@verax-ai/body 0.2.1 → 0.2.2

package/dist/cli.js

@@ -20,6 +20,7 @@ Usage: verax <command> [options]
   (no command)         serve MCP over Streamable HTTP at /mcp on VERAX_BIND (default 127.0.0.1:8787)
   doctor [--json]      check the configuration this process would run with
   demo [--keep]        run a loopback body against a temporary ledger and print what it recorded
+       [--with-conarium]  also fetch Conarium with npx, attach it as a child, and put a masked read through the gate
   approve <args>       approve a waiting request from this machine
   operator <args>      enrol an operator and manage their passkeys
   reconcile <args>     compare the ledger against a statement

package/dist/demo.d.ts

@@ -8,4 +8,11 @@ export type DemoIo = {
     stdin: NodeJS.ReadableStream;
     isTTY: boolean;
 };
-export declare function runDemo(argv: string[], env: NodeJS.ProcessEnv, io: DemoIo): Promise<number>;
+/** Test injection. The CLI never passes this; it is not read from argv or env. */
+export type DemoOpts = {
+    conariumChild?: {
+        command: string;
+        args: string[];
+    };
+};
+export declare function runDemo(argv: string[], env: NodeJS.ProcessEnv, io: DemoIo, opts?: DemoOpts): Promise<number>;

package/dist/demo.js

@@ -11,6 +11,16 @@ import { verifyLedger } from "@verax-ai/proxy";
 import { runApprove } from "./approve-cli.js";
 import { listen } from "./server.js";
 const NOT_SHOWN = "Not shown here: data masking arrives with a downstream server such as Conarium; statement reconciliation needs a real statement (verax reconcile).";
+const NOT_SHOWN_WITH_CONARIUM = "Not shown here: a real database (these are Conarium's sample rows); statement reconciliation needs a real statement (verax reconcile).";
+const NPX_DOWNLOAD_LINE = "npx will download @conarium-ai/core from npm and run it as a child process; a cold download takes longer.\n";
+const CONARIUM_NPX = {
+    command: "npx",
+    args: ["-y", "--package=@conarium-ai/core@^0.2.51", "conarium", "--demo"],
+};
+const CONARIUM_TIMEOUT_MS = 120_000;
+const CUSTOMERS_SQL = "SELECT name, email, card FROM public.customers";
+const SECRETS_SQL = "SELECT * FROM public.secrets";
+const MASKED_PII = "[MASKED_PII]";
 const AUDIENCE = "http://127.0.0.1/verax-demo";
 const KID = "demo";
 const TOKEN_TTL_SEC = 5 * 60;
@@ -48,7 +58,7 @@ function shippedPolicyPath() {
     throw new Error("demo: shipped policy file not found");
 }
 /** Shipped default plus message.send egress and a spend rule, written under the temp dir. */
-function writeDemoPolicy(stateDir) {
+function writeDemoPolicy(stateDir, withConarium) {
     const shipped = JSON.parse(readFileSync(shippedPolicyPath(), "utf8"));
     const document = {
         ...shipped,
@@ -75,12 +85,34 @@ function writeDemoPolicy(stateDir) {
                     dailyMaxMinor: 10_000,
                 },
             },
+            ...(withConarium
+                ? [
+                    {
+                        id: "conarium-query",
+                        tool: "conarium.query",
+                        requires: ["verax:read"],
+                        text: "A data read through Conarium needs the read scope.",
+                    },
+                ]
+                : []),
         ],
     };
     const path = join(stateDir, "policy.json");
     writeFileSync(path, `${JSON.stringify(document, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
     return path;
 }
+function writeConariumDownstream(stateDir, child) {
+    const path = join(stateDir, "downstream.json");
+    const document = {
+        prefix: "conarium",
+        command: child.command,
+        args: [...child.args],
+        trust: "same-user",
+        timeoutMs: CONARIUM_TIMEOUT_MS,
+    };
+    writeFileSync(path, `${JSON.stringify(document, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    return path;
+}
 function closeHttp(server) {
     if (!server)
         return Promise.resolve();
@@ -142,6 +174,49 @@ function parseTagged(text, kind) {
     const m = new RegExp(`^${kind}:([^:]+):(.+)$`).exec(text.trim());
     return m ? { code: m[1], ref: m[2] } : null;
 }
+async function callToolCaught(client, name, args) {
+    try {
+        const result = await client.callTool({ name, arguments: args });
+        return { isError: result.isError === true, text: toolText(result) };
+    }
+    catch (err) {
+        return { isError: true, text: err instanceof Error ? err.message : "fault" };
+    }
+}
+function customerRowsMasked(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return false;
+    const rows = parsed.rows;
+    if (!Array.isArray(rows) || rows.length === 0)
+        return false;
+    for (const row of rows) {
+        if (row === null || typeof row !== "object")
+            return false;
+        const rec = row;
+        if (rec.email !== MASKED_PII || rec.card !== MASKED_PII)
+            return false;
+    }
+    return true;
+}
+/**
+ * The body passes on that a downstream tool answered with an error, not what it
+ * said: the detail is the fixed word `call-failed`. A child that died or timed
+ * out carries the transport's own message there instead, and that is not an
+ * answer from Conarium.
+ */
+function childAnsweredWithError(text, tool) {
+    return text.trim().endsWith(`downstream-call-failed:${tool}:call-failed`);
+}
+function attachFailedDetail(detail) {
+    return /downstream-attach-failed|downstream-attach-timeout/.test(detail);
+}
 async function readAnswer(stdin) {
     const ended = stdin.readableEnded;
     if (ended)
@@ -165,18 +240,21 @@ async function readAnswer(stdin) {
             stdin.resume();
     });
 }
-export async function runDemo(argv, env, io) {
+export async function runDemo(argv, env, io, opts) {
     if (env.NODE_ENV === "production") {
         io.stderr.write("demo refuses NODE_ENV=production\n");
         return 1;
     }
     const keep = argv.includes("--keep");
+    const withConarium = argv.includes("--with-conarium");
     let stateDir = null;
     let jwks = null;
     let body = null;
     let client = null;
     let token = "";
     let cleaned = false;
+    let discardState = false;
+    let failed = false;
     const writeOut = (s) => {
         io.stdout.write(redact(s, token));
     };
@@ -196,7 +274,7 @@ export async function runDemo(argv, env, io) {
         body = null;
         await closeHttp(jwks);
         jwks = null;
-        if (stateDir && !keep) {
+        if (stateDir && (!keep || discardState)) {
             try {
                 rmSync(stateDir, { recursive: true, force: true });
             }
@@ -212,13 +290,21 @@ export async function runDemo(argv, env, io) {
     process.once("SIGTERM", onStop);
     try {
         stateDir = mkdtempSync(join(tmpdir(), "verax-demo-"));
-        const policyFile = writeDemoPolicy(stateDir);
+        const policyFile = writeDemoPolicy(stateDir, withConarium);
         const { privateKey, publicKey } = await generateKeyPair("ES256");
         const jwk = { ...(await exportJWK(publicKey)), alg: "ES256", use: "sig", kid: KID };
         const jwksBind = await serveJwks(jwk);
         jwks = jwksBind.server;
         const issuer = jwksBind.issuer;
         const jwksUrl = `${issuer}/.well-known/jwks.json`;
+        let downstreamFile;
+        if (withConarium) {
+            const child = opts?.conariumChild ?? CONARIUM_NPX;
+            downstreamFile = writeConariumDownstream(stateDir, child);
+            if (!opts?.conariumChild) {
+                writeErr(NPX_DOWNLOAD_LINE);
+            }
+        }
         body = await listen({
             issuer,
             jwksUrl,
@@ -228,6 +314,7 @@ export async function runDemo(argv, env, io) {
             bindPort: 0,
             policyFile,
             tlsTerminated: false,
+            ...(downstreamFile !== undefined ? { downstreamFile } : {}),
         });
         const addr = body.address();
         if (!addr || typeof addr === "string")
@@ -298,6 +385,49 @@ export async function runDemo(argv, env, io) {
             writeOut("  no terminal to ask, so it stays held (run this in a terminal to be asked)\n");
         }
         writeOut("\n");
+        if (withConarium) {
+            const customers = await callToolCaught(client, "conarium.query", { sql: CUSTOMERS_SQL });
+            if (customers.isError)
+                throw new Error(`demo: conarium.query customers ${customers.text}`);
+            writeOut("conarium.query customers\n");
+            if (customerRowsMasked(customers.text)) {
+                writeOut("  allowed; masked by Conarium before the rows left it\n");
+                writeOut("  measured [MASKED_PII] on every email and card\n");
+            }
+            else {
+                writeOut("  allowed; did not come out masked\n");
+                failed = true;
+            }
+            writeOut("\n");
+            const secrets = await callToolCaught(client, "conarium.query", { sql: SECRETS_SQL });
+            const secretsDenied = parseTagged(secrets.text, "denied");
+            writeOut("conarium.query public.secrets\n");
+            if (secretsDenied) {
+                writeOut(`  refused ${secretsDenied.code} (signed)\n`);
+                failed = true;
+            }
+            else if (childAnsweredWithError(secrets.text, "conarium.query")) {
+                writeOut("  allowed by this gate; Conarium answered with an error and no rows\n");
+                writeOut("  recorded as a failed call\n");
+            }
+            else if (secrets.isError) {
+                writeOut("  allowed by this gate; the call to Conarium failed before it answered\n");
+                failed = true;
+            }
+            else {
+                writeOut("  allowed; Conarium did not refuse public.secrets\n");
+                failed = true;
+            }
+            writeOut("\n");
+            const listed = await callToolCaught(client, "conarium.list_tables", {});
+            const listedDenied = parseTagged(listed.text, "denied");
+            writeOut("conarium.list_tables\n");
+            if (!listedDenied)
+                throw new Error(`demo: conarium.list_tables ${listed.text}`);
+            writeOut(`  refused ${listedDenied.code} (signed)\n`);
+            writeOut("  refused by this gate; the downstream server never saw the call\n");
+            writeOut("\n");
+        }
         const explained = await client.callTool({
             name: "audit.explain",
             arguments: { ref: denied.ref },
@@ -343,13 +473,19 @@ export async function runDemo(argv, env, io) {
             writeOut("ledger   removed on exit (run with --keep to keep it and check it with verax verify)\n");
         }
         writeOut("\n");
-        writeOut(`${NOT_SHOWN}\n`);
+        writeOut(`${withConarium ? NOT_SHOWN_WITH_CONARIUM : NOT_SHOWN}\n`);
         await cleanup();
-        return 0;
+        return failed ? 1 : 0;
     }
     catch (err) {
         const detail = err instanceof Error ? err.message : "fault";
-        writeErr(`demo: ${detail}\n`);
+        if (withConarium && attachFailedDetail(detail)) {
+            discardState = true;
+            writeErr(`could not start the Conarium child (${detail}). run without --with-conarium\n`);
+        }
+        else {
+            writeErr(`demo: ${detail}\n`);
+        }
         await cleanup();
         return 1;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verax-ai/body",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -22,8 +22,8 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@verax-ai/inventory": "^0.2.1",
-    "@verax-ai/proxy": "^0.2.1",
+    "@verax-ai/inventory": "^0.2.2",
+    "@verax-ai/proxy": "^0.2.2",
     "jose": "^6.2.11"
   },
   "description": "VERAX body: an MCP server that decides, records and proves what an agent did.",