@openauditmodel/cli 0.1.0

package/dist/conformance/src/integrity/verify-chain.js

@@ -0,0 +1,235 @@
+import { digestsEqual } from "./digest.js";
+import { verifyEventIntegrity, readIntegrity } from "./verify-event.js";
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function asSequence(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : undefined;
+}
+/** Orders members deterministically: by sequence, then by label for equal sequences. */
+function compareMembers(left, right) {
+    const leftSequence = left.sequence ?? Number.MAX_SAFE_INTEGER;
+    const rightSequence = right.sequence ?? Number.MAX_SAFE_INTEGER;
+    if (leftSequence !== rightSequence) {
+        return leftSequence - rightSequence;
+    }
+    return left.label.localeCompare(right.label, "en");
+}
+function verifyOneChain(chainId, members, validator) {
+    const findings = [];
+    const notes = [];
+    const checks = [];
+    // Every event's own digest must hold before its links mean anything.
+    let digestsValid = true;
+    for (const member of members) {
+        const result = verifyEventIntegrity(member.event, member.label, validator, {
+            validateSchema: false,
+        });
+        if (!result.verified) {
+            digestsValid = false;
+            findings.push(...result.findings);
+        }
+    }
+    if (digestsValid && members.length > 0) {
+        checks.push({ message: `all ${members.length} event digests valid` });
+    }
+    // A chain is only comparable if every member seals itself the same way: a
+    // `previousHash` produced by a different algorithm can never equal the
+    // predecessor's `hash`.
+    const algorithms = new Set(members.map((member) => member.hashAlgorithm ?? "(none)"));
+    const canonicalizations = new Set(members.map((member) => member.canonicalization ?? "(none)"));
+    if (algorithms.size > 1 || canonicalizations.size > 1) {
+        findings.push({
+            kind: "algorithm-mismatch",
+            message: "events in this chain do not share one hash algorithm and canonicalization",
+            detail: [
+                `hash algorithms: ${[...algorithms].sort().join(", ")}`,
+                `canonicalizations: ${[...canonicalizations].sort().join(", ")}`,
+            ],
+        });
+    }
+    // Ordering is by `sequence`; without it there is no deterministic order.
+    const withoutSequence = members.filter((member) => member.sequence === undefined);
+    for (const member of withoutSequence) {
+        findings.push({
+            kind: "sequence-missing",
+            label: member.label,
+            message: "event declares no sequence, so it cannot be ordered within the chain",
+        });
+    }
+    const ordered = [...members].sort(compareMembers);
+    const bySequence = new Map();
+    for (const member of ordered) {
+        if (member.sequence === undefined) {
+            continue;
+        }
+        const bucket = bySequence.get(member.sequence);
+        if (bucket === undefined) {
+            bySequence.set(member.sequence, [member]);
+        }
+        else {
+            bucket.push(member);
+        }
+    }
+    for (const [sequence, bucket] of [...bySequence.entries()].sort((a, b) => a[0] - b[0])) {
+        if (bucket.length > 1) {
+            findings.push({
+                kind: "duplicate-sequence",
+                message: `sequence ${sequence} is declared by ${bucket.length} events`,
+                detail: bucket.map((member) => member.label),
+            });
+        }
+    }
+    // Links are compared against the predecessor's *declared* hash. Every declared
+    // hash has already been checked against a recalculated digest above, so this
+    // is as strong as comparing against the recalculation while keeping a
+    // modified event and a broken link reported as separate, locatable problems.
+    const linkable = ordered.filter((member) => member.sequence !== undefined);
+    let linksValid = true;
+    for (const [index, member] of linkable.entries()) {
+        if (index === 0) {
+            if (member.previousHash !== undefined) {
+                notes.push({
+                    message: "chain does not start at a genesis event",
+                    detail: [
+                        `first supplied event ${member.label} declares previousHash`,
+                        "the supplied set is a segment; the events before it were not verified",
+                    ],
+                });
+            }
+            continue;
+        }
+        const predecessor = linkable[index - 1];
+        if (predecessor === undefined) {
+            continue;
+        }
+        if (member.previousHash === undefined) {
+            linksValid = false;
+            findings.push({
+                kind: "previous-hash-missing",
+                label: member.label,
+                message: "event declares no previousHash but is not the first event in the chain",
+            });
+            continue;
+        }
+        if (predecessor.hash === undefined || !digestsEqual(member.previousHash, predecessor.hash)) {
+            linksValid = false;
+            findings.push({
+                kind: "broken-link",
+                label: member.label,
+                message: "previousHash does not match the preceding event",
+                detail: [
+                    `preceding event:       ${predecessor.label}`,
+                    `declared previousHash: ${member.previousHash}`,
+                    `preceding event hash:  ${predecessor.hash ?? "(none declared)"}`,
+                ],
+            });
+        }
+    }
+    if (linksValid && linkable.length > 1) {
+        checks.push({ message: `all ${linkable.length - 1} previous-hash links valid` });
+    }
+    if (linkable.length > 0 && linkable[0]?.previousHash === undefined) {
+        checks.push({ message: "chain starts at a genesis event" });
+    }
+    // A gap is not a failure: the core model permits non-contiguous sequences, and
+    // an event removed from the middle would break a link rather than only a gap.
+    // Distinct values are used so that a duplicate is not also reported as a gap.
+    const sequences = [...new Set(linkable.map((member) => member.sequence))].sort((a, b) => a - b);
+    const first = sequences[0];
+    const last = sequences[sequences.length - 1];
+    if (first !== undefined && last !== undefined && last - first + 1 !== sequences.length) {
+        notes.push({
+            message: "sequence numbers are not contiguous",
+            detail: [
+                `observed: ${sequences.join(", ")}`,
+                "the core model permits gaps; a removed event would also break a link",
+            ],
+        });
+    }
+    return {
+        chainId,
+        eventCount: members.length,
+        ...(first === undefined ? {} : { firstSequence: first }),
+        ...(last === undefined ? {} : { lastSequence: last }),
+        intact: findings.length === 0,
+        checks,
+        findings,
+        notes,
+    };
+}
+/**
+ * Verifies every chain present in a set of events.
+ *
+ * Events are grouped by `integrity.chainId`; a set containing several chains is
+ * verified as several independent chains, which is the intended model — a
+ * single global chain is never required.
+ */
+export function verifyChains(inputs, validator) {
+    const unassigned = [];
+    const groups = new Map();
+    for (const input of inputs) {
+        const issues = validator.validateEvent(input.event);
+        if (issues.length > 0) {
+            const shown = issues.slice(0, 3).map((issue) => `${issue.path}  ${issue.message}`);
+            unassigned.push({
+                kind: "schema-invalid",
+                label: input.label,
+                message: "event does not conform to the canonical schema",
+                detail: issues.length > shown.length
+                    ? [...shown, `and ${issues.length - shown.length} further schema issues`]
+                    : shown,
+            });
+            continue;
+        }
+        const integrity = readIntegrity(input.event);
+        if (integrity === undefined) {
+            unassigned.push({
+                kind: "integrity-missing",
+                label: input.label,
+                message: "event carries no integrity object and cannot belong to a chain",
+            });
+            continue;
+        }
+        const chainId = asString(integrity.chainId);
+        if (chainId === undefined) {
+            unassigned.push({
+                kind: "chain-id-missing",
+                label: input.label,
+                message: "event declares no integrity.chainId, so it cannot be assigned to a chain",
+            });
+            continue;
+        }
+        const sequence = asSequence(input.event["sequence"]);
+        const hash = asString(integrity.hash);
+        const previousHash = asString(integrity.previousHash);
+        const hashAlgorithm = asString(integrity.hashAlgorithm);
+        const canonicalization = asString(integrity.canonicalization);
+        const member = {
+            label: input.label,
+            event: input.event,
+            ...(sequence === undefined ? {} : { sequence }),
+            ...(hash === undefined ? {} : { hash }),
+            ...(previousHash === undefined ? {} : { previousHash }),
+            ...(hashAlgorithm === undefined ? {} : { hashAlgorithm }),
+            ...(canonicalization === undefined ? {} : { canonicalization }),
+        };
+        const group = groups.get(chainId);
+        if (group === undefined) {
+            groups.set(chainId, [member]);
+        }
+        else {
+            group.push(member);
+        }
+    }
+    const chains = [...groups.entries()]
+        .sort((left, right) => left[0].localeCompare(right[0], "en"))
+        .map(([chainId, members]) => verifyOneChain(chainId, members, validator));
+    return {
+        chains,
+        unassigned,
+        eventCount: inputs.length,
+        intact: unassigned.length === 0 && chains.every((chain) => chain.intact),
+    };
+}
+//# sourceMappingURL=verify-chain.js.map

package/dist/conformance/src/integrity/verify-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-chain.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-chain.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAmBxE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,IAAiB,EAAE,KAAkB;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAChE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,YAAY,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CACrB,OAAe,EACf,OAA+B,EAC/B,SAAyB;IAEzB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,qEAAqE;IACrE,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;YACzE,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,YAAY,GAAG,KAAK,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC;IACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC,CAAC;IAChG,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,2EAA2E;YACpF,MAAM,EAAE;gBACN,oBAAoB,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACvD,sBAAsB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjE;SACF,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAClF,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,YAAY,QAAQ,mBAAmB,MAAM,CAAC,MAAM,SAAS;gBACtE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC;IAEtB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,yCAAyC;oBAClD,MAAM,EAAE;wBACN,wBAAwB,MAAM,CAAC,KAAK,wBAAwB;wBAC5D,uEAAuE;qBACxE;iBACF,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3F,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,iDAAiD;gBAC1D,MAAM,EAAE;oBACN,0BAA0B,WAAW,CAAC,KAAK,EAAE;oBAC7C,0BAA0B,MAAM,CAAC,YAAY,EAAE;oBAC/C,0BAA0B,WAAW,CAAC,IAAI,IAAI,iBAAiB,EAAE;iBAClE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,4BAA4B,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CACtF,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAChB,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,qCAAqC;YAC9C,MAAM,EAAE;gBACN,aAAa,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnC,sEAAsE;aACvE;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACrD,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM;QACN,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAkC,EAClC,SAAyB;IAEzB,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,gBAAgB;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,gDAAgD;gBACzD,MAAM,EACJ,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;oBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;oBACzE,CAAC,CAAC,KAAK;aACZ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAE,KAAK,CAAC,KAAiC,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAgB;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;YACzD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACjC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,MAAM;QACN,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/conformance/src/integrity/verify-event.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Verification of a single event's own digest.
+ *
+ * This proves that the event has not been altered since its digest was
+ * calculated. It proves nothing about whether the event was ever stored, is
+ * still stored, or belongs to a complete chain.
+ */
+import type { EventValidator } from "../validate-core.js";
+import { type EventVerificationResult } from "./types.js";
+export interface VerifyEventOptions {
+    /** Validate against the canonical schema first. Defaults to true. */
+    readonly validateSchema?: boolean;
+}
+/** The integrity object of an event, once it is known to be an object. */
+interface IntegrityObject {
+    readonly canonicalization?: unknown;
+    readonly hashAlgorithm?: unknown;
+    readonly hash?: unknown;
+    readonly previousHash?: unknown;
+    readonly chainId?: unknown;
+}
+/** Reads the integrity object of an event, or `undefined` when there is none. */
+export declare function readIntegrity(event: unknown): IntegrityObject | undefined;
+/**
+ * Verifies that an event's declared `integrity.hash` matches a digest
+ * recalculated from the event itself.
+ */
+export declare function verifyEventIntegrity(event: unknown, label: string, validator: EventValidator, options?: VerifyEventOptions): EventVerificationResult;
+export {};

package/dist/conformance/src/integrity/verify-event.js

@@ -0,0 +1,140 @@
+import { CanonicalizationError, isSupportedCanonicalization } from "./canonicalize.js";
+import { calculateDigest, digestByteLength, digestsEqual, isHexDigest, isSupportedHashAlgorithm, } from "./digest.js";
+import { SUPPORTED_CANONICALIZATIONS, SUPPORTED_HASH_ALGORITHMS, } from "./types.js";
+function failure(label, finding, checks = []) {
+    return { label, verified: false, checks, findings: [{ ...finding, label }] };
+}
+/** Reads the integrity object of an event, or `undefined` when there is none. */
+export function readIntegrity(event) {
+    if (event === null || typeof event !== "object" || Array.isArray(event)) {
+        return undefined;
+    }
+    const integrity = event["integrity"];
+    if (integrity === null || typeof integrity !== "object" || Array.isArray(integrity)) {
+        return undefined;
+    }
+    return integrity;
+}
+/**
+ * Verifies that an event's declared `integrity.hash` matches a digest
+ * recalculated from the event itself.
+ */
+export function verifyEventIntegrity(event, label, validator, options = {}) {
+    const checks = [];
+    if (options.validateSchema !== false) {
+        const issues = validator.validateEvent(event);
+        if (issues.length > 0) {
+            const shown = issues.slice(0, 3).map((issue) => `${issue.path}  ${issue.message}`);
+            const detail = issues.length > shown.length
+                ? [...shown, `and ${issues.length - shown.length} further schema issues`]
+                : shown;
+            return failure(label, {
+                kind: "schema-invalid",
+                message: "event does not conform to the canonical schema",
+                detail,
+            });
+        }
+        checks.push({ message: "schema valid" });
+    }
+    const integrity = readIntegrity(event);
+    if (integrity === undefined) {
+        return failure(label, {
+            kind: "integrity-missing",
+            message: "event carries no integrity object, so there is nothing to verify",
+            detail: ["integrity is optional in the core model; this command requires it"],
+        }, checks);
+    }
+    const { canonicalization, hashAlgorithm, hash } = integrity;
+    if (typeof hash !== "string") {
+        return failure(label, {
+            kind: "hash-missing",
+            message: "integrity object declares no hash",
+        }, checks);
+    }
+    if (typeof canonicalization !== "string") {
+        return failure(label, {
+            kind: "canonicalization-missing",
+            message: "integrity object declares a hash but no canonicalization",
+        }, checks);
+    }
+    if (!isSupportedCanonicalization(canonicalization)) {
+        return failure(label, {
+            kind: "unsupported-canonicalization",
+            message: `canonicalization "${canonicalization}" is not implemented by this verifier`,
+            detail: [`implemented: ${SUPPORTED_CANONICALIZATIONS.join(", ")}`],
+        }, checks);
+    }
+    checks.push({ message: `canonicalization: ${canonicalization}` });
+    if (typeof hashAlgorithm !== "string") {
+        return failure(label, {
+            kind: "hash-algorithm-missing",
+            message: "integrity object declares a hash but no hash algorithm",
+        }, checks);
+    }
+    if (!isSupportedHashAlgorithm(hashAlgorithm)) {
+        return failure(label, {
+            kind: "unsupported-algorithm",
+            message: `hash algorithm "${hashAlgorithm}" is not implemented by this verifier`,
+            detail: [
+                `implemented: ${SUPPORTED_HASH_ALGORITHMS.join(", ")}`,
+                "the schema keeps this vocabulary open; acceptance by the schema is not support",
+            ],
+        }, checks);
+    }
+    checks.push({ message: `hash algorithm: ${hashAlgorithm}` });
+    if (!isHexDigest(hash)) {
+        return failure(label, {
+            kind: "malformed-hash",
+            message: "declared hash is not lowercase hexadecimal",
+            detail: ["digests are encoded as lowercase hexadecimal; see specification/integrity.md §5"],
+        }, checks);
+    }
+    const expectedLength = digestByteLength(hashAlgorithm) * 2;
+    if (hash.length !== expectedLength) {
+        return failure(label, {
+            kind: "digest-length-mismatch",
+            message: `declared hash is ${hash.length} characters, but ${hashAlgorithm} produces ${expectedLength}`,
+        }, checks);
+    }
+    let calculated;
+    try {
+        calculated = calculateDigest(event, hashAlgorithm);
+    }
+    catch (cause) {
+        const message = cause instanceof CanonicalizationError
+            ? cause.message
+            : `digest could not be calculated: ${cause.message}`;
+        return failure(label, { kind: "canonicalization-failed", message }, checks);
+    }
+    if (!digestsEqual(hash, calculated)) {
+        return {
+            label,
+            verified: false,
+            checks,
+            findings: [
+                {
+                    kind: "hash-mismatch",
+                    label,
+                    message: "integrity hash mismatch",
+                    detail: [`declared:   ${hash}`, `calculated: ${calculated}`],
+                },
+            ],
+            canonicalization,
+            hashAlgorithm,
+            declaredHash: hash,
+            calculatedHash: calculated,
+        };
+    }
+    checks.push({ message: "integrity hash valid" });
+    return {
+        label,
+        verified: true,
+        checks,
+        findings: [],
+        canonicalization,
+        hashAlgorithm,
+        declaredHash: hash,
+        calculatedHash: calculated,
+    };
+}
+//# sourceMappingURL=verify-event.js.map

package/dist/conformance/src/integrity/verify-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-event.js","sourceRoot":"","sources":["../../../../conformance/src/integrity/verify-event.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAI1B,MAAM,YAAY,CAAC;AAgBpB,SAAS,OAAO,CACd,KAAa,EACb,OAAgB,EAChB,SAAiC,EAAE;IAEnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAI,KAAiC,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAA4B,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,KAAa,EACb,SAAyB,EACzB,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAC1B,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;gBACzE,CAAC,CAAC,KAAK,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,EAAE;gBACpB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gDAAgD;gBACzD,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,CAAC,mEAAmE,CAAC;SAC9E,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;IAE5D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mCAAmC;SAC7C,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,0DAA0D;SACpE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,qBAAqB,gBAAgB,uCAAuC;YACrF,MAAM,EAAE,CAAC,gBAAgB,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACnE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAElE,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wDAAwD;SAClE,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mBAAmB,aAAa,uCAAuC;YAChF,MAAM,EAAE;gBACN,gBAAgB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtD,gFAAgF;aACjF;SACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,aAAa,EAAE,EAAE,CAAC,CAAC;IAE7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,4CAA4C;YACrD,MAAM,EAAE,CAAC,iFAAiF,CAAC;SAC5F,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,OAAO,CACZ,KAAK,EACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,oBAAoB,aAAa,aAAa,cAAc,EAAE;SACvG,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,qBAAqB;YACpC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,eAAe;oBACrB,KAAK;oBACL,OAAO,EAAE,yBAAyB;oBAClC,MAAM,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,eAAe,UAAU,EAAE,CAAC;iBAC7D;aACF;YACD,gBAAgB;YAChB,aAAa;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAEjD,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,gBAAgB;QAChB,aAAa;QACb,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,UAAU;KAC3B,CAAC;AACJ,CAAC"}

package/dist/conformance/src/privacy/entropy.d.ts

@@ -0,0 +1,14 @@
+/** Shortest string the heuristic will consider. */
+export declare const MIN_ENTROPY_LENGTH = 24;
+/** Longest string the heuristic will consider; longer values are a size problem. */
+export declare const MAX_ENTROPY_LENGTH = 4096;
+/** Minimum Shannon entropy, in bits per character. */
+export declare const ENTROPY_THRESHOLD = 4;
+/** Minimum number of distinct character classes. */
+export declare const MIN_CHARACTER_CLASSES = 3;
+/** Shannon entropy of a string, in bits per character. */
+export declare function shannonEntropy(value: string): number;
+/** Number of distinct character classes present: lower, upper, digit, symbol. */
+export declare function characterClassCount(value: string): number;
+/** True when a value passes every gate of the entropy heuristic. */
+export declare function isHighEntropyTokenCandidate(value: string): boolean;

package/dist/conformance/src/privacy/entropy.js

@@ -0,0 +1,86 @@
+/**
+ * The entropy heuristic.
+ *
+ * This is the only rule in the linter that guesses. It exists because a secret
+ * can be stored under a harmless name in a format nobody publishes, and it is
+ * deliberately conservative: every gate below is there to keep it quiet, and it
+ * reports at low confidence unless the surrounding property name is itself
+ * suspicious.
+ *
+ * A value must pass **all** of these to be reported:
+ *
+ *   1. It is a string of at least 24 and at most 4096 characters.
+ *   2. It contains no whitespace, so ordinary prose is excluded.
+ *   3. Every character is drawn from the token alphabet `A-Za-z0-9+/=_.-`.
+ *   4. It uses at least 3 of the 4 character classes: lower case, upper case,
+ *      digits, symbols. This excludes single-case words and hexadecimal runs.
+ *   5. Its Shannon entropy is at least 4.0 bits per character.
+ *   6. It is not a recognised safe format (see safe-formats.ts).
+ *
+ * The thresholds are fixed in v0.1 and are documented in
+ * specification/privacy.md §6.
+ */
+import { isKnownSafeFormat } from "./safe-formats.js";
+/** Shortest string the heuristic will consider. */
+export const MIN_ENTROPY_LENGTH = 24;
+/** Longest string the heuristic will consider; longer values are a size problem. */
+export const MAX_ENTROPY_LENGTH = 4096;
+/** Minimum Shannon entropy, in bits per character. */
+export const ENTROPY_THRESHOLD = 4.0;
+/** Minimum number of distinct character classes. */
+export const MIN_CHARACTER_CLASSES = 3;
+/** Characters a token may be built from. */
+const TOKEN_ALPHABET = /^[A-Za-z0-9+/=_.-]+$/;
+/** Shannon entropy of a string, in bits per character. */
+export function shannonEntropy(value) {
+    if (value.length === 0) {
+        return 0;
+    }
+    const counts = new Map();
+    for (const character of value) {
+        counts.set(character, (counts.get(character) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+/** Number of distinct character classes present: lower, upper, digit, symbol. */
+export function characterClassCount(value) {
+    let classes = 0;
+    if (/[a-z]/.test(value)) {
+        classes += 1;
+    }
+    if (/[A-Z]/.test(value)) {
+        classes += 1;
+    }
+    if (/[0-9]/.test(value)) {
+        classes += 1;
+    }
+    if (/[^A-Za-z0-9]/.test(value)) {
+        classes += 1;
+    }
+    return classes;
+}
+/** True when a value passes every gate of the entropy heuristic. */
+export function isHighEntropyTokenCandidate(value) {
+    if (value.length < MIN_ENTROPY_LENGTH || value.length > MAX_ENTROPY_LENGTH) {
+        return false;
+    }
+    if (/\s/.test(value)) {
+        return false;
+    }
+    if (!TOKEN_ALPHABET.test(value)) {
+        return false;
+    }
+    if (characterClassCount(value) < MIN_CHARACTER_CLASSES) {
+        return false;
+    }
+    if (isKnownSafeFormat(value)) {
+        return false;
+    }
+    return shannonEntropy(value) >= ENTROPY_THRESHOLD;
+}
+//# sourceMappingURL=entropy.js.map

package/dist/conformance/src/privacy/entropy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy.js","sourceRoot":"","sources":["../../../../conformance/src/privacy/entropy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,sDAAsD;AACtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,oDAAoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,4CAA4C;AAC5C,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,0DAA0D;AAC1D,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QACzC,OAAO,IAAI,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,qBAAqB,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC;AACpD,CAAC"}

package/dist/conformance/src/privacy/field-names.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Property-name registries.
+ *
+ * Matching is **exact after normalization**, never substring. Substring
+ * matching is what makes name-based linters unusable: `passwordPolicy`,
+ * `secretRotationEnabled`, `tokenCount`, `authorizationDecision` and
+ * `cookieConsent` are all legitimate audit fields that a substring rule would
+ * flag, and a rule that cries wolf is a rule that gets switched off.
+ *
+ * Normalization removes only case and the separators that the same concept is
+ * spelled with in different systems: `clientSecret`, `client_secret`,
+ * `client-secret` and `Client.Secret` are one name.
+ */
+/** Lower-cases a property name and removes `-`, `_`, `.` and spaces. */
+export declare function normalizeFieldName(name: string): string;
+/**
+ * Property names whose value is a credential by definition. A field with one of
+ * these names has no non-sensitive interpretation.
+ */
+export declare const PROHIBITED_CREDENTIAL_FIELD_NAMES: ReadonlySet<string>;
+/**
+ * Property names that carry whole request, response or message bodies. These
+ * are prohibited by specification/privacy.md §2 from being captured
+ * automatically, and a populated field with one of these names is evidence that
+ * they were.
+ */
+export declare const RAW_PAYLOAD_FIELD_NAMES: ReadonlySet<string>;
+/**
+ * Names that are not credentials by themselves but that make a high-entropy
+ * value more suspicious. Used only to raise the confidence of the entropy rule
+ * from `low` to `medium`; never to raise a finding on its own.
+ */
+export declare const SUSPICIOUS_FIELD_NAME_HINTS: ReadonlySet<string>;
+export declare function isProhibitedCredentialFieldName(name: string): boolean;
+export declare function isRawPayloadFieldName(name: string): boolean;
+export declare function isSuspiciousFieldName(name: string): boolean;