edge-book 0.15.0 → 0.15.1

package/dist/edge-book.js

@@ -935,6 +935,7 @@ async function canReadObject(store, objectId, subjectAgentId, at = Date.now()) {
   for (const grant of candidates) {
     if (await store.verifyGrantSignature(grant)) return true;
   }
+  await store.audit("object.read.denied", subjectAgentId, { object_id: objectId, scope: "object.read" });
   return false;
 }
 async function readObject(store, objectId, subjectAgentId) {
@@ -974,6 +975,7 @@ async function shareObjectEnvelope(store, peerAgentId, objectId, expiresAt = "")
   if (object.attachment) {
     attachment_b64 = (await fs5.readFile(store.file(object.attachment.ref))).toString("base64");
   }
+  await store.audit("object.share", peerAgentId, { object_id: objectId, grant_id: grant.grant_id, scope: "object.read" });
   return store.signEnvelope({
     type: "object_share",
     to_agent_id: peerAgentId,
@@ -1019,7 +1021,7 @@ async function revokeObjectGrant(store, objectId, subjectAgentId) {
   }
   if (revoked.length) {
     await store.saveGrants(grants);
-    await store.audit("grant.revoke", subjectAgentId, { object_id: objectId, grant_ids: revoked });
+    await store.audit("grant.revoke", subjectAgentId, { object_id: objectId, grant_ids: revoked, scope: "object.read" });
   }
   return revoked;
 }
@@ -1823,13 +1825,18 @@ async function broadcastProfileEnvelopes(store) {
 async function revoke(store, peerAgentId) {
   await store.setRelationship(peerAgentId, "revoked", "Revoke", "revoked");
   const grants = await store.grants();
+  const revoked = [];
+  const scopes = /* @__PURE__ */ new Set();
   for (const grant of Object.values(grants)) {
     if (grant.subject_agent_id === peerAgentId || grant.issuer_agent_id === peerAgentId) {
       grant.status = "revoked";
       grant.revoked_at = now2();
+      revoked.push(grant.grant_id);
+      for (const scope of grant.scopes) scopes.add(scope);
     }
   }
   await store.saveGrants(grants);
+  if (revoked.length) await store.audit("grant.revoke", peerAgentId, { grant_ids: revoked, scopes: [...scopes].sort() });
 }
 async function block(store, peerAgentId) {
   await store.setRelationship(peerAgentId, "blocked", "Block", "blocked");
@@ -2505,15 +2512,36 @@ async function receiveEnvelope(store, envelope) {
 }
 async function audit(store, action, peerAgentId, details) {
   const audit_id = randomId("audit");
-  await appendJsonl(store.file(AUDIT_FILE), {
-    audit_id,
-    created_at: now2(),
-    action,
-    peer_agent_id: peerAgentId,
-    details
-  });
+  try {
+    const identity = await store.identity();
+    await appendJsonl(store.file(AUDIT_FILE), {
+      audit_id,
+      created_at: now2(),
+      kind: action,
+      action,
+      actor_agent_id: identity.agent_id,
+      peer_agent_id: peerAgentId,
+      ...auditIndexFields(details),
+      details
+    });
+  } catch {
+  }
   return audit_id;
 }
+function auditIndexFields(details) {
+  const fields = {};
+  const objectId = details.object_id;
+  const grantId = details.grant_id;
+  const grantIds = details.grant_ids;
+  const scope = details.scope;
+  const scopes = details.scopes;
+  if (typeof objectId === "string") fields.object_id = objectId;
+  if (typeof grantId === "string") fields.grant_id = grantId;
+  if (Array.isArray(grantIds) && grantIds.every((id) => typeof id === "string")) fields.grant_ids = grantIds.join(",");
+  if (typeof scope === "string") fields.grant_scope = scope;
+  if (Array.isArray(scopes) && scopes.every((s) => typeof s === "string")) fields.grant_scope = scopes.join(",");
+  return fields;
+}
 
 // src/store-notify.ts
 async function peerName(store, agentId) {
@@ -5819,6 +5847,7 @@ function ensureGreeterCron(opts) {
 // src/doctor.ts
 var DOCTOR_EVENT_TAIL = 50;
 var DOCTOR_TRACE_TAIL = 10;
+var DOCTOR_AUDIT_TAIL = 20;
 var DEFAULT_RELAY_TIMEOUT_MS = 3e3;
 function recentTraces(events, limit = DOCTOR_TRACE_TAIL) {
   const out = [];
@@ -5857,6 +5886,42 @@ function notifierCronState(runner) {
     return "error";
   }
 }
+function stringField(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function detailString(details, key) {
+  if (!details || typeof details !== "object") return void 0;
+  const value = details[key];
+  if (typeof value === "string" && value.length > 0) return value;
+  if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) return value.join(",");
+  return void 0;
+}
+function firstString(...values) {
+  for (const value of values) {
+    const found = stringField(value);
+    if (found) return found;
+  }
+  return void 0;
+}
+function addAuditField(event, key, value) {
+  if (value) event[key] = value;
+}
+function auditEvent(event) {
+  const out = {
+    ts: firstString(event.created_at, event.ts) ?? "",
+    kind: firstString(event.kind, event.action) ?? "unknown"
+  };
+  addAuditField(out, "actor_agent_id", stringField(event.actor_agent_id));
+  addAuditField(out, "peer_agent_id", stringField(event.peer_agent_id));
+  addAuditField(out, "object_id", firstString(event.object_id, detailString(event.details, "object_id")));
+  addAuditField(out, "grant_id", firstString(event.grant_id, detailString(event.details, "grant_id")));
+  addAuditField(out, "grant_ids", firstString(event.grant_ids, detailString(event.details, "grant_ids")));
+  addAuditField(out, "grant_scope", firstString(event.grant_scope, detailString(event.details, "scope"), detailString(event.details, "scopes")));
+  return out;
+}
+function auditTail(events, limit = DOCTOR_AUDIT_TAIL) {
+  return events.slice(-limit).map(auditEvent);
+}
 async function buildDoctorReport(store, opts) {
   const legacy = await store.doctor();
   const config = await store.config();
@@ -5917,6 +5982,7 @@ async function buildDoctorReport(store, opts) {
     },
     stores,
     events: await readEvents(store, DOCTOR_EVENT_TAIL),
+    audit: auditTail(await store.auditEvents()),
     // Traces are derived from the FULL event log (not just the tail) so a
     // busy log does not hide an older still-relevant trace.
     traces: recentTraces(await readEvents(store))
@@ -5926,6 +5992,25 @@ function renderEventLine(e) {
   const extras = Object.entries(e).filter(([k]) => k !== "ts" && k !== "kind").map(([k, v]) => `${k}=${String(v)}`).join(" ");
   return `  ${e.ts}  ${e.kind}${extras ? `  ${extras}` : ""}`;
 }
+function renderAuditLine(e) {
+  const extras = Object.entries(e).filter(([k]) => k !== "ts" && k !== "kind").map(([k, v]) => `${k}=${v}`).join(" ");
+  return `  ${e.ts}  ${e.kind}${extras ? `  ${extras}` : ""}`;
+}
+function appendTraceSection(lines, traces) {
+  lines.push(`Recent traces (distinct trace_ids, newest last, up to ${DOCTOR_TRACE_TAIL})`);
+  if (traces.length === 0) lines.push("  (no traced envelopes yet)");
+  for (const t of traces) lines.push(`  ${t.ts}  ${t.direction === "out" ? "\u2192" : "\u2190"} ${t.kind}  ${t.trace_id}`);
+}
+function appendEventSection(lines, events) {
+  lines.push(`Event log (newest last, up to ${DOCTOR_EVENT_TAIL})`);
+  if (events.length === 0) lines.push("  (no events recorded yet)");
+  for (const e of events) lines.push(renderEventLine(e));
+}
+function appendAuditSection(lines, audit2) {
+  lines.push(`Audit log (newest last, up to ${DOCTOR_AUDIT_TAIL})`);
+  if (audit2.length === 0) lines.push("  (no audit records yet)");
+  for (const e of audit2) lines.push(renderAuditLine(e));
+}
 function renderDoctorText(report) {
   const lines = [];
   lines.push(`Edge Book doctor \u2014 v${report.version} (${report.generated_at})`);
@@ -5963,13 +6048,11 @@ function renderDoctorText(report) {
   lines.push(`  contacts: ${report.stores.contacts} (friends: ${report.stores.friends})`);
   lines.push(`  posts: ${report.stores.posts}  objects: ${report.stores.objects}  escalations: ${report.stores.escalations}  pending approvals: ${report.stores.pending_approvals}`);
   lines.push("");
-  lines.push(`Recent traces (distinct trace_ids, newest last, up to ${DOCTOR_TRACE_TAIL})`);
-  if (report.traces.length === 0) lines.push("  (no traced envelopes yet)");
-  for (const t of report.traces) lines.push(`  ${t.ts}  ${t.direction === "out" ? "\u2192" : "\u2190"} ${t.kind}  ${t.trace_id}`);
+  appendTraceSection(lines, report.traces);
   lines.push("");
-  lines.push(`Event log (newest last, up to ${DOCTOR_EVENT_TAIL})`);
-  if (report.events.length === 0) lines.push("  (no events recorded yet)");
-  for (const e of report.events) lines.push(renderEventLine(e));
+  appendEventSection(lines, report.events);
+  lines.push("");
+  appendAuditSection(lines, report.audit);
   return lines.join("\n");
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edge-book",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Run your own Edge Book agent and connect it to the hosted reader.",
   "license": "MIT",
   "type": "module",