@grc-claw/evidence 2.0.0

package/dist/action-ledger.d.ts

@@ -0,0 +1,56 @@
+export type ActionExecutionState = 'intent_recorded' | 'approval_required' | 'denied' | 'executing' | 'simulated' | 'recorded' | 'executed' | 'verified' | 'not_configured' | 'failed';
+export interface ActionLedgerEvent {
+    sequence: number;
+    actionId: string;
+    at: string;
+    kind: 'intent' | 'decision' | 'result';
+    tenantId: number;
+    sessionId: string;
+    tool: string;
+    idempotencyKey?: string;
+    executionState: ActionExecutionState;
+    decisionReason?: string;
+    requiresApproval?: boolean;
+    argsHash?: string;
+    argKeys?: string[];
+    outputHash?: string;
+    evidenceId?: string;
+    targetReceipt?: string;
+    previousHash: string;
+    hash: string;
+}
+/**
+ * Append-only local proof of an agent action. Payloads are represented by hashes and key names,
+ * keeping sensitive request and response content out of the operational ledger.
+ */
+export declare class ActionLedger {
+    private readonly filePath?;
+    private readonly events;
+    constructor(filePath?: string | undefined);
+    recordIntent(input: {
+        tenantId: number;
+        sessionId: string;
+        tool: string;
+        args: Record<string, unknown>;
+        idempotencyKey?: string;
+    }): ActionLedgerEvent;
+    recordDecision(intent: ActionLedgerEvent, input: {
+        allowed: boolean;
+        reason: string;
+        requiresApproval: boolean;
+    }): ActionLedgerEvent;
+    recordResult(intent: ActionLedgerEvent, input: {
+        executionState: Exclude<ActionExecutionState, 'intent_recorded' | 'approval_required' | 'denied' | 'executing'>;
+        output?: Record<string, unknown>;
+        evidenceId?: string;
+        targetReceipt?: string;
+    }): ActionLedgerEvent;
+    list(limit?: number): ActionLedgerEvent[];
+    verify(): {
+        ok: boolean;
+        checked: number;
+        error?: string;
+    };
+    private append;
+}
+//# sourceMappingURL=action-ledger.d.ts.map

package/dist/action-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-ledger.d.ts","sourceRoot":"","sources":["../src/action-ledger.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,mBAAmB,GACnB,QAAQ,GACR,WAAW,GACX,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,gBAAgB,GAChB,QAAQ,CAAC;AAEb,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,oBAAoB,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAkCD;;;GAGG;AACH,qBAAa,YAAY;IAGX,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAFtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;gBAErB,QAAQ,CAAC,EAAE,MAAM,YAAA;IAQ9C,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,iBAAiB;IAcrB,cAAc,CACZ,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,GACrE,iBAAiB;IAkBpB,YAAY,CACV,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE;QACL,cAAc,EAAE,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,QAAQ,GAAG,WAAW,CAAC,CAAC;QAChH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,iBAAiB;IAepB,IAAI,CAAC,KAAK,SAAM,GAAG,iBAAiB,EAAE;IAItC,MAAM,IAAI;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAe1D,OAAO,CAAC,MAAM;CAgBf"}

package/dist/action-ledger.js

@@ -0,0 +1,122 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+const GENESIS_HASH = '0'.repeat(64);
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function hashable(event) {
+    return JSON.stringify({
+        sequence: event.sequence,
+        actionId: event.actionId,
+        at: event.at,
+        kind: event.kind,
+        tenantId: event.tenantId,
+        sessionId: event.sessionId,
+        tool: event.tool,
+        idempotencyKey: event.idempotencyKey,
+        executionState: event.executionState,
+        decisionReason: event.decisionReason,
+        requiresApproval: event.requiresApproval,
+        argsHash: event.argsHash,
+        argKeys: event.argKeys,
+        outputHash: event.outputHash,
+        evidenceId: event.evidenceId,
+        targetReceipt: event.targetReceipt,
+        previousHash: event.previousHash,
+    });
+}
+/**
+ * Append-only local proof of an agent action. Payloads are represented by hashes and key names,
+ * keeping sensitive request and response content out of the operational ledger.
+ */
+export class ActionLedger {
+    filePath;
+    events = [];
+    constructor(filePath) {
+        this.filePath = filePath;
+        if (filePath && existsSync(filePath)) {
+            for (const line of readFileSync(filePath, 'utf8').split('\n').filter(Boolean)) {
+                this.events.push(JSON.parse(line));
+            }
+        }
+    }
+    recordIntent(input) {
+        return this.append({
+            actionId: randomUUID(),
+            kind: 'intent',
+            tenantId: input.tenantId,
+            sessionId: input.sessionId,
+            tool: input.tool,
+            idempotencyKey: input.idempotencyKey,
+            executionState: 'intent_recorded',
+            argsHash: sha256(JSON.stringify(input.args)),
+            argKeys: Object.keys(input.args).sort(),
+        });
+    }
+    recordDecision(intent, input) {
+        return this.append({
+            actionId: intent.actionId,
+            kind: 'decision',
+            tenantId: intent.tenantId,
+            sessionId: intent.sessionId,
+            tool: intent.tool,
+            idempotencyKey: intent.idempotencyKey,
+            executionState: input.allowed
+                ? 'executing'
+                : input.requiresApproval
+                    ? 'approval_required'
+                    : 'denied',
+            decisionReason: input.reason,
+            requiresApproval: input.requiresApproval,
+        });
+    }
+    recordResult(intent, input) {
+        return this.append({
+            actionId: intent.actionId,
+            kind: 'result',
+            tenantId: intent.tenantId,
+            sessionId: intent.sessionId,
+            tool: intent.tool,
+            idempotencyKey: intent.idempotencyKey,
+            executionState: input.executionState,
+            outputHash: input.output ? sha256(JSON.stringify(input.output)) : undefined,
+            evidenceId: input.evidenceId,
+            targetReceipt: input.targetReceipt,
+        });
+    }
+    list(limit = 100) {
+        return this.events.slice(-Math.max(1, Math.min(limit, 500))).reverse();
+    }
+    verify() {
+        let previousHash = GENESIS_HASH;
+        for (const event of this.events) {
+            if (event.previousHash !== previousHash) {
+                return { ok: false, checked: event.sequence - 1, error: `chain_break_at_${event.sequence}` };
+            }
+            const { hash, ...body } = event;
+            if (sha256(hashable(body)) !== hash) {
+                return { ok: false, checked: event.sequence - 1, error: `hash_mismatch_at_${event.sequence}` };
+            }
+            previousHash = event.hash;
+        }
+        return { ok: true, checked: this.events.length };
+    }
+    append(input) {
+        const previousHash = this.events.at(-1)?.hash ?? GENESIS_HASH;
+        const withoutHash = {
+            ...input,
+            sequence: this.events.length + 1,
+            at: input.at ?? new Date().toISOString(),
+            previousHash,
+        };
+        const event = { ...withoutHash, hash: sha256(hashable(withoutHash)) };
+        this.events.push(event);
+        if (this.filePath) {
+            mkdirSync(dirname(this.filePath), { recursive: true });
+            appendFileSync(this.filePath, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+        }
+        return event;
+    }
+}
+//# sourceMappingURL=action-ledger.js.map

package/dist/action-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-ledger.js","sourceRoot":"","sources":["../src/action-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEpC,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsC;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,YAAY;IAGM;IAFZ,MAAM,GAAwB,EAAE,CAAC;IAElD,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;QAC5C,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,YAAY,CAAC,KAMZ;QACC,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,UAAU,EAAE;YACtB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,iBAAiB;YACjC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CACZ,MAAyB,EACzB,KAAsE;QAEtE,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,KAAK,CAAC,OAAO;gBAC3B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,KAAK,CAAC,gBAAgB;oBACtB,CAAC,CAAC,mBAAmB;oBACrB,CAAC,CAAC,QAAQ;YACd,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CACV,MAAyB,EACzB,KAKC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,GAAG;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACzE,CAAC;IAED,MAAM;QACJ,IAAI,YAAY,GAAG,YAAY,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,KAAK,EAAE,kBAAkB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/F,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,KAAK,EAAE,oBAAoB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjG,CAAC;YACD,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACnD,CAAC;IAEO,MAAM,CAAC,KAAuB;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,YAAY,CAAC;QAC9D,MAAM,WAAW,GAAoC;YACnD,GAAG,KAAK;YACR,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAChC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,YAAY;SACb,CAAC;QACF,MAAM,KAAK,GAAsB,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/assurance-envelope.d.ts

@@ -0,0 +1,48 @@
+import type { ActionLedgerEvent } from './action-ledger.js';
+export interface AssuranceEnvelope {
+    version: 'v1';
+    actionId: string;
+    tenantId: number;
+    sessionId: string;
+    tool: string;
+    idempotencyKey?: string;
+    createdAt: string;
+    updatedAt: string;
+    intent: {
+        argsHash?: string;
+        argKeys?: string[];
+        ledgerHash: string;
+    };
+    policy?: {
+        executionState: string;
+        allowed: boolean;
+        reason?: string;
+        requiresApproval?: boolean;
+        ledgerHash: string;
+    };
+    result?: {
+        executionState: string;
+        outputHash?: string;
+        evidenceId?: string;
+        targetReceipt?: string;
+        ledgerHash: string;
+    };
+    identity?: {
+        agentDid?: string;
+        status?: 'provisional' | 'verified';
+    };
+    assurance?: {
+        riskScore?: number;
+        blastRadiusImpact?: number;
+        controlId?: string;
+    };
+}
+/** Build a redacted, portable action receipt from hash-chained ledger events. */
+export declare function createAssuranceEnvelope(input: {
+    intent: ActionLedgerEvent;
+    decision?: ActionLedgerEvent;
+    result?: ActionLedgerEvent;
+    identity?: AssuranceEnvelope['identity'];
+    assurance?: AssuranceEnvelope['assurance'];
+}): AssuranceEnvelope;
+//# sourceMappingURL=assurance-envelope.d.ts.map

package/dist/assurance-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance-envelope.d.ts","sourceRoot":"","sources":["../src/assurance-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,MAAM,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACvH,MAAM,CAAC,EAAE;QACP,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,aAAa,GAAG,UAAU,CAAA;KAAE,CAAC;IACtE,SAAS,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpF;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;CAC5C,GAAG,iBAAiB,CAiCpB"}

package/dist/assurance-envelope.js

@@ -0,0 +1,36 @@
+/** Build a redacted, portable action receipt from hash-chained ledger events. */
+export function createAssuranceEnvelope(input) {
+    const { intent, decision, result } = input;
+    return {
+        version: 'v1',
+        actionId: intent.actionId,
+        tenantId: intent.tenantId,
+        sessionId: intent.sessionId,
+        tool: intent.tool,
+        idempotencyKey: intent.idempotencyKey,
+        createdAt: intent.at,
+        updatedAt: result?.at ?? decision?.at ?? intent.at,
+        intent: { argsHash: intent.argsHash, argKeys: intent.argKeys, ledgerHash: intent.hash },
+        policy: decision
+            ? {
+                executionState: decision.executionState,
+                allowed: decision.executionState === 'executing',
+                reason: decision.decisionReason,
+                requiresApproval: decision.requiresApproval,
+                ledgerHash: decision.hash,
+            }
+            : undefined,
+        result: result
+            ? {
+                executionState: result.executionState,
+                outputHash: result.outputHash,
+                evidenceId: result.evidenceId,
+                targetReceipt: result.targetReceipt,
+                ledgerHash: result.hash,
+            }
+            : undefined,
+        identity: input.identity,
+        assurance: input.assurance,
+    };
+}
+//# sourceMappingURL=assurance-envelope.js.map

package/dist/assurance-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance-envelope.js","sourceRoot":"","sources":["../src/assurance-envelope.ts"],"names":[],"mappings":"AAwBA,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,KAMvC;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC3C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,EAAE;QAClD,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE;QACvF,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC;gBACE,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,OAAO,EAAE,QAAQ,CAAC,cAAc,KAAK,WAAW;gBAChD,MAAM,EAAE,QAAQ,CAAC,cAAc;gBAC/B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,UAAU,EAAE,QAAQ,CAAC,IAAI;aAC1B;YACH,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC;gBACE,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,MAAM,CAAC,IAAI;aACxB;YACH,CAAC,CAAC,SAAS;QACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+export * from './action-ledger.js';
+export * from './assurance-envelope.js';
+export interface EvidenceRecord {
+    id: string;
+    controlId: string;
+    tenantId: number;
+    sha256: string;
+    uri: string;
+    collectedAt: string;
+    lineage: {
+        parentHash?: string;
+        source: string;
+    };
+}
+export interface EvidenceDatabase {
+    query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<{
+        rows: T[];
+        rowCount: number;
+    }>;
+    execute(sql: string, params?: unknown[]): Promise<void>;
+}
+export declare class EvidenceStore {
+    private readonly records;
+    private readonly db?;
+    constructor(database?: EvidenceDatabase);
+    static hashContent(buffer: Buffer | string): string;
+    attach(input: Omit<EvidenceRecord, 'id' | 'sha256'> & {
+        content?: Buffer | string;
+    }): EvidenceRecord;
+    get(id: string): EvidenceRecord | undefined;
+    listByControl(controlId: string): EvidenceRecord[];
+    loadFromDatabase(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAmB;gBAE3B,QAAQ,CAAC,EAAE,gBAAgB;IAIvC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAInD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,cAAc;IAiCpG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI3C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,EAAE;IAI5C,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;CA8BxC"}

package/dist/index.js

@@ -0,0 +1,68 @@
+import { createHash } from 'node:crypto';
+export * from './action-ledger.js';
+export * from './assurance-envelope.js';
+export class EvidenceStore {
+    records = new Map();
+    db;
+    constructor(database) {
+        this.db = database;
+    }
+    static hashContent(buffer) {
+        return createHash('sha256').update(buffer).digest('hex');
+    }
+    attach(input) {
+        const sha256 = input.content !== undefined
+            ? EvidenceStore.hashContent(input.content)
+            : EvidenceStore.hashContent(`${input.uri}|${input.collectedAt}`);
+        const id = `ev-${sha256.slice(0, 16)}`;
+        const record = { ...input, id, sha256 };
+        this.records.set(id, record);
+        if (this.db) {
+            const db = this.db;
+            void db.execute(`INSERT INTO evidence (id, tenant_id, control_id, sha256, uri, metadata, lineage, collected_at, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW())
+         ON CONFLICT (id) DO NOTHING`, [
+                id,
+                String(input.tenantId),
+                input.controlId,
+                sha256,
+                input.uri,
+                JSON.stringify({}),
+                JSON.stringify(input.lineage),
+                input.collectedAt,
+            ]).catch(() => {
+                // fall back to in-memory only
+            });
+        }
+        return record;
+    }
+    get(id) {
+        return this.records.get(id);
+    }
+    listByControl(controlId) {
+        return [...this.records.values()].filter((r) => r.controlId === controlId);
+    }
+    async loadFromDatabase() {
+        if (!this.db)
+            return;
+        try {
+            const { rows } = await this.db.query(`SELECT id, control_id, tenant_id, sha256, uri, collected_at, lineage FROM evidence`);
+            for (const row of rows) {
+                const record = {
+                    id: row.id,
+                    controlId: row.control_id,
+                    tenantId: Number(row.tenant_id),
+                    sha256: row.sha256,
+                    uri: row.uri,
+                    collectedAt: row.collected_at,
+                    lineage: row.lineage,
+                };
+                this.records.set(record.id, record);
+            }
+        }
+        catch {
+            // fall back to empty in-memory state
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AAiBxC,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,EAAE,CAAoB;IAEvC,YAAY,QAA2B;QACrC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,MAAuB;QACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,KAA4E;QACjF,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAmB,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE7B,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,OAAO,CACb;;qCAE6B,EAC7B;gBACE,EAAE;gBACF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACtB,KAAK,CAAC,SAAS;gBACf,MAAM;gBACN,KAAK,CAAC,GAAG;gBACT,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC7B,KAAK,CAAC,WAAW;aAClB,CACF,CAAC,KAAK,CAAC,GAAG,EAAE;gBACX,8BAA8B;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CASlC,oFAAoF,CACrF,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAmB;oBAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,SAAS,EAAE,GAAG,CAAC,UAAU;oBACzB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,WAAW,EAAE,GAAG,CAAC,YAAY;oBAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@grc-claw/evidence",
+  "version": "2.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@grc-claw/core": "*"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}