# Tool call audit log for the Vercel AI SDK

Pass your tools through `wrapTools` and each `execute` call is written as a signed, chained record: a `decision` before the tool runs and an `outcome` after it. TypeScript and JavaScript.

Full steps: [Vercel AI SDK quickstart](/docs/quickstart/typescript-vercel-ai). What recording covers and where it stops: [Tool coverage](/docs/coverage).

## The change

One call where `generateText` or `streamText` gets its tools. `wrapTools` takes the object you already pass, and each key is the recorded tool name. The `ai` package is not a dependency of the SDK.

```ts
import { wrapTools } from "signafaide";
import { generateText, stepCountIs } from "ai";

const tools = wrapTools(
  { lookup_order: lookupOrder, refund },
  { agent: "support-bot" },
);

const result = await generateText({
  model,
  tools,
  stopWhen: stepCountIs(3),
  prompt: "Refund order A-1001",
});
```

## A verify run

Run the agent once, then `npx signafaide verify`. This is a local run in which the model asked for `refund` once: three records for the tool list, one decision and one outcome.

```text
$ npx signafaide verify
local state: /home/dev/support-agent/.signafaide
 1. Envelope schema              PASS         5 records
 2. Record hashes                NOT CHECKED  0 records; 5 not yet shipped (no receipt); nothing co-signed yet
 3. Client signatures            PASS         5 records
 4. Agent chains                 PASS         5 records
 5. Merkle proofs                NOT CHECKED  0 records; nothing co-signed yet
 6. Batch hashes and signatures  NOT CHECKED  0 batches; nothing co-signed yet
 7. Batch chain                  NOT CHECKED  0 batches; nothing co-signed yet
 8. Signed heads                 NOT CHECKED  0 heads; nothing co-signed yet
 9. drand rounds                 NOT CHECKED  0 rounds
10. Anchors                      NOT CHECKED  0 anchors; local state holds no anchors
11. OpenTimestamps               NOT CHECKED  0 proofs
12. Content hashes               PASS         5 records
coverage: _pending/nokey/support-bot: all 2 declared tools are recorded
checked here: signatures, chain links and content hashes of all 5 records, using this machine's keys
co-signature, public timestamp: not yet. Run `signafaide init` to send hashes, or self-host (SIGNAFAIDE_URL)
PASS: 4 of 12 checks passed, 8 not checked (nothing co-signed yet)
```

## What is recorded and what is not

- **Recorded.** Every `execute(input)` of a wrapped tool: the tool name and input, then the output or the error. Inputs and outputs stay in `.signafaide/` on your machine. Nothing is sent until you run `npx signafaide init`, and then only salted hashes.
- **Not recorded.** The options argument of `execute` (the messages and the abort signal) is not recorded. A tool with no `execute` function cannot be wrapped, and a tool you did not wrap leaves no record. Give the full list to `declareTools` and `signafaide verify` names the tools that are not recorded.
- **Evidence, not certification.** Records prove integrity and timing, not that a decision was right. The eight checks not run above need a witness: the co-signature and the public timestamp come after `npx signafaide init`.

Next: install, wrap, verify and send hashes, step by step. [Vercel AI SDK quickstart](/docs/quickstart/typescript-vercel-ai)