@mcpose/audit 2.0.0 → 2.0.3

package/README.md

@@ -0,0 +1,120 @@
+# @mcpose/audit
+
+[![npm](https://img.shields.io/npm/v/@mcpose/audit)](https://www.npmjs.com/package/@mcpose/audit)
+[![license](https://img.shields.io/npm/l/@mcpose/audit)](https://github.com/amir-gorji/mcpose/blob/main/LICENSE)
+
+**Tamper-evident audit middleware for [mcpose](https://www.npmjs.com/package/mcpose).**
+
+`@mcpose/audit` turns every tool call flowing through an mcpose proxy into a tamper-evident **audit event**: HMAC-chained to its predecessor, hashed, and — for high-sensitivity calls — encrypted at rest. When a **session** closes, it emits a signed **replay manifest** with a Merkle root and per-event proofs, so any third party can verify that a single event happened without access to the full log.
+
+## When to reach for it
+
+You operate an MCP server in a regulated environment (e.g. financial services) and need to prove, after the fact, exactly which tool calls happened, by whom, in what order — with cryptographic evidence that the record has not been altered, inserted into, or truncated.
+
+## Install
+
+```bash
+npm install @mcpose/audit mcpose
+```
+
+`mcpose` is a peer dependency. Requires Node.js 18+ (uses `node:crypto`).
+
+## Quick start
+
+```ts
+import {
+  createAuditMiddleware,
+  createDefaultSigningKeyProvider,
+  createSensitivityResolver,
+} from '@mcpose/audit';
+import { startHttpProxy } from 'mcpose';
+
+// Supplied by your application:
+//   backend       — an mcpose BackendClient (see `mcpose` docs)
+//   auditLog      — your durable sink for audit events
+//   manifestStore — your durable sink for replay manifests
+//   piiMW         — an upstream redaction middleware
+//   extractJwt    — your resolveIdentity function
+
+// The signing secret never leaves the process; all subkeys derive from it.
+const signingKey = createDefaultSigningKeyProvider(process.env.AUDIT_SECRET!);
+
+// Map tools to a sensitivity tier. Unknown tools resolve to 'high'.
+const sensitivityResolver = createSensitivityResolver({
+  get_balance:    'low',
+  search_trades:  'medium',
+  transfer_funds: 'high',
+});
+
+const auditHandle = createAuditMiddleware({
+  signingKey,
+  sensitivityResolver,
+  onEvent: (event) => auditLog.append(event),
+  onManifest: (manifest) => manifestStore.save(manifest),
+});
+
+await startHttpProxy(
+  backend,
+  { toolMiddleware: [piiMW, auditHandle.middleware] },
+  {
+    resolveIdentity: extractJwt,
+    // Flush the replay manifest when the session ends.
+    onSessionClosed: (sessionId) => auditHandle.closeSession(sessionId),
+  },
+);
+```
+
+## How it works
+
+- **Audit event** — a record of one tool call: `identity`, `tool`, `outcome`, input/output hashes, and a `chainHash` linking it to the previous event. `AuditEvent` is a discriminated union on `sensitivityTier`.
+- **Sensitivity tier** (`low` | `medium` | `high`) — decides whether the event stores plaintext (`inputRaw`/`outputRaw`) or AES-256-GCM ciphertext (`inputEncrypted`/`outputEncrypted`). Unknown tools default to `high`.
+- **Replay manifest** — produced at session close: a Merkle root over every event's `chainHash`, individual `MerkleProof`s, and a signature over the root. Proves *what happened*; it does not re-execute calls.
+
+## Security model
+
+The append-only HMAC chain makes insertion, deletion, or reordering of events detectable; the signed Merkle root anchors the whole session; high-tier payloads are encrypted at rest.
+
+> **The signing secret is the root of all of it.** The per-entry **chain key** and the per-event AES **encryption root** are derived from the secret *through* the `SigningKeyProvider.sign()` oracle with domain separation — never from the public **key id**. The key id (`ReplayManifest.signedBy`) is a public identifier only; **never use it as key material**, and never hand-roll the chain or encryption keys. See **[ADR-0003](https://github.com/amir-gorji/mcpose/blob/main/docs/adr/0003-audit-subkeys-derived-from-signing-oracle.md)** for the reasoning and the attack it closes.
+
+For production, implement `SigningKeyProvider` against your KMS rather than holding the secret in process. `createDefaultSigningKeyProvider` is HMAC-SHA256 in-process signing, suitable for development and single-trust deployments.
+
+## API surface
+
+| Export | Purpose |
+|---|---|
+| `createAuditMiddleware(options)` | Returns `{ middleware, closeSession }`. Add `middleware` to the pipeline; call `closeSession(sessionId)` to emit the manifest. |
+| `createSensitivityResolver(map, override?)` | Build a `SensitivityResolverFn`; `override` takes precedence over the static map. |
+| `createDefaultSigningKeyProvider(secret)` | In-process HMAC-SHA256 `SigningKeyProvider`. |
+| `computeMerkleRoot` · `computeMerkleProof` · `verifyMerkleProof` | Low-level Merkle helpers for independent verification. |
+
+**Key types:** `AuditEvent` (`LowAuditEvent` \| `MediumAuditEvent` \| `HighAuditEvent`), `AuditEventBase`, `SensitivityTier`, `SensitivityResolverFn`, `SigningKeyProvider`, `AuditOptions`, `AuditMiddlewareHandle`, `ReplayManifest`, `MerkleProof`, `CostMetadata`.
+
+### `AuditOptions`
+
+```ts
+interface AuditOptions {
+  signingKey: SigningKeyProvider;
+  sensitivityResolver: SensitivityResolverFn;
+  onEvent: (event: AuditEvent) => void | Promise<void>;
+  onManifest?: (manifest: ReplayManifest) => void | Promise<void>;
+  hashAlgorithm?: 'SHA-256';   // default: SHA-256
+  includeRejections?: boolean; // default: true
+  includeCost?: boolean;       // default: true
+}
+```
+
+`closeSession(sessionId)` returns `undefined` if the session had no events or is unknown. Wire it to `HttpProxyOptions.onSessionClosed`.
+
+## Testing
+
+Verify chains and manifests in your test suite with [`@mcpose/testing`](https://www.npmjs.com/package/@mcpose/testing) — `assertAuditChainIntegrity`, `assertReplayManifestValid`, `assertPiiRedacted`.
+
+## Documentation
+
+- [Full README & API reference](https://github.com/amir-gorji/mcpose#mcposeaudit)
+- [ADR-0003 — audit subkeys derived from the signing oracle](https://github.com/amir-gorji/mcpose/blob/main/docs/adr/0003-audit-subkeys-derived-from-signing-oracle.md)
+- [CONTEXT.md](https://github.com/amir-gorji/mcpose/blob/main/CONTEXT.md) — canonical domain glossary
+
+## License
+
+MIT © Amir Gorji

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,qBAAqB,EACrB,YAAY,EAKb,MAAM,YAAY,CAAC;AAkCpB,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,qBAAqB,CA2FlF"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,qBAAqB,EACrB,YAAY,EAKb,MAAM,YAAY,CAAC;AAuCpB,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,qBAAqB,CAyGlF"}

package/dist/middleware.js

@@ -1,5 +1,9 @@
-import { createCipheriv, randomBytes, createHash } from 'node:crypto';
+import { createCipheriv, randomBytes, createHmac } from 'node:crypto';
 import { computeChainHash, computeMerkleProof, computeMerkleRoot, sha256hex } from './chain.js';
+// Domain-separation labels for subkey derivation. The version segment lets the
+// derivation scheme rotate without colliding with chains written under an old scheme.
+const DOMAIN_CHAIN = Buffer.from('mcpose/v1/chain');
+const DOMAIN_ENC = Buffer.from('mcpose/v1/enc');
 function aesEncrypt(plaintext, key) {
     const iv = randomBytes(12);
     const cipher = createCipheriv('aes-256-gcm', key.subarray(0, 32), iv);
@@ -7,8 +11,8 @@ function aesEncrypt(plaintext, key) {
     const tag = cipher.getAuthTag();
     return Buffer.concat([iv, tag, encrypted]).toString('base64');
 }
-function deriveEventKey(chainKey, eventId) {
-    return createHash('sha256').update(chainKey).update(eventId).digest();
+function deriveEventKey(encRoot, eventId) {
+    return createHmac('sha256', encRoot).update(eventId).digest();
 }
 function anonymousIdentity() {
     return {
@@ -22,11 +26,24 @@ function anonymousIdentity() {
 }
 export function createAuditMiddleware(options) {
     const sessions = new Map();
-    // Derive a stable 32-byte key from the signingKey.keyId (SHA-256 hex of the secret).
-    // Used for HMAC chain hashes (synchronous) and per-event AES-256 encryption.
-    // The async sign() on signingKey is reserved for signing the ReplayManifest root.
-    const chainKey = Buffer.from(options.signingKey.keyId, 'hex');
+    // Private subkeys, derived once from the signing secret THROUGH the oracle with
+    // domain separation. The provider never exposes raw key bytes, and keyId must
+    // NOT be used as key material — keyId is a public identifier, published in
+    // ReplayManifest.signedBy. sign() is HMAC-SHA256 per the SigningKeyProvider
+    // contract, hence a PRF suitable for key derivation.
+    //   chainKey — keys the per-entry HMAC chain (forgery resistance)
+    //   encRoot  — root for per-event AES-256 keys (high-tier confidentiality)
+    // Cache the promise so concurrent first calls share one derivation.
+    let subkeys;
+    const deriveSubkeys = () => (subkeys ?? (subkeys = (async () => {
+        const [chainKey, encRoot] = await Promise.all([
+            options.signingKey.sign(DOMAIN_CHAIN),
+            options.signingKey.sign(DOMAIN_ENC),
+        ]);
+        return { chainKey, encRoot };
+    })()));
     const middleware = async (req, next, ctx) => {
+        const { chainKey, encRoot } = await deriveSubkeys();
         const start = Date.now();
         const identity = ctx.identity ?? anonymousIdentity();
         const sessionId = ctx.sessionId;
@@ -57,7 +74,7 @@ export function createAuditMiddleware(options) {
                 ctx, identity, tool, args, result: undefined,
                 duration_ms: Date.now() - start, outcome, position,
                 prevChainHash: session?.prevChainHash ?? '',
-                tier, chainKey,
+                tier, chainKey, encRoot,
             });
             advanceSession(session, event);
             await options.onEvent(event);
@@ -68,7 +85,7 @@ export function createAuditMiddleware(options) {
                 ctx, identity, tool, args, result,
                 duration_ms: Date.now() - start, outcome, position,
                 prevChainHash: session?.prevChainHash ?? '',
-                tier, chainKey,
+                tier, chainKey, encRoot,
             });
             advanceSession(session, event);
             await options.onEvent(event);
@@ -124,7 +141,7 @@ function buildEvent(p) {
     const chainHash = computeChainHash(stableFields, p.prevChainHash, p.chainKey);
     const base = { ...stableFields, chainHash };
     if (p.tier === 'high') {
-        const eventKey = deriveEventKey(p.chainKey, base.id);
+        const eventKey = deriveEventKey(p.encRoot, base.id);
         return {
             ...base,
             sensitivityTier: 'high',

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUtE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAUhG,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAW;IAChD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAqB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,qFAAqF;IACrF,6EAA6E;IAC7E,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAwC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAEhC,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,MAAM,EAAE,EAAE;gBACV,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,SAAqC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/D,IAAI,OAAO,GAA0B,SAAS,CAAC;QAC/C,IAAI,MAAe,CAAC;QACpB,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,SAAS,CAAC;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;gBAC5C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;gBACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAA0C,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,YAAY,GAA0C,KAAK,EAAE,SAAS,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3F,MAAM,QAAQ,GAAmB;YAC/B,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YACjC,UAAU;YACV,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YAClC,SAAS;SACV,CAAC;QAEF,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,kFAAkF;AAElF,SAAS,cAAc,CAAC,OAAiC,EAAE,KAAiB;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;AAC1C,CAAC;AAgBD,SAAS,UAAU,CAAC,CAAc;IAChC,MAAM,YAAY,GAAG;QACnB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QACvD,sBAAsB,EAAE,CAAC,CAAC,QAAQ;KACnC,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;IAE5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,GAAG,IAAI;YACP,eAAe,EAAE,MAAM;YACvB,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;YAC5D,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC;SACtD,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAsB,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAmB,CAAC;AACrG,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUtE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGhG,+EAA+E;AAC/E,sFAAsF;AACtF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAShD,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAW;IAChD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe;IACtD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAqB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,gFAAgF;IAChF,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,qDAAqD;IACrD,kEAAkE;IAClE,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,OAAmE,CAAC;IACxE,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,CAAC,OAAO,KAAP,OAAO,GAAK,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,EAAE,EAAC,CAAC;IAER,MAAM,UAAU,GAAwC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAEhC,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,MAAM,EAAE,EAAE;gBACV,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,SAAqC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/D,IAAI,OAAO,GAA0B,SAAS,CAAC;QAC/C,IAAI,MAAe,CAAC;QACpB,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,SAAS,CAAC;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;gBAC5C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;gBACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAA0C,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,YAAY,GAA0C,KAAK,EAAE,SAAS,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3F,MAAM,QAAQ,GAAmB;YAC/B,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YACjC,UAAU;YACV,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YAClC,SAAS;SACV,CAAC;QAEF,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,kFAAkF;AAElF,SAAS,cAAc,CAAC,OAAiC,EAAE,KAAiB;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;AAC1C,CAAC;AAiBD,SAAS,UAAU,CAAC,CAAc;IAChC,MAAM,YAAY,GAAG;QACnB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QACvD,sBAAsB,EAAE,CAAC,CAAC,QAAQ;KACnC,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;IAE5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO;YACL,GAAG,IAAI;YACP,eAAe,EAAE,MAAM;YACvB,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;YAC5D,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC;SACtD,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAsB,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAmB,CAAC;AACrG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpose/audit",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "Integrity-chained audit middleware for mcpose — HMAC chain, Merkle proofs, ReplayManifest",
   "type": "module",
   "main": "./dist/index.js",
@@ -11,18 +11,8 @@
       "default": "./dist/index.js"
     }
   },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "keywords": [
-    "mcp",
-    "audit",
-    "compliance",
-    "fintech",
-    "hmac",
-    "merkle"
-  ],
+  "files": ["dist", "README.md"],
+  "keywords": ["mcp", "audit", "compliance", "fintech", "hmac", "merkle"],
   "author": "Amir Gorji",
   "license": "MIT",
   "repository": {
@@ -30,6 +20,12 @@
     "url": "git+https://github.com/amir-gorji/mcpose.git",
     "directory": "packages/audit"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "ts:ci": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "prepublishOnly": "pnpm run ts:ci && pnpm run test && pnpm run build"
+  },
   "peerDependencies": {
     "mcpose": ">=2.0.0"
   },
@@ -37,11 +33,6 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.0.0",
-    "mcpose": "2.0.1"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "ts:ci": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests"
+    "mcpose": "workspace:*"
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Amir Gorji
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/__tests__/middleware.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=middleware.test.d.ts.map

package/dist/__tests__/middleware.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/middleware.test.js

@@ -1,152 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { createAuditMiddleware } from '../middleware.js';
-import { createDefaultSigningKeyProvider } from '../signingKey.js';
-import { createSensitivityResolver } from '../sensitivity.js';
-import { createProxyContext } from 'mcpose';
-const identity = {
-    sub: 'user-1',
-    type: 'human',
-    roles: ['analyst'],
-    claims: {},
-    resolvedAt: '2026-06-01T00:00:00.000Z',
-    source: 'jwt',
-};
-function makeOptions(overrides = {}) {
-    return {
-        signingKey: createDefaultSigningKeyProvider('test-secret'),
-        sensitivityResolver: createSensitivityResolver({ search: 'low', transfer: 'high' }),
-        onEvent: vi.fn(),
-        ...overrides,
-    };
-}
-function makeCtx(sessionId) {
-    return createProxyContext({ transport: 'http', identity, sessionId });
-}
-function makeReq(tool, args = {}) {
-    return {
-        method: 'tools/call',
-        params: { name: tool, arguments: args },
-    };
-}
-describe('createAuditMiddleware — tracer bullet', () => {
-    it('calls onEvent after a successful tool call', async () => {
-        const onEvent = vi.fn();
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent }));
-        const ctx = makeCtx('session-1');
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        expect(onEvent).toHaveBeenCalledOnce();
-        const event = onEvent.mock.calls[0][0];
-        expect(event.tool).toBe('search');
-        expect(event.outcome).toBe('success');
-        expect(event.identity.sub).toBe('user-1');
-        expect(event.sessionId).toBe('session-1');
-        expect(event.sensitivityTier).toBe('low');
-    });
-    it('records error outcome when next throws', async () => {
-        const onEvent = vi.fn();
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent }));
-        await expect(middleware(makeReq('search'), async () => { throw new Error('upstream down'); }, makeCtx())).rejects.toThrow('upstream down');
-        const event = onEvent.mock.calls[0][0];
-        expect(event.outcome).toBe('error');
-    });
-    it('sets replayManifestPosition sequentially within a session', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        const ctx = makeCtx('sess-seq');
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        expect(events.map((e) => e.replayManifestPosition)).toEqual([0, 1, 2]);
-    });
-});
-describe('createAuditMiddleware — HMAC chain', () => {
-    it('first event chainHash is non-empty', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        await middleware(makeReq('search'), async () => ({ content: [] }), makeCtx('s1'));
-        expect(events[0].chainHash).toBeTruthy();
-        expect(events[0].chainHash.length).toBeGreaterThan(0);
-    });
-    it('each chainHash differs from the previous (chain advances)', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        const ctx = makeCtx('s2');
-        for (let i = 0; i < 5; i++) {
-            await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        }
-        const hashes = events.map((e) => e.chainHash);
-        const unique = new Set(hashes);
-        expect(unique.size).toBe(5);
-    });
-});
-describe('createAuditMiddleware — sensitivity tiers', () => {
-    it('low-tier event has inputRaw and outputRaw', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        await middleware(makeReq('search', { q: 'hello' }), async () => ({ content: [{ type: 'text', text: 'result' }] }), makeCtx());
-        const event = events[0];
-        expect(event.sensitivityTier).toBe('low');
-        if (event.sensitivityTier === 'low') {
-            expect(event.inputRaw).toEqual({ q: 'hello' });
-        }
-    });
-    it('high-tier event has encrypted fields, no inputRaw/outputRaw', async () => {
-        const events = [];
-        const { middleware } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        await middleware(makeReq('transfer', { amount: 1000 }), async () => ({ content: [] }), makeCtx());
-        const event = events[0];
-        expect(event.sensitivityTier).toBe('high');
-        if (event.sensitivityTier === 'high') {
-            expect(typeof event.inputEncrypted).toBe('string');
-            expect(typeof event.outputEncrypted).toBe('string');
-            expect('inputRaw' in event).toBe(false);
-        }
-    });
-});
-describe('createAuditMiddleware — closeSession', () => {
-    it('returns undefined for unknown session', async () => {
-        const { closeSession } = createAuditMiddleware(makeOptions());
-        const result = await closeSession('no-such-session');
-        expect(result).toBeUndefined();
-    });
-    it('returns undefined for session with no events', async () => {
-        const { closeSession } = createAuditMiddleware(makeOptions());
-        const result = await closeSession('empty-session');
-        expect(result).toBeUndefined();
-    });
-    it('returns ReplayManifest with correct fields after events', async () => {
-        const onManifest = vi.fn();
-        const { middleware, closeSession } = createAuditMiddleware(makeOptions({ onManifest }));
-        const ctx = makeCtx('sess-manifest');
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        const manifest = await closeSession('sess-manifest');
-        expect(manifest).toBeDefined();
-        expect(manifest.sessionId).toBe('sess-manifest');
-        expect(manifest.eventCount).toBe(2);
-        expect(manifest.merkleRoot).toBeTruthy();
-        expect(manifest.merkleProofs).toHaveLength(2);
-        expect(manifest.signature).toBeTruthy();
-        expect(manifest.signedBy).toBeTruthy();
-        expect(onManifest).toHaveBeenCalledOnce();
-        expect(onManifest.mock.calls[0][0]).toEqual(manifest);
-    });
-});
-describe('createAuditMiddleware — Merkle proof', () => {
-    it('proof for each event verifies against the merkle root', async () => {
-        const { verifyMerkleProof } = await import('../chain.js');
-        const events = [];
-        const { middleware, closeSession } = createAuditMiddleware(makeOptions({ onEvent: (e) => events.push(e) }));
-        const ctx = makeCtx('sess-merkle');
-        for (let i = 0; i < 4; i++) {
-            await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
-        }
-        const manifest = await closeSession('sess-merkle');
-        expect(manifest).toBeDefined();
-        for (let i = 0; i < events.length; i++) {
-            const valid = verifyMerkleProof(events[i].chainHash, manifest.merkleProofs[i], manifest.merkleRoot);
-            expect(valid).toBe(true);
-        }
-    });
-});
-//# sourceMappingURL=middleware.test.js.map

package/dist/__tests__/middleware.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.test.js","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAE5C,MAAM,QAAQ,GAAa;IACzB,GAAG,EAAE,QAAQ;IACb,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,0BAA0B;IACtC,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,SAAS,WAAW,CAAC,YAAmC,EAAE;IACxD,OAAO;QACL,UAAU,EAAE,+BAA+B,CAAC,aAAa,CAAC;QAC1D,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;QAChB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAkB;IACjC,OAAO,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAgC,EAAE;IAC/D,OAAO;QACL,MAAM,EAAE,YAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAe,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAEvE,MAAM,MAAM,CACV,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAC5F,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAe,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAEhC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,UAAU,CACd,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EACjC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAC7D,OAAO,EAAE,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAC1C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,UAAU,CACd,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EACrC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAC7B,OAAO,EAAE,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YACrC,MAAM,CAAC,OAAO,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,qBAAqB,CACxD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAC5B,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;QAErD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,CAAC,QAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,QAAS,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,CAAC,QAAS,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAS,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,QAAS,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,qBAAqB,CACxD,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,iBAAiB,CAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EACnB,QAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EACzB,QAAS,CAAC,UAAU,CACrB,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/sensitivity.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=sensitivity.test.d.ts.map

package/dist/__tests__/sensitivity.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitivity.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/sensitivity.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/sensitivity.test.js

@@ -1,27 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { createSensitivityResolver } from '../sensitivity.js';
-const identity = {
-    sub: 'u1',
-    type: 'human',
-    roles: [],
-    claims: {},
-    resolvedAt: new Date().toISOString(),
-    source: 'jwt',
-};
-describe('createSensitivityResolver', () => {
-    it('returns the mapped tier for a known tool', () => {
-        const resolve = createSensitivityResolver({ transfer_funds: 'high', get_balance: 'low' });
-        expect(resolve('transfer_funds', identity, {})).toBe('high');
-        expect(resolve('get_balance', identity, {})).toBe('low');
-    });
-    it('returns high for an unknown tool', () => {
-        const resolve = createSensitivityResolver({ get_balance: 'low' });
-        expect(resolve('unknown_tool', identity, {})).toBe('high');
-    });
-    it('override fn takes precedence over the static map', () => {
-        const resolve = createSensitivityResolver({ get_balance: 'low' }, (_tool, _identity, args) => (args.pii ? 'high' : 'low'));
-        expect(resolve('get_balance', identity, { pii: true })).toBe('high');
-        expect(resolve('get_balance', identity, {})).toBe('low');
-    });
-});
-//# sourceMappingURL=sensitivity.test.js.map

package/dist/__tests__/sensitivity.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sensitivity.test.js","sourceRoot":"","sources":["../../src/__tests__/sensitivity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,MAAM,QAAQ,GAAa;IACzB,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE;IACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACpC,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,OAAO,GAAG,yBAAyB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,yBAAyB,CACvC,EAAE,WAAW,EAAE,KAAK,EAAE,EACtB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/signingKey.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=signingKey.test.d.ts.map

package/dist/__tests__/signingKey.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signingKey.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/signingKey.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/signingKey.test.js

@@ -1,37 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { createDefaultSigningKeyProvider } from '../signingKey.js';
-describe('createDefaultSigningKeyProvider', () => {
-    it('has correct shape', () => {
-        const provider = createDefaultSigningKeyProvider('secret');
-        expect(provider.algorithm).toBe('HMAC-SHA256');
-        expect(typeof provider.keyId).toBe('string');
-        expect(provider.keyId.length).toBeGreaterThan(0);
-        expect(typeof provider.sign).toBe('function');
-    });
-    it('sign returns a non-empty buffer', async () => {
-        const provider = createDefaultSigningKeyProvider('secret');
-        const sig = await provider.sign(Buffer.from('hello'));
-        expect(sig).toBeInstanceOf(Buffer);
-        expect(sig.length).toBeGreaterThan(0);
-    });
-    it('same secret + same data → same signature (deterministic)', async () => {
-        const p1 = createDefaultSigningKeyProvider('secret');
-        const p2 = createDefaultSigningKeyProvider('secret');
-        const data = Buffer.from('test-data');
-        const [s1, s2] = await Promise.all([p1.sign(data), p2.sign(data)]);
-        expect(s1.toString('hex')).toBe(s2.toString('hex'));
-    });
-    it('different secrets → different signatures', async () => {
-        const p1 = createDefaultSigningKeyProvider('secret-a');
-        const p2 = createDefaultSigningKeyProvider('secret-b');
-        const data = Buffer.from('test-data');
-        const [s1, s2] = await Promise.all([p1.sign(data), p2.sign(data)]);
-        expect(s1.toString('hex')).not.toBe(s2.toString('hex'));
-    });
-    it('accepts Buffer as secret', async () => {
-        const provider = createDefaultSigningKeyProvider(Buffer.from('secret'));
-        const sig = await provider.sign(Buffer.from('data'));
-        expect(sig).toBeInstanceOf(Buffer);
-    });
-});
-//# sourceMappingURL=signingKey.test.js.map

package/dist/__tests__/signingKey.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signingKey.test.js","sourceRoot":"","sources":["../../src/__tests__/signingKey.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAEnE,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,QAAQ,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,QAAQ,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}