@keynv/core 0.1.0-rc.23

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 keynv-labs and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/audit/chain.d.ts

@@ -0,0 +1,44 @@
+import { type AuditEntry, type AuditInput } from './types.js';
+export declare function configureChainKey(key: Uint8Array | null): void;
+/** True once a tamper-evident chain key has been configured. */
+export declare function isChainKeyConfigured(): boolean;
+/**
+ * Computes the hash for a NEW audit entry. When a chain key is configured
+ * (via configureChainKey) this is an HMAC-SHA-256 tagged with the `v1:`
+ * prefix; otherwise it is a plain SHA-256 (not tamper-evident, legacy/test
+ * only).
+ */
+export declare function computeHash(prevHash: string, input: AuditInput): string;
+/**
+ * Builds the next chain entry. The caller persists the returned object
+ * verbatim (id is the auto-incremented row id from the DB).
+ *
+ * Pass `null` as `prev` when appending the very first entry.
+ */
+export declare function appendEntry(prev: AuditEntry | null, input: AuditInput, id: number): AuditEntry;
+export interface VerifyResult {
+    readonly ok: boolean;
+    /** Index (0-based, into `entries`) of the first inconsistent row. */
+    readonly brokenAt?: number;
+    readonly reason?: 'prev_hash_mismatch' | 'hash_mismatch';
+}
+export interface VerifyOptions {
+    /**
+     * The expected `prev_hash` of the first entry in `entries`. Defaults
+     * to GENESIS_HASH (the start of the chain). Set to the tail hash of
+     * the previous page when verifying a paginated chain so the cross-
+     * page boundary is checked. Without this, verifying any chain of
+     * more than one page produces a false `prev_hash_mismatch`.
+     */
+    readonly startingPrevHash?: string;
+}
+/**
+ * Walks an audit chain and reports the first inconsistency, if any.
+ *
+ * Verifies two invariants per row:
+ *  1. row.prev_hash equals the predecessor's hash (or
+ *     `opts.startingPrevHash` / GENESIS_HASH for the first row).
+ *  2. row.hash equals the recomputed hash over (prev_hash, inputs).
+ */
+export declare function verifyChain(entries: readonly AuditEntry[], opts?: VerifyOptions): VerifyResult;
+//# sourceMappingURL=chain.d.ts.map

package/dist/audit/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAgB,MAAM,YAAY,CAAC;AAwB5E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAE9D;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAgCD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvE;AAoBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAa9F;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,eAAe,CAAC;CAC1D;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,IAAI,GAAE,aAAkB,GACvB,YAAY,CAcd"}

package/dist/audit/chain.js

@@ -0,0 +1,134 @@
+import { createHash, createHmac } from 'node:crypto';
+import { GENESIS_HASH } from './types.js';
+/**
+ * HMAC key that makes the chain tamper-evident: an attacker with DB write
+ * access cannot recompute hashes without it. The server configures it from
+ * the KEK at startup (see configureChainKey). When no key is set, hashing
+ * uses a plain SHA-256 that is NOT tamper-evident — used only by tests.
+ *
+ * Keyed hashes carry a `v1:` prefix. Verification is STRICT and symmetric to
+ * the current configuration to defeat downgrade attacks: when a key IS
+ * configured every row must be a keyed (`v1:`) HMAC (a bare hash is rejected
+ * as a downgrade); when NO key is configured every row must be a bare keyless
+ * hash. There is intentionally no keyless fallback while a key is present, so
+ * an attacker cannot strip the prefix and recompute keyless to forge a row.
+ *
+ * Migration note: turning the key on establishes tamper-evidence for rows
+ * written from then on. A chain that contains rows written by an older
+ * keyless build will not HMAC-verify under a configured key — those rows are
+ * retained but reported as not verifiable.
+ */
+let chainHmacKey = null;
+const HMAC_PREFIX = 'v1:';
+export function configureChainKey(key) {
+    chainHmacKey = key;
+}
+/** True once a tamper-evident chain key has been configured. */
+export function isChainKeyConfigured() {
+    return chainHmacKey !== null;
+}
+/**
+ * JSON-canonicalize a payload so the hash is reproducible regardless of
+ * key insertion order. Sorts object keys at every level; arrays keep
+ * their original order. Undefined values are normalised to null to
+ * avoid JSON.stringify inconsistencies.
+ */
+function canonicalize(value) {
+    if (value === null || typeof value !== 'object') {
+        return value === undefined ? 'null' : JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalize).join(',')}]`;
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`);
+    return `{${parts.join(',')}}`;
+}
+function canonicalOf(prevHash, input) {
+    return canonicalize({
+        prev_hash: prevHash,
+        ts: input.ts,
+        actor_user_id: input.actor_user_id,
+        actor_agent: input.actor_agent,
+        event_type: input.event_type,
+        payload: input.payload,
+    });
+}
+/**
+ * Computes the hash for a NEW audit entry. When a chain key is configured
+ * (via configureChainKey) this is an HMAC-SHA-256 tagged with the `v1:`
+ * prefix; otherwise it is a plain SHA-256 (not tamper-evident, legacy/test
+ * only).
+ */
+export function computeHash(prevHash, input) {
+    const canonical = canonicalOf(prevHash, input);
+    if (chainHmacKey) {
+        return HMAC_PREFIX + createHmac('sha256', chainHmacKey).update(canonical, 'utf8').digest('hex');
+    }
+    return createHash('sha256').update(canonical, 'utf8').digest('hex');
+}
+/**
+ * Recomputes a stored hash and reports whether it matches, STRICTLY in the
+ * current key mode so a downgrade is impossible:
+ *  - key configured  → the row MUST be a `v1:` HMAC; a bare hash is rejected.
+ *  - no key configured → the row MUST be a bare keyless SHA-256; a `v1:` row
+ *    cannot be verified without the key and is rejected.
+ */
+function hashMatches(prevHash, input, storedHash) {
+    const canonical = canonicalOf(prevHash, input);
+    if (chainHmacKey) {
+        if (!storedHash.startsWith(HMAC_PREFIX))
+            return false; // downgrade attempt
+        const h = `${HMAC_PREFIX}${createHmac('sha256', chainHmacKey).update(canonical, 'utf8').digest('hex')}`;
+        return h === storedHash;
+    }
+    if (storedHash.startsWith(HMAC_PREFIX))
+        return false; // keyed row, no key to verify
+    return createHash('sha256').update(canonical, 'utf8').digest('hex') === storedHash;
+}
+/**
+ * Builds the next chain entry. The caller persists the returned object
+ * verbatim (id is the auto-incremented row id from the DB).
+ *
+ * Pass `null` as `prev` when appending the very first entry.
+ */
+export function appendEntry(prev, input, id) {
+    const prevHash = prev?.hash ?? GENESIS_HASH;
+    const hash = computeHash(prevHash, input);
+    return {
+        id,
+        prev_hash: prevHash,
+        hash,
+        ts: input.ts,
+        actor_user_id: input.actor_user_id,
+        actor_agent: input.actor_agent,
+        event_type: input.event_type,
+        payload: input.payload,
+    };
+}
+/**
+ * Walks an audit chain and reports the first inconsistency, if any.
+ *
+ * Verifies two invariants per row:
+ *  1. row.prev_hash equals the predecessor's hash (or
+ *     `opts.startingPrevHash` / GENESIS_HASH for the first row).
+ *  2. row.hash equals the recomputed hash over (prev_hash, inputs).
+ */
+export function verifyChain(entries, opts = {}) {
+    const expectedFirstPrevHash = opts.startingPrevHash ?? GENESIS_HASH;
+    for (let i = 0; i < entries.length; i++) {
+        const cur = entries[i];
+        if (!cur)
+            continue;
+        const expectedPrevHash = i === 0 ? expectedFirstPrevHash : entries[i - 1]?.hash;
+        if (cur.prev_hash !== expectedPrevHash) {
+            return { ok: false, brokenAt: i, reason: 'prev_hash_mismatch' };
+        }
+        if (!hashMatches(cur.prev_hash, cur, cur.hash)) {
+            return { ok: false, brokenAt: i, reason: 'hash_mismatch' };
+        }
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=chain.js.map

package/dist/audit/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/audit/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAoC,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5E;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAI,YAAY,GAAsB,IAAI,CAAC;AAE3C,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,YAAY,GAAG,GAAG,CAAC;AACrB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,KAAK,IAAI,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAiB;IACtD,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,QAAQ;QACnB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,KAAiB;IAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAiB,EAAE,UAAkB;IAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,oBAAoB;QAC3E,MAAM,CAAC,GAAG,GAAG,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxG,OAAO,CAAC,KAAK,UAAU,CAAC;IAC1B,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,8BAA8B;IACpF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,KAAiB,EAAE,EAAU;IAChF,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,IAAI,YAAY,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE;QACF,SAAS,EAAE,QAAQ;QACnB,IAAI;QACJ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAoBD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,OAA8B,EAC9B,OAAsB,EAAE;IAExB,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC;QAChF,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/audit/chain.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chain.test.d.ts.map

package/dist/audit/chain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.test.d.ts","sourceRoot":"","sources":["../../src/audit/chain.test.ts"],"names":[],"mappings":""}

package/dist/audit/chain.test.js

@@ -0,0 +1,192 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { GENESIS_HASH, appendEntry, computeHash, configureChainKey, isChainKeyConfigured, verifyChain, } from './index.js';
+function input(seed) {
+    return {
+        ts: `2026-05-09T12:00:${String(seed).padStart(2, '0')}.000Z`,
+        actor_user_id: 'u_alice',
+        actor_agent: 'cli-0.0.0',
+        event_type: 'secret.read.allowed',
+        payload: { alias: `@p.dev.k${seed}`, version: 1 },
+    };
+}
+function buildChain(n) {
+    const entries = [];
+    let prev = null;
+    for (let i = 0; i < n; i++) {
+        const e = appendEntry(prev, input(i), i + 1);
+        entries.push(e);
+        prev = e;
+    }
+    return entries;
+}
+describe('computeHash', () => {
+    it('is deterministic for equal inputs', () => {
+        const a = computeHash(GENESIS_HASH, input(1));
+        const b = computeHash(GENESIS_HASH, input(1));
+        expect(a).toBe(b);
+    });
+    it('changes when prev_hash changes', () => {
+        const a = computeHash(GENESIS_HASH, input(1));
+        const b = computeHash(`${'1'.repeat(64)}`, input(1));
+        expect(a).not.toBe(b);
+    });
+    it('is independent of payload key insertion order', () => {
+        const i = {
+            ts: '2026-05-09T12:00:00.000Z',
+            actor_user_id: 'u',
+            actor_agent: 'cli',
+            event_type: 'secret.read.allowed',
+            payload: { alias: '@p.d.k', version: 1, extra: { a: 1, b: 2 } },
+        };
+        const j = {
+            ...i,
+            payload: { extra: { b: 2, a: 1 }, version: 1, alias: '@p.d.k' },
+        };
+        expect(computeHash(GENESIS_HASH, i)).toBe(computeHash(GENESIS_HASH, j));
+    });
+    it('is 64 hex chars (SHA-256)', () => {
+        expect(computeHash(GENESIS_HASH, input(1))).toMatch(/^[0-9a-f]{64}$/);
+    });
+});
+describe('appendEntry', () => {
+    it('uses GENESIS_HASH for the first entry', () => {
+        const e = appendEntry(null, input(1), 1);
+        expect(e.prev_hash).toBe(GENESIS_HASH);
+        expect(e.hash).toMatch(/^[0-9a-f]{64}$/);
+    });
+    it('chains subsequent entries to the previous hash', () => {
+        const a = appendEntry(null, input(1), 1);
+        const b = appendEntry(a, input(2), 2);
+        expect(b.prev_hash).toBe(a.hash);
+    });
+    it('returns identical entries for the same input + prev', () => {
+        const a1 = appendEntry(null, input(1), 1);
+        const a2 = appendEntry(null, input(1), 1);
+        expect(a1.hash).toBe(a2.hash);
+    });
+});
+describe('verifyChain', () => {
+    it('returns ok for a valid chain', () => {
+        const chain = buildChain(50);
+        expect(verifyChain(chain)).toEqual({ ok: true });
+    });
+    it('returns ok for an empty chain', () => {
+        expect(verifyChain([])).toEqual({ ok: true });
+    });
+    it('detects a flipped payload byte (hash mismatch)', () => {
+        const chain = buildChain(10);
+        const tampered = chain.map((e, i) => i === 5 ? { ...e, payload: { ...e.payload, version: 999 } } : e);
+        const result = verifyChain(tampered);
+        expect(result.ok).toBe(false);
+        expect(result.brokenAt).toBe(5);
+        expect(result.reason).toBe('hash_mismatch');
+    });
+    it('detects a removed entry (prev_hash mismatch on the row that follows)', () => {
+        const chain = buildChain(10);
+        const truncated = [...chain.slice(0, 5), ...chain.slice(6)];
+        const result = verifyChain(truncated);
+        expect(result.ok).toBe(false);
+        expect(result.brokenAt).toBe(5);
+        expect(result.reason).toBe('prev_hash_mismatch');
+    });
+    it('detects a re-ordered entry', () => {
+        const chain = buildChain(10);
+        const swapped = [...chain.slice(0, 3), chain[4], chain[3], ...chain.slice(5)];
+        const result = verifyChain(swapped);
+        expect(result.ok).toBe(false);
+        expect(result.brokenAt).toBeGreaterThanOrEqual(3);
+    });
+    it('detects a forged entry inserted in the middle', () => {
+        const chain = buildChain(10);
+        const forged = {
+            id: 999,
+            prev_hash: chain[4].hash,
+            hash: '0'.repeat(64),
+            ...input(99),
+        };
+        const tampered = [...chain.slice(0, 5), forged, ...chain.slice(5)];
+        const result = verifyChain(tampered);
+        expect(result.ok).toBe(false);
+        expect(result.brokenAt).toBe(5);
+    });
+    it('handles a 1000-entry chain without false positives', () => {
+        const chain = buildChain(1000);
+        expect(verifyChain(chain)).toEqual({ ok: true });
+    });
+    it('verifies across page boundaries when startingPrevHash is threaded (regression for audit B1)', () => {
+        const chain = buildChain(2500);
+        const page1 = chain.slice(0, 1000);
+        const page2 = chain.slice(1000, 2000);
+        const page3 = chain.slice(2000);
+        expect(verifyChain(page1)).toEqual({ ok: true });
+        // Without startingPrevHash the second page falsely reports a
+        // mismatch — exactly the bug audit B1 caught.
+        expect(verifyChain(page2)).toMatchObject({ ok: false, reason: 'prev_hash_mismatch' });
+        // With startingPrevHash threaded, every page boundary checks out.
+        const tail1 = page1.at(-1);
+        const tail2 = page2.at(-1);
+        if (!tail1 || !tail2)
+            throw new Error('expected non-empty pages');
+        expect(verifyChain(page2, { startingPrevHash: tail1.hash })).toEqual({ ok: true });
+        expect(verifyChain(page3, { startingPrevHash: tail2.hash })).toEqual({ ok: true });
+    });
+    it('flags a tampered cross-page boundary', () => {
+        const chain = buildChain(2000);
+        const page1 = chain.slice(0, 1000);
+        const tail1 = page1.at(-1);
+        if (!tail1)
+            throw new Error('expected page1 non-empty');
+        const tamperedPage2 = chain
+            .slice(1000)
+            .map((e, i) => (i === 0 ? { ...e, prev_hash: 'a'.repeat(64) } : e));
+        const result = verifyChain(tamperedPage2, { startingPrevHash: tail1.hash });
+        expect(result.ok).toBe(false);
+        expect(result.brokenAt).toBe(0);
+        expect(result.reason).toBe('prev_hash_mismatch');
+    });
+});
+describe('tamper-evident (HMAC) chain key', () => {
+    const KEY = new Uint8Array(32).fill(7);
+    afterEach(() => configureChainKey(null)); // reset module-global between tests
+    it('tags keyed hashes with the v1: prefix and verifies them', () => {
+        configureChainKey(KEY);
+        expect(isChainKeyConfigured()).toBe(true);
+        const chain = buildChain(20);
+        expect(chain[0]?.hash.startsWith('v1:')).toBe(true);
+        expect(verifyChain(chain)).toEqual({ ok: true });
+    });
+    it('cannot be re-forged by recomputing keyless after a payload edit', () => {
+        configureChainKey(KEY);
+        const chain = buildChain(10);
+        // Attacker (no key) edits a payload and recomputes the hash keyless.
+        configureChainKey(null);
+        const forgedHash = computeHash(chain[5].prev_hash, {
+            ...input(5),
+            payload: { alias: '@p.dev.k5', version: 999 },
+        });
+        const tampered = chain.map((e, i) => i === 5 ? { ...e, payload: { alias: '@p.dev.k5', version: 999 }, hash: forgedHash } : e);
+        // Verifier (with the key) rejects it: the row is a v1: row, so a keyless
+        // recompute can never match.
+        configureChainKey(KEY);
+        const result = verifyChain(tampered);
+        expect(result.ok).toBe(false);
+        expect(result.reason).toBe('hash_mismatch');
+        expect(result.brokenAt).toBe(5);
+    });
+    it('reports a keyed chain as broken when the key is absent at verify time', () => {
+        configureChainKey(KEY);
+        const chain = buildChain(5);
+        configureChainKey(null);
+        expect(verifyChain(chain).ok).toBe(false);
+    });
+    it('rejects an entirely keyless chain when a key is configured (full-downgrade protection)', () => {
+        // An attacker who rewrites every row as keyless must NOT pass verification
+        // once the verifier holds the key.
+        configureChainKey(null);
+        const keyless = buildChain(5); // all bare SHA-256
+        expect(keyless[0]?.hash.startsWith('v1:')).toBe(false);
+        configureChainKey(KEY);
+        expect(verifyChain(keyless).ok).toBe(false);
+    });
+});
+//# sourceMappingURL=chain.test.js.map

package/dist/audit/chain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.test.js","sourceRoot":"","sources":["../../src/audit/chain.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,GACZ,MAAM,YAAY,CAAC;AAGpB,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO;QACL,EAAE,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO;QAC5D,aAAa,EAAE,SAAS;QACxB,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAe;YACpB,EAAE,EAAE,0BAA0B;YAC9B,aAAa,EAAE,GAAG;YAClB,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;SAChE,CAAC;QACF,MAAM,CAAC,GAAe;YACpB,GAAG,CAAC;YACJ,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE;SAChE,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,GAAG;YACP,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI;YACzB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,GAAG,KAAK,CAAC,EAAE,CAAC;SACb,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,6DAA6D;QAC7D,8CAA8C;QAC9C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAEtF,kEAAkE;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClE,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,KAAK;aACxB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oCAAoC;IAE9E,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7B,qEAAqE;QACrE,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE;YAClD,GAAG,KAAK,CAAC,CAAC,CAAC;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CACxF,CAAC;QACF,yEAAyE;QACzE,6BAA6B;QAC7B,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,2EAA2E;QAC3E,mCAAmC;QACnC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,5 @@
+export type { AuditEntry, AuditEventType, AuditInput } from './types.js';
+export { GENESIS_HASH } from './types.js';
+export { appendEntry, computeHash, configureChainKey, isChainKeyConfigured, verifyChain, type VerifyOptions, type VerifyResult, } from './chain.js';
+export { PAYLOAD_SCHEMAS, validateAuditPayload } from './payload-schemas.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,4 @@
+export { GENESIS_HASH } from './types.js';
+export { appendEntry, computeHash, configureChainKey, isChainKeyConfigured, verifyChain, } from './chain.js';
+export { PAYLOAD_SCHEMAS, validateAuditPayload } from './payload-schemas.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,GAGZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}