Skip to main content

Class: SignedOutputVerifier

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:197

Signed Output Verifier for creating and verifying HMAC-signed outputs.

This is the third layer of defense in the Wunderland security pipeline. It provides:

  • Cryptographic proof that output came from a specific agent
  • Tamper-evident audit trail via intent chain
  • Verification mechanism for downstream systems

Example​

const verifier = new SignedOutputVerifier({
  algorithm: 'sha256',
  secretKeyEnvVar: 'MY_SECRET_KEY',
});

const tracker = new IntentChainTracker();
tracker.addEntry({
  action: 'USER_INPUT',
  inputHash: verifier.hash('user message'),
  outputHash: '',
  modelUsed: 'llama3.2:3b',
  securityFlags: [],
});

const signedOutput = verifier.sign(
  { text: 'Hello!' },
  tracker.getEntries(),
  { seedId: 'my-agent' }
);

const isValid = verifier.verify(signedOutput);

Constructors​

Constructor​

new SignedOutputVerifier(config?): SignedOutputVerifier

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:201

Parameters​

config?​

Partial<OutputSigningConfig> = {}

Returns​

SignedOutputVerifier

Methods​

extractVerifiedIntentChain()​

extractVerifiedIntentChain(signedOutput): IntentChainEntry[] | null

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:380

Extracts and validates the intent chain from a signed output. Returns null if verification fails.

Parameters​

signedOutput​

SignedAgentOutput

Returns​

IntentChainEntry[] | null

getConfig()​

getConfig(): Omit<OutputSigningConfig, "secretKeyEnvVar"> & object

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:485

Gets the current configuration (without secret).

Returns​

Omit<OutputSigningConfig, "secretKeyEnvVar"> & object

hash()​

hash(data): string

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:234

Creates a hash of the given data.

Parameters​

data​

string | object

Returns​

string

sign()​

sign(content, intentChain, context): SignedAgentOutput

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:280

Signs an output with HMAC.

Parameters​

content​

unknown

intentChain​

readonly IntentChainEntry[]

context​

SigningContext

Returns​

SignedAgentOutput

signPayload()​

signPayload(payload): string

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:246

Signs an arbitrary payload deterministically (detached signature).

This is useful for compact artifacts (e.g. InputManifest) where we want a verifiable signature over the payload itself without embedding intent-chain structures or per-signature randomness (outputId/timestamp).

Parameters​

payload​

unknown

Returns​

string

summarizeIntentChain()​

summarizeIntentChain(chain): object

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:390

Creates a summary of the intent chain for logging.

Parameters​

chain​

readonly IntentChainEntry[]

Returns​

object

duration​

duration: number | null

modelsUsed​

modelsUsed: string[]

securityFlags​

securityFlags: string[]

stepCount​

stepCount: number

uniqueActions​

uniqueActions: string[]

updateConfig()​

updateConfig(updates): void

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:474

Updates the configuration.

Parameters​

updates​

Partial<OutputSigningConfig>

Returns​

void

validateIntentChainLogic()​

validateIntentChainLogic(chain): object

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:429

Checks if an intent chain has any logical inconsistencies. Used for auditing purposes.

Parameters​

chain​

readonly IntentChainEntry[]

Returns​

object

issues​

issues: string[]

valid​

valid: boolean

verify()​

verify(signedOutput): boolean

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:329

Verifies a signed output.

Parameters​

signedOutput​

SignedAgentOutput

Returns​

boolean

true if signature is valid, false otherwise

verifyPayload()​

verifyPayload(payload, signature): boolean

Defined in: .source/wunderland/src/security/SignedOutputVerifier.ts:258

Verifies a detached payload signature.

Parameters​

payload​

unknown

signature​

string

Returns​

boolean

true if signature matches, false otherwise