@mcpose/audit 2.0.2 → 2.0.3

package/dist/chain.d.ts

@@ -0,0 +1,12 @@
+import type { MerkleProof } from './types.js';
+export declare function sha256hex(data: string | Buffer): string;
+export declare function hmacSha256hex(data: string | Buffer, key: Buffer): string;
+/**
+ * HMAC-SHA256(JSON(entryWithoutChainHash) + prevChainHash, signingKey).
+ * The entry is serialized without its own chainHash to avoid circular dependency.
+ */
+export declare function computeChainHash(entryWithoutChainHash: Record<string, unknown>, prevChainHash: string, signingKey: Buffer): string;
+export declare function computeMerkleRoot(hashes: string[]): string;
+export declare function computeMerkleProof(hashes: string[], index: number): MerkleProof;
+export declare function verifyMerkleProof(leafHash: string, proof: MerkleProof, root: string): boolean;
+//# sourceMappingURL=chain.d.ts.map

package/dist/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9C,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,MAAM,CAGR;AAaD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAoB/E;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAUT"}

package/dist/chain.js

@@ -0,0 +1,66 @@
+import { createHash, createHmac } from 'node:crypto';
+export function sha256hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+export function hmacSha256hex(data, key) {
+    return createHmac('sha256', key).update(data).digest('hex');
+}
+/**
+ * HMAC-SHA256(JSON(entryWithoutChainHash) + prevChainHash, signingKey).
+ * The entry is serialized without its own chainHash to avoid circular dependency.
+ */
+export function computeChainHash(entryWithoutChainHash, prevChainHash, signingKey) {
+    const data = JSON.stringify(entryWithoutChainHash) + prevChainHash;
+    return hmacSha256hex(data, signingKey);
+}
+function nextPow2Layer(hashes) {
+    const layer = [...hashes];
+    // Pad to even length by duplicating the last node (standard Merkle convention)
+    if (layer.length % 2 === 1)
+        layer.push(layer[layer.length - 1]);
+    const next = [];
+    for (let i = 0; i < layer.length; i += 2) {
+        next.push(sha256hex(layer[i] + layer[i + 1]));
+    }
+    return next;
+}
+export function computeMerkleRoot(hashes) {
+    if (hashes.length === 0)
+        return sha256hex('');
+    if (hashes.length === 1)
+        return hashes[0];
+    let layer = [...hashes];
+    while (layer.length > 1) {
+        layer = nextPow2Layer(layer);
+    }
+    return layer[0];
+}
+export function computeMerkleProof(hashes, index) {
+    const siblings = [];
+    const directions = [];
+    let layer = [...hashes];
+    let idx = index;
+    while (layer.length > 1) {
+        // Pad odd layers
+        if (layer.length % 2 === 1)
+            layer.push(layer[layer.length - 1]);
+        const siblingIdx = idx % 2 === 0 ? idx + 1 : idx - 1;
+        siblings.push(layer[siblingIdx]);
+        directions.push(idx % 2 === 0 ? 'right' : 'left');
+        layer = nextPow2Layer(layer.slice(0, layer.length));
+        idx = Math.floor(idx / 2);
+    }
+    return { index, siblings, directions };
+}
+export function verifyMerkleProof(leafHash, proof, root) {
+    let current = leafHash;
+    for (let i = 0; i < proof.siblings.length; i++) {
+        const sibling = proof.siblings[i];
+        const dir = proof.directions[i];
+        current = dir === 'right'
+            ? sha256hex(current + sibling)
+            : sha256hex(sibling + current);
+    }
+    return current === root;
+}
+//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,UAAU,SAAS,CAAC,IAAqB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAqB,EAAE,GAAW;IAC9D,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA8C,EAC9C,aAAqB,EACrB,UAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACnE,OAAO,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1B,+EAA+E;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAgB,EAAE,KAAa;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,iBAAiB;QACjB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEhE,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACjC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAElD,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,KAAkB,EAClB,IAAY;IAEZ,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,GAAG,GAAG,KAAK,OAAO;YACvB,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YAC9B,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export type { SensitivityTier, SensitivityResolverFn, HashAlgorithm, SigningKeyProvider, CostMetadata, AuditEventBase, LowAuditEvent, MediumAuditEvent, HighAuditEvent, AuditEvent, MerkleProof, ReplayManifest, AuditOptions, AuditMiddlewareHandle, } from './types.js';
+export { createSensitivityResolver } from './sensitivity.js';
+export { createDefaultSigningKeyProvider } from './signingKey.js';
+export { createAuditMiddleware } from './middleware.js';
+export { computeMerkleRoot, computeMerkleProof, verifyMerkleProof } from './chain.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,WAAW,EACX,cAAc,EACd,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { createSensitivityResolver } from './sensitivity.js';
+export { createDefaultSigningKeyProvider } from './signingKey.js';
+export { createAuditMiddleware } from './middleware.js';
+export { computeMerkleRoot, computeMerkleProof, verifyMerkleProof } from './chain.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,3 @@
+import type { AuditMiddlewareHandle, AuditOptions } from './types.js';
+export declare function createAuditMiddleware(options: AuditOptions): AuditMiddlewareHandle;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,qBAAqB,EACrB,YAAY,EAKb,MAAM,YAAY,CAAC;AAuCpB,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,qBAAqB,CAyGlF"}

package/dist/middleware.js

@@ -0,0 +1,157 @@
+import { createCipheriv, randomBytes, createHmac } from 'node:crypto';
+import { computeChainHash, computeMerkleProof, computeMerkleRoot, sha256hex } from './chain.js';
+// Domain-separation labels for subkey derivation. The version segment lets the
+// derivation scheme rotate without colliding with chains written under an old scheme.
+const DOMAIN_CHAIN = Buffer.from('mcpose/v1/chain');
+const DOMAIN_ENC = Buffer.from('mcpose/v1/enc');
+function aesEncrypt(plaintext, key) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key.subarray(0, 32), iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, encrypted]).toString('base64');
+}
+function deriveEventKey(encRoot, eventId) {
+    return createHmac('sha256', encRoot).update(eventId).digest();
+}
+function anonymousIdentity() {
+    return {
+        sub: 'anonymous',
+        type: 'service',
+        roles: [],
+        claims: {},
+        resolvedAt: new Date().toISOString(),
+        source: 'custom',
+    };
+}
+export function createAuditMiddleware(options) {
+    const sessions = new Map();
+    // Private subkeys, derived once from the signing secret THROUGH the oracle with
+    // domain separation. The provider never exposes raw key bytes, and keyId must
+    // NOT be used as key material — keyId is a public identifier, published in
+    // ReplayManifest.signedBy. sign() is HMAC-SHA256 per the SigningKeyProvider
+    // contract, hence a PRF suitable for key derivation.
+    //   chainKey — keys the per-entry HMAC chain (forgery resistance)
+    //   encRoot  — root for per-event AES-256 keys (high-tier confidentiality)
+    // Cache the promise so concurrent first calls share one derivation.
+    let subkeys;
+    const deriveSubkeys = () => (subkeys ?? (subkeys = (async () => {
+        const [chainKey, encRoot] = await Promise.all([
+            options.signingKey.sign(DOMAIN_CHAIN),
+            options.signingKey.sign(DOMAIN_ENC),
+        ]);
+        return { chainKey, encRoot };
+    })()));
+    const middleware = async (req, next, ctx) => {
+        const { chainKey, encRoot } = await deriveSubkeys();
+        const start = Date.now();
+        const identity = ctx.identity ?? anonymousIdentity();
+        const sessionId = ctx.sessionId;
+        if (sessionId && !sessions.has(sessionId)) {
+            sessions.set(sessionId, {
+                events: [],
+                prevChainHash: '',
+                startedAt: new Date().toISOString(),
+                identity,
+            });
+        }
+        const session = sessionId ? sessions.get(sessionId) : undefined;
+        const position = session?.events.length ?? 0;
+        const tool = req.params.name;
+        const args = req.params.arguments ?? {};
+        const tier = options.sensitivityResolver(tool, identity, args);
+        let outcome = 'success';
+        let result;
+        let threw = false;
+        try {
+            result = await next(req);
+        }
+        catch (err) {
+            outcome = 'error';
+            threw = true;
+            result = undefined;
+            const event = buildEvent({
+                ctx, identity, tool, args, result: undefined,
+                duration_ms: Date.now() - start, outcome, position,
+                prevChainHash: session?.prevChainHash ?? '',
+                tier, chainKey, encRoot,
+            });
+            advanceSession(session, event);
+            await options.onEvent(event);
+            throw err;
+        }
+        if (!threw) {
+            const event = buildEvent({
+                ctx, identity, tool, args, result,
+                duration_ms: Date.now() - start, outcome, position,
+                prevChainHash: session?.prevChainHash ?? '',
+                tier, chainKey, encRoot,
+            });
+            advanceSession(session, event);
+            await options.onEvent(event);
+        }
+        return result;
+    };
+    const closeSession = async (sessionId) => {
+        const session = sessions.get(sessionId);
+        if (!session || session.events.length === 0)
+            return undefined;
+        sessions.delete(sessionId);
+        const hashes = session.events.map((e) => e.chainHash);
+        const merkleRoot = computeMerkleRoot(hashes);
+        const merkleProofs = hashes.map((_, i) => computeMerkleProof(hashes, i));
+        const signature = (await options.signingKey.sign(Buffer.from(merkleRoot))).toString('hex');
+        const manifest = {
+            sessionId,
+            identity: session.identity,
+            startedAt: session.startedAt,
+            closedAt: new Date().toISOString(),
+            eventCount: session.events.length,
+            merkleRoot,
+            merkleProofs,
+            signedBy: options.signingKey.keyId,
+            signature,
+        };
+        await options.onManifest?.(manifest);
+        return manifest;
+    };
+    return { middleware, closeSession };
+}
+// ── Helpers ────────────────────────────────────────────────────────────────────
+function advanceSession(session, event) {
+    if (!session)
+        return;
+    session.events.push(event);
+    session.prevChainHash = event.chainHash;
+}
+function buildEvent(p) {
+    const stableFields = {
+        id: p.ctx.requestId,
+        timestamp: new Date().toISOString(),
+        ...(p.ctx.sessionId !== undefined ? { sessionId: p.ctx.sessionId } : {}),
+        ...(p.ctx.delegatedFrom !== undefined ? { delegatedFrom: p.ctx.delegatedFrom } : {}),
+        identity: p.identity,
+        tool: p.tool,
+        duration_ms: p.duration_ms,
+        outcome: p.outcome,
+        inputHash: sha256hex(JSON.stringify(p.args)),
+        outputHash: sha256hex(JSON.stringify(p.result ?? null)),
+        replayManifestPosition: p.position,
+    };
+    const chainHash = computeChainHash(stableFields, p.prevChainHash, p.chainKey);
+    const base = { ...stableFields, chainHash };
+    if (p.tier === 'high') {
+        const eventKey = deriveEventKey(p.encRoot, base.id);
+        return {
+            ...base,
+            sensitivityTier: 'high',
+            inputEncrypted: aesEncrypt(JSON.stringify(p.args), eventKey),
+            outputEncrypted: aesEncrypt(JSON.stringify(p.result ?? null), eventKey),
+        };
+    }
+    if (p.tier === 'medium') {
+        return { ...base, sensitivityTier: 'medium', inputRaw: p.args, outputRaw: p.result };
+    }
+    return { ...base, sensitivityTier: 'low', inputRaw: p.args, outputRaw: p.result };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUtE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGhG,+EAA+E;AAC/E,sFAAsF;AACtF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAShD,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAW;IAChD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe;IACtD,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAqB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,gFAAgF;IAChF,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,qDAAqD;IACrD,kEAAkE;IAClE,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,OAAmE,CAAC;IACxE,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,CAAC,OAAO,KAAP,OAAO,GAAK,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,EAAE,EAAC,CAAC;IAER,MAAM,UAAU,GAAwC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/E,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAEhC,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,MAAM,EAAE,EAAE;gBACV,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAC,SAAqC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/D,IAAI,OAAO,GAA0B,SAAS,CAAC;QAC/C,IAAI,MAAe,CAAC;QACpB,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,GAAG,SAAS,CAAC;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;gBAC5C,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;gBACjC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ;gBAClD,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;gBAC3C,IAAI,EAAE,QAAQ,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAA0C,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,YAAY,GAA0C,KAAK,EAAE,SAAS,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE3F,MAAM,QAAQ,GAAmB;YAC/B,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YACjC,UAAU;YACV,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;YAClC,SAAS;SACV,CAAC;QAEF,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,kFAAkF;AAElF,SAAS,cAAc,CAAC,OAAiC,EAAE,KAAiB;IAC1E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;AAC1C,CAAC;AAiBD,SAAS,UAAU,CAAC,CAAc;IAChC,MAAM,YAAY,GAAG;QACnB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QACvD,sBAAsB,EAAE,CAAC,CAAC,QAAQ;KACnC,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;IAE5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO;YACL,GAAG,IAAI;YACP,eAAe,EAAE,MAAM;YACvB,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;YAC5D,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,QAAQ,CAAC;SACtD,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAsB,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAmB,CAAC;AACrG,CAAC"}

package/dist/sensitivity.d.ts

@@ -0,0 +1,3 @@
+import type { SensitivityTier, SensitivityResolverFn } from './types.js';
+export declare function createSensitivityResolver(map: Record<string, SensitivityTier>, override?: SensitivityResolverFn): SensitivityResolverFn;
+//# sourceMappingURL=sensitivity.d.ts.map

package/dist/sensitivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitivity.d.ts","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEzE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACpC,QAAQ,CAAC,EAAE,qBAAqB,GAC/B,qBAAqB,CAKvB"}

package/dist/sensitivity.js

@@ -0,0 +1,8 @@
+export function createSensitivityResolver(map, override) {
+    return (tool, identity, args) => {
+        if (override)
+            return override(tool, identity, args);
+        return map[tool] ?? 'high';
+    };
+}
+//# sourceMappingURL=sensitivity.js.map

package/dist/sensitivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitivity.js","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,yBAAyB,CACvC,GAAoC,EACpC,QAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/signingKey.d.ts

@@ -0,0 +1,3 @@
+import type { SigningKeyProvider } from './types.js';
+export declare function createDefaultSigningKeyProvider(secret: Buffer | string): SigningKeyProvider;
+//# sourceMappingURL=signingKey.d.ts.map

package/dist/signingKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingKey.d.ts","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,kBAAkB,CAWpB"}

package/dist/signingKey.js

@@ -0,0 +1,13 @@
+import { createHmac, createHash } from 'node:crypto';
+export function createDefaultSigningKeyProvider(secret) {
+    const secretBuf = typeof secret === 'string' ? Buffer.from(secret) : secret;
+    const keyId = createHash('sha256').update(secretBuf).digest('hex');
+    return {
+        algorithm: 'HMAC-SHA256',
+        keyId,
+        async sign(data) {
+            return createHmac('sha256', secretBuf).update(data).digest();
+        },
+    };
+}
+//# sourceMappingURL=signingKey.js.map

package/dist/signingKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingKey.js","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,MAAM,UAAU,+BAA+B,CAC7C,MAAuB;IAEvB,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,IAAY;YACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,98 @@
+import type { Identity, RejectionReason, ToolMiddleware } from 'mcpose';
+export type { ToolMiddleware };
+export type SensitivityTier = 'low' | 'medium' | 'high';
+export type SensitivityResolverFn = (tool: string, identity: Identity, args: Record<string, unknown>) => SensitivityTier;
+export type HashAlgorithm = 'SHA-256';
+export interface SigningKeyProvider {
+    sign(data: Buffer): Promise<Buffer>;
+    keyId: string;
+    algorithm: 'HMAC-SHA256';
+}
+export interface CostMetadata {
+    inputTokens?: number;
+    outputTokens?: number;
+    totalCostUsd?: number;
+}
+export interface AuditEventBase {
+    /** Equals the ProxyContext requestId. */
+    id: string;
+    timestamp: string;
+    sessionId?: string;
+    identity: Identity;
+    delegatedFrom?: Identity[];
+    tool: string;
+    duration_ms: number;
+    streamedChunkCount?: number;
+    outcome: 'success' | 'rejected' | 'error';
+    rejectionReason?: RejectionReason;
+    cost?: CostMetadata;
+    inputHash: string;
+    outputHash: string;
+    chainHash: string;
+    replayManifestPosition: number;
+}
+export type LowAuditEvent = AuditEventBase & {
+    sensitivityTier: 'low';
+    inputRaw: Record<string, unknown>;
+    outputRaw: unknown;
+};
+export type MediumAuditEvent = AuditEventBase & {
+    sensitivityTier: 'medium';
+    inputRaw: Record<string, unknown>;
+    outputRaw: unknown;
+};
+export type HighAuditEvent = AuditEventBase & {
+    sensitivityTier: 'high';
+    inputEncrypted: string;
+    outputEncrypted: string;
+};
+export type AuditEvent = LowAuditEvent | MediumAuditEvent | HighAuditEvent;
+export interface MerkleProof {
+    index: number;
+    siblings: string[];
+    directions: ('left' | 'right')[];
+}
+export interface ReplayManifest {
+    sessionId: string;
+    identity: Identity;
+    startedAt: string;
+    closedAt: string;
+    eventCount: number;
+    merkleRoot: string;
+    merkleProofs: MerkleProof[];
+    signedBy: string;
+    signature: string;
+}
+export interface AuditOptions {
+    signingKey: SigningKeyProvider;
+    hashAlgorithm?: HashAlgorithm;
+    sensitivityResolver: SensitivityResolverFn;
+    onEvent: (event: AuditEvent) => void | Promise<void>;
+    /**
+     * Called with the finished ReplayManifest when the host calls closeSession().
+     *
+     * Why this exists: ToolMiddleware is a pure per-request function with no
+     * lifecycle hooks. Sessions are owned by the HTTP transport, not by
+     * middleware. There is no in-band way for middleware to observe session close.
+     * This callback gives consumers a push-based way to receive the manifest
+     * exactly when the host signals the session has ended — mirroring how audit
+     * substrates in financial systems work: the host controls the flush boundary;
+     * the audit layer reacts.
+     */
+    onManifest?: (manifest: ReplayManifest) => void | Promise<void>;
+    /** @default true */
+    includeRejections?: boolean;
+    /** @default true */
+    includeCost?: boolean;
+}
+export interface AuditMiddlewareHandle {
+    middleware: ToolMiddleware;
+    /**
+     * Signal that a session has ended. Computes the Merkle tree over all audit
+     * events for the session, signs the root, fires onManifest, and returns the
+     * ReplayManifest. Returns undefined if the session had no events or is
+     * unknown.
+     */
+    closeSession(sessionId: string): Promise<ReplayManifest | undefined>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAExE,YAAY,EAAE,cAAc,EAAE,CAAC;AAI/B,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAExD,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,eAAe,CAAC;AAIrB,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC;AAEtC,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,aAAa,CAAC;CAC1B;AAID,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IAC1C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG;IAC3C,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,eAAe,EAAE,QAAQ,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAI3E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,oBAAoB;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oBAAoB;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACtE"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpose/audit",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Integrity-chained audit middleware for mcpose — HMAC chain, Merkle proofs, ReplayManifest",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,7 +23,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "ts:ci": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests"
+    "test": "vitest run --passWithNoTests",
+    "prepublishOnly": "pnpm run ts:ci && pnpm run test && pnpm run build"
   },
   "peerDependencies": {
     "mcpose": ">=2.0.0"