@catp-protocol/cli 0.7.3 → 0.7.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/dist/audit/durable.d.ts +68 -0
  2. package/dist/audit/durable.d.ts.map +1 -0
  3. package/dist/audit/durable.js +214 -0
  4. package/dist/audit/durable.js.map +1 -0
  5. package/dist/audit/logger.d.ts +51 -5
  6. package/dist/audit/logger.d.ts.map +1 -1
  7. package/dist/audit/logger.js +99 -20
  8. package/dist/audit/logger.js.map +1 -1
  9. package/dist/audit/paths.d.ts +11 -0
  10. package/dist/audit/paths.d.ts.map +1 -1
  11. package/dist/audit/paths.js +19 -0
  12. package/dist/audit/paths.js.map +1 -1
  13. package/dist/audit/verifier.d.ts +9 -0
  14. package/dist/audit/verifier.d.ts.map +1 -1
  15. package/dist/audit/verifier.js +70 -18
  16. package/dist/audit/verifier.js.map +1 -1
  17. package/dist/cli.js +11 -11
  18. package/dist/cli.js.map +1 -1
  19. package/dist/commands/authorization.js +6 -0
  20. package/dist/commands/authorization.js.map +1 -1
  21. package/dist/commands/log.d.ts +41 -1
  22. package/dist/commands/log.d.ts.map +1 -1
  23. package/dist/commands/log.js +82 -22
  24. package/dist/commands/log.js.map +1 -1
  25. package/dist/commands/receipt.d.ts +71 -1
  26. package/dist/commands/receipt.d.ts.map +1 -1
  27. package/dist/commands/receipt.js +344 -72
  28. package/dist/commands/receipt.js.map +1 -1
  29. package/dist/enforcement/core.d.ts +10 -4
  30. package/dist/enforcement/core.d.ts.map +1 -1
  31. package/dist/enforcement/core.js +40 -4
  32. package/dist/enforcement/core.js.map +1 -1
  33. package/dist/evidence/canonical.d.ts +22 -0
  34. package/dist/evidence/canonical.d.ts.map +1 -0
  35. package/dist/evidence/canonical.js +45 -0
  36. package/dist/evidence/canonical.js.map +1 -0
  37. package/dist/evidence/commitments.d.ts +46 -0
  38. package/dist/evidence/commitments.d.ts.map +1 -0
  39. package/dist/evidence/commitments.js +52 -0
  40. package/dist/evidence/commitments.js.map +1 -0
  41. package/dist/hook/post.d.ts +6 -0
  42. package/dist/hook/post.d.ts.map +1 -1
  43. package/dist/hook/post.js +1 -1
  44. package/dist/hook/post.js.map +1 -1
  45. package/dist/hook/pre.d.ts +6 -0
  46. package/dist/hook/pre.d.ts.map +1 -1
  47. package/dist/hook/pre.js +4 -1
  48. package/dist/hook/pre.js.map +1 -1
  49. package/dist/policy/types.d.ts +25 -2
  50. package/dist/policy/types.d.ts.map +1 -1
  51. package/package.json +1 -1
@@ -1 +1 @@
1
- {"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAanD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAO1B;IACC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,eAAe,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;YACxC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,MAAM,0BAA0B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,CAAC;YAChD,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAwB;IAChD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA0B;IACnD,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B,EAAE,IAAoD;IAC1G,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAa,EAAE,IAA+B;IAC5E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,4BAA4B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC9G,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEpD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,WAAW,CAAC,WAAW,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe,EAAE,IAA2F;IAC9I,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACpC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkB;IAClE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB;QACrC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAe,CAAC;gBACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,YAAY,IAAI,CAAC,IAAI,oBAAoB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,mBAAmB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,MAAM,GAAG,CAAC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
1
+ {"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAA8B,MAAM,4BAA4B,CAAC;AAGjG,iFAAiF;AACjF,gFAAgF;AAChF,4EAA4E;AAC5E,OAAO,EAAE,eAAe,EAAE,CAAC;AAY3B,uEAAuE;AACvE,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AA0BxD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAO1B;IACC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,eAAe,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;YACxC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,MAAM,0BAA0B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,CAAC;YAChD,sBAAsB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAwB;IAChD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACnC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA0B;IACnD,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAe,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B,EAAE,IAAoD;IAC1G,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAa,EAAE,IAA+B;IAC5E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,4BAA4B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC9G,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEpD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,UAAU,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,CAAC,aAAa,IAAI,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe,EAAE,IAA2F;IAC9I,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,EAAE;QACpC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkB;IAClE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB;QACrC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,UAAkB;IACpE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7B,IAAI,QAAQ,CAAC,kBAAkB,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAe,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,SAAS,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0B,CAAC;IAClF,IAAI,uBAAuB,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAsB;QAC9B,cAAc,EAAE,sBAAsB;QACtC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,cAAc,EAAE,KAAK,CAAC,KAAK;QAC3B,OAAO;QACP,MAAM;KACP,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,OAAO,SAAS,CAAC,sBAAsB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,UAA6B;IACtE,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAe,CAAC;gBACrD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAA+E,EAAE;IAEjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,YAAY,IAAI,CAAC,IAAI,oBAAoB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,mBAAmB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}
@@ -1,4 +1,4 @@
1
- import { type AuditExport } from "./log.js";
1
+ import { type AuditExport, type AuditExportV2 } from "./log.js";
2
2
  import type { CatpPolicy } from "../policy/types.js";
3
3
  export interface AuthorizationReceiptPayload {
4
4
  receiptVersion: "catp_authorization_receipt_v1";
@@ -17,13 +17,47 @@ export interface AuthorizationReceiptPayload {
17
17
  export interface AuthorizationReceipt extends AuthorizationReceiptPayload {
18
18
  signature: string;
19
19
  }
20
+ /**
21
+ * Version-2 authorization receipt body. Every security-relevant binding is
22
+ * COPIED from the enforcement-time v4 audit entry: `policy_commitment` and
23
+ * `action_commitment` are never re-derived from the current policy file. The
24
+ * body also pins the exact self-contained v2 audit export via
25
+ * `audit_export_sha256`, and identifies the issuer by `issuer_key_id`
26
+ * (SHA-256 of the public key's DER SubjectPublicKeyInfo).
27
+ */
28
+ export interface AuthorizationReceiptV2Body {
29
+ receipt_version: "catp_authorization_receipt_v2";
30
+ audit_commitment: string;
31
+ policy_commitment: string;
32
+ action_commitment: string;
33
+ audit_export_sha256: string;
34
+ agent_id: string;
35
+ tool: string;
36
+ decision: "allow" | "deny";
37
+ phase: "pre";
38
+ rule_matched: string | null;
39
+ reason: string;
40
+ timestamp: string;
41
+ signed_at: string;
42
+ issuer_key_id: string;
43
+ signature_algorithm: "Ed25519";
44
+ }
45
+ export interface AuthorizationReceiptV2 extends AuthorizationReceiptV2Body {
46
+ signature: string;
47
+ receipt_sha256: string;
48
+ }
49
+ /** SHA-256 of the public key's DER SubjectPublicKeyInfo bytes. */
50
+ export declare function computeIssuerKeyId(publicKeyPem: string): string;
20
51
  export interface ReceiptVerificationSummary {
21
52
  authorizationReceipt: "valid";
53
+ receiptVersion: "catp_authorization_receipt_v1" | "catp_authorization_receipt_v2";
54
+ assurance: "legacy" | "enforcement-time-bound";
22
55
  auditExport: "matched" | null;
23
56
  policy: "matched" | null;
24
57
  auditCommitment: string;
25
58
  auditExportHash: string;
26
59
  policyCommitment: string | null;
60
+ actionCommitment: string | null;
27
61
  agentId: string;
28
62
  tool: string;
29
63
  decision: "allow" | "deny";
@@ -66,4 +100,40 @@ export declare function verifyAuthorizationReceipt(receipt: AuthorizationReceipt
66
100
  export declare function verifyReceiptAuditExport(receipt: AuthorizationReceipt, auditExport: AuditExport): void;
67
101
  export declare function verifyReceiptPolicy(receipt: AuthorizationReceipt, policy: CatpPolicy): void;
68
102
  export declare function computePolicyCommitment(policy: CatpPolicy): string;
103
+ /**
104
+ * Structural + cryptographic validation of a self-contained v2 audit export.
105
+ * Recomputes `export_sha256` over the body, requires the prefix length to match
106
+ * `selected_index + 1`, requires a commitment-version-4 selected entry, and
107
+ * requires the bundled complete action to reproduce that entry's
108
+ * `action_commitment`.
109
+ */
110
+ export declare function validateAuditExportV2(value: unknown): asserts value is AuditExportV2;
111
+ /**
112
+ * Sign a v2 receipt. `policy_commitment` and `action_commitment` are copied
113
+ * verbatim from the enforcement-time entry — never re-derived from any current
114
+ * policy file.
115
+ */
116
+ export declare function signAuthorizationReceiptV2(auditExport: AuditExportV2, privateKeyPem: string, opts?: {
117
+ signedAt?: string;
118
+ }): AuthorizationReceiptV2;
119
+ export declare function validateReceiptV2(value: unknown): asserts value is AuthorizationReceiptV2;
120
+ /**
121
+ * Offline-verify a v2 receipt against an INDEPENDENTLY supplied trusted public
122
+ * key. Recomputes `issuer_key_id` from that key and requires an exact match
123
+ * before accepting the signature, then checks `receipt_sha256` and the Ed25519
124
+ * signature over the domain-separated body.
125
+ */
126
+ export declare function verifyAuthorizationReceiptV2(receipt: AuthorizationReceiptV2, trustedPublicKeyPem: string): void;
127
+ /**
128
+ * Cross-check a v2 receipt against its self-contained audit export: export hash,
129
+ * selected-entry equality for all three bindings, and the complete-action hash.
130
+ * Offline chain integrity over the prefix is enforced by `validateAuditExportV2`.
131
+ */
132
+ export declare function verifyReceiptAuditExportV2(receipt: AuthorizationReceiptV2, auditExport: AuditExportV2): void;
133
+ /**
134
+ * Optional policy-file check. The supplied file is verification evidence only:
135
+ * it is hashed with the SAME domained enforcement-time scheme and compared with
136
+ * the recorded commitment. A mismatch (e.g. a swapped policy) is rejected.
137
+ */
138
+ export declare function verifyReceiptPolicyV2(receipt: AuthorizationReceiptV2, policy: CatpPolicy): void;
69
139
  //# sourceMappingURL=receipt.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/commands/receipt.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2E,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAGrH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,SAAS,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,2BAA2B;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYxF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA8BrH;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAkFD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAmC1I;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACjE,oBAAoB,CAqBtB;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,GAAE,MAA6B,GAAG,IAAI,CAO3H;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAyBtG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAS3F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAElE"}
1
+ {"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/commands/receipt.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,WAAW,EAChB,KAAK,aAAa,EAEnB,MAAM,UAAU,CAAC;AAIlB,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,SAAS,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,2BAA2B;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,eAAe,EAAE,+BAA+B,CAAC;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,sBAAuB,SAAQ,0BAA0B;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,+BAA+B,GAAG,+BAA+B,CAAC;IAClF,SAAS,EAAE,QAAQ,GAAG,wBAAwB,CAAC;IAC/C,WAAW,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYxF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkBrH;AA4BD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAsED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA6C1I;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACjE,oBAAoB,CAqBtB;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,GAAE,MAA6B,GAAG,IAAI,CAO3H;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAyBtG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAS3F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAElE;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CA6CpF;AAqBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,aAAa,EAC1B,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,sBAAsB,CA4BxB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAqCzF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAe/G;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,aAAa,GAAG,IAAI,CAsB5G;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAM/F"}
@@ -1,8 +1,19 @@
1
1
  import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
2
2
  import { readFileSync, writeFileSync } from "node:fs";
3
- import { auditLogFiles, buildAuditExport, latestAuditCommitment, stableStringify } from "./log.js";
4
- import { verifyChain } from "../audit/verifier.js";
3
+ import { auditLogFiles, buildAuditExportV2, computeAuditExportV2Sha256, latestAuditCommitment, selectedAuditExportV2Entry, stableStringify, } from "./log.js";
4
+ import { verifyChain, verifyEntryChain } from "../audit/verifier.js";
5
+ import { computeActionCommitment, computePolicyCommitment as computeEnforcementPolicyCommitment } from "../evidence/commitments.js";
5
6
  import { findPolicyFile, loadPolicy } from "../policy/loader.js";
7
+ // Domain separators for version-2 receipts. The signature covers the receipt
8
+ // body; receipt_sha256 covers the body-plus-signature. Neither includes
9
+ // receipt_sha256 itself, so the hash is a stable external fingerprint.
10
+ const RECEIPT_SIGNATURE_V2_DOMAIN = "catp:receipt-signature:v2\n";
11
+ const RECEIPT_V2_DOMAIN = "catp:receipt:v2\n";
12
+ /** SHA-256 of the public key's DER SubjectPublicKeyInfo bytes. */
13
+ export function computeIssuerKeyId(publicKeyPem) {
14
+ const der = createPublicKey(publicKeyPem).export({ type: "spki", format: "der" });
15
+ return createHash("sha256").update(der).digest("hex");
16
+ }
6
17
  export function cmdReceiptKeygen(opts) {
7
18
  const privateKeyPath = opts.privateKey ?? "catp-receipt-private.pem";
8
19
  const publicKeyPath = opts.publicKey ?? "catp-receipt-public.pem";
@@ -22,23 +33,33 @@ export function cmdReceiptSign(opts) {
22
33
  if (!opts.privateKey) {
23
34
  throw new Error("missing --private-key <path>");
24
35
  }
25
- const auditExport = readAuditExport(opts.auditExport);
26
- assertPreEnforcementAuditExport(auditExport);
36
+ const auditExport = readAuditExportV2(opts.auditExport);
37
+ const selected = selectedPreEnforcementV4Entry(auditExport);
38
+ // --file is verification evidence, never the binding source: it must
39
+ // reproduce the enforcement-time policy_commitment copied from the entry.
40
+ if (opts.file) {
41
+ assertPolicyMatchesEnforcementCommitment(loadPolicy(opts.file), selected.policy_commitment);
42
+ }
27
43
  const privateKeyPem = readFileSync(opts.privateKey, "utf8");
28
- const publicKeyPem = derivePublicKeyPem(privateKeyPem);
29
- const policyCommitment = opts.file ? computePolicyCommitment(loadPolicy(opts.file)) : resolvePolicyCommitmentIfPresent();
30
- const receipt = signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, { policyCommitment });
44
+ const receipt = signAuthorizationReceiptV2(auditExport, privateKeyPem);
45
+ writeReceiptV2Output(receipt, selected, opts.out);
46
+ }
47
+ function writeReceiptV2Output(receipt, selected, out, auditExportOut) {
31
48
  const json = stableStringify(receipt, 2) + "\n";
32
- if (opts.out) {
33
- writeFileSync(opts.out, json, "utf8");
34
- process.stdout.write(`Wrote authorization receipt to ${opts.out}\n`);
35
- process.stdout.write(`auditCommitment=${receipt.auditCommitment}\n`);
36
- process.stdout.write(`auditExportHash=${receipt.auditExportHash}\n`);
37
- process.stdout.write(`policyCommitment=${receipt.policyCommitment ?? "none"}\n`);
38
- process.stdout.write(`selectedTool=${auditExport.entry.tool}\n`);
39
- process.stdout.write(`selectedDecision=${auditExport.entry.decision}\n`);
40
- process.stdout.write(`selectedTimestamp=${auditExport.entry.ts}\n`);
41
- process.stdout.write(`selectedInputSummary=${auditExport.entry.input_summary}\n`);
49
+ if (out) {
50
+ writeFileSync(out, json, "utf8");
51
+ process.stdout.write(`Wrote authorization receipt to ${out}\n`);
52
+ if (auditExportOut) {
53
+ process.stdout.write(`Wrote audit export to ${auditExportOut}\n`);
54
+ }
55
+ process.stdout.write(`auditCommitment=${receipt.audit_commitment}\n`);
56
+ process.stdout.write(`auditExportSha256=${receipt.audit_export_sha256}\n`);
57
+ process.stdout.write(`policyCommitment=${receipt.policy_commitment}\n`);
58
+ process.stdout.write(`actionCommitment=${receipt.action_commitment}\n`);
59
+ process.stdout.write(`selectedTool=${selected.tool}\n`);
60
+ process.stdout.write(`selectedDecision=${selected.decision}\n`);
61
+ process.stdout.write(`selectedTimestamp=${selected.ts}\n`);
62
+ process.stdout.write(`selectedInputSummary=${selected.input_summary}\n`);
42
63
  return;
43
64
  }
44
65
  process.stdout.write(json);
@@ -71,33 +92,22 @@ async function issueReceipt(opts) {
71
92
  }
72
93
  await verifyAuditLogIntegrity(agentId);
73
94
  const commitment = resolveIssueCommitment(agentId, opts);
74
- const auditExport = buildAuditExport(agentId, commitment);
75
- assertPreEnforcementAuditExport(auditExport);
95
+ // Build the self-contained v2 bundle and require a pre-enforcement v4 entry.
96
+ // The receipt's policy/action commitments are copied from that entry, never
97
+ // re-derived from the current policy file.
98
+ const auditExport = buildAuditExportV2(agentId, commitment);
99
+ const selected = selectedPreEnforcementV4Entry(auditExport);
100
+ // An explicit --file is verification evidence only: it must reproduce the
101
+ // enforcement-time policy_commitment already recorded in the entry.
102
+ if (opts.file) {
103
+ assertPolicyMatchesEnforcementCommitment(loadPolicy(opts.file), selected.policy_commitment);
104
+ }
76
105
  const privateKeyPem = readFileSync(opts.privateKey, "utf8");
77
- const publicKeyPem = derivePublicKeyPem(privateKeyPem);
78
- const receipt = signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, {
79
- policyCommitment: policy ? computePolicyCommitment(policy) : null,
80
- });
106
+ const receipt = signAuthorizationReceiptV2(auditExport, privateKeyPem);
81
107
  if (opts.auditExportOut) {
82
108
  writeFileSync(opts.auditExportOut, stableStringify(auditExport, 2) + "\n", "utf8");
83
109
  }
84
- const json = stableStringify(receipt, 2) + "\n";
85
- if (opts.out) {
86
- writeFileSync(opts.out, json, "utf8");
87
- process.stdout.write(`Wrote authorization receipt to ${opts.out}\n`);
88
- if (opts.auditExportOut) {
89
- process.stdout.write(`Wrote audit export to ${opts.auditExportOut}\n`);
90
- }
91
- process.stdout.write(`auditCommitment=${receipt.auditCommitment}\n`);
92
- process.stdout.write(`auditExportHash=${receipt.auditExportHash}\n`);
93
- process.stdout.write(`policyCommitment=${receipt.policyCommitment ?? "none"}\n`);
94
- process.stdout.write(`selectedTool=${auditExport.entry.tool}\n`);
95
- process.stdout.write(`selectedDecision=${auditExport.entry.decision}\n`);
96
- process.stdout.write(`selectedTimestamp=${auditExport.entry.ts}\n`);
97
- process.stdout.write(`selectedInputSummary=${auditExport.entry.input_summary}\n`);
98
- return;
99
- }
100
- process.stdout.write(json);
110
+ writeReceiptV2Output(receipt, selected, opts.out, opts.auditExportOut);
101
111
  }
102
112
  function resolveIssueCommitment(agentId, opts) {
103
113
  if (opts.commitment) {
@@ -116,34 +126,36 @@ export function cmdReceiptVerify(opts) {
116
126
  if (!opts.publicKey) {
117
127
  throw new Error("missing --public-key <path>; receipt verification requires a trusted external public key");
118
128
  }
119
- const receipt = readAuthorizationReceipt(opts.receipt);
129
+ // The trusted public key is supplied independently of the receipt; it is never
130
+ // taken from the receipt itself.
120
131
  const publicKeyPem = readFileSync(opts.publicKey, "utf8");
132
+ const receipt = readAuthorizationReceiptAny(opts.receipt);
133
+ if (isReceiptV2(receipt)) {
134
+ verifyAuthorizationReceiptV2(receipt, publicKeyPem);
135
+ if (opts.auditExport) {
136
+ verifyReceiptAuditExportV2(receipt, readAuditExportV2(opts.auditExport));
137
+ }
138
+ if (opts.file) {
139
+ verifyReceiptPolicyV2(receipt, loadPolicy(opts.file));
140
+ }
141
+ emitVerificationSummary(receiptVerificationSummaryV2(receipt, {
142
+ auditExportMatched: Boolean(opts.auditExport),
143
+ policyMatched: Boolean(opts.file),
144
+ }), opts);
145
+ return;
146
+ }
147
+ // Legacy version-1 receipts keep their historical semantics and assurance.
121
148
  verifyAuthorizationReceipt(receipt, publicKeyPem);
122
149
  if (opts.auditExport) {
123
- const auditExport = readAuditExport(opts.auditExport);
124
- verifyReceiptAuditExport(receipt, auditExport);
150
+ verifyReceiptAuditExport(receipt, readAuditExport(opts.auditExport));
125
151
  }
126
152
  if (opts.file) {
127
153
  verifyReceiptPolicy(receipt, loadPolicy(opts.file));
128
154
  }
129
- const summary = receiptVerificationSummary(receipt, {
155
+ emitVerificationSummary(receiptVerificationSummary(receipt, {
130
156
  auditExportMatched: Boolean(opts.auditExport),
131
157
  policyMatched: Boolean(opts.file),
132
- });
133
- if (opts.json) {
134
- process.stdout.write(stableStringify(summary, 2) + "\n");
135
- return;
136
- }
137
- process.stdout.write("authorizationReceipt=valid\n");
138
- if (opts.auditExport) {
139
- process.stdout.write("auditExport=matched\n");
140
- }
141
- if (opts.file) {
142
- process.stdout.write("policy=matched\n");
143
- }
144
- process.stdout.write(`auditCommitment=${summary.auditCommitment}\n`);
145
- process.stdout.write(`auditExportHash=${summary.auditExportHash}\n`);
146
- process.stdout.write(`policyCommitment=${summary.policyCommitment ?? "none"}\n`);
158
+ }), opts);
147
159
  }
148
160
  export function signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, opts = {}) {
149
161
  validateAuditExport(auditExport);
@@ -214,14 +226,233 @@ export function verifyReceiptPolicy(receipt, policy) {
214
226
  export function computePolicyCommitment(policy) {
215
227
  return sha256Hex(stableStringify(policy));
216
228
  }
229
+ // ---------------------------------------------------------------------------
230
+ // Version-2 receipts: issued only from recorded enforcement-time bindings.
231
+ // ---------------------------------------------------------------------------
232
+ /**
233
+ * Structural + cryptographic validation of a self-contained v2 audit export.
234
+ * Recomputes `export_sha256` over the body, requires the prefix length to match
235
+ * `selected_index + 1`, requires a commitment-version-4 selected entry, and
236
+ * requires the bundled complete action to reproduce that entry's
237
+ * `action_commitment`.
238
+ */
239
+ export function validateAuditExportV2(value) {
240
+ if (!value || typeof value !== "object") {
241
+ throw new Error("audit export must be an object");
242
+ }
243
+ const exp = value;
244
+ if (exp.export_version !== "catp_audit_export_v2") {
245
+ throw new Error("audit export version must be catp_audit_export_v2");
246
+ }
247
+ if (typeof exp.agent_id !== "string" || exp.agent_id === "") {
248
+ throw new Error("audit export agent_id must be a non-empty string");
249
+ }
250
+ if (typeof exp.log_date !== "string" || exp.log_date === "") {
251
+ throw new Error("audit export log_date must be a non-empty string");
252
+ }
253
+ if (!Number.isInteger(exp.selected_index) || exp.selected_index < 0) {
254
+ throw new Error("audit export selected_index must be a non-negative integer");
255
+ }
256
+ if (!Array.isArray(exp.entries) || exp.entries.length !== exp.selected_index + 1) {
257
+ throw new Error("audit export entries must be the daily prefix through selected_index");
258
+ }
259
+ if (!exp.action || typeof exp.action !== "object") {
260
+ throw new Error("audit export action must be an object");
261
+ }
262
+ assertHex(exp.export_sha256, "audit export export_sha256");
263
+ const { export_sha256, ...body } = exp;
264
+ if (computeAuditExportV2Sha256(body) !== export_sha256) {
265
+ throw new Error("audit export v2 export_sha256 does not match body");
266
+ }
267
+ const selected = selectedAuditExportV2Entry(exp);
268
+ if (!selected || typeof selected !== "object") {
269
+ throw new Error("audit export selected entry must be an object");
270
+ }
271
+ if (selected.commitment_version !== 4) {
272
+ throw new Error("audit export v2 selected entry must be commitment version 4");
273
+ }
274
+ if (computeActionCommitment(exp.action) !== selected.action_commitment) {
275
+ throw new Error("audit export action does not match the selected entry action_commitment");
276
+ }
277
+ // Enforce the same offline chain integrity here that buildAuditExportV2 and
278
+ // verifyReceiptAuditExportV2 enforce, so `receipt sign` can never sign over a
279
+ // bundle whose recorded prefix was tampered with.
280
+ const chain = verifyEntryChain(exp.entries);
281
+ if (!chain.ok) {
282
+ throw new Error(`audit export chain is broken at entry ${chain.broken_at}: ${chain.message}`);
283
+ }
284
+ }
285
+ function readAuditExportV2(path) {
286
+ const parsed = JSON.parse(readFileSync(path, "utf8"));
287
+ validateAuditExportV2(parsed);
288
+ return parsed;
289
+ }
290
+ // The selected entry must be a pre-enforcement v4 record; post-action and
291
+ // legacy entries can never authorize.
292
+ function selectedPreEnforcementV4Entry(exp) {
293
+ const selected = selectedAuditExportV2Entry(exp);
294
+ if (!selected || selected.commitment_version !== 4) {
295
+ throw new Error("authorization receipts require a commitment version 4 audit entry");
296
+ }
297
+ if (selected.phase !== "pre") {
298
+ throw new Error("authorization receipts require a pre-enforcement audit entry");
299
+ }
300
+ return selected;
301
+ }
302
+ /**
303
+ * Sign a v2 receipt. `policy_commitment` and `action_commitment` are copied
304
+ * verbatim from the enforcement-time entry — never re-derived from any current
305
+ * policy file.
306
+ */
307
+ export function signAuthorizationReceiptV2(auditExport, privateKeyPem, opts = {}) {
308
+ validateAuditExportV2(auditExport);
309
+ const selected = selectedPreEnforcementV4Entry(auditExport);
310
+ const publicKeyPem = derivePublicKeyPem(privateKeyPem);
311
+ const body = {
312
+ receipt_version: "catp_authorization_receipt_v2",
313
+ audit_commitment: selected.commitment,
314
+ policy_commitment: selected.policy_commitment,
315
+ action_commitment: selected.action_commitment,
316
+ audit_export_sha256: auditExport.export_sha256,
317
+ agent_id: auditExport.agent_id,
318
+ tool: selected.tool,
319
+ decision: selected.decision,
320
+ phase: "pre",
321
+ rule_matched: selected.rule_matched,
322
+ reason: selected.reason,
323
+ timestamp: selected.ts,
324
+ signed_at: opts.signedAt ?? new Date().toISOString(),
325
+ issuer_key_id: computeIssuerKeyId(publicKeyPem),
326
+ signature_algorithm: "Ed25519",
327
+ };
328
+ const signature = sign(null, Buffer.from(RECEIPT_SIGNATURE_V2_DOMAIN + stableStringify(body)), privateKeyPem).toString("base64");
329
+ const receipt_sha256 = sha256Hex(RECEIPT_V2_DOMAIN + stableStringify({ ...body, signature }));
330
+ const receipt = { ...body, signature, receipt_sha256 };
331
+ // Fail closed at signing time rather than emitting a receipt that offline
332
+ // verification would later reject.
333
+ validateReceiptV2(receipt);
334
+ return receipt;
335
+ }
336
+ export function validateReceiptV2(value) {
337
+ if (!value || typeof value !== "object") {
338
+ throw new Error("authorization receipt must be an object");
339
+ }
340
+ const receipt = value;
341
+ if (receipt.receipt_version !== "catp_authorization_receipt_v2") {
342
+ throw new Error("receipt_version must be catp_authorization_receipt_v2");
343
+ }
344
+ if (receipt.signature_algorithm !== "Ed25519") {
345
+ throw new Error("signature_algorithm must be Ed25519");
346
+ }
347
+ if (receipt.phase !== "pre") {
348
+ throw new Error("phase must be pre");
349
+ }
350
+ if (receipt.decision !== "allow" && receipt.decision !== "deny") {
351
+ throw new Error("decision must be allow or deny");
352
+ }
353
+ if (receipt.rule_matched !== null && typeof receipt.rule_matched !== "string") {
354
+ throw new Error("rule_matched must be a string or null");
355
+ }
356
+ assertHex(receipt.audit_commitment, "audit_commitment");
357
+ assertHex(receipt.policy_commitment, "policy_commitment");
358
+ assertHex(receipt.action_commitment, "action_commitment");
359
+ assertHex(receipt.audit_export_sha256, "audit_export_sha256");
360
+ assertHex(receipt.issuer_key_id, "issuer_key_id");
361
+ assertHex(receipt.receipt_sha256, "receipt_sha256");
362
+ // `reason` is explanatory metadata copied verbatim from the v4 entry; match
363
+ // that contract (a string, possibly empty) rather than imposing a stricter
364
+ // non-empty rule the recorded entry does not guarantee.
365
+ if (typeof receipt.reason !== "string") {
366
+ throw new Error("reason must be a string");
367
+ }
368
+ for (const field of ["agent_id", "tool", "timestamp", "signed_at", "signature"]) {
369
+ if (typeof receipt[field] !== "string" || receipt[field] === "") {
370
+ throw new Error(`${field} must be a non-empty string`);
371
+ }
372
+ }
373
+ }
374
+ /**
375
+ * Offline-verify a v2 receipt against an INDEPENDENTLY supplied trusted public
376
+ * key. Recomputes `issuer_key_id` from that key and requires an exact match
377
+ * before accepting the signature, then checks `receipt_sha256` and the Ed25519
378
+ * signature over the domain-separated body.
379
+ */
380
+ export function verifyAuthorizationReceiptV2(receipt, trustedPublicKeyPem) {
381
+ validateReceiptV2(receipt);
382
+ const expectedKeyId = computeIssuerKeyId(trustedPublicKeyPem);
383
+ if (receipt.issuer_key_id !== expectedKeyId) {
384
+ throw new Error("receipt issuer_key_id does not match the trusted public key");
385
+ }
386
+ const { receipt_sha256, signature, ...body } = receipt;
387
+ const expectedReceiptSha256 = sha256Hex(RECEIPT_V2_DOMAIN + stableStringify({ ...body, signature }));
388
+ if (receipt_sha256 !== expectedReceiptSha256) {
389
+ throw new Error("receipt_sha256 does not match the signed receipt body");
390
+ }
391
+ const ok = verify(null, Buffer.from(RECEIPT_SIGNATURE_V2_DOMAIN + stableStringify(body)), trustedPublicKeyPem, Buffer.from(signature, "base64"));
392
+ if (!ok) {
393
+ throw new Error("authorization receipt signature is invalid");
394
+ }
395
+ }
396
+ /**
397
+ * Cross-check a v2 receipt against its self-contained audit export: export hash,
398
+ * selected-entry equality for all three bindings, and the complete-action hash.
399
+ * Offline chain integrity over the prefix is enforced by `validateAuditExportV2`.
400
+ */
401
+ export function verifyReceiptAuditExportV2(receipt, auditExport) {
402
+ validateReceiptV2(receipt);
403
+ validateAuditExportV2(auditExport);
404
+ if (receipt.audit_export_sha256 !== auditExport.export_sha256) {
405
+ throw new Error("receipt audit_export_sha256 does not match audit export");
406
+ }
407
+ if (auditExport.agent_id !== receipt.agent_id) {
408
+ throw new Error("receipt agent_id does not match audit export");
409
+ }
410
+ const selected = selectedPreEnforcementV4Entry(auditExport);
411
+ if (selected.commitment !== receipt.audit_commitment) {
412
+ throw new Error("receipt audit_commitment does not match the selected audit entry");
413
+ }
414
+ if (selected.policy_commitment !== receipt.policy_commitment) {
415
+ throw new Error("receipt policy_commitment does not match the selected audit entry");
416
+ }
417
+ if (selected.action_commitment !== receipt.action_commitment) {
418
+ throw new Error("receipt action_commitment does not match the selected audit entry");
419
+ }
420
+ if (computeActionCommitment(auditExport.action) !== receipt.action_commitment) {
421
+ throw new Error("receipt action_commitment does not match the bundled complete action");
422
+ }
423
+ }
424
+ /**
425
+ * Optional policy-file check. The supplied file is verification evidence only:
426
+ * it is hashed with the SAME domained enforcement-time scheme and compared with
427
+ * the recorded commitment. A mismatch (e.g. a swapped policy) is rejected.
428
+ */
429
+ export function verifyReceiptPolicyV2(receipt, policy) {
430
+ validateReceiptV2(receipt);
431
+ const policyCommitment = computeEnforcementPolicyCommitment(policy);
432
+ if (receipt.policy_commitment !== policyCommitment) {
433
+ throw new Error("receipt policy_commitment does not match policy");
434
+ }
435
+ }
436
+ // The supplied --file policy is evidence, never the source of the binding: it
437
+ // must reproduce the enforcement-time policy_commitment copied from the entry.
438
+ function assertPolicyMatchesEnforcementCommitment(policy, enforcementPolicyCommitment) {
439
+ if (computeEnforcementPolicyCommitment(policy) !== enforcementPolicyCommitment) {
440
+ throw new Error("supplied policy file does not match the enforcement-time policy_commitment");
441
+ }
442
+ }
217
443
  function receiptVerificationSummary(receipt, opts) {
218
444
  return {
219
445
  authorizationReceipt: "valid",
446
+ receiptVersion: "catp_authorization_receipt_v1",
447
+ // Legacy receipts predate enforcement-time policy/action binding; label
448
+ // their assurance honestly and never imply an exact-action binding.
449
+ assurance: "legacy",
220
450
  auditExport: opts.auditExportMatched ? "matched" : null,
221
451
  policy: opts.policyMatched ? "matched" : null,
222
452
  auditCommitment: receipt.auditCommitment,
223
453
  auditExportHash: receipt.auditExportHash,
224
454
  policyCommitment: receipt.policyCommitment,
455
+ actionCommitment: null,
225
456
  agentId: receipt.agentId,
226
457
  tool: receipt.tool,
227
458
  decision: receipt.decision,
@@ -229,14 +460,64 @@ function receiptVerificationSummary(receipt, opts) {
229
460
  signedAt: receipt.signedAt,
230
461
  };
231
462
  }
232
- function readAuditExport(path) {
463
+ function receiptVerificationSummaryV2(receipt, opts) {
464
+ return {
465
+ authorizationReceipt: "valid",
466
+ receiptVersion: "catp_authorization_receipt_v2",
467
+ assurance: "enforcement-time-bound",
468
+ auditExport: opts.auditExportMatched ? "matched" : null,
469
+ policy: opts.policyMatched ? "matched" : null,
470
+ auditCommitment: receipt.audit_commitment,
471
+ auditExportHash: receipt.audit_export_sha256,
472
+ policyCommitment: receipt.policy_commitment,
473
+ actionCommitment: receipt.action_commitment,
474
+ agentId: receipt.agent_id,
475
+ tool: receipt.tool,
476
+ decision: receipt.decision,
477
+ timestamp: receipt.timestamp,
478
+ signedAt: receipt.signed_at,
479
+ };
480
+ }
481
+ function emitVerificationSummary(summary, opts) {
482
+ if (opts.json) {
483
+ process.stdout.write(stableStringify(summary, 2) + "\n");
484
+ return;
485
+ }
486
+ process.stdout.write("authorizationReceipt=valid\n");
487
+ process.stdout.write(`receiptVersion=${summary.receiptVersion}\n`);
488
+ process.stdout.write(`assurance=${summary.assurance}\n`);
489
+ if (summary.auditExport) {
490
+ process.stdout.write("auditExport=matched\n");
491
+ }
492
+ if (summary.policy) {
493
+ process.stdout.write("policy=matched\n");
494
+ }
495
+ process.stdout.write(`auditCommitment=${summary.auditCommitment}\n`);
496
+ process.stdout.write(`auditExportHash=${summary.auditExportHash}\n`);
497
+ process.stdout.write(`policyCommitment=${summary.policyCommitment ?? "none"}\n`);
498
+ if (summary.actionCommitment) {
499
+ process.stdout.write(`actionCommitment=${summary.actionCommitment}\n`);
500
+ }
501
+ }
502
+ function isReceiptV2(value) {
503
+ return (typeof value === "object" &&
504
+ value !== null &&
505
+ value.receipt_version === "catp_authorization_receipt_v2");
506
+ }
507
+ // Read a receipt of either version. A v2 file is validated as v2; anything else
508
+ // must satisfy the legacy v1 shape (and is labelled legacy on verification).
509
+ function readAuthorizationReceiptAny(path) {
233
510
  const parsed = JSON.parse(readFileSync(path, "utf8"));
234
- validateAuditExport(parsed);
511
+ if (isReceiptV2(parsed)) {
512
+ validateReceiptV2(parsed);
513
+ return parsed;
514
+ }
515
+ validateReceipt(parsed);
235
516
  return parsed;
236
517
  }
237
- function readAuthorizationReceipt(path) {
518
+ function readAuditExport(path) {
238
519
  const parsed = JSON.parse(readFileSync(path, "utf8"));
239
- validateReceipt(parsed);
520
+ validateAuditExport(parsed);
240
521
  return parsed;
241
522
  }
242
523
  function validateAuditExport(value) {
@@ -260,11 +541,6 @@ function validateAuditExport(value) {
260
541
  throw new Error("audit export entrySha256 does not match entry");
261
542
  }
262
543
  }
263
- function assertPreEnforcementAuditExport(auditExport) {
264
- if (auditExport.entry.phase === "post") {
265
- throw new Error("authorization receipts require a pre-enforcement audit entry");
266
- }
267
- }
268
544
  function validateReceipt(value) {
269
545
  if (!value || typeof value !== "object") {
270
546
  throw new Error("authorization receipt must be an object");
@@ -294,10 +570,6 @@ function validateReceipt(value) {
294
570
  function derivePublicKeyPem(privateKeyPem) {
295
571
  return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: "spki", format: "pem" }).toString();
296
572
  }
297
- function resolvePolicyCommitmentIfPresent() {
298
- const policyPath = findPolicyFile();
299
- return policyPath ? computePolicyCommitment(loadPolicy(policyPath)) : null;
300
- }
301
573
  async function verifyAuditLogIntegrity(agentId) {
302
574
  for (const { file } of auditLogFiles(agentId)) {
303
575
  const result = await verifyChain(file);