monora-ai 1.6.0 → 1.7.0

package/dist/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAIxC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAelE;AAmDD,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA2LrB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAEzE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAsD7E"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAIxC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAelE;AAqJD,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAClC,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkMrB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAEzE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAsD7E"}

package/dist/report.js

@@ -78,6 +78,99 @@ function coerceTokenCount(value) {
     const numberValue = Number(value);
     return Number.isFinite(numberValue) ? numberValue : null;
 }
+function resolvePolicyName(body) {
+    for (const key of ['policy_name', 'policy', 'policy_id', 'policyId']) {
+        const value = body[key];
+        if (value) {
+            const candidate = String(value).trim();
+            if (candidate) {
+                return candidate;
+            }
+        }
+    }
+    if (body.policy && typeof body.policy === 'object') {
+        for (const key of ['name', 'id', 'policy_name']) {
+            const value = body.policy[key];
+            if (value) {
+                const candidate = String(value).trim();
+                if (candidate) {
+                    return candidate;
+                }
+            }
+        }
+    }
+    if (body.data_handling && typeof body.data_handling === 'object' && body.data_handling.action) {
+        return 'data_handling.block';
+    }
+    return 'UNKNOWN_POLICY';
+}
+function resolvePolicyMessage(body) {
+    if (body.message) {
+        const candidate = String(body.message).trim();
+        if (candidate) {
+            return candidate;
+        }
+    }
+    if (body.data_handling && typeof body.data_handling === 'object') {
+        const rules = body.data_handling.rules;
+        if (Array.isArray(rules) && rules.length > 0) {
+            return `Sensitive data matched rules: ${rules.map(String).join(', ')}`;
+        }
+        if (body.data_handling.action) {
+            return `Data handling policy violation (${body.data_handling.action})`;
+        }
+    }
+    return 'Policy violation recorded';
+}
+function normalizeUsage(usage) {
+    if (!usage || typeof usage !== 'object') {
+        return null;
+    }
+    let prompt = coerceTokenCount(usage.prompt_tokens);
+    let completion = coerceTokenCount(usage.completion_tokens);
+    if (prompt === null) {
+        prompt = coerceTokenCount(usage.input_tokens);
+    }
+    if (completion === null) {
+        completion = coerceTokenCount(usage.output_tokens);
+    }
+    const total = coerceTokenCount(usage.total_tokens);
+    if (prompt === null && completion === null && total === null) {
+        return null;
+    }
+    const safePrompt = prompt ?? 0;
+    const safeCompletion = completion ?? 0;
+    const safeTotal = total ?? safePrompt + safeCompletion;
+    return { prompt: safePrompt, completion: safeCompletion, total: safeTotal };
+}
+function extractUsage(body) {
+    const response = body.response;
+    if (response && typeof response === 'object') {
+        const normalized = normalizeUsage(response.usage);
+        if (normalized) {
+            return normalized;
+        }
+    }
+    const usage = normalizeUsage(body.usage);
+    if (usage) {
+        return usage;
+    }
+    const tokenUsage = normalizeUsage(body.token_usage);
+    if (tokenUsage) {
+        return tokenUsage;
+    }
+    return null;
+}
+function classifyPolicyViolation(policyName) {
+    const lowered = policyName.toLowerCase();
+    if (lowered.includes('unknown_model')) {
+        return 'unknown';
+    }
+    if (['denylist', 'blocklist', 'forbidden'].some((token) => lowered.includes(token))) {
+        return 'forbidden';
+    }
+    return null;
+}
 function compilePatterns(patterns) {
     return patterns.map((pattern) => {
         const regexPattern = pattern
@@ -123,6 +216,31 @@ function buildReport(events, policies) {
     const usedAllowlistPatterns = new Set();
     const missingUsageModels = new Set();
     let missingUsageEvents = 0;
+    for (const event of filteredEvents) {
+        const body = event && typeof event.body === 'object' && event.body
+            ? event.body
+            : {};
+        if (body.status === 'policy_violation') {
+            const policyName = resolvePolicyName(body) || 'UNKNOWN_POLICY';
+            const message = resolvePolicyMessage(body) || 'Policy violation recorded';
+            violations.push({
+                timestamp: event.timestamp,
+                model: body.model,
+                policy: policyName,
+                message,
+            });
+            const model = normalizeModelName(body.model);
+            if (model) {
+                const classification = classifyPolicyViolation(policyName);
+                if (classification === 'forbidden') {
+                    forbiddenModelsBlocked.add(model);
+                }
+                else if (classification === 'unknown') {
+                    unknownModelsUsed.add(model);
+                }
+            }
+        }
+    }
     for (const event of filteredEvents) {
         if (event.trace_id) {
             traceIds.add(event.trace_id);
@@ -141,64 +259,39 @@ function buildReport(events, policies) {
             byClassification[event.data_classification] =
                 (byClassification[event.data_classification] || 0) + 1;
         }
-        const body = event.body || {};
+        const body = event && typeof event.body === 'object' && event.body
+            ? event.body
+            : {};
         if (event.event_type === 'llm_call') {
             const model = normalizeModelName(body.model);
-            if (model) {
+            const isBlocked = body.status === 'policy_violation';
+            if (model && !isBlocked) {
                 byModel[model] = (byModel[model] || 0) + 1;
                 modelsUsed.add(model);
             }
-            const response = body.response;
-            if (response && typeof response === 'object') {
-                const usage = response.usage;
-                if (usage && typeof usage === 'object') {
-                    const prompt = coerceTokenCount(usage.prompt_tokens) ?? 0;
-                    const completion = coerceTokenCount(usage.completion_tokens) ?? 0;
-                    const total = coerceTokenCount(usage.total_tokens) ??
-                        (coerceTokenCount(usage.prompt_tokens) !== null ||
-                            coerceTokenCount(usage.completion_tokens) !== null
-                            ? prompt + completion
-                            : null);
-                    if (total === null && prompt === 0 && completion === 0) {
-                        missingUsageEvents += 1;
-                        if (model) {
-                            missingUsageModels.add(model);
-                        }
-                    }
-                    else {
-                        tokenUsage.total_prompt_tokens += prompt;
-                        tokenUsage.total_completion_tokens += completion;
-                        tokenUsage.total_tokens += total ?? 0;
-                        if (model) {
-                            if (!tokenUsage.by_model[model]) {
-                                tokenUsage.by_model[model] = { prompt: 0, completion: 0, total: 0 };
-                            }
-                            tokenUsage.by_model[model].prompt += prompt;
-                            tokenUsage.by_model[model].completion += completion;
-                            tokenUsage.by_model[model].total += total ?? 0;
-                        }
+            if (!isBlocked) {
+                const usage = extractUsage(body);
+                if (!usage) {
+                    missingUsageEvents += 1;
+                    if (model) {
+                        missingUsageModels.add(model);
                     }
                 }
                 else {
-                    missingUsageEvents += 1;
+                    tokenUsage.total_prompt_tokens += usage.prompt;
+                    tokenUsage.total_completion_tokens += usage.completion;
+                    tokenUsage.total_tokens += usage.total;
                     if (model) {
-                        missingUsageModels.add(model);
+                        if (!tokenUsage.by_model[model]) {
+                            tokenUsage.by_model[model] = { prompt: 0, completion: 0, total: 0 };
+                        }
+                        tokenUsage.by_model[model].prompt += usage.prompt;
+                        tokenUsage.by_model[model].completion += usage.completion;
+                        tokenUsage.by_model[model].total += usage.total;
                     }
                 }
             }
         }
-        if (body.status === 'policy_violation') {
-            violations.push({
-                timestamp: event.timestamp,
-                model: body.model,
-                policy: body.policy_name,
-                message: body.message,
-            });
-            const model = normalizeModelName(body.model);
-            if (model) {
-                forbiddenModelsBlocked.add(model);
-            }
-        }
         if (body.error) {
             errors.push({
                 timestamp: event.timestamp,
@@ -238,6 +331,9 @@ function buildReport(events, policies) {
             allowedModelsUsed.add(model);
         }
     }
+    for (const model of modelsUsed) {
+        forbiddenModelsBlocked.delete(model);
+    }
     for (const model of allowedModelsUsed) {
         unknownModelsUsed.delete(model);
     }
@@ -255,6 +351,7 @@ function buildReport(events, policies) {
         start: timestamps.length ? new Date(Math.min(...timestamps.map((t) => t.getTime()))).toISOString() : null,
         end: timestamps.length ? new Date(Math.max(...timestamps.map((t) => t.getTime()))).toISOString() : null,
     };
+    const unknownModelsPayload = policies || unknownModelsUsed.size > 0 ? Array.from(unknownModelsUsed).sort() : [];
     return {
         total_events: filteredEvents.length,
         traces: traceIds.size,
@@ -269,7 +366,7 @@ function buildReport(events, policies) {
         model_compliance: {
             allowed_models_used: Array.from(allowedModelsUsed).sort(),
             forbidden_models_blocked: Array.from(forbiddenModelsBlocked).sort(),
-            unknown_models_used: policies ? Array.from(unknownModelsUsed).sort() : [],
+            unknown_models_used: unknownModelsPayload,
             unused_allowlist_patterns: unusedAllowlistPatterns.sort(),
         },
     };

package/dist/reporting.js

@@ -365,24 +365,67 @@ function verifyChainStatusWithProof(events, config) {
         return ['failed', exc instanceof Error ? exc.message : String(exc), null];
     }
 }
+const INVALID_IDENTIFIER_VALUES = new Set(['__main__.py', '__main__', 'unknown']);
+function sanitizeIdentifier(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    const candidate = String(value).trim();
+    if (!candidate) {
+        return null;
+    }
+    const base = candidate.split(/[\\/]/).pop() || '';
+    if (!base) {
+        return null;
+    }
+    if (INVALID_IDENTIFIER_VALUES.has(base.toLowerCase())) {
+        return null;
+    }
+    return base;
+}
+function normalizeEnvironmentValue(value) {
+    if (typeof value !== 'string') {
+        return 'dev';
+    }
+    const normalized = value.trim();
+    if (!normalized) {
+        return 'dev';
+    }
+    if (normalized.toLowerCase() === 'development') {
+        return 'dev';
+    }
+    return normalized;
+}
 function resolveProjectName(config) {
-    const projectName = process.env.MONORA_PROJECT_NAME ||
-        process.env.PROJECT_NAME ||
-        config?.defaults?.service_name ||
+    const projectName = sanitizeIdentifier(process.env.MONORA_PROJECT_NAME) ||
+        sanitizeIdentifier(process.env.PROJECT_NAME) ||
+        sanitizeIdentifier(config?.defaults?.service_name) ||
         'monora';
-    if (!projectName || projectName === 'unknown') {
+    if (projectName === 'monora') {
         console.error('Monora: project name missing; defaulting to "monora"');
-        return 'monora';
     }
     return projectName;
 }
 function resolveEnvironment(config) {
-    return config?.defaults?.environment || process.env.MONORA_ENV || 'dev';
+    const rawEnv = config?.defaults?.environment || process.env.MONORA_ENV || 'dev';
+    return normalizeEnvironmentValue(rawEnv);
 }
 function shouldRedactHost(config) {
     const reporting = config?.reporting || {};
     return reporting.redact_host !== false;
 }
+function applyTrustProofOverrides(events, environment) {
+    return events.map((event) => {
+        if (!event || typeof event !== 'object') {
+            return event;
+        }
+        const currentEnv = event.environment;
+        if (!currentEnv || normalizeEnvironmentValue(currentEnv) !== environment) {
+            return { ...event, environment };
+        }
+        return event;
+    });
+}
 function redactEventHosts(events, prefix) {
     const mapping = new Map();
     return events.map((event) => {
@@ -405,7 +448,11 @@ function redactEventHosts(events, prefix) {
 function buildTrustProofBundle(traceId, report, events, chainProof, artifacts, config) {
     const redactHosts = shouldRedactHost(config);
     const redactionPrefix = 'host-sha256:';
-    const sanitizedEvents = redactHosts ? redactEventHosts(events, redactionPrefix) : events;
+    const environment = resolveEnvironment(config);
+    const normalizedEvents = applyTrustProofOverrides(events, environment);
+    const sanitizedEvents = redactHosts
+        ? redactEventHosts(normalizedEvents, redactionPrefix)
+        : normalizedEvents;
     // Compute events digest
     const eventsDigestHash = (0, verify_1.computeEventsDigest)(sanitizedEvents);
     // Build artifact list for bundle
@@ -422,7 +469,6 @@ function buildTrustProofBundle(traceId, report, events, chainProof, artifacts, c
     }
     // Get project name from config
     const projectName = resolveProjectName(config);
-    const environment = resolveEnvironment(config);
     // Build the bundle
     const reportBytes = (0, attestation_1.serializeReport)(report);
     let bundle = (0, attestation_1.buildAttestationBundle)(report, reportBytes, undefined, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "monora-ai",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Lightweight governance and trace SDK for AI systems",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,10 +11,12 @@
     "build": "tsc && node scripts/copy-files.js",
     "test": "jest",
     "prepublishOnly": "npm run build",
+    "postinstall": "node scripts/postinstall.js",
     "clean": "rm -rf dist"
   },
   "files": [
     "dist",
+    "scripts",
     "README.md",
     "LICENSE"
   ],

package/scripts/copy-files.js

@@ -0,0 +1,10 @@
+const fs = require('fs');
+const path = require('path');
+
+const rootDir = path.resolve(__dirname, '..');
+const srcPath = path.join(rootDir, 'src', 'registryData.json');
+const distDir = path.join(rootDir, 'dist');
+const destPath = path.join(distDir, 'registryData.json');
+
+fs.mkdirSync(distDir, { recursive: true });
+fs.copyFileSync(srcPath, destPath);

package/scripts/postinstall.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+/**
+ * Postinstall script for Monora SDK
+ * Automatically runs the setup wizard after npm install
+ */
+
+const { execSync, spawn } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Check if we're in a CI environment or non-interactive terminal
+function isCI() {
+  return !!(
+    process.env.CI ||
+    process.env.CONTINUOUS_INTEGRATION ||
+    process.env.BUILD_NUMBER ||
+    process.env.GITHUB_ACTIONS ||
+    process.env.GITLAB_CI ||
+    process.env.CIRCLECI ||
+    process.env.TRAVIS ||
+    process.env.JENKINS_URL ||
+    process.env.MONORA_SKIP_POSTINSTALL
+  );
+}
+
+function isTTY() {
+  return process.stdout.isTTY && process.stdin.isTTY;
+}
+
+function findProjectRoot() {
+  // Walk up from current directory to find package.json (the user's project)
+  let dir = process.cwd();
+  const maxLevels = 10;
+
+  for (let i = 0; i < maxLevels; i++) {
+    const pkgPath = path.join(dir, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+        // Skip if this is the monora-ai package itself
+        if (pkg.name !== 'monora-ai') {
+          return dir;
+        }
+      } catch (e) {
+        // Continue searching
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.cwd();
+}
+
+function configExists(projectRoot) {
+  const configFiles = [
+    'monora.yml',
+    'monora.yaml',
+    'monora.json',
+    '.monora.yml',
+    '.monora.yaml',
+    '.monora.json',
+  ];
+
+  return configFiles.some(file =>
+    fs.existsSync(path.join(projectRoot, file))
+  );
+}
+
+async function main() {
+  // Skip in CI environments
+  if (isCI()) {
+    console.log('\n📦 Monora SDK installed successfully.');
+    console.log('   Run "npx monora init" to configure.\n');
+    return;
+  }
+
+  const projectRoot = findProjectRoot();
+
+  // Check if config already exists
+  if (configExists(projectRoot)) {
+    console.log('\n✅ Monora SDK installed. Existing configuration detected.\n');
+    return;
+  }
+
+  // Non-interactive terminal - show quick start
+  if (!isTTY()) {
+    console.log('\n📦 Monora SDK installed successfully!');
+    console.log('');
+    console.log('Quick Start:');
+    console.log('  1. Run: npx monora init');
+    console.log('  2. Or use zero-config:');
+    console.log('     import { init } from "monora-ai";');
+    console.log('     init();');
+    console.log('');
+    return;
+  }
+
+  // Interactive terminal - run setup wizard
+  console.log('\n🚀 Monora SDK installed! Starting setup wizard...\n');
+
+  try {
+    // Run the wizard with --yes for smart defaults
+    // Users can run `npx monora init` later for full interactive mode
+    const cliPath = path.join(__dirname, '..', 'dist', 'cli.js');
+
+    if (fs.existsSync(cliPath)) {
+      // Run the CLI init command
+      const child = spawn('node', [cliPath, 'init', '--yes'], {
+        cwd: projectRoot,
+        stdio: 'inherit',
+        shell: process.platform === 'win32',
+      });
+
+      child.on('error', (err) => {
+        console.log('\n📦 Monora SDK installed.');
+        console.log('   Run "npx monora init" to configure manually.\n');
+      });
+
+      child.on('close', (code) => {
+        if (code !== 0) {
+          console.log('\n   Run "npx monora init" to configure manually.\n');
+        }
+      });
+    } else {
+      // CLI not built yet (fresh install), show manual instructions
+      console.log('📦 Monora SDK installed successfully!');
+      console.log('');
+      console.log('Quick Start:');
+      console.log('  Option 1: Run "npx monora init" to configure');
+      console.log('  Option 2: Use zero-config in your code:');
+      console.log('     import { init } from "monora-ai";');
+      console.log('     init();');
+      console.log('');
+    }
+  } catch (err) {
+    // Silent fail - don't break npm install
+    console.log('\n📦 Monora SDK installed.');
+    console.log('   Run "npx monora init" to configure.\n');
+  }
+}
+
+main().catch(() => {
+  // Never fail the install
+  console.log('\n📦 Monora SDK installed.\n');
+});