@elinpf/dsh-ops-access-hub 0.2.0

package/lib/server.js

@@ -0,0 +1,303 @@
+/**
+ * HTTP API for the hub, built on bare `node:http` (no framework by design).
+ *
+ * Endpoints (default bind `127.0.0.1:3090`):
+ *
+ * - `GET /health`                        → `{ok:true}`, no auth
+ * - `GET /`                              → the static web UI, no auth (it holds no secrets)
+ * - `GET /entries`                       → `[{kind,name,envelope,tiers:{ro?:{probe?},rw?:{probe?}},updatedAt}]`
+ *                                          (read+; field values never appear here)
+ * - `GET /entries/:kind/:name/:tier`     → `{kind,name,tier,fields,envelope,probe?}` (read+; audited as `resolve`)
+ * - `PUT /entries/:kind/:name/:tier`     → upsert, body `{fields,envelope?,probe?}` (admin)
+ * - `DELETE /entries/:kind/:name/:tier`  → `{ok:true}` / 404 (admin; last tier removes the entry)
+ * - `GET /audit?limit=N`                 → recent N audit records (admin, default 100)
+ * - `POST /requests`                     → queue a tier-registration request, body
+ *                                          `{kind,name,tier,fields,envelope?,reason?}` (admin)
+ * - `GET /requests?status=pending`       → request list, metadata only — field
+ *                                          names + byte sizes, never values (read+)
+ * - `GET /requests/:id`                  → full request incl. field values, for
+ *                                          pre-approval review (admin)
+ * - `POST /requests/:id/decide`          → `{approved:boolean}`; approval writes the
+ *                                          tier, either way the request's fields are
+ *                                          wiped (admin; 409 unless pending)
+ *
+ * Auth: two Bearer tokens — admin (everything) and read (`GET /entries*`
+ * only). Comparisons use `crypto.timingSafeEqual`. Every error response is
+ * JSON `{ok:false,error}` and `error` never contains field values.
+ *
+ * @module
+ */
+import { timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { WEB_UI_HTML } from './web.js';
+/** Profile name / kind charset; kinds additionally can never contain `/` (path segment). */
+export const NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._@-]*$/;
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function tokenEqual(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return timingSafeEqual(ba, bb);
+}
+function roleOf(req, opts) {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer '))
+        return null;
+    const token = header.slice('Bearer '.length).trim();
+    if (tokenEqual(token, opts.adminToken))
+        return 'admin';
+    if (tokenEqual(token, opts.readToken))
+        return 'read';
+    return null;
+}
+function send(res, status, body) {
+    const text = JSON.stringify(body);
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(text);
+}
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            throw new HttpError(413, 'body too large');
+        chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text.trim() === '')
+        throw new HttpError(400, 'request body must be a JSON object');
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new HttpError(400, 'request body is not valid JSON');
+    }
+    if (!isPlainObject(parsed))
+        throw new HttpError(400, 'request body must be a JSON object');
+    return parsed;
+}
+/** Keep only the three known envelope keys, and only when they are strings. */
+function sanitizeEnvelope(raw) {
+    if (!isPlainObject(raw))
+        throw new HttpError(400, 'envelope must be a JSON object');
+    const out = {};
+    if (typeof raw.name === 'string')
+        out.name = raw.name;
+    if (typeof raw.description === 'string')
+        out.description = raw.description;
+    if (typeof raw.environment === 'string')
+        out.environment = raw.environment;
+    return out;
+}
+function sanitizeProbe(raw) {
+    if (!isPlainObject(raw))
+        throw new HttpError(400, 'probe must be a JSON object');
+    const { status, detail, probedAt } = raw;
+    if (status !== 'verified' && status !== 'mismatch' && status !== 'unverifiable') {
+        throw new HttpError(400, "probe.status must be 'verified', 'mismatch' or 'unverifiable'");
+    }
+    if (typeof probedAt !== 'string')
+        throw new HttpError(400, 'probe.probedAt must be a string');
+    if (detail !== undefined && typeof detail !== 'string')
+        throw new HttpError(400, 'probe.detail must be a string');
+    const out = { status, probedAt };
+    if (typeof detail === 'string')
+        out.detail = detail;
+    return out;
+}
+/** Strip a path segment to a validated kind/name, or throw 400. */
+function segment(raw, what) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(raw);
+    }
+    catch {
+        throw new HttpError(400, `invalid ${what}`);
+    }
+    if (!NAME_PATTERN.test(decoded))
+        throw new HttpError(400, `invalid ${what}: must match ${NAME_PATTERN.source}`);
+    return decoded;
+}
+function tierOf(raw) {
+    if (raw === 'ro' || raw === 'rw')
+        return raw;
+    throw new HttpError(400, "tier must be 'ro' or 'rw'");
+}
+export function createHubServer(opts) {
+    const { store } = opts;
+    async function handle(req, res) {
+        const method = req.method ?? 'GET';
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        const path = url.pathname;
+        // Unauthenticated surface: health probe and the static UI shell.
+        if (method === 'GET' && path === '/health')
+            return send(res, 200, { ok: true });
+        if (method === 'GET' && path === '/') {
+            res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+            res.end(WEB_UI_HTML);
+            return;
+        }
+        const role = roleOf(req, opts);
+        if (!role)
+            throw new HttpError(401, 'missing or invalid bearer token');
+        if (method === 'GET' && path === '/entries') {
+            // Listing never exposes field values — tiers carry only probe state.
+            const list = store.list().map((e) => ({
+                kind: e.kind,
+                name: e.name,
+                envelope: e.envelope,
+                tiers: {
+                    ...(e.tiers.ro ? { ro: { ...(e.tiers.ro.probe ? { probe: e.tiers.ro.probe } : {}) } } : {}),
+                    ...(e.tiers.rw ? { rw: { ...(e.tiers.rw.probe ? { probe: e.tiers.rw.probe } : {}) } } : {}),
+                },
+                updatedAt: e.updatedAt,
+            }));
+            return send(res, 200, list);
+        }
+        if (method === 'GET' && path === '/audit') {
+            if (role !== 'admin')
+                throw new HttpError(403, 'read token cannot access admin endpoints');
+            const raw = url.searchParams.get('limit');
+            let limit = 100;
+            if (raw !== null) {
+                limit = Number.parseInt(raw, 10);
+                if (!Number.isFinite(limit) || limit < 1)
+                    throw new HttpError(400, 'limit must be a positive integer');
+                limit = Math.min(limit, 1000);
+            }
+            return send(res, 200, await store.readAudit(limit));
+        }
+        const parts = path.split('/').filter((p) => p !== '');
+        if (parts[0] === 'requests' && parts.length === 1) {
+            if (method === 'GET') {
+                // Metadata only — the reviewer fetches values per request (admin).
+                const raw = url.searchParams.get('status');
+                if (raw !== null && raw !== 'pending' && raw !== 'approved' && raw !== 'rejected') {
+                    throw new HttpError(400, "status must be 'pending', 'approved' or 'rejected'");
+                }
+                const list = store.listRequests(raw ?? undefined).map((r) => ({
+                    id: r.id,
+                    kind: r.kind,
+                    name: r.name,
+                    tier: r.tier,
+                    envelope: r.envelope,
+                    ...(r.reason !== undefined ? { reason: r.reason } : {}),
+                    status: r.status,
+                    createdAt: r.createdAt,
+                    ...(r.decidedAt !== undefined ? { decidedAt: r.decidedAt } : {}),
+                    fields: Object.fromEntries(Object.entries(r.fields).map(([k, v]) => [k, typeof v === 'string' ? v.length : JSON.stringify(v).length])),
+                }));
+                return send(res, 200, list);
+            }
+            if (role !== 'admin')
+                throw new HttpError(403, 'read token cannot access admin endpoints');
+            if (method === 'POST') {
+                const body = await readBody(req);
+                const kind = segment(String(body.kind ?? ''), 'kind');
+                const name = segment(String(body.name ?? ''), 'name');
+                const tier = tierOf(String(body.tier ?? ''));
+                if (!isPlainObject(body.fields))
+                    throw new HttpError(400, 'fields must be a JSON object');
+                const envelope = body.envelope === undefined ? {} : sanitizeEnvelope(body.envelope);
+                if (body.reason !== undefined && typeof body.reason !== 'string')
+                    throw new HttpError(400, 'reason must be a string');
+                const request = store.putRequest({ kind, name, tier, fields: body.fields, envelope, reason: body.reason });
+                await store.save();
+                await store.audit(role, 'request', kind, name, tier);
+                return send(res, 200, { ok: true, id: request.id });
+            }
+            throw new HttpError(405, 'method not allowed');
+        }
+        if (parts[0] === 'requests' && parts.length === 2 && method === 'GET') {
+            // Full field values for pre-approval review — admin only.
+            if (role !== 'admin')
+                throw new HttpError(403, 'read token cannot review request contents');
+            const request = store.getRequest(parts[1]);
+            if (!request)
+                throw new HttpError(404, 'request not found');
+            return send(res, 200, request);
+        }
+        if (parts[0] === 'requests' && parts.length === 3 && parts[2] === 'decide') {
+            if (role !== 'admin')
+                throw new HttpError(403, 'read token cannot access admin endpoints');
+            if (method !== 'POST')
+                throw new HttpError(405, 'method not allowed');
+            const body = await readBody(req);
+            if (typeof body.approved !== 'boolean')
+                throw new HttpError(400, 'approved must be a boolean');
+            const request = store.decideRequest(parts[1], body.approved);
+            if (!request) {
+                const existing = store.getRequest(parts[1]);
+                throw existing
+                    ? new HttpError(409, `request already ${existing.status}`)
+                    : new HttpError(404, 'request not found');
+            }
+            await store.save();
+            await store.audit(role, body.approved ? 'approve' : 'reject', request.kind, request.name, request.tier);
+            return send(res, 200, { ok: true });
+        }
+        if (parts[0] === 'entries' && parts.length === 4) {
+            const kind = segment(parts[1], 'kind');
+            const name = segment(parts[2], 'name');
+            const tier = tierOf(parts[3]);
+            if (method === 'GET') {
+                const entry = store.getEntry(kind, name);
+                const tierData = entry?.tiers[tier];
+                if (!entry || !tierData)
+                    throw new HttpError(404, 'entry not found');
+                await store.audit(role, 'resolve', kind, name, tier);
+                return send(res, 200, {
+                    kind,
+                    name,
+                    tier,
+                    fields: tierData.fields,
+                    envelope: entry.envelope,
+                    ...(tierData.probe ? { probe: tierData.probe } : {}),
+                });
+            }
+            if (role !== 'admin')
+                throw new HttpError(403, 'read token cannot access admin endpoints');
+            if (method === 'PUT') {
+                const body = await readBody(req);
+                if (!isPlainObject(body.fields))
+                    throw new HttpError(400, 'fields must be a JSON object');
+                const envelope = body.envelope === undefined ? undefined : sanitizeEnvelope(body.envelope);
+                const probe = body.probe === undefined ? undefined : sanitizeProbe(body.probe);
+                store.putTier(kind, name, tier, { fields: body.fields, envelope, probe });
+                await store.save();
+                await store.audit(role, 'put', kind, name, tier);
+                return send(res, 200, { ok: true });
+            }
+            if (method === 'DELETE') {
+                if (!store.deleteTier(kind, name, tier))
+                    throw new HttpError(404, 'entry not found');
+                await store.save();
+                await store.audit(role, 'delete', kind, name, tier);
+                return send(res, 200, { ok: true });
+            }
+            throw new HttpError(405, 'method not allowed');
+        }
+        throw new HttpError(404, 'not found');
+    }
+    return createServer((req, res) => {
+        handle(req, res).catch((err) => {
+            if (err instanceof HttpError)
+                return send(res, err.status, { ok: false, error: err.message });
+            // Deliberately generic: internal details (paths, key material) stay out of responses.
+            send(res, 500, { ok: false, error: 'internal error' });
+        });
+    });
+}

package/lib/store.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Encrypted document store for the hub.
+ *
+ * The whole dataset is a single JSON document (`<data-dir>/hub-data.json.enc`)
+ * holding at most a few dozen entries, so it is decrypted into memory on
+ * load and re-encrypted on every mutation; plaintext never touches the disk.
+ * Writes are atomic: encrypt to a uniquely-named temp file in the same
+ * directory, fsync it, rename over the target, then fsync the directory —
+ * a power cut cannot leave a torn or zero-length data file.
+ *
+ * Document shape:
+ *
+ * ```json
+ * { "version": 1, "entries": { "k8s/prod": {
+ *     "kind": "k8s", "name": "prod",
+ *     "envelope": { "name": "...", "description": "...", "environment": "prod" },
+ *     "tiers": { "ro": { "fields": { ... }, "probe": { ... } }, "rw": { "fields": { ... } } },
+ *     "updatedAt": "<ISO>" } },
+ *   "requests": { "<uuid>": { "kind": "...", "name": "...", "tier": "rw",
+ *     "fields": { ... }, "status": "pending", ... } } }
+ * ```
+ *
+ * `requests` is the agent-registration approval queue (see server.ts
+ * `/requests` routes); a decided request keeps its metadata but its `fields`
+ * are wiped.
+ *
+ * The hub is dumb storage: file fields hold their *content* (inlined at
+ * import time) and no kind-specific schema validation happens here.
+ *
+ * Mutations are also mirrored to an append-only audit log
+ * (`<data-dir>/audit.log`, one JSON object per line) — never containing
+ * field values.
+ *
+ * @module
+ */
+export type TierName = 'ro' | 'rw';
+export interface ProbeState {
+    status: 'verified' | 'mismatch' | 'unverifiable';
+    detail?: string;
+    probedAt: string;
+}
+export interface EntryEnvelope {
+    name?: string;
+    description?: string;
+    environment?: string;
+}
+export interface TierData {
+    fields: Record<string, unknown>;
+    probe?: ProbeState;
+}
+export interface HubEntry {
+    kind: string;
+    name: string;
+    envelope: EntryEnvelope;
+    tiers: {
+        ro?: TierData;
+        rw?: TierData;
+    };
+    updatedAt: string;
+}
+export type RequestStatus = 'pending' | 'approved' | 'rejected';
+/**
+ * A tier-registration request submitted by an agent, pending human approval.
+ * `fields` holds the secret material (encrypted at rest with the rest of the
+ * document) and is WIPED on decision — the approved copy lives on the entry.
+ */
+export interface RegistrationRequest {
+    id: string;
+    kind: string;
+    name: string;
+    tier: TierName;
+    fields: Record<string, unknown>;
+    envelope: EntryEnvelope;
+    reason?: string;
+    status: RequestStatus;
+    createdAt: string;
+    decidedAt?: string;
+}
+export interface AuditRecord {
+    ts: string;
+    role: 'admin' | 'read';
+    action: 'resolve' | 'put' | 'delete' | 'request' | 'approve' | 'reject';
+    kind: string;
+    name: string;
+    tier: TierName;
+}
+export interface HubStoreOptions {
+    dataDir: string;
+    /** Defaults to `<dataDir>/hub.key`. */
+    keyFile?: string;
+    /** Master key text (base64/hex); takes priority over the key file. */
+    envKey?: string;
+}
+export declare class HubStore {
+    readonly dataDir: string;
+    readonly dataFile: string;
+    readonly auditFile: string;
+    private readonly keyFile;
+    private readonly envKey?;
+    private key;
+    private doc;
+    constructor(opts: HubStoreOptions);
+    /** Resolve the master key and decrypt the data file (a missing file means a fresh hub). */
+    init(): Promise<void>;
+    /** Encrypt the in-memory document and atomically replace the data file (mode 0600). */
+    save(): Promise<void>;
+    list(): HubEntry[];
+    getEntry(kind: string, name: string): HubEntry | undefined;
+    /** Upsert one tier of an entry; `envelope` replaces the entry envelope wholesale when given. */
+    putTier(kind: string, name: string, tier: TierName, data: {
+        fields: Record<string, unknown>;
+        envelope?: EntryEnvelope;
+        probe?: ProbeState;
+    }): HubEntry;
+    /** Delete one tier; removes the whole entry when its last tier goes. Returns false when absent. */
+    deleteTier(kind: string, name: string, tier: TierName): boolean;
+    /** The requests map, created lazily (old data files predate the approval flow). */
+    private requests;
+    /** Queue a tier-registration request; returns the generated id. */
+    putRequest(data: {
+        kind: string;
+        name: string;
+        tier: TierName;
+        fields: Record<string, unknown>;
+        envelope: EntryEnvelope;
+        reason?: string;
+    }): RegistrationRequest;
+    listRequests(status?: RequestStatus): RegistrationRequest[];
+    getRequest(id: string): RegistrationRequest | undefined;
+    /**
+     * Settle a pending request. On approval the tier is written through
+     * `putTier`. Either way the request's `fields` are wiped — secret material
+     * must not linger in a decided record. Returns null when absent or not
+     * pending.
+     */
+    decideRequest(id: string, approved: boolean): RegistrationRequest | null;
+    /** Append one audit line. Field values are never recorded. */
+    audit(role: AuditRecord['role'], action: AuditRecord['action'], kind: string, name: string, tier: TierName): Promise<void>;
+    /** Read the most recent `limit` audit records, oldest first. */
+    readAudit(limit: number): Promise<AuditRecord[]>;
+}

package/lib/store.js

@@ -0,0 +1,229 @@
+/**
+ * Encrypted document store for the hub.
+ *
+ * The whole dataset is a single JSON document (`<data-dir>/hub-data.json.enc`)
+ * holding at most a few dozen entries, so it is decrypted into memory on
+ * load and re-encrypted on every mutation; plaintext never touches the disk.
+ * Writes are atomic: encrypt to a uniquely-named temp file in the same
+ * directory, fsync it, rename over the target, then fsync the directory —
+ * a power cut cannot leave a torn or zero-length data file.
+ *
+ * Document shape:
+ *
+ * ```json
+ * { "version": 1, "entries": { "k8s/prod": {
+ *     "kind": "k8s", "name": "prod",
+ *     "envelope": { "name": "...", "description": "...", "environment": "prod" },
+ *     "tiers": { "ro": { "fields": { ... }, "probe": { ... } }, "rw": { "fields": { ... } } },
+ *     "updatedAt": "<ISO>" } },
+ *   "requests": { "<uuid>": { "kind": "...", "name": "...", "tier": "rw",
+ *     "fields": { ... }, "status": "pending", ... } } }
+ * ```
+ *
+ * `requests` is the agent-registration approval queue (see server.ts
+ * `/requests` routes); a decided request keeps its metadata but its `fields`
+ * are wiped.
+ *
+ * The hub is dumb storage: file fields hold their *content* (inlined at
+ * import time) and no kind-specific schema validation happens here.
+ *
+ * Mutations are also mirrored to an append-only audit log
+ * (`<data-dir>/audit.log`, one JSON object per line) — never containing
+ * field values.
+ *
+ * @module
+ */
+import { appendFile, chmod, mkdir, open, readFile, rename } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { decryptDoc, encryptDoc, loadMasterKey } from './crypto.js';
+export class HubStore {
+    dataDir;
+    dataFile;
+    auditFile;
+    keyFile;
+    envKey;
+    key;
+    doc = { version: 1, entries: {} };
+    constructor(opts) {
+        this.dataDir = opts.dataDir;
+        this.dataFile = join(opts.dataDir, 'hub-data.json.enc');
+        this.auditFile = join(opts.dataDir, 'audit.log');
+        this.keyFile = opts.keyFile ?? join(opts.dataDir, 'hub.key');
+        this.envKey = opts.envKey;
+    }
+    /** Resolve the master key and decrypt the data file (a missing file means a fresh hub). */
+    async init() {
+        this.key = await loadMasterKey({ envKey: this.envKey, keyFile: this.keyFile });
+        let blob;
+        try {
+            blob = await readFile(this.dataFile, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return;
+            throw err;
+        }
+        this.doc = JSON.parse(decryptDoc(blob, this.key));
+    }
+    /** Encrypt the in-memory document and atomically replace the data file (mode 0600). */
+    async save() {
+        await mkdir(this.dataDir, { recursive: true });
+        const blob = encryptDoc(JSON.stringify(this.doc), this.key);
+        // Unique tmp name per save: concurrent saves must never share one file.
+        const tmp = `${this.dataFile}.tmp-${randomUUID()}`;
+        // fsync the payload before the rename so a power cut cannot leave a
+        // zero-length or stale-bytes data file behind the new name.
+        const fh = await open(tmp, 'w', 0o600);
+        try {
+            await fh.writeFile(blob);
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+        await rename(tmp, this.dataFile);
+        await chmod(this.dataFile, 0o600);
+        // fsync the directory so the rename itself is durable.
+        const dh = await open(this.dataDir, 'r');
+        try {
+            await dh.sync();
+        }
+        finally {
+            await dh.close();
+        }
+    }
+    list() {
+        return Object.values(this.doc.entries);
+    }
+    getEntry(kind, name) {
+        return this.doc.entries[`${kind}/${name}`];
+    }
+    /** Upsert one tier of an entry; `envelope` replaces the entry envelope wholesale when given. */
+    putTier(kind, name, tier, data) {
+        const key = `${kind}/${name}`;
+        const entry = this.doc.entries[key] ?? { kind, name, envelope: {}, tiers: {}, updatedAt: '' };
+        if (data.envelope !== undefined)
+            entry.envelope = data.envelope;
+        const tierData = { fields: data.fields };
+        if (data.probe !== undefined)
+            tierData.probe = data.probe;
+        entry.tiers[tier] = tierData;
+        entry.updatedAt = new Date().toISOString();
+        this.doc.entries[key] = entry;
+        return entry;
+    }
+    /** Delete one tier; removes the whole entry when its last tier goes. Returns false when absent. */
+    deleteTier(kind, name, tier) {
+        const key = `${kind}/${name}`;
+        const entry = this.doc.entries[key];
+        if (!entry || !entry.tiers[tier])
+            return false;
+        delete entry.tiers[tier];
+        if (!entry.tiers.ro && !entry.tiers.rw)
+            delete this.doc.entries[key];
+        else
+            entry.updatedAt = new Date().toISOString();
+        return true;
+    }
+    /** The requests map, created lazily (old data files predate the approval flow). */
+    requests() {
+        return (this.doc.requests ??= {});
+    }
+    /** Queue a tier-registration request; returns the generated id. */
+    putRequest(data) {
+        const request = {
+            id: randomUUID(),
+            kind: data.kind,
+            name: data.name,
+            tier: data.tier,
+            fields: data.fields,
+            envelope: data.envelope,
+            ...(data.reason !== undefined ? { reason: data.reason } : {}),
+            status: 'pending',
+            createdAt: new Date().toISOString(),
+        };
+        this.requests()[request.id] = request;
+        return request;
+    }
+    listRequests(status) {
+        const all = Object.values(this.requests());
+        return status === undefined ? all : all.filter((r) => r.status === status);
+    }
+    getRequest(id) {
+        return this.requests()[id];
+    }
+    /**
+     * Settle a pending request. On approval the tier is written through
+     * `putTier`. Either way the request's `fields` are wiped — secret material
+     * must not linger in a decided record. Returns null when absent or not
+     * pending.
+     */
+    decideRequest(id, approved) {
+        const request = this.requests()[id];
+        if (!request || request.status !== 'pending')
+            return null;
+        if (approved) {
+            this.putTier(request.kind, request.name, request.tier, { fields: request.fields, envelope: request.envelope });
+        }
+        request.status = approved ? 'approved' : 'rejected';
+        request.decidedAt = new Date().toISOString();
+        request.fields = {};
+        return request;
+    }
+    /** Append one audit line. Field values are never recorded. */
+    async audit(role, action, kind, name, tier) {
+        const record = { ts: new Date().toISOString(), role, action, kind, name, tier };
+        await mkdir(this.dataDir, { recursive: true });
+        // A crash mid-append can leave a torn tail line without a newline; a
+        // naive append would fuse the next record onto it and lose both. Start
+        // a fresh line when the file does not end with one.
+        let prefix = '';
+        try {
+            const fh = await open(this.auditFile, 'r');
+            try {
+                const { size } = await fh.stat();
+                if (size > 0) {
+                    const last = Buffer.alloc(1);
+                    await fh.read(last, 0, 1, size - 1);
+                    if (last[0] !== 0x0a)
+                        prefix = '\n';
+                }
+            }
+            finally {
+                await fh.close();
+            }
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        await appendFile(this.auditFile, prefix + JSON.stringify(record) + '\n', { mode: 0o600 });
+    }
+    /** Read the most recent `limit` audit records, oldest first. */
+    async readAudit(limit) {
+        let text;
+        try {
+            text = await readFile(this.auditFile, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return [];
+            throw err;
+        }
+        // Tolerate a torn final line (crash mid-append): skip unparseable
+        // records instead of poisoning every future read.
+        const records = text
+            .split('\n')
+            .filter((line) => line.trim() !== '')
+            .flatMap((line) => {
+            try {
+                return [JSON.parse(line)];
+            }
+            catch {
+                return [];
+            }
+        });
+        return records.slice(-limit);
+    }
+}