TealProof

import { MerkleTree } from 'tealtiger/proof';

const tree = new MerkleTree({ algorithm: 'sha256' });

// Add governance decisions as leaves
tree.addLeaf(decision1);
tree.addLeaf(decision2);
tree.addLeaf(decision3);

// Build the tree
const root = tree.build();
console.log(root.hash);  // 'sha256:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069'

// Generate inclusion proof for a specific decision
const proof = tree.getProof(decision2);
console.log(proof.leaf);       // Hash of decision2
console.log(proof.siblings);   // Sibling hashes for verification
console.log(proof.root);       // Root hash
console.log(proof.index);      // Leaf index

// Verify inclusion
const valid = MerkleTree.verify(proof);
console.log(valid);  // true

interface MerkleTreeOptions {
  /** Hash algorithm (default: 'sha256') */
  algorithm: 'sha256' | 'sha384' | 'sha512';

  /** Maximum leaves before auto-rotation (default: 10000) */
  maxLeaves?: number;

  /** Leaf serialization method */
  serializer?: (decision: Decision) => Buffer;
}

import { GovernanceReceipt } from 'tealtiger/proof';

// Receipts are generated automatically by TealEngine when TealProof is enabled
const receipt = await engine.evaluate(request, ctx);

// Access the receipt from the decision
const proof = receipt.metadata.governanceReceipt;

console.log(proof.receiptId);      // 'rcpt-abc123'
console.log(proof.decisionHash);   // 'sha256:...'
console.log(proof.merkleRoot);     // Current tree root
console.log(proof.inclusionProof); // Merkle proof siblings
console.log(proof.timestamp);      // RFC 3161 timestamp token
console.log(proof.policyVersion);  // Policy version at evaluation time

interface GovernanceReceipt {
  /** Unique receipt identifier */
  receiptId: string;

  /** SHA-256 hash of the canonical decision */
  decisionHash: string;

  /** Merkle tree root at time of inclusion */
  merkleRoot: string;

  /** Inclusion proof (sibling hashes) */
  inclusionProof: string[];

  /** Leaf index in the tree */
  leafIndex: number;

  /** RFC 3161 timestamp token (base64-encoded) */
  timestamp: string;

  /** TSA (Time Stamping Authority) used */
  tsa: string;

  /** Policy version active at evaluation time */
  policyVersion: string;

  /** Engine version that produced the decision */
  engineVersion: string;

  /** Correlation ID linking to the original request */
  correlationId: string;
}

import { GovernancePassport } from 'tealtiger/proof';

const passport = new GovernancePassport({
  agentId: 'agent-support-bot-001',
  windowSize: '1h',  // New Merkle tree every hour
  tsa: 'https://freetsa.org/tsr',
  retention: '90d'
});

// Passport accumulates receipts automatically
// After 1 hour, it seals the current tree and starts a new one

// Query passport for coverage proof
const coverage = await passport.getCoverage({
  from: '2026-06-01T00:00:00Z',
  to: '2026-06-01T23:59:59Z'
});

console.log(coverage.windows);        // 24 sealed Merkle trees
console.log(coverage.totalDecisions); // 1,847 decisions governed
console.log(coverage.chainValid);     // true (all roots chain correctly)
console.log(coverage.gaps);           // [] (no coverage gaps)

interface GovernancePassport {
  /** Agent this passport belongs to */
  agentId: string;

  /** Time windows with sealed Merkle trees */
  windows: PassportWindow[];

  /** Chain of Merkle roots (each window's root) */
  rootChain: string[];

  /** Overall passport hash */
  passportHash: string;

  /** Coverage start time */
  coverageStart: string;

  /** Coverage end time */
  coverageEnd: string;
}

interface PassportWindow {
  /** Window start time */
  from: string;

  /** Window end time */
  to: string;

  /** Merkle root for this window */
  root: string;

  /** Number of decisions in this window */
  decisionCount: number;

  /** RFC 3161 timestamp for window seal */
  sealTimestamp: string;

  /** Whether this window is sealed (immutable) */
  sealed: boolean;
}

import { VerificationSDK } from 'tealtiger/proof';

const verifier = new VerificationSDK();

// Verify Merkle inclusion
const result = await verifier.verifyLocal(receipt);
console.log(result.valid);           // true
console.log(result.level);           // 'local'
console.log(result.checks.merkle);   // true (inclusion proof valid)
console.log(result.checks.hash);     // true (decision hash matches)

const result = await verifier.verifyTimestamp(receipt);
console.log(result.valid);              // true
console.log(result.level);              // 'timestamp'
console.log(result.checks.merkle);      // true
console.log(result.checks.hash);        // true
console.log(result.checks.timestamp);   // true (TSA confirms time)
console.log(result.checks.tsaCert);     // true (TSA certificate valid)
console.log(result.timestampVerified);  // '2026-06-01T14:47:23Z'

const result = await verifier.verifyPassport(passport, {
  from: '2026-06-01T00:00:00Z',
  to: '2026-06-01T23:59:59Z'
});

console.log(result.valid);              // true
console.log(result.level);              // 'full-chain'
console.log(result.checks.merkle);      // true (all trees valid)
console.log(result.checks.timestamps);  // true (all TSA timestamps valid)
console.log(result.checks.chain);       // true (root chain unbroken)
console.log(result.checks.coverage);    // true (no gaps in coverage)
console.log(result.windowsVerified);    // 24
console.log(result.decisionsVerified);  // 1847

import { TealEngine, TealProof } from 'tealtiger';

const engine = new TealEngine({
  policy: myPolicy,
  modules: [
    new TealProof({
      enabled: true,
      merkle: {
        algorithm: 'sha256',
        maxLeaves: 10000,
        autoRotate: true
      },
      timestamp: {
        tsa: 'https://freetsa.org/tsr',
        // Alternative TSAs for redundancy
        fallbackTsa: ['https://timestamp.digicert.com'],
        timeout: '5s'
      },
      passport: {
        enabled: true,
        windowSize: '1h',
        retention: '90d',
        storage: 'local'  // or 's3', 'gcs', 'azure-blob'
      },
      receipts: {
        attachToDecision: true,  // Include receipt in decision.metadata
        storage: 'local'
      }
    })
  ]
});

new TealProof({
  passport: {
    storage: 's3',
    storageConfig: {
      bucket: 'tealtiger-governance-evidence',
      prefix: 'passports/',
      region: 'us-east-1',
      encryption: 'aws:kms',
      kmsKeyId: 'arn:aws:kms:us-east-1:123456789:key/abc-123'
    }
  }
});

// Auditor asks: "Prove agent-001 was governed between June 1-7"
const passport = await GovernancePassport.load('agent-support-bot-001');

const auditReport = await verifier.verifyPassport(passport, {
  from: '2026-06-01T00:00:00Z',
  to: '2026-06-07T23:59:59Z'
});

if (auditReport.valid && auditReport.checks.coverage) {
  console.log('✓ Continuous governance coverage confirmed');
  console.log(`  Windows: ${auditReport.windowsVerified}`);
  console.log(`  Decisions: ${auditReport.decisionsVerified}`);
  console.log(`  Gaps: ${auditReport.gaps.length}`);  // 0
  console.log(`  TSA: ${auditReport.tsaUsed}`);

  // Export audit-ready report
  await auditReport.exportPDF('governance-audit-june-2026.pdf');
}