@mandatez/sdk 0.1.1 → 0.1.8

package/dist/client.js

@@ -2,6 +2,10 @@ import { createSignedEvent } from './events/signing.js';
 import { SupabaseTransport } from './transport/supabase.js';
 import { PolicyEngine } from './policy/index.js';
 import { OversightGate } from './oversight/index.js';
+import { computeTrustScore } from './trust/posture.js';
+import { checkIdentity as hibpCheckIdentity } from './identity/hibp.js';
+import { getRiskScore as fetchRiskScore, computeRiskScore as triggerRiskScoreCompute, } from './risk/index.js';
+const DEFAULT_DIRECTORY_URL = 'https://core-directory.vercel.app';
 /**
  * Main SDK surface for developers.
  *
@@ -15,10 +19,25 @@ export class MandateZClient {
     transport;
     policyEngine;
     oversightGate;
+    trustProfile = null;
+    hibpApiKey;
+    directoryUrl;
+    exporters;
+    apiUrl;
+    apiKey;
+    batchConfig;
+    buffer = [];
+    bufferFlushTimer = null;
     constructor(config) {
         this.agentId = config.agentId;
         this.ownerId = config.ownerId;
         this.privateKey = config.privateKey;
+        this.hibpApiKey = config.hibpApiKey ?? null;
+        this.directoryUrl = (config.directoryUrl ?? DEFAULT_DIRECTORY_URL).replace(/\/+$/, '');
+        this.exporters = config.exporters ?? [];
+        this.apiUrl = config.apiUrl ? config.apiUrl.replace(/\/+$/, '') : null;
+        this.apiKey = config.apiKey ?? null;
+        this.batchConfig = config.batchConfig ?? null;
         this.transport = new SupabaseTransport({
             supabaseUrl: config.supabaseUrl,
             supabaseAnonKey: config.supabaseAnonKey,
@@ -68,7 +87,11 @@ export class MandateZClient {
             }, input.waitForApproval);
             outcome = oversightResult.outcome;
         }
-        // Step 4: Sign and emit
+        // Step 4: Sign and emit — include trust_score in metadata
+        const metadata = {
+            ...(input.metadata ?? {}),
+            trust_score: this.trustProfile?.trust_score ?? 0,
+        };
         const eventInput = {
             agent_id: this.agentId,
             owner_id: this.ownerId,
@@ -76,10 +99,240 @@ export class MandateZClient {
             resource: input.resource,
             outcome,
             policy_id: policyId ?? null,
-            metadata: input.metadata ?? {},
+            metadata,
         };
         const signed = await createSignedEvent(eventInput, this.privateKey);
-        return this.transport.emitEvent(signed);
+        // Buffering mode: queue the signed event and let the batch flush handle
+        // delivery. The returned event is authoritative (already signed) even
+        // though it has not yet reached the server.
+        if (this.batchConfig?.enabled) {
+            this.enqueue(signed);
+            this.fanOutToExporters(signed);
+            return signed;
+        }
+        const emitted = await this.transport.emitEvent(signed);
+        // Fire-and-forget: recompute trust score in background
+        this.recomputeTrustScore().catch(() => { });
+        // Fire-and-forget: fan out to every configured exporter in parallel.
+        // Exporter failures are logged but never block the main flow.
+        this.fanOutToExporters(emitted);
+        return emitted;
+    }
+    /**
+     * Signs each input event locally and posts the batch to /api/events/batch.
+     *
+     * Requires `apiUrl` in config. The endpoint rejects the entire batch if
+     * any signature or schema check fails, so a returned `rejected` count is
+     * either 0 (all accepted) or equal to the input length (nothing inserted).
+     */
+    async trackBatch(events) {
+        if (!this.apiUrl) {
+            throw new Error('MandateZClient: apiUrl is required in config to call trackBatch()');
+        }
+        if (events.length === 0) {
+            return { accepted: 0, rejected: 0, errors: [] };
+        }
+        const signed = await Promise.all(events.map((input) => createSignedEvent({
+            agent_id: this.agentId,
+            owner_id: this.ownerId,
+            action_type: input.action_type,
+            resource: input.resource,
+            outcome: input.outcome ?? 'allowed',
+            policy_id: input.policy_id ?? null,
+            metadata: input.metadata ?? {},
+        }, this.privateKey)));
+        return this.postBatch(signed);
+    }
+    /**
+     * Flushes any buffered events immediately. Callers should invoke this
+     * during graceful shutdown to avoid dropping queued events.
+     */
+    async flush() {
+        if (this.bufferFlushTimer) {
+            clearTimeout(this.bufferFlushTimer);
+            this.bufferFlushTimer = null;
+        }
+        const pending = this.buffer;
+        this.buffer = [];
+        if (pending.length === 0) {
+            return { accepted: 0, rejected: 0, errors: [] };
+        }
+        return this.postBatch(pending);
+    }
+    enqueue(event) {
+        if (!this.batchConfig)
+            return;
+        this.buffer.push(event);
+        if (this.buffer.length >= this.batchConfig.maxSize) {
+            void this.flush().catch(() => { });
+            return;
+        }
+        if (!this.bufferFlushTimer) {
+            this.bufferFlushTimer = setTimeout(() => {
+                this.bufferFlushTimer = null;
+                void this.flush().catch(() => { });
+            }, this.batchConfig.maxWaitMs);
+        }
+    }
+    async postBatch(events) {
+        if (!this.apiUrl) {
+            throw new Error('MandateZClient: apiUrl is required to flush batched events');
+        }
+        const headers = { 'Content-Type': 'application/json' };
+        if (this.apiKey)
+            headers['Authorization'] = `Bearer ${this.apiKey}`;
+        const res = await fetch(`${this.apiUrl}/api/events/batch`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ owner_id: this.ownerId, events }),
+        });
+        const payload = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            return {
+                accepted: payload.accepted ?? 0,
+                rejected: payload.rejected ?? events.length,
+                errors: payload.errors ?? [
+                    { index: -1, reason: 'http_error', detail: payload.error ?? `HTTP ${res.status}` },
+                ],
+            };
+        }
+        return {
+            accepted: payload.accepted ?? 0,
+            rejected: payload.rejected ?? 0,
+            errors: payload.errors ?? [],
+        };
+    }
+    fanOutToExporters(event) {
+        if (this.exporters.length === 0)
+            return;
+        for (const exporter of this.exporters) {
+            // Each exporter runs independently; one failing cannot affect another.
+            exporter.export(event).catch((err) => {
+                const message = err instanceof Error ? err.message : String(err);
+                // eslint-disable-next-line no-console
+                console.warn(`[mandatez] exporter "${exporter.name}" failed: ${message}`);
+            });
+        }
+    }
+    /**
+     * Fetches all events for this agent from Supabase, recomputes
+     * the trust score, and updates the agents table.
+     */
+    async recomputeTrustScore() {
+        const events = await this.transport.fetchAgentEvents(this.agentId);
+        const profile = computeTrustScore(events);
+        this.trustProfile = profile;
+        await this.transport.updateAgentTrust(this.agentId, profile);
+        return profile;
+    }
+    /**
+     * Returns the last computed trust profile, or null if not yet computed.
+     */
+    getTrustProfile() {
+        return this.trustProfile;
+    }
+    /**
+     * Checks an email against HaveIBeenPwned, stores the result in
+     * Supabase (identity_checks table), and returns a recommendation.
+     *
+     * Recommendation logic:
+     * - status=clean    → allow
+     * - status=flagged  → onFlagged (default: 'restrict')
+     * - status=blocked  → block (cannot be overridden)
+     */
+    async checkIdentity(input) {
+        if (!this.hibpApiKey) {
+            throw new Error('MandateZClient: hibpApiKey is required in config to call checkIdentity()');
+        }
+        const result = await hibpCheckIdentity(input.email, this.hibpApiKey);
+        const agentId = input.agentId ?? this.agentId;
+        // Fire-and-forget persistence — don't let Supabase failures block the caller
+        this.transport
+            .insertIdentityCheck({
+            ownerId: this.ownerId,
+            agentId,
+            email: input.email,
+            result,
+        })
+            .catch(() => { });
+        const onFlagged = input.onFlagged ?? 'restrict';
+        let recommendation;
+        if (result.status === 'blocked')
+            recommendation = 'block';
+        else if (result.status === 'flagged')
+            recommendation = onFlagged;
+        else
+            recommendation = 'allow';
+        return { ...result, recommendation };
+    }
+    /**
+     * Verify another agent's MandateZ credentials before transacting with it.
+     *
+     * Calls the MandateZ directory's /api/agents/verify endpoint and returns
+     * whether the target agent meets the minimum trust score and grade you
+     * specified. Use this at the edge of any cross-agent interaction.
+     *
+     * @example
+     * const result = await client.verifyAgent({
+     *   requestingAgentId: 'ag_my_agent',
+     *   targetAgentId: 'ag_partner_agent',
+     *   requiredMinScore: 70,
+     * });
+     * if (!result.verified) {
+     *   throw new Error('Partner agent failed MandateZ verification');
+     * }
+     */
+    async verifyAgent(input) {
+        const res = await fetch(`${this.directoryUrl}/api/agents/verify`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                requesting_agent_id: input.requestingAgentId,
+                target_agent_id: input.targetAgentId,
+                required_min_score: input.requiredMinScore,
+                required_min_grade: input.requiredMinGrade,
+            }),
+        });
+        if (!res.ok) {
+            const err = (await res.json().catch(() => ({})));
+            throw new Error(err.error
+                ? `MandateZ verifyAgent failed: ${err.error}`
+                : `MandateZ verifyAgent failed: HTTP ${res.status}`);
+        }
+        const raw = (await res.json());
+        return {
+            verified: raw.verified,
+            targetTrustScore: raw.target_agent.trust_score,
+            targetTrustGrade: raw.target_agent.trust_grade,
+            targetPublicKey: raw.target_agent.public_key,
+            verificationId: raw.verification.verification_id,
+            raw,
+        };
+    }
+    /**
+     * Fetch the most recent risk score for an agent from the MandateZ
+     * dashboard. The server auto-computes a fresh score if none exists yet,
+     * so this never returns null.
+     *
+     * Requires `apiUrl` and `apiKey` in the client config.
+     */
+    async getRiskScore(agentId) {
+        if (!this.apiUrl || !this.apiKey) {
+            throw new Error('MandateZClient: apiUrl and apiKey are required in config to call getRiskScore()');
+        }
+        return fetchRiskScore(agentId, { apiUrl: this.apiUrl, apiKey: this.apiKey });
+    }
+    /**
+     * Trigger a fresh risk-score recomputation for an agent. The returned
+     * record is the newly persisted snapshot.
+     *
+     * Requires `apiUrl` and `apiKey` in the client config.
+     */
+    async computeRiskScore(agentId, windowDays) {
+        if (!this.apiUrl || !this.apiKey) {
+            throw new Error('MandateZClient: apiUrl and apiKey are required in config to call computeRiskScore()');
+        }
+        return triggerRiskScoreCompute(agentId, { apiUrl: this.apiUrl, apiKey: this.apiKey }, windowDays);
     }
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA6BrD;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,SAAS,CAAoB;IAC7B,YAAY,CAAe;IAC3B,aAAa,CAAuB;IAE5C,YAAY,MAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,SAAS;YACnC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,4BAA4B;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;QACpD,IAAI,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC;QAEzD,kDAAkD;QAClD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACzD,OAAO,GAAG,SAAS,CAAC;YACpB,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,CAAC;QAED,6DAA6D;QAC7D,IACE,OAAO,KAAK,SAAS;YACrB,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EACtD,CAAC;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAC9D;gBACE,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,iBAAiB,EAAE,IAAI;aACxB,EACD,KAAK,CAAC,eAAe,CACtB,CAAC;YAEF,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,wBAAwB;QACxB,MAAM,UAAU,GAAoB;YAClC,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,SAAS,EAAE,QAAQ,IAAI,IAAI;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,YAAY,IAAI,cAAc,EAC9B,gBAAgB,IAAI,uBAAuB,GAC5C,MAAM,iBAAiB,CAAC;AA2IzB,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACjB,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,SAAS,CAAoB;IAC7B,YAAY,CAAe;IAC3B,aAAa,CAAuB;IACpC,YAAY,GAA6B,IAAI,CAAC;IAC9C,UAAU,CAAgB;IAC1B,YAAY,CAAS;IACrB,SAAS,CAAkB;IAC3B,MAAM,CAAgB;IACtB,MAAM,CAAgB;IACtB,WAAW,CAAqB;IAChC,MAAM,GAAiB,EAAE,CAAC;IAC1B,gBAAgB,GAAyC,IAAI,CAAC;IAEtE,YAAY,MAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,SAAS;YACnC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,4BAA4B;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;QACpD,IAAI,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC;QAEzD,kDAAkD;QAClD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACzD,OAAO,GAAG,SAAS,CAAC;YACpB,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,CAAC;QAED,6DAA6D;QAC7D,IACE,OAAO,KAAK,SAAS;YACrB,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EACtD,CAAC;YACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAC9D;gBACE,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,iBAAiB,EAAE,IAAI;aACxB,EACD,KAAK,CAAC,eAAe,CACtB,CAAC;YAEF,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,0DAA0D;QAC1D,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;YACzB,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,IAAI,CAAC;SACjD,CAAC;QAEF,MAAM,UAAU,GAAoB;YAClC,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,SAAS,EAAE,QAAQ,IAAI,IAAI;YAC3B,QAAQ;SACT,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvD,uDAAuD;QACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE3C,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEhC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,MAAyB;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,iBAAiB,CACf;YACE,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,EACD,IAAI,CAAC,UAAU,CAChB,CACF,CACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAEO,OAAO,CAAC,KAAiB;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAExB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACnD,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC7B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAoB;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAEpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,mBAAmB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAElD,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;gBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM;gBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI;oBACxB,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE;iBACnF;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;YAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,KAAiB;QACzC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,uEAAuE;YACvE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC5C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAE5B,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAE9C,6EAA6E;QAC7E,IAAI,CAAC,SAAS;aACX,mBAAmB,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM;SACP,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEnB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC;QAChD,IAAI,cAA8C,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,cAAc,GAAG,OAAO,CAAC;aACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,cAAc,GAAG,SAAS,CAAC;;YAC5D,cAAc,GAAG,OAAO,CAAC;QAE9B,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,YAAY,oBAAoB,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,mBAAmB,EAAE,KAAK,CAAC,iBAAiB;gBAC5C,eAAe,EAAE,KAAK,CAAC,aAAa;gBACpC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB;gBAC1C,kBAAkB,EAAE,KAAK,CAAC,gBAAgB;aAC3C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC,gCAAgC,GAAG,CAAC,KAAK,EAAE;gBAC7C,CAAC,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CACtD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QAEzD,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW;YAC9C,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW;YAC9C,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;YAC5C,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,eAAe;YAChD,GAAG;SACJ,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,UAAmB;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,uBAAuB,CAC5B,OAAO,EACP,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC5C,UAAU,CACX,CAAC;IACJ,CAAC;CACF"}

package/dist/exporters/datadog.d.ts

@@ -0,0 +1,34 @@
+import type { AgentEvent } from '../events/schema.js';
+import type { EventExporter } from './index.js';
+export interface DatadogExporterConfig {
+    /** Datadog API key (DD-API-KEY). Required. */
+    apiKey: string;
+    /**
+     * Datadog site. Defaults to 'datadoghq.com'. Use 'datadoghq.eu' for EU,
+     * 'us3.datadoghq.com' / 'us5.datadoghq.com' / 'ap1.datadoghq.com' for
+     * other regions, or 'ddog-gov.com' for government.
+     */
+    site?: string;
+    /** Log service field — defaults to 'mandatez'. */
+    service?: string;
+    /** Log source field — defaults to 'mandatez-sdk'. */
+    source?: string;
+    /** Additional Datadog tags merged into every event. */
+    tags?: string[];
+}
+/**
+ * Ships MandateZ AgentEvents to Datadog Logs via the v2 HTTP intake.
+ *
+ * @see https://docs.datadoghq.com/api/latest/logs/#send-logs
+ */
+export declare class DatadogExporter implements EventExporter {
+    readonly name = "datadog";
+    private readonly endpoint;
+    private readonly apiKey;
+    private readonly service;
+    private readonly source;
+    private readonly tags;
+    constructor(config: DatadogExporterConfig);
+    export(event: AgentEvent): Promise<void>;
+}
+//# sourceMappingURL=datadog.d.ts.map

package/dist/exporters/datadog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.d.ts","sourceRoot":"","sources":["../../src/exporters/datadog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,qBAAqB;IACpC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACnD,QAAQ,CAAC,IAAI,aAAa;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;gBAEpB,MAAM,EAAE,qBAAqB;IAYnC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA+C/C"}

package/dist/exporters/datadog.js

@@ -0,0 +1,69 @@
+/**
+ * Ships MandateZ AgentEvents to Datadog Logs via the v2 HTTP intake.
+ *
+ * @see https://docs.datadoghq.com/api/latest/logs/#send-logs
+ */
+export class DatadogExporter {
+    name = 'datadog';
+    endpoint;
+    apiKey;
+    service;
+    source;
+    tags;
+    constructor(config) {
+        if (!config.apiKey) {
+            throw new Error('DatadogExporter: apiKey is required');
+        }
+        const site = (config.site ?? 'datadoghq.com').replace(/^https?:\/\//, '').replace(/\/+$/, '');
+        this.endpoint = `https://http-intake.logs.${site}/api/v2/logs`;
+        this.apiKey = config.apiKey;
+        this.service = config.service ?? 'mandatez';
+        this.source = config.source ?? 'mandatez-sdk';
+        this.tags = config.tags ?? [];
+    }
+    async export(event) {
+        const tags = [
+            `agent_id:${event.agent_id}`,
+            `owner_id:${event.owner_id}`,
+            `outcome:${event.outcome}`,
+            `action_type:${event.action_type}`,
+            ...this.tags,
+        ].join(',');
+        const payload = [
+            {
+                ddsource: this.source,
+                ddtags: tags,
+                hostname: 'mandatez-sdk',
+                service: this.service,
+                status: event.outcome === 'blocked' ? 'error' : event.outcome === 'flagged' ? 'warn' : 'info',
+                message: `[MandateZ] ${event.action_type} ${event.resource} → ${event.outcome}`,
+                timestamp: event.timestamp,
+                mandatez: {
+                    event_id: event.event_id,
+                    agent_id: event.agent_id,
+                    owner_id: event.owner_id,
+                    action_type: event.action_type,
+                    resource: event.resource,
+                    outcome: event.outcome,
+                    policy_id: event.policy_id,
+                    signature: event.signature,
+                    public_key: event.public_key,
+                    metadata: event.metadata,
+                },
+            },
+        ];
+        const res = await fetch(this.endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'DD-API-KEY': this.apiKey,
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new Error(`DatadogExporter: HTTP ${res.status} ${body.slice(0, 200)}`);
+        }
+    }
+}
+//# sourceMappingURL=datadog.js.map

package/dist/exporters/datadog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.js","sourceRoot":"","sources":["../../src/exporters/datadog.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,SAAS,CAAC;IACT,QAAQ,CAAS;IACjB,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,IAAI,CAAW;IAEhC,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,QAAQ,GAAG,4BAA4B,IAAI,cAAc,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,MAAM,IAAI,GAAG;YACX,YAAY,KAAK,CAAC,QAAQ,EAAE;YAC5B,YAAY,KAAK,CAAC,QAAQ,EAAE;YAC5B,WAAW,KAAK,CAAC,OAAO,EAAE;YAC1B,eAAe,KAAK,CAAC,WAAW,EAAE;YAClC,GAAG,IAAI,CAAC,IAAI;SACb,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,OAAO,GAAG;YACd;gBACE,QAAQ,EAAE,IAAI,CAAC,MAAM;gBACrB,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,cAAc;gBACxB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC7F,OAAO,EAAE,cAAc,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,MAAM,KAAK,CAAC,OAAO,EAAE;gBAC/E,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE;oBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB;aACF;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,MAAM;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}

package/dist/exporters/index.d.ts

@@ -0,0 +1,26 @@
+import type { AgentEvent } from '../events/schema.js';
+/**
+ * Pluggable destination for signed AgentEvents beyond the MandateZ
+ * event stream itself. Implementations fan events out to SIEMs,
+ * observability platforms, or custom webhooks.
+ *
+ * Implementations must treat export() as fire-and-forget — the
+ * MandateZClient never awaits the result on the hot path, and any
+ * thrown error is swallowed and logged. Do not rely on exporters for
+ * ordering or delivery guarantees; they are best-effort fan-out.
+ */
+export interface EventExporter {
+    /** Human-readable name used for error logging. */
+    name: string;
+    /** Ship a single signed event to the underlying destination. */
+    export(event: AgentEvent): Promise<void>;
+}
+export { DatadogExporter } from './datadog.js';
+export type { DatadogExporterConfig } from './datadog.js';
+export { SplunkExporter } from './splunk.js';
+export type { SplunkExporterConfig } from './splunk.js';
+export { WebhookExporter } from './webhook.js';
+export type { WebhookExporterConfig } from './webhook.js';
+export { OpenTelemetryExporter } from './otel.js';
+export type { OpenTelemetryExporterConfig } from './otel.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/exporters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/exporters/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,YAAY,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC"}

package/dist/exporters/index.js

@@ -0,0 +1,5 @@
+export { DatadogExporter } from './datadog.js';
+export { SplunkExporter } from './splunk.js';
+export { WebhookExporter } from './webhook.js';
+export { OpenTelemetryExporter } from './otel.js';
+//# sourceMappingURL=index.js.map

package/dist/exporters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/exporters/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC"}

package/dist/exporters/otel.d.ts

@@ -0,0 +1,38 @@
+import type { AgentEvent } from '../events/schema.js';
+import type { EventExporter } from './index.js';
+export interface OpenTelemetryExporterConfig {
+    /**
+     * OTLP/HTTP endpoint. The /v1/traces path is appended automatically
+     * if missing. Example: http://otel-collector:4318
+     */
+    endpoint: string;
+    /** OTel service.name resource attribute. Defaults to 'mandatez'. */
+    serviceName?: string;
+    /** Extra resource attributes merged into every export. */
+    resourceAttributes?: Record<string, string>;
+    /** Optional headers (Authorization, x-honeycomb-team, etc.). */
+    headers?: Record<string, string>;
+}
+/**
+ * Formats MandateZ AgentEvents as OTLP/HTTP spans and ships them to any
+ * OpenTelemetry Collector. This keeps the SDK dependency-free — we emit
+ * the wire-level JSON shape directly rather than pulling in the heavy
+ * @opentelemetry/sdk-node tree.
+ *
+ * Each event becomes a single zero-duration span whose name is
+ * `mandatez.<action_type>` with the full event serialized as span
+ * attributes. Status is mapped: blocked → ERROR, flagged → ERROR,
+ * everything else → OK.
+ *
+ * @see https://opentelemetry.io/docs/specs/otlp/#otlphttp
+ */
+export declare class OpenTelemetryExporter implements EventExporter {
+    readonly name = "opentelemetry";
+    private readonly endpoint;
+    private readonly serviceName;
+    private readonly resourceAttributes;
+    private readonly headers;
+    constructor(config: OpenTelemetryExporterConfig);
+    export(event: AgentEvent): Promise<void>;
+}
+//# sourceMappingURL=otel.d.ts.map

package/dist/exporters/otel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../src/exporters/otel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AA0BD;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,mBAAmB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyB;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAErC,MAAM,EAAE,2BAA2B;IAWzC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA2E/C"}

package/dist/exporters/otel.js

@@ -0,0 +1,115 @@
+import { randomBytes } from 'node:crypto';
+function anyValue(v) {
+    if (typeof v === 'string')
+        return { stringValue: v };
+    if (typeof v === 'boolean')
+        return { boolValue: v };
+    if (typeof v === 'number') {
+        return Number.isInteger(v) ? { intValue: v } : { doubleValue: v };
+    }
+    return { stringValue: JSON.stringify(v) };
+}
+function toAttrs(obj) {
+    return Object.entries(obj).map(([key, value]) => ({ key, value: anyValue(value) }));
+}
+/**
+ * Formats MandateZ AgentEvents as OTLP/HTTP spans and ships them to any
+ * OpenTelemetry Collector. This keeps the SDK dependency-free — we emit
+ * the wire-level JSON shape directly rather than pulling in the heavy
+ * @opentelemetry/sdk-node tree.
+ *
+ * Each event becomes a single zero-duration span whose name is
+ * `mandatez.<action_type>` with the full event serialized as span
+ * attributes. Status is mapped: blocked → ERROR, flagged → ERROR,
+ * everything else → OK.
+ *
+ * @see https://opentelemetry.io/docs/specs/otlp/#otlphttp
+ */
+export class OpenTelemetryExporter {
+    name = 'opentelemetry';
+    endpoint;
+    serviceName;
+    resourceAttributes;
+    headers;
+    constructor(config) {
+        if (!config.endpoint) {
+            throw new Error('OpenTelemetryExporter: endpoint is required');
+        }
+        const base = config.endpoint.replace(/\/+$/, '');
+        this.endpoint = /\/v1\/traces$/.test(base) ? base : `${base}/v1/traces`;
+        this.serviceName = config.serviceName ?? 'mandatez';
+        this.resourceAttributes = config.resourceAttributes ?? {};
+        this.headers = config.headers ?? {};
+    }
+    async export(event) {
+        const timestampNanos = BigInt(new Date(event.timestamp).getTime()) * 1000000n;
+        const ns = timestampNanos.toString();
+        // OTLP trace/span IDs: 16 and 8 random bytes, lowercase hex.
+        const traceId = randomBytes(16).toString('hex');
+        const spanId = randomBytes(8).toString('hex');
+        const blocked = event.outcome === 'blocked';
+        const flagged = event.outcome === 'flagged';
+        const statusCode = blocked || flagged ? 2 : 1; // 2 = ERROR, 1 = OK
+        const payload = {
+            resourceSpans: [
+                {
+                    resource: {
+                        attributes: toAttrs({
+                            'service.name': this.serviceName,
+                            'service.namespace': 'mandatez',
+                            ...this.resourceAttributes,
+                        }),
+                    },
+                    scopeSpans: [
+                        {
+                            scope: { name: '@mandatez/sdk', version: '0.1.6' },
+                            spans: [
+                                {
+                                    traceId,
+                                    spanId,
+                                    name: `mandatez.${event.action_type}`,
+                                    kind: 1, // SPAN_KIND_INTERNAL
+                                    startTimeUnixNano: ns,
+                                    endTimeUnixNano: ns,
+                                    attributes: toAttrs({
+                                        'mandatez.event_id': event.event_id,
+                                        'mandatez.agent_id': event.agent_id,
+                                        'mandatez.owner_id': event.owner_id,
+                                        'mandatez.action_type': event.action_type,
+                                        'mandatez.resource': event.resource,
+                                        'mandatez.outcome': event.outcome,
+                                        'mandatez.policy_id': event.policy_id ?? '',
+                                        'mandatez.public_key': event.public_key,
+                                        'mandatez.signature': event.signature,
+                                        'mandatez.metadata': JSON.stringify(event.metadata),
+                                    }),
+                                    status: {
+                                        code: statusCode,
+                                        message: blocked
+                                            ? 'Action blocked by MandateZ policy'
+                                            : flagged
+                                                ? 'Action flagged for review'
+                                                : '',
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        };
+        const res = await fetch(this.endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...this.headers,
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new Error(`OpenTelemetryExporter: HTTP ${res.status} ${body.slice(0, 200)}`);
+        }
+    }
+}
+//# sourceMappingURL=otel.js.map

package/dist/exporters/otel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.js","sourceRoot":"","sources":["../../src/exporters/otel.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA2B1C,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,eAAe,CAAC;IACf,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,kBAAkB,CAAyB;IAC3C,OAAO,CAAyB;IAEjD,YAAY,MAAmC;QAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC;QACxE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,UAAU,CAAC;QACpD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,QAAU,CAAC;QAChF,MAAM,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;QAErC,6DAA6D;QAC7D,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;QAEnE,MAAM,OAAO,GAAG;YACd,aAAa,EAAE;gBACb;oBACE,QAAQ,EAAE;wBACR,UAAU,EAAE,OAAO,CAAC;4BAClB,cAAc,EAAE,IAAI,CAAC,WAAW;4BAChC,mBAAmB,EAAE,UAAU;4BAC/B,GAAG,IAAI,CAAC,kBAAkB;yBAC3B,CAAC;qBACH;oBACD,UAAU,EAAE;wBACV;4BACE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE;4BAClD,KAAK,EAAE;gCACL;oCACE,OAAO;oCACP,MAAM;oCACN,IAAI,EAAE,YAAY,KAAK,CAAC,WAAW,EAAE;oCACrC,IAAI,EAAE,CAAC,EAAE,qBAAqB;oCAC9B,iBAAiB,EAAE,EAAE;oCACrB,eAAe,EAAE,EAAE;oCACnB,UAAU,EAAE,OAAO,CAAC;wCAClB,mBAAmB,EAAE,KAAK,CAAC,QAAQ;wCACnC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;wCACnC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;wCACnC,sBAAsB,EAAE,KAAK,CAAC,WAAW;wCACzC,mBAAmB,EAAE,KAAK,CAAC,QAAQ;wCACnC,kBAAkB,EAAE,KAAK,CAAC,OAAO;wCACjC,oBAAoB,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;wCAC3C,qBAAqB,EAAE,KAAK,CAAC,UAAU;wCACvC,oBAAoB,EAAE,KAAK,CAAC,SAAS;wCACrC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;qCACpD,CAAC;oCACF,MAAM,EAAE;wCACN,IAAI,EAAE,UAAU;wCAChB,OAAO,EAAE,OAAO;4CACd,CAAC,CAAC,mCAAmC;4CACrC,CAAC,CAAC,OAAO;gDACP,CAAC,CAAC,2BAA2B;gDAC7B,CAAC,CAAC,EAAE;qCACT;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,IAAI,CAAC,OAAO;aAChB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;CACF"}