@zanii/monitor 0.1.0

package/LICENSE

@@ -0,0 +1,159 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or agreed
+      to in writing, Licensor provides the Work (and each Contributor
+      provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
+      OR CONDITIONS OF ANY KIND, either express or implied, including,
+      without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Zanii
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,61 @@
+# @zanii/monitor
+
+An **independent watchdog** for a Zanii transparency log. "Trust no one, including
+Zanii" is only a claim until someone continuously checks it — this is that someone.
+It verifies each Signed Tree Head's signature, proves the log is **append-only**
+(a consistency proof from the last size it saw — rewriting past history fails this),
+and confirms every **anchored** checkpoint is still an append-only prefix of the
+current tree. Any violation is surfaced loudly.
+
+Run it as a library or the `zanii-monitor` CLI. Node 18+.
+
+```sh
+npm install @zanii/monitor
+```
+
+## CLI
+
+```sh
+# watch continuously, persist state, POST alerts on violation
+zanii-monitor --server https://ledger.zanii.agency --interval 60 \
+  --state ./monitor.state --alert https://your-app/alert
+
+# one-shot for CI/cron — exits 1 on any violation
+zanii-monitor --server https://ledger.zanii.agency --once
+```
+
+Persisting `--state` across runs is what makes an *offline* rewrite impossible to
+hide: the next check proves the log is consistent with the size you last verified.
+
+## Library
+
+```ts
+import { checkOnce, monitor } from '@zanii/monitor';
+
+const r = await checkOnce('https://ledger.zanii.agency', previousState);
+if (!r.ok) console.error('VIOLATION:', r.violations);
+// persist r.state and pass it back next time
+
+await monitor('https://ledger.zanii.agency', {
+  intervalMs: 60_000,
+  onViolation: (r) => pageOncall(r.violations),
+});
+```
+
+## What it checks
+
+| Check | Proves |
+|---|---|
+| STH signature | the tree head really came from the log operator |
+| Consistency (last size → now) | the log is **append-only** — no past entry was altered, removed, or reordered |
+| Anchor validity + extension | the current tree is an append-only extension of every on-chain checkpoint |
+
+`MonitorResult = { ok, size, root, checks[], violations[], state }`. Persist `state`.
+
+## Changelog
+
+- **0.1.0** — initial release: `checkOnce`, `monitor`, and the `zanii-monitor` CLI.
+
+## License
+
+Apache-2.0.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * zanii-monitor — watch a Zanii log for any append-only or anchoring violation.
+ *
+ *   zanii-monitor --server https://ledger.zanii.agency --interval 60 \
+ *     --state ./monitor.state --alert https://you/webhook
+ *   zanii-monitor --server https://ledger.zanii.agency --once     # exit 1 on violation
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { checkOnce, monitor } from './index.js';
+const argOf = (name) => {
+    const i = process.argv.indexOf(`--${name}`);
+    return i >= 0 ? process.argv[i + 1] : undefined;
+};
+const has = (name) => process.argv.includes(`--${name}`);
+const server = argOf('server');
+if (!server) {
+    console.error('usage: zanii-monitor --server <url> [--interval <sec>] [--once] [--state <file>] [--alert <webhook-url>]');
+    process.exit(2);
+}
+const stateFile = argOf('state');
+const alertUrl = argOf('alert');
+const loadState = () => {
+    if (stateFile && existsSync(stateFile)) {
+        try {
+            return JSON.parse(readFileSync(stateFile, 'utf8'));
+        }
+        catch { /* ignore */ }
+    }
+    return undefined;
+};
+const saveState = (s) => { if (stateFile)
+    writeFileSync(stateFile, JSON.stringify(s)); };
+const line = (r) => {
+    const ts = new Date().toISOString();
+    return r.ok
+        ? `${ts}  OK  size=${r.size} root=${r.root.slice(0, 24)}… (${r.checks.length} checks passed)`
+        : `${ts}  VIOLATION  size=${r.size} :: ${r.violations.join(' ; ')}`;
+};
+const alert = async (r) => {
+    if (!alertUrl)
+        return;
+    try {
+        await fetch(alertUrl, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ source: 'zanii-monitor', server, ...r }),
+        });
+    }
+    catch { /* best-effort */ }
+};
+if (has('once')) {
+    const r = await checkOnce(server, loadState());
+    console.log(line(r));
+    saveState(r.state);
+    if (!r.ok) {
+        await alert(r);
+        process.exit(1);
+    }
+    process.exit(0);
+}
+else {
+    const interval = Number(argOf('interval') ?? '60') * 1000;
+    console.error(`zanii-monitor: watching ${server} every ${interval / 1000}s${alertUrl ? ` (alerting ${alertUrl})` : ''}`);
+    await monitor(server, {
+        intervalMs: interval,
+        initialState: loadState(),
+        onResult: (r) => { console.log(line(r)); saveState(r.state); },
+        onViolation: alert,
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAyC,MAAM,YAAY,CAAC;AAEvF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAsB,EAAE;IACjD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAE1E,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;IACZ,OAAO,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;IAC1H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;AACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,SAAS,GAAG,GAA6B,EAAE;IAC/C,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAiB,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AACF,MAAM,SAAS,GAAG,CAAC,CAAe,EAAQ,EAAE,GAAG,IAAI,SAAS;IAAE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7G,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAU,EAAE;IACxC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,EAAE;QACT,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,iBAAiB;QAC7F,CAAC,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAgB,EAAiB,EAAE;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAChB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;KAAM,CAAC;IACN,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,UAAU,QAAQ,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzH,MAAM,OAAO,CAAC,MAAM,EAAE;QACpB,UAAU,EAAE,QAAQ;QACpB,YAAY,EAAE,SAAS,EAAE;QACzB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,WAAW,EAAE,KAAK;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,35 @@
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/** Persist this between runs so an offline rewrite can't slip past. */
+export interface MonitorState {
+    size: number;
+    root: string;
+}
+export interface Check {
+    name: string;
+    ok: boolean;
+    detail?: string;
+}
+export interface MonitorResult {
+    ok: boolean;
+    size: number;
+    root: string;
+    checks: Check[];
+    violations: string[];
+    /** The verified head — persist this and pass as `prev` next time. */
+    state: MonitorState;
+}
+/**
+ * Run one integrity check. Pass the `state` returned last time as `prev` to prove
+ * the log only grew (never rewrote) since you last looked.
+ */
+export declare function checkOnce(server: string, prev?: MonitorState, fetchImpl?: FetchLike): Promise<MonitorResult>;
+export interface MonitorOptions {
+    intervalMs?: number;
+    fetchImpl?: FetchLike;
+    initialState?: MonitorState;
+    onResult?: (r: MonitorResult) => void | Promise<void>;
+    onViolation?: (r: MonitorResult) => void | Promise<void>;
+}
+/** Run forever, checking every `intervalMs` (default 60s). Never resolves. */
+export declare function monitor(server: string, opts?: MonitorOptions): Promise<never>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,qEAAqE;IACrE,KAAK,EAAE,YAAY,CAAC;CACrB;AAQD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,YAAY,EACnB,SAAS,GAAE,SAAiC,GAC3C,OAAO,CAAC,aAAa,CAAC,CAoDxB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,8EAA8E;AAC9E,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,CAevF"}

package/dist/index.js

@@ -0,0 +1,89 @@
+/**
+ * @zanii/monitor — an independent watchdog for a Zanii transparency log.
+ *
+ * "Trust no one, including Zanii" is a claim until someone continuously checks it.
+ * This monitor does: it verifies each Signed Tree Head's signature, proves the log
+ * is **append-only** (a consistency proof from the last size it saw — a rewrite of
+ * past history fails this), and confirms every **anchored** checkpoint is still an
+ * append-only prefix of the current tree. Any violation is surfaced loudly.
+ *
+ * Run it as a library (`checkOnce`, `monitor`) or via the `zanii-monitor` CLI.
+ */
+import { hexToBytes } from '@noble/hashes/utils';
+import { verifyConsistency, verifySTH } from '@zanii/core';
+const toRoot = (s) => hexToBytes(s.replace('sha256:', ''));
+const short = (s) => {
+    const t = String(s ?? '');
+    return t.length > 16 ? t.slice(0, 16) + '…' : t;
+};
+/**
+ * Run one integrity check. Pass the `state` returned last time as `prev` to prove
+ * the log only grew (never rewrote) since you last looked.
+ */
+export async function checkOnce(server, prev, fetchImpl = (u, i) => fetch(u, i)) {
+    const base = server.replace(/\/$/, '');
+    const get = async (p) => {
+        const r = await fetchImpl(`${base}${p}`);
+        if (!r.ok)
+            throw new Error(`${p} → ${r.status}`);
+        return r.json();
+    };
+    const checks = [];
+    const violations = [];
+    const push = (name, ok, detail) => {
+        checks.push({ name, ok, detail });
+        if (!ok)
+            violations.push(detail ?? name);
+    };
+    const sth = (await get('/v1/sth'));
+    push('signed tree head signature', verifySTH(sth) && !!sth.log_id, 'STH signature invalid');
+    if (prev) {
+        if (sth.size < prev.size) {
+            push(`append-only (size ${sth.size} ≥ ${prev.size})`, false, `log SHRANK: size ${sth.size} < previously seen ${prev.size}`);
+        }
+        else if (sth.size === prev.size) {
+            push('append-only (root unchanged at same size)', sth.root === prev.root, `root changed at unchanged size ${sth.size} — history was rewritten`);
+        }
+        else {
+            const c = await get(`/v1/consistency?first=${prev.size}`);
+            const ok = verifyConsistency(prev.size, sth.size, toRoot(prev.root), toRoot(sth.root), c.proof.map(hexToBytes));
+            push(`append-only (consistency ${prev.size}→${sth.size})`, ok, `consistency proof ${prev.size}→${sth.size} FAILED — history was rewritten`);
+        }
+    }
+    // Every anchored checkpoint must be an append-only prefix of the current tree.
+    try {
+        const { anchors } = (await get('/v1/anchors'));
+        for (const a of anchors ?? []) {
+            let ok = verifySTH(a.sth) && a.sth.log_id === sth.log_id && a.sth.size <= sth.size;
+            if (ok && a.sth.size < sth.size) {
+                const c = await get(`/v1/consistency?first=${a.sth.size}`);
+                ok = verifyConsistency(a.sth.size, sth.size, toRoot(a.sth.root), toRoot(sth.root), c.proof.map(hexToBytes));
+            }
+            push(`anchor ${short(a.ref)} valid + extended`, ok, `anchor ${short(a.ref)}: invalid STH or current tree is not an append-only extension of it`);
+        }
+    }
+    catch {
+        /* anchors endpoint optional */
+    }
+    return { ok: violations.length === 0, size: sth.size, root: sth.root, checks, violations, state: { size: sth.size, root: sth.root } };
+}
+/** Run forever, checking every `intervalMs` (default 60s). Never resolves. */
+export async function monitor(server, opts = {}) {
+    const interval = opts.intervalMs ?? 60_000;
+    const impl = opts.fetchImpl ?? ((u, i) => fetch(u, i));
+    let state = opts.initialState;
+    for (;;) {
+        try {
+            const r = await checkOnce(server, state, impl);
+            state = r.state;
+            await opts.onResult?.(r);
+            if (!r.ok)
+                await opts.onViolation?.(r);
+        }
+        catch (e) {
+            await opts.onResult?.({ ok: false, size: -1, root: '', checks: [], violations: [String(e)], state: state ?? { size: 0, root: '' } });
+        }
+        await new Promise((res) => setTimeout(res, interval));
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AA0BhF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/E,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,IAAmB,EACnB,YAAuB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAS,EAAgB,EAAE;QAC5C,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAW,EAAE,MAAe,EAAE,EAAE;QAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,CAAmB,CAAC;IACrD,IAAI,CAAC,4BAA4B,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAE5F,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,qBAAqB,GAAG,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,EACzD,oBAAoB,GAAG,CAAC,IAAI,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EACtE,kCAAkC,GAAG,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClF,CAAC,CAAC,KAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,4BAA4B,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,EAC3D,qBAAqB,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,CAAgE,CAAC;QAC9G,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACnF,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAC9E,CAAC,CAAC,KAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,EAChD,UAAU,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AACxI,CAAC;AAUD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,OAAuB,EAAE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/C,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAChB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvI,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@zanii/monitor",
+  "version": "0.1.0",
+  "description": "Independent Zanii log monitor: continuously verify the transparency log is append-only (consistency proofs) and that anchored checkpoints hold. Makes 'trust no one' operational.",
+  "license": "Apache-2.0",
+  "homepage": "https://ledger.zanii.agency",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "zanii-monitor": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.7.1",
+    "@zanii/core": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.9",
+    "@zanii/testing": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+/**
+ * zanii-monitor — watch a Zanii log for any append-only or anchoring violation.
+ *
+ *   zanii-monitor --server https://ledger.zanii.agency --interval 60 \
+ *     --state ./monitor.state --alert https://you/webhook
+ *   zanii-monitor --server https://ledger.zanii.agency --once     # exit 1 on violation
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { checkOnce, monitor, type MonitorResult, type MonitorState } from './index.js';
+
+const argOf = (name: string): string | undefined => {
+  const i = process.argv.indexOf(`--${name}`);
+  return i >= 0 ? process.argv[i + 1] : undefined;
+};
+const has = (name: string): boolean => process.argv.includes(`--${name}`);
+
+const server = argOf('server');
+if (!server) {
+  console.error('usage: zanii-monitor --server <url> [--interval <sec>] [--once] [--state <file>] [--alert <webhook-url>]');
+  process.exit(2);
+}
+const stateFile = argOf('state');
+const alertUrl = argOf('alert');
+
+const loadState = (): MonitorState | undefined => {
+  if (stateFile && existsSync(stateFile)) {
+    try { return JSON.parse(readFileSync(stateFile, 'utf8')) as MonitorState; } catch { /* ignore */ }
+  }
+  return undefined;
+};
+const saveState = (s: MonitorState): void => { if (stateFile) writeFileSync(stateFile, JSON.stringify(s)); };
+
+const line = (r: MonitorResult): string => {
+  const ts = new Date().toISOString();
+  return r.ok
+    ? `${ts}  OK  size=${r.size} root=${r.root.slice(0, 24)}… (${r.checks.length} checks passed)`
+    : `${ts}  VIOLATION  size=${r.size} :: ${r.violations.join(' ; ')}`;
+};
+
+const alert = async (r: MonitorResult): Promise<void> => {
+  if (!alertUrl) return;
+  try {
+    await fetch(alertUrl, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ source: 'zanii-monitor', server, ...r }),
+    });
+  } catch { /* best-effort */ }
+};
+
+if (has('once')) {
+  const r = await checkOnce(server, loadState());
+  console.log(line(r));
+  saveState(r.state);
+  if (!r.ok) { await alert(r); process.exit(1); }
+  process.exit(0);
+} else {
+  const interval = Number(argOf('interval') ?? '60') * 1000;
+  console.error(`zanii-monitor: watching ${server} every ${interval / 1000}s${alertUrl ? ` (alerting ${alertUrl})` : ''}`);
+  await monitor(server, {
+    intervalMs: interval,
+    initialState: loadState(),
+    onResult: (r) => { console.log(line(r)); saveState(r.state); },
+    onViolation: alert,
+  });
+}

package/src/index.ts

@@ -0,0 +1,131 @@
+/**
+ * @zanii/monitor — an independent watchdog for a Zanii transparency log.
+ *
+ * "Trust no one, including Zanii" is a claim until someone continuously checks it.
+ * This monitor does: it verifies each Signed Tree Head's signature, proves the log
+ * is **append-only** (a consistency proof from the last size it saw — a rewrite of
+ * past history fails this), and confirms every **anchored** checkpoint is still an
+ * append-only prefix of the current tree. Any violation is surfaced loudly.
+ *
+ * Run it as a library (`checkOnce`, `monitor`) or via the `zanii-monitor` CLI.
+ */
+import { hexToBytes } from '@noble/hashes/utils';
+import { verifyConsistency, verifySTH, type SignedTreeHead } from '@zanii/core';
+
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+/** Persist this between runs so an offline rewrite can't slip past. */
+export interface MonitorState {
+  size: number;
+  root: string;
+}
+
+export interface Check {
+  name: string;
+  ok: boolean;
+  detail?: string;
+}
+
+export interface MonitorResult {
+  ok: boolean;
+  size: number;
+  root: string;
+  checks: Check[];
+  violations: string[];
+  /** The verified head — persist this and pass as `prev` next time. */
+  state: MonitorState;
+}
+
+const toRoot = (s: string): Uint8Array => hexToBytes(s.replace('sha256:', ''));
+const short = (s: unknown): string => {
+  const t = String(s ?? '');
+  return t.length > 16 ? t.slice(0, 16) + '…' : t;
+};
+
+/**
+ * Run one integrity check. Pass the `state` returned last time as `prev` to prove
+ * the log only grew (never rewrote) since you last looked.
+ */
+export async function checkOnce(
+  server: string,
+  prev?: MonitorState,
+  fetchImpl: FetchLike = (u, i) => fetch(u, i),
+): Promise<MonitorResult> {
+  const base = server.replace(/\/$/, '');
+  const get = async (p: string): Promise<any> => {
+    const r = await fetchImpl(`${base}${p}`);
+    if (!r.ok) throw new Error(`${p} → ${r.status}`);
+    return r.json();
+  };
+
+  const checks: Check[] = [];
+  const violations: string[] = [];
+  const push = (name: string, ok: boolean, detail?: string) => {
+    checks.push({ name, ok, detail });
+    if (!ok) violations.push(detail ?? name);
+  };
+
+  const sth = (await get('/v1/sth')) as SignedTreeHead;
+  push('signed tree head signature', verifySTH(sth) && !!sth.log_id, 'STH signature invalid');
+
+  if (prev) {
+    if (sth.size < prev.size) {
+      push(`append-only (size ${sth.size} ≥ ${prev.size})`, false,
+        `log SHRANK: size ${sth.size} < previously seen ${prev.size}`);
+    } else if (sth.size === prev.size) {
+      push('append-only (root unchanged at same size)', sth.root === prev.root,
+        `root changed at unchanged size ${sth.size} — history was rewritten`);
+    } else {
+      const c = await get(`/v1/consistency?first=${prev.size}`);
+      const ok = verifyConsistency(prev.size, sth.size, toRoot(prev.root), toRoot(sth.root),
+        (c.proof as string[]).map(hexToBytes));
+      push(`append-only (consistency ${prev.size}→${sth.size})`, ok,
+        `consistency proof ${prev.size}→${sth.size} FAILED — history was rewritten`);
+    }
+  }
+
+  // Every anchored checkpoint must be an append-only prefix of the current tree.
+  try {
+    const { anchors } = (await get('/v1/anchors')) as { anchors?: Array<{ sth: SignedTreeHead; ref?: unknown }> };
+    for (const a of anchors ?? []) {
+      let ok = verifySTH(a.sth) && a.sth.log_id === sth.log_id && a.sth.size <= sth.size;
+      if (ok && a.sth.size < sth.size) {
+        const c = await get(`/v1/consistency?first=${a.sth.size}`);
+        ok = verifyConsistency(a.sth.size, sth.size, toRoot(a.sth.root), toRoot(sth.root),
+          (c.proof as string[]).map(hexToBytes));
+      }
+      push(`anchor ${short(a.ref)} valid + extended`, ok,
+        `anchor ${short(a.ref)}: invalid STH or current tree is not an append-only extension of it`);
+    }
+  } catch {
+    /* anchors endpoint optional */
+  }
+
+  return { ok: violations.length === 0, size: sth.size, root: sth.root, checks, violations, state: { size: sth.size, root: sth.root } };
+}
+
+export interface MonitorOptions {
+  intervalMs?: number;
+  fetchImpl?: FetchLike;
+  initialState?: MonitorState;
+  onResult?: (r: MonitorResult) => void | Promise<void>;
+  onViolation?: (r: MonitorResult) => void | Promise<void>;
+}
+
+/** Run forever, checking every `intervalMs` (default 60s). Never resolves. */
+export async function monitor(server: string, opts: MonitorOptions = {}): Promise<never> {
+  const interval = opts.intervalMs ?? 60_000;
+  const impl = opts.fetchImpl ?? ((u: string, i?: RequestInit) => fetch(u, i));
+  let state = opts.initialState;
+  for (;;) {
+    try {
+      const r = await checkOnce(server, state, impl);
+      state = r.state;
+      await opts.onResult?.(r);
+      if (!r.ok) await opts.onViolation?.(r);
+    } catch (e) {
+      await opts.onResult?.({ ok: false, size: -1, root: '', checks: [], violations: [String(e)], state: state ?? { size: 0, root: '' } });
+    }
+    await new Promise((res) => setTimeout(res, interval));
+  }
+}