@clawbureau/clawsig-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clawbureau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,149 @@
+# @clawbureau/clawsig-sdk
+
+Lightweight SDK for emitting **verifiable proof bundles** from any Node.js agent. Five lines to go from raw LLM calls to a cryptographically signed, offline-verifiable evidence pack.
+
+## Quickstart
+
+```ts
+import { createClawsigRun } from '@clawbureau/clawsig-sdk';
+
+const run = await createClawsigRun({
+  agentDid: 'did:key:z6Mk...',       // Your agent's DID
+  proxyUrl: 'https://proxy.example.com',
+  keyFile: '.clawsig-key.json',       // Ed25519 JWK
+});
+
+// Record an LLM call
+const response = await run.callLLM({
+  model: 'claude-sonnet-4-20250514',
+  messages: [{ role: 'user', content: 'Explain proof bundles' }],
+});
+
+// Finalize → signed proof bundle + URM
+const bundle = await run.finalize();
+console.log(bundle.path); // artifacts/poh/.../run_xxx-bundle.json
+```
+
+## What it records
+
+| Method | Receipt type | Coverage level |
+|--------|-------------|----------------|
+| `callLLM()` | Gateway receipt | M (model) |
+| `recordToolCall()` | Tool receipt | MT (model + tools) |
+| `recordSideEffect()` | Side-effect receipt | MTS (+ side-effects) |
+| `recordHumanApproval()` | Human approval receipt | MTS (+ approvals) |
+| `finalize()` | Proof bundle + URM | — |
+
+## API
+
+### `createClawsigRun(options)`
+
+Creates a new proof run. Options:
+
+```ts
+interface ClawsigRunOptions {
+  agentDid: string;          // Agent DID (did:key:...)
+  proxyUrl: string;          // Clawsig proxy URL
+  keyFile?: string;          // Path to Ed25519 JWK key file
+  outputDir?: string;        // Output directory (default: artifacts/poh/<branch>/)
+  branchName?: string;       // Git branch name for output path
+}
+```
+
+### `run.callLLM(params)`
+
+Proxies an LLM call through the gateway and records a gateway receipt.
+
+```ts
+const response = await run.callLLM({
+  model: 'claude-sonnet-4-20250514',
+  messages: [{ role: 'user', content: '...' }],
+  // All standard OpenAI-compatible params supported
+});
+```
+
+### `run.recordToolCall(params)`
+
+Records a tool invocation as a hash-only receipt (arguments and results are digested, not stored).
+
+```ts
+run.recordToolCall({
+  tool_name: 'file_read',
+  args_digest: 'sha256:abc123...',    // SHA-256 of JSON-serialized args
+  result_digest: 'sha256:def456...',  // SHA-256 of JSON-serialized result
+  duration_ms: 42,
+});
+```
+
+### `run.recordSideEffect(params)`
+
+Records a side-effect (network call, file write, external API write).
+
+```ts
+run.recordSideEffect({
+  effect_class: 'network_egress',     // or 'filesystem_write', 'external_api_write'
+  target_digest: 'sha256:...',        // Digest of target URL/path
+  request_digest: 'sha256:...',
+  response_digest: 'sha256:...',
+  vendor_id: 'api.github.com',
+  bytes_written: 1024,
+});
+```
+
+### `run.recordHumanApproval(params)`
+
+Records a human approval decision that gates capability minting.
+
+```ts
+run.recordHumanApproval({
+  approval_type: 'explicit_approve',  // or 'explicit_deny', 'auto_approve', 'timeout_deny'
+  scope_hash_b64u: '...',             // Scope being approved
+  plan_hash_b64u: '...',              // Hash of the proposed plan
+  approver_subject: 'user@example.com',
+  capability_minted: true,
+});
+```
+
+### `run.finalize()`
+
+Finalizes the run, signs the proof bundle, and writes all artifacts.
+
+Returns:
+```ts
+interface FinalizeResult {
+  path: string;           // Path to proof bundle JSON
+  urmPath: string;        // Path to URM (Universal Receipt Manifest)
+  trustPulsePath: string; // Path to trust pulse
+  runId: string;          // Run UUID
+  eventCount: number;     // Number of events in the chain
+  receiptCount: number;   // Number of gateway receipts
+}
+```
+
+## Verification
+
+Proof bundles produced by this SDK can be verified offline with:
+
+```bash
+npx @clawbureau/clawverify-cli verify proof-bundle --input run_xxx-bundle.json
+```
+
+Or programmatically:
+
+```ts
+import { verifyProofBundle } from '@clawbureau/clawverify-core';
+const result = verifyProofBundle(bundleJson, config);
+// result.status === 'PASS' | 'FAIL'
+```
+
+## Coverage levels
+
+The Clawsig Protocol defines three coverage levels:
+
+- **M** (Model): Gateway receipts prove which model was called
+- **MT** (Model + Tools): Tool receipts prove which tools were invoked
+- **MTS** (Model + Tools + Side-effects): Side-effect and human approval receipts prove what external effects occurred and who approved them
+
+## License
+
+MIT

package/dist/crypto.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Cryptographic utilities for the clawsig SDK.
+ *
+ * Standalone copy so this package typechecks independently.
+ * Uses the Web Crypto API (Node 20+, Deno, Workers).
+ */
+import type { Ed25519KeyPair } from './types.js';
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(str: string): Uint8Array;
+export declare function hexToBytes(hex: string): Uint8Array;
+/**
+ * Normalize a SHA-256 hash string into base64url (no padding).
+ * Converts clawproxy's hex SHA-256 output (64 chars) when needed.
+ */
+export declare function normalizeSha256HashB64u(hash: string): string;
+export declare function base58Encode(bytes: Uint8Array): string;
+export declare function sha256B64u(data: Uint8Array): Promise<string>;
+export declare function hashJsonB64u(value: unknown): Promise<string>;
+export declare function generateKeyPair(): Promise<Ed25519KeyPair>;
+export declare function exportPublicKeyRaw(publicKey: CryptoKey): Promise<Uint8Array>;
+export declare function didFromPublicKey(publicKey: CryptoKey): Promise<string>;
+export declare function signEd25519(privateKey: CryptoKey, message: Uint8Array): Promise<string>;
+export declare function randomUUID(): string;
+export declare function exportKeyPairJWK(keyPair: Ed25519KeyPair): Promise<{
+    publicKey: JsonWebKey;
+    privateKey: JsonWebKey;
+}>;
+export declare function importKeyPairJWK(jwk: {
+    publicKey: JsonWebKey;
+    privateKey: JsonWebKey;
+}): Promise<Ed25519KeyPair>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CASvD;AAMD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAgBlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D;AASD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CA2BtD;AAMD,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlE;AAMD,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC,CAG/D;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlF;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAO5E;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAMD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,CAM5D;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE;IAC1C,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM1B"}

package/dist/crypto.js

@@ -0,0 +1,143 @@
+/**
+ * Cryptographic utilities for the clawsig SDK.
+ *
+ * Standalone copy so this package typechecks independently.
+ * Uses the Web Crypto API (Node 20+, Deno, Workers).
+ */
+// ---------------------------------------------------------------------------
+// Base64url
+// ---------------------------------------------------------------------------
+export function base64UrlEncode(bytes) {
+    const binary = String.fromCharCode(...bytes);
+    const base64 = btoa(binary);
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function base64UrlDecode(str) {
+    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+// ---------------------------------------------------------------------------
+// Hex → bytes / base64url (for bridging clawproxy hex hashes)
+// ---------------------------------------------------------------------------
+export function hexToBytes(hex) {
+    const normalized = hex.startsWith('0x') ? hex.slice(2) : hex;
+    if (normalized.length % 2 !== 0) {
+        throw new Error(`Invalid hex string length: ${normalized.length}`);
+    }
+    const bytes = new Uint8Array(normalized.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        const byte = normalized.slice(i * 2, i * 2 + 2);
+        const value = Number.parseInt(byte, 16);
+        if (Number.isNaN(value)) {
+            throw new Error(`Invalid hex byte: ${byte}`);
+        }
+        bytes[i] = value;
+    }
+    return bytes;
+}
+/**
+ * Normalize a SHA-256 hash string into base64url (no padding).
+ * Converts clawproxy's hex SHA-256 output (64 chars) when needed.
+ */
+export function normalizeSha256HashB64u(hash) {
+    const normalized = hash.startsWith('0x') ? hash.slice(2) : hash;
+    if (/^[a-f0-9]{64}$/i.test(normalized)) {
+        return base64UrlEncode(hexToBytes(normalized));
+    }
+    return hash;
+}
+// ---------------------------------------------------------------------------
+// Base58btc (Bitcoin alphabet)
+// ---------------------------------------------------------------------------
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+export function base58Encode(bytes) {
+    let leadingZeros = 0;
+    for (const b of bytes) {
+        if (b !== 0)
+            break;
+        leadingZeros++;
+    }
+    const digits = [0];
+    for (const byte of bytes) {
+        let carry = byte;
+        for (let i = 0; i < digits.length; i++) {
+            carry += digits[i] << 8;
+            digits[i] = carry % 58;
+            carry = (carry / 58) | 0;
+        }
+        while (carry) {
+            digits.push(carry % 58);
+            carry = (carry / 58) | 0;
+        }
+    }
+    let result = '';
+    for (let i = 0; i < leadingZeros; i++) {
+        result += '1';
+    }
+    for (let i = digits.length - 1; i >= 0; i--) {
+        result += BASE58_ALPHABET[digits[i]];
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// SHA-256 hashing
+// ---------------------------------------------------------------------------
+export async function sha256B64u(data) {
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    return base64UrlEncode(new Uint8Array(hashBuffer));
+}
+export async function hashJsonB64u(value) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(JSON.stringify(value));
+    return sha256B64u(data);
+}
+// ---------------------------------------------------------------------------
+// Ed25519 key management
+// ---------------------------------------------------------------------------
+export async function generateKeyPair() {
+    const kp = await crypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']);
+    return { publicKey: kp.publicKey, privateKey: kp.privateKey };
+}
+export async function exportPublicKeyRaw(publicKey) {
+    const raw = await crypto.subtle.exportKey('raw', publicKey);
+    return new Uint8Array(raw);
+}
+export async function didFromPublicKey(publicKey) {
+    const pubBytes = await exportPublicKeyRaw(publicKey);
+    const multicodec = new Uint8Array(2 + pubBytes.length);
+    multicodec[0] = 0xed;
+    multicodec[1] = 0x01;
+    multicodec.set(pubBytes, 2);
+    return `did:key:z${base58Encode(multicodec)}`;
+}
+export async function signEd25519(privateKey, message) {
+    const sigBuffer = await crypto.subtle.sign('Ed25519', privateKey, message);
+    return base64UrlEncode(new Uint8Array(sigBuffer));
+}
+export function randomUUID() {
+    return crypto.randomUUID();
+}
+// ---------------------------------------------------------------------------
+// Key import/export (JWK) for file-based key storage
+// ---------------------------------------------------------------------------
+export async function exportKeyPairJWK(keyPair) {
+    const [publicKey, privateKey] = await Promise.all([
+        crypto.subtle.exportKey('jwk', keyPair.publicKey),
+        crypto.subtle.exportKey('jwk', keyPair.privateKey),
+    ]);
+    return { publicKey, privateKey };
+}
+export async function importKeyPairJWK(jwk) {
+    const [publicKey, privateKey] = await Promise.all([
+        crypto.subtle.importKey('jwk', jwk.publicKey, 'Ed25519', true, ['verify']),
+        crypto.subtle.importKey('jwk', jwk.privateKey, 'Ed25519', true, ['sign']),
+    ]);
+    return { publicKey, privateKey };
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,eAAe,GACnB,4DAA4D,CAAC;AAE/D,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM;QACnB,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxB,KAAK,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC;IAChB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAgB;IAC/C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAoB,CAAC,CAAC;IAC/E,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAoB;IAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAoB;IACzD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,YAAY,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAqB,EACrB,OAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,OAAuB,CAAC,CAAC;IAC3F,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAuB;IAEvB,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAGtC;IACC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;KAC1E,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @clawbureau/clawsig-sdk
+ *
+ * Lightweight SDK for emitting verifiable proof bundles from
+ * API scripts and automation workloads.
+ *
+ * Provides:
+ *   - Hash-linked event chain recording
+ *   - Proxied LLM calls through clawproxy with receipt collection
+ *   - URM (Universal Run Manifest) generation
+ *   - Ed25519-signed proof bundle output
+ *
+ * Usage:
+ *   import { createRun, generateKeyPair, didFromPublicKey, hashJsonB64u } from '@clawbureau/clawsig-sdk';
+ *
+ *   const keyPair = await generateKeyPair();
+ *   const run = await createRun({ proxyBaseUrl: '...', keyPair, harness: { id: 'my-script', version: '1.0' } });
+ *   await run.recordEvent({ eventType: 'run_start', payload: { task: '...' } });
+ *   const { response } = await run.callLLM({ provider: 'anthropic', model: 'claude-sonnet-4-5-20250929', body: { ... } });
+ *   const result = await run.finalize({ inputs: [...], outputs: [...] });
+ */
+export { createRun } from './run.js';
+export { generateKeyPair, didFromPublicKey, hashJsonB64u, sha256B64u, exportKeyPairJWK, importKeyPairJWK, } from './crypto.js';
+export type { ClawproofConfig, ClawproofRun, Ed25519KeyPair, HarnessConfig, BindingContext, SDKEventType, RecordEventInput, RecorderEvent, ReceiptArtifact, ClawproxyReceipt, FinalizeOptions, FinalizeResult, ResourceDescriptor, LLMCallParams, LLMCallResult, SignedEnvelope, ProofBundlePayload, URMDocument, EventChainEntry, GatewayReceiptPayload, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,eAAe,EACf,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,aAAa,EAEb,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+/**
+ * @clawbureau/clawsig-sdk
+ *
+ * Lightweight SDK for emitting verifiable proof bundles from
+ * API scripts and automation workloads.
+ *
+ * Provides:
+ *   - Hash-linked event chain recording
+ *   - Proxied LLM calls through clawproxy with receipt collection
+ *   - URM (Universal Run Manifest) generation
+ *   - Ed25519-signed proof bundle output
+ *
+ * Usage:
+ *   import { createRun, generateKeyPair, didFromPublicKey, hashJsonB64u } from '@clawbureau/clawsig-sdk';
+ *
+ *   const keyPair = await generateKeyPair();
+ *   const run = await createRun({ proxyBaseUrl: '...', keyPair, harness: { id: 'my-script', version: '1.0' } });
+ *   await run.recordEvent({ eventType: 'run_start', payload: { task: '...' } });
+ *   const { response } = await run.callLLM({ provider: 'anthropic', model: 'claude-sonnet-4-5-20250929', body: { ... } });
+ *   const result = await run.finalize({ inputs: [...], outputs: [...] });
+ */
+// Core SDK
+// NOTE: Use explicit `.js` extensions so the built SDK works under plain Node ESM.
+export { createRun } from './run.js';
+// Crypto utilities
+export { generateKeyPair, didFromPublicKey, hashJsonB64u, sha256B64u, exportKeyPairJWK, importKeyPairJWK, } from './crypto.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,WAAW;AACX,mFAAmF;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,mBAAmB;AACnB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,20 @@
+/**
+ * ClawproofRun — core SDK runtime for recording events and producing
+ * signed proof bundles from API scripts.
+ *
+ * Usage:
+ *   const run = await createRun(config);
+ *   await run.recordEvent({ eventType: 'run_start', payload: { task: '...' } });
+ *   const { response } = await run.callLLM({ provider: 'anthropic', model: 'claude-sonnet-4-5-20250929', body });
+ *   const result = await run.finalize({ inputs: [...], outputs: [...] });
+ */
+import type { ClawproofConfig, ClawproofRun } from './types.js';
+/**
+ * Create a new clawsig run for recording events and producing
+ * a signed proof bundle.
+ *
+ * Each run gets a unique `run_<uuid>` identifier and manages its own
+ * event chain, receipt collection, and finalization.
+ */
+export declare function createRun(config: ClawproofConfig): Promise<ClawproofRun>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EA2Bb,MAAM,YAAY,CAAC;AAmIpB;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAwZ9E"}