.
|
|
438
|
+
function assertPolicyMatchesEnforcementCommitment(policy, enforcementPolicyCommitment) {
|
|
439
|
+
if (computeEnforcementPolicyCommitment(policy) !== enforcementPolicyCommitment) {
|
|
440
|
+
throw new Error("supplied policy file does not match the enforcement-time policy_commitment");
|
|
441
|
+
}
|
|
442
|
+
}
|
|
217
443
|
function receiptVerificationSummary(receipt, opts) {
|
|
218
444
|
return {
|
|
219
445
|
authorizationReceipt: "valid",
|
|
446
|
+
receiptVersion: "catp_authorization_receipt_v1",
|
|
447
|
+
// Legacy receipts predate enforcement-time policy/action binding; label
|
|
448
|
+
// their assurance honestly and never imply an exact-action binding.
|
|
449
|
+
assurance: "legacy",
|
|
220
450
|
auditExport: opts.auditExportMatched ? "matched" : null,
|
|
221
451
|
policy: opts.policyMatched ? "matched" : null,
|
|
222
452
|
auditCommitment: receipt.auditCommitment,
|
|
223
453
|
auditExportHash: receipt.auditExportHash,
|
|
224
454
|
policyCommitment: receipt.policyCommitment,
|
|
455
|
+
actionCommitment: null,
|
|
225
456
|
agentId: receipt.agentId,
|
|
226
457
|
tool: receipt.tool,
|
|
227
458
|
decision: receipt.decision,
|
|
@@ -229,14 +460,64 @@ function receiptVerificationSummary(receipt, opts) {
|
|
|
229
460
|
signedAt: receipt.signedAt,
|
|
230
461
|
};
|
|
231
462
|
}
|
|
232
|
-
function
|
|
463
|
+
function receiptVerificationSummaryV2(receipt, opts) {
|
|
464
|
+
return {
|
|
465
|
+
authorizationReceipt: "valid",
|
|
466
|
+
receiptVersion: "catp_authorization_receipt_v2",
|
|
467
|
+
assurance: "enforcement-time-bound",
|
|
468
|
+
auditExport: opts.auditExportMatched ? "matched" : null,
|
|
469
|
+
policy: opts.policyMatched ? "matched" : null,
|
|
470
|
+
auditCommitment: receipt.audit_commitment,
|
|
471
|
+
auditExportHash: receipt.audit_export_sha256,
|
|
472
|
+
policyCommitment: receipt.policy_commitment,
|
|
473
|
+
actionCommitment: receipt.action_commitment,
|
|
474
|
+
agentId: receipt.agent_id,
|
|
475
|
+
tool: receipt.tool,
|
|
476
|
+
decision: receipt.decision,
|
|
477
|
+
timestamp: receipt.timestamp,
|
|
478
|
+
signedAt: receipt.signed_at,
|
|
479
|
+
};
|
|
480
|
+
}
|
|
481
|
+
function emitVerificationSummary(summary, opts) {
|
|
482
|
+
if (opts.json) {
|
|
483
|
+
process.stdout.write(stableStringify(summary, 2) + "\n");
|
|
484
|
+
return;
|
|
485
|
+
}
|
|
486
|
+
process.stdout.write("authorizationReceipt=valid\n");
|
|
487
|
+
process.stdout.write(`receiptVersion=${summary.receiptVersion}\n`);
|
|
488
|
+
process.stdout.write(`assurance=${summary.assurance}\n`);
|
|
489
|
+
if (summary.auditExport) {
|
|
490
|
+
process.stdout.write("auditExport=matched\n");
|
|
491
|
+
}
|
|
492
|
+
if (summary.policy) {
|
|
493
|
+
process.stdout.write("policy=matched\n");
|
|
494
|
+
}
|
|
495
|
+
process.stdout.write(`auditCommitment=${summary.auditCommitment}\n`);
|
|
496
|
+
process.stdout.write(`auditExportHash=${summary.auditExportHash}\n`);
|
|
497
|
+
process.stdout.write(`policyCommitment=${summary.policyCommitment ?? "none"}\n`);
|
|
498
|
+
if (summary.actionCommitment) {
|
|
499
|
+
process.stdout.write(`actionCommitment=${summary.actionCommitment}\n`);
|
|
500
|
+
}
|
|
501
|
+
}
|
|
502
|
+
function isReceiptV2(value) {
|
|
503
|
+
return (typeof value === "object" &&
|
|
504
|
+
value !== null &&
|
|
505
|
+
value.receipt_version === "catp_authorization_receipt_v2");
|
|
506
|
+
}
|
|
507
|
+
// Read a receipt of either version. A v2 file is validated as v2; anything else
|
|
508
|
+
// must satisfy the legacy v1 shape (and is labelled legacy on verification).
|
|
509
|
+
function readAuthorizationReceiptAny(path) {
|
|
233
510
|
const parsed = JSON.parse(readFileSync(path, "utf8"));
|
|
234
|
-
|
|
511
|
+
if (isReceiptV2(parsed)) {
|
|
512
|
+
validateReceiptV2(parsed);
|
|
513
|
+
return parsed;
|
|
514
|
+
}
|
|
515
|
+
validateReceipt(parsed);
|
|
235
516
|
return parsed;
|
|
236
517
|
}
|
|
237
|
-
function
|
|
518
|
+
function readAuditExport(path) {
|
|
238
519
|
const parsed = JSON.parse(readFileSync(path, "utf8"));
|
|
239
|
-
|
|
520
|
+
validateAuditExport(parsed);
|
|
240
521
|
return parsed;
|
|
241
522
|
}
|
|
242
523
|
function validateAuditExport(value) {
|
|
@@ -260,11 +541,6 @@ function validateAuditExport(value) {
|
|
|
260
541
|
throw new Error("audit export entrySha256 does not match entry");
|
|
261
542
|
}
|
|
262
543
|
}
|
|
263
|
-
function assertPreEnforcementAuditExport(auditExport) {
|
|
264
|
-
if (auditExport.entry.phase === "post") {
|
|
265
|
-
throw new Error("authorization receipts require a pre-enforcement audit entry");
|
|
266
|
-
}
|
|
267
|
-
}
|
|
268
544
|
function validateReceipt(value) {
|
|
269
545
|
if (!value || typeof value !== "object") {
|
|
270
546
|
throw new Error("authorization receipt must be an object");
|
|
@@ -294,10 +570,6 @@ function validateReceipt(value) {
|
|
|
294
570
|
function derivePublicKeyPem(privateKeyPem) {
|
|
295
571
|
return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: "spki", format: "pem" }).toString();
|
|
296
572
|
}
|
|
297
|
-
function resolvePolicyCommitmentIfPresent() {
|
|
298
|
-
const policyPath = findPolicyFile();
|
|
299
|
-
return policyPath ? computePolicyCommitment(loadPolicy(policyPath)) : null;
|
|
300
|
-
}
|
|
301
573
|
async function verifyAuditLogIntegrity(agentId) {
|
|
302
574
|
for (const { file } of auditLogFiles(agentId)) {
|
|
303
575
|
const result = await verifyChain(file);
|