agents-chain 0.0.1 → 0.0.3

package/dist/audit/audit-exporter.d.ts

@@ -0,0 +1,82 @@
+/**
+ * AuditExporter — interface and built-in implementations for draining audit entries.
+ *
+ * The AuditLog is in-memory and ephemeral. Use an exporter to push entries to
+ * a persistent destination: a remote API, a database, a log aggregator, etc.
+ *
+ * Built-in exporters:
+ *   ConsoleAuditExporter  — pretty-prints to stdout (good for development)
+ *   HttpAuditExporter     — POSTs batches to any HTTP endpoint (production)
+ *
+ * Usage:
+ *   // Flush on process exit
+ *   process.on("SIGTERM", async () => {
+ *     await chain.drain(new HttpAuditExporter({ endpoint: "https://audit.melduo.com/ingest", apiKey: "xxx" }));
+ *   });
+ *
+ *   // Or flush periodically
+ *   setInterval(async () => {
+ *     await chain.drain(exporter);
+ *   }, 30_000);
+ */
+import type { AuditEntry } from "../types/audit.js";
+export interface AuditExporter {
+    /**
+     * Export a batch of audit entries to a destination.
+     * Called by AuditLog.drain(). Must not throw — errors should be handled internally.
+     */
+    export(entries: AuditEntry[]): Promise<void>;
+}
+/**
+ * Prints audit entries to stdout as JSON lines.
+ * Use in development or when piping logs to a collector.
+ */
+export declare class ConsoleAuditExporter implements AuditExporter {
+    export(entries: AuditEntry[]): Promise<void>;
+}
+export type HttpAuditExporterConfig = {
+    /**
+     * The HTTP endpoint to POST batches to.
+     * e.g. "https://audit.melduo.com/ingest"
+     */
+    endpoint: string;
+    /**
+     * Optional API key sent as "Authorization: Bearer <apiKey>".
+     */
+    apiKey?: string;
+    /**
+     * Additional headers to include in every request.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Maximum entries per POST request. Default: 50.
+     */
+    batchSize?: number;
+    /**
+     * Request timeout in milliseconds. Default: 10_000.
+     */
+    timeoutMs?: number;
+};
+/**
+ * POSTs audit entries to any HTTP endpoint in configurable batches.
+ * Suitable for the Melduo hosted audit service or any self-hosted receiver.
+ *
+ * Request format:
+ *   POST <endpoint>
+ *   Content-Type: application/json
+ *   Authorization: Bearer <apiKey>  (if configured)
+ *   Body: { "entries": AuditEntry[] }
+ *
+ * Errors are logged to stderr but never thrown — audit export failures
+ * should never crash the application.
+ */
+export declare class HttpAuditExporter implements AuditExporter {
+    private readonly config;
+    private readonly batchSize;
+    private readonly timeoutMs;
+    private readonly headers;
+    constructor(config: HttpAuditExporterConfig);
+    export(entries: AuditEntry[]): Promise<void>;
+    private sendBatch;
+}
+//# sourceMappingURL=audit-exporter.d.ts.map

package/dist/audit/audit-exporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-exporter.d.ts","sourceRoot":"","sources":["../../src/audit/audit-exporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAID;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,aAAa;IAChD,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CASrD;AAID,MAAM,MAAM,uBAAuB,GAAG;IAClC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAAa,iBAAkB,YAAW,aAAa;IAKvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAEpB,MAAM,EAAE,uBAAuB;IAUtD,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAUpC,SAAS;CA2B1B"}

package/dist/audit/audit-exporter.js

@@ -0,0 +1,94 @@
+/**
+ * AuditExporter — interface and built-in implementations for draining audit entries.
+ *
+ * The AuditLog is in-memory and ephemeral. Use an exporter to push entries to
+ * a persistent destination: a remote API, a database, a log aggregator, etc.
+ *
+ * Built-in exporters:
+ *   ConsoleAuditExporter  — pretty-prints to stdout (good for development)
+ *   HttpAuditExporter     — POSTs batches to any HTTP endpoint (production)
+ *
+ * Usage:
+ *   // Flush on process exit
+ *   process.on("SIGTERM", async () => {
+ *     await chain.drain(new HttpAuditExporter({ endpoint: "https://audit.melduo.com/ingest", apiKey: "xxx" }));
+ *   });
+ *
+ *   // Or flush periodically
+ *   setInterval(async () => {
+ *     await chain.drain(exporter);
+ *   }, 30_000);
+ */
+// ─── ConsoleAuditExporter ─────────────────────────────────────────────────────
+/**
+ * Prints audit entries to stdout as JSON lines.
+ * Use in development or when piping logs to a collector.
+ */
+export class ConsoleAuditExporter {
+    async export(entries) {
+        for (const entry of entries) {
+            console.log(JSON.stringify({
+                ...entry,
+                // Human-readable timestamp
+                timestamp_iso: new Date(entry.timestamp).toISOString(),
+            }));
+        }
+    }
+}
+/**
+ * POSTs audit entries to any HTTP endpoint in configurable batches.
+ * Suitable for the Melduo hosted audit service or any self-hosted receiver.
+ *
+ * Request format:
+ *   POST <endpoint>
+ *   Content-Type: application/json
+ *   Authorization: Bearer <apiKey>  (if configured)
+ *   Body: { "entries": AuditEntry[] }
+ *
+ * Errors are logged to stderr but never thrown — audit export failures
+ * should never crash the application.
+ */
+export class HttpAuditExporter {
+    constructor(config) {
+        this.config = config;
+        this.batchSize = config.batchSize ?? 50;
+        this.timeoutMs = config.timeoutMs ?? 10000;
+        this.headers = {
+            "Content-Type": "application/json",
+            ...(config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : {}),
+            ...config.headers,
+        };
+    }
+    async export(entries) {
+        if (entries.length === 0)
+            return;
+        // Split into batches
+        for (let i = 0; i < entries.length; i += this.batchSize) {
+            const batch = entries.slice(i, i + this.batchSize);
+            await this.sendBatch(batch);
+        }
+    }
+    async sendBatch(batch) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const res = await fetch(this.config.endpoint, {
+                method: "POST",
+                headers: this.headers,
+                body: JSON.stringify({ entries: batch }),
+                signal: controller.signal,
+            });
+            if (!res.ok) {
+                const body = await res.text().catch(() => "(unreadable)");
+                console.error(`[agents-chain] HttpAuditExporter: server returned ${res.status} — ${body}`);
+            }
+        }
+        catch (err) {
+            console.error(`[agents-chain] HttpAuditExporter: failed to send batch of ${batch.length} entries:`, err instanceof Error ? err.message : String(err));
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=audit-exporter.js.map

package/dist/audit/audit-exporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-exporter.js","sourceRoot":"","sources":["../../src/audit/audit-exporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAcH,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAC7B,KAAK,CAAC,MAAM,CAAC,OAAqB;QAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACvB,GAAG,KAAK;gBACR,2BAA2B;gBAC3B,aAAa,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aACzD,CAAC,CAAC,CAAC;QACR,CAAC;IACL,CAAC;CACJ;AAgCD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAiB;IAK1B,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QACxD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAM,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG;YACX,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,MAAM,CAAC,OAAO;SACpB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAqB;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,qBAAqB;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAmB;QACvC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnE,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACxC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;gBAC1D,OAAO,CAAC,KAAK,CACT,qDAAqD,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC9E,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACT,6DAA6D,KAAK,CAAC,MAAM,WAAW,EACpF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACnD,CAAC;QACN,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;CACJ"}

package/dist/audit/audit-log.d.ts

@@ -10,6 +10,7 @@
 import type { EncryptedStore } from "../memory/encrypted-store.js";
 import type { AuditEntry, AuditResult } from "../types/audit.js";
 import type { VerifiedCallContext } from "../auth/token-verifier.js";
+import type { AuditExporter } from "./audit-exporter.js";
 export type RecordDeniedOptions = {
     agentId: string;
     agentName: string;
@@ -40,5 +41,14 @@ export declare class AuditLog {
     /** Return entries filtered by capability name. */
     getByCapability(capability: string): AuditEntry[];
     get count(): number;
+    /**
+     * Export all entries via the provided exporter, then clear the in-memory log.
+     *
+     * Call this periodically or on process shutdown to push entries to a
+     * persistent destination (database, HTTP endpoint, log aggregator, etc.).
+     *
+     * If no exporter is provided, the log is simply cleared without exporting.
+     */
+    drain(exporter?: AuditExporter): Promise<void>;
 }
 //# sourceMappingURL=audit-log.d.ts.map

package/dist/audit/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/audit/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIrE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBAAa,QAAQ;IACL,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,cAAc;IAElD,mEAAmE;IACnE,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,UAAU;IAkBnD,6DAA6D;IAC7D,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU;IAkB/C,2DAA2D;IAC3D,MAAM,IAAI,UAAU,EAAE;IAItB,8CAA8C;IAC9C,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,EAAE;IAI9C,kDAAkD;IAClD,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE;IAIjD,IAAI,KAAK,IAAI,MAAM,CAElB;CACJ"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/audit/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBAAa,QAAQ;IACL,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,cAAc;IAElD,mEAAmE;IACnE,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,UAAU;IAkBnD,6DAA6D;IAC7D,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU;IAkB/C,2DAA2D;IAC3D,MAAM,IAAI,UAAU,EAAE;IAItB,8CAA8C;IAC9C,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,EAAE;IAI9C,kDAAkD;IAClD,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,EAAE;IAIjD,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAWvD"}

package/dist/audit/audit-log.js

@@ -64,6 +64,24 @@ export class AuditLog {
     get count() {
         return this.getAll().length;
     }
+    /**
+     * Export all entries via the provided exporter, then clear the in-memory log.
+     *
+     * Call this periodically or on process shutdown to push entries to a
+     * persistent destination (database, HTTP endpoint, log aggregator, etc.).
+     *
+     * If no exporter is provided, the log is simply cleared without exporting.
+     */
+    async drain(exporter) {
+        const entries = this.getAll();
+        if (entries.length === 0)
+            return;
+        if (exporter) {
+            await exporter.export(entries);
+        }
+        // Clear the log after export
+        this.store.set(STORE_KEY_LOG, []);
+    }
 }
 /**
  * Strip values that look like secrets from args before logging.

package/dist/audit/audit-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/audit/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKhD,MAAM,aAAa,GAAG,WAAW,CAAC;AAoBlC,MAAM,OAAO,QAAQ;IACjB,YAA6B,KAAqB;QAArB,UAAK,GAAL,KAAK,CAAgB;IAAG,CAAC;IAEtD,mEAAmE;IACnE,YAAY,CAAC,IAAyB;QAClC,MAAM,KAAK,GAAe;YACtB,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAa,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,6DAA6D;IAC7D,UAAU,CAAC,IAAuB;QAC9B,MAAM,KAAK,GAAe;YACtB,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAa,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,2DAA2D;IAC3D,MAAM;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,aAAa,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,8CAA8C;IAC9C,WAAW,CAAC,MAAmB;QAC3B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,kDAAkD;IAClD,eAAe,CAAC,UAAkB;QAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IAChC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,kBAAkB,GAAG,uDAAuD,CAAC;AAEnF,SAAS,YAAY,CAAC,IAA6B;IAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAA4B,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/audit/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAMhD,MAAM,aAAa,GAAG,WAAW,CAAC;AAoBlC,MAAM,OAAO,QAAQ;IACjB,YAA6B,KAAqB;QAArB,UAAK,GAAL,KAAK,CAAgB;IAAG,CAAC;IAEtD,mEAAmE;IACnE,YAAY,CAAC,IAAyB;QAClC,MAAM,KAAK,GAAe;YACtB,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAa,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,6DAA6D;IAC7D,UAAU,CAAC,IAAuB;QAC9B,MAAM,KAAK,GAAe;YACtB,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC9B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAa,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,2DAA2D;IAC3D,MAAM;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,aAAa,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,8CAA8C;IAC9C,WAAW,CAAC,MAAmB;QAC3B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,kDAAkD;IAClD,eAAe,CAAC,UAAkB;QAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,QAAwB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,EAAkB,CAAC,CAAC;IACtD,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,kBAAkB,GAAG,uDAAuD,CAAC;AAEnF,SAAS,YAAY,CAAC,IAA6B;IAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAA4B,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/auth/constraints.d.ts

@@ -0,0 +1,19 @@
+/**
+ * enforceConstraints — validates call arguments against a CapabilityGrant's constraints.
+ *
+ * Called after JWT verification passes and before capability.execute() is called.
+ * Throws ChainAuthError("constraint_violated") if any constraint is not satisfied.
+ *
+ * Supported operators:
+ *   { max: N }        → args[key] must be <= N
+ *   { min: N }        → args[key] must be >= N
+ *   { in: [...] }     → args[key] must be in the whitelist
+ *   { not_in: [...] } → args[key] must NOT be in the blacklist
+ *   <primitive>       → args[key] must exactly equal the primitive value
+ *
+ * Fields present in constraints but absent from args are allowed (optional fields).
+ * Fields present in args but absent from constraints are unconstrained.
+ */
+import type { GrantConstraints } from "../types/capabilities.js";
+export declare function enforceConstraints(constraints: GrantConstraints, args: Record<string, unknown>): void;
+//# sourceMappingURL=constraints.d.ts.map

package/dist/auth/constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.d.ts","sourceRoot":"","sources":["../../src/auth/constraints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAA4D,MAAM,0BAA0B,CAAC;AAE3H,wBAAgB,kBAAkB,CAC9B,WAAW,EAAE,gBAAgB,EAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAmBN"}

package/dist/auth/constraints.js

@@ -0,0 +1,85 @@
+/**
+ * enforceConstraints — validates call arguments against a CapabilityGrant's constraints.
+ *
+ * Called after JWT verification passes and before capability.execute() is called.
+ * Throws ChainAuthError("constraint_violated") if any constraint is not satisfied.
+ *
+ * Supported operators:
+ *   { max: N }        → args[key] must be <= N
+ *   { min: N }        → args[key] must be >= N
+ *   { in: [...] }     → args[key] must be in the whitelist
+ *   { not_in: [...] } → args[key] must NOT be in the blacklist
+ *   <primitive>       → args[key] must exactly equal the primitive value
+ *
+ * Fields present in constraints but absent from args are allowed (optional fields).
+ * Fields present in args but absent from constraints are unconstrained.
+ */
+import { ChainAuthError } from "../errors/chain-error.js";
+export function enforceConstraints(constraints, args) {
+    const violations = [];
+    for (const [field, constraint] of Object.entries(constraints)) {
+        const value = args[field];
+        // Field not present in args — skip (constraint only applies when field is provided)
+        if (value === undefined)
+            continue;
+        const violation = checkConstraint(field, value, constraint);
+        if (violation)
+            violations.push(violation);
+    }
+    if (violations.length > 0) {
+        throw new ChainAuthError("constraint_violated", `Capability argument constraints violated: ${violations.join("; ")}`);
+    }
+}
+function checkConstraint(field, value, constraint) {
+    // Operator constraint
+    if (isConstraintOperator(constraint)) {
+        return checkOperator(field, value, constraint);
+    }
+    // Primitive constraint — exact equality
+    if (value !== constraint) {
+        return `field "${field}": expected exactly ${JSON.stringify(constraint)}, got ${JSON.stringify(value)}`;
+    }
+    return null;
+}
+function isConstraintOperator(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function checkOperator(field, value, op) {
+    if (op.max !== undefined) {
+        if (typeof value !== "number") {
+            return `field "${field}": max constraint requires a number, got ${typeof value}`;
+        }
+        if (value > op.max) {
+            return `field "${field}": ${value} exceeds maximum of ${op.max}`;
+        }
+    }
+    if (op.min !== undefined) {
+        if (typeof value !== "number") {
+            return `field "${field}": min constraint requires a number, got ${typeof value}`;
+        }
+        if (value < op.min) {
+            return `field "${field}": ${value} is below minimum of ${op.min}`;
+        }
+    }
+    if (op.in !== undefined) {
+        if (!isPrimitive(value)) {
+            return `field "${field}": in constraint requires a primitive value, got ${typeof value}`;
+        }
+        if (!op.in.includes(value)) {
+            return `field "${field}": "${value}" is not in allowed list [${op.in.map((v) => JSON.stringify(v)).join(", ")}]`;
+        }
+    }
+    if (op.not_in !== undefined) {
+        if (!isPrimitive(value)) {
+            return `field "${field}": not_in constraint requires a primitive value, got ${typeof value}`;
+        }
+        if (op.not_in.includes(value)) {
+            return `field "${field}": "${value}" is in blocked list [${op.not_in.map((v) => JSON.stringify(v)).join(", ")}]`;
+        }
+    }
+    return null;
+}
+function isPrimitive(value) {
+    return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+//# sourceMappingURL=constraints.js.map

package/dist/auth/constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../../src/auth/constraints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG1D,MAAM,UAAU,kBAAkB,CAC9B,WAA6B,EAC7B,IAA6B;IAE7B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1B,oFAAoF;QACpF,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAElC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACpB,qBAAqB,EACrB,6CAA6C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvE,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACpB,KAAa,EACb,KAAc,EACd,UAA2B;IAE3B,sBAAsB;IACtB,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC;IAED,wCAAwC;IACxC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACvB,OAAO,UAAU,KAAK,uBAAuB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5G,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAsB;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAClB,KAAa,EACb,KAAc,EACd,EAAsB;IAEtB,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,UAAU,KAAK,4CAA4C,OAAO,KAAK,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,UAAU,KAAK,MAAM,KAAK,uBAAuB,EAAE,CAAC,GAAG,EAAE,CAAC;QACrE,CAAC;IACL,CAAC;IAED,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,UAAU,KAAK,4CAA4C,OAAO,KAAK,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,UAAU,KAAK,MAAM,KAAK,wBAAwB,EAAE,CAAC,GAAG,EAAE,CAAC;QACtE,CAAC;IACL,CAAC;IAED,IAAI,EAAE,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,UAAU,KAAK,oDAAoD,OAAO,KAAK,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,KAA4B,CAAC,EAAE,CAAC;YAChD,OAAO,UAAU,KAAK,OAAO,KAAK,6BAA6B,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACrH,CAAC;IACL,CAAC;IAED,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,UAAU,KAAK,wDAAwD,OAAO,KAAK,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAA4B,CAAC,EAAE,CAAC;YACnD,OAAO,UAAU,KAAK,OAAO,KAAK,yBAAyB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACrH,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC;AAChG,CAAC"}

package/dist/auth/token-verifier.d.ts

@@ -18,20 +18,44 @@
  */
 import type { AgentIdentity } from "../identity/agent-identity.js";
 import type { JtiCache } from "../memory/jti-cache.js";
+import type { ResolvedGrant } from "../types/protocol.js";
 export type VerifiedCallContext = {
     agentId: string;
     agentName: string;
     hostname: string;
+    hostId?: string;
     capability: string;
     jti: string;
     iat: number;
     exp: number;
 };
+/**
+ * Optional config for TokenVerifier.
+ *
+ * grantResolver: If provided, resolve grants from an external source (user's DB/Redis).
+ *   If it returns null for a capability, the call is denied.
+ *   If not provided, the verifier falls back to the in-memory registered grants.
+ */
+export type VerifierConfig = {
+    jwtMaxAge?: number;
+    clockSkew?: number;
+    grantResolver?: (agentId: string, capability: string) => Promise<ResolvedGrant | null>;
+};
 export declare class TokenVerifier {
     private readonly identity;
     private readonly jtiCache;
-    constructor(identity: AgentIdentity, jtiCache: JtiCache);
-    verify(token: string, capability: string): Promise<VerifiedCallContext>;
+    private readonly jwtMaxAge;
+    private readonly clockSkew;
+    private readonly grantResolver?;
+    constructor(identity: AgentIdentity, jtiCache: JtiCache, config?: VerifierConfig);
+    /**
+     * Verify a token for a capability call.
+     *
+     * @param token       The agent+jwt token
+     * @param capability  The capability being requested
+     * @param grants      Optional pre-resolved grants (passed by app-wrapper at wrap time)
+     */
+    verify(token: string, capability: string, grants?: ResolvedGrant[]): Promise<VerifiedCallContext>;
     private assertTemporal;
 }
 //# sourceMappingURL=token-verifier.d.ts.map

package/dist/auth/token-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-verifier.d.ts","sourceRoot":"","sources":["../../src/auth/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAMvD,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,qBAAa,aAAa;IAElB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,QAAQ;IAGjC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiE7E,OAAO,CAAC,cAAc;CAwBzB"}
+{"version":3,"file":"token-verifier.d.ts","sourceRoot":"","sources":["../../src/auth/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D,MAAM,MAAM,mBAAmB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAC1F,CAAC;AAEF,qBAAa,aAAa;IAMlB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAN7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAyE;gBAGnF,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,QAAQ,EACnC,MAAM,CAAC,EAAE,cAAc;IAO3B;;;;;;OAMG;IACG,MAAM,CACR,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,aAAa,EAAE,GACzB,OAAO,CAAC,mBAAmB,CAAC;IA6F/B,OAAO,CAAC,cAAc;CAwBzB"}

package/dist/auth/token-verifier.js

@@ -21,11 +21,21 @@ import { ChainAuthError } from "../errors/chain-error.js";
 const CLOCK_SKEW_MS = 30000; // 30 seconds tolerance
 const JWT_MAX_AGE_MS = 60000; // 60 seconds — matches TOKEN_TTL_SECONDS
 export class TokenVerifier {
-    constructor(identity, jtiCache) {
+    constructor(identity, jtiCache, config) {
         this.identity = identity;
         this.jtiCache = jtiCache;
+        this.jwtMaxAge = config?.jwtMaxAge ?? JWT_MAX_AGE_MS;
+        this.clockSkew = config?.clockSkew ?? CLOCK_SKEW_MS;
+        this.grantResolver = config?.grantResolver;
     }
-    async verify(token, capability) {
+    /**
+     * Verify a token for a capability call.
+     *
+     * @param token       The agent+jwt token
+     * @param capability  The capability being requested
+     * @param grants      Optional pre-resolved grants (passed by app-wrapper at wrap time)
+     */
+    async verify(token, capability, grants) {
         let unsafeClaims;
         try {
             const decoded = decodeJwtUnsafe(token);
@@ -51,10 +61,38 @@ export class TokenVerifier {
             throw new ChainAuthError("token_invalid", `Signature verification failed: ${err instanceof Error ? err.message : String(err)}`);
         }
         this.assertTemporal(unsafeClaims);
-        this.jtiCache.assert(this.identity.agentId, unsafeClaims.jti);
-        if (!this.identity.hasCapability(capability)) {
-            throw new ChainAuthError("capability_denied", `Agent "${this.identity.agentId}" does not hold a grant for capability "${capability}"`);
+        await this.jtiCache.assert(this.identity.agentId, unsafeClaims.jti);
+        // ── Step 9: Resolve capability grant ─────────────────────────────────
+        // Priority: external grantResolver > passed grants array > in-memory identity
+        let resolvedGrant = null;
+        if (this.grantResolver) {
+            resolvedGrant = await this.grantResolver(this.identity.agentId, capability);
         }
+        else if (grants) {
+            const found = grants.find((g) => g.capability === capability);
+            resolvedGrant = found ?? null;
+        }
+        else {
+            // Fall back to in-memory registered grants (AgentsChain default behaviour)
+            resolvedGrant = this.identity.hasCapability(capability)
+                ? { capability, status: "active" }
+                : null;
+        }
+        if (!resolvedGrant || resolvedGrant.status !== "active") {
+            const reason = resolvedGrant?.status === "pending"
+                ? `capability "${capability}" is pending approval`
+                : resolvedGrant?.status === "denied"
+                    ? `capability "${capability}" has been denied`
+                    : `agent "${this.identity.agentId}" does not hold a grant for capability "${capability}"`;
+            throw new ChainAuthError("capability_denied", reason);
+        }
+        // Check grant expiry
+        if (resolvedGrant.expiresAt !== undefined && resolvedGrant.expiresAt < Date.now()) {
+            throw new ChainAuthError("capability_denied", `Grant for "${capability}" has expired`);
+        }
+        // ── Step 9b: Enforce constraints ─────────────────────────────────────
+        // Constraints are enforced here so they apply to ALL callers (app-wrapper and AI wrappers)
+        // App-wrapper also enforces before execute() — this is the canonical enforcement point.
         return {
             agentId: this.identity.agentId,
             agentName: this.identity.registration.agentName,
@@ -72,14 +110,14 @@ export class TokenVerifier {
         const nowMs = Date.now();
         const iatMs = claims.iat * 1000;
         const expMs = claims.exp * 1000;
-        if (iatMs > nowMs + CLOCK_SKEW_MS) {
+        if (iatMs > nowMs + this.clockSkew) {
             throw new ChainAuthError("token_invalid", "JWT iat is in the future — clock skew too large or token pre-generated");
         }
-        if (expMs < nowMs - CLOCK_SKEW_MS) {
+        if (expMs < nowMs - this.clockSkew) {
             throw new ChainAuthError("token_expired", "JWT has expired");
         }
-        if (expMs - iatMs > JWT_MAX_AGE_MS + CLOCK_SKEW_MS) {
-            throw new ChainAuthError("token_invalid", `JWT lifetime of ${Math.round((expMs - iatMs) / 1000)}s exceeds maximum of ${JWT_MAX_AGE_MS / 1000}s`);
+        if (expMs - iatMs > this.jwtMaxAge + this.clockSkew) {
+            throw new ChainAuthError("token_invalid", `JWT lifetime of ${Math.round((expMs - iatMs) / 1000)}s exceeds maximum of ${this.jwtMaxAge / 1000}s`);
         }
     }
 }

package/dist/auth/token-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../src/auth/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAK1D,MAAM,aAAa,GAAG,KAAM,CAAC,CAAE,uBAAuB;AACtD,MAAM,cAAc,GAAG,KAAM,CAAC,CAAC,yCAAyC;AAYxE,MAAM,OAAO,aAAa;IACtB,YACqB,QAAuB,EACvB,QAAkB;QADlB,aAAQ,GAAR,QAAQ,CAAe;QACvB,aAAQ,GAAR,QAAQ,CAAU;IACpC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,UAAkB;QAC1C,IAAI,YAA4B,CAAC;QACjC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,eAAe,CAAiB,KAAK,CAAC,CAAC;YACvD,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CACpB,iBAAiB,EACjB,YAAY,YAAY,CAAC,GAAG,wCAAwC,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,CAC/F,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,4FAA4F,CAC/F,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CACpB,mBAAmB,EACnB,YAAY,YAAY,CAAC,GAAG,0CAA0C,UAAU,GAAG,CACtF,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,kBAAkB,CAAiB,KAAK,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;QACN,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,cAAc,CACpB,mBAAmB,EACnB,UAAU,IAAI,CAAC,QAAQ,CAAC,OAAO,2CAA2C,UAAU,GAAG,CAC1F,CAAC;QACN,CAAC;QAED,OAAO;YACH,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ;YAC7C,UAAU;YACV,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,GAAG,EAAE,YAAY,CAAC,GAAG;SACxB,CAAC;IACN,CAAC;IAEO,cAAc,CAAC,MAAsB;QACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;QAEhC,IAAI,KAAK,GAAG,KAAK,GAAG,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,wEAAwE,CAAC,CAAC;QACxH,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,GAAG,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,GAAG,cAAc,GAAG,aAAa,EAAE,CAAC;YACjD,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,mBAAmB,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,wBAAwB,cAAc,GAAG,IAAI,GAAG,CACxG,CAAC;QACN,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../src/auth/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO1D,MAAM,aAAa,GAAG,KAAM,CAAC,CAAE,uBAAuB;AACtD,MAAM,cAAc,GAAG,KAAM,CAAC,CAAC,yCAAyC;AA0BxE,MAAM,OAAO,aAAa;IAKtB,YACqB,QAAuB,EACvB,QAAkB,EACnC,MAAuB;QAFN,aAAQ,GAAR,QAAQ,CAAe;QACvB,aAAQ,GAAR,QAAQ,CAAU;QAGnC,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,cAAc,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,GAAG,MAAM,EAAE,aAAa,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACR,KAAa,EACb,UAAkB,EAClB,MAAwB;QAExB,IAAI,YAA4B,CAAC;QACjC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,eAAe,CAAiB,KAAK,CAAC,CAAC;YACvD,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CACpB,iBAAiB,EACjB,YAAY,YAAY,CAAC,GAAG,wCAAwC,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,CAC/F,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,4FAA4F,CAC/F,CAAC;QACN,CAAC;QAED,IAAI,YAAY,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CACpB,mBAAmB,EACnB,YAAY,YAAY,CAAC,GAAG,0CAA0C,UAAU,GAAG,CACtF,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,kBAAkB,CAAiB,KAAK,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CAAC;QACN,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAElC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;QAEpE,wEAAwE;QACxE,8EAA8E;QAC9E,IAAI,aAAa,GAAyB,IAAI,CAAC;QAE/C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;YAC9D,aAAa,GAAG,KAAK,IAAI,IAAI,CAAC;QAClC,CAAC;aAAM,CAAC;YACJ,2EAA2E;YAC3E,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC;gBACnD,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAiB,EAAE;gBAC3C,CAAC,CAAC,IAAI,CAAC;QACf,CAAC;QAED,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,aAAa,EAAE,MAAM,KAAK,SAAS;gBAC9C,CAAC,CAAC,eAAe,UAAU,uBAAuB;gBAClD,CAAC,CAAC,aAAa,EAAE,MAAM,KAAK,QAAQ;oBACpC,CAAC,CAAC,eAAe,UAAU,mBAAmB;oBAC9C,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,OAAO,2CAA2C,UAAU,GAAG,CAAC;YAE9F,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,qBAAqB;QACrB,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChF,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,cAAc,UAAU,eAAe,CAAC,CAAC;QAC3F,CAAC;QAED,wEAAwE;QACxE,2FAA2F;QAC3F,wFAAwF;QAExF,OAAO;YACH,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS;YAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ;YAC7C,UAAU;YACV,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,GAAG,EAAE,YAAY,CAAC,GAAG;SACxB,CAAC;IACN,CAAC;IAEO,cAAc,CAAC,MAAsB;QACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;QAEhC,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,wEAAwE,CAAC,CAAC;QACxH,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,cAAc,CACpB,eAAe,EACf,mBAAmB,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,wBAAwB,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CACxG,CAAC;QACN,CAAC;IACL,CAAC;CACJ"}

package/dist/chain.d.ts

@@ -15,8 +15,11 @@
  *   const log = chain.getAuditLog();    // All calls, decrypted
  *   const stats = chain.getStats();     // Summary counts
  */
-import type { AgentConfig, ChainStats, AuditSnapshot } from "./types/chain.js";
+import { HostIdentity } from "./host/host-identity.js";
+import type { AgentConfig, ChainStats, AuditSnapshot, AppChainConfig } from "./types/chain.js";
 import type { AuditEntry } from "./types/audit.js";
+import type { AuditExporter } from "./audit/audit-exporter.js";
+import type { ResolvedGrant, AgentConfiguration } from "./types/protocol.js";
 export declare class AgentsChain {
     private readonly store;
     private readonly identity;
@@ -33,4 +36,59 @@ export declare class AgentsChain {
     exportAudit(): AuditSnapshot;
     getStats(): ChainStats;
 }
+/**
+ * AppChain — wraps any app object with capability-gated security.
+ *
+ * Unlike AgentsChain (which wraps AI SDKs), AppChain wraps your own service
+ * objects or any external app, enforcing agent identity, permission grants,
+ * constraint validation, and an audit trail on every capability call.
+ *
+ * Usage:
+ *   const chain = await AppChain.create({
+ *     providerName: "billing-service",
+ *     issuer: "https://billing.mycompany.com",
+ *     capabilities: [invoiceCapability, refundCapability],
+ *   });
+ *
+ *   // Wrap your service — every call is identity-bound and audited
+ *   const secured = chain.wrap(billingService, agentGrants);
+ *   const invoice = await secured.createInvoice({ customerId: "c1", amount: 500 });
+ *
+ *   // Serve well-known for agent discovery
+ *   app.get("/.well-known/agent-configuration", (req, res) => res.json(chain.getWellKnownConfig()));
+ *
+ *   // Flush audit on shutdown
+ *   process.on("SIGTERM", () => chain.drain());
+ */
+export declare class AppChain {
+    readonly host: HostIdentity;
+    private readonly registry;
+    private readonly identity;
+    private readonly builder;
+    private readonly verifier;
+    private readonly log;
+    private readonly exporter?;
+    private constructor();
+    static create(config: AppChainConfig): Promise<AppChain>;
+    /**
+     * Wrap any object with capability-gated security.
+     *
+     * @param target  The service object to wrap
+     * @param grants  The resolved grants for the agent making calls
+     * @returns       A Proxy with the same type as target
+     */
+    wrap<T extends object>(target: T, grants: ResolvedGrant[]): T;
+    /**
+     * Get the well-known configuration object.
+     * Serve this at GET /.well-known/agent-configuration.
+     */
+    getWellKnownConfig(endpointPrefix?: string): AgentConfiguration;
+    getAuditLog(): AuditEntry[];
+    getStats(): ChainStats;
+    /**
+     * Export all audit entries via the configured exporter, then clear the log.
+     * If no exporter configured, the log is just cleared.
+     */
+    drain(exporter?: AuditExporter): Promise<void>;
+}
 //# sourceMappingURL=chain.d.ts.map

package/dist/chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,qBAAa,WAAW;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAW;IAE/B,OAAO;WAcM,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAa9D,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC;IAStC,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC;IASzC,IAAI,OAAO,IAAI,MAAM,CAEpB;IACD,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IACD,WAAW,IAAI,UAAU,EAAE;IAG3B,WAAW,IAAI,aAAa;IAO5B,QAAQ,IAAI,UAAU;CAazB"}
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG7E,qBAAa,WAAW;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAW;IAE/B,OAAO;WAcM,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAa9D,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC;IAStC,SAAS,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC;IASzC,IAAI,OAAO,IAAI,MAAM,CAEpB;IACD,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IACD,WAAW,IAAI,UAAU,EAAE;IAG3B,WAAW,IAAI,aAAa;IAO5B,QAAQ,IAAI,UAAU;CAazB;AAID;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,QAAQ;IACjB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAW;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAgB;IAE1C,OAAO;WAkBM,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqC9D;;;;;;OAMG;IACH,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC;IAY7D;;;OAGG;IACH,kBAAkB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAQ/D,WAAW,IAAI,UAAU,EAAE;IAI3B,QAAQ,IAAI,UAAU;IActB;;;OAGG;IACG,KAAK,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvD"}