@probemesh/sdk 0.1.0

package/dist/cli/audit-trail-export.cjs

@@ -0,0 +1,1193 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/cli/auditTrailExportCli.ts
+var import_promises2 = require("fs/promises");
+var import_node_path2 = require("path");
+
+// src/cli/configLoader.ts
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var import_node_url = require("url");
+async function loadCliConfigDefault(configPath, cwd) {
+  const resolvedPath = (0, import_node_path.resolve)(cwd, configPath);
+  const moduleUrl = (0, import_node_url.pathToFileURL)(resolvedPath);
+  try {
+    const loadedModule = await import(
+      /* @vite-ignore */
+      moduleUrl.href
+    );
+    return loadedModule.default;
+  } catch (error) {
+    return loadSelfContainedConfigFallback(resolvedPath, error);
+  }
+}
+async function loadSelfContainedConfigFallback(resolvedPath, importError) {
+  const source = await (0, import_promises.readFile)(resolvedPath, "utf8");
+  if (/\bimport\s/.test(source) || !/\bexport\s+default\b/.test(source)) {
+    throw importError;
+  }
+  const transformedSource = source.replace(
+    /\bexport\s+default\b/,
+    "const __probemeshDefault ="
+  );
+  try {
+    const factory = new Function(
+      `${transformedSource}
+return __probemeshDefault;`
+    );
+    return factory();
+  } catch {
+    throw importError;
+  }
+}
+
+// src/auditTrailBundle.ts
+var import_node_crypto2 = require("crypto");
+
+// src/callAuditArtifact.ts
+var import_node_crypto = require("crypto");
+
+// src/errors.ts
+var ProbeMeshError = class extends Error {
+  code;
+  status = "failed";
+  capability;
+  provider;
+  callId;
+  receiptRefs;
+  safety;
+  timeline;
+  retrySafety;
+  attempt;
+  route;
+  cause;
+  constructor(options) {
+    super(options.message);
+    this.name = "ProbeMeshError";
+    this.code = options.code;
+    this.capability = options.capability;
+    this.provider = options.provider;
+    this.callId = options.callId;
+    this.receiptRefs = options.receiptRefs;
+    this.safety = options.safety;
+    this.timeline = options.timeline;
+    this.retrySafety = options.retrySafety;
+    this.attempt = options.attempt;
+    this.route = options.route;
+    this.cause = options.cause;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      status: this.status,
+      capability: this.capability,
+      provider: this.provider,
+      callId: this.callId,
+      receiptRefs: this.receiptRefs,
+      safety: this.safety,
+      timeline: this.timeline,
+      retrySafety: this.retrySafety,
+      attempt: this.attempt,
+      route: this.route
+    };
+  }
+};
+
+// src/protocols/x402Redaction.ts
+var DEFAULT_REPLACEMENT = "[REDACTED]";
+var DEFAULT_MAX_DEPTH = 12;
+var PRIVATE_KEY_PATTERN = /\b0x[a-fA-F0-9]{64}\b/g;
+var HEX_SIGNATURE_PATTERN = /\b0x[a-fA-F0-9]{130}\b/g;
+var SECRET_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "api-key",
+  "apikey",
+  "authorization",
+  "bearer",
+  "payment-required",
+  "payment-response",
+  "payment-signature",
+  "privatekey",
+  "signature",
+  "x-api-key"
+]);
+function redactX402Secrets(value, options = {}) {
+  const replacement = options.replacement ?? DEFAULT_REPLACEMENT;
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const seen = /* @__PURE__ */ new WeakSet();
+  return redactValue(value, {
+    replacement,
+    maxDepth,
+    depth: 0,
+    seen,
+    key: void 0
+  });
+}
+function redactValue(value, context) {
+  if (context.key && shouldRedactKey(context.key)) {
+    return context.replacement;
+  }
+  if (typeof value === "string") {
+    return redactString(value, context.replacement);
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (context.depth >= context.maxDepth) {
+    return "[MaxDepth]";
+  }
+  if (context.seen.has(value)) {
+    return "[Circular]";
+  }
+  context.seen.add(value);
+  if (Array.isArray(value)) {
+    return value.map(
+      (entry) => redactValue(entry, {
+        ...context,
+        depth: context.depth + 1,
+        key: void 0
+      })
+    );
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      redactValue(entry, {
+        ...context,
+        depth: context.depth + 1,
+        key
+      })
+    ])
+  );
+}
+function shouldRedactKey(key) {
+  const normalized = key.toLowerCase().replace(/_/g, "-");
+  return SECRET_FIELD_NAMES.has(normalized) || normalized.includes("private-key") || normalized.includes("privatekey") || normalized.includes("payment-signature") || normalized.includes("payment-response") || normalized.includes("payment-required") || normalized.includes("api-key");
+}
+function redactString(value, replacement) {
+  return value.replace(PRIVATE_KEY_PATTERN, replacement).replace(HEX_SIGNATURE_PATTERN, replacement);
+}
+
+// src/callAuditArtifact.ts
+var PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION = "probemesh.call-audit.v1";
+function validateProbeMeshCallAuditArtifact(artifact) {
+  const errors = [];
+  if (!isRecord(artifact)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "ProbeMesh call audit artifact must be an object."
+        }
+      ]
+    };
+  }
+  if (artifact.schemaVersion !== PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROBEMESH_CALL_AUDIT_ARTIFACT_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString(artifact.artifactId, "artifactId", errors);
+  validateIsoTimestamp(artifact.generatedAt, "generatedAt", errors);
+  if (artifact.status !== "completed" && artifact.status !== "failed") {
+    errors.push({
+      path: "status",
+      message: 'status must be "completed" or "failed".'
+    });
+  }
+  if (artifact.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateHashes(artifact.hashes, errors);
+  validateCallSummary(artifact.call, artifact.status, errors);
+  validateRequestProof(artifact.request, artifact.hashes, errors);
+  validateEvidence(artifact.evidence, errors);
+  if (errors.length === 0) {
+    const typedArtifact = artifact;
+    pushHashMismatch(
+      errors,
+      "hashes.route",
+      typedArtifact.hashes.route,
+      hashStableJson(typedArtifact.evidence.route ?? null)
+    );
+    pushHashMismatch(
+      errors,
+      "hashes.timeline",
+      typedArtifact.hashes.timeline,
+      hashStableJson(typedArtifact.evidence.timeline)
+    );
+    pushHashMismatch(
+      errors,
+      "hashes.receipts",
+      typedArtifact.hashes.receipts,
+      hashStableJson(typedArtifact.evidence.receiptRefs)
+    );
+    pushHashMismatch(
+      errors,
+      "hashes.safety",
+      typedArtifact.hashes.safety,
+      hashStableJson(typedArtifact.evidence.safety ?? null)
+    );
+    pushHashMismatch(
+      errors,
+      "hashes.retrySafety",
+      typedArtifact.hashes.retrySafety,
+      hashStableJson(typedArtifact.evidence.retrySafety ?? null)
+    );
+    pushHashMismatch(
+      errors,
+      "hashes.artifact",
+      typedArtifact.hashes.artifact,
+      hashArtifactContent(typedArtifact)
+    );
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function validateHashes(hashes, errors) {
+  if (!isRecord(hashes)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const key of [
+    "request",
+    "route",
+    "timeline",
+    "receipts",
+    "safety",
+    "retrySafety",
+    "artifact"
+  ]) {
+    validateSha256String(hashes[key], `hashes.${key}`, errors);
+  }
+}
+function validateCallSummary(call, status, errors) {
+  if (!isRecord(call)) {
+    errors.push({
+      path: "call",
+      message: "call must be an object."
+    });
+    return;
+  }
+  validateNonEmptyString(call.capability, "call.capability", errors);
+  if (call.status !== status) {
+    errors.push({
+      path: "call.status",
+      message: "call.status must match artifact status."
+    });
+  }
+  if (call.callId !== void 0) {
+    validateNonEmptyString(call.callId, "call.callId", errors);
+  }
+  if (call.providerId !== void 0) {
+    validateNonEmptyString(call.providerId, "call.providerId", errors);
+  }
+  if (call.errorCode !== void 0 && (typeof call.errorCode !== "string" || call.errorCode.length === 0)) {
+    errors.push({
+      path: "call.errorCode",
+      message: "call.errorCode must be a non-empty string when provided."
+    });
+  }
+  if (call.latencyMs !== void 0 && (typeof call.latencyMs !== "number" || !Number.isFinite(call.latencyMs) || call.latencyMs < 0)) {
+    errors.push({
+      path: "call.latencyMs",
+      message: "call.latencyMs must be a non-negative finite number."
+    });
+  }
+}
+function validateRequestProof(request, hashes, errors) {
+  if (!isRecord(request)) {
+    errors.push({
+      path: "request",
+      message: "request must be an object."
+    });
+    return;
+  }
+  validateSha256String(request.requestHash, "request.requestHash", errors);
+  if (isRecord(hashes) && hashes.request !== request.requestHash) {
+    errors.push({
+      path: "hashes.request",
+      message: "hashes.request must equal request.requestHash."
+    });
+  }
+  if (request.idempotencyKey !== void 0) {
+    validateNonEmptyString(
+      request.idempotencyKey,
+      "request.idempotencyKey",
+      errors
+    );
+  }
+}
+function validateEvidence(evidence, errors) {
+  if (!isRecord(evidence)) {
+    errors.push({
+      path: "evidence",
+      message: "evidence must be an object."
+    });
+    return;
+  }
+  validateReceiptSummary(evidence.receiptSummary, errors);
+  validateReceiptRefs(evidence.receiptRefs, errors);
+  validateTimelineSummary(evidence.timeline, errors);
+}
+function validateReceiptSummary(summary, errors) {
+  if (!isRecord(summary)) {
+    errors.push({
+      path: "evidence.receiptSummary",
+      message: "evidence.receiptSummary must be an object."
+    });
+    return;
+  }
+  if (typeof summary.total !== "number" || !Number.isFinite(summary.total)) {
+    errors.push({
+      path: "evidence.receiptSummary.total",
+      message: "evidence.receiptSummary.total must be a number."
+    });
+  }
+  validateStringArray(summary.types, "evidence.receiptSummary.types", errors);
+  validateStringArray(
+    summary.providers,
+    "evidence.receiptSummary.providers",
+    errors
+  );
+  if (!isRecord(summary.byType)) {
+    errors.push({
+      path: "evidence.receiptSummary.byType",
+      message: "evidence.receiptSummary.byType must be an object."
+    });
+  }
+  for (const key of [
+    "hasPaymentProof",
+    "hasSettlementConfirmation",
+    "hasProviderDelivery"
+  ]) {
+    if (typeof summary[key] !== "boolean") {
+      errors.push({
+        path: `evidence.receiptSummary.${key}`,
+        message: `evidence.receiptSummary.${key} must be a boolean.`
+      });
+    }
+  }
+}
+function validateReceiptRefs(receiptRefs, errors) {
+  if (!Array.isArray(receiptRefs)) {
+    errors.push({
+      path: "evidence.receiptRefs",
+      message: "evidence.receiptRefs must be an array."
+    });
+    return;
+  }
+  receiptRefs.forEach((receiptRef, index) => {
+    if (!isRecord(receiptRef)) {
+      errors.push({
+        path: `evidence.receiptRefs.${index}`,
+        message: "receipt ref must be an object."
+      });
+      return;
+    }
+    for (const key of ["type", "provider", "status", "ref", "timestamp"]) {
+      validateNonEmptyString(
+        receiptRef[key],
+        `evidence.receiptRefs.${index}.${key}`,
+        errors
+      );
+    }
+  });
+}
+function validateTimelineSummary(timeline, errors) {
+  if (!isRecord(timeline)) {
+    errors.push({
+      path: "evidence.timeline",
+      message: "evidence.timeline must be an object."
+    });
+    return;
+  }
+  if (timeline.routeId !== void 0) {
+    validateNonEmptyString(timeline.routeId, "evidence.timeline.routeId", errors);
+  }
+  validateStringArray(
+    timeline.eventTypes,
+    "evidence.timeline.eventTypes",
+    errors
+  );
+  if (!Array.isArray(timeline.events)) {
+    errors.push({
+      path: "evidence.timeline.events",
+      message: "evidence.timeline.events must be an array."
+    });
+    return;
+  }
+  timeline.events.forEach((event, index) => {
+    if (!isRecord(event)) {
+      errors.push({
+        path: `evidence.timeline.events.${index}`,
+        message: "timeline event must be an object."
+      });
+      return;
+    }
+    validateNonEmptyString(
+      event.type,
+      `evidence.timeline.events.${index}.type`,
+      errors
+    );
+    validateIsoTimestamp(
+      event.timestamp,
+      `evidence.timeline.events.${index}.timestamp`,
+      errors
+    );
+  });
+}
+function hashArtifactContent(artifact) {
+  return hashStableJson({
+    ...artifact,
+    hashes: {
+      ...artifact.hashes,
+      artifact: ""
+    }
+  });
+}
+function pushHashMismatch(errors, path, expected, actual) {
+  if (expected === actual) {
+    return;
+  }
+  errors.push({
+    path,
+    message: `${path} does not match artifact content.`
+  });
+}
+function hashStableJson(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(stableStringify(value)).digest("hex");
+}
+function stableStringify(value) {
+  return JSON.stringify(sortSerializable(value));
+}
+function sortSerializable(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortSerializable);
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.keys(value).sort().filter((key) => value[key] !== void 0).map((key) => [key, sortSerializable(value[key])])
+  );
+}
+function validateSha256String(value, path, errors) {
+  if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+    errors.push({
+      path,
+      message: `${path} must be a sha256 hex string.`
+    });
+  }
+}
+function validateNonEmptyString(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function validateStringArray(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push({
+      path,
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/auditTrailBundle.ts
+var PROBEMESH_AUDIT_TRAIL_BUNDLE_SCHEMA_VERSION = "probemesh.audit-trail.v1";
+function createProbeMeshAuditTrailBundle(options) {
+  assertBundleOptions(options);
+  for (const [index, artifact] of options.artifacts.entries()) {
+    const validation = validateProbeMeshCallAuditArtifact(artifact);
+    if (!validation.valid) {
+      throw new ProbeMeshError({
+        code: "invalid_request",
+        message: `Invalid ProbeMesh call audit artifact at index ${index}: ${formatValidationErrors(
+          validation.errors
+        )}`
+      });
+    }
+  }
+  const artifacts = sanitizeBundleOutput(
+    options.artifacts,
+    options.forbiddenOutputValues ?? []
+  );
+  const summary = summarizeArtifacts(artifacts);
+  const hashesWithoutBundle = {
+    artifacts: hashStableJson2(artifacts),
+    summary: hashStableJson2(summary),
+    bundle: ""
+  };
+  const bundleBase = {
+    schemaVersion: PROBEMESH_AUDIT_TRAIL_BUNDLE_SCHEMA_VERSION,
+    bundleId: options.bundleId ?? `audit_trail_${hashStableJson2({
+      artifacts: hashesWithoutBundle.artifacts,
+      summary: hashesWithoutBundle.summary
+    }).slice(0, 16)}`,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    status: artifacts.length > 0 ? "complete" : "incomplete",
+    hashAlgorithm: "sha256",
+    hashes: hashesWithoutBundle,
+    summary,
+    artifacts
+  };
+  const bundle = {
+    ...bundleBase,
+    hashes: {
+      ...hashesWithoutBundle,
+      bundle: hashBundleContent(bundleBase)
+    }
+  };
+  assertProbeMeshAuditTrailBundle(bundle);
+  return bundle;
+}
+function validateProbeMeshAuditTrailBundle(bundle) {
+  const errors = [];
+  if (!isRecord2(bundle)) {
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "$",
+          message: "ProbeMesh audit trail bundle must be an object."
+        }
+      ]
+    };
+  }
+  if (bundle.schemaVersion !== PROBEMESH_AUDIT_TRAIL_BUNDLE_SCHEMA_VERSION) {
+    errors.push({
+      path: "schemaVersion",
+      message: `schemaVersion must be "${PROBEMESH_AUDIT_TRAIL_BUNDLE_SCHEMA_VERSION}".`
+    });
+  }
+  validateNonEmptyString2(bundle.bundleId, "bundleId", errors);
+  validateIsoTimestamp2(bundle.generatedAt, "generatedAt", errors);
+  if (bundle.status !== "complete" && bundle.status !== "incomplete") {
+    errors.push({
+      path: "status",
+      message: 'status must be "complete" or "incomplete".'
+    });
+  }
+  if (bundle.hashAlgorithm !== "sha256") {
+    errors.push({
+      path: "hashAlgorithm",
+      message: 'hashAlgorithm must be "sha256".'
+    });
+  }
+  validateHashes2(bundle.hashes, errors);
+  validateSummary(bundle.summary, errors);
+  if (!Array.isArray(bundle.artifacts)) {
+    errors.push({
+      path: "artifacts",
+      message: "artifacts must be an array."
+    });
+  } else {
+    bundle.artifacts.forEach((artifact, index) => {
+      const validation = validateProbeMeshCallAuditArtifact(artifact);
+      for (const artifactError of validation.errors) {
+        errors.push({
+          path: `artifacts.${index}.${artifactError.path}`,
+          message: artifactError.message
+        });
+      }
+    });
+  }
+  if (errors.length === 0) {
+    const typedBundle = bundle;
+    pushHashMismatch2(
+      errors,
+      "hashes.artifacts",
+      typedBundle.hashes.artifacts,
+      hashStableJson2(typedBundle.artifacts)
+    );
+    pushHashMismatch2(
+      errors,
+      "hashes.summary",
+      typedBundle.hashes.summary,
+      hashStableJson2(typedBundle.summary)
+    );
+    pushHashMismatch2(
+      errors,
+      "hashes.bundle",
+      typedBundle.hashes.bundle,
+      hashBundleContent(typedBundle)
+    );
+    const expectedSummary = summarizeArtifacts(typedBundle.artifacts);
+    if (stableStringify2(typedBundle.summary) !== stableStringify2(expectedSummary)) {
+      errors.push({
+        path: "summary",
+        message: "summary does not match bundle artifacts."
+      });
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertProbeMeshAuditTrailBundle(bundle) {
+  const result = validateProbeMeshAuditTrailBundle(bundle);
+  if (result.valid) {
+    return;
+  }
+  throw new ProbeMeshError({
+    code: "invalid_request",
+    message: `Invalid ProbeMesh audit trail bundle: ${formatValidationErrors(
+      result.errors
+    )}`
+  });
+}
+function formatProbeMeshAuditTrailBundle(bundle, options = {}) {
+  assertProbeMeshAuditTrailBundle(bundle);
+  if ((options.format ?? "json") === "markdown") {
+    return formatBundleMarkdown(bundle);
+  }
+  return JSON.stringify(bundle, null, 2);
+}
+function assertBundleOptions(options) {
+  if (!isRecord2(options)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "ProbeMesh audit trail bundle options must be an object."
+    });
+  }
+  if (!Array.isArray(options.artifacts)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "ProbeMesh audit trail bundle artifacts must be an array."
+    });
+  }
+  if (options.generatedAt !== void 0 && (typeof options.generatedAt !== "string" || Number.isNaN(Date.parse(options.generatedAt)))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "ProbeMesh audit trail bundle generatedAt must be an ISO timestamp."
+    });
+  }
+  if (options.bundleId !== void 0 && (typeof options.bundleId !== "string" || options.bundleId.length === 0)) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "ProbeMesh audit trail bundleId must be a non-empty string."
+    });
+  }
+  if (options.forbiddenOutputValues !== void 0 && (!Array.isArray(options.forbiddenOutputValues) || options.forbiddenOutputValues.some((value) => typeof value !== "string"))) {
+    throw new ProbeMeshError({
+      code: "invalid_request",
+      message: "ProbeMesh audit trail bundle forbiddenOutputValues must be an array of strings."
+    });
+  }
+}
+function summarizeArtifacts(artifacts) {
+  const providers = [];
+  const capabilities = [];
+  const receiptTypes = [];
+  const policyBundleIds = [];
+  let unsafePaymentEvidenceCalls = 0;
+  let retrySafeFailures = 0;
+  let uncoveredPolicyFailures = 0;
+  for (const artifact of artifacts) {
+    pushUnique(providers, artifact.call.providerId);
+    pushUnique(capabilities, artifact.call.capability);
+    for (const receiptType of artifact.evidence.receiptSummary.types) {
+      pushUnique(receiptTypes, receiptType);
+    }
+    const attestationBundleId = artifact.evidence.route?.attestation?.bundleId;
+    pushUnique(policyBundleIds, attestationBundleId);
+    if (artifact.evidence.safety?.moneyMayHaveMoved === true || artifact.evidence.receiptSummary.hasPaymentProof) {
+      unsafePaymentEvidenceCalls += 1;
+    }
+    if (artifact.status === "failed" && artifact.evidence.retrySafety?.safeToAutoRetry === true) {
+      retrySafeFailures += 1;
+    }
+    if (artifact.status === "failed" && artifact.evidence.route?.explanation?.attempts.some(
+      (attempt) => attempt.reason === "skipped_policy_bundle_uncovered"
+    ) === true) {
+      uncoveredPolicyFailures += 1;
+    }
+  }
+  return {
+    totalCalls: artifacts.length,
+    completedCalls: artifacts.filter((artifact) => artifact.status === "completed").length,
+    failedCalls: artifacts.filter((artifact) => artifact.status === "failed").length,
+    providers,
+    capabilities,
+    receiptTypes,
+    policyBundleIds,
+    unsafePaymentEvidenceCalls,
+    retrySafeFailures,
+    uncoveredPolicyFailures
+  };
+}
+function validateHashes2(hashes, errors) {
+  if (!isRecord2(hashes)) {
+    errors.push({
+      path: "hashes",
+      message: "hashes must be an object."
+    });
+    return;
+  }
+  for (const key of ["artifacts", "summary", "bundle"]) {
+    validateSha256String2(hashes[key], `hashes.${key}`, errors);
+  }
+}
+function validateSummary(summary, errors) {
+  if (!isRecord2(summary)) {
+    errors.push({
+      path: "summary",
+      message: "summary must be an object."
+    });
+    return;
+  }
+  for (const key of [
+    "totalCalls",
+    "completedCalls",
+    "failedCalls",
+    "unsafePaymentEvidenceCalls",
+    "retrySafeFailures",
+    "uncoveredPolicyFailures"
+  ]) {
+    if (typeof summary[key] !== "number" || !Number.isFinite(summary[key]) || summary[key] < 0) {
+      errors.push({
+        path: `summary.${key}`,
+        message: `summary.${key} must be a non-negative finite number.`
+      });
+    }
+  }
+  validateStringArray2(summary.providers, "summary.providers", errors);
+  validateStringArray2(summary.capabilities, "summary.capabilities", errors);
+  validateStringArray2(summary.receiptTypes, "summary.receiptTypes", errors);
+  validateStringArray2(summary.policyBundleIds, "summary.policyBundleIds", errors);
+}
+function hashBundleContent(bundle) {
+  return hashStableJson2({
+    ...bundle,
+    hashes: {
+      ...bundle.hashes,
+      bundle: ""
+    }
+  });
+}
+function pushHashMismatch2(errors, path, expected, actual) {
+  if (expected === actual) {
+    return;
+  }
+  errors.push({
+    path,
+    message: `${path} does not match bundle content.`
+  });
+}
+function hashStableJson2(value) {
+  return (0, import_node_crypto2.createHash)("sha256").update(stableStringify2(value)).digest("hex");
+}
+function stableStringify2(value) {
+  return JSON.stringify(sortSerializable2(value));
+}
+function sortSerializable2(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortSerializable2);
+  }
+  if (!isRecord2(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.keys(value).sort().filter((key) => value[key] !== void 0).map((key) => [key, sortSerializable2(value[key])])
+  );
+}
+function sanitizeBundleOutput(value, forbiddenOutputValues) {
+  const forbiddenValues = forbiddenOutputValues.filter((entry) => entry.length > 0);
+  return redactX402Secrets(
+    replaceForbiddenValues(cloneSerializable(value), forbiddenValues)
+  );
+}
+function replaceForbiddenValues(value, forbiddenValues) {
+  if (typeof value === "string") {
+    return forbiddenValues.reduce(
+      (current, forbidden) => current.split(forbidden).join("[REDACTED]"),
+      value
+    );
+  }
+  if (value === null || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => replaceForbiddenValues(entry, forbiddenValues));
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      replaceForbiddenValues(entry, forbiddenValues)
+    ])
+  );
+}
+function cloneSerializable(value) {
+  if (value === void 0) {
+    return value;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function formatBundleMarkdown(bundle) {
+  return [
+    `# ProbeMesh Audit Trail Bundle`,
+    ``,
+    `Status: ${bundle.status}`,
+    `Schema: ${bundle.schemaVersion}`,
+    `Bundle ID: ${bundle.bundleId}`,
+    `Generated: ${bundle.generatedAt}`,
+    ``,
+    `## Summary`,
+    `- Total calls: ${bundle.summary.totalCalls}`,
+    `- Completed: ${bundle.summary.completedCalls}`,
+    `- Failed: ${bundle.summary.failedCalls}`,
+    `- Providers: ${formatInlineList(bundle.summary.providers)}`,
+    `- Capabilities: ${formatInlineList(bundle.summary.capabilities)}`,
+    `- Receipt types: ${formatInlineList(bundle.summary.receiptTypes)}`,
+    `- Policy bundles: ${formatInlineList(bundle.summary.policyBundleIds)}`,
+    `- Unsafe payment evidence calls: ${bundle.summary.unsafePaymentEvidenceCalls}`,
+    `- Retry-safe failures: ${bundle.summary.retrySafeFailures}`,
+    `- Uncovered policy failures: ${bundle.summary.uncoveredPolicyFailures}`,
+    ``,
+    `## Artifacts`,
+    ...bundle.artifacts.map(
+      (artifact) => `- ${artifact.call.callId ?? artifact.artifactId}: ${artifact.status} / ${artifact.call.capability} / ${artifact.call.providerId ?? "none"}`
+    ),
+    ``,
+    `## Hashes`,
+    `- Bundle: ${bundle.hashes.bundle}`,
+    `- Artifacts: ${bundle.hashes.artifacts}`,
+    `- Summary: ${bundle.hashes.summary}`
+  ].join("\n");
+}
+function formatInlineList(values) {
+  return values.length === 0 ? "none" : values.join(", ");
+}
+function pushUnique(values, value) {
+  if (value && !values.includes(value)) {
+    values.push(value);
+  }
+}
+function validateSha256String2(value, path, errors) {
+  if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+    errors.push({
+      path,
+      message: `${path} must be a sha256 hex string.`
+    });
+  }
+}
+function validateNonEmptyString2(value, path, errors) {
+  if (typeof value !== "string" || value.length === 0) {
+    errors.push({
+      path,
+      message: `${path} must be a non-empty string.`
+    });
+  }
+}
+function validateIsoTimestamp2(value, path, errors) {
+  if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+    errors.push({
+      path,
+      message: `${path} must be an ISO timestamp.`
+    });
+  }
+}
+function validateStringArray2(value, path, errors) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+    errors.push({
+      path,
+      message: `${path} must be an array of non-empty strings.`
+    });
+  }
+}
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function formatValidationErrors(errors) {
+  return errors.map((error) => `${error.path}: ${error.message}`).join("; ");
+}
+
+// src/cli/auditTrailExportCli.ts
+var USAGE = "Usage: probemesh-audit-trail-export --config <path> [--format markdown|json] [--out-json <path>] [--out-md <path>] [--bundle-id <text>] [--generated-at <iso>]";
+async function runProbeMeshAuditTrailExportCli(options = {}) {
+  const argv = options.argv ?? [];
+  const cwd = options.cwd ?? process.cwd();
+  try {
+    const parsedArgs = parseCliArgs(argv);
+    if (parsedArgs.help) {
+      return {
+        exitCode: 0,
+        skipped: true,
+        stdout: `${USAGE}
+`
+      };
+    }
+    if (!parsedArgs.configPath) {
+      return cliFailure("--config <path> is required.");
+    }
+    const configExport = await loadCliConfig(parsedArgs.configPath, {
+      argv,
+      cwd
+    });
+    if (isCliSkip(configExport)) {
+      return {
+        exitCode: 0,
+        skipped: true,
+        skip: configExport,
+        stdout: `ProbeMesh audit trail export skipped: ${configExport.reason}
+`
+      };
+    }
+    assertCliConfig(configExport);
+    const artifacts = await loadArtifacts({
+      cwd,
+      inlineArtifacts: configExport.artifacts,
+      artifactFiles: configExport.artifactFiles
+    });
+    const bundle = createProbeMeshAuditTrailBundle({
+      artifacts,
+      bundleId: parsedArgs.bundleId ?? configExport.bundle?.bundleId,
+      generatedAt: parsedArgs.generatedAt ?? configExport.bundle?.generatedAt,
+      forbiddenOutputValues: configExport.bundle?.forbiddenOutputValues
+    });
+    const selectedFormat = parsedArgs.format ?? configExport.bundle?.format ?? "markdown";
+    const stdout = formatProbeMeshAuditTrailBundle(bundle, {
+      format: selectedFormat
+    });
+    const artifactPaths = await writeArtifacts({
+      cwd,
+      bundle,
+      outputs: {
+        json: parsedArgs.outJson ?? configExport.outputs?.json,
+        markdown: parsedArgs.outMarkdown ?? configExport.outputs?.markdown
+      }
+    });
+    return {
+      exitCode: bundle.status === "complete" ? 0 : 1,
+      skipped: false,
+      bundle,
+      stdout,
+      artifactPaths
+    };
+  } catch (error) {
+    return cliFailure(
+      error instanceof Error ? error.message : "Unknown audit trail export CLI failure."
+    );
+  }
+}
+function parseCliArgs(argv) {
+  const parsedArgs = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--") {
+      continue;
+    }
+    if (arg === "--help" || arg === "-h") {
+      parsedArgs.help = true;
+      continue;
+    }
+    if (arg === "--config") {
+      parsedArgs.configPath = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--format") {
+      const format = requireValue(argv, index, arg);
+      if (format !== "markdown" && format !== "json") {
+        throw new Error("--format must be markdown or json.");
+      }
+      parsedArgs.format = format;
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-json") {
+      parsedArgs.outJson = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--out-md") {
+      parsedArgs.outMarkdown = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--bundle-id") {
+      parsedArgs.bundleId = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--generated-at") {
+      parsedArgs.generatedAt = requireValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    throw new Error(`Unknown argument "${arg}".`);
+  }
+  return parsedArgs;
+}
+function requireValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${flag} requires a value.`);
+  }
+  return value;
+}
+async function loadCliConfig(configPath, context) {
+  const configExport = await loadCliConfigDefault(configPath, context.cwd);
+  if (typeof configExport === "function") {
+    return configExport(context);
+  }
+  return configExport;
+}
+function isCliSkip(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && value.skip === true && typeof value.reason === "string";
+}
+function assertCliConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Audit trail export CLI config must export an object.");
+  }
+  const config = value;
+  if (config.artifacts !== void 0 && !Array.isArray(config.artifacts)) {
+    throw new Error("Audit trail export CLI artifacts must be an array.");
+  }
+  if (config.artifactFiles !== void 0 && (!Array.isArray(config.artifactFiles) || config.artifactFiles.some((artifactFile) => typeof artifactFile !== "string"))) {
+    throw new Error("Audit trail export CLI artifactFiles must be an array of strings.");
+  }
+  if (config.bundle !== void 0) {
+    assertBundleConfig(config.bundle);
+  }
+  const outputs = config.outputs;
+  if (outputs !== void 0 && (!outputs || typeof outputs !== "object" || Array.isArray(outputs) || outputs.json !== void 0 && typeof outputs.json !== "string" || outputs.markdown !== void 0 && typeof outputs.markdown !== "string")) {
+    throw new Error("Audit trail export CLI outputs must contain string paths.");
+  }
+}
+function assertBundleConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Audit trail export CLI bundle config must be an object.");
+  }
+  const bundle = value;
+  if (bundle.bundleId !== void 0 && typeof bundle.bundleId !== "string") {
+    throw new Error("Audit trail export CLI bundleId must be a string.");
+  }
+  if (bundle.generatedAt !== void 0 && typeof bundle.generatedAt !== "string") {
+    throw new Error("Audit trail export CLI generatedAt must be a string.");
+  }
+  if (bundle.forbiddenOutputValues !== void 0 && (!Array.isArray(bundle.forbiddenOutputValues) || bundle.forbiddenOutputValues.some((value2) => typeof value2 !== "string"))) {
+    throw new Error(
+      "Audit trail export CLI forbiddenOutputValues must be an array of strings."
+    );
+  }
+  if (bundle.format !== void 0 && bundle.format !== "markdown" && bundle.format !== "json") {
+    throw new Error("Audit trail export CLI bundle format must be markdown or json.");
+  }
+}
+async function loadArtifacts(options) {
+  const artifacts = [
+    ...options.inlineArtifacts ?? []
+  ];
+  for (const artifactFile of options.artifactFiles ?? []) {
+    const loadedArtifacts = await loadArtifactFile(options.cwd, artifactFile);
+    artifacts.push(...loadedArtifacts);
+  }
+  return artifacts;
+}
+async function loadArtifactFile(cwd, artifactFile) {
+  const artifactPath = (0, import_node_path2.resolve)(cwd, artifactFile);
+  const body = await (0, import_promises2.readFile)(artifactPath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch (error) {
+    throw new Error(
+      `Invalid audit artifact JSON in "${artifactFile}": ${error instanceof Error ? error.message : "parse failed"}`
+    );
+  }
+  if (Array.isArray(parsed)) {
+    return parsed;
+  }
+  if (parsed && typeof parsed === "object") {
+    return [parsed];
+  }
+  throw new Error(
+    `Audit artifact file "${artifactFile}" must contain an artifact object or artifact array.`
+  );
+}
+async function writeArtifacts(options) {
+  const artifactPaths = {};
+  if (options.outputs.json) {
+    const outputPath = (0, import_node_path2.resolve)(options.cwd, options.outputs.json);
+    await writeArtifact(
+      outputPath,
+      formatProbeMeshAuditTrailBundle(options.bundle, {
+        format: "json"
+      })
+    );
+    artifactPaths.json = outputPath;
+  }
+  if (options.outputs.markdown) {
+    const outputPath = (0, import_node_path2.resolve)(options.cwd, options.outputs.markdown);
+    await writeArtifact(
+      outputPath,
+      formatProbeMeshAuditTrailBundle(options.bundle, {
+        format: "markdown"
+      })
+    );
+    artifactPaths.markdown = outputPath;
+  }
+  return artifactPaths;
+}
+async function writeArtifact(outputPath, body) {
+  await (0, import_promises2.mkdir)((0, import_node_path2.dirname)(outputPath), {
+    recursive: true
+  });
+  await (0, import_promises2.writeFile)(outputPath, body, "utf8");
+}
+function cliFailure(message) {
+  return {
+    exitCode: 2,
+    skipped: false,
+    stdout: "",
+    stderr: `${message}
+${USAGE}
+`
+  };
+}
+
+// src/cli/audit-trail-export.ts
+void main();
+async function main() {
+  const result = await runProbeMeshAuditTrailExportCli({
+    argv: process.argv.slice(2),
+    cwd: process.cwd()
+  });
+  if (result.stdout) {
+    process.stdout.write(result.stdout);
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr);
+  }
+  process.exitCode = result.exitCode;
+}
+//# sourceMappingURL=audit-trail-export.cjs.map