@mcpose/audit 2.0.2 → 3.0.0

package/dist/subjectKeyStore.js

@@ -0,0 +1,37 @@
+import { randomBytes } from 'node:crypto';
+/**
+ * Reference {@link SubjectKeyStore}, backed by a `Map` in this process.
+ *
+ * NOT DURABLE, and not for production. The keys live only in this process's
+ * heap, so a restart erases every subject at once and a second proxy instance
+ * cannot decrypt what the first recorded. Both are silent failures: the chain
+ * still verifies, and the loss shows up only when someone tries to read a
+ * payload back.
+ *
+ * A real deployment needs a durable, access-controlled store — a KMS, an HSM,
+ * or an encrypted table whose read path is audited — because in erasable mode
+ * this store IS the confidentiality of every high-tier payload it holds a key
+ * for (ADR-0018).
+ */
+export function createInMemorySubjectKeyStore() {
+    const keys = new Map();
+    return {
+        async getOrCreate(subjectId) {
+            const existing = keys.get(subjectId);
+            if (existing !== undefined)
+                return existing;
+            // 256-bit, random rather than derived: a key recomputable from the
+            // signing secret could not be destroyed, which is the whole point.
+            const created = randomBytes(32);
+            keys.set(subjectId, created);
+            return created;
+        },
+        async destroy(subjectId) {
+            keys.delete(subjectId);
+            // Idempotent: an unknown subject still gets a tombstone, so a repeated
+            // erasure request produces evidence rather than an error.
+            return { destroyedAt: new Date().toISOString() };
+        },
+    };
+}
+//# sourceMappingURL=subjectKeyStore.js.map

package/dist/subjectKeyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subjectKeyStore.js","sourceRoot":"","sources":["../src/subjectKeyStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,SAAiB;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;YAC5C,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,244 @@
+import type { Identity, PromptMiddleware, ProxyIdentity, RejectionReason, ToolMiddleware } from 'mcpose';
+export type SensitivityTier = 'low' | 'medium' | 'high';
+export type SensitivityResolverFn = (tool: string, identity: Identity, args: Record<string, unknown>) => SensitivityTier;
+/**
+ * Override passed to `createSensitivityResolver`. Receives the static map's
+ * resolution as `mapTier` (already defaulted to `'high'` for unknown tools)
+ * so it can fall back: `(tool, id, args, mapTier) => mapTier`.
+ */
+export type SensitivityOverrideFn = (tool: string, identity: Identity, args: Record<string, unknown>, mapTier: SensitivityTier) => SensitivityTier;
+export interface SigningKeyProvider {
+    sign(data: Buffer): Promise<Buffer>;
+    keyId: string;
+    algorithm: 'HMAC-SHA256';
+}
+/** Evidence that a subject's key was destroyed, returned by `destroy`. */
+export interface SubjectKeyTombstone {
+    /** ISO timestamp of the destruction. */
+    destroyedAt: string;
+}
+/**
+ * Custody of the per-subject keys that make erasable mode erasable (ADR-0018).
+ *
+ * Supplying one to `AuditOptions.keyStore` switches the audit layer into
+ * erasable mode: per-event encryption keys and the keyed payload hashes then
+ * derive from the stored subject key rather than from the signing secret, so
+ * `destroy(subjectId)` makes that subject's recorded payloads permanently
+ * unreadable and unconfirmable. The chain and the manifest are untouched.
+ *
+ * These keys are private key material with the same handling rules as the
+ * signing secret: they must never be logged, exported, or written into an
+ * event, a manifest, or telemetry. An implementation that stores them in the
+ * clear voids the encryption guarantee for every subject in it.
+ */
+export interface SubjectKeyStore {
+    /**
+     * The subject's 256-bit key, created at random on first use. Called before
+     * every audited call in erasable mode, so it must not be memoized in a way
+     * that outlives `destroy`: a subject that calls again after erasure gets a
+     * fresh key, and the old events stay dead.
+     *
+     * A rejection fails the audited call (the pre-call failure stage) rather
+     * than letting it run unaudited.
+     */
+    getOrCreate(subjectId: string): Promise<Buffer>;
+    /**
+     * Permanently removes the subject's key and returns the tombstone that
+     * evidences the erasure. Idempotent: destroying an unknown subject still
+     * returns a tombstone, because "this subject holds no key" is the state the
+     * caller asked for either way.
+     */
+    destroy(subjectId: string): Promise<SubjectKeyTombstone>;
+}
+export interface AuditEventBase {
+    /** Equals the ProxyContext requestId. */
+    id: string;
+    /** ISO timestamp captured before the upstream call started. */
+    startedAt: string;
+    /** ISO timestamp captured after the upstream call settled. */
+    endedAt: string;
+    sessionId?: string;
+    identity: Identity;
+    delegatedFrom?: Identity[];
+    /**
+     * The proxy instance that recorded this event, from `ProxyContext.proxy`.
+     * Provenance, not a principal — never part of `delegatedFrom` (ADR-0012).
+     *
+     * Required, and covered by the chain unconditionally (ADR-0019). While it
+     * was omitted when absent, an event with no `proxy` and an event whose
+     * `proxy` was stripped produced the same preimage, so deleting recorded
+     * provenance was not chain-detectable.
+     */
+    proxy: ProxyIdentity;
+    /**
+     * Present ONLY on events recorded for a prompt call (`prompts/get`), where
+     * `tool` holds the prompt name. An absent `kind` means a tool call, so
+     * every event recorded before prompts were audited keeps its meaning and
+     * its chain preimage (additive within v2, ADR-0012 and ADR-0014).
+     */
+    kind?: 'prompt';
+    /**
+     * Present ONLY on events recorded in erasable mode, where the per-event
+     * encryption key and the keyed `inputHash`/`outputHash` derive from a
+     * destroyable subject key instead of the signing secret (ADR-0018).
+     *
+     * Optional and covered by the chain under the ADR-0012 omission rule,
+     * exactly as `kind` is: an absent marker means default mode with plain
+     * `sha256` hashes, so events recorded before erasable mode existed keep
+     * their preimage, and a stored event cannot be silently reinterpreted
+     * under the wrong hash scheme.
+     */
+    erasable?: true;
+    tool: string;
+    duration_ms: number;
+    outcome: 'success' | 'rejected' | 'error';
+    /** Present when outcome is 'rejected' (from the MCP error's data field). */
+    rejectionReason?: RejectionReason;
+    /**
+     * Present when outcome is 'error': what the upstream call threw, or
+     * `{ name: 'ToolError' }` with a fixed message when a tool result carried
+     * `isError: true` in-band.
+     */
+    error?: {
+        name: string;
+        message: string;
+    };
+    inputHash: string;
+    outputHash: string;
+    chainHash: string;
+    replayManifestPosition: number;
+}
+export type LowAuditEvent = AuditEventBase & {
+    sensitivityTier: 'low';
+    inputRaw: Record<string, unknown>;
+    outputRaw: unknown;
+};
+export type MediumAuditEvent = AuditEventBase & {
+    sensitivityTier: 'medium';
+    inputRaw: Record<string, unknown>;
+    outputRaw: unknown;
+};
+export type HighAuditEvent = AuditEventBase & {
+    sensitivityTier: 'high';
+    inputEncrypted: string;
+    outputEncrypted: string;
+};
+export type AuditEvent = LowAuditEvent | MediumAuditEvent | HighAuditEvent;
+export interface MerkleProof {
+    index: number;
+    siblings: string[];
+    directions: ('left' | 'right')[];
+}
+export interface ReplayManifest {
+    sessionId: string;
+    identity: Identity;
+    /**
+     * The proxy instance that produced this session's trail, captured when
+     * the session was first seen. Covered by the signature like every other
+     * field (ADR-0004, ADR-0012).
+     *
+     * Required, and included in the signing payload unconditionally
+     * (ADR-0019), so stripping it from a stored manifest fails the signature
+     * rather than rebuilding a payload that verifies.
+     */
+    proxy: ProxyIdentity;
+    startedAt: string;
+    closedAt: string;
+    eventCount: number;
+    merkleRoot: string;
+    merkleProofs: MerkleProof[];
+    signedBy: string;
+    /**
+     * HMAC over the canonical serialization of the ENTIRE manifest (every
+     * field above, domain-separated) — not just the Merkle root. Verify with
+     * `verifyManifestSignature`.
+     */
+    signature: string;
+}
+export interface AuditOptions {
+    signingKey: SigningKeyProvider;
+    sensitivityResolver: SensitivityResolverFn;
+    /**
+     * Supply a store to run in ERASABLE mode (ADR-0018). Omit it and the audit
+     * layer behaves exactly as it always has, byte for byte: same preimages,
+     * same ciphertexts, same plain `sha256` payload hashes, no `erasable`
+     * marker on any event.
+     *
+     * With a store, the erasure unit is the data subject — the resolved
+     * `identity.sub` of each event, with anonymous events sharing the
+     * `anonymousIdentity()` bucket — and `destroy(sub)` renders that subject's
+     * recorded payloads permanently undecryptable and unconfirmable. Chain and
+     * manifest verification are unaffected, because payloads are bound to the
+     * chain only through their hashes.
+     *
+     * Key custody becomes your responsibility: see the README's erasable-mode
+     * section before choosing a store.
+     */
+    keyStore?: SubjectKeyStore;
+    onEvent: (event: AuditEvent) => void | Promise<void>;
+    /**
+     * Called with the finished ReplayManifest when the host calls closeSession().
+     *
+     * Why this exists: ToolMiddleware is a pure per-request function with no
+     * lifecycle hooks. Sessions are owned by the HTTP transport, not by
+     * middleware. There is no in-band way for middleware to observe session close.
+     * This callback gives consumers a push-based way to receive the manifest
+     * exactly when the host signals the session has ended — mirroring how audit
+     * substrates in financial systems work: the host controls the flush boundary;
+     * the audit layer reacts.
+     */
+    onManifest?: (manifest: ReplayManifest) => void | Promise<void>;
+    /**
+     * Record events for rejected calls (hidden tools etc.).
+     * @default true
+     */
+    includeRejections?: boolean;
+    /**
+     * How long `closeSession` waits for calls already admitted to the session
+     * to append and persist their events before it seals the manifest. Past
+     * the deadline the manifest covers what has landed, and each straggler is
+     * reported through `onAuditError` with its tool and requestId. `Infinity`
+     * waits without bound.
+     * @default 30_000
+     */
+    closeDrainTimeoutMs?: number;
+    /**
+     * Called when the audit layer itself fails (event serialization, a
+     * throwing onEvent sink). The audit layer NEVER throws into the tool-call
+     * path; failures are reported here instead. If this hook itself throws,
+     * the exception is contained and never reaches the caller either.
+     * @default console.error
+     */
+    onAuditError?: (err: unknown, info: {
+        tool: string;
+        requestId: string;
+        sessionId?: string;
+    }) => void;
+}
+export interface AuditMiddlewareHandle {
+    middleware: ToolMiddleware;
+    /**
+     * Audits `prompts/get` calls. Wire it into
+     * `ProxyOptions.promptMiddleware`; it shares the session chain with
+     * `middleware`, so tool and prompt events interleave in one trail.
+     * Prompt events carry `kind: 'prompt'` (ADR-0014).
+     */
+    promptMiddleware: PromptMiddleware;
+    /**
+     * Signal that a session has ended. Waits for every call already admitted
+     * to the session to append and persist its event, then computes the
+     * Merkle tree over all audit events for the session, signs the full
+     * manifest, fires onManifest, and returns the ReplayManifest. A call still
+     * inside its handler at teardown therefore lands in the manifest rather
+     * than orphaned at position 0. Concurrent calls for the same session share
+     * one close. Returns undefined if the session had no events or is unknown.
+     *
+     * A rejection from the signing provider or from onManifest is retryable:
+     * the sealed session is retained, and calling closeSession again with the
+     * same id resumes where it stopped. A retry signs the same payload and
+     * delivers the same manifest, never a second signed artifact. The state
+     * is released only once onManifest has settled successfully.
+     */
+    closeSession(sessionId: string): Promise<ReplayManifest | undefined>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,cAAc,EACf,MAAM,QAAQ,CAAC;AAIhB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAExD,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,eAAe,CAAC;AAErB;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,eAAe,KACrB,eAAe,CAAC;AAIrB,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,aAAa,CAAC;CAC1B;AAID,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1D;AAID,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IAC1C,4EAA4E;IAC5E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG;IAC3C,eAAe,EAAE,KAAK,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,eAAe,EAAE,QAAQ,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG;IAC5C,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAI3E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;;;;OAQG;IACH,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAC1D,IAAI,CAAC;CACX;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;;OAKG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACtE"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/verify.d.ts

@@ -0,0 +1,24 @@
+import type { AuditEvent, ReplayManifest, SigningKeyProvider } from './types.js';
+export type ChainVerification = {
+    valid: true;
+} | {
+    valid: false;
+    index: number;
+    reason: string;
+};
+/**
+ * KEYED chain verification: recomputes every event's chainHash from its
+ * preimage fields with the chain key derived through the signing oracle.
+ * Unlike the keyless `assertAuditChainIntegrity` in @mcpose/testing, this
+ * detects key-inconsistent forgeries — a rewritten event, a renumbered
+ * suffix, or a chain built under a different secret.
+ *
+ * An empty event list is invalid: truncation-to-zero must not verify.
+ */
+export declare function verifyAuditChain(events: readonly AuditEvent[], signingKey: SigningKeyProvider): Promise<ChainVerification>;
+/**
+ * Recomputes the manifest's signature (which covers every manifest field,
+ * not just the Merkle root) and compares it in constant time.
+ */
+export declare function verifyManifestSignature(manifest: ReplayManifest, signingKey: SigningKeyProvider): Promise<boolean>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,iBAAiB,GAC3B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQpE;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/verify.js

@@ -0,0 +1,50 @@
+import { timingSafeEqual } from 'node:crypto';
+import { chainPreimageFields, computeChainHash } from './chain.js';
+import { manifestSigningPayload } from './middleware.js';
+const DOMAIN_CHAIN = Buffer.from('mcpose/v2/chain');
+function hexEqual(aHex, bHex) {
+    const a = Buffer.from(aHex, 'hex');
+    const b = Buffer.from(bHex, 'hex');
+    return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+/**
+ * KEYED chain verification: recomputes every event's chainHash from its
+ * preimage fields with the chain key derived through the signing oracle.
+ * Unlike the keyless `assertAuditChainIntegrity` in @mcpose/testing, this
+ * detects key-inconsistent forgeries — a rewritten event, a renumbered
+ * suffix, or a chain built under a different secret.
+ *
+ * An empty event list is invalid: truncation-to-zero must not verify.
+ */
+export async function verifyAuditChain(events, signingKey) {
+    if (events.length === 0) {
+        return { valid: false, index: 0, reason: 'empty event list' };
+    }
+    const chainKey = await signingKey.sign(DOMAIN_CHAIN);
+    let prevChainHash = '';
+    for (const [i, event] of events.entries()) {
+        if (event.replayManifestPosition !== i) {
+            return {
+                valid: false,
+                index: i,
+                reason: `replayManifestPosition ${event.replayManifestPosition}, expected ${i}`,
+            };
+        }
+        const expected = computeChainHash(chainPreimageFields(event), prevChainHash, chainKey);
+        if (!hexEqual(event.chainHash, expected)) {
+            return { valid: false, index: i, reason: 'chainHash mismatch' };
+        }
+        prevChainHash = event.chainHash;
+    }
+    return { valid: true };
+}
+/**
+ * Recomputes the manifest's signature (which covers every manifest field,
+ * not just the Merkle root) and compares it in constant time.
+ */
+export async function verifyManifestSignature(manifest, signingKey) {
+    const { signature, ...unsigned } = manifest;
+    const expected = await signingKey.sign(Buffer.from(manifestSigningPayload(unsigned)));
+    return hexEqual(signature, expected.toString('hex'));
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAKpD,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA6B,EAC7B,UAA8B;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,aAAa,GAAG,EAAE,CAAC;IAEvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,0BAA0B,KAAK,CAAC,sBAAsB,cAAc,CAAC,EAAE;aAChF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,mBAAmB,CAAC,KAAK,CAAC,EAC1B,aAAa,EACb,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAClE,CAAC;QACD,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAwB,EACxB,UAA8B;IAE9B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CACpC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAC9C,CAAC;IACF,OAAO,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpose/audit",
-  "version": "2.0.2",
+  "version": "3.0.0",
   "description": "Integrity-chained audit middleware for mcpose — HMAC chain, Merkle proofs, ReplayManifest",
   "type": "module",
   "main": "./dist/index.js",
@@ -9,29 +9,58 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
-  "files": ["dist", "README.md"],
-  "keywords": ["mcp", "audit", "compliance", "fintech", "hmac", "merkle"],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "keywords": [
+    "mcp",
+    "audit",
+    "compliance",
+    "fintech",
+    "hmac",
+    "merkle"
+  ],
   "author": "Amir Gorji",
   "license": "MIT",
+  "homepage": "https://github.com/amir-gorji/mcpose#readme",
+  "bugs": {
+    "url": "https://github.com/amir-gorji/mcpose/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/amir-gorji/mcpose.git",
     "directory": "packages/audit"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "ts:ci": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests"
+  "engines": {
+    "node": ">=20"
   },
   "peerDependencies": {
-    "mcpose": ">=2.0.0"
+    "mcpose": ">=3.0.0 <4"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.0.0",
-    "vitest": "^3.0.0",
-    "mcpose": "workspace:*"
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
+    "@types/node": "^26.5.1",
+    "@vitest/coverage-v8": "5.0.1",
+    "fast-check": "4.10.2",
+    "typescript": "6.0.3",
+    "vitest": "5.0.1",
+    "mcpose": "3.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "benchmark:merkle": "node ./bench/merkle-proofs.mjs",
+    "ts:ci": "tsc --noEmit",
+    "test": "vitest run --coverage",
+    "mutation": "stryker run"
   }
-}
+}

package/src/__tests__/chain.batch.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+import {
+  computeMerkleProof,
+  computeMerkleRoot,
+  computeMerkleRootAndProofs,
+  verifyMerkleProof,
+} from '../chain.js';
+
+describe('batched Merkle root and proofs', () => {
+  it('matches the existing root and individual proofs for empty, odd, and even trees', () => {
+    for (let size = 0; size <= 17; size++) {
+      const hashes = Array.from(
+        { length: size },
+        (_, index) => `hash-${index}`,
+      );
+      const { merkleRoot, merkleProofs } = computeMerkleRootAndProofs(hashes);
+
+      expect(merkleRoot).toBe(computeMerkleRoot(hashes));
+      expect(merkleProofs).toEqual(
+        hashes.map((_, index) => computeMerkleProof(hashes, index)),
+      );
+
+      for (let index = 0; index < hashes.length; index++) {
+        expect(
+          verifyMerkleProof(hashes[index]!, merkleProofs[index]!, merkleRoot),
+        ).toBe(true);
+      }
+    }
+  });
+});