@omnitype-code/journal 2.0.0

package/dist/schema/events.d.ts

@@ -0,0 +1,224 @@
+/**
+ * OmniType v2 canonical event schema.
+ *
+ * Design rules:
+ *  - Every event is immutable once appended.
+ *  - Probabilistic attribution is always tagged; no silent defaults to "ai".
+ *  - Origin requires positive evidence; unknown is a valid (and honest) value.
+ */
+export type Bytes32 = string;
+export type Bytes16 = string;
+export type Bytes20 = string;
+export type UnixMicros = number;
+export type Origin = 'ai' | 'user' | 'paste' | 'tool' | 'external' | 'unknown';
+export type Intent = 'type' | 'edit-tool' | 'format' | 'paste' | 'refactor' | 'import' | 'snippet' | 'undo' | 'redo' | 'git-checkout' | 'unknown';
+/** Attribution confidence tier. T0 is deterministic; T3 is best-effort guess. */
+export type Tier = 'T0' | 'T1' | 'T2' | 'T3';
+export interface Actor {
+    kind: 'ai' | 'human' | 'tool' | 'system' | 'unknown';
+    tool: string;
+    tool_pid?: number;
+    tool_ppid?: number;
+    tool_path?: string;
+    model?: string;
+    session_id?: string;
+    user: string;
+    host: string;
+    workspace: string;
+}
+export interface Splice {
+    offset: number;
+    delete_len: number;
+    insert_text: string;
+    insert_blob?: Bytes32;
+}
+export type AttributionSignal = 'sentinel' | 'process-list' | 'lsp-client' | 'git' | 'formatter-config' | 'ide-host' | 'transcript' | 'none';
+export interface ActorCandidate {
+    actor: Actor;
+    signal: AttributionSignal;
+    weight: number;
+}
+export interface EventHeader {
+    v: 2;
+    seq: number;
+    ts: UnixMicros;
+    actor: Actor;
+    prev: Bytes32;
+    nonce: Bytes16;
+    tier: Tier;
+    adapter_id: string;
+    sig: Bytes32;
+}
+export interface FileOpened {
+    type: 'FileOpened';
+    path: string;
+    blob_sha256: Bytes32;
+    line_count: number;
+    byte_count: number;
+    origin_seed: 'git' | 'fresh' | 'external';
+    git_blob?: Bytes20;
+}
+export interface EditOp {
+    type: 'EditOp';
+    path: string;
+    pre_hash: Bytes32;
+    post_hash: Bytes32;
+    ops: Splice[];
+    origin: Origin;
+    intent: Intent;
+    parent_intent?: number;
+}
+export interface EditConfirmed {
+    type: 'EditConfirmed';
+    path: string;
+    observed_hash: Bytes32;
+    edit_op_seq: number;
+}
+export interface UnattributedDelta {
+    type: 'UnattributedDelta';
+    path: string;
+    pre_hash: Bytes32;
+    post_hash: Bytes32;
+    ops?: Splice[];
+    delta_bytes?: number;
+    candidates?: ActorCandidate[];
+    confidence: number;
+}
+export interface SessionStarted {
+    type: 'SessionStarted';
+    session_id: string;
+    tool: string;
+    model: string;
+    prompt_hash: Bytes32;
+    prompt_bytes: number;
+    prompt_deferred?: boolean;
+    parent_session?: string;
+}
+export interface SessionEnded {
+    type: 'SessionEnded';
+    session_id: string;
+    reason: 'user' | 'timeout' | 'tool-exit';
+}
+export interface TxnBegin {
+    type: 'TxnBegin';
+    txn_id: Bytes16;
+    session_id: string;
+    expected_files: string[];
+}
+export interface TxnCommit {
+    type: 'TxnCommit';
+    txn_id: Bytes16;
+    event_seqs: number[];
+}
+export interface TxnAbort {
+    type: 'TxnAbort';
+    txn_id: Bytes16;
+    reason: string;
+}
+export interface ModelClaim {
+    type: 'ModelClaim';
+    session_id: string;
+    model: string;
+    source: 'sdk-call' | 'hook-stdin' | 'transcript' | 'config-file' | 'env' | 'inference';
+}
+export interface PromptCapture {
+    type: 'PromptCapture';
+    session_id: string;
+    prompt_id: string;
+    prompt_hash: Bytes32;
+    prompt_bytes: number;
+    prompt_text?: string;
+    privacy_marks: Array<'pii-suspected' | 'secret-detected'>;
+    client_scrubbed: boolean;
+}
+export interface CapabilityClaim {
+    type: 'CapabilityClaim';
+    adapter_id: string;
+    capabilities: Record<string, 'available' | 'degraded' | 'unavailable'>;
+    tier_breakdown: Record<string, number>;
+}
+export interface Marker {
+    type: 'Marker';
+    kind: 'undo' | 'redo' | 'format-on-save' | 'git-checkout' | 'workspace-snapshot' | 'rebase-start' | 'daemon-start' | 'daemon-stop';
+    detail?: string;
+}
+export interface TierShift {
+    type: 'TierShift';
+    adapter_id: string;
+    from_tier: Tier;
+    to_tier: Tier;
+    reason: string;
+    capability?: string;
+}
+export interface AttestationClaim {
+    type: 'AttestationClaim';
+    adapter_id: string;
+    path: string;
+    byte_start: number;
+    byte_end: number;
+    origin: Origin;
+    tier: Tier;
+    confidence: number;
+    basis: string;
+}
+export interface IntentOverride {
+    type: 'IntentOverride';
+    path: string;
+    original_seq: number;
+    new_intent: Intent;
+    detector: string;
+}
+export interface AdapterInstalled {
+    type: 'AdapterInstalled';
+    adapter_id: string;
+    trust_circle: number;
+    declared_capabilities: string[];
+    manifest_sig_verified: boolean;
+    runtime_mode: 'co-process' | 'in-process' | 'out-of-process' | 'hook';
+}
+export interface DevIdentity {
+    type: 'DevIdentity';
+    dev_key_fingerprint: string;
+    install_id: string;
+    enrolled_at: UnixMicros;
+}
+export interface Heartbeat {
+    type: 'Heartbeat';
+    head_seq: number;
+    head_hash: Bytes32;
+}
+export type EventBody = FileOpened | EditOp | EditConfirmed | UnattributedDelta | SessionStarted | SessionEnded | TxnBegin | TxnCommit | TxnAbort | ModelClaim | PromptCapture | CapabilityClaim | TierShift | AttestationClaim | IntentOverride | AdapterInstalled | DevIdentity | Marker | Heartbeat;
+export type JournalEvent = EventHeader & EventBody;
+export interface Span {
+    path: string;
+    byte_start: number;
+    byte_end: number;
+    origin: Origin;
+    actor: Actor;
+    seq_introduced: number;
+    seq_last_touched: number;
+    txn_id: Bytes16 | null;
+    tier: Tier;
+    confidence: number;
+    formatted: boolean;
+}
+export interface FileState {
+    path: string;
+    hash: Bytes32;
+    byte_count: number;
+    last_seq: number;
+    tracking_status: 'unknown' | 'tracked' | 'quarantined' | 'reconciling';
+}
+export interface InstallInfo {
+    install_id: string;
+    user: string;
+    host: string;
+    workspace: string;
+    created_at: UnixMicros;
+    protocol_version: '2.0';
+    org_id?: string | null;
+    auth_token?: string | null;
+    project_name?: string;
+    hardened?: boolean;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/schema/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/schema/events.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAC7B,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,MAAM,MAAM,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAC/E,MAAM,MAAM,MAAM,GACd,MAAM,GACN,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,GACV,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,GACN,cAAc,GACd,SAAS,CAAC;AAEd,iFAAiF;AACjF,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAI7C,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAID,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,cAAc,GACd,YAAY,GACZ,KAAK,GACL,kBAAkB,GAClB,UAAU,GACV,YAAY,GACZ,MAAM,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,UAAU,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;CACd;AAID,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,KAAK,GAAG,OAAO,GAAG,UAAU,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC;CAC1C;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,KAAK,GAAG,WAAW,CAAC;CACxF;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,KAAK,CAAC,eAAe,GAAG,iBAAiB,CAAC,CAAC;IAC1D,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACvE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EACA,MAAM,GACN,MAAM,GACN,gBAAgB,GAChB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,aAAa,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAKD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,GAAG,MAAM,CAAC;CACvE;AAID,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,MAAM,SAAS,GACjB,UAAU,GACV,MAAM,GACN,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,UAAU,GACV,aAAa,GACb,eAAe,GACf,SAAS,GACT,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAInD,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,CAAC;CACxE;AAID,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;IACvB,gBAAgB,EAAE,KAAK,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}

package/dist/schema/events.js

@@ -0,0 +1,10 @@
+/**
+ * OmniType v2 canonical event schema.
+ *
+ * Design rules:
+ *  - Every event is immutable once appended.
+ *  - Probabilistic attribution is always tagged; no silent defaults to "ai".
+ *  - Origin requires positive evidence; unknown is a valid (and honest) value.
+ */
+export {};
+//# sourceMappingURL=events.js.map

package/dist/schema/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/schema/events.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/security/developer-identity.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Per-developer sub-identity enrollment. (Day 11: §10.5)
+ *
+ * Allows multiple developers sharing an OS account to have separate attribution
+ * identities. Each developer generates an Ed25519 keypair; the public key is
+ * registered with the install_id. The dev_key_fingerprint is included in all
+ * events emitted by that developer's session.
+ *
+ * Storage: ~/.omnitype/developer-keys/<fingerprint>.json (private key + metadata)
+ * The private key is additionally protected by OS keychain when available.
+ */
+export interface DeveloperKey {
+    fingerprint: string;
+    public_key_pem: string;
+    private_key_pem: string;
+    developer_name: string;
+    install_id: string;
+    enrolled_at: number;
+}
+export declare function devKeysDir(): string;
+export declare function enrollDeveloper(installId: string, developerName?: string): DeveloperKey;
+export declare function listEnrolledDevelopers(): DeveloperKey[];
+export declare function loadDeveloperKey(fingerprint: string): DeveloperKey | null;
+/** Sign arbitrary bytes with the developer's private key. */
+export declare function signWithDevKey(key: DeveloperKey, data: Buffer): Buffer;
+/** Verify a developer signature against the stored public key. */
+export declare function verifyDevKeySignature(key: DeveloperKey, data: Buffer, signature: Buffer): boolean;
+/**
+ * Get the active developer key for this process.
+ * If OMNITYPE_DEV_KEY env is set, use that fingerprint.
+ * If exactly one key is enrolled, use it automatically.
+ * Otherwise return null (fall back to OS-user identity).
+ */
+export declare function getActiveDeveloperKey(): DeveloperKey | null;
+//# sourceMappingURL=developer-identity.d.ts.map

package/dist/security/developer-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-identity.d.ts","sourceRoot":"","sources":["../../src/security/developer-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAaD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,YAAY,CAuBd;AAED,wBAAgB,sBAAsB,IAAI,YAAY,EAAE,CAYvD;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQzE;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,YAAY,GAAG,IAAI,CAO3D"}

package/dist/security/developer-identity.js

@@ -0,0 +1,105 @@
+/**
+ * Per-developer sub-identity enrollment. (Day 11: §10.5)
+ *
+ * Allows multiple developers sharing an OS account to have separate attribution
+ * identities. Each developer generates an Ed25519 keypair; the public key is
+ * registered with the install_id. The dev_key_fingerprint is included in all
+ * events emitted by that developer's session.
+ *
+ * Storage: ~/.omnitype/developer-keys/<fingerprint>.json (private key + metadata)
+ * The private key is additionally protected by OS keychain when available.
+ */
+import { generateKeyPairSync, createSign, createVerify, createHash, } from 'node:crypto';
+import { mkdirSync, readdirSync, readFileSync, writeFileSync, existsSync, } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const DEV_KEYS_DIR = join(homedir(), '.omnitype', 'developer-keys');
+export function devKeysDir() {
+    return DEV_KEYS_DIR;
+}
+function fingerprintOf(publicKeyPem) {
+    const der = Buffer.from(publicKeyPem
+        .replace(/-----BEGIN PUBLIC KEY-----/, '')
+        .replace(/-----END PUBLIC KEY-----/, '')
+        .replace(/\s+/g, ''), 'base64');
+    return createHash('sha256').update(der).digest('hex').slice(0, 32);
+}
+export function enrollDeveloper(installId, developerName) {
+    mkdirSync(DEV_KEYS_DIR, { recursive: true, mode: 0o700 });
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    const fingerprint = fingerprintOf(publicKey);
+    const name = developerName ?? process.env['USER'] ?? process.env['USERNAME'] ?? 'unknown';
+    const key = {
+        fingerprint,
+        public_key_pem: publicKey,
+        private_key_pem: privateKey,
+        developer_name: name,
+        install_id: installId,
+        enrolled_at: Date.now(),
+    };
+    const keyPath = join(DEV_KEYS_DIR, `${fingerprint}.json`);
+    writeFileSync(keyPath, JSON.stringify(key, null, 2), { mode: 0o600 });
+    return key;
+}
+export function listEnrolledDevelopers() {
+    if (!existsSync(DEV_KEYS_DIR))
+        return [];
+    return readdirSync(DEV_KEYS_DIR)
+        .filter((f) => f.endsWith('.json'))
+        .map((f) => {
+        try {
+            return JSON.parse(readFileSync(join(DEV_KEYS_DIR, f), 'utf-8'));
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((k) => k !== null);
+}
+export function loadDeveloperKey(fingerprint) {
+    const keyPath = join(DEV_KEYS_DIR, `${fingerprint}.json`);
+    if (!existsSync(keyPath))
+        return null;
+    try {
+        return JSON.parse(readFileSync(keyPath, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Sign arbitrary bytes with the developer's private key. */
+export function signWithDevKey(key, data) {
+    const signer = createSign('SHA256');
+    signer.update(data);
+    return signer.sign(key.private_key_pem);
+}
+/** Verify a developer signature against the stored public key. */
+export function verifyDevKeySignature(key, data, signature) {
+    try {
+        const verifier = createVerify('SHA256');
+        verifier.update(data);
+        return verifier.verify(key.public_key_pem, signature);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get the active developer key for this process.
+ * If OMNITYPE_DEV_KEY env is set, use that fingerprint.
+ * If exactly one key is enrolled, use it automatically.
+ * Otherwise return null (fall back to OS-user identity).
+ */
+export function getActiveDeveloperKey() {
+    const envFingerprint = process.env['OMNITYPE_DEV_KEY'];
+    if (envFingerprint)
+        return loadDeveloperKey(envFingerprint);
+    const all = listEnrolledDevelopers();
+    if (all.length === 1)
+        return all[0];
+    return null;
+}
+//# sourceMappingURL=developer-identity.js.map

package/dist/security/developer-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"developer-identity.js","sourceRoot":"","sources":["../../src/security/developer-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAWlC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAEpE,MAAM,UAAU,UAAU;IACxB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CACrB,YAAY;SACT,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EACtB,QAAQ,CACT,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,aAAsB;IAEtB,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;QAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IAE1F,MAAM,GAAG,GAAiB;QACxB,WAAW;QACX,cAAc,EAAE,SAAS;QACzB,eAAe,EAAE,UAAU;QAC3B,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC,YAAY,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAiB,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAiB,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAY;IAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CACnC,GAAiB,EACjB,IAAY,EACZ,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,cAAc;QAAE,OAAO,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/security/keychain.d.ts

@@ -0,0 +1,20 @@
+/**
+ * OS keychain integration for install key storage. (Day 3: §2.1)
+ *
+ * macOS  — Keychain Services via `security` CLI (system-level, no dependency)
+ * Linux  — Secret Service API via `secret-tool` if available; falls back to file
+ * Windows — DPAPI via PowerShell if available; falls back to file
+ *
+ * The fallback path (plain file) preserves backward compatibility for
+ * environments where OS keychain tools are not present. Installations
+ * that are enrolled in an org SHOULD always use the keychain path.
+ */
+export declare function keychainSupported(): boolean;
+export declare function storeKeyInKeychain(key: Buffer): void;
+export declare function loadKeyFromKeychain(): Buffer | null;
+/**
+ * Load install key from keychain first; fall back to plain file.
+ * On first use, attempt to migrate the plain file key to keychain.
+ */
+export declare function loadOrCreateInstallKeySecure(keysDir: string): Buffer;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/security/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../src/security/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAgHH,wBAAgB,iBAAiB,IAAI,OAAO,CAe3C;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAIpD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAKnD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA4BpE"}

package/dist/security/keychain.js

@@ -0,0 +1,167 @@
+/**
+ * OS keychain integration for install key storage. (Day 3: §2.1)
+ *
+ * macOS  — Keychain Services via `security` CLI (system-level, no dependency)
+ * Linux  — Secret Service API via `secret-tool` if available; falls back to file
+ * Windows — DPAPI via PowerShell if available; falls back to file
+ *
+ * The fallback path (plain file) preserves backward compatibility for
+ * environments where OS keychain tools are not present. Installations
+ * that are enrolled in an org SHOULD always use the keychain path.
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+const SERVICE = 'omnitype-journal';
+const ACCOUNT = 'install-key';
+// ─── macOS ────────────────────────────────────────────────────────────────────
+function macosStore(key) {
+    const hex = key.toString('hex');
+    try {
+        execSync(`security add-generic-password -U -s ${SERVICE} -a ${ACCOUNT} -w ${hex}`, { stdio: 'pipe' });
+    }
+    catch {
+        // key may already exist; update it
+        try {
+            execSync(`security delete-generic-password -s ${SERVICE} -a ${ACCOUNT}`, { stdio: 'pipe' });
+            execSync(`security add-generic-password -s ${SERVICE} -a ${ACCOUNT} -w ${hex}`, { stdio: 'pipe' });
+        }
+        catch { /* ignore */ }
+    }
+}
+function macosLoad() {
+    try {
+        const hex = execSync(`security find-generic-password -s ${SERVICE} -a ${ACCOUNT} -w`, { encoding: 'utf-8' }).trim();
+        const buf = Buffer.from(hex, 'hex');
+        return buf.length === 32 ? buf : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Linux (Secret Service via secret-tool) ───────────────────────────────────
+function linuxStore(key) {
+    const hex = key.toString('hex');
+    try {
+        execSync(`echo -n ${hex} | secret-tool store --label="OmniType install key" service ${SERVICE} account ${ACCOUNT}`, { stdio: 'pipe' });
+    }
+    catch { /* secret-tool not available */ }
+}
+function linuxLoad() {
+    try {
+        const hex = execSync(`secret-tool lookup service ${SERVICE} account ${ACCOUNT}`, { encoding: 'utf-8' }).trim();
+        const buf = Buffer.from(hex, 'hex');
+        return buf.length === 32 ? buf : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Windows (DPAPI via PowerShell) ───────────────────────────────────────────
+function windowsStore(key) {
+    const hex = key.toString('hex');
+    const ps = `
+    Add-Type -AssemblyName System.Security;
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes('${hex}');
+    $encrypted = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, 'CurrentUser');
+    $b64 = [Convert]::ToBase64String($encrypted);
+    [System.IO.File]::WriteAllText('${process.env['LOCALAPPDATA']}\\omnitype-install.dpapi', $b64);
+  `;
+    try {
+        execSync(`powershell -NonInteractive -Command "${ps.replace(/\n\s*/g, ' ')}"`, { stdio: 'pipe' });
+    }
+    catch { /* DPAPI not available */ }
+}
+function windowsLoad() {
+    const dpapiPath = `${process.env['LOCALAPPDATA']}\\omnitype-install.dpapi`;
+    if (!existsSync(dpapiPath))
+        return null;
+    try {
+        const b64 = readFileSync(dpapiPath, 'utf-8').trim();
+        const ps = `
+      Add-Type -AssemblyName System.Security;
+      $encrypted = [Convert]::FromBase64String('${b64}');
+      $bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($encrypted, $null, 'CurrentUser');
+      Write-Output ([System.Text.Encoding]::UTF8.GetString($bytes));
+    `;
+        const hex = execSync(`powershell -NonInteractive -Command "${ps.replace(/\n\s*/g, ' ')}"`, { stdio: ['pipe', 'pipe', 'pipe'] }).toString('utf-8').trim();
+        const buf = Buffer.from(hex, 'hex');
+        return buf.length === 32 ? buf : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+export function keychainSupported() {
+    try {
+        if (process.platform === 'darwin') {
+            execSync('which security', { stdio: 'pipe' });
+            return true;
+        }
+        if (process.platform === 'linux') {
+            execSync('which secret-tool', { stdio: 'pipe' });
+            return true;
+        }
+        if (process.platform === 'win32') {
+            return !!process.env['LOCALAPPDATA'];
+        }
+    }
+    catch { /* tool not found */ }
+    return false;
+}
+export function storeKeyInKeychain(key) {
+    if (process.platform === 'darwin')
+        macosStore(key);
+    else if (process.platform === 'linux')
+        linuxStore(key);
+    else if (process.platform === 'win32')
+        windowsStore(key);
+}
+export function loadKeyFromKeychain() {
+    if (process.platform === 'darwin')
+        return macosLoad();
+    if (process.platform === 'linux')
+        return linuxLoad();
+    if (process.platform === 'win32')
+        return windowsLoad();
+    return null;
+}
+/**
+ * Load install key from keychain first; fall back to plain file.
+ * On first use, attempt to migrate the plain file key to keychain.
+ */
+export function loadOrCreateInstallKeySecure(keysDir) {
+    mkdirSync(keysDir, { recursive: true, mode: 0o700 });
+    const keyPath = join(keysDir, 'install.key');
+    // Try keychain first
+    const keychainKey = loadKeyFromKeychain();
+    if (keychainKey)
+        return keychainKey;
+    // Fall back to file
+    if (existsSync(keyPath)) {
+        const key = readFileSync(keyPath);
+        if (key.length !== 32)
+            throw new Error('install.key is corrupt — expected 32 bytes');
+        // Opportunistic migration to keychain
+        if (keychainSupported()) {
+            try {
+                storeKeyInKeychain(key);
+            }
+            catch { /* non-fatal: migration failure still allows file-based operation */ }
+        }
+        return key;
+    }
+    // Create fresh key
+    const key = randomBytes(32);
+    writeFileSync(keyPath, key, { mode: 0o600 });
+    if (keychainSupported()) {
+        try {
+            storeKeyInKeychain(key);
+        }
+        catch { /* non-fatal */ }
+    }
+    return key;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/security/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/security/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,OAAO,GAAG,aAAa,CAAC;AAE9B,iFAAiF;AAEjF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,CACN,uCAAuC,OAAO,OAAO,OAAO,OAAO,GAAG,EAAE,EACxE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;QACnC,IAAI,CAAC;YACH,QAAQ,CACN,uCAAuC,OAAO,OAAO,OAAO,EAAE,EAC9D,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YACF,QAAQ,CACN,oCAAoC,OAAO,OAAO,OAAO,OAAO,GAAG,EAAE,EACrE,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAClB,qCAAqC,OAAO,OAAO,OAAO,KAAK,EAC/D,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,CACN,WAAW,GAAG,+DAA+D,OAAO,YAAY,OAAO,EAAE,EACzG,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAClB,8BAA8B,OAAO,YAAY,OAAO,EAAE,EAC1D,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG;;sDAEyC,GAAG;;;sCAGnB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;GAC9D,CAAC;IACF,IAAI,CAAC;QACH,QAAQ,CAAC,wCAAwC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG;;kDAEmC,GAAG;;;KAGhD,CAAC;QACF,MAAM,GAAG,GAAG,QAAQ,CAClB,wCAAwC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,EACpE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACpC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC;SAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC;SAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,WAAW,EAAE,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAE7C,qBAAqB;IACrB,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,oBAAoB;IACpB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACrF,sCAAsC;QACtC,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mBAAmB;IACnB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/verify/chain-verify.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Chain integrity verifier.
+ *
+ * Streams all segment files in order and checks:
+ *  1. Monotonic seq — no gaps, no duplicates
+ *  2. prev pointer — each event's prev must equal SHA-256(previous event)
+ *  3. HMAC sig — re-derived from install.key must match stored sig
+ *
+ * Usage:
+ *   omnitype-daemon verify [--from-seq N] [--to-seq M] [--report text|json]
+ */
+export interface VerifyOptions {
+    fromSeq?: number;
+    toSeq?: number;
+    report?: 'text' | 'json';
+    keysDir: string;
+    segmentsDir: string;
+}
+export interface VerifyResult {
+    ok: boolean;
+    total_verified: number;
+    first_seq: number;
+    last_seq: number;
+    first_ts: number;
+    last_ts: number;
+    gaps: Array<{
+        after_seq: number;
+        before_seq: number;
+    }>;
+    hmac_failures: Array<{
+        seq: number;
+        reason: string;
+    }>;
+    prev_mismatches: Array<{
+        seq: number;
+        expected: string;
+        got: string;
+    }>;
+    duration_ms: number;
+}
+export declare function verifyChain(opts: VerifyOptions): Promise<VerifyResult>;
+export declare function formatVerifyResult(result: VerifyResult, format?: 'text' | 'json'): string;
+//# sourceMappingURL=chain-verify.d.ts.map

package/dist/verify/chain-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-verify.d.ts","sourceRoot":"","sources":["../../src/verify/chain-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,eAAe,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAiE5E;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,GAAE,MAAM,GAAG,MAAe,GAAG,MAAM,CA+CjG"}