@mcp-audit-gateway/core 0.1.0

package/dist/attestation/chain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.test.js","sourceRoot":"","sources":["../../src/attestation/chain.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9B,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEtC,kCAAkC;QAClC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhD,gDAAgD;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7D,gDAAgD;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAClC,kDAAkD,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,oCAAoC;QACpC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAClC,kDAAkD,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE5C,uCAAuC;QACvC,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,kBAAkB;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACrC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kDAAkD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/attestation/keygen.d.ts

@@ -0,0 +1,5 @@
+export declare function generateKeyPair(outputDir: string): Promise<{
+    publicKeyPath: string;
+    privateKeyPath: string;
+}>;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/attestation/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/attestation/keygen.ts"],"names":[],"mappings":"AAEA,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CAYD"}

package/dist/attestation/keygen.js

@@ -0,0 +1,12 @@
+import { writeFile } from "node:fs/promises";
+export async function generateKeyPair(outputDir) {
+    const ed = await import("@noble/ed25519");
+    const privateKey = ed.utils.randomPrivateKey();
+    const publicKey = await ed.getPublicKeyAsync(privateKey);
+    const privateKeyPath = `${outputDir}/gateway.key`;
+    const publicKeyPath = `${outputDir}/gateway.pub`;
+    await writeFile(privateKeyPath, Buffer.from(privateKey), { mode: 0o600 });
+    await writeFile(publicKeyPath, Buffer.from(publicKey), { mode: 0o644 });
+    return { publicKeyPath, privateKeyPath };
+}
+//# sourceMappingURL=keygen.js.map

package/dist/attestation/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../../src/attestation/keygen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IAIrD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEzD,MAAM,cAAc,GAAG,GAAG,SAAS,cAAc,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,cAAc,CAAC;IAEjD,MAAM,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AAC3C,CAAC"}

package/dist/attestation/signer.d.ts

@@ -0,0 +1,25 @@
+import type { AttestationConfig, AuditRecord } from "../types.js";
+export interface Signer {
+    sign(record: AuditRecord): Promise<string>;
+    verify(record: AuditRecord, signature: string): Promise<boolean>;
+}
+export declare class HmacSigner implements Signer {
+    private secret;
+    constructor(secret: string);
+    sign(record: AuditRecord): Promise<string>;
+    verify(record: AuditRecord, signature: string): Promise<boolean>;
+    private canonicalize;
+}
+export declare class Ed25519Signer implements Signer {
+    private keyPath?;
+    private privateKey;
+    private publicKey;
+    constructor(keyPath?: string | undefined);
+    init(): Promise<void>;
+    sign(record: AuditRecord): Promise<string>;
+    verify(record: AuditRecord, signature: string): Promise<boolean>;
+    getPublicKey(): Uint8Array | null;
+    private canonicalize;
+}
+export declare function createSigner(config: AttestationConfig): Signer;
+//# sourceMappingURL=signer.d.ts.map

package/dist/attestation/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/attestation/signer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,qBAAa,UAAW,YAAW,MAAM;IACvC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM;IAIpB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAO1C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQtE,OAAO,CAAC,YAAY;CAGrB;AAED,qBAAa,aAAc,YAAW,MAAM;IAI9B,OAAO,CAAC,OAAO,CAAC;IAH5B,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,SAAS,CAA2B;gBAExB,OAAO,CAAC,EAAE,MAAM,YAAA;IAE9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQtE,YAAY,IAAI,UAAU,GAAG,IAAI;IAIjC,OAAO,CAAC,YAAY;CAGrB;AAmBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAS9D"}

package/dist/attestation/signer.js

@@ -0,0 +1,93 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+export class HmacSigner {
+    secret;
+    constructor(secret) {
+        this.secret = Buffer.from(secret, "hex");
+    }
+    async sign(record) {
+        const payload = this.canonicalize(record);
+        const hmac = createHmac("sha256", this.secret);
+        hmac.update(payload);
+        return hmac.digest("hex");
+    }
+    async verify(record, signature) {
+        const expected = await this.sign(record);
+        const expectedBuf = Buffer.from(expected, "hex");
+        const signatureBuf = Buffer.from(signature, "hex");
+        if (expectedBuf.length !== signatureBuf.length)
+            return false;
+        return timingSafeEqual(expectedBuf, signatureBuf);
+    }
+    canonicalize(record) {
+        return canonicalizeRecord(record);
+    }
+}
+export class Ed25519Signer {
+    keyPath;
+    privateKey = null;
+    publicKey = null;
+    constructor(keyPath) {
+        this.keyPath = keyPath;
+    }
+    async init() {
+        const ed = await import("@noble/ed25519");
+        if (this.keyPath) {
+            const { readFile } = await import("node:fs/promises");
+            const keyData = await readFile(this.keyPath);
+            this.privateKey = new Uint8Array(keyData);
+        }
+        else {
+            this.privateKey = ed.utils.randomPrivateKey();
+        }
+        this.publicKey = await ed.getPublicKeyAsync(this.privateKey);
+    }
+    async sign(record) {
+        if (!this.privateKey)
+            await this.init();
+        const ed = await import("@noble/ed25519");
+        const payload = new TextEncoder().encode(this.canonicalize(record));
+        const sig = await ed.signAsync(payload, this.privateKey);
+        return Buffer.from(sig).toString("hex");
+    }
+    async verify(record, signature) {
+        if (!this.publicKey)
+            await this.init();
+        const ed = await import("@noble/ed25519");
+        const payload = new TextEncoder().encode(this.canonicalize(record));
+        const sig = Buffer.from(signature, "hex");
+        return ed.verifyAsync(sig, payload, this.publicKey);
+    }
+    getPublicKey() {
+        return this.publicKey;
+    }
+    canonicalize(record) {
+        return canonicalizeRecord(record);
+    }
+}
+function canonicalizeRecord(record) {
+    const ordered = [
+        ["id", record.id],
+        ["timestamp", record.timestamp],
+        ["method", record.method],
+        ["toolName", record.toolName ?? null],
+        ["namespace", record.namespace ?? null],
+        ["upstream", record.upstream ?? null],
+        ["principal", record.principal ?? null],
+        ["durationMs", record.durationMs],
+        ["success", record.success],
+        ["errorCode", record.errorCode ?? null],
+        ["previousHash", record.previousHash ?? null],
+    ];
+    return JSON.stringify(ordered);
+}
+export function createSigner(config) {
+    if (!config.enabled) {
+        return { sign: async () => "", verify: async () => true };
+    }
+    if (config.algorithm === "hmac-sha256") {
+        const secret = config.secret ?? randomBytes(32).toString("hex");
+        return new HmacSigner(secret);
+    }
+    return new Ed25519Signer(config.keyPath);
+}
+//# sourceMappingURL=signer.js.map

package/dist/attestation/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/attestation/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQvE,MAAM,OAAO,UAAU;IACb,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,SAAiB;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAEO,YAAY,CAAC,MAAmB;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAIJ;IAHZ,UAAU,GAAsB,IAAI,CAAC;IACrC,SAAS,GAAsB,IAAI,CAAC;IAE5C,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IAExC,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAW,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,SAAiB;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAU,CAAC,CAAC;IACvD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,MAAmB;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,MAAmB;IAC7C,MAAM,OAAO,GAAiD;QAC5D,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QACvC,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QACvC,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QACvC,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;KAC9C,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/attestation/signer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signer.test.d.ts.map

package/dist/attestation/signer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.test.d.ts","sourceRoot":"","sources":["../../src/attestation/signer.test.ts"],"names":[],"mappings":""}

package/dist/attestation/signer.test.js

@@ -0,0 +1,62 @@
+import { describe, it, expect } from "vitest";
+import { HmacSigner, Ed25519Signer } from "./signer.js";
+const mockRecord = {
+    id: "test-uuid-001",
+    timestamp: "2026-08-16T10:00:00.000Z",
+    method: "tools/call",
+    toolName: "github/create_pr",
+    namespace: "github",
+    upstream: "github-server",
+    principal: "agent:dev-bot",
+    durationMs: 234,
+    success: true,
+};
+describe("HmacSigner", () => {
+    const secret = "a".repeat(64);
+    const signer = new HmacSigner(secret);
+    it("produces a hex signature", async () => {
+        const sig = await signer.sign(mockRecord);
+        expect(sig).toMatch(/^[0-9a-f]{64}$/);
+    });
+    it("verifies a valid signature", async () => {
+        const sig = await signer.sign(mockRecord);
+        const valid = await signer.verify(mockRecord, sig);
+        expect(valid).toBe(true);
+    });
+    it("rejects a tampered record", async () => {
+        const sig = await signer.sign(mockRecord);
+        const tampered = { ...mockRecord, durationMs: 999 };
+        const valid = await signer.verify(tampered, sig);
+        expect(valid).toBe(false);
+    });
+    it("rejects a wrong signature", async () => {
+        const valid = await signer.verify(mockRecord, "bad".repeat(21) + "b");
+        expect(valid).toBe(false);
+    });
+});
+describe("Ed25519Signer", () => {
+    it("signs and verifies a record", async () => {
+        const signer = new Ed25519Signer();
+        await signer.init();
+        const sig = await signer.sign(mockRecord);
+        expect(sig.length).toBeGreaterThan(100);
+        const valid = await signer.verify(mockRecord, sig);
+        expect(valid).toBe(true);
+    });
+    it("rejects a tampered record", async () => {
+        const signer = new Ed25519Signer();
+        await signer.init();
+        const sig = await signer.sign(mockRecord);
+        const tampered = { ...mockRecord, success: false };
+        const valid = await signer.verify(tampered, sig);
+        expect(valid).toBe(false);
+    });
+    it("exposes the public key for external verification", async () => {
+        const signer = new Ed25519Signer();
+        await signer.init();
+        const pubKey = signer.getPublicKey();
+        expect(pubKey).not.toBeNull();
+        expect(pubKey.length).toBe(32);
+    });
+});
+//# sourceMappingURL=signer.test.js.map

package/dist/attestation/signer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.test.js","sourceRoot":"","sources":["../../src/attestation/signer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGxD,MAAM,UAAU,GAAgB;IAC9B,EAAE,EAAE,eAAe;IACnB,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/attestation/verify.d.ts

@@ -0,0 +1,26 @@
+import type { AuditRecord } from "../types.js";
+import { type Signer } from "./signer.js";
+export interface VerifyResult {
+    total: number;
+    valid: number;
+    invalid: number;
+    errors: Array<{
+        line: number;
+        id: string;
+        reason: string;
+    }>;
+}
+export interface ChainVerifyResult {
+    total: number;
+    valid: boolean;
+    errors: Array<{
+        line: number;
+        id: string;
+        reason: string;
+    }>;
+}
+export declare function verifyAuditLog(path: string, signer: Signer, options?: {
+    verifyChain?: boolean;
+}): Promise<VerifyResult>;
+export declare function verifyChain(records: AuditRecord[]): Promise<ChainVerifyResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/attestation/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/attestation/verify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAA6B,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,YAAY,CAAC,CA0EvB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+BpF"}

package/dist/attestation/verify.js

@@ -0,0 +1,104 @@
+import { createReadStream } from "node:fs";
+import { createInterface } from "node:readline";
+import { hashRecord } from "./audit-log.js";
+export async function verifyAuditLog(path, signer, options) {
+    const result = { total: 0, valid: 0, invalid: 0, errors: [] };
+    const rl = createInterface({
+        input: createReadStream(path),
+        crlfDelay: Infinity,
+    });
+    let lineNum = 0;
+    let previousHash = null;
+    for await (const line of rl) {
+        lineNum++;
+        if (!line.trim())
+            continue;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch {
+            result.invalid++;
+            result.errors.push({ line: lineNum, id: "?", reason: "invalid JSON" });
+            result.total++;
+            continue;
+        }
+        result.total++;
+        const signature = record.attestation;
+        if (!signature) {
+            result.invalid++;
+            result.errors.push({ line: lineNum, id: record.id, reason: "missing attestation" });
+            continue;
+        }
+        const recordWithoutSig = { ...record };
+        delete recordWithoutSig.attestation;
+        const valid = await signer.verify(recordWithoutSig, signature);
+        if (valid) {
+            result.valid++;
+        }
+        else {
+            result.invalid++;
+            result.errors.push({ line: lineNum, id: record.id, reason: "signature mismatch" });
+        }
+        if (options?.verifyChain) {
+            if (record.previousHash === undefined) {
+                if (valid) {
+                    result.invalid++;
+                    result.valid--;
+                }
+                result.errors.push({
+                    line: lineNum,
+                    id: record.id,
+                    reason: "missing previousHash in chain mode",
+                });
+            }
+            else {
+                const expectedPrevHash = previousHash === null ? "genesis" : previousHash;
+                if (record.previousHash !== expectedPrevHash) {
+                    if (valid) {
+                        result.invalid++;
+                        result.valid--;
+                    }
+                    result.errors.push({
+                        line: lineNum,
+                        id: record.id,
+                        reason: "chain hash mismatch",
+                    });
+                }
+            }
+            previousHash = hashRecord(record);
+        }
+    }
+    return result;
+}
+export async function verifyChain(records) {
+    const result = { total: records.length, valid: true, errors: [] };
+    for (let i = 0; i < records.length; i++) {
+        const record = records[i];
+        const lineNum = i + 1;
+        if (i === 0) {
+            if (record.previousHash !== "genesis") {
+                result.valid = false;
+                result.errors.push({
+                    line: lineNum,
+                    id: record.id,
+                    reason: "first record previousHash must be \"genesis\"",
+                });
+            }
+        }
+        else {
+            const prevRecord = records[i - 1];
+            const expectedHash = hashRecord(prevRecord);
+            if (record.previousHash !== expectedHash) {
+                result.valid = false;
+                result.errors.push({
+                    line: lineNum,
+                    id: record.id,
+                    reason: "previousHash does not match hash of prior record",
+                });
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=verify.js.map

package/dist/attestation/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/attestation/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAe5C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,MAAc,EACd,OAAmC;IAEnC,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAC7B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAE3B,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,WAAW,CAAC;QAEpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,gBAA+B,EAAE,SAAS,CAAC,CAAC;QAC9E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,oCAAoC;iBAC7C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,gBAAgB,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC1E,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;oBAC7C,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;wBACjB,IAAI,EAAE,OAAO;wBACb,EAAE,EAAE,MAAM,CAAC,EAAE;wBACb,MAAM,EAAE,qBAAqB;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAErF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,+CAA+C;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,OAAO;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,MAAM,EAAE,kDAAkD;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/attestation/verify.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verify.test.d.ts.map

package/dist/attestation/verify.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.d.ts","sourceRoot":"","sources":["../../src/attestation/verify.test.ts"],"names":[],"mappings":""}

package/dist/attestation/verify.test.js

@@ -0,0 +1,79 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { writeFile, unlink } from "node:fs/promises";
+import { HmacSigner } from "./signer.js";
+import { AuditLog } from "./audit-log.js";
+import { verifyAuditLog } from "./verify.js";
+const TEST_LOG = "/tmp/test-verify-audit.jsonl";
+const SECRET = "b".repeat(64);
+describe("verifyAuditLog", () => {
+    const signer = new HmacSigner(SECRET);
+    beforeEach(async () => {
+        try {
+            await unlink(TEST_LOG);
+        }
+        catch { }
+    });
+    afterEach(async () => {
+        try {
+            await unlink(TEST_LOG);
+        }
+        catch { }
+    });
+    it("verifies a valid audit log", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", {
+            toolName: "test/tool_a",
+            namespace: "test",
+            upstream: "test-server",
+            principal: "agent:bot",
+            durationMs: 100,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_b",
+            namespace: "test",
+            upstream: "test-server",
+            principal: "agent:bot",
+            durationMs: 50,
+            success: true,
+        });
+        const result = await verifyAuditLog(TEST_LOG, signer);
+        expect(result.total).toBe(2);
+        expect(result.valid).toBe(2);
+        expect(result.invalid).toBe(0);
+        expect(result.errors).toHaveLength(0);
+    });
+    it("detects tampered records", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", {
+            toolName: "test/tool_a",
+            durationMs: 100,
+            success: true,
+        });
+        const { readFile: rf } = await import("node:fs/promises");
+        const content = await rf(TEST_LOG, "utf-8");
+        const tampered = content.replace('"success":true', '"success":false');
+        await writeFile(TEST_LOG, tampered);
+        const result = await verifyAuditLog(TEST_LOG, signer);
+        expect(result.total).toBe(1);
+        expect(result.invalid).toBe(1);
+        expect(result.errors[0].reason).toBe("signature mismatch");
+    });
+    it("detects missing attestation", async () => {
+        const record = JSON.stringify({
+            id: "no-sig",
+            timestamp: "2026-08-16T10:00:00Z",
+            method: "tools/call",
+            durationMs: 50,
+            success: true,
+        });
+        await writeFile(TEST_LOG, record + "\n");
+        const result = await verifyAuditLog(TEST_LOG, signer);
+        expect(result.total).toBe(1);
+        expect(result.invalid).toBe(1);
+        expect(result.errors[0].reason).toBe("missing attestation");
+    });
+});
+//# sourceMappingURL=verify.test.js.map

package/dist/attestation/verify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../../src/attestation/verify.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,aAAa;YACvB,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5B,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}