sello 0.1.9 → 0.1.10

package/README.md

@@ -49,6 +49,12 @@ npx --yes sello init-http-demo
 npx --yes sello call-http-demo
 ```
 
+## What Just Happened?
+
+`sello dev` created a local owner key, service key, token, registry, and transparency log. The demo tool or route verified the token before running the handler. After the handler ran, the service signed an encrypted receipt for the action it observed. The local log stored the encrypted receipt, not plaintext action details. `sello actions` fetched the receipt, verified the log entry and service signature, decrypted it with the owner key, and printed the owner's view.
+
+Local dev state lives under `.sello/`. The dev log is stored as encrypted receipt entries in `.sello/dev-log.jsonl`, so receipts survive restarting `sello dev` while staying out of git.
+
 ## Why Sello?
 
 Most agent logs are written by the same system whose behavior they describe. If the agent, runtime, or operator is compromised, those logs can be incomplete or false.

package/dist/cli/sello.js

@@ -1,7 +1,13 @@
 #!/usr/bin/env node
 
 import { createServer,                                           } from "node:http";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
 import { dirname, join } from "node:path";
 
 import { generateEd25519KeyPair } from "../cose/sign1.js";
@@ -163,7 +169,7 @@ async function devCommand(args          )                {
     "calendar.example.com/mcp/v1";
   const logEndpoint = `http://localhost:${port}/api`;
   const logUrl = toCanonicalLogUrl(`http://localhost:${port}/api`);
-  const state = createDevState({ serviceId, logUrl, logEndpoint });
+  const state = loadOrCreateDevState({ serviceId, logUrl, logEndpoint });
   saveDevState(state);
 
   if (dryRun) {
@@ -174,10 +180,12 @@ async function devCommand(args          )                {
   }
 
   const log = new MockTransparencyLog(logUrl);
+  const logPath = devLogPath();
+  const loadedEntries = loadDevLogEntries(log, logPath);
   const registry = parseRegistry(textEncoder.encode(state.registryJson));
   const server = createServer(async (request, response) => {
     try {
-      await handleDevRequest({ request, response, log, state, registry });
+      await handleDevRequest({ request, response, log, logPath, state, registry });
     } catch (error) {
       sendJson(response, 500, {
         error: error instanceof Error ? error.message : String(error),
@@ -187,6 +195,9 @@ async function devCommand(args          )                {
 
   server.listen(port, () => {
     printDevConfig(port, state);
+    console.log("");
+    console.log(`Local dev log: ${logPath}`);
+    console.log(`Loaded ${devLogEntryCountLabel(loadedEntries)}.`);
   });
 }
 
@@ -364,9 +375,10 @@ async function handleDevRequest(input
                            
                            
                   
+                  
                                              
  )                {
-  const { request, response, log, state, registry } = input;
+  const { request, response, log, logPath, state, registry } = input;
   const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
 
   if (request.method === "GET" && (url.pathname === "/" || url.pathname === "/actions")) {
@@ -391,6 +403,7 @@ async function handleDevRequest(input
       decodeBase64url(body.envelope, "envelope"),
       typeof body.integratedTime === "string" ? body.integratedTime : undefined,
     );
+    appendDevLogEntry(logPath, entry);
     sendJson(response, 200, serializeEntry(entry));
     return;
   }
@@ -412,6 +425,24 @@ async function handleDevRequest(input
   sendJson(response, 404, { error: "not found" });
 }
 
+function loadOrCreateDevState(input   
+                    
+                          
+                      
+ )           {
+  const existing = loadDevStateIfPresent();
+  if (
+    existing &&
+    existing.serviceId === input.serviceId &&
+    existing.logUrl === input.logUrl &&
+    existing.logEndpoint === input.logEndpoint
+  ) {
+    return existing;
+  }
+
+  return createDevState(input);
+}
+
 function verifyDevActions(input   
                            
                   
@@ -527,6 +558,54 @@ function devStatePath()         {
   return join(process.cwd(), ".sello", "dev.json");
 }
 
+function devLogPath()         {
+  return join(process.cwd(), ".sello", "dev-log.jsonl");
+}
+
+function loadDevLogEntries(log                     , path        )         {
+  if (!existsSync(path)) {
+    return 0;
+  }
+
+  const lines = textDecoder
+    .decode(readFileBytes(path))
+    .split(/\r?\n/)
+    .filter((line) => line.trim().length > 0);
+
+  let loaded = 0;
+  for (const [index, line] of lines.entries()) {
+    let entry;
+    try {
+      entry = deserializeEntry(JSON.parse(line));
+      if (entry.logUrl !== log.logUrl) {
+        continue;
+      }
+      log.append(entry.envelope, entry.integratedTime);
+      loaded += 1;
+    } catch (error) {
+      throw new TypeError(
+        `invalid local dev log entry ${index + 1} in ${path}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    }
+  }
+
+  return loaded;
+}
+
+function appendDevLogEntry(
+  path        ,
+  entry                                           ,
+)       {
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, `${JSON.stringify(serializeEntry(entry))}\n`, { mode: 0o600 });
+}
+
+function devLogEntryCountLabel(count        )         {
+  return count === 1 ? "1 encrypted receipt" : `${count} encrypted receipts`;
+}
+
 function readFileBytes(path        )             {
   return new Uint8Array(readFileSync(path));
 }

package/docs/sdk-quickstart.md

@@ -48,6 +48,12 @@ npx --yes sello call-http-demo
 npx --yes sello actions
 ```
 
+## What Just Happened?
+
+`sello dev` created local development keys, a demo authorization token, a service registry, and a local transparency log. The wrapped tool or route verified the token before running your handler. After the handler returned, Sello signed an encrypted receipt for the observed action and submitted it to the local log. The log stored encrypted receipt data, not plaintext action details. `sello actions` used the owner key from local dev state to fetch, verify, decrypt, and print the action.
+
+Local dev state lives under `.sello/`. The encrypted dev log is stored in `.sello/dev-log.jsonl`, so receipts survive restarting `sello dev` without being committed to git.
+
 Inside this repo, start the local log and action viewer:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sello",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Reference implementation of the Sello protocol for service-signed AI agent receipts.",
   "type": "module",
   "license": "Apache-2.0",

package/src/cli/sello.ts

@@ -1,7 +1,13 @@
 #!/usr/bin/env -S node --experimental-strip-types
 
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
 import { dirname, join } from "node:path";
 
 import { generateEd25519KeyPair } from "../cose/sign1.ts";
@@ -164,7 +170,7 @@ async function devCommand(args: string[]): Promise<void> {
     "calendar.example.com/mcp/v1";
   const logEndpoint = `http://localhost:${port}/api`;
   const logUrl = toCanonicalLogUrl(`http://localhost:${port}/api`);
-  const state = createDevState({ serviceId, logUrl, logEndpoint });
+  const state = loadOrCreateDevState({ serviceId, logUrl, logEndpoint });
   saveDevState(state);
 
   if (dryRun) {
@@ -175,10 +181,12 @@ async function devCommand(args: string[]): Promise<void> {
   }
 
   const log = new MockTransparencyLog(logUrl);
+  const logPath = devLogPath();
+  const loadedEntries = loadDevLogEntries(log, logPath);
   const registry = parseRegistry(textEncoder.encode(state.registryJson));
   const server = createServer(async (request, response) => {
     try {
-      await handleDevRequest({ request, response, log, state, registry });
+      await handleDevRequest({ request, response, log, logPath, state, registry });
     } catch (error) {
       sendJson(response, 500, {
         error: error instanceof Error ? error.message : String(error),
@@ -188,6 +196,9 @@ async function devCommand(args: string[]): Promise<void> {
 
   server.listen(port, () => {
     printDevConfig(port, state);
+    console.log("");
+    console.log(`Local dev log: ${logPath}`);
+    console.log(`Loaded ${devLogEntryCountLabel(loadedEntries)}.`);
   });
 }
 
@@ -364,10 +375,11 @@ async function handleDevRequest(input: {
   request: IncomingMessage;
   response: ServerResponse;
   log: MockTransparencyLog;
+  logPath: string;
   state: DevState;
   registry: ReturnType<typeof parseRegistry>;
 }): Promise<void> {
-  const { request, response, log, state, registry } = input;
+  const { request, response, log, logPath, state, registry } = input;
   const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
 
   if (request.method === "GET" && (url.pathname === "/" || url.pathname === "/actions")) {
@@ -392,6 +404,7 @@ async function handleDevRequest(input: {
       decodeBase64url(body.envelope, "envelope"),
       typeof body.integratedTime === "string" ? body.integratedTime : undefined,
     );
+    appendDevLogEntry(logPath, entry);
     sendJson(response, 200, serializeEntry(entry));
     return;
   }
@@ -413,6 +426,24 @@ async function handleDevRequest(input: {
   sendJson(response, 404, { error: "not found" });
 }
 
+function loadOrCreateDevState(input: {
+  serviceId: string;
+  logUrl: CanonicalLogUrl;
+  logEndpoint: string;
+}): DevState {
+  const existing = loadDevStateIfPresent();
+  if (
+    existing &&
+    existing.serviceId === input.serviceId &&
+    existing.logUrl === input.logUrl &&
+    existing.logEndpoint === input.logEndpoint
+  ) {
+    return existing;
+  }
+
+  return createDevState(input);
+}
+
 function verifyDevActions(input: {
   log: MockTransparencyLog;
   state: DevState;
@@ -528,6 +559,54 @@ function devStatePath(): string {
   return join(process.cwd(), ".sello", "dev.json");
 }
 
+function devLogPath(): string {
+  return join(process.cwd(), ".sello", "dev-log.jsonl");
+}
+
+function loadDevLogEntries(log: MockTransparencyLog, path: string): number {
+  if (!existsSync(path)) {
+    return 0;
+  }
+
+  const lines = textDecoder
+    .decode(readFileBytes(path))
+    .split(/\r?\n/)
+    .filter((line) => line.trim().length > 0);
+
+  let loaded = 0;
+  for (const [index, line] of lines.entries()) {
+    let entry;
+    try {
+      entry = deserializeEntry(JSON.parse(line));
+      if (entry.logUrl !== log.logUrl) {
+        continue;
+      }
+      log.append(entry.envelope, entry.integratedTime);
+      loaded += 1;
+    } catch (error) {
+      throw new TypeError(
+        `invalid local dev log entry ${index + 1} in ${path}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    }
+  }
+
+  return loaded;
+}
+
+function appendDevLogEntry(
+  path: string,
+  entry: ReturnType<MockTransparencyLog["append"]>,
+): void {
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, `${JSON.stringify(serializeEntry(entry))}\n`, { mode: 0o600 });
+}
+
+function devLogEntryCountLabel(count: number): string {
+  return count === 1 ? "1 encrypted receipt" : `${count} encrypted receipts`;
+}
+
 function readFileBytes(path: string): Uint8Array {
   return new Uint8Array(readFileSync(path));
 }