@iflow-mcp/jkheadley-instar 0.26.2

package/dist/core/SecretStore.js

@@ -0,0 +1,405 @@
+/**
+ * Encrypted secret storage and forward-secret sync protocol.
+ *
+ * At-rest encryption:
+ *   - Master key stored in OS keychain (macOS Keychain, Linux Secret Service)
+ *   - File fallback for headless servers (.instar/machine/secrets-master.key, 0600)
+ *   - AES-256-GCM encryption of secret store
+ *
+ * Wire encryption (for sync between machines):
+ *   - Ephemeral X25519 ECDH key exchange
+ *   - HKDF-SHA256 key derivation
+ *   - AES-256-GCM authenticated encryption
+ *   - Forward secrecy: ephemeral keys discarded after each transfer
+ *
+ * Part of Phase 4 (secret sync via tunnel).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { DegradationReporter } from '../monitoring/DegradationReporter.js';
+// ── Constants ────────────────────────────────────────────────────────
+const KEYCHAIN_SERVICE = 'instar-secret-store';
+const KEYCHAIN_ACCOUNT = 'master-key';
+const MASTER_KEY_LENGTH = 32; // AES-256
+const IV_LENGTH = 12; // AES-256-GCM
+const AUTH_TAG_LENGTH = 16;
+const HKDF_INFO = 'instar-secret-sync-v1';
+// ── Master Key Management ────────────────────────────────────────────
+/**
+ * Store/retrieve the master key from the OS keychain.
+ * Falls back to file-based storage if keychain is unavailable.
+ */
+export class MasterKeyManager {
+    stateDir;
+    forceFile;
+    keyFilePath;
+    constructor(stateDir, forceFile = false) {
+        this.stateDir = stateDir;
+        this.forceFile = forceFile;
+        this.keyFilePath = path.join(stateDir, 'machine', 'secrets-master.key');
+    }
+    /** Retrieve or generate the master key. */
+    getMasterKey() {
+        if (!this.forceFile) {
+            // Try keychain first
+            const keychainKey = this.readKeychain();
+            if (keychainKey)
+                return keychainKey;
+        }
+        // File fallback
+        return this.getFileKey();
+    }
+    /** Whether the master key is stored in the OS keychain (vs file fallback). */
+    get isKeychainBacked() {
+        if (this.forceFile)
+            return false;
+        try {
+            return this.readKeychain() !== null;
+        }
+        catch {
+            // @silent-fallback-ok — keychain unavailable, file fallback
+            return false;
+        }
+    }
+    // ── Keychain ────────────────────────────────────────────────────
+    readKeychain() {
+        if (process.platform === 'darwin') {
+            return this.readMacKeychain();
+        }
+        else if (process.platform === 'linux') {
+            return this.readLinuxKeychain();
+        }
+        return null; // Windows or unsupported — fall through to file
+    }
+    writeKeychain(key) {
+        if (process.platform === 'darwin') {
+            return this.writeMacKeychain(key);
+        }
+        else if (process.platform === 'linux') {
+            return this.writeLinuxKeychain(key);
+        }
+        return false;
+    }
+    readMacKeychain() {
+        try {
+            const result = execFileSync('security', [
+                'find-generic-password',
+                '-s', KEYCHAIN_SERVICE,
+                '-a', KEYCHAIN_ACCOUNT,
+                '-w', // Print password only
+            ], { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+            return Buffer.from(result, 'base64');
+        }
+        catch {
+            // @silent-fallback-ok — platform keychain read
+            return null;
+        }
+    }
+    writeMacKeychain(key) {
+        try {
+            // Delete existing entry first (ignore errors if it doesn't exist)
+            try {
+                execFileSync('security', [
+                    'delete-generic-password',
+                    '-s', KEYCHAIN_SERVICE,
+                    '-a', KEYCHAIN_ACCOUNT,
+                ], { stdio: 'pipe', timeout: 5000 });
+            }
+            catch {
+                // @silent-fallback-ok — entry may not exist
+            }
+            execFileSync('security', [
+                'add-generic-password',
+                '-s', KEYCHAIN_SERVICE,
+                '-a', KEYCHAIN_ACCOUNT,
+                '-w', key.toString('base64'),
+            ], { stdio: 'pipe', timeout: 5000 });
+            return true;
+        }
+        catch (err) {
+            DegradationReporter.getInstance().report({
+                feature: 'SecretStore.writeMacOSKeychain',
+                primary: 'Persist master key to macOS keychain',
+                fallback: 'Key only in memory — lost on restart',
+                reason: `Why: ${err instanceof Error ? err.message : String(err)}`,
+                impact: 'Master key not persisted, may be lost',
+            });
+            return false;
+        }
+    }
+    readLinuxKeychain() {
+        try {
+            const result = execFileSync('secret-tool', [
+                'lookup',
+                'service', KEYCHAIN_SERVICE,
+                'account', KEYCHAIN_ACCOUNT,
+            ], { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+            return Buffer.from(result, 'base64');
+        }
+        catch {
+            // @silent-fallback-ok — linux keychain read
+            return null;
+        }
+    }
+    writeLinuxKeychain(key) {
+        try {
+            execFileSync('secret-tool', [
+                'store',
+                '--label', 'Instar Secret Store Master Key',
+                'service', KEYCHAIN_SERVICE,
+                'account', KEYCHAIN_ACCOUNT,
+            ], {
+                input: key.toString('base64'),
+                timeout: 5000,
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            return true;
+        }
+        catch (err) {
+            DegradationReporter.getInstance().report({
+                feature: 'SecretStore.writeLinuxKeychain',
+                primary: 'Persist master key to Linux keychain',
+                fallback: 'Key only in memory — lost on restart',
+                reason: `Why: ${err instanceof Error ? err.message : String(err)}`,
+                impact: 'Master key not persisted, may be lost',
+            });
+            return false;
+        }
+    }
+    // ── File fallback ───────────────────────────────────────────────
+    getFileKey() {
+        if (fs.existsSync(this.keyFilePath)) {
+            const hex = fs.readFileSync(this.keyFilePath, 'utf-8').trim();
+            return Buffer.from(hex, 'hex');
+        }
+        // Generate new key
+        const key = crypto.randomBytes(MASTER_KEY_LENGTH);
+        // Try to store in keychain first
+        if (!this.forceFile && this.writeKeychain(key)) {
+            return key;
+        }
+        // Write to file with restrictive permissions
+        const dir = path.dirname(this.keyFilePath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(this.keyFilePath, key.toString('hex'), { mode: 0o600 });
+        return key;
+    }
+}
+// ── Secret Store (At-Rest) ───────────────────────────────────────────
+export class SecretStore {
+    stateDir;
+    keyManager;
+    encryptedPath;
+    constructor(config) {
+        this.stateDir = config.stateDir;
+        this.keyManager = new MasterKeyManager(config.stateDir, config.forceFileKey);
+        this.encryptedPath = path.join(config.stateDir, 'secrets', 'config.secrets.enc');
+    }
+    /** Read and decrypt secrets from the encrypted store. Returns empty object if no secrets exist. */
+    read() {
+        if (!fs.existsSync(this.encryptedPath)) {
+            return {};
+        }
+        const raw = fs.readFileSync(this.encryptedPath);
+        const masterKey = this.keyManager.getMasterKey();
+        return this.decryptAES(raw, masterKey);
+    }
+    /** Encrypt and write secrets to the store. */
+    write(secrets) {
+        const masterKey = this.keyManager.getMasterKey();
+        const encrypted = this.encryptAES(secrets, masterKey);
+        const dir = path.dirname(this.encryptedPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        // Atomic write via temp file
+        const tmpPath = this.encryptedPath + '.tmp';
+        fs.writeFileSync(tmpPath, encrypted, { mode: 0o600 });
+        fs.renameSync(tmpPath, this.encryptedPath);
+    }
+    /** Get a specific secret by dot-notation path (e.g., 'telegram.token'). */
+    get(keyPath) {
+        const secrets = this.read();
+        return getNestedValue(secrets, keyPath);
+    }
+    /** Set a specific secret by dot-notation path. */
+    set(keyPath, value) {
+        const secrets = this.read();
+        setNestedValue(secrets, keyPath, value);
+        this.write(secrets);
+    }
+    /** Delete a specific secret by dot-notation path. */
+    delete(keyPath) {
+        const secrets = this.read();
+        deleteNestedValue(secrets, keyPath);
+        this.write(secrets);
+    }
+    /** Whether the secret store file exists. */
+    get exists() {
+        return fs.existsSync(this.encryptedPath);
+    }
+    /** Whether the master key is in the OS keychain. */
+    get isKeychainBacked() {
+        return this.keyManager.isKeychainBacked;
+    }
+    /** Delete the encrypted store file. */
+    destroy() {
+        if (fs.existsSync(this.encryptedPath)) {
+            fs.unlinkSync(this.encryptedPath);
+        }
+    }
+    // ── AES-256-GCM Helpers ────────────────────────────────────────
+    encryptAES(data, key) {
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+        const plaintext = Buffer.from(JSON.stringify(data), 'utf-8');
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        // Format: [iv (12)] [tag (16)] [ciphertext]
+        return Buffer.concat([iv, tag, encrypted]);
+    }
+    decryptAES(raw, key) {
+        if (raw.length < IV_LENGTH + AUTH_TAG_LENGTH + 1) {
+            throw new Error('SecretStore: encrypted file is too short (corrupted?)');
+        }
+        const iv = raw.subarray(0, IV_LENGTH);
+        const tag = raw.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+        const ciphertext = raw.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+        const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return JSON.parse(decrypted.toString('utf-8'));
+    }
+}
+// ── Forward-Secret Wire Encryption ───────────────────────────────────
+/**
+ * Encrypt secrets for wire transfer using forward-secret ECDH.
+ *
+ * Protocol:
+ * 1. Generate ephemeral X25519 key pair
+ * 2. ECDH: ephemeral private + recipient's long-term public = shared secret
+ * 3. HKDF-SHA256 to derive AES-256 key
+ * 4. AES-256-GCM encrypt
+ * 5. Return: { ephemeralPublicKey, iv, ciphertext, tag }
+ *
+ * The ephemeral private key is not retained — forward secrecy.
+ */
+export function encryptForSync(secrets, recipientPublicKeyBase64) {
+    // Generate ephemeral X25519 key pair
+    const ephemeral = crypto.generateKeyPairSync('x25519');
+    const ephemeralPublicRaw = ephemeral.publicKey.export({ type: 'spki', format: 'der' });
+    // X25519 SPKI DER: 12-byte header + 32-byte key
+    const ephemeralPublicBytes = ephemeralPublicRaw.subarray(ephemeralPublicRaw.length - 32);
+    // Reconstruct recipient's X25519 public key from base64
+    // Handles both raw 32-byte keys and full SPKI DER (44 bytes)
+    const recipientPublicBytes = Buffer.from(recipientPublicKeyBase64, 'base64');
+    const recipientSpki = recipientPublicBytes.length === 32
+        ? buildX25519Spki(recipientPublicBytes)
+        : recipientPublicBytes; // Already SPKI DER
+    const recipientKey = crypto.createPublicKey({
+        key: recipientSpki,
+        format: 'der',
+        type: 'spki',
+    });
+    // ECDH: shared secret
+    const sharedSecret = crypto.diffieHellman({
+        privateKey: ephemeral.privateKey,
+        publicKey: recipientKey,
+    });
+    // HKDF: derive AES-256 key
+    const salt = ephemeralPublicBytes;
+    const derivedKey = crypto.hkdfSync('sha256', sharedSecret, salt, HKDF_INFO, 32);
+    // AES-256-GCM encrypt
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv('aes-256-gcm', Buffer.from(derivedKey), iv);
+    const plaintext = Buffer.from(JSON.stringify(secrets), 'utf-8');
+    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        ephemeralPublicKey: ephemeralPublicBytes.toString('base64'),
+        iv: iv.toString('base64'),
+        ciphertext: encrypted.toString('base64'),
+        tag: tag.toString('base64'),
+    };
+}
+/**
+ * Decrypt secrets received via wire transfer.
+ *
+ * Protocol:
+ * 1. ECDH: own private key + sender's ephemeral public = shared secret
+ * 2. HKDF-SHA256 to derive AES-256 key
+ * 3. AES-256-GCM decrypt
+ */
+export function decryptFromSync(payload, ownPrivateKey) {
+    // Reconstruct sender's ephemeral public key
+    const ephemeralPublicBytes = Buffer.from(payload.ephemeralPublicKey, 'base64');
+    const ephemeralKey = crypto.createPublicKey({
+        key: buildX25519Spki(ephemeralPublicBytes),
+        format: 'der',
+        type: 'spki',
+    });
+    // ECDH: shared secret
+    const sharedSecret = crypto.diffieHellman({
+        privateKey: ownPrivateKey,
+        publicKey: ephemeralKey,
+    });
+    // HKDF: derive AES-256 key
+    const salt = ephemeralPublicBytes;
+    const derivedKey = crypto.hkdfSync('sha256', sharedSecret, salt, HKDF_INFO, 32);
+    // AES-256-GCM decrypt
+    const iv = Buffer.from(payload.iv, 'base64');
+    const ciphertext = Buffer.from(payload.ciphertext, 'base64');
+    const tag = Buffer.from(payload.tag, 'base64');
+    const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(derivedKey), iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return JSON.parse(decrypted.toString('utf-8'));
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+/** Build X25519 SPKI DER from raw 32-byte public key. */
+function buildX25519Spki(publicKeyRaw) {
+    // X25519 SPKI header (12 bytes): 30 2a 30 05 06 03 2b 65 6e 03 21 00
+    const header = Buffer.from('302a300506032b656e032100', 'hex');
+    return Buffer.concat([header, publicKeyRaw]);
+}
+/** Get nested value from object using dot notation. */
+function getNestedValue(obj, keyPath) {
+    const parts = keyPath.split('.');
+    let current = obj;
+    for (const part of parts) {
+        if (current === null || current === undefined || typeof current !== 'object') {
+            return undefined;
+        }
+        current = current[part];
+    }
+    return current;
+}
+/** Set nested value in object using dot notation. */
+function setNestedValue(obj, keyPath, value) {
+    const parts = keyPath.split('.');
+    let current = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        if (!(parts[i] in current) || typeof current[parts[i]] !== 'object') {
+            current[parts[i]] = {};
+        }
+        current = current[parts[i]];
+    }
+    current[parts[parts.length - 1]] = value;
+}
+/** Delete nested value from object using dot notation. */
+function deleteNestedValue(obj, keyPath) {
+    const parts = keyPath.split('.');
+    let current = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        if (!(parts[i] in current) || typeof current[parts[i]] !== 'object') {
+            return; // Path doesn't exist
+        }
+        current = current[parts[i]];
+    }
+    delete current[parts[parts.length - 1]];
+}
+//# sourceMappingURL=SecretStore.js.map

package/dist/core/SecretStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretStore.js","sourceRoot":"","sources":["../../src/core/SecretStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,wEAAwE;AAExE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,CAAC,CAAC,UAAU;AACxC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,cAAc;AACpC,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,SAAS,GAAG,uBAAuB,CAAC;AA0B1C,wEAAwE;AAExE;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACjB,SAAS,CAAU;IACnB,WAAW,CAAS;IAE5B,YAAY,QAAgB,EAAE,SAAS,GAAG,KAAK;QAC7C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IAED,2CAA2C;IAC3C,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,qBAAqB;YACrB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,WAAW;gBAAE,OAAO,WAAW,CAAC;QACtC,CAAC;QAED,gBAAgB;QAChB,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,IAAI,gBAAgB;QAClB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mEAAmE;IAE3D,YAAY;QAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,gDAAgD;IAC/D,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE;gBACtC,uBAAuB;gBACvB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,sBAAsB;aAC7B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,CAAC;gBACH,YAAY,CAAC,UAAU,EAAE;oBACvB,yBAAyB;oBACzB,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,gBAAgB;iBACvB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;YAED,YAAY,CAAC,UAAU,EAAE;gBACvB,sBAAsB;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC7B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC;gBACvC,OAAO,EAAE,gCAAgC;gBACzC,OAAO,EAAE,sCAAsC;gBAC/C,QAAQ,EAAE,sCAAsC;gBAChD,MAAM,EAAE,QAAQ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClE,MAAM,EAAE,uCAAuC;aAChD,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,EAAE;gBACzC,QAAQ;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,SAAS,EAAE,gBAAgB;aAC5B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,GAAW;QACpC,IAAI,CAAC;YACH,YAAY,CAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,gCAAgC;gBAC3C,SAAS,EAAE,gBAAgB;gBAC3B,SAAS,EAAE,gBAAgB;aAC5B,EAAE;gBACD,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC;gBACvC,OAAO,EAAE,gCAAgC;gBACzC,OAAO,EAAE,sCAAsC;gBAC/C,QAAQ,EAAE,sCAAsC;gBAChD,MAAM,EAAE,QAAQ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAClE,MAAM,EAAE,uCAAuC;aAChD,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mEAAmE;IAE3D,UAAU;QAChB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,mBAAmB;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAElD,iCAAiC;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC;QAED,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,OAAO,WAAW;IACd,QAAQ,CAAS;IACjB,UAAU,CAAmB;IAC7B,aAAa,CAAS;IAE9B,YAAY,MAAyB;QACnC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnF,CAAC;IAED,mGAAmG;IACnG,IAAI;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,OAAgB;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,6BAA6B;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,OAAe;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,kDAAkD;IAClD,GAAG,CAAC,OAAe,EAAE,KAAc;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,OAAe;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM;QACR,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,oDAAoD;IACpD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC1C,CAAC;IAED,uCAAuC;IACvC,OAAO;QACL,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,kEAAkE;IAE1D,UAAU,CAAC,IAAa,EAAE,GAAW;QAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,4CAA4C;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAAW,EAAE,GAAW;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgB,EAChB,wBAAgC;IAEhC,qCAAqC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,kBAAkB,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,gDAAgD;IAChD,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAEzF,wDAAwD;IACxD,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,KAAK,EAAE;QACtD,CAAC,CAAC,eAAe,CAAC,oBAAoB,CAAC;QACvC,CAAC,CAAC,oBAAoB,CAAC,CAAC,mBAAmB;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC;QAC1C,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACxC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,YAAY;KACxB,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAEhF,sBAAsB;IACtB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,kBAAkB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3D,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA+B,EAC/B,aAA+B;IAE/B,4CAA4C;IAC5C,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC;QAC1C,GAAG,EAAE,eAAe,CAAC,oBAAoB,CAAC;QAC1C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;QACxC,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,YAAY;KACxB,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAEhF,sBAAsB;IACtB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,wEAAwE;AAExE,yDAAyD;AACzD,SAAS,eAAe,CAAC,YAAoB;IAC3C,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,uDAAuD;AACvD,SAAS,cAAc,CAAC,GAA4B,EAAE,OAAe;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qDAAqD;AACrD,SAAS,cAAc,CAAC,GAA4B,EAAE,OAAe,EAAE,KAAc;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAA4B,GAAG,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4B,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAC3C,CAAC;AAED,0DAA0D;AAC1D,SAAS,iBAAiB,CAAC,GAA4B,EAAE,OAAe;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAA4B,GAAG,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpE,OAAO,CAAC,qBAAqB;QAC/B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4B,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/core/SecurityLog.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Security event log with hash-chain integrity.
+ *
+ * Append-only JSONL log where each entry includes a prevHash field
+ * containing the SHA-256 hash of the previous entry. This makes
+ * retroactive tampering detectable — altering any entry breaks
+ * the chain for all subsequent entries.
+ *
+ * Part of Phase 1 (machine identity infrastructure).
+ */
+export type SecurityEventType = 'pairing_attempt' | 'pairing_success' | 'pairing_failure' | 'signature_verification_failure' | 'nonce_replay_detected' | 'machine_revoked' | 'role_transition' | 'lock_acquired' | 'lock_contention' | 'unauthorized_user_blocked' | 'secret_sync' | 'split_brain_detected' | 'auto_failover' | 'tiebreaker_promotion';
+export interface SecurityEvent {
+    timestamp: string;
+    event: SecurityEventType;
+    machineId: string;
+    prevHash: string;
+    /** Additional event-specific data */
+    [key: string]: unknown;
+}
+export declare class SecurityLog {
+    private logPath;
+    private lastHash;
+    private initialized;
+    constructor(logsDir: string);
+    /**
+     * Initialize the log by reading the last entry's hash.
+     * Must be called before appending. Idempotent.
+     */
+    initialize(): void;
+    /**
+     * Append a security event to the log.
+     */
+    append(eventData: Omit<SecurityEvent, 'timestamp' | 'prevHash'>): SecurityEvent;
+    /**
+     * Read all log entries.
+     */
+    readAll(): SecurityEvent[];
+    /**
+     * Verify the integrity of the hash chain.
+     * Returns { valid: true } if the chain is intact, or
+     * { valid: false, brokenAt: index } if tampering is detected.
+     */
+    verifyChain(): {
+        valid: true;
+    } | {
+        valid: false;
+        brokenAt: number;
+    };
+    /**
+     * Get the number of entries in the log.
+     */
+    get length(): number;
+    /**
+     * Get the path to the log file.
+     */
+    get path(): string;
+}
+//# sourceMappingURL=SecurityLog.d.ts.map

package/dist/core/SecurityLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityLog.d.ts","sourceRoot":"","sources":["../../src/core/SecurityLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,MAAM,iBAAiB,GACzB,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,gCAAgC,GAChC,uBAAuB,GACvB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,2BAA2B,GAC3B,aAAa,GACb,sBAAsB,GACtB,eAAe,GACf,sBAAsB,CAAC;AAE3B,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AASD,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAAkB;gBAEzB,OAAO,EAAE,MAAM;IAK3B;;;OAGG;IACH,UAAU,IAAI,IAAI;IAiBlB;;OAEG;IACH,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,aAAa;IAsB/E;;OAEG;IACH,OAAO,IAAI,aAAa,EAAE;IAS1B;;;;OAIG;IACH,WAAW,IAAI;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAsBnE;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAKnB;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/core/SecurityLog.js

@@ -0,0 +1,123 @@
+/**
+ * Security event log with hash-chain integrity.
+ *
+ * Append-only JSONL log where each entry includes a prevHash field
+ * containing the SHA-256 hash of the previous entry. This makes
+ * retroactive tampering detectable — altering any entry breaks
+ * the chain for all subsequent entries.
+ *
+ * Part of Phase 1 (machine identity infrastructure).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { maybeRotateJsonl } from '../utils/jsonl-rotation.js';
+// ── Constants ────────────────────────────────────────────────────────
+const GENESIS_HASH = 'GENESIS';
+const LOG_FILE = 'security.jsonl';
+// ── SecurityLog ──────────────────────────────────────────────────────
+export class SecurityLog {
+    logPath;
+    lastHash;
+    initialized = false;
+    constructor(logsDir) {
+        this.logPath = path.join(logsDir, LOG_FILE);
+        this.lastHash = GENESIS_HASH;
+    }
+    /**
+     * Initialize the log by reading the last entry's hash.
+     * Must be called before appending. Idempotent.
+     */
+    initialize() {
+        if (this.initialized)
+            return;
+        fs.mkdirSync(path.dirname(this.logPath), { recursive: true });
+        if (fs.existsSync(this.logPath)) {
+            const content = fs.readFileSync(this.logPath, 'utf-8').trim();
+            if (content) {
+                const lines = content.split('\n');
+                const lastLine = lines[lines.length - 1];
+                this.lastHash = hashEntry(lastLine);
+            }
+        }
+        this.initialized = true;
+    }
+    /**
+     * Append a security event to the log.
+     */
+    append(eventData) {
+        this.initialize();
+        // Rotate before building the entry — rotation changes the last hash
+        if (maybeRotateJsonl(this.logPath)) {
+            this.initialized = false;
+            this.initialize();
+        }
+        const entry = {
+            timestamp: new Date().toISOString(),
+            prevHash: this.lastHash,
+            ...eventData,
+        };
+        const line = JSON.stringify(entry);
+        fs.appendFileSync(this.logPath, line + '\n');
+        this.lastHash = hashEntry(line);
+        return entry;
+    }
+    /**
+     * Read all log entries.
+     */
+    readAll() {
+        if (!fs.existsSync(this.logPath))
+            return [];
+        const content = fs.readFileSync(this.logPath, 'utf-8').trim();
+        if (!content)
+            return [];
+        return content.split('\n').map(line => JSON.parse(line));
+    }
+    /**
+     * Verify the integrity of the hash chain.
+     * Returns { valid: true } if the chain is intact, or
+     * { valid: false, brokenAt: index } if tampering is detected.
+     */
+    verifyChain() {
+        if (!fs.existsSync(this.logPath))
+            return { valid: true };
+        const content = fs.readFileSync(this.logPath, 'utf-8').trim();
+        if (!content)
+            return { valid: true };
+        const lines = content.split('\n');
+        let expectedPrevHash = GENESIS_HASH;
+        for (let i = 0; i < lines.length; i++) {
+            const entry = JSON.parse(lines[i]);
+            if (entry.prevHash !== expectedPrevHash) {
+                return { valid: false, brokenAt: i };
+            }
+            expectedPrevHash = hashEntry(lines[i]);
+        }
+        return { valid: true };
+    }
+    /**
+     * Get the number of entries in the log.
+     */
+    get length() {
+        if (!fs.existsSync(this.logPath))
+            return 0;
+        const content = fs.readFileSync(this.logPath, 'utf-8').trim();
+        if (!content)
+            return 0;
+        return content.split('\n').length;
+    }
+    /**
+     * Get the path to the log file.
+     */
+    get path() {
+        return this.logPath;
+    }
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+/**
+ * Compute the SHA-256 hash of a JSON line.
+ */
+function hashEntry(jsonLine) {
+    return `sha256:${crypto.createHash('sha256').update(jsonLine).digest('hex')}`;
+}
+//# sourceMappingURL=SecurityLog.js.map

package/dist/core/SecurityLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityLog.js","sourceRoot":"","sources":["../../src/core/SecurityLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AA6B9D,wEAAwE;AAExE,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC,wEAAwE;AAExE,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,WAAW,GAAY,KAAK,CAAC;IAErC,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAwD;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,oEAAoE;QACpE,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,SAAS;SACI,CAAC;QAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAEhC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAE5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAEzD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,gBAAgB,GAAG,YAAY,CAAC;QAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAkB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAElD,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACvC,CAAC;YAED,gBAAgB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED,wEAAwE;AAExE;;GAEG;AACH,SAAS,SAAS,CAAC,QAAgB;IACjC,OAAO,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC"}