overlane 0.1.125 → 0.1.126

package/dist/overlane.mjs

@@ -22378,6 +22378,208 @@ var init_onboarding = __esm({
   }
 });
 
+// ../contracts/src/audit.ts
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+function sha256Hex(text) {
+  const data = new TextEncoder().encode(text);
+  const bitLength = data.length * 8;
+  const padded = new Uint8Array(Math.ceil((data.length + 9) / 64) * 64);
+  padded.set(data);
+  padded[data.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(bitLength / 2 ** 32));
+  view.setUint32(padded.length - 4, bitLength >>> 0);
+  const h = new Uint32Array([1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]);
+  const w = new Uint32Array(64);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    for (let i2 = 0; i2 < 16; i2 += 1) w[i2] = view.getUint32(offset + i2 * 4);
+    for (let i2 = 16; i2 < 64; i2 += 1) {
+      const a2 = w[i2 - 15];
+      const b2 = w[i2 - 2];
+      const s0 = rotr(a2, 7) ^ rotr(a2, 18) ^ a2 >>> 3;
+      const s1 = rotr(b2, 17) ^ rotr(b2, 19) ^ b2 >>> 10;
+      w[i2] = w[i2 - 16] + s0 + w[i2 - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i2 = 0; i2 < 64; i2 += 1) {
+      const t1 = hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + K[i2] + w[i2] >>> 0;
+      const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    const sums = [a, b, c, d, e, f, g, hh];
+    for (let i2 = 0; i2 < 8; i2 += 1) h[i2] = h[i2] + sums[i2] >>> 0;
+  }
+  return [...h].map((n) => n.toString(16).padStart(8, "0")).join("");
+}
+function auditHash(prevHash, body2) {
+  return sha256Hex(`${prevHash}
+${canonicalJson(AuditEventBody.parse(body2))}`);
+}
+function chainAuditEvent(prevHash, body2) {
+  const previous = prevHash ?? AUDIT_GENESIS_HASH;
+  return AuditEvent.parse({ ...body2, prevHash: previous, hash: auditHash(previous, body2) });
+}
+var AUDIT_CATEGORIES, AuditCategory, AUDIT_ACTIONS, AUDIT_ACTION_NAMES, AuditActionName, AUDIT_RESULTS, AuditResult, AuditPrincipalType, AuditTarget, Hash, AUDIT_GENESIS_HASH, AuditEventBody, AuditEvent, AuditList, AuditVerification, K, FIXTURE_AT, fixtureBodies, AUDIT_FIXTURE;
+var init_audit = __esm({
+  "../contracts/src/audit.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    AUDIT_CATEGORIES = ["admin", "policy", "token"];
+    AuditCategory = external_exports.enum(AUDIT_CATEGORIES);
+    AUDIT_ACTIONS = {
+      "member.removed": "admin",
+      "member.role_changed": "admin",
+      "invitation.created": "admin",
+      "invitation.revoked": "admin",
+      "run_policy.updated": "policy",
+      "project.updated": "policy",
+      "release.published": "policy",
+      "release.promoted": "policy",
+      "release.withdrawn": "policy",
+      "release.pinned": "policy",
+      "release.rolled_back": "policy",
+      "memory_settings.updated": "policy",
+      "issue_sync.updated": "policy",
+      "loop.created": "policy",
+      "loop.updated": "policy",
+      "loop.deleted": "policy",
+      "bot.registered": "policy",
+      "bot.revoked": "policy",
+      "bot.key_rotated": "policy",
+      "token.created": "token",
+      "token.revoked": "token"
+    };
+    AUDIT_ACTION_NAMES = Object.keys(AUDIT_ACTIONS);
+    AuditActionName = external_exports.enum(Object.keys(AUDIT_ACTIONS));
+    AUDIT_RESULTS = ["success", "denied", "failure"];
+    AuditResult = external_exports.enum(AUDIT_RESULTS);
+    AuditPrincipalType = external_exports.enum(["user", "agent", "system"]);
+    AuditTarget = external_exports.object({ type: external_exports.string().min(1).max(40), id: external_exports.string().max(200) }).strict();
+    Hash = external_exports.string().regex(/^[0-9a-f]{64}$/, "must be 64 lowercase hex characters");
+    AUDIT_GENESIS_HASH = "0".repeat(64);
+    AuditEventBody = external_exports.object({
+      tenantId: TenantId,
+      /** 1, 2, 3 ... per tenant, with no gaps. */
+      seq: external_exports.number().int().positive(),
+      eventId: external_exports.string().min(1).max(64),
+      at: Timestamp,
+      /** User ID, agent token ID or `system`. */
+      actor: external_exports.string().min(1).max(200),
+      principalType: AuditPrincipalType,
+      role: external_exports.string().min(1).max(40).nullable(),
+      action: AuditActionName,
+      category: AuditCategory,
+      target: AuditTarget,
+      result: AuditResult
+    }).strict();
+    AuditEvent = AuditEventBody.extend({ prevHash: Hash, hash: Hash }).strict().refine((event) => AUDIT_ACTIONS[event.action] === event.category, { message: "category does not match the action", path: ["category"] });
+    AuditList = external_exports.object({
+      tenantId: TenantId,
+      events: external_exports.array(AuditEvent),
+      /** Pass as `after` to read the next page; null when this is the last page. */
+      nextAfter: external_exports.number().int().nonnegative().nullable(),
+      /** Hash of the newest row of the tenant's chain (null for an empty log). */
+      head: Hash.nullable()
+    }).strict();
+    AuditVerification = external_exports.object({
+      tenantId: TenantId,
+      ok: external_exports.boolean(),
+      checked: external_exports.number().int().nonnegative(),
+      head: Hash.nullable(),
+      /** The first row that fails (its seq) and why. */
+      brokenAt: external_exports.number().int().positive().optional(),
+      reason: external_exports.enum(["bad_hash", "bad_link", "bad_sequence", "wrong_tenant", "bad_category"]).optional()
+    }).strict();
+    K = new Uint32Array([
+      1116352408,
+      1899447441,
+      3049323471,
+      3921009573,
+      961987163,
+      1508970993,
+      2453635748,
+      2870763221,
+      3624381080,
+      310598401,
+      607225278,
+      1426881987,
+      1925078388,
+      2162078206,
+      2614888103,
+      3248222580,
+      3835390401,
+      4022224774,
+      264347078,
+      604807628,
+      770255983,
+      1249150122,
+      1555081692,
+      1996064986,
+      2554220882,
+      2821834349,
+      2952996808,
+      3210313671,
+      3336571891,
+      3584528711,
+      113926993,
+      338241895,
+      666307205,
+      773529912,
+      1294757372,
+      1396182291,
+      1695183700,
+      1986661051,
+      2177026350,
+      2456956037,
+      2730485921,
+      2820302411,
+      3259730800,
+      3345764771,
+      3516065817,
+      3600352804,
+      4094571909,
+      275423344,
+      430227734,
+      506948616,
+      659060556,
+      883997877,
+      958139571,
+      1322822218,
+      1537002063,
+      1747873779,
+      1955562222,
+      2024104815,
+      2227730452,
+      2361852424,
+      2428436474,
+      2756734187,
+      3204031479,
+      3329325298
+    ]);
+    FIXTURE_AT = "2026-10-09T00:00:00.000Z";
+    fixtureBodies = [
+      { tenantId: "tm-1", seq: 1, eventId: "aud_1", at: FIXTURE_AT, actor: "u-owner", principalType: "user", role: "owner", action: "invitation.created", category: "admin", target: { type: "invitation", id: "inv_1" }, result: "success" },
+      { tenantId: "tm-1", seq: 2, eventId: "aud_2", at: "2026-10-09T00:05:00.000Z", actor: "u-admin", principalType: "user", role: "admin", action: "run_policy.updated", category: "policy", target: { type: "project", id: "prj-demo" }, result: "success" },
+      { tenantId: "tm-1", seq: 3, eventId: "aud_3", at: "2026-10-09T00:10:00.000Z", actor: "u-viewer", principalType: "user", role: "viewer", action: "token.created", category: "token", target: { type: "token", id: "" }, result: "denied" }
+    ];
+    AUDIT_FIXTURE = fixtureBodies.reduce((rows, body2) => [...rows, chainAuditEvent(rows.at(-1)?.hash ?? null, body2)], []);
+  }
+});
+
 // ../contracts/src/docs-service.ts
 function scoped(shape2) {
   return external_exports.discriminatedUnion("visibility", [external_exports.object({ ...shape2, ...PublicScope }).strict(), external_exports.object({ ...shape2, ...PrivateScope }).strict()]);
@@ -23551,6 +23753,7 @@ var init_src = __esm({
     init_memory();
     init_issues();
     init_onboarding();
+    init_audit();
     init_docs_service();
     init_review();
     init_guardrails();
@@ -30909,7 +31112,7 @@ var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.125" : "0.0.0-dev";
+    VERSION = true ? "0.1.126" : "0.0.0-dev";
   }
 });
 
@@ -38841,9 +39044,9 @@ import { lstat, readFile as readFile4 } from "node:fs/promises";
 import { join as join25 } from "node:path";
 import { promisify } from "node:util";
 function shardKeyOf(shard) {
-  return `sha256:${sha256Hex(Buffer.from(`${shard.path}\0${shard.contentHash}\0${shard.precision}`, "utf8"))}`;
+  return `sha256:${sha256Hex2(Buffer.from(`${shard.path}\0${shard.contentHash}\0${shard.precision}`, "utf8"))}`;
 }
-function sha256Hex(bytes) {
+function sha256Hex2(bytes) {
   return createHash6("sha256").update(bytes).digest("hex");
 }
 async function listTrackedFiles(repoRoot) {
@@ -38869,7 +39072,7 @@ async function hashRegularFile(repoRoot, path) {
   try {
     const stats = await lstat(absolute);
     if (!stats.isFile()) return null;
-    return `sha256:${sha256Hex(await readFile4(absolute))}`;
+    return `sha256:${sha256Hex2(await readFile4(absolute))}`;
   } catch (error62) {
     if (error62 instanceof Error && "code" in error62 && error62.code === "ENOENT") return null;
     throw error62;
@@ -38905,7 +39108,7 @@ async function buildSnapshot(options) {
     if (languageForPath(path) === null) return { path, shard: null };
     const bytes = await readFile4(join25(options.repoRoot, path));
     if (bytes.byteLength > MAX_PARSE_BYTES) return { path, shard: null };
-    const hash2 = `sha256:${sha256Hex(bytes)}`;
+    const hash2 = `sha256:${sha256Hex2(bytes)}`;
     if (hash2 !== hashes.get(path)) throw new Error(`${path} changed while the snapshot was being built`);
     const shard = await parseDeclarations(path, bytes.toString("utf8"));
     return { path, shard: shard ? { ...shard, contentHash: hash2 } : null };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlane",
-  "version": "0.1.125",
+  "version": "0.1.126",
   "description": "Overlane: connect a GitHub project to your coding agents. One portable CLI with project memory, tasks, a code index, guardrails and the Claude Code and Codex plugin.",
   "keywords": [
     "overlane",

package/plugins/claude/plugins/mvrx-harness/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mvrx-harness",
-  "version": "0.1.125",
+  "version": "0.1.126",
   "description": "Overlane context at session start and the shared Overlane skills.",
   "author": {
     "name": "owenob1"