auditreach-cli 0.1.0

package/dist/commands/search.js

@@ -0,0 +1,112 @@
+import { writeFile } from "node:fs/promises";
+import { RedditClient, MAX_LIMIT as REDDIT_MAX_LIMIT } from "../clients/reddit-client.js";
+import { YoutubeClient, MAX_MAX_RESULTS as YOUTUBE_MAX_MAX_RESULTS, } from "../clients/youtube-client.js";
+import { getRedditCredentials, getYoutubeCredentials } from "../auth/credential-store.js";
+import { appendAuditLogEntry, getLastEntryHash } from "../audit-log/hash-chain-writer.js";
+import { credentialFingerprint, generateEntryId } from "../util/crypto.js";
+export async function runSearchCommand(args) {
+    let outcome;
+    let fingerprintSource;
+    if (args.platform === "reddit") {
+        const credentials = getRedditCredentials();
+        if (!credentials) {
+            console.error('No Reddit credentials found. Run "auditreach auth --platform reddit" first.');
+            process.exitCode = 1;
+            return;
+        }
+        if (!args.query) {
+            console.error('Reddit search requires --query "<search terms>".');
+            process.exitCode = 1;
+            return;
+        }
+        const client = new RedditClient(credentials);
+        outcome = await client.search({
+            query: args.query,
+            subreddit: args.subreddit,
+            limit: args.maxResults,
+            before: args.before,
+            after: args.after,
+        });
+        fingerprintSource = credentials.clientSecret;
+    }
+    else {
+        const credentials = getYoutubeCredentials();
+        if (!credentials) {
+            console.error('No YouTube credentials found. Run "auditreach auth --platform youtube" first.');
+            process.exitCode = 1;
+            return;
+        }
+        const client = new YoutubeClient(credentials);
+        outcome = await client.search({
+            query: args.query,
+            channelHandle: args.channel,
+            since: args.since,
+            maxResults: args.maxResults,
+        });
+        fingerprintSource = credentials.apiKey;
+    }
+    printResults(outcome);
+    const outputPath = args.output ?? defaultOutputPath();
+    await writeFile(outputPath, JSON.stringify(outcome.items, null, 2), "utf8");
+    const prevHash = await getLastEntryHash();
+    const entry = await appendAuditLogEntry({
+        entry_id: generateEntryId(),
+        timestamp: new Date().toISOString(),
+        platform: outcome.platform,
+        endpoint: outcome.endpoint,
+        query_params: outcome.queryParams,
+        auth_scope: outcome.authScope,
+        consent_basis: outcome.consentBasis,
+        api_key_fingerprint: `sha256:${credentialFingerprint(fingerprintSource)}`,
+        results_returned: outcome.items.length,
+        prev_entry_hash: prevHash,
+    });
+    console.log(`\nAudit log entry written: ${entry.entry_id}`);
+    console.log(`Consent basis: ${entry.consent_basis}`);
+    console.log(`Full results: ${outputPath}`);
+    console.log(`Full audit trail: ./auditreach.log.jsonl`);
+}
+function defaultOutputPath() {
+    const date = new Date().toISOString().slice(0, 10);
+    return `./auditreach-results-${date}.json`;
+}
+function printResults(outcome) {
+    console.log(`\nAuditReach v0.1 -- Official-API Research CLI`);
+    console.log(`Platform: ${capitalize(outcome.platform)}  |  Auth: ${outcome.authScope}`);
+    console.log(`\nFetching... (official API, rate-limit aware)`);
+    console.log(`✓ ${outcome.items.length} results returned (${outcome.consentBasis})\n`);
+    console.log(`RESULTS (${outcome.items.length})`);
+    outcome.items.slice(0, 10).forEach((item, i) => {
+        console.log(`[${i + 1}] "${item.title}"`);
+        console.log(`    ${item.author ?? "unknown"} · ${item.createdAt}`);
+        console.log(`    ${item.url}`);
+    });
+    if (outcome.items.length > 10) {
+        console.log(`... and ${outcome.items.length - 10} more (see output file)`);
+    }
+    if (outcome.nextCursor?.after) {
+        console.log(`\nNext page: rerun with --after ${outcome.nextCursor.after}`);
+    }
+    if (outcome.nextCursor?.before) {
+        console.log(`Previous page: rerun with --before ${outcome.nextCursor.before}`);
+    }
+    warnIfTruncated(outcome);
+}
+function warnIfTruncated(outcome) {
+    const appliedLimit = outcome.platform === "reddit" ? outcome.queryParams.limit : outcome.queryParams.maxResults;
+    if (typeof appliedLimit !== "number" || outcome.items.length < appliedLimit) {
+        return;
+    }
+    const cap = outcome.platform === "reddit" ? REDDIT_MAX_LIMIT : YOUTUBE_MAX_MAX_RESULTS;
+    const platformName = capitalize(outcome.platform);
+    if (appliedLimit < cap) {
+        console.error(`\nWarning: returned exactly ${outcome.items.length} results, the limit applied for this search -- more results may exist. Pass --max-results <n> (up to ${cap} for ${platformName}) to request more.`);
+    }
+    else {
+        console.error(`\nWarning: returned exactly ${outcome.items.length} results, ${platformName}'s per-request maximum -- more results may exist beyond what a single search call can return.`);
+    }
+}
+function capitalize(value) {
+    return value.charAt(0).toUpperCase() + value.slice(1);
+}
+//# sourceMappingURL=search.js.map

package/dist/commands/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../src/commands/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EACL,aAAa,EACb,eAAe,IAAI,uBAAuB,GAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAe3E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAuB;IAC5D,IAAI,OAAsB,CAAC;IAC3B,IAAI,iBAAyB,CAAC;IAE9B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;YAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;QAC7C,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,UAAU;YACtB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,iBAAiB,GAAG,WAAW,CAAC,YAAY,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,qBAAqB,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,KAAK,CACX,+EAA+E,CAChF,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,OAAO,CAAC,CAAC;IAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACtD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAE5E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;QACtC,QAAQ,EAAE,eAAe,EAAE;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,mBAAmB,EAAE,UAAU,qBAAqB,CAAC,iBAAiB,CAAC,EAAE;QACzE,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QACtC,eAAe,EAAE,QAAQ;KAC1B,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,wBAAwB,IAAI,OAAO,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,OAAsB;IAC1C,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,aAAa,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,sBAAsB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,SAAS,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB;IAC7C,MAAM,YAAY,GAChB,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;IAC7F,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACvF,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,+BAA+B,OAAO,CAAC,KAAK,CAAC,MAAM,wGAAwG,GAAG,QAAQ,YAAY,oBAAoB,CACvM,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CACX,+BAA+B,OAAO,CAAC,KAAK,CAAC,MAAM,aAAa,YAAY,+FAA+F,CAC5K,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/commands/verify-log.d.ts

@@ -0,0 +1,5 @@
+export interface VerifyLogCommandArgs {
+    path?: string;
+}
+export declare function runVerifyLogCommand(args: VerifyLogCommandArgs): Promise<void>;
+//# sourceMappingURL=verify-log.d.ts.map

package/dist/commands/verify-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-log.d.ts","sourceRoot":"","sources":["../../src/commands/verify-log.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnF"}

package/dist/commands/verify-log.js

@@ -0,0 +1,19 @@
+import { verifyAuditLogChain } from "../audit-log/chain-verifier.js";
+import { DEFAULT_AUDIT_LOG_PATH } from "../audit-log/hash-chain-writer.js";
+export async function runVerifyLogCommand(args) {
+    const logPath = args.path ?? DEFAULT_AUDIT_LOG_PATH;
+    console.log(`Verifying ${logPath}...`);
+    const result = await verifyAuditLogChain(logPath);
+    if (result.totalEntries === 0) {
+        console.log("No entries yet -- nothing to verify.");
+        return;
+    }
+    if (result.valid) {
+        console.log(`✓ Chain intact: ${result.totalEntries} entries, no gaps, no tampering detected.`);
+    }
+    else {
+        console.error(`✗ Chain broken at entry ${result.brokenAtIndex} (${result.brokenAtEntryId ?? "unknown"}): ${result.reason}`);
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=verify-log.js.map

package/dist/commands/verify-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-log.js","sourceRoot":"","sources":["../../src/commands/verify-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAM3E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA0B;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,KAAK,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,2CAA2C,CAAC,CAAC;IACjG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CACX,2BAA2B,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,eAAe,IAAI,SAAS,MAAM,MAAM,CAAC,MAAM,EAAE,CAC7G,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { RedditClient } from "./clients/reddit-client.js";
+export { YoutubeClient } from "./clients/youtube-client.js";
+export { getCredential, setCredential, deleteCredential, getRedditCredentials, getYoutubeCredentials, } from "./auth/credential-store.js";
+export { appendAuditLogEntry, getLastEntryHash, computeEntryHash, DEFAULT_AUDIT_LOG_PATH, } from "./audit-log/hash-chain-writer.js";
+export { verifyAuditLogChain } from "./audit-log/chain-verifier.js";
+export { credentialFingerprint, canonicalJson, sha256Hex } from "./util/crypto.js";
+export type { Platform, AuditLogEntry, UnhashedAuditLogEntry, ChainVerificationResult, SearchResultItem, SearchOutcome, RedditSearchOptions, YoutubeSearchOptions, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,YAAY,EACV,QAAQ,EACR,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { RedditClient } from "./clients/reddit-client.js";
+export { YoutubeClient } from "./clients/youtube-client.js";
+export { getCredential, setCredential, deleteCredential, getRedditCredentials, getYoutubeCredentials, } from "./auth/credential-store.js";
+export { appendAuditLogEntry, getLastEntryHash, computeEntryHash, DEFAULT_AUDIT_LOG_PATH, } from "./audit-log/hash-chain-writer.js";
+export { verifyAuditLogChain } from "./audit-log/chain-verifier.js";
+export { credentialFingerprint, canonicalJson, sha256Hex } from "./util/crypto.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,62 @@
+export type Platform = "reddit" | "youtube";
+export interface AuditLogEntry {
+    entry_id: string;
+    timestamp: string;
+    platform: Platform;
+    endpoint: string;
+    query_params: Record<string, string | number | boolean | undefined>;
+    auth_scope: string;
+    consent_basis: string;
+    api_key_fingerprint: string;
+    results_returned: number;
+    prev_entry_hash: string | null;
+    entry_hash: string;
+}
+export type UnhashedAuditLogEntry = Omit<AuditLogEntry, "entry_hash">;
+export interface ChainVerificationResult {
+    valid: boolean;
+    totalEntries: number;
+    brokenAtEntryId: string | null;
+    brokenAtIndex: number | null;
+    reason: string | null;
+}
+export interface SearchResultItem {
+    id: string;
+    title: string;
+    url: string;
+    createdAt: string;
+    author: string | null;
+    score: number | null;
+    extra: Record<string, unknown>;
+}
+/** Cursor fullnames read back from a platform's response, for requesting the next/previous page. */
+export interface SearchCursor {
+    after: string | null;
+    before: string | null;
+}
+export interface SearchOutcome {
+    platform: Platform;
+    endpoint: string;
+    queryParams: Record<string, string | number | boolean | undefined>;
+    authScope: string;
+    consentBasis: string;
+    items: SearchResultItem[];
+    /** Pagination cursors extracted from the response itself (not an echo of the request params). Populated when the platform's API exposes them. */
+    nextCursor?: SearchCursor;
+}
+export interface RedditSearchOptions {
+    query: string;
+    subreddit?: string;
+    limit?: number;
+    /** Reddit fullname (e.g. "t3_abc123") to page results before, for paginating past the ~1000-result search cap. */
+    before?: string;
+    /** Reddit fullname (e.g. "t3_abc123") to page results after, for paginating past the ~1000-result search cap. */
+    after?: string;
+}
+export interface YoutubeSearchOptions {
+    query?: string;
+    channelHandle?: string;
+    since?: string;
+    maxResults?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AAEtE,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,oGAAoG;AACpG,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,iJAAiJ;IACjJ,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kHAAkH;IAClH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/util/crypto.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Canonical JSON: sorts object keys recursively so the same logical entry
+ * always serializes to the same bytes, regardless of insertion order. This
+ * is required for the audit-log hash chain to verify deterministically.
+ */
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256Hex(input: string): string;
+/**
+ * A fingerprint proves which credential made a query without ever storing
+ * or logging the credential itself. Only the last 6 hex characters of the
+ * hash are kept -- enough to distinguish rotated keys in a local audit log,
+ * not enough to be a partial credential leak.
+ */
+export declare function credentialFingerprint(secret: string): string;
+export declare function generateEntryId(prefix?: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/util/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/util/crypto.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAgBD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,eAAe,CAAC,MAAM,SAAO,GAAG,MAAM,CAIrD"}

package/dist/util/crypto.js

@@ -0,0 +1,40 @@
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * Canonical JSON: sorts object keys recursively so the same logical entry
+ * always serializes to the same bytes, regardless of insertion order. This
+ * is required for the audit-log hash chain to verify deterministically.
+ */
+export function canonicalJson(value) {
+    return JSON.stringify(sortKeysDeep(value));
+}
+function sortKeysDeep(value) {
+    if (Array.isArray(value)) {
+        return value.map(sortKeysDeep);
+    }
+    if (value !== null && typeof value === "object") {
+        const sorted = {};
+        for (const key of Object.keys(value).sort()) {
+            sorted[key] = sortKeysDeep(value[key]);
+        }
+        return sorted;
+    }
+    return value;
+}
+export function sha256Hex(input) {
+    return createHash("sha256").update(input, "utf8").digest("hex");
+}
+/**
+ * A fingerprint proves which credential made a query without ever storing
+ * or logging the credential itself. Only the last 6 hex characters of the
+ * hash are kept -- enough to distinguish rotated keys in a local audit log,
+ * not enough to be a partial credential leak.
+ */
+export function credentialFingerprint(secret) {
+    return sha256Hex(secret).slice(-6);
+}
+export function generateEntryId(prefix = "ar") {
+    const date = new Date().toISOString().slice(0, 10);
+    const rand = randomBytes(3).toString("hex");
+    return `${prefix}_${date}_${rand}`;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/util/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/util/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAM,GAAG,IAAI;IAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/util/prompt.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Prompts for a plain-text value (non-secret). Echoes normally.
+ */
+export declare function promptText(question: string): Promise<string>;
+/**
+ * Prompts for a secret value (API key, client secret, password) without
+ * echoing it back to the terminal -- masks each keystroke as it's typed
+ * so a secret never appears in scrollback or a screen-share.
+ */
+export declare function promptSecret(question: string): Promise<string>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/util/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/util/prompt.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ5D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgD9D"}

package/dist/util/prompt.js

@@ -0,0 +1,67 @@
+import { createInterface } from "node:readline";
+const CTRL_C = String.fromCharCode(3);
+const BACKSPACE_DEL = String.fromCharCode(127);
+const BACKSPACE_BS = String.fromCharCode(8);
+/**
+ * Prompts for a plain-text value (non-secret). Echoes normally.
+ */
+export function promptText(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+/**
+ * Prompts for a secret value (API key, client secret, password) without
+ * echoing it back to the terminal -- masks each keystroke as it's typed
+ * so a secret never appears in scrollback or a screen-share.
+ */
+export function promptSecret(question) {
+    return new Promise((resolve) => {
+        process.stdout.write(question);
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw;
+        let value = "";
+        if (stdin.isTTY) {
+            stdin.setRawMode(true);
+        }
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        const cleanup = () => {
+            stdin.removeListener("data", onData);
+            if (stdin.isTTY) {
+                stdin.setRawMode(wasRaw ?? false);
+            }
+            stdin.pause();
+        };
+        const onData = (chunk) => {
+            for (const char of chunk) {
+                if (char === "\n" || char === "\r") {
+                    cleanup();
+                    process.stdout.write("\n");
+                    resolve(value);
+                    return;
+                }
+                if (char === CTRL_C) {
+                    cleanup();
+                    process.stdout.write("\n");
+                    process.exit(130);
+                }
+                if (char === BACKSPACE_DEL || char === BACKSPACE_BS) {
+                    if (value.length > 0) {
+                        value = value.slice(0, -1);
+                        process.stdout.write("\b \b");
+                    }
+                    continue;
+                }
+                value += char;
+                process.stdout.write("*");
+            }
+        };
+        stdin.on("data", onData);
+    });
+}
+//# sourceMappingURL=prompt.js.map

package/dist/util/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/util/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,IAAI,KAAK,GAAG,EAAE,CAAC;QAEf,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnC,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,OAAO,CAAC,KAAK,CAAC,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;gBACD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;oBACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "auditreach-cli",
+  "version": "0.1.0",
+  "description": "Official-API-only, BYOK research CLI with a hash-chained compliance audit log -- for AI agents that can't legally use cookie-based scraping",
+  "type": "module",
+  "bin": {
+    "auditreach": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/cli.ts",
+    "lint": "eslint .",
+    "format": "prettier --check .",
+    "format:fix": "prettier --write .",
+    "typecheck": "tsc --noEmit --strict",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "cli",
+    "byok",
+    "compliance",
+    "audit-log",
+    "reddit-api",
+    "youtube-api",
+    "ai-agent",
+    "research"
+  ],
+  "author": "Rudrendu Paul",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/RudrenduPaul/auditreach.git"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.3.0",
+    "commander": "^12.1.0",
+    "googleapis": "^173.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.17.0",
+    "@types/node": "^22.10.2",
+    "@typescript-eslint/eslint-plugin": "^8.19.1",
+    "@typescript-eslint/parser": "^8.19.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^9.17.0",
+    "globals": "^15.15.0",
+    "prettier": "^3.4.2",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.10"
+  }
+}